A power plant microcomputer protection hardware-in-the-loop test platform and test method

Abstract

The application discloses a power plant microcomputer protection hardware-in-the-loop test platform and a test method, and relates to the technical field of microcomputer protection hardware test.The first host computer in the system builds an electromagnetic transient model of a primary system of a power plant and a circuit breaker failure protection control logic model and compiles them; the real-time simulator uses the compiled electromagnetic transient model to perform electromagnetic transient real-time calculation; the microcomputer protection hardware is used to execute protection criteria according to analog quantity signals, and outputs a trip instruction when the protection action condition is met; the real-time simulator is further used to: according to the trip instruction, using the compiled circuit breaker failure protection control logic model, judge whether the circuit breaker of the interval refuses to act, if yes, output a backup trip instruction; the first simulated circuit breaker is used to: receive and execute the backup trip instruction, and feed back the opening and closing state signal of the first simulated circuit breaker to the real-time simulator.The application reduces the hardware investment and the construction complexity, and meets the demand of the self-innovation and speed-up of the test tool chain.

Description

Technical Field

[0001] This invention relates to the field of microcomputer protection hardware testing technology, and in particular to a power plant microcomputer protection hardware-in-the-loop testing platform and testing method. Background Technology

[0002] The safe and stable operation of nuclear power plants directly determines the reliability of the power system. Relay protection, as the last line of defense against various electrical faults in nuclear power plants, plays a crucial role in the safety of both the unit and the power grid. However, the primary system of nuclear power plants is large-scale, with high voltage levels and complex protection device configurations. Traditional offline simulation methods can only perform static analysis and are insufficient to reflect the dynamic characteristics of electromagnetic transient processes. On-site testing is also constrained by equipment safety and testing costs, making it almost impossible to conduct full-process verification in a real power plant environment. Therefore, there is an urgent need to construct a nuclear power plant testing platform that combines flexibility, safety, and autonomous controllability to meet the actual needs of testing and verification.

[0003] Existing research has shown that real-time simulation and hardware-in-the-loop platforms can reproduce complex electromagnetic transients in microsecond-level steps. By forming a closed loop through equivalent current transformer secondary injection, voltage transformer secondary injection, and device input / output, the selectivity, speed, and timing of protection criteria can be consistently verified across multiple scenarios. Experiments on typical coupling problems have also demonstrated good explanatory power. Regarding the mutual influence between series compensation devices and line distance protection, researchers completed a series of hardware-in-the-loop verifications of compensation-distance protection coupling scenarios on a real-time digital simulator platform, confirming the constraint effect of suppression measures on the misjudgment boundary. Existing literature has presented semi-physical and full-physical verification processes based on the collaboration of field-programmable gate arrays and central processing units (CPUs) and the dSPACE platform in wind power systems and permanent magnet synchronous generator control, respectively, providing a reusable paradigm for protection in power electronics scenarios. Furthermore, regarding the real-time verification of relay protection devices, the latest work presents a hardware-in-the-loop (HIL) process for co-simulating electromagnetic and electromechanical transients using a real-time digital simulator (RTD) and OPAL-RT. The equivalence and portability of the method are demonstrated through physical testing of the relay protection device. Simultaneously, the closed-loop testing of the RTD for engineering relays systematically summarizes the key points of modeling, interface, and use case design, providing a reusable paradigm for device-level HIL evaluation. These results collectively demonstrate that, in the context of strong power electronic coupling and multi-source grid connection, a hardware-in-the-loop testing link based on real-time simulation can effectively improve the engineering verification efficiency and cross-platform applicability of relay protection algorithms and devices.

[0004] However, from the perspective of engineering investment and testing boundaries, traditional "full-device, full-scenario" semi-physical and power amplifier solutions often require high-power amplifiers, complex coupling interfaces, and a large number of tested objects, leading to increased costs and construction complexity. This also hinders rapid reproduction and multiple regression tests in high-safety-level scenarios such as nuclear power plants. Meanwhile, circuit breaker failure protection, as the last line of defense in near-backup protection within the station, is affected by the dynamic processes of primary equipment and must establish reliable start-up and output coordination relationships with generators, transformers, busbars, short leads, and line protection. Engineering specifications also clearly require failure protection for voltage levels of 220kV and above, and impose blocking and logic requirements on wiring methods such as double busbars. This highlights the necessity of cross-disciplinary and cross-device coordination verification of circuit breaker failure protection. Simply relying on offline simulation is insufficient to achieve consistency and interactivity of the on-site action chain at millisecond timescales, failing to meet the requirements of microprocessor-based protection development for real-time performance, replayability, and measurability, and also failing to provide quantifiable evidence for the coordination boundaries between circuit breaker failure protection and station-wide protection. Furthermore, the industry's demand for self-sufficiency in testing tools, despite the fact that key main equipment has been largely developed, further indicates that existing testing methods still have shortcomings in terms of real-time performance, repeatability, and cost-effectiveness. Summary of the Invention

[0005] This invention aims to address the shortcomings of existing technologies, specifically providing a hardware-in-the-loop test platform and test method for power plant microcomputer protection, as detailed below: 1) In a first aspect, the present invention provides a hardware-in-the-loop test platform for power plant microcomputer protection, the specific technical solution of which is as follows: The system includes: a first host computer, a real-time simulator, a first simulated circuit breaker, and the power plant's microcomputer protection hardware. The first simulated circuit breaker corresponds to the adjacent line circuit breaker or bus-side circuit breaker in the power plant's primary system. The first host computer is used to: build and compile the electromagnetic transient model and circuit breaker failure protection control logic model of the power plant's primary system, and then send them to the real-time simulator. The real-time simulator is used to: perform real-time electromagnetic transient calculations using the compiled electromagnetic transient model, obtain analog signals, and output them to the microcomputer protection hardware. The microcomputer protection hardware is used to: execute protection criteria based on the analog signals, and when the protection action conditions are met, output a tripping command to the real-time simulator to control the tripping of the circuit breaker in this bay. The real-time simulator is also used to: determine whether the circuit breaker in this bay fails to operate based on the tripping command and the compiled circuit breaker failure protection control logic model, and output a backup tripping command if the determination result is yes. The first simulated circuit breaker is used to: receive and execute the backup tripping command and feed back the opening and closing status signal of the first simulated circuit breaker to the real-time simulator.

[0006] The beneficial effects of the power plant microcomputer protection hardware-in-the-loop test platform provided by this invention are as follows: The electromagnetic transient model of the power plant's primary system and the circuit breaker failure protection control logic model, built by the first host computer, are compiled and sent to the real-time simulator for execution. The real-time simulator can perform real-time electromagnetic transient calculations and output analog signals to the microcomputer protection hardware. This overcomes the shortcomings of traditional offline simulation methods, which can only perform static analysis and cannot reflect the dynamic process of electromagnetic transients, thus meeting the real-time requirements of microcomputer protection R&D. Simultaneously, the microcomputer protection hardware executes protection criteria based on the analog signals and outputs trip commands when the conditions are met. The real-time simulator, based on the trip commands, uses the circuit breaker failure protection control logic model to determine whether the circuit breaker in this bay has failed to operate. If it determines that it has failed to operate, it outputs a backup trip command to the first simulated circuit breaker for execution. This achieves backup clearing of circuit breaker failure faults by having the first simulated circuit breaker correspond to adjacent line circuit breakers or bus-side circuit breakers in the power plant's primary system. This overcomes the limitation of field testing being constrained by equipment safety and testing costs, preventing full-process verification in a real power plant environment. It provides quantifiable evidence for the coordination boundary between circuit breaker failure protection and station-wide protection. In addition, the platform does not require high-power amplifiers, complex coupling interfaces, or a large number of test objects, which reduces hardware investment and setup complexity, meets the industry's demand for accelerated self-sufficiency in testing toolchains, and enables rapid reproduction and multi-round regression testing, thereby improving the repeatability of the testing process.

[0007] 2) In a second aspect, the present invention also provides a hardware-in-the-loop testing method for power plant microcomputer protection, the specific technical solution of which is as follows: The first host computer builds an electromagnetic transient model of the power plant's primary system and a circuit breaker failure protection control logic model. After compiling these models, they are sent to a real-time simulator. The real-time simulator uses the compiled electromagnetic transient model to perform real-time electromagnetic transient calculations, obtaining analog signals, which are then output to the power plant's microcomputer protection hardware. The microcomputer protection hardware executes protection criteria based on the received analog signals. When the protection action conditions are met, the microcomputer protection hardware outputs a tripping command to the real-time simulator to control the opening of the circuit breaker in this bay. Based on the received tripping command, the real-time simulator uses the compiled circuit breaker failure protection control logic model to determine whether the circuit breaker in this bay has failed to operate. If the result is a failure to operate, a backup tripping command is output. The first simulated circuit breaker receives and executes the backup tripping command and feeds back its opening / closing status signal to the real-time simulator. The first simulated circuit breaker corresponds to an adjacent line circuit breaker or bus-side circuit breaker in the power plant's primary system.

[0008] It should be noted that the beneficial effects of the technical solution of the second aspect of the present invention and the corresponding possible implementation can be found in the above description of the technical effects of the first aspect and its corresponding possible implementation, and will not be repeated here. Attached Figure Description

[0009] Figure 1 A schematic diagram of the hardware-in-the-loop test platform for power plant microcomputer protection. Figure 2 This is a schematic diagram of the hardware architecture of a real-time simulator. Figure 3 This is a schematic diagram of the topology of the primary system of a power plant. Figure 4 This is a schematic diagram of a bidirectional coupling channel between analog and digital signals. Figure 5 This is a schematic diagram of the physical connection relationships of the test platform; Figure 6 This is a schematic diagram of the current waveform under the action of the line protection device; Figure 7 This is a schematic diagram of the voltage waveform under the action of the line protection device; Figure 8 This is a schematic diagram illustrating the protective actions of the line protection device. Figure 9 This is a schematic diagram of the current waveform under the action of the line protection device; Figure 10 This is a schematic diagram illustrating the protective actions of the line protection device. Figure 11 A schematic diagram of the current waveform under the action of the control logic model for line protection device and circuit breaker failure protection; Figure 12 A schematic diagram of voltage waveforms under the action of the control logic model for line protection devices and circuit breaker failure protection; Figure 13 This is a schematic flowchart of a hardware-in-the-loop testing method for power plant microcomputer protection according to an embodiment of the present invention. Detailed Implementation

[0010] like Figure 1 As shown, an embodiment of the present invention provides a power plant microcomputer protection hardware-in-the-loop test platform, comprising: a first host computer, a real-time simulator, a first simulated circuit breaker, and power plant microcomputer protection hardware, wherein the first simulated circuit breaker corresponds to an adjacent line circuit breaker or a bus-side circuit breaker in the primary system of the power plant.

[0011] The first host computer is used to: build the electromagnetic transient model of the primary system of the power plant and the circuit breaker failure protection control logic model, compile them, and then send them to the real-time simulator; In this context, a power plant specifically refers to a nuclear power plant, a thermal power plant, or a hydroelectric power station. The primary system of a power plant refers to the main electrical circuit consisting of generators, step-up transformers, busbars, transmission lines, and circuit breakers connecting these devices. Whether it's a nuclear power plant, a thermal power plant, or a hydroelectric power station, the core components of their primary system are the same, including generators, step-up transformers, busbars, transmission lines, and circuit breakers. The generator model generates electrical energy, the step-up transformer model raises the generator's output voltage to transmission levels, the busbar model collects and distributes electrical energy, the transmission line model transmits electrical energy to the external power grid, and the circuit breaker model performs tripping operations to clear faults according to protection commands. In this primary system, fault modules are configured at key nodes to simulate single-phase ground faults, two-phase short-circuit faults, two-phase ground faults, three-phase short-circuit faults, open-circuit faults, and equivalent faults related to switch operations. The electromagnetic transient model calculates in real time electrical quantities such as voltage and current in the primary system, as well as the open / closed position of the circuit breaker. These electrical quantities and open / closed position signals are led out through signal lines and transmitted to the generator protection device, transformer protection device, bus protection device, short lead protection device, and line protection device, respectively, to execute their respective protection criteria. At the same time, they are also transmitted to the current monitoring module and position signal monitoring module in the circuit breaker failure protection control logic model to determine whether the circuit breaker in this bay has failed to operate.

[0012] The real-time simulator can be a UREP300 model, or a OP5707XG, OP5700, OP5705XG or MicroLabBox model, depending on the specific circumstances.

[0013] In this context, the first simulated circuit breaker corresponds to the adjacent line circuit breaker or bus-side circuit breaker in the primary system of the power plant. This means that the first simulated circuit breaker physically represents the operating behavior of the adjacent line circuit breaker or bus-side circuit breaker in the electromagnetic transient model. In the electromagnetic transient model, the adjacent line circuit breaker or bus-side circuit breaker is the circuit breaker located adjacent to the circuit breaker in this bay in the main electrical circuit. When the circuit breaker in this bay fails to operate, the first simulated circuit breaker receives and executes the backup trip command generated by the multi-core central processing unit, performs a tripping operation to disconnect the fault area, and simultaneously feeds back the opening / closing status signal indicating the opening / closing position to the real-time simulator through its digital output interface, so that the corresponding circuit breaker model in the electromagnetic transient model can synchronously update its opening / closing status.

[0014] In this context, an adjacent line circuit breaker refers to a circuit breaker located in the primary system of a power plant, adjacent to the circuit breaker in this bay, on the same outgoing line. In a 3 / 2 connection configuration, an outgoing line is typically controlled by two circuit breakers, which are considered adjacent line circuit breakers. When the circuit breaker in this bay fails to operate, the circuit breaker failure protection control logic model generates a backup trip command. The first simulated circuit breaker receives and executes this backup trip command, and this first simulated circuit breaker corresponds to the adjacent line circuit breaker.

[0015] In this context, the busbar-side circuit breaker refers to the circuit breaker located on the busbar side of the power plant's primary system. In the 3 / 2 connection configuration, the busbar-side circuit breaker is directly connected to the substation busbar and is used to control the power transmission on the busbar side. When the circuit breaker in this bay fails to operate, if the adjacent line circuit breaker also fails to clear the fault, the backup trip command generated by the circuit breaker failure protection control logic model can be executed by the busbar-side circuit breaker to clear the fault area on the busbar side. The first simulated circuit breaker also corresponds to the busbar-side circuit breaker and receives and executes the backup trip command when needed.

