CN102420020A - A digital safety interlock system for a magnetic confinement nuclear fusion experimental device - Google Patents

Abstract

The invention relates to a magnetic confinement nuclear fusion experimental device, in particular to a digital safety interlocking system of the magnetic confinement nuclear fusion experimental device. The invention relates to a digital safety interlocking system of a magnetic confinement nuclear fusion experimental device, which comprises a circuit: the microcontroller module at least comprises a Flash memory and an Ethernet interface circuit and is responsible for detecting the real-time state of each safety interlocking subsystem of the nuclear fusion experimental device, storing fault log information of the safety interlocking subsystems and carrying out network communication; the programmable logic circuit module is electrically connected with the microcontroller module and each subsystem of the nuclear fusion experimental device, at least comprises an input logic and register, a control logic circuit, an output register and a buffer register read-write control circuit, is realized by adopting a Programmable Logic Device (PLD), and is responsible for acquiring the running state and fault signals of each safety interlocking subsystem of the nuclear fusion experimental device and processing the signals; and the power supply module is used for supplying power to the system. The invention is applied to the safety interlocking protection and on-line monitoring of the magnetic confinement nuclear fusion experimental device.

Description

A digital safety interlock system for a magnetic confinement nuclear fusion experimental device

technical field

The invention relates to a magnetic confinement nuclear fusion experimental device, in particular to a digital safety interlock system of the magnetic confinement nuclear fusion experimental device.

Background technique

The safety interlock system is an important part of the control system of large-scale magnetic confinement nuclear fusion experimental devices (such as: tokamak device, stellarator, etc.). The safety interlocking system of the magnetic confinement nuclear fusion experimental device includes a safety system and an interlocking system. A linkage mechanism for protection systems and fault handling is established between various subsystems to prevent and avoid risks to the greatest extent, and to ensure the safety of the magnetic confinement nuclear fusion experimental device. The safe operation and the smooth progress of the experiment. The main task of the safety interlock system is to coordinate the protection logic relationship of each safety interlock subsystem (such as water cooling system, vacuum system, cryogenic system, etc.) Safety protection of person, device and environment.

The safety interlock system of the existing magnetic confinement nuclear fusion experimental device is generally constructed by means of a programmable logic controller (PLC) or an industrial control computer plus an interface board. For example, Sun Xiaoyang, Luo Jiarong, Ji Zhenshan, Wu Yichun and others published the article "Design and Implementation of EAST Safety Inspection and Interlock Protection System" in the fourth issue of Volume 31 of "Nuclear Technology" in April 2008. Wu Yichun, Ji Zhenshan, Sun Xiaoyang, etc. "EAST Safety Interlock Supervision System Design" published in "Atomic Energy Science and Technology" Volume 45 No. 2 in February 2011, all disclosed the safety interlock system realized by programmable logic controller (PLC); Those skilled in the art can refer to related materials to know the way of adding an interface board to an industrial control computer, so it will not be repeated here. Both of the above two methods are based on microcontrollers or microcomputers, and use software processing methods to realize the safety interlock function. Specifically, the software program is used to obtain and analyze the status signals of each subsystem, and judge whether the subsystem is faulty or not according to the status signals. , and then determine whether to take corresponding protection measures for the subsystem. The main advantages of the safety interlock system are: 1. The optional programmable logic controller and the input and output interface boards of the industrial control computer are complete, and there are rich software API functions for calling; 2. The network communication function is powerful, It is conducive to remote monitoring; 3. High reliability, industrial-grade programmable logic controllers and industrial control computers are suitable for use in the industrial environment of magnetic confinement nuclear fusion devices, with strong functions and low equipment failure rate.

However, the above-mentioned safety interlock system has the following disadvantages: 1. The safety interlock system is realized by using software processing, and the control algorithm is run in a sequential execution mode, and the system response time is uncertain (especially in the PLC mode), and the system response It takes a long time; 2. Due to the problem of common cause failure in the software, the safety interlock system is not easy to meet the special redundancy and diversity design requirements of the nuclear fusion experimental device, which is not conducive to the implementation of the defense-in-depth strategy.

