阅读说明：本技术 Atwt控制装置及核电设备 (ATWT control device and nuclear power equipment ) 是由 李大伟 王誉霖 王正斌 郑伟智 杨爽 于 2020-05-14 设计创作，主要内容包括：本发明涉及核电厂反应堆控制及保护技术领域,提供了一种ATWT控制装置及核电设备。ATWT控制装置用于控制核电设备的执行机构执行保护操作,包括至少两个控制站以及控制电路,每个控制站包括：IO模块,包括输入模块和输出模块,输入模块用于接收核电设备的第一检测信号值；以及控制器,与IO模块连接,控制器用于判断第一检测信号值是否大于第一阈值,在第一检测信号值大于第一阈值后触发驱动信号并通过输出模块输出；控制电路与每个控制站的输出模块连接且与执行机构连接,控制电路用于在每个控制站都输出驱动信号时控制执行机构执行保护操作。上述ATWT控制装置能够有效避免执行机构误动作而使核电厂停运造成经济损失。(The invention relates to the technical field of nuclear power plant reactor control and protection, and provides an ATWT (automatic train maintenance) control device and nuclear power equipment. The ATWT control device is used for controlling an actuating mechanism of nuclear power equipment to execute protection operation, and comprises at least two control stations and a control circuit, wherein each control station comprises: the input module is used for receiving a first detection signal value of the nuclear power equipment; the controller is connected with the IO module and used for judging whether the first detection signal value is larger than a first threshold value or not, triggering the driving signal and outputting the driving signal through the output module after the first detection signal value is larger than the first threshold value; the control circuit is connected with the output module of each control station and is connected with the actuating mechanism, and the control circuit is used for controlling the actuating mechanism to execute protection operation when each control station outputs a driving signal. The ATWT control device can effectively avoid economic loss caused by shutdown of a nuclear power plant due to misoperation of the execution mechanism.)

1. An ATWT control device for controlling an actuator of a nuclear power plant to perform a protection operation, the ATWT control device comprising a control circuit and at least two control stations, each control station comprising:

the IO module comprises an input module and an output module, wherein the input module is used for receiving a first detection signal value of the nuclear power equipment; and

the controller is connected with the input module and the output module and is used for judging whether the first detection signal value is larger than a first threshold value or not, triggering a driving signal and outputting the driving signal through the output module after the first detection signal value is larger than the first threshold value;

the control circuit is connected with the output module of each control station, is used for being connected with the actuating mechanism and controlling the actuating mechanism to execute the protection operation when each control station outputs the driving signal.

2. The ATWT control device of claim 1, wherein the number of control stations is two; the control circuit controls the actuator to perform the protection operation when both the control stations output the drive signal.

3. The ATWT control arrangement according to claim 1, wherein the nuclear power plant is provided with a drive power supply; the control circuit comprises a plurality of normally-open first switch units, the number of the first switch units is the same as that of the control stations, and each first switch unit is connected in series between the driving power supply and the actuating mechanism; each first switch unit is respectively connected with an output module of one control station, and when the first switch unit receives the driving signal, the first switch unit is closed; the actuator performs the protection operation after all the first switching units are closed.

4. The ATWT control arrangement according to claim 1, wherein the nuclear power plant is provided with a drive power supply; the control circuit comprises a plurality of normally closed second switch units, the number of the second switch units is the same as that of the control stations, and each second switch unit is connected in parallel and then connected between the driving power supply and the actuating mechanism; each second switch unit is respectively connected with an output module of one control station, and when the second switch unit receives the driving signal, the second switch unit is disconnected; the actuator performs the protection operation after all the second switching units are turned off.

5. ATWT control device according to claim 1, characterized in that the nuclear power plant is provided with an alarm device; the control circuit is also used for being connected with the alarm device;

the input module is also used for receiving a second detection signal value of the nuclear power equipment;

the controller is further configured to determine whether the second detection signal value is greater than a second threshold, and trigger an alarm signal and output the alarm signal through the output module after the second detection signal value is greater than the second threshold;

the control circuit is also used for controlling the alarm device to alarm when at least one control station outputs the alarm signal.

