Safety protection systems and safety protection methods

Abstract

This safety protection system meets the requirement for electrical isolation while suppressing an increase in the physical volume of isolators and facilitating the replacement of controllers and other components. [Solution] The safety protection system 10A includes a detector 15 that emits a detection signal 25, a set value comparison unit 11 that compares and calculates an output value 26 of the detection signal 25 based on a set value and transmits it to a first optical cable 31 in a first optical communication standard, a first converter 21 that converts the output value 26 transmitted in the first optical cable 31 to a metal communication standard and transmits it to a metal cable 33, a second converter 22 that converts the output value 26 transmitted in the metal cable 33 to a second optical communication standard and transmits it to a second optical cable 32, and a logic circuit unit 12 that performs a logical operation on a plurality of different output values ​​26 of the detector 15 transmitted in the second optical cable 32 and determines whether or not to transmit an activation signal 27 for the operating device 17.

Description

[Technical Field]

[0001] Embodiments of the present invention relate to safety protection technology mainly targeting plants. [Background Art]

[0002] The safety protection system of a nuclear power plant is multiplexed into a plurality of divisions to achieve a highly reliable design. In order prevent multiple failures caused by a single factor, when electrical signals are exchanged between different divisions, an isolator is installed for electrical isolation in the electrical equipment of the safety protection system. As such an isolator, there is a technology that implements electrical isolation by converting an electrical signal transmitted via a metal cable into an optical signal and transmitting the optical signal via an optical cable.

[0003] In modern plants that also use optical cables for transmitting optical signals as isolators, multiplexing is performed in four divisions. Furthermore, two types of controllers each equipped with a function-specific CPU are provided in each division.

[0004] For signal exchange between these two types of controllers, it is necessary to convert a transmitted optical signal from the communication standard of the transmitting side to the communication standard of the receiving side. Such digital-to-digital standard conversion has various forms depending on the combination of the communication standard of a set value comparison unit and the communication standard of a logic circuit unit.

[0005] Generally, these controllers are updated approximately every 10 years for maintenance. Controller updates are also required due to the discontinuation of production for CPUs and peripheral components. In such cases, all controllers are updated collectively because the communication standard becomes obsolete or is controller-specific. [Prior Art Documents] [Patent Documents]

[0006] [Patent Document 1] Japanese Unexamined Patent Publication No. Hei 3-3526 [Overview of the project] [Problems that the invention aims to solve]

[0007] Because the safety protection systems control the plant's safety facilities, this type of controller replacement work must be carried out while the plant is shut down. Therefore, to ensure economic efficiency, the work must be completed in a short period to avoid reducing the plant's operating rate. For this reason, a phased replacement of each controller is being considered.

[0008] If the original communication standards between controllers are proprietary or outdated, it is desirable that the replacement controllers also support such proprietary or outdated communication standards. However, there is a challenge in obtaining the necessary parts to achieve such compatibility. As mentioned above, this challenge has traditionally been overcome by replacing all controllers in all sections at once. However, replacing all controllers with the same model not only worsens cost-effectiveness but also prolongs the construction period, creating other problems.

[0009] These two challenges can be avoided by abandoning digital signal transmission, which uses specialized and frequently updated communication standards, and switching to analog signal transmission, which uses highly universal communication standards. However, switching from digital to analog signal transmission means replacing optical cables with metal cables.

[0010] This would mean that a single multiplexed signal would be reverted back to its original multiplexed form, and the signal interception between the segments would be replaced by a metal cable with an increased number of strands instead of optical cables. Therefore, replacing optical cables with metal cables contradicts the aforementioned requirement for electrical isolation and is not practical or feasible.