Contents of the invention

The technical solution to be solved by the present invention is to provide a digital safety interlock system for magnetic confinement nuclear fusion experimental devices based on programmable logic devices (PLD) and microcontrollers (MCU), using pure hardware control logic to achieve safety The parallel processing of the interlocking function overcomes the problem of uncertain response time of the existing safety interlocking system, and adopts the defense-in-depth technology to meet the special redundancy and diversity needs of the nuclear fusion experimental device.

In order to solve the above-mentioned technical problems, the technical solution adopted in the present invention is: a digital safety interlock system of a magnetic confinement nuclear fusion experimental device, the circuit of which includes:

A microcontroller module, including at least Flash memory and Ethernet interface circuit, responsible for detecting the real-time status of each safety interlock subsystem of the nuclear fusion experimental device, saving the fault log information of the safety interlock subsystem, and network communication ;

A programmable logic circuit module is electrically connected to the microcontroller module and the safety interlock subsystems of the nuclear fusion experimental device, which at least includes input logic and registers, control logic circuits, output registers, and buffer registers. Realization of programming logic device PLD, which is responsible for obtaining the operating status and fault signals of each safety interlock subsystem of the nuclear fusion experimental device and processing the signals;

A power supply module for supplying power to the system.

Further, in order to adapt to the harsh electromagnetic and radiation environment of the nuclear fusion laboratory, the programmable logic device PLD is a field programmable gate array FPGA or a complex programmable logic device CPLD.

Further, in order to meet the special redundancy and diversity design requirements of the nuclear fusion experimental device, the microcontroller module adopts a dual-redundant microcontroller module, and the programmable logic circuit module adopts a quad-redundant programmable logic circuit module.

Further, in order to realize the diversity of the system, the said dual-redundancy micro-controller module is two micro-controller modules with different manufacturers, different models, different design methods, and the same function; the four-redundancy programmable logic circuit The modules are four programmable logic circuit modules with different manufacturers, different models, different design methods and the same function.

Further, in order to ensure the time synchronization between the system and the safety interlock subsystems of the nuclear fusion experimental device, the dual redundant micro-controller modules have built-in IEEE 1588 precise network clock synchronization protocol.

Further, the intermediate output signal after the parallel operation of the four redundant programmable logic circuit modules also passes through a voting circuit module, and the voting circuit module is electrically connected to the four redundant programmable logic circuit modules, the dual redundant Each safety interlock subsystem of the microcontroller module and the nuclear fusion experimental device, the voting circuit module at least includes a voting logic, an output register, and a buffer memory read and write control circuit, and the voting circuit module will pass through four redundant programmable logic circuits The intermediate output signal after the parallel operation of the module is judged by voting and then transmitted to the dual redundant microcontroller module and the safety interlock subsystem of the nuclear fusion experimental device.

Further, in order to adapt to the harsh electromagnetic and radiation environment of the nuclear fusion laboratory, the voting circuit module is realized by a field programmable gate array FPGA or a complex programmable logic device CPLD.

Further, in order to facilitate system maintenance, the voting circuit module adopts 2/4 voting logic.

Further, in order to satisfy the safety and stability of the power supply of the hardware equipment of the safety interlock system, the power supply module adopts a dual redundant structure, and is composed of a rechargeable battery, a charging management circuit module, and a DC power supply circuit module.

