JPH04294401A - Device for protecting plant - Google Patents

Abstract

PURPOSE:To offer a compact plant protecting device by taking countermeasures flexibly and carefuly to changes in protecting conditions. CONSTITUTION:The abnormality of each protection factor is judged (10-1 to 10-k) by respective multiple digital controllers 1A to 1C and the validity of plant stop is judged (20-1 to 20-k) by software majority logic (2 out of 3) processing based upon respective judged results to secure the reliability of the device and taking countermeasures flexibly and carefully to a change in a protecting condition or the like by means of a data change in a program, a memory or the like. On the other hand, the judged results of respective controllers 1A to 1C are concentrated into one point so as to simplify and compact the hardware constitution of a stop determination logic circuit 4.

Description

[Detailed description of the invention]

0001

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a plant protection device for protecting components of various plants such as thermal power plants and nuclear power plants from damage.

0002

[Prior Art] Plant control devices for power generation plants, etc.
As the functions required of plants have become more sophisticated, the control content has become more sophisticated and complex, so configuring control devices using conventional wired logic using electromagnetic relays or analog computing units such as operational amplifiers reduces the amount of hardware required. Due to the enormous number of devices, digital control devices using digital controllers have recently been introduced. In such a digital control device, a microprocessor executes multiple processes sequentially by time sharing, so one
Failure of one digital controller affects multiple control processes. Therefore, digital controllers are multiplexed to increase the reliability of control processing.

On the other hand, from the viewpoint of ensuring the reliability of plant protection, it is common practice to provide a plant protection device separate from such multiplexed digital control devices. In other words, even if a failure occurs in a control device such as a control device, a control detector, or an operating end, the plant protection device determines whether or not it is necessary to stop the plant, and takes appropriate action to stop the plant. This is because a function is required to reliably stop the plant based on the Moreover, since plant protection devices are required to operate accurately in emergencies, they have traditionally been constructed as simple as possible using wired logic using electromagnetic relays and analog computing units using operational amplifiers. Consideration has been given to ensure that the operations can be carried out reliably (Japanese Patent Application Laid-Open Nos. 1983-109101, 150920-1980, 217297-1997).
Publication No.).

0004

[Problem to be solved by the invention] However, due to the increasing sophistication of plant operation, the margin of protection standard values has to be reviewed,
In order to achieve more fine-grained protection, it is necessary to change the protection standard values according to the operating conditions of the plant. Such demands are difficult to meet with the conventional protection devices made of hardware such as wired logic, which are difficult to change and require large-scale and complicated hardware. There is.

[0005] For example, factors that cause a boiler to trip when an abnormality is detected in a thermal power plant include a low air-fuel ratio, a low feed water flow rate, an abnormally low furnace pressure, an abnormally high furnace pressure, an abnormally high main steam pressure, and the like. Then, a detection circuit is configured with hardware such as an analog arithmetic unit for each of these detection factors, and in order to ensure reliability, the detection circuits are multiplexed including a detector, and 2 o
A selection logic circuit such as utof3 makes the final decision as to whether or not to shut down the plant. Therefore, a hardware detection circuit is required for each detection factor and in accordance with multiplexing, resulting in an enormous configuration. Moreover, using the detection results for each factor as a factor, 2 out
Since the selection logic circuit such as the OF 3 circuit is realized by wired logic consisting of electromagnetic relays and the like, the circuit becomes enormous.

[0006]Also, it is conceivable to implement the plant protection device using a digital controller, but as mentioned above, there is a problem in entrusting everything to software from the point of view of ensuring reliability. For example, it is preferable that a detection circuit for each factor be formed by a computer, and a selection logic circuit such as a 2 out of 3 circuit be formed by hardware. However, even in this case, according to the prior art, 2 out of
The problem remains that the configuration of the selection logic circuit such as the f3 circuit becomes enormous.

[0007] An object of the present invention is to provide a compact plant protection device that is highly flexible to changes in protection conditions such as protection judgment values, can realize fine-grained protection, and has reduced hardware.

