The shift from analog to digital hardware is providing greater capability for automation 6 The use of more digitally oriented process-control equipment tends to over­come the disadvantages in cost or reliability of an analog predecessor

7- 2.1 Analog Control Systems

Before the advent of the transistor, analog controllers, independently serving individual process loops, became the design standard As shown in Fig 8.1, this system provides process control under one set of conditions Changes in the operating status of the process are accommodated by manually adjusting the set point and the analog controller characteristics These devices incorporate proportional, integral, and derivative control action as appropriate to the process

When the transistor introduced solid-state control elec­tronics more-elaborate analog systems became feasible. Figure 8 2 shows schematically the components of such a system. Automation is achieved through relieving the operators of having to adjust set points for changes m process conditions A distinguishing feature of this system
is that the analog computer has available to it all significant process variable signals This permits feed-forward, cascade, and multivariable control modes

In contrast to the controller bank of Fig 8 1, the number of operators needed does not necessarily grow with increasing size and complexity of the process under control The control system grows, and the cost of installing and maintaining an extensive configuration limits large-scale analog automation even with solid-state hardware

8- 2.2 Hybrid Control Systems

Although the transistor gave needed improvement to analog devices its effect in the digital field was outstanding Vacuum-tube digital computers required a great deal of maintenance and almost continuous adjusting As transis tors improved in time response and reliability, larger and faster machines were built The continued advance into integrated circuits lowered the cost of smaller models into the realm of process control

The utility of the digital computer lies in its inherent time-shared nature and its memory One set of arithmetic elements serves the calculating needs of all control loops one at a time, and the computer remembers the inputs, outputs, limit values, and decisional requirements of each loop between turns These features make the digital computer superior to analog computing elements, the configuration shown in Fig 8 3 was that seen in most of the early digital applications Since the digital computer was added to feedback control systems already in opera­tion, it was visualized as “supervising” the process by monitoring and alarming out-of-limits conditions, adjusting analog controller set points, and generally performing the simpler tasks of a human operator Thus the hybrid arrangement is often called “supervisory control,” although the term will not be used here because it has several other meanings

As seen in Fig 8 3, the hybrid approach adds even more equipment to the system But the multiplexer, which scans the inputs and distributes the set-point signals, is the only major component whose size is proportional to the number of measurements and control loops In a basic setup there is one set of mput/output equipment to change analog inputs to digital, digital outputs to analog, and to perform the required amplification, there is one computer to do the timing, logic, and arithmetic The cost of these two items rises slowly with greater system size Hence, as the controlled process gets larger, there exists a point where the hybnd becomes less expensive than the analog system, this is one reason for using hybrid automatic control

8- 2.3 Digital Control Systems

The analog controllers in a hybrid system are usually there because they were already there, they are familiar to and are trusted by the plant operators, and they do a job that would otherwise require a bigger computer and more programming Their inputs are differences between mea­sured variables and corresponding set points, and their outputs are signals to process actuators, such as valve motors and heater relays The controller amplifies, inte­grates, or differentiates the input and combines the results to produce an output that makes a portion of the process respond to set points and process disturbances in a stable fashion

The function of the controller can be done easily by the digital computer, so the analog feedback-loop hardware need not be present 7 The result is a digital automatic control system as illustrated in Fig 8 4 The defining characteristic of the digital configuration is that all major control loops pass through the computer The system is often called “direct digital control,” which, because it implies the exclusive use of digital control signals, will not be used in this chapter In the practical case digital actuators for some process components have not yet been developed

The schematic diagram of the digital system indicates that less equipment is needed for a large number of control loops than with the analog or hybrid However, the complexities of design are still there As will be shown later, they have been largely transferred from the hardware to the computer programs

•

The software part of the specification is the most difficult to state in precise terms This is partly attributable to the prevalence of an imprecise vocabulary in which several words can mean the same thing (monitor, executive, organizer), a practice that compels the specification writer to describe programs by function. Some of the difficulty may also be credited to the existence of the two distinct kinds of software systems programs (sometimes called utility programs or operator routines), which implement programming, and process programs, which implement data handling and control Avoid confusion by specifying programs in terms of the tasks that each is to perform

The designer must be very firm about receiving the systems programs in working order Although many of the programs are fixed for all systems, those which require the operation of peripherals may never have been tried on the exact configuration being specified.

