Safety protection device

Abstract

This safety protection device comprises: a plurality of first determination circuits (211, 212) that are connected to a plurality of detectors (101, 102, 103, 104) respectively, receive input of detection values from the detectors, and output operation request signals if the detection values are equal to or larger than a predetermined threshold value; and a majority vote circuit that receives input of the outputs of the plurality of first determination circuits, receives input of the outputs of a plurality of second determination circuits (311, 312) from outside of the safety protection device, and confirms majority vote if the total number of outputs of the operation request signals is half the total number of the input outputs of the first and second determination circuits or more, and is characterized by comprising a limiting circuit that puts a limitation such that the result of determination by the majority vote circuit does not depend only on the outputs of the second determination circuits, the limiting circuit being provided upstream of, downstream of, or in the majority vote circuit. The majority vote circuit is provided with a function for executing the limiting function only when a process parameter is detected to be abnormal on the basis of the signals from the detectors connected to the safety protection device. This configuration prevents the function of the safety protection device from being limited or disabled only by the signals from other devices.

Description

[Technical field]

[0001] The present application relates to a safety device. [Background technology]

[0002] In order to achieve high reliability in safety protection devices for nuclear power plants, detectors for detecting process parameters are multiplexed, and judgments are made by comparing the signals from each of the multiplexed detectors with the activation settings of the safety functions. The operation of the safety functions is then determined by a majority voting circuit using each judgment result.

[0003] For example, the logic of the safety function in Patent Document 1 discloses a safety function activation logic in a system configuration in which the detectors are quadruple-redundant and the safety protection device is duplicated. The duplicated safety protection devices must be able to execute their functions independently of each other. For example, in the logic of Patent Document 1, two of the signals from the four detectors are input to the first safety protection device, and the signals from the remaining two detectors are input to the second safety protection device, so that the signals from the detectors are transmitted and received between the duplicated safety protection devices. That is, the first safety protection device is configured to be able to output an activation signal for the safety function by a majority circuit (TWO OF FOUR VOTER) of the judgment results of the two detectors and the judgment results of the remaining two detectors input from the second safety protection device. With this configuration, even if one safety protection device loses function, the safety function activation logic is able to execute the safety function by the other safety protection device. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] International Publication No. 2016 / 160492 Summary of the Invention [Problem to be solved by the invention]

[0005] In the safety function activation logic of Patent Document 1, when the first safety protection device receives two abnormality-determined judgment results from the second safety protection device, a safety function activation signal is sent from the majority voting circuit (TWO OF FOUR VOTER) even if the judgment results of the two detectors input to the first safety protection device do not indicate an abnormality, but this is tolerated because it does not represent an event that compromises safety.

[0006] However, if this safety function activation logic is applied to a function that limits the safety function, the safety function will be disabled based on the judgment result from the second safety protection device, and the independence of the duplicated devices cannot be ensured. For this reason, this safety function activation logic cannot be applied to a function that limits the safety function.

[0007] Here, the function to limit the safety function is, for example, a function to emergency shut down the reactor when the coolant pressure falls below a certain value, since in a pressurized water reactor, the cooling water in the core is pressurized to prevent the water from boiling. However, in the process of starting up a nuclear power plant from a shut-down state to an operating state, the pressure of the cooling water is increased along with the output of the nuclear power plant. For this reason, it is necessary to temporarily limit the emergency shutdown function due to low coolant pressure. This limit is implemented by logic that disables the emergency shutdown function due to low coolant pressure, provided that the power plant output is low.

