This invention relates to a monitoring system for, and a method of monitoring, industrial plants or apparatus, and one application of the invention is in nuclear reactors for the detection of fault conditions.

A monitoring system is described in UK Patent GB 2 142 206 B in which a test signal generator generates signals which are superimposed on data signals from a plant in such a way as to create a recognisable pattern of acceptable and unacceptable signals (as long as the data signals themselves all lie within acceptable limits). Correct operation of the plant and of the monitoring system is assured as long as the expected pattern is received. The received pattern represented as binary digits is compared to the expected pattern eight bits at a time, each bit (0 or 1) representing an acceptable or unacceptable received signal. A dynamic output is generated by comparing the expected pattern to the received pattern (so it should match) , and then to the next received pattern. An upper limit is placed on the frequency of the dynamic output by the time taken to receive all eight signals and to assess which are acceptable and which unacceptable. Although this monitoring system is suitable under some circumstances, it may sometimes be desirable to have a more rapidly oscillating dynamic output than this system can provide.

According to the present invention there is provided a system for monitoring data signals from a plant or apparatus, each data signal representing a parameter of the plant or apparatus, the system comprising, means for examining the data signals and for providing status signals representing whether each data signal represents an acceptable or an unacceptable state of the respective parameter; means for supplying test signals in such a way that the examining means produces a recognisable pattern of

said status signals as long as the parameters remain in acceptable states; and a pattern recognition means arranged to receive the said status signals, to form an array of digits corresponding to a plurality of status signals and to compare the pattern of the array with a reference pattern, and to provide output signals representing the outcome of that comparison, the system also comprising a memory unit arranged to supply the reference pattern to the pattern recognition means, and means to cause the memory unit to supply a multiplicity of such reference patterns in succession for comparison with each said array, the succession of reference patterns being such that a desired sequence of output signals is provided by the pattern recognition means as long as the parameters remain in the acceptable states.

This technique of supplying the reference patterns enables a dynamic output of much higher frequency to be obtained, the upper limit to the frequency being set in practice by the storage capacity available in the memory unit. For example a square wave output can be obtained at a frequency 256 times the rate at which new arrays are generated from the status signals, by arranging the memory unit to supply 256 successive reference patterns which are alternately the same as and different from the pattern of the array, for every different array.

Not only can the dynamic output be of higher frequency than was possible with the previously known systems, but the system of the invention can be arranged to generate any desired output bit code, by suitable programming of the memory unit. In particular the memory unit can supply a succession of reference patterns such that the output signal is a binary code suitable as one input to a pulse-coded logic (PCL) guardline.

A pulse-coded logic guardline system is described in

an article by B. Fast, in "Science and Technology of fast reactor safety", BNES, London, 1986. The system includes three PCL guardlines each of which includes its own pulse generator which is synchronised with those in the other guardlines, and which produces a respective repeating binary-coded pulse train A, B, or C. The coded pulses are supplied to instruments monitoring parameters of a plant (there are three instruments for each parameter, each receiving one of the pulse trains A, B, or C), and if the instrument is un-tripped (i.e. the parameter has an acceptable value) then the received pulse train is distributed back to all three guardlines. Each guardline votes on a two-out-of-three basis on the three coded pulse trains received from each instrument, giving a square-wave dynamic output as long as at least two of the pulse trains A, B, or C is received corresponding to each monitored parameter; the codes are however such that tripping of any one instrument can be identified, even though it does not trip the guardline itself.

A variety of different repeating binary codes are suitable as PCL pulse-train inputs, depending on the voting strategy adopted (e.g. 2-out-of-4, or 3-out-of-4) and on how long a pulse train is desired. For example for 2-out-of-3 voting, failure of any one instrument (stuck at 0, or stuck at 1) can be identified using six bits of code, but typically a ten-bit or sixteen-bit code would be used. With an n-bit code it is apparent that the square-wave dynamic output from the guardline will be at a frequency n-times less than the frequency at which the binary code pulses are generated.

