Diverse protection system and diverse-component control system satisfying single failure criterion requirements

Abstract

The present invention relates to a diverse protection system and a diverse-component control system for reactors and, more specifically, to a diverse protection system (DPS) and a diverse-component control system (D-CSS) satisfying single failure criterion requirements. The present invention comprises: a diverse protection system including a plurality of logic controllers that uses, as inputs, at least some of a diverse protection system sensor, a plant protection system sensor, and an ex-core neutron flux monitoring system sensor, and output at least four reactor trip signals and signals corresponding to the diverse-component control system; and a diverse-component control system including component control logic processors configured in a redundant structure, wherein the component control logic processors perform selective 2 / 4 logic by receiving signals, which correspond to the input of the diverse-component control system and are output from the diverse protection system.

Description

Diversified protection system and diverse device control system that satisfy single-fault criterion requirements

[0001] The present invention relates to a nuclear reactor protection system and control system, and more specifically, to a diversity protection system and a diversity equipment control system.

[0002] Nuclear power plants are comprised of multiple systems, including protection systems, control systems, and monitoring systems. Among these systems, the plant protection system consists of the Reactor Protection System (RPS), which safely shuts down the reactor in the event of a design basis accident, and the Engineering Safety Features - Component Control System (ESF-CCS), which mitigates design basis accidents.

[0003] Nuclear power plants are designed with a separate Diverse Protection System (DPS) to prepare for transient conditions that prevent the reactor from shutting down safely even when conditions require it to do so.

[0004] In the case of Europe, unlike in Korea, a diverse system design is required for the Engineering Safety Equipment Control System (ESF-CCS), and a Diverse-Component Control System (D-CCS) has been designed.

[0005] Figure 1 is a partial configuration diagram of a system that ensures the safety of an existing nuclear reactor.

[0006] Referring to Fig. 1, as part of a system for ensuring the safety of an existing nuclear reactor, it may be composed of a Diverse Protection System (DPS), a Diverse Component Control System (D-CSS) (100), an Engineering Safety Facility Control System (ESF-CCS) (125), and a Diverse Trip Breaker (128).

[0007] The diversity protection system (118) is composed of channel G (116) and channel H (117), and each channel receives signals from a diversity protection system (DPS) sensor (110) (steam generator water level sensor, steam generator pressure sensor, pressurizer pressure sensor, containment pressure sensor) and an ex-core neutron flux monitoring system (ENFMS) sensor (neutron flux measurement).

[0008] Each of the 2 / 2 logic processors of channel G (116) and the 2 / 2 logic processors of channel H (117) is independently supplied with a first safety-grade power supply (114) and a second safety-grade power supply (115).

[0009] Among the 2 / 2 logic processor output signals of each channel of channel G (116) and channel H (117), the output signal (119) corresponding to the input of the diversity device control system (123) is input to the 2 / 2 device control logic processor (122) of the diversity device control system (123), and when the 2 out of 2 condition is satisfied, the device (126) such as a pump or valve is operated through the device control interface module (CIM, Component Interface Module) (124) of the engineering safety equipment device control system (125). Here, the input signal (119) of the diversity device control system (123) includes EBAS (Emergency Boration Actuation Signal), SGEBDAS (S / G Emergency Blowdown Actuation Signal), PAFAS (Passive Auxiliary Feedwater Actuation Signal), etc.

[0010] Among the 2 / 2 logic processor output signals of each channel of channel G (116) and channel H (117), the reactor stop signal (120, 121) is input to the diversity trip breaker (128), which opens the breaker to cut off the power supplied from the MG Set (motor-generator set) (129). When both the first breaker and the second breaker of the diversity trip breaker (128) are cut off, the power supplied to the DRCS (Digital Rod Control System) (127) is cut off, the control rod falls freely, and the reactor is stopped.

[0011] In the existing European standard design, the diversity protection system and diversity device control system were not required to satisfy the single-fault criterion requirements, but now they must satisfy the single-fault criterion requirements due to the requirements of certain countries.

