Nuclear reactor protection system with built-in diversity

Abstract

The invention discloses a nuclear reactor protection system with built-in diversity. A system architecture with three sequences, local coincidence logic, two-stage two-out-of-three voting and parallel processing of two technical routes is adopted. Wherein the three sequences are three multiple sequences, each sequence is composed of a plurality of subsequences adopting different technical route devices, and three subsequences adopting the same technology form a subgroup; each subgroup has the capability of independently executing a security function; system architecture configuration with built-in diversity is adopted, additional arrangement of a DAS system is not needed, better compactness is achieved, and the requirement of a small reactor for space is better met; a plurality of subgroups use chips based on different technologies, adopt different architecture schemes, different development tools and logic design methods, have independent safety function driving paths, and adopt diversified means for verification and confirmation, so that common cause faults can be effectively handled.

Description

Technical Field

[0001] The invention belongs to the technical field of nuclear reactor safety protection, and in particular relates to a nuclear reactor protection system with built-in diversity. Background Art

[0002] The statements herein merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] Nuclear safety is the most critical factor in nuclear energy applications, and the Reactor Protection System (RPS), as a safety-related part of the nuclear facility instrumentation and control system, is the "safety guard" that ensures the safe operation of nuclear power plants. RPS monitors parameters directly related to the reactor and safety barrier throughout the life of the nuclear facility. When the monitored safety parameters reach or exceed the preset protection action setting value, it executes safety functions such as emergency shutdown and dedicated safety facility actuation to mitigate the consequences of operating events or accidents and maintain the integrity of the nuclear facility safety barrier. A safe and reliable RPS can ensure the safety of the reactor to the greatest extent when abnormal conditions occur in nuclear facilities, and reduce the impact and consequences of events / accidents.

[0004] Compared with large nuclear power plants, new nuclear facilities / devices such as small nuclear power plants, research reactors, and marine reactors have new design features, including: 1) small reactor power; 2) integrated or compact configuration, small layout space; 3) large coolant volume; 4) full use of passive safety technology (natural circulation, gravity or pressurized injection). Design features 1), 3), and 4) give the above-mentioned small reactors the advantage of high inherent safety, while design feature 2) places higher requirements on the space occupied by each system.

[0005] At present, the RPS of large commercial nuclear power plants (such as Guohe No. 1) with relatively mature applications in the industry generally adopts a 4-redundant sequence and 4-out-of-2 logic voting architecture configuration mode, and an additional diversified actuation system (DAS) with diversity such as RPS is set up to provide the ability to perform backup emergency shutdown and dedicated safety facility driving functions to prevent common cause failures (common cause failure / failure: multiple failures attributed to the same cause) of RPS. However, the traditional RPS+DAS solution cannot perfectly adapt to the application requirements of small reactors. First, the system configuration scheme of RPS+DAS is highly complex and large in scale, which cannot meet the design requirements of compactness of small reactors; secondly, small reactors have good inherent safety, and the system configuration scheme of RPS+DAS is relatively reliable and over-designed. Therefore, it is necessary to carry out architecture design for RPS of small reactors to meet the characteristics of compactness and high inherent safety of small reactors. Summary of the invention

[0006] The purpose of the present invention is to overcome the deficiencies in the above-mentioned prior art and to provide a nuclear reactor protection system with built-in diversity. The system architecture configuration with built-in diversity is adopted, and there is no need to set up an additional DAS system. The system has better compactness and is more adaptable to the space requirements of small reactors. Multiple subgroups use chips based on different technologies, adopt different architecture schemes, different development tools and logic design methods, have independent safety function driving paths, and adopt diverse means for verification and confirmation, which can effectively deal with the occurrence of common cause failures. Compared with the traditional RPS+DAS combination, the system is simpler, has better economic characteristics, and is conducive to promotion and implementation.

