KR100788826B1 - Apparatus and method for automatic test and self-diagnosis in digital reactor protection system - Google Patents

Abstract

An apparatus and a method for an automatic test and self-diagnosis in a digital reactor protection system are provided to reduce the complexity of a circuit and perform comparison and calibration of signals within the range of an input stage signal processor by using the digital reference input of the input stage signal processor to provide a reference signal. A digital reactor protection system(200) includes four channels(201) which monitor the operation state of reactor systems and channels. Each of the channels has two bistable processors, two coincidence processors, an initiation circuit, and an automatic test and interface processor. The bistable processor generates a trip signal by comparing an input signal value with a predetermined trip set value based on a plurality of detection signals indicating the state of the reactor system. The coincidence processor generates a final trip signal by performing the 2/4 logic combination of the trip signal from the bistable processor. The initiation circuit starts the driving of a reactor trip switchgear and an ESF-CCS(Engineered Safety Feature-Component Control System). The automatic test and interface processor collects the operation states of the bistable processor and the coincidence processor for the diagnosis of soundness, and generates the results of diagnosis.

Description

APPARATUS AND METHOD FOR AUTOMATIC TEST AND SELF-DIAGNOSIS IN DIGITAL REACTOR PROTECTION SYSTEM}

1 is a view for explaining the main configuration of a general nuclear power plant.

2 is a diagram illustrating a configuration of a digital reactor protection system according to an embodiment of the present invention.

3 is a diagram illustrating a detailed configuration of each channel of the digital reactor protection system according to an embodiment of the present invention.

4 is a diagram illustrating a function of an entire scheduler according to an embodiment of the present invention.

5 is a diagram illustrating a function of a channel scheduler according to an embodiment of the present invention.

6 is a diagram illustrating a configuration of an automatic test and associated processor according to an embodiment of the present invention.

7 is a block diagram illustrating a configuration of an input signal processing processor according to an embodiment of the present invention.

<Explanation of symbols for the main parts of the drawings>

300: channel

301a, 301b: comparative logic processors BP1, BP2

302a, 302b: simultaneous logic processors (CP1, CP2)

303: Remote stop room operator module (RSR OM)

304: Main control room operator module (MCR OM)

305: cabinet operator module (COM)

306: initiation circuit

307: automatic test and associated processor (ATIP)

The present invention relates to an apparatus and a method for testing the health of the digital reactor protection system and to provide a diagnostic function in order to increase the reliability and increase the availability of the digital reactor protection system of a nuclear power plant. When the test start signal is transmitted to the assigned channel scheduler, it is possible to automatically test whether the comparative logic processor and the simultaneous logic processor are malfunctioning one by one, and to diagnose the health of the sensor detection signals acquired from the reactor systems in the form of loop back. The present invention relates to a digital reactor protection system and a method thereof.

Nuclear power plants usually consist of more than 100 individual functions. They are largely nuclear-oriented nuclear steam supply systems (NSSS), secondary circulation cooling systems that deliver steam to generators, turbine generator systems that supply steam from secondary systems and run generators, and other accessories. It is divided into facilities. Looking at the pressurized light water reactor-type power plant, which is currently dominated by the Korean nuclear power plant, the primary system centered on the nuclear reactor, the secondary system including steam generators, turbines, generators and condensers, engineering safety equipment systems for accidents, transmission and distribution systems, It consists of measurement control system and other auxiliary systems.

1 is a view for explaining the main configuration of a general nuclear power plant (100). Referring to FIG. 1, the primary system of the nuclear power plant 100 includes a nuclear reactor 130, a pressurizer 140, a coolant pump 150, and a steam generator 160. The vehicle system generally includes a turbine 170, a generator 180, a condenser 190, and a feed pump 191.

Reactor 130 generates heat of about 1000 degrees Celsius when the nuclear fuel 120 is nuclear fission, and increases the temperature of the coolant to about 300 ?. In the pressurizer 140, the coolant is applied at a pressure of 160 kg / cm ² in the case of a hard water reactor, and the coolant is applied at a pressure of 110 kg / cm ² in the case of a heavy water reactor so that the coolant water does not boil even at 100 degrees Celsius or more. The coolant pump 150 performs a function of circulating the coolant of the primary system from the reactor 130 through the steam generator 160 to the reactor 130 again. The steam generator 160 performs a boiler function of a thermal power plant. The steam generator 160 transmits heat to the water supplied through the condenser 190 and the water supply pump 191 of the secondary system by the coolant of the primary system heated. To steam. The steam generated in this way rotates the turbine 170, and thus the generator 180 converts mechanical energy into electrical energy.

In order to monitor the health of each system while operating such a nuclear power plant, various types of sensors are installed in the reactor system and the detection signals from the sensors are monitored to determine the state of the nuclear power plant. To protect the reactor in case of abnormality in the system affecting the safety of the reactor or cooling function in the nuclear steam supply system during the operation of the nuclear power plant, the reactor protection system detects such an abnormal condition and stops the reactor shutdown function by dropping the control rod. And the engineering safety equipment operating system to cool the reactor. By performing these reactor protection functions, a nuclear power plant is kept safe even if an accident occurs, and radiation and radioactive materials are not leaked to the outside. Therefore, the reactor protection system plays the most important role in the safety and reliability of nuclear power plants. To be applied to the power plant site, the reactor protection system must be a system with high reliability and high precision. The function of stopping the reactor under any circumstances inside and outside the protection system is to be carried out, and the function of not stopping the reactor under conditions where it is not to be stopped.

