Interlock system, interlock method and program

Abstract

To provide a system allowed to detect an abnormality of a device and alleviate the abnormality without relying on a determination of an operator.SOLUTION: An interlock system comprises: an abnormality detecting section that detects an abnormality if there is an inconsistency in a state of a control signal for controlling a device with respect to a change of an associated parameter due to an action of the device; a normality diagnosing section that diagnosis the device as normal based on a change of the associated parameter due to an intended operation; and a stopping section that stops the action of the device if an abnormality is detected by the abnormality detecting section and the normality diagnosing section does not diagnose that the device is normal.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present disclosure relates to an interlock system, an interlock method, and a program for equipment.

Background Art

[0002] In recent years, in order to shorten the period of regular inspections and improve the operating rate of nuclear power plants, studies have been underway to extend the operation cycle and introduce OLM (On Line Maintenance). In addition, from the perspective of improving the operating rate, it is important to avoid unexpected shutdowns. Looking at existing plants from the perspective of deep defense, there is room for improvement in the operating continuity ability. Analyzing past cases, there are cases where reactor trips have occurred due to the operation of control rods. Currently, regarding the operation of control rods, determining whether it is normal or abnormal and performing a relaxation operation in the case of an abnormality to normalize the operation of the control rods depends on the judgment of the operator. There are cases where the operator's judgment causes a reactor trip.

[0003] Patent Document 1 discloses that in a situation where no control rod drive command is output from the control rod position control circuit and the operation of the control rod is detected, it is considered that the cause is a malfunction of the power supply device. By turning off the power breaker to stop the control rod, even if the power supply device malfunctions, control is disclosed to prevent an unexpected reactivity insertion operation into the reactor.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] Control is required to detect an abnormality in the operation of a device and mitigate the abnormality without relying on the judgment of an operator.

[0006] The present disclosure provides an interlock system, an interlock method, and a program that can solve the above problems.

Means for Solving the Problems

[0007] According to one embodiment of the present disclosure, an interlock system includes an abnormality detection unit that detects an abnormality when the state of a control signal for controlling a device contradicts a change in a related parameter associated with the operation of the device, a normal diagnosis unit that diagnoses normalcy with respect to a change in the related parameter associated with an intended operation, and a stop unit that stops the operation of the device when the abnormality is detected by the abnormality detection unit and no normal diagnosis is made by the normal diagnosis unit. It has, and when the abnormality detection unit detects an abnormality, it outputs an interlock signal. When the normal diagnosis unit diagnoses it as normal, it outputs an interlock block signal. The stop unit receives the interlock signal and stops the operation of the device when it does not receive the interlock block signal.

[0008] According to one embodiment of the present disclosure, an interlock method includes a step of detecting an abnormality when the state of a control signal for controlling a device contradicts a change in a related parameter associated with the operation of the device, a step of diagnosing normalcy with respect to a change in the related parameter associated with an intended operation, and a step of stopping the operation of the device when the abnormality is detected in the step of detecting the abnormality and no normal diagnosis is made in the step of diagnosing normalcy. And in the step of detecting the abnormality, when an abnormality is detected, an interlock signal is output. In the step of diagnosing it as normal, when it is diagnosed as normal, an interlock block signal is output. In the step of stopping, the operation of the device is stopped when the interlock signal is received and the interlock block signal is not received. 。

[0009] According to one embodiment of the present disclosure, a program causes a computer to perform a step of detecting an abnormality when the state of a control signal for controlling a device contradicts a change in a related parameter associated with the operation of the device, a step of diagnosing normalcy with respect to a change in the related parameter associated with an intended operation, and a step of stopping the operation of the device when the abnormality is detected in the step of detecting the abnormality and no normal diagnosis is made in the step of diagnosing normalcy. It has, and in the step of detecting the abnormality, when an abnormality is detected, an interlock signal is output. In the step of diagnosing it as normal, when it is diagnosed as normal, an interlock block signal is output. In the step of stopping, the operation of the device is stopped when the interlock signal is received and the interlock block signal is not received, the process. to execute.

Advantages of the Invention

[0010] According to the above interlock system and interlock method, it is possible to detect abnormal operation of equipment from related parameters and the like without depending on the judgment of the operator, and mitigate the abnormality. Thereby, it is possible to prevent a trip of the nuclear power plant and improve the plant operation rate.

Brief Description of the Drawings

[0011]

Figure 1

Figure 2

Figure 3

Figure 4

Mode for Carrying Out the Invention

[0012] <Embodiment> (Configuration) Hereinafter, the interlock system of the present disclosure will be described with reference to FIGS. 1 to 4. FIG. 1 is a schematic diagram of a PWR (Pressurized Water Reactor) type nuclear power plant 100 according to the present embodiment. The nuclear power plant 100 includes a reactor facility 5 and a control system 40. The reactor facility 5 stores a reactor 1, a primary cooling loop 4 through which a primary coolant circulates, a detector 6, a steam generator (not shown), a pressurizer, a cooling water pump, and the like. The reactor 1 is provided with a fuel cluster 2 and a plurality of control rods 3. The plurality of control rods 3 are moved up and down in the core axis direction to control the output of the reactor 1. A detector 6 provided outside the reactor 1 detects the output region neutron flux output from the reactor 1. For example, four detectors 6 are provided, and the output values of the output region neutron fluxes detected by each detector 6 (hereinafter simply referred to as the neutron flux output values) are output to the control system 40 as the detection values of the neutron fluxes in four channels CH1 to 4 (output region neutron fluxes 1 to 4 in FIG. 2, where 1 to 4 are described in Roman numerals in FIG. 2). Also, in the reactor facility 5, the temperature of the primary coolant is measured and output to the control system 40. In addition to this, the nuclear power plant 100 includes turbine facilities such as a turbine, a condenser, and a generator, as well as various instruments, controllers, and equipment, which are not shown in the figure.

