Backup device for safety protection system

Abstract

A safety protection system backup device that detects the state of a plant and if an abnormality is found, issues an instruction to safety system field equipment (4) according to the output of a first safety protection logic (222) in a safety protection device (2), and if there is a common cause failure in the safety protection device (2), issues an instruction to the safety system field equipment (4) according to the output of a second safety protection logic (312) in a CCF facility (3), wherein the first safety protection logic (222) and the second safety protection logic (312) are configured to perform digital signal processing using different logic configurations, so that an input device (21) and an output device (23) can be shared by the safety protection device (2) and the CCF facility (3), thereby eliminating the need to provide an input device and an output device dedicated to the CCF facility (3), and so that even if there is an increase in the quantity of detectors (1) and safety system field equipment (4), that increase can be accommodated without increasing the quantity of the CCF facility (3).

Description

[Technical field]

[0001] The present application relates to a backup device for a security system. [Background technology]

[0002] In nuclear power plants, reactor trip breakers are used as one of the protective equipment that shuts down the reactor in the event of an abnormality. Power is supplied from the power bus to the control rod drive mechanism via the power converter and the reactor trip breaker. By releasing the reactor trip breaker, power is no longer supplied to the control rod drive mechanism, the control rod is inserted into the reactor, and the reactor is shut down. In addition to the reactor trip breaker, the protective equipment also includes safety equipment such as pumps and valves that inject cooling water into the reactor for emergency cooling in the event of an abnormality.

[0003] The protection system equipment receives signals from various detection sensors, and when the protection logic determines that the reactor needs to be shut down or emergency cooling is required, it generates a reactor shutdown signal and sends an operation (release) request signal to the reactor trip breaker or safety system equipment.

[0004] The protection system equipment is configured in a redundant manner to achieve high reliability, but if a Common Cause Failure (CCF) occurs between the redundant devices, there is a risk that an operation (release) request signal cannot be sent to the reactor trip breaker, etc., even if an abnormality occurs in the plant.

[0005] A method of installing CCF countermeasure equipment that backs up the protective system equipment to properly shut down the reactor when a CCF occurs in the protective system equipment has been disclosed (see, for example, Patent Document 1). The main cause of CCF occurring in redundant protective system equipment is software errors. For this reason, the CCF countermeasure equipment is an analog equipment composed of electric circuit components such as switches and relays, and the CCF countermeasure equipment determines the need to shut down the reactor in response to a signal from a detection sensor. The power conversion equipment that receives a reactor shutdown signal from the CCF countermeasure equipment cuts off the power supply to the reactor trip breaker. This causes the control rod drive unit to lose power, and the reactor is shut down by inserting the control rod into the reactor. [Prior art documents] [Patent documents]

[0006] JP 2012-122907 A Summary of the Invention [Problem to be solved by the invention]

[0007] However, as in Patent Document 1, if the CCF countermeasure equipment is configured with analog equipment such as switches and relays, signal input devices corresponding to the number of detectors are required, and further signal output devices corresponding to the number of field devices of the protection system equipment are required.

[0008] In addition, compared to protective equipment as normal use equipment, CCF equipment is permitted to be designed and manufactured with relaxed design grades, but to prevent electrical failures in the CCF equipment from affecting the protective equipment, it is required to install isolation devices such as relays and fuses between the CCF equipment and the protective equipment to block the effects of electrical failures.As a result, the number of functions implemented in the CCF equipment increases, which creates the issue of the material volume of the CCF equipment increasing according to the number of inputs and outputs.

[0009] The present application has been made to solve the above-mentioned problems, and aims to provide a backup device for a safety protection system that does not increase the amount of material in the CCF equipment even when the number of detectors and safety-related on-site equipment increases. [Means for solving the problem]

