Nuclear power station priority module interface test system

Abstract

The utility model discloses a nuclear power station priority module interface test system. The risk of misoperation of a safety-level actuator is reduced, and the test automation level is improved. The interface test system comprises a security level control and display device, an RPS bypass device, three security level controllers and n priority modules, wherein n is greater than or equal to 1; the three security level controllers are respectively an SETA controller, an SETB controller and a third controller; the X controller comprises a bypass state judgment unit, a test instruction triggering unit, a test time control unit, n real instruction locking units and n DO driving logic units; x is equal to SETA and SETB; the RPS bypass device is connected with the X controller; the security level control and display device is connected with the three security level controllers; and the third controller comprises n SETA test feedback processing units and n SETB test feedback processing units.

Description

Technical Field

[0001] The present application relates to the field of nuclear facility control and testing technology, and in particular to a nuclear power plant priority module interface test system. Background Art

[0002] Safety-grade actuators (such as electric valves, pumps, fans, etc.) are key equipment used in nuclear power plants to realize the driving functions of dedicated safety facilities, and play an important role in ensuring the safe operation of nuclear power plants.

[0003] Safety-level actuators, under varying operating conditions, must receive control commands from various I&C systems within a nuclear power plant, including the reactor protection system (RPS), the kernel diversity protection system (KDS), and the control system. To ensure that RPS commands are prioritized in emergencies, nuclear power plant I&C systems typically include an independent priority module. This module prioritizes commands from the RPS over those from other I&C systems and outputs the final command to the safety-level actuators.

[0004] To ensure the proper functioning of a nuclear power plant's dedicated safety features under accident conditions, regular testing of the RPS system's command paths is required. This testing typically employs a segmented, overlapping strategy, sequentially examining the following three steps: "RPS system output to the priority module (testing whether the RPS system's commands are correctly transmitted to the priority module)," "priority module internal processing (testing whether the priority module's internal logic and command processing are correct)," and "priority module output to the safety-level actuator (testing whether the priority module's output commands are correctly transmitted to and executed by the safety-level actuator on site)."

[0005] To test the "RPS system output to the priority module" link, nuclear power plants utilize a nuclear power plant priority module interface test system. In existing technology, this interface test system is constructed by introducing a maintenance tool (loaded with customized periodic test software) and a test interface device based on the RPS system. The maintenance tool is connected to the RPS system and the test interface device. The maintenance tool uses the customized periodic test software to inject test instructions into the RPS system and reads the test feedback signal from the priority module from the test interface device, forming a closed-loop confirmation mechanism. However, this interface periodic test has the following problems:

[0006] 1) The maintenance tools, test interface devices, and periodic test software used are all non-safety-grade and have low reliability. Abnormalities in the maintenance tools and periodic test software may cause test failures and may even cause the RPS system to erroneously trigger test instructions after the bypass is released, resulting in the risk of malfunction of safety-grade actuators on site.

[0007] 2) Since maintenance tools and test interface devices need to be introduced into the RPS system, personnel are required to manually plug in wires and power supply before and after the test. The test steps are complicated and the level of automation is low. Utility Model Content

[0008] In view of the above problems, this application provides a nuclear power plant priority module interface test system to reduce the risk of malfunction of safety-level actuators on site and improve the automation level of the test. The specific solution is as follows:

[0009] The present application provides a nuclear power plant priority module interface test system, comprising: a safety level control and display device located in a reactor protection system RPS, an RPS bypass device and three safety level controllers, and n priority modules located outside the RPS, where n≥1;

[0010] The three safety level controllers are SETA controller, SETB controller and third controller; the instructions output by RPS in the nuclear power plant to each priority module are divided into two groups, SETA and SETB; each group of instructions is equipped with a corresponding controller, namely SETA controller and SETB controller;

[0011] The X controller includes: a bypass state judgment unit, a test instruction trigger unit, a test time control unit, n real instruction locking units and n DO drive logic units; X=SETA, SETB;

[0012] The RPS bypass device is connected to the X controller and is used to send bypass instructions to the SETA controller or SETB controller under user operation; the safety level control and display device is used to send test instructions or manual reset instructions to the X controller under user operation;

[0013] The bypass state judgment unit is used to send the bypass instruction received by the X controller to the first input terminal of the i-th priority module via the i-th DO drive logic unit, and to send an X test ready signal after confirming that the X controller is bypassed; the DO drive logic unit is used to convert the input signal into a signal that can be recognized by the priority module; i = 1, 2, 3, ... n;

[0014] The test instruction trigger unit includes a first AND gate AND1; the test time control unit includes a first pulse generating circuit Pulse1, a second pulse generating circuit Pulse2, a delay circuit, and a second AND gate AND2; each real instruction locking unit includes a third AND gate AND3, a fourth AND gate AND4, and a first OR gate OR1; the two input ends of the first AND gate AND1 are respectively used to receive the X test ready signal and the test instruction; the output end signal of the first AND gate AND1 is sequentially passed through the first pulse generating circuit Pulse1 and the delay circuit, then inverted and input into the first input end of the third AND gate AND3 in each real instruction locking unit; the input end of the second pulse generating circuit Pulse2 is used to receive the manual reset instruction; the inverted signal of the output end signal of the second pulse generating circuit Pulse2, the X test ready signal, and the output end signal of the first pulse generating circuit Pulse1 are respectively input into The three input ends of the second AND gate AND2; the output end signal of the second AND gate AND2 is input into the second input end of the third AND gate AND3 in each real instruction locking unit; the two input ends of the fourth AND gate AND4 in each real instruction locking unit are respectively used to receive the signal after the output end signal of the second AND gate AND2 is inverted and the real instruction; in each real instruction locking unit, the output end of the third AND gate AND3 and the output end of the fourth AND gate AND4 are respectively connected to the two input ends of the first OR gate OR1; the output end of the first OR gate OR1 in the i-th real instruction locking unit is connected to the second input end of the i-th priority module via the i-th DO driving logic unit; the first pulse generating circuit Pulse1 and the second pulse generating circuit Pulse2 are both used to start outputting a high level for T seconds when detecting the rising edge of the input signal, and then change back to a low level; the delay circuit is used to delay the input signal for T / 2 seconds and output it, where T is a preset value;