To this end, reactor protection systems generally consist of systems that perform the same function of multiple channels. In addition, the reactor protection system includes a signal input unit for acquiring a detection signal from a sensor measuring a process variable that adversely affects the reactor, a comparison logic unit comparing the acquired process variable with a predetermined setting value, and a process variable setting value in the comparison logic unit. In case of exceeding, it consists of the simultaneous logic unit which generates the stop signal by combining the output of the comparative logic part of several channels, and the stop start circuit which drives the reactor stop circuit or the engineering safety equipment operation circuit according to the stop signal output from the simultaneous logic part. have.

Conventionally, a nuclear reactor protection system having the above configuration has been built on an analog basis, and an existing analog based reactor protection system is gradually replaced by a digital based reactor protection system. In analog-based reactor protection systems, all components are analog components and all tests must be performed manually. However, due to the high level of functionality of the digital system, the digital reactor protection system is generally performed periodically by the operator.

The present invention has been made to solve the problems of the prior art as described above, in order to improve the reliability and availability of the above-described digital reactor protection system, the digital reactor protection system by the conventional manual test or manual start automatic test. In addition to the test method, the objective is to provide a digital reactor protection system and method for automatically testing the reactor protection system function during reactor operation even if the operator does not intervene in the test at shorter time intervals.

In addition, the digital reactor protection system and the method according to the present invention is the integrity of the acquisition of the detection signals indicating the state of the reactor system in the form of a loop back (loop) in order to determine the health of the input stage as part of the monitoring and diagnostic function of the reactor protection system. The purpose of the present invention is to provide a processor monitoring function by comparing in-channel and inter-channel signals for passively monitoring the functions of the processors in the reactor protection system.

In order to achieve the above object and to solve the above-mentioned problems of the prior art, the digital reactor protection system according to an embodiment of the present invention includes four channels that operate independently, each of the four channels of the reactor system It monitors the operating state and the operating state of the channel, each of the four channels includes two comparative logic processors operating independently, each comparative logic processor is input based on a plurality of sensing signals representing the state of the reactor system A comparison logic processor (BP) for independently generating trip signals by comparing the signal values with previously stored trip set values; Including two simultaneous logic processors that operate independently, each simultaneous logic processor is a simultaneous logic processor for independently generating the final trip signal by logically combining the trip signals output from the comparison logic processor of each of the four channels 2/4 (CP: Coincidence Processor); Initiate the operation of the reactor trip switchgear to cause the reactor stop by dropping the control rod in response to the last trip signal, and the engineering safety equipment-equipment control system (ESF-CCS) for operating the engineering safety equipment (ESF). Initiation Circuits for starting the drive of the; And an automatic test and interface processor (ATIP) that collects the operating states of the comparative logic processor and the simultaneous logic processor in the channel and the other channels to diagnose the health and generate a diagnosis result. It is characterized in that the automatic operation of the operation state of the comparative logic processor and the simultaneous logic processor of the channel sequentially.

In addition, a method for automatically testing a digital reactor protection system including four channels of redundancy structure for operating independently and monitoring the operating state of the reactor systems and the channel according to an embodiment of the present invention, Each of the four channels includes a comparative logic processor including two independently operating comparative logic processors and a simultaneous logic processor including two independently operating concurrent processor, wherein any one of the four channels includes: Determining, among all four channels, a channel for performing the automatic test and transmitting a test start signal to the corresponding channel; And receiving, by the channel scheduler included in each of the four channels, the test start signal, and determining a sequential test order of two comparative logic processors and two simultaneous logic processors of the corresponding channel and performing a test command to the corresponding processor. And a step of repeating and automatically testing whether the eight comparative logic processors included in the four channels and the eight simultaneous logical processors are normally operated at predetermined intervals.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings and the contents described in the accompanying drawings, but the present invention is not limited or limited to the embodiments.

2 is a diagram illustrating a configuration of a digital reactor protection system according to an embodiment of the present invention.

As shown in FIG. 2, the digital reactor protection system 200 includes four channels 201, Channel A, B, C, and D, a redundancy operator module 202 (RSR OM), which has a redundancy structure. Main control room operator module (203, MCR OM). Although four or more channels may be configured, a redundancy structure of four channels is preferable in consideration of redundancy efficiency and circuit complexity, and the four channels are configured to maintain physical and electrical independence between channels. The remote stop room operator module 202 (RSR OM) and the main control room operator module 203 (MCR OM) can monitor and control the operating state of the reactor protection system.

In addition, the digital reactor protection system 200 is composed of a control device, a man-machine interface (MMI) related to test / diagnosis, and an engineering work station (EWS) for initially loading a set point. . The EWS is used to enter a setpoint and associated constants for each processor or hardware in the reactor protection system. External system has Tr. It consists of a CPC, a reactor trip unit (RTSG), and an engineering safety equipment-equipment control system (ESF-CCS). Here, Tr may be referred to as PI (Process Instrument).

