JPS6140953B2 - - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION [Field of Industrial Application] The present invention relates to an interlock circuit for testing a nuclear reactor protection system.

[Prior Art] Various standards have been established for the reactor protection system, and according to these standards, the reactor protection system must be inspected periodically, so that its functionality can be tested at any time. Must be familiar. This is called the testability criterion.

In addition, the reactor protection system performs the actual protection operation based on the majority vote principle based on the normal and abnormal judgment signals given from other redundant protection systems. The reactor protection system during testing must be designed to generate a simulated abnormality signal so that a protective action can be taken in the event that a real abnormality occurs in the reactor during the test. This is called the single failure criterion. Single failure criteria are required when testing nuclear reactor protection systems, for example during periodic inspections.

An example of such a reactor protection system is shown in Figure 1. Figure 1 shows the reactor shutdown system of the reactor protection system. A reactor shutdown system is a system that inserts negative reactivity into a nuclear reactor from a critical or supercritical state to make the reactor subcritical, bring it from high-temperature shutdown to low-temperature shutdown, and bring it into shutdown state. equipment designed to have functions for maintaining (“Safety Design Review Guidelines for Light Water Nuclear Reactor Facilities for Power Generation” Atomic Energy Commission, June 14, 1978)
(From the definitions of terms on page 3) In Figure 1, D is a process signal detector, and the process signal detected by this is passed through the normally closed contact _A of the relay RL to the calculators C ₁ and C ₂ , _C3 , and undergoes predetermined signal processing. The output signals of arithmetic units C ₂ and C ₃ are sent to signal monitors B _{1 and} B 1 , respectively.
B given to ₂ . Two signal monitors, _B1 and _B2 , are provided to provide alarm signals regarding, for example, the upper and lower temperature limits of the reactor. A plurality of signal monitors are provided depending on the number of factors for determining whether or not protection of the nuclear reactor is necessary, such as upper and lower temperature limits. These signal monitors
B ₁ and B ₂ each judge the applied signal based on a reference value and generate a corresponding binary judgment signal. For this reason, the signal monitor B ₁ ,
_B2 monitors whether there are any abnormalities in the reactor. Note that a plurality of signal monitors other than two may be provided. SW ₁ and SW ₂ are test
There are two switches corresponding to the signal monitors. The output signals of signal monitors B ₁ and B ₂ are sent to the protection logic circuit through test switches SW ₁ and SW ₂ , respectively, which are connected to the normal contact side (NOR).
Given to G ₁ and G ₂ . For example, signal monitor B ₁ ,
An alarm signal of the upper limit value of the reactor temperature is transmitted through the system of test switch SW ₁ and protection logic circuit G ₁ , and the system of signal monitor B ₂ , test switch SW ₂ , and protection logic circuit G ₂ is transmitted to the reactor. An alarm signal of the lower temperature limit is transmitted. Judgment signals k and l are applied to the protection logic circuits G ₁ and G ₂ . These judgment signals k and l are generated by a nuclear reactor protection system having a configuration similar to that of the nuclear reactor protection system shown in FIG. The protection logic circuits G ₁ and G ₂ are, for example, 2-out
If at least two of the three determination signals from the reactor protection system match, the OBS3 circuit outputs a signal based on the majority rule as a reactor protection signal.

In order to satisfy the testability criteria, the operator C ₁
By switching the relay RL, a simulated input signal from the test jack TJ can be supplied to the test jack TJ, and by switching the test switches SW ₁ and SW ₂ , the signal monitors B ₁ and B ₂ can be supplied with a simulated input signal. The output signals can be supplied to test lamps BL ₁ and BL ₂ , respectively. This will cause the test lamp to
BL ₁ and BL ₂ light up when in test status. In addition, in order to satisfy the single failure criterion, test switches SW ₁ and SW ₂ are connected to the test side (TEST).
When the switch is switched to the protection logic circuits G ₁ and G ₂ , a "1" signal is given to the protection logic circuits G 1 and G 2 to indicate the occurrence of a pseudo abnormality.

