WO1996020439A1

WO1996020439A1 - Computer-assisted device for detecting the cause of a malfunction in a technical plant

Info

Publication number: WO1996020439A1
Application number: PCT/DE1995/001792
Authority: WO
Inventors: Heinrich Reiner; Heinrich Pfadler
Original assignee: Siemens Aktiengesellschaft
Priority date: 1994-12-27
Filing date: 1995-12-14
Publication date: 1996-07-04

Abstract

The invention concerns a computer-assisted device for detecting the cause of an incident in a technical plant, the incident possibly triggering deceleration of the technical plant in an operationally reliable state of the plant. The device comprises the following components: a) a plant-specific incident decision tree (STEB) stored in a memory (16); b) means (14a to 14c) for linking, in a manner which can be differentiated in terms of time, plant top signals (8a to 8c), which can be measured even in the event of an incident, to decision criteria arranged in the incident decision tree (STEB) in a logical hierarchy; c) means (14a to 14c) for triggering a decision locating the cause of the incident according to the result of the preceding linkage and a possible further decision path, following the preceding linkage in a logical hierarchy, in the incident decision tree (STEB); and d) means (18) for displaying the corresponding incident decision tree (STEB).

Description

description

Computer-aided device for recognizing a cause of an accident in a technical installation

The invention relates to a computer-aided device for recognizing a cause of an accident in a technical system that triggers a malfunction, the malfunction possibly triggering a shutdown of the technical system into an operationally safe system state.

A technical plant, such as a fossil-fueled or nuclear power plant, or a production plant or a process plant, usually has a system for processing process data. Such a system can be part of a distributed real-time process information system in which large amounts of data have to be recorded, processed and processed and are to be represented visually. A real-time process information system is usually integrated in the control system of the technical system.

With increasing use of energy and / or work of such technical systems and with increasing security standards, in particular in the case of a nuclear power plant, the requirements for the system for processing the measurement data of the technical system also increase.

In the technical plant, for example, a malfunction can occur, which triggers the shutdown of a production line in a manufacturing plant or, for example, even a rapid reactor shutdown in a nuclear power plant. In such operating phases, the plant operator is willing to identify and control one or more causes of the malfunction which cause the malfunction particularly quickly, so that the malfunction caused by the malfunction Damage to materials and / or people and the environment remains as low as possible.

The strategy of accident management, e.g. According to the operating manual of the technical system, it is usually designed in such a way that there are basically two ways in which the technical system can be brought into a safe operating state in the event of an accident. The first, event-oriented way is to identify a fault failure with the help of a fault decision tree and then to bring the system into a long-term safe state in accordance with the assigned description in the operating manual. The second, protection-goal-oriented path is only followed if the accident cannot be clearly classified according to the first event-oriented path, or if a criterion for the violation of a particularly important protection target is reached.

The event-oriented driving style is relieved to a certain degree by the possibility of a protection-oriented driving style, because it is no longer the only way to master accidents. In principle, however, it has so far been customary for an operator of the technical system to make the decision in the event of a fault using the fault decision tree described in the operating manual as to which cause of the fault is or has existed. For this purpose, the operator usually has to read individual displays in the control room of the technical system in a relatively short time and use them, for example, to answer yes / no decisions. The time required for this is relatively large and can increase if an advertisement is disrupted by a loss of air and / or has to be replaced by other advertisements. In particular, if the cause of the accident was only available for a limited time in the past, it is only possible for the operator to recognize such a cause of the accident after a long time. The invention is therefore based on the object of providing the operator in the control room of a technical system particularly well with means for detecting and controlling faults. This object is achieved according to the invention by a computer-aided device for recognizing a cause of an accident causing a malfunction in a technical system, the malfunction possibly triggering a shutdown of the technical system in an operationally reliable system state, with the following components: a) a system-specific system stored in a memory

Accident decision tree,

b) Means for the temporally differentiable linking of

Plant top signals that can be measured in the event of an accident with decision criteria arranged in a logical hierarchy in the accident decision tree,

c) means for triggering a decision restricting the cause of the accident in accordance with the result of one of the preceding links and, if appropriate, a further decision path in the accident decision tree, which follows the logical hierarchy, and

d) means for displaying the corresponding accident decision tree.

