Protection system for transferring turbine and steam generator operation to a backup mode especially adapted for multiple computer electric power plant control systems

Claim 2

A control system for an electric power plant having at least one steam turbine and a steam generator, said control system comprising multiple digital computers including at least a first digital computer and a second digital computer, means for generating input signals representing predetermined process variables associated with said steam generator, means for generating input signals representing predetermined process variables associated with said steam turbine, means for coupling the input signals to both of said computers, each of said computers including substantially identical control elements which generate control outputs as a function of input signals in various control loops, means for coupling the control outputs of each computer to controllable elements of said steam generator and said steam turbine, means for sensing predetermined circuit conditions representing malfunctions in said input signal coupling means for each computer, means for sensing predetermined circuit conditions representing malfunctions in said control output coupling means for each computer, means for sensing predetermined computer conditions indirectly related to said computer control elements and representing malfunctions in the operation of each of said computers, means for substantially conforming the structure of one of said computers in a standby state to the structure of the other and controlling one of said computers in real time including means for generating control outputs in the one standby computer substantially equal to those from said other controlling computer, and means for operating said output coupling means normally to connect the outputs of said controlling computer to the steam generator and turbine controllable elements and to connect the outputs of said standby computer to the steam generator and turbine controllable elements when said sensing means detects a control system malfunction associated with the controlling computer so as to execute a transfer in the control of the steam generator and the turbine from said one computer to said other computer substantially without disturbing the plant power generation.

Claim 3

A control system as set forth in claim 1 wherein said output couPling means includes at least one contact closure output system having a plurality of output contacts for each of said computers, means are provided for detecting whether the computer output contacts function in accordance with computer output contact signals, and wherein said operating means responds to said detecting means to operate said output coupling means and execute a computer transfer when a computer output contact failure is detected.

Claim 4

A control system as set forth in claim 1 wherein said output coupling means includes at least one contact closure output system having a plurality of output contacts for each of said computers, said input signal coupling means includes at least one contact closure input system having a plurality of contacts for each of said computers, means are provided for coupling predetermined process logic signals commonly to said contact closure input systems, means are provided for operating said contact closure output system to operate input contacts in said contact closure input system and to detect failures in the operation of such input contacts, and wherein said operating means responds to the latter operating and detecting means to operate said output coupling means and execute a computer transfer when an input contact failure is detected.

Claim 5

A control system as set forth in claim 1 wherein said input signal coupling means includes at least one system for converting analog input signals to digital signals for each of said computers, means for coupling predetermined process analog signals commonly to said analog to digital converting systems, each of said converting systems includes a plurality of point relays associated with respective process analog signals and operative to channel the process analog signals in said converting system for conversion to digital signals, means are provided for selectively operating said point relays to generate selected analog signal inputs, means are provided for detecting whether said selective point relay operating means is operating point relays other than selected point relays, and wherein said operating means for said output coupling means responds to said detecting means to operate said output coupling means and execute a computer transfer when a point relay selection malfunction is detected.

Claim 6

A control system as set forth in claim 1 wherein said input signal coupling means includes at least one system for converting analog input signals to digital signals for each of said computers, means for coupling predetermined process analog signals commonly to said analog to digital converting systems, means are provided for detecting errors in the conversion of analog signals to digital signals in each of said converting systems, and wherein said operating means responds to said detecting means to operate said output coupling means and execute a computer transfer when the conversion error associated with the controlling computer reaches a predetermined condition.

Claim 7

A control system as set forth in claim 1 wherein each of said computers includes means for detecting the generation of predetermined task errors in the operation of preselected program elements, and wherein said operating means responds to said detecting means to operate said output coupling means and execute a computer transfer when a computer task error is detected.

Claim 8

A control system as set forth in claim 1 wherein each of said computers include means for detecting whether a preselected task is performed at a preselected priority level within a predefined time period, and wherein said operating means responds to said detecting means to operate said output coupling means and execute a computer transfer when said detecting means indicates a task failure and the presence of tight loop operation.

