Patent Number: 046613102
Section: summary

BACKGROUND OF THE INVENTION 1. Field of the Invention: This invention is related to highly reliable, redundant channel protection systems for complex closely controlled processes and is particularly suitable for an integrated protection system for a nuclear power plant. More particularly, it is directed to a fail-safe, multichannel protection system which utilizes rectangular hysteresis loop magnetic core logic units controlled by the monitored parameters to gate pulsed signals to converters which energize the undervoltage coils of the reactor trip switch-gear with voting logic between redundant channels being modified by bypasses to accommodate for failed sensors or the removal of an entire channel from service for testing or maintenance. 2. Description of the Prior Art: Many industrial and commercial processes require close monitoring and rapid, reliable response to deviations from established criteria for an array of process parameters. The protection systems which carry out these functions must be reliable and fail-safe but must also be resistant to spurious responses to avoid costly down time. Nowhere is the need for a dependable protection system more essential than in a nuclear power plant. In such a plant, a large number of parameters must be continuously monitored to assure that conditions remain within specified operating limitations. Deviations from certain of the established criteria require that the reactor be immediately shutdown. Shutdown or tripping of the reactor is accomplished by removing power from mechanisms holding control rods above the reactor core so that the rods fall by gravity into the core where they absorb sufficient neutrons to lower the reactivity to the subcritical level. Regulations for the operation of nuclear power plants require that the protection system meet the single failure criterion under which the reactor must be tripped in response to deviations from any of the specified operating limitations despite the existence of any possible single failure in the protection system. Since the advent of commercial nuclear reactors, it has been the practice to provide redundant sensors, and where required, signal processors, for the critical parameters, and to utilize the signals thus generated in separate protection channels or actuation trains. Typically, a set of four signals is generated for each parameter, with one signal from each set being utilized in one of four protection channels. Thus, each protection channel incorporates a signal representative of the state of each of the monitored parameters, any one of which can generate a trip signal in that channel. The redundant channels provide reliability, however, in order to reduce the occurrence of spurious trips, coincidence of trip signals in the same set in more than one channel is required to trip the reactor. Typically, the coincidence of two out of four signals in a set, in other words, two of the channels, is required to remove power from the control rod actuators. The two out of four voting logic is carried out by the arrangement of the trip breakers which control the flow of electric power to the control rod actuators and by tie-ins between channels which assure that the trip signals in the two channels are from the same set. Since a trip signal is required in more than one channel to trip the reactor, the trip signal generated by an individual sensor is referred to as a partial trip signal. At times, a sensor in a set will fail and in some instances cannot be repaired until the reactor is shut down. In addition, regulations require that various components of the protection system be tested periodically. In many of the prior art protection systems, a failed sensor or a sensor taken out of service for maintenance or test generates a trip signal in the associated protection channel. This trip in one channel caused by an out of service sensor reduces the protection system from a two out of four voting system to a one out of three system, and therefore, reduces the availability of the system by subjecting it to a greater likelihood of a spurious trip caused by a failure or transient in only one other channel. The protection system described in commonly owned U.S. patent application Ser. No. 252,515 entitled "Power Supply With Nuclear Reactor" and filed on Apr. 9, 1981 in the name of Bruce M. Cook avoids these problems by bypassing the signals generated by the affected sensors. Two types of bypasses are provided. The channel level or local bypass bypasses in the appropriate channel the logic module associated with the sensor which has failed or has been taken out of service for maintenance. The remainder of that channel is not affected and a trip signal can be generated by it in response to an abnormal condition detected by any of the other sensors associated with that channel. The second type of bypass is the global bypass which bypasses the entire channel to prevent actuation of the trip breakers associated with that channel when the channel is taken out of service for maintenance or testing. The occurrence of a local bypass modifies the voting logic in the channels to two out of three of the remaining channels in the case of one bypass and to one out of two where two logic modules in a set are bypassed. If an attempt is made to bypass the logic modules associated with three sensors in a set, a trip is generated. This modification in the voting logic is carried out by microprocessors associated with each channel. The trip and bypass status of each of the logic modules associated with each monitored parameter in each channel is communicated