Patent Number: 046684654
Section: description

DESCRIPTION OF THE PREFERRED EMBODIMENTS The invention will be described as applied to a rod position monitoring system for the pressurized water reactor (PWR) shown in FIG. 1 although it is to be understood that the invention has broader application to instrumentation generally for nuclear reactors, and even more broadly, to remote control and monitoring of other processes carried out in a hazardous environment inside a containment structure. The PWR 1 of FIG. 1 includes a nuclear reactor 3 enclosed within a containment building 5 which prevents the escape of most radiation generated by the reactor. The reactor 3 includes a reactor vessel 7 housing a core 9 of fissile material having hundreds of neutron absorbing rods 11 which control the reactivity of the core. These neutron absorbing rods 11 include: control rods which are moved in and out of the core to regulate the power level of the reactor, shutdown rods which are either all the way in when the reactor is shutdown or all the way out when it is at power, and part-length rods which can be used to regulate the axial distribution of power in the core 9. The neutron absorbing rods 11 are inserted in and retracted from the core by drive rods 13 with several neutron absorbing rods driven by a common drive rod 13 through a spider 15. The control rods and shutdown rods are further grouped into typically four banks each with the rods in each bank distributed symmetrically across the reactor core and with all of the rods in each bank driven in and out of the core in synchronism by their drive rods 13. The drive rods 13 are incrementally stepped into and out of the core 9 by a drive rod mechanism 17 such as the magnetic jack device disclosed in U.S. Pat. No. 3,158,766. As the drive rods 13 are lifted up by their respective drive rod mechanisms 17 they each advance upward into a separate housing 19 on top of the reactor vessel 7. A rod position detector 21 tracks the movement of the end of the drive rod within the housing to determine the position within the reactor core 9 of the associated neutron absorbing rods 11. Since the reactor vessel 7 forms one of the several barriers to the release of fissile material and since the rod housings form an extension of that barrier, no penetrations of the housings are permitted to determine the position of the drive rods. It is for this reason that it has been common practice to use various arrangements of electrical coils in the detectors 21 as described above. A separate detector 21 is provided for each drive rod 13 of which, as mentioned above, there are several scores in a typical PWR. The electrical signals generated by each detector 21 are sent to a data cabinet 23 over electrical leads 25. The data cabinet 23 is located within the containment building 5 but is separated from the reactor 3 by a "biological shield" 27 which reduces the radiation to which the electrical components within the cabinet 23 are exposed, thereby significantly extending their useful life. As will be more fully discussed below, these electrical components process the signals received from the detectors 21 and output them over serial data links 29 extending through the containment building wall to controller/interface equipment 31 in equipment room 33. The controller/interface equipment 31 processes the serial data received over the data links and sends the processed data over leads 35 to a display device and plant computer, identified collectively as 37, in the control room 39. The overall architecture of the rod position indicating system is illustrated in FIG. 2. In the system shown, one level of redundancy is used except that only one detector 21 and one set of interconnecting leads 25 are provided for each drive rod. Field history has shown these components to be sufficiently reliable to be used without backup in most applications. However, as will be more evident from the more detailed discussion below, the system architecture is also applicable to systems using redundant detector coils. The signals on leads 25 from each of the detectors 21 are applied to a separate encoder card 41 housed in the data cabinet 23 in the containment building. Each of the detector cards 41 has two identical circuits, labeled A and B in FIG. 2, which process the signals generated by the detector coils to produce redundant binary gray code representations of rod position. A key aspect of the invention is that the redundant information from the A and B circuits on the encoder cards 41 is distributed to each set of redundant components in the system. Thus, the encoder cards 41 include four separate fault isolating bus interfaces which feed the redundant binary rod position signals generated by the A and B circuits to each of two redundant, fully independent, byte parallel communications buses 43 and 45 physically provided on backplane cards in the data cabinet 