Water turbine heavy hammer safety control method based on double redundant power supply and state self-checking

Abstract

This application relates to the field of turbine safety control technology, and discloses a turbine counterweight safety control method based on dual redundant power supply and status self-checking. During normal power supply of the main power supply circuit, under preset safe operating conditions, an automatic self-check of the insulation status of the backup power supply circuit is triggered, and an effective value of the insulation resistance is obtained. When a power failure occurs in the main power supply circuit, the logic control module judges based on the pre-stored effective value of the insulation resistance: if the value is greater than or equal to a safety threshold, the power switching module is controlled to switch to the backup power supply circuit; if it is less than the safety threshold or determined to be a disconnection fault, switching is prohibited and a fault signal is sent. This invention changes passive switching to active prediction, ensuring that switching is only performed when the health status of the backup circuit is confirmed to be good, effectively avoiding secondary accidents caused by switching to a faulty backup line, and significantly improving the safety and reliability of the control system.

Description

Technical Field

[0001] This invention relates to the field of water turbine safety control technology, specifically a water turbine counterweight safety control method based on dual redundant power supply and status self-checking. Background Technology

[0002] To ensure the safe shutdown of hydro-generator units in emergency situations, their key actuators, such as the counterweight closing solenoid valve, are typically equipped with dual redundant power supply circuits: a main power supply circuit and a backup power supply circuit. In conventional control logic, when a power failure is detected in the main power supply circuit, the control system automatically switches the power supply to the backup circuit to maintain the counterweight closing solenoid valve in a state of constant availability.

[0003] However, this switching strategy implies a technical risk that has not been fully considered: the default backup power supply circuit is always intact and usable under long-term hot or cold standby conditions. In actual operating environments, the cables and terminals of the backup power supply circuit may experience deterioration in insulation performance, loose connections, or wire breaks due to factors such as humidity, equipment aging, or mechanical vibration. If the control system still performs the switch when such potential faults already exist, it will not only fail to provide effective power to the counterweight solenoid valve, causing the emergency shutdown function to fail, but may also trigger more serious secondary accidents such as DC feeder power tripping due to grounding or short-circuit faults being switched on, threatening the safe and stable operation of the entire unit. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides a method for safe control of turbine counterweights based on dual redundant power supply and status self-checking. This method solves the problem that existing dual redundant power supply schemes for turbine counterweight safety control directly switch when the main power supply fails, ignoring potential faults such as insulation or broken wires in the backup circuit itself, which could lead to shutdown failure or even secondary electrical accidents.

[0005] To achieve the above objectives, the present invention is implemented through the following technical solution: a water turbine counterweight safety control method based on dual redundant power supply and status self-checking. This method is applied to a control system that includes main and backup power supply circuits, a power switching module, a counterweight closing solenoid valve, an insulation monitoring module, and a logic control module.

[0006] The specific implementation of the method is as follows:

[0007] During normal operation of the control system, the main power supply circuit supplies power to the counterweight closing solenoid valve via the power switching module, while the incoming switch on the backup power supply circuit remains in the physically disconnected position to achieve electrical isolation between the two power supplies.

[0008] The logic control module continuously monitors the power supply status of the main power supply circuit. Specifically, it collects the voltage parameters of the main power supply circuit and determines whether these parameters remain below a preset voltage drop threshold for a preset period of time. When this condition is met, a power failure is determined to have occurred in the main power supply circuit.

[0009] After a power failure occurs in the main power supply circuit, the logic control module does not immediately execute the switching action. Instead, it performs subsequent judgment and switching logic based on a pre-acquired effective value of insulation resistance that characterizes the health status of the backup power supply circuit.

[0010] The process of obtaining the effective value of the insulation resistance is automatically executed before the main power supply circuit is de-energized, provided that specific safety prerequisites are met. This process includes: First, the logic control module determines whether two preconditions are met simultaneously: one is that the unit mode is in the commissioning state, and the other is that a reset signal for the forced speed signal has been received.

[0011] When both of the above conditions are met, the logic control module generates a self-test enable signal, triggering the insulation monitoring module to perform status calculations on the backup power supply circuit.

[0012] The calculation steps of the insulation monitoring module are as follows: a high-resistivity test signal is injected into the backup power supply circuit, and the leakage current in the circuit is collected simultaneously to calculate an equivalent insulation resistance value. To ensure the safety of the self-test process, the current amplitude of the injected high-resistivity test signal is limited to a level lower than the level of the solenoid valve's closing action current to prevent malfunction of the solenoid valve during the test.

[0013] To improve the stability and anti-interference capability of the test results, the logic control module collects equivalent insulation resistance values ​​for multiple consecutive cycles and processes them using a moving average algorithm to obtain a smooth and reliable effective insulation resistance value. This effective value is stored for later retrieval.