The four channels (channel A, channel B, channel C, channel D) are driven completely independently from the sensor signal input terminal to the output terminal of each channel, and each of them through a communication method using a safety data link (SDL). A trip signal for each process variable of reactor systems output from a Bistable Processor (BP) of a channel is transmitted to a Coincidence Processor (CP) of another channel to exchange information between channels. Sensing signals for each process variable measured by the sensor include pressure, flow rate, frequency, and internal factor values calculated by the core protection calculator (CPC) and neutron flux monitoring system (ENFMS). Neutron Flux Monitoring System) includes neutron flux output values, and these values are input independently for each channel.

The sensor detection signals inputted to the input terminal are transmitted to the comparison logic processor BP to be compared with the trip setpoint stored in the comparison logic processor BP, and when the specific signal value exceeds the corresponding trip setpoint, the comparison logic processor (BP) generates a trip signal for that variable. The generated trip signal is transmitted through the safety data link to each simultaneous logic processor (CP of channel A, CP of channel B, CP of channel C, CP of channel D) in four channels. The simultaneous logic processor (CP) performs a 2/4 logic combination on the trip signal for each process variable output from the comparative logic processor (BP) in four channels to satisfy the logic, that is, from two of four channels. If the logic values are the same, the final trip signal is generated and sent to the initiating circuit. Upon receiving the final trip signal, the initiating circuit shuts down the control rod power through a reactor trip switch gear (RTSG) to drive a reactor stop by dropping the control rod, and the engineering safety equipment-equipment control system (ESF-). CCS: Engineered Safety Features-Component Control System (CCS) to cool the reactor.

Hereinafter, a detailed configuration of each channel will be described with reference to FIG. 3.

Each channel 300 of the digital reactor protection system 200 is a comparative logic processor (301a, 301b) of the redundant structure, simultaneous logic processors (302a, 302b) of the redundant structure, a remote stop operator module (303, RSR OM), It consists of main control room driver module 304 (MCR OM), cabinet driver module 305, COM, initiation circuit 306, automatic test and associated processor (307, ATIP), and other hardware devices. (OM: Operator Module) is connected through a data communication network.

Comparative logic processors (301a, 301b), simultaneous logic processors (302a, 302b), automatic test and associated processor (307, ATIP) uses a programmable logic controller (PLC). The digital controller (PLC) comprises an input / output module for processing analog and digital signals, a CPU module for performing protection logic, a communication module for processing data communication, and a power module. Remote stop room operator module (303, RSR OM) and main control room operator module 304 (MCR OM) can monitor and control the operating state of the reactor protection system.

The digital reactor protection system 200 satisfies the safety class (Class 1E) and is classified into seismic category I. In the case of software, the software installed in the cabinet driver module 305 and COM and the automatic test and associated processor 307 and ATIP are safety related, and the comparative logic processors 301a and 301b and the simultaneous logic processor 302a, 302b) are Safety Critical.

The comparative logic processor 301a and the simultaneous logic processor 302a are the first group, and the comparative logic processor 301b and the concurrent logic processor 302b are configured as a second group in a redundant structure. The first group and the second group in the channel are completely separated from the input module to the output module, and share sensor detection signals for each process variable and predetermined input signals for each trip variable. That is, only the processors belonging to each group are interconnected, and the comparative logic processors and the concurrent logic processors in different groups operate independently. The output of the comparative logic processor (e.g., BP1 output) is the same group and the same group simultaneous logic processor (CP1 of channel A, CP1 of channel B, CP1 of channel C, channel C) of the same channel and other channels through the safety data link (SDL). CP1 of D).

The comparison logic processors 301a and 301b acquire an input signal value based on the sensor detection signals, compare the value with the trip setting value, and determine a trip or pre-beat state. The sensor detection signal is converted into a digital signal through an input signal processing processor and transferred to the comparison logic processors 301a and 301b. All trip / pre-bit states and operation information generated by the comparative logic processors 301a and 301b are operated through the inter-channel network (ICN) and the remote stop operator module (303, RSR OM) and main control room operator module. (304, MCR OM), information processing system (IPS), cabinet operator module (305, COM), and automatic test and associated processor (307, ATIP).

In addition, the simultaneous logic processors 302a and 302b generate a final trip signal by logically combining two-by-variable trip signals output from the four channels of the logical logic processors. Simultaneous logic processors 302a and 302b transmit the generated final trip signal to the start circuit 306 and IC.

Initiation circuit 306 (IC: Initiation Circuit) is a series of watchdog timer (IC) to be started in the event of a CPU failure of the simultaneous logic processors (302a, 302b), it is configured in series and parallel It features. In addition, the initiating circuit 306 receives output signals from the simultaneous logic processors 302a and 302b of each group to stop the reactor through the reactor stop circuit breaker (RTSG) or to control the engineering safety equipment-equipment control system (ESF-CCS). Operate engineering safety equipment. The initiating circuit 306 implements the outputs of the two groups of concurrent logic processors 302a, 302b in half logic or logic that selects two outputs. The output of the reactor protection system initiation circuit is connected via the hardwire to the reactor stop circuit breaker (RTSG) of the corresponding channel, and the output of the engineering safety equipment-device control system (ESF-CCS) initiation circuit is connected to the engineering safety equipment-equipment through the optical cable. Control System Connects to the group controller of each division. In addition, each channel 300 uses a watchdog timer to detect operating states of simultaneous logic processors 302a and 302b and automatic test and associated processors 307 and ATIP.