The present invention thus enables a monitoring system using pattern recognition to be coupled dynamically to PCL guardlines, and it enables that coupling to be performed at a much higher frequency that that at which arrays are generated from the status signals, so that in spite of the

inevitable n—times frequency decrease in the PCL guardline the output from the guardline is still of satisfactorily high frequency. Generating the PCL code in this way provides the further safety advantage that the code exists nowhere in the electronic circuitry forming the system, except at the output from the pattern recognition unit, and so the correct PCL code can only be generated by correct operation of the circuitry.

In the preferred embodiment the PCL code is an n-bit code, and N such n-bit codes are provided by the pattern recognition means in succession for any one array (N and n are positive integers) ; the memory unit supplies reference patterns to the pattern recognition means at a frequency Nxn times the frequency at which new arrays are formed; the last bit of the PCL code corresponds to a mis-match between the array and the reference pattern; the reference pattern supplied by the memory unit in creating the last bit of the Nth code is the same as the next expected array (and so should be a mis-match) ; and the memory unit does not change its reference pattern as the next array is formed. Consequently the number of reference patterns stored by the memory unit is [(Nxn)-l] for each array of the pattern.

The invention will now be further described by way of example only, and with reference to the accompanying drawings, in which

Figure 1 shows a block diagram of a monitoring system;

Figure 2 shows a block diagram of a plant protection system incorporating monitoring systems as in Figure 1;

Figures 3a, 3b and 3c show graphically sixteen-bit binary codes for a plant protection system as

shown in Figure 2; and

Figure 4 shows a block diagram of the pattern recognition unit of the monitoring system of Figure 1.

Referring to Figure 1, a monitoring system 10 for monitoring temperatures at sixteen locations in a core of a nuclear reactor (not shown) has sixteen input terminals 12 (only four are shown) to which leads carrying data signals from sixteen temperature sensors (not shown) are connected. Each input terminal 12 is connected to one input 14 of a respective two-input, signal adding-and-amplifying unit 16 (only four are shown) , the other input 18 of which is connected to a test signal generating system 22. The output of each unit 16 is connected to a respective input of a sixteen input multiplexer 20, whose output is connected through an analogue-to-digital converter 24 to a signal analyser 30 arranged to provide an input to a pattern recognition unit 40 in response to a data request- signal from the unit 40.

In operation of the monitoring system 10, the multiplexer 20 scans sequentially the signals it receives, which in the absence of signals from the test signal generating system 22 would correspond to the data signals representing the temperatures of the temperature sensors connected to the input terminals 12. At the end of each scan the polarity of the output from the multiplexer 20 is reversed, and the signal analyser 30 identifies this polarity change as signifying the beginning of a new scan. The signal received by the signal analyser 30 hence consists of a sequence of signals in digital form, each representing the temperature of one of the temperature sensors. The signal analyser 30 is a computer which, from the signal from each sensor:

(a) calculates the corresponding temperature;

(b) determines whether the temperature lies within predetermined acceptable limits for that sensor;

(c) calculates the rate of change of temperature, from the calculated temperature and a memory of the previously calculated temperature;

(d) determines whether the rate of change of temperature lies within predetermined acceptable limits for that sensor;

(e) updates the memory of the temperature of that sensor if both the temperature and the rate of change of temperature lie within the respective limits; and

(f) gives an output signal "1" if both the temperature and the rate of change of temperature are acceptable, or an output signal "0" if either the temperature or the rate of change of temperature are unacceptable.

The test signal generating system 22 consists of a test signal generator 32 for producing a sequence of signals in digital form, and connected by a data link 42 to the signal analyser 30 for receiving the memory of the current values of the temperatures of the sensors. The test signal generator 32 is connected through a digital-to- analogue converter 34 to the input of a sixteen output demultiplexer 36, the outputs of which are connected through respective sample-and-hold amplifiers 38 (only four of which are shown) to the inputs 18 of the units 16, each amplifier 38 being adapted to generate a steady signal corresponding to the most recent signal received from the demultiplexer 36 until it receives the next signal from the demultiplexer 36.

