Reactor protection system with automatic self-testing and diagnostic
First Claim
1. A self-testing system for initiating safety action in response to monitoring of a critical parameter, comprising:
- first through fourth sensors for independently detecting the value of a critical parameter and outputting first through fourth sensor readings respectively;
first through fourth division electronics respectively connected to said first through fourth sensors for processing said first through fourth sensor readings respectively and comprising respective means for outputting a safety actuation inhibition signal in response to said respective sensor reading being below a predetermined threshold voltage and terminating the output of said safety actuation inhibition signal in response to said respective sensor reading being above said predetermined threshold voltage; and
cross communication channels for interconnecting said first through fourth division electronics such that each one of said first through fourth division electronics receives the processed sensor readings from the other division electronics,wherein each of said first through fourth division electronics further comprises means for inputting a respective reference voltage in place of said respective sensor reading and means for detecting a difference in the response of one of said division electronics to its own reference voltage and the response of another of said division electronics to its own reference voltage.
2 Assignments
0 Petitions
Accused Products
Abstract
A reactor protection system having four divisions, with quad redundant sensors for each scram parameter providing input to four independent microprocessor-based electronic chassis. Each electronic chassis acquires the scram parameter data from its own sensor, digitizes the information, and then transmits the sensor reading to the other three electronic chassis via optical fibers. To increase system availability and reduce false scrams, the reactor protection system employs two levels of voting on a need for reactor scram. The electronic chassis perform software divisional data processing, vote 2/3 with spare based upon information from all four sensors, and send the divisional scram signals to the hardware logic panel, which performs a 2/4 division vote on whether or not to initiate a reactor scram. Each chassis makes a divisional scram decision based on data from all sensors. Automatic detection and discrimination against failed sensors allows the reactor protection system to automatically enter a known state when sensor failures occur. Cross communication of sensor readings allows comparison of four theoretically "identical" values. This permits identification of sensor errors such as drift or malfunction. A diagnostic request for service is issued for errant sensor data. Automated self test and diagnostic monitoring, sensor input through output relay logic, virtually eliminate the need for manual surveillance testing. This provides an ability for each division to cross-check all divisions and to sense failures of the hardware logic.
58 Citations
21 Claims
-
1. A self-testing system for initiating safety action in response to monitoring of a critical parameter, comprising:
-
first through fourth sensors for independently detecting the value of a critical parameter and outputting first through fourth sensor readings respectively; first through fourth division electronics respectively connected to said first through fourth sensors for processing said first through fourth sensor readings respectively and comprising respective means for outputting a safety actuation inhibition signal in response to said respective sensor reading being below a predetermined threshold voltage and terminating the output of said safety actuation inhibition signal in response to said respective sensor reading being above said predetermined threshold voltage; and cross communication channels for interconnecting said first through fourth division electronics such that each one of said first through fourth division electronics receives the processed sensor readings from the other division electronics, wherein each of said first through fourth division electronics further comprises means for inputting a respective reference voltage in place of said respective sensor reading and means for detecting a difference in the response of one of said division electronics to its own reference voltage and the response of another of said division electronics to its own reference voltage. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
-
8. A self-testing system for initiating safety action in response to monitoring of a critical parameter, comprising:
-
first through fourth means for monitoring said critical parameter; first through fourth division processing means for issuing first through fourth continuous safety actuation inhibition signals when said critical parameter does not exceed a predetermined threshold, and discontinuing said respective safety actuation inhibition signal when said critical parameter exceeds said predetermined threshold; a hardware logic circuit connected to receive an output from each of said first through fourth division processing means, wherein said hardware logic circuit changes from a normal state to a safety actuation state in response to discontinuance of said safety actuation inhibition signals by at least two of said first through fourth division processing means; a safety actuator; an actuator power supply circuit, wherein said safety actuator is coupled to said actuator power supply circuit via said hardware logic circuit; and means for detecting the state of said hardware logic circuit, wherein each of said first through fourth division processing means comprises means for diagnosing a fault state of said hardware logic circuit as a function of the output of said detecting means. - View Dependent Claims (9, 10, 11, 12, 13, 14, 15, 16)
-
-
17. A self-testing reactor protection system for initiating a scram in a nuclear reactor in response to monitoring of a critical reactor parameter, comprising:
-
first through fourth reactor parameter sensors for independently detecting the value of a critical reactor parameter and outputting first through fourth sensor readings respectively; first through fourth division electronics respectively connected to said first through fourth reactor parameter sensors for processing said first through fourth sensor readings respectively and comprising respective means for outputting a scram inhibition signal in response to said respective sensor reading being below a predetermined threshold voltage and terminating the output of said scram inhibition signal in response to said respective sensor reading being above said predetermined threshold voltage; and cross communication channels for interconnecting said first through fourth division electronics such that each one of said first through fourth division electronics receives the processed sensor readings from the other division electronics, wherein each of said first through fourth division electronics further comprises means for inputting a respective reference voltage greater than said predetermined threshold voltage in place of said respective sensor reading;
means for outputting a scram inhibition signal despite the input of said respective reference voltage;
means for detecting a difference in the response of one of said division electronics to its own reference voltage and the response of another of said division electronics to its own reference voltage; and
means for issuing an error message in response to nonuniformity of the sensor readings processed by different divisional electronics. - View Dependent Claims (18, 19, 20)
-
-
21. A method for testing a system which initiates safety action in response to monitoring of a critical parameter, said system comprising:
-
first through fourth sensors for independently detecting the value of a critical parameter and outputting first through fourth sensor readings respectively; first through fourth division electronics respectively connected to said first through fourth sensors for processing said first through fourth sensor readings respectively and comprising respective means for outputting a safety actuation inhibition signal in response to said respective sensor reading being below a respective predetermined threshold voltage and terminating the output of said safety actuation inhibition signal in response to said respective sensor reading being above said respective predetermined threshold voltage; and cross communication channels for interconnecting said first through fourth division electronics such that each one of said first through fourth division electronics receives the processed sensor readings from the other division electronics, wherein said method comprises the steps of; polling said first through fourth sensors in sequence once during each polling cycle; inputting a respective reference signal having a level in excess of said respective predetermined threshold level during each polling cycle, said reference voltage being treated as a sensor output; terminating the output of said respective safety actuation inhibition signal by a selected one of said first through fourth division electronics in response to said respective reference signal being in excess of said respective predetermined threshold level during a selected one of said polling cycles; and inhibiting the termination of the output of said respective safety actuation inhibition signal by the ones of said first through fourth division electronics other than said selected one in response to said respective reference signal being in excess of said respective predetermined threshold level.
-
Specification