6. The ATWT control arrangement according to claim 5, wherein the nuclear power plant is provided with a drive power supply; the control circuit comprises a plurality of normally open third switch units, the number of the third switch units is the same as that of the control stations, and each third switch unit is connected in parallel and then connected between the driving power supply and the alarm device; each third switch unit is respectively connected with an output module of one control station, and when the third switch unit receives the alarm signal, the third switch unit is closed; the alarm unit alarms after at least one of the third switch units is closed.

7. The ATWT control device according to claim 1 or 5, further comprising a first isolation assignment module connected to the input modules of all the control stations, the first isolation assignment module being configured to split the first detected signal value into multiple signals and assign the multiple signals to the control stations;

and/or, the ATWT control apparatus further comprises a second isolation allocation module connected to the input modules of all the control stations, the second isolation allocation module being configured to divide the second detection signal value into multiple signals and allocate the multiple signals to each control station.

8. The ATWT control device of claim 1, wherein the controller comprises an FPGA controller, the FPGA controller further configured to diagnose self-faults.

9. The ATWT control device of claim 1, wherein the nuclear power plant includes a detection module for collecting the first detection signal value; the ATWT control device further comprises a detection module interface connected with the input module, an execution mechanism interface connected with the control circuit and an internal interface; the detection module interface is used for being connected with the detection module through a hardware line, the execution mechanism interface is used for being connected with the execution mechanism through a hardware line, the IO module is connected with the controller through the internal interface through a communication bus communication connection, and the output module is connected with the control circuit through the internal interface through a hardware line.

10. A nuclear power plant, comprising:

the detection module is used for collecting a current signal of the nuclear power equipment to serve as a first detection signal value;

an actuator for performing a protection operation; and

the ATWT control device of any of claims 1-9, the ATWT control device being coupled to the detection module and the actuator.

Technical Field

The invention relates to the technical field of nuclear power plant reactor control and protection, in particular to an ATWT (automatic train transfer) control device and nuclear power equipment.

Background

An Anticipated transient without scram (ATWT) refers to an Anticipated transient without scram or Trip of the crew. In an operational ATWT design of a nuclear power plant, when a protection condition is met, an associated actuating mechanism is required to be arranged to execute a protection operation to protect the operation process of the nuclear power equipment, but the actuating mechanism in the traditional nuclear power equipment is often operated incorrectly to stop the nuclear power plant, so that economic loss is caused.

Disclosure of Invention

Therefore, it is necessary to provide an ATWT control device and a nuclear power plant, which are directed to the problem of economic loss caused by shutdown of a nuclear power plant due to misoperation of an actuator in a conventional nuclear power plant.

An ATWT control apparatus for controlling an actuator of a nuclear power plant to perform a protection operation, the ATWT control apparatus comprising a control circuit and at least two control stations, each control station comprising:

the IO module comprises an input module and an output module, wherein the input module is used for receiving a first detection signal value of the nuclear power equipment; and

the controller is connected with the input module and the output module and is used for judging whether the first detection signal value is larger than a first threshold value or not, triggering a driving signal and outputting the driving signal through the output module after the first detection signal value is larger than the first threshold value;

the control circuit is connected with the output module of each control station, is used for being connected with the actuating mechanism and controlling the actuating mechanism to execute the protection operation when each control station outputs the driving signal.

According to the ATWT control device, the same execution mechanism is controlled through the control stations to vote, when the control stations output driving signals, the control circuit controls the execution mechanism to execute protection operation, reliable safety guarantee can be provided for safe operation of a nuclear power plant, and economic loss caused by shutdown of the nuclear power plant due to misoperation of the execution mechanism can be effectively avoided.

