KR100191566B1 - Indicator validation method in control complex of nuclear power plant - Google Patents

Abstract

The present invention provides distributed monitor monitoring and control capabilities to the nuclear indicator compliance system 72 that responds quickly to changes in plant parameters and distributed indicators and panels 14-22, 26, 28 of the control room 10. An advanced control room complex for a nuclear power plant that includes a component control system 64. The separate data processing system 70 does not require nuclear compliance, and provides comprehensive and objective information to the control room and each panel through the CRT and the large integrated status overview board 24 at the top. The distributed indicator and alarm system 72 and the data processing system 70 accept input from a common plant sensor, confirm the output of the sensor, and make the parameter indications available to the operator during normal or accident conditions, thereby allowing the operator. There is no need to assimilate data from each of these sensors individually. The integrated processing state board 24 is the apex of the information layer extending through four levels, providing access to the front display layer in each panel. The control room panel is preferably modular, allowing installation and general testing of the device in parallel with the assembly of the panel, allowing for the definition of inputs and outputs, human-machine interface and plant specific algorithms.

Description

[Name of invention]

How to Validate Indicators in a Nuclear Power Plant Control Complex

[Brief Description of Drawings]

1 is an illustration of a nuclear control room complex in accordance with the present invention.

FIG. 2 (a) is a schematic diagram of communication between systems, and FIG. 2 (b) is an abbreviation explanation.

3 (a) and 3 (b) are first type diagrams of modules and panels according to one of the features of the invention, and FIGS. 3 (c) and 3 (d) are second type diagrams.

4 is a main system display page directory useful for CRT screens in accordance with the present invention.

5 and 6 illustrate exemplary component signal and shape coding for use in CRT and IPSO display devices in accordance with the present invention.

7 is a typical distributed indicator display in trend format for pressurizer pressure and level in accordance with the present invention.

FIG. 8 is an indicator display for the system pressure and level menu pages associated with the indicator of FIG.

9 is a schematic diagram of an alarm indication according to the invention.

10 is a typical display page diagram showing an alarm display in a first level display page menu selection in accordance with the present invention.

FIG. 11 is a schematic diagram of a weak station of the first level display page set category of the complex shown in FIG.

12 is an exemplary diagram of a typical display page directory showing a display page containing alert information.

13 is an exemplary diagram of the type of information provided to the CRT with alert support after recognizing the alert.

14 is an illustration of a categorized alert list useful to an operator in a CRT.

15 is a typical alarm tile group diagram for a reactor coolant system / closed alarm tile associated with a distributed indication and alarm system.

16 is an illustration of an alarm tile display for a reactor coolant pump with one tile activated.

FIG. 17 is an exemplary diagram of an alarm indication after recognition of the activated alarm of FIG.

FIG. 18 is an explanatory diagram of an alarm display usable in response to an operator's touch on an alarm state area of the indication shown in FIG. 17; FIG.

19 is an exemplary diagram of a CRT display for a main system.

FIG. 20 is an exemplary diagram of a CRT display for a second level page based on the first level page shown in FIG.

FIG. 21 is an exemplary diagram of a third level display page obtained from the second level page shown in FIG.

Fig. 22 is an illustration and illustration of a display page menu selection area in a CRT display.

FIG. 23 illustrates an exemplary CRT display page showing an alert tile display.

FIG. 24 is a diagram illustrating association of a CRT display page hierarchy. FIG.

25 is an exemplary diagram showing an outline of a comprehensive processing state.

FIG. 26 is an explanatory diagram of symbols used to convey trending information in the overall processing status overview. FIG.

27 is a schematic diagram of a general information display useful in the present invention.

FIG. 28 is a block diagram related to FIG. 2 showing the relationship of the main system constituting the control room complex of the present invention. FIG.

FIG. 29 is a block diagram illustrating inputs and outputs associated with distributed indicator and alarm system portions of the present invention. FIG.

30 is a schematic diagram of the use of effective sensor data for monitoring and control in accordance with the present invention.

31 is a functional diagram of an engineering safety installation system and a component control system with a corresponding interface selectively adjusted in accordance with the present invention.

Figure 32 illustrates an exemplary display page directory corresponding to threshold function monitoring possible through the data processing system of the present invention.

FIG. 33 is an illustration of a first level threshold function display page corresponding to the hierarchy shown in FIG.

34 is an illustration of a first level threshold function display page after a reactor trip.

35 illustrates an exemplary second level threshold function display page corresponding to an inventory control system.

Figures 36 (a) and 36 (b) are diagrams of typical prior art manipulation and control design processing, respectively, and useful acceleration design processing diagrams resulting from the use of the modular panel according to the present invention.

Detailed description of the invention

[Background of invention]

The present invention relates to apparatus and methods for monitoring and controlling the operation of commercial nuclear power plants. Commercial nuclear power plants typically have a central control room with facilities for operators to collect, detect, read, compare, copy, calculate, edit, analyze, verify, control and / or verify a lot of information from various indicators and alarms. Typically, the main operating systems are installed in the control room and operate somewhat independently. These systems can be monitored to monitor components and processes within the plant, control to deliberately change or adjust components and processes, and protect against plant risks and take immediate corrective action. It includes. The result of this conventional control room layout and functionality can sometimes give the operator excessive information or excessive stimulation. That is, the amount of aggregated information, variety of equipment, and complexity that are useful for the operator's judgments to take action can cause mistakes beyond the operator's perception. The most famous example of an operator's well-recognized and misbehaving action based on a vast amount of information stimulation in a control room was an accident that occurred in 1978 during an exceptionally unexpected and unexpected transition period at Drimile Island Nuclear Power Plant. Since that event, the industry has paid great attention to increasing plant operability by improving the control room operator's work. The main aspect of the improvement process is the application of ergonomic design principles. Advances in computer technology since 1978 have allowed nuclear engineers and control room designers to display more information in more ways, but this can be counterproductive due to information overload. Improving user convenience while leaving the quantity and type of information at the disposal of operators has been a difficult engineering challenge.

[Summary of invention]

It is an object of the present invention to provide an apparatus for control and monitoring of a nuclear power plant with features such as concise information processing and display, reliable structures and hardware, and easily maintainable components while eliminating excessive information from the operator; and To provide a way. The above object is achieved with higher reliability, easier operation and better cost effectiveness of the control room complex. The solution to the problem is obtained by the many features provided by the present invention, both novel and individual in combination with the control complex.

The complex includes six main systems:

(1) control central panel, (2) data processing system (DPS), (3) distributed indication and alarm system (DIAS), (4) engineering safety equipment functional component control (ESFC) and processing component control (PCC) Component control system, (5) power plant protection system (PPS) and (6) power control system (PCS).

The six systems collect information from the plant, giving the operator the necessary information efficiently, performing all functions automatically and directly controlling plant components.

The control complex according to the present invention provides a top-down integrated information display and alarm access indicating direct evaluation of high levels of critical power plant safety and power generation functions; Guide the operator about the location of the information to further diagnose the high level assessment; Significantly reduce the number of display devices associated with conventional nuclear control complexes. The complex also significantly reduces the amount of data that an operator must process at some point; Greatly reduce the operational impact of failure of the display facility and provide a fixed location for critical information; Eliminates the display system used only when the plant is abnormal.

It is known that the nuclear steam supply system can be kept safe and stable by maintaining only limited facilities for critical safety functions.

The present invention extends the concept of a critical plant safety function to include a critical plant power production function, ie essentially combines two functions so that the information presented to the operator is stable. In addition, it maintains the high level of critical plant functions needed for power generation. The information display layer according to the present invention comprises a large version of an integrated processing status overview screen (IPSO) provided at one dedicated location at the apex for rapid evaluation of critical information representing critical power plant power generation and stability functions. More details on the data and trends of normal or abnormal parameters are obtained by DIAS. IPSO and DIAS provide direct access to additional system and component status information contained in the CRT presentation page layer driven by the DPS.

The IPSO continues to spatially display dedicated information indicating the critical stability of the plant and the status of the power generation functions. This information is provided using a small number of codes that can be easily understood for highly processed data. This frees the operator from the large amount of correlated loads of individual parameters, system or component states, and alarms to verify the functional status of the plant. IPSO provides operators with high level effects with low level components.

The IPSO mainly conveys important information by the direction of the parameter tendency, ie higher, lower, alarm symbol color and shape. This is reinforced by the value for the selected parameter. The IPSO provides the operator with a simplified amount of aggregated information in a relatively small amount that is easily recognized and understood.

Moreover, IPSO compensates for the inherent shortcomings of recent industry trends in providing all the information systematically to the CRT by allowing operators to get an overview or feel of plant status.

Dedicated Marking The display of the plant-level overview in a large format presents two additional operational concerns. First, operator tasks require detailed diagnosis in very limited processing areas. At the same time, however, it is also necessary to be perceivable at plant level. By allowing multiple operators in the control room to monitor IPSOs from anywhere in the control room rather than monitoring each instrument on a spatially separated panel, it gives the operator constant instructions for the entire plant business, regardless of the specific tasks that need attention. It becomes possible.

In a preferred embodiment, the IPSO will support power and stability thresholds by providing critical processing parameters indicative of each functional state. For each function the main continuous pad is selected according to the indicated continuous path condition. IPSO is concerned with the physical function of a power plant. Critical functions are applied to power production, normal post trip behavior, and proper function recovery processes.

The second level of the display information layer according to the invention is the power plant alarm display obtained with DIAS. There is a limited number of fixed distributed tiles, which are used with three levels of alarm priority. The dynamic alarm process uses operators' information on plant status (e.g. reactor power, reactor trips, refueling, outages, etc.) and information on system and component status to eliminate unnecessary and redundant alarms. Contribute to preventing overcharge. The alarm system directs information to distributed indicators, CRTs, regulators, etc. to provide additional levels that are easily understood. Alarms are based on confirmed data, so they inform you of actual plant processing problems, not machine and control system failures. Alarm features include providing the operator with the ability to recognize alarm individual messages through the window and group the alarm contents. The tile dynamically displays different priorities for the operator. The recognition sequence provides instantaneous sound, subsequent alarms, and memory sound to ensure that the alarms are not forgotten, reducing the burden on the operator while ensuring that all alarms are recognized at the same time. The operator may momentarily stop the alarm flash to avoid visual overload or resume the flash to make the alarm well recognized. Distributed indicators provide a third level in the present invention layer in DIAS. Flat panel display devices compress many signal data into a reading set of critical power plant data that is frequently monitored.

Signal confirmation and automatic selection of the sensor with the most accurate signal range are used to reduce the number of control panel indicators. The information readout is touch-screened to enhance operator interaction and includes numerical parameter values, analog display bars and point trends. Many different ranges of indicators are available on one display device with automatic response selection and range display. Automatic calculation of valid processing display parameter values while reading each sensor on the same display device eliminates the need for a secondary display device or display device for normal operation in case of an accident or after an accident. Moreover, another desirable feature of the present invention is that the parameter verification process automatically distinguishes between failed sensors while giving the operator information that will continue to operate and minimize accidents even when the CRT display is unavailable. Furthermore, normal display information may be correlated to a suitable sensor, for example a sensor that is used for the purpose of monitoring after an accident. At the information display level related to the control of a particular component, dynamic soft controllers are provided with component state and control signal information necessary for the operator to control the components. For ESFC systems this information includes status lights, switch controllers, modulation controllers, open-close controllers, and logic controllers. For PCCS, the information includes confirmation load, target value, operating range, processing value and control signal output. At the fourth level of the information layer, the dynamic CRT display page is complementary to all levels of spatial dedicated control and information and can be accessed from any CRT location in the control room, the technical assistant center, or the emergency operations facility. These indications are grouped into three level hierarchies including general monitoring (level 1), power plant components and system control (level 2), and component / process diagnostics (level 3). The display means duplicates all distributed alarm or indicator processing that is driven by the DPS and performed in the DIAS.

