Patent Number: 045171548
Section: summary

FIELD OF THE INVENTION The present invention relates to nuclear power plants and, more particularly, to a self-test subsystem for a nuclear reactor protection system. Specifically, between sensors such as core overheat sensors and a corresponding safety or operation function, such as the insertion of rods to shutdown a reactor, there is located an electronic nuclear reactor protection system. The readiness of this system to respond to emergency conditions is the subject of this disclosure. Specifically, provision is herein disclosed for constant self-test of such systems to assure that at all times a power plant is in readiness to respond to emergency. BACKGROUND OF THE INVENTION Modern nuclear safety requirements are high. In the prior art it is known to have nuclear reactor protection systems. An example of such a system is helpful to the reader. Specifically, if core overheat is detected, it is usually detected in sensors. The sensors in turn have to communicate through a nuclear reactor protection system to actuate core apparatus for correcting the condition. Assuming that overheat has been detected by a sensor, an appropriate response (used in this disclosure as a primary example) may be the insertion of rods to absorb neutrons and shutdown the reactor. This may be part of a system wide emergency shutdown known as a "scram". In such a system there is always the danger of latent failures. Specifically, and as time lapses after a test has occurred, the probability increases that the system may be inoperative. The system must await the next actual test until proper operation can again be confirmed and a lower probability of failure established. The seriousness of undetected failures becomes even more apparent when one considers the case of so called "common mode failures". "Common mode failures" are system wide. Because they are system wide, common mode failures affect the system throughout, even at points of system redundancy. Failures due to high voltage transients, fire, earthquake, and other mechanical causes may remain latent until the system is exercised. If system exercise is to occur in response to an emergency, no one may be aware that the system is incapable of responding to the emergency until the required emergency procedure is instituted. Then it is too late. An operator may respond to an emergency in a number of different ways by moving the plant from the perilled operating state to one that is safer. All of these safer states require different operating configurations of the plant. In nuclear plants, the availability of different operating configurations has not heretofore been capable of test without actual plant manipulation. SUMMARY OF THE PRIOR ART Prior art testing of nuclear plants has included manual tests. In such manual tests, portions of the system are first isolated. Thereafter, these isolated portions are individually exercised. During such individual exercise, at least three conditions can occur, all of which are detrimental to the plant operating state. First, an isolated portion of the plant may have to be rendered inoperative for the test to occur. Whenever any portions of the plant are rendered inoperative, emergency responses and/or plant operations must of necessity be adversely affected. For example, individual exercise of rods in the reactor core will of itself affect core reaction. Secondly, while the exercise is occurring, system failure is still possible and may become even more catastrophic. Typically, the isolated portion of the system is not capable of responding to an emergency. For example, assuming that one of four banks of reactor rods is being tested and therefore rendered inoperative, failure of a second bank of reactor rods leaves shutdown capacity at a reduced level of design system capacity. Finally, some shutdown components of the system require that the system go completely off-line. When the system goes completely off-line, at best, valuable power output is lost. System losses at rates of $200,000 per hour necessitated because of tests are common and known. Moreover, testing itself can cause an undetected failure. For example, rods are actuated and a solenoid breaks while returning the rods. The result of the test shows the solenoid to be working while in actuality it is now broken and the break will not be detected until the next test. SUMMARY OF THE INVENTION A self-test system for a nuclear power plant, nuclear reactor protection system is disclosed. Nuclear protection systems are the electronic controls, typically including circuit cards, located intermediate between sensors (as for detecting core overheat) and a control (as for providing rod injection to shut down a reactor). Constant surveillance of the nuclear system protection system is provided by a microprocessor that serially addresses protection system circuit cards and loads them at predetermined input points with test commands. The addressed cards are thereafter simultaneously activated by a system-wide command. The test command is a pulse which is so short in duration that its affect is transparent to the system and cannot cause overall system operation. The pulse passes through the actuating electrical components to verify, on the real actuating path, the operating integrity of the system. After an appropriate response interval, the output state of the system is recorded in system-wide resident registers. Thereafter, with response data contained in these registers frozen at the recorded state, the output is read. This result is compared with the expected output in computer memory. If correspondence between memory output and register output is found, the next sequential set of test commands is acted upon. If correspondence is not found, a subroutine search is automatically conducted to locate the error. The disclosed self-test subsystem is duplicated in four separate divisions with each division testing one of the four duplicate protection systems. The three remaining and idle divisions constantly monitor the active subsystem's operation. The end result is an overall system which reduces the mean time to discover error, thus minimizing mean time to repair and maximizing protection system availability and safety. The separation of the protection system into four duplicate divisions is not dependent on the disclosed invention and the invention may be applied to protective systems with a different number of divisions. OTHER OBJECTS, FEATURES AND ADVANTAGES An objective of this invention is to disclose a process for testing the electronic controls of a nuclear reactor protection system. According to this aspect of the invention, test input registers throughout the nuclear reactor protection system are serially loaded on command from a