In one embodiment, the number of the control stations is two; the control circuit controls the actuator to perform the protection operation when both the control stations output the drive signal.

In one embodiment, the nuclear power equipment is provided with a driving power supply; the control circuit comprises a plurality of normally-open first switch units, the number of the first switch units is the same as that of the control stations, and each first switch unit is connected in series between the driving power supply and the actuating mechanism; each first switch unit is respectively connected with an output module of one control station, and when the first switch unit receives the driving signal, the first switch unit is closed; the actuator performs the protection operation after all the first switching units are closed.

In one embodiment, the nuclear power equipment is provided with a driving power supply; the control circuit comprises a plurality of normally closed second switch units, the number of the second switch units is the same as that of the control stations, and each second switch unit is connected in parallel and then connected between the driving power supply and the actuating mechanism; each second switch unit is respectively connected with an output module of one control station, and when the second switch unit receives the driving signal, the second switch unit is disconnected; the actuator performs the protection operation after all the second switching units are turned off.

In one embodiment, the nuclear power equipment is provided with an alarm device; the control circuit is also used for being connected with the alarm device;

the input module is also used for receiving a second detection signal value of the nuclear power equipment;

the controller is further configured to determine whether the second detection signal value is greater than a second threshold, and trigger an alarm signal and output the alarm signal through the output module after the second detection signal value is greater than the second threshold;

the control circuit is also used for controlling the alarm device to alarm when at least one control station outputs the alarm signal.

In one embodiment, the nuclear power equipment is provided with a driving power supply; the control circuit comprises a plurality of normally open third switch units, the number of the third switch units is the same as that of the control stations, and each third switch unit is connected in parallel and then connected between the driving power supply and the alarm device; each third switch unit is respectively connected with an output module of one control station, and when the third switch unit receives the alarm signal, the third switch unit is closed; the alarm unit alarms after at least one of the third switch units is closed.

In one embodiment, the ATWT control apparatus further comprises a first isolation assignment module connected to the input modules of all the control stations, the first isolation assignment module being configured to divide the first detected signal value into a plurality of signals and assign the plurality of signals to the control stations;

and/or, the ATWT control apparatus further comprises a second isolation allocation module connected to the input modules of all the control stations, the second isolation allocation module being configured to divide the second detection signal value into multiple signals and allocate the multiple signals to each control station.

In one embodiment, the controller comprises an FPGA controller, and the FPGA controller is further used for diagnosing self faults.

In one embodiment, the nuclear power plant includes a detection module for acquiring the first detection signal value; the ATWT control device further comprises a detection module interface connected with the input module, an execution mechanism interface connected with the control circuit and an internal interface; the detection module interface is used for being connected with the detection module through a hardware line, the execution mechanism interface is used for being connected with the execution mechanism through a hardware line, the IO module is connected with the controller through the internal interface through a communication bus communication connection, and the output module is connected with the control circuit through the internal interface through a hardware line.

A nuclear power plant comprising:

the detection module is used for collecting a current signal of the nuclear power equipment to serve as a first detection signal value;

an actuator for performing a protection operation; and

the ATWT control apparatus of any preceding claim, the ATWT control apparatus being connected to the detection module and the actuator.

According to the nuclear power equipment, the same execution mechanism is controlled by the control stations to vote, when the control stations output driving signals, the control circuit controls the execution mechanism to execute protection operation, reliable safety guarantee can be provided for safe operation of a nuclear power plant, and economic loss caused by shutdown of the nuclear power plant due to misoperation of the execution mechanism can be effectively avoided.

Drawings

Fig. 1 is a block diagram of an ATWT control apparatus according to an embodiment.

FIG. 2 is a schematic diagram of a system architecture of a nuclear power plant in an embodiment.

FIG. 3 is a schematic diagram of a system architecture of a nuclear power plant in another embodiment.

Detailed Description

In order to make the objects, technical solutions and advantages of the present application more apparent, the present application is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present application and are not intended to limit the present application.

