SK127199A3 - Arrangement for individually controlling an actuator in a high security industrial installation - Google Patents

Abstract

The actuators (1) is controlled by individual intermediate control units (2) forming part of a general control system or are connected to other programmed units in the installation.. The system permits an operator to drive the installation either from a principal control room (12) or, if needed, from a safety control room (14) both of which are equipped with manual control devices (13) each of which permit direct operation of an actuator control unit. The system includes a manual control which is individually connected to an actuator control unit on which it acts via two digital connections of the inverse series type (1L1, 1L2). The actuator (1) control unit (2) is connected to two controllers (13) respectively installed in each of the control rooms (12,14) by an individual uni-directional series connection (1L1,1L2) which are used to transmit digital data towards each controller. Each series connection in fed in a closed loop so as to permit auto-test and transmission of digital data by opening the loop.

Description

TV42.71-33

EQUIPMENT FOR INDIVIDUAL CONTROL OF THE CONTROLLER FOR HIGH-SAFE INDUSTRIAL OPERATION.

Technical field

The invention relates to a device for the individual control of an actuator for highly safe industrial operation and in particular for nuclear power plants.

BACKGROUND OF THE INVENTION

When actuators are put into such operations to perform important functions, they are known to duplicate for reasons of reliability. For example, they can be joined together in 2 to 4 independent security sequences. Whenever necessary, it must always be possible for an individual control device to be able to control each actuator of these safety sequences independently and in an individual and priority manner. Each controller is under the control of an individual control unit that is directly operated by an individual control device, the individual control device being manually operated for safety reasons. Individual controllers are part of an overall control system in which they are connected via a communication architecture to various other operating units and supervisory programmed units. If operation is operating normally, each controller is controlled by the overall control system and interlocking is normally provided between the controllers of the controller of the same operation.

The master control system allows the operator to operate from a main control room having different control and control means, and a backup control room that is independent of the main control room and its exact copy is usually used for safety reasons. The supervision and control means of the control room comprise, in particular, manual control members which allow individual control devices to operate directly on the individual control units of the actuators. These control members are, for example, the box button

31295 T-type or tum-push-light (TPL) type switches, which allow to act directly and usually electrically on a control unit belonging to the control member. Those controllers that are installed in the main control room are just connected via an individual point-to-point / point-to-point connection to the respective control units of the actuator on which they operate. They are duplicated in the backup supervisor and each of the respective control members is also connected there via a respective individual point-to-point connection to the same control unit as the control member that duplicates it.

Such a control arrangement has the disadvantage of requiring a large amount of multi-core cable to be supplied between the control units and the control members, with the risk of unreliability if each control member generally includes a plurality of terminals for connecting different wires connecting it with the control unit and if the control unit has a duplicate terminal connection in order to allow connection to both control members allowing the operator to act directly on them.

In addition, as is known, it may be necessary to control certain drivers progressively. Such progressive control is performed, for example, by pressing the control button for different times, resulting in an electrical signal that is present during the time the button is pressed. This requires signal generating means for the respective control members and means for interpreting and transmitting the signal in the control units receiving such signals.

Essential for commands sent by manual controllers to controllers of controllers is that they are transmitted reliably and as safely as possible.

31295 T

SUMMARY OF THE INVENTION

The invention provides a device for individual control of a controller for high-security industrial operation, in which the controls are controlled through individually programmed control units, which are included in an overall control system enabling the operator to control the operation, whether from the main control room or control rooms, both of which are equipped with a manually operated control member, which allows to operate directly on the control unit of the controller.

According to the characteristics of the invention, each manually operated control member is individually connected to a control unit of the actuator, which acts through two serial-type digital lines that operate in opposite directions.

According to the invention, each controller control unit is connected to each of the two control members separately located in the two traffic controllers via respective individual serial DC links to receive digitized control information from the control members, and through other

J individual serial one-way links for transmitting digitized information to each controller.

According to the invention, each controller control unit comprises at least one processor and dual access memory, which is connected separately to the processor and the transmission interface giving access to the upper level of the control system so as to allow said unit to operate independently of the control system whenever necessary.

The invention, its characteristics and advantages will become more apparent from the following description.

