Abstract: A component interface module (CIM) arbitrates through priority logic component command signals from redundant systems and integrates the selected priority command signal with component feedback signals in component logic to generate a control signal for a component in a complex plant. The non-software based CIM is programmable for use with a variety of plant components. The component logic includes blocking logic that prevents or terminates generation of the control signal such as when component activation has been completed. Diagnostics incorporated into the CIM include: an input port interface test, a pulse test that continuously checks for proper propagation of test pulses through the priority and component logic, and a test of the functioning of the CIM output device such as a relay.

Abstract: A component interface module (CIM) arbitrates through priority logic component command signals from redundant systems and integrates the selected priority command signal with component feedback signals in component logic to generate a control signal for a component in a complex plant. The non-software based CIM is programmable for use with a variety of plant components. The component logic includes blocking logic that prevents or terminates generation of the control signal such as when component activation has been completed. Diagnostics incorporated into the CIM include: an input port interface test, a pulse test that continuously checks for proper propagation of test pulses through the priority and component logic, and a test of the functioning of the CIM output device such as a relay.

Abstract: A protection system for a complex process has four redundant protection sets, each of which produces partial reactor trip and partial safeguard actuation signals in pairs of microprocessor-based controllers. Two independent and redundant voting logic trains are provided for the partial reactor trip signals, and two identical, independent and redundant voting logic trains are provided for the partial safeguard actuation signals. Each of the trains includes a pair of redundant microprocessor-based voting logic controllers, each of which receives the partial reactor trip or partial safeguard actuation signals from each of the process protection sets and has a voting processor which generates an intermediate reactor trip or intermediate safeguard actuation signal in response to partial signals from a predetermined number of protection sets. The intermediate signals from the two voting logic controllers in each train are ANDed to generate train signals.

Abstract: Prioritization logic determines the final command applied to a process control component from a plurality of commands generated by diverse independent control subsystems, each utilizing different hardware and software to implement a common algorithm to preclude common mode failures. In one embodiment, priority is given to commands generated by one control subsystem, such as a safety grade subsystem, over commands provided by a second, non-safety grade control subsystem. In another embodiment, equal priority is given to commands from two control subsystems. In this case, ambiguous commands from either or both subsystems are ignored, but conflicting commands produce a final command which provides a safe state.

Abstract: A method of automatically realigning a steam generator secondary piping system, such as the feedwater system, in the event of a pipe break to a given steam generator in a system having plural steam generators sharing, in part, a common secondary piping system. A feedwater line break is identified by monitoring the respective generators' steam exit line pressures and comparing the several pressures to a first predetermined setpoint. If any one of the several monitored pressures falls below the first setpoint the main steam line isolation valves are automatically closed and the respective generator pressures are again monitored and compared to a second predetermined setpoint. The feedwater line to the generator then exhibiting a drop in pressure below the second setpoint is isolated and the remaining generator main steam line isolation valves may be opened to return the functional intact generators to the system.