More preferred means of the present invention group the indicator, alarm and controller functions into one modular panel for a given main functional system of the power plant. Panels can be made with switchgears that are spatially dedicated to each of the indicators, alarms, controllers and CRTs, independent of the main plant functional system. This enables the transfer of equipment prior to finalization of specific plant logic, algorithms, and preliminary testing of facilities and panels, allowing for later software modifications in the plant construction plan. This modularization is achieved because the space required for the panels is independent of the main plant functional system, which is dedicated to the plant. Alarms and indicators can be easily modulated in software. The number of instrument or alarm tiles that can be displayed to the operator is not limited significantly by the usable area of the panel, allowing standardization of panel size and breaker matches for display windows.

I. Overview of Control Complex 10

II. Panel Overview 12

A. Alarms and Messages 12

B. Indicators 13

C. CRT 13

D. Controller 14

E. Display Format 15

F. General Display 18

III. DIAS 20

A. Dispersion Indicator 20

B. Summary of Validation Algorithms 24

C. Alarm Processing and Display 28

1.Mode and Equipment Dependencies 30

2. Grouping Subfunctions 31

3. Shape and Color Coding 32

4. Alarms on the CRT 33

5. Determination of Alarm Status 35

6. Is it an alarm?

IV .Data Processing System

A. CRT Display 42

B. IPSO 47

V. Overall Control Room 56

VI. Panel Modularity 60

[Description of Preferred Embodiment]

I. Overview of the Control Complex

1 shows a removal chamber complex according to a preferred embodiment of the present invention. The central part of the main control chamber 10 is a master control unit 12 that allows one person to operate the nuclear steam supply system in a preliminary to electric power state. The facilities and methods of the control room described herein may be advantageously used for light water reactors, heavy water reactors, hot gas cooling reactors, light metal reactors, and advanced passive light water reactors, but this will be described on the assumption that the power plant has a pressurized water NSSS. For this NSSS, the master control station 12 typically has five panels: a reactor coolant system (RCS) 14, a chemical volume and control system (CVCS) 16, reactor core 18, Feedwater and Condenser System (FWCS) 20, and turbine system 22. As will be described in more detail below, the control and monitoring of each of these five power plant systems takes place in each panel of the master control station. Immediately behind the core monitoring and control panel 18 is a large screen plate 24 displaying the overall processing status overview (IPSO). In this way, the operator can sit or stand in the center of the master control panel and easily see the five panels and the IPSO behind them. On the left side of the master control station is a safety related control station 26, which typically includes modules related to safety monitoring, engineering safety features, cooling water, and similar functions. On the right side of the master control station is an auxiliary system control station 28 that includes modules related to secondary cycles, auxiliary power and diesel generators, switch yards, and heating and circulation systems. The power plant computer 30 and the mass data storage device 32, which are linked to the control room, are kept in isolation for fire protection and sabotage protection. The control room complex 10 includes a mobile supervisor's office (34), a bird's eye view room outside the control area, a technical support center (TSC) 36, and office work related to power plant operation. It is associated with another office 38. Similarly, desks, tables, and lights 40 are on the floor of the control room for operator convenience. A remote stop 42 (Figure 2) is also available here for post-accident monitoring purposes (PAM). 2 is a schematic diagram of power plant components that are conventionally considered for this purpose between the sensors and various panels of the main control room. It is evident in FIG. 2 that the information flows in two directions through line 46 representing the nuclear steam supply system and turbo power system boundaries. NSSS status and sensor information 48 used in power plant protection system 50 and PAMS 58 pass directly through NSSS boundary 46. Control signals 52 from the power control system pass directly through the NSSS boundary. The engineering safety equipment functional component control system 56 and the normal processing component control system 64 are interfaced through the NSSS boundary via a remote multiplexer. The protection system, the ESF component control system, the processing component control system, the power control system and the PAMs are respectively located in the main control room 10, with each other, the data processing system (DPS) 70 and the distributed indicator and alarm system (DIAS). (72). 2 illustrates one important aspect of the present invention, which greatly simplifies the operator's work in determining the appropriate direction of action by combining monitoring control and protection information in normal and accident conditions. How this is done will be explained below.

II. Panel overview

3 (a) and 3 (b) are schematic diagrams of, for example, a reactor coolant system panel that sits and / or stands on the master control station 12 in accordance with one example embodying the present invention. 3 (c) and 3 (d) are examples of another embodiment for standing only. In fact, the flat top or wall 74 of the panel is vertical and the flat bottom or desk portion 76 is actually horizontal, at the top the interface of monitoring and alarming and at the bottom the control interface.

A. Alarms and Messages

The alert function (see FIGS. 9, 15- 18) includes an alert and information interface (AM) 78 having various tiles 80 each having a special two letter word or associated signal associated therewith. The alarm condition is indicated by the illumination of the tile and the accompanying audible signaling.

The operator must press the tile or other interface provided for that purpose to acknowledge the alarm. The number of tiles associated with a special panel depends on the number of different alarm states that can occur depending on the system being monitored, eg the reactor coolant system. Typically hundreds of these tiles are associated with each panel. Alarms are prioritized into three alarm classes (Priority 1, Priority 2, and Priority 3, Very Immediate Response, Immediate Response and Attention Perception). This RCS panel alarm is in facility state and independent mode (normal RCS, heating / cooling shutdown / fuel replenishment and post trip). If a high priority alarm is activated simultaneously with a low priority alarm in the same parameter, the low priority alarm is automatically released. As the condition improves, the high-priority alarm will blink and sound a recovery tone. The operator will know that the high priority alarm has been cleared. If a low priority alarm still exists, the alarm or indicator will light after the operator knows that the high priority alarm has been cleared.

B. Indicator

The second monitoring interface is a process variable indicator such as reactor coolant hot leg temperature and cold leg temperature, pressurizer level and pressure, and the like. Distributed indicators (see FIGS. 7 and 8) provide an improved method of representing RCS panel parameters. RCS panel parameters require continuous validation and trending on the master control station. Category 1 parameters such as pressurizer levels and RCS cold inlet temperatures and plant processes fall into this category. Other RCS panel parameters are used less often. The distributed indicators provide instructions for the parameters required for operation when the data processing system (CRT information display device) is unavailable. They are operators of regulatory requirements 1.97 Category 1 and Category 2 variables, parameters associated with Priority 1 or Priority 2 alarms, other parameters required for operation due to inaccessibility of the local gauges, and operators when the data processing system is unavailable for 24 hours. It contains the parameters that must be seen to monitor. These less frequently seen parameters are available in indicators distributed to the operator selectable menus. The menu shows an alphanumeric listing of useful data points. Finally, the parameters displayed on the processing controller do not need to be used for distributed indicators.

C. CRT

In addition, the CRT display 84 produces images of major pipes, pipes, pumps, valves, etc. related to the reactor coolant system, for example, and other displays 78, 82 (FIGS. 4-6, FIG. 10, 12-14 and 19-23) indicate parameter values or alarms that appear in bars, graphs, trend lines or other forms. In this CRT, the operator has access to all NSSS information. The information is presented in hierarchies of three levels that match the operator's system imaging. 4 shows an NSSS main page directory 84 containing all CRT pages related to the functionality of the RCS panel.

D. Controller

Distributed switch 86 on the control portion 76 of the panel 14 is on the left side (see FIG. 3). Each switch pattern has a special reactor cooling pump, conventional dial, etc., in which operating parameters are immediately displayed thereon. (Not shown) or analog control interface, which may be in the form of a touch screen. The process controller is provided to the RCS panel to provide the operator with the ability to automatically or manually control the process control loop. The process controller enables control of throttling or variable position devices (eg electro-air valves) in a single control panel device. The processing controller is used for the closed loop control of the following RCS panel processing variables. Pressure level, pressurizer pressure, RCP sealed injection flow, and RCP sealed injection temperature and processing controllers are designed for specific control loops using a series of indicators and control features. In conventional control rooms, each process control loop has its own control, usually called a manual / automatic station. For example, the RCP sealed injection subsystem has five process control loops, a sealed injection flow control loop for each of the four RCPs, and a sealed injection temperature control loop for the entire sub-system. These five control loops each have their own manual / automatic stations, which occupy a large area of the control panel and bother cross loop comparison. Although these five processing loops are each controlled independently, the processing change of one controlled parameter affects the other four processing parameters. Conventional manual / automatic stations make it difficult for the operator to simultaneously interact with five manual / automatic stations. For similar processing (related by function or system), the RCS panel processing controller operates from a single control station called the processing controller. This single control station frees up panel space, enables convenient cross-channel inspection, and facilitates control loop interaction for multiple related controls.

Component control features (ie, operation of switch controllers) provide the primary way for operators to operate equipment and systems in an RCS panel. The RCS panel has 43 components controlled by a momentary type switch. Each switch includes a red status indicator indicating active or open and a green status indicator indicating inactive or closed. Blue status indicators / switches are used to select or indicate adjustments via auto or process controls. In addition to color coding, the red switch is always positioned above the green switch to highlight color differences. Each switch generates an active control signal when it is weak and no signal when it is released. Each switch is backlit to indicate facility status / location.

E. Display Format

The processing display format uses similar processing standard information facilities and facilities. The fluid system piping markings are from top to bottom, left to right, and where crossover avoidance is possible. Incoming and outgoing flow path connections are located at the boundary. Relevant data is grouped by task and analysis specification for comparison, order of use, function and frequency.

The process display / arrangement is based on the process imaging of the operator to maximize the efficiency of the operator's data collection tasks. The operator's imaging of the system is based on diagrams used with training data and plant design documentation related to the system description. Graphical information is given in the form of display pages to help the operator understand the process quickly.

Geometry information includes bar graphs, flowcharts, trends, and other plots (eg, temperature versus pressure). Bar graphs are mainly used to represent flow, pressure and level. Since the levels correspond to tanks, the bar graphs are located in the spatial direction corresponding to the tank sign. Level bar graphs are oriented vertically. The order bar graph is oriented horizontally when used. Bar graphs also help to compare quantities. Flowcharts are used when they are helpful for the operator's process imaging. Flowcharts help to understand the control system process, such as turbine control system. Operators learning data for processing control systems often encounter flowchart formats, which are easy to understand on the display page. Trends are used in the display page format when it appears that information about parameter changes over time should be given. In addition, the operator can trend any database point in the plant computer database. In some situations, one or more trends are indicated as important for monitoring process comparisons. In other states, such as heating / cooling curves, two parameters can be located on different axes of the graph. When more than one trend curve has the same coordinate axis, the two coordinate axes can be used for parameters with different units. The tick marks can be divided into 1, 2, 5 or 10. Between graduations can also be divided into 1, 2, 5 or 10. Trend information is typically displayed on the display page on a 30 minute scale. The operator can adjust the scale according to his needs. Logarithmic axes using a multiple of 10 are also used. If the full range is less than 10, the midrange marker is placed near the middle of the scale. Different colors are used for the tendency to occupy the same coordinate. When the double curve uses the normal scale, the scale is gray and the curve is coded color. When a dual ordinate scale is used, this is the codeline color corresponding to the curve. The color used for the trend does not include an alarm color or steady state color in order to avoid relevant processing parameters with a normal or alarm condition.