[0013] The control system 40 is a control system for the control rod 3 with an interlock function. The interlock function is a function of detecting an abnormal operation of the control rod 3 and mitigating the abnormal operation. The control system 40 has two functions: an abnormality diagnosis logic and an abnormality mitigation logic. The abnormality diagnosis logic uses the measured values of relevant parameters measured by the instruments provided in the nuclear power plant 100 and the control signals output by controllers and the like to detect a deviation from the "should-be state" of the control rod 3, thereby diagnosing an abnormality in the operation of the control rod. The abnormality mitigation logic performs control to mitigate the detected abnormality when an abnormality is detected by the abnormality diagnosis logic. For example, the abnormality mitigation logic stops the operation of the control rod 3 to mitigate the abnormality.

[0014] The control system 40 includes a reactor control system instrument rack 10, a control panel 20, and a control rod drive device 30. The reactor control system instrument rack 10, the control panel 20, and the control rod drive device 30 are connected to be communicable with each other. All of these three devices are conventionally provided in the nuclear power plant 100. By newly adding functions to each device, the control system of the control rod 3 with an interlock function according to the present embodiment is realized. In the following description, the functions and configurations related to the present embodiment will be described, and descriptions of other functions and configurations provided in these devices will be omitted.

[0015] As operations on the reactor 1, the operator can perform manual operations of withdrawing and inserting the control rod 3 and manual operations of concentrating and diluting the primary coolant. In addition, the operator can select the automatic control mode of the control rod 3 and select the automatic replenishment mode for automatically replenishing the primary coolant. Since any operation by the operator is input through the control panel 20 or the like in either of these manual control and automatic control, the control system 40 can identify what control mode is selected and what control is being implemented for the control rod 3 and the primary coolant. The control signal indicating what control mode is selected and the like is configured to be input to the reactor control system instrument rack 10.

[0016] (Reactor control system instrument rack) The reactor control system instrument rack 10 collects measurement values measured by instruments and controls the operation of devices provided in the nuclear power plant 100 based on the collected measurement values. The reactor control system instrument rack 10 has a signal acquisition unit 11, a normal diagnosis unit 12, and an abnormality detection unit 13. The signal acquisition unit 11 acquires various measurement values and control signals. For example, the signal acquisition unit 11 acquires four output values of the neutron fluxes CH1 to CH4 detected by the detector 6, the measurement value of the primary coolant temperature, the control mode of the control rod 3 (such as automatic control or manual control, and further a control signal indicating the extraction or insertion of the control rod 3), and control signals indicating control modes such as the concentration / dilution control of the primary coolant (automatic control, manual control, implementation of emergency concentration operation, etc.). The nuclear reactor control system instrument rack 10 generates a control rod control signal based on the measurement value of the primary coolant temperature acquired by the signal acquisition unit 11.

[0017] The normal diagnosis unit 12 diagnoses whether the change in the output value (related parameter) of the neutron flux associated with the manual operation of the operator is normal. For example, when the operator manually operates the control rod 3 or concentrates / dilutes the primary coolant, even if a change occurs in the output value of the neutron flux, the normal diagnosis unit 12 diagnoses that the change is the result of the intended operation and is normal. When a control signal indicating the manual operation of the operator is not acquired, the normal diagnosis unit 12 does not perform a normal diagnosis. When diagnosed as normal, the normal diagnosis unit 12 outputs an interlock block signal to the control rod drive device 30.

[0018] The abnormality detection unit 13 determines whether the state of the control signal (control rod control deviation signal) for the control rod 3 is inconsistent with the change in the output value (related parameter) of the neutron flux associated with the operation of the control rod 3, and detects an abnormal operation of the control rod 3 when there is a contradiction. For example, when the control rod control deviation signal is in a state where the extraction control of the control rod 3 occurs (for example, the current temperature of the primary coolant is lower than the reference temperature by a predetermined value or more), if the output value of the neutron flux changes in response to the extraction operation of the control rod 3, the abnormality detection unit 13 determines that the operation of the control rod 3 is normal. On the contrary, when the control rod control deviation signal is in a state where the extraction control of the control rod 3 does not occur, if the output value of the neutron flux changes in response to the extraction operation of the control rod 3, the abnormality detection unit 13 determines that the operation of the control rod 3 is abnormal. When an abnormality is determined, the abnormality detection unit 13 outputs an interlock signal requesting the stop of the control rod 3 to the control rod drive device 30.

[0019] (Control Panel) The control panel 20 is provided with an operation interface such as a screen for displaying the state of the plant and alarms, and an operator for the operator to perform operations. The control panel 20 includes an input unit 21 and an output unit 22. The input unit 21 is configured to include input devices such as switches (reset switch 211, control rod stop switch 212, etc. in FIG. 2), buttons, keyboards, touch panels, etc., and accepts operations of these input devices by the operator. For example, the input unit 21 accepts operations for pulling out, inserting, stopping the control rod 3, operations for instructing operations of concentrating / diluting the primary coolant, operations for setting the automatic control mode for the control of the control rod 3, and operations for setting the automatic replenishment mode for the primary coolant by the operator. Further, the input unit 21 accepts an operation for instructing reset by the operator (pressing the reset switch 211). By the reset instruction, it is possible to reset the interlock signal output from the abnormality detection unit 13 and the stop instruction of the control rod 3 operated by the operator (pressing the control rod stop switch 212). For example, when the reset for the interlock signal is performed, the interlock signal becomes invalid, and when the reset for the stop instruction of the control rod 3 is performed, the stop instruction becomes invalid. The output unit 22 generates a signal corresponding to the operation received by the input unit 21 and outputs the signal to the reactor control system instrument rack 10 and the control rod drive device 30. For example, when a reset operation is performed, the output unit 22 generates and outputs a reset signal. When an operation for instructing the stop of the control rod 3 is performed, a stop signal is generated and output.