The present invention adopts the above structure, and compared with the prior art, it has the following advantages:

1 The programmable logic circuit module and the voting circuit module of the present invention are realized by the programmable logic device PLD, the system responds quickly and the response time is determined;

2. The present invention is realized by using pure hardware control logic without the participation of software programs, avoiding common cause failures caused by software errors, and simplifying the process of system structure, development and verification;

3 The present invention adopts dual-redundant micro-controller modules and four-redundant programmable logic circuit modules, and the dual-redundant microcontroller modules and four-redundant programmable logic circuit modules are all designed by different manufacturers and different models. The principle of redundancy and diversity is improved, the defense-in-depth capability of the system is improved, and it is conducive to system maintenance;

4. The hardware circuit description of the present invention is described by using hardware description language (VHDL and Verilog HDL) and schematic diagram respectively, and the PLD design based on the hardware description language can be easily transplanted to other PLDs, thus effectively overcoming the obsolescence due to the elimination of components. problems that cannot be maintained;

5 The microcontroller module of the present invention has an Ethernet interface circuit, communicates with the workstation installed in the central control room through the network, and provides the workstation with real-time online status and fault log information of each safety interlock subsystem of the nuclear fusion experimental device, which is convenient for operation personnel monitoring and query analysis;

6 The dual-redundant microcontroller modules of the present invention have built-in IEEE 1588 precise network clock synchronization protocol, which can be synchronized with the central time of the nuclear fusion experimental device to ensure time synchronization with all safety interlock subsystems of the device, with precise The time-stamped fault log information is very necessary for the operator to accurately judge the fault of the safety interlock subsystem of the device;

7 The present invention adopts dual redundant power supply circuit modules and dual redundant MCU circuit modules, which effectively improves the reliability of system power supply and network communication.

Description of drawings

Fig. 1 is a schematic block diagram of the digital safety interlock system of the magnetic confinement nuclear fusion experimental device of the present invention.

Detailed ways

The present invention will be further described in conjunction with the accompanying drawings and specific embodiments.

As shown in Figure 1, the best embodiment of the present invention is a digital safety interlock system of a magnetic confinement nuclear fusion experimental device, and its circuit includes: dual redundant microcontroller modules 1, four redundant programmable logic circuit modules 2. Voting circuit module 3. Dual redundant power supply module 4.

Wherein, the dual redundant microcontroller module 1 is made up of a master microcontroller module 11 and a slave microcontroller module 12, the master microcontroller module 11 and the slave microcontroller module 12 have the same structure, at least including a Flash memory 1. Ethernet interface circuit, the master microcontroller module 11 and the slave microcontroller module 12 have built-in IEEE 1588 precise network clock synchronization protocol, and the master microcontroller module 11 is responsible for each safety interlocking sub-unit of the nuclear fusion experimental device The real-time status of the system is detected, the fault log information of the safety interlock subsystem is preserved, and network communication is carried out. The slave microcontroller module 12 is responsible for monitoring the operating status of the main microcontroller module 11. When the main microcontroller module 11 fails , the slave microcontroller module 12 automatically switches to the control state, and sends an alarm signal, and the slave microcontroller module 12 replaces the microcontroller module 11 to detect the real-time status of each safety interlock subsystem of the nuclear fusion experimental device, and to Save the fault log information of the safety interlock subsystem and communicate with the network;

The four redundant programmable logic circuit modules 2 are composed of a first programmable logic circuit module 21, a second programmable logic circuit module 22, a third programmable logic circuit module 23, and a fourth programmable logic circuit module 24, The first programmable logic circuit module 21, the second programmable logic circuit module 22, the third programmable logic circuit module 23, and the fourth programmable logic circuit module 24 are respectively connected with the microcontroller module 1, the voting circuit 3 and the core Each safety interlock subsystem of the fusion experiment device is electrically connected, at least including input logic and registers, control logic circuits, output registers, and buffer register read and write control circuits. The operating status and fault signal of the lock subsystem and process the signal;

The voting circuit module 3 is electrically connected to the four redundant programmable logic circuit module 2, the dual redundant microcontroller module 1 and each safety interlock subsystem of the nuclear fusion experimental device, and the voting circuit module 3 is at least Including voting logic, output register, buffer memory read and write control circuit, said voting circuit module 3 transmits the intermediate output signal after the parallel operation of four redundant programmable logic circuit modules 2 to the dual redundant microcontroller after voting judgment Module 1 and the safety interlock subsystem of the nuclear fusion experimental device, the voting circuit module 3 adopts 2/4 voting logic;

The dual redundant power supply module 4 includes a rechargeable battery, a charging management circuit module 41, and a DC power supply circuit module 42 to provide power for the system.