[0015] The third controller includes n SETA test feedback processing units and n SETB test feedback processing units; each X test feedback processing unit includes a second OR gate OR2, a fifth AND gate AND5, a sixth AND gate AND6, a seventh AND gate AND7, an eighth AND gate AND8, a first RS flip-flop, and a second RS flip-flop; the two input ends of the second OR gate OR2 in each X test feedback processing unit are respectively used to receive the inverted signal of the X test ready signal and the manual reset instruction; the output end signal of the second AND gate AND2 in the i-th real instruction locking unit and the output end signal of the delay circuit are respectively input into the two input ends of the eighth AND gate AND8 in the i-th X test feedback processing unit; the output end signal of the third AND gate AND3 in the i-th real instruction locking unit is input into the i-th X test feedback The first input terminal of the sixth AND gate AND6 in the processing unit; the i-th priority module inputs the signal from its second input terminal into the second input terminal of the sixth AND gate AND6 in the i-th X-trial feedback processing unit, and after inversion processing, inputs the signal into the second input terminal of the fifth AND gate AND5 in the i-th X-trial feedback processing unit; in each X-trial feedback processing unit, the output terminal of the second OR gate OR2 is connected to the reset terminals of the first and second RS flip-flops, the output terminal of the eighth AND gate AND8 is connected to the first input terminal of the fifth AND gate AND5, the output terminal of the fifth AND gate AND5 is connected to the set terminal of the first RS flip-flop, and the output terminal of the sixth AND gate AND6 is connected to the set terminal of the second RS flip-flop; the output terminals of the first and second RS flip-flops are respectively connected to the two input terminals of the seventh AND gate AND7;

[0016] In the safety-level control and display device, one lamp group is provided corresponding to n SETA test feedback processing units, and one lamp group is provided corresponding to n SETB test feedback processing units. The output of the seventh AND gate AND7 in the i-th X test feedback processing unit is connected to the i-th indicator light in the corresponding lamp group. When n ≥ 2, the third controller further includes a ninth AND gate and a tenth AND gate. The output of the first RS flip-flop in the n X test feedback processing units is connected to the i+1-th indicator light in the corresponding lamp group via the ninth AND gate, and the output of the second RS flip-flop in the n X test feedback processing units is connected to the i+2-th indicator light in the corresponding lamp group via the tenth AND gate. When n = 1, the ninth and tenth AND gates are omitted.

[0017] In a possible implementation, the security level control and display device utilizes optical fibers and communication equipment to form a communication network with the SETA controller, the SETB controller, and the third controller.

[0018] In one possible implementation, an interlock circuit is provided in the bypass state determination unit so that the SETA controller and the SETB controller are not bypassed at the same time;

[0019] The bypass state judgment unit is used to send the bypass instruction received by the X controller to the first input end of the i-th priority module through the i-th DO drive logic unit after interlocking processing;

[0020] The priority module is used to send a feedback signal to the RPS bypass device, SETA controller and SETB controller after receiving the bypass instruction, forming a closed-loop confirmation mechanism; the RPS bypass device will only display the test ready indication information after confirmation, and the SETA controller and SETB controller will only trigger the safety level control and display device to display the test ready indication information after confirmation.

[0021] In one possible implementation, the RPS bypass device includes: a SETA bypass instruction sending end connected to the SETA controller and the SETB controller, a SETB bypass instruction sending end connected to the SETA controller and the SETB controller, and a feedback signal receiving end connected to the priority module;

[0022] The SETB bypass instruction sending end and the feedback signal receiving end are respectively connected to the two input ends of the eleventh AND gate AND11, and the output end of the eleventh AND gate AND11 is connected to the SETB test ready indicator light on the RPS bypass device; the SETA bypass instruction sending end and the feedback signal receiving end are respectively connected to the two input ends of the twelfth AND gate AND12, and the output end of the twelfth AND gate AND12 is connected to the SETA test ready indicator light on the RPS bypass device;

[0023] The bypass state judgment unit in the SETA controller includes a thirteenth AND gate AND13, a fourteenth AND gate AND14, and a fifteenth AND gate AND15; the first input terminal of the thirteenth AND gate AND13 is connected to the SETA bypass instruction sending terminal; the first input terminal of the fourteenth AND gate AND14 is connected to the SETB bypass instruction sending terminal; the output terminal of the thirteenth AND gate AND13 is connected to the second input terminal of the fourteenth AND gate AND14 after being inverted; the output terminal of the fourteenth AND gate AND14 is connected to the second input terminal of the thirteenth AND gate AND13 after being inverted; the output terminal of the thirteenth AND gate AND13 is also connected to the first input terminal of the fifteenth AND gate AND15 and the D0 drive logic unit; the second input terminal of the fifteenth AND gate AND15 is connected to the feedback signal receiving terminal; and the output terminal of the fifteenth AND gate AND15 is connected to the safety level control and display device.