[0012] Considering the diversity design according to the single-fault criterion requirement, the number of safety-grade power supplied to the cabinet of the diversity protection system (118) of Fig. 1 and the number of dedicated sensors of the diversity protection system (118) are each required to be doubled, and the logic of the diversity device control system (123) is also required accordingly, which causes design complexity and safety issues.

[0013] The purpose of the present invention to solve the above-mentioned problems is to provide a reactor diversity protection system and a diversity equipment control system that operate with two channels and two safety-grade power sources like existing systems while satisfying single-fault criterion requirements and European nuclear power plant design requirements, and have reduced design complexity.

[0014] However, the problem to be solved by the present invention is not limited to this, and may be expanded in various ways without departing from the spirit and scope of the present invention.

[0015] According to one embodiment of the present invention, a reactor safety assurance system satisfying a single-failure criterion requirement may include a Diverse Protection System (DPS) including a plurality of channels that receive at least some of a Diverse Protection System (DPS) sensor, a Plant Protection System (PPS) sensor, and an Ex-core Neutron Flux Monitoring System (ENFMS) sensor as inputs and output signals corresponding to at least four reactor shutdown signals and inputs of a Diverse Component Control System (D-CSS); and a Diverse Component Control System (D-CSS) in which a device control logic processor that receives a signal output from the Diverse Protection System and performs selective 2 / 4 logic is configured in a redundant structure.

[0016] Each of the device control logic processors performing the optional 2 / 4 logic of the above duplex structure can receive all signals corresponding to the input of the diversity device control system among the signals output from the multiple channels of the diversity protection system.

[0017] Each of the plurality of channels of the above diversity protection system can be configured with a plurality of logic controllers performing 2 / 4 logic.

[0018] The above-described diversity device control system may further include a gate logic circuit that connects the outputs of each device control logic processor performing the optional 2 / 4 logic of the above-described duplex structure with OR or AND.

[0019] A first safety-grade power may be supplied to a first device control logic processor among the device control logic processors that perform a first channel among the plurality of channels of the above-mentioned diversity protection system and an optional 2 / 4 logic of the above-mentioned redundant structure of the above-mentioned diversity device control system, and a second safety-grade power may be supplied to a second device control logic processor among the device control logic processors that perform a second channel among the plurality of channels of the above-mentioned diversity protection system and an optional 2 / 4 logic of the above-mentioned redundant structure of the above-mentioned diversity device control system.

[0020] The above first safety grade power source and the above second safety grade power source are characterized in that they are independent of each other.

[0021] The above reactor safety assurance system may further include a diversity trip circuit breaker connected to the diversity protection system and operating with selective 2 / 4 logic.

[0022] The above-mentioned diversity protection system can transmit at least four reactor shutdown signals to the diversity trip breakers operating with the above-mentioned optional 2 / 4 logic.

[0023] The above-mentioned diversity trip circuit breaker connected to multiple channels of the above-mentioned diversity protection system and operating with the above-mentioned selective 2 / 4 logic is composed of multiple trip circuit breakers in a parallel structure, and each of the multiple trip circuit breakers can be composed of multiple circuit breakers in a series structure.

[0024] A first channel among the plurality of channels of the above-mentioned diversity protection system may be connected to a first trip breaker among the plurality of trip breakers, and a second channel among the plurality of channels of the above-mentioned diversity protection system may be connected to a second trip breaker among the plurality of trip breakers.

[0025] Among the plurality of trip breakers, the first safety grade power can be supplied to the first trip breakers, and the second safety grade power can be supplied to the second trip breakers among the plurality of trip breakers.

[0026] The first and second reactor stop signals output from the first channel among the plurality of channels of the above diversity protection system may be transmitted to the first and second circuit breakers of the first trip breaker among the plurality of trip breakers, and the third and fourth reactor stop signals output from the second channel among the plurality of channels of the above diversity protection system may be transmitted to the third and fourth circuit breakers of the second trip breaker among the plurality of trip breakers.