[0020] (Control Rod Drive Device) The control rod drive device 30 controls the operation of the control rod 3. The control rod drive device 30 includes a signal acquisition unit 31, a stop unit 32, and a control unit 33. The signal acquisition unit 31 acquires various signals from the nuclear reactor control system instrument rack 10 and the control panel 20. For example, the signal acquisition unit 31 acquires a control rod automatic withdrawal signal or a control rod manual withdrawal signal for instructing the withdrawal of the control rod 3, and a control rod automatic insertion signal or a control rod manual insertion signal for instructing the insertion of the control rod 3 from the nuclear reactor control system instrument rack 10. For example, the signal acquisition unit 31 acquires an interlock block signal output by the normal diagnosis unit 12 and an interlock signal output by the abnormality detection unit 13. Also, for example, the signal acquisition unit 31 acquires a stop signal and a reset signal for instructing the stop of the control rod 3.

[0021] The stop unit 32 determines whether to stop the operation of the control rod 3 based on the diagnosis result by the normal diagnosis unit 12 and the determination result by the abnormality detection unit 13 acquired by the signal acquisition unit 31. Specifically, when the abnormality detection unit 13 determines that the control rod 3 has an abnormal operation and outputs an interlock signal, and the normal diagnosis unit 12 does not make a normal diagnosis (when the interlock block signal is not output), the stop unit 32 determines to stop the operation of the control rod 3, and otherwise, determines not to stop the operation of the control rod 3. When the signal acquisition unit 31 acquires an interlock signal and a reset signal, the stop unit 32 resets and invalidates the interlock signal based on the reset signal. Thereby, even when an interlock signal is output, the stop unit 32 determines not to stop the operation of the control rod 3.

[0022] The control unit 33 controls the operation of the control rod 3 based on the control rod automatic withdrawal signal, the control rod automatic insertion signal, the control rod manual withdrawal signal, the control rod manual insertion signal acquired by the signal acquisition unit 31, and the determination result of the stop unit 32. For example, when the stop unit 32 determines not to stop the operation of the control rod 3, the control unit 33 performs the withdrawal operation of the control rod 3 based on the automatic or manual control rod withdrawal signal acquired by the signal acquisition unit 31. For example, even when the signal acquisition unit 31 acquires a control rod automatic withdrawal signal, if the stop unit 32 determines to stop the operation of the control rod 3, the control unit 33 does not perform the withdrawal operation of the control rod 3. Also, when the signal acquisition unit 31 acquires a stop signal, the control unit 33 stops the operation of the control rod 3.

[0023] Next, referring to FIG. 2, the control logic of the control rod 3 will be described in detail centering on the interlock function according to this embodiment. The control system 40 has an abnormality diagnosis logic and an abnormality mitigation logic. The abnormality diagnosis logic can be further classified into an abnormality detection logic 130 and a normal operation diagnosis logic 120. The abnormality detection logic is executed by the abnormality detection unit 13, and the normal operation diagnosis logic is executed by the normal diagnosis unit 12. Further, the abnormality mitigation logic 320 is mainly executed by the stop unit 32. The functions of each logic can be described as follows.

[0024] (Abnormality Detection Logic) The abnormality detection logic is intended to detect control rod continuous malfunction (an event in which the control rod withdrawal / insertion operation occurs without a control rod withdrawal / insertion signal) and control rod inconsistency (control rod slip, control rod drop). The rate of change of the output value of the neutron flux is calculated by incomplete differentiation. An interlock signal is transmitted on the condition that the calculated rate of change exceeds a threshold value and no control rod control deviation signal sufficient for the control rod to operate is being transmitted.

[0025] (Normal Operation Diagnosis Logic) Operations that cause a change in the output of the nuclear reactor 1 (change in the output value of the neutron flux) regardless of the control rod control deviation signal include control rod manual operation, dilution / concentration operation, and emergency concentration operation, all of which are arbitrarily operated by the operator. Therefore, it is possible to detect normal operation based on the position of the operator, switch, etc. In the normal operation diagnosis logic, after detecting a manual operation, the transmission of the detection signal is continued until reactivity is generated by the operation to compensate for the delay, and a flip-flop (circuit 124) is established. As a result, an interlock block signal indicating that the output change of the nuclear reactor 1 is a normal operation is transmitted, and the operation of the interlock is blocked. When the rate of change of the output falls below the set value, the interlock block signal is stopped.

[0026] (Abnormality Mitigation Logic) Stop the automatic control rod operation on the condition that the interlock signal is output and the interlock block signal is not transmitted. This function can be reset arbitrarily by the control rod automatic withdrawal / insertion stop reset switch (reset switch 211), and the reset takes precedence. Also, for events with an output change rate so small that they cannot be detected by the abnormality detection logic, the operator can arbitrarily stop the automatic and manual control rod operations by the control rod stop switch 212.

[0027] Next, with reference to FIG. 2, the configuration and operation of each logic will be described. <Abnormality Detection Logic> The abnormality detection unit 13 has circuits 131, 132, 133a, 133b, 133c, 133d, 134a, 134c, 136a, 136b, 138, and uses these to execute the abnormality detection logic 130.

[0028] (Process 1A) The circuit 131 of the abnormality detection unit 13 acquires the detection values of the neutron beams CH1 to CH4 through the signal acquisition unit 11, performs incomplete differentiation on each of them, and calculates the rate of change. Subsequently, the circuit 132 of the abnormality detection unit 13 selects the second largest value from among the rates of change of the neutron beams CH1 to CH4. The reason for selecting the second largest value instead of the largest value is to exclude the influence of abnormal values caused by channel failures or the like. The circuit 133a of the abnormality detection unit 13 determines whether the degree of increase in the second largest rate of change is equal to or greater than the threshold value. If it is equal to or greater than the threshold value, it further determines whether the state where the degree of increase in the rate of change is equal to or greater than the threshold value continues for a predetermined time or more. This eliminates the possibility of a temporary increase in the rate of change due to noise or the like. When the control rod 3 is withdrawn, the detection value of the neutron beam increases. If the degree of increase in the detection value of the neutron beam is equal to or greater than the threshold value, it is considered that the control rod 3 is being withdrawn. That is, the abnormality detection unit 13 detects the occurrence of the withdrawal operation of the control rod 3 using the output values (related parameters) of the neutron beams CH1 to CH4. When the circuit 133a of the abnormality detection unit 13 detects the occurrence of the withdrawal operation of the control rod 3, it issues a signal 135a, and when it does not detect the occurrence of the withdrawal operation of the control rod 3, it does not issue the signal 135a.