In the description of the present application, it is to be understood that the terms "center", "lateral", "upper", "lower", "left", "right", "vertical", "horizontal", "top", "bottom", "inner" and "outer" etc. indicate orientations or positional relationships based on those shown in the drawings, and are only for convenience in describing the present application and simplifying the description, but do not indicate or imply that the referred device or element must have a particular orientation, be constructed in a particular orientation, and be operated, and thus should not be construed as limiting the present application. Further, when an element is referred to as being "formed on" another element, it can be directly connected to the other element or intervening elements may also be present. When an element is referred to as being "connected" to another element, it can be directly connected to the other element or intervening elements may also be present. In contrast, when an element is referred to as being "directly on" another element, there are no intervening elements present.

The ATWT control device is used for controlling an execution mechanism of nuclear power equipment in a nuclear power plant to execute protection operation, and can effectively prevent misoperation of the execution mechanism, so that economic loss caused by accidental shutdown of the nuclear power plant is avoided. Fig. 1 is a block diagram of an ATWT control apparatus according to an embodiment. As shown in fig. 1, the ATWT control apparatus includes a control circuit 200 and at least two control stations 100.

Specifically, each control station 100 includes an IO module 110 and a controller 120. The IO module 110 includes an input module 111 and an output module 112. The input module 111 is used for receiving a first detection signal value of nuclear power equipment. The first detection signal value may be an analog quantity of current, voltage, power, etc. of the nuclear power plant, for example, the first detection signal value is a current value ranging from 4mA to 20 mA.

The controller 120 is connected to the IO module 110, and specifically, connected to the input module 111 and the output module 112 of the IO module 110. The controller 120 receives a first detection signal value of the nuclear power plant through the input module 111, and the controller 120 is configured to determine whether the first detection signal value is greater than a first threshold, trigger a driving signal when the first detection signal value is greater than the first threshold, and output the driving signal through the output module 112. Wherein the first threshold may be a bi-stable threshold. For example, after the controller 120 determines that the first detection signal value is greater than the first threshold, a high level signal is output; after the controller 120 determines that the first detection signal value is not greater than the first threshold, it outputs a low level signal and uses the high level signal as a driving signal. In other embodiments, the first detection signal value may also include a plurality of detection signal values, for example, both a current value and a power value of the nuclear power plant, and the controller 120 outputs the driving signal when determining that both the current value and the power value are greater than the first threshold.

The control circuit 200 is connected to the output module 112 of each control station 100. The control circuit 200 is configured to be connected to an actuator 500 of a nuclear power plant, and the control circuit 200 is configured to control the actuator 500 to perform a protection operation when each control station 100 outputs a driving signal. The actuators 500 include, but are not limited to, a shutdown circuit breaker, a steam turbine, a steam assisted feedwater pump, a steam generator blowdown valve, an electric feedwater flow control valve, and a steam feedwater flow control valve. Correspondingly, the actuator 500 performs protection operations including, but not limited to, shutdown breaker triggered ATWT trip protection, turbine triggered ATWT trip protection, pneumatic auxiliary feed pump pneumatic, steam generator blow-down valve closed, opening electric and pneumatic feed flow control valves in the auxiliary feed system.

For example, when the number of the control stations 100 is two, the control circuit 200 controls the actuator 500 to perform the protection operation when both the control stations 100 output the driving signal, that is, the two control stations 100 control the driving signal of the same actuator 500, and the two-out-of-two voting is implemented to drive the actuator 500 to perform the protection operation. For another example, when the number of the control stations 100 is three, the control circuit 200 controls the actuator 500 to perform the protection operation when all the three control stations 100 output the driving signals, that is, the three control stations 100 control the driving signals of the same actuator 500, and the "three-out-of-three" voting is implemented to drive the actuator 500 to perform the protection operation. The number of the control stations 100 is only required to be at least two. In this way, it is determined whether the actuator 500 performs the protection operation by determining whether all the control stations 100 output the driving signal, and it is possible to effectively prevent the actuator 500 from malfunctioning.