31295 T

BRIEF DESCRIPTION OF THE DRAWINGS

In FIG. 1 is a block diagram of a control system for high-security industrial operation, the control system comprising a device for individually controlling a controller according to the invention

In FIG. 2 is a diagram of a manually actuated control member for an individual controller control apparatus according to the invention; and

Fig. 3 shows a diagram of an example of an actuator control unit configured to cooperate with an actuator control device according to the invention.

EXAMPLES

Example 1

The individual control devices of the invention are designed to provide a highly safe industrial operation, such as an atomic power plant, which includes a plurality of actuators, such as actuators 1 and Γ, which are individually controlled via individual control units such as units 2 and 1 '. Typically, these individual control units are programmed units of the type intended for applications with a high degree of operational safety and especially where software interruption of the process is not accepted. The programs in place are in modular form and as small as possible for safety reasons, taking into account that no interruption measure is taken. Program data is stored permanently to eliminate the risk of data being deleted.

The controller control unit is part of a master control system in which it is connected to one, or generally to a plurality of programmed operational and / or supervisory units, these units being connected via a communication architecture. These constitute a process control system by which the operation of the operation is managed under the supervision of the operating personnel designated for that operation. The communication architecture consists of one or more networks,

31295 T which are interconnected and which then serve units distributed at different levels of the master control system.

Each of the operational and supervisory units includes at least one processor, a read / write (R / W) and / or read-only (ROM) set of memories plus various accessory devices, in particular input / output devices.

In a first known variant designed for relatively small operations, the control units 2 for controlling the drivers are connected to a local network, for example a LAN 3 with an electric or optical type bus, allowing them to communicate with the upper level of the process control system. These connections can optionally be established directly with a programmed upper level unit such as 4, which is then connected to the network 3.

In a second known variant designed for larger operations, the connection between the control units 2 and the upper level of the programmed units can be realized through specialized units 5, usually of the type of program logic controller that operates as an input / output concentrator and as a data exchange router between the control unit 2 and top-level units other than themselves. In this example, it is assumed that the unit 5 is connected to the local network 6 to operate the level 2 units represented in this example by two programmed units 7 and 8. For example, the unit 7 is an electronic power controller, the unit 8 is considered as a program logic controlling the control units 2, 2 'in a second variant in which the unit 4 is not.

As is known, the other programmed units may be located at this intermediate level of the control system so as to control other groups of lower-level units, which may for example be grouped together, each group being located near a network, for example of the bus type. These programmed units are no longer described in detail unless they are directly related to the invention.

31295 T

In the example contemplated herein, it corresponds to a process control system where an arrangement based on a modular monitoring and control system such as e.g. Applicants' ALSPA 8000 system, a top level is provided provided that it is represented in this example by two units 9 and 10. These units are coupled together and to inter-process control units via a local network 11, such as an Ethernet network or a network that is functional equivalent to the Applican's S8000 network.

The unit 9 corresponds, for example, to a running process control and operator control platform, or more simply to the main operator control, and in this example it is considered to be located in the main supervisor 12 of the plant.

The unit 10 corresponds, for example, to a computer for a running process control system.

As mentioned at the outset, each individual control unit 2, 2 * associated with the actuator can be controlled directly and in a priority manner either from the control room by means of the individual actuator control device.

The individual actuator control device is provided with manually operated control members, such as control members 13, 13 ', and whose control members function functionally to replace conventional box-type pushbutton actuators or push-button light-type switch to allow operating personnel to control the control units 2 controls 1 from the main control room 12 of the operation or from the standby control room 14.

In this example, all control members are arranged to be capable of transmitting or receiving information in digital form, for example in the form of one or more 8-bit bytes. Each control member is individually connected to the control unit via two upstream serial lines 11L1, 11L2 to the control member 13 of room 12 and 11L1. 12 'to the control member 13' of the same room. Each control unit is connected to a control member of each of the control rooms 12 and 14 and thus to two one-way serial lines for

31295 T receiving digitized control information from two control members connected thereto, and two serial-type one-way links for sending digitized information to these control members.

On the control member serving it, each unidirectional link is connected to the encoder / decoder 19, such as a multiplexer / demultiplexer. When the lines transmit signals in electrical form, an electrical isolator device 21, typically of the optoelectronic coupler type, is inserted between the encoder and each of the two unidirectional lines connected thereto.