[0029] (Process 1B) In parallel with Process 1A, circuit 133b of the abnormality detection unit 13 acquires a control rod control deviation signal through the signal acquisition unit 11, and determines whether the acquired control rod control deviation signal is in a state where the withdrawal control of the control rod 3 occurs. The reactivity and the temperature of the primary coolant in the nuclear reactor 1 change depending on the insertion and withdrawal of the control rod 3. The control rod control deviation signal is a signal related to the deviation between the reference temperature of the primary coolant temperature and the current average temperature. When automatically controlling the control rod 3 in a PWR type nuclear power plant, the control rod 3 operates when the deviation between these temperatures is large, and is controlled not to operate when the deviation is small. Therefore, the control state of the control rod 3 can be detected by the control rod control deviation signal. Circuit 133b of the abnormality detection unit 13 outputs signal 134 when the state of the control rod control deviation signal causes the withdrawal control of the control rod 3 (for example, when the current primary coolant temperature is lower than the reference temperature and the deviation is larger than the threshold value), and does not output signal 134 otherwise. Next, circuit 134a of the abnormality detection unit 13 performs an operation opposite to the presence or absence of the output signal based on the determination of circuit 133b (134a is a NOT circuit, and the same applies hereinafter). That is, circuit 134a of the abnormality detection unit 13 does not output signal 135b when the state of the control rod control deviation signal causes the withdrawal control of the control rod 3, and outputs signal 135b when the withdrawal control does not occur.

[0030] (Process 1C) Next, when circuit 136a of the abnormality detection unit 13 receives both signal 135a output as a result of Process 1A and signal 135b output as a result of Process 1B (136a is an AND circuit, and the same applies hereinafter), it outputs signal 137a. That is, when it is detected as a result of Process 1A that the withdrawal operation of the control rod 3 has occurred, and when it is determined as a result of Process 1B that the control rod control deviation signal is not in a state that causes the withdrawal control, circuit 136a of the abnormality detection unit 13 outputs signal 137a.

[0031] (Process 1D) The circuit 133c of the abnormality detection unit 13 determines whether the degree of decrease in the change rate, which is the second largest value selected by the processing of the circuit 132, is equal to or greater than a threshold value. If it is equal to or greater than the threshold value, it further determines whether the state where the degree of decrease in the change rate is equal to or greater than the threshold value continues for a predetermined time or more. When the control rod 3 is inserted, the detected value of the neutron flux decreases. If the degree of decrease in the change rate is equal to or greater than the threshold value, it is considered that the insertion of the control rod 3 has occurred. The circuit 133c of the abnormality detection unit 13 detects the insertion operation of the control rod 3 using the output values of the neutron fluxes CH1 to CH4. When the circuit 133c of the abnormality detection unit 13 detects that the insertion operation of the control rod 3 has occurred, it issues a signal 135c, and when it does not detect that the insertion operation of the control rod 3 has occurred, it does not issue the signal 135c.

[0032] (Process 1E) In parallel with Process 1D, the circuit 133d of the abnormality detection unit 13 acquires the control rod control deviation signal and determines whether the acquired control rod control deviation signal causes the insertion control of the control rod 3 (for example, the current primary coolant temperature is higher than the reference temperature and the deviation is greater than the threshold value). When the control rod control deviation signal causes the insertion control of the control rod 3, the circuit 133d of the abnormality detection unit 13 outputs a signal 134b, and when it does not, it does not output the signal 134b. Next, the circuit 134c of the abnormality detection unit 13 performs an operation opposite to the presence or absence of the output signal based on the determination of the circuit 133d. That is, when the state of the control rod control deviation signal causes the insertion control of the control rod 3, the circuit 134c of the abnormality detection unit 13 does not output a signal 135d, and when it does not cause the insertion control, it outputs a signal 135d.

[0033] (Process 1F) Next, when the circuit 136b of the abnormality detection unit 13 receives both the signal 135c output as a result of Process 1D and the signal 135d output as a result of Process 1E, it outputs a signal 137b. That is, when it is detected by Process 1D that the insertion operation of the control rod 3 has occurred and it is determined by Process 1E that the insertion control of the control rod 3 is not being performed from the control rod control deviation signal, the abnormality detection unit 13 outputs a signal 137b.

[0034] (Process 1G) Next, when the circuit 138 of the abnormality detection unit 13 receives either the signal 137a output as a result of Process 1C or the signal 137b output as a result of Process 1F (the circuit 138 is an OR circuit, and the same applies hereinafter), it outputs an abnormality detection signal 139. That is, even though the extraction operation of the control rod 3 is detected from the change in the output values of the neutron fluxes CH1 to 4, if the extraction control of the control rod 3 is not detected from the control rod control deviation signal, or even though the insertion operation of the control rod 3 is detected from the change in the output values of the neutron fluxes CH1 to 4, if the insertion control of the control rod 3 is not detected from the control rod control deviation signal, the abnormality detection unit 13 outputs an abnormality detection signal (139). The abnormality detection signal 139 is output to the control rod drive device 30 as an interlock signal 139.

[0035] <Normal operation diagnosis logic> Based on the information regarding the operations and control modes being performed on the control rod 3 and the primary coolant acquired through the signal acquisition unit 11, the normal diagnosis unit 12 performs the following processes (normal operation diagnosis logic 120). The normal diagnosis unit 12 includes circuits 121, 122, 123, and 124.