Several of the programs listed in the sample specifica­tion (below) are optional Many users will not make the compiler a firm requisite, although most U S man­ufacturers include some version of FORTRAN in the software package The editor program is very valuable when paper tape is the programmer’s only high-speed communica­tion with the computer, but the editor program loses value if punched-card equipment is available. The process pro­grams are useful only to the extent to which they can be adapted to the application at hand. The current difficulty in this regard is simply that a compact and efficient software package cannot support a variety of applications, nor can a computer, properly sized for the application, support an oversized software package that has been designed to suit all occasions. It is hoped that in the future a truly modular approach to process software will allow the designer to specify a control system, equipment, and programs as easily as he has specified analog equipment in the past1 9 The software section of the sample specification follows

6. SOFTWARE

Specific software requirements to be furnished with this equipment are listed m the following sections In addition, each bidder shall include a description of all software available (including extra price where applicable) for the specific configuration (core memory, peripherals, etc ) described in this specification

A complete listing of the software documentation available for the specified configuration shall be supplied

6.1 Executive

An executive monitor oriented to on-line real-time proces­sing shall be provided The monitor shall reside on the disk, along with the processor and library routines, and shall utilize the disk for scratch storage if necessary. Foreground-background processing shall be required Foreground operations shall include provision for both resident (in-core) and nonresident (core-disk swapping) real-time programs. Both the monitor and real-time programs shall be protected against inadvertent destruc­tion by a background program.

The monitor shall provide automatic interrupt, context switching and storing, programmable priority-interrupt structure, nested-interrupt inquiries, program-pnonty queries, and linkages and facilities for handling all devices included m this specification. Device-independent I/O programming shall be provided. The monitor shall provide for reentrant subroutine execution The maximum time that the monitor disables interrupts shall be stated

6.2 Compiler

A FORTRAN compiler shall be provided to allow programming in English and mathematical-like state­ments The compiler shall be capable of operating in a real-time environment and, as a minimum, of meeting the following requirements

Compliance with ASA Standard X3.9-1966 FORTRAN.

Intermixing of FORTRAN statements and assembly — language statements by macros or other suitable means.

Provision for reenu. nt subroutines.

Provision for queuing and utilization of priority interrupts in real time

6.3 Assembler

A symbolic assembler program shall be provided which processes a machine-oriented language. The assembler shall provide pseudo instructions for the purpose of defining symbols, reserving memory, linking subroutines, and controlling mput/output options. The assembler shall provide macroinstruction capability.

6.4 Correction Program

A correction program shall be provided which shall enable corrections and additions to be made on source programs by inputting the source program into memory (limited by the capacity of the memory) and making corrections through the keyboard. The output shall be a new program taken from memory which includes the corrected state­ments.

6.5 Diagnostic and Utility Programs

Programs shall be provided to assist programmers during the debugging phase of program development. These programs shall include, but not be limited to, the following features

Clearing all or part of memory Modifying memory from the keyboard.

Printing all or part of memory under specified conditions.

Inserting and deleting breakpoints.

Initiating a jump on condition to any part of memory. Additional features shall be listed in the bid response.

6.6 Input/Output Programs

Input/output drivers shall be provided for all peripheral devices required in this specification. The drivers shall provide for testing device status and executing data transfers. The tests used for each device, the device address (logical and hardware), and the number of interrupts, by level, shall be indicated in the bid response

6 7 Maintenance Programs

Maintenance programs shall be provided which enable testing of the entire central processor and all peripheral equipment Testing shall include the memory instruction set, central control, arithmetic section, priority interrupts, and each peripheral

6 8 Delivery Form

All software shall be delivered as individual paper tapes. Where more than one program (e g., loader and monitor) resides on a tape, the individual tapes will also be supplied This requirement does not apply for the library decks for FORTRAN and assembly language

6 9 Documentation

Three sets of all software manuals shall be provided All paper tapes shall be accompanied by a source program listing.

 

9-5.3 Rectifier—Battery—Static Inverter Systems (a) Basic Continuous-Inverter System. The basic continuous-inverter system (Fig 9.3) consists of a static rectifier, battery charger, battery, and static inverter The inverter carries the a-c load at all times Under normal

 

A-C LOAD

 

The following various combinations of the basic power — supply building blocks are representative of the power — supply systems in use. In any system different possibilities exist for improving one characteristic at the expense of others. However, the vast majority of practical systems incorporate the principles and characteristics represented by the power supplies described in this section. 9-5.1 Simple A-C/D-C System The basic a-с/d-c system (Fig. 9.1) consists of a single voltage-regulating and harmonic-filtered stepdown trans­former and a static rectifier This system is usually fed from the facility essential auxiliary-power buses and, of course, is subject to interruptions in the order of 15 sec before the large standby diesel generators can reestablish power to the essential buses At best the simple a-c/d-c system provides filtering and voltage regulation for noncrmcal instrumenta­tion loads. When the system is required to supply only d-c power, the regulating transformer is usually incorporated within the static rectifier