[0016] In this context, the "interval circuit breaker" refers to the circuit breaker corresponding to the electrical interval in the primary system of the power plant that experiences a fault. Specifically, it is the circuit breaker that should perform a tripping operation to disconnect the faulty circuit breaker upon receiving a tripping command from the microprocessor-based protection hardware. In the power system protection configuration, each electrical interval is equipped with a corresponding circuit breaker. When a fault occurs in the equipment or line within this interval, the microprocessor-based protection hardware executes protection criteria based on analog signals. When the protection action conditions are met, it outputs a tripping command to the real-time simulator. The target of this tripping command is the circuit breaker in this interval. In the test platform, the circuit breaker in this interval is simulated by a second simulated circuit breaker. The second simulated circuit breaker receives and executes the tripping command issued by the microprocessor-based protection hardware and relayed through the real-time simulator, and feeds back the opening and closing status signals to the real-time simulator. When the circuit breaker in this interval fails to complete the tripping operation within the set time, the circuit breaker failure protection control logic model intervenes and determines that the circuit breaker in this interval has failed to operate. Subsequently, it generates a backup tripping command, which is executed by the first simulated circuit breaker to disconnect the faulty area.

[0017] The electromagnetic transient model includes a generator model, a step-up transformer model, a busbar model, and a transmission line model. Fault modules are configured at the corresponding nodes in the electromagnetic transient model. The fault modules are used to simulate single-phase grounding faults, two-phase short-circuit faults, two-phase grounding short-circuit faults, three-phase short-circuit faults, open-circuit faults, and equivalent faults of switch operation.

[0018] The generator model construction process is as follows: When building the generator model in the simulation environment of the graphical modeling and simulation software, the synchronous motor module from the standard components of the software is used. This module can simulate the electromagnetic transient characteristics of a synchronous generator, including the electromagnetic relationship between the stator and rotor windings, the rotor motion equation, and the dynamic response of the excitation system. In the module parameter setting dialog box, electrical parameters such as the generator's rated capacity, rated voltage, stator resistance, stator leakage inductance, and direct-axis and quadrature-axis reactances are input, while mechanical parameters such as the generator set's moment of inertia time constant and damping coefficient are set. After the model is built, the three-phase voltage and three-phase current signals at the generator terminals are collected through the voltage measurement module and the current measurement module, respectively, for subsequent signal interaction with the protection device.

[0019] The construction process of the step-up transformer model is as follows: When building the step-up transformer model in the simulation environment of the graphical modeling and simulation software, the three-phase transformer module from the standard components of the software is used. This module can simulate the electromagnetic transient characteristics of the transformer, including winding leakage reactance, excitation branch, and core saturation nonlinear characteristics. In the module parameter setting dialog box, parameters such as the transformer's rated capacity, rated voltage, connection group, short-circuit impedance percentage, and no-load current percentage are input. The primary side of the transformer model is connected to the generator outlet, and the secondary side is connected to the step-up station bus, realizing voltage level transformation and power transmission.

[0020] The busbar model construction process is as follows: When building the busbar model in the simulation environment of the graphical modeling and simulation software, the three-phase busbar module in the standard components of the graphical modeling and simulation software is used, or the busbar is directly constructed through electrical connection nodes. In the electromagnetic transient model, the busbar serves as an electrical connection point, connecting various electrical components such as generators, step-up transformers, and transmission lines to form a complete electrical circuit. Voltage measurement modules are installed at the busbar nodes to collect the three-phase voltage signals of the busbar for system status monitoring and protection criterion calculation.

[0021] The process of building the transmission line model is as follows: When building the transmission line model in the simulation environment of the graphical modeling and simulation software, the appropriate line model is selected according to the line length. For short-to-medium distance transmission lines, the lumped parameter π-type line module in the standard components of the graphical modeling and simulation software is used; for long-distance transmission lines, the distributed parameter line module is used to accurately reflect the wave process of the line. In the module parameter setting dialog box, parameters such as line length, positive sequence resistance per unit length, positive sequence reactance, positive sequence susceptance, and zero sequence resistance, zero sequence reactance, and zero sequence susceptance are input. One end of the transmission line model is connected to the step-up substation bus, and the other end is connected to the external power grid or load, forming a complete transmission channel.

[0022] The configuration process of the fault module is as follows: When configuring the fault module at the corresponding node of the electromagnetic transient model, the three-phase fault module from the standard components of the graphical modeling and simulation software is used. This fault module can simulate various types of power system faults. In the module parameter setting dialog box, different fault mode parameters are configured to simulate different types of faults. For a single-phase ground fault, the fault mode is set to single-phase ground fault mode in the fault module parameter setting dialog box, and the phase in which the ground fault occurs is specified in the fault phase selection parameter. Simultaneously, the ground resistance value is set to simulate the ground fault characteristics under different transition resistances. For a two-phase phase-to-phase short-circuit fault, the fault mode is set to two-phase phase-to-phase short-circuit mode in the fault module parameter setting dialog box, and the two phases in which the short circuit occurs are specified in the fault phase selection parameter. Simultaneously, the phase-to-phase short-circuit resistance value is set to simulate the fault characteristics under different short-circuit resistances. For a two-phase ground fault, the fault mode is set to two-phase ground fault mode in the fault module parameter setting dialog box, and the two phases in which the ground fault occurs are specified in the fault phase selection parameter, while the ground resistance value is set. For three-phase short-circuit faults, set the fault mode to three-phase short-circuit mode in the fault module parameter setting dialog box, and check the ground fault option in the parameter panel. Set the short-circuit resistance value to near zero to simulate an ideal short circuit. For open-circuit faults, set the fault mode to open-circuit mode in the fault module parameter setting dialog box, and specify the phase where the open circuit occurred in the open-circuit phase selection parameter. In this mode, the electrical circuit of the fault phase is disconnected, simulating a line open-circuit fault. For equivalent faults of switch operation, the timing control function of the fault module is used. Set the fault occurrence time and fault clearing time in the fault module parameter setting dialog box to simulate the electrical state changes corresponding to the circuit breaker opening and closing operations. Through the combination configuration of timing parameters, various switch operation conditions such as reclosing and switch failure can be simulated. These fault modules are arranged at the corresponding nodes in the electromagnetic transient model, such as generator outlet, transformer sides, bus nodes, and transmission lines, according to the distribution locations of typical faults in actual nuclear power plant operation, to simulate power system faults of different locations and types.

[0023] The circuit breaker failure protection control logic model includes a timer module, a current monitoring module, a position signal monitoring module, and a backup trip command generation module. The timer module starts timing when the real-time simulator receives a trip command. The current monitoring module detects whether the current value in the circuit where the circuit breaker in this bay is located is higher than a preset threshold. The position signal monitoring module detects whether the position of the circuit breaker in this bay has changed based on the open / closed status signal fed back by the first simulated circuit breaker. The backup trip command generation module generates a backup trip command when the timer module reaches the set time and the current monitoring module detects that the current value is still higher than the preset threshold, or when the position signal monitoring module detects that the position has not changed.

[0024] In building the circuit breaker failure protection control logic model within the simulation environment of the graphical modeling and simulation software, the logic operation module, comparator module, timer module, and signal selection module from the standard components of the software are used. These modules are connected and combined according to the logical relationship of circuit breaker failure protection to form a complete control logic model. This control logic model receives trip commands from the microcomputer protection hardware, and simultaneously receives the current measurement signal of the circuit where the circuit breaker in this bay is located in the electromagnetic transient model, as well as the open / closed status signal fed back by the first simulated circuit breaker. After logical judgment, a backup trip command is output.

[0025] The timer module is used to start timing when the real-time simulator receives a trip command. In the standard components of the graphical modeling and simulation software, the timer module is implemented by combining a rising-edge trigger subsystem and an integrator module. When the real-time simulator receives a trip command signal from the microcomputer protection hardware through the digital input interface, the trip command signal transitions from low to high; this rising-edge signal serves as the trigger signal for the timer module. After being triggered, the timer module begins timing, with the timing step size consistent with the electromagnetic transient calculation step size of the real-time simulator. The timer module compares the current timing value with a preset set time. When the current timing value is less than the set time, the timer module outputs a false signal; when the current timing value is greater than or equal to the set time, the timer module outputs a true signal, indicating that the set time has been reached. The value of the set time is preset through the constant module in the standard components of the graphical modeling and simulation software and can be adjusted in the model parameter configuration interface.

[0026] The current monitoring module is used to detect whether the current value in the circuit where the circuit breaker in this bay is located exceeds a preset threshold. In the standard components of the graphical modeling and simulation software, the current monitoring module is implemented through a comparator module. The effective or instantaneous current value of the circuit where the circuit breaker in this bay is located, calculated in real time by the electromagnetic transient model in the real-time simulator, is introduced to the input terminal of the current monitoring module through a signal line. The comparator module compares the input current value with a preset threshold value, which is set by a constant module in the standard components of the graphical modeling and simulation software. When the input current value is higher than the preset threshold, the comparator module outputs a true logic signal, indicating that there is still current in the circuit where the circuit breaker in this bay is located; when the input current value is lower than the preset threshold, the comparator module outputs a false logic signal, indicating that the current in the circuit where the circuit breaker in this bay has decreased to a safe level. A holding module is connected to the output terminal of the current monitoring module to maintain the stability of the current detection result during fault transients and prevent signal jitter from causing misjudgments.

[0027] The position signal monitoring module is used to detect whether the position of the circuit breaker in this bay has changed based on the open / closed status signal fed back by the first simulated circuit breaker. In the standard components of the graphical modeling and simulation software, the position signal monitoring module is implemented through a logic comparison module. After executing a trip command or a backup trip command, the first simulated circuit breaker feeds back an open / closed status signal to the real-time simulator through a digital output interface. This open / closed status signal uses both open and closed status codes to represent the current position of the circuit breaker. The position signal monitoring module receives this open / closed status signal and compares it with the open / closed status signal recorded before the trip command was issued. The comparison operation is implemented using an XOR logic gate. When the two open / closed status signals are inconsistent, it indicates that the position of the circuit breaker has changed; when the two open / closed status signals are consistent, it indicates that the position of the circuit breaker has not changed. The position signal monitoring module also includes a signal latching submodule, used to latch the initial position state of the circuit breaker at the moment the trip command is issued, as a reference for subsequent comparisons.

[0028] The backup trip instruction generation module generates a backup trip instruction when the timer module reaches its set time and the current monitoring module detects that the current value is still higher than the preset threshold, or when the timer module reaches its set time and the position signal monitoring module detects that the position has not changed. In the standard components of the graphical modeling and simulation software, the backup trip instruction generation module is implemented by combining AND and OR gate modules. The output signals of the timer module, the current monitoring module, and the position signal monitoring module are introduced into the backup trip instruction generation module. The timer module outputs a true signal when it reaches its set time; the current monitoring module outputs a true signal when it detects that the current value is higher than the preset threshold; and the position signal monitoring module outputs a true signal when it detects that the position has not changed. The first AND gate module performs a logical AND operation on the output signals of the timer module and the current monitoring module, outputting a true signal when both signals are true. The second AND gate module performs a logical AND operation on the output signals of the timer module and the position signal monitoring module, outputting a true signal when both signals are true. The OR gate module performs a logical OR operation on the output signals of the first AND gate module and the second AND gate module. When either condition is met, it outputs a true logical signal, which is the backup trip command. The backup trip command is output to the first analog circuit breaker through the digital output interface of the real-time emulator, driving the first analog circuit breaker to perform a tripping operation.

[0029] The first host computer compiles the electromagnetic transient model and the circuit breaker failure protection control logic model and sends them to the real-time simulator. The specific implementation process is as follows: 1) Open the graphical modeling and simulation software on the first host computer and load the completed electromagnetic transient model file and circuit breaker failure protection control logic model file. In the standard component model configuration parameter dialog box of the graphical modeling and simulation software, set the simulation target to the real-time simulation target and the code generation target to the target platform corresponding to the real-time simulator. The code automatic generation toolkit compiles the electromagnetic transient model and the circuit breaker failure protection control logic model into executable C code based on the module types, signal connection relationships, and parameter settings in the model. During the compilation process, the code automatic generation toolkit first performs a syntax check on the model to confirm that all module parameters are valid and signal line connections are complete; then, it converts the mathematical operation logic and state update logic in the model into corresponding C language functions; finally, it calls the C compiler to compile these C language functions into executable files that can run on the real-time simulator.

[0030] 2) After compilation, the first host computer establishes a communication connection with the real-time simulator via an Ethernet interface. The graphical modeling and simulation software in the first host computer sends the compiled executable file to the real-time simulator via the Ethernet protocol. After receiving the executable file, the real-time simulator stores it in its program memory and waits for the start command to begin real-time execution.

[0031] Compilation refers to the process of using a code generation toolkit to convert model files into executable C code, and then using a C compiler to generate an executable file that can run on a real-time simulator. This process includes three stages: model syntax checking, mathematical operation logic conversion, and code generation.

[0032] The real-time simulator is used to perform real-time electromagnetic transient calculations using a compiled electromagnetic transient model, obtain analog signals, and output them to the microcomputer protection hardware. The real-time simulator includes a multi-core CPU, a timer card, an analog signal card, a high-speed network card, and a system bus. The multi-core CPU, timer card, analog signal card, and high-speed network card are all connected to the system bus. The high-speed network card connects to the first host computer via Ethernet to receive the compiled electromagnetic transient model. The timer card provides a unified time reference signal to the multi-core CPU to coordinate the time steps of each task. The multi-core CPU executes the real-time calculations of the compiled electromagnetic transient model, obtaining analog signals after the calculations. The analog signal card connects to the microcomputer protection hardware via an analog output interface to send analog signals. The specific implementation process is as follows: 1) The high-speed network card establishes a communication connection with the first host computer via Ethernet. After the first host computer completes the model compilation, it sends the executable file of the compiled electromagnetic transient model to the real-time simulator via the Ethernet protocol. After receiving the executable file, the high-speed network card transfers the executable file via the system bus and stores it in the program memory accessed by the multi-core CPU, waiting for the multi-core CPU to call and execute it.

[0033] 2) The timer card contains a high-precision crystal oscillator to generate periodic clock pulse signals. The timer card uses this clock pulse signal as a unified time reference signal and broadcasts it to the multi-core CPU via the system bus. Upon receiving the time reference signal, the multi-core CPU uses it as the synchronization basis for the time steps of each computational task. The multi-core CPU initiates a real-time calculation of the electromagnetic transient model upon the arrival of each time reference signal pulse, ensuring that the calculations within each time step are completed within a fixed time interval.

[0034] 3) The multi-core CPU reads the compiled executable code of the electromagnetic transient model from the program memory and executes the real-time calculation of the electromagnetic transient model step by step according to the time base signal. The executable code of the electromagnetic transient model contains the mathematical operation logic of the generator model, step-up transformer model, bus model, and transmission line model, as well as the triggering logic of the fault module. The multi-core CPU completes an iterative calculation of the electrical quantities of the entire system in each time step, obtaining the voltage values ​​of each node, the current values ​​of each branch, and the open / closed position status of the circuit breaker at the current time step. These electrical quantity calculation results are stored in the data memory of the multi-core CPU for subsequent output and logical judgment.

