I. INTRODUCTION

In order to study lead-bismuth eutectic (LBE) related technologies, a multifunction LBE loop named KYLIN-II-M has been built at the Institute of Nuclear Energy Safety Technology of Chinese Academy of Sciences and operated since 2013. It aimed at the corrosion, oxygen measurements, and control tests for the LBE fast reactor [1]. The loop is characterized by the "8" structure with forced circulation driven, as shown in Fig. 1. It consists of a molten tank, a storage tank, a flow meter, a pump, a cooler, a heater, a heat exchanger, an oxygen control facility, and three experimental sections etc. Compared to other LBE loops [2-4], the specialty of KYLIN-II-M is its operating temperature which can reach 800 ℃ and its continuous running time which is over 10000 h.

Fig. 1.Full-screen View

The structure block diagram of KYLIN-II-M.

To guarantee that the high temperature LBE loop is operating normally, process variables(such as flow, pressure, liquid level and temperature), control valves, and other components must be monitored in real time. Even though the LBE loop is a non-nuclear facility, a high performance of safety, stability and reliability is necessary. In order to meet the requirements of the experiment, a data acquisition and control system (DACS) based on a programmable logic controller (PLC) and a data acquisition card system was developed. In this system, the PLC is applied to measure the low frequency signal of the sensors and control execution components. In the meantime, the data acquisition card system is designed to measure the high frequency signal of the sensors.

Most DACSs of existing LBE loops are developed based on PLC systems and "one point to one point" hardware measurement and control technologies [5, 6]. However, when a problem with the I/O port occurs, the overall system may malfunction. It will affect the normal and secure operation of the LBE loop. In addition, there are also lots of DACSs which are based on data acquisition card systems [7, 8]. Although hardware redundancy technology is adopted to reach the requirements of a DACS’s operation reliability, it will not monitor and control the LBE loop flexibly. Due to the fact that the data acquisition system usually has no CPU and storage module, when the monitored computer is down, the system will not work normally.

Redundancy control and virtualization technologies have been used in the DACS of KYLIN-II-M. Redundancy control technology can not only largely improve the DACS’s reliability, but also can set the base for system expansion. The virtualization technology based on the database server can realize centralized management and storage of experimental data whilst the virtual desktop infrastructure (VDI) based virtualization technology could control the LBE loop via different operation terminals at different times. Thus, once one monitoring computer is shut down, another can gain access control to ensure system reliability and operational integrity.

II. GENERAL DESCRIPTION

The main requirements of the DACS for the KYLIN-II-M are remote monitoring and controlling in the central control room. When experiments start-up, an initial process will be done to self-check 562 data acquisition channels and 123 digital output channels. In addition, 7 analog output channels are required to control the electrically operated valve (EOV). A large amount of measurement data is stored in the database server in string format using structured query language (SQL) [9] statements during the operation of the loop. The transmission bandwidth is estimated to be as large as 100MB. All the operational parameters can meet the system requirements.

Major functions of the DACS are as follows:

— To acquire the experimental data from the field sensors, including all sensors signals, fault signals, environmental signals and operation parameters.

— To control the equipment of the loop, including all execution components (EOV, solenoid valve and vacuum pump, etc.), the pump, the heat exchanger, the insulation system and the gas system, etc.

— To realize online fault detection and fault diagnosis. In order to effectively avoid accidents caused by operation errors, a fault tolerant control and interlock protection program should be developed as well.

— To design a VDI system.

— To support remote access and control, a virtual digital loop (VDL) of the loop was developed to simulate LBE loop operating conditions in real time.

III. THE DACS ARCHITECTURE

The DACS of KYLIN-II-M consists of a main DACS, a data processed system, a user interface system and a virtual laboratory. The architecture of the DACS is presented in Fig. 2. Communication between each system is done via local area network (LAN).

Fig. 2.Full-screen View

The architecture of the DACS for KYLIN-II-M.

The main design parameters of the DACS for KYLIN-II-M are listed in Table 1. The number of designed I/O ports has more than 10% channel allowance to ensure that the system be extensible and easily-updated.

A. The main DACS

The main DACS hardware consists of Siemens S7-300 series PLC modules, NI PXI series modules and an alarm system. The architecture of the main DACS is a distribution and centralization system (DCS). Some independent systems such as driven, heater and oxygen control systems are distributed on site and used as field ET200 substation systems for the PLC master station. This considerably reduces the distance of signal transmission, thus signal detection capabilities are improved.

For the low speed data acquisition and logic control of the loop, PLC AI and DI modules were used. Their advantage includes support from comparative self-contained software and hardware systems, cost-effectiveness and reliability, and especially anti-environment disturbance ability. For the high speed data acquisition system, PXI series data acquisition cards have been used to collect high frequency signals in the dynamic measurement experiment. To adequately preserve the shape of the signals, it should sample at a much higher rate than the Nyquist frequency. Thus, the sample rate of the DACS is 5 times the maximum frequency component of the signals.