[0027] At least some different types of sensors may be connected to a first logic controller of a first channel among the plurality of channels of the above diversity protection system and a third logic controller of a second channel among the plurality of channels of the above diversity protection system, and the same type of sensors may be connected to a second logic controller of the first channel among the plurality of channels of the above diversity protection system and a fourth logic controller of the second channel among the plurality of channels of the above diversity protection system.

[0028] The disclosed technology may have the following effects. However, this does not mean that a particular embodiment must include all or only the following effects, and therefore the scope of the disclosed technology should not be construed as being limited thereby.

[0029] First, by reducing the complexity of the hardware and software that constitute the reactor diversity protection system and diversity equipment control system, it is possible to easily deploy equipment on site without design interference between other fields, thereby shortening the construction period and reducing installation costs.

[0030] Second, by using sensor signals and safety-grade power sources related to the existing power plant protection system, a diverse protection system and diverse equipment control system can be implemented without installing additional dedicated sensors and separate power sources.

[0031] Figure 1 is a partial configuration diagram of a system that ensures the safety of an existing nuclear reactor.

[0032] FIG. 2 is a drawing illustrating a part of the configuration of a system for ensuring reactor safety according to one embodiment of the present invention.

[0033] Figure 3 is a detailed configuration diagram of a part of a system that ensures reactor safety according to another embodiment of the present invention.

[0034] The present invention is capable of various modifications and embodiments. Specific embodiments are illustrated in the drawings and described in detail in the detailed description. However, this is not intended to limit the present invention to specific embodiments, and it is to be understood that all modifications, equivalents, and alternatives included within the technical spirit and scope of the present invention are included. In describing the present invention, if a detailed description of a related known technology is judged to obscure the gist of the present invention, the detailed description will be omitted.

[0035] Terms like "first" and "second" may be used to describe various components, but these terms do not limit the components themselves. These terms are used solely to distinguish one component from another.

[0036] The terminology used in this invention is solely for the purpose of describing specific embodiments and is not intended to limit the invention. The terminology used in this invention has been selected from widely used, current terms, taking into account the functions of the invention. However, this may vary depending on the intentions of those skilled in the art, precedents, or the emergence of new technologies. Furthermore, in certain cases, the applicant may arbitrarily select terms, in which case their meanings will be described in detail in the relevant description of the invention. Therefore, the terms used in this invention should not be defined simply as names of terms, but rather based on their meanings and the overall content of the invention.

[0037] Singular expressions include plural expressions unless the context clearly dictates otherwise. In the present invention, terms such as "comprise" or "have" are intended to indicate the presence of a feature, number, step, operation, component, part, or combination thereof described in the specification, but should be understood not to preclude the possibility of the presence or addition of one or more other features, numbers, steps, operations, components, parts, or combinations thereof.

[0038] Hereinafter, embodiments of the present invention will be described in detail with reference to the attached drawings. In describing with reference to the attached drawings, identical or corresponding components are assigned the same drawing numbers, and redundant descriptions thereof will be omitted.

[0039] FIG. 2 is a drawing illustrating a part of the configuration of a system for ensuring reactor safety according to one embodiment of the present invention.

[0040] As illustrated in FIG. 2, part of the configuration of the system for ensuring reactor safety of the present invention may be composed of a diversity system (200), an engineering safety equipment control system (ESF-CCS, ESF - Component Control System) (270), and a diversity trip breaker (230).

[0041] The diversity system (200) may be composed of a diversity protection system (210) and a diversity device control system (D-CSS, Diverse - Component Control System) (220).

[0042] The diversity protection system (210) is connected to a diversity protection system sensor (211), a power plant protection system sensor (212), and an external neutron flux monitoring system sensor (213), and can receive values ​​from each sensor.

[0043] The diversity protection system sensor (211) may include temperature, flow rate, pressure, etc. as measurement values ​​related to the power plant operating status.

[0044] The power plant protection system sensor (212) may include a steam generator water level sensor, a steam generator pressure sensor, a pressurizer pressure sensor, a containment building pressure sensor, etc.