[0035] 4) After the multi-core CPU completes the real-time calculation of the electromagnetic transient model, it transmits the obtained analog signal data to the analog signal card via the system bus. The analog signal card contains a digital-to-analog converter (DAC) to convert the digital analog signal data into continuous analog voltage or current signals. The analog signal card sends the converted analog signal to the microprocessor-based protection hardware through its analog output interface on its front panel. The analog output interface and the microprocessor-based protection hardware are connected via a shielded cable to ensure that the analog signal is not subject to electromagnetic interference during transmission.

[0036] The timer card is a hardware board installed inside the real-time simulator chassis, containing a high-precision crystal oscillator and clock signal distribution circuitry. The timer card generates a stable clock pulse signal through the crystal oscillator and uses this signal as a time reference signal to provide a unified time step synchronization source to the multi-core CPU, ensuring that all tasks of the real-time simulator run under strictly synchronized time ticks. The analog signal card is also a hardware board installed inside the real-time simulator chassis, containing a digital-to-analog converter (DAC). The analog signal card receives digital analog signal data from the multi-core CPU via the system bus, converts the digital signal into a continuous analog voltage or current signal through the DAC, and sends the analog signal to external devices through the analog output interface. The high-speed network card is a hardware board installed inside the real-time simulator chassis, containing an Ethernet controller and network protocol processing circuitry. The high-speed network card establishes a communication connection with the first host computer via an Ethernet interface, receives the compiled executable file of the electromagnetic transient model sent by the first host computer via the Ethernet protocol, and transfers the executable file to the program memory via the system bus. The system bus refers to the physical data transmission channel within the real-time simulator used to connect the multi-core CPU, timer card, analog signal card, and high-speed network card. The system bus includes data lines, address lines, and control lines. Each hardware module uses the system bus to exchange data, address, and transmit instructions. Analog signals refer to the three-phase voltage and three-phase current signals obtained after the multi-core CPU in the real-time simulator performs real-time calculations on the compiled electromagnetic transient model. These voltage and current signals correspond to the real-time electrical quantities of each bus and component in the primary system. The analog signals are converted from digital signals to continuous analog voltage or current signals by the digital-to-analog converter in the analog signal card, then amplitude-shifted by a power amplifier, and finally output to the current and voltage input terminals of the microprocessor-based protection hardware. The microprocessor-based protection hardware then executes protection criteria based on these electrical quantities.

[0037] The microcomputer protection hardware is used to: execute protection criteria based on analog signals, and when the protection action conditions are met, output a tripping command to the real-time simulator to control the circuit breaker of this bay to open. The microcomputer-based protection hardware includes generator protection devices, transformer protection devices, busbar protection devices, short-lead protection devices, and line protection devices. These devices are connected to a real-time simulator. The generator protection device executes generator protection criteria based on analog signals and outputs a trip command when the conditions are met. The transformer protection device executes transformer protection criteria based on analog signals and outputs a trip command when the conditions are met. The busbar protection device executes busbar protection criteria based on analog signals and outputs a trip command when the conditions are met. The short-lead protection device executes short-lead protection criteria based on analog signals and outputs a trip command when the conditions are met. The line protection device executes line protection criteria based on analog signals and outputs a trip command when the conditions are met. The specific implementation process is as follows: 1) Each protection device acquires analog signals from the real-time simulator. After the real-time simulator completes the real-time calculation of the electromagnetic transient model, it sends the three-phase voltage and three-phase current signals to each protection device through the analog output interface on the analog signal card. Each protection device is equipped with current input terminals and voltage input terminals to receive electrical signals of the corresponding protected object. Specifically, the current input terminals and voltage input terminals of the generator protection device are connected to the three-phase current output channel and three-phase voltage output channel of the generator model in the real-time simulator; the current input terminals and voltage input terminals of the transformer protection device are connected to the three-phase current output channel and three-phase voltage output channel of each side of the transformer model in the real-time simulator; the current input terminals and voltage input terminals of the bus protection device are connected to the three-phase current output channel and three-phase voltage output channel of each connecting branch of the bus model in the real-time simulator; the current input terminals and voltage input terminals of the short lead protection device are connected to the three-phase current output channel and three-phase voltage output channel of the short lead section between the generator outlet and the step-up transformer in the real-time simulator; and the current input terminals and voltage input terminals of the line protection device are connected to the three-phase current output channel and three-phase voltage output channel of the beginning and end of the sending line model in the real-time simulator.

[0038] 2) Each protection device executes its respective protection criteria based on the received analog signals. The generator protection device samples and calculates the received three-phase voltage and three-phase current at the generator terminals, and executes stator differential protection criteria, overcurrent protection criteria, negative sequence protection criteria, loss-of-excitation protection criteria, over-excitation protection criteria, undervoltage protection criteria, and underfrequency protection criteria. When a phase-to-phase short circuit, turn-to-turn short circuit, or asymmetrical fault occurs inside the generator, the generator protection device outputs a trip command after the criteria conditions are met. Specifically: The transformer protection device samples and calculates the received three-phase voltage and current on each side of the transformer, and executes the ratio differential protection criteria, overcurrent protection criteria, gas protection criteria, and overload protection criteria. When a winding short circuit, core fault, or abnormal overload occurs inside the transformer, the transformer protection device outputs a trip command after meeting the criteria. The bus protection device samples and calculates the received three-phase current of each connected branch of the bus, and executes the dual differential protection criteria and instantaneous overcurrent protection criteria. When a phase-to-phase short circuit or ground fault occurs on the bus, the bus protection device outputs a trip command after meeting the criteria. The short lead protection device samples and calculates the received three-phase current of the short lead segment, and executes the differential protection criteria and overcurrent protection criteria. When a short circuit fault occurs on the short lead segment between the generator outlet and the step-up transformer, the short lead protection device outputs a trip command after meeting the criteria. The line protection device samples and calculates the received three-phase voltage and three-phase current at the beginning and end of the transmitting line, and executes distance protection criteria, differential protection criteria, zero-sequence overcurrent protection criteria, and single-phase reclosing logic. When a single-phase ground fault, phase-to-phase short-circuit fault, or open-circuit fault occurs on the transmitting line, the line protection device outputs a trip command after meeting the criteria conditions. When the circuit breaker failure protection control logic model determines that the circuit breaker in this bay has failed to operate, the single-phase reclosing logic of the line protection device is blocked.

[0039] 3) Each protection device outputs a trip command through its digital output interface when the criterion conditions are met. The trip command is a switching signal transmitted to the digital input interface of the real-time simulator via a shielded cable. The real-time simulator receives the trip command through the digital card and transmits it to the circuit breaker failure protection control logic model and the circuit breaker model in the primary system to drive the circuit breaker's tripping operation.

[0040] The generator protection device can be a PCS-985G, PCS-985GE, PCS-985A, or PCS-985B model. These devices are complete protection equipment used to monitor and protect the generator. The generator protection device receives the three-phase voltage and three-phase current signals from the generator terminals and executes stator differential protection criteria, overcurrent protection criteria, negative sequence protection criteria, loss of excitation protection criteria, overexcitation protection criteria, undervoltage protection criteria, and underfrequency protection criteria. When an internal fault occurs in the generator, it outputs a trip command to disconnect the generator. Transformer protection devices can be of models PCS-985T, PCS-985TE, PCS-985TA, or PCS-985TB. These devices are complete protection systems used to monitor and protect step-up transformers. The transformer protection devices receive three-phase voltage and three-phase current signals from each side of the transformer, execute ratio differential protection criteria, overcurrent protection criteria, gas protection criteria, and overload protection criteria, and output trip commands to disconnect the transformer when an internal fault or abnormal operating condition occurs. Busbar protection devices can be of models PCS-915-N, PCS-915-G, PCS-915E, or the PCS-915 series. These devices are complete protection systems used to monitor and protect the busbars of the step-up substation. The busbar protection devices receive three-phase current signals from each connected branch of the busbar, execute dual differential protection criteria and instantaneous overcurrent protection criteria, and output trip commands to quickly disconnect the busbar fault when a short-circuit fault occurs. The short lead protection device can be a PCS-922-N, PCS-922-G, PCS-922A or PCS-922 series device. These devices are complete protection equipment used to monitor and protect the short lead section between the generator outlet and the step-up transformer. The short lead protection device receives the three-phase current signal of the short lead section, executes the differential protection criteria and overcurrent protection criteria, and outputs a trip command to clear the fault when a short circuit fault occurs in the short lead section. The line protection device can be a PCS-931-N, PCS-931-G, PCS-931N-DG or PCS-931 series device. These devices are complete sets of protection equipment used to monitor and protect high-voltage transmission lines. The line protection device receives three-phase voltage and three-phase current signals from the beginning and end of the transmission line, executes distance protection criteria, differential protection criteria, zero-sequence overcurrent protection criteria and single-phase reclosing logic, and outputs trip commands to disconnect the faulty line when various faults occur in the transmission line.

[0041] The real-time simulator is also used to: determine whether the circuit breaker in this bay fails to operate based on the trip command and the compiled circuit breaker failure protection control logic model, and output a backup trip command when the determination result is yes. Specifically, the high-speed network card is connected to the first host computer via Ethernet to receive the compiled circuit breaker failure protection control logic model, the digital signal card is connected to the microcomputer protection hardware via digital input interface to receive the trip command, and the multi-core central processing unit is used to execute the real-time calculation of the compiled circuit breaker failure protection control logic model. During the real-time calculation of the compiled circuit breaker failure protection control logic model, it determines whether the circuit breaker in this bay fails to operate based on the trip command, and generates a backup trip command when the determination result is yes. The digital signal card is connected to the first simulated circuit breaker via digital output interface to send the backup trip command.

[0042] A high-speed network card connects to the first host computer via Ethernet to receive the compiled circuit breaker failure protection control logic model. After compiling the circuit breaker failure protection control logic model, the first host computer sends the compiled executable file to the real-time simulator via Ethernet protocol. The high-speed network card receives the executable file via the Ethernet interface, transfers it via the system bus, and stores it in the program memory accessible by the multi-core CPU, awaiting execution by the multi-core CPU. A digital input card connects to the microprocessor protection hardware via a digital input interface to receive trip commands. When the microprocessor protection hardware detects a system fault and meets the protection criteria, it issues a trip command via its digital output interface. This trip command is a DC voltage switching signal. The digital input interface of the digital input card connects to the digital output interface of the microprocessor protection hardware via a shielded cable. When the trip command signal arrives at the digital input interface, the input circuit inside the digital input card converts the switching signal into a logic level signal recognizable by the multi-core CPU and transmits the converted trip command signal to the multi-core CPU via the system bus. The multi-core CPU is used to perform real-time calculations of the compiled circuit breaker failure protection control logic model. The multi-core CPU reads the executable code of the circuit breaker failure protection control logic model from the program memory and executes the real-time calculations of the model step-by-step according to the time reference signal provided by the timer card. The real-time calculation process of the circuit breaker failure protection control logic model includes: the multi-core CPU continuously monitors the trip command signal transmitted from the digital signal card through the system bus; when a trip command signal is received, the multi-core CPU immediately starts the timer module to begin timing; during the timer module's timing process, the multi-core CPU simultaneously reads the current current value in the circuit where the circuit breaker in this bay is located, calculated in real-time by the electromagnetic transient model, through the current monitoring module, and reads the current open / closed status signal of the circuit breaker in this bay, fed back by the first analog circuit breaker, through the position signal monitoring module.

[0043] After the set time is reached, the multi-core CPU performs a failure-to-operate determination. The multi-core CPU compares the current current value with a preset threshold value through the current monitoring module, and compares the current open / closed position of the circuit breaker in this bay with the open / closed position before the trip command was issued through the position signal monitoring module. If the current value is still higher than the preset threshold value or the open / closed position of the circuit breaker in this bay has not changed, the multi-core CPU determines that the circuit breaker in this bay has failed to operate. If the current value is lower than the preset threshold value and the open / closed position of the circuit breaker in this bay has changed, the multi-core CPU determines that the circuit breaker in this bay has not failed to operate. After determining that the circuit breaker in this bay has failed to operate, the multi-core CPU generates a backup trip command through the backup trip command generation module. The digital quantity card is connected to the first analog circuit breaker through the digital output interface to send the backup trip command. After generating the backup trip command, the multi-core CPU transmits the backup trip command to the digital quantity card through the system bus. The output circuit inside the digital signal card converts the backup trip command into a DC voltage switching signal and sends it to the first analog circuit breaker through the digital output interface. Upon receiving the backup trip command, the first analog circuit breaker performs a tripping operation to disconnect the faulty area.

[0044] The digital input interface is an electrical connection port on the digital signal card panel, used to receive trip command switching signals from the microprocessor-based protection hardware. The digital input interface connects to the digital output interface of the microprocessor-based protection hardware via a shielded cable. Internally, it incorporates a level conversion circuit to convert the input switching signals into logic level signals recognizable by the multi-core CPU. The trip command is a switching control signal issued by the microprocessor-based protection hardware through its digital output interface when it detects a fault in the primary system and meets the protection criteria. The trip command is a DC voltage signal, transmitted via a shielded cable to the digital input interface of the real-time simulator, notifying the simulator that a fault has occurred in the primary system and that the microprocessor-based protection hardware has requested the circuit breaker to perform a tripping operation. The backup trip command is a switching control signal generated by the multi-core CPU after performing real-time calculations on the circuit breaker failure protection control logic model, when it determines that the circuit breaker in this bay has failed to operate. The backup trip command is transmitted to the digital signal card via the system bus. The output circuit of the digital signal card converts it into a DC voltage switch signal and sends it to the first analog circuit breaker through the digital output interface to disconnect the fault area.

[0045] The first simulated circuit breaker is used to: receive and execute backup trip commands, and feed back the opening and closing status signals of the first simulated circuit breaker to the real-time simulator. Specifically: 1) The first analog circuit breaker receives the backup trip command. The digital input interface of the first analog circuit breaker is connected to the digital output interface of the digital signal card via a shielded cable. After the multi-core CPU generates the backup trip command, the backup trip command is transmitted to the digital signal card via the system bus. The output circuit inside the digital signal card converts the backup trip command into a DC voltage switch signal and sends it to the digital input interface of the first analog circuit breaker via the digital output interface. After receiving the switch signal, the input circuit inside the first analog circuit breaker transmits the signal to the control logic circuit inside the first analog circuit breaker.

[0046] 2) The first simulated circuit breaker executes the backup trip command. Upon receiving the backup trip command, the control logic circuit inside the first simulated circuit breaker energizes the electromagnetic coil. The energized coil generates electromagnetic force, which actuates the mechanical linkage mechanism inside the first simulated circuit breaker, causing the moving contact to separate from the stationary contact, thus completing the tripping operation. The tripping operation of the first simulated circuit breaker simulates the physical tripping process of adjacent line circuit breakers or busbar circuit breakers in the primary system of a power plant after receiving a trip command. Its tripping time is set by internal circuit parameters to a value consistent with the rated breaking time of the actual circuit breaker.

