Nuclear reactor protection system using heterogeneous processors in master-slave relationship

Abstract

The present invention relates to a nuclear reactor protection system. According to one embodiment of the present invention, a nuclear reactor protection system using heterogeneous processors comprises: M channels that equally receive N different input signals, where M and N are integers greater than 1; and a pair of protection logic processors arranged on each of the M channels, which receive the N different input signals, perform protection logic, and generate a trip signal, wherein the pair of protection logic processors is configured within a single board in each of the M channels.

Description

Reactor protection system using heterogeneous processors in a master-slave relationship

[0001] The present invention relates to a nuclear reactor protection system, and more particularly, to a nuclear reactor protection system using heterogeneous processors in a master-slave relationship.

[0002] Figure 1 is a drawing for explaining the main configuration of a typical nuclear power plant (100). As illustrated in Figure 1, the primary system of the nuclear power plant (100) includes a reactor (130), a pressurizer (140), a coolant pump (150), and a steam generator (160), and the secondary system may include a turbine (170), a generator (180), a condenser (190), and a feedwater pump (191).

[0003] The reactor (130) generates heat of about 1000 degrees Celsius when the nuclear fuel (120) undergoes nuclear fission, thereby raising the temperature of the coolant to about 300 degrees Celsius. In the pressurizer (140), the coolant water is kept from boiling even at temperatures exceeding 100 degrees Celsius, and in the case of a light water reactor, the coolant is 160 kg / cm 2 Apply pressure of 110 kg / cm for the coolant in the case of heavy water reactors. 2 Apply pressure to it.

[0004] The coolant pump (150) performs the function of circulating the primary system coolant that has passed through the steam generator (160) from the reactor (130) back into the reactor (130). The steam generator (160) performs the boiler function of a thermal power plant, and transfers heat to the feedwater that comes in through the secondary system condenser (190) and feedwater pump (191) by the coolant of the primary system that has become hot, thereby converting the feedwater into steam. The steam generated in this way rotates the turbine (170), and accordingly, the generator (180) converts mechanical energy into electrical energy.

[0005] In order to monitor the health of each system while operating a nuclear power plant like this, various types of sensors are installed in the reactor system and the detection signals from the sensors are monitored to determine the status of the nuclear power plant.

[0006] During nuclear power plant operation, if a system malfunction that threatens reactor safety or a cooling malfunction within the nuclear steam supply system occurs, the reactor protection system detects these abnormalities and activates the reactor shutdown function by dropping the control rods. It also activates the engineering safety equipment operation system to cool the reactor. By performing these reactor protection functions, even if a nuclear power plant accident occurs, the plant remains safe and prevents the leakage of radiation and radioactive materials.

[0007] Therefore, the reactor protection system is a system that plays the most important role in the safety and reliability of nuclear power plants. In order to be applied to the power plant site, it must be a system with high reliability and high precision. In addition, when the reactor must be shut down, the reactor protection system must be able to perform the function of shutting down the reactor in any environment inside or outside the reactor protection system.

[0008] To this end, the reactor protection system is generally composed of multiple channels that perform the same function. In addition, the reactor protection system is composed of a signal input unit that acquires detection signals from sensors that measure various process variables and transmits them to multiple channels, a comparison logic unit that compares the acquired detection signals for each process variable with pre-stored set values, a simultaneous logic unit that generates a trip signal by combining the outputs of the comparison logic units of multiple channels when the sensor detection signals for each process variable in the comparison logic unit exceed the set value, and a stop initiation circuit that operates the reactor stop circuit or the engineering safety equipment operation circuit according to the stop signal output from the simultaneous logic unit.

[0009] Figure 2 is a functional block diagram briefly explaining the concept of a digital reactor protection system having one type of processor on a single board in the same channel.

[0010] As illustrated in Fig. 2, the digital reactor protection system (200) is composed of four channels (Channel A, B, C, D) (211, 212, 213, 214) with a redundancy structure. The number of channels may be four or more, but a four-channel redundancy structure is preferable in consideration of redundancy efficiency and circuit complexity. The remote shutdown room operator module and the main control room operator module (not illustrated) are connected to the four channels (211 to 214) to monitor and control the operating status of the reactor protection system.

