Redundant Control Switching Device With 2oo4 Button Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional control switching devices, despite being configured with multiple locations, are prone to erroneous or failed operations due to single-factor failures, leading to potential inadvertent switching in nuclear power plant control systems.
Innovation Solution
A control switching device with duplicated control devices and operating panels at two locations, utilizing a first and second determination unit to perform 2oo4 voting operations on operation signals from multiple buttons to ensure accurate and redundant control switching, preventing inadvertent switching by verifying the operation of multiple buttons before initiating control changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If control switching devices are provided at multiple locations, then the ability to switch control during emergency is improved, but the risk of erroneous switching due to single-factor failure increases
Solution Approach 1:
The control switching device is divided into multiple independent control devices (first control device and second control device) located at different positions. Each control device has its own operating panel with multiple buttons (A1, A2, B1, B2). This segmentation ensures that a failure at one location does not affect the other, allowing redundant control switching capability while isolating failure risks.
Solution Approach 2:
Each control device is equipped with specific local operating panels containing multiple buttons (A1, A2 for first control device; B1, B2 for second control device). The local quality of having multiple buttons at each location enables independent verification and prevents erroneous switching by requiring multiple button operations, while maintaining the ability to switch control from either location.
2Device complexity
If a single button is used for switching operation, then the device complexity is reduced, but the reliability of control switching deteriorates due to single-point failure
Solution Approach 1:
Instead of using a single button for switching, the system provides multiple buttons (A1, A2, B1, B2) at each control location. This excessive action approach requires multiple button operations to initiate control switching, thereby preventing erroneous switching due to single-button failure while maintaining relatively simple individual button structures.
Solution Approach 2:
The system changes the operational parameter from single-button activation to multi-button verification. The determination unit evaluates the combination of button operations (A1+A2 or B1+B2) to verify intended switching action. This parameter change from single-point to multi-point activation maintains operational simplicity while significantly improving reliability.
3Reliability
If multiple buttons are required for switching operation, then the prevention of erroneous switching is improved, but the ease of operation deteriorates
Solution Approach 1:
The system performs preliminary verification by requiring operation of multiple buttons (A1+A2 or B1+B2) before allowing control switching. This preliminary action ensures that the operator intends to switch control deliberately, preventing erroneous switching while the verification process itself becomes part of the standard operating procedure, thereby maintaining ease of operation.
Solution Approach 2:
The determination unit provides feedback by verifying the combination of button operations before executing the switching command. This feedback mechanism confirms that the intended switching action is deliberate and correct, improving switching accuracy while the automated verification process reduces the operational burden on the user.
Data Source
AI summary
This control switching device includes: a first operating panel provided at a first place and having A1, A2 buttons connected to a first control device and B1, B2 buttons connected to a second control device; and a second operating panel provided at a second place and having a1, a2 buttons connected to the first control device and b1, b2 buttons connected to the second control device. The first control device includes a first determination circuitry which determines whether to shut down input/output to/from an input/output device located at the first place, using operation signals of the A1, A2, B1, B2 buttons from the first operating panel. The second control device also includes a second determination circuitry similar to the first determination circuitry.