Nuclear Safety Channel Architecture Against Common Cause Failure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing control safety systems in nuclear power plants face reliability issues due to common cause failures, non-optimal redundancy, and high costs associated with extensive optical fiber communication, leading to potential false protection commands and complex software development.
Innovation Solution
Implementing a control safety system with dual redundant subsystems (subchannels A and B) using diverse hardware and software platforms, organized in a '2 out of 4' majority redundancy logic, and utilizing a centralized processing module with point-to-point Ethernet interfaces to reduce optical fiber reliance and enhance reliability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If safety channels use the same digital processing hardware and basic software, then device complexity is reduced, but reliability deteriorates due to common cause failures
Solution Approach 1:
The patent implements local quality by making each safety channel unique through customized processing hardware and software tailored to specific protection tasks, while maintaining standardized I/O interfaces and communication protocols. This allows each channel to have optimized characteristics for its function while preserving overall system reliability through diversity.
Solution Approach 2:
The system segments safety functions into independent channels, each with dedicated processing units and software modules. This segmentation isolates potential common cause failures to individual channels while maintaining overall system functionality through the independence of other channels.
2Reliability
If distributed software is applied across several processors, then reliability improves through redundancy, but device complexity and software development difficulty increase
Solution Approach 1:
The patent employs universal software modules that can execute on different processor types and architectures. These modular software components handle common safety functions across all channels, reducing overall software complexity while maintaining reliability through redundant execution on multiple processors.
Solution Approach 2:
The system changes software parameters and configuration settings to adapt universal modules to different processor platforms. This allows the same software to run reliably across multiple processors without increasing complexity, by adjusting runtime parameters rather than rewriting code for each platform.
3Reliability
If extensive optical fiber communication paths are used for cross-connecting safety channels, then reliability improves through robust data exchange, but cost and device complexity increase
Solution Approach 1:
The patent merges communication functions by combining data exchange, synchronization, and diagnostic capabilities into integrated communication modules. This reduces the number of separate optical fiber links needed while maintaining reliable communication between channels through multi-functional interfaces.
Solution Approach 2:
The system introduces intermediary communication controllers that manage data exchange between safety channels. These intermediaries consolidate optical fiber connections and provide intelligent routing, reducing the overall complexity of the communication network while ensuring reliable data transmission.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to automatics and computer engineering, and can be used in I&C systems of nuclear power plants (NPP) for constructing control safety systems (CSS) of NPP. Technical result of the invention is exclusion of common cause failures of all safety channels owing to including in each safety channel of the two mutually independent hardware and software sets built based on different hardware and software platforms and executing all functions of the safety channel, and enhancement of multichannel control safety system (CSS) reliability due to double redundancy of each channel equipment. Technical result is achieved by the fact that in the digital control safety system of a nuclear plant that contains multiple identical safety channels, each channel includes process signal I/O stations IOS1 - n, actuation mechanism priority control stations PCS 1-m connected with the main control room MCR and emergency control room ECR, safety features automation controller (SF AC), safety feature I/O bus SF IOB for data exchange between SF AC and IOS/PCS stations, and is cross-connected with other safety channels by means of duplex optical fiber communication paths; I/O stations IOS; priority control stations PCS and safety feature automation controller SF AC of each safety channel contain two mutually independent software & hardware sets that form subchannel A and subchannel B built based on different hardware & software platforms; each subchannel executes all functions of a safety channel, each CSS channel contains controller SF AC A of subchannel A and controller SF AC B of subchannel B, each of which is connected, respectively, with SF AC A and SF AC B controllers of other safety channels via interprocessor interfaces IPI A and IPI B of 'point-to point' type built based on Ethernet interface and specific data-level communication protocol, with the normal operation system via redundant switched system bus EN of normal operation built based on Ethernet interface, ring structure of net switches connection, and specific data-level communication protocol, with the main control room MCR and emergency control room ECR via communication lines of IPI1 A, IPI1 B and IPI2 A, IPI2 B buses, respectively, built based on Ethernet interface and specific data-level communication protocol, with IOS1 - n and PCS1 - m stations of the safety channel and with PCS1 - m stations of other safety channels via special-purpose I/O bus, respectively, SF IOB A of subchannel A and SF IOB B of subchannel B; and here each of SF IOB A and SF IOB B buses has a 'tree'-type structure, the upper root node of which is, respectively, automation processor module SF APM A of SF AC A controller and SF APM B of SF AC B controller, and the low end nodes are modules of communication with the process MCP of IOS 1 - n stations and priority control modules PCM of PCS1 - m stations, and intermediate nodes are communication modules, and here links between SF IOB A nodes and between SF IOB B nodes are implemented as the lines of serial duplex 'point-to-point'-type interface. I/O station IOS contains modules of communication with the process MCP1 - k, and two communication modules - converters of interfaces: CIC A of SF IOB A bus and CIC B of SF IOB B bus, and here CIC A module, CIC B module are connected via one communication line of the module with its automation controller SF AC A,SF AC B and via separate communication lines with each MCP1 - k module; modules of communication with the process MCP1 - k of IOS station include processor of subchannel A and processor of subchannel B that are connected, respectively, via intra-station lines of SF IOB A and SF IOB B buses with communication modules CIC A and CIC B and via SF IOB A and SF IOB B buses are connected, respectively, to SF AC A controller of subchannel A and SF AC B controller of subchannel B. Each priority control station PCS contains priority control modules PCM1 - e, communication modules of SF IOB A bus of subchannel A and SF IOB B bus of subchannel B: voting communication modules VCM A, VCM B and voting modules VM A, VM B of input commands from N channels according to '2 out of 4' principle. In each subchannel of a safety channel, PCS stations are combined into groups of N stations; the number of PCS stations is determined by the number of safety channels; in subchannel A of each safety channel the first station of the group PCS1 is connected by the SF IOB A communication line with SF AC A controller of its safety channel; the other stations PCS2 - N of the group are connected with SF AC A controllers of the other N-1 safety channels; communication module VCM A of each PCS station is connected with the voting communication module VM A of its PCS station and with communication modules VM A of the other PCS stations of the group; communication module VM A of each PCS station is connected via SF IOB A communication lines with priority control modules PCM1 - e; and in subchannel B of each safety channel communication links of PCM modules of PCS stations of the group with automation controllers SF AC B of each safety channel are implemented similarly to communication links of subchannel A. Priority control modules PCM1 - e of PCS station contain safety feature programmable logic circuits (PLC) - SF PLC A of subchannel A and SF PLC B of subchannel B that are connected, respectively, via intra-station lines of SF IOB A and SF IOB B buses with communication modules VM A of subchannel A and VM B of subchannel B and via SF IOB A and SF IOB B buses are connected, respectively, to controllers SF AC A of subchannel A and SF AC B of subchannel B. Automation controller SF AC A of subchannel A of each safety channel includes automation processor module APM A and p communication modules BM-4 A of SF IOB A bus connected via SF IOB A communication lines with processor modules SF APM A, with communication modules CIC A of I/O stations IOS1 - n and communication modules VCM A of priority control stations of their own safety channel and with communication modules VCM A of priority control stations PCS 1 - m of the other safety channels; automation controller SF AC B of subchannel B of each safety channel is similar to subchannel A as to its configuration and links.