Patent Number: 046876235
Section: description

DESCRIPTION OF THE PREFERRED EMBODIMENTS The invention will be described as applied to the protection system for a nuclear power plant although it could also be incorporated into the power interface systems for many other types of complex processes. As shown in FIG. 1, the exemplary system 1 employs four redundant sets of sensors 3 to monitor selected plant parameters such as pressure temperature, flow, radiation level, et cetera, and/or the status of various components, such as whether a valve is open or closed or whether a pump is running or not. Where such a system is used for a particular safeguard function, the sensors 3 may monitor only one or a plurality of plant parameters or conditions. The signals generated by each set of sensors 3 are applied to separate channel sets 5, numbered 1 through 4 in FIG. 1, where the detected values of the sensor signals are analyzed for an indication of an abnormal condition by comparing them with selected setpoint values. In some instances, the values of measured parameters are used to calculate other parameters which are then compared with limiting values for an indication of an abnormal condition as is well-known in the field of control system engineering. Each channel set generates a digital output signal which indicates whether or not the sensors in that channel set are sensing conditions which warrant actuation of the associated safeguard function. Since confirmation by more than one channel set is required to initiate the safeguard function, the digital signals are referred to as "partial actuation signals". The partial actuation signals from each of the channel sets 5 are each applied to three independent logic trains 7 labeled A, B and C in FIG. 1. In order to provide separation between the redundant partial actuation signals, they are electrically isolated from one another such as by applying each of them to the coil of a separate relay in each logic train as is now common practice. The coil to contact separation of these relays provides the electrical isolation between the actuation signals and between the logic trains. Isolation could also be provided for instance, by optical isolators where solid state switches are used in place of relays. The logic trains 7 which may preferably comprise microcomputer systems, independently vote the partial trip signals received from the four channel sets 5 and generate an actuation signal a, b or c on their associated output lines 9 when the prescribed number of partial trip signals is detected. Typically, two out of four voting logic is employed by these logic trains. That is, two out of the four channel sets must be generating a partial actuation signal in order for the logic train to generate an actuation signal. Such a scheme allows for failures which preclude the generation of a partial actuation signal by two of the channel sets, while reducing the likelihood of a spurious trip which could occur if only one partial trip signal was required to generate an actuation signal. In the normal course of events, all four channel sets would generate partial actuation signals upon the occurrence of the abnormal condition, and all three logic trains 7 would generate an actuation signal. Of course, voting strategies other than two out of four could be employed by the logic trains 7. The actuation signals on the leads 9 are utilized to control the energization of a load device 11 by a voltage source V through a power interface identified generally in FIG. 1 by the reference character 13. The load device 11 may be any type of electrically operated device which effects an automatic response to the detection of the associated abnormal condition. Such a device could be for example, a pump, an electrically controlled valve, a heater, a circuit breaker or any motor driven device. In the system of FIG. 1, the load device would be a normally deenergized device, but as will be seen, the invention can also be used with normally energized load devices also. The power interface 13 includes a network of switches connected in series with the load device 11 across the voltage source V. In the circuit of FIG. 1, the switches are the normally open contacts 15 of relays A, (A), B, (B), C and (C). The coils 17 of two relays are connected to the output line 9 from each logic train 7. The contacts of these coils are connected in three groups 19 of two contacts each with the two contacts in each group connected in series and the groups connected in parallel. The two contacts in each group are associated with relays energized by different logic trains. Thus, the first group includes the make contacts of relays A and B; the second, contacts of relays (A) and (C); and the third, contacts of relays (B) and C. Hence, it will be seen from FIG. 1, that for any combination of actuation signals generated on the lines 9 by two out of three of the logic trains 7, contacts will be closed in the power interface 13 to actuate the load device 11 by completing a circuit between the voltage source V and the device. With this power interface, protection against spurious actuations is provided by requiring confirmation of the abnormal condition by at least two of the logic trains, yet a failure in any one logic channel will not disable the system. Alternatively, one relay with two sets of contacts could be used instead of the two separate relays, such as A and (A) connected to each logic train. In order to provide an on-line test capability of the power interface 13, each of the switches 15 is shunted by a resistor R1, and a current monitor 21 is connected in each branch of the switching network. A microprocessor based tester 23 generates test signals which are applied through lines 25 to the logic trains to cause the latter to selectively generate the actuation signals a, b and c. The current