In order to guarantee operation safety and reliability of the loop, an alarm system has been developed. It consists of a fault detection system, a fault diagnosis system and a safety interlock system. First of all, the definition and classification of fault is shown in table 2. Fault classification "A" is serious accidents, fault classification "B" is normal accidents, and fault classification "C" is minor accidents. The system should be shut down as soon as possible when a serious accident occurs. Figure 3 shows the steps of the system shutdown process in a flow chart. In consideration of the operational integrity of KYLIN-II-M, when a minor accident occurs, the system should keep alarming unless the failure is recovered but not shutdown. However, due to the existence of the noise, it affects the DACS reliability of fault detection and estimate. To solve this problem, a multipoint measurement system, safety barrier and isolator were used. Different alarm modules, such as text alarms, voice alarms, GSM alarms and web distribution alarms, have been developed as well. A noticeable feature of the alarm system is the GSM alarm which will send text messages to registered cell phones when an abnormal status of the loop is detected.

Fig. 3.Full-screen View

Flow chart of fault diagnosis.

TABLE 2.Full-screen View

The main design parameters of the DACS

Fault	Definition of fault	Fault classification	The way of detection
LBE leakage	Leakage signals "ON"	A	Detection probe and pressure gauge
Fire disaster	Fire signal 8 mA	A	Smoke-actuated and flame actuated sensor
Electric leakage	Leakage current 6 mA	A	Current mode leakage protector
Temperature anomaly	Set temperature 30 ℃	A	K or N thermocouple
Pressure anomaly	≥ Maximum pressure	B	Pressure gauge
Liquid level anomaly	Tirgger the probe	B	Liquid level detection probe
Flow anomaly	≥ Maximum flow	C	Flow meter
Misoperation	Mistake operation	C	Self-test program

Show more

C. User interface system

The user interface system has developed 20 VMs for researchers in the central control room. While the data processing system distributes 20 virtual workstations and 20 VMs, all these should be monitored and controlled in a remote central control room, as well. The user interface system of the loop is designed and constructed with the aid of LAN. All experiment data can be displayed and monitored in this system. 20 virtual desktops (VD) were designed to monitor the loop operation. Note that the VDs can be switched. Thus, when the primary monitored computer is shut down, the standby VD will gain access control to ensure the system reliability and operational integrity. In this process of control, watchdog technology has been used. The instructions for transfering between the primary and the standby computers are presented in Fig. 4. When the primary monitored VD is working normally, it periodically sends reset instructions to the standby VD. Then the standby VD will be periodically reset and the control program will not be executed. However, if the primary VD fails, the transfer of reset instructions is aborted. Thus, the standby VD will execute the control program and gain control of the DACS.

Fig. 4.Full-screen View

Instructions transfer between primary and standby computer.

E. The software interface

The DACS software is developed with configuration and graphical programming language. In order to efficiently develop some special system functions, Matlab and C language have been used.

PLC software is developed by SIMATIC, as well as HMI (Human-Machine Interface), based on configuration software of WinCC and WinCC Flexible. LabVIEW, a graphical software development tool, provides another reason for choosing the PXI platform because LabVIEW enables code development by just writing graphical icons and greatly enhances productivity.

Based on the above work, remote monitor software has been developed. The principles of the DACS software interface design are simplicity, support, accessibility and versatility. The DACS of the monitor software is presented in Fig. 5. It consists of five interfaces, each interface realizing different functions. The main interface provides operators with the functions of experimental data display and key components control. In an emergency situation, some emergency measurements can be taken through the main interface. Gas valves and the subsystem (e.g. electromagnetic pump) can be controlled and monitored through the gas valve interface and subsystem interface. In the alarm interface, system alarm information and parameters can be displayed and modified. In addition, the most recent data can be viewed with automatic refresh, in addition to viewing the historical data.

Fig. 5.Full-screen View

(Color online) The main interface of the DACS software.

IV. REDUNDANCY CONTROL SYSTEM

To ensure the reliability of the DACS, the redundancy control system was designed. Both redundant methods and redundancy are studied and analyzed so as to improve the reliability and cost effectiveness of the DACS. Two redundant methods are established to research the effect of redundant methods on the reliability of the DACS. The schematic diagram of the two redundant methods is presented in Fig. 6. It consists of several control components A_n. As the influence of the intermediate is neglected, the reliability of the DACS can be calculated through the following formula

Fig. 6.Full-screen View

Two redundant mode of redundancy control system. (a) Redundant mode with series-connected after parallel-connected, (b) Redundant mode with parallel-connected after series-connected.

where, R₁(t) is the reliability of the series-connected after parallel-connected system, R₂(t) is the reliability of the parallel-connected after series-connected system, $R_{A_i}(t)$ is the reliability of control component Ai and $0<R_{A_i}(t)<1$. After numerical calculation, it can get the following result

where, i is the number of control components and i>1. Thus, the redundant mode with parallel-connected then series-connected is designed.

