JPS60243593A - Logic circuit for nuclear reactor protective system - Google Patents

Abstract

(57) [Summary] This bulletin contains application data before electronic filing, so abstract data is not recorded.

Description

[Detailed Description of the Invention] [Field of Application of the Invention] The present invention detects an abnormal state in a nuclear couplant during abnormal transient changes during operation, and immediately shuts down the reactor in the event of an accident. Concerning logic circuits for nuclear reactor protection systems.

[Background of the invention]

During normal operation of the nuclear couplant, if abnormal transient conditions or malfunctions occur that may jeopardize the safety of the reactor,
Or, if such a situation is expected to occur,
In order to prevent or suppress this, there is a signal processing system that automatically triggers a protective operation and shuts down the reactor (scram).

This system is generally called the reactor protection system.

The reactor protection system is a logic circuit that processes signals from the detector that detects abnormal conditions in the plant to the start of operation of the system that scrams the reactor. This is an extremely important system, and it is designed using the following design principles.

(1) When an abnormal transient change occurs during operation, the abnormal condition is detected and the reactor shutdown system is automatically activated to prevent the fuel from exceeding the allowable design limit.

(2) Ensure that fuel permissible design limits are not exceeded for any single malfunction of the reactor shutdown system, such as accidental control rod withdrawal.

(3) In the event of an accident, it will be detected immediately and the reactor shutdown system will be activated automatically.

(4) The design shall have redundancy and electrical and physical independence, so that any single failure of the equipment or removal of the equipment from use, which may actually occur, will not impede its functionality. Make sure not to.

(5) Even if the system is shut off or the driving source is lost, the system should be in a state that is acceptable from a safety standpoint, that is, fail-safe or fail-as-is.

(6) Separate four parts from the general measurement and control system to prevent failures in the measurement and control system from affecting the reactor protection system even if parts of the system are shared.

(7) Even during normal operation, function tests can be performed periodically.

In order to satisfy these design principles, the reactor protection system of a conventional boiling water nuclear coupler is designed as follows.

As an example, the operation of the reactor protection system when the pressure in the reactor is abnormally high and it is necessary to make an emergency shutdown of the reactor will be explained using FIG. Detectors (IA, IB, IC) that detect the pressure of the nuclear reactor 101.

ID), and when the pressure exceeds a predetermined value, the operating contact is activated, and each logical channel A l * A
2 + B 1r Operate B 2. The logical configuration of the reactor protection system consists of activation of either logical channels AI or km (loutof2), and logical channels Bl and B.
If either operation of 2 (1 out of 2) is established at the same time and both logical channels A and B (2A, 2B) are activated, the reactor will come to an emergency shutdown. It is called the 2 twice logic circuit.

Control rods for emergency shutdown of the reactor are group 1゜2.3.
,4. It is divided into A detailed view of only representative group 1 is shown along with FIG. 1.

Group 1 includes a plurality of control rods for shutting down the reactor, and there is a scram valve 6 for each control rod. Control of the instrumentation air pressure 5 to this valve is performed by two solenoid valves 4A and 4B.

4A and 4B are in an energized state when the plant is normal, and are not energized when there is an abnormality.When the plant is normal, the measurement air pressure 5 is applied to the scram valve 6 through the scram pilot valve 3, and the valve is closed. There is. In the event of an abnormality, the instrumentation air pressure 5 that has been applied until now is exhausted through the scram pilot valve 3, the scram valve 6 is opened, and the control rods are urgently inserted into the reactor. Furthermore, this group 1 also provides operating signals to other scram and pilot valves.

21 Solenoid valves 4A and 4B are the 2nd part of the reactor protection system.
One detector logical channel person, B (2A.

If both channels are activated simultaneously, the reactor will scram, but if only a single channel is activated, only one solenoid valve will be de-energized and there will be no scram, i.e. the atomic In the event of a malfunction of a single piece of equipment in the reactor protection system, we are trying to avoid erroneous scrams.

FIG. 2 shows a logic circuit diagram in which the above logic circuit is simplified. The solenoid valves 4A and 4B are normally energized (E), but when a signal indicating an abnormality in the reactor, such as AL +
Bl + C1r Dt is the neutron flux height, A2 * B
2 * C2 * B2 is the reactor pressure high, ・・・・・・A
N, BN, CM, and Dw become non-energized (,NE) when the reactor water level low signal is issued, and scram occurs when jD, 4A, and 4B become non-energized at the same time.