[0045] The diversity protection system (210) is composed of a plurality of logical processors (not shown), and the plurality of logical processors receive signals from the diversity protection system sensor (211), the power plant protection system sensor (212), and the off-site neutron flux monitoring system sensor (213) as inputs and output an input signal (214) of the diversity equipment control system (220) and four reactor shutdown signals (215, 216, 217, 218). Here, the input signal (214) of the diversity equipment control system (220) may include an Emergency Boration Actuation Signal (EBAS), an S / G Emergency Blowdown Actuation Signal (SGEBDAS), a Passive Auxiliary Feedwater Actuation Signal (PAFAS), etc.

[0046] Four reactor stop signals (215, 216, 217, 218) control the diversity trip circuit breaker (230) to determine whether to cut off the power supplied to the DRCS (Digital Rod Control System) (see Fig. 1).

[0047] The diversity device control system (220) may be configured with a redundant structure, including a first device control logic processor (221), a second device control logic processor (222), and an OR (or AND) gate logic circuit (223). Here, redundancy means multiplexing, and includes duplication and triplication.

[0048] Each of the first device control logic processor (221) and the second device control logic processor (222) includes a processor that receives a signal (214) corresponding to the input of the diversity device control system (220) output from the diversity protection system (118) and performs selective 2 / 4 logic.

[0049] The OR (or AND) gate logic circuit (223) receives the output signals of the first device control logic processor (221) and the second device control logic processor (222), performs OR (or AND) logic, and ultimately transmits a device control signal (224) to the engineering safety facility device control system (ESF-CCS) (270).

[0050] Figure 3 is a detailed configuration diagram of a part of a system that ensures reactor safety according to another embodiment of the present invention.

[0051] As illustrated in FIG. 3, part of the system for ensuring reactor safety of the present invention may be composed of a diversity system (300), an engineering safety equipment control system (390), and a diversity trip circuit breaker (380).

[0052] The diversity system (300) may be composed of a diversity protection system (DPS) (340) and a diversity device control system (D-CSS) (370). The diversity protection system (340) is composed of a channel G (341) and a channel H (342). Channel G (341) is configured by being divided into channels G1 and G2, and channels G1 and G2 include a first 2 / 4 logic controller (341_1) and a second 2 / 4 logic controller (341_2), respectively. In addition, channel H (342) is configured by being divided into channels H1 and H2, and channels H1 and H2 include a third 2 / 4 logic controller (342_1) and a fourth 2 / 4 logic controller (342_2), respectively. The comparison logic result (343) of the first 2 / 4 logic controller (341_1) of channel G1 is transmitted to the remaining three logic controllers (341_2, 342_1, 342_2) and used for 2 / 4 logic execution of the corresponding logic controllers. The comparison logic result (343) of each of the logic controller (341_2) of channel G2, the logic controller (342_1) of channel H1, and the logic controller (342_2) of channel H2 is also transmitted to the remaining three logic controllers and used for 2 / 4 logic execution of the corresponding logic controllers. Here, the number of channels, the number of safety-grade power supplies, and the number of logic controllers disclosed in the present invention may include a larger range.

[0053] When the first safety level power supply (330) is lost, the comparison logic result (343) of the 2 / 4 logic controller (341_1, 341_2) of channel G (341) becomes “0” and is not transmitted to other controllers, but the 2 / 4 logic controller (342_1, 342_2) of channel H (342) can perform the safety function with 2 / 2 logic. Even when the second safety level power supply (331) is lost, the 2 / 4 logic controller (341_1, 341_2) of channel G (341) can perform the safety function with 2 / 2 logic in the same way as in the case of the loss of the first safety level power supply (330).

[0054] The diversity device control system (370) may be composed of a first optional 2 / 4 device control logic processor (371), a second optional 2 / 4 device control logic processor (372), and a gate logic circuit (373). The diversity device control system (370) is configured with a redundant structure that can perform normal functions even if one of the first optional 2 / 4 device control logic processor (371) and the second optional 2 / 4 device control logic processor (372) fails.

