WO2025154878A1 - Nuclear reactor protection system using heterogeneous processors in master-slave relationship - Google Patents

Abstract

The present invention relates to a nuclear reactor protection system. According to one embodiment of the present invention, a nuclear reactor protection system using heterogeneous processors comprises: M channels that equally receive N different input signals, where M and N are integers greater than 1; and a pair of protection logic processors arranged on each of the M channels, which receive the N different input signals, perform protection logic, and generate a trip signal, wherein the pair of protection logic processors is configured within a single board in each of the M channels.

Description

Reactor protection system using heterogeneous processors in a master-slave relationship

The present invention relates to a nuclear reactor protection system, and more particularly, to a nuclear reactor protection system using heterogeneous processors in a master-slave relationship.

Figure 1 is a drawing for explaining the main configuration of a typical nuclear power plant (100). As shown in Figure 1, the primary system of the nuclear power plant (100) includes a reactor (130), a pressurizer (140), a coolant pump (150), and a steam generator (160), and the secondary system may include a turbine (170), a generator (180), a condenser (190), and a feedwater pump (191).

The reactor (130) increases the temperature of the coolant to about 300 degrees by generating heat of about 1000 degrees Celsius when the nuclear fuel (120) undergoes nuclear fission. In the pressurizer (140), the coolant is applied at a pressure of 160 kg/cm ² in the case of a light water reactor and at a pressure of 110 kg/cm ² in the case of a heavy water reactor so that the coolant water does not boil even at over 100 degrees Celsius.

The coolant pump (150) performs the function of circulating the primary system coolant that has passed through the steam generator (160) from the reactor (130) back into the reactor (130). The steam generator (160) performs the boiler function of a thermal power plant, and transfers heat to the feedwater that comes in through the secondary system condenser (190) and feedwater pump (191) by the heated primary system coolant, thereby converting the feedwater into steam. The steam generated in this way rotates the turbine (170), and accordingly, the generator (180) converts mechanical energy into electrical energy.

In order to monitor the health of each system while operating a nuclear power plant like this, various types of sensors are installed in the reactor system, and the detection signals from the sensors are monitored to determine the status of the nuclear power plant.

If an abnormality occurs in a system that affects the safety of a nuclear reactor during the operation of a nuclear power plant or in the cooling function of the nuclear steam supply system, the reactor protection system detects such abnormalities to protect the reactor, operates the reactor stop function by dropping the control rod, and operates the engineering safety equipment operation system to cool the reactor. By performing these reactor protection functions, even if an accident occurs at the nuclear power plant, the nuclear power plant is maintained in a safe state and radiation and radioactive materials are prevented from leaking to the outside.

Therefore, the reactor protection system is a system that plays the most important role in the safety and reliability of nuclear power plants. In order to be applied to power plant sites, it must be a system with high reliability and high precision. In addition, when the reactor must be stopped, the reactor protection system must be able to perform the function of stopping the reactor in any environment inside or outside the reactor protection system.

To this end, the reactor protection system is generally composed of a plurality of channels that perform the same function. In addition, the reactor protection system is composed of a signal input section that acquires detection signals from sensors that measure various process variables and transmits them to a plurality of channels, a comparison logic section that compares the acquired detection signals for each process variable with pre-stored set values, a simultaneous logic section that generates a trip signal by combining the outputs of the comparison logic sections of a plurality of channels when the sensor detection signals for each process variable in the comparison logic section exceed the set value, and a stop initiation circuit that drives the reactor stop circuit or the engineering safety equipment operation circuit according to the stop signal output from the simultaneous logic section.

Figure 2 is a functional block diagram briefly explaining the concept of a digital reactor protection system having one type of processor on a single board in a conventional same channel.

As illustrated in FIG. 2, the digital reactor protection system (200) is composed of four channels (Channel A, B, C, D) (211, 212, 213, 214) with a redundancy structure. The channels may be composed of four or more, but a four-channel redundancy structure is preferable in consideration of redundancy efficiency and circuit complexity. The remote shutdown room operator module and the main control room operator module (not illustrated) are connected to the four channels (211 to 214) to monitor and control the operating status of the reactor protection system.

In addition, the digital reactor protection system (200) is composed of a control device and a man-machine interface (MMI: Man-Machine Interface) related to testing/diagnosis, and an engineering workstation (EWS: Engineering Work Station) for initially loading the settings. The EWS is used to input the settings and related constants for each processor or hardware in the reactor protection system. The external system is composed of Tr. CPC, reactor trip device (RTSG), and engineering safety facility-equipment control system (ESF-CCS). Here, Tr can be expressed as PI (Process Instrument).