The use of color aids the operator in urgent discrimination between different kinds of information. The benefit of color coding is that more is displayed with fewer colors, so that the coding on the information display (ie IPSO, CRT, alert tile) is limited to seven colors. Moreover, color coded information has another display characteristic, which helps color deficiency observers to identify data and colors.

The following colors are used for the information display to display the next kind of information. The color used was carefully chosen to obtain a satisfactory contrast for the red-green color blind observer.

[Color Display Properties]

Black background color

Green component off / inactive, valve closed and actuated

Red component on / active, valve open and operable

Yellow Alarm Status-Caution-Color Appears

Other applications not covered by gray text, labels, split lines, menu options, piping, inoperative and non-instrumented valves, graph grids, and other coding rules

Light Blue Processing Parameter Values

System response to white operator contact, eg menu selections until a suitable system response occurs

Shape coding is used in information systems to help operators identify component types, operating states, and alarm conditions. Component shape coding is based on symbolic notation studies, including shape coding questionnaires given to nuclear power plant personnel. 5 and 6 show the shapes used to represent the components in the control room. The shape of the blank / filled shape reflects the state of the component. Blank coding indicates that the component is working, where filled coding is used to represent non-working components. Examples of shape coding for pumps and valves are as follows.

Pump empty pump indicates that the pump is operated by operator or automatic control signal. The filling pump indicates that it is released by an operator or an automatic control signal.

Valve empty valves indicate that the valve is fully open and filled valves indicate that the valve is fully closed. Valves that are not fully open or closed have a filled / empty mix, ie left filled / right emptied.

Information coding on the valve is provided with these additional features / indications:

Valve Open and Operable-Red Coded

Valve closed and operable-green coded

Non-Instrument Valve-Green Coding (position is entered operator)

Valve inoperable-gray coding with alarm coding (see section 8)

Instruction breakdown-gray coding with alarm coding and blank / filled shapes

F. Comprehensive Display

Safety-related information is incorporated as part of the control room information during normal operation so that the operator can use safety-related information. This is a better design from a human point of view than in the past because people tend to use the information they are most familiar with in a tense situation.

In many situations, safety-related parameters are only a subset of the parameters that monitor a particular process variable. Operators of currently designed control rooms usually use a narrow range of instructions during process control, and distributed safety-related instructions should be used when monitoring plant safety concerns.

In the present invention, the parameters typically used for monitoring and control are accurate for safety related parameters. If the parameter deviates from the combined safety related information beyond expectations, a validity alert is provided to the operator. In response to the alert condition, the operator reviews the individual channel associated with the parameter on the distributed indicator displaying the diagnostic CRT page or its parameters. At this point, the operator can select the most suitable sensor for display.

The operator can know the information when the validity algorithm checks the data. The resulting composite output of the validity algorithm is used on the high level display page on the CRT display system, including the IPSO, the normal display format of the distributed indicator, and the parameters. Regulatory Requirements 1.97 Category 1 information is also displayed by a separate indication display in a single location on the safety monitoring panel.

Critical functions and continuous path (availability and execution) information (see also 10, 24, 25, 26, 27, 32-35) through the information layer can be accessed through the information layer. Alerts provide guidance on unexpected deviations in terms of critical functionality as well as continuous path inability or execution issues. Priority 1 alerts alert the operator if a path of success that minimizes functional requirements is not working or fails to maintain critical functionality. Low priority alarms alert you when systems / trains and components are unavailable or malfunctioning. IPSO provides the most useful view information for the operator to evaluate critical priority 1 alerts combined with critical functions, continuous paths supporting critical functions in the IPSO critical function matrix. Support information related to this alert condition utilizes the critical function section of the alert tile or CRT display page layer.

The critical function section of the display page hierarchy contains the following information:

Level 1 Display Page-Threshold Functions: This page provides a lot of detail on the Critical Functions Matrix in IPSO. This helps the operator to move the appropriate level 2 threshold function display page.

Second level pages exist for each of the 12 threshold functions.

Each page contains:

Threshold function information included in the first level display page related to the threshold function;

Information related to the execution of continuous paths capable of maintaining continuous path availability and said critical function;

-Current high level information using mock format with critical function / continuous path related information

-Time slope of the most representative critical function parameters

The third level display page in the critical functional layer is a dual display page that exists anywhere in the layer. For example, a safety injection display page under inventory control resides within a major section of the display page hierarchy.

III. Distributed indicator and alarm system

A. Distributed Indicator

Dispersion indicator 82 provides an improved method of representing safety related parameters. Regulatory Requirements 1.97 Key processing parameters, such as category 1, shall be indicated and trended in succession by the control station. This distributed indicator also provides instructions and alarms according to the parameters required for operation when the data processing system (DPS) is unavailable. This includes Requirements 1.97 Category 1.2 and 3 parameters, parameters related to Priority 1 or Priority 2 alarms, and other monitoring related parameters. While DPS is a reliable and large computer system, it may be unavailable for up to 24 hours. Less frequently observed parameters can be used by the operator by selecting a menu on the dispersion indicator.

Each distributed indicator has a capacity indicating the number of parameters associated with the component, system, or process. Distributed indicators represent various display formats according to the operator's information needs.

When monitoring or controlling a process, such as a pressurizer pressure (see FIGS. 7 and 8), it is desirable for the operator to use the process indication in the most accurate range. For this kind of information, as shown in FIGS. 7 and 8, the dispersion indicator 82 shows an analog bar graph of the average of the digital values and sensors in the field 92. Preferred validation techniques are described in the appendix, and the valid status is shown in field 92. This validation data is checked against Post-Accident Monitoring Indication (PAMI) when applied. When consistent with the PAMI, the indicator can be used for post-incident monitoring. This has the advantage of continuing to allow the operator to be very familiar and use the indicators used every day.

If desired, the operator can display the individual channels on a separate indicating digital display by touching the sensor. The use of validated parameters is beneficial to the operator by reducing the irritating overload and workload resulting from the display of multiple sensor channels representing a single parameter.

When the parameter is not validated, the disconnect indicator displays the sensor reading closest to the last validated value. A validity alert is generated for this condition. The dispersion indicator continues to display the value of this sensor until the operator selects another value. The field on the variance indicator changes from an indication of VALID to an indication of FAULT SEL. This indicates that an invalid value was selected by the computer. In this case, the operator looks again at the sensor used for the treatment indication. If the operator selects a sensor (fails to validate the valid signal or causes it to match the PAMI due to inadequate data), the inadequate field 96 will be replaced by the message OPERATOR SELECT, which is displayed in reverse. . When the validation algorithm validates the data and removes all inadequacies, the inadequacy alarm disappears and the algorithm is replaced with a valid calculation signal instead of an inadequacy or operator selection process indication.

The parameters required to monitor the overall performance of the plant process or to respond to priority 1 or 2 alarms are provided on the distributed indicator. The most representative process parameter is the value displayed. Through the menu options, the operator can monitor further processing related parameters. The indicator on the RCS panel has 10 related scatter indicators. This indicator is as follows:

1.RCP 1A

2.RCP 1B

3.RCP 2A

4.RCP 2B

5.RCP SealBleed

6. RCS

7.T _hot

8.T _cold

9. Pressurizer pressure

10. Pressurizer Level

7 shows two separation indicators that may appear on the display 82. Pressure appears on the left side of display 82 and pressure level on the right. This pressure indication is as follows. Digital processing display value (2254 psig) (90) with unit of measure, nature of display (effective) (96), indication of acceptance of post-accident monitoring of display (PAMI) (98), bar with processing value Chart 94, Thirty-Minute Trend 104, Normal Operating Range (NORMAL) 106, Device Range 1500-2500, and Units of Measure (psig) for Bar Chart.

In the upper right corner of the pressure display, there are two buttons, CRT and MENU, and when the selection button black light is pressed, it indicates the selection. When the operator releases, the actual selection is processed.

The CRT 84 button changes the CRT menu on the CRT located on the same panel as the dispersion indicator at which the button is pressed. This CRT selection identifies the CRT page that is very closely related to the parameters on the distributed indicator.

The MENU button selects the dispersion indicator menu (Figure 8). The top selection of the menu page is almost identical to the normal display.

Process indication values (2254 psig) with units of measure, nature of the display (valid), indication of the acceptance of post-incident monitoring of the display (PAMI), CRT and MENU buttons.

The lower part of the menu page contains the selector button 102 for all sensor inputs and the calculation signal of this dispersion indicator. When the selector button 102 is pressed, a light indicating the selection is turned on. When the operator releases his finger, the actual processing of the selection takes place. There are 13 buttons; Four for 0-1600 psig pressures: P-103, P-104, P-105 and P-106, six for 1500-2500 psig pressures: P-01A, P-01B, P-01C, P-0101, P-l00X and P-l00Y, two for O-4000 psig RCS pressures: P-90A and P-l90B and one for calculated signal pressure: CALC (currently selected) When selected, the CALC Press button is the calculated signal (That is, the output of the algorithm). The computational signal of the algorithm can be a valid signal. If the algorithm is defaulted and an individual sensor is selected for the calculated signal, the valid message is replaced with an inappropriate selection message. This inappropriate selection message is displayed in reverse on the separation indicator. This message is displayed on the split indicator when CALC PRESS is selected until the algorithm outputs a valid signal on behalf of the ineligible selection sensor. To change the display, the operator presses a button containing the sensor he wants to see. For example: Pressing button display P-103, the digital display shows the output from the 0-1600 psig range sensor (P-103). Message valid below the digital value is replaced by message P-103. Moreover, PAMI messages are discarded because the P-103 is not a PAMI sensor.

The button ANAL / ALARM OPER SEL selects the signal used for valid display on the DIAS.

Select any sensor displayed on the digital display. This signal selection button gives the operator the option of selecting an operator among the sensors for analog display and alarm handling when the following faults occur:

1. When validation fails and the validity selection sensor is selected for processing indication.

2. The effective output is not correlated with the PAMI sensor.

If the operator wants to select the P-103 for processing indications by mistake, select P-103 for the menu and display and press the ANAL / ALARM OPER SEL button. The message in the field 96 under the digital display is recorded as P-103 OP SEL in reverse. Whenever P-103 is selected for display, the message OP SEL appears in reverse,

The output from P-103 is used for processing display.

After selecting the operator selection sensor for processing display, the operator releases the button labeled ANALOG DISPLAY. This returns the bar chart art 94 of the analog display and the trend display 104 to the inverse display with the message OP SEL. The ANAL / ALARM OPER SEL button is not displayed on the Dispersion Indicator Menu Page when normal. It is automatically displayed when operator selection is available after a fault. The ANAL / ALARM OPER SEL button is removed from the menu page when all faults have been corrected and operator selection is not available. The button ANALOG DISPLAY removes the menu page and replaces the sensor or calculation signal with the bar graph (analog) and trend selected as the processing display (usually a valid calculation signal output).

Another valid processing parameter distribution indicator operates in the same way.

The menu driven distribution indicator includes all level 1 and 2 indications for the functional group of indications.

