Patent Number: 046876235
Section: summary

CROSS-REFERENCE TO RELATED APPLICATIONS Commonly owned U.S. patent application entitled "Voted Logic Power Circuit and Method of Testing the Same" concurrently filed in the names of Bruce M. Cook and Jerzy Gutman and identified by assignee's docket number 52,263. Commonly owned U.S. patent application entitled "A Voted Logic Power Interface with Tester" concurrently filed in the name of Rober E. Hager and identified by assignee's docket number 52,264. Commonly owned U.S. patent application entitled "Testable, Fault Tolerant Power Interface Circuit for Normally De-Energized Loads", concurrently filed in the name of Robert A. Hager and identified by assignee's docket No. 52,579. BACKGROUND OF THE INVENTION 1. Field of the Invention This invention is directed to systems used to provide automatic responses to abnormal conditions in complex processes such as nuclear reactors, and to apparatus for testing such systems. More particularly, it is directed to means for reliably testing such systems for both normally energized and normally deenergized response devices without interrupting system response to abnormal conditions and despite large variations in energizing voltage. 2. Prior Art Protection systems for complex processes monitor selected process parameters, such as temperatures, pressures and flows, and the status of various components such as whether a valve is open or closed or whether a pump is on or off, and provide automatic responses to measured values of the parameters and to detected status states of the components which require positive intervention to prevent, or to alleviate the effects of, abnormal process conditions. High reliability is an essential requirement for such a system. In order to enhance reliability, it is common practice to provide redundant sensors for each selected parameter and component status. It is also common practice to vote the responses of the redundant sensors, that is to require that a plurality, but not necessarily all, of the sensors, detect the abnormal condition before action is initiated, in order to reduce the probability of a spurious actuation. A nuclear power plant is one example of a complex process in which such a protection system is employed. The protection system in a nuclear power plant performs a plurality of functions. It can shutdown, or trip, the reactor if conditions warrant, or it can perform a number of engineered safeguard functions, such as opening or closing valves and turning on or off pumps or other components. Typically, the trip function involves deenergizing electro-mechanical jacks which normally hold control rods in a position withdrawn from the reactor core so that the rods reenter the core and cause it to go subcritical. The engineered safeguard functions may involve either deenergizing a load device which is normally energized or energizing a device which is normally deenergized. In a typical engineered safeguard function system, four redundant sensors are used to detect the selected parameters and/or status conditions. The response of each sensor is compared with a setpoint value to generate a digital signal which is referred to as a partial actuation signal since an indication from more than one sensor is required to actuate the safety component. The four partial actuation signals for each parameter or status condition are all fed to each of two identical, electrically isolated logic trains. Typically, this is accomplished by applying each partial actuation signal to the coil of a relay having one set of contacts in each logic train. Each logic train independently votes the partial actuation signals, such as two out of four, and generates an actuation signal. The two independently generated actuation signals are then applied to a power interface circuit which requires the presence of both actuation signals to actuate the load device, either a normally energized or normally deenergized component, to initiate the engineered safeguard function. Such a two out of two voting power interface can be disabled by a single failure in one of the two channels. In order to provide tolerance to single failures in a logic train or switching device, the systems described in the related applications referred to above propose the use of two out of three voting power interfaces. Regulations require that the switching devices comprising the power interface be tested periodically. At present, these tests are performed manually with the plant remaining on line. To avoid disrupting plant operation, special test procedures and circuits have been employed to permit testing without changing the energization status of the actuated device associated with the interface under test. In the case of a normally energized load which cannot be deenergized while the plant is in operation, the apparatus and method used are as described in U.S. Pat. No. 3,967,257. This involves connecting a current monitor in series with the switching device under test and connecting in parallel with that combination, a second switching device which is also equipped with a visual current monitor. To perform the test, the second switching device is first "closed" in order to maintain power to the load. The device under test is then exercised while the corresponding current monitor is observed as an indication of its switching state. Normally, deenergized loads which cannot be energized during testing are generally tested by exercising the switching devices using a current which is of sufficient magnitude to be detectable but which is below the actuation current threshold for the actuated device. The prior art systems for testing power interfaces utilize feedback signals which indicate the presence or absence of current in the various circuit legs or they generate analog or digital representations of current magnitude. One problem with test schemes which rely on reading current magnitude is that the current varies as a function of power supply voltage. In the case of a nominal 120 volt DC system, a voltage swing of 50 volts may occur between a low battery condition (approximately 100 VDC) and a full battery or charging condition (approximately 150 VDC). A primary object of the subject invention is to provide a testable voted logic protection system and particulary a power interface for such a system which is operative with either normally energized or normally deenergized loads without interrupting the protection function and without a change in circuit topology. It is another important object of the invention to provide such apparatus which is self-compensating for large variations in power supply voltage. It is still another important object of the invention to provide such apparatus which generates reliable, one bit digital signals in response to test signals. SUMMARY OF THE INVENTION These and other objects are realized by an n out of m voted logic power interface circuit in which m sets of switches are arranged in a plurality of groups of switches with the groups of switches connected in parallel with each other and in series with a voltage source and a load. Each group of switches includes a different selection of n switches connected in series, each from a different one of the m sets of switches. The plurality of groups of switches include all possible combinations of m sets taken n at a time such that with at least n out of the m sets of switches actuated the load device is actuated. Each of the switches is shunted by a resistor to provide a leakage path through each group of switches. However, the impedance of the shunt resistors is several magnitudes greater than that of a closed switch so that the leakage current is insufficient to energize the load. Detectors associated with each group of switches, and responsive to changes in impedance in the group, generate output signals indicative of the state of the switches. Preferably, the detectors generate digital signals having a first value when none of the switches are actuated and a second value when at least one switch in the group is actuated. As used throughout the specification and claims, the term actuated means that the referenced device is in its operated condition. Thus, a normally closed switch is open when actuated, and a normally open switch is closed. Likewise, a normally deenergized load is energized in its actuated state and a normally energized load is deenergized. In order to provide self-compensation for variations in supply voltage, each group of switches is incorporated into a resistance measuring bridge circuit in which the voltage drop across the resistor shunted switches is compared with a reference voltage. Both of these voltages are proportional to the supply voltage so that reliable indications of switch actuation are generated despite even large fluctuations in supply voltage. Thus, in a wheatstone bridge circuit, the voltage drop across the group of resistor shunted switches forming one leg of the bridge is applied to one input of a comparator and the reference voltage generated by the other side of the bridge is applied to the other comparator input. The three reference resistors in the bridge circuit are selected such that the comparator has two discrete outputs; one when none of the switches are actuated and another when at least one of them is actuated. Preferably, the reference resistors are selected such that the reference voltage developed by the bridge and applied to the comparator is about halfway between the voltage drop across the group of resistor shunted switches when no switches are actuated, and that when at least one switch is actuated, for all supply voltages. Where the switches are normally closed devices, a bias voltage is added to the reference voltage to assure reliable switching by the comparator. While suitable for use in other applications, the invention is particularly adapted for use in a protection system for a nuclear power plant where redundant sets of sensors monitor selected reactor parameters and multiple logic trains independently generate a voted logic actuation signal for each set of switches from redundant signals generated by the sensors. A test unit selectively generates test actuation signals and monitors the detectors for preselected patterns of digital signals. By generating fewer actuation signals than are required to actuate the load, the tests can be performed while the protection system remains on line, for both normally energized and normally deenergized loads. Hence, the protection function is not interrupted during test and no changes in circuit topology are required.