Patent Description:
The PMS is an interface management device between field devices and a digital instrument control system as well as other systems in NPP, mainly used to manage priorities of instructions sent by each system or device so as to ensure safe operation of NPP. Existing PMSs have strong customization features and low engineering applicability. Typically, a PMS only has hard-wired interfaces, or its communication interfaces merely support a safety class communication interface, or otherwise the communication interfaces only support a non-safety class communication interface. Therefore, a large number of hard-wired interfaces are needed to convert the communication safety class, when device level manual control instructions are received from a non-safety class system or a safety class system.

As mentioned in <CIT>, when a hard-wired approach is used in a PMS, the PMS receives instructions directly from ESFAC (Engineered Safety Features Actuation Cabinets), SRC (Safety Related cabinets), DAC (Diverse Actuation cabinets), SA I&C (Severe Accident I&C cabinets) and SAC (Safety Automation cabinets) in an NPP. The instructions are output through a priority management module and a drive control module, and a drive device for driving a field actuator collects feedback information of the field actuator, supports self-diagnosis functions, supports periodic testing of the safety system, and transmits information such as the feedback information of the field actuator, the diagnosis results and periodic test results to the DCS system of the nuclear power plant. The electrical and instrument control systems for nuclear power plants are divided into three classes: safety class (1E), safety related class (SR) and non-safety class (NC). Priority module design should be different from digital systems to avoid common cause failure (CCF); a common cause failure refers to a failure of two or more structures, systems or components due to a specific single event or cause. Therefore, the priority module should be independent of the digital system and its function cannot be affected by the digital system.

Among them, especially when the PMS receives manual device control instructions from non-safety systems, a large amount of hardwire is connected across non-safety class plants and safety class plants, with a long distance and a large quantity and occupying cabinet space. As a result, implementation for the project is extremely inconvenient.

<CIT> describes an enhancement of a NPP safety system reliability and protection against common cause failures by means of constructing safety features and normal operation features based on different software and hardware platforms. <CIT> describes a communication network for NPP protection system that provides means for exchanging information between redundant plant protection system channels and engineered safety feature trains. <NPL> the architecture for upgrading the instrumentation and control systems of a Korean standard NPP as an operating NPP.

The object of the present disclosure is to provide a PMS in an NPP, so that it is convenient for the system to receive control instructions from systems for various safety classes to avoid a large number of hard-wired connections, thereby ensuring favorable engineering applicability of the system.

According to an embodiment of the present disclosure, a nuclear power plant priority management system is provided. The nuclear power plant priority management system includes a priority management device, the priority management device being connected with hard-wired interfaces and a safety class instruction interface. The priority management device is further connected with a non-safety class communication interface through the hard-wired interfaces, and the non-safety class communication interface is configured for connecting with a non-safety class system and receiving non-safety class device level control instructions from the non-safety class system.

Optionally, the non-safety class communication interface includes at least two identical transceivers, the at least two transceivers being connected with the non-safety class system and being configured for receiving the non-safety class device level control instructions from the non-safety class system.

Optionally, the non-safety class communication interface further includes a communication connection module, the communication connection module being connected between a hard-wired interface corresponding to the non-safety class communication interface and the at least two transceivers, and being configured for transmitting the non-safety class device level control instructions received from one of the at least two transceivers to the priority management device via the corresponding hard-wired interface.

Optionally, the non-safety class communication interface further includes a communication conversion module, the communication conversion module being connected between a hard-wired interface corresponding to the non-safety class communication interface and the communication connection module, and being configured for converting a format of the non-safety class device level control instructions received from the communication connection module to a corresponding format of the corresponding hard-wired interface and transmitting he format converted non-safety class device level control instructions to the priority management device through the corresponding hard-wired interface.

Optionally, the non-safety class communication interface further includes a communication protocol module, which is connected between the communication conversion module and the communication connection module, and is configured for transmitting the non-safety class device level control instructions received from the communication connection module to the communication conversion module according to a set communication protocol.

Optionally, the priority management device is further connected with the non-safety class communication interface through a feedback module for transmitting feedback signals in one direction.

Optionally, at least one of the hard-wired interfaces and the safety class instruction interface is provided with a signal isolation unit for electrical isolation and/or communication isolation of signals.

