Abstract: A protection system for a complex process has four redundant protection sets, each of which produces partial reactor trip and partial safeguard actuation signals in pairs of microprocessor-based controllers. Two independent and redundant voting logic trains are provided for the partial reactor trip signals, and two identical, independent and redundant voting logic trains are provided for the partial safeguard actuation signals. Each of the trains includes a pair of redundant microprocessor-based voting logic controllers, each of which receives the partial reactor trip or partial safeguard actuation signals from each of the process protection sets and has a voting processor which generates an intermediate reactor trip or intermediate safeguard actuation signal in response to partial signals from a predetermined number of protection sets. The intermediate signals from the two voting logic controllers in each train are ANDed to generate train signals.

Abstract: Updated images of messages are passed between asynchronous digital processors using dual port shared memory. In the basic form of the invention, three buffers in shared memory are assigned to each message. Where one of the processors is a controller for a data link channel carrying n messages, 2n+1 buffers are provided in free shared memory space with 2 buffers assigned to each message at all times and a common buffer serving as the third buffer for all of the messages. Where linked buffers in local memory of a controller processor receive message updates from a data highway, two buffers in shared memory are assigned to each message and a linked buffer in the controller local memory serves as the third buffer. The buffers containing the message updates are passed between processors by use of a buffer status array in shared memory. A semaphore lock in the array permits only one processor at a time to assign or release buffers.

Abstract: A signal processor which applies non-linear dynamic compensation to an applied analog signal is tested by applying to a reference ramp signal compensation having a transfer function equal to the inverse of the transfer function of the signal processor. This test signal is applied to the signal processor in place of the sensor signal so that after the compensation of the processor is applied to it, the resultant signal should match the reference signal. When the signal processing is carried out digitally in a microcomputer and the response to the test signal is multiplexed back to the tester along with response signals from other microcomputers, variable time skewing of the returned test signal is eliminated by feeding the reference signal through a processing path parallel to that of the test signal and then comparing those two signals in the tester.

Abstract: An analog output network provides multiple communication paths for control of an actuator in response to an input signal. The analog output network includes at least two controllers, each of which is connected to an analog output circuit and a controller selector which is connected to each of the controllers and the analog output circuits. The controller selector ensures that at least one of the analog output circuits is enabled at all times and identifies one of the controllers as an on-line controller. The analog output circuit connected to the on-line controller generates an actuation signal which passes through the actuator and the other analog output circuit. An alternate current path comprising a diode string with a voltage drop larger than the voltage drop of the actuation signal in the other analog output circuit is provided so that if an analog output circuit is removed or defective, the actuation signal from the on-line analog output circuit is still provided with a current path.

Abstract: A speed feedback loop for load control regulation of a steam turbine. A difference between rated and actual turbine speed results in a speed error to which a deadband function is applied. Operation is such that the deadband, rather than being centered about a fixed value, moves as a function of speed error.

Abstract: A valve test system for closing off certain governor valves under steam flow conditions while still maintaining a substantially constant steam flow. A plurality of valve position demand signals is calculated for the respective governor valves with the signals being fully compensated with respect to non-linear flow characteristics of the valve. A valve test signal is injected in the control arrangement prior to the calculation of the valve position demand signals and causes closures of the valves under test and a proportionate further opening of the remaining valves.

Abstract: An electric power plant including a steam generator and a steam turbine is operated by a control system including two redundant digital computers. Switching circuitry is provided for coupling one of the computers through interface equipment to the steam generator and the turbine and a generator according to programmed computer control. A data link is established between the computers to transfer manual/automatic status and other needed data from the control computer to the standby computer. A system is provided for detecting when certain hardware and software malfunctions have occurred and for responsively transferring control to the standby computer. The standby computer is tracked to the control computer so that control computer transfer can be made reliably without disturbing the electric power generation process. The turbine control includes a load control loop which is implemented with computer operations.