Claim 9

A control system as set forth in claim 1 wherein each of said computers includes a core memory having a plurality of word locations, means are provided for generating electric signals to detect whether a parity bit in each of at least some core words is correctly set to indicate the number of set bits in its word, and wherein said operating means responds to the latter generating means to operate said output coupling means and execute a computer transfer when a parity error is detected.

Claim 10

A control system as set forth in claim 1 wherein means are provided for generating signals indicative of predetermined data to be linked from the controlling computer to the standby computer and for coupling the signals to the standby computer, means are provided for detecting predetermined malfunction in said generating and coupling means, and wherein said operating means responds to said generating and coupling means to operate said output coupling means and execute a computer transfer when a data link malfunction is detected.

Claim 11

A control system as set forth in claim 9 wherein said coupling and generating means includes a coupling circuit and said detecting means includes means for detecting a failure in the operation of the coupling circuit.

Claim 12

A control system as set forth in claim 10 wherein said coupling and generating means further includes means forming a part of each computer for handling data to be linked to the other computer, and said detecting means further includes means for detecting the generation of predetermined task errors in the operation of said data link handling means.

Claim 13

A control system as set forth in claim 9 wherein means are provided for inhibiting automatic control by the standby computer after it comes into control following a transfer caused by a data link malfunction.

Claim 14

A control system as set forth in claim 1 wherein said input signal coupling means includes at least one system for converting analog input signals to digital signals for each of said computers, means for coupling predetermined process analog signals commonly to said analog to digital converting system, each of said converting systems include a plurality of point relays associated with respective process analog signals and operative to channel the process analog signals in said converting systems for conversion to digital signals, means are provided for selectively operating said point relays to generate selected analog signal inputs, means are provided for detecting whether said point relays operate when selected for operation, and wherein said operating means for said output coupling means responds to said detecting means to operate said output coupling means and execute a computer transfer when a point relay failure is detected.

Claim 15

A control system as set forth in claim 13 wherein means are provided for detecting whether said selective point relay operating means is operating point relays other than selected point relays, and wherein said operating means for said output coupling means responds to the latter detecting means to operate said output coupling means and execute a computer transfer when a point relay selection malfunction is detected.

Claim 16

A control system as set forth in claim 14 wherein said output coupling means includes at least one contact closure output system having a plurality of output contacts for each of said computers, said input signal coupling means includes at least one contact closure input system having a plurality of contacts for each of said computers, means are provided for coupling predetermined process logic signals commonly to said contact closure input systems, means are provided for operating said contact closure output system to operate input contacts in said contact closure input system and to detect failures in the operation of such input contacts, means are provided for detecting whether the computer output contacts function in accordance with computer output contact signals, and wherein said operating means further responds to said input and output contact detecting means to operate said output coupling means and execute a computer transfer when a computer input or output contact failure is detected.

Claim 17

A plant for generating electric power comprising at least a steam generator and a steam turbine and a control system, a plurality of throttle and governor valves for directing steam from said steam generator to said turbine, said control system comprising multiple digital computers including at least a first digital computer and a second digital computer, means for controlling the position of said governor and throttle valves, means for generating input signals representing predetermined process variables associated with said steam generator, means for generating input signals representing predetermined process variables associated with said steam turbine, means for coupling the input signals to both of said computers, each of said computers including substantially identical control elements which generate control outputs as a function of input signals in various control loops, means for coupling the control outputs of each computer to said valve position controlling means and other controllable elements of said steam generator and said steam turbine, means for sensing predetermined circuit conditions representing malfunctions in said input signal coupling means for each computer, means for sensing predetermined circuit conditions representing malfunctions in said control output coupling means for each computer, means for sensing predetermined computer conditions indirectly related to said computer control elements and representing malfunctions in the operation of each of said computers, means for substantially conforming the structure of one of said computers in a standby state to the structure of the other and controlling one of said computers in real time including means for generating control outputs in the one standby computer substantially equal to those from said other controlling computer, and means for operating said output coupling means normally to connect the outputs of said controlling computer to the steam generator and turbine controllable elements and to connect the outputs of said standby computer to the steam generator and turbine controllable elements when said sensing means detects a control system malfunction associated with the controlling computer so as to execute a transfer in the control of the steam generator and the turbine from said one computer to said other computer substantially without disturbing the plant power generation.