[0011] In addition, the digital reactor protection system (200) is composed of a control device and a man-machine interface (MMI: Man-Machine Interface) related to testing / diagnosis, and an engineering workstation (EWS: Engineering Work Station) for initially loading the settings. The EWS is used to input the settings and related constants for each processor or hardware within the reactor protection system. The external system is composed of Tr. CPC, reactor trip device (RTSG), and engineering safety facility-component control system (ESF-CCS). Here, Tr can be expressed as PI (Process Instrument).

[0012] The above four channels (211 to 214) are completely independently driven from the sensor signal input terminal to the output terminal of each channel on the same board, and transmit the trip signals (240) for each process variable of the reactor systems output from the comparative logic processors (231 to 234) of each channel to the simultaneous logic processors (251 to 254) of the other channels through a communication method by the Safety Data Link (SDL) to exchange information between each channel. The sensor detection signals (220) for each process variable measured by the sensor include the pressure, flow rate, and water content of each system, the factor values ​​inside the reactor calculated by the Core Protection Calculator (CPC), and the neutron flux output values ​​measured by the Ex-core Neutron Flux Monitoring System (ENFMS), and these values ​​are input independently for each channel.

[0013] Sensor detection signals (220) input to the input terminals of each channel (211 to 214) are transmitted to comparison logic processors (231 to 234) and compared with trip setpoints stored within the comparison logic processors (231 to 234). When a specific signal value exceeds the corresponding trip setpoint, the comparison logic processors (231 to 234) generate trip signals (240) for the corresponding variable. The generated trip signals (240) are transmitted to the respective simultaneous logic processors (251 to 254) in the four channels (211 to 214) via a safety data link.

[0014] The simultaneous logic processors (251 to 254) perform a 2 / 4 logic combination on the trip signals (240) for each process variable output from the comparison logic processors (231 to 234) in the 4 channels (211 to 214) and, if the logic is satisfied, that is, if the corresponding logic values ​​from 2 out of the 4 channels are the same (Voting), generate a final trip signal (not shown) and transmit it to the initiation circuit (not shown). When the initiation circuit receives the final trip signal (not shown), it cuts off the control rod power through the reactor trip switch gear (RTSG) to stop the reactor due to the control rod dropping, and operates the engineered safety features-device control system (ESF-CCS) to cool the reactor.

[0015] As shown in FIG. 2, for the diversity of the reactor protection system (200), channel A (211) may be configured with a type A comparison logic processor (231) and a type A simultaneous logic processor (251) on a single board, channel B (211) may be configured with a type B comparison logic processor (232) and a type A simultaneous logic processor (252) on a single board, channel C (213) may be configured with a type A comparison logic processor (233) and a type B simultaneous logic processor (253) on a single board, and channel D (314) may be configured with a type B comparison logic processor (234) and a type B simultaneous logic processor (254) on a single board.

[0016] As shown in Fig. 2, the type A comparison logic processors (231, 233) of channel A (211) and channel C (213) equally receive all sensor detection signals (220) from the sensor signal input terminal and perform comparison logic.

[0017] In this case, if the type A comparison logic processors (231, 233) of channel A (211) and channel C (213) fail, channel A (211) and channel C (213) will not operate. Of course, channel B (212) and channel D (214) composed of type B processors receive the same sensor detection signals (220) and perform protection logic, but since two channels are used, the range of protection logic is limited. That is, there is a problem that the reliability of the logic is reduced because the 2oo4 logic is changed to 2oo2 or 2oo3 logic.