[0007] In order to achieve the above object, the present invention is implemented through the following technical solutions:

[0008] The technical solution of the present invention provides a nuclear reactor protection system with built-in diversity, which adopts a system architecture of three sequences, local coincidence logic, two-level three-out-of-two voting, and two technical routes for parallel processing;

[0009] The three sequences are three multiple sequences, each of which is composed of multiple subsequences using different technical route equipment, and three subsequences using the same technology constitute a subgroup; each subgroup has the ability to independently execute safety functions;

[0010] All three sequences contain the same number of set value processing subsystems and voting logic subsystems as the number of subgroups; two of the sequences also contain an equipment control subsystem and a shutdown relay matrix;

[0011] The fixed value processing subsystem is used to receive the sensor input signal of the sequence and perform the fixed value comparison operation, and send the fixed value comparison result to the voting logic subsystem belonging to the same subgroup in the three sequences;

[0012] The voting logic subsystem is used to receive the set value comparison results sent by the set value processing subsystems of the three sequences belonging to the same subgroup, perform two-out-of-three voting, and send the voting results to the equipment control subsystem or the shutdown relay matrix belonging to the same subgroup respectively;

[0013] The device control subsystem is used to receive the logic voting results sent by the three voting logic subsystems from the same subgroup, and perform a two-out-of-three vote; when the vote is passed, it sends a device trigger signal to the actuator of the controlled device;

[0014] The shutdown relay matrix is ​​used to receive system-level shutdown drive command signals from three voting logic subsystems belonging to the same subgroup and other systems, and after executing three-out-of-two relay logic voting, send commands to the shutdown circuit breaker.

[0015] In at least one embodiment, the multiple constant value processing subsystems of each sequence all adopt different technical route devices; the multiple voting logic subsystems of each sequence all adopt different technical route devices.

[0016] In at least one embodiment, the equipment control subsystems of the two sequences use equipment of different technical routes; the shutdown relay matrices of the two sequences use equipment of different technical routes.

[0017] In at least one embodiment, the device control subsystem generates a system-level device trigger signal when the vote is passed, then generates a device-level trigger signal through fan-out, and finally sends the device trigger signal to the actuator of the controlled device through the device interface module.

[0018] In at least one embodiment, when the shutdown relay matrix sends a command to the shutdown circuit breaker, the shutdown circuit breaker connects the power circuit of the control rod drive mechanism. When the circuit breaker is opened, the control rod drive mechanism is powered off, and the control rods fall into the core due to gravity, completing the shutdown.

[0019] In at least one embodiment, each sequence is provided with an independent field sensor, and the measurement value signal collected by the field sensor is input into the constant value processing subsystem of the sequence after data processing, and the constant value processing subsystem compares the measurement value with the set value; if the measurement value exceeds the preset set value, the constant value processing subsystem will generate a local shutdown command triggered by the measurement value.

[0020] In at least one embodiment, each device control subsystem includes two three-out-of-two voting modules, each voting module receives three-out-of-two voting results from three voting logic subsystems of the same subgroup, and performs three-out-of-two voting again; the voting results generated by the two three-out-of-two voting modules are respectively fanned out as device-level trigger signals.

[0021] In at least one embodiment, each device interface module receives device-level trigger signals fanned out by two three-out-of-two voting modules respectively, and performs two-out-of-two matching logic voting; when the matching logic is satisfied, the device interface module sends the final device control command to the device's actuator.

[0022] In at least one embodiment, the set value processing subsystem can also send the set value comparison result directly to the shutdown relay matrix for logical voting.

[0023] In at least one embodiment, two sequences of equipment control subsystems respectively control two redundant dedicated safety devices in the nuclear facility process system, and any dedicated safety device driver has the ability to fully mitigate the corresponding accident, satisfying the single failure criterion.

[0024] The beneficial effects of the technical solution of the present invention are as follows:

[0025] 1) A nuclear reactor protection system with built-in diversity of the present invention adopts a system architecture configuration with built-in diversity, does not need to set up an additional DAS system, has better compactness, and is more adaptable to the space requirements of small reactors.