 

circumstances the charger provides the d-c load plus the input to the inverter and floats the battery or recharges it as required. The charger in turn is fed from the plant auxiliary source of a-c power. If the plant auxiliary power fails, the inverter continues to run on the battery for a period of time dependent upon the reserve battery capacity. In this mode of operation, as long as the charger is functioning properly, there is no drain on the battery. Input current for the inverter is derived from the charger and does not pass through the battery. If the a-c line fails, the inverter drain is transferred to the battery without any interruption or disturbance in the inverter output Thus this simple system functions as a complete no-break backup power source Some capacitance is generally required in the input circuit of the inverter, and this provides a small amount of energy that, because there is a fast voltage regulator in the inverter, enables the system to handle the input transient from float voltage on the battery to discharge voltage without a significant transient in the output Loss of voltage on the input of the rectifier has no effect on the inverter output The advantages of this system are offset by the complete loss of power if the inverter fails. This disadvantage can be eliminated by using redundant equipment (see Fig 9 7) (b) Continuous-Inverter System with Direct A-C Feed. The inverter system shown in Fig 9 4 is a more sophisticated version of the basic system shown in Fig 9 3 The normal a-c line feeds into the inverter directly at all times and is rectified. The resulting value of the d-c voltage is compared to the d-c voltage from the battery Solid-state circuitry within the inverter determines the highest d-c source, battery or rectified a-c line, and then inverts it to supply the a-c load. This is commonly referred to as

 

D-C LOAD

 

A-C INPUT

 

A-C LOAD

 

Fig 9.1—Simple a-c/d-c system

 

9-5.2 Rectifier—Battery System The basic system (Fig. 9.2) consists of a static rectifier, a battery charger, and a battery. The normal d-c load is supplied from the rectifier. If the a-c line fails, the load is automatically transferred to the battery without interrup­tion. Although the system is highly reliable, the capacity of the batteries limits the length of possible emergency operation. Of course, the system can only serve d-c loads

 

Fig. 9.4—Continuous-inverter system with direct a-c feed.

auctioneering. The internal transfer between the two sources of d-c power occurs instantaneously and is virtually undetectable. In this way the a-c load never sees the incoming a-c line, only the a-c output from the static inverter. Line synchronization problems, which are often a cause of difficulty (when external switching methods are used to effect the transfer between the inverter output and plant auxiliary a-c line), are avoided. Reliability is enhanced because there are no switching operations to cause transient voltages, and fewer critical components are needed The same result can be achieved by bringing the a-c line to the inverter through the battery charger (see Eig. 9.3), but then the battery charger must be large enough to handle the entire a-c load in addition to the d-c load and battery loads. This would necessarily increase system cost

Another inherent advantage of the system where the a-c line is fed into the inverter directly is built-in stabilization of line frequency and voltage Since the incoming a-c supply is rectified at once, input frequency is of little concern. The output oscillator of the inverter can have frequency stability to almost any accuracy desired, being only a function of inverter design The typical 60-Hz system maintains frequency to a tolerance of ±1.0%. The addition of an oscillator standard in the inverter can reduce the variation m output frequency to ±0.01%. The input frequency does not necessarily have to define the inverter output frequency, and therefore the same power supply can be used for frequency conversion. Similarly, phase changing can also be accomplished since the number of phases in does not determine the number of phases out

(c) Continuous-Inverter System with Electromechanical Transfer Switch. In certain applications it is desirable to feed the a-c load from a source other than the inverter This can be accomplished by switching from inverter to line (see Fig 9.5) or switching from line to inverter The two methods differ in the length of interruption of a-c power to the load and should be used where short-term interruptions can be tolerated. Conventional transfer switches are used and are generally supplied as electrically held, mechanically interlocked contactors. In the commoner mode of opera­tion, the inverter is considered as the normal source The inverter carries the a-c load until it is manually transferred by an operator or until an inverter failure occurs The chief advantage of this arrangement is that the inverter failure rate is substantially lower than that of the plant auxiliary- power source. Thus transfers occur substantially less often than they would if the a-c line were considered the normal source. Since the inverter is operating continuously, there is assurance that both sources are available as long as the a-c line is present