23. Each of the communications buses 41 and 43 is controlled by a bus controller/serial output device 47 and 49 respectively mounted on its own printed circuit card in cabinet 23. Each bus controller/serial output card polls each redundant half of each encoder card 41 to collect and store all of the rod position data once per second. These devices also contain circuitry to monitor the local environment including temperature, power supply voltage, door "open" status, and self test. Each of the bus controller/serial output cards 47 and 49 has two redundant individually buffered serial data link outputs 29a and b and 29c and d respectively. On one bus controller/serial output card, 47 for instance, one data link, 29a, is the primary link to a display controller/interface 51, which forms part of the equipment 31 located in the equipment room 33, and the second data link, 29b, serves as a backup input for a plant computer interface 53 also located in the equipment room. The other bus controller/serial output card, 49, has one data link, 29c, which is the primary link to the plant computer interface 53 and a second, 29d, which is a backup to the display controller/interface 51. The data stored by the bus controller/serial output cards 47 and 49 is formatted into three blocks for transmission over each of the associated pairs of data links. The three blocks contain, respectively, all rod positions from the "A" portion of each of the encoder cards, all rod positions from the "B" portion of each of the encoder cards, and a fixed field and system status information. The data is transmitted using an asynchronous simplex byte count oriented protocol similar to DDCMP (digital data communications message protocol). The bus controller/serial output cards 47 and 49 each utilize a single chip microprocessor for control of all functions. As a result, the sequence of bus control and serial data link protocol can be easily modified for unique applications. A single bus monitor card 55 is provided to improve self test and fault diagnosis. When polled by the bus controller/serial output cards, 47 and 49, it provides complementary fixed binary codes in place of rod position signals. Proper receipt of those codes verifies the integrity of each bus and assists in the isolation of system faults to the board level before maintenance personnel enter the containment building. Alternatively, separate bus monitor cards can be provided at the remote end of each bus 43 and 45 to assure continuity of the entire bus. The fixed field block of data transmitted by each bus controller/serial output device provides a means for checking and isolating faults in the data links 29. The containment electronics in data cabinet 23 also includes fully redundant d-c power supplies that are individually distributed via the backplane and are diode auctioneered at the board level. The display controller/interface 51 and the plant computer interface 53, which comprise the controller/interface equipment 31 located in the equipment room 33, each receive data from the two bus controller/serial output cards 47 and 49 over serial data links 29a and d and 29c and b respectively. Only one serial data link is used by either subsystem at any give time. The source of the data is chosen manually by a toggle switch 57. Each subsystem 51, 53 receives the serially transmitted data and checks for transmission errors. They also check system status failures and compare the rod position from the redundant portions of each encoder card 41 as a reasonability check. Only one source, either "A" or "B", of data for each rod is used for control of display, alarm and plant computer interfaces. The selection of the set of redundant data to be used is made manually by a small hand-held portable terminal 59 which may be plugged as needed into the display controller/interface 51 or plant computer interface 53. The operator may choose that all rod position data be taken from the "A" side or the "B" side of each encoder card 41 or he may choose which side the data will be taken from on a rod by rod basis. Once the selection is made, the instructions are stored in non-volatile memory so that the system will automatically return to the previous operating mode following a power outage. The ability to manually select the source of the data, both from the bus controller/serial output cards and from the encoder cards, as well as the overall system architecture, insures maximum fault tolerance and recoverability for those few equipment failures that may occur. Each subsystem 51 and 53 processes its set of rod position data and controls it associated display devices. The display controller interface 51 formats the data for one of five display pages and produces an output compatible for driving a color cathode ray tube (CRT) monitor 61 in the main control board located in the control room 39. The operator interface is provided with four