[0010] The backup device of the security protection system disclosed in the present application comprises: A backup device for a safety protection system that detects a plant state, and when an abnormality is detected, issues an instruction to a safety-related field device in response to an output of a first safety protection logic in the safety protection device, and when a common cause failure occurs in the safety protection device, issues an instruction to a safety-related field device in response to an output of a second safety protection logic in a CCF facility, Detectors to detect plant conditions; a first and a second analog-to-digital conversion circuit disposed in the input device of the safety protection apparatus and configured to digitally convert an output of the detector; a first communication control circuit disposed in the input device and configured to transmit a signal output from the first analog / digital conversion circuit to the arithmetic processing unit; a second communication control circuit disposed in the input device and configured to transmit a signal output from the second analog / digital conversion circuit to the CCF equipment; a third communication control circuit disposed in the first arithmetic processing unit of the safety protection device, receiving an output of the first communication control circuit and transmitting the output to the first safety protection logic of the arithmetic processing unit; a fourth communication control circuit that receives an output of the second communication control circuit and transmits the output to a second security protection logic disposed in a second arithmetic processing unit of the CCF equipment; a fifth communication control circuit disposed in the first arithmetic processing unit and configured to transmit an output from the first safety protection logic; a sixth communication control circuit disposed in the second processing unit and configured to transmit an output from the second safety protection logic; a seventh communication control circuit disposed in an output device area of ​​the safety interlocking device for receiving a signal transmitted from the fifth communication control circuit; an eighth communication control circuit disposed in the output device area for receiving a signal transmitted from the sixth communication control circuit; a first digital / analog conversion circuit disposed in the output device area for converting a signal from the seventh communication control circuit into an analog signal; a second digital / analog conversion circuit disposed in the output device area for converting a signal from the eighth communication control circuit into an analog signal; a hardware circuit that receives a signal from the first or second digital / analog conversion circuit and outputs the signal to a safety-related field device; Equipped with The first safety protection logic and the second safety protection logic execute digital signal processing with different logic configurations; the first analog / digital conversion circuit and the second analog / digital conversion circuit are configured with different circuits or different components; the first digital / analog conversion circuit and the second digital / analog conversion circuit are configured with different circuits or different components; a communication protocol between the first communication control circuit and the third communication control circuit is different from a communication protocol between the second communication control circuit and the fourth communication control circuit; a communication protocol between the fifth communication control circuit and the seventh communication control circuit is different from a communication protocol between the sixth communication control circuit and the eighth communication control circuit; It is characterized by: Effect of the Invention

[0011] According to the backup device for the safety protection system disclosed in the present application, the first safety protection logic in the safety protection device and the second safety protection logic in the CCF equipment are configured to run different application software, so that input and output devices can be shared between the safety protection device and the CCF equipment, eliminating the need to provide input and output devices dedicated to the CCF equipment. Even if the number of detectors and on-site safety equipment increases, it can be accommodated without increasing the volume of material in the CCF equipment. [Brief description of the drawings]

[0012] [Figure 1] 1 is a schematic configuration diagram of a backup device of a security protection system according to a first embodiment. [Diagram 2] FIG. 11 is a schematic configuration diagram of a backup device of a security protection system according to a second embodiment. [Diagram 3] FIG. 11 is a schematic configuration diagram of a backup device of a security protection system according to a third embodiment. [Figure 4] FIG. 13 is a schematic configuration diagram of a backup device of a safety protection system according to a fourth embodiment. [Diagram 5] FIG. 2 is a hardware configuration diagram of a safety logic according to the first to fourth embodiments. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] Hereinafter, preferred embodiments of the backup device for the safety protection system according to the present invention will be described with reference to the drawings. Note that the same reference numerals are used for the same contents and corresponding parts, and detailed descriptions thereof will be omitted. In the following embodiments, the same reference numerals are used to designate the same components, and redundant descriptions will be omitted.

[0014] Embodiment 1 1 is a schematic diagram of a backup device for a safety protection system according to the present embodiment. This embodiment will be described in terms of its application to a nuclear power plant, but is not limited thereto. A detector 1 monitors the state of the nuclear power plant, and transmits a detection signal to a safety protection device 2, which is a protection system facility. An input device 21 of the safety protection device 2 receives the transmitted detection signal, electrically branches the signal within the input device 21, and inputs one of the branched signals to an analog / digital (A / D) conversion circuit 211 of the safety protection device 2, and inputs the other to an A / D conversion circuit 212 for the CCF facility 3.

[0015] The detection signal is converted into a digital signal by the A / D conversion circuit 211 and transmitted to the arithmetic processing unit 22 via the first communication control circuit 213 of the safety protection device 2. The transmitted digital signal is received by the third communication control circuit 221, which is the input of the arithmetic processing unit 22, and is used to generate an operation command signal for the safety-system field device 4 of the protection system facility by a safety protection logic 222 implemented as the execution of a pre-designed protection logic of a microprocessor or FPGA (hereinafter referred to as application software). The operation command signal for the safety-system field device 4 generated by the safety protection logic 222 is transmitted to the output device 23 via the fifth communication control circuit 223, which is the output of the arithmetic processing unit 22. The function of the application software here includes analog four arithmetic operations in addition to logical operations.