between channels by fiber optics, multiplexed data links which also provide electrical isolation between channels. The appropriate voting logic for each of the monitored parameters in each channel is bypass status of each channel is also transmitted to microprocessors in the other channels by the isolated, multiplexed data links. Since the reactor trip breakers are arranged in a matrix so that a trip signal from any two channels removes power from the control rod actuators, the first global bypass need do nothing more than block any trip signal from the bypassed channel and the system reverts to two out of three voting logic on the remaining channels. Bypassing of a second channel by a global bypass opens the trip breakers associated with the second channel to initiate one out of two voting logic on the remaining two channels. If an attempt is made to bypass a third channel, the opening of the associated reactor trip breakers in addition to those already opened by the second global bypass results in tripping of the reactor. The trip breakers through which current flows to hold the control rods in the retracted position are held in the closed position by undervoltage coils on the switchgear. Deenergization of these undervoltage coils results in opening of the associated trip breakers. In the system described in the above identified patent application, the undervoltage coils are energized through an output transistor in the associated protection channel. The output transistor is held on by the channel trip bus which normally "floats" at the d-c logic voltage. However, the channel trip bus can be pulled down to ground potential by any of the channel logic units to thereby turn off the output transistor and open the associated reactor trip switchgear. In this system, the logic units comprise either relays or solid state switches. While this system is very effective for detecting failures, there are some limitations. Most notably, a short circuit failure in the output transistor or a build-up of film on the relay contacts could prevent a trip. Toroidal cores of magnetic material having a rectangular hysteresis loop characteristic have been widely used as memory and switching elements in logic circuitry. In addition, a specialized form of such a "square loop" device called a Laddic is used in some nuclear power plant protection systems. The Laddic is a ladder-like structure cut out of the rectangular hysteresis loop material having an input winding on the first rung and an output winding on the last rung. Starting with a suitable saturation flux pattern which is induced by a current pulse applied through a reset winding on one of the side rails of the ladder structure, a drive pulse applied to the input winding so as to switch flux in the first rung will switch the flux almost entirely through the closest available rung rather than split it among all available rungs. Thus, normally there is no change in flux and thus no output in the last rung of the ladder which carries the output winding. However, if inhibiting fields produced by current pulses are applied to all of the rungs intervening between the input and output rungs, the switched flux must return through the output rung and an output pulse will be obtained. In this protection system, a clock pulse is applied to the input rung of the Laddic and the signals representing the trip status of the selected parameters are the input variables applied to the intermediate rungs of the ladder. If none of the parameters are in an abnormal state so that all of the alternate paths are blocked, a pulse is generated in the output. By repetitively resetting the flux pattern with the reset pulses and reapplying the clock pulses, a continuous pulse signal is generated at the output. This pulse signal is applied to a converter which produces a d-c output of sufficient voltage to maintain the undervoltage coils of the reactor trip switchgear energized. If any of the monitored parameters are in the trip state, the switching pulses cease to trip the reactor trip breakers. In this arrangement, each Laddic forms a channel of a multichannel system with the two out of three voting logic being accomplished by additional windings on the intervening rungs to which signals from the other sensors in the set are applied. In some systems employing Laddics, two out of four voting logic is achieved by use of an arrangement including additional Laddic devices. While the protection system utilizing Laddics has the advantage that transmission through a protection channel of a pulse signal is required to prevent tripping of the reactor so that a failure which causes a d-c signal will not prevent a trip, it still has some unacceptable failure modes. For instance, certain cracks in the ladder lattice can prevent a trip and certain failures in the converter could mask a trip command where reset pulses were still being applied to the converter. Furthermore, the multichannel Laddic protection system lacks electrical isolation between channels and has no means for implementing the bypass logic described above but rather reverts to one out of three voting logic when a sensor fails, both of which adversely affect the availability of the system. SUMMARY OF THE INVENTION According to the present invention, a protection system for process apparatus propagates a clock pulse signal through logic means to an output device which responds according to whether it receives or does not receive the pulse signal. The logic means includes core means of rectangular hysteresis loop magnetic material with input, output and control winding means all wound on the core. A number of sensors