Optionally, the priority management device is further connected with a first priority logic module and a second priority logic module, the first priority logic module and the second priority logic module being connected with an execution device; the priority management device outputs control instructions to the execution device via one of the first priority logic module and the second priority logic module.

Optionally, the priority management system further includes a safety self-diagnosis device; the safety self-diagnosis device includes an output drive loop detection module connected with the priority management device, the output drive loop detection module includes a voltage detection module and/or a current detection module connected with the priority management device as well as a pulse generation module (<NUM>) connected with the priority management device (<NUM>), the voltage detection module (<NUM>) and/or a current detection module (<NUM>) also being connected with the output control module (<NUM>) which is connected between the first priority logic module (<NUM>) as well as the second priority logic module (<NUM>) and the execution device (<NUM>); and/or, the safety self-diagnosis device includes a fault collection and diagnosis module connected with the priority management device.

Optionally, the priority management system further includes an indicator light, which is connected with the priority management device and is configured for indicating a working status of the priority management device.

The priority management system for a nuclear power plant according to embodiments of the present disclosure, by integrating hard-wired interfaces, a safety class communication interface and a non-safety class communication interface on the priority management device as communication interfaces of the priority management system, makes it convenient for the system to receive control instructions from different safety class systems, helpful to improve engineering applicability of the system. Non-safety communication interfaces can be directly connected to a non-safety class system and redundant communication links are established to ensure stable reception of non-safety class device level control instructions. With the hard-wired interfaces, stable transmission of the non-safety class device level control instructions is ensured, with no requirements of connecting a large amount of hardwire, so that usability of the system in engineering implementation is greatly improved.

<NUM> - priority management device; <NUM> - hard-wired interface; <NUM> - safety class instruction interface; <NUM> - safety class system; <NUM> - non-safety class communication interface; <NUM> - non-safety class system; <NUM> - transceiver; <NUM> - communication connection module; <NUM> - communication protocol module; <NUM> - communication conversion module; <NUM> - feedback module; <NUM> - first priority logic module; <NUM> - second priority logic module; <NUM> - output control module; <NUM> - safety self-diagnosis device; <NUM> - pulse generation module; <NUM> - voltage detection module; <NUM> - current detection module; <NUM> - indicator light; <NUM> - execution device.

Specific embodying modes of the present disclosure are further described in detail below with reference to the accompanying drawings and embodiments, wherein like elements are indicated with like reference numerals throughout the drawings. The following embodiments are provided for purposes of explaining the present disclosure, not for limiting the scope of the present disclosure.

<FIG> is a structural diagram illustrating a nuclear power plant priority management system according to an embodiment of the present disclosure. Communication interfaces of the nuclear power plant priority management system include hard-wired interfaces, a safety class communication interface, and a non-safety class communication interface. These communication interfaces facilitate in receiving device level manual control instructions from safety class systems and non-safety class systems, with no requirements of connecting a large amount of hardwire. Accordingly, favorable engineering applicability of the priority management is ensured, and engineering application requirements can be met for priority management systems of various types of nuclear power plants.

As shown in <FIG>, the nuclear power plant priority management system of an embodiment of the present disclosure includes a priority management device <NUM>, on which hard-wired interfaces <NUM>, a safety class instruction interface <NUM>, and a non-safety class communication interface <NUM> are integrated. The non-safety class communication interface <NUM> is connected with the priority management device <NUM> via the hard-wired interfaces <NUM>, and the non-safety class communication interface is configured for connecting with a non-safety class system <NUM>, for receiving non-safety class device level control instructions from the non-safety class system <NUM> and for transmitting the non-safety class device level control instructions to the priority management device <NUM> via the hard-wired interfaces <NUM>.

Having the hard-wired interfaces <NUM>, the safety class instruction interface <NUM> and the non-safety class communication interface <NUM> integrated on the priority management device <NUM> is equivalent to the priority management system having communication interfaces or communication input ends with hard-wired interfaces and supporting both safety class communication and non-safety class communication. By connecting a respective interface to a system of a corresponding class in the nuclear power plant, control instructions can be received directly, with no need for conversion on safety classes in communication connections, so that connecting a large amount of hardwire can be avoided, and usability in engineering implementation of priority management systems can be effectively improved. In particular, the non-safety class communication interface <NUM> can directly communicate with the non-safety class system <NUM> and receive the non-safety class device level control instructions from the non-safety class system <NUM>. In comparison with conventional priority management systems in which communication interfaces have to connect hard-wired or perform communicate safety class conversion, and indirectly receive non-safety class device control instructions from the non-safety class system <NUM>, such problems as connecting hard-wired across factory buildings and occupying cabinet space can be effectively avoided, project implementation and overall planning in controlling safe operation of nuclear power plant can be greatly facilitated.