[0036] (Process 2A) The circuit 121 of the normal diagnosis unit 12 determines whether the emergency enrichment line flow rate has risen above a threshold value, and if it is above the threshold value, determines whether the state of being above the threshold value continues for a predetermined time or more. The emergency enrichment line flow rate rises when the process of injecting high-concentration boric acid water into the reactor core is carried out, and this increase in flow rate means that boric acid is intentionally added by the operator. That is, the circuit 121 of the normal diagnosis unit 12 detects, by this Process 2A, that the reactivity of the nuclear reactor 1 is being intentionally changed by the operator. In such a situation, even if the control rod control deviation signal is not in a state where the control rod 3 operates, the detected value of the neutron flux changes. The normal diagnosis unit 12 issues a signal 121a when the state of the emergency enrichment line flow rate being above the threshold value continues for a predetermined time or more, and does not issue a signal 121a otherwise.

[0037] (Process 2B) When the automatic replenishment mode is not set and the driver arbitrarily performs a concentration or dilution operation, the circuit 122 of the normal diagnosis unit 12 issues a signal 122a. This is a signal indicating that since the driver is consciously performing a concentration or dilution operation, even if a change occurs in the output value of the neutron flux, it is not abnormal.

[0038] (Process 2C) When the circuit 123 of the normal diagnosis unit 12 acquires either a control rod manual extraction signal or a control rod manual insertion signal, it issues a signal 123a. This indicates that the operation of the control rod 3 is not under automatic control but is manually performed by the driver. In such a case, this is a signal indicating that even if a change occurs in the output value of the neutron flux, it is not abnormal.

[0039] (Process 2D) When the circuit 124 of the normal diagnosis unit 12 receives any one of the signal 121a output as a result of Process 2A, the signal 122a output as a result of Process 2B, and the signal 123a output as a result of Process 2C, it outputs an interlock block signal 125. That is, the circuit 124 outputs the interlock block signal 125 when a manual operation (concentration, dilution, manual operation of the control rod 3) is being performed. Next, while these manual operations are being performed and the result appears as a change in the neutron flux, the circuit 124 continuously outputs the interlock block signal 125. As will be described later (Process 2E), while the change rate of the neutron flux exceeds a predetermined set value, the interlock block signal 125 is continuously output.

[0040] (Process 2E) In addition, the circuit 124 of the normal diagnosis unit 12 obtains the second largest change rate 124a of the neutron flux, and outputs an interlock block signal 125 from when this change rate 124a starts to fluctuate until it stabilizes. More specifically, the normal diagnosis unit 12 outputs an interlock block signal 125 when the change rate of the output value of the neutron flux falls within the range of the change rate caused by the manual operation until a predetermined time has elapsed after the manual operation is performed, and stops the output of the interlock block signal 125 when the change rate falls below a predetermined set value. The period during which the interlock block signal 125 is output is the period during which the manual control affects the output value of the neutron flux. During this period, even if the control rod control signal does not cause the control rod 3 to operate and there is a change in the output value of the neutron flux, the change is due to the manual control. That is, when a manual operation related to enrichment, dilution, and control rod movement is performed by the operator, while the operation affects the output of the neutron flux, the change in the output of the neutron flux is due to the influence of the manual control, and a normal diagnosis signal indicating that the change is normal is output as the interlock block signal 125 to the control rod drive device 30.

[0041] <Abnormality mitigation logic> The abnormality mitigation logic 320 is executed by the reset switch 211 (input unit 21) of the control panel 20 and its output circuit (output unit 22), the stop unit 32, and the control unit 33 of the control rod drive device 30. The stop unit 32 has a circuit 321, and the control unit 33 has circuits 331, 332, 333, 334, 335, 336, 337.

[0042] The circuit 321 of the stop unit 32 acquires the interlock signal and the interlock block signal through the signal acquisition unit 31. Since these signals are not always transmitted, regarding the acquisition status of these two signals, there are four states: (a) when acquiring both the interlock signal and the interlock block signal, (b) when acquiring only the interlock signal, (c) when acquiring only the interlock block signal, and (d) when acquiring neither the interlock signal nor the interlock block signal. The circuit 321 does not output the signal 322 only when (b) only the interlock signal is acquired, and outputs the signal 322 in cases (a), (c), and (d). That is, when only (b) the interlock signal is acquired, the signal 322 is not supplied to the subsequent stage, and in cases (a), (c), and (d), the signal 322 is supplied to the subsequent stage.

[0043] When the control rod stop switch 212 is pressed, the control rod stop switch 212 outputs a stop signal 212a. The stop signal 212a is output to the circuit 331. The circuit 331 does not output the signal 331a while acquiring the stop signal 212a, and outputs the signal 331a when not acquiring the stop signal 212a.

[0044] When the reset switch 211 is pressed, a reset signal 211a is output. The reset signal 211a is output to the circuit 321 and the circuit 331. The reset signal means resetting the interlock signal 139 or the stop signal 212a. For example, while the circuit 321 is acquiring the reset signal 211a, even in the case of (b) above, it outputs the signal 322. (In cases (a), (c), and (d) above, the circuit 321 outputs the signal 322 even when acquiring the reset signal 211a.) Also, while acquiring the reset signal 211a, even if acquiring the stop signal 212a, the circuit 331 outputs the signal 331a.

[0045] (1) When the control rod 3 is under automatic control in cases (a), (c), and (d) above (without reset signal and stop signal) When the reset switch 211 is not pressed and in cases other than (b) where only the interlock signal is acquired (cases (a), (c), and (d) above) (signal 322 is output), when the control rod stop switch 212 is not pressed (signal 331a is output), and when the signal acquisition unit 31 acquires the control rod automatic insertion signal 331b, the AND condition is satisfied in the AND circuit 332, and the control unit 33 outputs a control rod insertion command to the control rod 3 via the OR circuit 334. Similarly, under the same conditions, when the signal acquisition unit 31 acquires the control rod automatic withdrawal signal 331d, the AND condition is satisfied in the AND circuit 335, and the control unit 33 outputs a control rod withdrawal command to the control rod 3 via the OR circuit 337. In these cases, the control rod 3 operates based on the control rod insertion command or the control rod withdrawal command.