[0047] 3) The first simulated circuit breaker feeds back its open / closed status signal to the real-time simulator. The first simulated circuit breaker has an auxiliary contact internally linked to the moving contact. When the first simulated circuit breaker is in the closed position, the auxiliary contact closes, outputting a DC voltage signal indicating the closed status to the digital input interface of the digital signal card. When the first simulated circuit breaker performs an opening operation and is in the open position, the auxiliary contact opens, outputting a DC voltage signal indicating the open status to the digital input interface of the digital signal card. This open / closed status signal is transmitted to the digital input interface of the digital signal card via a shielded cable. The input circuit inside the digital signal card converts the switch signal into a logic level signal that can be recognized by the multi-core central processing unit (CPU), and transmits it to the CPU via the system bus. This CPU is then used by the position signal monitoring module in the circuit breaker failure protection control logic model to determine whether the position of the circuit breaker in this bay has changed.

[0048] The auxiliary contact is a miniature switch installed inside the first simulated circuit breaker and mechanically linked to the moving contact. The opening and closing state of the auxiliary contact is synchronized with the opening and closing state of the main contacts of the first simulated circuit breaker. When the first simulated circuit breaker is in the closed position, the auxiliary contact is closed; when the first simulated circuit breaker is in the open position, the auxiliary contact is open. The auxiliary contact is used to convert the opening and closing position state of the first simulated circuit breaker into a switching signal, which is then sent to the real-time simulator via a digital output interface.

[0049] The first analog circuit breaker feeds back its open / closed status signal to the digital input interface of the real-time simulator through its digital output interface. This open / closed status signal is generated by the auxiliary contacts inside the first analog circuit breaker and indicates its current open / closed position. After receiving this open / closed status signal through a shielded cable, the digital input interface of the digital signal card converts the switch signal into a logic level signal that can be recognized by the multi-core CPU and transmits it to the multi-core CPU via the system bus. Specifically, the open / closed status signal is used as the basis for judgment by the position signal monitoring module in the circuit breaker failure protection control logic model. When the position signal monitoring module receives a trip command from the microcomputer protection hardware, it latches the open / closed position status of the first analog circuit breaker at the time the trip command is issued. During the real-time calculation of the circuit breaker failure protection control logic model by the multi-core CPU, the position signal monitoring module continuously acquires the current open / closed position open / closed status signal of the first analog circuit breaker and compares it with the open / closed position status latched at the time the trip command is issued. When the current open / closed position of the first simulated circuit breaker is consistent with the open / closed position at the time the trip command was issued, the position signal monitoring module determines that the position of the first simulated circuit breaker has not changed; when the current open / closed position of the first simulated circuit breaker is inconsistent with the open / closed position at the time the trip command was issued, the position signal monitoring module determines that the position of the first simulated circuit breaker has changed. During the real-time calculation of the electromagnetic transient model, the multi-core CPU needs to update the conduction state of the circuit breaker model in the electromagnetic transient model based on the actual open / closed position of the first simulated circuit breaker. When the open / closed state signal indicates that the first simulated circuit breaker is in the closed position, the corresponding circuit breaker model in the electromagnetic transient model is set to the conducting state, allowing current to flow. When the open / closed state signal indicates that the first simulated circuit breaker is in the open position, the corresponding circuit breaker model in the electromagnetic transient model is set to the closed state, blocking current flow. This ensures that the circuit breaker state in the electromagnetic transient model remains synchronized with the actual physical state of the first simulated circuit breaker, ensuring a one-to-one correspondence between the calculation results of the electromagnetic transient model and the actual actions of the first simulated circuit breaker.

[0050] Optionally, the above technical solution also includes a second host computer connected to a real-time simulator. The second host computer has a human-machine interface (HMI) for parameter setting, fault injection, status monitoring, and protection action analysis. The HMI integrates a topology visualization module for the main wiring of the primary system and the open / close status signals of each circuit breaker in the primary system, a real-time oscilloscope display module for key electrical quantities, a programmable fault injection and time-stamping recording module, and an action event and trip link tracing module. The topology visualization module reads the open / close status signals of each circuit breaker in the primary system from the real-time simulator or from the microcomputer. The trip position signal acquisition status of the protection hardware feedback is refreshed on the interface display through a combination of polling trigger and interrupt trigger. The real-time oscilloscope display module acquires key electrical quantity data from the real-time simulator and marks the fault time. The programmable fault injection and time stamp recording module sends fault commands to the real-time simulator and records the fault injection time, protection start time, and trip command issuance time. The action event and trip link backtracking module acquires the trip signals of each circuit breaker in the primary system from the real-time simulator and generates a trip link diagram and backtracking report in chronological order. The human-machine interface also supports setting group switching, one-click test reset, and scenario repetition.

[0051] The implementation process of the topology visualization module is as follows: The main wiring diagram of the primary system is drawn on the front panel of the graphical programming measurement and control development software. This diagram includes graphic symbols for the generator, step-up transformer, busbar, transmission lines, and circuit breakers. The topology visualization module reads the open / close status signals of each circuit breaker in the electromagnetic transient model from the real-time simulator via Ethernet, and simultaneously acquires status data from the trip position signals fed back by the microcomputer protection hardware. The topology visualization module refreshes the interface display using a combination of polling and interrupt triggering. During normal operation, the topology visualization module queries the real-time simulator for the circuit breaker status every 50 microseconds via Ethernet and updates the front panel display. When a change in the circuit breaker status is detected, the interrupt triggering mechanism immediately refreshes the interface display.

[0052] The implementation process of the real-time oscilloscope display module is as follows: The real-time oscilloscope display module acquires key electrical quantity data from the real-time simulator via Ethernet, including bus voltages at each voltage level, three-phase currents of each component, system frequency, active power, reactive power, power factor, and generator stator voltage and current, and excitation voltage and current. The real-time oscilloscope display module acquires data from the real-time simulator at a sampling rate of one thousand times per second and displays it in real-time as a waveform graph on the front panel of the graphically programmed measurement and control development software. When a fault is injected through the programmable fault injection and time-stamping module, the real-time oscilloscope display module marks the fault time on the waveform graph.

[0053] The implementation process of the programmable fault injection and time-stamping module is as follows: The operator selects the fault type, fault location, and fault time in the interface of the programmable fault injection and time-stamping module. These parameters are sent to the real-time simulator via Ethernet. After receiving the fault command, the high-speed network card in the real-time simulator transmits the fault command to the multi-core central processing unit (CPU). The CPU triggers the fault module at the corresponding node in the electromagnetic transient model at the set fault time. The programmable fault injection and time-stamping module records the fault injection time, protection start time, and trip command issuance time using a high-precision system clock.

[0054] The implementation process of the action event and trip link backtracking module is as follows: The module collects trip signals from each circuit breaker via Ethernet from the real-time simulator, recording the occurrence time of each trip event and the corresponding circuit breaker number in chronological order. Based on the collected trip signals, the module generates a trip link diagram in the front panel of the graphical programming measurement and control development software, and generates a backtracking report in chronological order.

[0055] The topology visualization module defines device relationships based on Extensible Markup Language or comma-separated value configuration files to achieve topology linkage.

[0056] The real-time oscilloscope display module imports the acquired data into a comma-separated value format file and marks the fault time on the waveform graph. The programmable fault injection and time-stamping module sends trigger signals to the fault injection unit of the real-time simulator through the digital output module of the graphically programmed measurement and control development software, and issues fault commands via Ethernet. It uses a high-precision system clock with 1 millisecond accuracy to record the fault injection time, protection start time, and trip command issuance time. The setting group switching sends setting group switching commands to the microcomputer protection hardware through the human-machine interface, switching between different pre-stored setting value combinations in the protection device. The one-button test reset sends a reset command to the real-time simulator through the human-machine interface. Upon receiving the reset command, the multi-core central processing unit in the real-time simulator restores all electrical quantities in the electromagnetic transient model to the initial test state, and simultaneously sends a reset command to the microcomputer protection hardware, clearing the protection action signals and fault records in the microcomputer protection hardware, clearing the interface waveforms and event records, and restoring all controls to their initial state. Scenario repetition can be achieved by saving test parameters as scenario files. Scenario files contain parameters such as fault type, fault time, setting group number, and trigger conditions. After loading the scenario file, the exact same test conditions can be repeated multiple times.

[0057] The topology visualization module is a graphical display module in the human-machine interface (HMI) used to display the main wiring and circuit breaker status of the primary system. This module uses graphic symbols to show the connection relationships of generators, step-up transformers, busbars, transmission lines, and circuit breakers, and updates the display status of the graphic symbols based on the circuit breaker opening and closing status signals read from the real-time simulator. The real-time oscilloscope display module is a data acquisition and display module in the HMI used to display waveforms of key electrical quantities. This module acquires electrical quantity data such as voltage, current, power, and frequency from the real-time simulator via Ethernet, displays it in real-time as waveform graphs, and supports marking fault times on the waveform graphs. The programmable fault injection and time-stamped recording module is a control module in the HMI used to issue fault commands and record fault-related times. Operators use this module to select the fault type and fault parameters and issue them to the real-time simulator. Simultaneously, a high-precision system clock records the fault injection time, protection activation time, and trip command issuance time. The Action Event and Trip Link Retrospective Module is an analysis module within the human-machine interface used to record and analyze trip events. This module collects trip signals from each circuit breaker from the real-time simulator, generates a trip link diagram and retrospective report in chronological order, and is used for post-event analysis of the timing and coordination of protection actions. Setting Group Switching refers to issuing commands through the human-machine interface to the microcomputer protection hardware to switch one of multiple pre-stored setting value combinations to the currently used setting value, used to verify the protection action performance under different protection settings. One-Click Test Reset refers to sending reset and reset commands simultaneously to the real-time simulator and microcomputer protection hardware through the human-machine interface, restoring all electrical quantities in the electromagnetic transient model to their initial state, clearing protection action signals and fault records in the microcomputer protection hardware, and restoring the interface display to its initial state. Scenario Repeated Run refers to saving test parameters as a scenario file; after loading this scenario file, the same test conditions can be run multiple times to verify the consistency and repeatability of protection actions.

[0058] It also includes a second simulated circuit breaker, which corresponds to the circuit breaker in this bay of the power plant's primary system. The second simulated circuit breaker is used to receive and execute trip commands issued by the microcomputer protection hardware and forwarded by the real-time simulator, and to feed back the open / close status signal of the second simulated circuit breaker to the real-time simulator. The specific implementation process is as follows: 1) When the microprocessor-based protection hardware detects a system fault and meets the protection criteria, it issues a trip command through its digital output interface. This trip command is a DC voltage-based switch signal, transmitted via a shielded cable to the digital input interface of the real-time emulator. Upon receiving the trip command, the digital input interface of the digital signal card converts the switch signal into a logic level signal recognizable by the multi-core CPU, and transmits the converted trip command signal to the multi-core CPU via the system bus. Upon receiving the trip command, the multi-core CPU transmits it to the digital signal card via the system bus. The output circuit of the digital signal card converts the trip command into a DC voltage-based switch signal and sends it via a shielded cable to the digital input interface of the second analog circuit breaker. Upon receiving the switch signal, the input circuit of the second analog circuit breaker transmits the signal to its internal control logic circuit.

[0059] 2) Upon receiving a trip command, the control logic circuit inside the second simulated circuit breaker energizes the electromagnetic coil. The energized coil generates electromagnetic force, which actuates the mechanical linkage mechanism inside the second simulated circuit breaker, causing the moving contact to separate from the stationary contact, thus completing the tripping operation. The tripping operation of the second simulated circuit breaker simulates the physical tripping process of the circuit breaker in this bay upon receiving a trip command. Its tripping time is set by internal circuit parameters to a value consistent with the rated breaking time of the actual circuit breaker.

[0060] 3) The second analog circuit breaker has an auxiliary contact that is mechanically linked to the moving contact. When the second analog circuit breaker is in the closed position, the auxiliary contact closes, outputting a DC voltage signal indicating the closed state to the digital input interface of the digital signal transceiver. When the second analog circuit breaker performs an opening operation and is in the open position, the auxiliary contact opens, outputting a DC voltage signal indicating the open state to the digital input interface of the digital signal transceiver. This open / close state signal is transmitted to the digital input interface of the digital signal transceiver via a shielded cable. The input circuit inside the digital signal transceiver converts the switch signal into a logic level signal that can be recognized by the multi-core CPU and transmits it to the multi-core CPU via the system bus. Based on the open / close state signal fed back by the second analog circuit breaker, the multi-core CPU updates the open / close position state of the corresponding circuit breaker in the electromagnetic transient model, keeping the circuit breaker state in the electromagnetic transient model synchronized with the actual physical state of the second analog circuit breaker.

[0061] The first and second simulated circuit breakers are electrical devices used to simulate the opening and closing operations of adjacent line circuit breakers or bus-side circuit breakers and circuit breakers in the primary system of a power plant. They have identical internal structures, both including digital input interfaces, digital output interfaces, electromagnetic coils, mechanical linkage mechanisms, and auxiliary contacts. The first simulated circuit breaker receives backup trip commands generated by a multi-core central processing unit through its digital input interface, performs the opening operation through its electromagnetic coil and mechanical linkage mechanism, and feeds back the opening / closing status signal indicating the position to the real-time simulator through its auxiliary contacts. The second simulated circuit breaker receives trip commands issued by the microcomputer protection hardware and relayed through the real-time simulator through its digital input interface, performs the opening operation through its electromagnetic coil and mechanical linkage mechanism, and feeds back the opening / closing status signal indicating the position to the real-time simulator through its auxiliary contacts. Both the first and second simulated circuit breakers can be devices of models MD-H2, GMDL-02, PRS-101M, PRS-102M, or PRS-1010M.

[0062] Optionally, the above technical solution also includes a power amplifier connected between the real-time emulator and the microcomputer protection hardware. The analog signal output by the real-time emulator is amplified by the power amplifier before being output to the microcomputer protection hardware. The power amplifier is connected between the real-time emulator and the microcomputer protection hardware. The analog signal card of the real-time emulator is connected to the input terminal of the power amplifier via a shielded cable, and the output terminal of the power amplifier is connected to the current input terminal and voltage input terminal of the microcomputer protection hardware via a shielded cable. The analog signal output by the analog signal card of the real-time emulator first enters the power amplifier, is amplified by the power amplifier, and is then output to the microcomputer protection hardware. The specific implementation process is as follows: 1) The power amplifier receives analog signals output from the real-time simulator. After the multi-core CPU in the real-time simulator completes the real-time calculation of the electromagnetic transient model, it transmits the obtained voltage and current signal data to the analog signal card via the system bus. The analog signal card's internal digital-to-analog converter converts the digital voltage and current signal data into continuous analog voltage and current signals. The analog signal card then sends the analog signals to the input of the power amplifier via a shielded cable through its analog output interface.