[0024] In a possible implementation, a three-position rotary switch is provided on the RPS bypass device; the three-position rotary switch has three positions, corresponding to three states: neither the SETA controller nor the SETB controller is bypassed, only the SETA controller is bypassed, and only the SETB controller is bypassed.

[0025] In one possible implementation, the bypass state determination unit is configured to send the bypass instruction received by the X controller to the i-th DO drive logic unit after interlocking processing, and then the i-th DO drive logic unit sends the bypass instruction to the first input end of the i-th priority module through a redundant hard-wired link.

[0026] By utilizing the above-described technical solution, the nuclear power plant priority module interface test system provided in this application includes a safety-level control and display device, an RPS bypass device, three safety-level controllers (SETA, SETB, and a third controller), and n priority modules. The user is responsible for bypassing and sending test instructions to the SETA and SETB controllers through the RPS bypass device and the safety-level control and display device, ensuring that only one of the SETA and SETB controllers is bypassed at any given time, while the other maintains normal control. The third controller is responsible for processing test feedback after bypassing the SETA or SETB controller. The user only needs to operate the system through the bypass device and the safety-level control and display device to verify the normal operation of the hard-wired path from the SETA / SETB controller to the priority module through a series of logic units and circuits. The test results are then displayed through indicator lights on the safety-level control and display device, thereby improving the automation level of interface testing. Moreover, the interface test system uses safety-level control and display devices to trigger and display feedback of test instructions, eliminating non-safety-level equipment and software such as maintenance tools, test interface devices, and periodic test software, reducing the potential impact of non-safety-level items on the RPS system and reducing the risk of malfunction of on-site safety-level actuators. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The above and other features, advantages, and aspects of the various embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that the originals and elements are not necessarily drawn to scale.

[0028] Figure 1 A schematic diagram of the structure of a nuclear power plant priority module interface test system provided in this application;

[0029] Figure 2 A circuit diagram of a SETA controller provided in this application;

[0030] Figure 3 A circuit schematic diagram of a third controller provided in this application;

[0031] Figure 4 A schematic diagram of the structure of a safety-level control and display device provided in this application;

[0032] Figure 5This is a circuit schematic diagram of an RPS bypass device and a bypass status judgment unit provided in this application. DETAILED DESCRIPTION

[0033] The embodiments of the present application are described below in conjunction with the accompanying drawings. Those skilled in the art will appreciate that, with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0034] The terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, and this is merely a way of distinguishing the objects of the same attributes when describing them in the embodiments of the present application. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, so that the process, method, system, product or equipment comprising a series of units need not be limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0035] See also Figure 1 The embodiment of the present application provides a nuclear power plant priority module interface test system, comprising: a safety level control and display device located in a reactor protection system (RPS), an RPS bypass device and three safety level controllers, and n priority modules located outside the RPS, n≥1 ( Figure 1 Only n=1 is used as an example);

[0036] The three safety level controllers are SETA controller, SETB controller and third controller; the instructions output by RPS in the nuclear power plant to each priority module are divided into two groups, SETA and SETB; each group of instructions is equipped with a corresponding controller, namely SETA controller and SETB controller;

[0037] See also Figure 1 and Figure 2 ( Figure 2 Shown in detail Figure 1 The internal structure of the SETA controller and SETB controller mentioned in the previous section is shown in the figure). The X controller includes: a bypass state judgment unit, a test instruction trigger unit, a test time control unit, n real instruction locking units, and n DO drive logic units; X = SETA, SETB (that is, the description of the X controller in this article is applicable to both the SETA controller and the SETB controller).

[0038] The RPS bypass device is connected to the X controller and is used to send bypass instructions to the SETA controller or SETB controller under user (i.e. test personnel) operation; the safety level control and display device is used to send test instructions or reset instructions to the X controller under user operation;

[0039] The bypass state judgment unit is used to send the bypass instruction received by the X controller to the first input terminal of the i-th priority module via the i-th (i=1, 2, 3, ... n) DO drive logic unit, and send an X test ready signal after confirming that the X controller is bypassed;

[0040] The test instruction trigger unit includes a first AND gate AND1; the test time control unit includes a first pulse generating circuit Pulse1, a second pulse generating circuit Pulse2, a delay circuit, and a second AND gate AND2; each real instruction locking unit includes a third AND gate AND3, a fourth AND gate AND4, and a first OR gate OR1; the two input ends of the first AND gate AND1 are respectively used to receive the X test ready signal and the test instruction; the output end signal of the first AND gate AND1 passes through the first pulse generating circuit Pulse1 and the delay circuit in sequence, is inverted, and then input into the first input end of the third AND gate AND3 in each real instruction locking unit; the input end of the second pulse generating circuit Pulse2 is used to receive the manual reset instruction; the inverted signal of the output end signal of the second pulse generating circuit Pulse2, the X test ready signal, and the output end signal of the first pulse generating circuit Pulse1 are respectively input into the three input ends of the second AND gate AND2; the second AND gate A The output signal of ND2 is input to the second input of the third AND gate AND3 in each real instruction locking unit; the two inputs of the fourth AND gate AND4 in each real instruction locking unit are respectively used to receive the inverted signal of the output of the second AND gate AND2 and the real instruction (i.e., the real dedicated safety facility driving instruction); the output of the third AND gate AND3 in the i-th real instruction locking unit and the output of the fourth AND gate AND4 in the i-th real instruction locking unit are connected to the two inputs of the first OR gate OR1 in the i-th real instruction locking unit; the output of the first OR gate OR1 in the i-th real instruction locking unit is connected to the second input of the i-th priority module via the i-th DO drive logic unit; the first pulse generating circuit Pulse1 and the second pulse generating circuit Pulse2 are both used to start outputting a high level for T seconds when detecting a rising edge of the input signal, and then return to a low level; the delay circuit is used to delay the output of the input signal by T / 2 seconds, where T is a preset value;