[0014] When the main power supply circuit confirms a power failure, the logic control module retrieves the stored effective value of the insulation resistance and compares it with the preset safety threshold: If the effective value of the insulation resistance is greater than or equal to the safety threshold, it indicates that the backup power supply circuit is in good insulation condition and meets the conditions for safe operation. At this time, the logic control module outputs an unlock signal, driving the power switching module to turn on the incoming switch of the backup power supply circuit, establishing physical continuity of the circuit, thereby switching the power supply to the backup power supply circuit and ensuring continuous power supply to the counterweight closing solenoid valve.

[0015] If the effective value of the insulation resistance is less than the safety threshold, it indicates that there is an insulation defect in the backup power supply circuit. In this case, the logic control module will generate a lockout command, actively preventing the power switching module from switching to the backup power supply circuit, thus avoiding electrical accidents caused by connecting to the faulty line. Simultaneously, the logic control module will send the circuit insulation fault signal to the monitoring backend, prompting maintenance personnel to handle the situation.

[0016] Furthermore, this method integrates disconnection diagnosis logic. If the logic control module detects that the effective value of the insulation resistance remains continuously at the upper limit of the measurement range, it determines that a disconnection fault has occurred in the backup power supply circuit. In this case, switching to the backup power supply circuit is also prohibited.

[0017] This invention provides a safety control method for the counterweight of a hydraulic turbine based on dual redundant power supply and status self-checking. It has the following beneficial effects: 1. This invention changes the traditional direct switching mode after a fault. By performing a status self-check on the backup power supply circuit and obtaining its effective value of insulation resistance in advance when the main power supply circuit is normal, the switching decision is based on the known health status of the circuit when the main power supply circuit loses power, effectively avoiding secondary electrical accidents that may be caused by blindly switching on the faulty line.

[0018] 2. This invention not only determines whether there is a circuit insulation degradation fault caused by moisture or aging by comparing the effective value of insulation resistance with the safety threshold, but also identifies a wire break fault caused by loose terminals or broken cables by determining whether the value is continuously at the upper limit of measurement. This dual diagnostic logic covers the most important electrical fault modes of the backup circuit and enhances the accuracy of condition assessment.

[0019] 3. This invention does not interfere with the normal operation of the unit during the self-test process. Firstly, the triggering of the self-test function is bound to specific safety conditions such as the unit commissioning state, ensuring that the test is only performed during non-production operation. Secondly, the high-resistance test signal used for self-test has a current amplitude lower than the action maintenance current of the counterweight closing solenoid valve, ensuring that the test behavior will not cause malfunctions of critical safety components. Attached Figure Description

[0020] Figure 1 This is a schematic diagram of the system architecture of the present invention; Figure 2 This is a flowchart of the method of the present invention; Figure 3 This is a comparison chart of the optimized system fault response generated according to the present invention. Detailed Implementation

[0021] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] Please see the appendix Figure 1 This invention provides a water turbine counterweight safety control system based on dual redundant power supply and status self-checking. The device includes a main power supply circuit and a backup power supply circuit. The power supply end of the main power supply circuit is connected to the governor mechanical cabinet, and the power supply end of the backup power supply circuit is connected to an independent inverter power supply. The main power supply circuit and the backup power supply circuit are used to supply power to the counterweight closing solenoid valve.

[0023] The system also includes a power switching module, an insulation monitoring module, and a logic control module. The input of the power switching module is connected to the main power supply circuit and the backup power supply circuit, respectively. The output of the power switching module is connected to the counterweight closing solenoid valve. The insulation monitoring module is located in the backup power supply circuit, between the independent inverter and the power switching module.

[0024] The logic control module is connected to both the power switching module and the insulation monitoring module. The logic control module receives unit operating condition signals, sends test commands to the insulation monitoring module, receives monitoring results, and sends control commands to the power switching module. The backup power supply circuit runs from the monitoring LCU cabinet to the counterweight closing solenoid valve (4...). 1.5mm 2 The circuit is constructed of cables and is equipped with an incoming switch ZK6.

[0025] See attached document Figure 2 This invention provides a method for safety control of a turbine counterweight based on dual redundant power supply and status self-checking, comprising the following steps: S10, Under normal system operation, the main power supply circuit supplies power to the counterweight closing solenoid valve through the power switching module; S20, the logic control module detects the power supply status of the main power supply circuit, and triggers the self-test precondition judgment when a power failure occurs in the main power supply circuit; S30, the logic control module determines whether the unit's operating mode is in the debugging state and whether it has received the speed forced signal reset signal, i.e., DI[5]=0 signal. When both conditions are met, a self-test enable signal is generated. S40, the insulation monitoring module responds to the self-test enable signal, injects a high-resistivity test signal into the backup power supply circuit, and collects and calculates the insulation resistance value of the backup power supply circuit; S50, the logic control module obtains the insulation resistance value and compares the insulation resistance value with the preset 2000MΩ safety threshold; S60, if the insulation resistance value is greater than or equal to 2000MΩ, the logic control module outputs an unlock signal to control the power switching module to turn on the incoming line switch ZK6 and switch the power supply circuit to the backup power supply circuit. S70 If the insulation resistance value is less than 2000MΩ or the backup power supply circuit is disconnected, the logic control module generates a lockout command to prevent the power switching module from switching to the backup power supply circuit and sends the circuit insulation fault signal to the monitoring background.