In order to satisfy the single failure criterion, test switches SW ₁ and SW ₂ must be turned on to the TEST side during testing. Otherwise, when the simulated input signal is a signal corresponding to normality, a normality judgment signal will be given to the protection logic circuits G ₁ and G ₂ , so even if the process is abnormal at this time, one of them will be damaged due to a failure in the redundant protection system. This is because if only one system detects an abnormality, it will be considered normal by majority vote. Therefore, in the past, the test switch was configured using an interlock circuit as shown in Figure 2.
It specifies the relationship between switching SW ₁ and SW ₂ and excitation of relay RL. In other words, both test switches SW ₁ and SW ₂ are set to TEST by the logical product circuit AND.
Relay RL provided that it is inserted into the side
It is used to excite.

[Problem that the invention seeks to solve]

With such conventional interlock circuits, the single fault criterion is always satisfied during testing, but in view of the actual testing situation, such conditioning of the excitation of relay RL is inflexible in test execution. Become. In other words, in addition to tests that are carried out voluntarily during normal operation, there are tests that are carried out during test runs and tests that are carried out during periodic inspections. There are tests such as measuring the response time until actual protection is achieved, and checking the operation of arithmetic circuits and signal monitoring circuits in response to actual process signals. In these tests, the single failure criterion is not particularly required. In the former case, relay RL must be energized without switching test switches SW ₁ and SW ₂ to the TEST side, and in the latter case, test switches SW ₁ and SW ₂ must be switched to the TEST side.
Relay RL must be de-energized by switching to the TEST side. However, such a thing is impossible as long as the interlock shown in FIG. 2 is applied. Further, since the notification "Testing in progress" does not appear unless the test switches SW ₁ and SW ₂ are switched to the TEST side, depending on the type of test, the notification may not be displayed even if the test is in progress.

An object of the present invention is to provide an interlock circuit that is flexible for various tests.

[Means for solving problems]

a relay that switches between an actual input signal from a process signal detector and a simulated input signal from a test jack; a computing unit that performs predetermined signal processing on the signal input via the relay; and a nuclear reactor. A plurality of units are provided according to the number of factors for determining the necessity of protection of A number of signal monitors are provided corresponding to the number of signal monitors that monitor the presence or absence of abnormalities in the signal monitors, and the binary signals from the corresponding signal monitors are switched to the test side and the normal contact side, and A test switch that is on the test side during all tests to satisfy the single failure criterion, and when the test switch is on the test side,
A test lamp that displays the test status, and when the test switch is on the normal contact side, a majority decision is made based on the signal given from the signal monitor and the signals given from other reactor protection systems. It is used in a reactor shutdown system of a nuclear reactor protection system that has a protection logic circuit that generates a reactor protection signal based on the principle, and that the plurality of test switches are switched to the test side. calculating the logical sum of a first logical product circuit that calculates a logical product, that a removable logic bypass switch is installed, and that the plurality of test switches are switched to the test side;
A first logical sum circuit that outputs this logical sum to the central operation unit, and a logical sum of the logical bypass switch being in one of the binary states and the first logical sum product circuit, and the output signal thereof. a second OR circuit for displaying a second OR circuit; a simulated input switch provided near the test jack and switched to the test side when testing with a simulated input signal; and a simulated input switch for switching the simulated input switch to the test side The logical product of the fact that the switch has been switched and the output signal of the second OR circuit is calculated, and the output signal excites the relay to switch the input signal to the reactor protection system from the actual input to the simulated input. This is an interlock circuit for testing a nuclear reactor protection system, comprising a second AND circuit.