The above four channels (211 to 214) are driven completely independently from the sensor signal input terminal to the output terminal of each channel on the same board, and transmit the trip signals (240) for each process variable of the reactor systems output from the comparative logic processors (231 to 234) of each channel to the simultaneous logic processors (251 to 254) of the other channels through a communication method by the Safety Data Link (SDL), thereby exchanging information between each channel. The sensor detection signals (220) for each process variable measured by the sensor include the pressure, flow rate, and water content of each system, the factor values inside the reactor calculated by the Core Protection Calculator (CPC), and the neutron flux output value measured by the Ex-core Neutron Flux Monitoring System (ENFMS), and these values are input independently for each channel.

Sensor detection signals (220) input to the input terminals of each channel (211 to 214) are transmitted to comparison logic processors (231 to 234) and compared with trip setpoints stored within the comparison logic processors (231 to 234), and when a specific signal value exceeds the corresponding trip setpoint, the comparison logic processors (231 to 234) generate trip signals (240) for the corresponding variable. The generated trip signals (240) are transmitted to the respective simultaneous logic processors (251 to 254) in the four channels (211 to 214) via the safety data link.

The simultaneous logic processors (251 to 254) perform a 2/4 logic combination on the trip signals (240) for each process variable output from the comparison logic processors (231 to 234) in the 4 channels (211 to 214) and, if the logic is satisfied, that is, if the corresponding logic values from 2 out of the 4 channels are the same (Voting), generate a final trip signal (not shown) and transmit it to an initiation circuit (not shown). When the initiation circuit receives the final trip signal (not shown), it cuts off the control rod power through the reactor trip switch gear (RTSG) to stop the reactor due to the control rod dropping, and drives the engineered safety features (ESF-CCS) to cool the reactor.

As illustrated in FIG. 2, for the diversity of the reactor protection system (200), channel A (211) may be configured with a type A comparison logic processor (231) and a type A simultaneous logic processor (251) on a single board, channel B (211) may be configured with a type B comparison logic processor (232) and a type A simultaneous logic processor (252) on a single board, channel C (213) may be configured with a type A comparison logic processor (233) and a type B simultaneous logic processor (253) on a single board, and channel D (314) may be configured with a type B comparison logic processor (234) and a type B simultaneous logic processor (254) on a single board.

As illustrated in Fig. 2, the type A comparison logic processors (231, 233) of channel A (211) and channel C (213) equally receive all sensor detection signals (220) from the sensor signal input terminal and perform comparison logic.

In this case, if the type A comparison logic processor (231, 233) of channel A (211) and channel C (213) fails, channel A (211) and channel C (213) will not operate. Of course, channel B (212) and channel D (214) configured with type B processors receive the same sensor detection signals (220) and perform protection logic, but since two channels are used, the range of protection logic is limited. That is, since the 2oo4 logic is changed to 2oo2 or 2oo3 logic, there is a problem that the reliability of the logic is reduced.

[Prior art literature]

[Patent Document]

(Patent Document 1) Korean Patent Publication No. 10-2016-0052861 (Nuclear reactor protection system including heterogeneous control devices, Korea Atomic Energy Research Institute)

(Patent Document 2) Korean Patent Publication No. 10-0848881 (Digital Reactor Protection System, Samchang Enterprise)

An object of the present invention to solve the above-mentioned problems is to provide a reactor protection system with greatly improved diversity against common cause failure modes that may occur in a reactor protection system.

However, the problem to be solved by the present invention is not limited thereto, and may be expanded in various ways without departing from the spirit and scope of the present invention.

According to one embodiment of the present invention, a nuclear reactor protection system using heterogeneous processors comprises M channels that equally receive N different input signals, where M and N are integers greater than 1, and a pair of protection logic processors arranged on each of the M channels, which receive the N different input signals, perform protection logic, and generate a trip signal, wherein the pair of protection logic processors can be configured within a single board in each of the M channels.

The input signals of the N different items may include at least one of pressure, temperature, flow rate and radioactivity measured in the reactor.

The above protection logic processor can perform comparison logic (Bistable Processor) and coincidence logic (Coincedence Processor).

Each of the pair of protection logic processors implemented within a single board of each of the above M channels can equally receive input signals of the N different items.

Each of the pair of protection logic processors implemented within a single board of each of the above M channels may be implemented heterogeneously.

The pair of protection logic processors implemented within a single board of each of the above M channels may be composed of different heterogeneous processors.

Each of the above different heterogeneous processors can be configured as a master or a slave.

The above different heterogeneous processors are configured to cross-monitor each other, but a processor designated as the master may have control priority.