B. Summary of Validation Algorithms

In order to reduce the operator's work and reduce the overload of the stimulus, a generic validation algorithm is used. This algorithm takes the outputs of all the sensors measuring the same parameters and generates a single output representing the so-called processing mark. The generic effective approach is used to ensure that the operator understands it well. This generic algorithm checks all sensors [(A, B, C and D) (the sensor amount can be specified according to the parameter)] and checks all sensors with deviations from the mean. If the deviation check is satisfied, the average is used as a process indication and output as a valid signal. If a sensor does not satisfy the deviation against average check, the sensor is recalculated with the remaining sensors, except for the sensor with the largest deviation from the average. When all sensors make a mean deviation check satisfactorily for the mean, this mean is used as a valid treatment indication. This valid treatment indication also checks for deviations in the post-incident monitoring system sensor (if present). If this second deviation check is satisfied, the process indication is indicated by the message Valid PAMI (post-incident monitoring indication), which is valid for monitoring the emergency because it matches the value determined by the PAMI sensor. As long as there is a match, this indicator will be used for post-incident monitoring rather than the dedicated PAMI indicator. This has the advantage of using a very familiar indicator that the operator uses for daily work.

The above-mentioned validation algorithm is as follows when looking at the specific process applied to the indicator system for displaying the display value 90 of the plant operating parameters to the operator of the control room of the nuclear power plant (see FIGS. 2 and 30). Power plant protection system 50 responsive to a plurality of processing parameter sensors, each generating one of a first set of respective signals P1, P2, ... Pi, ... n corresponding to detection values of the same processing parameter, said same Power plant control system 56 responsive to a plurality of processing parameter sensors 48, 66, 68 that each generate one of a second set of respective signals C1, C2, ... Ci, ... Cm corresponding to the processing parameter values. 64) and means for transmitting the first and second sets of signals in digital form to the indicator system of the control room, wherein the indicator system receives and processes the first and second sets of signals. And a fourth signal comprising a third set of signals corresponding to the signals generated by each said sensor and at least two signals in said third set of signals and having an indication 90 of the actual value of said parameter. Generation A digital processor means (72) located in a control room and display means for selectively generating a numerical image corresponding to said third set of signals and said fourth signal, and comprising an operator interface coupled to said digital processor means. Is configured to perform the algorithm.

As described, the validation process reduces the time it takes for the operator to perform a task related to critical process related parameters. To ensure information in time, all valid outputs are recalculated at least once every two seconds. Moreover, margins and hardware variability ensure reliability in the computing device.

The following sections describe algorithms and display processing in DIAS and CRT displays.

1. The process indication is always displayed on the DIAS display and / or the CRT page when a single process indication is required for multiple sensor values.

Each plant treatment parameter is measured individually to determine the type and location of the display (DIAS and CRT or CRT only).

2. The treatment indication is always valid except in the following cases:

a. Inappropriate value

b. Operator Selection Value

Both are described next.

3. Process indications are always used for alarm calculation and trending. This may be valid, improper selection or operator selection data, depending on the result of the algorithm calculation described below.

4. Using the menu on the DIAS or CRT, the operator can observe the value (A, B, C, D or calculated output) without changing the processing indication.

5. When the valid algorithm cannot generate valid data, the improper selection value is automatically displayed in the process indication.

Inappropriate readings are output from the sensor closest to the last valid signal when it becomes invalid.

In DIAS (if applicable), this information is labeled as inappropriate.

In the CRT 5 graphics page, this information is treated with an asterisk 1 to indicate suspicious data.

The improper selection mark is automatically returned to the valid mark when the valid algorithm calculates valid data.

6. Operator Selection The sensor is selected for processing indication only when:

a. Inadequacy or

b. PAMI failure

The operator selection process indication will replace the effective inappropriate selection process indication.

In DIAS (if applicable), this information will label the operator selection.

In the CRT 5 this information is treated as an asterisk 1 in the graphic display and labels the operator selection in the database. The operator selection process indication is automatically replaced with the appropriate signal when both nonconformance and PAMI faults are eliminated.

It should be understood that discrete validation is performed using a generic algorithm applicable to other parameters. In this way, the operator understands how verification verification is determined for every parameter and has confirmation. This algorithm always has an output and allows the operator to select a display when it is not available. This distributed indicator facilitates access to all essential information through a functional or organized menu system and allows operators to access less frequently required information. Since backups are aggregated at the secondary level of retrieval, there is no need for a separate backup display. These displays use the format to provide all the necessary instructions, drastically reducing the amount of indicators placed on the panel.

C. Alarm Processing & Display:

Another feature of monitoring associated with each panel is to reduce the number of alarms to minimize information overload on the operator.

Cross channel signal validity is executed prior to the alarm occurrence, and alarm logic and set points can occur in the applicable plant mode.

Alerts are visually displayed according to the operator's response priority. For example, priority 1 commands immediate execution, priority 2 commands quick execution, priority 3 is an alarm, and priority 4 or operator assistance only It is just information that represents the status.

The types of alarm conditions in each category are described below.

[Priority 1]

1.Trigger causing a trip within 10 minutes

2. Condition causing major device damage

3. Personal / Radiation Risk

4. Critical safety feature violation

5. Implement required regulatory requirements immediately

6. First Output Reactor / Turbine Trip

[Priority 2]

1.Trigger causing a trip after 10 minutes

2. Implement regulatory requirements other than priority 1

3. Possible device damage

[Priority 3]

1. Sensor deviation

2. Device

3. Devices / Trouble Delays Not Critical to Operation

Alarms are displayed using technology to quickly correlate the impact an operator has on plant safety or performance alarms. This technique groups the displays in light of the underlying problem rather than the manifestation of a particular alarm condition. Another feature is the spatial concept of an alarm indication allowing pattern recognition. Another is a plant level screen overview display over IPSO boards showing success paths and critical functions affected by priority 1 alerts.

In order to ensure that all alarms are recognized by the operator without heavy work, all alarms can be recognized individually or in small and functionally related groups. All alarms can be recognized at the control panel. Instantaneous automatic alarms for alarm state changes pause without operation. In case of unrecognized case, periodic instant auto player is provided. When the operator wants to recognize it later, he activates the comprehensive alarm stop flash, which is automatically adapted again on time.

In addition to alarms, the operator help, an information notification category, is set up for information that is helpful for operation but does not indicate deviations from abnormal conditions.

States classified as Operator Assistance include: access to interlocks, device state change allowed, and channel bypass state.

Some parameters have one or more alarms for the same parameters (ie seal inlet temperatures Hi Hi and Hi). To limit the response required by the operator, the low priority alarm is automatically cleared without a reset tone or slow flash when the high priority alarm is triggered after the low priority alarm is triggered. Hi Hi alarm will be recognized by the operator; Therefore, the employee does not need to be aware of lower priority alerts. If the high priority alarm is not needed, the reset tone or alarm window will flash slowly.

The operator will know that the high priority alarm has been cleared. If the low priority alarm condition still remains, the alarm tile or indicator will light after the operator recognizes that the high priority alarm has been cleared. If the condition is improved before the operator recognizes and the high and low priority alarms are cleared, the clearing of the high priority alarm means that the low priority status is also cleared.

1. Mode and equipment dependence

Important specifics of the alarm system are mode dependence and device state dependency logic. This feature greatly reduces the number of alarms received during critical events and limits the number of alarms to those that indicate deviations from normal plant conditions. Mode and equipment dependent states are implemented through both alarm logic changes and set point changes. Mode dependent alarms reduce the low pressure pressurizer alarm set point to avoid disturbing alarms on the normal reactor ring. Equipment dependent logic is used to trigger a low outflow alarm only when the upflow pump is assumed to operate.

Four modes were selected that correspond to significant changes in alarm logic based on plant status.

1. Normal operation

2. heating / cooling

3. Cooling shutdown / fuel resupply

4. Post-trip

The alarm mode is entered manually by the operator except for the post-trip mode. In reactor trips, the alarm logic automatically changes to post-trip mode without operator action. All equipment dependent alarm characteristics are triggered automatically without operator action.

2. Subfunction grouping

The RCS panel can cause more than 200 alarms. In order to reduce the amount of alarms imposed on the operator and to improve the alarm grasping of the operator, many alarms are formed into the auxiliary function groups 108, 110, 112 (FIG. 15). The auxiliary functional group alarm tile is read in the panel alarm message window (accessing the alarm tile) or in the CRT. In the event that critical processing related parameters are alarmed, there is one alarm message for each alarm tile (ie RCS low pressure). This single alert message allows the operator to quickly recognize the problem handling process.

Each alarm tile can be in one of the following states:

As shown in Figure 16, some alarms are grouped by similar components rather than by processing functions and increased by messages like 116.

As you see in Figure 9,

1. Unrecognized Alerts-If there are unrecognized alerts associated with the alert tile, the alert tile flashes at a high rate (ie 4 times / sec using 50/50 duty cycle). This state takes precedence over all other alarm tiles for group alarms.

2, Alarm Stop / Return to Normal-When the alarm condition is cleared, the corresponding alarm tile will respond slowly (ie, using the 50/50 duty cycle as indicated by the short beam in Figure 9) until this condition is recognized. / Second).

This state takes precedence over the other two group alarms.

3. Alarm—If there is an alarm condition and there are no alarm states 1 and 2 above, the alarm tile will flash (not shown in Figure 9 as no light) and not flash.

4. No alarm-If no alarm condition is associated with the pager tile, the alarm tile will not light (no indication in Figure 9). To indicate that the bulb of the information tile is working, a lamp test characteristic is provided.

3. Shape and Color Coding

The alert information is distinguished by a unique tile color, preferably yellow 118. The parameter / component descriptor or concise message 120 in the tile is shown in blue. Gray coding for tile color 122 is used to indicate recovery to steady state. Shape coding is used to identify alert priorities, i.e. 1, 2 or 3. Use the primary colors to draw maximum attention to the alarm information. The shape code used to identify the alarm priority is shown using representative characteristics.

Alarm priority is shown in shape according to the priority of information for returning to normal state.

For Priority 1 alerts, the alert tiles, faux components, symbols, processing parameters, and menu option fields are reversed using alert color coding (ie, blue characters 120 on a yellow 118 filled square background 124). With the indicated descriptor. Descriptors are marked in blue to provide good contrast for reading. Furthermore, the menu options fields of the alert tile and the CRT use the same display.

For Priority 2 alerts, the alert tile, pseudo parameter, component, menu option, and symbol have a thin (one line) border 126 using a blue alert color code around its descriptor.

For a priority 3 alert, the alert tile, pseudo parameter, component, menu option, and symbol have a bracket 128 around its descriptor. For all alarms, the English descriptor on the message line of the CRT is also displayed in the alarm display format when in an alarm state.

4. Alarm in CRT

Each CRT page in the data processing system provides the operator with an overview of the presence of an unrecognized alarm state and where such an unrecognized alarm condition exists in the power plant. The standard menu with each display page includes all first level display pages as IPSO and menu options (see menu 10 of FIG. 10). This menu option field indicates in the portion of the display page hierarchy that there is an unrecognized alert and provides the alert status / priority using the Alert Highlight feature above. If the alert tile on the DIAS is in an alert state, the first level display page menu option field 132 in the menu 130 shows that the alert state is in the relevant area of the display page hierarchy. The alert tile in the menu 130 is placed in the category of the first level display page set in response to control grouping as shown in FIG. 11 or by a threshold function.

In addition to the alert information shown in the first level display page menu option, the next display page characteristic is also used to indicate the presence of an alert. If the information on the corresponding page is in an alert state, it is illuminated with the alert indication described above in the display page menu option 134 which provides access to the Level 2 and 3 display pages (ie, if there is an unrecognized alert, the display page menu option is the highest). Is highlighted to show priority unrecognized conditions).