[0026] This method clarifies the hardware loop state of the system in its initial operating mode when executing normal power supply logic.

[0027] S101, based on the conventional redundant power supply isolation design principle in industrial control systems, the unit typically relies on the main power supply network for operation when in a stable production state. In this embodiment, under normal system operation, the main power supply circuit provides operating power to the counterweight closing solenoid valve through a power switching module. The power supply terminal of the main power supply circuit is electrically connected to the power bus in the speed controller's mechanical cabinet to obtain the initial electrical energy required for the counterweight device to operate. The power switching module can be implemented using a physical switching circuit composed of contactors, solid-state relays, or mechanical dual-power automatic transfer switches. To ensure the uniqueness of the control path and the reliability of the power supply, during periods of normal voltage in the main power supply circuit, the main path execution contact of the power switching module remains closed, maintaining the physical conduction of the main path. During this stage, whether the counterweight closing solenoid valve can be in a energized hot standby state essentially depends on whether the main power supply circuit voltage is within the normal operating range and whether the main path execution contact inside the power switching module is physically closed; the two form a series conduction dependency in the electrical circuit. For the specific electrical wiring structure of the switching circuit composed of contactors or solid-state relays, those skilled in the art can select and match them according to the on-site voltage level and control requirements. The hardware construction method is a well-known technology in this field and will not be described in detail here.

[0028] S102, in coordination with the continuous power supply of the backbone network, keeps the backup power supply circuit disconnected and in logical standby mode during the normal operation of the main power supply circuit. The backup power supply circuit consists of the power supply cable connecting the independent inverter power supply in the monitoring LCU cabinet, the insulation monitoring module, and the incoming switch ZK6. When the main power supply is normal, the incoming switch ZK6 is in the physically disconnected position, blocking the DC power supply in the monitoring LCU cabinet from outputting power to the counterweight closing solenoid valve. The physical purpose of this normally open isolation measure is to effectively prevent circulating current surges or system-level short-circuit faults that may be caused by the asynchronous parallel operation of two power supplies from different sources, ensuring the absolute electrical independence of the two redundant power supplies. Accompanying the above hardware status, the logic control module does not send switching commands to the power switching module during this period, but only maintains real-time monitoring of the voltage status of the main power supply circuit, preparing to deal with potential power anomalies by continuously comparing the difference between the real-time voltage and the rated voltage.

[0029] S201, based on the established normal power supply mode, to cope with emergencies, the control system needs to have the ability to detect and logically block main power supply anomalies in real time. Based on the fundamental requirement of uninterrupted power supply to key control nodes in the power system, the logic control module continuously monitors the power supply status of the main power supply circuit throughout the entire unit operation cycle. In this embodiment, the identification of power failure or fault is specifically implemented by real-time acquisition of voltage parameters from the output side of the governor's mechanical cabinet through voltage sensing units deployed on the main line. To improve the accuracy of the judgment and effectively avoid system misjudgments caused by transient fluctuations in the plant power grid (such as voltage transient drops caused by the start-up and shutdown of large equipment), the logic control module introduces voltage drop judgment logic with time hysteresis characteristics. The core of this logic is not only to determine whether the real-time voltage amplitude has dropped below the safety standard, but also to determine whether the low voltage state has lasted for a sufficiently long time. The safety threshold for voltage drop is usually determined based on the technical specifications of downstream actuators (such as counterweight closing solenoid valves), and its value must ensure sufficient reliable operating margin, generally set to 80% to 85% of the rated voltage. The delay parameter of the anti-shake filter is adjusted according to the electromagnetic transient characteristics of the power grid on site, and is usually set in the range of hundreds of milliseconds to several seconds to ensure that transient disturbances can be effectively filtered out.

[0030] S202, when the logic control module confirms a continuous power outage fault in the main power supply circuit based on the aforementioned judgment logic, the control flow undergoes a state transition. The logic control module immediately cuts off the drive signal sent to the main circuit maintenance side of the power switching module, terminates the normal power supply logic, and generates a backup power switching request at the internal software level. At this moment, the system does not directly drive the incoming line switch ZK6 to physically close, but instead suspends the switching request. This forces the system to rely on the results of a prior review of the backup line's safety under suitable operating conditions, fundamentally eliminating the risk of secondary accidents caused by blindly switching directly to an unknown backup power supply due to a main power failure.

[0031] The safety review of the aforementioned backup lines is pre-implemented through an independent insulation self-test procedure within the system. To prevent the injection of test voltage into electrical circuits under unsuitable operating conditions, which could cause system disturbances, the control system must execute a pre-test condition judgment logic before performing the self-test review procedure.