[0011] Embodiments of the present invention have been made in consideration of these circumstances, and aim to provide a safety protection system that meets the requirements for electrical isolation, suppresses an increase in the physical volume of isolators, and facilitates the replacement of controllers and the like. [Means for solving the problem]

[0012] The safety protection system according to the embodiment is characterized by comprising: a detector that transmits a detection signal; a set value comparison unit that compares and calculates the output value of the detection signal based on a set value and transmits it to a first optical cable in a first optical communication standard; a first converter that converts the output value transmitted in the first optical cable to a metal communication standard and transmits it to a metal cable; and a logic circuit unit that performs a logical operation on a plurality of output values ​​transmitted in the metal cable that differ from the detector and determines whether or not to transmit an activation signal for an operating device. [Effects of the Invention]

[0013] Embodiments of the present invention provide a safety protection system that meets the requirement for electrical isolation while suppressing an increase in the physical volume of isolators and facilitating the replacement of controllers and the like. [Brief explanation of the drawing]

[0014] [Figure 1] A diagram illustrating the configuration of a safety protection system according to the first embodiment of the present invention. [Figure 2] A diagram illustrating the configuration of the safety protection system according to the second embodiment. [Figure 3] Configuration diagram of the safety protection system according to the third embodiment. [Figure 4] A diagram illustrating the configuration of the safety protection system according to the fourth embodiment. [Modes for carrying out the invention]

[0015] (First Embodiment) Embodiments of the present invention will be described below with reference to the accompanying drawings. Figure 1 is a configuration diagram of the safety protection system 10A(10) according to the first embodiment of the present invention. In a typical nuclear power plant, the safety protection system 10 is redundantly divided into four sections 16, but in this embodiment, the number of sections 16 is not particularly limited. Hereafter, the subscript n (n=1,2,...N) in the figures will be omitted from the description.

[0016] Thus, the safety protection system 10A(10) includes a detector 15 that emits a detection signal 25, a set value comparison unit 11 that compares and calculates an output value 26 of the detection signal 25 based on a set value (not shown) and transmits it to the first optical cable 31 in the first optical communication standard, a first converter 21 that converts the output value 26 transmitted in the first optical cable 31 to the metal communication standard (not shown) and transmits it to the metal cable 33, a second converter 22 that converts the output value 26 transmitted in the metal cable 33 to the second optical communication standard (not shown) and transmits it to the second optical cable 32, and a logic circuit unit 12a that performs a logical operation on multiple different output values ​​26 of the detector 15 transmitted in the second optical cable 32 and determines whether or not to transmit an activation signal 27 for the operating device 17.

[0017] Furthermore, the safety protection system 10A has multiple nth divisions 16 (n=1,2,...N) each uniquely containing a set value comparison unit 11, a first converter 21, a second converter 22, and a logic circuit unit 12. The first converter 21 belonging to each nth division 16 converts the output value 26 transmitted from the set value comparison unit 11 belonging to the other divisions 16 from the first optical communication standard to the metal communication standard. Furthermore, the logic circuit unit 12a belonging to each nth division 16 performs logical operations on the output value 26 transmitted from the other divisions 16 as well, and decides whether or not to transmit the activation signal 27.

[0018] Detector 15 is a sensor disposed in a plant for detecting abnormal events and the like when they occur. Specifically, it quantitatively detects physical quantities indicating the state of a detection target, such as a temperature sensor, a pressure sensor, an acceleration sensor, and the like. Detector 15 continues to transmit a detection signal 25 to the set value comparison unit 11 regardless of whether such an abnormal event has occurred or not.

[0019] The set value comparison unit 11 is a controller equipped with a CPU, and determines the state (abnormal / normal) of the detection target indicated by the detection signal 25 by comparing and calculating the received detection signal 25 with a pre-registered set value. When the received detection signal 25 satisfies a predetermined condition with respect to the set value, a trip signal indicating that the state has changed from normal to abnormal is transmitted as an output value 26.

[0020] The output value 26 from the set value comparison unit 11 is an optical signal conforming to a first digital optical communication standard, and is transmitted to a first optical cable 31. The other end of the first optical cable 31 is not only connected to the first converter 21 of the same n-th section 16, but also branched and connected to the first converters 21 of other sections 16. Here, the first optical communication standard is a communication standard supported by the set value comparison unit 11.

[0021] As described above, when the output value 26 is shared between different sections 16 via the first optical cable 31, the first optical cable 31 functions as an isolator, electrically isolating the different sections 16 and preventing multiple failures.