In an embodiment, the priority management device <NUM> receives control instructions for systems of respective safety classes via the hard-wired interfaces <NUM>, the safety class instruction interface <NUM> and the non-safety class communication interface <NUM>, and performs priority management, specifically with a CPLD (Complex Programmable Logic Device). A plurality of hard-wired interfaces <NUM> are integrated on the priority management device <NUM>, which is connected to the safety class instruction interface <NUM> through a hard-wired interface <NUM>, and to the non-safety class communication interface <NUM> through a hard-wired interface <NUM>, to ensure that the priority management device <NUM> can stably receive control instructions of each class.

In a practical application scenario, the safety class instruction interface <NUM> can be connected to a safety class system <NUM> in the nuclear power plant for receiving safety class control instructions from the safety class system <NUM>. For example, the safety class instruction interface <NUM> can receive 1E class automatic or manual control instructions from a 1E (safety class of nuclear power plant equipment)-DCS (Distributed Control System) system. The non-safety class communication interface <NUM> can be connected to the non-safety class system <NUM> in the nuclear power plant for receiving non-safety class device level manual control instructions from the non-safety class system <NUM>. For example, the non-safety class communication interface <NUM> can receive NC-DCS device level manual control instructions from an NC (non-safety class of nuclear power plant equipment)-DCS system. The hard-wired interfaces <NUM> can be connected to other systems or field devices in the nuclear power plant and receive associated control instructions. For example, the hard-wired interfaces <NUM> can receive diversity backup instructions from a diversity backup system, or receive severe post-accident instructions from a severe post-accident driving system.

As shown in <FIG>, in the priority management system of the present embodiment, the non-safety class communication interface <NUM> includes two (or more than two) identical transceivers <NUM>. The two identical transceivers <NUM> are connected with the non-safety class system <NUM>, configured for receiving non-safety class device level control instructions from the non-safety class system <NUM>.

The two transceivers <NUM> have the same structure and are connected in parallel to the non-safety class system <NUM>, which is equivalent to establishing a physical layer channel of parallel redundant communication links between the non-safety class communication interface <NUM> and the non-safety class system <NUM> through the two transceivers <NUM>. When one transceiver <NUM> fails on its own or the connection line fails, the other transceiver <NUM> can be used to ensure that the non-safety class communication interface <NUM> can stably receive non-safety class device level control instructions.

Preferably, the non-safety class communication interface <NUM> further includes a communication connection module <NUM>, which is connected between a hard-wired interface <NUM> corresponding to the non-safety class communication interface <NUM> and the two transceivers <NUM>, configured for transmitting non-safety class device level control instructions received from one of the two transceivers <NUM> to the priority management device <NUM>.

Specifically, the communication connection module <NUM> is communicatively connected to the two transceivers <NUM> respectively and establishes a communication connection with the hard-wired interfaces <NUM>, configured for receiving non-safety class device level control instructions from the two transceivers <NUM> and transmitting the received non-safety class device level control instructions to the priority management device <NUM> via the hard-wired interface <NUM>. The communication connection module <NUM> determines whether the two transceivers <NUM> have transmitted non-safety class device level control instructions. If the two transceivers <NUM> have transmitted non-safety class device level control instructions, non-safety class device level control instructions received from one of the two transceivers <NUM> are selected and sent to the hard-wired interface <NUM>; if only one of the transceivers <NUM> has transmitted non-safety class device level control instructions, the received non-safety class device level control instructions are sent to the hard-wired interface <NUM>. For example, the communication connection module <NUM> may be a CPLD chip integrated with "and/or" logic.

Preferably, the non-safety class communication interface <NUM> further includes a communication conversion module <NUM>. The communication conversion module <NUM> is connected between a hard-wired interface <NUM> corresponding to the non-safety class communication interface <NUM> and the communication connection module <NUM>, and is configured for receiving non-safety class device level control instructions from the communication connection module <NUM> and converting its format to a format corresponding to the hard-wired interface <NUM>, and then transmitting the converted non-safety class device level control instructions to the priority management device <NUM> through the hard-wired interface <NUM>. For example, the communication conversion module <NUM> may be an MCU (Microcontroller Unit or Single Chip Micyoco) integrated with the above communication and conversion functions.