By selecting option 136, the operator invokes a level 2 display page directory that includes a screen view of the level 3 display page in a hierarchical format associated with the first level display page (see FIGS. 12 and 15). If the display page information is in an unrecognized alert state, each level 2 and 3 display page provides an alert notification. This alert information is most useful for determining where an alert exists within the region of the display page hierarchy. For example, the operator knows that there is an unacknowledged alarm in the auxiliary system by gray alarm-shaped coding (return to normal) and flashing alarm in the PRI menu selection field. Then, the operator touches the menu selection DIRECTORY then PRI to access the directory / hierarchy to find out which page (s) have alarm information. When the critical display directory appears, the field (s) (RRI level 138) indicating the display page (s) with the FIG. 12 alert state (s) will be highlighted. The desired page with alert information can be accessed by touching the flashing field. The descriptors of the components and the plant data on the processing display page of the CRT (FIG. 13) are coded and flashed to provide alerts and their recognition status. If a parameter associated with a component is in an alarm state, the component's descriptor can provide this alert information. Alarm information is provided even if the parameter of the alarm condition does not appear on the display page. For example, the pump rube oil pressure is indicated by alarm coding of the component symbol. To know the exact information about the alarm, the operator can access the lower level display page or use the alarm system feature described below.

5. Determination of alarm status and whether it is alarm

According to FIG. 16, each category 1 and 2 alarm signal indicator tile in the DIAS may inform the operator of one or more alarm conditions. A message window 114 is installed in the display area 78 on the panel to quickly determine the actual alarm condition. By pressing the unacknowledged alert signal indicator tile 138, an English representation 116 of the particular alert condition appears on the message window 114. The alert tile 138 continues to flash until all alert conditions associated with that alert tile have been confirmed. The English descriptor of the additional alert can be accessed by pressing the alert tile 138 again. The message appears on the message window of the DIAS alarm display 78 and at the same time an alarm message line appears in another field at the bottom of the display page 84 on the CRT panel (see FIG. 13). The alert message contains the following information: time, priority, severity (ie Hi, Hi-Hi), descriptor, set point, and real time processing (coded to show the alert priority and alert status). If there are additional unacknowledged alerts associated with the tile, then the unacknowledged alert number is specified in the right hand side of the message area (see Figure 13). In addition to this alert message, a menu selection / field appears on the display page menu (area 4) to allow direct access to the display page. The display area is shown in FIG. In the DIAS display 78 of a given panel, the alert tile being alerted can be accessed and confirmed on the CRT by way of accessing and confirming the alert via the alert tile.

By adopting an alert tile menu selection followed by an alert display page menu selection, i.e., a first level display page set (area 3), an alert tile in the alert associated with the display page is installed in area 4 of the display page menu. One tile appears, which is a touch target that provides access to another tile. The operator recognizes and reviews the CRT alarm tile by the touch target in the same format as described above, obtains information, and supports the display page touch target.

This method of responding to alert tile alerts is the most useful way to respond to alerts at a workstation away from the operator's position.

All alarm states associated with the DIAS display's signal indicator tile remain buffered. The buffer containing the alarm status is shown in the following form.

Tap the alarm tile to go to the alarm state at the top of the buffer.

Recognizing an unacknowledged alarm transfers this alarm condition to the bottom of the buffer. Recognition of cleared alarms causes them to come out of the buffer. If there is no unknown information or if there is a cleared unknown alarm condition, the already recognized alarm (etc.) (n + 1, n + 2, ...) can be reviewed.

When reviewing these alarms they move to the bottom of the buffer.

Priority 3 alarm alert messages and operator assistance are generated by the computer only and appear only on the message line 132 of the CRT page (Figure 13); There is no English descriptor on the message window of the DIAS display 78. Signal indicators for all priority 3 alarms are installed on each signal indicator workstation, and priority 1 alarm tiles are installed to assist the operators involved in these workstations. If an alarm condition changes its priority, then the alarm handling system also changes. If a high priority alarm comes on the same parameter, the previous alarm is automatically cleared without a reset tone or flashing slowly (i.e. it does not need to be recognized as he needs to check the higher priority status).

When the high priority alert is removed, the operator needs to confirm that the higher priority alert has been removed. However, if a lower priority alarm still exists, it will light (as soon as the operator confirms a higher priority removal) and automatically go to a confirmed state (ie the operator does not need to take any action). When the highest priority alarm is removed, the operator sees a new lower priority alarm condition.

The present invention provides a listing, categorizing alert, and accessing support display page. In the present system an alert is provided on an alert listener display page accessible from the fields 138 of the CRT display 84 and DIAS display 78 shown in FIGS. 15 and 13, respectively. The alarm categories in this listing are as follows (see Figure 14):

A) First level display page set (major power plant system / function grouping)

B) Control Room Workstation

C) alarm tile

Workstation alarm tiles during an alarm are logged first. Alarms associated with the alarm tile are recorded as included in the alarm buffer of the alarm tile.

These alarm categories match the operator's information and provide the alarm data needed to respond to alarm conditions. Accessing alert listing 78 via categorized display page 84 (FIGS. 4 and 12) allows the operator to easily select the data he wants to find within the category. By using an alarm list menu selection (FIG. 4) followed by a display page feature indicating the alarm condition, the operator can look at the particular alarm condition he is interested in. Three practical examples of accessible alarm data in the categorized list on display page 84 (FIG. 4) are as follows.

1) The operator adopts the ELEC 148 (FIG. 12) menu selection followed by the alert list 140 (FIG. 4) menu selection.

This accesses a categorized alarm listing of the type shown in FIG. 14 beginning with an electrical alarm.

2) If the operator wants to look for a special alarm, that is, the alarm related to RCP1A, he adopts the following menu selections in Figs.

-Alarm Tiles (150)

Primary (PRI) (152)

The menu of the display page changes to the display of the alarm tile during the alarm and relative to the first system (see FIG. 14). The operator can then request one of two different information type types associated with the displayed alert tile.

A. Categorized Alarm List-The operator adopts the alarm list followed by a tile or RCP1A menu selection.

The categorized alarm list is accessed with the RCP1A alarm at the top of the page.

B. Alarm Message-The operator can use the alarm tile menu selection in the same way as the control panel alarm tile.

The adoption of an alert tile menu selection provides a display page for alert messages and menus that can provide support information for an alert condition.

Alarm information is also provided on all process display mimic diagrams that have parameters or components in alarm state. As mentioned above, color and shape coatings are used to indicate alarm conditions.

For example, if the pump lube oil pressure is not recorded on the level 2 display page, in the alarm associated with the component, the parameter lights up in the component indicator, causing the alarm to appear in the indicator on the pump. If the operator wants to know the exact alarm condition associated with the component, he can access the appropriate lower level display page. He can also touch the alert tile menu selection and then touch the component's descriptor and use the alert tile representation to respond to the alert. This action gives access to menu selections related to display pages that provide more detail about the component.

According to the present invention, the following alarm recognition method is provided.

1) Alarm indication via the signal indicator tile-The alarm may indicate that the alarm has been acknowledged by pressing the alarm / cognition signal indicator tile or the CRT indicator tile indication.

This changes the signal indicator tile from flashing to stationary when all alarm conditions associated with the tile are acknowledged and silences the audible sound associated with the alarm condition (described below).

Alert messages appear on the message window (when using physical tiles) and on the workstation's CRT message line (see Figure 16).

2) Indication of Alarm Acknowledgment Using Alarm Listing Page—Alarm can indicate acknowledgment on a categorized listing by touching the alarm tile touch target associated with the alarm tile category (see Figure 14).

Touching the display of an alarm tile recognizes all alarms related to the tile.

Such an alarm recognition device may be most useful for recognition of multiple alarms away from the operator position.

These methods of alarm acknowledgment cleanse unidentified alarm indicators in other alarm formats.

If the alarm condition is removed, it must be acknowledged by the operator. Slow flashing of the annunciator and associated process display will recognize this information. You can recognize and reset cleared alarm indicators in a similar way to the recognition of new alarms, by touching alarm tiles or CRT alarm indications / characteristics.

A clear sound / tone is heard in the control room to signal the next alarm information.

1.Unacknowledged Priority 1 or 2 Alarm

2. Alert reminder tone for priority 1 or 2 unconfirmed or removed.

3. Removed priority 1 alarm, or removed priority 2 alarm.

Audible alarms, tone 1 or 3, exist for 1 second and tone 2 repeats once every minute until all new or removed alarms are acknowledged.

In situations where multiple unknown alarms exist, the operator needs to pay attention to the alarm state of the highest priority. In such a situation, the sounds of all the tamper-acknowledged alarms, such as new priority 2, 3, and all cleared alarm conditions, overlap, preventing the operator from hearing the most important alarm conditions. In the control room, STOP FLASH and RESUME buttons are present in the MCC, ACC and ASC. When the STOP FLASH button is pressed, the behavior of the alarm system has the following characteristics.

All new / unrecognized priority 2, 3 and operator assistance features change from fast flashing to slowly brightly lit, ie tile and CRT alarm indications.

-The alarm condition removed, i.e. flashing slowly, does not exist as alarm information.

Any new or cleared alarm condition that appears after the STOP FLASH button is activated is normally presented to the operator (ie flats).

However, the operator can press the alarm STOP FLASH button again to inhibit this condition.

The alarm reminder tone informs the operator of the unacknowledged new and removed alarm conditions present. To know the acknowledgment state, the operator employs a resume button to switch all unrecognized and removed states to their normal indication and alarm states.

After adopting the alarm suppression feature to appear, the alarm suppression button is backlit.

In order to allow the operator to quickly and directly access the support information and quickly respond to the alarm condition, the operator's single action allows the operator to select and select the appropriate CRT display page for alarm recognition, alarm parameter display, and alarm condition.

The present invention provides redundancy and versatility for alarm processing, giving operators confidence in the alarm handling technology and ensuring that plant safety and utility are not affected by equipment failure. Priority 1 and 2 alerts are handled and presented by two independent systems. The two-system margin is not visible to the operator with continuous cross-checking and integrated operator contact area.

Figures 16-18 show schematic diagrams of alarm responses using tiles according to the present invention. The group of tiles described is related to reactor coolant pump seal monitoring in the reactor cooling system panel shown in FIG. Priority 2 Seal / Breed System Trouble alarms flash to alert the operator and the operator can read a more complete complex message in the message window that the control bleed off pressure is high. Such messages are provided for priority 1 and 2 alerts.

The same message in a more complete form is presented on the panel CRT. The CRT confirms a menu selection indicating a useful support display page. In addition, the operator can directly access all alarm listings within a particular group.

As such, an overview of the alarm status is provided on the tile, and details are provided in the relevant messages.

A given alarm may be more important or less important for the point of view depending on the condition of the device and the mode of NESS operation. The amount of information handled by verifying the parametric signal is reduced and automatically removes the lower priority if a higher priority alarm is active in the same state.

IV. Data processing system

A. CRT Display

The CRT 84, seen in the middle of the panel in FIG. 3, is part of a data processing system that processes and displays all power plant operation data. It is therefore connected to all other machines and control systems in the control room.

2, 28, and 30 schematically show the relationship between data processing systems, control systems, power plant protection systems, and distributed indication and alarm systems. The data processing system 70 receives from the control system 64 the same sensor data used by the control system to implement the control logic. It likewise receives from the distributed indication and alert system 72 valid sensor data that the distributed indication and alert system is used to generate distributed alerts and displays. The plant protection system 50 does not internally use valid data for its trip logic and this raw signal passes along a data processing system 70 that performs its signal validation logic on the plant protection system signal for each channel. Internally, it passes through a valid signal and passes through valid signal comparison logic. Within that zone of operation, valid signals from control system 64, power plant protection system 50, and distributed indication and alarm systems are compared and displayed on CRT 84. Valid signals from the comparison logic and valid signals from the plant protection system are used to display on the CRT.