[0008]

[Means for Solving the Problems] In order to achieve the above object, the plant protection device of the present invention inputs various plant states from a plurality of state detectors that detect plant states, and uses the input plant states as input. Based on this, the presence or absence of an abnormality in the plant is judged, and based on this judgment result, the digital controllers that output a plant stop command are multiplexed, the plant stop commands output from each of the multiplexed digital controllers are input, and the majority decision is made. A shutdown decision logic circuit is provided which makes a final decision on whether or not to shut down the plant based on logic, and each of the multiplexed digital controllers has a plurality of abnormality detection circuits that determine whether the plant is abnormal for each protection factor according to a preset program. Based on the judgment results of each abnormality detection means and the judgment results of the corresponding abnormality detection means of other digital controllers, it is determined whether or not to stop the plant for each of the protection factors according to preset majority logic, and the plant is stopped. The stop determination means outputs a command.

In the above configuration, it is preferable that the stop decision logic circuit is configured using an electromagnetic relay.

0010

[Operations] With the above structure, according to the present invention, the above object is achieved by the following operations. Based on the plant status, multiple digital controllers determine abnormalities for each protection factor. Further, based on the judgment results of each digital controller regarding each of these protection factors, processing is performed using software majority logic (2 out of 3, etc.) to judge whether or not to stop the plant. therefore,
Changes in protection conditions such as protection judgment values can be handled flexibly and precisely by changing programs or data such as memory, and reliability can be ensured.

[0011] Furthermore, since the judgment results of each digital controller are aggregated into one result, the hardware configuration of the majority logic circuit that ultimately decides whether to stop the plant becomes extremely simple, and the hardware can be reduced. It becomes compact. Moreover, since the final decision is made by the majority logic circuit using the decision results of each digital controller, the protection function can be performed even if some of the digital controllers fail.

Furthermore, since the digital controllers are multiplexed, even if one controller fails, the other two controllers can accurately determine an abnormality without any trouble. That is, each digital controller mutually monitors periodic signals from other digital controllers, detects a failure when the signal is interrupted, and operates so as not to use the data of the failed digital controller. Data may be exchanged between each digital controller via a multiplexed serial transmission path, or may be connected via a data bus via an input/output device (PI/O). According to this, even if a failure occurs in one of the data transmission systems, data can be sent and received through other transmission paths. Therefore, according to the present invention, a sufficient protection function can be achieved in the same manner as in the conventional case configured with hardware.

[0013]

[Embodiments] Hereinafter, embodiments of the present invention will be explained with reference to the drawings. FIGS. 1 to 3 show configuration diagrams of a plant protection device according to an embodiment of the present invention. This embodiment is applied to boiler protection in a power generation plant, and is an example in which the entire protection device is triplexed, as shown in FIG. That is, triplexed digital controllers 1A to 1C, multiplexed serial transmission line 2 connecting these, and digital controllers 1A to 1C.
The triplicated status detector groups 3A to 3C, each of which inputs the same detection data of the plant status, and the plant stop judgment results output from each digital controller 1A to 1C are input, and finally the plant is stopped. It is comprised of a stop decision logic circuit 4 that determines. Each of the digital controllers 1A to 1C includes a central processing unit CPU, a process input/output device PI/O, and power supplies PS1 and PS2. The CPU includes a digital microprocessor and a memory, and a plurality of abnormality detection means for detecting an abnormality for each protection factor of the plant according to a preprogrammed procedure based on the plant status input from the PI/O; Based on the judgment results of each abnormality detection means and the judgment results of the corresponding abnormality detection means of other digital controllers, it is determined whether or not to stop the plant for each of the protection factors according to preset majority logic, and a plant stoppage command is output. and a stop judgment means. The PI/O performs input/output processing of input data and output data necessary for the digital controller to perform predetermined calculations. Power supply device PS1,
2 supplies operating power for the CPU and PI/O;
Each MFT (Mas
(ter Fuel Trip) connected to power supplies 5A and 5B. The serial transmission path 2 transmits calculation results such as abnormality determination between the digital controllers 1A to 1C.

FIG. 2 shows a functional block diagram of the digital controller 1A. In addition, digital controller 1A,
Since 1B and 1C have the same configuration, 1A will be mainly explained here. Detected values of the plant state necessary for determining abnormalities in the plant are input from the state detector group 3A to the digital controller 1A via the PI/O. In the illustrated example, an air flow rate detector 3A-1, a fuel flow rate detector 3A-2,
..., feed water flow rate detector 3A-n, feed water temperature detector 3A
The plant status is input from -m respectively. In addition, n
The state detectors 3A-1 to 3A-n are multiplexed to correspond to each digital controller. Feed water temperature detector 3A-
m is provided in common.