push buttons 63 also in the main control board to control system reset, alarm acknowledgement, rod position data page selection and system alarm page selection. The display controller interface 51 also provides two contact closure outputs to a control board annunciator system 65 for urgent and non-urgent alarms. The urgent alarm results from any of the many detectable system failures. Those system alarms are displayed on the CRT 61. The non-urgent alarms result from detectable misplacement of rods including rod deviation (rod to rod in a bank), rod on bottom, and rod off top. These alarms are also deisplayed on the CRT 61 as more fully described below. The plant computer interface 53 generates outputs suitable for use by the plant computer 67 located in the control room for generating on its CRT, displays similar to those presented on the CRT color monitor 61 thus providing the redundant representation of the rod positions. The plant computer also logs the rod position signals for record keeping purposes. FIGS. 3 and 4 illustrate a suitable rod position detector 21 for use with the invention. The detector depicted is the digital detector covered by commonly owned copending application Ser. No. 657,423 filed on Oct. 3, 1984. As illustrated, the drive rod 13 is longitudinally movable inside the tubular housing 19 and is preferably made of a material of high magnetic permeability such as steel, but could also be made of an electrically conductive material in which eddy currents can be induced by magnetic fields. Spaced along the travel path of the drive rod 13 at spaced intervals along the outside of the housing 19 are a number of electrical coils L.sub.1 through L.sub.20. As shown in FIG. 4, each of the coils L.sub.1 through L.sub.20 is energized by a low voltage, low frequency, for instance 12 volt 60 hertz, a-c power source. The magnetic fields generated by such a low frequency current in the coils penetrate the non-magnetic housing 13 and, where it is present, the drive rod 13. Since the drive rod is electrically conductive and/or preferably magnetically permeable, the impedance of each coil in succession changes as the end of the drive rod passes through it. Thus, by monitoring the sequential changes in the impedance of the coils, the movement of the rod can be tracked. Pairs of detector coils are connected in series across the a-c source 69 together with a pair of series connected resistors R.sub.1 and R.sub.2 which are located in the data cabinet 23. Leads 25a through 25j connect the common nodes 71 of each resistor pair with appropriate circuits on dedicated encoder card 41 in the data cabinet 23. Lead 73 connects the common node 75 between the resistors R.sub.1 and R.sub.2 with these same circuits which compare the voltage at node 75 with that at each of the nodes 71 of the coil pairs. With matched coils and resistors of equal value, no differential voltage is generated for coil pairs in which both coils or neither coil is penetrated by the rod 13, however, a differential voltage will be generated for those coil pairs in which one coil is penetrated by the rod 13 and one is not. As will be seen, the differential voltage between the node 74 and each node 71 generates one digit of a binary coded signal. By arranging the coils so that the end of the rod 13 penetrates a coil in a pair to the left and a pair to the right between passing through the two coils in a given pair, a unique multi-digit digital signal is generated by the detector. FIG. 5 illustrates the circuit on one of the encoder boards 41 which processes the signals from one of the detectors 21. The lead 25a through j from the detector coils are applied to the input side of a printed circuit board 77 through connector 79. Each of the leads 25a through 25j is split at a branch point 81 into two leads 25a' and a" through 25j' and j" with each of the leads 25a' through 25j' applied to one input of a differential amplifier 83A in a processing circuit 85A through an input resistor 87A, and with each of the leads 25a" through 25j" applied through an input resistor 87B to one input of a differential amplifier 83B in processing circuit 85B. In the case where a redundant coils were used, the signals from one set would be applied to the differential amplifiers 83A and those from the other set to the amplifiers 85B. The lead 73 from the common node 75 between the resistors R.sub.1 and R.sub.2, which are physically located on the printed circuit board 77, is applied to the other input of each of the differential amplifiers 83A and B through resistors 87A and B respectively. The differential a-c voltages produced by the amplifiers 83A and B are applied to discriminators 91A and B respectively where they are converted to d-c signals and compared with threshold levels to generate standard logic outputs, D.sub.0 through D.sub.9. Since there are only 20 coils in each detector, the 10 digit binary