A disadvantage of the inverter-to-line switching mode of operation is that the charger must have sufficient capacity not only to feed any d-c loads and recharge the battery but also to supply the input current to the inverter. In the alternate arrangement, where the plant auxiliary a-c line is considered the normal source and transfers are made to the inverter on-line failure, the charger capacity need only be sufficiently greater to recharge the battery and feed any d-c loads

In most transfer arrangements of this type, a delay is provided to prevent the emergency from transferring to the normal source after an outage until the normal source has been present for some period of time This time interval ranges from a few seconds to as much as several minutes, depending on the application

With standard contactors operated in a conventional manner, outage times on transfer are of the order of 0 1 sec. The outage time depends primarily on the time for failure sensing and transfer of the contactor In switching from line to inverter, however, an additional period of reduced output voltage is caused by the response of the inverter to a step-load change. For most commercially available inverters, the time to respond to a full-load step change is less than 0.04 sec Because of the relatively long transfer time, it is generally not necessary for the inverter to be synchronized in phase with the a-c power line Frequency synchronization may be desirable where the inverter carries the load continuously to keep certain classes of loads, such as clocks and chart drives, in step with local time.

In certain applications the transfer from normal to emergency a-c power source need not be automatic By substituting a make-before-break manual transfer switch for the automatic transfer switch indicated in Fig 9.5, the load can be successfully removed from the inverter without loss of potential The manual make-before-break transfer is an inexpensive concept of switching to the plant auxiliary source of power while still maintaining the continuity of power flow to the load. This system suffers the same problems as the system shown m Fig 9.5 The load experiences complete loss of power should the inverter fail (One could, however, manually transfer to the plant auxiliary a-c source after detection of the inverter failure )

(d) Continuous-Inverter System with High-Speed Trans­fer Switch. In certain cases extremely sensitive a-c in­strumentation and control systems cannot tolerate the finite outage time given by the transfer arrangement of Fig. 9.5. The system shown in Fig. 9.6 uses special transfer- switch drive circuitry that allows transfer to be effected in less than 1 cycle, or 0.016 sec, in a standard 60-Hz system. Depending on the sensitivity of the sensing circuitry and

the size of the transfer switch, transfer times below 0.008 sec can be obtained. In all short-time transfer schemes, special attention must be given to line-phase synchroniza­tion and transformer saturations.

Because of the short transfer time, the inverter must be operated in phase synchronism with the commercial power line. It must also be recognized that the transfer time from line to inverter is increased by the load response time of the inverter. For these reasons it is generally preferable to use the inverter as the normal source of power and transfer to the line only if an inverter fails. Retransfer, after correction of the inverter failure, can be made either by allowing for the increased transfer time or by providing an auxiliary manual make-before-break switch which momentarily parallels the inverter output with the plant auxiliary-power system on retransfer.

To achieve a high-speed transfer, the sensing circuit must detect departure of the source from its standard value in periods as short as a millisecond. Most plant auxiliary — power systems experience short-term transients. It is extremely difficult to design transfer-sensing circuits that avoid transferring on a momentary line transient that is not necessarily followed by a complete line failure. The inverter output is relatively free of such spikes unless they are generated by the load, and therefore the likelihood of false transfer is avoided when operating with the inverter as the normal source. However, most inverters have a current — limited output characteristic; so any overload exceeding the output capability of the inverter is regarded as a failure and causes transfer to the plant auxiliary-power system.

In several available commercial systems of the type shown in Fig. 9.6, the high-speed electromechanical transfer switch is replaced by a solid-state silicon-controlled rectifier (SCR) a-c switch. The advantages gained include a decrease in transfer time down to 0.002 sec or less and, since the switch has no moving parts, a virtual elimination of maintenance requirements. A disadvantage is that the static transfer switch does not provide the same degree of positive isolation from the plant auxiliary system as does the mechanical transfer switch. Therefore, in a situation where a plant auxiliary-power-system failure is accompanied by a high-voltage transient, the static switch could fail and cause a complete system breakdown involving both a portion of the plant auxiliary power and the inverter. An important consideration when assessing the relative merits of a static vs. electromechanical transfer switch is that the inverter response time must be added to the transfer time when transferring from line to inverter.

The system shown in Fig. 9.6 uses the stored energy of the output transformer to overcome the relatively slow response of the inverter and provides improved transfer­time characteristics. By transferring on the primary of the ferroresonant output transformer with a high-speed transfer switch, one can achieve transfer times in the range of 0.008 to 0.016 sec. Because of the stored energy in the output transformer, there is no interruption of supply to the load during the transfer period. As previously mentioned, the inverter must be operated in phase synchronism with the plant auxiliary-power system to effect the desired uninter­rupted transfer.

