JP2912425B2 - Reactor safety protection device - Google Patents

Description

Description: TECHNICAL FIELD The present invention relates to a reactor safety protection device, and more particularly to a reactor safety protection device suitable for avoiding a malfunction at the time of starting a system in a multiplex configuration. About.

[Related Art] For example, in a nuclear power plant, it is necessary to ensure the safety of a nuclear reactor. Therefore, when there is a possibility that an abnormal transient state may occur, a safety protection device is provided to prevent the abnormal transient state.
FIG. 10 is a configuration diagram of a well-known safety protection device described in Proceedings B41 of the Atomic Energy Society of Japan, Fall Meeting 1987, “Basic Configuration of New Reactor Protection System”. Incidentally, in the above-mentioned proceedings B41, the safety protection device has a quadruple configuration, but FIG. 10 shows only one of them.

The detection signals of the redundant sensors A _{1 to} A ₄ ,..., N _{1 to} N ₄ are taken into the signal processing circuit 1 (only one of the quadruple systems is shown). The signal processing circuit 1, a trip module 1A1 ₁ to 1A the respective detection signals of the sensors A ₁ to A ₄ are compared with respective prescribed values
Comprises a 1 _4, ..., and a trip module 1an ₁ ～1AN ₄ of the respective detection signals of the sensor N ₁ to N ₄ are compared with respective prescribed values. Each trip module _{1A1 1 ~1A1 4, ..., 1AN} 1, 1AN 4 , when the detection signal of the corresponding sensor indicates a plant abnormal, that is, when the detected value exceeds a prescribed value, a trip command signal of logic "0" Create and output. The signal processing circuit 1 outputs “0” for each of the _four trip modules 1A1 _{1 to} 1A1 ₄ ,..., 1AN _{1 to} 1AN _4.
A majority decision means 1B1 to 1BN of priority 2 out of 4 logic is provided. The outputs of the majority decision means 1B1 to 1BN are output to the power circuit 5 through a 1-out-of-N circuit 1C, a latch circuit (not shown in FIG. 11), and a bypass switch 1E. The power circuit 5 takes majority logic of the output signal a of the signal processing circuit 1 and the output signals b, c, d from the other signal processing circuits, and controls the scram solenoid valve 9 to be controlled. It has become.

According to this conventional example, a trip module for determining whether or not the detection signal of each sensor exceeds a corresponding prescribed value is required four times the number of sensors. Therefore, as shown in FIG. 11, the output of one sensor is received by one trip module, and the output signal of this trip module is distributed to other signal processing circuits, thereby reducing the number of trip modules. It is also possible. Incidentally, the latch circuit 1D shown in FIG. 11 is a circuit necessary for operating the scram solenoid valve 9 to be controlled and thereafter holding this operation. Then, by manually turning on the switch 1F, the latch circuit 1D is reset.

[Problems to be Solved by the Invention] In the above-mentioned conventional technology, when each signal processing circuit is independently activated, the following problem occurs. FIG.
FIG. 7 is a diagram illustrating a relationship between all signal processing circuits, focusing on processing for output signals of two sensors. Here, the output signal of each sensor A ₁ to A ₄ is does not exceed the specified value. That is, the scram control valve 9 to be controlled is not operated because the state is not an abnormal transient state.

First, it is assumed that the signal processing circuit 1 is started. Since the detection signal of the sensor A ₁ it does not reach the predetermined value, from the trip module 1A naturally "1" (non-trip command) is output. However, since the other signal processing circuits 2, 3, and 4 are not activated, each trip module 2A, 3A, 4A is set to "0".
(Trip command) is output. That is, "1", "0", "0", "0" are input to the majority decision means 1B of the signal processing circuit 1, and as a result, "0" is output from the majority decision means 1B. One input of the 1 out-of-N circuit 1C is “0”
Then, since "0" is output, the latch circuit 1D latches the "0" output, and the signal processing circuit 1 outputs "0", that is, a trip command signal.