In order to study the relation between redundancy and reliability, the parallel control components model is established and presented in Fig. 6. When the life distributions of each component are exponential, the reliability of the control system can be calculated as

where, λ is the failure rate of the control component, and n is the redundancy of systems. Considering that the mean time between failures (MTBF) of the PLC component is nearly 300000 h [11], the failure rate can be calculated as:

As MTBF = 300000 h, the failure rate λ is 5.0×10^-6.

In this case, the reliability of the system under different redundancies will be presented, especially with the redundancy n=1, 2, 3 and 4, as shown in Fig. 7.

Fig. 7.Full-screen View

(Color online) The reliability of DACS.

From Fig. 7, it is clear that reliability of the DACS improves as redundancy increases, but when n>2, the reliability of the DACS will not improve significantly. When the redundancy n=2 and after running 50000 h, the reliability is nearly 0.97, meeting the stability demand of the DACS. Thus, double redundancy is used in the DACS including redundant PLC CPU and functional modules.

From the analysis above, using the double redundancy and redundant mode with series-connected after parallel-connected redundancy DACS is designed and presented in Fig. 8. Under the premise of meeting the requirements in safety and reliability, the redundancy DACS should be economically with minimized control components. The key control components are applied to make experimental data reliable in the case of a loop operation emergency. Experimental data is stored in local and remote database server to ensure data security. The DACS employed a double redundant PLC CPU hot standby and functional modules (AI and DI modules) design. As the hardware structure is simple and the two CPUs are connected by Ethernet, the safety and reliability of the DACS has been greatly enhanced.

Fig. 8.Full-screen View

The block diagram of redundancy DACS for KYLIN-II-M.

V. EXPERIMENTAL AND RESULTS

The DACS has been operated for thousands of hours. Preliminary results such as temperature and flow rate have been obtained using analog input modules. The traditional survey temperature of the LBE method uses temperature sensors and puts these sensors on the pipe of the loop. In this way the measurement results may be inaccurate due to uneven heat transfer of the pipe. In order to overcome this problem, it is possible to take advantage of multi-point measuring. Then temperature average data of certain station measured will automatically be computed through the DACS. The outlet temperature measurement and result is shown in Fig. 9. From Fig. 9, the average temperature may comparatively reflect the true temperature of LBE. The variation of temperature is less than 3 ℃, it shows that the DACS is reliable and can meet the demand of loop operation. Meanwhile, the advantage of this measurement method is that in case of a temperature sensor failure, there are two remaining sensors to measure the temperature.

Fig. 9.Full-screen View

(Color online) The outlet temperature measurement method and results of heater. (a) The graph of temperature distribution; (b) The temperature result, where, T = (T1+T2+T3)/3.

The flow rate of LBE is measured by the Venturi Pitot tube flow meter. In order to make the Venturi Pitot tube work in a linear range, the pump current should not be less than 50 A and the flow rate of LBE is greater than 1 m³/h. The flow rate of LBE is measured at a temperature of 302 ℃ and is presented in Fig. 10. The results indicated that with the increasing value of pump current, the flow rate of LBE increased gently but did not indefinitely show a linear relationship. The main influence factor is the characteristics of pumping pressure.

Fig. 10.Full-screen View

(Color online) The flow rate of LBE test results.

The liquid LBE level meter is used for local level measurement. It consists of an electrode, DC power and a signal-processing unit. Two states can be measured by using this method, namely the contact height has arrived or not. This kind of method is mostly simple, self made constructions. The contact electrode technique takes advantage of the good electrical conductivity of the LBE. If an initially open electric circuit stressed by a voltage of 24VDC is closed at the moment where the liquid LBE surface makes contact with the spike of the electrode, the potential decreases. This can be captured by an optocoupler and the level translator. An optocoupler was mainly used in isolation of the liquid level signal transmission and the level translators mainly met the trigger level requirement of the PLC DI modules. The signal from the liquid level was acquired by the PLC and PXI systems to ensure the level of the loop can be controlled below safe liquid level. In order to gather more information about the actual liquid level, it is necessary to install an array of these filling level meters. A sketch of such level meters and measurement results are shown in Fig. 11.

Fig. 11.Full-screen View

The schematic of level meters and measurement results. (a) The schematic of liquid level measurement; (b) The results of liquid level measurement.

To ensure the liquid level is controlled exactly and smoothly, three level meters are used in the control process. When LBE reached the first level meter, the gas pressure was decreased to limit LBE flow rate. Once LBE reached the second level meter, the gas valve was immediately closed. When LBE reached the third level meter, the DACS would trigger an alarm.

VI. CONCLUSION

The hardware architecture solution for the high temperature liquid LBE loop, KYLIN-II-M, was presented. Virtualization technologies successfully solved the problem that the DACS is difficult to be monitored flexibly. Redundancy control improved the reliability of the DACS. The fault diagnosis has been designed to ensure security of the loop. The DACS has been operated thousands of hours and the results show that the DACS is reliable, flexible and secure.

The DACS software will be optimized further in the future to satisfy the stability and seamless operation of the loop and the a new operating system (OS), such as Linux, will be employed as well.