According to the ATWT control device, the plurality of control stations 100 control the same execution mechanism 500 to vote, and when all the control stations 100 output driving signals, the control circuit 200 controls the execution mechanism 500 to execute protection operation, so that reliable safety guarantee can be provided for safe operation of a nuclear power plant, and economic loss caused by shutdown of the nuclear power plant due to misoperation of the execution mechanism 500 can be effectively avoided.

In one embodiment, as shown in fig. 2, the nuclear power plant is provided with an alarm device 600, and the control circuit 200 is further connected to the alarm device 600 of the nuclear power plant. The input module 111 in the IO module 110 is further configured to receive a second detection signal value of the nuclear power equipment, and the controller 120 is further configured to determine whether the second detection signal value is greater than a second threshold, and trigger an alarm signal and output the alarm signal through the output module 112 after the second detection signal value is greater than the second threshold. The second detection signal value may be an analog quantity of current, voltage, power and the like of the nuclear power equipment, and the second detection signal value may be a bistable threshold value. For example, the second detection signal value may be the same detection value as the first detection signal value, for example, the second detection signal value and the first detection signal value are both current detection values of the nuclear power plant, and the second threshold value is set to a current value smaller than the first threshold value. In other embodiments, the second detection signal value may also be a detection value different from the first detection signal value.

The control circuit 200 is also used for controlling the alarm device 600 to alarm when at least one control station 100 outputs an alarm signal. For example, when the number of the control stations 100 is two, when any one of the control stations 100 outputs an alarm signal or both of the control stations 100 output an alarm signal, the control circuit 200 controls the alarm device 600 to alarm, that is, the alarm signal is output by a "two-to-one" vote. The alarm device 600 includes but is not limited to one or a combination of a light alarm device, a voice alarm device, a text prompt alarm device and a short message alarm device. For example, the alarm device 600 is an alarm lamp that is turned on when at least one control station 100 outputs an alarm signal. In the embodiment, when the second detection signal value of the nuclear power equipment is detected to be abnormal, an alarm is given to inform an operator of timely maintenance, and stable operation of the nuclear power equipment is facilitated.

Specifically, the ATWT control device can be manufactured into an independent type and installed in a cabinet of a nuclear power plant; the ATWT control device can also be made in a card style, which is first assembled into the cage and then installed in the cabinet.

The nuclear power equipment is provided with a detection module 700 for acquiring a first detection signal value, for example, the detection module 700 includes a current sensor for acquiring a current value of the nuclear power equipment. Correspondingly, the ATWT control apparatus further includes a detection module interface connected to the input module 111, the detection module interface being configured to be connected to the detection module 700 by a hardware line to obtain the first detection signal value.

The ATWT control device further comprises an actuator interface connected to the control circuit 200, the actuator interface being adapted to be hardwired to the actuator 500. The ATWT further includes an internal interface, the IO module 110 and the controller 120 are communicatively connected by a communication bus through the internal interface, and the output module 112 and the control circuit 200 are connected by a hardware line through the internal interface. In other embodiments, the detection module 700 is further configured to collect a second detection signal value, the control station 100 obtains the second detection signal value through a detection module interface, and the ATWT control apparatus further includes an alarm interface connected to the control circuit 200, and the alarm interface is configured to be connected to the alarm apparatus 600 by a hardware line.

In this embodiment, a plurality of control stations 100 independently perform signal acquisition and processing, each control station 100 is connected to other devices (the control circuit 200, the detection module 700 in the nuclear power plant, the execution mechanism 500, the alarm device 600, and the like) through a hardware line, and the two control stations 100 are independent from each other and have no communication relationship. In this way, errors, delays, etc. in the transmission of data due to differences in the communication network can be avoided to cause control errors in the actuator 500 and the alarm device 600.