Next, it is assumed that the signal processing circuit 2 is activated. The output of the trip module 2A of this signal processing circuit 2 becomes "1" as described above, but since the signal processing circuits 3 and 4 have not been started yet, the input signals of the majority decision means 2B are "1" and "1". 1 ",
“0”, “0”. Accordingly, the output of the majority decision means 2B becomes "0", and the signal processing circuit 2 outputs a trip command signal.

Next, it is assumed that the signal processing circuit 3 is activated. At this time, the output of trip module 3A becomes "1",
Since the input of 3B is “1” “1”, “1”, “0”, the non-trip command “1” is output from the signal processing circuit 3.

Finally, it is assumed that the signal processing circuit 4 is activated. In this case, the inputs of the majority decision means 4B are all "1", and the output from the signal processing circuit 4 is "1".

As a result, the output of the signal processing circuit 1 is "0", the output of the signal processing circuit 2 is "0", the output of the signal processing circuit 3 is "1", and the signal processing circuit 4 is "1". That is, the input of the power circuit 5 that takes the majority logic of “0” priority is “0”, “0”, “1”,
The output becomes "1", the output becomes "0", that is, a trip command, and the scram solenoid valve 9 malfunctions.

An object of the present invention is to provide a reactor safety protection device capable of avoiding a malfunction when starting a signal processing circuit.

[Means for Solving the Problems] The object of the present invention is to provide a multiplex system for outputting a trip command signal when a plurality of sensors for detecting a state quantity of a reactor and a state quantity detected by these sensors exceed a specified value. Multiplexed trip means, multiplexed signal processing means for receiving a trip command signal of the multiplexed trip means, performing a majority operation and outputting a trip signal, and tripping of the multiplexed signal processing means. Power means for inputting a signal, performing a majority operation and driving a controlled object, and state regulating means for regulating a state such that these signal processing means output a non-trip signal when the multiplexed signal processing means is activated. Is achieved by providing the following.

[Operation] By inhibiting the operation of the control target by the output signal of each signal processing circuit until the functions of all the signal processing circuits are established and the entire multiplex system operates normally, malfunction at startup is avoided. .

Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

FIG. 1 is a configuration diagram of a security device according to a first embodiment of the present invention. In this embodiment, each trip module 1A
~ 4A and fixed signal switching means 1G ~ between majority decision means 1B ~ 4B
In addition to interposing 4G, the signal processing circuits 1 to 4 are provided with state determination means 1H to 4H, respectively. Then, the fixed signal switching means of the own signal processing circuit, when confirming the establishment of the function of all the signal processing circuits by the signals output from each state determination means 1H to 4H, the input trip module output signal of the subsequent stage If the function is not established in any of the signal processing circuits through the majority decision means, a fixed signal (the same signal as the non-trip instruction) is output to the majority decision means in order to inhibit the trip command output from the trip module. It has become.

The state determining means 1H to 4H of each of the signal processing circuits 1 to 4 are means for determining whether or not the function of each of the signal processing circuits 1 to 4 is established, and details of an example thereof are shown in FIG. . In the example of FIG. 2, if the DC power supply 1I to be supplied to the signal processing circuit 1 has been established, it can be determined that each of the circuits constituting the signal processing circuit 1 is operating, so that the power supply 1I operates. The function establishment of the signal processing circuit 1 is determined based on the relay contact signal α. The establishment of the function of the signal processing circuit 2 is determined by the same contact signal β, the establishment of the function of the signal processing circuit 3 is determined by the same contact signal γ, and the establishment of the function of the signal processing circuit 4 is determined by the same contact signal δ. Shall be. In FIG. 2, 1K is an AC power supply, and 1J is a start switch. Function establishment signals α, β, γ, δ (function establishment is indicated by logic “1”) output from each of the state determination units 1H to 4H are output to each of the fixed signal switching units 1G to 4G.