which monitor selected process parameters are connected to the control winding means so as to block the flow of pulses through the logic means if any of the monitored parameters are out of limits. Thus, for instance, in the case of a nuclear power plant where the sensors would monitor reactor trip parameters, the generation of a trip signal by any of the sensors would interrupt the flow of pulses to the output means which would actuate the reactor trip switchgear. The invention also encompasses the provision of an alternate, parallel path for the clock pulses so that the output device can receive pulses even though a signal from one of the sensors may be blocking the flow of pulses through the logic means. This alternate path is referred to as the global bypass path since it bypasses the entire logic means. Local bypasses for the individual sensor signals are also provided within the logic means. According to the best mode of the invention, the logic means is a plurality of individual logic units each of which has a core of rectangular hysteresis loop magnetic material wound with an input winding, an output winding, and a control winding. With a d-c current applied to the control winding of sufficient magnitude to saturate the core in one direction, pulses applied to the input winding of sufficient magnitude to overcome the magnetic flux caused by the control winding and to saturate the core in the opposite direction, generate pulses on the output winding. The absence of a d-c current on the control winding results in the core remaining saturated in the second direction to block pulses applied to the input winding from appearing on the output winding. The individual logic units are arranged in a series with the input winding on each successive unit connected to the output of the preceding unit. A partial trip signal from one of the sensors controls a switch which supplies current to the control winding of each of the logic units. The local bypass means includes a switch in parallel with the switch controlled by the sensor so that even if the sensor controlled switch is open because the monitored parameter is out of limits, current is supplied to the control winding through the local bypass controlled switch and pulses continue to be outputted by the logic unit. This permits bypassing of a faulty sensor without eliminating the protection afforded by the other sensors controlling the other logic units in the train. Each logic unit preferably includes a pulse discriminator-shaper connected to the output winding which is responsive only to pulses generated by a change in flux in the magnetic core from saturation in either direction to saturation in the other direction for more reliable response. It also shapes the pulses into an output pulse having a magnitude, duration and shape similar to that of the pulse applied to the input winding. In this manner, a pulse signal similar to that applied by the clock to the first logic unit in the series is propagated through the train of logic units. The train of logic units together with the global bypass and output means form a channel, and preferably a plurality of such channels are provided for redundancy. Redundant sensors control the flow of d-c current in the control windings of corresponding logic units in each channel. The global bypass means in each channel, which bypasses the entire channel, is preferably constructed of the same basic logic units. One such logic unit controls the flow of pulses in the parallel path from the clock to the output means and a second blocks the flow of pulses from the train of logic units to the output means when the global bypass is in effect. A third logic unit in series with the first in the global bypass path has its control winding current controlled by computing means which gathers information from the other channels and blocks the flow of pulses from the clock to the output means thorugh the global bypass path if a global bypass is already in effect in another channel. The computing means also gathers information on partial trips and local bypasses in all the other channels in addition to the global bypasses and generates a trip enable signal for each of the logic units in the train. The trip enable signal controls a switch in parallel with the switch controlled by the sensor associated with each logic unit so that a partial trip signal generated by the sensor is only effective to terminate current flow in the control winding and block the propagation of pulses through the logic train if the trip enable signal is present. This trip enable signal incorporates the voting logic which takes into account by the state of the logic units in all of the channels. The output means is a dc-to-dc power converter which generates a level d-c signal to response to an applied pulse signal. Preferably, the converter is a buck-boost, flyback dc-to-dc converter which in the case of the nuclear power plant, generates an output voltage of sufficient magnitude to energize the undervoltage coils on the reactor trip switchgear. In the absence of pulses on the input to the converter, the output drops to zero and the switchgear trips the reactor. The process apparatus protection system of this invention is very reliable and is highly resistant to spurious responses. Its reliance on dynamic principles in which logic levels are represented by the presence or absence of current pulses provides protection against faults which cause hard d-c levels. The magnetic logic units have no moving parts and tests have shown that no postulated failure of these units prevents a trip output although many failures result in a trip.