In addition, the non-safety class communication interface <NUM> may further include a communication protocol module <NUM>. The communication protocol module <NUM> is connected between the communication connection module <NUM> and the communication conversion module <NUM>, and is configured for receiving non-safety class device level control instructions from the communication connection module <NUM>, and transmitting the non-safety class device level control instructions to the communication conversion module <NUM> according to a set communication protocol. For example, the communication protocol module may be a DP (Decentralized Periphery) communication protocol chip, which is used to implement data link layer parsing and cache processing of the DP communication protocol, and the DP communication protocol is utilized to ensure stable and fast transmission of non-safety class device level control instructions.

Preferably, the priority management device <NUM> is further connected with the non-safety class communication interface <NUM> via a feedback module <NUM>, for transmitting unidirectional feedback signals to the non-safety class communication interface <NUM>.

The priority management device <NUM> receives the non-safety class device level control instructions from the non-safety class communication interface <NUM> via the hard-wired interface <NUM>, and after the priority management is performed, a status feedback signal is fed back to the non-safety class communication interface <NUM> through the feedback module <NUM>. For example, the feedback module <NUM> can receive the status feedback signal from the priority management device <NUM> based on a SPI (Serial Peripheral Interface) communication method, and send the status feedback signal to the non-safety class communication interface <NUM>. Accordingly, the status feedback signal is sequentially transmitted to the communication conversion module <NUM>, the communication protocol module <NUM>, the communication connection module <NUM> and the transceivers <NUM>, and is fed back to the non-safety class system <NUM> through the transceivers <NUM>.

Preferably, the hard-wired interfaces <NUM> and the safety class instruction interface <NUM> are both provided with a signal isolation unit therein for electrical isolation, communication isolation or functional isolation in signals transmission. For example, the hard-wired interfaces <NUM> in the present embodiment is designed with a one-way isolation signal interface to meet isolation requirements of automatic control instructions or device level control instructions for respective safety class, thereby improving the reliability of the priority management system.

In the present embodiment, the priority management device <NUM> is further connected with a first priority logic module <NUM> and a second priority logic module <NUM>, the first priority logic module <NUM> and the second priority logic module <NUM> being identical. The first priority logic module <NUM> and the second priority logic module <NUM> are connected to an execution device <NUM>, and the priority management device <NUM> outputs control instructions to the execution device <NUM> through the first priority logic module <NUM> or the second priority logic module <NUM>.

The first priority logic module <NUM> and the second priority logic module <NUM> form a parallel, redundant priority logic, in other words, the priority management system performs priority management logic with redundant hardware, which can effectively ensure the stable output of the control instructions, increase reliability of priority management, and effectively avoid software common cause failure.

For example, the priority management device <NUM> performs priority management on automatic control instructions collected through a first hard-wired interface <NUM>, or 1E-class automatic control instructions collected through the safety class instruction interface <NUM>, or the NC-DCS device level manual control instructions collected through the non-safety class communication interface <NUM>. Then, the preferred control instructions are sent to the first priority logic module <NUM> and the second priority logic module <NUM>, respectively, and the control instructions are output to the execution device <NUM> though the first priority logic module <NUM> or the second priority logic module <NUM>.

As shown in <FIG>, an output control module <NUM> is connected between the first priority logic module <NUM> as well as the second priority logic module <NUM> and the execution device <NUM>. The output control module may receive the control instructions sent by one of the first priority logic module <NUM> and the second priority logic module <NUM> according to an "and/or" logic, and output the control instructions to the execution device <NUM>. The first priority logic module <NUM> and the second priority logic module <NUM> may be a CPLD (Complex Programmable Logic Device) or a logic circuit with identical priority logic integrated therein.

Preferably, the priority management system according to the present embodiment further includes a safety self-diagnosis device <NUM>. The safety self-diagnosis device <NUM> is connected to the priority management device <NUM>, and is configured for performing detection and diagnosis on the control signal output by the priority management device to ensure that the control signal does not cause malfunction of the execution device <NUM>, further to control the nuclear power plant to operate in a safe state and to enhance reliability of the priority management system.