Thus, the CRT display inside each panel includes signal validity and all CRTs in the yard can access information available at other CRTs in the plant. Moreover, alarm tile images from any other tile panel are generated at any given CRT and alerts are acknowledged. The world display indicator window is also accessed. The CRT actually corresponds at nearly two second intervals.

The CRT display page contains all the plant information available to the operator in a structured, hierarchical fashion. CRT pages are very useful for displaying information because the plant process is graphically displayed in a format consistent with the operator's time. Moreover, the CRT form provides trends, categorized data, messages, quick actions and alerts the operator of abnormal processing.

The basic method for an operator to obtain an information form on a CRT is through a touch screen contact area that works in a well known manner. The touch screen is based on infrared irradiation technology. Horizontal and vertical illumination are present in bezels installed around the surface of each color monitor. If the beam is disturbed by the user, it is cross-quoted with the display page database to determine the adopted information.

Message and support display page selection Touch targets can be accessed on the panel CRT by touching other panel features such as distributed indicators and alert tiles. IPSO is useful as a display page and forms a display page hierarchy (see FIGS. 10, 22, and 24). There are three levels under the IPSO, and each level in the hierarchy provides information that matches the information that satisfies the particular operation. The hierarchical structure is based on helping the operator carry out his task and on the easy access to all the information displayed via the CRT. The display mode on the normal level provides information on general monitoring behavior, while the lowest level has useful information to support symptomatic behavior.

Level 1 display pages provide useful information for general monitoring actions related to major plant processes. This display page informs the operator of major system implementations and critical device status and directs them to lower level displays for supportive or symptomatic information. The level 1 display page looks like this:

1) First system (see eg 19)

2) second system

3) power conversion

4) electrical system

5) Auxiliary System

6) Critical function

Level 2 display pages provide the most useful information for controlling plant components and systems. These pages contain all the information needed to control the processing and functions of the system. The parameters that must be observed while controlling the job appear on the same display even if they are part of another system. The operating process or component control instructions presented are used to determine which parameters are displayed. FIG. 20 is a sample display for controlling Reactor Coolant Pumps 1A and 1B. The operator usually monitors the first system display page to access the RCS implementation. If the operator wants to operate or adjust RCP 1A or 1B, he can access the control display page. All information about the reactor coolant pump control is on the control display to end unnecessary jumping between display pages.

The level 3 display page provides information useful for diagnosing the process and the components of the process displayed on the level 2 display page. Level 3 display pages provide useful data such as directed cross-channel comparisons, detailed information about device diagnostics or inoperability of the system, and trending information useful in determining the direction of system transition changes, degradation or enhancement. 21 shows a diagnostic display of the sealing and cooling sections of RCP1A. The pump section, support oil system, and motor section appear on a separate display page due to display page information density limitations.

Display page access is achieved through the use of a menu located on the bottom of the display page. Each display page has a single touch, one standard menu style that provides directions for access to all related display pages within the information hierarchy. The menu has a field (see FIG. 10) in which a display page title is recorded. By adopting the field, the specified display page is accessed. Menu selection fields associated with the display page include the following (see Figure 22).

1) Higher level (if applicable) display page, ie item C, directly within the hierarchy.

This feature is more meaningful on the third level display page since the next higher level page is a level 2 display page which is not normally on the menu.

2) Display pages (h, i) of the system that are connected or supported by the processing of the currently displayed page.

3) All six first level display pages (b, c, d, e, f, g).

4) IPSO display page (a)

5) Last display page (j) shown on the monitor.

In order to access the display page described by the menu selection, the operator adopts the menu selection a-k by touching the desired menu selection field on the monitor. The menu selection glows brightly until the display page appears (black text on white background). Because menu selection allows direct access to the minimum set of display pages in the display page hierarchy, other means are used to quickly access other display pages.

The operator has three choices.

(1) Display page access using alarm tile—This mechanism for display page access is most useful for obtaining display pages related to the processing of a workstation.

By pressing the workstation alarm tile, area 4 of the display page menu of the workstation CRT changes to a new menu with the display page selection associated with the descriptor of the alarm tile. For example, the RCP1A alarm tile provides menu selections related to RCP1A. The desired display page is then a direct access menu selection.

(2) Accessing CRT Information from Distributed Indicators-As shown in FIG. 7, each distributed indicator 82 has a CRT access touch target 158. This button allows access to support information for the processing parameters currently displayed on the distributed indicator.

By touching the CRT target on the distributed indicator, area 4 of the menu selection on the CRT of the workstation is changed to a menu selection including a display page with supporting and diagnostic information related to the processing parameters.

(3) Display Page Access Using Display Page Directory-Any display page in the display page hierarchy can be accessed using the currently displayed menu.

For example, if the operator wants to see the water supply system display page and access the CVCS display page, the following sequence occurs (see Figures 22 and 4):

The operator touches to adopt the DIRECTORY menu selection (selection 1 of 2 regions in FIG. 22), followed by the PRIMARY menu selection (selection b of 3 regions in FIG. 22).

This accesses the first region of the display page hierarchy from the display page library (see Figure 4).

Each display page in the first portion of the display page hierarchy is a touch target on this display page and the operator can select a CVCS display page. Any page in the display page hierarchy can be accessed using this feature.

The DIRECTORY menu selection is followed by the desired hierarchy associated with one of the six first level display pages, i.e. the menu selection b, c, d, e, f or g on FIG.

In addition to the menu selections described above, there are menu selections for the last page, alarm list, alarm tile, other and horizontal paging selection (Keys). The last page (selection j on Figure 22) gives direct access to the last page on the monitor. This is very useful for the operator to compare information between two display pages or for the operator to recover the information already associated.

The alert list (selection n on FIG. 22) provides quick access to the alert listing display page.

The alert tile (selection m on FIG. 22) provides quick access to the alert tile representation of the active alert tile in the region on four areas of the workstation's CRT menu (see FIG. 23). This allows the operator to quickly access alarm information related to a particular tile on a workstation's CRT.

Otherwise (selection k on FIG. 22) allows easy access to information or display pages that do not fall within the category of information described by the currently displayed menu selection.

B. IPSO

Another part of the data processing system is the overall processing status overview (IPSO board Figure 24). Although the number of displays and alarms that excite the operator at one time can be significantly reduced by using the distributed alarms, distributed displays, and CRT displays described above, the number of stimuli is still relatively high, especially during emergency operation. Delay the operator's understanding of status and trends. A single display is needed that gives the operator only the highest level of interest, which should be able to guide the operator with more detailed information as needed. Although attempts have been made to provide large boards or displays to operators in the past, to date, such displays have not sufficiently synthesized information in their nature, as described below.

IPSO boards provide an overview of high-level concerns, including an overview of plant status, critical safety and power functions, symbols representing key systems and processes, and critical plant data and critical information. IPSO information includes trends, deviations, and numerical values of the most representative critical function parameters, and also includes the presence and location of priority 1 alarms, including the availability and performance of the system supporting the critical function. This is also known as success path monitoring. IPSO boards also confirm the presence of other unknown alarms and their location in the plant. Therefore, IPSO bridges the gap between the operator's tendency to system incidents and a more desirable assessment of critical functions. This compensates for the reduction of the dedicated display to help the operator maintain the site power station. It also helps the operator get an overview of plant operating status while involved in detailed diagnostic work. IPSO facilitates understanding among all plant personnel by providing a common mental visualization of plant processes.

The state shown in FIG. 25 is a reactor trip. In the example shown, the temperature rise in the reactor is 27 ° and the average temperature rise is greater than desired so that the rise is indicated by an arrow and a + sign.

The pressurizer pressure is higher than desired, but it is falling. Similarly, the level of water in the steam generator is higher than desired but is decreasing.

Figure 24 shows the CRT display page hierarchy, where the IPSO is on top, and the first level display page set contains general monitor information for the second, electrical, primary and secondary power conversion and critical function systems, respectively. The second level display page relates to system and / or component control, and the third level display page provides information on details and diagnostics.

IPSO is a continuous display that can be found in control room workstations, mobile supervisors' offices and technical support centers. The IPSO is also more centrally located than the master control station. IPSO exists in a display page format that can be accessed from any control room workstation CRT, as well as from remote facilities such as Emergency Operations Facility.

The large IPSO panel format is 4.5 feet high by 6 feet wide. It is located about 40 meters away from the director's office, behind the MCC Weekstation. One of the advantages of IPSO is the use of IPSO information in the event of plant abnormalities, especially those that have a large impact on plant function. IPSO information helps operators respond to plant power generation issues as well as safety issues. The IPSO provides information to quickly assess the critical safety functions of the plant, enabling operators to quickly assess the overall plant process status. The concept of monitoring plant power and safety functions makes it possible to categorize power and safety-related plant processes into an easy set of information during / representing the plant process.

The features are:

There is a 3x4 alert matrix block 160 in the upper right corner of the IPSO, each containing a box 162 for important functions (see CRT display of IPSO in FIGS. 25 and 10). The matrix provides a location for successive indications of critical functional states. If there is a priority 1 alarm condition related to the threshold function, the corresponding matrix box 162 is lit brightly according to the priority 1 alert presentation technique. Threshold alarms are representative of one of the following priority 1 states:

Failure to meet safety status test (post-trip).

-Success paths / system failures that have been used to support critical functions

-Unavailability of an undesired priority 1 control deviation safety system in the power production function (pre-trip) (less than the minimum availability defined in Regulation 1.47).

The 3x4 matrix display is a summary summary of FIG. 32 of the first level threshold function display page information.

The operator obtains detailed information related to the critical function and the success path alert in the critical function area of the display page. Each critical function can be maintained by one or more power plant systems.

Information in the IPSO typically supports systems that maintain critical functions. For some critical functions, all states of the critical function can be evaluated by representatively controlled parameters. For these critical functions, the relationship between the control target value and the processing parameters for indication of trend improvement or degradation is shown on the right side of the parameter scripter in the IPSO.

The arrow head described in FIG. 26 is used to indicate that the parameter falls toward or from the control target value when the integer portion of the parameter value is larger than the acceptable narrow band control value. The up and down arrow heads indicate the direction of processing parameter change. If this parameter is outside the normal control boundary, a plus or minus signal will appear above or below the control target value display. The following basic evidences were used in the selection of parameters or other indications used in IPSO to monitor the overall status of critical functions.

1. Reactivity Control

Reactor power is the only parameter displayed in the IPSO as a means of monitoring responsiveness. Using reactor power, operators can quickly determine if a rod is inserted. Reactor power is also used to determine the general speed and direction of the change in reactivity after shutdown. Reactor power is represented digitally 166 in the IPSO because the distributed values of this parameter are often important to both operators and administrators. The IPSO also alerts the reactor vessel when there is a priority 1 alarm associated with the core operation limit monitoring system.

2, core heat removal

The parameters given to the IPSO to determine if core heat removal is appropriate are representative of the core outlet temperature 168 and the subcooling margin 170. If the core exit temperature is within the range, the operator can be assured that the raw material is maintained without defects. The subcooling margin is used because it gives the operator a temperature limit for bulk boiling. The core exit temperature is expressed in the IPSO using a dynamic representation (ie, a trending form) because there is a clear upper limit that defines the limit for the core exit temperature and the target value for a representative feature can be easily defined. The subcooling margin is also expressed in the IPSO using dynamic representation because there is a lower limit that defines the operating limit for subcooling.

