Voting Circuit Limitation for Independent Safety Protection Logic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing safety function actuation logic in nuclear power plants does not ensure independency between duplex safety protection devices, as it can disable the emergency stop function based on coolant pressure when receiving abnormality signals from another device, even if the local device does not detect abnormalities, leading to potential safety function limitations.
Innovation Solution
A safety protection device with first determination circuits that output actuation demand signals when detecting abnormality and a voting circuit that determines a majority of actuation demand signals, combined with a limitation circuit to prevent dependence on external device signals, ensuring the safety function is only limited when abnormalities are detected locally.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the safety function actuation logic receives abnormality signals from another device in a duplex configuration, then the safety function can be actuated based on majority voting, but the independency between duplex devices is compromised and the safety function may be disabled unnecessarily
Solution Approach 1:
The patent divides the determination logic into two separate segments: a first determination circuit that evaluates only local detector signals, and a voting circuit that combines both local and external determination results. This segmentation ensures that the local device maintains independent decision-making capability while still participating in the overall safety function actuation through the voting mechanism.
Solution Approach 2:
The patent introduces an intermediary limitation circuit that mediates between the voting circuit output and the safety function actuation. This limitation circuit acts as a gatekeeper that prevents the safety function from being disabled solely based on external device signals, thereby preserving device independency while allowing cooperative safety actuation when both local and external conditions are met.
2Adaptability or versatility
If the safety function is limited to depend only on local detector signals, then device independency is maintained, but the ability to achieve high reliability through multiplexed detectors is reduced
Solution Approach 1:
The patent merges the independent local determination result with the external determination results in the voting circuit. The voting circuit combines multiple determination sources (local first determination circuit and external second determination circuits) to achieve a majority vote, thereby enhancing reliability while preserving local device independence through the limitation circuit.
3Adaptability or versatility
If the voting circuit considers only local determination results, then device independence is ensured, but the safety function cannot be actuated when external detectors indicate abnormality
Solution Approach 1:
The patent implements a feedback mechanism where the voting circuit receives determination results from both local and external devices and feeds back the combined evaluation to control the safety function actuation. The limitation circuit provides additional feedback to ensure that external signals alone cannot disable the safety function, maintaining a balance between independence and cooperative reliability.
Data Source
AI summary
This safety protection device includes: a limitation circuit for performing limitation so that a determination result of a voting circuit does not depend on only outputs of the second determination circuits from outside of the safety protection device, is provided to the voting circuit or at a preceding stage or a subsequent stage of the voting circuit. The voting circuit is imparted with a function of executing a limiting function only when abnormality of a process parameter is detected by a signal from a detector connected to the own device, thereby preventing the function of the own device from being limited or disabled by only a signal from another device.