[0026] 2) A nuclear reactor protection system with built-in diversity of the present invention has three multiple sequences, with physical and electrical isolation between the sequences, including from top to bottom: fixed value logic layer, compliance logic layer and device driver layer, realizing two-level 2 / 3 voting; each sequence is composed of two subsequences using different technical route equipment, and three subsequences using the same technology constitute a subgroup, and the functions of the subgroups are independent, and each subgroup can independently complete the emergency shutdown and dedicated drive functions. Each subgroup uses chips based on different technologies, adopts different architecture schemes, different development tools and logic design methods, has an independent safety function drive path, and uses diverse means for verification and confirmation, which can effectively deal with the occurrence of common cause failures.

[0027] 3) A nuclear reactor protection system with built-in diversity of the present invention is aimed at the nuclear power high shutdown function path, and its set value comparison is implemented in the nuclear measurement system, and the voting logic is implemented in the RTM of the two subgroups of the two DERPS respectively, which reduces the response time of the safety function to perform analog-to-digital conversion and signal processing in the DERPS.

[0028] 4) The nuclear reactor protection system with built-in diversity of the present invention is simpler than the traditional RPS+DAS combination, has better economic characteristics, and is conducive to promotion and implementation. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0030] Figure 1 is a schematic diagram of three processing layers from top to bottom of a nuclear reactor protection system with built-in diversity of the present invention;

[0031] Figure 2 It is a schematic diagram of three entity sequences and subsequences of a nuclear reactor protection system with built-in diversity of the present invention;

[0032] Figure 3 It is a schematic diagram of two subgroups of a nuclear reactor protection system with built-in diversity according to the present invention;

[0033] Figure 4It is a system architecture and signal flow diagram from a sequence perspective of a nuclear reactor protection system with built-in diversity of the present invention;

[0034] Figure 5 It is a subgroup angle system architecture and signal flow diagram of a nuclear reactor protection system with built-in diversity of the present invention;

[0035] Figure 6 It is a schematic diagram of a method for executing a nuclear power high shutdown function of a nuclear reactor protection system with built-in diversity according to the present invention;

[0036] Figure 7 It is a schematic diagram of a method for executing a dedicated safety facility driving function of a nuclear reactor protection system with built-in diversity according to the present invention. DETAILED DESCRIPTION

[0037] It should be noted that the following detailed descriptions are illustrative and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used in the present invention have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0038] Terminology explanation:

[0039] RPS: Reactor Protection System;

[0040] DAS: Diverse Actuation System;

[0041] Common cause failure / failure: Multiple failures attributed to the same cause;

[0042] DERPS: Diversity-Embeded Reactor Protection System;

[0043] Sequence: The name of a given group of systems or equipment that can be physically, electrically, and functionally independent of other redundant equipment groups;

[0044] Local coincidence logic: Voting is first performed on the two-state logic output signals of the redundant instrument channels of each protection parameter. After processing, the output signals are subjected to "n out of 1" coincidence logic with other output signals that have also undergone coincidence processing.

[0045] 3 out of 2 (2oo3) voting: if two of the three binary inputs (0 or 1) are 1, the output is 1;

[0046] BL: fixed value processing subsystem;

[0047] VL: voting logic subsystem;

[0048] CL: Equipment control subsystem;

[0049] RTM: trip relay matrix;

[0050] Fan-out: Decompose a system-level trigger signal that drives multiple devices simultaneously into trigger signals for each device;

[0051] Equipment interface module: the interface device between RPS and the actuator of the controlled equipment, which executes the priority selection logic and equipment driving logic and belongs to RPS;

[0052] Channel: A configuration of components and assemblies required to generate a single protection action signal when the nuclear power plant operating conditions require it. A channel terminates at the confluence of the single protection action signals.

[0053] As introduced in the background technology, the purpose of the present invention is to overcome the shortcomings existing in the above-mentioned prior art and provide a nuclear reactor protection system with built-in diversity. It adopts a system architecture configuration with built-in diversity, does not require an additional DAS system, has better compactness, and is more adaptable to the space requirements of small reactors; multiple subgroups use chips based on different technologies, adopt different architecture schemes, different development tools and logic design methods, have independent safety function driving paths, and use diverse means for verification and confirmation, which can effectively deal with the occurrence of common cause failures; compared with the traditional RPS+DAS combination, it is simpler, has better economic characteristics, and is conducive to promotion and implementation.