In this way, the operator m of the control room of a technical system is supported in the operation of the system with an event-oriented driving style by the computer-aided device. The computer-aided device provides the operator with a complete diagnosis in the event of a malfunction

(in accordance with the anise-specific accident decision tree in the operating manual) with regard to determining the cause of the fault. In particular, the possibility that interference-free, measurable system top signals, ie measured values with particular relevance for system safety, can be linked in a time-differentiated manner can also be a time-based and only time-related limits the occurrence of an accident and the cause of the accident. It can also be achieved by this time differentiation that, in the case of inferences made from two specific measured values, a distinction can be made as to which of the inferences is to be drawn depending on the arrival of the two measured values, ie in particular also a classification depending on which of the two or more further measured values occurred first. Decision criteria arranged in a logical hierarchy mean that the cause of the accident can be narrowed down more and more when decision criteria which are increasingly arranged further down in the logical hierarchy are reached in the accident decision tree. By means of triggering a decision limiting the cause of the accident is understood to mean that such decisions are triggered, for example, fully automatically by the computer of the device. However, it is also understood that the operator has to make a specific decision here, the data required for such a decision being measured and made available in an accident-proof manner. Means for displaying the accident decision tree are understood to mean, for example, a data display device in the control room of the technical system, in which an image of the accident decision tree is shown and by appropriate color or other optical classification of the symbols arranged in the accident decision tree, the decision path determined by the facility and along this decision path the cause of the accident is displayed. In a particularly advantageous embodiment of the invention, means for measuring the system top signals are provided, which are, for example, of redundant design. In this way it is possible, for example, to make "two out of three" decisions and, moreover, to recognize the failure of a single measuring point or a single measuring path which is triplicate. For the detection of a past and only temporary cause of a fault, it is particularly advantageous if briefly occurring system top signals can be stored in a memory provided for this purpose. In this way, it is possible to use the system top signals required to identify the cause of the accident, which were measured in the past and / or were only present for a short time, for the detection of the accident.

Embodiments of the invention are explained in more detail with reference to a drawing. Show:

1 shows the schematic structure of a device for detecting an accident triggering an accident; and

2 shows a schematic diagram of an accident decision tree. In the device 2 shown in FIG. 1 for recognizing a cause of an accident which triggers an accident in a technical system (not shown further here), a system bus 4 can be recognized, by means of which the measured values coming from the system and signals affecting the system are transported. A measured value evaluator 6 accesses the plant bus 4 and detects so-called plant top signals 8a to 8c, the data acquisition and structure of which are triple redundant. The measured value evaluator 6 forwards the system top signals 8a to 8c, which are only briefly present on the system bus, to a redundant data memory 10 for storage.

Likewise, after a corresponding request from a computer module 12, the measured value evaluator 6 can also read data from the data memory 10 into the process in the opposite direction. The measured value evaluator 6 transmits the triple redundant system top signals 8a to 8c to the computer module 12, which here has three microprocessor subunits 14a to 14c working independently of one another. In the microprocessor subunits 14a to 14c, a routine is routinely run independently, which checks the system top signals 8a to 8c coming from the measured value evaluator 6 for limit values or other criteria that are important for system operation. If a system top signal 8a to 8c is now present on two of three microprocessor subunits 14a to 14c, which triggers a particularly relevant criterion for triggering the shutdown of the technical system, that is to say a serious fault, the system may be shutdown by a control system (not shown).

At the same time, the computer module 12 loads from a further memory 16 a fault decision tree STEB which is specific to the system and outputs this to a data display device 18 which is located, for example, in the control room (not shown further here). After the fault failure decision tree STEB has been output to the visual display device 18, the cause of the fault is limited and determined step by step with the aid of the program running in the microprocessor subunits from 14a to 14c. For this purpose, decision criteria arranged at certain points in the accident decision tree STEB are linked with the system top signals 8a to 8c assigned according to this criterion. By means of this link, the microprocessor subunits 14a to 14c, provided that two of the microprocessor subunits 14a to 14c come to the same result, trigger a decision that limits the cause of the disturbance. For example, the accident decision tree SFEB displayed in the data display device 18 has a decision path, in the course of which three decisions can be measured using the link between the accident-proof measure Ren plant top signals 8a to 8c had to be felled so that the cause of the accident causing the accident could be determined. By means of an input unit 20, it is also possible, for example, for the operator of the technical installation to make certain decisions himself on a case-by-case basis and thus trigger the further decision-making path which follows the logical hierarchy. It is provided here that the content and the representation of the interference decryption tree STEB in the data display device 18 have a transparency which allows the operator to check certain decision-making paths in a way that the operator remains involved in the process, which is the case, for example, with the sole representation of an analysis Result would not be the case. By means of the device 2 explained above, an operator of the technical system is supported by the computer-assisted accident decision tree STEB when the system is operating in an event-oriented manner in such a way that a complete and error-free diagnosis of the determination of the cause of the accident is provided in the data display device 18. It is also possible for the operator to operate the device by means of the transmitter unit 20 on the basis of the diagnosis derived from the accident decision tree STEB

Power plant intervenes. For this purpose, commands implemented by the operator can be processed in the computer module 12 and corresponding data can be output to the system bus 4.

FIG. 2 shows an accident decision tree STEB as it is displayed, for example, on the data display device 18 m in the control room of a nuclear power plant in the presence of a cause of an accident that triggers a failure. The incidents and causes of accidents dealt with in the accident decision tree SFEB according to the decision-making paths result from the design, ie the nuclear power plant is for this stor cases designed. This also means that the plant top signals required to determine certain decision criteria are measured in a fail-safe manner and generally in triplicate redundancy.