[0041] The DO drive logic unit is used to convert the input signal into a signal that the priority module can recognize and then output it ( Figure 1 and Figure 2The "A-drive" in the figure indicates the output signal of the first OR gate OR1 after being processed by the DO drive logic unit. Figure 1 and Figure 2 "A-Bypass 1" in the figure indicates the output signal of the bypass instruction after being processed by the DO drive logic unit. Figure 1 and Figure 2 "A-Bypass 2" and "A-Bypass 1" are two redundant signals).

[0042] Still see Figure 2 For the convenience of description, the output signal of the first AND gate AND1 is referred to as the test instruction A, the output signal of the second AND gate AND2 is referred to as the test instruction B, the output signal of the delay circuit is referred to as the test locking instruction C, and the output signal of the third AND gate AND3 is referred to as the test instruction D.

[0043] See also Figure 1 and Figure 3 The third controller includes n SETA test feedback processing units and n SETB test feedback processing units; each X test feedback processing unit (X=SETA, SETB; that is, the description of the X test feedback processing unit in this article is applicable to both the SETA test feedback processing unit and the SETB test feedback processing unit) includes a second OR gate OR2, a fifth AND gate AND5, a sixth AND gate AND6, a seventh AND gate AND7, an eighth AND gate AND8, a first RS flip-flop and a second RS flip-flop; the two input ends of the second OR gate OR2 in each X test feedback processing unit are respectively used to receive the inverted signal of the X test ready signal and the manual reset instruction; the test instructions B and C in the i-th real instruction locking unit are respectively input into the two input ends of the eighth AND gate AND8 in the i-th X test feedback processing unit; the i-th real instruction locking unit The test instruction D in the test is input to the first input terminal of the sixth AND gate AND6 in the i-th X-trial feedback processing unit. The i-th priority module inputs the signal from its second input terminal into the second input terminal of the sixth AND gate AND6 in the i-th X-trial feedback processing unit, and after inversion processing, inputs the signal into the second input terminal of the fifth AND gate AND5 in the i-th X-trial feedback processing unit. In each X-trial feedback processing unit, the output terminal of the second OR gate OR2 is connected to the R terminal (reset terminal) of the first and second RS flip-flops, the output terminal of the eighth AND gate AND8 is connected to the first input terminal of the fifth AND gate AND5, the output terminal of the fifth AND gate AND5 is connected to the S terminal (set terminal) of the first RS flip-flop, and the output terminal of the sixth AND gate AND6 is connected to the S terminal of the second RS flip-flop. The output terminals of the first and second RS flip-flops are respectively connected to the two input terminals of the seventh AND gate AND7.

[0044] In the safety level control and display device, a set of light groups is set corresponding to n SETA test feedback processing units, and a set of light groups is set corresponding to n SETB test feedback processing units. Figure 3 The output of the seventh AND gate AND7 in the i-th X test feedback processing unit is connected to the i-th indicator light in the corresponding light group; when n≥2, the third controller further includes a ninth AND gate ( Figure 3 Not shown) and the tenth AND gate ( Figure 3 (not shown), the output of the first RS flip-flop in the n X-trial feedback processing units is connected to the (i+1)th indicator light (defined as the T→F indicator light) in the corresponding light group via a ninth AND gate, and the output of the second RS flip-flop in the n X-trial feedback processing units is connected to the (i+2)th indicator light (defined as the F→T indicator light) in the corresponding light group via a tenth AND gate. When n=1, the ninth and tenth AND gates are omitted.

[0045] The key points of the nuclear power plant priority module interface test system provided above are as follows:

[0046] 1) Use a highly reliable safety-level control and display device to connect to the three safety-level controllers in the RPS system through network communication to trigger test instructions and receive test feedback to implement priority module interface testing; and use the RPS bypass device to send manually triggered bypass instructions to the bypass status judgment unit through hard wiring;

[0047] 2) The SETA / SETB controller is equipped with a bypass state judgment unit, a test instruction trigger unit, a test time control unit, and a real instruction blocking unit. The bypass state judgment unit is mainly responsible for screening out bypass instructions, the test instruction trigger unit is mainly responsible for blocking the test instruction trigger in the non-bypass state, the test time control unit is mainly responsible for controlling the test instruction length, and the real instruction blocking unit is mainly responsible for eliminating the interference of the real instruction on the test results.

[0048] 3) The priority module is connected to the SETA and SETB controllers through hard wiring, receives the bypass status and test command signals from the RPS controller, and sends test feedback to the SETA and SETB controllers.

