1,010,704. Fault testing. D. D. BOWEN. June 19,1964 [March 27,1963], No. 2067/63. Heading G1U. [Also in Division H3] An electrical apparatus comprising at least two circuits each of plural series connected electrically operated gates is tested by continuous repetition of a sequence of electrically isolating each circuit in turn while operatively connecting at least one of the other circuits into the apparatus; testing the isolated circuits by applying a trigger test signal to each gate in turn; an analysing the response of such circuit to each such trigger test signal; whereby faulty operation of any gate is detected and such faulty gate or gates located. Fig. 1 shows safety apparatus for controlling the operation of a nuclear reactor wherein plural lines 11 energizing solenoids retaining control rods (not shown) are excited from line 10 over manual switch 12; opening of which releases the rods to shut down the reactor. Line 10 is energized from identical circuits suffixed A and B comprising rectifiers 16 in series with silicon controlled rectifiers 14,15 and windings of transformers 13 energized from independent 50 c.p.s. supplies 9. Master pulse generators 17 are driven from windings S of transformers 13 and control the S.C.R.'s over series gates 18 1 .... 18 n and final gates 19 each circuit including interrogator unit 20 triggered by master generator 17 and connected to plural trip units 21 1 .... 21 n one per gate respective specific reactor parameters, e.g. temperature, neutron flux, so as to trigger the appropriate trip unit on excess of such parameters over critical values, so as to remove a D.C. control signal from the associated gate, which then closes, so as to disable S.C.R.'s 14,15. Each trip unit has a trigger test input, connected to an interrogator unit 21 for each circuit, driven from master generator 17, and each circuit also comprises a responder 22, an alarm indicator 23 and a gate 19 connecting or disconnecting the series gates 18 from the SCR's 14,15. In operation, one only of circuits A, B is operatively connected in the apparatus to energize line 10, while the other is disconnected therefrom and is tested for serviceability; being substituted for the operative circuit on satisfactory test with the sequence automatically. Each master pulse generator 17 generates 10 ms. SCR gating pulses (ii) (Fig. 3) synchronized with the A.C. waveform (i) of supply 9 with leading edge delayed 1/2 ms from zero phase thereof, which when applied to SCR's 14,15 enables holding current to pass over line 10. Gate 19A is initially closed and 19B is open, so that circuit B is operative. Assuming no triggering pulses are applied to any trip unit 21B, the interrogator unit 20A comprising (Fig. 4) a scalar switching unit slaved to the master pulse generator 17A sends a trigger test signal (iii) comprising square 9 ms pulses with leading edge 1<SP>1</SP>/ 2 ms behind zero phase to the first trip unit 21A, and the associated gate should close within 9 ms of signal receipt. During the margin for closure, a gate test signal (iv) of 2 ms pulses with trailing edges coincident with those of signal (iii) is applied to circuit A, and the outgoing signals of gate chain 18A 1 to 18A n at point 0 (Fig. 1) are monitered by responder unit 22A, which includes a fail safe AND gate 30 and a fail danger AND gate 31 (Fig. 4). Gate 30 receives SCR gating pulses (ii) (Fig. 3) and the pulse signals at 0, and since pulses of waveform (ii) precede those of waveform (iii), gates 18A are open if the circuit is serviceable, AND gate 30 gives an output. Absence of output operates alarm 32 in unit 23A indicating fail to safety of trip unit 21A or gate 18A. Fail danger gate 31 receives waveform (iv) (Fig. 3) and the waveform received at point 0, so that if trip unit 21a is correctly operative, gate 18A should close for the duration of the pulses of waveform (iii) so that no signal reaches point 0, and if inoperative by failure to danger, waveform (iv) reaches point 0 so that gate 31 produces a positive output pulse (v) (Fig. 3) which operates alarm 33 in unit 23A to indicate failure to danger of trip unit 21A. Output (v) energizes test position register 34 of the interrogater unit 20A to indicate the location of the failed trip unit 21A in indicator 35 of alarm indicator unit 23A. On satisfactory test, indicators 32, 33 are inoperative and trip unit 21A resets on the cessation of the pulse of signal (iii) and the next SCR gate pulse (ii) arrives unimpeded at point 0, confirming the reset, and is passed to AND gate 36 of the interrogator unit 20A with a signal from the responder unit, indicating that gate 19A is still closed. A positive output from AND gate 36 switches the triggering test signal to the next succeeding trip unit 