In order to facilitate maintenance, overhaul and regular tests, the above-mentioned unit circuit modules are designed with standard chassis sizes and support hot-swappable functions.

In order to adapt to the harsh electromagnetic and radiation environment of the nuclear fusion laboratory, in order to improve the protection of the programmable logic device PLD from damage or transient effects that may occur when the bombardment of high-energy particles (that is, single-event inversion SEU), four redundant programmable logic circuit modules 2 And voting circuit module 3 adopts Field Programmable Gate Array FPGA based on Flash/Antifuse or complex programmable logic device CPLD based on Flash/EEPROM.

The application of digital safety interlocking system of the present invention in actual experiment is specified below:

The software program of the digital safety interlocking system is installed on the workstation in the central monitoring room, and is connected to the workstation network through the Ethernet interface circuit of the dual redundant microcontroller module 1, and the software program running on the workstation provides a friendly visual interface , can conveniently monitor the input and output status of each signal of the digital safety interlock system, and can query the fault log information submitted by the digital safety interlock system, which is convenient for the operator to analyze.

The four-redundant programmable logic circuit module 2 receives the operating status and fault signals from each safety interlock subsystem of the nuclear fusion experimental device. The operating status and fault signals are logic level signals or clock pulse signals, and each signal depends on the specific meaning And the degree of harm caused is divided into multiple fault levels, for example: the software and hardware of the safety interlock subsystem cannot normally perform the control or detection function of the system is a common fault, and the fault that causes moderate danger to system safety and personal safety is a second fault. Class-1 faults, faults that are very dangerous to system safety and personal safety are class-1 faults, etc. According to the actual situation of each safety interlock subsystem of the nuclear fusion experimental device, if each safety interlock subsystem on site can provide four redundant operation status and fault signals, then the operation status of the four redundant safety interlock subsystem and the fault signal are respectively connected to the first programmable logic circuit module 21, the second programmable logic circuit module 22, the third programmable logic circuit module 23, and the fourth programmable logic circuit module 2 of the four redundant programmable logic circuit module 2 after being electrically isolated. If the programming logic circuit module 24 cannot provide four redundant operation statuses and fault signals on the spot, then the single operation status and fault signals are electrically isolated and then connected in parallel to the first programmable logic circuit module 2 of the four redundancy modules 2 respectively. A programmable logic circuit module 21 , a second programmable logic circuit module 22 , a third programmable logic circuit module 23 , and a fourth programmable logic circuit module 24 . The former method has high reliability, but requires four redundant mutually independent safety interlock subsystems running status and fault signals and four independent signal transmission lines, and the system cost is high; the latter method is low in cost but reliable Sex is not as good as the former way. In this embodiment, the operating state and fault signal of the four-redundant safety interlock subsystem are taken as an example. The operating state and fault signal of the four-redundant safety interlock subsystem are connected to four After a programmable logic circuit module, first enter the control logic circuit through the input logic and register, and the control logic circuit processes these signals in parallel according to the fault level described in the status signal and the specific logic relationship between each signal.