[0049] The following describes the working principle of the nuclear power plant priority module interface test system provided above in detail, taking n=1 and T=10 as an example:

[0050] The safety-level control and display device is a high-reliability and high-safety device. It provides a human-machine interface, which makes it convenient for test personnel to send manually triggered test instructions and manual reset instructions (test instructions and manual reset instructions are both high-level signals) to the SETA controller and SETB controller through the human-machine interface, and receive and display the final test results, such as Figure 4As shown, the human-machine interface of the safety level control and display device has operation buttons such as "reset" and "test", as well as multiple indicator lights. The safety level control and display device forms a communication network with the SETA controller, SETB controller and the third controller, for example Figure 1 and Figure 4 As shown in the figure, a communication network is formed with these controllers using optical fiber and communication equipment. As an integral part of the RPS system, the safety-level control and display device meets the design requirements of the safety-level DCS (digital control system) of nuclear power plants.

[0051] To ensure that the driving function of the dedicated safety facilities is not affected during interface testing, the embodiments of the present application adopt a separate testing strategy: when conducting an interface test via the SETA controller, the SETA controller is bypassed (bypassing refers to bypassing the SETA controller within the entire RPS system. The bypassed SETA controller no longer participates in normal control operations. Its output signal is blocked in the priority module and cannot be sent to the on-site safety-level actuator, preventing the test instructions from triggering the safety-level actuator) while the SETB controller maintains normal control operations; when conducting an interface test via the SETB controller, the SETB controller is bypassed while the SETA controller maintains normal control operations. This ensures that only one of the SETA and SETB controllers is bypassed at any given time, while the other maintains normal control operations. The SETA and SETB controllers cannot be bypassed simultaneously at any time, ensuring that the RPS system has critical safety protection in the event of an emergency.

[0052] To enable the RPS bypass device to send a bypass command to the SETA or SETB controller under user control, a three-position rotary switch is included in the RPS bypass device. This switch has three positions: neither the SETA or SETB controller is bypassed (the default state, which is in the middle position), only the SETA controller is bypassed, and only the SETB controller is bypassed. By manually rotating this switch, the tester can flexibly control the status of the SETA and SETB controllers.

[0053] Taking the bypass of only the SETA controller as an example, after the test personnel send a bypass instruction to the SETA controller by operating the RPS bypass device, the bypass status judgment unit will send the bypass instruction received by the SETA controller to the first input end of the i-th priority module via the i-th DO drive logic unit, and the bypass status judgment unit will send a SETA test ready signal after confirming that the SETA controller is bypassed.

[0054] Bypass command and SETA test ready signal are both high level signals, see Figure 2 :

[0055] In the test instruction trigger unit, when the test instruction and the SETA test ready signal exist at the same time, the test instruction A output by the first AND gate AND1 is a high level signal;

[0056] In the test time control unit, when the test command and the SETA test-ready signal are present simultaneously, the first pulse generating circuit, Pulse1, begins outputting a high level for 10 seconds upon detecting a rising edge in the input signal, then returns to a low level. The delay circuit delays the input signal output by 5 seconds. That is, during the 0-10 second test period, test lockout command C is low from 0-5 seconds and high from 6-10 seconds. Furthermore, when the test command and the SETA test-ready signal are present simultaneously, and there is no manual reset command from the safety-level control and display device, test command B is high from 0-10 seconds.

[0057] In the real instruction locking unit, when the test instruction B exists, the real instruction is locked by the fourth AND gate AND4 and cannot be output; during the existence of the test instruction B, affected by the test locking instruction C, the test instruction D is high from 0 to 5 seconds and low from 6 to 10 seconds; at this time, the output of the first OR gate OR1 is high from 0 to 5 seconds and low from 6 to 10 seconds; when the output of the first OR gate OR1 is high, the test dedicated safety facility driving instruction received by the priority module is high, and when the output of the first OR gate OR1 is low, the test dedicated safety facility driving instruction received by the priority module is low, thereby verifying that the hard-wired path from the SETA controller to the priority module can be triggered normally, and can also be restored to the original state (reset) after being triggered, proving that there is no fault in the hard-wired path.

[0058] Based on the bypass instructions it receives, the priority module determines whether to output the dedicated test safety facility drive instructions to the SETA test feedback processing unit or the SETB test feedback processing unit. Continuing with the example of a SETA controller bypass, the priority module outputs the dedicated test safety facility drive instructions to the SETA test feedback processing unit but not to the SETB test feedback processing unit (DO in the figures represents an output pin, and DI represents an input pin). The priority module includes a bypass blocking unit and a priority management & drive management unit. The dedicated test safety facility drive instructions output by the bypassed SETA controller are blocked by the bypass blocking unit in the priority module and cannot be sent to the on-site safety-level actuator via the priority management & drive management unit, preventing the test instructions from triggering the safety-level actuator.

[0059] See also Figure 3, the output of the second OR gate OR2 is low during the test, the output of the eighth AND gate AND8 is low from 0 to 5 seconds and high from 6 to 10 seconds, the output of the fifth AND gate AND5 is low from 0 to 5 seconds and high from 6 to 10 seconds, the output of the sixth AND gate AND6 is high from 0 to 5 seconds and low from 6 to 10 seconds, the output of the first RS trigger is low from 0 to 5 seconds and high from 6 to 10 seconds, and the output of the second RS trigger is high from 0 to 10 seconds; thus, as long as there is no fault in the tested circuit, the following will appear: the F→T indicator light is on from 0 to 10 seconds; the T→F indicator light is off from 0 to 5 seconds and on from 6 to 10 seconds, and the indicator light corresponding to the SETA test feedback processing unit is off from 0 to 5 seconds and on from 6 to 10 seconds.