In an optional embodiment, as shown in <FIG>, the safety self-diagnosis device <NUM> includes an output drive loop detection module connected with the priority management device <NUM>. The output drive loop detection module specifically includes a pulse generation module <NUM>, a voltage detection module <NUM>, and a current detection module <NUM>. The pulse generation module <NUM> is connected with the priority management device <NUM>, and is configured for transmitting a pulse enable signal of <NUM> to the priority management device <NUM>, and driving the priority management device <NUM> to actively output an experimental control instruction of <NUM>. The voltage detection module <NUM> and the current detection module <NUM> are respectively connected with the priority management device <NUM>, and are connected with the output control module <NUM> which connects with the first priority logic module <NUM> as well as the second priority logic module <NUM> and the execution device <NUM>. The voltage detection module <NUM> and the current detection module <NUM> are configured for detecting voltage and current on the experimental control instruction received from the priority logic module <NUM> and the second priority logic module <NUM>, and send detection results to priority management device <NUM> for state readback detection. If the detection results indicate that the experimental control instruction is the expected control instruction, the control signal output by the priority management device <NUM> is determined to be normal, and the priority management device <NUM> can continue outputting control instructions to the execution device <NUM>. If the detection results indicate that the experimental control instruction is different from the expected control instruction, the control signal output by the priority management device <NUM> is determined to be incorrect. The loop of the priority management device <NUM> outputting the control instruction breaks, and the priority management device <NUM> cannot continue outputting control instructions to the execution device <NUM>, so that malfunctions of the execution device <NUM> affecting safe operations of the nuclear power plant can be avoided.

Of course, in other embodiments, the safety self-diagnosis device <NUM> may further include a fault collection diagnosis module connected with the priority management device <NUM>. The fault collection diagnosis module is connected with the priority management device <NUM> through a communication interface or a communication input (for example, the above-mentioned plurality of hard-wired interfaces <NUM>), and performs fault diagnosis on the control instructions collected by the priority management device <NUM>.

In addition, the priority management system according to the present embodiment further includes an indicator light <NUM> which is connected with the priority management device <NUM> for indicating working state information of the priority management device <NUM>. For example, the indicator light <NUM> may indicate power status information, fault status information, communication link status information, control instructions output status information, etc. by displaying different setting colors, so as to facilitate working staff in obtaining the information indicated by the indicator light <NUM>.

The nuclear power plant priority management system according to embodiments of the invention integrates hard-wired interfaces, a safety class communication interface and a non-safety class communication interface on a priority management device as a communication interface of the priority management system, thereby facilitating the system in its receiving control instructions from different safety class systems and improving the engineering applicability of the system. Further, the non-safety communication interface can directly connect with non-safety class systems, and can establish a redundant communication link to ensure steady reception of non-safety class device level control instructions, and to ensure stable and fast transmission of non-safety class device level control instructions through hard-wired interfaces and communication method. Consequently, connection of a large amount of hardwire can be avoided, and usability in engineering implementation of the system is greatly improved.

Next, with priority management logic implemented by redundant hardware, the priority management device can stably output the control instructions, increasing reliability of the priority management system.

Still next, with a self-diagnosis device performing fault detection on the input or output control instructions by the priority management device, outputting fault control instructions that cause the malfunction of the execution device may be avoided, so that reliability and safety of the system is improved, and the nuclear power plant can be controlled to operate in a safe state.

It should be noted that the components described in the present application can be split into more components, or two or more components or partial operations of the components can be combined into new components to achieve the object of the present disclosure, as required in implementation.

Claim 1:
A nuclear power plant priority management system, comprising a priority management device (<NUM>), the priority management device being connected via first hard-wired interfaces (<NUM>) with
a safety class instruction interface (<NUM>), the safety class instruction interface being configured for connecting with a safety class system (<NUM>) and receiving safety class control instructions from the safety class system;
the priority management device (<NUM>) is further connected with a non-safety class communication interface (<NUM>) via second hard-wired interfaces (<NUM>), the non-safety class communication interface (<NUM>) being configured for connecting with a non-safety class system (<NUM>) and receiving non-safety class device level control instructions from the non-safety class system (<NUM>) and for transmitting the non-safety class device level control instructions to the priority management device (<NUM>) via the second hard-wired interfaces (<NUM>).