registered by each of the current monitors 21 is feedback to the tester 23 over lines 27. The resistors R1 provide a leakage path through each group 19 of switches in the power interface 13, however, they are selected to have an impedance which is several magnitudes greater than that of a closed switch so that the total leakage current is insufficient to energize the load 11. By way of example, for a load device 11 with an impedance of 120 ohms, and a power supply voltage of 120 volts, a suitable value for the resistors R1 is 30,000 ohms. Under these conditions, if both switches in one leg of the switching network are open, the corresponding current monitor 21 will register a current of about 2 milliamps and the load will not be energized. This is defined as the "OFF" state. If just one of the switches is closed, the current will be about 4 milliamps and this is defined as the "ON" state for the interface employing make contacts although the load will still be deenergized at this current level. When both switches in a group 19 are closed, the current is about 1 amp and the load is energized. This is also defined as an "ON" state. While a simple "ON" indication does not indicate which of the two switches in a group is closed, the operablilty of each device can be checked by forcing the inputs using the tester 23 and monitoring the "OFF"/"ON" status of each branch in the switching network. Thus, the tester 23 generates a pattern of test signals and compares the results reported back by the current monitors 21 with a stored expected pattern of responses. Any deviation from the expected responses is identified as an indication of a malfunction. Table I below illustrates the test sequence for the power interface circuit of FIG. 1 for the normally deenergized load shown: TABLE I ______________________________________ NORMALLY DEENERGIZED LOAD Step Operation I.sub.1 I.sub.2 I.sub.3 ______________________________________ 1. no actuation signal OFF OFF OFF 2. actuation signal a ON ON OFF 3. actuation signal b ON OFF ON 4. actuation signal c OFF ON ON ______________________________________ The circuit of FIG. 1 can also be used with normally energized loads in which case the switches 15 would all comprise break contacts of the associated relays, and the load device 11 would be actuated by interruption of the energizing current in response to generation of two out of three of the actuation signals a, b and c. In this instance, the "OFF" state is defined as a condition in which at least one of the break contacts in a group is open. The power interface circuit 13 utilizing break contacts would be tested in the same manner as discussed above through generation of a pattern of actuation signals under the direction of the tester 23. Table II below illustrates the test sequence for the circuit of FIG. 1 with a normally energized load: TABLE II ______________________________________ NORMALLY ENERGIZED LOAD Step Operation I.sub.1 I.sub.2 I.sub.3 ______________________________________ 1. no actuation signals ON ON ON 2. actuation signal a OFF OFF ON 3. actuation signal b OFF ON OFF 4. actuation signal c ON OFF OFF ______________________________________ Since the invention does not require any change in circuit topology for the test sequence, and hence, the resistors R1 and the current monitors 21 remain effective during normal operation, the system can be continuously monitored without degrading the protection function. Accordingly, all of the current monitors should be "OFF" for a normally energized load and should be in an "ON" state for a normally deenergized load, under normal operating conditions when no test is being conducted. Conversely, they should all be in the opposite states when conditions in the reactor warrant actuation of the protection function. Any deviation from these all "ON" or "OFF" states indicates a malfunction in the system, and through continuous monitoring could be detected when they occur without waiting for a test sequence. In order to overcome the effects of large fluctuations in the magnitude of the voltage of the power source V which were mentioned above, the groups 19 of switches 15 are incorporated into a series of parallel resistance bridges as shown in FIG. 2. The resistor shunted switches 15 of each group form one leg of a wheatstone bridge circuit and are connected in series with a reference resistor R3, forming a second leg, at a first node 29. Reference resistors R5 and R6 forming the remaining two legs of the bridge circuit generate a reference voltage, Vref, at a second node 31. The legs formed by resistors R5 and R6 are shared by each of the three bridge circuits so that a common Vref is generated. Each bridge is spanned between nodes 29 and 31 by a comparator 33 which compares the voltage drop generated by the associated group of resistor shunted switches 15 with Vref. The comparator 33 generates a digital output which assumes an "ON" state when the voltage at the first node 29 exceeds Vref indicating that at least one of the normally open resistor shunted switches is closed, and assumes an "OFF" state, indicating that both switches are open, when Vref exceeds the voltage at node 29. Reference to Tables I and II will confirm that each switching state that the interface is capable of assuming can be verified by interrogating the digital status of each comparator 33 in light of the inputs imposed by tester 23. The key advantage of the bridge circuits is that a change in power supply voltage, which of course, will produce a change in the voltage at node 29, is compensated for by a similar change in Vref. For example, if we select R1=30k ohms, R3=2 ohms, R5=450K ohms, and R6=20 ohms, a power supply voltage of 120 volts will result in Vref=5.33 millivolts and: Va=4 millivolts (both switches open) PA1 Va=8 millivolts (one switch open). PA1 Va=3.33 millivolts (both switches open) PA1 Va=6.66 millivolts (one switch open). PA1 Va=5 millivolts (both switches open) PA1 Va=10 millivolts (one switch open). Thus, it can be seen that the values of R5 and R6 have been selected such that Vref lies about midway between the value of Va, the voltage at node 29, with both switches open and the value of Va with one switch closed. If the supply drops to 100 volts, Vref will drop to 4.4 millivolts and: Likewise, if the supply voltage rises to 150 volts, Vref=6.66 millivolts and: It should be noted that over this wide range of supply voltages, the comparator trip point, Vref, remains about midway between the two possible values of Va, and that those two values remain distinct. A further advantage of the invention is that the feedback signals on lines 27 consist of 3 single bit signals which directly specify the switching state of the interface rather than current magnitudes from which the switching state is deduced. The above analysis applies to testing an interface circuit with a normally open output. For a normally closed type of output, the comparator reference would be almost zero since most of the voltage drop would appear across the load 11 with the resistors R1 shunted by closed switches. As shown in FIG. 2, a 10 volt supply and resistor R7, chosen as 200K ohms for this example, add a small bias, 1 millivolt, to the reference voltage to allow the comparator to function when the voltage across the bridge is small due to one of the legs being energized. The voltage Va applied to the comparators 33 is 0.66 volt when all three groups 19 of switches 15 are conducting. When a normally closed switch is open in two groups of switches and only one group of switches conducts, as would be the case during testing, the voltage Va applied by the two non-conducting groups of switches to the associated comparator 33 would be zero volts and the voltage applied to the comparator by the conducting groups of switches would be about 2 volts. By adding the 1 millivolt bias to Vref, a definite difference is generated between Vref and Va for the conducting group of switches, and again, a reliable single bit digital signal is generated despite variations in supply voltage. FIG. 3 illustrates a practical circuit for implementing the invention for d-c power interfaces utilizing solid state switching devices. In place of the relays, power FETs 35 are utilized as the switching devices between the load 11 and power supply 12. The FETs are switched by square wave actuation signals a, b and c generated by the logic trains 7 through conventional drive circuits 37 which convert the a-c logic signal to a d-c control signal. The transformers 39 in the drive circuit provide isolation between the logic trains 7 and the power interface 13. As in the case of the power interface of FIG. 2, the FETs of FIG. 3 are arranged in resistance measuring bridge circuits. The output circuit 41 for each group of switches includes the comparator 33 which compares Vref generated by the resistors R5 and R6 with the voltage at node 29. The voltage at node 29 is applied to the positive input of the comparator 33 through an input resistor R4 with the switching noise filtered out by a capacitor C1. An LED 43 is energized by the digital output of the comparator 33 when the voltage Va exceeds Vref. Radiation from the LED 43 turns ON a phototransistor 45 to provide an isolated output for the comparator. A diode 47 prevents reverse biasing of LED 43. Similar isolated, single bit digital output circuits 41 are provided for each of the other groups 19 of switches. Each of the FETs 35 is turned ON when a square wave signal is applied to the drive circuit 37. Thus, for a normally deenergized load 11, no signal is applied to the drive circuits under normal conditions so that the FETs are OFF. Under these conditions, the voltage, Va, at node 29 for each of the groups of switches is lower than Vref so that the output of the comparator 33 is low, the LED is OFF and therefore the phototransistor does not conduct. As a result, the digital output FEEDBACK signal which is returned to the tester over line 27 is high. When the tester induces a logic train 7 to generate a square wave actuation signal, one of the FETs in each of two of the groups 19 of switches is turned ON. This raises the voltage at node 29 above Vref for those groups of switches, causing the comparators to turn ON the associated LEDs, which in turn, turn on the phototransistors to cause their FEEDBACK signals to go low. Conversely, for a normally energized load, a square wave signal is normally applied to the drive circuits of the FETs to keep them turned ON. This results in the voltage at node 29 being higher than Vref and the phototransistor conducts to pull the output down. Thus, under normal conditions, a low level FEEDBACK signal is returned over line 27 to the tester. This is the opposite of the case with the normally deenergized load discussed above. Generation of an actuation signal by a logic train 7, either on its own or under the direction of the tester, removes the square wave signal from the appropriate FET drive circuit which turns those switches OFF. The voltage applied to the associated comparators will then be lower than Vref so that these LEDs will be OFF. Since this will turn OFF the associated phototransistors, their FEEDBACK signals will be high. While specific embodiments of the invention have been described in detail, it will be appreciated by those skilled in the art that various modifications and alternatives to those details could be developed in light of the overall teachings of the disclosure. Accordingly, the particular arrangements disclosed are meant to be illustrative only and not limiting as to the scope of the invention which is to be given the full breadth of the appended claims and any and all equivalents thereof.