[0055] A first safety-grade power supply (330) is connected to the first 2 / 4 logic controller (341_1), the second 2 / 4 logic controller (341_2) of channel G (341) of the diversity protection system (340) and the first optional 2 / 4 device control logic processor (371) of the diversity device control system (370), and a second safety-grade power supply (331) is connected to the third 2 / 4 logic controller (342_1), the fourth 2 / 4 logic controller (342_2) of channel H (342) of the diversity protection system (340) and the second optional 2 / 4 device control logic processor (372) of the diversity device control system (370), and the first safety-grade power supply (330) and the second safety-grade power supply (331) are configured as independent power supplies that do not affect each other.

[0056] Even if the logic controller (341_1, 341_2) of channel G (341) of the diversity protection system (340) does not operate due to a power failure of channel G (341), the function of the diversity protection system (340) can be performed without interruption by the logic controller (342_1, 342_2) of channel H (342).

[0057] The signals of the diversity protection system sensor (DPS sensor) (310), the external neutron flux monitoring system sensor (ENFMS) (311), and the power plant protection system sensor (PPS sensor) (312) are input equally to channel G (341) and channel H (342) of the diversity protection system (340), respectively.

[0058] More specifically, signals of a diversity protection system sensor (DPS sensor) (310) and an external neutron flux monitoring system sensor (ENFMS) (311) are input to the first 2 / 4 logic controller (341_1) of channel G1, signals of an external neutron flux monitoring system (ENFMS) (311) and a power plant protection system sensor (PPS sensor) (312) are input to the second 2 / 4 logic controller (341_2) of channel G2, signals of a diversity protection system sensor (DPS sensor) (310) and an external neutron flux monitoring system sensor (ENFMS) (311) are input to the third 2 / 4 logic controller (342_1) of channel H1, and signals of an external neutron flux monitoring system sensor (ENFMS) (311) and a power plant protection system sensor (PPS The sensor)(312) signal is input.

[0059] Thereafter, each signal corresponding to the input of the diversity device control system (370) among the outputs of the first to fourth 2 / 4 logic controllers (341_1, 341_2, 342_1, 342_2) is branched and input equally to the first selective 2 / 4 device control logic processor (371) of channel G (341) and the second selective 2 / 4 device control logic processor (372) of channel H (342).

[0060] That is, each of the first optional 2 / 4 device control logic processor (371) and the second optional 2 / 4 device control logic processor (372) receives all signals corresponding to the input of the diversity device control system (370) among the outputs of the first 2 / 4 logic controller (341_1), the second 2 / 4 logic controller (341_2), the third 2 / 4 logic controller (342_1), and the fourth 2 / 4 logic controller (342_2), and through this, each of the first optional 2 / 4 device control logic processor (371) and the second optional 2 / 4 device control logic processor (372) performs the optional 2 out of 4 logic.

[0061] The output values ​​of the first optional 2 / 4 device control logic processor (371) and the second optional 2 / 4 device control logic processor (372) are input to the OR logic gate (373). Through this, when the safety-grade power supplied to either the first optional 2 / 4 device control logic processor (371) or the second optional 2 / 4 device control logic processor (372) fails, the single failure criterion for the safety-grade power can be satisfied.

[0062] However, if the reliability of the output result value is given priority over the satisfaction of the single failure criterion for the diversity device control system (370) (e.g., to prevent sudden malfunction), the OR logic gate is replaced with an AND logic gate.

[0063] Through a configuration according to one embodiment of the present invention, each of channel G (341) and channel H (342) can perform 2 out 4 logic.

[0064] The output signal of the diversity device control system (370) operates devices (393) such as pumps and valves through the device control interface module (CIM, Component Interface Module) (392) of the engineering safety equipment device control system (390). Here, signals (350) corresponding to the input of the diversity device control system (370) include EBAS (Emergencty Boration Actuation Signal), SGEBDAS (S / G Emergency Blowdown Actuation Signal), PAFAS (Passive Auxiliary Feedwater Actuation Signal), etc.