21A 2 , when the test sequence repeats to test all units 21A, to 21A n . Failure of a trip unit 21A to reset and open to gate 18A after cessation of trigger test signal (iii) closes circuit A so that SCR gate pulses (ii) fail to reach point 0, the AND gate 66 gives no output, and the trip unit test sequence ceases. After cessation for more than a predetermined interval, a delay unit connected to the test position register 34 operates an interrogator responder fault alarm 35 of the delay circuit 37. A monostable gate 39 of the responder unit 22A is connected to a bi-stable gate 40 common to responder units 22A, B and is in turn connected to gates 19A, B so that gate 19A is closed and 19B open and vice versa for alternate stable states of gate 40 testing circuits A and B in turn. While circuit A is under test, waveform (v) from AND gate 31 is passed through monostable gate 39 but does not alter the state of bistable gate 40, since gate 19A is already closed; instead waveform (v) passes to the alternative AND gate 41 inhibiting the test sequence of circuit A as set forth above. Trip units 21 of circuits A and B are sensitive to genuine reactor alarm trigger signals over lines 24 even when under test. Receipt of such a signal or development of a fail safe fault closing circuit A when it is operatively connected to line 10, operates monostable gate 39 of responder unit 22A to switch bi-stable gate 40 to its other setting, so as to close gate 19A and open gate 19B and to operatively substitute circuit B for circuit A. A genuine alarm signal similarly affects circuit B to interrupt the SCR gate pulses (ii),and deenergize line 10 within a short time interval. A fail safe fault in circuit A will not affect circuit B, so line 10 remains energized, and OR gate 42 operated from bi-stable gate 40 initiates testing of circuit A by operating AND gate 36 to locate the fault therein. When circuit A is operative with gate 19A open, the responder unit 22A continuously monitors point R of line 10, and if SCR's 14A, 15A are correctly gated by pulses (ii) (Fig. 4) there should appear halfwave pulses fed to AND gate 43 of the responder unit also receiving the SCR gating pulses (ii) to give an output only if both are present, to operate a rectifier failure indicator 44 in absence of output, and to initiate waveform v (Fig. 4) to substitute circuit B for circuit A. Indicator 35 is operated only when the or each SCR 14A or 15A or rectifier 16A become open circuited. Responder 22A also monitors outputs of SCR gates 14A, 15A at points P, Q during the time interval between zero phase of A.C. energization and the leading edge of the SCR gate pulse by passing the outputs of P, Q to monostable gate 39, which is normally closed but opened once per cycle by gating waveform (vi) (Fig. 4) at one input thereof; gate 39 yielding no output for correct gating of SCR's 14A, 15A. If either or both SCR's are inoperative in response to gating waveform (ii) or are short circuited, gate 39 gives an integrated waveform (vii) to operate a fail danger alarm 45 in alarm indicator unit 23A. An output is taken to AND gate 41 to inhibit further testing of circuit A until fault clearance. Generation of the SCR fail danger signal (vii) also initiates waveform (v) which when gate 19A is open (circuit A operative) operates bi-stable circuit 40 to render circuit B operative and circuit A under test. After successful completion of the trip unit test sequence, the final trip unit 21A n of circuit A gates a signal from master generator 17A to the S.C.R. monostable gate 39, whose output is correctly functioning is an integrated pulse similar to (vii) sufficient in amplitude to initiate circuit substitution similarly to waveform (v), but insufficient to operate alarm indicator 45, so that gate 39 is tested once per trip unit sequence. Should a halfwave rectifier 16 open circuit, AND gate 43 of the associated responder unit 22 fails in output, operating rectifier alarm 44 and initiating a circuit substitution by means of waveform (v) as before. Shortcircuit of a rectifier develops S.C.R. gating pulses (ii) at point Q to operate alarm 45 through monostable gate 39. Two independent parallel multivibrators generate the SCR gating pulses (ii) and if both fail the responder unit 22 initiates waveform (v) to effect circuit substitution. Each trip unit incorporates a variable gain circuit enabling trip levels to be set and the circuit may also provide a further pulse signal exceeding the trip level for application to the associated gate 18 when the trip unit receives triggering test signal (iii). The apparatus may be applied to equipment comprising more than two alternative circuits, and is applicable to control equipment other than that for a nuclear reactor.