The biggest problem with such reactor protection systems is testing during normal operation.

As a design policy for the reactor protection system, it is necessary to ensure that functional tests can be performed periodically even during normal operation. In conventional nuclear reactor protection systems, this is implemented as follows.

For example, when performing functional tests on detectors and logic circuits,
Activate the channels to which they belong. The operation state will be explained using a logic circuit diagram as shown in FIG.

In FIG. 2, 21 and 22 indicate a logical sum, and 23 indicates a logical product.

In the figure, bringing the solenoid into an operating state means performing a functional test with the four solenoids or solenoids 4B in a non-energized state. In other words, it is a half scrum situation. In such a state, if any of the channels of the other detector logic circuits were to malfunction, the reactor would immediately scram and the plant would not be able to continue operating.

Conversely, if the auxiliary relay of the detector logic circuit performing the functional test is jumpered and the test is performed with it artificially kept energized, during this test, assuming a failure in other channels, the reactor protection It has the potential to interfere with system operation.

Therefore, if you want to perform a functional test while driving,
It is better to run tests with the channel to which it belongs always in operation so as not to disturb the functionality of the reactor protection system.

Since there are many detectors and logic circuits belonging to the reactor protection system,
It takes a long time to conduct this test, and during this time the plant state is extremely unstable because it is necessary to maintain a half-scrum state.

In order to solve the above-mentioned problems, it is necessary to configure a reactor protection system that allows testing even during normal operation, reduces the risk of scrams during testing, and is highly reliable.

In order to solve these problems, studies are underway to construct a logic circuit that has a four-channel configuration and can bypass the channel to which it belongs during testing. An example of this is shown in FIG.

In Figure 3, n measurement variables PII Pla...
・.

It is assumed that P. These n measurement variables Pi
m P2 M... p, respectively, are neutron fluxes.

Refers to variables to be measured such as reactor pressure and reactor water level. Each of these n measurement variables P1 has four operating contacts P
1t m Pit s Pa1 and Pd2.

In Figure 3, this Pll m pHl * 1Pat
4 channels 20A, 20 receiving I Pd2
B, 200°20D was formed. These four logical channels 20A to 20D have the same logical configuration. Moreover, the input signals to the four logical channels 20A to 20D were also the same. In other words, it is a four-fold system of thinking. The input points to the four cooking channels are Q>(Plt.

P12+...e Pta) * Q2 (P
zx #P22 +...

Pll1 ) I Q3 (Pat # Psi + +
+++P1. ), Q4 (Pd2 rP413...
..., P4-).

Furthermore, each of the four logical channels 20A-20D is
2 out of 4 logic circuits 7, n pieces, 1 out
It has one of n logic circuit 8. These n logic circuits 7 each have a small group input (Pil r P2t #P3
凰・P4K）・（Pla、Pla・P
a2, Pa2) ・−+−−++.

(Pla I Pzx I Pa, +24m) is taken in and 2 out of 4 logical processing is performed. logic circuit 8
takes in the outputs of these n logic circuits 7, and 1oulOf
Perform n logical processing.

Output kA, B of logic circuit 8 for each channel.

Assuming C and D, the logical sum 11 performs the logical processing of A+B, and the logical sum 12 performs the logical processing of C+D. Furthermore,
In logical product 13, -fill processing of (A+B).(C+D) is performed, and if either one is 'l', a scram command is issued.

In Fig. 3, an operating contact (for example, Pi
r P*1+ Pat s Pd2 ) indicates that each logical channel operates with two operations (2 out of 4) out of four. In reality, there are n measurement variables Pt I p, j..., P, and if any one of them operates at 1 m (1 out o
f n) It is designed to start the protection operation. Finally, l out of each logical channel 20A to 20D
of 2 twice (D logic test ram is configured. The problem in this case is that the channel cannot be bypassed when testing the logical channels (tests include detector tests, etc.). If you bypass a channel (for example, logical channel 20A), logical channel 20B must be healthy, so if logical channel 20B is faulty, it may not scram, so when testing a logical channel, bypass it. The logical channel must be kept operational without being disconnected.

In other words, with the configuration shown in Figure 3, when testing the detector, it can be bypassed because it is a 2 out of 4 configuration, but when testing the logical channel, channel bypass is not possible. Similar problems cannot be completely eliminated.