[0046] (2) When the control rod 3 automatically controls and only acquires the (b) interlock signal (without reset signal and stop signal) When the control rod stop switch 212 is not pressed (signal 331a is output), the reset switch 211 is not pressed, and the signal acquisition unit 31 acquires only the control rod automatic insertion signal 331b and the (b) interlock signal (signal 322 is not output), the signal 322 is not supplied to the subsequent stage of the circuit 321. Therefore, the AND condition is not satisfied in the AND circuit 332, and no control rod insertion command is output, so the control rod 3 stops. Also, under the same conditions, when the signal acquisition unit 31 acquires the control rod automatic withdrawal signal 331d instead of the control rod automatic insertion signal 331b, the signal 322 is not supplied to the subsequent stage of the circuit 321. Therefore, the AND condition is not satisfied in the AND circuit 335, and no control rod withdrawal command is output. Thus, the control rod 3 stops. At this time, when the reset switch 211 is pressed, the reset signal 211a is self-held in the circuit 321, and the interlock is invalidated. That is, during the automatic control of the control rod 3, even if the interlock signal 139 is output due to abnormal detection, if the operator confirms that there is no abnormality in the operation of the control rod 3 and presses the reset switch 211, the interlock signal 139 is reset (invalidated), and the control rod 3 continues to operate. This reset is released when the input of the interlock signal 139 stops.

[0047] (3) When the control rod 3 is under manual control In addition, when the signal acquisition unit 31 acquires the control rod manual insertion signal 331c, since the signal 332 is not input to the AND circuit 333, if the control rod stop switch 212 is not pressed, regardless of the presence or absence of the interlock signal or the interlock block signal (regardless of the presence or absence of the signal 322 output by the circuit 321), the AND condition is satisfied in the AND circuit 333, and the control unit 33 outputs a control rod insertion command to the control rod 3 through the OR circuit 334. Similarly, when the signal acquisition unit 31 acquires the control rod manual extraction signal 331e, if the control rod stop switch 212 is not pressed, the AND condition is satisfied in the AND circuit 336, and the control unit 33 outputs a control rod extraction command to the control rod 3 through the OR circuit 337.

[0048] (4) When the control rod 3 is under automatic control with a reset signal and no stop signal When the reset switch 211 is pressed and the control rod stop switch 212 is not pressed, in any of the above cases (a) to (d), the circuit 321 outputs the signal 322 and the circuit 331 outputs the signal 331a. Therefore, when the control rod automatic insertion signal 331b is acquired, a control rod insertion command is output, and when the control rod automatic extraction signal 331d is acquired, a control rod extraction command is output.

[0049] (5) When the control rod 3 is under automatic or manual control without pressing the reset switch and with the control rod stop switch pressed When the control rod stop switch 212 is pressed without pressing the reset switch 211, the circuit 331 does not output the signal 331a. In this case, even if the control rod automatic insertion signal 331b is obtained, the AND condition is not satisfied in the AND circuit 332, and even if the control rod manual insertion signal 331c is obtained, the AND condition is not satisfied in the AND circuit 333. Similarly, even if the control rod automatic withdrawal signal 331d is obtained, the AND condition is not satisfied in the AND circuit 335, and even if the control rod manual withdrawal signal 331e is obtained, the AND condition is not satisfied in the AND circuit 336. When the control rod stop switch 212 is pressed in this way, regardless of whether it is automatic or manual, no control rod withdrawal command or control rod insertion command is output, and the control rod 3 stops.

[0050] (6) The control rod 3 is under automatic control or manual control with the reset switch pressed and the control rod stop switch pressed The reset switch 211 is effective not only for resetting the interlock signal 139, that is, invalidating the interlock signal 139, but also for resetting the stop signal 212a output by pressing the control rod stop switch 212. When the control rod stop switch 212 is pressed and the reset switch 211 is then pressed, the stop signal 212a is invalidated, and the circuit 331 outputs the signal 331a. Then, in the AND circuits 332 to 336, it is determined whether the AND condition is satisfied based on the acquisition states of the other signals described above, and based on the determination result, a control rod withdrawal command or a control rod insertion command is output. For example, assume that the control rod automatic insertion signal 331b is issued and the operator accidentally presses the control rod stop switch 212. Then, the control rod 3 stops without the signal 331a being supplied to the subsequent stage of the circuit 331. After that, if the operator notices the error and presses the reset switch 211, the signal 331a will be supplied to the subsequent stage of the circuit 331 while the reset switch 211 is being pressed. In the AND circuit 332, the AND condition is satisfied, a control rod insertion command is output to the control rod 3, and the control rod 3 performs an insertion operation.

[0051] <Determination flow> Next, with reference to FIG. 3, the operation determination process of the control rod 3 will be described. The abnormality detection unit 13 performs abnormality detection of the control rod 3 based on whether the state of the control signal (control rod control deviation signal) is inconsistent with respect to the change in the related parameter (output value of the neutron flux) (step S1). The normal diagnosis unit 12 performs a normal diagnosis of the change in the related parameter based on whether an intended operation that causes the change has been performed with respect to the change in the related parameter (step S2). The order of step S1 and step S2 may be reversed. Next, the stop unit 32 determines whether an abnormality is detected in step S1 and a normal diagnosis is made in step S2 (step S3). If an abnormality is detected in step S1 and no normal diagnosis is made in step S2 (step S3; Yes), the stop unit 32 determines whether a reset signal for the interlock signal has been input (step S4). If the reset signal has not been input (step S4; No), the stop unit 32 determines to stop the operation of the control rod 3 (step S5). If the reset signal has been input (step S4; Yes), the stop unit 32 determines not to stop the operation of the control rod 3 (step S8).