The decision path triggered in the present accident decision tree SFE3 is shaded. The top field in the drawing with the inscription "RESA" stands for the triggering of a reactor cutoff due to an accident. The reactor is shut down until it reaches a safe operating state. To the side of the R nebenSA field is the field "t", in which the actual time at which a reactor fast shutdown (RESA) is triggered is recorded. The "Dew point T loop 1/2/3/4" field is triggered when two of three of the dew point temperature measurements or "one of three" of these dew point temperature measurements and a dew point temperature measurement on the corresponding circulating air coolers respond. The "Kond AR" field is triggered when the amount of condensate that exceeds a certain limit value is measured on the loop 1/2 or the Lopp 3/4 air cooler and at the same time the level in one of the two sumps of the air cooler rises above a maximum value. The "Betr Ra" field is triggered when the amount of condensate in the operating rooms of the nuclear power plant on two out of four circulating air coolers exceeds a maximum value. Likewise, the water level in one of the two swamps

Exceed the maximum value and at the same time there is a condenser attack on one of four circulating air coolers. If the logical and plant-specific combination of the abovementioned measurement criteria leads to the result "yes", the next step is to determine whether activity is released in the reactor containment. In addition, it should be noted that if the decision "no" is present, a part of the accident decision tree STEB, which is not shown in FIG. 2, is run through. For the detection of small primary leaks, interference-safe activity measurements of the room air in the reactor containment are provided, which lead to the triggering of the "Activity RSB" field if limit values are exceeded. The triggered limit values such as

"Local dose rate too high" or "High dose test too high" is displayed. If the measurement of the activities does not trigger the "Activity RSB" field, the no path is triggered and the analysis result "secondary leak within the reactor containment (RSB)" is output.

If the "yes" criterion is present, as provided in the exemplary embodiment, the next step is to query whether the emergency cooling criterion is present. In this case, there is no emergency cooling criterion based on the measured plant top values, so that the decision criterion "No" and the field "Leak in the reactor cooling system" following in the decision path are triggered. Because there was no emergency cooling criterion, a mini leak in the reactor cooling system is identified as the cause of the accident. This means that the "Minileck" field with the associated description in the operating manual, here in Chapter 3-1.1, will be drawn.

If the existence of an emergency cooling criterion was answered in the affirmative, which resulted in the activation of the "yes" field, the criterion would then be checked in the decision-making process as to whether the

Pressure drop of the coolant reaches a certain value within a certain time. If the field "Δp KMD <9bar" is drawn, i.e. if there is a "yes" decision, the "large leak" field is triggered in the further decision-making process.

If this pressure drop present within a certain time is less than the permissible limit value, the "No" decision is triggered. It is then checked next whether the pressure holder maintaining the reactor pressure maintains the prescribed level. If there is a "Yes" decision here , the "Kl / M RKL" field is triggered, which means that there is a small to medium leak in the reactor cooling system. If the "No" decision is drawn above, there is a leak in the pressure holder, which is indicated by triggering the "DH leak" field.

The device 2 explained above thus contributes in an almost fully automatic manner to the control of system accidents for which the system and, accordingly, the accident decision tree are designed. Because the measured value acquisition and processing are designed to be accident-proof in relation to the design accidents, the described device fully supports the event-oriented driving style of the technical system and completely safeguards its operation. In addition, once the cause of the accident causing the malfunction has been identified, a therapeutic procedure that eliminates the malfunction can be started automatically.

The device 2 triggers a decision by analyzing the criteria relevant to the system top signals 8a to 8c. By analyzing the chronological order of arrival and / or the length of time that system top signals 8a to 8c are present, a decision is drawn and, in particular, a time differentiation of these variables for decision-making.

Claims

claims

1.Computer-supported device (2) for recognizing a cause of an accident in a technical system, the accident possibly triggering a shutdown of the technical system in an operationally safe system state, with the following components: a) a system-specific accident decision tree stored in a memory (16) (STEB),

b) Means for the temporally differentiable linking of

Plant top signals (8a to 8c) that can be measured in a fail-safe manner with decision criteria arranged in a logical hierarchy in the incident decision tree (STEB),

c) means (14a to 14c) for triggering a decision limiting the cause of the accident in accordance with the result of a previous link and, if appropriate, a further decision path in the hierarchical hierarchy following this in the accident decision tree (STEB), and d) means (18) for representing the corresponding accident decision tree (STEB).

2. Computer-aided device according to claim 1,

That means that means for measuring the system top signals (8a to 8c) are provided, which are designed with multiple redundancies.

3. Computer-aided device according to claim 1 or 2, characterized in that short-term system top signals (8a to 8c) can be stored in a memory (10) provided for this purpose.

4. Computer-aided device according to claim 3,

that a decision can be triggered by analyzing the criteria relevant to the plant top signals (8, 8a to 8c).

5. Computer-based device according to claim 3 or 4, so that a decision is made by analyzing the chronological order and / or the duration of the pending system top signals (8, 8a to 8c).