The operating status and fault signals of the safety interlock subsystem processed by the four-redundant programmable logic circuit module 2 are used as intermediate output signals, and are connected to the voting circuit module 3 through the output register. The voting logic of the voting circuit module 3 performs 2/4 voting judgment on the intermediate output signal, and passes the intermediate output signal after the voting judgment through the output register to generate an output signal, and the output signal is electrically isolated and driven and then sent to the Each safety interlock subsystem of the nuclear fusion experimental device plays the function of interlock protection. The above-mentioned 2/4 voting is carried out under normal circumstances, if the first programmable logic circuit module 21, the second programmable logic circuit module 22, the third programmable logic circuit module 23, If any module of the fourth programmable logic circuit module 24 is pulled out due to reasons such as maintenance, the 2/4 voting logic of the voting circuit module 3 is automatically switched to 2/3 voting. If two of the four redundant programmable logic modules 2 are pulled out, the voting circuit module 3 is automatically switched to 1/2 voting. At this time, if any module of the quad-redundant programmable logic module 2 is pulled out, the voting circuit module 3 sends out protection and alarm signals. When the voting logic output of the voting circuit module 3 changes, the system will automatically record the intermediate output signal after passing through the quad-redundant programmable logic circuit module 2, so as to analyze the first programmable logic circuit of the quad-redundant programmable logic module 2 The state of the module 21 , the second programmable logic circuit module 22 , the third programmable logic circuit module 23 , and the fourth programmable logic circuit module 24 .

Under normal circumstances, the main microcontroller module 11 of the dual redundant microcontroller module 1 is on duty, responsible for detecting the real-time status of each safety interlock subsystem of the nuclear fusion experimental device, and checking the fault log of the safety interlock subsystem Information is preserved, and network communication, is responsible for monitoring the running status of master microcontroller module 11 from microcontroller module 12, when master microcontroller module 11 fails, automatically switches to control state from microcontroller module 12, and sends an alarm signal, the slave microcontroller module 12 replaces the microcontroller module 11 to detect the real-time status of each safety interlock subsystem of the nuclear fusion experimental device, save the fault log information of the safety interlock subsystem, and communicate through the network. The main microcontroller module 11 of the dual redundant microcontroller module 1 or the slave microcontroller module 12 can read and write the control circuit through the buffer memory of the voting circuit module 3, and read the output signal of its output register, and can also pass through four redundant The first programmable logic circuit module 21 of the programmable logic module 2 or the second programmable logic circuit module 22 or the third programmable logic circuit module 23 or the buffer memory read and write control circuit of the fourth programmable logic circuit module 24, read Get the state signal of its input logic and register or the intermediate output signal of the output register, and send the above-mentioned signal and recorded log information to the workstation through the main microcontroller module 11 or from the Ethernet interface circuit of the microcontroller 12, so as to achieve for real-time monitoring purposes. Simultaneously main micro-controller module 11 or from the Flash memory of micro-controller 12 are used for the failure log information of each safety interlock subsystem of the nuclear fusion experiment device that the digital safety interlock system detects locally, guarantee in the situation that network communication is interrupted Under this condition, the fault log can still be recorded accurately and timely. In addition, due to the different safety interlock subsystems used in different nuclear fusion experiments, those safety interlock subsystems that do not participate in nuclear fusion experiments for the time being are often in a shutdown state, which can be controlled by the main microcontroller module 11 or from the microcontroller 12 The safety interlock signal of the safety interlock subsystem that does not participate in the nuclear fusion experiment is bypassed, specifically the main microcontroller module 11 or the slave microcontroller 12 through the buffer memory read and write control circuit of the four redundant programmable logic circuit module 2 , read the input logic and registers to obtain the operating status and fault signals of each safety interlock subsystem, and write the input logic and registers to bypass the status signal of a certain safety interlock subsystem. In addition, both the master microcontroller module 11 and the slave microcontroller module 12 have a built-in IEEE 1588 precise network clock synchronization protocol, which can be synchronized with the central time of the nuclear fusion experimental device to ensure that it is always synchronized with all safety interlock subsystems of the device. The fault log information with accurate time stamp is very necessary for the operator to accurately judge the fault of the safety interlock subsystem of the device.