[0022] Considering the occurrence of a fire, unlike electrical signals, optical signals do not generate heat, so there is no possibility of ignition. Furthermore, the only impact of a fire on an optical cable is breakage of the cable itself, and it does not affect other cables. On the other hand, if different sections 16 are connected by metal cables, fusion to other cables may occur, which complicates impact analysis for fires.

[0023] Here, the detection signal 25 processed by a single setpoint comparison unit 11 is not limited to one type but may be of multiple types (the connected detector 15 may be not limited to one type but may be of multiple types). For this reason, the output value 26 is an aggregation of multiple signals, and the first optical communication standard may employ a multiplex transmission method.

[0024] Incidentally, because such multiplex transmission methods involve highly specialized and diverse communication standards, there is no guarantee that the first optical communication standard of the setting value comparison unit 11 is common among different sections 16. Furthermore, when updating the controller of the setting value comparison unit 11 for maintenance purposes, it may be necessary to change the first optical communication standard before and after the update.

[0025] This is because the controllers constituting the setting value comparison unit 11 tend to become outdated easily due to the adoption of communication standards that were common at the time of design. Furthermore, controllers may employ proprietary communication standards to ensure functionality, performance, and improve reliability.

[0026] The first converter 21 receives the output value 26 transmitted via the first optical cable 31 from a set value comparison unit 11 belonging to the same nth division 16. Furthermore, the first converter 21 also receives the output value 26 transmitted via the first optical cable 31 connected to a set value comparison unit 11 belonging to another division 16.

[0027] The first converter 21 then converts the received output value 26, which is an optical signal of the first digital optical communication standard, into an output value 26, which is an electrical signal of the analog metal communication standard. The electrical signal of the metal communication standard output value 26 is then transmitted through the metal cable 33 and received by the second converter 22. In this way, each first converter 21 belonging to the nth division 16 also converts the output value 26 transmitted from the setting value comparison unit 11 belonging to the other division 16 from the first optical communication standard to the metal communication standard and transmits it to the second converter 22.

[0028] Unlike optical communication standards, analog metal communication standards are highly universal and less likely to become obsolete. Therefore, there is no need to change the metal communication standard, not only for communication between different sections 16, but also before and after updating the first converter 21 or the second converter 22 for maintenance purposes.

[0029] The second converter 22, to which the other end of the metal cable 33 is connected, converts the received electrical signal of output value 26, which is a metal communication standard, into an optical signal of the second optical communication standard. This optical signal of output value 26, which is a second optical communication standard, is transmitted to the second optical cable 32 and received by the logic circuit unit 12a.

[0030] Here, the second optical communication standard is an optical communication standard specific to the logic circuit unit 12a, which is a controller equipped with a CPU. Therefore, when updating the logic circuit unit 12a during maintenance, it may be necessary to change the second optical communication standard before and after the update. In this case, along with updating the logic circuit unit 12a, the second converter 22 is also updated from an older second converter 22 that converts the metal communication standard to the old second optical communication standard to a newer second converter 22 that converts the metal communication standard to the new second optical communication standard.

[0031] Similarly, when updating the setting value comparison unit 11, the first converter 21 is also updated from an older first converter 21 that converts the old first optical communication standard to the metal communication standard to a new first converter 21 that converts the new first optical communication standard to the metal communication standard.

[0032] The logic circuit unit 12a receives the optical signal of the output value 26 of the second optical communication standard transmitted through the connected second optical cable 32. In this way, the logic circuit unit 12a receives the electrical signal of the output value 26 transmitted through the metal cable 33, which is converted into an optical signal by the second converter 22. The logic circuit unit 12a then performs a logical operation not only on the output value 26 of the same nth division 16 but also on the output values ​​26 received from other divisions 16, and outputs a start signal 27 for the operating device 17 if the result satisfies certain conditions. In other words, the logic circuit unit 12a decides whether or not to send a start signal 27 to the operating device 17.

[0033] Here, the operating device 17 is a mechanism that resolves abnormal events that occur in the plant, and the activation signal 27 is a signal that activates the actuators, such as motors and hydraulic equipment, that operate this operating device 17.