The functions of the digital controller 1A are broadly divided into k abnormality detection means 10-1 to k and k stop judgment means 20-1 to k, which are connected to the CP
Realized by U. The abnormality detection means 10-1 is means for detecting a low air-fuel ratio among protective factors. In gas-fired boilers, if the air-fuel ratio becomes low and deviates from the appropriate value, the burner may misfire. If this condition continues, unburned raw gas will fill the boiler, and if air is subsequently supplied, the burner may misfire. The raw gas may ignite or explode, damaging the boiler. Therefore, the abnormality detection means 10-1
Taking in the air flow rate and fuel flow rate supplied to the boiler,
A dividing means 11 divides the air flow rate by the fuel flow rate to obtain the air-fuel ratio. The signal monitor 12 compares the obtained air-fuel ratio with a preset protection judgment value, and outputs an abnormality detection signal 101A that becomes "1" when the air-fuel ratio decreases. This abnormality detection signal 101A is sent to the stop judgment means 20-1 via the timer means 13 on the condition that it continues for a certain period of time. The stop judgment means 20-1 realizes 2 out of 3 majority logic by a program, and uses its own abnormality detection signal 101A and other digital controller 1B.
, 1C, abnormality detection signals 101B, 101C transferred from
When at least two of the above are "1", the plant stop command 201 is set to "1". Further, the abnormality detection means 10-k
is for detecting a low feed water flow rate as a protection factor, and the feed water flow rate taken in from the feed water flow rate detector 3A-n is taken in from the feed water temperature detector 3A-m in the multiplication means 14 and the function generation means 15. The water supply temperature is converted into a weight standard, and when this value falls below the protection judgment value, the signal monitor 16 outputs an abnormality detection signal of 10 kA via the timer means 17. This timer means 17 is the timer means 1
It has the same function as 3. The abnormality detection signal 10kA is judged by a majority decision in the stop judgment means 20-k as an abnormality detection signal related to the same protection factor transferred from the other digital controllers 1B and 1C in the same manner as described above, and if there are many abnormalities, the plant is stopped. Set command 20k to "1". Next, the logical sum of the outputs of the stop judgment means 20-1 to 20-k is determined by the OR means 30, that is, when any one of the plant stop commands is "1", the plant stop command 31A is output from the digital controller 1A. Ru. This command 31A is input to the drive circuit of the electromagnetic relay RA of the stop decision logic circuit 4.

The stop decision logic circuit 4 has a configuration shown in FIG. In the figure, an electromagnetic relay MFT (Maste
r Fuel Trip) is a fuel stop command (trip command) that is the final plant stop command to the boiler.
The MFT power supply (
100v) Driven by P,N. In that drive circuit,
A 2 out of 3 logic circuit 41 is inserted in which the contact signals of the electromagnetic relays RA, RB, RC driven by the plant stop commands 31A, 31B, 31C outputted from the digital controllers 1A to 1C are assembled according to majority logic. There is. As a result, plant stop commands 31A-
When C is output, the electromagnetic relay MFT is driven, and a trip command (not shown) is output to the fuel cutoff valve of the boiler, etc., thereby stopping the plant.

As described above, according to this embodiment, for any protection factor (trip factor), the digital controller 1 including the status detector 3 and the abnormality detection means 10 is triplexed. Even if one system fails, there will be no misjudgment, the plant can be safely stopped, and the reliability of the protection device can be sufficiently ensured.

Furthermore, the abnormality determining means 10 and the stop determining means 2
0 is formed by a digital controller, so compared to conventional hardware configurations, changes in protection conditions such as protection judgment values can be handled flexibly and precisely by changing data in programs or memory. It is possible to apply advanced calculation processing.