The dual redundant power supply module 4 provides safe and stable power supply for the equipment of the present invention. When the DC power supply is normally powered, the equipment power supply automatically selects the DC power supply circuit module 42 to supply power, and at the same time, the rechargeable battery and the charging management circuit module 41 are powered. The rechargeable battery is used for charging management; after the DC power supply is lost, the power multiplexer automatically and seamlessly switches to the rechargeable battery and the rechargeable battery of the charging management circuit module 41 for power supply. The maximum time required for the safe shutdown of the lock subsystem; after the DC power is regained, the power multiplexer automatically and seamlessly switches to the DC power circuit module 42 for power supply, and the rechargeable battery is charged and managed. Preferably, the rechargeable battery is a lithium battery.

In addition to using hardware to effectively overcome the common cause failure problem inside the system, the present invention adopts dual-redundant micro-controller modules, four-redundant programmable logic circuit modules and double-redundant power supply modules to realize the principle of redundancy. Possesses the principle of diversity: for the four-redundant programmable logic circuit modules, the programmable logic devices of different manufacturers, different hardware circuit description methods, different development tools and other measures are used to design; the dual-redundant microcontroller module Microcontrollers and network interface circuits from different manufacturers are used respectively; the dual redundant power supply modules use DC power supply circuits and rechargeable battery circuits respectively.

Although the present invention has been particularly shown and described in conjunction with preferred embodiments, it will be understood by those skilled in the art that changes in form and details may be made to the present invention without departing from the spirit and scope of the invention as defined by the appended claims. Making various changes is within the protection scope of the present invention. the

Claims (9)

1. the digital safety interlocking system of a magnetic confinement nuclear fusion experimental provision is characterized in that, its circuit comprises:

One micro controller module comprises Flash storer, ethernet interface circuit at least, is responsible for the real-time status of each safety interlocking subsystem of nuclear fusion experimental device is detected, the fault log information of safety interlocking subsystem is preserved and network service,

One PLD module; Be electrically connected with micro controller module and each safety interlocking subsystem of nuclear fusion experimental device; It comprises input logic and register, control logic circuit, output register, buffer register read-write control circuit at least; Adopt PLD PLD to realize, be responsible for obtaining running status and the fault-signal of each safety interlocking subsystem of nuclear fusion experimental device and this signal is handled

One power module is system's power supply.

2. digital safety interlocking system according to claim 1 is characterized in that: said PLD PLD is on-site programmable gate array FPGA or complex programmable logic device (CPLD).

3. digital safety interlocking system according to claim 1 is characterized in that: said micro controller module adopts two redundant micro controller modules to form, and said PLD module adopts four redundant PLD modules to form.

4. digital safety interlocking system according to claim 3 is characterized in that: said two all built-in IEEE 1588 precision net clock synchronization protocol of redundant micro controller module.

5. digital safety interlocking system according to claim 3 is characterized in that: said two redundant micro controller modules are two micro controller modules that adopt different manufacturers, different model, different designs method, identical function; Said four redundant PLD modules are to adopt four PLD modules of different manufacturers, different model, different designs method, identical function.

6. according to claim 3 or 4 or 5 described digital safety interlocking systems; It is characterized in that: through the output signal after the four redundant PLD module concurrent operations also through a voting circuit module; Said voting circuit module is electrically connected on said four redundant PLD modules, said two redundant micro controller modules and each safety interlocking subsystem of nuclear fusion experimental device; Said voting circuit module comprises voting logic, output register, memory buffer read-write control circuit at least, is transferred to the safety interlocking subsystem of two redundant micro controller modules and nuclear fusion experimental device after said voting circuit module will be judged through voting through the output signal after the four redundant PLD module concurrent operations.

7. digital safety interlocking system according to claim 6 is characterized in that: said voting circuit module adopts on-site programmable gate array FPGA or complex programmable logic device (CPLD) to realize.

8. digital safety interlocking system according to claim 6 is characterized in that: said voting circuit module adopts 2/4 voting logic.

9. digital safety interlocking system according to claim 1 is characterized in that: said power module adopts two redundancy structures, is made up of rechargeable battery and charge management circuit module, DC power supply circuit module.

Images