[0016] In the output device 23, after receiving the operation command signal transmitted from the fifth communication control circuit 223 at the seventh communication control circuit 231, the signal is converted to an analog signal at the digital / analog (D / A) conversion circuit 232 and transmitted to the hardware (H / W) circuit 236, which is the final output terminal. The H / W circuit performs priority processing of the input signal. For example, there is a logical OR circuit, a logical AND circuit, an ON priority circuit, an OFF priority circuit, etc., but it is not limited to these.

[0017] On the other hand, the digital signal input to the A / D conversion circuit 212 is transmitted to a second communication control circuit 214 for the CCF facility 3 .

[0018] The A / D conversion circuit 211 and the A / D conversion circuit 212 are configured and implemented as different circuits or different devices (components). Similarly, the first communication control circuit 213 and the second communication control circuit 214 are configured and implemented as different circuits or components.

[0019] The second communication control circuit 214 transmits the input digital signal to a fourth communication control circuit 311 connected to the arithmetic processing unit 31 of the CCF facility 3, similar to the arithmetic processing unit 22. The transmitted digital signal is received by the fourth communication control circuit 311, and then used to generate an operation request signal to the safety-system field device 4 by a safety protection logic 312 configured by a microprocessor or a Field-Programmable Gate Array (FPGA) on which application software is implemented.

[0020] Here, in order to ensure diversity, the following applies to each component: (1) A communication protocol applied between the second communication control circuit 214 and the fourth communication control circuit 311 is different from the communication protocol applied between the first communication control circuit 213 and the third communication control circuit 221. (2) The arithmetic processing unit 31 and the arithmetic processing unit 22 perform similar digital signal processing using different circuits. For example, the microprocessor of the arithmetic processing unit 31 uses a device different from the microprocessor of the arithmetic processing unit 22. Alternatively, an FPGA is used for the arithmetic processing unit 31. (3) The safety protection logic 312 and the safety protection logic 222 are designed based on different concepts for similar digital signal processing. For example, when a microprocessor is used for each of the arithmetic processing units 31 and 22, different designers design them so that the design concepts of the application software to be implemented are different and decisions are not made with the same logical configuration. Also, when an FPGA is used for the arithmetic processing unit 31, different designers program the same processing as the digital signal processing in the microprocessor of the arithmetic processing unit 22 so that the logical configuration is based on a different design concept. (4) The CCF equipment 3 and the safety protection device 2 are designed by different designers in different departments in order to have different design concepts and to realize protection with different logical configurations.

[0021] An operation request signal to the safety-system field device 4 generated by the safety protection logic 312 is transmitted from the sixth communication control circuit 313, which is the output of the arithmetic processing unit 31, to the output device 23 of the safety protection apparatus 2. The transmitted operation request signal is received by the eighth communication control circuit 235 for the CCF facility 3, converted into an analog signal by the D / A conversion circuit 234 for the CCF facility 3, and then output to the H / W circuit 236.

[0022] The D / A conversion circuit 232 and the D / A conversion circuit 234 are configured and implemented with different circuits or devices (components). Similarly, the seventh communication control circuit 231 and the eighth communication control circuit 235 are configured with different circuits or components. Furthermore, a communication protocol different from the communication protocol between the fifth communication control circuit 223 and the seventh communication control circuit 231 is applied as the communication protocol between the sixth communication control circuit 313 and the eighth communication control circuit 235.

[0023] As described above, by configuring a backup device for the safety protection system, input and output devices can be shared between the safety protection equipment and the CCF equipment. This eliminates the need to provide input and output devices exclusively for the CCF equipment, and allows for an increase in the number of detectors and on-site safety equipment without increasing the amount of material in the CCF equipment.

[0024] Embodiment 2 In the configuration of embodiment 1, an optical-electrical (E / O) conversion circuit 24 is applied for converting an electrical signal from the second communication control circuit 214 of the safety protection device 2 into an optical signal, and an O / E conversion circuit 32 is applied for converting a signal received at the CCF facility from an optical signal to an electrical signal.

[0025] Similarly, an E / O conversion circuit 33 that converts the output signal of the sixth communication control circuit 313 of the CCF equipment 3 into an optical signal, and an O / E conversion circuit 25 that converts the signal received by the safety protection device 2 into an electrical signal are also applied. As a result, by transmitting and receiving optical signals between the safety protection device 2 and the CCF facility 3, when an electrical fault or the like occurs in the CCF facility 3, the effects of the fault are prevented from spreading to the safety protection device 2. Furthermore, by transmitting signals via optical cables, the transmission distance can be extended compared to electrical signals, and constraints on the installation location of the CCF facility 3 can be alleviated.