Thus the signals produced by the test signal generator 32 are superimposed in analogue form on the data signals

from the sensors by the signal adding-and-amplifying units 16. Some of the signals produced by the test signal generator 32, referred to as test signals, are such as to cause the multiplexer 20 and hence the signal analyser 30 to receive a signal representing a temperature outside the acceptable limits, or representing a temperature corresponding to an unacceptable rate of change of temperature, while other signals from the test signal generator 32 have no such effect on the respective data signals. The test signal generator 32 is programmed to calculate suitable values of test signals, utilising where necessary the temperature values received from the signal analyser 30 via the data link 42, so as to result in a desired test pattern of acceptable and unacceptable signals, i.e. to produce a desired sequence of "0" and "1" output signals from the signal analyser 30. The presence of the desired pattern is then detected by the pattern recognition unit 40.

It is clearly important for the test signal generator 32 and the demultiplexer 36 to operate in phase, so that the test signals are supplied to the appropriate sample-and-hold amplifiers 38, and this is ensured by the use of timing signals provided by a timer 44. Timing signals from the timer 44 also control the multiplexer 20 so that the multiplexer 20 performs one scan of the inputs it receives for every scan of the demultiplexer 36.

In this example the complete pattern of test signals is produced in eight scans of the multiplexer 20, the test signals being applied to the inputs 18 of a different selection of adding-and-amplifying units 16 on successive scans of the multiplexer 20. The pattern is then repeated. The sequence of output signals from the signal analyser 30 is shown in Table 1. It will be observed that with this pattern, each input is tested at least once; one input is tested twice, five are tested three times, five are tested

four times, three are tested five times, and one is tested six times. (The hexadecimal equivalents of the first four sets of eight bits are given in brackets, the first bit in each set being the least significant (units) digit) .

Table 1

1st Scan 2nd Scan 3rd Scan 4th Scan

1 0 1 1 0 0 0 0 1 1 0 1 1 (3D) 0 (B4) 1 1 1 1 0 0 1 1 1 0 0 0 0 1 0 1 1 1

1 0 0 1 1 0 0 1 1 1 1 0 0 (67) 0 (44) 1 1 0 0 1 1 1 0 0 1 1 1 1 1 0 0 1 1

5th Scan 6th Scan 7th Scan 8th Scan

1 0 0 0 0 0 1 1 1 1 0 0 0 1 1 0 0 0 1 1 1 0 1 1 1 0 1 1 0 0 1 1

0 0 0 1 1 1 0 1 1 1 1 1 0 1 0 1 1 0 1 0 0 1 0 0 1 0 0 0 0 1 0 0

Referring to Figure 2, there is shown a plant protection system 50 which includes three monitoring systems 10 as described above, and which differ only in the binary code output signals provided by the respective pattern recognition units 40, identified as codes A, B, and C. These binary code output signals are supplied as inputs to an interface unit 52 forming part of a pulse-coded logic guardline 54. The guardline 54 also includes a pulse generator 56 which generates set and reset pulses, and a guardline monitor 58 which receives the set and reset pulses after their passage through the interface unit 52. (The pulse generator 56 also provides signals to synchronise operation of the monitoring systems 10). The set pulses are propagated through the interface unit 52 as long as two out of three of the code signals A, B, and C are 1; the reset pulses are propagated through the interface unit as long as two out of three of the code signals A, B, and C are 0. In this example the PCL codes are ten-bit codes, as indicated in Table 2, in which TO to T9 are successive time intervals:

Table 2

TO Tl T2 T3 T4 T5 T6 T7 T8 T9

As long as at least two of the monitoring systems 10 provide respective codes A, B, or C, the guardline monitor 58 receives a set pulse 1 at time TO, and receives a reset pulse 1 at time T5, and consequently generates a square-wave dynamic output signal. If any single one of the codes is stuck at 0 this will affect the receipt of the

set signal by the monitor 58 in time intervals Tl, T2 and/or T3 (so the identity of the failed code can be determined), while if any single one of the codes is stuck at 1 this will affect the receipt of the reset signal in the time intervals T6, T7 and/or T8 (so the identity of the failed code can be determined) .