The details of the fixed signal switching means 1G (2G, 3G, 4G have the same configuration) are shown in FIG. The fixed signal switching means 1G is a logical product of a switch means 1G2 having four switches for simultaneously switching a signal from each trip module 1AE4A and a fixed signal from the fixed voltage 1G1, respectively, and a function establishment signal α, β, γ, δ. When the output signal of the AND gate 1G5 becomes "1", this is latched and the switch means 1G
2 is provided with a latch circuit 1G3 for switching 2 from a fixed signal side to a trip module output signal side, and a manual operation switch 1G4 for resetting the latch circuit 1G3.

When any of the function establishment signals α, β, γ, and δ is “0”, the output of the AND gate 1G5 becomes “0”. This "0" passes through the latch circuit 1G3 as it is, and the switch means 1G2 receives this signal "0", selects the fixed signal side, and outputs a fixed signal of logic "1" to the majority decision means 1B. As a result, all the fixed signals of logic "1" are inputted to the 2 out of 4 majority decision means 1B, and the majority decision means 1B outputs logic "1", that is, a non-trip command. That is, the scram solenoid valve 9 to be controlled is in a non-operating state.

When all of the function establishment signals α, β, γ, and δ become “1” (functions are established in all the signal processing circuits), the output of the AND gate 1G5 becomes “1”, which is latched by the latch circuit 1G3, and the switching means 1G2 Switches the output signal from the fixed signal to the output signal of each of the trip modules 1A to 4A, and outputs the output signal to the subsequent multi-cutting means 1B. As a result, the majority decision means 1B starts the function of the original security protection system.

Here, it is assumed that a certain signal processing circuit has failed. In this case, the power must be turned off for the system and repaired. When the power is turned off, the function establishment signal of the system becomes “0” and the output of the AND gate 1G5 becomes “0”.
However, since the latch circuit 1G3 keeps latching "1", the switch means 1G2 still selects the trip module output signal change. The output signal of the signal processing circuit whose power is turned off is “0”, but if all the output signals of the other signal processing circuits are “1”, the output is “1” by the function of majority decision means. However, the safety protection system does not malfunction.

The manual reset switch 1G4 is turned on to set the latch circuit to an initial value when, for example, the power of the signal processing circuit that has been repaired is turned on.

As described above, according to the present embodiment, the establishment of the function of each signal processing circuit is determined, and when the function of any one of the signal processing circuits is not established, all the inputs of the majority decision means in each signal processing circuit are determined. Since the signal is a fixed signal of logic "1", the control target can be kept in an inactive state to avoid a malfunction.

FIG. 4 is a configuration diagram of a security device according to a second embodiment of the present invention. In the first embodiment described above, the fixed signal switching means provided in the preceding stage of the majority decision means is controlled by the judgment result of the state judging means, but in this embodiment, the latch means 1D, 2D, 3D and 4D are controlled to obtain the same result. For this reason, as shown in FIG. 4, the latch means 1D to 4D
Reset means for controlling the respective latch resets
1L to 4L are provided in parallel with the respective latch switches 1F to 4F.

FIG. 5 is a detailed configuration diagram of the latch reset means 1L (the other latch reset means 2L to 4L have the same configuration). The AND gate 1L5 calculates the logical product of the function establishment signals α to δ and outputs the logical product to the latch circuit 1L3, and outputs the output signal of the latch circuit 1L3 to the latch circuit 1D. When any of the function establishment signals α to δ is logic “0”, the output signal of the AND gate 1L5 is also “0”.
And the output of the latch circuit 1L3 also becomes "0".

The latch circuit 1D outputs a logical “1” when a latch reset signal (a signal connected to the latch reset switch 1F) is a logical “0”. Therefore, when any of the function establishment signals α to δ is “0”, that is, when there is a signal processing circuit whose function is not established, the latch circuit 1D outputs “1”, that is, outputs a non-trip instruction.

All of the function establishment signals α to δ become “1” and AND gate
When the output of 1L5 becomes "1", this "1" state
L3 is latched, and the latch reset signal of the latch circuit 1D is fixed at "1". As a result, the latch reset state of the latch circuit 1D is released, and the latch circuit 1D
The output signal of the 1-out-of-N circuit 1C is directly output to the bypass switch 1E. That is, the safety protection system starts functioning when the function of all signal processing circuits is established.