The Automatic Test and Interface Processor (ATIP) 307 tests and monitors whether the functions of the comparative logic processors 301a and 301b and the simultaneous logic processors 302a and 302b are operating correctly. In addition, the operation state of each channel is transmitted to the other channel through the intra-channel data network (ICDN) and the operation state of the other channel is collected through the inter-channel communication network to compare the logical logic processor (BP) of the corresponding channel. And monitor the health of the concurrent logic processor (CP). Automated test and associated processor (307, ATIP) is an engineering safety facility-equipment control system through an engineering safety facility-device control system (ETIP, ESF-CCS Test & Interface Processor) and a safety data link (SDL). It receives the state information of the (ESF-CCS) and transmits it to the operator module (OM). In addition, the state signals in the channel, such as the state information of the reactor stop circuit breaker (RTSG) and the temperature signal of the cabinet, may be received as input through the hard wire.

Operator linkage of the digital reactor protection system 200 is composed of a remote stop room operator module (303, RSR OM), main control room operator module 304 (MCR OM) and the cabinet operator module (305, COM). Here, the remote stop room 303 (RSR: Remote Shutdown Room) and the main control room (304, MCR: Main Control Room) operate the reactor operation such as driving bypass and manual reset of the set value. The cabinet operator module 305 (COM: Cabinet Operator Module) performs various monitoring and manipulations for preventive maintenance and repair. These signals are initiated through a hardware switch and transmitted via hardwires to the associated comparative or concurrent logic processor.

In the cabinet operator module (305, COM), Trip-Channel Bypass (TCB), All-Channel Bypass (ACB), and Reactor Protection System Reset Breaker Reset (RPS Trip Circuit Breaker Reset) ), And reset the safety signal of the engineering safety equipment (ESF) through the hardware switch. The cabinet operator module 305 (COM) is composed of a touch screen, a computer, a trackball, a keyboard, and a manual control panel, and is installed at the front of the cabinet, one for each channel. The cabinet driver module 305 and COM are connected to the comparative logic processors 301a and 301b, the simultaneous logic processors 302a and 302b, the automatic test and the associated processor 307, and ATIP through the channel internal communication network. It is used as a gateway for transmitting the operation status of the protection system to the information processing system (IPS).

The digital reactor protection system 200 has three types of data communication networks for signal transmission between each processor module. The safety data link (SDL) sends the output of the comparative logic processors 301a, 301b to the simultaneous logic processors 302a, 302b, and uses unidirectional and deterministic protocols. The communication between the automatic test and associated processor (307, ATIP) and the engineering safety equipment-device control system (ESF-CCS) test and associated processor (ETIP) is also made up of SDL. The channel internal communication network (ICN) is used to exchange information between the comparative logic processors 301a and 301b, the simultaneous logic processors 302a and 302b, the automatic test and link processor 307 (ATIP), and the operator module (OM) in each channel. Used. Inter-channel data communication network (ICDN) is a communication network that connects channels to each other, and exchanges operation information between each channel's automatic test and associated processor (307, ATIP), and the QIAS (Qualified Indication & Alarm System) Perform communication between the test and associated processor (307, ATIP).

The digital reactor protection system 200 is equipped with a test and diagnostic function for checking whether the hardware and software of the system is operating as designed, and whether each processor is operating normally. Hereinafter, the test type will be described in order.

(1) Response time measurement test is a time taken when an arbitrary test signal is input to the reactor protection system input terminal by using an external response time test facility, and the time required until the corresponding signal corresponding to the test signal is output to the start circuit; The test is performed during shutdown of the nuclear power plant by verifying the accuracy of the output signal.

(2) The manual test is automatically performed when the operator inputs the variable, test value, etc. in the corresponding processor (BP or CP) of the channel to be tested through the cabinet operator module 305 or COM in the digital reactor protection system 200. The test and transmission to the associated processor (307, ATIP). The automatic test and associated processor 307 (ATIP) is a test for receiving the output result processed by the processor by inputting the variable and the test value to the corresponding processor and transmitting it to the cabinet driver module 305 (COM). When performing the manual test, since the channel variable to be tested causes a trip when the test is performed, the signal channel for the variable should be bypassed before starting the manual test. When the channel bypass signal (TCB) is input, each simultaneous logic processor (CP) switches from 2/4 simultaneous logic to 2/3 simultaneous logic, and the output from the channel performing the test is excluded from the concurrent logic. The manual test was the only test method in the conventional analog-based reactor protection system, but in the digital reactor protection system 200 currently applied to nuclear power plants, the manual start automatic test is performed in parallel with the manual test.

(3) Manual start automatic test is usually performed on a monthly basis when the operator inputs the test start through the cabinet operator module 305, COM, and transmits an input signal to the automatic test and associated processor 307 (ATIP) to compare the logic logic ( 301a, 301b) and simultaneous logic processors 302a, 302b. The automatic test and associated processor 307 (ATIP) automatically performs a test by providing test values to the comparative logic processors 301a and 301b and the simultaneous logic processors 302a and 302b. It is provided to the cabinet operator module 305, COM through a communication network. In order to prevent improper reactor shutdown by manual start automatic tests, only one channel is tested at a time, and only one group is tested within a channel.