[0063] 2) The power amplifier boosts the amplitude of analog signals. Internally, the power amplifier contains multiple independent amplification channels, corresponding to voltage amplification and current amplification respectively. The voltage amplification channel is used to increase the amplitude of the voltage signal, and the current amplification channel is used to increase the amplitude of the current signal. The power amplifier amplifies the input analog signal according to a preset amplification factor, so that the amplitudes of the output voltage and output current reach the standard secondary values ​​that match the input range of the microprocessor-based protection hardware. The amplitude of the voltage signal is typically amplified to the standard secondary voltage value, and the amplitude of the current signal is typically amplified to the standard secondary current value.

[0064] 3) The power amplifier outputs the amplified analog signal to the microprocessor-based protection hardware. After amplification, the power amplifier transmits the amplified voltage and current signals via shielded cables to the voltage and current input terminals of the microprocessor-based protection hardware, respectively. Upon receiving the amplified voltage and current signals, the microprocessor-based protection hardware executes protection criteria based on these signals.

[0065] The verification of relay protection in nuclear power plants is constrained by on-site conditions and costs, making it difficult to conduct full-scenario tests. To address the issues of high hardware investment and insufficient real-time performance in existing platforms, this invention constructs a virtual-physical hybrid hardware-in-the-loop test platform and its testing method based on a real-time simulator. The platform uses graphical modeling and simulation software to build a circuit breaker failure protection control logic model, and microcomputer-based protection hardware undertakes the protection functions of generators, transformers, busbars, short leads, and lines, forming a collaborative architecture of "virtualized failure protection and physical main protection." Based on a 500kV step-up access system primary model and typical fault injection, tests were conducted on single-phase grounding faults and single-phase reclosing of transmission lines. Results show that the platform can achieve coordination between virtual and physical protection, with correct action, good selectivity and coordination, and repeatable testing. Simultaneously, it reduces the investment in hardware such as power amplifiers and improves the efficiency of scheme iteration and setting optimization. The platform provides an economical and sustainable engineering testing environment for nuclear power plant relay protection strategy verification, device performance evaluation, and personnel training.

[0066] Example 1: As Figure 1As shown, the platform includes a first host computer, a second host computer, a real-time simulator, a first simulated circuit breaker, a second simulated circuit breaker, and microcomputer protection hardware. Both the first and second host computers are connected to the real-time simulator. The real-time simulator is connected to the power amplifier and the simulated circuit breaker, which in turn are connected to the microcomputer protection hardware. The first host computer is used to build an electromagnetic transient model of the nuclear power plant's primary system and implement the circuit breaker failure protection control logic strategy. This logic is compiled into executable C code using an automatic code generation tool and then downloaded to the real-time simulator for execution. The second host computer is equipped with graphical programming software for measurement and control development, serving as a human-machine interface and monitoring interface for parameter setting, fault injection, status monitoring, and protection action analysis. The second simulated circuit breaker corresponds to the circuit breaker in the same bay of the power plant's primary system. It receives and executes trip commands issued by the microcomputer protection hardware and relayed through the real-time simulator, and feeds back the opening and closing status signals of the second simulated circuit breaker to the real-time simulator. The first simulated circuit breaker corresponds to the adjacent line circuit breaker or bus-side circuit breaker in the primary system of the power plant. It is used to receive and execute backup trip commands generated by the multi-core central processing unit and to feed back the opening and closing status signals of the first simulated circuit breaker to the real-time simulator. The microcomputer protection hardware includes generator protection devices, transformer protection devices, bus protection devices, short lead protection devices, and line protection devices. A virtual-real hybrid nuclear power plant microcomputer protection hardware-in-the-loop test platform based on a real-time simulator is proposed. Specifically, the circuit breaker failure protection is modeled and implemented as a circuit breaker failure protection control logic model in the standard components of the graphical modeling simulation software, while the main protection of generators, transformers, buses, short leads, and lines adopts microcomputer protection hardware. The microcomputer protection hardware can be selected from models such as PCS-985G, PCS-985T, PCS-915-N, PCS-922-N, and PCS-931-N. The two are coupled at the electrical quantity and input / output level through a real-time simulator, thereby achieving the goals of "virtualization of critical backup logic" and "on-site verification of main protection" with lower hardware investment. The strategy reduces the investment and debugging costs of equipment such as power amplifiers, realizes real-time simulation of faults in all scenarios of nuclear power plants, provides a cost-effective and scalable solution for protection action verification, strategy optimization and personnel training, and also provides a new path for the independent development of virtual-real fusion testing platforms in the nuclear power field.

[0067] The first host computer runs the standard component primary system and virtual protection logic using graphical modeling and simulation software, while the second host computer provides the monitoring and interactive interface. In terms of platform hardware and software design, the first host computer deploys graphical modeling and simulation software to build the electromagnetic transient model of the nuclear power plant's primary system and implement the circuit breaker failure protection control logic strategy. This is compiled into executable C code using an automatic code generation tool and finally downloaded to the real-time simulator for system-level real-time simulation and interaction with external signals. The second host computer deploys graphical programming measurement and control development software as the human-machine interface and monitoring interface. The platform provides functions such as parameter setting, fault injection, status monitoring, and protection action analysis. The graphical interface and modular backend design improve operational convenience and system visualization, serving as a support tool for training and research.

[0068] Figure 1The platform also fully demonstrates the components and the flow of data and control signals between them. The first host computer deploys graphical modeling and simulation software to build the electromagnetic transient model of the power plant's primary system and the circuit breaker failure protection control logic model. After the model is built, it is compiled into executable C code using an automatic code generation tool and downloaded to a real-time simulator (e.g., a UREP300 real-time simulator) via Ethernet communication protocol. The second host computer deploys graphical programming measurement and control development software, serving as the human-machine interface and monitoring interface. It connects to the real-time simulator via Ethernet communication protocol and is used to send control commands and monitoring signals to the real-time simulator, enabling parameter setting, fault injection, status monitoring, and protection action analysis. The real-time simulator integrates a multi-core CPU and a high-speed scheduler. The multi-core CPU performs real-time calculations on the compiled electromagnetic transient model and the circuit breaker failure protection control logic model downloaded to the real-time simulator. The real-time simulator has multiple real-time tasks for parallel processing of electromagnetic transient real-time calculations, analog signal output, digital signal acquisition, and control command issuance. After completing the real-time electromagnetic transient calculation, the real-time simulator obtains an analog signal, which is then sent to a power amplifier via a shielded cable through the analog output interface for amplitude amplification. The power amplifier outputs the amplified analog signal via the shielded cable to the current and voltage input terminals of the microprocessor-based protection hardware. The microprocessor-based protection hardware executes protection criteria based on the received analog signal. When the protection action conditions are met, it outputs a trip command via a digital output interface, which is transmitted to the digital input interface of the real-time simulator via the shielded cable. The circuit breaker failure protection control logic model inside the real-time simulator determines whether the circuit breaker in this bay has failed to operate based on the trip command. If failure to operate is determined, a backup trip command is generated. The backup trip command is sent to the first analog circuit breaker via the digital output interface. The first analog circuit breaker receives and executes the backup trip command to complete the tripping operation and disconnect the fault area. Simultaneously, it feeds back the open / closed status signal to the real-time simulator via the digital output interface. The real-time simulator updates the open / closed position status of the corresponding circuit breaker in the electromagnetic transient model based on this open / closed status signal. The second host computer collects key electrical quantity data and circuit breaker opening / closing status signals from the real-time simulator via Ethernet port and displays them in real time on the human-machine interface. The second host computer also sends fault injection commands to the real-time simulator via Ethernet port. Upon receiving the fault command, the real-time simulator triggers the fault module at the corresponding node in the electromagnetic transient model. The second host computer collects tripping signals of each circuit breaker from the real-time simulator via Ethernet port and generates a tripping link diagram and a retrospective report in chronological order. The real-time simulator exchanges data bidirectionally with the first and second host computers via Ethernet port, receiving compiled model files and fault commands, while simultaneously transmitting back electrical quantity calculation results, circuit breaker opening / closing status signals, and tripping signals.The microcomputer protection hardware and the real-time simulator form a bidirectional coupling channel through analog and digital signals to realize the real-time exchange of electrical quantities and control commands.

[0069] like Figure 2 As shown, the real-time simulator, as the core of the platform, possesses a multi-core parallel computing architecture, and its performance indicators have reached and exceeded the level of mainstream international real-time simulation technologies, supporting the real-time operation of large-scale electromagnetic transient models. The real-time simulator is equipped with multiple interfaces, including digital signal cards, analog signal cards, and a USB interface. The real-time simulator connects to the first host computer through input / output interfaces to realize parameter configuration, command issuance, and result feedback for simulation tasks. Simultaneously, it utilizes digital and analog interfaces to collect the voltage, current, and switching status of the primary system and injects signals into the microcomputer protection hardware, realizing dynamic interaction between the real-time simulator and the actual device. In the secondary system configuration, the circuit breaker failure protection control logic model runs in the standard components of the graphical modeling simulation software, primarily undertaking the circuit breaker failure protection function. The actual device consists of a PCS-985G generator protection device, a PCS-985T transformer protection device, a PCS-915-N bus protection device, a PCS-922-N short lead protection device, and a PCS-931-N line protection device. Both are directly interconnected with the real-time simulator to realize the control link of power acquisition, protection criteria, trip signal, and simulator feedback, ensuring the authenticity and verifiability of the protection logic.

[0070] Figure 2This section demonstrates the composition and interconnections of the various hardware modules within the real-time simulator. The simulator connects all hardware boards via a system bus, enabling data exchange and instruction transmission. The system bus includes data lines, address lines, and control lines. The multi-core CPU is the core of the real-time simulator, integrating multiple processing cores. Each core can independently execute calculations for the electromagnetic transient model and the circuit breaker failure protection control logic model. The multi-core CPU is connected to program memory and data memory via the system bus. Program memory stores the executable files of the electromagnetic transient model and the circuit breaker failure protection control logic model, compiled by the host computer and sent to the real-time simulator. Data memory stores the calculation results generated by the multi-core CPU during real-time calculations, such as voltage values, current values, and the circuit breaker's open / closed position. The timer card connects to the multi-core CPU via the system bus. Internally, it contains a high-precision crystal oscillator and clock signal distribution circuitry to provide a unified time reference signal to the CPU, coordinating the time steps of each task and ensuring that all tasks in the real-time simulator operate under strictly synchronized timing. The digital quantity card also connects to the CPU via the system bus. Its panel features digital input and digital output (DI / DO) interfaces. The digital input interface connects to the digital output interface of the microprocessor-based protection hardware via a shielded cable to receive trip command signals from the hardware. The digital output interface connects to the digital input interface of the first analog circuit breaker via a shielded cable to send backup trip commands generated by the CPU. The analog quantity card connects to the CPU via the system bus. Its panel features analog output interfaces. Internally, it contains a digital-to-analog converter (DAC) to convert the digital analog signals calculated by the CPU into continuous analog voltage or current signals, which are then sent to the power amplifier via a shielded cable through the analog output interface. The analog input card also features an analog input interface on its front panel for acquiring external signals. The high-speed network card connects to the multi-core CPU via the system bus. Its front panel includes an Ethernet interface (RJ45), used to establish communication connections with both the first and second host computers. This allows it to receive executable files of the compiled electromagnetic transient model and circuit breaker failure protection control logic model from the first host computer, as well as fault injection and parameter setting commands from the second host computer. Simultaneously, it transmits electrical quantity calculation data and circuit breaker open / close status signals back to the second host computer's human-machine interface. The real-time simulator also includes a USB interface for connecting to external devices via a universal serial bus, enabling model debugging and data export. Furthermore, the real-time simulator is equipped with a fiber optic interface and an SC connector for high-speed data communication with external devices via fiber optic cable.The real-time emulator is also equipped with a VGA interface circuit and a VGA interface for connecting display devices to enable the local display output function of the real-time emulator.

[0071] like Figure 3 As shown, an electromagnetic transient model of the primary system of a 500kV step-up substation in a nuclear power plant was built in the simulation environment of a graphical modeling and simulation software. This model includes the generator, step-up transformer, busbar, and transmission lines. To balance engineering realism and real-time simulation efficiency, a generator rated capacity of 1000MVA and a stator voltage of 24kV were selected. The main transformer has a capacity of 1200MVA, a voltage level of 24 / 500kV, a connection group of YNd11, and a short-circuit impedance of approximately 16%. The transmission line is a single-circuit 200km overhead line with a rated voltage of 500kV, and the positive sequence impedance is taken as... The zero-sequence impedance is approximately three times that of the positive-sequence impedance, and parallel reactors are configured to suppress reactive power charging over long lines. The transformer parameters are scaled down according to commonly used engineering ratios to ensure that the simulation output matches the secondary range of the microcomputer protection hardware, thereby achieving platform repeatability and engineering comparability. To simulate various possible fault conditions in the primary system of a nuclear power plant, fault modules are configured at corresponding nodes in the electromagnetic transient model of the primary system, referencing the distribution locations of typical faults in actual nuclear power plant operation, including generator and outlet areas, main transformer and plant service transformer areas, high-voltage distribution equipment and transmission lines, plant service power systems, excitation and reactive power compensation systems, and nuclear island-related electrical interfaces. These fault modules can simulate various types of fault scenarios, including single-phase ground faults, two-phase-to-phase short-circuit faults, two-phase-to-ground short-circuit faults, three-phase short-circuit faults, open-circuit faults, and equivalent faults related to switch operations, providing support for subsequent in-depth research on the response and protection strategies of the primary system of a nuclear power plant under fault conditions.