[0054] Example 1

[0055] This embodiment discloses a nuclear reactor protection system with built-in diversity, which adopts a system architecture of three sequences, local coincidence logic, two-level three-out-of-two voting, and two technical routes for parallel processing;

[0056] Among them, the three sequences are three multiple sequences, each sequence is composed of multiple subsequences using different technical route equipment, and three subsequences using the same technology constitute a subgroup; each subgroup has the ability to independently execute safety functions;

[0057] All three sequences contain the same number of set value processing subsystems and voting logic subsystems as the number of subgroups; two of the sequences also contain an equipment control subsystem and a shutdown relay matrix;

[0058] The fixed value processing subsystem is used to receive the sensor input signal of the sequence and perform the fixed value comparison operation, and send the fixed value comparison result to the voting logic subsystem belonging to the same subgroup in the three sequences;

[0059] The voting logic subsystem is used to receive the set value comparison results sent by the set value processing subsystems of the three sequences belonging to the same subgroup, perform two-out-of-three voting, and send the voting results to the equipment control subsystem or the shutdown relay matrix belonging to the same subgroup respectively;

[0060] The device control subsystem is used to receive the logic voting results sent by the three voting logic subsystems from the same subgroup, and perform a two-out-of-three vote; when the vote is passed, it sends a device trigger signal to the actuator of the controlled device;

[0061] The shutdown relay matrix is ​​used to receive system-level shutdown drive command signals from three voting logic subsystems belonging to the same subgroup and other systems, and after executing three-out-of-two relay logic voting, send commands to the shutdown circuit breaker.

[0062] In this embodiment, three sequences A, B, and C and two subgroups are used for detailed description.

[0063] The system architecture of the nuclear reactor protection system with built-in diversity in this embodiment has the following characteristics:

[0064] (1) The physical and electrical isolation between the three multiple sequences A, B, and C includes three processing layers from top to bottom: the fixed value logic layer, the compliance logic layer, and the device driver layer. Figure 1 As shown, the custom logic layer includes a custom processing subsystem (BL), the conforming logic layer includes a voting logic subsystem (VL), and the device driver layer includes a device control subsystem (CL), a trip relay matrix (RTM) and a trip circuit breaker.

[0065] (2) Each sequence is composed of two subsequences (subsequence I and subsequence II) of different technical route equipment, such as Figure 2 As shown. Three subsequences using the same technology constitute a subgroup (subgroup I and subgroup II), as shown Figure 3 The two subgroups are diversely designed and functionally independent. Each subgroup can independently complete the process from signal acquisition to the output of the final device control signal, and has the ability to independently perform safety functions, that is, built-in diversity.

[0066] (3) Using local coincidence logic, first perform fixed value comparison and 2oo3 voting on the same parameter, and then take the "OR" of the function-related voting results to generate the final drive signal.

[0067] The two subgroups using different technologies have the following characteristics:

[0068] (1) It is based on two different types of chips developed and manufactured by different manufacturers, and the two chips have different underlying architectures and operating mechanisms;

[0069] (2) adopt different architectural schemes, including input / output (I / O) and functional logic allocation;

[0070] (3) Use different development tools and logic design methods;

[0071] (4) There is no signal transmission between the two subgroups on the safety function drive link, and they are independent;

[0072] (5) Implement independent verification and validation using means that are diverse from development activities.

[0073] Therefore, the DERPS of this embodiment does not have any credible potential common cause failure mechanism that may cause the simultaneous failure of two subgroups, and there is no need to set up an additional DAS.

[0074] In this embodiment, the three sequences A, B, and C each include two fixed value processing subsystems (BL-X1 and BL-X2, X is A, B or C, corresponding to the three sequences A, B, and C) using different technical route equipment and two voting logic subsystems (VL-X1 and VL-X2, X is A, B or C, corresponding to the three sequences A, B, and C) using different technical route equipment. The A and B sequences each include one equipment control subsystem, namely CL-A1 and CL-B2, respectively, and the two use different technical route equipment. The A and B sequences each also include one shutdown relay matrix (RTM), namely RTM-A2 and RTM-B1, respectively, and the two use different technical route equipment.