The above M channels can be composed of boards of the same type and of different types.

The above same type of board can have the same type of protection logic processor operate as master and slave.

In the above cross-monitoring, if the master is disabled, the slave has control priority and performs the protection logic of the master, and transmits a selection signal to the output path so that the output of the slave becomes a trip signal.

The disclosed technology may have the following effects. However, this does not mean that a specific embodiment must include all or only the following effects, and thus the scope of the disclosed technology should not be construed as being limited thereby.

First, the controllers within a single board that constitute the channel of the reactor protection system are configured heterogeneously, so that even if a common cause failure occurs in a controller of one type, the controllers of other types can perform safety functions, thereby improving the safety of the channel.

Second, the controllers in one channel are configured as master-slave, so that the channel can maintain normal control functions even if one of them fails.

Third, heterogeneous controllers are configured as master-slave on one channel, so that even if a common cause failure occurs in one controller on one channel, normal control functions can be performed on the same channel.

Fourth, by combining and using different types of controllers with different master-slave assignments for each model, the immunity to common-cause failures of the reactor protection system can be greatly improved.

Figure 1 is a drawing to explain the main components of a typical nuclear power plant.

Figure 2 is a functional configuration diagram briefly explaining a method for securing diversity in an existing digital nuclear reactor protection system.

FIG. 3 is a functional configuration diagram briefly explaining the channel configuration of a digital nuclear reactor protection system based on heterogeneous processors according to one embodiment of the present invention.

FIG. 4 is a functional configuration diagram briefly explaining a method for securing diversity within a channel of a digital reactor protection system according to another embodiment of the present invention.

FIG. 5 is a functional configuration diagram briefly explaining a method for securing diversity of a digital reactor protection system according to another embodiment of the present invention.

The present invention can be modified in various ways and has various embodiments, and specific embodiments are illustrated in the drawings and described in detail in the detailed description. However, this is not intended to limit the present invention to specific embodiments, and it can be understood that it includes all modifications, equivalents, or substitutes included in the technical spirit and technical scope of the present invention. In describing the present invention, if it is determined that a specific description of a related known technology may obscure the gist of the present invention, the detailed description thereof will be omitted.

The terms first, second, etc. may be used to describe various components, but the components are not limited by the terms. The terms are used only to distinguish one component from another.

The terms used in the present invention are only used to describe specific embodiments and are not intended to limit the present invention. The terms used in the present invention were selected from widely used general terms as much as possible while considering the functions of the present invention, but this may vary depending on the intention of a technician working in the relevant field, precedents, or the emergence of new technologies. In addition, in certain cases, there are terms arbitrarily selected by the applicant, and in this case, the meanings thereof will be described in detail in the description of the relevant invention. Therefore, the terms used in the present invention should be defined based on the meanings of the terms and the overall contents of the present invention, rather than simply the names of the terms.

Singular expressions include plural expressions unless the context clearly indicates otherwise. In the present invention, it should be understood that terms such as "comprise" or "have" are intended to specify the presence of a feature, number, step, operation, component, part or combination thereof described in the specification, but do not preclude the possibility of the presence or addition of one or more other features, numbers, steps, operations, components, parts or combinations thereof.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. When describing with reference to the accompanying drawings, identical or corresponding components are assigned the same drawing numbers and redundant descriptions thereof are omitted.

FIG. 3 is a functional configuration diagram briefly explaining the channel configuration of a digital nuclear reactor protection system based on heterogeneous processors according to one embodiment of the present invention.

As illustrated in FIG. 3, a channel board forming part of the reactor protection system of the present invention has a heterogeneous-based protection logic processor (330, 331) (including a comparison logic processor and a simultaneous logic processor).

That is, a first type-based protection logic processor (comparison and simultaneous logic processor) and a second type-based protection logic processor (comparison and simultaneous logic processor) are arranged in channel A (310) and channel B (311). The first type-based and second type-based protection logic processors in channel A (310) and channel B (311) receive sensor detection signals (P, T, F, N) (300) for each process variable through input paths (320, 321).

The input path (320) of channel A (310) can select some of the sensor detection signals (P, T, F, N) (300) for each process variable and provide them to the first type-based protection logic processor (330), and can select and provide the remaining signals, excluding the sensor detection signals (300) for each process variable provided to the first type-based protection logic processor (330), to the second type-based protection logic processor (331). That is, the input path (320) of channel A (310) can provide the sensor detection signals pressure (P) and temperature (T) to the first type-based protection logic processor (330), and can provide the flow rate (F) and radiation (N) excluding the sensor detection signals P and T to the second type-based protection logic processor (331).