[0060] The above operating principle analysis is based on n = 1. When n > 2, as long as the tested line is fault-free, the following conditions will apply: the F→T indicator will be on from 0 to 10 seconds; the T→F indicator will be off from 0 to 5 seconds and on from 6 to 10 seconds; the indicator corresponding to the first SETA test feedback processing unit will be off from 0 to 5 seconds and on from 6 to 10 seconds; and the indicator corresponding to the second SETA test feedback processing unit will be off from 0 to 5 seconds and on from 6 to 10 seconds. When n > 2, if the line from the SETA controller to the first priority module fails (e.g., it cannot be opened or closed), the F→T or T→F indicator will be off from 0 to 10 seconds; the indicator corresponding to the first SETA test feedback processing unit will be off from 0 to 10 seconds, and the indicator corresponding to the second SETA test feedback processing unit will be on from 0 to 10 seconds.

[0061] In summary, the nuclear power plant priority module interface test system provided in the embodiments of the present application includes a safety-level control and display device, an RPS bypass device, three safety-level controllers (SETA, SETB, and a third controller), and n priority modules. The user is responsible for bypassing the SETA and SETB controllers and sending test instructions through the RPS bypass device and the safety-level control and display device, ensuring that only one of the SETA and SETB controllers is bypassed at any given time, while the other maintains normal control. The third controller is responsible for processing test feedback after bypassing the SETA or SETB controller. The user only needs to operate the system through the bypass device and the safety-level control and display device to verify the normal operation of the hard-wired path from the SETA / SETB controller to the priority module through a series of logic units and circuits. The test results are then displayed through indicator lights on the safety-level control and display device, thereby improving the automation level of the interface test. Moreover, the interface test system uses safety-level control and display devices to trigger and display feedback of test instructions, eliminating non-safety-level equipment and software such as maintenance tools, test interface devices, and periodic test software, reducing the potential impact of non-safety-level items on the RPS system and reducing the risk of malfunction of on-site safety-level actuators.

[0062] The operation of the tester in this test is very simple. Take the SETA controller bypass as an example: the tester only needs to select SETA controller bypass on the RPS bypass device. The RPS bypass device will then prompt the tester that the SETA controller is in the SETA test bypass ready state. At the same time, the safety-level control and display device will prompt the tester to start the test. Then, the tester observes whether the test results displayed on the safety-level control and display device meet the expectations. If so, the reset operation is selected in the safety-level control and display device to eliminate the corresponding test feedback status display. If not, it indicates that there is a problem in the signal link from the SETA controller to the priority module. The specific fault location can be determined based on the test results displayed in the safety-level control and display device. Finally, the tester cancels the SETA controller bypass in the RPS bypass device and observes that the test ready indicator light goes out. At this point, the interface test from the SETA controller to the priority module is completed.

[0063] In one possible implementation, to ensure critical safety protection in an RPS system emergency, an interlock circuit is provided in the bypass state judgment unit of the X controller to prevent the SETA controller and the SETB controller from being bypassed simultaneously at any time. The X controller sends the bypass command after the interlock processing to the priority module (in one possible implementation, to enhance the reliability of the bypass command, the bypass command after the interlock processing is sent to the priority module via a redundant hard-wired link. This design can prevent the safety-level actuator from malfunctioning due to the loss of the bypass command after the interlock processing, see Figure 1 、 Figure 2 and Figure 3 A-Bypass 1 and A-Bypass 2 in the example). After receiving the bypass command, the priority module sends a feedback signal to the RPS bypass device, SETA controller, and SETB controller, forming a closed-loop confirmation mechanism. The RPS bypass device displays the test-ready indication only when it confirms that the bypass command manually triggered by the user in the RPS bypass device matches the feedback signal from the priority module. The SETA controller and SETB controller trigger the safety-level control and display devices to display the test-ready indication only when they confirm that the bypass command manually triggered by the user in the RPS bypass device matches the feedback signal from the priority module. This closed-loop confirmation mechanism not only improves the safety of the RPS system but also ensures the smooth progress of the interface test process.

[0064] To achieve this, see Figure 5 , the RPS bypass device includes: a SETA bypass instruction sending end connected to the SETA controller and the SETB controller, a SETB bypass instruction sending end connected to the SETA controller and the SETB controller, and a feedback signal receiving end connected to the priority module;

[0065] The SETB bypass instruction sending end and the feedback signal receiving end are respectively connected to the two input ends of the eleventh AND gate AND11, and the output end of the eleventh AND gate AND11 is connected to the SETB test ready indicator light on the RPS bypass device; the SETA bypass instruction sending end and the feedback signal receiving end are respectively connected to the two input ends of the twelfth AND gate AND12, and the output end of the twelfth AND gate AND12 is connected to the SETA test ready indicator light on the RPS bypass device;

[0066] The bypass state judgment unit in the SETA controller includes a thirteenth AND gate AND13, a fourteenth AND gate AND14, and a fifteenth AND gate AND15; wherein, a first input terminal of the thirteenth AND gate AND13 is connected to the SETA bypass instruction sending terminal; a first input terminal of the fourteenth AND gate AND14 is connected to the SETB bypass instruction sending terminal; an output terminal of the thirteenth AND gate AND13 is connected to the second input terminal of the fourteenth AND gate AND14 after being inverted; an output terminal of the fourteenth AND gate AND14 is connected to the second input terminal of the thirteenth AND gate AND13 after being inverted; an output terminal of the thirteenth AND gate AND13 is also connected to the first input terminal of the fifteenth AND gate AND15 and the D0 drive logic unit; a second input terminal of the fifteenth AND gate AND15 is connected to the feedback signal receiving terminal; and an output terminal of the fifteenth AND gate AND15 is connected to the safety level control and display device.