A plant protection system 50 may include several interfaces 52 in series between the pulse generator 56 and the monitor 58, each with its respective monitoring systems 10. A system 50 may also include a different number of monitoring systems 10, for example four instead of three, and the binary code signals might have a different number of bits, for example sixteen. Referring now to Figures 3a, 3b and 3c, sixteen-bit codes are shown graphically as follows: codes A, B and C suitable for a two-out-of-three voting guardline (Figure 3a); codes A, B, C and D suitable for a three-out-of-four voting guardline (Figure 3b); and codes A, B, C-and D suitable for a two-out-of-four voting guardline (Figure 3c). In each case the outcome of the voting is shown graphically. The time intervals Tl to T6 enable any single code stuck at 0 to be identified; the intervals T9 to T14 enable a single code stuck at 1 to be identified.

Referring now to Figure 4 a block diagram is shown of the pattern recognition unit 40 of the monitoring system 10 of Figure 1. The unit 40 receives from the signal analyser 30 signals representing the sequence of binary digits listed in Table 1, these signals being received eight bits at a time by an eight-bit comparator 60, every 16.4 milliseconds, in response to a data request signal from a control logic unit 62 to the signal analyser 30. The control logic unit 62 receives timing signals from a clock unit 64, and sends a control pulse every 64 microseconds to a twelve-bit counter 66. The output from the counter 66 is

supplied to a programmable read-only memory 68, so that it sends a new eight-bit reference pattern to the comparator 60 every 64 microseconds.

The memory 68 is programmed so that the binary output code provided by the comparator 60 is (by way of example) the A code suitable as an input for a two-out-of-four PCL guardline, as shown in Figure 3c, that is to say 1011111101010100, each digit being of duration 64 microseconds. This requires the first reference pattern from the memory 68 to match the first eight-digit array received from the signal analyser (00111101, which is 3D in hexadecimal notation) ; the next reference pattern must not match, and is preferably 00000000 (= 00 in hexadecimal); the next reference pattern must match (=3D); the next must match (=3D) etc.

The reference patterns are thus provided by the memory 68 to the comparator 60 at a frequency 256 times higher than that at which eight-bit arrays are received from the signal analyser 30, so the sixteen-bit code A of Figure 3c is generated sixteen times for each new eight-bit array from the signal analyser 30. In this example the 256th reference pattern provided by the memory 68 is the same as the next eight-bit array 01100111 (= 67 in hexadecimal) expected from the signal analyser 30 and so will give a mismatch. The control logic unit 62 does not send any signal to the counter 66 when it sends the next data request signal to the signal analyser 30, so that when the next eight-bit array is received the comparator 60 will indicate a match with its current reference pattern. Thus the reference memory 68 stores all the patterns needed to generate 256 bits of output code A in just 255 memory addresses; the entire pattern from the signal analyser 30 (see Table 1) consists of sixteen eight-bit arrays, so the reference memory 68 must have 16x255 = 4080 addresses in

each of which a reference pattern is stored. When the 4080th reference pattern has been output the counter 66 is reset to zero.

As a check on its correct operation the pattern recognition unit 40 also includes a code checking unit 70 to which the output from the comparator 60 is supplied. The output is also supplied to an output veto gate 72 controlled by a dynamic latch 74, the latch 74 being controlled by the code checking unit 70. Every bit of the output PCL code is checked against a hard-wired code, and the phase of the code is also checked; if the output is not the expected code (i.e. code A of Figure 3c) then the gate 72 is closed and a trip warning indicator 76 is operated.

It will be appreciated that the pattern recognition unit 40 can be arranged to provide any desired PCL code by suitably programming the read-only memory 68, or indeed can be arranged to provide any other desired output code such as a high frequency square wave. Equally the frequency with which output code bits are provided may differ from that described above (once every 64 microseconds); this frequency can be changed by changing the frequency at which the control logic unit 62 supplies control pulses to the counter 66.