On the other hand, the input path (321) of channel B (311) can operate in a manner that provides sensor detection signals pressure (P) and temperature (T) to the second type-based protection logic processor (332) within channel B (311), and provides flow rate (F) and radiation (N) excluding the sensor detection signals P and T to the first type-based protection logic processor (331).

In addition, each of the output paths (340, 341) of channel A (310) and channel B (311) can bypass or combine the outputs of each of the protection logic processors (330, 331, 332, 333) in a predetermined combination according to the operation of the input paths (320, 311) of each channel to output the final trip signal (450, 451). For example, the first type and the second type can be configured with different types of devices such as FLASH, SRAM, etc.

FIG. 4 is a functional configuration diagram briefly explaining a method for securing diversity within a channel of a digital reactor protection system according to another embodiment of the present invention.

As illustrated in FIG. 4, a board of a channel forming part of the nuclear protection system of the present invention has a heterogeneous-based protection logic processor (430, 431). Here, the protection logic processor may include a comparison logic processor and a simultaneous logic processor.

According to one embodiment, a first type-based protection logic processor and a second type-based protection logic processor may be co-located in channel A (410) and channel B (411). Here, the first type-based protection logic processor may be configured with FLASH, and the second type-based protection logic processor may be configured with SRAM. For example, the first type may be FLASH, and the second type may be SRAM, or vice versa.

As illustrated in FIG. 4, the first type-based protection logic processor (430, 433) and the second type-based protection logic processor (431, 432) within channel A (410) and channel B (411) receive sensor detection signals (P, T, F, N) (400) for each process variable through input paths (420, 421).

As an example, the input path (420) of channel A (410) may select some of the sensor detection signals (P, T, F, N) (400) for each process variable and provide them to a first type-based protection logic processor (430), and may select and provide the remaining signals, other than the sensor detection signals (400) for each process variable provided to the first type-based protection logic processor (430), to a second type-based protection logic processor (431).

That is, the input path (420) of channel A (410) can provide the sensor detection signals pressure (P) and temperature (T) to the first type-based protection logic processor (430), and can provide the flow rate (F) and radiation (N) excluding the sensor detection signals P and T to the second type-based protection logic processor (431). On the other hand, the input path (421) of channel B (411) can operate in a manner of providing the sensor detection signals pressure (P) and temperature (T) to the second type-based protection logic processor (432) within channel B (411), and providing the flow rate (F) and radiation (N) excluding the sensor detection signals P and T to the first type-based protection logic processor (431).

In addition, each of the output paths (440, 441) of channel A (410) and channel B (411) can bypass or combine the outputs of each of the protection logic processors (430, 431, 432, 433) in a predetermined combination according to the operation of the input paths (320, 311) of each channel to output the final trip signal (450, 451).

As illustrated in FIG. 4, in one embodiment of the present invention, heterogeneous protection logic processors (430, 431) within channel A (410) can be configured to cross-monitor (M) each other. That is, they can cross-monitor whether the counterpart processor is operating normally or is in a disabled state. Various monitoring methods, such as an active signal, a counter, and a voltage signal, can be used to cross-monitor in real time whether the counterpart process is disabled.

As a result of the monitoring (M), if the master, i.e., the protection logic processor (430) based on the first type of channel A (410), operates normally, the slave, i.e., the protection logic processor (431) based on the second type does not operate.

However, if the master (430) becomes incapacitated and the slave (431) recognizes the master's incapacity, the slave (431) has control authority. Here, the control authority can cause the slave, i.e., the second type-based protection logic processor (431), to automatically perform the same protection logic processing that the master, i.e., the first type-based protection logic processor (430) was performing, and at the same time, transmit a selection signal (S) to select and output a signal of the second type-based protection logic processor (431) to the output path (440).

Likewise, the protection logic processors (432, 433) and output path (441) within channel B (411) perform the same operations as the protection logic processors (430, 431) and output path (440) within channel A (410) described above.

The configuration of channel A (410) illustrated in Fig. 4 is A-Type, in which the protection logic processor (430) based on the first type becomes the master and the protection logic processor (431) based on the second type becomes the slave. On the other hand, the configuration of channel B (411) is B-Type, in which the protection logic processor (430) based on the second type becomes the master and the protection logic processor (431) based on the first type becomes the slave.

On the other hand, in order to prevent the failure of the first type-based protection logic processor (430) and the second type-based protection logic processor (431) of channel A (410) from electrically affecting each other, the power supply of the first type-based protection logic processor (430) and the power supply of the second type-based protection logic processor (431) are provided separately.