In one embodiment, the ATWT control apparatus further comprises a first isolation assignment module 810 coupled to the input modules 111 of all of the control stations 100, the first isolation assignment module 810 configured to divide the first detected signal value into a plurality of signals and assign the plurality of signals to the respective control stations 100. Further, the ATWT control apparatus may further include a second isolation assignment module 820 connected to all of the input modules 111, the second isolation assignment module 820 being configured to divide the second detection signal values into a plurality of signals and assign the plurality of signals to the respective control stations 100.

For example, when the number of the control stations 100 is two, the first isolation allocation module 810 isolates and allocates a first detection signal value (such as a 4mA to 20mA current signal) into two 4mA to 20mA current signals based on an analog technology design, and inputs the two 4mA to the input modules 111 of the two control stations 100 through the detection module interfaces, respectively.

In one embodiment, the controller 120 includes an FPGA controller, and correspondingly, the IO module 110 in the control station 100 may also be based on an FPGA design. The IO module 110 and the FPGA controller 120 can both diagnose their own faults, the IO module 110 can transmit fault information to the FPGA controller 120 for processing, and correspondingly, an alarm signal can be triggered to alarm when the FPGA controller 120 diagnoses the IO module 110 fault or its own fault. In addition, a filtering unit and an isolation unit may be further disposed in the IO module 110 to implement a filtering function and a function of electrically isolating from the outside.

The input module 111 of the IO module 110 includes an analog input module AI and a digital input module DI (not shown in the figure), and the analog input module AI receives the first detection signal value and the second detection signal value through the detection module interface. The first detection signal value and the second detection signal value received by the analog input module AI may be active signals or passive signals. The ATWT control device may also receive an externally input digital signal through the digital input module DI for other uses, and the digital signal received by the digital input module DI is a passive dry contact signal.

The output module 112 in the IO module 110 includes a digital output module DO, and the control station 100 outputs a digital signal as a trigger signal and an alarm signal through the digital output module DO, and sets a digital signal "0" or "1" as the trigger signal according to an actual requirement and sets a digital signal "0" or "1" as the alarm signal according to the actual requirement.

The controller 120 performs an analog operation after receiving the first detection signal value and the second detection signal value. The controller 120 may perform application configuration according to actual applications, specifically, the algorithm configuration is realized through an FPGA programming language, the configuration logic may realize steady-state threshold judgment through a bistable threshold algorithm except for the application algorithm, and set a bistable threshold (a first threshold and a second threshold), the controller 120 triggers a driving signal and outputs the driving signal to the control circuit 200 through the digital output module DO when the first detection signal value is greater than the first threshold, and triggers an alarm signal and outputs the alarm signal to the control circuit 200 through the digital output module DO when the second detection signal value is greater than the second threshold. Since the controller 120 in this embodiment adopts the FPGA controller 120, the controller 120 can not only diagnose the fault itself, but also receive or transmit the validity information of the input/output signal, so that the final control output is a fail-safe state.

In this embodiment, the ATMT control device performs function redundancy configuration based on the FPGA technology, and determines whether to output a trigger signal and an alarm signal by determining the size of a detection signal and a threshold value, and compared with a conventional method in which an analog technology control device or a digital control device of a PLC or a DCS controls an execution mechanism and an alarm device in an ATWT design of an operating nuclear power plant, since the control station 100 has a self-diagnosis function, the overall reliability is higher, the maintainability is better, software common cause failure caused by a software-based digital technology is avoided, and the operation of a unit in nuclear power equipment is more reliable; and because the FPGA technology has the diversity of an analog technology and a microprocessor digitization technology, the ATWT control device can be particularly applied to ATWT control of a nuclear power equipment protection system which adopts an analog technology or a microprocessor digitization technology, and can still meet the diversity requirement of the protection system even after the protection system of the nuclear power equipment is digitally transformed.