[0026] As described above, in the configuration of embodiment 2, by connecting the CCF equipment to the input device and the output device with optical cables, it is possible to prevent an electrical failure in the CCF equipment from affecting the safety protection system, and there is no need to provide a separation device.

[0027] Embodiment 3 As shown in Fig. 3, in the configuration of the first or second embodiment, detection signals are transmitted from a plurality of detectors 11, 12, 13 to a safety protection device 2, which is a protection system facility. The input devices 2101, 2102, 2103 of the safety protection device 2 receive the transmitted detection signals, electrically branch the signals within the input devices 2101, 2102, 2103, and input one of the branched signals to A / D conversion circuits 211a, 211b, 211c of the safety protection device 2, and input the other to A / D conversion circuits 212a, 212b, 212c for the CCF facility 3. The outputs from the A / D conversion circuits 212a, 212b, 212c are input to repeater circuits 26a, 26b, 26c having a signal aggregation function via a plurality of second communication control circuits 214a, 214b, 214c. The repeater circuits 26a, 26b, and 26c are electric amplifier circuits including a multiplexer, a two-port memory, and the like. The amplified signal is transmitted to the CCF facility 3 via the E / O conversion circuit 24. With this configuration, it is possible to transmit detection signals from the multiple detectors 11, 12, and 13 to the CCF facility 3 without increasing the number of transmission lines. In this embodiment, an example in which three detectors are input to three input devices has been shown, but the number of detectors and the number of input devices are not limited to this.

[0028] Embodiment 4 As shown in FIG. 4, a detection signal transmitted from the detectors 11, 12, and 13 is input to a plurality of input devices 2101, 2102, and 2103, and the signal is electrically branched within the input devices 2101, 2102, and 2103. One of the branched signals is input to the A / D conversion circuits 211a, 211b, and 211c of the safety protection device 2, and the other is input to the A / D conversion circuit 212 for the CCF equipment 3 in one input device (for example, the input device 2101). The output from the A / D conversion circuit 212 is input to the repeater circuit 26 via the second communication control circuit 214. The signal amplified by the repeater circuit 26 is transmitted to the CCF equipment 3 via the E / O conversion circuit 24. This makes it unnecessary for the A / D conversion circuits, second communication control circuits, and repeater circuits for the CCF equipment 3 of the two input devices 2102 and 2103, making it possible to miniaturize the input device. In the present embodiment, an example is shown in which three detectors are input to three input devices, but the number of detectors and the number of input devices are not limited to this.Furthermore, in the present embodiment, an example is shown in which an A / D conversion circuit, a second communication control circuit, and a repeater circuit arranged in one input device are shared with another input device, but only the A / D conversion circuit, or the A / D conversion circuit and the second communication control circuit may be shared.

[0029] An example of the hardware of the safety logic 222, 312 is shown in FIG. 5. As described above, the safety logic 222, 312 is composed of a microprocessor 50 and a storage device 60. Although not shown, the storage device 60 includes a volatile storage device such as a random access memory and a non-volatile auxiliary storage device such as a flash memory. Also, instead of the flash memory, a hard disk auxiliary storage device may be included. The microprocessor 50 executes application software input from the storage device 60. In this case, a program is input from the auxiliary storage device to the microprocessor 50 via the volatile storage device. Also, the microprocessor 50 may output data such as a calculation result to the volatile storage device of the storage device 60, or may store data in the auxiliary storage device via the volatile storage device. As described above, an FPGA may be used instead of a microprocessor for the hardware of the safety logic 312.