[0032] S301, the logic control module collects the unit's mode status in real time to determine whether the unit is in commissioning mode. This step is achieved by reading the unit's mode status manually issued by maintenance personnel on the monitoring system backend or human-machine interface. The self-test program is forcibly bound to the commissioning status to ensure that related electrical testing operations are only performed after the unit has been confirmed to be out of production operation, disconnected from the main grid, and under controlled conditions.

[0033] S302, based on confirming the unit mode status, the logic control module synchronously monitors a specific digital input channel to determine whether the forced speed signal reset condition is met. In this embodiment, this status is characterized by monitoring the level change of a specific digital input port DI[5] of the LCU cabinet. This condition serves as another logical interlocking condition for self-test access, and its technical purpose is to confirm that the forced control logic related to the unit speed has been released and the unit is in a stable state waiting for instructions. Using this condition status as a prerequisite for the self-test procedure can effectively prevent electromagnetic interference or false triggering of the main control system during self-testing when the unit speed is forcibly controlled or in a dynamic process such as abnormal coasting.

[0034] The system determines that the current operating condition is suitable for electrical self-testing only when both of the above logical conditions are simultaneously satisfied. To precisely define the multi-condition joint authorization mechanism, the logical relationship of this dual-condition verification can be expressed by the following formula: ; In the formula, This indicates a self-test enable signal. A value of 1 indicates that the self-test is allowed to start, and a value of 0 indicates that the self-test is disabled. This indicates the unit's mode status. When the unit is in commissioning mode... The value is 1 if it is set to 1, otherwise the value is 0. This indicates the condition for the forced speed signal to return to normal. When the input level of input port DI[5] is detected to be 0, The value is 1 if it is set to 1, otherwise the value is 0. Represents the logical AND operation.

[0035] The physical meaning of this logical operation lies in the joint verification of the macroscopic unit mode state and the specific underlying control signal state. If and only if When the calculation result is 1, the logic control module internally generates a self-test enable signal. This self-test enable signal serves as the sole control command to activate the subsequent insulation monitoring module, thereby triggering the dynamic insulation parameter acquisition process. By introducing the above-mentioned condition-aware state self-test triggering mechanism, the system transforms the offline insulation test, which originally required manual intervention, into a controlled automated procedure.

[0036] Based on the self-test enable signal generated by the aforementioned dual condition verification, the system then enters the physical and electrical characteristic evaluation stage of the backup power supply circuit to confirm whether the backup path has the hardware conditions to safely carry the operating current.

[0037] S401, the insulation monitoring module is activated upon receiving a self-test enable signal and connects to the backup power supply circuit to perform physical testing. As a core component of this invention, this newly added insulation monitoring module is the basic hardware for realizing the self-test function. This insulation monitoring module can be set up as an independent monitoring unit or highly integrated into the newly added PULS switching power supply, saving installation space within the cabinet. In this embodiment, the module connects its test terminals in parallel to the backup power supply circuit through the closure of an internal relay. This circuit specifically consists of four relays connecting the monitoring LCU cabinet and the counterweight closing solenoid valve. 1.5mm 2 Cable configuration. Subsequently, the insulation monitoring module injects a high-resistance test signal into the cable line. This test signal injection is achieved through a known DC voltage source attached within the insulation monitoring module, applying a test voltage of a specific amplitude between the cable's conductive cores and the system grounding grid. The technical purpose of using a high-resistance power supply for testing is to effectively limit the current amplitude injected into the test circuit, preventing the test current from generating a sufficient electromagnetic force to trigger the solenoid valve coil, thereby avoiding mechanical malfunction of the counterweight device during self-testing.

[0038] Meanwhile, this micro-current testing method also ensures that even if the line has insulation defects, the test process itself will not generate a destructive short-circuit current, thereby avoiding secondary faults such as DC system grounding or power tripping caused by the self-test, and ensuring the safety of the test itself.

[0039] S402, based on the applied test voltage, the insulation monitoring module synchronously acquires the electrical parameters fed back in the circuit and calculates the equivalent insulation resistance value accordingly. The insulation monitoring module calculates the ratio of the internally injected test voltage to the real-time acquired leakage current, and subtracts the inherent internal current-limiting resistor value of the test circuit from the underlying firmware to obtain the current equivalent insulation resistance value of the backup power supply circuit. To ensure the integrity of the system's underlying algorithm logic and the stability of the microprocessor operation, when the system preferentially determines that the real-time leakage current is less than the preset micro-current resolution threshold, the system will abort the ratio calculation instruction and directly assign the equivalent insulation resistance value to the upper limit of the measurement range supported by the insulation monitoring module's hardware (e.g., 9999MΩ) to prevent the microprocessor from causing division by zero overflow during floating-point operations.

[0040] Based on the acquisition results of the aforementioned dynamic insulation parameters, the system needs to perform quantitative evaluation and logical judgment on the physical state of the backup power supply circuit.