The system indicated in Fig. 9.6 requires the inverter to be the normal source of power. Several advantages result from this mode of operation. The frequency of transfer during operation is substantially reduced since the inverter output is comparatively clean. During plant-auxiliary — power-system fault conditions, when transfers from the line normally take place, the plant auxiliary power is charac­terized by erratic phase shifts and voltage excursions, and, if the transfer from source to inverter is to be successful at these times, the inverter must be maintained in phase with the faulted line. It is questionable if the inverter could respond properly to this mode of operation. Either the transfer would be made out of phase or the inverter would malfunction. In addition, the voltage transients charac­terized by the failing a-c line may make clearing of the transfer-switch contacts difficult. For example, a suf­ficiently large voltage transient on the line prior to switching could cause an arc to persist in the opening contact of the transfer switch for more than 0.008 sec. Since this would, in essence, short the inverter output to the failing line, an inverter malfunction would be likely. Using the inverter as the normal source avoids these undesirable possibilities.

(e) Continuous-Inverter System with Redundant In­verter and Transfer Switch. In the systems shown in Figs. 9.5 and 9.6, the switching is from the inverter back to the commercial a-c line to provide a backup source of power. The system shown in Fig. 9.7 represents a significant

improvement with respect to isolation from the plant auxiliary a-c line. During normal operation both of the inverters are operated in parallel and are sized so that either

could carry the entire a-c load. The two inverters are

connected through normally closed transfer switches to the common a-c load. The logic and synchronizing circuits ensure that under all circumstances the inverters are

operating in phase synchronism with each other and with the commercial a-c line if required. As long as both units are operating in phase with each other, the load is shared. Should either inverter fail, by either a reduction in output voltage or a shift in phase, the logic circuit disconnects the faulty inverter from the system, thereby transferring the entire load to the remaining inverter. The transfer switch

need not operate with extreme rapidity since the surviving inverter can drive the output transformer of the failing inverter without adverse effects. The failure of either inverter would cause some load disturbance attributable to

the response of the surviving inverter to the 50% step-load increase (assuming each inverter to be normally 50% loaded). The overall output performance of this system is, therefore, essentially identical to that of the system represented by Fig. 9.6. The principal advantage is that both sources of power can be considered extremely reliable. Since there is no connection to the commercial power line except that provided by the charger, the possibility of introducing large voltage transients from external sources is minimal.

It is important to realize there is a substantial increase in cost as the complexity of the transfer circuits is increased. The transfer-circuit complexity increases as the permissible load-interruption time decreases. Usually the power source for the instrumentation and control system in a nuclear reactor facility is only one part of a larger system. In fact, because redundancy is necessary in the instrumenta­tion and control system, several separate isolated power systems may be required. Therefore, in overall operation an inverter failure may be indistinguishable from a failure in a portion of the instrumentation and control system that the inverter feeds. In such circumstances justification of an elaborate (and expensive) power supply must take into account that the additional cost might better be used to improve some part of the system other than the power source.

The preceding section treated control systems from the standpoint of the kind of hardware used, analog or digital, the amount of automatic operation provided was a secon-

dary consideration In this regard it should be noted that the presence of a digital computer implies no special level of automation For example, many digital systems have been installed which perform only the control functions of a set of analog feedback controllers with the added benefit of automatic data logging

To avoid hardware implications, we will take the functional approach and use the degree of automation to define the extent to which the operator is removed from the immediate closed loop

The environmental and miscellaneous characteristics comprise the temperature and humidity ranges under which the system is to operate and such various items as power requirements, documentation, cabinets, and quality as­surance

The hardships that have been caused by inadequate or erroneous circuit and schematic diagrams are well-known. The same pains can be experienced if the software is incorrect. Complete program descriptions and updated listings of all supplied software, as well as accurate as-built drawings of the hardware, must be required.

A subsection on the manufacturer’s quality-assurance practices should be included in the specification It is usually a requirement of any large system The specification should require that all proposals describe the seller’s current quality-control programs to an extent commensurate with the size of the system Incoming-materials inspection, manufacturing procedures, quality control, documentation control, and use of existing codes and standards should be covered. It should be made clear that response to this section will influence the selection of the supplier.

