Patent Number: 042008646
Section: description

DETAILED DESCRIPTION In FIG. 1, an enclosure of a nuclear power plant encloses three sets of sensor probes R.sub.1 . . . R.sub.n, S.sub.1 . . . S.sub.n, T.sub.1 . . . T.sub.n ; the probes R.sub.1, S.sub.1 and T.sub.1 each measure the same physical characteristics among a number of n physical characteristics. The output signal of each probe R.sub.1 . . . T.sub.n is brought across a conductor to a corresponding comparator circuit R.sub.1 ' . . . T.sub.n '. A second input of each comparator circuit R.sub.1 ' . . . T.sub.n ' is connected to a reference transmitter via a plurality of conductors R.sub.1 " . . . T.sub.n ". The actual circuitry of the comparator circuit R.sub.1 ' . . . T.sub.n ' is well known, as is its function. At the output of each circuit R.sub.1 ' . . . T.sub.n ' appears a signal representing the difference between the value of the references and the value of the output signal of the probe to which it is connected. Circuits for the reproduction of the signals of the same value as the input signal, galvanically separated one with respect to the other and with respect to the input signal, are designated by R.sub.1 .degree. . . . T.sub.n .degree.. Each reproduction circuit R.sub.1 .degree. S.sub.1 .degree. T.sub.1 .degree. is respectively connected to a corresponding probe R.sub.1 S.sub.1 T.sub.1 measuring the physical characteristic "1"through a respective comparator circuit R.sub.1 ' S.sub.1 ' T.sub.1 '. An example of a reproduction circuit which may be used is described in the Belgian patent application No. 1/7598. However, if the value at the input of the reproduction circuit is a binary value, it is possible to choose a simple relay as a reproduction circuit. This further assumes that a relay is considered sufficiently reliable for the physical characteristic under consideration to be transmitted. Each reproduction circuit R.sub.1 .degree. . . . T.sub.1 .degree. comprises six outputs galvanically separated with respect to one another and to the input. A plurality of majority decision circuits V.sub.1 to V.sub.n, each general index k having three inputs and an output, are connected in front of the inputs of six identical logic circuit trains C.sup.1 to C.sup.3 used for intrinsic security. The outputs indexed a, b, c of these circuits are for security, "a" representing, for example, triggering the alarm for the release of the rods; and b and c representing safeguard functions. The majority decision circuits V.sub.1 . . . V.sub.n are each connected to the corresponding reproduction circuits R.sub.1 .degree. . . . R.sub.n .degree., S.sub.1 .degree. . . . S.sub.n .degree., T.sub.1 .degree. . . . T.sub.n .degree. which in turn are connected to comparator circuit R.sub.1 ' . . . R.sub.n ', S.sub.1 ' . . . S.sub.n ', T.sub.1 ' . . . T.sub.n ' and to the probes R.sub.1 . . . R.sub.n, S.sub.1 . . . S.sub.n, T.sub.1 . . . T.sub.n, each probe of same index 1 . . . n measuring the same physical characteristic "k" taken from 1 . . . n. These are the majority decision circuits which are "two of three" and which are well known in the regulation and automation art. They produce therefore an output signal corresponding to two identical input signals, one of the input signals capable of being different from the other two. As a result, the breakdown of one of the probes R.sub.1 . . . R.sub.n, S.sub.1 . . . S.sub.n, T.sub.1 . . . T.sub.n or of its associated comparator circuit R.sub.1 ' . . . R.sub.n ', S.sub.1 ' . . . S.sub.n ', T.sub.1 ' . . . T.sub.n ' or of the associated reproduction circuit R.sub.1 .degree. . . . R.sub.n .degree., S.sub.1 .degree. . . . S.sub.n .degree., T.sub.1 .degree. . . . T.sub.n .degree. does not modify the input signal to the logic circuit trains C. The six trains C.sup.1, C.sub.1, C.sup.2, C.sub.2, C.sup.3, C.sub.3 are assembled in three pairs by means of nine AND functional logic circuits. Each pair C.sup.1, C.sub.1 ; C.sup.2, C.sub.2 ; C.sup.3, C.sub.3 is associated with three AND functional logic circuits E.sub.1.sup.a, E.sub. 1.sup.b, E.sub.1.sup.c ; E.sub.2.sup.a, E.sub.2.sup.b, E.sub.2.sup.c ; E.sub.3.sup.a, E.sub.3.sup.b, E.sub.3.sup.c by means of three different outputs. In their turn, the outputs of the groups E.sub.1.sup.a, E.sub.2.sup.a, E.sub.3.sup.a ; E.sub.1.sup.b, E.sub.2.sup.b, E.sub.3.sup.b ; E.sub.1.sup.c, E.sub.2.sup.c, E.sub.3.sup.c are connected to the inputs of the functional OR logic circuits or "two of three" majority decision circuits respectively U.sup.a, U.sup.b, U.sup.c. The U.sup.a group can, for