Furthermore, since the plant stop judgment results 31A to 31C of the digital controllers 1A to 1C are aggregated into one point each, the hardware configuration of the stop decision logic circuit 4 that ultimately determines the plant stop is It is extremely simple, requires less hardware, and is more compact. Incidentally, in the past, the function corresponding to the abnormality judgment means described above was configured using an analog computing unit, wired logic, etc., and the output signal of these abnormality judgment circuits was used to generate a trip command using a logic circuit formed from an electromagnetic relay and wired logic. That's what I did. Therefore, even if only the abnormality judgment circuit is configured by a digital controller, wired logic circuits such as electromagnetic relays will become complicated and enormous in order to consolidate the outputs of each abnormality judgment circuit into one. In addition, in the above embodiment, the abnormality detection means 1
Although we have briefly explained the processing of detected plant status values at This includes processing such as converting into a signal, converting a differential pressure signal of a flow rate detection orifice into a flow rate, and performing various correction processes based on temperature, pressure, etc.

[0020]

[Effects of the Invention] As explained above, according to the present invention,
For each protection factor (trip factor), the status detector and digital controller are multiplexed, so even if less than half of the systems fail, there is no misjudgment and the plant can be safely stopped. I can do it,
Sufficient reliability of the protection device can be ensured.

In addition, since the abnormality judgment means and the stop judgment means concerning the protection factors are formed by a digital controller, compared to the conventional structure which is configured by hardware, it is possible to change the protection conditions such as the protection judgment value by using the program or memory. By changing data such as, it is possible to respond flexibly and precisely, and also to apply advanced calculation processing.

Furthermore, since the plant shutdown judgment results of each digital controller are aggregated into one point each, the hardware configuration of the majority logic shutdown decision logic circuit that ultimately determines the plant shutdown can be extremely simplified. It is possible to realize a compact plant protection device with reduced hardware.

[Brief explanation of the drawing]

FIG. 1 is an overall configuration diagram of a plant protection device according to an embodiment of the present invention.

FIG. 2 is a functional block diagram of the digital controller of the embodiment in FIG. 1;

FIG. 3 is a wiring diagram of the stop decision logic circuit of the embodiment in FIG. 1;

[Explanation of symbols]

1 (A to C) Digital controller 2 Serial transmission line 3 (A to C) Status detector 4 Stop decision logic circuit 5 (A to B) MFT power supply 10 Abnormality detection means 20 Stop judgment means 41 2 out of 3 logic circuit RA ,RB,
RC electromagnetic relay, contact signal MFT electromagnetic relay

Claims (3)

[Claims] Claim 1: Inputting various plant states from a plurality of state detectors that detect plant states, and determining whether or not there is an abnormality in the plant based on the input plant states,
Based on this judgment result, digital controllers that output plant stop commands are multiplexed, and the plant stop commands output from each of the multiplexed digital controllers are input, and the final decision on whether or not to stop the plant is made based on majority logic. Each of the multiplexed digital controllers is provided with a decision logic circuit, and each of the multiplexed digital controllers includes a plurality of abnormality detection means that respectively determine abnormalities in the plant for each protection factor according to a preset program, and a judgment result of each of the abnormality detection means. and a stop judgment means for determining whether to stop the plant for each of the protection factors according to a preset majority logic based on the judgment result of the corresponding abnormality detection means of the other digital controller, and outputting a plant stop command. A plant protection device. 2. The plant protection device according to claim 1, wherein the stop decision logic circuit is constructed using an electromagnetic relay. [Claim 3] Various boiler conditions including the air flow rate and fuel flow rate supplied to the boiler of the thermal power plant are input, and based on the input boiler conditions, it is determined whether or not there is an abnormality in the boiler, and based on this determination result. A stop decision logic circuit is provided which inputs the fuel stop commands output from each of the multiplexed digital controllers and makes a final decision on whether or not to stop the fuel based on majority logic. Each of the multiplexed digital controllers calculates an air-fuel ratio from the air flow rate and fuel flow rate according to a preset program, and when the calculated air-fuel ratio is lower than a preset protection judgment value. A plurality of abnormality detection means that determine whether there is an abnormality in the boiler or the abnormality of the plant for each predetermined protection factor based on the status of other boilers, and the judgment results of the respective abnormality detection means and other digital controllers. and a stop determination means for determining whether or not to stop the boiler for each of the protection factors according to a preset majority logic based on the determination result of the corresponding abnormality detection means, and outputting one aggregated fuel stop command. A plant protection device.