[0030] Although the present application describes various exemplary embodiments and examples, the various features, aspects, and functions described in one or more embodiments are not limited to application to a particular embodiment, but may be applied to the embodiments alone or in various combinations. Therefore, countless modifications not exemplified are assumed within the scope of the technology disclosed in the present specification, including, for example, modifying, adding, or omitting at least one component, and further, extracting at least one component and combining it with a component of another embodiment. [Explanation of symbols]

[0031] 1, 11, 12, 13: detector, 2: safety protection device, 3: CCF equipment, 4: safety field equipment, 21, 2101, 2102, 2103: input device, 22: calculation processing unit, 23: output device, 24: E / O conversion circuit, 25: O / E conversion circuit, 26, 26a, 26b, 26c: repeater circuit, 31: calculation processing unit, 32: O / E conversion circuit, 33: E / O conversion circuit, 50: microprocessor, 60: storage device, 211, 211a, 211b, 211c, 21 2, 212a, 212b, 212c: A / D conversion circuit, 213: first communication control circuit, 214, 214a, 214b, 214c: second communication control circuit, 221: third communication control circuit, 222: safety protection logic, 223: fifth communication control circuit, 231: seventh communication control circuit, 232, 234: D / A conversion circuit, 235: eighth communication control circuit, 236: H / W circuit, 311: fourth communication control circuit, 312: safety protection logic, 313: sixth communication control circuit.

Claims

1. A backup device for a safety protection system detects a plant state, and if an abnormality is detected, issues an instruction to a safety-related field device in response to an output of a first safety protection logic in a safety protection device, and if a common cause failure occurs in the safety protection device, issues an instruction to the safety-related field device in response to an output of a second safety protection logic in a CCF facility, a detector for detecting a state of the plant; a first and a second analog-to-digital conversion circuit disposed in an input device of the safety protection device and configured to digitally convert an output of the detector; a first communication control circuit disposed in the input device and configured to transmit a signal output from the first analog / digital conversion circuit to an arithmetic processing unit; a second communication control circuit disposed in the input device and configured to transmit a signal output from the second analog / digital conversion circuit to the CCF facility; a third communication control circuit disposed in a first processing unit of the safety protection device, the third communication control circuit receiving an output of the first communication control circuit and transmitting the output to the first safety protection logic of the processing unit; a fourth communication control circuit that receives an output of the second communication control circuit and transmits it to the second security protection logic disposed in a second processing unit of the CCF equipment; a fifth communication control circuit disposed in the first processing unit and configured to transmit an output from the first security protection logic; a sixth communication control circuit disposed in the second processing unit and configured to transmit an output from the second security logic; a seventh communication control circuit disposed in an output device area of ​​the safety protection device for receiving a signal transmitted from the fifth communication control circuit; an eighth communication control circuit disposed in the output device area for receiving a signal transmitted from the sixth communication control circuit; a first digital / analog conversion circuit disposed in the output device area for converting a signal from the seventh communication control circuit into an analog signal; a second digital / analog conversion circuit disposed in the output device area for converting a signal from the eighth communication control circuit into an analog signal; a hardware circuit that receives a signal from the first or second digital / analog conversion circuit and outputs the signal to the safety-system field device; Equipped with the first security logic and the second security logic execute digital signal processing with different logic configurations; the first analog / digital conversion circuit and the second analog / digital conversion circuit are configured by different circuits or different components; the first digital / analog conversion circuit and the second digital / analog conversion circuit are configured by different circuits or different components; a communication protocol between the first communication control circuit and the third communication control circuit is different from a communication protocol between the second communication control circuit and the fourth communication control circuit; a communication protocol between the fifth communication control circuit and the seventh communication control circuit is different from a communication protocol between the sixth communication control circuit and the eighth communication control circuit; A backup device for a security protection system.

2. 2. A backup device for a safety protection system according to claim 1, characterized in that a first photoelectric conversion circuit is connected to the rear stage of the second communication control circuit, a second photoelectric conversion circuit is connected to the front stage of the fourth communication control circuit, the first photoelectric conversion circuit and the second photoelectric conversion circuit are connected by an optical fiber cable, a third photoelectric conversion circuit is connected to the rear stage of the sixth communication control circuit, a fourth photoelectric conversion circuit is connected to the front stage of the eighth communication control circuit, and the third photoelectric conversion circuit and the fourth photoelectric conversion circuit are connected by an optical fiber cable.

3. A backup device for a safety protection system as described in claim 1 or 2, characterized in that when outputs from a plurality of the detectors are digitally converted by a plurality of the second analog / digital conversion circuits arranged in a plurality of the input devices and transmitted to the CCF equipment via a plurality of the second communication control circuits, outputs from the plurality of the second communication control circuits are transmitted via a repeater circuit.

4. 3. The backup device for a safety protection system as described in claim 1 or 2, characterized in that when each of the outputs of the multiple detectors is input to the multiple input devices and transmitted to the CCF equipment, the outputs of the multiple detectors are converted by the second analog / digital conversion circuit arranged in one of the input devices.

Images