[0067] Still see Figure 5 Taking the interface test through the SETA controller as an example, the tester manually triggers the SETA bypass instruction on the RPS bypass device. At this time, the SETA bypass instruction sending end is at a high level, and the SETB bypass instruction sending end is at a low level. At this time, the SETA bypass instruction sending end signal and the SETB bypass instruction sending end signal are processed by the interlock circuit in the SETA controller and output a high level. The output signal of the interlock circuit is sent to the priority module through the DO drive logic unit, causing the priority module to send a feedback signal. The feedback signal is high level, and then: the twelfth AND gate AND12 outputs a high level, and the SETA test ready indicator on the RPS bypass device is lit; the eleventh AND gate AND11 outputs a low level, and the SETB test ready indicator on the RPS bypass device remains off; at the same time, the fifteenth AND gate 15 in the SETA controller outputs a high level, and the test ready indicator in the safety level control and display device is lit.

[0068] Regarding the wiring between the safety level control and display device, the RPS bypass device, the three safety level controllers, and the n priority modules, in the drawings of this application, dotted lines are used to represent hard-wired links, and solid lines are used to represent communication links.

[0069] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present application. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the embodiments of the present application. Therefore, the embodiments of the present application are not limited to the embodiments shown herein, but are intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A nuclear power plant priority module interface test system, characterized in that: include: The safety level control and display device, RPS bypass device and three safety level controllers located in the reactor protection system RPS, and n priority modules located outside the RPS, n ≥ 1; The three safety level controllers are SETA controller, SETB controller and third controller; the instructions output by RPS in the nuclear power plant to each priority module are divided into two groups, SETA and SETB; each group of instructions is equipped with a corresponding controller, namely SETA controller and SETB controller; The X controller includes: a bypass state judgment unit, a test instruction trigger unit, a test time control unit, n real instruction locking units and n DO drive logic units; X=SETA,SETB; The RPS bypass device is connected to the X controller and is used to send bypass instructions to the SETA controller or SETB controller under user operation; the safety level control and display device is used to send test instructions or manual reset instructions to the X controller under user operation; The bypass state judgment unit is used to send the bypass instruction received by the X controller to the first input terminal of the i-th priority module via the i-th DO drive logic unit, and to send an X test ready signal after confirming that the X controller is bypassed; the DO drive logic unit is used to convert the input signal into a signal that can be recognized by the priority module; i = 1, 2, 3, ... n; The test instruction trigger unit includes a first AND gate (AND1); the test time control unit includes a first pulse generating circuit (Pulse1), a second pulse generating circuit (Pulse2), a delay circuit, and a second AND gate (AND2); each real instruction locking unit includes a third AND gate (AND3), a fourth AND gate (AND4), and a first OR gate (OR1); the two input ends of the first AND gate (AND1) are respectively used to receive the X test ready signal and the test instruction; the output end signal of the first AND gate (AND1) passes through the first pulse generating circuit (Pulse1) and the delay circuit in sequence, is inverted, and then input into the first input end of the third AND gate (AND3) in each real instruction locking unit; the input end of the second pulse generating circuit (Pulse2) is used to receive the manual reset instruction; the output end signal of the second pulse generating circuit (Pulse2) after inversion processing, the X test ready signal, and the output end signal of the first pulse generating circuit (Pulse1) are respectively input into the first input end of the third AND gate (AND3) in each real instruction locking unit; The output terminal signal of the second AND gate AND2 is respectively input into the three input terminals of the second AND gate (AND2); the output terminal signal of the second AND gate AND2 is input into the second input terminal of the third AND gate AND3 in each real instruction locking unit; the two input terminals of the fourth AND gate AND4 in each real instruction locking unit are respectively used to receive the signal after the output terminal signal of the second AND gate AND2 is inverted and the real instruction; in each real instruction locking unit, the output terminal of the third AND gate (AND3) and the output terminal of the fourth AND gate (AND4) are respectively connected to the two input terminals of the first OR gate (OR1); the output terminal of the first OR gate (OR1) in the i-th real instruction locking unit is connected to the second input terminal of the i-th priority module via the i-th DO driving logic unit; the first pulse generating circuit (Pulse1) and the second pulse generating circuit (Pulse2) are both used to start outputting a high level for T seconds when detecting the rising edge of the input signal, and then change back to a low level; the delay circuit is used to delay the input signal for T / 2 seconds, where T is a preset value; The third controller includes n SETA test feedback processing units and n SETB test feedback processing units; each X test feedback processing unit includes a second OR gate (OR2), a fifth AND gate (AND5), a sixth AND gate (AND6), a seventh AND gate (AND7), an eighth AND gate (AND8), a first RS flip-flop, and a second RS flip-flop; the two input ends of the second OR gate (OR2) in each X test feedback processing unit are respectively used to receive the signal after the X test ready signal is inverted and the manual reset instruction; the output end signal of the second AND gate (AND2) in the i-th real instruction locking unit and the output end signal of the delay circuit are respectively input into the two input ends of the eighth AND gate (AND8) in the i-th X test feedback processing unit; the output end signal of the third AND gate (AND3) in the i-th real instruction locking unit is input into the i-th X test feedback The first input terminal of the sixth AND gate (AND6) in the processing unit; the i-th priority module inputs the signal from its second input terminal into the second input terminal of the sixth AND gate (AND6) in the i-th X-trial feedback processing unit, and inputs the signal after inversion processing into the second input terminal of the fifth AND gate (AND5) in the i-th X-trial feedback processing unit; in each X-trial feedback processing unit, the output terminal of the second OR gate (OR2) is connected to the reset terminals of the first RS flip-flop and the second RS flip-flop, the output terminal of the eighth AND gate (AND8) is connected to the first input terminal of the fifth AND gate (AND5), the output terminal of the fifth AND gate (AND5) is connected to the set terminal of the first RS flip-flop, and the output terminal of the sixth AND gate (AND6) is connected to the set terminal of the second RS flip-flop; the output terminal of the first RS flip-flop and the output terminal of the second RS flip-flop are respectively connected to the two input terminals of the seventh AND gate (AND7); In the safety-level control and display device, one lamp group is provided corresponding to n SETA test feedback processing units, and one lamp group is provided corresponding to n SETB test feedback processing units. The output of a seventh AND gate (AND7) in the i-th X test feedback processing unit is connected to the i-th indicator light in the corresponding lamp group. When n ≥ 2, the third controller further includes a ninth AND gate and a tenth AND gate. The output of a first RS flip-flop in the n X test feedback processing units is connected to the i+1-th indicator light in the corresponding lamp group via the ninth AND gate, and the output of a second RS flip-flop in the n X test feedback processing units is connected to the i+2-th indicator light in the corresponding lamp group via the tenth AND gate. When n = 1, the ninth AND gate and the tenth AND gate are omitted.