[0052] Also, if no abnormality is detected in step S1 or a normal diagnosis is made in step S2, the determination in step S3 is No. In this case (step S3; No), the control unit 33 determines whether a stop signal has been input (step S6). If the stop signal has not been input (step S6; No), the control unit 33 determines not to stop the operation of the control rod 3 (step S8).

[0053] If the stop signal has been input (step S6; Yes), the stop unit 32 determines whether a reset signal for the stop signal has been input (step S7). If the reset signal has not been input (step S7; No), the stop unit 32 determines to stop the operation of the control rod 3 (step S5). If the reset signal has been input (step S7; Yes), the stop unit 32 determines not to stop the operation of the control rod 3 (step S8).

[0054] As described above, according to the present embodiment, based on the change rate of the output value of the neutron flux and the deviation signal for control rod control, continuous malfunction, control rod slip, and dropping during the automatic control of the control rod 3 can be quickly detected, and the operation of the control rod 3 can be automatically stopped. Thereby, the abnormal operation of the control rod 3 can be determined without relying on the judgment of the operator, and by performing relaxation control promptly, a trip of the nuclear power plant 100 can be prevented. Further, when there is a manual operation by the operator, by blocking the interlock signal, an incorrect stop of the operation of the control rod 3 can be prevented. Further, even when the change rate of the output value of the neutron flux is small and an abnormality cannot be detected by the abnormality detection logic, the operator can stop the operation of the control rod 3 by operating the control rod stop switch 212. Further, even when an interlock signal is output, if the operator can confirm that no abnormality has occurred, the operation of the control rod 3 can be continued by operating the reset switch 211.

[0055] FIG. 4 is a diagram showing an example of the hardware configuration of the control system 40 of the embodiment. The computer 900 includes a CPU 901, a main storage device 902, an auxiliary storage device 903, an input / output interface 904, and a communication interface 905. The above-described nuclear reactor control system instrument rack 10, control panel 20, and control rod drive device 30 are mounted on the computer 900. And each function described above is stored in the auxiliary storage device 903 in the form of a program. The CPU 901 reads the program from the auxiliary storage device 903, expands it in the main storage device 902, and executes the above processing according to the program. Further, the CPU 901 secures a storage area in the main storage device 902 according to the program. Further, the CPU 901 secures a storage area in the auxiliary storage device 903 for storing data being processed according to the program.

[0056] A program for realizing all or part of the functions of the nuclear reactor control system instrument rack 10, the control panel 20, and the control rod drive device 30 may be recorded on a computer-readable recording medium, and the program recorded on this recording medium may be read into a computer system and executed to perform the processing by each functional unit. Here, the "computer system" shall include hardware such as an OS and peripheral devices. Also, the "computer system" shall include a homepage providing environment (or display environment) if the WWW system is used. Further, the "computer-readable recording medium" refers to a portable medium such as a CD, DVD, USB, etc., and a storage device such as a hard disk built into a computer system. Also, when this program is distributed to the computer 900 via a communication line, the computer 900 that has received the distribution may expand the program in the main storage device 902 and execute the above processing. Also, the above program may be for realizing a part of the functions described above, and may further be capable of being realized in combination with a program already recorded in the computer system for the functions described above.

[0057] As described above, several embodiments according to the present disclosure have been described, but all of these embodiments are presented as examples and are not intended to limit the scope of the invention. These embodiments can be implemented in various other forms, and various omissions, replacements, and changes can be made without departing from the gist of the invention. These embodiments and their modifications are included in the scope and gist of the invention, and are also included in the invention described in the claims and the equivalent scope thereof.

[0058] <Supplementary Note> The interlock system, interlock method, and program described in each embodiment are understood as follows, for example.

[0059] (1) The interlock system (control system 40) according to the first aspect includes an abnormality detection unit 13 that detects an abnormality when the state of a control signal (control rod control deviation signal) for controlling the device is inconsistent with a change in a related parameter (output value of neutron flux) associated with the operation of the device (control rod 3), a normal diagnosis unit 12 that diagnoses normality with respect to a change in the related parameter associated with an intended operation (manual operation of the control rod 3 or concentration / dilution of primary coolant), and a stop unit 32 that stops the operation of the device when an abnormality is detected by the abnormality detection unit and no normal diagnosis is made by the normal diagnosis unit. Accordingly, it is possible to determine an abnormal operation of the device from the related parameters without depending on the judgment of the operator and mitigate the abnormality.

[0060] (2) The interlock system according to the second aspect is the interlock system of (1), wherein the abnormality detection unit detects an abnormality of the device when the change rate of the related parameter is outside a threshold range with respect to the control signal for which the change rate of the related parameter should be within the threshold range. Accordingly, it is possible to detect and detect an inconsistency in the state of the control signal with respect to a change in the related parameter associated with the operation of the device.

[0061] (3) The interlock system according to the third aspect is the interlock system of (1) to (2), wherein the abnormality detection unit calculates the change rate of the related parameter by incomplete differentiation. In complete differentiation, the signal disappears and the change rate of the related parameter cannot be calculated, but the change rate can be calculated by leaving the signal through incomplete differentiation.

[0062] (4) The interlock system according to the fourth aspect is the interlock system of (1) to (3), wherein in the normal diagnosis unit, when the change rate of the related parameter falls within the range of the change rate caused by the intended operation until a predetermined time has elapsed after the intended operation is performed, it is diagnosed as normal, and the normal diagnosis is stopped when the change rate falls below a preset set value. As a result, for the period during which manual operation is performed and its influence affects the relevant parameters, it can be diagnosed as normal, and interlock can be prevented.

[0063] (5) The interlock system according to the fifth aspect is the interlock system of (1) to (4), wherein the stop unit outputs a signal for stopping the device based on an operator's instruction regardless of the detection of an abnormality by the abnormality detection unit and the diagnosis of normality by the normality diagnosis unit. The operator can stop the operation of the control rod 3 by operating the control rod stop switch 212. As a result, for example, even when the change in the neutron flux output value is so small that no interlock signal is output, the operator can stop the operation of the control rod 3.