[0041] The S501 logic control module acquires the equivalent insulation resistance value output by the insulation monitoring module via the internal communication bus. The system collects equivalent insulation resistance values ​​for multiple consecutive communication cycles within a set time window, and uses a moving average algorithm to eliminate abrupt noise caused by high-frequency interference, thereby extracting a smooth and stable effective insulation resistance value that reflects the true impedance characteristics.

[0042] S502, the logic control module compares the effective value of the insulation resistance with a preset 2000MΩ insulation safety threshold. When the effective value of the insulation resistance is greater than or equal to the preset insulation safety threshold, the logic control module sets the health status evaluation flag of the backup power supply circuit in its internal storage area to indicate that the circuit's insulation status is qualified; conversely, when the effective value of the insulation resistance is less than the insulation safety threshold, the flag is reset to indicate that the circuit has an insulation defect. This extremely weak leakage current is far below the operating current of the coil inside the counterweight closing solenoid valve or the charging threshold of the distributed capacitance of the control node, thus ensuring from the underlying physical level that when the backup power is subsequently connected, it will not induce a DC system ground short circuit alarm or cause malfunction of the mechanical actuator.

[0043] Furthermore, to effectively distinguish between situations where the insulation condition is excellent and situations where the line is physically disconnected, both of which can lead to extremely high measured resistance values, the logic control module can further integrate disconnection diagnosis logic. This logic considers a state where the insulation resistance value is continuously at the upper limit of the measurement range (e.g., 9999MΩ) as a potential disconnection characteristic. When the system recognizes this characteristic, it will also reset the health status assessment flag. In this way, the present invention can not only detect grounding faults caused by insulation aging, moisture, etc., but also identify open circuit faults caused by loose terminals, broken cables, etc., achieving a comprehensive assessment of the health status of the backup circuit.

[0044] Based on the health status data established and stored in the pre-quantitative assessment phase, when a main power supply failure is encountered during actual operation, the control system will activate the linkage authorization mechanism between the status self-test results and power switching, and transform the data conclusions into actual physical power supply connection actions.

[0045] S601, in this embodiment, when the logic control module reads that the health status assessment flag of the backup power supply circuit in the internal storage area is set, the system determines that the backup path has met the electrical commissioning conditions. Based on this determination, the logic control module actively releases the backup power supply switching interception logic that was previously suspended during the backbone network power failure response phase.

[0046] After the S602 is unblocked, to ensure the rigor of the underlying execution logic and prevent unexpected closing due to a single signal mis-triggering, the logic control module internally uses a joint authorization method to generate the closing command. The system logically concatenates the pending backup power supply switching request signal with the internally read health status assessment flag. Only under the dual conditions that the system recognizes the main power supply abnormality and generates a switching request internally, and the backup circuit's health status assessment flag is set, can the logic control module output an unlock drive signal to the external actuator through its digital output channel. This drive signal is specifically manifested in the underlying hardware as an output of a 24VDC or 220VAC control level with a specific pulse width.

[0047] S603, based on the aforementioned unlocking drive signal, the physical power supply circuit is immediately activated. The electromagnetic operating mechanism of the incoming line switch ZK6 actuates, causing the main contacts to close. With the physical connection of the main contacts, the independent inverter DC power supply (preferably DC24V+) located in the monitoring LCU cabinet stably supplies power to the counterweight closing solenoid valve via a previously insulated backup power cable. At this time, the coil inside the counterweight closing solenoid valve is energized and overcomes the mechanical resistance of the return spring, maintaining the hydraulic reversing valve core in the pressure-holding position. The turbine counterweight device remains in hot standby mode, thus preventing accidental shutdowns caused by brief main power supply failures and ensuring the core safety of the unit.

[0048] Conversely, based on the abnormal operating condition where the insulation of the backup power supply circuit fails to meet the standard, when a main power supply failure occurs, the control system will execute logic interlocking and safety guidance procedures to prevent the electrical short circuit fault from expanding.

[0049] S701: When the logic control module reads that the health status assessment flag in the internal storage area is in a reset state, the system determines that the backup power supply circuit has hidden defects such as insulation aging, wire core grounding, or physical breakage. In this condition, the system assesses that forcibly performing the backup power supply activation operation would pose a physical risk of inducing a short circuit in the DC bus or causing the counterweight to fail to operate. The logic control module continues to maintain the blocking and interception logic for the incoming switch ZK6 in the underlying program, actively blocking the backup power supply switching request caused by the main power supply failure, and prohibiting the issuance of closing drive levels to the corresponding digital output channel, thus achieving physical isolation between the faulty node and the DC bus.

[0050] In the S702, during the electrical isolation process, the control system converts the underlying impedance anomaly into alarm data for reporting. The logic control module internally generates a fault characteristic word representing the insulation anomaly and encapsulates it in a communication message, sending it to the host computer monitoring system via the field communication bus. This triggers the alarm module to activate, allowing maintenance personnel to intervene and investigate. Simultaneously, the logic control module forcibly locks the control logic related to backup power switching, ensuring that any switching commands from the system or operator are rejected until the fault is manually confirmed and reset, until maintenance personnel investigate on-site and release the logic lockout.