[0018] [Prior Art Literature]

[0019] [Patent Document]

[0020] (Patent Document 1) Korean Patent Publication No. 10-2016-0052861 (Reactor protection system including heterogeneous control devices, Korea Atomic Energy Research Institute)

[0021] (Patent Document 2) Korean Patent Publication No. 10-0848881 (Digital Reactor Protection System, Samchang Enterprise)

[0022] An object of the present invention to solve the above-mentioned problems is to provide a reactor protection system with greatly improved diversity against common cause failure modes that may occur in a reactor protection system.

[0023] However, the problem to be solved by the present invention is not limited to this, and may be expanded in various ways without departing from the spirit and scope of the present invention.

[0024] According to one embodiment of the present invention, a nuclear reactor protection system using heterogeneous processors comprises M channels that equally receive input signals of N different items, where M and N are integers greater than 1, and a pair of protection logic processors arranged on each of the M channels, which receive input signals of the N different items, perform protection logic, and generate a trip signal, wherein the pair of protection logic processors can be configured within a single board in each of the M channels.

[0025] The input signals of the N different items may include at least one of pressure, temperature, flow rate and radioactivity measured in the reactor.

[0026] The above protection logic processor can perform comparison logic (Bistable Processor) and coincidence logic (Coincedence Processor).

[0027] Each of the pair of protection logic processors implemented within a single board of each of the M channels can equally receive input signals of the N different items.

[0028] Each of the pair of protection logic processors implemented within a single board of each of the above M channels may be implemented heterogeneously.

[0029] The pair of protection logic processors implemented within a single board of each of the above M channels may be composed of different heterogeneous processors.

[0030] Each of the above different heterogeneous processors can be configured as a master or a slave.

[0031] The above different heterogeneous processors are configured to cross-monitor each other, but the processor designated as the master may have control priority.

[0032] The above M channels can be composed of boards of the same type and of different types.

[0033] The above same type of board can have the same type of protection logic processor operate as master and slave.

[0034] In the above cross-monitoring, if the master is incapable, the slave has control priority and performs the protection logic of the master, and transmits a selection signal to the output path so that the output of the slave becomes a trip signal.

[0035] The disclosed technology may have the following effects. However, this does not mean that a particular embodiment must include all or only the following effects, and therefore the scope of the disclosed technology should not be construed as being limited thereby.

[0036] First, by configuring the controllers within a single board that constitute the channel of the reactor protection system as heterogeneous, even if a common cause failure occurs in a controller of one type, the controllers of other types can perform safety functions, thereby improving the safety of the channel.

[0037] Second, the controllers in one channel are configured as master-slave, so that the channel can maintain normal control functions even if one of them fails.

[0038] Third, heterogeneous controllers are configured as master-slave on one channel, so that even if a common cause failure occurs in one controller on one channel, normal control functions can be performed on the same channel.

[0039] Fourth, by combining different types of controllers with different master-slave assignments for each model, the immunity of the reactor protection system against common cause failures can be greatly improved.

[0040] Figure 1 is a drawing to explain the main components of a typical nuclear power plant.

[0041] Figure 2 is a functional diagram briefly explaining a method for securing diversity in an existing digital reactor protection system.

[0042] FIG. 3 is a functional configuration diagram briefly explaining the channel configuration of a digital reactor protection system based on heterogeneous processors according to one embodiment of the present invention.

[0043] FIG. 4 is a functional diagram briefly explaining a method for securing diversity within a channel of a digital reactor protection system according to another embodiment of the present invention.

[0044] FIG. 5 is a functional diagram briefly explaining a method for securing diversity in a digital reactor protection system according to another embodiment of the present invention.

[0045] The present invention is capable of various modifications and embodiments. Specific embodiments are illustrated in the drawings and described in detail in the detailed description. However, this is not intended to limit the present invention to specific embodiments, and it is to be understood that all modifications, equivalents, and alternatives included within the technical spirit and scope of the present invention are included. In describing the present invention, if a detailed description of a related known technology is judged to obscure the gist of the present invention, the detailed description will be omitted.

[0046] Terms like "first" and "second" may be used to describe various components, but these terms do not limit the components themselves. These terms are used solely to distinguish one component from another.