This embodiment also has an effect that the circuit configuration becomes simpler than the first embodiment.

FIG. 6 is a configuration diagram of a safety protection device according to an embodiment in which the signal processing circuit 1 in the first embodiment is divided into two modules. For only one system when (Other systems also identical configuration) describing this embodiment, collectively trip module 1A and state determining means 1H as a single module 1 _1, the fixed signal switching means 1G and majority decision means 1B and 1 out-of-N circuit the 1C and a latch circuit 1D are summarized as a single module 1 _2. Sixth
In the figure, when turning off the power of two or more trip modules among the trip modules 1A to 4A, the reset switches in the respective fixed signal switching means 1G to 4G are turned on, and the fixed signals are turned to the majority decision means. It is possible to prevent the malfunction of the system by inputting it.

FIG. 7 is a configuration diagram of a safety protection device according to an embodiment in which the signal processing circuit 1 in the second embodiment is divided into two modules. When only (the other system also identical configuration) describing this embodiment for one system, collectively trip module 1A and state determining means 1H as a single module 1 _1, majority means 1B
When summarizes the 1-out-of-N circuit 1C and a latch circuit 1D and latch reset means 1L as a single module 1 _2.

As in the embodiment shown in FIGS. 6 and 7, the signal processing circuit is separated into modules for each function and modularized.
There is an effect that the reliability of the device can be improved and mounting can be facilitated. In this case, the state determination means
1H~4H is by determining the power state of each module 1 _{1-4 1,} it is determined the function established.

FIG. 8 is a configuration diagram of a security device according to another embodiment of the present invention. The safety protection device of the present embodiment is configured by a normal microcomputer system, and has a CPU, a ROM, a RAM, an I / O, and the like.
In the embodiments described above, the state determination unit 1H~4H, which had been output function establishment signal by determining the power establishment of the signal processing circuit 1-4 or module 1 _{1-4 1,} in this embodiment At startup, the CPU executes a function establishment signal output program and outputs a function establishment signal. Then, as shown in FIG. 9, after outputting the function establishment signal, the function determination processing of the fixed signal switching means 1G to 4G or the latch reset means 1L to 4L (not shown in FIG. 8) is performed. After the establishment of the function of the signal processing circuit is confirmed, the processing of the safety protection function is started.

In each of the above-described embodiments, the state determination units 1H to 4H
Although the function establishment signal is output when the power is established or the program is executed, the present invention is not limited thereto, and it is needless to say that the function establishment of each signal processing circuit may be determined by other means. Absent.

According to the present invention, in a multiplexed safety protection device,
Until the function of each multiplexed signal processing circuit is established, the function operation of the safety protection device is stopped and the control target is kept in an inactive state, so that malfunction of the control target at startup etc. can be avoided. , Reliability is improved.

[Brief description of the drawings]

FIG. 1 is a configuration diagram of a safety protection device according to a first embodiment of the present invention, FIG. 2 is a detailed configuration diagram of a state determination unit shown in FIG. 1,
FIG. 3 is a detailed configuration diagram of the fixed signal switching means shown in FIG. 1,
FIG. 4 is a block diagram of a security device according to a second embodiment of the present invention, FIG. 5 is a detailed configuration diagram of the latch reset means shown in FIG. 4, and FIG. FIG. 7 is a block diagram of an embodiment in which functions are separated from the security protection device of the second embodiment, FIG. 8 is a block diagram of an embodiment in which the security protection device is configured by a microcomputer system, FIG. 9 is a flowchart showing a processing procedure from output of a function establishment signal to safety protection processing when the safety protection device is configured by a microcomputer system, FIG. 10 is a configuration diagram of the safety protection device in a nuclear power plant, and FIG. FIG. 12 is another configuration diagram of one signal processing circuit constituting the safety protection device, and FIG. 12 is an overall configuration diagram of the quadruple system safety protection device. 1-4 signal processing circuit, 1A-4A trip module, 1B-4B 2 out of 4 majority decision means, 1C-4C
1 out of N circuit, 1D to 4D ... Latch circuit, 1E to 4E ...
... Bypass switch, 5-8 ... Power circuit, 9-12 ...
... Control target, 1F-4F ... Manual operation reset switch, 1G-4G ... Fixed signal switching means, 1H-4H ... State determination means, 1L-4L ... Latch reset means.