[0051] In S703, under the condition of main power failure and backup power being logically blocked due to insulation defects, the physical execution layer enters a power failure safety guidance state. Since the power supply path is completely cut off, the coil inside the counterweight closing solenoid valve cannot obtain excitation current. When the coil current decays below the engagement holding threshold, the electromagnet's attraction disappears, and its internal reset spring actuates to push the reversing valve core to release the control oil pressure maintaining the counterweight's lifting. Due to the loss of hydraulic support, the turbine counterweight device loses mechanical balance and falls using the gravitational potential energy of the counterweight, directly driving the turbine guide vane control mechanism to perform an emergency shutdown action. This fundamentally prevents the risk of unit malfunction due to complete power failure from the underlying physical mechanism.

[0052] Specific application examples: This section uses the control system modification of Unit A (rated capacity 700MW) of a large-scale cascade hydropower station as an example to illustrate the application of the present invention.

[0053] System background and settings: The original power supply system for this unit consisted of only a single main power supply circuit, directly powered by the power bus inside the governor's mechanical cabinet, posing a single point of failure risk. To improve the safety and reliability of the unit's operation, it was decided to upgrade and modify it using the control system described in this invention.

[0054] Logic control module: The core controller is a Siemens S7-1500 series PLC, which integrates high-speed processing, rich communication interfaces and powerful logic programming capabilities to execute all the monitoring, judgment and control logic described in this invention.

[0055] Power switching module: ABB's OTM series electric transfer switch (ATS) is selected as the physical switching actuator between the incoming switch ZK6 and the main and backup power supplies.

[0056] Insulation monitoring module: It adopts PULS switching power supply with built-in insulation monitoring function. As part of the independent inverter power supply, the power supply directly provides DC24V power to the backup power supply circuit and can send the real-time insulation resistance value of the backup circuit to the PLC through its communication interface.

[0057] Main power supply circuit: sourced from the original AC220V control power supply inside the speed controller's mechanical cabinet.

[0058] Backup power supply circuit: drawn from the newly added PULS switching power supply, through a brand new 4 1.5mm 2 The armored cable is laid to the junction box of the counterweight-closing solenoid valve.

[0059] Implementation process: Phase 1: Normal Operation and Planned Self-Inspection During normal grid-connected power generation, the main power supply circuit supplies power to the counterweight closing solenoid valve through the power switching module, and the solenoid valve is in a energized hot standby state. The PLC continuously monitors the main circuit voltage, and everything is normal.

[0060] During a planned shutdown and maintenance window, the maintenance personnel set the operating mode of Unit A to debug mode in the host computer monitoring system. Subsequently, after completing the relevant mechanical and hydraulic system checks, all forced speed control signals were reset, at which point the PLC's digital input port DI[5] received a low-level signal (DI[5]=0).

[0061] The internal logic of the PLC is based on the formula A judgment is made, and at this time the unit is in the commissioning state. =1) and speed forced signal reset ( =1) If both conditions are met simultaneously, the self-test enable signal ( The value is set to 1. The PLC then sends a self-test command to the PULS power supply via the PROFINET bus.

[0062] The insulation monitoring module within the PULS power supply is activated, injecting a high-resistance test signal into the backup power cable. After several seconds of measurement and calculation, the module measures the insulation resistance of the circuit to be 9560MΩ. This data is read by the PLC. The PLC's internal program compares this value with a preset threshold of 2000MΩ. Since 9560MΩ is much greater than 2000MΩ, the PLC sets the backup circuit's health status assessment flag to 1 in its internal data block, indicating that the backup circuit is in good condition and ready for immediate operation. After the self-test process is complete, the maintenance work continues.

[0063] Phase Two: Main Power Failure and Automatic Switching Several weeks later, due to a voltage fluctuation in the plant's power grid, the power supply branch supplying power to the speed controller's mechanical cabinet experienced a momentary power outage. The PLC's voltage sensing unit detected that the main power supply circuit voltage had dropped to below 50% of its rated value, and this state persisted for more than the preset 500ms delay.

[0064] The PLC determines that a continuous power outage has occurred in the main power supply circuit and immediately generates a backup power supply switching request. At the same time, the PLC reads the backup circuit health status assessment flag stored internally and confirms that its value is 1 (healthy).

[0065] Once both conditions are met, the PLC's digital output channel immediately outputs a DC24V unlock drive signal to the power switching module. The ZK6 electromagnetic operating mechanism of the power switching module's incoming switch activates, and the backup power supply circuit is quickly connected. The entire switching process is completed within 1 second.