[0008] The present application has been made to solve the problems described above, and aims to provide a safety protection device that limits a safety function only when an abnormality in a process parameter is detected by a signal from a detector connected to the device itself. [Means for solving the problem]

[0009] The safety protection device disclosed in the present application comprises a plurality of first judgment circuits connected to a plurality of detectors, which input the detection values ​​of the detectors and output an activation request signal when the detection value reaches or exceeds a predetermined threshold value, and a majority voting circuit which inputs the outputs of the plurality of first judgment circuits and also inputs the outputs of a plurality of second judgment circuits from outside the device, and which makes a majority decision when the total number of activation request signal outputs is half or a majority of the total number of input outputs of the first and second judgment circuits, and is characterized in that a limiting circuit which limits the judgment result of the majority circuit to not depend solely on the output of the second judgment circuit is provided upstream or downstream of the majority voting circuit, or in the majority voting circuit. Effect of the Invention

[0010] According to the safety protection device disclosed in the present application, the safety function is restricted only when an abnormality in a process parameter is detected by a signal from a detector connected to the device, thereby making it possible to prevent the functions of the device from being restricted or disabled solely by a signal from another device. [Brief description of the drawings]

[0011] [Figure 1] FIG. 2 is a configuration diagram of an execution logic for limiting a safety function of the safety protection device according to the first embodiment. [Diagram 2] FIG. 11 is a configuration diagram of an execution logic for limiting a safety function of a safety protection device according to a second embodiment. [Diagram 3] FIG. 11 is a circuit configuration diagram showing an example of a majority circuit according to a second embodiment. [Figure 4] FIG. 11 is a configuration diagram of an execution logic for limiting a safety function of a safety protection device according to a third embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, preferred embodiments of the safety protection device according to the present invention will be described with reference to the drawings. Note that the same reference numerals are used to designate the same contents and corresponding parts, and detailed descriptions thereof will be omitted. In the following embodiments, the same reference numerals are used to designate the same components, and redundant descriptions will be omitted.

[0013] Embodiment 1 1 is a configuration diagram of execution logic for limiting a safety function of a safety protection device according to this embodiment. Detectors 101 to 104 measure process parameters such as the flow rate, water level, pressure, and temperature of cooling water used in a plant system of a nuclear power plant, for example. Each process value is multiplexed by multiple detectors. Here, as an example, it is assumed that detectors 101 to 104 detect the pressure of cooling water.

[0014] The detection signals of detectors 101 and 102 are input to safety protection device 2, and the detection signals of detectors 103 and 104 are input to safety protection device 3. In safety protection device 2, a judgment circuit 211 judges whether the pressure value of the detection signal from detector 101 is equal to or greater than a predetermined threshold, and when it is equal to or greater than the threshold, it judges that the pressure value is in an abnormal state and outputs an operation request signal. Similarly, a judgment circuit 212 judges whether the pressure value of the detection signal from detector 102 is equal to or greater than a predetermined threshold, and when it is equal to or greater than the threshold, it judges that the pressure value is in an abnormal state and outputs an operation request signal.

[0015] In the safety protection device 3, a judgment circuit 311 judges whether the pressure value of the detection signal from the detector 103 is equal to or greater than a predetermined threshold, and when it is equal to or greater than the threshold, it judges that the pressure value is in an abnormal state and outputs an operation request signal. Similarly, a judgment circuit 312 judges whether the pressure value of the detection signal from the detector 102 is equal to or greater than a predetermined threshold, and when it is equal to or greater than the threshold, it judges that the pressure value is in an abnormal state and outputs an operation request signal.

[0016] The majority circuit 222 of the safety protection device 2 outputs a safety signal when half or a majority of the input signals from the judgment circuits are activation request signals. In the present embodiment, as shown in Fig. 1, the majority circuit 222 outputs a safety signal when activation request signals are input from a plurality (two or more) of the four judgment circuits 211, 212, 311, and 312 (TWO OF FOUR VOTER). However, the configuration is such that the restriction of the safety protection operation of the safety protection device 2 is executed only when an activation request signal is output from either the judgment circuits 211 or 212.

[0017] 1, the output of the logical sum (OR circuit 221) of the outputs of the judgment circuits 211 and 212 and the logical product (AND circuit 223) of the output of the majority circuit 222 are configured as the output of the safety protection device 2. This prevents the restriction of the safety protection operation of the safety protection device 2 from being executed only by an output from outside the safety protection device 2, for example, an operation request signal from the judgment circuits 311 and 312 from the safety protection device 3.