signals produced by the discriminators 91A and B are converted to 8 bit signals, D.sub.0 ' through D.sub.7 ', inconverters 93A and B respectively to be compatible with the 8 bit structure of the downstream components even though 5 digits would be sufficient to identify the location of the rod with respect to the 20 coils. The 8 bit binary signals D.sub.0 ' through D.sub.7 'produced by the processing circuits 85A and B are each applied through an interface 95 to each of the communications buses, BUS No. 1, 43, and BUS No. 2, 45. The leads 97a through 97h carrying the 8 bit signal from the A processing circuit are split into two leads each 97a' through h' and 97a" through h" for application to an A Data Bus Driver 99' and 99" associated with the No. 1 and No. 2 Buses 43 and 45 respectively. Similarly, the 8 bit signal from the converter 93B in the B processing circuit is applied over leads 101a through h which split into 101a' through 101h' and 101" through h' to B Data Bus Drivers 103' and 103". Each of the bus drivers 99', 99", 103' and 103" includes 8 CMOS gates 105 which selectively feed either the applied A or B data to each of the 8 bit buses 43 and 45 through leads 107 and 109 and connectors 111 and 113 respectively. A Bus 1 Address Decoder 115 receives a detector address signal DET ADD, and A/B DATA signal and an ENABLE signal from the BUS 1 through connector 111. These signals are generated by the bus controller/serial output No. 1, 47, to control the sequential transmission of data on communications Bus No. 1. The DET ADD signal identifies which board (i.e. which detector) is to place data on the bus, the A/B DATA signal determines which of the redundant sets of signals, A or B, is to be transmitted and the ENABLE signal implements the transfer. With the detector board shown in FIG. 5 addressed and A data selected, the ENABLE signal applies a pulse to each of the CMOS gates 105 in A Data Bus Driver 99' through lead 117 to apply the 8 bit digital position signal generated by processing circuit 85A to Bus No. 1. With the B data from this detector selected, an ENABLE signal applies a pulse through lead 119 to each of the CMOS gates (not shown) in B Data Bus Driver 103'. In like manner, the A data and B data are applied to BUS No. 2 by similar control signals generated by bus controller/serial output No. 2, 49, and applied to BUS 2 Address Decoder 121 which responds by pulsing the A Data Bus Driver 99" through lead 123 and the B Data Bus Driver 103" through lead 125 as commanded. The input impedance of the differential amplifiers 83A and B and the value of the input resistors 87A and B and 89A and B is very high while the impedance of the coils L.sub.1 to L.sub.20 and resistors R.sub.1 and R.sub.2 is low so that a failure in one of the processing circuits 85A or B is not propagated to the other through the inputs. Likewise, the input impedance of the CMOS gates 105 in the bus drivers 99', 99", 103' and 103" is very high as is the value of resistors 127', 127", 129' and 129" while the output impedance of the converters 93A and B is relatively low so that no faults are propagated through the outputs. The serial transmission of data through the communications buses, and data links as well as the digital storage of data in the bus controller/serial outputs preserve the isolation of the redundant detector signals. The primary function of the rod position indicating system is to provide plant operators with as much information as possible concerning the position of the rods in the reactor core. It was determined that this could best be done by preventing the information to the operator in the form of graphical displays on a color CRT rather than through individual analog or digital indicators. Redundant displays are made available by presenting the rod position information on the CRT of the plant computer 67 as well as the dedicated CRT 61 in the control room. Since all the pertinent data cannot be reasonably presented on one CRT display, a five page display 131 was developed. Three pages illustrate respectively, the positions of the control rods, shutdown rods and the part-length rods (where necessary). FIG. 6 illustrates the control rod display page 131A. The major field of the CRT is devoted to a bargraph representation 133 of rod position, while space is reserved at the bottom of each page for status messages 135. This arrangement provides the operator with information pertinent to abnormal conditions on the other pages while viewing the position data on a particular page. Rod position is displayed by bank. The customary convention of indicating rod position by the number of steps the rod has been withdrawn is utilized with a scale of 1 to 228 steps in 12 step increments shown. In keeping with this convention, the amount of withdrawal is shown on the bargraph in a prominent color such as yellow with the background shown in a less prominent color