Claim 18

A plant for generating electric power comprising at least a steam generator and a steam turbine and a control system, a plurality of throttle and governor valves for directing steam from said steam generator to said turbine, said control system comprising multiple digital computers including at least a first digital computer and a second digital computer, means for controlling the position of said governor and throttle valves, means for generating input signals representing predetermined process variables associated with said steam generator, means for generating input signals representing predetermined process variables associated with said steam turbine, means for coupling the input signals to both of said computers, each of said computers including substantially identical control elements which generate control outputs as a function of input signals in various control loops, means for coupling the control outputs of each computer to said valve position controlling means and other controllable elements of said steam generator and said steam turbine, means for sensing predetermined circuit conditions representing malfunctions in said input signal coupling means for each computer, means for sensing predetermined circuit conditions representing malfunctions in said control output coupling means for each computer, means for sensing predetermined computer conditions indirectly related to said computer control elements and representing malfunctions in the operation of each of said computers, means for substantially conforming the structure of one of said computers in a standby state to the structure of the other and controlling one of said computers in real time including means for generating control outputs in the one standby computer substantially equal to those from said other controlling computer, and means for operating said output coupling means normally to connect the outputs of said controlling computer to the steam generator and turbine controllable elements and to connect the outputs of said standby computer to the steam generator and turbine controllable elements when said sensing means detects a control system malfunction associated with the controlling computer so as to execute a transfer in the control of the steam generator and the turbine from said one computer to said other computer substantially without disturbing the plant power generation.

Claim 19

An electric power plant as set forth in claim 16 wherein said output coupling means includes at least one contact closure output system having a plurality of output contacts for each of said computers, means are provided for detecting whether the computer output contacts function in accordance with computer output contact signals, and wherein said operating means responds to said detecting means to operate said output coupling means and execute a computer transfer when a computer output contact failure is detected.

Claim 20

An electric power plant as set forth in claim 16 wherein said output coupling means includes at least one contact closure output system having a plurality of output contacts for each of said computers, said input signal coupling means includes at least one contact closure input system having a plurality of contacts for each of said computers, means are provided for coupling predetermined process logic signals commonly to said contact closure input systems, means are provided for operating said contact closure output system to operate input contacts in said contact closure input system and to detect failures in the operation of such input contacts, and wherein said operating means responds to the latter operating and detecting means to operate said output coupling means and execute a computer transfer when an input contact failure is detected.

Claim 21

An electric power plant as set forth in claim 16 wherein said input signal coupling means includes at least one system for converting analog input signals to digital signals for each of said computers, means for coupling predeterminEd process analog signals commonly to said analog to digital converting system, each of said converting systems include a plurality of point relays associated with respective process analog signals and operative to channel the process analog signals in said converting systems for conversion to digital signals, means are provided for selectively operating said point relays to generate selected analog signal inputs, means are provided for detecting whether said point relays operate when selected for operation, and wherein said operating means for said output coupling means responds to said detecting means to operate said output coupling means and execute a computer transfer when a point relay failure is detected.

Claim 22

An electric power plant as set forth in claim 16 wherein means are provided for generating signals indicative of predetermined data to be linked from the controlling computer to the standby computer and for coupling the signals to the standby computer, means are provided for detecting predetermined malfunctions in said generating and coupling means, and wherein said operating means responds to said generating and coupling means to operate said output coupling means and execute a computer transfer when a data link malfunction is detected, and wherein means are provided for inhibiting automatic control by the standby computer after it comes into control following a transfer caused by a data link malfunction.