[0075] The fixed value processing subsystem (BL) is mainly used to receive inputs from field sensors to obtain sensor inputs related to the emergency shutdown of the reactor and the driving functions of the dedicated safety facilities, and to perform calculations or logical operations on the obtained sensor inputs to confirm whether the reactor has abnormal operating conditions. BL-X1 and BL-X2 share the field sensor input signals of this sequence and perform the same data processing and fixed value comparison operations. After completing the operation, BL forms a local trigger signal with the fixed value comparison result and further sends it to the VL belonging to the same subgroup in the three sequences.

[0076] The voting logic subsystem (VL) is mainly used to determine whether to execute the reactor shutdown function through control logic and compliance voting. VL receives the local trigger (fixed value comparison result) signal sent by the BL of the three sequences belonging to the same subgroup, performs three-out-of-two (2oo3) voting, and sends the voting results to the CL or RTM of the same subgroup. The logic voting result is the system-level dedicated safety facility drive command signal.

[0077] The device control subsystem (CL) is mainly used to determine whether to execute the dedicated safety facility drive function through control logic and compliance voting. CL receives the system-level dedicated safety facility drive command signal sent by the three VLs in the same subgroup and performs 2oo3 voting. When the vote is passed, a system-level device trigger signal is generated, and then a device-level trigger signal is generated through fan-out, and finally the device trigger signal is sent to the actuator of the controlled device through the device interface module.

[0078] The trip relay matrix (RTM) is mainly used to determine whether to execute the dedicated safety facility drive function through control logic and compliance voting. As the interface between the DERPS cabinet and the trip circuit breaker, the RTM receives the system-level trip drive command signal from the three VLs of the same subgroup of the DERPS and other systems, and sends the command to the trip circuit breaker after executing the 2oo3 relay logic vote. The trip circuit breaker is connected to the power circuit of the control rod drive mechanism. When the circuit breaker is opened, the control rod drive mechanism is de-energized, and the control rods fall into the core due to gravity, completing the shutdown.

[0079] like Figure 4 and Figure 5 As shown, DERPS monitors the key safety parameters of nuclear facilities and their auxiliary facilities. When the safety parameters selected for monitoring reach or exceed the preset first-stage protection action setting value, DERPS automatically issues a shutdown trigger signal to disconnect the shutdown circuit breaker. Furthermore, DERPS is also used to limit the consequences of expected operating events and design basis accidents. When the key safety parameters selected for monitoring reach the preset second-stage protection action setting value, it means that the integrity of part of the safety barrier of the current nuclear facility is damaged. After issuing the shutdown command, DERPS further issues a device drive command to drive the corresponding dedicated safety facility.

[0080] In this embodiment, when DERPS performs the emergency shutdown function of the reactor, DERPS uses three measurement channels / sequences for each shutdown variable, and each channel is provided with an independent field sensor. The three channels of DERPS receive signals from the corresponding field sensors respectively, and the BL processes the sensor signals and compares the measured values ​​with the preset set values ​​of the variables. If the BL measurement value of a channel exceeds the preset set value, the BL will generate a local shutdown command triggered by the variable. The BL of each sequence sends a local shutdown signal to the VL of the same subgroup of the sequence and the other two sequences through an isolated data link, and the VL further performs a logical voting. When the VL meets the 2oo3 triggering condition, the VL sends a system-level shutdown drive command to the RTM of the A or B sequence (the other RTM receives the system-level shutdown drive command from the three VLs of another subgroup), and the RTM generates a final shutdown signal after performing a 2oo3 relay logic voting, triggering the shutdown circuit breaker action controlled by the sequence.

[0081] like Figure 6 As shown in the figure, for some small reactors with high requirements on the response time of the nuclear power high shutdown protection function performed by DERPS, in order to reduce the response time of this function, the fixed value comparison function of the nuclear power high shutdown function is completed in the nuclear measurement system. After the fixed value comparison function is executed, the nuclear measurement system directly sends the fixed value comparison result to RTM-B1 and RTM-A2 for logical voting, which reduces the time for the sensor input signal to perform data processing in DERPS.