The environmental and miscellaneous characteristics section of the sample specification is as follows

7.0 ENVIRONMENTAL AND MISCELLANEOUS

7 1 Temperature

The computer and all peripheral devices shall meet the requirements of this specification over a temperature range of 50 to 90° F

7 2 Humidity

The computer and all peripheral devices shall meet the requirements of this specification over a humidity range of 50 ± 30%

7 3 Power

The computer shall operate from 120/208-volt, 60-Hz power, single or multiple phase Each manufacturer shall provide literature that describes the following items 1. Power required—by voltage, current, and phase 2 Power dissipation in British thermal units per hour and kilovolt-amperes separately stated for the central processor and each peripheral device plus the total power consumed by the system.

3. Connector wiring diagrams for every input power connector, cross labeled by manufacturer type

7 4 Enclosure

Each item specified is to be supplied in a fully enclosed cabinet with access doors for ease of maintenance Peripheral devices may be grouped to share a single cabinet Each manufacturer shall provide literature that describes the following items

1 Cabinet configuration and mechanical position as­signment for each peripheral device and for each portion of the central processor. Unused rack space shall be identified and dimensioned.

2 Service clearances required for all racks and cabi­nets

3 Installation dimensions for assessing doorway, elevator, and loading-dock clearances

4. Total system weight and weight by cabinet (console or rack) Shipping weight.

7 5 Spare Parts

Standard spare parts package and terms for later exchange of faulty circuit boards shall be provided. Extender boards shall be provided for each type of pnnted-circuit connector supplied (where applicable).

7 6 Documentation

Four copies, unless otherwise noted, of the following documentation shall be supplied

1 Final as-built drawings.

2 System block diagram.

3. Instruction and maintenance manuals.

4. Parts list.

7.7 Reliability

Reliability data shall be provided, both calculated and tested. The method of calculation (MIL-METHOD etc ) shall be specified. Where data are not available, so indicate.

7.8 Quality-Assurance Program

The vendors shall supply in the proposals evidence that a Quality-Assurance Program is maintained that will assure the purchaser that all articles procured from the vendors will satisfy the purchaser’s requirements. This evidence shall consist of either the vendor’s quality-control proce­dures manual or references to applicable public docu­ments which constitute the procedures used in the vendor’s quality program.

The vendor’s quality program shall show evidence of an organized and documented approach to the attainment of quality both in inspection and manufacturing procedures and in document control as it pertains to the purchased system.

In the system using a generator and an internal- combustion engine (Fig. 9.8), the normal flow of power is from the plant auxiliary a-c system. If the commercial power fails, the internal-combustion engine is started. As soon as the proper voltage and frequency are established at the generator terminals, the transfer switch connects the load to the generator. This system is widely used in nuclear
power plants as the emergency auxiliary-power source. The main disadvantage of this system is that the load is interrupted for the time interval required to start the engine and transfer the load to the generator; typically this is 10 to 15 sec.

A-C

INPUT

The system shown in Fig. 9.8 can be modified so that the generator will float across the line by being driven continuously by the engine. Whenever the normal a-c source failed, the generator would deliver power im­mediately without interruption. With this scheme the engine starting period is eliminated. However, the engine runs constantly, and transients are present on the line when switching. Power directional relays and synchronizing equipment are required for proper operation of the transfer switch. Since the engine is running continuously, increased maintenance and operating costs are involved. This is a distinct disadvantage.

9- 5.5 Synchronous Motor-Generator—Flywheel- Clutch—Internal-Combustion-Engine Systems

(a) Nonisolated System. In the nonisolated system shown in Fig. 9.9, the critical load is normally fed directly from the plant auxiliary a-c power system in parallel with a synchronous machine operating as a motor driving a flywheel. Whenever normal plant auxiliary power is inter­rupted or a frequency or voltage anomaly in excess of preset tolerances is experienced, the synchronous motor

and critical bus are disconnected from the system. The synchronous motor instantaneously converts to generator operation to supply the critical bus with interim power, with the stored energy of the flywheel being transferred to
drive the generator. The engine, when furnished, would simultaneously be started and then connected to the load when it is up to speed. The engine is recommended only for those systems requiring operating time, after plant auxiliary-power failure, in excess of the stored-energy capability of the flywheel.

Under fault conditions this type of system is subject to a power dip during the time required to isolate the critical a-c load from the plant auxiliary source In addition, since the critical load is normally fed from the plant auxiliary source, it is subjected to any transients occurring on that system. At best this system (with the engine) is justified only where the plant auxiliary source is very unreliable.