Claim 23

A steam turbine system operative to receive motive steam and drive an electric generator and produce electric power, said turbine comprising a plurality of turbine sections, a plurality of throttle and governor valves for directing steam through said turbine sections, and a control system having multiple digital computers including at least a first digital computer and a second digital computer, means for controlling the position of said governor and throttle valves, for generating input signals representing predetermined process variables associated with said steam turbine, means for coupling the input signals to both of said computers, each of said computers including substantially identical control elements which generate control outputs as a function of input signals in various control loops, means for coupling the control outputs of each computer to said valve position controlling means, means for sensing predetermined circuit conditions representing malfunctions in said input signal coupling means for each computer, means for sensing predetermined circuit conditions representing malfunctions in said control output coupling means for each computer, means for sensing predetermined computer conditions indirectly related to said computer control elements and representing malfunctions in the operation of each of said computers, means for substantially conforming the structure of one of said computers in a standby state to the structure of the other and controlling one of said computers in real time including means for generating control outputs in the one standby computer substantially equal to those from said other controlling computer, and means for operating said output coupling means normally to connect the outputs of said controlling computer to the turbine valve position controlling means and to connect the outputs of said standby computer to the turbine valve controlling means when said sensing means detects a control system malfunction associated with the controlling computer so as to execute a transfer in the control of the turbine from said one computer to said other computer substantially without disturbing the plant power generation.

Claim 24

A steam turbine system operative to receive motive steam and drive an electric generator and produce electric power, said turbine comprising a plurality of turbine sections, a plurality of throttle and governor valves for directing steam through said turbine sections, and a control system having multiple digital computers including at least a first digital computer and a second digital computer, means for controlling the position of said governor and throttle valves, for generating input signals representing predetermined process variables associated with said steam turbine, means for coupling the input signals to both of said computers, each of said computers including substantially identical control elements which generate control outputs as a function of input signals in various control loops, means for coupling the control outputs of each computer to said valve position controlling means, means for sensing predetermined circuit conditions representing malfunctions in said input signal coupling means for each computer, means for sensing predetermined circuit conditions representing malfunctions in said control output coupling means for each computer, means for sensing predetermined computer conditions indirectly related to said computer control elements and representing malfunctions in the operation of each of said computers, means for substantially conforming the structure of one of said computers in a standby state to the structure of the other and controlling one of said computers in real time including means for generating control outputs in the one standby computer substantially equal to those from said other controlling computer, and means for operating said output coupling means normally to connect the outputs of said controlling computer to the turbine valve position controlling means and to connect the outputs of said standby computer to the turbine valve controlling means when said sensing means detects a control system malfunction associated with the controlling computer so as to execute a transfer in the control of the turbine from said one computer to said other computer substantially without disturbing the plant power generation.

Claim 25

An electric power plant as set forth in claim 21 wherein said output coupling means includes at least one contact closure output system having a plurality of output contacts for each of said computers, means are provided for detecting whether the computer output contacts function in accordance with computer output contact signals, and wherein such operating means responds to said detecting meAns to operate said output coupling means and execute a computer transfer when a computer output contact failure is detected.

Claim 26

An electric power plant as set forth in claim 21 wherein said input signal coupling means includes at least one system for converting analog input signals to digital signals for each of said computers, means for coupling predetermined process analog signals commonly to said analog to digital converting system, each of said converting systems include a plurality of point relays associated with respective process analog signals and operative to channel the process signals in said converting systems for conversion to digital signals, means are provided for selectively operating said point relays to generate selected analog signal inputs, means are provided for detecting whether said point relays operate when selected for operation, and wherein said operating means for said output coupling means responds to said detecting means to operate said output coupling means and execute a computer transfer when a point relay failure is detected.

Claim 27

An electric power plant as set forth in claim 21 wherein means are provided for generating signals indicative of predetermined data to be linked from the controlling computer to the standby computer and for coupling the signals to the standby computer, means are provided for detecting predetermined malfunctions in said generating and coupling means, and wherein said operating means responds to said generating and coupling means to operate said output coupling means and execute a computer transfer when a data link malfunction is detected, and wherein means are provided for inhibiting automatic control by the standby computer after it comes into control following a transfer caused by a data link malfunction.

Claim 28

An electric power plant as set forth in claim 21 wherein said output coupling means includes at least one contact closure output system having a plurality of output contacts for each of said computers, said input signal coupling means includes at least one contact closure input system having a plurality of contacts for each of said computers, means are provided for coupling predetermined process logic signals commonly to said contact closure input systems, means are provided for operating said contact closure output system to operate input contacts in said contact closure input system and to detect failures in the operation of said input contacts, and wherein said operating means responds to the latter operating and detecting means to operate said output coupling means and execute a computer transfer when an input contact failure is detected.