[0082] In this embodiment, when DERPS performs the dedicated safety facility driving function, the three measurement channels of DERPS use independent field sensors (these sensors may monitor the same variables as the shutdown function). The three channels of DERPS receive signals from the corresponding field sensors respectively. After necessary processing, BL compares the measured value with the set value of the variable. When the measured value exceeds the set value, BL generates a channel local trigger signal and sends it to the VL of this sequence and the other two sequences for coincidence logic voting. When the coincidence logic of VL meets the 2oo3 condition, VL sends the system-level dedicated safety facility driving command to CL.

[0083] like Figure 7 As shown, the CL of the A and B sequences of DERPS has design diversity. Each CL includes two 2oo3 voting modules. Each voting module receives the 2oo3 voting results of the three VLs from the same subgroup and performs 2oo3 processing again. The voting results (i.e., system-level device trigger signals) generated by the two 2oo3 voting modules are fanned out as device-level trigger signals. Each device interface module receives the device-level trigger signals fanned out by the two 2oo3 voting modules (each controlled device is provided with a corresponding device interface module) and executes the 2oo2 coincidence logic. When the coincidence logic is satisfied, the device interface module sends the final device control command to the actuator of the device. In this embodiment, the CL of the two sequences respectively controls two redundant dedicated safety devices in the nuclear facility process system. Any dedicated safety device driver has the ability to fully mitigate the corresponding accident and meets the single failure criterion.

[0084] In this embodiment, the workflow of the nuclear reactor protection system with built-in diversity is as follows:

[0085] (1) Three sequences of sensors monitor the safety-related parameters of the nuclear power plant and transmit the monitoring results to DERPS for executing emergency shutdown or driving functions of dedicated safety facilities;

[0086] (2) BL-A1 and A2, BL-B1 and B2, BL-C1 and C2 of DERPS respectively receive signals from sensors of corresponding sequences and perform engineering unit conversion and fixed value comparison processing;

[0087] (3) VL-A1, VL-B1, and VL-C1 of DERPS receive the constant value comparison results from BL-A1, BL-B1, and BL-C1 of the same subgroup, and further perform logic voting processing.

[0088] (4) CL-A1 of DERPS receives the logic voting results from VL-A1, VL-B1, and VL-C1 of the same subgroup, performs the logic voting again, and finally outputs the device control command to the execution structure of the dedicated safety device in column A;

[0089] (5) CL-B2 of DERPS receives the logic voting results from VL-A2, VL-B2, and VL-C2 of the same subgroup, performs the logic voting again, and finally outputs the device control command to the execution structure of the dedicated safety device of column B;

[0090] (6) RTM-A2 of DERPS receives the logic voting results from VL-A2, VL-B2, and VL-C2 of the same subgroup, and performs the logic voting again, and finally outputs the shutdown command to the shutdown circuit breakers RTA1 and RTA2.

[0091] (7) RTM-B1 of DERPS receives the logic voting results from VL-A1, VL-B1, and VL-C1 of the same subgroup, and performs the logic voting again, and finally outputs the shutdown command to the shutdown circuit breakers RTB1 and RTB2.

[0092] Example 2

[0093] Based on Example 1, the number of diversity subgroups in Example 1 is still 2, and the number of 3 sequences can be N sequences, where the value of N is 2, 3, 4, 5, etc. The voting logic executed in VL and CL changes with the number of configured sequences.

[0094] Example 3

[0095] On the basis of Example 1, the number of the two diverse subgroups in Example 1 can be M subgroups, where M≥2, and each subgroup has the ability to independently complete emergency shutdown and dedicated safety facility driving, thereby achieving the effect of eliminating the diversified driving system.

[0096] Example 4

[0097] On the basis of Example 1, the number of levels and the boundary range in Example 1 are adjusted, and the three levels can be merged into two levels, or decomposed into four levels.

[0098] Example 5

[0099] On the basis of Example 1, the device control subsystem (CL) of each subgroup in the above Example 1 is adjusted to have the ability to drive a column of dedicated safety devices by setting up multiple device control systems to control a column of dedicated safety devices.