[0065] The diversity trip circuit breaker (380) of the present invention is configured with a total of four circuit breakers in a selective 2 out of 4 form, with two circuit breakers (381, 382) installed in series in channel G (341) and two circuit breakers (383, 384) installed in series in channel H (342).

[0066] Among the output signals of channel G (341) and channel H (342), the reactor stop signal (361 to 364) is input to the diversity trip circuit breaker (380), and the circuit breaker is opened according to the selective 2 out 4 logic, so that the power supplied from the MG Set (motor-generator set) (386) to the DRCS (Digital Rod Control System) (385) is cut off, and the control rod falls freely, thereby stopping the reactor.

[0067] The diversity trip breaker (380) is configured in parallel with a first trip breaker (not shown) connected to channel G (341) and a second trip breaker (not shown) connected to channel H (342). Here, the first trip breaker is configured in series with a first breaker (381) and a second breaker (382), and the second trip breaker is configured in series with a third breaker (383) and a fourth breaker (384). The first breaker (381) and the second breaker (382) of the first trip breaker receive power from a first safety-grade power source (330), and the third breaker (383) and the fourth breaker (384) of the second trip breaker receive power from a second safety-grade power source (331) (not shown). When the first safety grade power source (330) is lost, the first circuit breaker (381) and the second circuit breaker (382) are automatically opened by the undervoltage trip function, and when the second safety grade power source (331) is lost, the third circuit breaker (383) and the fourth circuit breaker (384) are automatically opened by the undervoltage trip function. Accordingly, when the first safety level power source (330) is lost, the reactor stop signal (361, 362) of the logic controllers (341_1, 341_2) of channels G1 and G2 becomes “0” and the reactor stop signal is not transmitted to the first circuit breaker (381) and the second circuit breaker (382) connected to channel G (341). However, the first circuit breaker (381) and the second circuit breaker (382) are automatically opened by the low voltage trip function, and the third circuit breaker (383) and the fourth circuit breaker (384) can be opened by the reactor stop signal (363, 364) of the logic controllers (342_1, 342_2) of channels H1 and H2, thereby performing the safety function. Even if the second safety class power source (331) is lost, the diversity trip circuit breaker (380) can perform the safety function in the same way as in the case of the loss of the first safety class power source (330). Here, the number of trip circuit breakers and the number of circuit breakers disclosed in the present invention can include a larger range.

[0068] Channel G (341) and channel H (342) of the diversity protection system (340) of the present invention can perform 2 / 4 logic controller performance instead of the existing 2 / 2 logic controller performance while utilizing existing power plant protection system sensors without adding safety-grade power and adding dedicated sensors for the diversity protection system, thereby satisfying the single-fault criterion requirements of the new European standard design to the greatest extent possible.

[0069] [Explanation of symbols]

[0070] 200, 300: Diversity lineage

[0071] 210, 340: Diversity protection system

[0072] 211, 310: Diversity protection system sensor

[0073] 212, 312: Power plant protection system sensor

[0074] 213, 311: Off-site neutron flux monitoring system sensor

[0075] 220, 370: Diversity Device Control System

[0076] 221, 222, 371, 372: Optional 2 / 4 device control logic processor

[0077] 223, 373: Gate logic circuit

[0078] 230, 380: Diversity trip circuit breaker

[0079] 270, 390: Engineering safety equipment control system

[0080] 341_1, 341_2, 342_1, 342_2: 2 / 4 logic controller

Claims

1. As a reactor safety assurance system that satisfies the single-fault criterion requirements, A Diverse Protection System (DPS) including a plurality of channels that input at least some of the Diverse Protection System (DPS) sensors, the Plant Protection System (PPS) sensors, and the Ex-core Neutron Flux Monitoring System (ENFMS) sensors and output signals corresponding to at least four reactor shutdown signals and inputs of the Diverse Component Control System (D-CSS); and A device control logic processor that receives a signal output from the above-mentioned diversity protection system and performs selective 2 / 4 logic includes a diversity device control system (D-CSS, Diverse - Component Control System) configured with a redundancy structure. A reactor safety assurance system that satisfies single-fault criterion requirements.