When operating the manual selection devices with which the control members are provided, characteristic binary combinations are generated which recognize the control units, in particular one of these units which receives them. In the example, the manual dial devices 22 represented by ON / OFF type electrical contacts that are connected to the encoder / decoder 19 are shown such that when triggered each of them causes a different binary combination that is generated.

The reference control device 23 is also connected to the encoder / decoder 19 to enable the control of a sequentially variable controller that receives one of the typical combinations of value settings that may arise. For example, a setting as a function of time for which a button is pressed may be introduced in the reference control device.

The plurality of individually lit indicator lights 24 respond to the illumination commands that are transmitted to the encoder / decoder 19 by the control unit 2 to which the respective control member 13 is connected.

An example of the control unit 2 for controlling the actuator 1 is shown schematically in FIG. 3. Included is a processor 25 associated with a set of memories typically comprising at least one ROM memory and one R / W memory, the ROM set 26 contemplated in this example being associated with a dual-access memory 27. Memory 27 is used to exchange information between the processor 25 and a bus type 3 network through which control units such as 2 and 2 'communicate with the upper level control system units. Memory 27 is

The 31295 T connected to the bus 3 via the transmission interface 28. The hardware and software of the memory 27 is arranged to enable the controller 1 controlled by the processor 425 to be coupled to be independently controlled by the rest of the traffic management system whenever necessary, and in particular in the case of a failure concerning that part of the control system which is located on the other side of the interface 28 from the processor 25.

The processor 25 acts in a known manner on one of the controls 1 through the control circuit and through the electrical insulator device 21 and through the interface 30. The signals which appear at the output of the interface 30 and which are addressed to the controller 1 are retransmitted in parallel to the monitoring device 31 to verify them and to transmit information to the processor 25 about the results of this verification. This information is in the form of digital signals that are transmitted to the processor via the electrical insulator 21.

The test circuit 32 receives the signals transmitted by the controller 1 and addressed to the processor 25 to be notified of how it operates using a protocol known to those skilled in the art. The information based on the received signals is transmitted to the test circuit 32 of the processor 25 under its control. Electrical insulator devices 21 are located first on a line through which the processor acts on the test circuit, and second on a line through which the test circuit informs the processor.

The controller 25 also communicates with two manually operated controllers of the same controller. This communication is realized by a serial link that connects the processor to each control member, such as the upstream lines 1L1. 1L2 with a control member 13 of the main control room 12 for the processor of the control unit 2, and such as the upstream lines 2L1, 2L2 with a control member 13 of the backup control room 14.

Each bidirectional link to the control member is made up of two individual devices of the electrical insulator 21 and a two-wire / four-wire circuit 29 interposed between the devices and the processor port 25, which is different for the two control members that communicate with the processor. For example

31295 A bidirectional line built from unidirectional lines 2L1, 2L2 to the control member 13 of room 14 is of the same type.

For example, each unidirectional link is interconnected in a loop to allow self-testing, and the loop is opened to transmit digitized information.

Claims (4)

1. Device for individual control of a control (1) for high-security industrial operation, the controls of which are controlled by individual control units (2) forming part of an overall control system in which they are connected to other programmed control units, allowing the operator to control operation either from the main control room (12) or, if necessary, from the backup control room (14), both control rooms equipped with manual control members (13), each of which allows direct operation on the control unit, characterized in that: includes a manual control member that is individually connected to the controller control unit, which operates through two serial-type digital lines (1L1, 1L2) operating in opposite directions. Apparatus according to claim 1, characterized in that the control unit (2) of the actuator (1) is connected to each of the two control members (13) separately arranged in the two operating supervision units (12, 14), via respective individual serial DC lines (1L1, 2L1) to receive digitized control information from the control members, and through other respective individual serial one-way links (1L2, 2L2) to transmit the digitized information to each control member. Device according to claim 1 or 2, characterized in that each serial line is connected to a loop so as to allow self-testing, and for the transmission of digitized information the loop is opened. 31285 T Device according to claim 2, characterized in that the controller control unit comprises at least one processor (25) and a dual access memory (27) which is separately connected to the processor and to the transmission interface (28) giving access to the upper level of the control system so to allow said unit to operate independently of the control system whenever necessary.