[0034] According to the first embodiment, in the safety protection system 10A, a request may arise to update either the set value comparison unit 11 or the logic circuit unit 12a, both of which are controllers. In such cases, it may be difficult to obtain a replacement for the set value comparison unit 11 (or logic circuit unit 12a) that supports the first optical communication standard (or the second optical communication standard).

[0035] Even in such cases, the problem can be addressed by either updating the setting value comparison unit 11 and the first converter 21 as a set, or by updating the logic circuit unit 12a and the second converter 22 as a set. In other words, it becomes unnecessary to update both the setting value comparison unit 11 and the logic circuit unit 12a at once, including the other unit which does not actually need updating.

[0036] Furthermore, when updating both the setting value comparison unit 11 and the logic circuit unit 12a, they can be updated in stages, allowing the work to be completed in a short period of time without reducing the plant's operating rate.

[0037] Here, as a first comparative example, we consider a case where the configuration of the first converter 21, metal cable 33, second converter 22, and second optical cable 32 is eliminated from the first embodiment, and the set value comparison unit 11 and the logic circuit unit 12a are directly interconnected by the first optical cable 31.

[0038] In this first comparative example, the set value comparison unit 11 and the logic circuit unit 12a, both of which are controllers, adopt a common optical communication standard. Therefore, if either the set value comparison unit 11 or the logic circuit unit 12a needs to be updated, and a replacement unit that supports the same optical communication standard is not available, both units, including the other unit which does not actually need updating, must be updated at once, which is uneconomical.

[0039] As a second comparative example, let's assume that the set value comparison unit 11 and the logic circuit unit 12a, both of which are controllers, each employ a different optical communication standard, such as a first optical communication standard and a second optical communication standard, respectively. In this case, a digital-to-digital converter that converts the optical signal from the first optical communication standard to the second optical communication standard is provided in the optical cable connecting the set value comparison unit 11 and the logic circuit unit 12a.

[0040] Consequently, if either the setting value comparison unit 11 or the logic circuit unit 12a needs to be updated, and a replacement digital-to-digital converter supporting the same optical communication standard is not available, both units, including the other unit which does not actually need updating, must be updated at once, which is uneconomical.

[0041] (Second Embodiment) Next, a second embodiment of the present invention will be described with reference to Figure 2. Figure 2 is a configuration diagram of the safety protection system 10B(10) according to the second embodiment. Here, the logic circuit section 12a of the first embodiment was a digital type composed of a controller, whereas the logic circuit section 12b of the second embodiment is an analog type composed of analog devices such as relays.

[0042] Accordingly, the second embodiment differs from the first embodiment (Figure 1) in that the second converter 22 and the second optical cable 32 are omitted. In Figure 2, parts that have the same configuration or function as those in Figure 1 are indicated by the same reference numerals, and redundant explanations are omitted.

[0043] In other words, the safety protection system 10B includes a detector 15 that emits a detection signal 25, a set value comparison unit 11 that compares and calculates an output value 26 of the detection signal 25 based on a set value (not shown) and transmits it to the first optical cable 31 in the first optical communication standard (not shown), a first converter 21 that converts the output value 26 transmitted in the first optical cable 31 to the metal communication standard (not shown) and transmits it to the metal cable 33, and a logic circuit unit 12b that performs a logical operation on multiple output values ​​26 that are transmitted in the metal cable 33 and which differ from the detector 15, and determines whether or not to transmit an activation signal 27 for the operating device 17.

[0044] Furthermore, in the safety protection system 10A, an nth division (n=1,2,...N) is set, each having its own unique set value comparison unit 11, first converter 21, and logic circuit unit 12. The first converter 21 belonging to each nth division 16 also converts the output value 26 transmitted from the set value comparison unit 11 belonging to the other division into the metal communication standard. Furthermore, the logic circuit unit 12b of each nth division 16 performs a logical operation on the output value 26 transmitted from the other divisions 16 together and decides whether or not to transmit the activation signal 27.

[0045] As described above, the logic circuit section 12b of the second embodiment is an analog type composed of analog devices such as relays, so the electrical signal of the output value 26 transmitted via the metal cable 33 is received directly by the logic circuit section 12b. The logic circuit section 12b also receives the electrical signals of the output value 26 transmitted from the other sections 16 via their respective metal cables 33.