[0072] Figure 3The diagram illustrates the main electrical wiring configuration of the primary system of the 500kV step-up substation. The generator (a synchronous generator) is connected to the first 500kV busbar (500kV busbar 1) via a first step-up transformer (10kV / 500kV transformer) and a first circuit breaker BRK1. Simultaneously, the generator is connected to the second 500kV busbar (500kV busbar 2) via a second step-up transformer (10kV / 500kV transformer) and a second circuit breaker BRK2. The generator is a 1000MVA nuclear power unit generator. Both the first and second step-up transformers have a rated capacity of 1200MVA, a voltage level of 24kV / 500kV, a connection group of YNd11, and a short-circuit impedance of approximately 16%, used to step up the generator's output voltage from 24kV to the 500kV transmission level. The first and second 500kV busbars serve as electrical connection points, responsible for collecting and distributing electrical energy. The two busbars are interconnected through multiple circuit breakers to form a complete main electrical circuit. Circuit breakers 5011 (third), 5012 (fourth), and 5021 (fifth) are installed on the first 500kV busbar, while circuit breakers 5022 (sixth), 5031 (seventh), and 5032 (eighth) are installed on the second 500kV busbar. These circuit breakers form a 3 / 2 connection configuration, with each outgoing line controlled by two circuit breakers, improving power supply reliability and operational flexibility. The branch between the seventh circuit breaker 5031 and the eighth circuit breaker 5032 is connected to the external power grid (external system). The branch between the fifth circuit breaker 5021 and the sixth circuit breaker 5022 is connected to the external power grid. The branch between the third circuit breaker 5011 and the fourth circuit breaker 5012 is connected to the first 500kV busbar and the second 500kV busbar through the third circuit breaker BRK3. The first circuit breaker BRK1 and the second circuit breaker BRK2 are respectively connected to the generator output side and the two 500kV busbars. The fourth circuit breaker BRK4 is located between the first step-up transformer and the first 500kV busbar. In the electromagnetic transient model, fault modules are configured at each key node to simulate single-phase grounding faults, two-phase-to-phase short-circuit faults, two-phase-to-ground short-circuit faults, three-phase short-circuit faults, open-circuit faults, and equivalent faults related to switch operation. These fault modules are arranged at corresponding nodes such as generator outlets, transformer sides, busbar nodes, and transmission lines, according to the distribution locations of typical faults in actual nuclear power plant operation, to simulate power system faults of different locations and types. Each circuit breaker on the first and second 500kV busbars corresponds one-to-one with the first and second simulated circuit breakers, respectively. Among them, the seventh circuit breaker 5031 is simulated by the second simulated circuit breaker as the circuit breaker of this bay, while the fifth circuit breaker 5021 and the eighth circuit breaker 5032 are simulated by the first simulated circuit breaker as adjacent line circuit breakers. This is used to verify the correctness of the operation of the circuit breaker failure protection control logic model and the selectivity of protection coordination in the platform test.

[0073] like Figure 4 As shown, a circuit breaker failure protection control logic model is built using standard components from graphical modeling and simulation software. The judgment criteria employ a parallel approach of current monitoring and circuit breaker position signals. Upon receiving a trip command from the microprocessor-based protection hardware, a timer module is activated, with the set time recorded as [time value missing]. If the current remains above the operating threshold within the set time, or if the circuit breaker position signal does not change, the circuit breaker is deemed to have failed to operate, and a backup trip command is issued. The set time is generally between 80ms and 120ms, including the circuit breaker's rated breaking time, the tripping circuit delay, and the current transformer's saturation recovery margin. The circuit breaker failure protection control logic model is built using standard components from graphical modeling and simulation software. The actual installation uses NARI Group Corporation's PCS series microcomputer protection hardware to construct the protection system. Line protection uses the PCS-931-N model, protecting 500kV outgoing lines, with main protection functions including distance protection, differential protection, zero-sequence overcurrent protection, and single-phase reclosing. Busbar protection uses the PCS-915-N model, protecting the substation busbar and dead zone area, with main protection functions including dual differential protection and instantaneous overcurrent protection. The transformer protection uses the PCS-985T model, protecting the 24 / 500kV main transformer. Its main protection functions include ratio differential protection, overcurrent protection, gas protection, and overload protection. The generator protection uses the PCS-985G model, protecting the 1000MVA nuclear power unit generator. Its main protection functions include stator differential protection, overcurrent protection, negative sequence protection, loss of excitation, over-excitation protection, undervoltage protection, and underfrequency protection. The short-lead protection uses the PCS-922-N model, protecting the cable between the generator and the main transformer short lead section, and between the 3 / 2 connection busbar circuit breaker and the line circuit breaker. Its main protection functions include differential protection and overcurrent protection. Through the above interconnection method, all installed microcomputer protection hardware is connected to the simulator and the circuit breaker failure protection control logic model. When the circuit breaker in this bay fails to operate and the current is not extinguished, the circuit breaker failure protection control logic model is activated and sets a timer. The first simulated circuit breaker then sends a backup trip command to the adjacent line circuit breaker or the bus-side circuit breaker. The second simulated circuit breaker receives and executes the trip command issued by the microcomputer protection hardware and relayed through the real-time simulator. The electromagnetic transient model of the primary system and the circuit breaker failure protection control logic model are automatically generated and downloaded to the real-time simulator for execution.

[0074] The complete protection action process from fault occurrence to fault clearing or intervention of the circuit breaker failure protection control logic model is as follows: When a fault occurs in the primary system of the power plant, the microcomputer protection hardware executes protection criteria based on the received analog signals. After the protection action conditions are met, a trip command is issued. This trip command is transmitted through the digital output interface to the digital input interface of the real-time simulator via a shielded cable. The real-time simulator transmits the trip command to the second analog circuit breaker, which performs an opening operation to clear the fault. Simultaneously, after the real-time simulator receives the trip command, the circuit breaker failure protection control logic model (BFP) starts a timer module to begin timing, entering the circuit breaker failure monitoring step. The current monitoring module continuously monitors whether the current value in the circuit where the circuit breaker in this bay is located exceeds a preset threshold, and the position signal monitoring module detects whether the position of the circuit breaker in this bay has changed based on the opening / closing status signal fed back by the second analog circuit breaker. When the circuit breaker in this bay completes the tripping operation within the set time and the current drops below the preset threshold, and the position status has changed, the circuit breaker failure protection control logic model determines that the circuit breaker in this bay is operating normally. At this time, the fault is cleared, the process ends, and the circuit breaker failure protection control logic model does not generate a backup trip command. When the circuit breaker in this bay fails to complete the tripping operation within the set time and the current is still higher than the preset threshold or the position status has not changed, the circuit breaker failure protection control logic model determines that the fault is not cleared, and the circuit breaker failure determination is executed, confirming that the circuit breaker in this bay has failed to operate. The circuit breaker failure protection control logic model then generates a backup trip command and sends it to the first analog circuit breaker through the digital output interface of the digital quantity card, realizing the issuance of backup trip commands to adjacent line circuit breakers or bus-side circuit breakers. After receiving and executing the backup trip command, the first analog circuit breaker performs a tripping operation, completing the operation of tripping the adjacent circuit breaker, and finally realizing the fault clearing.

[0075] like Figure 4As shown, the test platform is built around a real-time simulator, employing a hybrid virtual-real approach to form a hardware-in-the-loop system with both electromagnetic transient modeling capabilities and realistic protection response capabilities. The platform is functionally divided into two subsystems: a "virtual" subsystem and a "real" subsystem, responsible for power system modeling and simulation, and realistic protection response, respectively. The virtual system consists of a primary system electromagnetic transient model and a circuit breaker failure protection control logic model. After being built in the simulation environment of the graphical modeling and simulation software, the models are automatically generated and downloaded to the real-time simulator for execution. The real system uses the same NARI PCS series microcomputer protection hardware as used in the engineering field. Through the real-time simulator, a bidirectional coupling channel between analog and digital signals is established between the primary system and secondary equipment, enabling real-time exchange of electrical quantities and control commands. The device side possesses complete start-up criteria, action logic, and output loop links, capable of responding to disturbances in the primary system in a manner consistent with the field, and injecting control quantities such as tripping and blocking back into the simulation model, thereby ensuring the engineering authenticity and verifiability of the test process. The proposed solution places the circuit breaker failure protection control logic model, which is closely integrated with the entire station and most sensitive to channel and hardware resources, in a virtual environment. This reduces the number of secondary injection channels and power amplifiers while retaining the device-level operating characteristics and criteria implementation of each main protection device. This achieves a balance between hardware investment, realism, and scalability. The platform utilizes a hardware-software collaborative approach, enabling the circuit breaker failure protection control logic model and the microcomputer-based protection hardware to operate collaboratively according to functional zones. Figure 5 As shown, a virtual-real complementary relay protection test environment was constructed.

[0076] Figure 4 This is a schematic diagram of a bidirectional coupling channel between analog and digital signals. Figure 4The document demonstrates the signal interaction between various microprocessor-based protection hardware devices and the primary system of a power plant, established through a real-time simulator. The generator protection device (model PCS-985G) receives analog signals of three-phase voltage and current from the generator terminals via an analog channel from the real-time simulator. It executes stator differential protection criteria, overcurrent protection criteria, negative sequence protection criteria, loss of excitation protection criteria, over-excitation protection criteria, undervoltage protection criteria, and underfrequency protection criteria. When the conditions are met, it outputs a trip command to the real-time simulator via a digital channel. The transformer protection device (model PCS-985T) receives analog signals of three-phase voltage and current from each side of the transformer via an analog channel from the real-time simulator. It executes ratio differential protection criteria, overcurrent protection criteria, gas protection criteria, and overload protection criteria. When the conditions are met, it outputs a trip command to the real-time simulator via a digital channel. The short-lead protection device (model PCS-922-N) receives three-phase current analog signals from the short-lead section from the real-time simulator via an analog channel, executes differential protection criteria and overcurrent protection criteria, and outputs a trip command to the real-time simulator via a digital channel when the conditions are met. The bus protection device (model PCS-915-N) receives three-phase current analog signals from each connected branch of the bus via an analog channel from the real-time simulator, executes dual differential protection criteria and instantaneous overcurrent protection criteria, and outputs a trip command to the real-time simulator via a digital channel when the conditions are met. The line protection device (model PCS-931-N) receives three-phase voltage and three-phase current analog signals from the start and end of the line via an analog channel from the real-time simulator, executes distance protection criteria, differential protection criteria, zero-sequence overcurrent protection criteria, and single-phase reclosing logic, and outputs a trip command to the real-time simulator via a digital channel when the conditions are met. The power plant's primary system consists of two 500kV busbars. Circuit breakers BRK1 and BRK2 connect the generator outgoing line to the two 500kV busbars, respectively. Circuit breakers BRK3 and BRK4 connect the step-up transformer to the two 500kV busbars, respectively. The real-time simulator sends analog signals to the current and voltage input terminals of each protection device via its analog output interface. Each protection device returns trip command digital signals to the real-time simulator's digital input interface via its digital output interface. This forms a bidirectional coupling channel between analog and digital signals, enabling real-time exchange of electrical quantities and control commands.

[0077] Figure 5The physical connections and signal flows between the various hardware devices on the platform are demonstrated. The first host computer contains graphical modeling and simulation software used to build electromagnetic transient models of the power plant's primary system and circuit breaker failure protection control logic models. After the models are built, they are compiled into executable C code using an automatic code generation tool and downloaded to the real-time simulator via an Ethernet interface using the Ethernet communication protocol. The second host computer contains graphical programming measurement and control development software used to build a human-machine interface. It connects to the real-time simulator via an Ethernet interface using the Ethernet communication protocol to realize parameter setting, fault injection, status monitoring, and protection action analysis functions. The real-time simulator, as the core computing and signal interaction device of the platform, outputs analog signals to the power amplifier through an analog output interface. The analog signals include voltage and current signals, corresponding to the secondary quantities of the current transformer and voltage transformer. The power amplifier amplifies the received analog signals and outputs the amplified analog signals via shielded cables to the current and voltage input terminals of the microcomputer protection hardware. The microprocessor-based protection hardware executes protection criteria based on the received analog signals. When the protection action conditions are met, it issues a trip command through its digital output interface. This trip command is transmitted via a shielded cable to the digital input interface of the real-time simulator, corresponding to the digital input signal in the diagram. The circuit breaker failure protection control logic model inside the real-time simulator determines whether the circuit breaker in this bay has failed to operate based on the trip command. If failure to operate is determined, a backup trip command is generated. This backup trip command is sent to the first analog circuit breaker via the digital output interface of the real-time simulator, corresponding to the digital output signal in the diagram. The first analog circuit breaker receives and executes the backup trip command to complete the tripping operation. The first analog circuit breaker feeds back its open / closed status signal to the real-time simulator through its digital output interface, corresponding to the digital input signal in the diagram. The real-time simulator updates the open / closed position of the corresponding circuit breaker in the electromagnetic transient model based on this status signal. The real-time simulator transmits key electrical quantity data and circuit breaker opening / closing status signals back to the human-machine interface of the second host computer for real-time display via an Ethernet interface. It also receives fault injection commands and parameter setting commands from the second host computer via the Ethernet interface. Throughout the platform, analog signals flow from the real-time simulator to the power amplifier and microprocessor-based protection hardware; trip commands flow from the microprocessor-based protection hardware to the real-time simulator; backup trip commands flow from the real-time simulator to the first analog circuit breaker; and opening / closing status signals flow from the first analog circuit breaker to the real-time simulator. Ethernet communication flows bidirectionally between the real-time simulator and the first and second host computers, forming a complete hardware-in-the-loop test closed-loop connection.

[0078] The simulation process is as follows: After the first host computer completes the construction of the primary system and circuit breaker failure protection control logic model and downloads it to the real-time simulator, the real-time simulator performs real-time electromagnetic transient calculations according to the set step size and outputs the corresponding voltage and current analog quantities. The real-time simulator uses a power amplifier to derating the voltage to meet the amplitude requirements of the secondary quantities of the current transformer and voltage transformer in the actual device, driving the current input and voltage input terminals of the microprocessor protection hardware respectively. The microprocessor protection hardware executes distance, differential, and zero-sequence criteria based on the sampled quantities, including impedance criteria, Kirchhoff current criteria, and zero-sequence protection criteria. When the conditions are met, it returns to the digital input interface of the real-time simulator through the trip output, driving the circuit breaker state change in the platform. If the main protection has tripped and the circuit breaker has not completed the interruption within the setting time limit, the circuit breaker failure protection control logic model embedded in the real-time simulator immediately intervenes. Under the protection control logic strategy framework, after determining the failure to operate, it issues a backup disconnection command to the adjacent circuit breaker and interlocks with the single-phase reclosing of the high-voltage transmission line. The circuit breaker failure protection control logic model's operation blocks reclosing; successful reclosing automatically resets the circuit, while failure escalates to three-phase disconnection, thus forming an end-to-end control chain. Power injection, device discrimination, control output, and primary model feedback operate coupled within a unified timescale, ensuring dynamic consistency and verifiable protection coordination throughout the fault process. The platform achieves coordination between the circuit breaker failure protection control logic model and the main protection of the entire station, preserving device-level operational characteristics while enabling repeatable and quantifiable verification of station-level logic such as cross-device coordination, failure backup, and reclosing interlocking.