[0047] The terminology used in this invention is solely for the purpose of describing specific embodiments and is not intended to limit the invention. The terminology used in this invention has been selected from widely used, current terms, taking into account the functions of the invention. However, this may vary depending on the intentions of those skilled in the art, precedents, or the emergence of new technologies. Furthermore, in certain cases, the applicant may arbitrarily select terms, in which case their meanings will be described in detail in the relevant description of the invention. Therefore, the terms used in this invention should not be defined simply as names of terms, but rather based on their meanings and the overall content of the invention.

[0048] Singular expressions include plural expressions unless the context clearly dictates otherwise. In the present invention, terms such as "comprise" or "have" are intended to indicate the presence of a feature, number, step, operation, component, part, or combination thereof described in the specification, but should be understood not to preclude the possibility of the presence or addition of one or more other features, numbers, steps, operations, components, parts, or combinations thereof.

[0049] Hereinafter, embodiments of the present invention will be described in detail with reference to the attached drawings. In describing with reference to the attached drawings, identical or corresponding components are assigned the same drawing numbers, and redundant descriptions thereof will be omitted.

[0050] FIG. 3 is a functional configuration diagram briefly explaining the channel configuration of a digital reactor protection system based on heterogeneous processors according to one embodiment of the present invention.

[0051] As illustrated in FIG. 3, a channel board forming part of the reactor protection system of the present invention has a heterogeneous-based protection logic processor (330, 331) (including a comparison logic and a simultaneous logic processor).

[0052] That is, a first type-based protection logic processor (comparison and simultaneous logic processor) and a second type-based protection logic processor (comparison and simultaneous logic processor) are arranged in channel A (310) and channel B (311). The first type-based and second type-based protection logic processors in channel A (310) and channel B (311) receive sensor detection signals (P, T, F, N) (300) for each process variable through input paths (320, 321).

[0053] The input path (320) of channel A (310) can select some of the sensor detection signals (P, T, F, N) (300) for each process variable and provide them to the first type-based protection logic processor (330), and can select and provide the remaining signals other than the sensor detection signals (300) for each process variable provided to the first type-based protection logic processor (330) to the second type-based protection logic processor (331). That is, the input path (320) of channel A (310) can provide the sensor detection signals pressure (P) and temperature (T) to the first type-based protection logic processor (330), and can provide the flow rate (F) and radiation (N) excluding the sensor detection signals P and T to the second type-based protection logic processor (331).

[0054] On the other hand, the input path (321) of channel B (311) can operate in a manner of providing sensor detection signals pressure (P) and temperature (T) to the second type-based protection logic processor (332) within channel B (311), and providing flow rate (F) and radiation (N) excluding the sensor detection signals P and T to the first type-based protection logic processor (331).

[0055] In addition, each of the output paths (340, 341) of channel A (310) and channel B (311) can bypass or combine the outputs of each of the protection logic processors (330, 331, 332, 333) in a predetermined combination according to the operation of the input paths (320, 311) of each channel to output the final trip signal (450, 451). For example, the first type and the second type can be configured with different types of devices such as FLASH, SRAM, etc.

[0056] FIG. 4 is a functional diagram briefly explaining a method for securing diversity within a channel of a digital reactor protection system according to another embodiment of the present invention.

[0057] As illustrated in Fig. 4, a channel board forming part of the nuclear reactor protection system of the present invention has a heterogeneous-based protection logic processor (430, 431). Here, the protection logic processor may include a comparison logic processor and a simultaneous logic processor.

[0058] In one embodiment, a first type-based protection logic processor and a second type-based protection logic processor may be co-located in Channel A (410) and Channel B (411). Here, the first type-based protection logic processor may be configured as FLASH, and the second type-based protection logic processor may be configured as SRAM. For example, the first type may be FLASH, and the second type may be SRAM, or vice versa.

[0059] As illustrated in FIG. 4, the first type-based protection logic processor (430, 433) and the second type-based protection logic processor (431, 432) within channel A (410) and channel B (411) receive sensor detection signals (P, T, F, N) (400) for each process variable through input paths (420, 421).