(b) Isolated System. The isolated system shown in Fig 9.10 offers a significant improvement over the nonisolated system (Fig. 9.9) in that complete isolation from the plant auxiliary source is obtained. The system consists of a synchronous motor with a stored-energy flywheel unit, which is fed from the plant auxiliary source and drives a synchronous generator that feeds the critical bus A standby engine is used whenever the duration of the outage exceeds the capability of the inertial unit. During normal operation voltage — and frequency-sensing devices monitor the incoming power line for variations beyond acceptable limits.

Should an unacceptably large voltage or frequency excursion occur, the synchronous motor is disconnected from the plant auxiliary-power source, and the stored

energy in the flywheel is used to drive the synchronous generator. The standby engine, if furnished, is simul­taneously started and brought up to synchronous speed in about 10 to 60 sec, depending on the stored-energy content of the flywheel, at which time the engine is connected to the generator shaft by the magnetic clutch. The frequency stability under engine operation is maintained by a highly sensitive load — and frequency-sensing governor that closely controls the speed of the engine. Should the voltage and frequency of the plant auxiliary power return to acceptable values and remain for a preset time period, the synchronous motor is synchronized to the source, the clutch is deener­gized, and the engine is returned to standby condition.

On loss of plant auxiliary power, the system begins to draw energy from the flywheel and causes it to lose speed. Since the frequency is directly related to the speed of the flywheel-driven motor—generator unit, the frequency is soon reduced to a value below an acceptable limit to the critical bus.

The overall frequency regulation of this system is equal to that of the plant auxiliary-power system.

The defining property of this system is that no significant logical decisions are made by the hardware, either on the display side or in the control channels In a system like that shown in Fig 8 1, the feedback controllers provide only process control at a given static operating level All control actions are taken by the operator and are based on the information he obtains by observing the process variables displayed at the consoles and his interpre­tation, through experience and training, of this information in terms of needed process changes

8- 3.2 Monitored Operator Control

Hardware logic may be placed in the path from the operator to the process to prevent a control action at the wrong time or under adverse conditions These may range from simple electrical interlocks to a complicated set of prerequisites in a plant start-up sequence Such systems are now seldom seen in the absence of other automatic control features They are mentioned here only to illustrate one aspect of automation easing the operator’s decision-making burden

8- 3.3 Operator Guidance

In a large plant the amount of data generated cannot be assimilated by one operator or even a staff of operators In many installations digital computers are used only to get process information to the operator quickly and in mean­ingful form This involves data acquisition, on-line analysis, and information display, and it often results in a highly complex instrumentation system made practical only through the use of a digital computer The essence of the operator guidance system is that it comprises nearly all the hardware elements needed for fully automatic control, the only missing item being the part of the computer—process interface which sends control signals back to the process

The operator guidance system appears to produce a low degree of automation, nevertheless, it provides all the aspects of automatic control except direct feedback action No data analysis or decision making is required of the operator In practice, however, the operator is seldom reduced to a robot On the contrary his effectiveness is enhanced by his possession of a continuous and up-to-date knowledge of the process This includes energy balances, anticipatory alarms based on predicted plant behavior, or instructions for optimizing the process, all requiring that data be processed faster and more accurately than is possible by humans

8- 3.4 Automatic Control

When under a given set of conditions a process is run efficiently without human direction, its operation represents the highest degree of automation Input data are analyzed, decisions are made, and control actions are taken entirely under the guidance of the control equipment

Automating a facility to a high degree may allow a significant reduction in the size of the control-room staff, although resulting operating cost savings may be partly offset by the need for computer programmers and more highly skilled maintenance specialists More importantly the operators are relieved of trivial and routine tasks requiring continual alertness and are allowed to perform more complex functions, such as general surveillance and emer­gency intervention, which are beyond the capability of a control system of reasonable cost 8

There are several other items to consider when pro­curing a computer system for the automation of a nuclear power plant. The specification should provide for ap­propriate vendor action on each item

(a) Acceptance Tests. The complex nature of a com­puter control system demands a close and continuing check on its operability. A thorough set of checkout programs should be run at the factory and again after delivery to the site to disclose any faults that might have occurred in transit. These tests must encompass all the requirements of the specification and will be time consuming and tedious

(b) Installation. It is impractical in a full-size power plant to require the control-system manufacturer to install his equipment. He will, however, be expected to supervise the placement of cabinets, interconnecting cables, and the running of final acceptance tests

(c) Training. There has been, to date, no surplus of experienced process programmers. The quality of program­ming and maintenance training that the system manu­facturer offers will depend on the availability of his personnel. It is advisable to leave the training schedule open to negotiation, within specified limits, to make best use of the teacher’s time. However, the specification should include a request for outlines of the training courses.