[0079] To enhance test interactivity and training usability, a nuclear power plant monitoring system was built on a second host computer using graphical programming-based measurement and control development software. The test methodology also includes this nuclear power plant monitoring system built on the second host computer using graphical programming-based measurement and control development software. The system features a unified human-machine interface (HMI) that integrates the modeling, injection, and evaluation processes. The HMI integrates a topology visualization module for the main wiring of the primary system and the open / closed status signals of each circuit breaker in the primary system, a real-time oscilloscope display module for key electrical quantities, a programmable fault injection and time-stamped recording module, and an action event and trip link backtracking module. It also supports setting group switching, one-click test reset, and scenario repetition. Key electrical quantities include bus voltages at each voltage level, three-phase currents of each component, system frequency, active power, reactive power, power factor, generator stator voltage and current, excitation voltage and current, electrical quantities and oil temperature on each side of the main transformer and station service transformer, high-voltage outgoing line power flow, station service voltage and current, as well as switch quantities such as circuit breaker position, disconnector position, and protection action signals.

[0080] The implementation method of the topology visualization module is as follows: The main wiring diagram of the primary system is drawn on the front panel of the graphically programmed measurement and control development software. Device relationships are defined based on Extensible Markup Language (EXPLAIN) or comma-separated value configuration files to achieve topology linkage. Digital signals indicating the opening and closing status of circuit breakers and disconnectors are read from the real-time simulator, or the status is acquired from the trip position signals fed back by the microcomputer protection hardware. The interface is refreshed using a 50-microsecond polling trigger plus interrupt trigger method; refreshes every 50 microseconds under normal conditions, and immediately upon fault or change, ensuring real-time performance. The implementation method of the real-time oscilloscope display module is as follows: Key electrical quantities, including voltage, current, power, and frequency, are acquired from the analog signal output of the real-time simulator and via Ethernet. The sampling rate is set to 1kHz, and the acquired data is imported into a comma-separated value format file to annotate the fault time. The implementation method of the programmable fault injection and time-stamping recording module is as follows: The fault type is set, and a trigger signal is sent to the fault injection unit of the real-time simulator through the digital output module of the graphically programmed measurement and control development software. Fault commands are issued via Ethernet, and a high-precision system clock with 1 millisecond accuracy is used to record the fault injection time, protection start time, and circuit breaker trip time. The implementation method of the action event and trip link backtracking module is as follows: Circuit breaker trip signals are collected from the real-time simulator, a trip link diagram is generated in chronological order, and a backtracking report is generated. The implementation methods of setting group switching, one-click test reset, and scenario repetition are as follows: Setting group switching commands are sent to the microcomputer protection hardware through graphical programming measurement and control development software. A reset command is sent to the real-time simulator to restore the system to its initial test state. A reset command is sent to the microcomputer protection hardware to clear protection action signals and fault records. The interface waveforms and event records are cleared, and all controls are restored to their initial state. Test parameters are saved as a scenario file, including fault type, fault time, setting group number, trigger conditions, etc. After loading the scenario file, the same scenario can be run multiple times. This allows for multiple rounds of comparative experiments and sensitivity analysis without changing the simulation conditions, enhancing the repeatability and interpretability of the results. It also meets the requirements of teaching and training for strong visibility, easy reproducibility, and rapid iteration, forming a full-scenario testing environment covering modeling, injection, response, and evaluation. The system integrates observation, control, and learning, responding to the needs of interactive training and enhancing the relevance and systematic nature of the training.

[0081] The following typical test cases and results analysis are presented to illustrate the beneficial effects of this technical solution. To verify the virtual-real interaction and coordination relationship under the architecture of "main protection actual installation—circuit breaker failure protection control logic model virtual", a 500kV substation primary system model was constructed on a real-time simulator. Secondary quantities equivalent to current transformers and voltage transformers were output through a power amplification unit and injected into the actual installation devices such as line protection devices. The test uniformly adopted a phase-B ground fault at 20% of the starting point of the sending line. The fault injection time was recorded as... The line protection phase selection is based on a comprehensive criterion of negative sequence and zero sequence, with single-phase tripping and single-phase reclosing enabled. The circuit breaker failure protection control logic model is implemented using standard components of graphical modeling and simulation software and embedded in the simulator, triggering a "trip start" signal. The criterion uses a parallel approach of current monitoring and circuit breaker position signals, with typical time delay settings. Current threshold ,in, The rated current of the protected line. Reclosing dead time. The single-phase closing pulse width is 40ms to 60ms. The circuit breaker failure protection control logic model is interlocked with the reclosing mechanism. The operation of the circuit breaker failure protection control logic model blocks single-phase reclosing. Successful single-phase reclosing automatically resets the memory of the circuit breaker failure protection control logic model. To highlight the comparison, only the fault duration and circuit breaker status are changed in the three operating conditions; other parameters remain the same as the wiring.

[0082] Operating condition A involves a permanent single-phase ground fault combined with normal circuit breaker interruption, without the involvement of the circuit breaker failure protection control logic model. For example... Figure 6 , Figure 7 and Figure 8 As shown, the fault is in After injection, the B-phase current and zero-sequence current rapidly increased. The line protection system responded at approximately... to Within the specified time, phase selection and discrimination are completed, and a single-phase trip for phase B is issued. After receiving the trip command from the microcomputer protection hardware and relayed through the real-time simulator, the second simulated circuit breaker, according to the rated breaking time... to The left and right switches were disconnected, and the current in phase B dropped to near zero. After this, the dead time period began. The line protection maintains the reclosing timer. Since this is a transient fault, the fault arc extinguishes itself after being interrupted, and the system voltage and current waveforms recover within the dead time. At a certain moment, the device sends a single-phase closing pulse. After phase B of the second simulated circuit breaker closes, the current waveform stabilizes, there is no secondary initiation, and the reclosing is judged as successful, and the process ends. The circuit breaker failure protection control logic model should not be activated throughout the entire process. The prerequisite for activation is that a trip has occurred and the circuit breaker has not yet... Internal current extinguishing or in place; under this operating condition, the second simulated circuit breaker operates normally, and the current monitoring is in place. The internal timer is cleared, and the timing of the circuit breaker failure protection control logic model is canceled. The results verify the correctness of the single-phase reclosing operation, phase selectivity, and rapid self-healing capability for transient faults at the device level.

[0083] Operating condition B involves a permanent single-phase ground fault combined with normal circuit breaker interruption, without the involvement of the circuit breaker failure protection control logic model. For example... Figure 9 and Figure 10 As shown, the line protection is the same as in operating condition A. to A single trip of phase B was issued, and the second analog circuit breaker... After both sides are switched on, the current drops to near zero during the dead zone. A closing pulse was issued. Due to the permanent fault, the B-phase current and zero-sequence current surged again upon closing. The line protection determined the reclosing failure and escalated to three-phase tripping according to the set logic. The second simulated circuit breaker completed three-phase tripping within the rated time, and the fault was finally cleared. The circuit breaker failure protection control logic model should not have been activated. Although three-phase tripping occurred after the reclosing failure, the second simulated circuit breaker completed the interruption within the rated time each time, and the current monitoring of the circuit breaker failure protection control logic model was... The internal clearing or circuit breaker position signal is in place, and the starting condition is not met. The operating condition verifies the correctness of the single-phase reclosing failure detection and escalation strategy, as well as the consistency of the action of first selectively clearing a small range and then expanding the clearing range after failure.

[0084] Operating condition C involves a single-phase ground fault and circuit breaker failure to operate, with the circuit breaker failure protection control logic model participating. For example... Figure 11 and Figure 12 As shown, the fault type and device settings are the same as before, but the second simulated circuit breaker 5031 is set to fail to operate. The line protection is in... to A single trip of phase B was issued. Due to the failure of the second simulated circuit breaker 5031 to operate, the second simulated circuit breaker did not trip within the rated time, and the phase B current was... The difference between the front and back is still significantly greater than the threshold. Furthermore, the circuit breaker position signal was not in place. Therefore, the circuit breaker failure protection control logic model... A failure was determined and a backup trip command was issued. The circuit breaker failure protection control logic model then issued an action signal based on the near-backup principle of the 3 / 2 wiring configuration. Upon receiving the backup command from the circuit breaker failure protection control logic model, the first simulated circuit breaker 5021 and the first simulated circuit breaker 5032 opened within the rated time, and the fault current within the station was quickly cleared. Since the circuit breaker failure protection control logic model had already activated, the reclosing interlock took effect, and single-phase reclosing was blocked and no further commands were issued during this fault process. The operating condition fully reproduced the virtual-real coordination of main protection tripping, circuit breaker failure in this bay, circuit breaker failure protection control logic model supervision, backup disconnection, and reclosing interlock. Supervision and judgment were completed by the virtual circuit breaker failure protection control logic model. The backup output was executed by the simulator, power amplifier, and first simulated circuit breaker. The system status was written back from the simulation model, the links operated under a unified time scale, and the selectivity of protection actions and backup boundaries were clear.

[0085] The three sets of operating conditions clearly distinguish the functional boundaries of single-phase reclosing and the intervention conditions of the circuit breaker failure protection control logic model. When the second simulated circuit breaker operates normally, regardless of whether the fault is transient or permanent, the entire process is completed independently by the line protection, and the circuit breaker failure protection control logic model should not intervene, verifying the platform's correct representation of selectivity and speed. However, when the second simulated circuit breaker fails to operate, only the circuit breaker failure protection control logic model can intervene. The system determines a malfunction based on the fact that the current has not been extinguished and the circuit breaker position signal has not been received. It then issues a backup disconnection order to the adjacent circuit breaker, thereby quickly clearing the fault at the substation level with minimal cost. Single-phase reclosing is interlocked to prevent accidental closing. From the perspective of setting consistency, The selection needs to cover the tripping circuit delay, the rated breaking time of the circuit breaker, and the saturation recovery margin of the current transformer. This platform uses 0.10s as a benchmark and can reliably distinguish between true current extinguishing and failure to extinguish under operating condition C. No false current extinguishing caused by current transformer saturation was observed. It can balance system transient recovery and reconnection self-healing probability. In condition B, rapid failure after reconnection was accurately identified and escalated to three-phase disconnection. No malfunctions were observed in non-faulty sections in the three sets of tests. The selectivity of actions and the sequence of coordination were correct, verifying the coverage of typical operating conditions and engineering consistency of the virtual-real hybrid platform.

[0086] The hardware-in-the-loop test platform for power plant microcomputer protection provided by this invention has the following advantages over the prior art: 1) This invention achieves coupled operation of the electromagnetic transient model and engineering device under a unified time scale. The electromagnetic transient model of the power plant primary system and the circuit breaker failure protection control logic model built by the first host computer are compiled and sent to the real-time simulator for operation. The real-time simulator performs real-time electromagnetic transient calculations and outputs analog signals to the microcomputer protection hardware. The microcomputer protection hardware executes protection criteria based on the analog signals. When the conditions are met, it outputs a trip command to the real-time simulator. The trip command simultaneously triggers the timer module in the circuit breaker failure protection control logic model to start timing. The multi-core central processing unit detects in real time whether the current value in the circuit where the circuit breaker in this bay is located is higher than the preset threshold through the current monitoring module, and detects whether the position of the circuit breaker in this bay has changed through the position signal monitoring module based on the opening and closing status signal fed back by the second simulated circuit breaker. When the timer module reaches the set time and the current value is still higher than the preset threshold, or the position has not changed, the multi-core central processing unit determines that the circuit breaker in this bay has failed to operate and generates a backup trip command. The first simulated circuit breaker receives and executes the backup trip command. The aforementioned power injection, device discrimination, control output, and primary model feedback operate in a coupled manner within a unified time scale, ensuring the dynamic consistency of the entire fault process and the verifiability of protection coordination.

[0087] 2) This invention implements the circuit breaker failure protection control logic model in a real-time simulator using virtualization, while the main protections for generators, transformers, busbars, short leads, and lines utilize real microcomputer protection hardware devices. This hybrid virtual-real architecture allows the platform to retain device-level action characteristics and criterion implementation while significantly reducing the number of secondary injection channels and power amplifiers, lowering hardware investment and setup complexity, and improving the efficiency of scheme iteration and setting optimization.

[0088] 3) This invention achieves coordinated verification of circuit breaker failure protection and the main protection of the entire station by corresponding the first simulated circuit breaker with the adjacent line circuit breaker or bus-side circuit breaker in the primary system of the power plant. This enables repeatable and quantifiable verification of station-level logic such as cross-device coordination, failure backup, and reclosing interlocking, ensuring the repeatability of the test process. Simultaneously, the platform achieves a balance between hardware investment, realism, and scalability, and can serve various scenarios such as protection strategy verification, device performance evaluation, and personnel training.

[0089] 4) This application utilizes a virtual-real hybrid hardware-in-the-loop (HIL) testing platform built upon a real-time simulator. This hybrid approach couples the electromagnetic transient model with the engineering device at a unified timescale, preserving the engineering realism of device-level actions and criteria while reducing channel and hardware investment. Through experimental analysis of typical cases, the platform can quickly and selectively complete backup removal at the site level, verifying its effectiveness and applicability in terms of protection coordination, action consistency, and repeatability. Furthermore, the platform possesses excellent visualization and operability, serving various scenarios such as strategy optimization, device evaluation, and personnel training.

[0090] like Figure 13 As shown, an embodiment of the present invention provides a hardware-in-the-loop testing method for power plant microcomputer protection, comprising: S1. The first host computer builds the electromagnetic transient model of the power plant's primary system and the circuit breaker failure protection control logic model. After compiling the electromagnetic transient model and the circuit breaker failure protection control logic model, it sends them to the real-time simulator. S2. Enable the real-time simulator to perform real-time electromagnetic transient calculations using the compiled electromagnetic transient model, obtain analog signals, and output the analog signals to the power plant's microcomputer protection hardware. S3. The microcomputer protection hardware executes protection criteria based on the received analog signal. When the protection action conditions are met, the microcomputer protection hardware outputs a tripping command to the real-time simulator to control the circuit breaker of this bay to open. S4. The real-time simulator uses the compiled circuit breaker failure protection control logic model to determine whether the circuit breaker in this bay fails to operate based on the received trip command, and outputs a backup trip command when the determination result is that it fails to operate. S5. The first simulated circuit breaker receives and executes the backup trip command and feeds back the opening and closing status signal of the first simulated circuit breaker to the real-time simulator. The first simulated circuit breaker corresponds to the adjacent line circuit breaker or bus-side circuit breaker in the primary system of the power plant.