〔Example〕

The present invention will be explained below with reference to the drawings. FIG. 3 is a conceptual configuration diagram of an embodiment of the present invention. In FIG. 3, the portion surrounded by a dashed line is an improved portion according to the present invention. In other words, the switching state of the simulated input switch TJSW is used as one input of the AND circuit AND ₂ , and the _other input is the AND of the switching states of the test switches SW ₁ and SW ₂ or the logic bypass circuit. It is designed to give the switching state of the switch BYSW. Simulated input switch
TJSW is provided near the simulated input jack TJ, and is switched to the "TEST" side when testing by simulated input. The logic bypass switch BYSW is removable and is installed only during test runs and periodic inspections. The logic bypass switch BYSW is turned on when it is desired to energize the relay RL, regardless of the switching state of the test switches SW ₁ and SW ₂ . For these switches, "TEST" and "ON" respectively represent a logic signal of "1". The output state of the OR circuit _OR2 is displayed by the lamp EL. The lamp EL lights up when the signal is "1". Also, the logic bypass switch
The signal corresponding to the attachment/detachment from BYSW is a logical sum circuit.
OR given to ₁ . This signal is "1" when the logic bypass switch BYSW is "on" and "0" when it is "off". OR circuit OR ₁ contains logical bypass switches for other reactor protection systems.
A signal is given according to the attachment/detachment of BYSW. As a result, when at least one logical bypass switch BYSW is installed in the reactor protection system, the OR circuit _OR1 outputs a "1" signal. The output of the OR circuit OR ₁ is sent to the central control unit for the reactor.

[Effect]

FIG. 4 shows an example of the arrangement of each switch, each indicator lamp, and a simulated input jack. However, the logic bypass switch BYSW is mounted on a separate removable unit.

The operation of the interlock circuit thus constructed is as follows.

When testing the actual protection operation using a simulated input, leave test switches SW ₁ and SW ₂ in the NOR side and turn on the logic bypass switch.
Turn on BYSW. Then, the lamp EL will light up and "Test possible" will be displayed. Therefore, when the simulated input switch TJSW is switched to the TEST side, the output of the AND circuit AND ₂ becomes "1" and the relay RL is excited, and the open/closed states of the contacts Ac and Ao are alternated and the simulated input terminal TJ It becomes possible to supply a simulated input to the protection system. Therefore, the actual protection operation can be tested by varying the simulated input. In this case, the single failure criterion is not satisfied.

When testing the arithmetic units C ₁ , C ₂ , C ₃ and signal monitors B ₁ , B ₂ using actual inputs, switch the test switches SW ₁ and SW ₂ to the TEST side, and turn on the simulated input switch TJSW. Switch to NOR side. The logic bypass switch BYSW can be on or off. Then, the output of the AND circuit AND ₂ becomes "0" and the relay RL is no longer energized, and the open/closed states of the contacts Ac and Ao return to their original states. As a result, the actual input is given to the protection system, and the operation results of the arithmetic units C ₁ , C ₂ , C ₃ and the signal monitoring circuits B ₁ , B ₂ based on the input are displayed on the test lamps BL ₁ and BL ₂ , respectively. Ru. At this time, the lamp EL lights up and displays the status ``testable''.

When testing the computing units C ₁ , C ₂ , C ₃ and the signal monitors B ₁ , B ₂ by simulated input, the simulated input switch TJSW is turned to the TEST side in the above state. Then, by this, the logical product circuit AND ₂
The output of becomes “1” and relay RL is energized,
Contacts Ac and Ao switch to a state in which simulated input is possible. In this test and the actual input test described above, turning the logic bypass switch BYSW on and off has no effect, so these tests can be performed even when the logic bypass switch is not installed. In particular, the latter test is the same test that is performed at any time during normal operation, so the fact that it can be performed without the logical bypass switch BYSW means that the same test can be performed during normal operation when this switch is removed. It means that.

During the above three tests, the lamp EL is always lit to indicate "Test possible". Conversely, any of the above tests can be performed while the lamp EL is lit. In other words, when the lamp EL is on, test switches SW ₁ and SW ₂ are set to NOR.
If you set the simulated input switch TJSW to the TEST side, you can perform the first test above and set the test switch to the TEST side.
SW ₁ and SW ₂ on TEST side, simulated input switch TJSW
If you set it to the NOR side, you can perform the second test above,
The last test above can be performed by setting both switches to the TEST side. Note that when the lamp EL is lit, at least one of the test switches SW ₁ and SW ₂ is on the NOR side and the logic bypass switch BYSW is off or in the "off" state, so the simulated input switch TJSW is Testing cannot be performed regardless of the input state.