(d) Appendixes. A list of control-system inputs and outputs can be appended to the specification to aid the bidder in sizing the equipment required. A rough layout of the control console will also help him visualize the display configuration and perhaps offer suggestions for improve­ment A floor plan will aid in placing components and in determining the lengths of interconnecting cables.

In normal operation of the system (Fig 9.11), an induction motor drives a flywheel at a higher speed than the speed of the generator shaft. The induction motor — flywheel system is coupled to the generator shaft through an eddy-current coupling. The variable slip provided by the coupling allows the generator to be maintained at syn­chronous speed under all normal load conditions (see Sec. 9-4.3). When the frequency or voltage of the plant auxiliary-power system deviates from preset limits, it is interrupted. Through the use of speed sensing and slip control of the eddy-current coupling, the generator is maintained at synchronous speed as the flywheel speed drops to that approaching the generator synchronous speed. Simultaneously, the incoming plant auxiliary-power system voltage — and frequency-sensing relays determine whether a momentary transient or a complete loss of power has occurred. At a predetermined flywheel speed, the standby engine is started and brought up to speed, but it is not connected to the system at this time. If the speed of the flywheel continues to drop and reaches a preset minimum value prior to the return of the plant auxiliary-power system, the engine is connected to the system by energizing the magnetic clutch. The energy storage capability of this system varies between 10 sec and a maximum of approxi­mately 2 min. If the allowable outage time for which protection is desired is less than 2 min, the engine standby unit can be eliminated.

This system gives excellent results in speed control, output voltage, and frequency regulation, and, when combined with the engine backup, it is able to operate for extended periods of time. However, eddy-current-coupling

systems are inefficient and generate considerable heat that has to be dissipated. Other disadvantages include high maintenance cost and, when combined with an engine backup, the requirement for fuel storage, exhaust ventila­tion, and scheduled exercising

To complete a description of the extent of plant automation, one must discuss the proportion of facility operation that is under automatic control This is here called “scope” and comprises two distinct aspects (1) the physical portion of the facility involved and (2) the number of different plant operating conditions included

Reactor safety circuits (see Vol 2, Chap 12) are not treated in this chapter since they are not considered a part of the control system

8- 4.1 Conventional Processes

A reactor facility can usually be divided into two parts according to whether or not the operation of the compo­nent processes is markedly affected by using a nuclear reactor for a source of heat Thus the generators, turbines, and steam loops in a pressurized water-reactor power­generating unit could be considered conventional equip­ment Their operation is not substantially different from that of a fossil fuel plant, so automatic control systems that have proven successful for this part of a nonnuclear station can be applied to a nuclear plant Nevertheless, extensive computer control of only the conventional part of a nuclear plant is uncommon There are several interrelated reasons for this (1) computers are installed primarily for data acquisition and display, (2) basic feedback control by computer to date has shown little or no cost advantage over analog controllers, and (3) the more serious control problems involve complex modes (such as multivariable, feed-forward, or cascade) which include controlling a part of the nuclear plant as well, again introducing concern by the designer over acceptance by licensing authorities

8- 4.2 Nuclear Processes

When computer control extends into the nuclear part of the facility, the engineer becomes involved with design procedures not common to a conventional plant Radiation and radioactive materials reduce access to many compo­nents of the control system and constitute potential hazards that demand extra care in system design and strict conformance to safety criteria The division between conventional and nuclear processes is made to emphasize those control functions requiring the most thorough reli ability analysis 9

8- 4.3 Auxiliary Processes

During the early planning of a process computer system, the following question arises “How much of the facility is going to be under computer control5” One must decide whether or not to include equipment not directly related to the main plant process, such as coolant makeup units, coolant-purification loops, and standby power plants Added functions of this kind are not being included in current plant designs The hardware cost savings are outweighed by the expense of greater system size and complexity

An exception to the above is the control of a certain class of on-line instrumentation comprising coolant samplers, chromatographs, mass spectrometers, neutron — flux scanners, etc These are characterized by their need for precisely timed control signals with a resulting data input to the computer The control signals are normally of a fixed-sequence kind, independent of the reading of the instrument, and do not effect closed-loop control actions in the usual sense

A second exception is monitoring and procedural control of reactor refueling operations If so programmed, the control system keeps track of the reactivity status of the reactor at all times Given the incremental reactivity of a replacement fuel element, the computer can predict the new reactivity status at each stage in the refueling sequence This, coupled with a step-by-step comparison between fuel-handling machine control actions by an operator and a prescribed checklist in the computer, can substantially improve the charge—discharge process