computer. These test input registers, once wholly loaded, are simultaneously activated by a system-wide command. Test pulses are released, which test pulses have such short duration in real time that they are not seen by or are "transparent" to the nuclear plant operating system. The test pulses pass through the real actuating electronic components of the nuclear system thus causing the components to be in fact tested for their actual electronic integrity. Thereafter and when an appropriate period of time has passed, the response data contained in the registers are frozen so as to record the protection system's state. Once the data is frozen, the system wide registers are serially read and their output compared with predetermined, correct responses stored in memory. Where matching occurs, system integrity is verified. An advantage to this apparatus is that no part of the power plant need be isolated for testing of nuclear system integrity to occur. Therefore, even though the disclosed process is continually verifying the operational integrity of the plant, in no way is the plant's ability to respond to an emergency adversely affected. For example, in testing the controls to exercise rods in a reactor, no actual exercise of the rods is required. A further advantage of the disclosed process is that since system exercise is not required for testing, the system is at all times capable of responding to an emergency. The necessity of rendering inoperative banks of rods, for example, is not required for a test of the nuclear reactor protection system. Yet a further advantage of this apparatus is to reduce substantially the necessity of taking the system off-line. Accordingly, expensive test periods wherein system downtime is required are avoided. Yet another object of this invention is to disclose an apparatus for practicing the disclosed process. Specifically, at least one computer (here having a central processing unit and associated memories) sequentially tests various discrete systems. In the test of each group of protection system circuits, input registers at preselected locations throughout the protection system's electronic cabinets are serially addressed and thereafter loaded with test commands. When the input registers are loaded, test impulses of a duration short enough to be transparent to overall operation are simultaneously released by a system-wide pulse. This simultaneous release causes the effectively transparent pulses to travel through the real actuating path of the system. After an appropriate interval, and upon receipt of signal, the system response state is frozen in resident registers. These registers are thereafter read and their output compared to data stored in memory output to verify integrity of the real operating path of the system. An advantage of this aspect of the invention is that the test process of this invention may be continually and repeatedly practiced by a computer. The computer in practicing the test process continually and remotely verifies the operational integrity of a nuclear reactor protection system. Yet another advantage of this aspect of the invention is that the system is capable of detecting whether any discrete emergency function, in whole or in part, is sufficiently functional to move the plant to another operating state. For example, during either normal operation or crisis, an operator can ascertain relatively quickly before rearrangement of the operating state of the plant, whether the next and intended operating state of the plant is available. Yet another object of this invention is to disclose partitioning of the protection system's circuits into subgroupings in the event that an error is located. According to this aspect of the invention and where the memory output does not compare with the desired register output, partitioning of the test can occur. In such partitioning, either additional system output registers may be read or, alternatively, new system subtests may be initiated. Further, appropriate branching can be accomplished so that testing is directed with increasing particularity towards points of system failure. Yet another object of this invention is to disclose the components of the test system and in particular to disclose replacable circuit cards. According to this aspect of the invention, the cards include electronic apparatus for recognizing serial addresses and registers for input or output of either test commands or system status. These discrete cards are replacable and inventoried so that when a point of failure is located with particularity, a technician may be dispatched for card removal and replacement to restore system integrity. A further advantage of this apparatus is continuous testing wherein the mean time to discover failure is dramatically reduced. The sooner the failure is discovered and located, the sooner it can be repaired and the system be made available. Using the formula: EQU (MTBF/MTBF+MTBR=A, where: A=Availability, PA1 MTBF=Mean Time between Failures, and PA1 MTBR=Mean Time between Repairs, it is easily seen that as MTBR is reduced, availability approaches the desired 100%. An advantage of testing without affecting functional operation is that the particular system being tested remains fully operative, thus retaining full safety protection for the plant. Furthermore, when simple hardware design precautions are observed, failures in the self-test system itself cannot affect any essential circuitry of the nuclear reactor protection system. Another advantage of automatic, computerized testing over manual testing is speed. The self-test system performs a complete agenda of tests within 30 minutes as compared to many days of manual test. It also allows for testing by request as well as automatic surveillance. A further advantage of the self-test system is the ability to test using simulated plant state input to the nuclear system protection system. By not requiring the plant to be in any particular actual state to conduct the test, time is saved and availability thereby enhanced. This is especially true for seldom-used states such as core overheating which would require a scram. Yet another advantage of this invention is that there are four independent self-test controllers, one for each of the redundant nuclear system protection systems. There are no electrical connections between the four self-test controllers, the only intercommunication being through optically coupled isolators. The advantage of this isolation is that if, for example, one of the self-test controllers were shorted out it would not affect the operation of the others. Furthermore, there are minor variations in the design of the four self-test controllers (for example, wiring) in order to avoid any possible common-mode systematic design error.