[0060] In one embodiment, the input path (420) of channel A (410) can select some of the sensor detection signals (P, T, F, N) (400) for each process variable and provide them to the first type-based protection logic processor (430), and can select and provide the remaining signals other than the sensor detection signals (400) for each process variable provided to the first type-based protection logic processor (430) to the second type-based protection logic processor (431).

[0061] That is, the input path (420) of channel A (410) can provide the sensor detection signals pressure (P) and temperature (T) to the first type-based protection logic processor (430), and provide the flow rate (F) and radiation (N) excluding the sensor detection signals P and T to the second type-based protection logic processor (431). On the other hand, the input path (421) of channel B (411) can operate in a manner of providing the sensor detection signals pressure (P) and temperature (T) to the second type-based protection logic processor (432) within channel B (411), and providing the flow rate (F) and radiation (N) excluding the sensor detection signals P and T to the first type-based protection logic processor (431).

[0062] In addition, each of the output paths (440, 441) of channel A (410) and channel B (411) can bypass or combine the outputs of each of the protection logic processors (430, 431, 432, 433) in a predetermined combination according to the operation of the input paths (320, 311) of each channel to output the final trip signal (450, 451).

[0063] As illustrated in FIG. 4, in one embodiment of the present invention, heterogeneous protection logic processors (430, 431) within channel A (410) can be configured to cross-monitor (M) each other. That is, they can cross-monitor whether the counterpart processor is operating normally or is in a disabled state. Various monitoring methods, such as active signals, counters, and voltage signals, can be used to cross-monitor in real time whether the counterpart process is disabled.

[0064] As a result of the monitoring (M), if the master, i.e., the protection logic processor (430) based on the first type of channel A (410) operates normally, the slave, i.e., the protection logic processor (431) based on the second type does not operate.

[0065] However, if the master (430) becomes incapacitated and the slave (431) recognizes the master's incapacity, the slave (431) has control authority. Here, the control authority can be transmitted so that the slave, i.e., the second-type-based protection logic processor (431), automatically performs the same protection logic processing that the master, i.e., the first-type-based protection logic processor (430), was performing, and at the same time, a selection signal (S) can be transmitted to select and output a signal of the second-type-based protection logic processor (431) to the output path (440).

[0066] Likewise, the protection logic processors (432, 433) and output path (441) within channel B (411) also perform the same operations as the protection logic processors (430, 431) and output path (440) within channel A (410) described above.

[0067] The configuration of channel A (410) illustrated in FIG. 4 is of A-Type, in which the protection logic processor (430) based on the first type becomes the master and the protection logic processor (431) based on the second type becomes the slave. On the other hand, the configuration of channel B (411) is of B-Type, in which the protection logic processor (430) based on the second type becomes the master and the protection logic processor (431) based on the first type becomes the slave.

[0068] On the other hand, in order to prevent the failure of the first type-based protection logic processor (430) and the second type-based protection logic processor (431) of channel A (410) from electrically affecting each other, the power supply of the first type-based protection logic processor (430) and the power supply of the second type-based protection logic processor (431) are provided separately.

[0069] In addition, in order to isolate the protection logic processor (430) based on the first type of channel A (410) and the protection logic processor (431) based on the second type of channel A, the grounding within the board is independently configured, so that although it is physically the same board, it has a completely independent configuration in terms of electrical characteristics. In the case of channel B (411), it also has a configuration in the same form as the power and grounding configuration of channel A (410).

[0070] FIG. 5 is a functional diagram briefly explaining a method for securing diversity in a digital reactor protection system according to another embodiment of the present invention.

[0071] As illustrated in FIG. 5, the reactor protection system (500) of the present invention is composed of a combination of an A-Type board of channel A (410) and a B-Type board of channel B (411) illustrated in FIG. 4.

[0072] As illustrated in Figure 5, for example, in the A-Type, a FLASH-based protection logic processor becomes the master, and an SRAM-based protection logic processor becomes the slave. On the other hand, in the B-Type, an SRAM-based protection logic processor becomes the master, and a FLASH-based protection logic processor becomes the slave.