(4) Hardware self-diagnosis is based on comparative logic processors (301a, 301b), simultaneous logic processors (302a, 302b), automatic test and interworking processors (307, ATIP), which are implemented as safety-grade programmable logic controllers (PLCs). And a digital processor such as a cabinet driver module 305 (COM) implemented as a general digital controller. The hardware self-diagnosis is executed continuously in the operating program that runs the operating system (OS) of each processor and checks the processor module operation check, application checksum check, communication module operation check, I / O module operation check, I / O channel Check the operation, etc. The diagnosis result thus confirmed is transmitted to each processor application program related to the digital reactor protection system 200, and the application program generates a reactor trip when it is found to be a major failure based on these results. In the event of a fault, the operator module and the plant alarm system provide the diagnostic results.

(5) The automatic test is performed in order to increase the reliability of the digital reactor protection system 200 and improve the utilization rate of the reactor protection system on a regular basis without the operator's intervention, unlike the manual test and the manual start automatic test. The test is automatically performed for the comparative logic processors 301a and 301b and the simultaneous logic processors 302a and 302b which perform core functions. The comparative logic processors 301a and 301b of the digital reactor protection system 200 have the function of automatically testing the comparative logic in their own, and the simultaneous logic processors 302a and 302b have the function of automatically testing the simultaneous logic in them. . The digital reactor protection system 200 should perform only one channel automatic test at a time and only one processor of four processors (BP1, CP1, BP2, CP2) should be tested at a time within the channel under test.

For this purpose, the entire scheduler manages the reactor protection system automatic tests to perform only one channel automatic test at a time, and the channel scheduler manages the automatic test in the channel so that only one processor can perform the test in the channel. One processor of the four logical logic processors may include the entire scheduler or the channel scheduler.

The entire scheduler determines a channel for performing the test among the four channels and transmits a test start signal. The channel scheduler receives a test start signal of a corresponding channel from the entire scheduler and configures the two comparison logic processors 301a and 301b constituting the comparison logic processor and the two simultaneous logic processors. A sequential test order of the processors 302a and 302b is determined to command a test to the processor. In this way, automatic tests are sequentially performed on the two comparison logic processors 301a and 301b and the two simultaneous logic processors 302a and 302b. For example, any one of two comparison logic processors (BPs) in any one of the four channels includes the entire scheduler, and two comparison logic processors (BPs) belonging to each of the four channels. Any one of these processors may include the channel scheduler.

Specifically, this will be described with reference to FIGS. 4 and 5.

As shown in FIG. 4, the entire scheduler may be in charge of the comparative logic processor BP1 of the first group of channel A, and the channel scheduler is the comparative logic processor of the first group of each channel (BP1 of channel A, channel). BP1 of B, BP1 of channel C, BP1 of channel D).

First, when the entire scheduler transmits the test start time to the channel scheduler BP1 every predetermined period, the corresponding comparison logic processor BP1 performs an automatic test, and when the automatic test is completed, sends a test completion signal to the full scheduler. send. Then, the entire scheduler receives the test completion signal from the channel scheduler BP1 and transmits a test start signal to the next channel scheduler BP2. For example, the entire scheduler generates an automatic test start signal in order of channel A, channel B, channel C, and channel D and transmits the signal to the channel scheduler of the corresponding channel. In this case, when the entire scheduler is included in the comparison logic processor BP1 of the channel A, the start signal is transmitted to the channel scheduler of the channel A in the same processor, and the safety data link (SDL, dotted line) is transmitted to the channel scheduler of the other channel. Transmits the start signal through

In addition, the entire scheduler inputs a test start signal to each channel scheduler and generates an automatic test error signal and stops the automatic test if a test completion signal of a channel is not input from the channel scheduler within a predetermined automatic test time.

In addition, when the entire scheduler receives the manual start auto test and manual test state from the auto test and associated processor 307 (ATIP), the test start signal is not generated when the manual start auto test and manual test state are in the manual scheduler.

As shown in FIG. 5, the first group comparative logic processor BP1 of each channel is responsible for the channel scheduler that manages the automatic test of each channel of the digital reactor protection system 200. The channel scheduler of each channel receives the test start signal of the corresponding channel from the entire scheduler and inputs the test start signal to each processor in the channel. In this case, the channel scheduler transmits a test start signal to the first group comparison logic processor BP1 in the same processor in the processor, and transmits a test start signal to the first group simultaneous logic processor CP1 in the channel in a safety data link ( SDL, dotted line), and a test start signal is transmitted to the second group comparison logic processor BP2 and the simultaneous logic processor CP2 by using a hard wire (solid line). Each processor transmits a processor test completion signal to the channel scheduler in the same manner as a test start signal input method. For example, the channel scheduler may generate a test start signal in the order of BP1, CP1, BP2, CP2 in the channel. The channel scheduler transmits a test completion signal to the entire scheduler when the automatic test of the corresponding channel is completed.

Comparative logic processors BP receive a test start signal from the channel scheduler and perform an automatic test. Comparative logic processors (BPs) generate values that cause trips of the comparison logic on their own to test that the comparison logic has no problem generating trips. The test results and status are provided to the automatic test and associated processor 307 (ATIP) and the cabinet operator module 305, COM via the channel internal network. At this time, the comparative logic processors (BP) block trip signals in its own processor so that an inappropriate trip does not occur during the automatic cycle test, so that trip signals are not transmitted to the simultaneous logic processor on the same channel and the simultaneous logic processor on the other channel. do. Comparative Logic Processors (BP) should remove the test signal after a certain test time has elapsed.

