Nuclear Safety Channel Control with Integrated Diagnostics Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current digital control safety systems in nuclear power plants lack direct access to safety system sensors and actuation mechanisms from normal operation systems, complicating monitoring and control, and do not have built-in self-testing capabilities, which hampers failure localization and increases recovery time.
Innovation Solution
The system integrates normal operation features and hardware/software platforms into safety channels, enabling access to sensors and actuation mechanisms, and includes self-testing and monitoring capabilities, using redundant buses and Ethernet interfaces for data exchange and control, allowing for enhanced diagnostic capabilities and fault detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If safety channels are physically separated from normal operation system, then safety and reliability are improved, but access to sensors and actuation mechanisms becomes difficult and additional inputs are required
Solution Approach 1:
The system is divided into separate safety channels and normal operation system, with each safety channel being physically isolated. This segmentation maintains safety integrity while allowing controlled access through defined communication paths. The safety channels process safety-critical functions independently, while access to sensors and actuators is provided through dedicated interfaces that maintain the physical separation boundary.
2Reliability
If safety channels are physically separated, then safety integrity is improved, but failure localization and recovery time are worsened due to lack of self-checking capabilities
Solution Approach 1:
The safety channels incorporate self-checking capabilities that continuously monitor their own operational status and generate diagnostic information. This feedback mechanism allows the system to detect failures, localize them to specific channels or components, and initiate recovery procedures without external intervention, thus maintaining safety integrity while improving maintainability.
Solution Approach 2:
The safety channels are equipped with built-in self-testing and self-diagnostic functions that enable them to monitor their own health status, detect anomalies, and initiate recovery actions autonomously. This self-service capability eliminates the need for constant external monitoring while ensuring rapid failure detection and recovery, resolving the contradiction between safety isolation and ease of repair.
3Ease of operation
If additional inputs are added for monitoring and control access, then access capability is improved, but device complexity increases
Solution Approach 1:
The safety channels are designed with multi-functional interfaces that provide both safety-critical processing and access to sensors/actuators through the same physical infrastructure. The communication bus and interface circuits serve dual purposes: maintaining safety channel independence while enabling monitoring and control access, thus avoiding the need for separate dedicated inputs and reducing overall system complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to automatics and computer engineering, and can be used in I&C systems of nuclear power plants (NPP) for constructing control safety systems (CSS) of NPP. Technical result of the invention includes reduction of inputs for monitoring and automatic control of general NPP equipment from the side of the safety and normal operation systems owing to normal operation features integrated in safety channels, enhancement of safety system reliability and protection against common cause failures by means of constructing safety features and normal operation features based on different software & hardware platforms, extension of CSS diagnostic capabilities owing to implementation by a normal operation automation controller of additional functions of evaluating safety channel operation using NPP state-of-health data received by the controller from the process and from the automation controllers of safety channels, extension of CSS diagnostic capabilities owing to equipment state-of-health control features integrated into CSS generating special fault signals, and their input, processing and transmission by the normal operation automation controller to the upper level of the normal operation system control. Technical result is achieved by the fact that in the control safety system of a nuclear plant, which contains multiple identical safety channels, each channel includes process signal I/O stations IOS1-n, actuation mechanism priority control stations PCS1-m connected with the main control room MCR and emergency control room ECR, safety features automation controller (SF AC), safety feature I/O bus SF IOB for data exchange between SF AC and IOS/PCS stations, and is cross-connected with other safety channels by means of duplex optical fiber communication paths; the IOS station contains modules of communication with the process MCP1-k and communication module - converter of communication interfaces CIC of SF IOB bus; the PCS station contains actuation mechanism priority control modules PCM1-e and communication modules: voting communication module VCM and voting module VM of SF IOB bus; the automation controller SF AC contains safety feature automation processor module SF APM and communication modules - branching modules BM-41-p of SF IOB bus; automation controllers SF AC of all safety channels are connected to the normal operation system via redundant bus EN; each safety channel additionally contains normal operation automation controllers AC1-s that are connected with IOS1-n stations and PCS1-m stations via redundant buses ENL of normal operation built based on switched Ethernet interface, radial structure of net switch connection and specific data-level communications protocol, and with the normal operation system via redundant bus EN of normal operation built based on switched Ethernet interface, ring structure of net switch connection and specific data-level communications protocol; normal operation automation processors AC, means of AC communication with MCP and PCM modules integrated into IOS and PCS stations, and normal operation software & hardware built in MCP and PCM modules are built based on different hardware & software platforms; IOS and PCS stations, SF AC controller, and power supply and communications equipment of the safety system contain built-in self-testing and self-monitoring means that generate at special outputs binary signals of state of the respective equipment 'operative/inoperative' coming to NO AC, where signals are processed and transmitted to the upper level of the normal operation system control via EN bus. In IOS station, communication module CIC of SF IOB bus via separate SF IOB communication lines is connected with automation controller SF AC of safety channel and with each MCP1-k module of this station. Each IOS station contains two redundant interface modules IMN of normal operation connected to normal operation automation controller NO AC via redundant bus ENL; an individual normal operation processor is built in each MCP1-k module, which is connected with each of the 2 IMN modules via separate line of a serial duplex 'point-to-point'-type interface of the normal operation bus NO IOB. In each safety channel, PCS stations are combined into groups of N stations, a number of PCS stations is determined by a number of safety channels; the first station of the group PCS1 via SF IOB communication line is connected with SF AC controller of its safety channel, other stations PCS2-N of the group are connected with SF AC controllers of the other safety channels 2-N; communication module VCM of each station PCS is connected with communication module of voting according to '2 out of N' majority algorithm VM of its PCS station and communication modules VM of other PCS stations of the group; communication module VM of each PCS station is connected via SF IOB communication lines with priority control modules PCM1-e of this station. Each PCS station contains two redundant interface modules IMN of normal operation connected to normal operation automation controller NO AC via redundant bus ENL; an individual normal operation processor is built in each PCM1-e module, which is connected with each of the 2 IMN modules via separate line of serial duplex 'point-to-point'-type interface of the normal operation bus NO IOB.