In an embodiment, referring to fig. 2, a nuclear power plant is provided with a driving power supply 400. The control circuit 200 includes a plurality of normally-on first switching units 210. The number of the first switching units 210 is the same as that of the control station 100, and each of the first switching units 210 is connected in series between the driving power source 400 and the actuator 500. Each of the first switch units 210 is connected to the output module 112 of one of the control stations 100, and when the first switch unit 210 receives a driving signal, the first switch unit 210 is turned on. The actuator 500 performs a protection operation after all the first switching units 210 are closed.

Illustratively, the number of control stations 100 is two. The first switch unit 210 is a relay, and the relays all use normally open contacts, that is, the contacts of the relay are in an off state when the relay is in an uncharged state. Each digital output DO of the control station 100 controls a set of relays, respectively, and when the digital output DO of the control station 100 outputs a driving signal to a corresponding relay, the contacts of the relay are actuated, so that the contacts are closed. The contacts of the relays are sequentially connected in series between the driving power supply 400 and the executing mechanism 500, and only when the two control stations 100 respectively output driving signals to the corresponding relays, after the contacts of the two relays are closed, the executing mechanism 500 is conducted with the driving power supply 400, and the executing mechanism 500 is triggered by electricity to execute protection operation. In this embodiment, two-out-of-two voting of the two control stations 100 is realized by connecting two relay contacts in series, and then the two relay contacts are connected in series to the driving power supply 400 and the actuating mechanism 500 of the nuclear power equipment to form a loop, so as to avoid false operation of the actuating mechanism 500.

In another embodiment, referring to fig. 3, the control circuit 200 includes a plurality of second switch units 220 in a normally closed state, the number of the second switch units 220 is the same as that of the control station 100, and each of the second switch units 220 is connected between the driving power source 400 and the actuator 500 in parallel. Each of the second switching units 220 is connected to the output module 112 of one of the control stations 100, and when the second switching units 220 receive the driving signal, the second switching units 220 are turned off, and the actuator 500 performs the protection operation after all the second switching units 220 are turned off.

Illustratively, the number of control stations 100 is two. The second switch unit 220 is a relay, and the relay is a normally closed contact, that is, the contact is in a closed state when the relay is in an uncharged state. Each digital output DO of the control station 100 controls a set of relays, respectively, and when the digital output DO of the control station 100 outputs a driving signal to the corresponding relay, the contacts of the relay are actuated, so that the contacts are opened. The contacts of the relays are connected in parallel and then connected between the driving power supply 400 and the executing mechanism 500, and only when the two control stations 100 respectively output driving signals to the corresponding relays, the executing mechanism 500 is disconnected from the driving power supply 400 after the contacts of the two relays are both operated and disconnected, and the executing mechanism 500 is triggered when power is lost to execute protection operation. In this embodiment, two-out-of-two voting of the two control stations 100 is realized by connecting two relay contacts in parallel, and then the two relay contacts are connected in series to the driving power supply 400 and the actuating mechanism 500 of the nuclear power equipment to form a loop, and when any one or both of the relays act, the driving power supply 400 and the actuating mechanism 500 are both conducted, so that malfunction of the actuating mechanism 500 is avoided.

Furthermore, a protective resistor can be arranged between two parallel-connected relay contacts to prevent the circuit from being burnt by overlarge short-circuit current between the two contacts.

In one embodiment, the control circuit 200 includes a plurality of normally open third switching units 230, the number of the third switching units 230 is the same as that of the control station 100, and each of the third switching units 230 is connected in parallel between the driving power supply 400 and the alarm device 600. Each third switching unit 230 is connected to an output module 112 of one control station 100, and when the third switching unit 230 receives an alarm signal, the second switching unit 220 is closed. The alarm unit alarms after at least one third switching unit 230 is closed.