The simultaneous logic processors CP receive the test start signal from the automatic test channel scheduler and perform the automatic test. Automated testing of concurrent logic processors (CP) tests its 2/4 logic. The simultaneous logic processors (CP) generate a value that causes 2/4 of the logic to trip on their own, and test that 2/4 of the logic does not cause a problem. The test results and status are provided to the automatic test and associated processor (307, ATIP) and the cabinet operator module (305, COM) via the channel internal network. The simultaneous logic processors (CP) should remove the test signal after a certain test time has elapsed. Simultaneous Logic Processors (CP) block the trip signal in its own processor so that an inappropriate trip does not occur during the automatic test so that the trip signal is not transmitted to the start circuit.

(6) The health monitoring and diagnosis function monitors and diagnoses the health of the comparative logic processor (BP) and the simultaneous logic processor (CP) corresponding to the core functions of the digital reactor protection system 200, and compares each channel. Passive signals that determine the soundness of each processor by receiving signals transmitted from the logic processor (BP) and the simultaneous logic processor (CP) from the automatic test and associated processor (307, ATIP) and performing comparative analysis on signal levels and patterns. Is a test method.

Specifically, health monitoring and diagnostic functions will be described with reference to FIG. 6.

The automatic test and associated processor 307 (ATIP) receives a start signal for health monitoring and diagnosis from the cabinet operator module 305 (COM), and performs health monitoring and diagnosis every cycle of, for example, seconds. The automatic test and associated processor (307, ATIP) receives information for health monitoring and diagnosis from the comparative logic processor (BP) and the simultaneous logic processor (CP) of the same channel, and performs the internal monitoring and comparison of the other channels. It receives the information for monitoring and diagnosing the health of the channel from the automatic test and linked processor, and performs the comparison monitoring between channels. The automatic test and associated processor (307, ATIP) transmits the monitoring and diagnostic results to the cabinet operator module (305, COM).

To this end, the automatic test and associated processor 307 (ATIP) includes a comparative logic processor health monitoring and diagnosis unit 601, a simultaneous logic processor health monitoring and diagnosis unit 602 and a pulse rate monitoring unit 603.

First, the comparative logic processor soundness monitoring and diagnosis unit 601 performs 1) process variable value monitoring, 2) safety setpoint comparison monitoring, and 3) comparative logic trip / prebit state comparison monitoring of the comparative logic processor BP. . The comparison monitoring performs intra-channel comparison and inter-channel comparison, and transmits the comparison result to the cabinet driver module 305 (COM).

1) Process variable comparison monitoring of the comparison logic processor (BP) is to compare the A / D conversion values of the sensor detection signals of 4 channels with each other. The algorithm receives the A / D conversion value of the same variable from the automatic test of the other channel and the associated processor 307 (ATIP) through the inter-channel communication network. The interchannel comparison of process variables is performed on sensor detection signals of four channels of the same group. The automatic test and associated processor 307 (ATIP) outputs an error signal to the cabinet operator module when the value of the sensor detection signals for each process input to the comparative logic processor (BP) of the same channel deviates from the maximum value and the minimum value of the corresponding process value. 305, COM). The automatic test and associated processor (307, ATIP) determines the maximum value and the minimum value by using the process-specific sensor detection signals input to the four channels, and then if the difference between the maximum value and the minimum value is out of the defined error range, The signal should be displayed on the cabinet operator module (305, COM). In addition, the automatic test and associated processor (307, ATIP) receives the A / D conversion value of the sensor detection signals of the two comparison logic processor (BP) in the channel and monitors the values of the two groups compared with each other. If an error occurs, it is displayed on the cabinet operator module (305, COM).

2) Safety Setpoint Comparison Monitoring of Comparative Logic Processor (BP) As an automatic monitoring and linking processor (307, ATIP), the two sets of comparison logic processors (BP) are used for comparing logical setpoints (e.g., pre-rip / trip setpoint, hysteresis, and Receive time delay) through the channel internal network and compare and monitor. The automatic test and associated processor 307 (ATIP) monitors the hysteresis and time delay values present in itself and the hysteresis and time delay values provided by the comparative logic processor (BP). The automatic test and associated processor 307 (ATIP) receives a fixed pre-trip / trip set point of the comparative logic processor BP and tests the fixed set point by comparing it with its constant value. To test the manual reset variable setpoint algorithm, the automatic test and associated processor 307 (ATIP) inputs a fixed step value, current variable value, high / low limit value, current trip setpoint and pre-bit set point from the comparative logic processor (BP). Receive. The automatic test and associated processor 307 (ATIP) compares the fixed step value with its constant value, determines the difference between the current trip set point and the current variable value and tests whether the difference is less than or equal to the trip step value. The same test is done for the pre-beat set point. To test the rate-limiting variable setpoint algorithm, the automated test and associated processor 307 (ATIP) uses the comparison logic processor (BP) to determine the rate setpoint, the amount of change in the variable value, the high and low limit values (lower and upper setpoint values), trip and pre-bit setpoints. Verification is performed by receiving the amount and state of change. The automatic test and associated processor 307 (ATIP) compares the ratio set point and the high limit value with its constant value. Next, determine the difference between the previous trip set point and the current trip set point, and test if this difference matches the small value of the rate set point and the rate of change of the variable. The same test is done for the pre-beat set point.