3. RCS heat removal

T _H , T _C S / G level 172, and T _ave 174 are used in IPSO to give the operator the ability to quickly determine the effect of the RCS heat removal function. In order to remove heat from the reactor coolant, the S / G level must be maintained sufficiently to allow the necessary heat transfer from the RCS to the steam plant.

Dynamic expressions are used so that the operator can observe at a glance whether the condition is abnormal or improves.

T _H and T _C are used in IPSO because they are needed by the operator as data to determine how much heat is transferred from the reactor coolant to the secondary system. Since a quick comparison of these parameters is desirable to observe the delta T, the digital values of these parameters are used. Moreover, these actual values are often used and may assist the operator in locations where the distributed indicators indicating T _H and T _C are not readily visible. T _ave is provided to IPSO using dynamic indication to allow the operator to quickly assess whether this controlled parameter is within acceptable operating boundaries.

4. RCS inventory control

A pressurizer level 176 is provided to the IPSO using dynamic indication to allow the operator to quickly access whether the RCS has the right amount of coolant and observe the deviation of the level indicating an improvement or degradation condition.

5. RCS pressure control

The pressurizer pressure 178 and the Sub Cooled Margin are directed to the IPSO to determine the RCS pressure control. The dynamic display allows the operator to notice that the pressure changes to RCS pressure or overpressure. Dynamic notation is used in IPSO to indicate saturation margin. Saturation of the RCS can adversely affect the pressure control capability of the pressurizer. In addition, when the pressure drops, the subcooling margin monitor display of the IPSO shows a decrease from the limit to saturation.

6. Steam / feed conversion

Processes related to steam / feed conversion are quickly evaluated by providing information on the IPSO described below.

(a) Feed water and condensation system status information (eg operating status, alarm status)

(b) Steam generator level, dynamic indication

(c) Steam generator safety valve status

(d) Pressure pump valve status

(e) Main steam isolation valve status

(f) Turbine bypass system status

7. Electric power generation

The process (process) related to electricity generation can be quickly evaluated by providing IPSO with the following information.

(a) Power plant net electrical output, digital value

(b) Alarm information on deviations in critical processing related to main turbines and turbine generators.

(c) Power distribution operation and alarm status for the plant bus and site grid

8. Heat Rejection

Treatments related to heat release are quickly assessed by providing the IPSO with the information described below.

(a) Circulation water system status

(b) alarm information for critical deviations in condenser pressure;

9. Containment Environment Control

The containment pressure and containment temperature are parameters used in the IPSO to monitor containment environment control. They are provided for IPSO using dynamic presentation to allow evaluation of trends and relative values. Containment pressure parameters are used in IPSO to alert operators to hazardous overpressure conditions that may result in the destruction of the reactor cooling system. The containment pressure also helps to indicate the concerned breakdown of the reactor cooling system. This may also indicate combustion in the containment building.

10. Containment Isolation

The containment containment safety function is monitored by the IPSO as a containment containment safety symbol. This symbol is driven by an algorithm that indicates the validity of the containment isolation state, which states that the associated state is when containment isolation is assured.

-Containment isolation activation

Safety injection activated

Main vapor isolation

-Containment Purge Isolation

11. Radiation Control

Radiation symbols are present in the IPSO to indicate (1) the indication of high radioactive levels, such as containment vessels, and (2) the radiation associated with the radioactive release pathways to the main environment. These symbols are provided to the IPSO only when there is a high level of radioactivity. These instructions are provided in alarm colors at the relative positions of the sensors when any of the states described below occur.

High air radiation of containment vessel

High activity associated with any release pathway

Cooling activity

12, Vital Auxiliaries

Essential aids are monitored in the IPSO by providing the information described below.

(a) Diesel generator status

(b) Distribution of power in the plant

(c) Instrument air system condition

(d) Service water system status

(e) Component cooling water system status

The systems indicated in the IPSO are the systems required to support the main heat transfer path systems and the major heat transfer processes related to power and safety. These systems include systems requiring all major success routes to support availability monitoring and plant critical functions in accordance with Regulatory Requirements 1.47. The system described below has a dynamic indication on the IPSO.

CCW-Component Cooling Water

CD-Condensate

CI-Containment Isolation

CS- Containment Spray

CW-Circulating Water

EF-Emergency Feedwater

FW-Feedwater

IA-Instrument Air

SDC-Shutdown Cooling

RCS-Reactor Coolant

SI-Safety Injection

SW-Service Water

IB-Turbine Bypass

The system information provided to the IPSO includes the system operational status, changes in operational status (eg active to inactive or inactive to active) and priority 1 presence of alerts associated with the system.

The alarm information in the system helps inform operators of critical function alarms associated with success paths. Priority 1 alert information is also provided to the IPSO by an alert encoding a descriptor of the display characteristic on the IPSO as described above.

V. Comprehensive Control Room

27 is a schematic diagram that collectively displays information available to the operator in accordance with the present invention. The operator can observe the high priority alarm from the overall processing situation overview or board. If the operator is interested in the trend of the parameters, the engraving source looks at the distributed indicators. If the operator is interested in the system and component status, he or she sees the system control settings. Therefore, the IPSO information is displayed on the board or panel CRT, and the operator can use information from the operator's panel or other panels on the CRT. From the IPSO overview, the operator can scroll through the CRT or DIAS display pages. Moreover, the operator can directly access all of these types of information from any control panel, and when the system control is adjusted or set, the results are aggregated into different alarm and display generators in the other panels. As shown in FIGS. 2 and 28-31, in general overview, the overall synthesis of the system is driven by the data processing system 70, with each panel comprising a main console, a safety console, and an auxiliary console. It means that it includes a CRT (84). The data processing system uses a power plant main computer and, although powerful, is not as reliable as a DIAS computer (which is supplied as a microprocessor or minicomputer base). It is also menu driven and slower because it performs more. It is mainly used to convey the most important information to the operator, so critical alarm tiles are shown on each CRT and recognized on any CRT. Information available in one CRT can be used in all other CRTs. The indication and alarm system 72 for a given panel is related to control, but the alarm and indication display 78, 82 (e.g., quick and accurate) and the control of the panel cannot be used in any other panel.

Basically, information is categorized into three categories. Category 1 information should always be displayed continuously and this is done in DIAS 72. Category 2 information need not be used continuously, but it should be used periodically and this is also done in the DIAS 72. Category 3 information does not need to be provided quickly, it is for information only and provided by the DPS. If the DPS fails, some essential information is provided by DIAS. The DPS and DIAS are connected to the IPSO board by the display generator 180. From the IPSO, the operator can get detailed information by going to the relevant panel or page through the CRT display. DIAS and DPS do not necessarily receive input from the same parameters and the sensors for these parameters are the same as they accept information from common parameters. Moreover, the valid algorithms used for DIAS and DPS are the same. Moreover, the algorithms and variance indicators for distinct alert tiles include comparison of DIAS and DPS valid values as part of the calculation of the indication.

FIG. 29 is a block diagram illustrating distinct indicators and alarm systems associated with other parts of control room signal processing. The DIAS system is preferably partitioned so that, for example, the required distributed indicator and distributed alarm information for a given panel N are processed in only one segment. However, each segment includes a redundant processor. The information processed in DIAS 1 is Category 1 and 2 information that is not normally displayed directly on the IPSO. IPSO normally receives input from DPS. However, when the DPS fails, a certain amount of DIAS information is sent to the IPSO display generator and displayed on the IPSO board.

DIAS and DPS use the sensor outputs from all sensors in the plant to measure a given parameter, but the number of sensors in the plant for a given parameter may vary from parameter to parameter. For example, the pressurizer pressure is obtained from twelve sensors, and the parameters from other parameters, for example the balance of the power plant, are measured by two or three sensors. Some systems, such as plant protection systems, do not employ validation because they have to perform their functions as quickly as possible, for example, employing two of the four operating logics from four independent channels. If the validation for a given parameter differs from that determined in two or four systems, an alert or other queue will be provided to the operator via the CRT.

One of the important features of the present invention is credible because the DPS does not need to be nuclear qualified but also obtains parameter values from the same sensor as the nuclear compatible DIAS. They are valid in the same way and you can compare the valid DPS parameters and the valid DIAS parameters before the DPS information is displayed in CRTs and IPSO.

Nuclear qualification of alarm tiles and windows, and DIAS's distributed indicator display, is required for VTs such as 512 × 256 voltage emitting display panels, power conversion circuits and M3 voltage emitting display modules available from Digital Electronics, Hayyard, California. It is preferably achieved by using a graphical drawing controller or the like with text terminal emulation. The control of each panel is preferably achieved by using a distributed distributed programmable controller type of the MODICON 984 trademark, available from AEG Modicon, North Andover, Massachusetts. Therefore, the computational base of DIAS is a distributed distributed programmable microprocessor or minicomputer, and the computational base of DPS is a dedicated mainframe computer.

The ESF control system and the processing component control system are shown schematically in FIG. 3, wherein the plant protection system is preferably a system for control of nuclear power systems, US Pat. No. 4,330,367, registered May 18, 1982 by Combustion Engineering. And a process based on a core protection calculator as disclosed in " Process. &Quot;

Another feature of the synthesis is the ability to display the critical function and success path of the IPSO as described above.

Since the main safety and power generation signals and status generators are connected to the DIAS and DPS, the operator can page through the threshold function according to the display page hierarchy shown in FIGS. In FIG. 33 the operator finds that emergency injection cannot be used in the reactant cooling system. In FIG. 34 the operator finds that emergency injection cannot be used and that the reactor is in a trip state. Under this condition, the operator must determine an alternative to remove heat from the reactor core by page to the second page of the critical function display page, which is shown for inventory control (FIG. 35) and has a comparable level of detail for heat removal. This type of information with this level of detail and synthesis can be used for all critical functions not only in the event of an accident but under almost all operating conditions.

VI. Panel modularity

As mentioned above, distributed tile and message technology can significantly reduce the panel area needed to perform a particular monitor function. Similarly, the distributed display portion of the monitor function, including hierarchical pages, is reduced compared to conventional nuclear control room systems. The control functions on a given panel can be combined in a similar manner. Therefore, a feature of the present invention lies in the physical modularity of each panel of the master control console, and more generally each panel of the main control room.

Basically, the space required for an effective interface between an operator and a given panel is independent of the number of alarms, displays or controls that must be accessed by the operator. For example, as shown in FIG. 3, six locations may be assigned to each of the CRTs for alarm and indicator display. Preferably, the top two of each side may be dedicated to the alarm 78 and the other fourth of each side may be dedicated to the indicator display 82. The same layout is provided on each panel of the control room. This allows for significant flexibility and cost savings in the construction phase of the power plant, since hardware can be installed and terminals can be connected in the early stages of construction even before the functional requirements of all systems are addressed. The software base system is loaded early with the installation of the display software for preliminary check of control room operation. Final software installation and functional testing are performed at a more appropriate point in the construction process. This method can significantly accelerate the power plant construction process for installation and control systems. Since the installation and control requirements at a given power plant are often not finalized until later stages of the power plant design, the present invention can significantly reduce the costly delay during construction in all cases. This is also a significant cost savings in the production of uniform and general panels in the design stages required for the positioning and layout of alarms and displays, as well as in saving material by making the panels more compact. Moreover, this modularity at the plant can facilitate operator training and reduce operator error in emergencies because the functionality of each panel is spatially consistent.