Illustratively, the number of control stations 100 is two. The third switching unit 230 is a relay, and the relays all use normally open contacts, that is, the contacts of the relay are in an off state when the relay is in an uncharged state. Each digital output DO of the control station 100 controls a group of relays, and when the digital output DO of the control station 100 outputs an alarm signal to a corresponding relay, the contacts of the relay act, so that the contacts are closed. The contacts of the relays are connected in parallel and then connected between the driving power supply 400 and the actuator 500, any one control station 100 outputs an alarm signal to the corresponding relay so that the contact of any one relay is closed after action or two control stations 100 output the alarm signal to the corresponding relay, the contacts of the two relays are closed, the actuator 500 and the driving power supply 400 are conducted, and the alarm device 600 gives an alarm (such as an alarm lamp is turned on to give an alarm). In this embodiment, "two is one" voting of two control stations 100 is realized through two relay contacts connected in parallel, and then is connected in series to drive power supply 400 and the alarm lamp of nuclear power equipment in order to constitute a return circuit, and when any one of them relay action or two relays all act, all switch on between drive power supply 400 and the alarm lamp, the alarm lamp lights the warning, and operating personnel can in time maintain.

Furthermore, a protective resistor can be arranged between two parallel-connected relay contacts to prevent the circuit from being burnt by overlarge short-circuit current between the two contacts.

The application also provides nuclear power equipment. The nuclear power plant includes a detection module 700, an actuator 500, and an ATWT control apparatus as in any of the embodiments described above. The detection module 700 is configured to collect a current signal of a nuclear power plant as a first detection signal value. The actuator 500 is used to perform a protection operation. The ATWT control apparatus is connected to the detection module 700 and the actuator 500, and outputs the trigger signal when the control station 100 in the ATWT control apparatus determines that the first detection signal value is greater than the first threshold, and controls the actuator 500 to perform the protection operation when the control circuit 200 in the ATWT control apparatus determines that all the control stations 100 output the trigger signal.

The actuators 500 include, but are not limited to, a shutdown circuit breaker, a steam turbine, a steam assisted feedwater pump, a steam generator blowdown valve, an electric feedwater flow control valve, and a steam feedwater flow control valve. Correspondingly, the actuator 500 performs protection operations including, but not limited to, shutdown breaker triggered ATWT trip protection, turbine triggered ATWT trip protection, pneumatic auxiliary feed pump pneumatic, steam generator blow-down valve closed, opening electric and pneumatic feed flow control valves in the auxiliary feed system.

According to the nuclear power equipment, the control circuit 200 controls the same execution mechanism 500 to vote through the control stations 100, and when the control stations 100 output driving signals, the control circuit 200 controls the execution mechanism 500 to execute protection operation, so that reliable safety guarantee can be provided for safe operation of a nuclear power plant, and economic loss caused by shutdown of the nuclear power plant due to misoperation of the execution mechanism 500 can be effectively avoided.

Further, the nuclear power plant may further include an alarm device 600, and the control circuit 200 is further configured to be connected to the alarm device 600. The detection module 700 is further configured to collect a second detection signal value of the nuclear power plant. The input module 111 is further configured to receive a second detection signal value of the nuclear power plant. The controller 120 is further configured to determine whether the second detection signal value is greater than a second threshold, and trigger an alarm signal and output the alarm signal through the output module 112 after the second detection signal value is greater than the second threshold. The control circuit 200 is also used for controlling the alarm device 600 to alarm when at least one control station 100 outputs an alarm signal.

The technical features of the embodiments described above may be arbitrarily combined, and for the sake of brevity, all possible combinations of the technical features in the embodiments described above are not described, but should be considered as being within the scope of the present specification as long as there is no contradiction between the combinations of the technical features.

The above-mentioned embodiments only express several embodiments of the present invention, and the description thereof is more specific and detailed, but not construed as limiting the scope of the invention. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the inventive concept, which falls within the scope of the present invention. Therefore, the protection scope of the present patent shall be subject to the appended claims.