[0066] The counterweight shut-off solenoid valve was seamlessly powered by a DC 24V backup power supply from the PULS power supply in the monitoring LCU cabinet, ensuring continuous energization of the coil and maintaining the counterweight in a hot standby state. Unit operation was unaffected, avoiding an unplanned shutdown due to a main power failure. The monitoring backend only displayed an alarm indicating a main power failure in the counterweight, prompting maintenance personnel to pay attention.

[0067] Phase 3: Safety interlocking for simulated backup circuit faults In another verification test, maintenance personnel artificially connected a 10MΩ resistor in parallel to the terminals of the backup power cable to ground, in order to simulate a scenario of severe insulation aging.

[0068] During the next shutdown and debugging window, the system performed a self-test again according to the procedure. This time, the insulation monitoring module measured an insulation resistance value of 9.8MΩ. After reading this value, the PLC set the health status assessment flag of the backup circuit to 0 because it was much less than 2000MΩ, and immediately generated an alarm for insulation defects in the backup circuit in the monitoring background, prompting the maintenance personnel to handle it.

[0069] Subsequently, the testers simulated a main power failure. After detecting the main power failure, the PLC also generated a switching request, but when verifying the health status of the backup circuit, it read a flag bit of 0 (fault). Therefore, the PLC executed the interlocking logic and refused to send a switching command to the power switching module.

[0070] Since neither the main nor backup power supply could provide power, the solenoid valve for closing the counterweight lost power and reset under the action of the spring force, causing the counterweight to fall safely under the action of gravity, and the unit executed the normal emergency shutdown procedure.

[0071] This embodiment fully demonstrates how the system of the present invention can achieve intelligent pre-detection of backup power supply, achieve safe and seamless switching when the main power supply fails, and achieve reliable logic interlocking and safety-guided shutdown when the backup power supply itself has defects, thus comprehensively improving the safety margin of the system.

[0072] Experimental verification and effect comparison: To quantify the actual effect of the present invention, a hardware simulation platform identical to the above embodiments was built and compared with a traditional dual-power redundant system (which only has voltage detection and automatic switching functions and no state self-test) was conducted.

[0073] Experimental setup: Operating Condition 1: Main power supply is normal, and backup power supply circuit is normal.

[0074] Operating Condition 2: Simulates a main power supply failure, while the backup power supply circuit remains normal.

[0075] Operating Condition 3 (Critical): Simulates a main power supply failure, while the backup power supply circuit has a preset grounding fault (insulation resistance set to 10MΩ).

[0076] Experimental Results and Comparative Analysis: Under both operating conditions 1 and 2, the traditional system and the system of this invention performed the same, both maintaining normal power supply or achieving rapid switching, thus ensuring continuous power supply to the counterweight solenoid valve.

[0077] The core difference is reflected in the experimental results of operating condition three.

[0078] Performance of traditional redundant systems: When the main power supply fails, the controller in a traditional system only detects the voltage loss and immediately activates the transfer switch to switch to the backup power supply. Due to a ground fault in the backup power supply circuit, this activation instantly creates a short circuit to ground between the positive (or negative) terminal of the DC system. In the experiment, it was observed that the backup power supply (PULS power supply) immediately triggered short-circuit protection, causing the output voltage to collapse. This resulted in the solenoid valve remaining de-energized, leading to a unit shutdown. This switching action triggered a severe ground fault in the DC system. In a real power plant, this could trigger a plant-wide DC ground fault alarm and even cause cascading trips of protection devices, threatening the safety of other critical control systems.

[0079] Performance of the system of this invention: In this invention's system, since a status self-check had already been performed during the previous debugging phase, the PLC had already recorded the insulation defect status of the backup circuit (health status flag bit is 0). When the simulated main power supply fails, the PLC anticipates the unavailability of the backup circuit during the decision-making phase. Therefore, the system decisively executes a logic interlock, prohibiting switching to the backup circuit. The system then sends a combined alarm message for both main power supply failure and backup power supply switching interlock (due to insulation failure). Ultimately, the counterweight solenoid valve safely loses power due to the lack of available power, and the unit performs an emergency shutdown according to the preset power failure safety principle.

[0080] To illustrate this core difference more clearly, see the attached document. Figure 3 The response processes of the two systems under operating condition 3 were compared in detail using time sequence diagrams.

[0081] Before the fault occurs (0-4 seconds): As shown in the figure, during the time period before the fault occurs, the two curves coincide with the main power supply status, indicating that whether it is the conventional system or the system of this invention, the counterweight of Unit A is normally powered by the main power supply and is in a stable hot standby state.

[0082] When the fault occurs (4 seconds): The vertical dashed line in the figure precisely marks the occurrence of the main power supply failure event, which corresponds to the simulated power outage fault of the main power supply circuit of Unit A in the experiment.

[0083] Response of a traditional system: For a traditional redundant system (shown by the solid line in the figure), its state curve drops instantly to a secondary fault state after the main power supply fails. This clearly verifies the observation in the experiment: the system blindly switched without checking the health status of the backup circuit beforehand, directly connecting the preset ground fault to the DC system, leading to a more serious short circuit problem and threatening the electrical safety of Unit A and even the entire plant.