[0018] The safety protection device 3 is configured in the same manner as the safety protection device 2. In this case, the outputs of the decision circuits 211 and 212 are input to a majority circuit 322 in the safety protection device 3.

[0019] As described above, by adding a function to the majority circuit to execute the restriction function only when an abnormality in a process parameter is detected by a signal from a detector connected to the device itself, it is possible to prevent the functions of the device itself from being restricted or disabled solely by a signal from another device.

[0020] Embodiment 2 2 shows the configuration of the execution logic for limiting the safety function of the safety protection device according to this embodiment. The configurations and operations of the detectors 101 to 104 and the configurations and operations of the decision circuits 211, 212, 311, and 312 are the same as those in the first embodiment, so a description thereof will be omitted.

[0021] The majority circuit 222a outputs a safety signal when half or a majority of the input signals from the judgment circuits are activation request signals. In the present embodiment, the configuration is such that the restriction of the safety protection operation of the safety protection device 2 is executed when activation request signals are input from at least two of the four judgment circuits 211, 212, 311, and 312 (TWO OF FOUR VOTER). However, the circuit configuration is such that the signal is not output when only activation request signals are input from the judgment circuits 311 and 312 of the safety protection device 3.

[0022] A specific circuit configuration of the majority circuit 222a is shown in Fig. 3. The majority circuit shown in Fig. 3 is configured to output a signal by an OR circuit 2227 that receives the following signals as input. (1) Output of AND circuit 2221 having judgment circuit 211 and judgment circuit 212 as inputs (2) Output of the AND circuit 2222 having the judgment circuit 211 and the judgment circuit 311 as inputs (3) Output of the AND circuit 2223 having the judgment circuit 211 and the judgment circuit 312 as inputs (4) Output of the AND circuit 2224 having the judgment circuit 212 and the judgment circuit 311 as inputs (5) Output of the AND circuit 2225 to which the decision circuit 212 and the decision circuit 312 are input Incidentally, the signals of the judgment circuit 311 and the judgment circuit 312 are not input to the OR circuit 2227 since only the signal from the safety protection device 3 is input.

[0023] The safety protection device 3 is configured in the same manner as the safety protection device 2. In this case, the outputs of the decision circuits 211 and 212 are input to a majority circuit 322a in the safety protection device 3.

[0024] With the above configuration, the majority circuit is configured to execute the limiting function only when an abnormality in the process parameter is detected by a signal from a detector connected to the device itself, thereby preventing the function of the device itself from being limited or disabled only by a signal from another device. Also, compared to the first embodiment, there is no need to add an external circuit to the majority circuit, which makes it possible to simplify and miniaturize the circuit configuration.

[0025] Embodiment 3 4 shows the configuration of the execution logic for limiting the safety function of the safety protection device according to this embodiment. The configurations and operations of the detectors 101 to 104, the decision circuits 211, 212, 311, 312, and the majority circuit 222 are the same as those in the first embodiment, so the description will be omitted.

[0026] The signals from the judgment circuits 311, 312 of the safety protection device 3 are input to AND circuits 243, 244 together with the output of an OR circuit 241 which receives as input the output signals of the judgment circuits 211, 212 of the safety protection device 2, and the outputs of the AND circuits 243, 244 are input to the majority circuit 222 together with the outputs of the judgment circuits 211, 212. This prevents the safety protection device 2 from operating without a signal from either of the judgment circuits 211, 212 of the safety protection device 2. In other words, the configuration is such that the restriction on the safety protection operation of the safety protection device 2 is executed only when half or a majority of the signals from the judgment circuits input to the majority circuit 222 are operation request signals and an operation request signal is being output from either of the judgment circuits 211, 212.

[0027] The safety protection device 3 is configured in the same manner as the safety protection device 2. In this case, the outputs of the decision circuits 211 and 212 are input to AND circuits 343 and 344 in the safety protection device 3, respectively.