[Purpose of the invention]

SUMMARY OF THE INVENTION An object of the present invention is to provide a logic circuit for a nuclear reactor protection system that is configured to improve the reliability of the reactor protection system and to facilitate functional tests even during normal operation of the nuclear couplant.

[Summary of the invention]

In order to eliminate the above-mentioned drawbacks, the present invention has a four-channel logical configuration for the reactor protection system, and two of the four channels are
The operation of the channel causes the reactor to come to an emergency stop, and during the function test, that channel is bypassed and the remaining 3 out of 9
The reactor protection system is constructed so that the reactor can be brought to an emergency shutdown by operating two of the channels, improving the reliability of the entire reactor protection system.

[Embodiments of the invention]

FIG. 4 shows an embodiment of the reactor protection system of the present invention.

The logic circuit of the reactor protection system consists of four logic channels 20
It has A to 20D. This logical channel 20A~20D
have n logic circuits 7 and one logic circuit 8, respectively. Logic circuit 7 performs 2 out of 4 logic processing, and logic circuit 8 performs l out of B) logic processing. Each logical channel 20A to 20D has the same configuration 9,
Moreover, the input signals are also the same. Therefore, a so-called quadruple logical channel is formed.

The n logic circuits 7 in the valley channel have PL (Plt
h Plt * P+u + P41 ) m Pg
(P121 Pxz rP32+ P42) *・
...I P a ('Pi111 Pg@ *
PSm +P4. ) are each manually operated. And 4 operating contacts Fil + Plt + "31 m" 41
are respectively distributed to four channels 20A to 20D.

The above configuration is the same as the prior art shown in FIG.
, 210, 211). This output processing section 21A~
21D each has one output logic section 9 and two logical sums 13. The output logic section 9 on the output side of the cooking channel 2OA takes the logic A=A+B.(C+D). The output logic section 9 on the output side of the logic channel 20B is B" =
Take the logic of B+C・(D+A). Similarly, the output logic sections 9 on the output side of the logic channels 20G and 20D have C lines=C+D・(A+B), DI=D+A・(H
+C) Cook.

The two logical sums 13 corresponding to each channel are A
” +CI, B* +D ratios are logically summed. Based on this result, the logical product 14 is (A4+CI)・(B”
+D") logic. When this output is "1", the reactor protection system is activated and the reactor is brought to an emergency shutdown. In addition, A, B
, C, D are "'1" in the operating state and "0#" in the non-operating state.
becomes.

FIG. 4 shows that all the control rods required for an emergency shutdown of a nuclear reactor are divided into four groups. This is designed to ensure that even if a failure occurs in the logic circuit, failure to insert control rods due to the failure will be limited to only one group, and control rods in the remaining three groups can be inserted in an emergency. This is because there is. Even if this situation occurs, the reactor is designed to be able to safely shut down and maintain subcriticality.

Hereinafter, only the scram by the control rods of group 1 will be described, but the same applies to the other groups.

Emergency control rod insertion can be accomplished by simultaneously de-energizing two solenoids on the scram pilot valve. In this case, the logical sum of the A and C umbrellas is 1 and one solenoid is de-energized, B* and D*
The configuration is such that the logical sum of is 1 and the other solenoid of the remaining υ is not energized.

In other words, A umbrella + CI = A + B・(C+D)+C+D・(A+B
)=A+C+B-D B book +9 book =B+C・(D+A)+f)+A・(B
+C)=B+D+A-C, 9, A''+C = 1, one of the two solenoids is not energized, B''+D'' = 1, and the remaining solenoids are not energized.

Ultimately, when both solenoids become de-energized at the same time, the control rod will be forced into emergency insertion, and this can be expressed as a logical equation as follows.

(A”+C umbrella) ・ (B* +CI)=(A+C
+B-D)・(B+D×A-C)=A-B+A-C+A
-D+B, -C+B-D+C-DThis formula clearly shows that
Out of the four logical channels (A, B, C, D), the operation of two logical channels results in (AI +C”)・(B
Umbrella+D*)=1, which indicates that the control rod will be inserted urgently, and the overall configuration of the logic circuit is 2o.
This shows that the logic is utof4.

A functional test for the logic circuit configuration described above can be performed as follows.

When performing a functional test from detector to operation, bypass the channel to which it belongs.