[0064] (6) The interlock system according to the sixth aspect is the interlock system of (1) to (5), wherein the stop unit cancels the stop of the operation of the device based on an operator's instruction when an abnormality is detected by the abnormality detection unit and no normality diagnosis is made by the normality diagnosis unit. The operator can reset the interlock signal by operating the reset switch 211. As a result, for example, even when an interlock signal is output, if it can be confirmed that it is normal, the operation of the control rod 3 can be continued.

[0065] (7) The interlock system according to the seventh aspect is the interlock system of (1) to (6), wherein the device is a control rod of a nuclear reactor, the relevant parameter is the change rate of the neutron flux output value, and the control signal is a deviation signal for controlling the control rod. As a result, it becomes possible to detect an abnormal operation of the control rod 3 and perform mitigation control.

[0066] (8) The interlock system according to the eighth aspect is the interlock system of (1) to (7). When the abnormality detection unit detects an abnormality, it outputs an interlock signal. When the normal diagnosis unit diagnoses normality, it outputs an interlock block signal. The stop unit receives the interlock signal and stops the operation of the device when it does not receive the interlock block signal. Thereby, it becomes possible to detect an abnormal operation of the control rod 3 and perform relaxation control.

[0067] (9) The interlock method according to the ninth aspect includes a step of detecting an abnormality when the state of a control signal for controlling the device is inconsistent with a change in a related parameter associated with the operation of the device, a step of diagnosing normality with respect to a change in the related parameter associated with an intended operation, and a step of stopping the operation of the device when the abnormality is detected in the step of detecting the abnormality and no normal diagnosis is made in the step of diagnosing normality.

[0068] (10) The program according to the tenth aspect causes a computer to execute a step of detecting an abnormality when the state of a control signal for controlling the device is inconsistent with a change in a related parameter associated with the operation of the device, a step of diagnosing normality with respect to a change in the related parameter associated with an intended operation, and a step of stopping the operation of the device when the abnormality is detected in the step of detecting the abnormality and no normal diagnosis is made in the step of diagnosing normality.

Explanation of Reference Numerals

[0069] 1... Reactor, 2... Fuel cluster, 3... Control rod, 4... Primary cooling loop, 5... Reactor equipment, 6... Detector, 10... Reactor control system instrument rack, 11... Signal acquisition unit, 12... Normal diagnosis unit, 13... Abnormality detection unit, 20... Control panel, 21... Input unit, 22... Output unit, 30... Control rod drive device, 31... Signal acquisition unit, 32... Stop unit, 33... Control unit, 40... Control system, 100... Nuclear power plant, 900... Computer, 901... CPU, 902... Main memory device, 903... Auxiliary memory device, 904... Input / output interface, 905... Communication interface

Claims

1. an anomaly detection unit that detects an anomaly when a state of a control signal for controlling the device is inconsistent with a change in a related parameter accompanying an operation of the device; a normality diagnosis unit that diagnoses a change in the related parameter associated with an intended operation as normal; a stop unit that stops operation of the device when the abnormality detection unit detects an abnormality and the normality diagnosis unit does not diagnose normality; having When the abnormality detection unit detects an abnormality, it outputs an interlock signal, When the normality diagnosis unit diagnoses that the device is normal, the normality diagnosis unit outputs an interlock block signal, The stop unit receives the interlock signal and stops the operation of the device when the interlock block signal is not received. Interlock system.

2. 2. The interlock system according to claim 1, wherein the abnormality detection unit detects an abnormality in the device when a rate of change of the related parameter of the control signal, which should be within a threshold range, falls outside the threshold range.

3. The anomaly detection unit determines a rate of change of the related parameter by imperfect differentiation. The interlock system according to claim 1 or 2.

4. the normality diagnosis unit diagnoses the device as normal when a rate of change of the related parameter falls within a range of the rate of change caused by the intended operation until a predetermined time has elapsed since the intended operation was performed; The interlock system according to any one of claims 1 to 3.

5. The stop unit outputs a signal to stop the equipment based on an instruction from an operator, regardless of whether the abnormality is detected by the abnormality detection unit or the normality is diagnosed by the normality diagnosis unit. An interlock system according to any one of claims 1 to 4.

6. The stop unit cancels the stop of the operation of the equipment based on an instruction from an operator when the abnormality detection unit detects an abnormality and the normality diagnosis unit does not diagnose normality. An interlock system according to any one of claims 1 to 5.

7. The device is a control rod of a nuclear reactor, the relevant parameter is a neutron flux output value, and the control signal is a deviation signal for control rod control. An interlock system according to any one of claims 1 to 6.

8. Detecting an abnormality when a state of a control signal for controlling the device is inconsistent with a change in a related parameter accompanying an operation of the device; A step of diagnosing a change in the related parameter associated with an intended operation as normal; a step of stopping an operation of the device when an abnormality is detected in the step of detecting an abnormality and a diagnosis of normality is not made in the step of diagnosing normality; having In the step of detecting an abnormality, an interlock signal is output when an abnormality is detected, In the step of diagnosing the normal state, when the normal state is diagnosed, an interlock block signal is outputted, In the step of stopping, the operation of the device is stopped when the interlock signal is received and the interlock block signal is not received. Interlock method.

9. On the computer, Detecting an abnormality when a state of a control signal for controlling the device is inconsistent with a change in a related parameter accompanying an operation of the device; A step of diagnosing a change in the related parameter associated with an intended operation as normal; a step of stopping an operation of the device when an abnormality is detected in the step of detecting an abnormality and a diagnosis of normality is not made in the step of diagnosing normality; having In the step of detecting an abnormality, an interlock signal is output when an abnormality is detected, In the step of diagnosing the normal state, when the normal state is diagnosed, an interlock block signal is outputted, In the step of stopping, a process of receiving the interlock signal and stopping the operation of the device when the interlock block signal is not received; A program that executes the following.

Images