[0084] The response of the system of this invention: In contrast, the response path of the system of this invention (shown by the dashed line in the figure) is completely different. Its state curve first enters a brief power loss state after power failure, representing the process of the PLC detecting a voltage drop and performing logical judgment. Subsequently, because the PLC identified an insulation defect in the backup circuit based on the previous self-test results (health status flag bit is 0), the system decisively executed a logic lockout, rejecting the switching command. Finally, the system smoothly transitioned to the preset safe shutdown state. This demonstrates how the present invention utilizes pre-inspection information to make correct decisions at critical moments, guiding Unit A safely into the predetermined shutdown procedure, thereby avoiding secondary accidents.

[0085] in conclusion: Experimental results and appendix Figure 3 The analysis clearly shows that the control system and method provided by this invention have fundamental advantages compared to traditional redundant systems. By introducing a condition-aware self-checking mechanism, the health assessment of the backup circuit is transformed from reactive remediation (i.e., only known after a switchover failure) to proactive prediction.

[0086] This invention successfully avoids secondary accidents (such as DC system short circuits) caused by blindly switching to a faulty backup power source, ensuring that system decisions are based on known and reliable loop status information under all circumstances. This not only prevents unintended shutdowns but, more importantly, prevents the escalation of faults, significantly improving the ultimate safety and operational reliability of the turbine unit and the entire power plant's control power system. Through this invention, the detection time of latent faults is advanced from after an accident to the planned maintenance window, significantly improving the overall availability of the system.

Claims

1. A safety control method for a turbine counterweight based on dual redundant power supply and status self-checking, applied to a control system, wherein the control system includes a main power supply circuit, a backup power supply circuit, a power switching module, a counterweight closing solenoid valve, an insulation monitoring module, and a logic control module, wherein the backup power supply circuit is equipped with an incoming line switch, characterized in that... Includes the following steps: The main power supply circuit is controlled to supply power to the solenoid valve closing the counterweight through the power switching module; The logic control module detects the power supply status of the main power supply circuit; When a power failure occurs in the main power supply circuit, the logic control module performs subsequent judgment and switching logic based on an effective value of insulation resistance obtained from the backup power supply circuit. The subsequent judgment and switching logic includes: The effective value of the insulation resistance is compared with the preset 2000MΩ safety threshold. If the effective value of the insulation resistance is greater than or equal to the 2000MΩ safety threshold, the logic control module controls the power switching module to switch the power supply circuit to the backup power supply circuit. If the effective value of the insulation resistance is less than the 2000MΩ safety threshold, the logic control module prohibits the power switching module from switching to the backup power supply circuit.

2. The method according to claim 1, characterized in that, The step of obtaining the effective value of the insulation resistance is performed before a power failure occurs in the main power supply circuit, and the step includes: The logic control module determines whether the unit mode is in the debugging state and whether it has received a speed forced signal reset signal; When both conditions are met simultaneously, the logic control module generates a self-test enable signal and triggers the insulation monitoring module to perform calculations through the self-test enable signal.

3. The method according to claim 2, characterized in that, The steps for the insulation monitoring module to perform calculations include: Inject a high-impedance test signal into the backup power supply circuit; The leakage current is collected and an equivalent insulation resistance value is calculated.

4. The method according to claim 3, characterized in that, The current amplitude of the high-resistivity test signal is lower than the operating current of the hammer-closed solenoid valve.

5. The method according to claim 1, characterized in that, The steps for the logic control module to detect the power supply status of the main power supply circuit include: Collect the voltage parameters of the main power supply circuit; Determine whether the voltage parameter remains below a preset voltage drop threshold for a preset duration.

6. The method according to claim 1, characterized in that, The method further includes a disconnection diagnosis logic executed by the logic control module, which determines that the insulation resistance effective value is continuously at the upper limit of the measurement range as a disconnection fault in the backup power supply circuit, and prohibits the power switching module from switching to the backup power supply circuit.

7. The method according to claim 1, characterized in that, The steps by which the logic control module controls the power switching module to switch the power supply circuit to the backup power supply circuit include: The logic control module outputs an unlock signal, which drives the power switching module to turn on the incoming line switch and establishes physical connection of the backup power supply circuit.

8. The method according to claim 1, characterized in that, The step of the logic control module preventing the power switching module from switching to the backup power supply circuit includes: The logic control module generates a lockout command and sends the circuit insulation fault signal to the monitoring backend.

9. The method according to claim 1, characterized in that, The effective value of the insulation resistance is obtained in the following manner: Collect equivalent insulation resistance values ​​for multiple consecutive cycles; The effective value of insulation resistance is obtained by using the moving average algorithm.

10. The method according to claim 1, characterized in that, While the main power supply circuit supplies power to the solenoid valve that closes the counterweight, the incoming switch on the backup power supply circuit is in the physically disconnected position.

Images