Each module control panel therefore has a spatially dedicated distributed indicator and alarm, preferably an interconnect between the at least spatially dedicated distributed controller 88, the CRT 84 and at least one other module control panel or these Have a computer for communication between them. For example, communication via DPS provides the ability to recognize alarms while being located on another panel with the operator among others and the automatic availability of all other panels for information about the systems controlled from one panel. Include.

Figure 36 (a) shows a conventional flow chart providing installation and control of nuclear power generation, and Figure 36 (b) shows a flow chart according to the present invention. Conventionally, inputs and outputs are defined, and then the required algorithms are defined, which measure the human-machine interface. Assembly of all devices begins at this time and all devices are installed at the power plant before system testing begins. In contrast, the modularity of the present invention makes it possible to immediately start assembling the hardware in parallel with the definition of the input / output. Similarly, hardware can be installed and generally tested in parallel with the definition of the human-machine interface and the definition of plant-specific algorithms. Hardware and software are then integrated before final testing. In the conventional nuclear facility, the device is installed in the fourth year of total installation and control operation, but according to the present invention, the device can be installed in the second and third years.

Referring back to FIG. 2, processing component control system 56 and designed safety characteristic component control elements employ a programmable logic controller similar to the Modicon device described above that includes an input / output multiplexer and associated wires and cables, All can be loaded into the plant before the plant's own logic and algorithms are developed. This device does not fail.

The data processing system 70 uses redundant power station mainframe computers with datalinks associated with modular software and hardware. This hardware is shipped before comprehensive and system testing, with modular software unique to the plant. The DIAS 72 also uses input / output multiplexers with programmable logic processors and minicomputers and fail-safe devices, which have the advantages described above in process control and designed safety characteristic control systems.

Claims (18)

In an indicator system for displaying an indication value 90 of a plant operating parameter to an operator of a control room of a nuclear power plant, the power plant has a signal Pl, P2, ... Pi, ... corresponding to the detected value of the same processing parameter. Power plant protection system 50 responsive to a plurality of processing parameter sensors, each generating one of a first set of Pn, each signal C1, C2, ... Ci, ... Cm corresponding to said same processing parameter value Power plant control systems 56, 64 responsive to a plurality of processing parameter sensors 48, 66, 68, each generating one of a second set of c), and said first and second sets of signals in digital form. Means for transmitting to an indicator system in a control room, the indicator system receiving and processing the first and second sets of signals, the third set of signals corresponding to the signals generated by each of the sensors; And digital processor means (72) located in a control room for generating a fourth signal composed of at least two signals from said third set of signals and having an indication (90) of an actual value of said parameter, and said third set of And display means for selectively generating a numerical image corresponding to said signal and said fourth signal, said operator interface coupled to said digital processor means. 2. The logic according to claim 1, wherein said digital processor means discards a signal that deviates by more than a predetermined amount from the third set of average values in said third set of signals, and constitutes said fourth signal from all of said third sets of signals. Indicator system comprising means. The apparatus of claim 1, wherein the operator interface comprises a display screen, and the image generating means is configured to display a numerical value corresponding to each signal of the first page screen image and the third set of signals including the numerical value corresponding to the fourth signal. Indicator system for generating a second page screen image comprising. The method of claim 1, wherein said display means comprises means for selectively displaying an image of each signal of the third set of signals, only the fourth signal, or both the third set of signals and the fourth signal. Indicator system characterized by the above. 2. The digital signal processor of claim 1, wherein the digital processor means comprises means for storing a value of a fourth signal during an operating period of a previous power plant, wherein the display generating means is a trend graph of the fourth and fourth signals during the period. Indicator system comprising a screen for displaying the. A method of generating an indication of process parameters in a control room of a nuclear power plant, wherein the power plant is responsive to a plurality of first process parameter sensors from each of the first set of respective measurement signals P1, P2 for the same process parameters. And a second set of respective measurement signals C1, C2 for the same processing parameters from each of them in response to the first system of the power plant, respectively generating Pi, ..., Pn, and a plurality of second processing parameter sensors. And a second system of the power plant for generating Cj, ... Cm), respectively, said method comprising the steps of: transmitting all said measurement signals in digital form to a digital processor; Combining each tolerance with each sensor depending on the measurement uncertainty for each sensor and the expected change tolerance of the processing parameters; Calculating a weighted average of all the value signals P1, P2, Pi, ... Pn and (C1, C2, Ci, ... Cm) in the digital processor; Comparing each value signal with the sum of the weighted average value and the respective tolerance for each sensor; Determining whether one or more value signals Pi, Ci are outside of the allowable range; Recalculating the weighted average except for values outside the allowable range to obtain a validated average; And displaying the validated average in the control room as an indication of the parameter; Method comprising a. 7. The display according to claim 6, wherein the displaying step comprises: average signals validated on one display screen and value signals P1, P2, Pi, ..., Pn and (C1, C2, Ci, ...) on another display screen. Selectively displaying each of Cm). A method of generating an indication of a process parameter in a control room of a nuclear power plant, wherein the power plant is responsive to a plurality of process parameter sensors, the first set of respective measured value signals (P1, P2, ...) for the same process parameter from each of them. A second set of respective measured value signals C1, C2, ... for the same processing parameters from each of them, in response to the first system of the power plant generating Pi, ..., Pn, respectively, and a plurality of processing parameter sensors. And a second system of the power plant, each generating Cj, ... Cm), said method comprising the steps of: transmitting all said measurement signals in digital form to a digital processor; At the digital processor, combining a tolerance with each sensor that depends on the measurement uncertainty for each sensor and the expected range of change in the processing variable; Calculating, in the digital processor, a first weighted average of all value signals P1, P2, Pi, ... Pn and a second weighted average of all value signals C1, C2, Ci, ... Cm; For each sensor of the first system of the power plant, comparing each of the value signal Pi with a first range, such as the sum of the first weighted average and the tolerance; Determining whether one or more of the value signals Pi is outside the first range, and if out, recalculating the first weighted average except for the value signal outside the first range; After said determining, storing said first weighted average as a validated average of a first set of signals; For each sensor of each of the second system of the plant, comparing each of the value signal Ci with a second range, such as the sum of the second weighted average and the tolerance; Determining whether one or more of the value signals Ci are out of the second range, and if out, recalculating the second weighted average except for the value signal out of the second range; Immediately after proceeding with the determining, storing the second weighted average as a validated average of the second set of signals; And in the control room, displaying one of the validated averages as an indication of the parameter. In an integrated process state overview system for a nuclear power plant, the plant comprises a plurality of process parameter sensors each generating a protection system original value signal for a given process protection parameter of the plurality of power plant components and connecting fluid lines, components or lines. Power plant protection system comprising: a power plant control system having a plurality of processing parameter sensors, each generating a control system original value signal for a given process control parameter of a component or line, at least some of the protection parameters are also control parameters; The overview system, coupled to the plant protection system and the plant control system, calculates a validated protection system signal from a plurality of protection system original signals for each parameter unique to the protection system, and each parameter unique to the control system. Revenge for A data processing system including logic means for calculating a validated control system signal from the control system original signal and for calculating a plurality of protection systems for each parameter in both systems and a validated common system signal from the control system original signal; Connected to the plant protection system and the plant control system, the validated protection system signal is calculated from the multiple protection system original signals for each parameter unique to the protection system, and the multiple control for each parameter unique to the control system. An indicator and alarm system including logic means for calculating a validated control system signal from the system original signal and for calculating a plurality of protection systems for each parameter in both systems and a validated common system signal from the control system original signal; A screen display for generating an image of the major components and connecting fluid lines in the power plant where the protection system and control system parameters are detected; Means for calculating an indication of a processing parameter from the validated signal for the parameter and projecting the parameter indication adjacent to an image of each component and line; Means for projecting a first symbol indicative of at least adjacent to the projected display value whether greater than or less than a normal range limit for the simplified parameter; And means for projecting a second symbol indicative of whether the magnitude of the value is increased or decreased adjacent to the first symbol; System comprising a. 10. The system of claim 9, wherein the status overview system comprises: means for projecting a plurality of alarm tile images on a screen; And means for visually highlighting a tile image of an alert when the state associated with the alert exceeds a threshold, corresponding to at least one indication, wherein each alert tile is associated with a state associated with a parameter of a protection or control system. And a state overview system according to the above. 10. The system of claim 9, wherein the condition overview system, in response to the protection system and the control system, implements a number of power plant critical functions related to safety and power generation, including responsive control, core heat removal, steam / supply conversion and electricity generation. Means for projecting a symbol on the screen to indicate a combination of components and fluid lines usable for performing. 12. The condition overview system of claim 11, wherein the critical functions include reactor coolant system heat removal, reactor coolant system inventory control, second system heat release, and the like. A plurality of sensors for the same parameter, a first set of at least one sensor having a first sensitivity range of the first accuracy level, and a second set of at least one sensor having a different second sensitivity range of the second accuracy level An indicator device for power plant operating parameters of a power plant comprising: the second range overlaps at least a portion of the first range, each sensor generating a respective sensor signal corresponding to a detected value of the parameter and coupling to the sensor. And the indicator device comprises: means for responding to means for generating a sensor signal and for calculating a best evaluation indication of the parameter; A display screen having a plurality of display fields, means for displaying an indication in one field on the screen, in another field on the screen, means for distinguishing each sensor set, each range, and each sensor within each set ; And means for selecting any of the sensors to display signal values associated with the selected sensor on a screen. 14. The apparatus of claim 13, wherein the indicator device further comprises a first control system utilizing a first parameter value derived from a first set of sensors and a second control system using a second parameter value derived from a second control system, And the screen comprises means for selecting and displaying one of the first and second parameter values. 15. The indicator apparatus of claim 14, wherein the first control system provides control in normal operation of the power plant and the second control system provides control in abnormal operation of the power plant. A display apparatus for indicating parameter values in a processing power plant having an indicator and an alarm system, comprising: a display screen; Create multiple display fields on the display screen, accept input signals from sensors that respond to changes in parameters, calculate values derived from the input signals, and output corresponding to each input signal and derived values Digital processing means for generating a value image in some of the display fields; And some of said fields defining touch-sensitive selection means for selecting said particular field and said particular value for display on said screen, said first set of fields defining a first display page, The set of fields defines a second display page, wherein (a) each of the first and second display pages is a processing field for displaying an output image, a property field for displaying a property of the one output, and the first and second display pages. And a menu field defining a touch-sensitive menu selection target that allows the user to alternately display between two pages, and (b) the first display page includes an identity of each sensor generating the parameter input signal. And a touch of one of the sensor fields causes a display of a corresponding value image of the processed value field. The operator can specify which of the touch sensitive sensor field, the touch sensitive calculation field causing the display of the derived value of the parameter in the processed value field, and the output of the display device should be used as an indication of the parameter in the indicator and alarm system. And a touch sensitive override field, wherein (c) the second display page comprises an analog field in which at least one analog display value is displayed in the processed value field. 17. The display device of claim 16, wherein the sensor field comprises a display that distinguishes at least one sensor for each of at least two different ranges of parameter values. 17. The method of claim 16, wherein the property field indicates a first category indicating that a processing parameter value is derived from multiple sensor inputs and is considered valid, wherein the processing parameter value is derived from multiple sensor inputs but cannot be considered valid. And display one of at least three categories, including a second category and a third category indicating that the processing parameter value is one of the sensor values.