[0073] In another embodiment, as illustrated in FIG. 5, channels A and C may be configured as A-Type, and channels B and D may be configured as B-Type, but the Type setting for each channel may be configured as a combination of various methods.

[0074] In the configuration of FIG. 5, when the master processors (511, 513, 515, 517) of channels A, B, C, and D operate normally, the entire protection logic of the reactor protection system (500) performs 2out4 voting protection logic, and if a failure occurs in FLASH, the master (511) of channel A and the master (515) of channel C become disabled, and at this time, the SRAM-based slave (512) of channel A and the slave (516) of channel C perform the protection logic processing that the masters (511, 515) were performing. At the same time, the master (511) or slave (512) of channel A transmits a selection signal (S) for a signal to be output to the output path, and the output path determines the signal path according to the selection signal (S). That is, the output path is switched to the master output path or the slave output path depending on the selection signal (S).

[0075] In this way, by the configuration of FIG. 5, which is an embodiment of the present invention, even if a common cause failure due to a FLASH or SRAM failure occurs in the reactor protection system (500), the entire protection logic of the reactor protection system (500) can perform the 2out4 voting protection logic as is, thereby improving the reliability and durability of the reactor protection system (500).

[0076] [Explanation of symbols]

[0077] 310, 311, 410, 411, 521 to 524: Channels

[0078] 300, 400: Sensor detection signals

[0079] 320, 321, 420, 421: Input path

[0080] 330 to 333, 430 to 433, 511 to 518: Protection logic processor

[0081] 340, 341, 440, 441: Output path

[0082] 350, 451: Trip signal

Claims

1. A nuclear reactor protection system using heterogeneous processors, M channels that receive input signals of N different items equally, where M and N are integers greater than 1; and It is composed of a pair of protection logic processors arranged in each of the above M channels and receiving input signals of the N different items, performing protection logic, and generating a trip signal. A nuclear reactor protection system using heterogeneous processors, wherein the above pair of protection logic processors are configured within a single board in each of the M channels.

2. In paragraph 1, A nuclear reactor protection system using heterogeneous processors, wherein the input signals of the N different items include at least one of pressure, temperature, flow rate, and radioactivity measured in the nuclear reactor.

3. In paragraph 1, The above protection logic processor is a nuclear reactor protection system using heterogeneous processors that perform comparison logic (Bistable Processor) and coincidence logic (Coincedence Processor).

4. In paragraph 1, A nuclear reactor protection system using heterogeneous processors, wherein each of the pair of protection logic processors implemented within a single board of each of the M channels receives input signals of the N different items in the same manner.

5. In paragraph 1, A nuclear reactor protection system using heterogeneous processors, wherein each of the pair of protection logic processors implemented within a single board of each of the above M channels is implemented heterogeneously.

6. In paragraph 1, A nuclear reactor protection system using heterogeneous processors, wherein the pair of protection logic processors implemented within a single board of each of the above M channels are composed of different heterogeneous processors.

7. In paragraph 6, A nuclear reactor protection system using heterogeneous processors, wherein each of the above different heterogeneous processors is configured as a master or a slave.

8. In paragraph 7, A nuclear reactor protection system using heterogeneous processors, wherein the above different heterogeneous processors are configured to cross-monitor each other, and a processor designated as the master has control priority.

9. In paragraph 8, A nuclear protection system using heterogeneous processors, wherein the above M channels are composed of boards of the same type and non-identical types.

10. In paragraph 9, The above-mentioned same type of board is a nuclear protection system using heterogeneous processors, in which the protection logic processor of the same type operates as a master or slave.

11. In paragraph 8, A nuclear reactor protection system using heterogeneous processors, in which, in the case where the master is incapable of monitoring the above crossover, the slave has control priority and performs the protection logic of the master, and transmits a selection signal to the output path so that the output of the slave becomes a trip signal.

Images