[0046] Here, the logic circuit section 12b employs an analog metal communication standard, making it highly universal and less prone to becoming obsolete. Therefore, there is no need to change the metal communication standard, not only for communication between different sections 16, but also before and after updating the logic circuit section 12b for maintenance or other purposes.

[0047] According to the second embodiment, in the safety protection system 10B, a request may arise to update either the set value comparison unit 11, which is a controller, or the logic circuit unit 12b of the analog device. In this case, a replacement for the set value comparison unit 11 that supports the first optical communication standard may be difficult to obtain, but a replacement for the logic circuit unit 12b that supports the metal communication standard is readily available.

[0048] In such cases, the issue can be addressed by either updating the setting value comparison unit 11 and the first converter 21 as a set, or by updating the logic circuit unit 12b individually. In other words, it becomes unnecessary to update both the setting value comparison unit 11 and the logic circuit unit 12b at once, including the other unit which does not actually need updating.

[0049] Furthermore, when updating both the setting value comparison unit 11 and the logic circuit unit 12b, they can be updated in stages, allowing the work to be completed in a short period of time without reducing the plant's operating rate.

[0050] (Third embodiment) Next, a third embodiment of the present invention will be described with reference to Figure 3. Figure 3 is a configuration diagram of the safety protection system 10C(10) according to the third embodiment. The third embodiment differs from the configuration of the second embodiment described above in that it determines whether or not to transmit the activation signal 27 of the operating device 17 of interest based on the detection signal 25 of a multi-channel detector 15 belonging to the same category. In Figure 3, parts that have the same configuration or function as those in Figure 2 are indicated by the same reference numerals, and redundant explanations are omitted.

[0051] In other words, the safety protection system 10C includes a detector 15 that emits a detection signal 25, a set value comparison unit 11 (11a, 11b) that compares and calculates an output value 26 of the detection signal 25 based on a set value (not shown) and transmits it to the first optical cable 31 in the first optical communication standard (not shown), a first converter 21 that converts the output value 26 transmitted in the first optical cable 31 to the metal communication standard (not shown) and transmits it to the metal cable 33, and a logic circuit unit 12b that performs a logical operation on multiple output values ​​26 that are transmitted in the metal cable 33 and which differ from the detector 15, and determines whether or not to transmit an activation signal 27 for the operating device 17.

[0052] Thus, in the third embodiment, the output value 26 is shared between the set value comparison unit 11 (11a, 11b) and the combination of the first converter 21 and the logic circuit unit 12b via the first optical cable 31. In this case, the first optical cable 31 acts as an isolator, electrically isolating the set value comparison unit 11 (11a, 11b) and the logic circuit unit 12b to prevent multiple faults.

[0053] According to the third embodiment, in the safety protection system 10C, a request may arise to update either the set value comparison unit 11 (11a, 11b), which is a controller, or the logic circuit unit 12b of the analog device. In such a case, the request can be addressed by either updating the set value comparison unit 11 (11a, 11b) and the first converter 21 as a set, or by updating the logic circuit unit 12b individually. In other words, it becomes unnecessary to update both the set value comparison unit 11 and the logic circuit unit 12b at once, including the other part which does not actually need updating.

[0054] Furthermore, when updating both the setting value comparison unit 11 and the logic circuit unit 12b, they can be updated in stages, allowing the work to be completed in a short period of time without reducing the plant's operating rate.

[0055] (Fourth Embodiment) Next, a fourth embodiment of the present invention will be described with reference to Figure 4. Figure 4 is a configuration diagram of the safety protection system 10D(10) according to the fourth embodiment. The fourth embodiment has a configuration in which a second converter 22 and a second optical cable 32 are further added to the configuration of the third embodiment described above. In Figure 4, parts that have the same configuration or function as those in Figure 3 are indicated by the same reference numerals, and redundant explanations are omitted.

[0056] In other words, the safety protection system 10D, in addition to the configuration of the safety protection system 10C (Figure 3), is equipped with a second converter 22 that converts the output value 26 transmitted through the metal cable 33 into a second optical communication standard and transmits it to the second optical cable 32. The logic circuit unit 12a then performs logical operations on the output value 26 transmitted from the metal cable 33 to the second optical cable 32 via the second converter 22.