such as blue. The identification of the rod and the number of steps it is withdrawn is shown below the bar. Where no information or erroneous information is received, ERR appears in reverse video with a red background and no bar is shown as for the rod H10 in the A bank of control rods. The average value of the valid rod position signals is shown after the bank label, for instance "152" for the B bank. Four groups of status messages 135 are provided at the bottom of the page. The first indicates Rod Deviation. All of the rods in a bank should move simultaneously. Any deviations from this pattern should be brought to the operator's attention. FIG. 6 shows in the status message area that there are deviations in control rod banks B and D. Reference then to the bargraphs shows that rod B6 is only out 36 steps while the remainder of the rods in B bank are out 168 steps. Likewise, the Bank D bargraphs show that rod M8 is out 84 steps while all the other D bank control rods are on the bottom. When such a status message first appears, the bank label flashes in reverse video. When the message is acknowledged, the background appears solid. The second status message is identified as the "Rod on Bottom" signal. Normally, at power the control rods in all the banks will be out part way. The boron system is used to accommodate long term changes in load so that this condition prevails. Also, at power all the shutdown rods should be fully withdrawn. On the other hand, when the reactor is shutdown, all of the rods should be "on the bottom" or fully inserted. Thus, this message alerts the operator to an abnormal condition during operation and provides a quick reference during a reactor trip whether all the rods have been fully inserted. In FIG. 6, it can be seen that all of the rods in the D bank, except one which is out of place, are on the bottom indicating an abnormal condition in the control system which should be investigated. The third status message is "Rod Off Top" which is only pertinent as to the shutdown rods and indicates in FIG. 6 that rods in the A and C shutdown banks are not fully withdrawn as they should be with the reactor at power. If the operator wants more detailed information, he can page to the shutdown rod page which is presented in the simpler format to FIG. 6 to see in more detail from the bargraphs what the situation is. The part-length rod page for plants having such rods is much similar since there is only one bank of such rods and normally they are fully withdrawn under present control schemes. The fourth status message is the rod position indicating system alarm messages "RPI System Alarm". When the "See Alarm Page" message appears in reverse video, the operator should look to the remaining two pages which include the "System Status" page 131B of FIG. 7. This page shows thh status of system components by location. For the equipment room electronics, PROM and RAM memory check results are displayed. The valid check results are shown in blue while components which failed the test are shown in red. In the example shown, the number 2 PROM memory and number 6 RAM have failed their tests and are thus shown in red which also generates a "System Alarm" in the lower right-hand corner of this page and the "See Alarm Page" signal on the rod position pages. The "Number Of Main Loop Time-outs" count shown for the equipment room electronics is the number of times the dead man timer timed out since the last software reset. This number provides a measure of system integrity. The "Containment Electronics" section indicates the status of components in the cabinet 23 located inside the containment building. The items displayed are self-explanatory. The "Communication System" section provides information on the status of the data link which is supplying data to the redundant display being viewed. "The quick brown fox jumped over the lazy dog" is an example of the fixed field header message which is transmitted as an integrity check. The "Header Count" indicates how many times this message has been received correctly and the A and B counts indicate the number of times the A and B data have been received without an error. A system alarm is generated if any of the three counts exceeds the average of the counts. A maintenance page can also be provided which displays the raw data received on each rod and can be referred to for more detailed information in case of a system alarm. While specific embodiments of the invention have been described in detail, it will be appreciated by those skilled in the art that various modifications and alternatives to those details could be developed in light of the overall teachings of the disclosure. Accordingly, the particular arrangements disclosed are meant to be illustrative only and not limiting as to the scope of the invention which is to be given the full breadth of the appended claims and any and all equivalents thereof.