3) Comparative Logic Trip / Prebit Trip State Monitoring, the automatic test and associated processor (307, ATIP) is a pre-trip state of trip logic (BP) of the digital reactor protection system 200 (a trip of a level lower than the trip set point). All trips) and trip status are correct. This test compares and compares the trip states of two logical logics in a channel and the same between two channels of logical logic. If it does not match, provide it to the cabinet operator module (305, COM). The same monitoring is carried out for the Yevit bit as well as for the trip.

Next, the simultaneous logic processor health monitoring and diagnosis unit 602 performs 1) simultaneous logic comparison monitoring, 2) bypass status monitoring and 3) digital output module monitoring.

1) Simultaneous logic comparison monitoring of the simultaneous logic processor (CP) The automatic test and associated processor (307, ATIP) verifies that the simultaneous logic works correctly for the reactor trip function and the engineering safety equipment-device control system initiation function. This test is carried out by receiving the reactor trip and engineering safety equipment-device control system start signal of the simultaneous logic processor (CP) of another channel through the inter-channel communication network from the automatic test and associated processor (307, ATIP) of each channel. The automatic test and associated processor 307 (ATIP) performs a test by comparing simultaneous logical trip and start signals of the same group between channels.

2) For monitoring the bypass status, the automatic test and associated processor (307, ATIP) receives the trip channel bypass status from the simultaneous logic processor (CP) and continuously monitors the bypass status. The automatic test and associated processor 307 (ATIP) receives a trip channel bypass state from two groups of simultaneous logic processors (CP) in the channel, and compares and monitors whether the bypass states of the two groups match. In addition, the automatic test and association processor 307 (ATIP) of each channel receives a trip channel bypass state from the automatic test and association processor of another channel, and monitors whether the trip channel bypass state is constant in all channels.

3) For the monitoring of the digital output module, the automatic test and associated processor (307, ATIP) is used to initiate the reactor trip in the simultaneous logic processor (CP), start the engineering safety equipment-device control system, and start the watchdog timer. Monitor the health of the digital output module. The automatic test and associated processor 307 (ATIP) provides the digital output module test signal to the simultaneous logic processor (CP) through the channel internal communication network. The automatic test and associated processor 307 (ATIP) receives a signal output from the digital output module of the simultaneous logic processor (CP) through the digital input module, and monitors the health of the simultaneous logic processor (CP) digital output module.

The pulsatile coefficient monitoring unit 603 monitors the pulsatile coefficients for the outputs from each processor (own channels BP1, BP2, CP1, CP2, and other channels of automatic testing and associated processors), and monitors the result of the cabinet operator module. Send to (305, COM). If heartbeat signal error occurs, health monitoring and diagnosis, automatic test, manual start automatic test shall be stopped.

(7) Input calibration The loopback test is a test to determine whether the sensor signal value for each process acquired at the analog-to-digital A / D converter terminal matches the reference signal level. For example, the input stage adjustment test may be performed in units of 18 months.

The input stage adjustment test is demonstrated with reference to FIG.

For the input stage test, the digital reactor protection system 200 adjusts a detection signal of a sensor for each process associated with the reactor systems based on an internal reference signal, and compares the digital value of the adjusted detection signal with the comparison logic processor BP. It further comprises an input signal processing processor for outputting.

The input stage signal processing processor includes an input port 701, a signal adjusting circuit 702, a switch 703, a D / A converter 704, an A / D converter 705, a communication module 706, and a memory 707. And a central processing unit 708 (CPU).

Central processing unit 708 (CPU) generates process-specific digital reference signals associated with the reactor systems and generates adjustment control signals and selection control signals. The CPU 708 may generate the digital reference signal to test whether there is no problem in converting the detection signal received from the process-specific sensor into a digital signal.

The input port 701 receives a detection signal of the sensor for each process. The signal adjustment circuit 702 adjusts the received detection signal in accordance with the adjustment control signal of the central processing unit 708 (CPU). The D / A converter 704 generates an analog reference signal from the digital reference signal of the CPU 708 (CPU). The switch 703 is the adjusted reference signal output from the signal adjustment circuit 702 or the analog reference output from the D / A converter 704 according to the selection control signal of the CPU 708 (CPU). Alternately selects signals. A / D converter 705 generates a first digital signal from the adjusted sense signal selected at switch 703 and a second digital signal from the analog reference signal selected at switch 703. . The memory 707 stores the first digital signal and the second digital signal.

The central processing unit 708 (CPU) generates the adjustment control signal to match the first digital signal with the second digital signal, and transmits the first digital signal to the comparison logic processor through the communication module 706. Control as possible.

In this way, the input stage signal processing processor may determine the functional integrity of the input stage and compensate for the presence of a bias between the reference signal and the actual signal.

The test method of the digital reactor protection system according to the present invention is implemented in the form of program instructions that can be executed by various computer means can be recorded on a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. Program instructions recorded on the media may be those specially designed and constructed for the present invention, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks, such as floppy disks. Magneto-optical media, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

As described above, although the present invention has been described with reference to limited embodiments and drawings, the present invention is not limited to the above embodiments, and those skilled in the art to which the present invention pertains various modifications and variations from such descriptions. This is possible.

Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined not only by the claims below but also by the equivalents of the claims.

As described above, the digital reactor protection system and the method according to the present invention can automatically test the function of the critical processor without operator intervention to improve the reliability of the digital reactor protection system and to quickly and accurately determine the status of the critical processor. It can be effective.