In addition, in order to isolate the protection logic processor (430) based on the first type of channel A (410) and the protection logic processor (431) based on the second type of channel A, the grounding within the board is independently configured, so that although it is physically the same board, it has a completely independent configuration in terms of electrical characteristics. In the case of channel B (411), it also has a configuration in the same form as the power and grounding configuration of channel A (410).

FIG. 5 is a functional configuration diagram briefly explaining a method for securing diversity of a digital reactor protection system according to another embodiment of the present invention.

As illustrated in FIG. 5, the nuclear reactor protection system (500) of the present invention is composed of a combination of an A-Type board of channel A (410) and a B-Type board of channel B (411) illustrated in FIG. 4.

As shown in Fig. 5, for example, in the A-Type, a FLASH-based protection logic processor becomes the master, and a SRAM-based protection logic processor becomes the slave. On the other hand, in the B-Type, a SRAM-based protection logic processor becomes the master, and a FLASH-based protection logic processor becomes the slave.

In another embodiment, as illustrated in FIG. 5, channels A and C may be configured as A-Type, and channels B and D may be configured as B-Type, but the Type setting for each channel may be configured as a combination of various methods.

In the configuration of FIG. 5, when the master processors (511, 513, 515, 517) of channels A, B, C, and D operate normally, the entire protection logic of the reactor protection system (500) performs 2out4 voting protection logic, and if a failure occurs in FLASH, the master (511) of channel A and the master (515) of channel C become disabled, and at this time, the SRAM-based slave (512) of channel A and the slave (516) of channel C perform the protection logic processing that the masters (511, 515) were performing. At the same time, the master (511) or slave (512) of channel A transmits a selection signal (S) for a signal to be output to the output path, and the output path determines the signal path according to the selection signal (S). That is, the output path switches to the master output path or the slave output path depending on the selection signal (S).

In this way, by the configuration of FIG. 5, which is an embodiment of the present invention, even if a common cause failure due to a FLASH or SRAM failure occurs in the reactor protection system (500), the entire protection logic of the reactor protection system (500) can perform the 2out4 voting protection logic as it is, thereby improving the reliability and durability of the reactor protection system (500).

[Explanation of symbols]

310, 311, 410, 411, 521 to 524 : Channels

300, 400: Sensor detection signals

320, 321, 420, 421 : Input path

330 to 333, 430 to 433, 511 to 518: Protection logic processor

340, 341, 440, 441 : Output path

350, 451: Trip signal

Claims (11)

A reactor protection system using heterogeneous processors is M channels that receive input signals of N different items equally, where M and N are integers greater than 1; and It is composed of a pair of protection logic processors arranged in each of the above M channels and receiving input signals of the N different items, performing protection logic, and generating a trip signal. A nuclear reactor protection system using heterogeneous processors, wherein the above pair of protection logic processors are configured within a single board in each of the M channels. In the first paragraph, A nuclear reactor protection system using heterogeneous processors, wherein the input signals of the N different items include at least one of pressure, temperature, flow rate, and radioactivity measured in the nuclear reactor. In the first paragraph, The above protection logic processor is a nuclear reactor protection system using heterogeneous processors that perform comparison logic (Bistable Processor) and coincidence logic (Coincedence Processor). In the first paragraph, A nuclear reactor protection system using heterogeneous processors, wherein each of the pair of protection logic processors implemented within a single board of each of the M channels receives input signals of the N different items in the same manner. In the first paragraph, A nuclear reactor protection system using heterogeneous processors, wherein each of the pair of protection logic processors implemented within a single board of each of the above M channels is implemented heterogeneously. In the first paragraph, A nuclear reactor protection system using heterogeneous processors, wherein the pair of protection logic processors implemented within a single board of each of the above M channels are composed of different heterogeneous processors. In Article 6, The above different heterogeneous processors are each configured as a master or slave. Reactor protection system using heterogeneous processors. In Article 7, A nuclear reactor protection system using heterogeneous processors, wherein the above different heterogeneous processors are configured to cross-monitor each other, and a processor designated as the master has control priority. In Article 8, A nuclear protection system using heterogeneous processors, wherein the above M channels are composed of boards of the same type and non-identical types. In Article 9, The above-mentioned same type of board is a nuclear protection system using heterogeneous processors, in which the protection logic processor of the same type operates as a master or slave. In Article 8, A nuclear reactor protection system using heterogeneous processors, in which, in the case where the master is incapable of monitoring the above crossover, the slave has control priority and performs the protection logic of the master, and transmits a selection signal to the output path so that the output of the slave becomes a trip signal.