When testing, use a mock input switch.
In order to ensure that the lamp EL is lit regardless of the state of TJSW, a mock input switch is set.
Relay RL is excited by the AND of the output signals of TJSW and OR switch _OR2 .

When the logical bypass switch BYSW is installed, depending on its ON state, a test that does not satisfy the single failure criteria as described above may be performed. It is installed only when a test that does not satisfy the single failure criterion may be performed, such as in the case of a test, and this fact is notified to the central operation unit through the OR circuit _OR1 . On the other hand, when entering steady operation, the logic bypass switch BYSW is removed, so if the test switches on the same channel are not in the TEST state at this time, this notification will disappear. Therefore, the person executing the test can determine whether or not to shift to steady operation based on this notification.

In this way, the tester can know whether the test is possible by the flashing state of the lamp EL, and the test switch can also be used.
In order to be able to test the actual protection operation using a simulated input while SW ₁ and SW ₂ remain connected to the NOR side, a logic bypass switch is installed.
BYSW is provided.

〔Effect of the invention〕

As described above, the present invention provides a removable logic bypass switch that can be used as a test switch as well as a simulated input switch for conditioning the excitation of relays.
A switch is provided so that the relay can be excited by the simulated input switch and the logic bypass switch regardless of the switching state of the test switch. Therefore, an interlock circuit that is flexible for various tests can be obtained. In addition, since it is arranged to notify each of whether the test is possible or not and whether steady operation is possible, an easy-to-operate interlock circuit can be obtained.

[Brief explanation of the drawing]

Figure 1 is a conceptual configuration diagram of an example of a nuclear reactor protection system.
FIG. 2 is an example of a conventional interlock circuit, FIG. 3 is a conceptual block diagram of an embodiment of the present invention, and FIG. 4 is a layout diagram of switches and lamps in the embodiment of the present invention. D...Detector, _C1 to _C3 ...Arithmetic unit, _B1 , _B2 ...
...Signal monitor, SW ₁ , SW ₂ ...Test switch, BL ₁ , BL ₂ ...Test lamp, G ₁ , G ₂ ...
Protection logic circuit, AND...logical product circuit, OR...logical sum circuit, EL...lamp.

Claims (1)

[Claims] 1. An actual input signal from a process signal detector;
A relay that switches the input of the simulated input signal from the test jack, an arithmetic unit that performs predetermined signal processing on the signal input through the relay, and factors that determine whether or not protection of the reactor is necessary. a signal monitor, which is provided in a plurality according to the number of the arithmetic units, and which determines the signal from the arithmetic unit based on a reference value and generates a binary determination signal to monitor the presence or absence of an abnormality in the reactor; The number of connections corresponds to the number of signal monitors, and the binary signals from the corresponding signal monitors are switched between the test side and the normal contact side. When the test switch is also turned on the test side, and the test switch is on the test side,
A test lamp that displays the test status, and when the test switch is on the normal contact side, a majority decision is made based on the signal given from the signal monitor and the signals given from other reactor protection systems. It is used in a reactor shutdown system of a nuclear reactor protection system that has a protection logic circuit that generates a reactor protection signal based on the principle, and that the plurality of test switches are switched to the test side. calculating the logical sum of a first logical product circuit that calculates a logical product, that a removable logic bypass switch is installed, and that the plurality of test switches are switched to the test side;
a first logical sum circuit that outputs the logical sum to a central operation unit for the reactor, and a logical sum of the logic bypass switch being in one of the binary states and the first logical product circuit; a second OR circuit for displaying the output signal; a simulated input switch provided near the test jack and switched to the test side when performing a test using the simulated input signal; and the simulated input switch The logical product of the switching to the test side and the output signal of the second OR circuit is calculated, and the output signal excites the relay to input the input signal to the reactor protection system from the actual input to the simulated input. An interlock circuit for testing a nuclear reactor protection system, comprising: a second logical product circuit for switching to a reactor protection system;