NUCLEAR POWER PLANT DEFENSE-IN-DEPTH SAFETY APPARATUS HAVING DIVERSITY

The present invention relates to a nuclear power plant defense-in-depth safety apparatus having diversity, comprising: an analog type first control unit for generating an operation signal for a safety system; a digital type second control unit for generating an operation signal for the safety system; and a device interface module for receiving the operation signal of the first control unit and the operation signal of the second control unit and applying the operation signal of the first control unit to the safety system as a top priority.

TECHNICAL FIELD

The present invention relates to a defense-in-depth safety apparatus with diversity in a nuclear power plant.

BACKGROUND ART

A safety system for a nuclear power plant plays a critical role in operating the nuclear power plant safely.

With digitalization of the nuclear power plant, the safety system is also controlled by a digitalized control device. However, the digital control device is operated by a computer program made of complex software and thus there is a possibility to incur errors in the digital control device. For this problem, countries including the United States require thorough verification of safety of such a digital device.

DISCLOSURE

Technical Problem

Accordingly, an object of the present invention is to provide a defense-in-depth safety apparatus with diversity in a nuclear power plant.

Technical Solution

The object of the present invention can be accomplished by providing a diverse defense-in-depth safety apparatus with diversity in a nuclear power plant, the apparatus including: an analog-type first controller configured to generate an operation signal for a safety system; a digital-type second controller configured to generate an operation signal for the safety system; and a component interface module (CIM) configured to receive the operation signal from the first controller and the operation signal from the second controller, and apply first the operation signal from the first controller to the safety system as a top priority.

The operation signal from the second controller may include an engineered safety feature component control system signal (ESF-CCS) and a diversity protection system signal.

The safety system may include at least one of a safety injection system, a main steam isolation system, a containment spray system, or a steam generator auxiliary feedwater system.

The first controller may be not affected from a common mode failure of the second controller.

The first controller may include a selector that allows an operator to select operation by the first controller.

The apparatus may further include a selector that allows the operator to select operation by the first controller.

The apparatus may further include a display unit that is not affected from a common mode failure of the second controller and displays an emergency operation state.

The first controller, the second controller, and the display unit may be installed inside a main control room.

Advantageous Effects

According to the present invention, there is provided a defense-in-depth safety apparatus with diversity in a nuclear power plant. With this apparatus, it is possible to safely maintain the nuclear power plant in any case, thereby preventing a severe accident, corresponding a beyond design basis accident, in advance and securing economic effects thereby.

MODE FOR INVENTION

The accompanying drawings correspond to merely an example shown to illustrate technical scope of the present invention more detail, and the scope of the present invention is not limited to the accompanying drawings. In addition, for explanation of a relationship between elements, size and spacing may be shown differently from actual implementation.

With reference toFIGS. 1 and 2, a defense-in-depth safety apparatus according to a first embodiment of the present invention will be described.

FIG. 1is a diagram showing configuration of the defense-in-depth safety apparatus according to the first embodiment of the present invention, andFIG. 2is a diagram showing physical arrangement of the defense-in-depth safety apparatus according to the first embodiment of the present invention.

A safety apparatus1according to the first embodiment of the present invention includes a first controller10, a second controller20, a component interface module (CIM)40, and a display unit50.

The first controller10and the second controller20generate operation signals to operate a safety system. The first controller10is operated in an analog type. That is, the first controller10generates an operation signal according to direct manipulation of an operator. The second controller20is operated in a digital type. That is, the second controller20generates an operation signal by a computer program, and manipulation by an operator is allowed in this course.

The second controller20generates an engineered safety feature component control system signal (ESF-CCS) and a diversity protection system signal to operate the safety system. The ESF-CCS relates to safety of systems excluding a reactor at an emergency, and the diversity protection system signal is to stop the rector at the emergency. The ESF-CCS and the diversity protection system signal are generated from different platforms. These platforms are operated by computer software, and failure may occur in the platforms. However, a common mode failure may occur in these platforms, and, in this case, the second controller20does not generate an operation signal that enables the safety system to operate properly.

Meanwhile, the first controller10is operated in an analog type and not affected from the common mode failure of the second controller20. Thus, although the common mode failure occurs in the second controller20, the first controller10is able to generate a normal operation signal.

The first controller10includes a selector11. The selector11may be provided in a physical analog switch form or in a digital form. The selector11may enable selecting operation of the safety system by the first controller10, and may be manipulated by an operator.

The CIM40receives operation signals from the first controller10and the second controller20, and transmits one of the operation signals to the safety system by a predetermined logic. If an operation signal is generated in the first controller10and or if the selector30is operated to select an operation signal from the first controller10, the CIM40transmits only the operation signal from the first controller10to the safety system. That is, the CIM40transmits first the operation signal from the first controller10to the safety system as a top priority.

The CIM40may be configured as an analog electronic card module

The display unit50receives measurement data on an operation state of the safety system such as temperature or pressure so as to inform an operator. It is possible to monitor a reactor core cooling state, an emergency situation or the like through the display unit50. The display unit50is not affected by a common mode failure or the like of the second controller20and thus able to display a plant status even in an emergency situation.

The safety system includes at least one of a safety injection system, a main steam isolation system, a containment spray system, or a steam generator auxiliary feedwater system.

All of the first controller10, the second controller20, and the CIM40, and the display unit50may be positioned within a main control room.

The aforementioned components may be physically located as follows: as shown inFIG. 2, a large display panel is disposed on one side of the main control room, the first controller10and the display unit50are disposed at a first location, and the second controller20is disposed at a second location spaced apart from the first location. Specifically, the first controller10and the display unit50may be positioned at the first location as a safety control panel. The position of the CIM40is not limited and thus omitted in the drawings.

Hereinafter, an operation method using the safety apparatus1will be described.

When it is difficult to operate the safety system using the second controller20due to a common mode failure or the like, an operator operates the selector11. When the selector11is operated to select the first controller10, the CIM40may apply first a signal from the first controller10to the safety system as a top priority.

The operator operates the safety system through the first controller10while monitoring an operation state. Accordingly, even when digital devices malfunction, the safety system is able to be safely operated in an analog type through the first controller10and therefore a severe accident may be prevented in advance.

In another embodiment, if an operation signal is generated in the first controller10by manipulation by an operator, without additional operation of the selector11, the interface module40may apply first the signal from the first controller10to the safety system as a top priority. In this case, the selector11may be omitted.

As such, according to the present invention, a severe accident is prevented in advance, thereby significantly improving reliability and safety of an instrumentation and control system in a nuclear power plant. In addition, since the first controller10is configured in an analog type, the present invention may be easily implemented with reduced manufacturing costs and high reliability.

With reference toFIG. 3, a defense-in-depth safety apparatus according to the second embodiment of the present invention will be described.FIG. 3is a diagram showing configuration of the defense-in-depth safety apparatus according to the second embodiment of the present invention.

According to the second embodiment, a selector30is provided separately from a first controller10. Using the selector30, it is possible to select one of the first controller10and a second controller20to operate a safety system. In this case, the selector30may be located at the first location shown inFIG. 3, but not limited thereto.

The above-described embodiments are illustrative of the present invention, and the present invention is not limited thereto. Since numerous variations and modifications will become apparent to those skilled in the art once the above disclosure is fully appreciated, the scope and spirit of the invention come within the scope of the appended claims.