In addition, in the digital reactor protection system and method according to the present invention, the health monitoring of the signal processed in the processor is performed by performing comparative analysis using the signals of other channels as well as the input of the multiple processors of the magnetic channel through the health monitoring and diagnosis. There is an effect that can be identified more reliably.

In addition, in the digital reactor protection system and method according to the present invention, a reference signal is obtained by using a digital reference input of an input signal processor without requiring a sophisticated circuit device for providing an external reference signal for calibration of an input signal acquisition. By reducing the complexity of the circuit, it is possible to compare and adjust the signal within the range of the input signal processor.

In addition, in the digital reactor protection system and method according to the present invention, the automatic test function and the loop back input calibration function are applied not only to the reactor protection system of nuclear power plants, but also to the process protection system by the multi-channel method of other industries. It can work.

Claims (10)

In the digital reactor protection system, Including four channels operating independently, each of the four channels monitor the operating state of the reactor system and the operating state of the channel, Each of the four channels, It includes two comparative logic processors that operate independently, and each comparative logic processor independently generates a trip signal by comparing an input signal value with a previously stored trip set value based on a plurality of sensing signals representing the state of the reactor systems. Bistable Processor (BP); Including two simultaneous logic processors that operate independently, each simultaneous logic processor is a simultaneous logic processor for independently generating the final trip signal by logically combining the trip signals output from the comparison logic processor of each of the four channels 2/4 (CP: Coincidence Processor); Initiate the operation of a reactor trip switchgear to cause a reactor stop by dropping the control rod according to the final trip signal, and the engineering safety equipment-equipment control system (ESF-CCS) for operating the engineering safety equipment (ESF). Initiation Circuits for starting the drive of the; And Automatic Test and Interface Processor (ATIP) that collects the operating status of the comparative logic processor and the simultaneous logic processor in the channel and other channels to diagnose the health and generate the diagnostic result (ATIP) Including, A digital reactor protection system, characterized in that the automatic operation of the operation of the comparative logic processor and the simultaneous logic processor of each channel in a predetermined cycle sequentially. The method of claim 1, An entire scheduler which determines a channel for performing the automatic test among the four channels and transmits a test start signal to the corresponding channel; And A channel scheduler that receives the test start signal, determines a sequential test order of the two comparison logic processors and the two simultaneous logic processors, and instructs a test to the corresponding processor Digital reactor protection system comprising a. The method of claim 2, Any one of two comparative logic processors in any one of the four channels includes the full scheduler, And any one of two comparative logic processors belonging to each of the four channels includes the channel scheduler. The method of claim 2, The full scheduler, When the test completion signal is received from the channel scheduler of the channel that has transmitted the test start signal, the test start signal is transmitted to the channel scheduler of the next channel, and the test completion signal is received from the channel scheduler of each channel within a predetermined test period. Otherwise, generating a test error signal and stopping the automatic test. The method of claim 1, The automatic test and associated processor, Determining the functional health of the comparative logic processor in the channel and the other channel based on the information on the process variable value, trip set point and trip state associated with the reactor systems collected from the four channels of the comparative logic processors. Digital Reactor Protection System. The method of claim 1, The automatic test and associated processor, Determining the functional health of the simultaneous logic processor in the channel and the other channel based on the information about the simultaneous logic state and the bypass state collected from the simultaneous logic processors of the four channels, and digital output of the output stage of the corresponding logic processor of each channel Digital reactor protection system, characterized in that for diagnosing the operating state of the module. The method of claim 1, Each channel is And an input stage signal processing processor for adjusting a detection signal of a process-specific sensor associated with reactor systems based on an internal reference signal, and outputting a digital value of the adjusted detection signal to the comparison logic processor. Digital Reactor Protection System. The method of claim 7, wherein The input stage signal processing processor, A central processing unit for generating process-specific digital reference signals associated with the reactor systems, and generating adjustment control signals and selection control signals; An input port for receiving a detection signal of the sensor for each process; A signal adjustment circuit for adjusting the received detection signal in accordance with the adjustment control signal; A D / A converter for generating an analog reference signal from the digital reference signal; A switch for alternately selecting the adjusted detection signal output from the signal adjustment circuit or the analog reference signal output from the D / A converter according to the selection control signal; An A / D converter for generating a first digital signal from the adjusted sense signal selected at the switch and a second digital signal from the analog reference signal selected at the switch; And A memory for storing the first digital signal and the second digital signal Including, The CPU may generate the adjustment control signal to match the first digital signal and the second digital signal, and control the first digital signal to be transmitted to the comparison logic processor through a communication module. Digital Reactor Protection System. A method for automatically testing a digital reactor protection system that includes four channels of redundancy structure that operate independently to monitor the operational status of the reactor systems and the operational status of the channels. Each of the four channels comprises two independently operating comparative logic processors and two independently operating concurrent logic processors, Determining, from a total scheduler included in any one of the four channels, a channel for performing the automatic test among the four channels and transmitting a test start signal to the corresponding channel; And In the channel scheduler included in each of the four channels, receiving the test start signal, determining a sequential test order of two comparison logic processors and two simultaneous logic processors of the corresponding channel and performing a test command to the corresponding processor. Including, 8. The method for testing a digital reactor protection system according to claim 8, wherein the 8 comparative logic processors included in the 4 channels and 8 simultaneous logic processors are repeatedly tested automatically for a predetermined period. A computer-readable recording medium having recorded thereon a program for executing the method of claim 9.

Images