[0028] With the above configuration, by adding a function to the majority circuit to execute the restriction function only when an abnormality in a process parameter is detected by a signal from a detector connected to the device itself, it is possible to prevent the functions of the device itself from being restricted or disabled solely by a signal from another device.

[0029] In the first to third embodiments, the number of safety protection devices is two, the number of detectors is four, and the number of determination circuits is four, but this is not limiting.

[0030] Although the present application describes various exemplary embodiments and examples, the various features, aspects, and functions described in one or more embodiments are not limited to application to a particular embodiment, but may be applied to the embodiments alone or in various combinations. Therefore, countless modifications not exemplified are assumed within the scope of the technology disclosed in the present specification, including, for example, modifying, adding, or omitting at least one component, and further, extracting at least one component and combining it with a component of another embodiment. [Explanation of symbols]

[0031] 2, 3: safety protection device, 101, 102, 103, 104: detector, 211, 212, 311, 312: decision circuit, 222, 222a: majority circuit

Claims

1. a plurality of first determination circuits connected to the plurality of detectors, respectively, for inputting detection values ​​of the detectors and outputting an operation request signal when the detection values ​​reach or exceed a predetermined threshold value; a majority decision circuit which inputs the outputs of a plurality of the first decision circuits and also inputs the outputs of a plurality of second decision circuits from outside the device, and judges that a majority decision has been made when the total number of the outputs of the operation request signals among the total number of the input outputs of the first and second decision circuits is half or a majority; In a safety protection device comprising: a limiting circuit for limiting a decision result of said majority circuit so that it does not depend only on the output of said second decision circuit, said limiting circuit being provided in said majority circuit or in a stage preceding or succeeding said majority circuit.

2. a plurality of first determination circuits connected to the plurality of detectors, respectively, for inputting detection values ​​of the detectors and outputting an operation request signal when the detection values ​​reach or exceed a predetermined threshold value; a majority decision circuit which inputs the outputs of a plurality of the first decision circuits and also inputs the outputs of a plurality of second decision circuits from outside the device, and judges that a majority decision has been made when the total number of outputs of the operation request signals among the total number of outputs of the first and second decision circuits input thereto is half or a majority; a limiting circuit that does not output the output of the majority circuit to the outside of the device when the result of the decision of the majority circuit is based only on the output of the second decision circuit; A safety protection device comprising:

3. 3. The safety protection device according to claim 2, wherein the limiting circuit is a circuit that outputs a logical product of an output of a logical sum of a plurality of the first decision circuits and an output of the majority circuit.

4. a plurality of first determination circuits connected to the plurality of detectors, respectively, for inputting detection values ​​of the detectors and outputting an operation request signal when the detection values ​​reach or exceed a predetermined threshold value; a majority decision circuit which inputs the outputs of a plurality of the first decision circuits and also inputs the outputs of a plurality of second decision circuits from outside the device, and judges that a majority decision has been reached when the total number of outputs of the operation request signals among the total number of the input outputs of the first and second decision circuits is half or a majority, and does not reflect a decision based only on the output of the second decision circuit in the majority decision decision; A safety protection device comprising:

5. a plurality of first determination circuits connected to the plurality of detectors, respectively, for inputting detection values ​​of the detectors and outputting an operation request signal when the detection values ​​reach or exceed a predetermined threshold value; a majority decision circuit which inputs the outputs of a plurality of the first decision circuits and also inputs the outputs of a plurality of second decision circuits from outside the device, and judges that a majority decision has been made when the total number of the outputs of the operation request signals among the total number of the input outputs of the first and second decision circuits is half or a majority; a limiting circuit that limits an input of the output of the second decision circuit to the majority circuit so that the decision result of the majority circuit does not depend only on the output of the second decision circuit; A safety protection device comprising:

6. 6. The safety protection device according to claim 5, wherein the limiting circuit is a circuit that inputs to the majority circuit a logical product of a logical sum of outputs from a plurality of the first decision circuits and an output from the second decision circuit.

Images