──────────────────────────────────────────────────続 き Continuing on the front page (72) Inventor Ichiro Kano 5-2-1 Omikacho, Hitachi City, Ibaraki Prefecture Inside the Omika Plant, Hitachi, Ltd. (72) Shoji Kumanami 5-2-2 Omikacho, Hitachi City, Ibaraki Prefecture No. 1 Inside the Omika Plant of Hitachi, Ltd. (56) References JP-A-63-140305 (JP, A) JP-A-53-133084 (JP, U) (58) Fields investigated (Int. Cl. ⁶ , DB G21D 3/04 G21C 17/00 G21C 9/02 G21C 7/36 G05B 9/03 G05B 9/02

Claims (6)

(57) [Claims] A plurality of sensors for detecting a state quantity of the reactor, multiplexed trip means for outputting a trip command signal when a state quantity detected by the sensors exceeds a specified value; A trip command signal of the multiplexed trip means is input, a multiplexed signal processing means for performing a majority operation and outputting a trip signal, and the trip signal output by the multiplexed signal processing means are respectively latched. Latching means, power means for receiving a trip signal of the multiplexed signal processing means, performing majority operation and driving a controlled object, and non-tripping the power means when the multiplexed signal processing means is activated. A reactor safety protection device comprising: a state control unit that controls a state of the latch unit so that a signal is input. 2. A plurality of sensors for detecting a state quantity of the reactor, multiplexed trip means for outputting a trip command signal when the state quantity detected by these sensors exceeds a specified value, The trip command signal of the multiplexed trip means is input, the multiplexed signal processing means for performing a majority operation and outputting a trip signal, and the trip signal of the multiplexed signal processing means are inputted, and the majority operation is performed. Power means for driving the controlled object, and bypass means provided for each of the multiplexed signal processing means, and providing a non-trip signal to the power means in place of the signal processing means when the corresponding signal processing means fails, Until the function of the multiplexed signal processing unit is established, the multiplexed signal processing unit includes a state regulating unit that regulates a state such that the signal processing unit outputs a non-trip signal. Reactor security device, characterized in that. 3. The reactor safety protection device according to claim 1, wherein said trip means and said signal processing means are constituted by a microcomputer system. 4. Four sensors for detecting the same state quantity of the reactor, and a trip signal is output when two or more of the state quantities detected by the four sensors exceed a specified value. Quadrupled signal processing means each having 2 out-of-4 logic means, latch means for respectively latching the trip signal output by the quadrupled signal processing means, and the quadrupled signal Power means for inputting a trip signal of a processing means and performing a majority operation to drive a controlled object; and a latch for inputting a non-trip signal to the power means when the quadrupled signal processing means is activated. And a state regulating means for regulating the state of the means. 5. A sensor for detecting the same state quantity of a reactor, and a trip signal is output when two or more of the state quantities detected by the four sensors exceed a specified value. Quadruple signal processing means each having two out-of-logic means, power means for receiving a trip signal of the quadruple signal processing means, performing a majority operation and driving a controlled object; A bypass means provided for each of the multiplexed signal processing means, for providing a non-trip signal to the power means in place of the signal processing means in the event of a failure of the corresponding signal processing means, and a function of the quadrupled signal processing means Until the establishment, a nuclear reactor safety protection device comprising: a state regulating unit that regulates a state such that the signal processing unit outputs a non-trip signal. 6. The reactor safety protection device according to claim 4, wherein said signal processing means is constituted by a microcomputer system.