2. The nuclear power plant priority module interface test system according to claim 1, characterized in that: The safety-level control and display device utilizes optical fibers and communication equipment to form a communication network with the SETA controller, the SETB controller and the third controller.

3. The nuclear power plant priority module interface test system according to claim 1, characterized in that: An interlock circuit is provided in the bypass state judgment unit to prevent the SETA controller and the SETB controller from being bypassed at the same time; The bypass state judgment unit is used to send the bypass instruction received by the X controller to the first input end of the i-th priority module through the i-th DO drive logic unit after interlocking processing; The priority module is used to send a feedback signal to the RPS bypass device, SETA controller and SETB controller after receiving the bypass instruction, forming a closed-loop confirmation mechanism; the RPS bypass device will only display the test ready indication information after confirmation, and the SETA controller and SETB controller will only trigger the safety level control and display device to display the test ready indication information after confirmation.

4. The nuclear power plant priority module interface test system according to claim 3, characterized in that: The RPS bypass device includes: a SETA bypass instruction sending end connected to the SETA controller and the SETB controller, a SETB bypass instruction sending end connected to the SETA controller and the SETB controller, and a feedback signal receiving end connected to the priority module; The SETB bypass instruction sending end and the feedback signal receiving end are respectively connected to the two input ends of the eleventh AND gate (AND11), and the output end of the eleventh AND gate (AND11) is connected to the SETB test ready indicator light on the RPS bypass device; the SETA bypass instruction sending end and the feedback signal receiving end are respectively connected to the two input ends of the twelfth AND gate (AND12), and the output end of the twelfth AND gate (AND12) is connected to the SETA test ready indicator light on the RPS bypass device; The bypass state judgment unit in the SETA controller includes a thirteenth AND gate (AND13), a fourteenth AND gate (AND14), and a fifteenth AND gate (AND15); a first input terminal of the thirteenth AND gate (AND13) is connected to a SETA bypass instruction sending terminal; a first input terminal of the fourteenth AND gate (AND14) is connected to a SETB bypass instruction sending terminal; an output terminal of the thirteenth AND gate (AND13) is connected to a second input terminal of the fourteenth AND gate (AND14) after being inverted; an output terminal of the fourteenth AND gate (AND14) is connected to a second input terminal of the thirteenth AND gate (AND13) after being inverted; an output terminal of the thirteenth AND gate (AND13) is also connected to a first input terminal of a fifteenth AND gate (AND15) and a D0 driving logic unit; a second input terminal of the fifteenth AND gate (AND15) is connected to the feedback signal receiving terminal; and an output terminal of the fifteenth AND gate (AND15) is connected to a safety level control and display device.

5. The nuclear power plant priority module interface test system according to claim 4, characterized in that: The RPS bypass device is provided with a three-position rotary switch; the three-position rotary switch has three positions, corresponding to the three states of neither the SETA controller nor the SETB controller being bypassed, only the SETA controller being bypassed, and only the SETB controller being bypassed.

6. The nuclear power plant priority module interface test system according to claim 3, characterized in that: The bypass state judgment unit is used to send the bypass instruction received by the X controller to the i-th DO drive logic unit after interlocking processing, and then the i-th DO drive logic unit sends it to the first input end of the i-th priority module through a redundant hard-wired link.

Images