[0057] Thus, in the fourth embodiment, the output value 26 is shared between the set value comparison unit 11 (11a, 11b) and the logic circuit unit 12a by the first optical cable 31 and the second optical cable 32. In this case, the first optical cable 31 and the second optical cable 32 act as isolators, electrically isolating the set value comparison unit 11 (11a, 11b) and the logic circuit unit 12a to prevent multiple faults.

[0058] According to the fourth embodiment, in the safety protection system 10D, a request may arise to update either the controller, the set value comparison unit 11 (11a, 11b), or the logic circuit unit 12a. In such a case, the request can be addressed by updating either the set value comparison unit 11 (11a, 11b) and the first converter 21 as a set, or by updating the logic circuit unit 12a and the second converter 22 as a set. In other words, it becomes unnecessary to update both the set value comparison unit 11 and the logic circuit unit 12a at once, including the other which does not normally need updating.

[0059] Furthermore, when updating both the setting value comparison unit 11 and the logic circuit unit 12a, they can be updated in stages, allowing the work to be completed in a short period of time without reducing the plant's operating rate.

[0060] According to the safety protection system of at least one embodiment described above, the output value of the set value comparison unit that compares and calculates the detection signal is first transmitted via optical cable, then further transmitted via metal cable, and then subjected to a logic calculation by the logic circuit unit that determines whether or not to transmit the activation signal of the operating device. This makes it possible to meet the requirement of electrical isolation while suppressing an increase in the physical volume of the isolator and facilitating the replacement of controllers and the like.

[0061] While several embodiments of the present invention have been described, these embodiments are presented as examples only and are not intended to limit the scope of the invention. These embodiments can be carried out in a variety of other forms, and various omissions, substitutions, modifications, and combinations are possible without departing from the spirit of the invention. These embodiments and their variations are included in the scope and spirit of the invention, as well as in the claims and their equivalents. [Explanation of Symbols]

[0062] 10 (10A, 10B, 10C, 10D)... Safety protection system, 11... Set value comparison unit, 12 (12a, 12b)... Logic circuit unit, 15... Detector, 16... nth division (other divisions), 17... Actuator, 21... First converter, 22... Second converter, 25... Detection signal, 26... Output value, 27... Activation signal, 31... First optical cable, 32... Second optical cable, 33... Metal cable.

Claims

1. A detector that emits a detection signal, A setting value comparison unit that compares and calculates the output value of the detection signal based on the setting value and transmits it to the first optical cable in the first optical communication standard, A first converter that converts the output value transmitted in the first optical cable into a metal communication standard and transmits it to a metal cable, A safety protection system comprising: a logic circuit unit that performs a logical operation on multiple different output values ​​transmitted by the detector via the metal cable and determines whether or not to transmit a startup signal for the operating device.

2. In the safety protection system according to claim 1, The system includes a second converter that converts the output value transmitted through the metal cable into a second optical communication standard and transmits it to the second optical cable. The logic circuit unit is a safety protection system that performs the logic operation on the output value transmitted from the metal cable to the second optical cable via the second converter.

3. In the safety protection system according to claim 1 or claim 2, A unique nth division (n = 1, 2, ..., N) is set for the set value comparison unit, the first converter, and the logic circuit unit. Each of the first converters belonging to the nth division also converts the output value transmitted from the set value comparison unit belonging to the other divisions into the metal communication standard. A safety protection system in which each logic circuit unit belonging to the aforementioned division performs the logic operation and makes the determination, taking into account the output value transmitted from the other divisions.

4. The steps include: the detector emitting a detection signal, The set value comparison unit compares the detection signal based on the set value and transmits the output value to the first optical cable in the first optical communication standard. The first converter converts the output value transmitted through the first optical cable into a metal communication standard and transmits it to the metal cable. A safety protection method comprising the step of a logic circuit unit performing a logical operation on a plurality of different output values ​​transmitted by the detector via the metal cable, and determining whether or not to transmit a start signal for the operating device.

Images