[0091] Optionally, the above technical solution further includes: setting up a human-machine interface on the second host computer, through which parameter settings, fault injection, status monitoring, and protection action analysis are performed; the human-machine interface integrates a topology visualization module for the main wiring of the primary system and the opening and closing status signals of each circuit breaker in the primary system, a real-time oscilloscope display module for key electrical quantities, a programmable fault injection and time-stamping recording module, and an action event and tripping link backtracking module; enabling the topology visualization module to read the opening and closing status signals of each circuit breaker in the primary system from the real-time simulator or the tripping position fed back from the microcomputer protection hardware. The signal acquisition status refreshes the interface display using a combination of polling and interrupt triggering; the real-time oscilloscope display module acquires key electrical quantity data from the real-time simulator and marks the fault time; the programmable fault injection and time-stamping recording module sends fault commands to the real-time simulator and records the fault injection time, protection start time, and trip command issuance time; the action event and trip link backtracking module acquires the trip signals of each circuit breaker in the primary system from the real-time simulator and generates a trip link diagram and backtracking report in chronological order; the human-machine interface also supports setting group switching, one-click test reset, and scenario repetition. This system enables operators to monitor the main wiring and circuit breaker status signals of the primary system in real time through the topology visualization module, observe key electrical waveforms and locate fault moments through the real-time oscilloscope display module, flexibly set faults and accurately record the timing of each action through the programmable fault injection and time-stamping recording module, and analyze the tripping process in chronological order through the action event and tripping link backtracking module. It also supports setting group switching, one-click test reset and scenario repetition, improving the convenience of test operation, the flexibility of fault injection, the accuracy of data recording and the efficiency of process analysis, thus meeting the requirements of teaching and training for strong visibility, easy reproducibility and rapid iteration.

[0092] Optionally, in the above technical solution, the microcomputer protection hardware includes a generator protection device, a transformer protection device, a busbar protection device, a short-lead protection device, and a line protection device. The generator protection device, transformer protection device, busbar protection device, short-lead protection device, and line protection device are respectively connected to a real-time simulator. The generator protection device executes generator protection criteria based on analog signals and outputs a trip command when the conditions are met. The transformer protection device executes transformer protection criteria based on analog signals and outputs a trip command when the conditions are met. The busbar protection device executes busbar protection criteria based on analog signals and outputs a trip command when the conditions are met. The short-lead protection device executes short-lead protection criteria based on analog signals and outputs a trip command when the conditions are met. The line protection device executes line protection criteria based on analog signals and outputs a trip command when the conditions are met.

[0093] Optionally, in the above technical solution, the real-time simulator includes a multi-core central processing unit (CPU), a timer card, a digital quantity card, an analog quantity card, a high-speed network card, and a system bus. The multi-core CPU, timer card, digital quantity card, analog quantity card, and high-speed network card are respectively connected to the system bus. The high-speed network card is connected to the first host computer via Ethernet to receive the compiled electromagnetic transient model and the compiled circuit breaker failure protection control logic model. The timer card is used to provide a unified time reference signal to the multi-core CPU to coordinate the time steps of each task. The multi-core CPU is used to execute the compiled electromagnetic transient model and the compiled circuit breaker failure protection control logic model. The real-time calculation of the circuit breaker failure protection control logic model is performed by obtaining analog signals after executing the real-time calculation of the compiled electromagnetic transient model. During the real-time calculation of the compiled circuit breaker failure protection control logic model, the circuit breaker in this bay is judged according to the trip command to determine whether it fails to operate. If the judgment result is yes, a backup trip command is generated. The analog signal card is connected to the microcomputer protection hardware through the analog signal output interface to send analog signals. The digital signal card is connected to the microcomputer protection hardware through the digital signal input interface to receive trip commands. The digital signal card is connected to the first analog circuit breaker through the digital signal output interface to send backup trip commands. The high-speed network card receives two compiled models sent by the first host computer. The timer card provides a unified time reference signal to the multi-core central processing unit to coordinate the time steps of each task. The multi-core central processing unit executes the real-time calculations of the electromagnetic transient model and the circuit breaker failure protection control logic model in parallel. After the real-time calculation of the electromagnetic transient model, an analog signal is obtained. During the real-time calculation of the circuit breaker failure protection control logic model, the circuit breaker in this bay is judged according to the trip command to determine whether it fails to operate. If the judgment result is yes, a backup trip command is generated. The analog signal card sends the analog signal to the microcomputer protection hardware through the analog output interface. The digital signal card receives the trip command through the digital input interface and sends the backup trip command to the first analog circuit breaker through the digital output interface, ensuring the synchronization of electrical quantity injection, device discrimination and control command return on a unified time scale.

[0094] Optionally, in the above technical solution, before outputting the analog signal to the microprocessor-based protection hardware, the method further includes: amplifying the analog signal using a power amplifier, and then outputting the amplified analog signal to the microprocessor-based protection hardware. By amplifying the analog signal using a power amplifier before outputting it to the microprocessor-based protection hardware, the low-amplitude analog signal output by the real-time simulator is amplified to a standard quadratic value that matches the input range of the microprocessor-based protection hardware. This ensures that the microprocessor-based protection hardware can correctly sample and process voltage and current signals, thereby ensuring the accuracy and reliability of the protection criteria execution.

[0095] It also includes: enabling the second simulated circuit breaker to receive and execute trip commands issued by the microcomputer protection hardware and relayed through the real-time simulator, and to feed back the opening and closing status signals of the second simulated circuit breaker to the real-time simulator. The second simulated circuit breaker corresponds to the circuit breaker in this bay in the primary system of the power plant. By setting the second simulated circuit breaker to correspond to the circuit breaker in this bay in the primary system of the power plant, enabling the second simulated circuit breaker to receive and execute trip commands issued by the microcomputer protection hardware and relayed through the real-time simulator, and to perform opening operations and feed back opening and closing status signals to the real-time simulator through the second simulated circuit breaker, the simulation substitution of the operating behavior of the circuit breaker in this bay is realized, thereby completing the verification of the operating response of the circuit breaker in this bay without the participation of the real circuit breaker.

[0096] It should be noted that the beneficial effects of the power plant microcomputer protection hardware-in-the-loop testing method provided in the above embodiments are the same as the beneficial effects of the power plant microcomputer protection hardware-in-the-loop testing platform described above, and will not be repeated here. Furthermore, the method and platform embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the platform embodiments, which will not be repeated here.

[0097] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A hardware-in-the-loop test platform for power plant microcomputer protection, characterized in that, include: The first host computer, real-time simulator, first simulated circuit breaker and power plant microcomputer protection hardware, the first simulated circuit breaker corresponds to the adjacent line circuit breaker or bus side circuit breaker in the primary system of the power plant. The first host computer is used to: build an electromagnetic transient model of the primary system of the power plant and a circuit breaker failure protection control logic model, compile them, and then send them to the real-time simulator; The real-time simulator is used to: perform real-time electromagnetic transient calculations using the compiled electromagnetic transient model, obtain analog signals, and output them to the microcomputer protection hardware; The microcomputer protection hardware is used to: execute protection criteria according to the analog signal, and when the protection action conditions are met, output a trip command to the real-time simulator to control the tripping of the circuit breaker in this bay in the primary system of the power plant. The real-time simulator is also used to: determine whether the circuit breaker in this bay fails to operate according to the trip command using the compiled circuit breaker failure protection control logic model, and output a backup trip command when the determination result is yes; The first simulated circuit breaker is used to: receive and execute the backup trip command, and feed back the opening and closing status signal of the first simulated circuit breaker to the real-time simulator.

2. The power plant microcomputer protection hardware-in-the-loop test platform according to claim 1, characterized in that, It also includes a second host computer connected to the real-time simulator. The second host computer has a human-machine interface (HMI) for parameter setting, fault injection, status monitoring, and protection action analysis. The HMI integrates a topology visualization module for the main wiring of the primary system and the open / close status signals of each circuit breaker in the primary system, a real-time oscilloscope display module for key electrical quantities, a programmable fault injection and time-stamping recording module, and an action event and trip link tracing module. The topology visualization module reads the open / close status signals of each circuit breaker in the primary system from the real-time simulator or from feedback from the microcomputer protection hardware. The trip position signal acquisition status is refreshed on the interface display using a combination of polling triggering and interrupt triggering. The real-time oscilloscope display module acquires key electrical quantity data from the real-time simulator and marks the fault time. The programmable fault injection and time-stamping recording module sends fault commands to the real-time simulator and records the fault injection time, protection start time, and trip command issuance time. The action event and trip link backtracking module acquires the trip signals of each circuit breaker in the primary system from the real-time simulator and generates a trip link diagram and backtracking report in chronological order. The human-machine interface also supports setting group switching, one-click test reset, and scenario repetition.

3. The power plant microcomputer protection hardware-in-the-loop test platform according to claim 1, characterized in that, The microcomputer-based protection hardware includes a generator protection device, a transformer protection device, a busbar protection device, a short-lead protection device, and a line protection device. These devices are connected to the real-time simulator. The generator protection device executes generator protection criteria based on the analog signal and outputs a trip command when the conditions are met. The transformer protection device executes transformer protection criteria based on the analog signal and outputs a trip command when the conditions are met. The busbar protection device executes busbar protection criteria based on the analog signal and outputs a trip command when the conditions are met. The short-lead protection device executes short-lead protection criteria based on the analog signal and outputs a trip command when the conditions are met. The line protection device executes line protection criteria based on the analog signal and outputs a trip command when the conditions are met.

4. The power plant microcomputer protection hardware-in-the-loop test platform according to claim 1, characterized in that, The real-time simulator includes a multi-core CPU, a timer card, a digital quantity card, an analog quantity card, a high-speed network card, and a system bus. The multi-core CPU, the timer card, the digital quantity card, the analog quantity card, and the high-speed network card are all connected to the system bus. The high-speed network card connects to the first host computer via Ethernet to receive the compiled electromagnetic transient model and the compiled circuit breaker failure protection control logic model. The timer card provides a unified time reference signal to the multi-core CPU to coordinate the time steps of each task. The multi-core CPU executes the compiled electromagnetic transient model and the compiled circuit breaker failure model. The real-time calculation of the protection control logic model obtains analog signals after executing the real-time calculation of the compiled electromagnetic transient model. During the real-time calculation of the compiled circuit breaker failure protection control logic model, it is determined whether the circuit breaker in this bay fails to operate according to the trip command, and a backup trip command is generated when the determination result is yes. The analog signal card is connected to the microcomputer protection hardware through the analog output interface to send the analog signal, and the digital signal card is connected to the microcomputer protection hardware through the digital input interface to receive the trip command. The digital signal card is connected to the first analog circuit breaker through the digital output interface to send the backup trip command.

5. A power plant microcomputer protection hardware-in-the-loop test platform according to any one of claims 1 to 4, characterized in that, It also includes a power amplifier, which is connected between the real-time simulator and the microcomputer protection hardware. The analog signal output by the real-time simulator is amplified by the power amplifier and then output to the microcomputer protection hardware.

6. A hardware-in-the-loop testing method for power plant microcomputer protection, characterized in that, include: The first host computer builds the electromagnetic transient model of the power plant's primary system and the circuit breaker failure protection control logic model. After compiling the electromagnetic transient model and the circuit breaker failure protection control logic model, the data is sent to the real-time simulator. The real-time simulator uses the compiled electromagnetic transient model to perform real-time electromagnetic transient calculations, obtains analog signals, and outputs the analog signals to the power plant's microcomputer protection hardware. The microcomputer protection hardware executes protection criteria based on the received analog signal. When the protection action conditions are met, the microcomputer protection hardware outputs a tripping command to the real-time simulator to control the circuit breaker of this bay to open. The real-time simulator, based on the received trip command, uses the compiled circuit breaker failure protection control logic model to determine whether the circuit breaker in this bay fails to operate, and outputs a backup trip command when the determination result is that it fails to operate. The first simulated circuit breaker receives and executes the backup trip command and feeds back the opening and closing status signal of the first simulated circuit breaker to the real-time simulator. The first simulated circuit breaker corresponds to the adjacent line circuit breaker or bus-side circuit breaker in the primary system of the power plant.

7. The hardware-in-the-loop testing method for power plant microcomputer protection according to claim 6, characterized in that, The second host computer is equipped with a human-machine interface, through which parameter settings, fault injection, status monitoring and protection action analysis are performed; the human-machine interface integrates a topology visualization module for the main wiring of the primary system and the opening and closing status signals of each circuit breaker in the primary system, a real-time oscilloscope display module for key electrical quantities, a programmable fault injection and time stamp recording module, and an action event and trip link backtracking module. The topology visualization module reads the open / close status signals of each circuit breaker in the system from the real-time simulator or collects the status from the trip position signals fed back by the microcomputer protection hardware, and refreshes the interface display in a combination of polling trigger and interrupt trigger. The real-time oscilloscope display module collects key electrical quantity data from the real-time simulator and marks the fault time; the programmable fault injection and time-stamping recording module sends fault commands to the real-time simulator and records the fault injection time, protection start time, and trip command issuance time; the action event and trip link backtracking module collects the trip signals of each circuit breaker in the primary system from the real-time simulator and generates a trip link diagram and backtracking report in chronological order; the human-machine interface also supports setting group switching, one-click test reset, and scenario repetition.

8. A hardware-in-the-loop testing method for power plant microcomputer protection according to claim 6, characterized in that, The microcomputer-based protection hardware includes a generator protection device, a transformer protection device, a busbar protection device, a short-lead protection device, and a line protection device. These devices are connected to the real-time simulator. The generator protection device executes generator protection criteria based on the analog signal and outputs a trip command when the conditions are met. The transformer protection device executes transformer protection criteria based on the analog signal and outputs a trip command when the conditions are met. The busbar protection device executes busbar protection criteria based on the analog signal and outputs a trip command when the conditions are met. The short-lead protection device executes short-lead protection criteria based on the analog signal and outputs a trip command when the conditions are met. The line protection device executes line protection criteria based on the analog signal and outputs a trip command when the conditions are met.

9. A hardware-in-the-loop testing method for power plant microcomputer protection according to claim 6, characterized in that, The real-time simulator includes a multi-core CPU, a timer card, a digital quantity card, an analog quantity card, a high-speed network card, and a system bus. The multi-core CPU, the timer card, the digital quantity card, the analog quantity card, and the high-speed network card are all connected to the system bus. The high-speed network card connects to the first host computer via Ethernet to receive the compiled electromagnetic transient model and the compiled circuit breaker failure protection control logic model. The timer card provides a unified time reference signal to the multi-core CPU to coordinate the time steps of each task. The multi-core CPU executes the compiled electromagnetic transient model and the compiled circuit breaker failure model. The real-time calculation of the protection control logic model obtains analog signals after executing the real-time calculation of the compiled electromagnetic transient model. During the real-time calculation of the compiled circuit breaker failure protection control logic model, it is determined whether the circuit breaker in this bay fails to operate according to the trip command, and a backup trip command is generated when the determination result is yes. The analog signal card is connected to the microcomputer protection hardware through the analog output interface to send the analog signal, and the digital signal card is connected to the microcomputer protection hardware through the digital input interface to receive the trip command. The digital signal card is connected to the first analog circuit breaker through the digital output interface to send the backup trip command.

10. A hardware-in-the-loop testing method for power plant microcomputer protection according to any one of claims 6 to 9, characterized in that, Before outputting the analog signal to the microcomputer protection hardware, the method further includes: amplifying the analog signal using a power amplifier, and then outputting the amplified analog signal to the microcomputer protection hardware.

Images