[0100] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A nuclear reactor protection system with built-in diversity, characterized in that: The system architecture adopts three sequences, local coincidence logic, two-level three-out-of-two voting, and two technical routes for parallel processing; The three sequences are three multiple sequences, each of which is composed of multiple subsequences using devices of different technical routes, and three subsequences using the same technology constitute a subgroup; each subgroup has the ability to independently execute safety functions; All three sequences contain the same number of set value processing subsystems and voting logic subsystems as the number of subgroups; two of the sequences also contain an equipment control subsystem and a shutdown relay matrix; The fixed value processing subsystem is used to receive the sensor input signal of the sequence and perform the fixed value comparison operation, and send the fixed value comparison result to the voting logic subsystem belonging to the same subgroup in the three sequences; The voting logic subsystem is used to receive the set value comparison results sent by the set value processing subsystems of the three sequences belonging to the same subgroup, perform two-out-of-three voting, and send the voting results to the equipment control subsystem or the shutdown relay matrix belonging to the same subgroup respectively; The device control subsystem is used to receive the logic voting results sent by the three voting logic subsystems from the same subgroup, and perform two-out-of-three voting; when the voting is passed, it sends a device trigger signal to the actuator of the controlled device; The shutdown relay matrix is ​​used to receive system-level shutdown drive command signals from three voting logic subsystems belonging to the same subgroup and other systems, and after executing three-out-of-two relay logic voting, send commands to the shutdown circuit breaker.

2. A nuclear reactor protection system with built-in diversity as claimed in claim 1, characterized in that: The multiple constant value processing subsystems of each sequence all adopt different technical route equipment; the multiple voting logic subsystems of each sequence all adopt different technical route equipment.

3. A nuclear reactor protection system with built-in diversity as claimed in claim 1, characterized in that: The equipment control subsystems of the two sequences use equipment of different technical routes; the shutdown relay matrices of the two sequences use equipment of different technical routes.

4. A nuclear reactor protection system with built-in diversity as claimed in claim 1, characterized in that: The device control subsystem generates a system-level device trigger signal when the vote is passed, and then generates a device-level trigger signal through fan-out, and finally sends the device trigger signal to the actuator of the controlled device through the device interface module.

5. A nuclear reactor protection system with built-in diversity as claimed in claim 1, characterized in that: When the shutdown relay matrix sends a command to the shutdown circuit breaker, the shutdown circuit breaker connects the power circuit of the control rod drive mechanism. When the circuit breaker is opened, the control rod drive mechanism is powered off, and the control rods fall into the core due to gravity, completing the shutdown.

6. A nuclear reactor protection system with built-in diversity as claimed in claim 1, characterized in that: Each sequence is provided with an independent field sensor. The measurement value signal collected by the field sensor is input into the fixed value processing subsystem of the sequence after data processing. The fixed value processing subsystem compares the measurement value with the set value. If the measured value exceeds the preset set value, the set value processing subsystem will generate a local shutdown command triggered by the variable.

7. A nuclear reactor protection system with built-in diversity as claimed in claim 1, characterized in that: Each device control subsystem includes two three-out-of-two voting modules. Each voting module receives the three-out-of-two voting results from the three voting logic subsystems of the same subgroup and performs three-out-of-two voting again. The voting results generated by the two three-out-of-two voting modules are fanned out as device-level trigger signals.

8. A nuclear reactor protection system with built-in diversity as claimed in claim 8, characterized in that: Each device interface module receives device-level trigger signals fanned out by two three-out-of-two voting modules, and performs two-out-of-two matching logic voting; when the matching logic is met, the device interface module sends the final device control command to the device's actuator.

9. A nuclear reactor protection system with built-in diversity as claimed in claim 1, characterized in that: The set value processing subsystem can also directly send the set value comparison result to the shutdown relay matrix for logical voting.

10. A nuclear reactor protection system with built-in diversity as claimed in claim 1, characterized in that: The two sequences of equipment control subsystems respectively control two redundant dedicated safety devices in the nuclear facility process system. Any dedicated safety device driver has the ability to fully mitigate the corresponding accident and meets the single failure criterion.

Images