2. In paragraph 1, Each of the above device control logic processors performing the optional 2 / 4 logic of the above duplex structure Receiving all signals corresponding to the input of the diversity device control system among the signals output from the plurality of channels of the diversity protection system, A reactor safety assurance system that satisfies single-fault criterion requirements.

3. In paragraph 1, Each of the plurality of channels of the above diversity protection system is composed of a plurality of logic controllers that perform 2 / 4 logic. A reactor safety assurance system that satisfies single-fault criterion requirements.

4. In paragraph 1, The above diversity device control system Further comprising a gate logic circuit that connects the outputs of each of the device control logic processors performing the optional 2 / 4 logic of the above duplex structure with OR or AND. A reactor safety assurance system that satisfies single-fault criterion requirements.

5. In paragraph 1, A first safety level power is supplied to a first device control logic processor among the device control logic processors that performs a first channel among the plurality of channels of the above diversity protection system and an optional 2 / 4 logic of the redundant structure of the above diversity device control system, and a second safety level power is supplied to a second device control logic processor among the device control logic processors that performs a second channel among the plurality of channels of the above diversity protection system and a 2 / 4 logic of the redundant structure of the above diversity device control system. A reactor safety assurance system that satisfies single-fault criterion requirements.

6. In paragraph 5, The first safety grade power source and the second safety grade power source are characterized in that they are independent of each other. A reactor safety assurance system that satisfies single-fault criterion requirements.

7. In paragraph 1, The above reactor safety assurance system further includes a diversity trip circuit breaker connected to the diversity protection system and operating with selective 2 / 4 logic. A reactor safety assurance system that satisfies single-fault criterion requirements.

8. In paragraph 7, The above diversity protection system Transmitting at least four reactor shutdown signals to the Diverse Trip Breaker operating with the above optional 2 / 4 logic, A reactor safety assurance system that satisfies single-fault criterion requirements.

9. In paragraph 8, A diversity trip circuit breaker connected to the above multiple channels of the above diversity protection system and operating with the optional 2 / 4 logic It is composed of a plurality of trip breakers in a parallel structure, and each of the plurality of trip breakers is composed of a plurality of breakers in a series structure. A reactor safety assurance system that satisfies single-fault criterion requirements.

10. In paragraph 9, A first channel among the plurality of channels of the above diversity protection system is connected to a first trip breaker among the plurality of trip breakers, and a second channel among the plurality of channels of the above diversity protection system is connected to a second trip breaker among the plurality of trip breakers. A reactor safety assurance system that satisfies single-fault criterion requirements.

11. In paragraph 10, Among the plurality of trip breakers, the first trip breaker is supplied with a first safety grade power source, and among the plurality of trip breakers, the second trip breaker is supplied with a second safety grade power source. A reactor safety assurance system that satisfies single-fault criterion requirements.

12. In paragraph 10, The first and second reactor stop signals output from the first channel among the plurality of channels of the above diversity protection system are transmitted to the first and second circuit breakers of the first trip breaker among the plurality of trip breakers, and the third and fourth reactor stop signals output from the second channel among the plurality of channels of the above diversity protection system are transmitted to the third and fourth circuit breakers of the second trip breaker among the plurality of trip breakers. A reactor safety assurance system that satisfies single-fault criterion requirements.

13. In paragraph 10, At least some different types of sensors are connected to the first logic controller of the first channel among the plurality of channels of the above diversity protection system and the third logic controller of the second channel among the plurality of channels of the above diversity protection system. The same type of sensor is connected to the second logic controller of the first channel among the plurality of channels of the above diversity protection system and the fourth logic controller of the second channel among the plurality of channels of the above diversity protection system. A reactor safety assurance system that satisfies single-fault criterion requirements.

Images