Process protection system

• US 6,532,550 B1
• Filed: 02/10/2000
• Issued: 03/11/2003
• Est. Priority Date: 02/10/2000
• Status: Expired due to Term

• Current Assignee: Westinghouse Electric Company LLC (Brookfield Asset Management Incorporated)
• Original Assignee: Westinghouse Electric Company LLC (Brookfield Asset Management Incorporated)
• Inventors: Lang, Glenn E., Hayes, Thomas Pierce, Ghrist, William D. III, Crew, Albert W., Vitalbo, Carl A.
• Primary Examiner(s): Baderman, Scott
• Assistant Examiner(s): LOHN, JOSHUA A
• Application Number:
  US09/501,804
• Time in Patent Office: 1,125 Days
• Field of Search: 714/10, 714/11, 714/797
• US Class Current: 714/11
• CPC Class Codes: G05B 9/03 with multiple-channel loop, i.e. redundant control systems
• CPC Class Codes: G21C 17/00 Monitoring; Testing measuring in general G01; Maintaining
• CPC Class Codes: G21D 3/001 Computer implemented control
• CPC Class Codes: Y02E 30/00 Energy generation of nuclear origin
• CPC Class Codes: Y02E 30/30 Nuclear fission reactors

Abstract

A protection system for a complex process has four redundant protection sets, each of which produces partial reactor trip and partial safeguard actuation signals in pairs of microprocessor-based controllers. Two independent and redundant voting logic trains are provided for the partial reactor trip signals, and two identical, independent and redundant voting logic trains are provided for the partial safeguard actuation signals. Each of the trains includes a pair of redundant microprocessor-based voting logic controllers, each of which receives the partial reactor trip or partial safeguard actuation signals from each of the process protection sets and has a voting processor which generates an intermediate reactor trip or intermediate safeguard actuation signal in response to partial signals from a predetermined number of protection sets. The intermediate signals from the two voting logic controllers in each train are ANDed to generate train signals. The reactor trip train signals are then ORed to generate a reactor trip signal. Each of the train safeguard actuation signals activates a separate set of redundant components.

Claims

1. A process protection system for a complex process comprising:

a plurality of redundant process protection sets, each independently computing partial protection signals;

a voting logic system having two independent and redundant logic trains, each logic train having a pair of redundant microprocessor based voting logic controllers, each voting logic controller of each logic train receiving said partial protection signals from each said process protection set and having a voting processor which generates an intermediate protection signal in response to partial protection signals, from a selected number of said protection sets;

logic associated with each logic train generating a train protection signal only when each voting processor in the train generates an intermediate protection signal; and

an output device producing a protection output in response to a train protection signal from either of said logic trains.

2. The process protection system of claim 1 wherein said plurality of process protection sets generates partial protection signals in the form of partial reactor trip signals, said two logic trains each including a reactor trip logic train an generating intermediate reactor trip signal in response to said partial reactor trip signals from said selected number of said protection sets, and said logic means associated with each logic train generates a train reactor trip signal only when each voting processor in the train generates an intermediate trip signal, and said output device generates a reactor trip signal in response to a train reactor trip signal from either of said logic trains.

3. The process protection system of claim 2 wherein said logic includes indicator logic generating an associated partial trip indicator signal for each protection set for each trip function only when partial reactor trip signals from that protection set for that protection function have been applied to both voting logic controllers in at least one of said two independent and redundant reactor trip logic trains, and said output device includes a partial trip indicator device for each protection set for each trip function generating a partial trip indication for that protection set for that trip function in response to the associated partial trip indicator signal.

4. The process protection system of claim 3 wherein said voting processors in said reactor trip logic trains generate function specific intermediate trip signals for each reactor trip function and said indicator logic includes additional indicator logic generating a function specific reactor trip signal for a specific reactor trip function only when both voting processors in at least one of said reactor trip logic trains generate a function specific intermediate trip signal for that specific trip function.

5. The process protection system of claim 2 wherein said plurality of protection sets also generate partial protection signals in the form of partial safeguard actuation signals, said logic trains also comprise safeguard actuation logic trains each including a pair of redundant microprocessor-based additional voting logic controllers, each additional voting logic controller of each safeguard actuation logic train receiving said partial safeguard actuation signals from each of said process protection sets and having an additional voting processor which generates an intermediate safeguard actuation signal in response to partial safeguard actuation signals from a preselected number of said process protection sets, said logic means associated with each logic train comprising additional logic means generating a train safeguard actuation signal only when each additional voting processor in the safeguard actuation logic train generates an intermediate safeguard actuation signal.

6. The process protection system of claim 5 wherein said logic includes indicator logic generating an associated partial safeguard actuation indicator signal for each protection set for each safeguard actuation function only when partial safeguard actuation signals from that protection set for that protection function have been applied to both voting logic controllers in at least one of said two independent and redundant safeguard actuation logic trains, and said output device includes a partial safeguard actuation indicator device for each protection set for each safeguard actuation function generating a partial safeguard actuation indication for that protection set for that safeguard actuation function in response to the associated partial safeguard actuation indicator signal.

7. The process protection system of claim 6 wherein said voting processors in said safeguard actuation logic trains generate function specific intermediate safeguard actuation signals for each safeguard actuation function and said indicator logic includes logic generating a function specific safeguard actuation signal for a specific safeguard actuation function only when both voting processors in at least one of said safeguard actuation logic trains generate a function specific intermediate safeguard actuation signal for that specific safeguard actuation function.