This bypass is equivalent to putting it into a non-operating state as expressed in a logical formula, and the logic after being bypassed will have a configuration of 2 out of 4 to 20 out of 3, which will lead to malfunctions and errors. The logic circuit is extremely strong against both malfunctions.

Similarly, when performing a functional test of a logic circuit after an operating contact, the logic channel to which it belongs is bypassed. For example, when performing a functional test on physical channel A,
Let the logical channel person be in the inactive state, A=0. At this time (A” + C”)・(B*+D umbrella) = A-B+A-C+A-D+B-C+B-D+C-D=
B-C+B-D+C-D becomes the final logic. This is clearly 2 auto
This indicates that it is a f3 logic circuit, and as with the above, it is an extremely reliable logic circuit.

On the other hand, if a malfunction of a certain logical channel is considered, the following will occur. That is, when logical channel A malfunctions and becomes operational, A=1. At this time, the final logic is (h* 10c*) ・ (B umbrella + D book) = A-B+
A-C+A-D+B-C+B-D+C-D=B+C+D If any of the remaining three channels operate, the control rods will be inserted urgently, protecting the reactor even in the event of a single malfunction. The functionality to do so is maintained.

Up to this point, we have described an example in which two solenoids attached to a scram pilot valve are de-energized at the same time in order to emergencyally insert a control rod. It can also be applied to the case of couplant. Such a plant has two electromagnetic clutches, each of which is constantly excited by a separate power source, and 211I! Even if the control rod is urgently inserted (automatically dropped) due to the simultaneous deenergization of the iI's electromagnetic clutch, or even if the electromagnetic clutch is only in one position, it is always energized by the valley-separate power supply, and the control rod can be inserted by simultaneous deenergization of the two power supplies. are being inserted on an emergency basis. In these cases as well, the same purpose can be achieved by inserting the above-mentioned output logic into a circuit that constantly excites the -magnetic clutch using two power supplies.

〔Effect of the invention〕

The effects of the present invention are as follows.

(a) The logic circuit of the reactor maintenance system is 2o as a whole.
Since the configuration is 2 out of 4, the logical channels to be tested can be bypassed (inactive) during functional tests during operation, and at this time, the logical channel configuration becomes 2 out of 3. , has a highly reliable logical configuration.

(b) Therefore, even during a functional test, it has sufficiently high reliability, there is almost no possibility of erroneous scrams, and the operating rate of the plant can be improved.

(C) Even if a single malfunction occurs, it will not result in loss of functionality and the reactor protection function can be maintained.

[Brief explanation of the drawing]

Figure 1 shows the structure of a conventional nuclear reactor protection system. Figures 2 and 3
The diagram shows the interfaces IA, IB, and IC of a conventional reactor protection system.
, ID...Detector, 2A, 2B...Detector logical channel, 3...Scram pilot valve, 4A, 4B...
... Solenoid, 5... Instrument air, 6... Scram valve, 7... 2 out of 4 logic circuit, 8...
・l out of N logic circuit, 9... Output logic circuit, 10A4.10Bt + 10Ct, 10. D.I.
...Operating contact. Agent: Patent Attorney Masami Akimoto Figure 1 Figure 2

Claims (1)

[Claims] 1. A logic circuit of a reactor protection system for emergency shutdown of a nuclear reactor has a plurality of measurement variables P1 to P for detecting an abnormality in the atomic couplant, and each measurement variable P' 1 (
x=1.2.・・・・・・+n) is at least four operating contacts P1' + "!l * pat I PI3
and the pH+ P311 P31 m PI
3 signals to form four logical channels, and the four
Each of the three logical channels has n subgroups (Ptt I pat j P31 # P
I3) + (PI3 +P112 + P32 r
P42) *・Old..., (pt□P2□P3□P4.
), perform 2 out of 4 logical processing for each small group, then perform 1 oLIt □f n logical processing on the logical outputs of these n small groups, and perform the above four logical processes. When the logical outputs of channel 1 out of n are A, B, C, D, on the processing output side of the first logical channel, A'' = A + B
・(c+n) In B on the processing output side of the second logical channel =B+C
・(D1A) 0 on the processing output side of the third logical channel =C+D
・(A+B) On the processing output side of the fourth logical channel, DI = D+A
・Perform the logical processing of (B+C), take in the four logical outputs AI, B book, C *, D skewer,
A logic circuit of the reactor protection system that activates when (A middle + C lines)・(Bψ10”)=1 and generates the output that should cause the reactor to stop urgently.