example, control a retention system for control rods, permitting, upon receipt of an emergency signal, release of the control rods such that they fall freely into the reactor acting as stop rods. In this case, the output signals of the groups E.sup.a, or E.sub.1.sup.a, E.sub.2.sup.a, E.sub.3.sup.a (FIG. 2) represent the state of the emergency alert signals. To prevent that a fault in one of the circuits E.sub.1.sup.a, E.sub.2.sup.a, E.sub.3.sup.a sets off the emergency signal, U.sup.a can be a "two of three" majority decision circuit, in this situation by means of three pairs of circuit breakers in parallel. Placed in series with the windings D.sub.1.sup.1, D.sub.1.sup.2, D.sub.2.sup.1, D.sub.2.sup.2, D.sub.3.sup.1, D.sub.3.sup.2 which have a minimum voltage are output signals of the circuits E.sub.1.sup.a, E.sub.2.sup.a, E.sub.3.sup.a. Each circuit breaker of one pair in parallel comprises a winding fed by a different signal than that feeding the winding of the other circuit breakers of the pair in parallel. For example: D.sub.1.sup.1, D.sub.3.sup.2 ; D.sub.2.sup.1, D.sub.1.sup.2 ; D.sub.3.sup.1, D.sub.2.sup.2. In this way, an interruption of the current in a conductor A in circuit with the three pairs of circuit breakers cannot take place in the case where at least two of the three signals E.sub. 1.sup.a, E.sub.2.sup.a, E.sub.3.sup.a transmit the emergency signal. In effect, if only E.sub.1.sup.a transmits the emergency signal, the maintenance current in the conductor A circulates via D.sub.3.sup.2 D.sub.2.sup.1 D.sub.3.sup.1. If E.sub.2.sup.a transmits the emergency signal, the current circulates via D.sub.3.sup.2 D.sub.1.sup.2 D.sub.3.sup.1. If E.sub.3.sup.a transmits the emergency signal, the current circulates via D.sub.1.sup.1 D.sub.2.sup.1 D.sub.2.sup.2. For the current to be cut, it is necessary that two of the groups E.sub.1.sup.a, E.sub.2.sup.a, E.sub.3.sup.a transmit the emergency signal. U.sup.a is thus "two of three" functional majority decision circuit. The circuit U.sup.b can, for example, control the introduction of emergency feed water into a stream generator in case of a loss of normal feed water. This feed water removes the thermal power produced in the reactor. In case of emergency, the signals of the output of the devices E.sub.1.sup.b, E.sub.2.sup.b, E.sub.3.sup.b activate, on the one hand, (FIG. 3) an emergency pumps P.sub.1, P.sub.2, P.sub.3 disposed in parallel pipes in series with check valves Z, feeding a common conduit C.sub.P from a recovery water circuit H to the condenser. From this Conduit C.sub.P pipes emanate to manually remote-controlled valves V.sub.P.sup.1, V.sub.P.sup.2, V.sub.P.sup.3. These valves are connected to check valves Z of the type which can be maintained open. The output signals of the devices E.sub.1.sup.b, E.sub.2.sup.b, E.sub.3.sup.b are applied on the other hand to a functional OR sub-circuit U.sub.Q.sup.b activating a turbo-pump Q when any one of the devices E.sub.1.sup.b, E.sub.2.sup.b, E.sub.3.sup.b transmits an alarm. The turbo-pump Q feeds water from the recovery circuit H to the condenser via a common conduit C.sub.Q which connects pipes through the manually remote-controlled valves V.sub.Q.sup.1, V.sub.Q.sup. 2, V.sub.Q.sup.3 followed equally by check valves Z. The valves V.sub.Q.sup.1, V.sub.Q.sup.2, V.sub.Q.sup.3 can thus equally remain normally open. The valves V.sub.P.sup.1, V.sub.Q.sup.1 ; V.sub.P.sup.2, V.sub.Q.sup.2 ; V.sub.P.sup.3, V.sub.Q.sup.3 feed in parallel, respectively, three steam generators G.sup.1, G.sup.2, G.sup.3. The circuit U.sup.b is thus in fact a functional OR hydraulic circuit for the emergency feeding of feed water of each generator G.sup.1, G.sup.2, G.sup.3. The circuit U.sub.c can, for example, control a system of boric acid release in the reactor in the event of an uncontrollable accident in releasing the control bars. One such system (FIG. 4) comprises a high pressure circuit having an injection reservoir I and a group of injection pumps F.sub.1, F.sub.2, F.sub.3, as well as a low pressure circuit comprising an expansion reservoir J and circulation pumps K.sub.1, K.sub.2, K.sub.3. Pneumatic valves W.sub.1, W.sub.2, W.sub.3 make it possible to cut communication between the high pressure circuit and the low pressure circuit. Motor-operated, remote-controlled valves X.sub.1, X.sub.2, X.sub.3 make it possible to establish communication between the reactor and the high pressure circuit. In normal operation, the injection pumps F.sub.1, F.sub.2, F.sub.3 are stopped and the motor-operated valves X.sub.1, X.sub.2, X.sub.3 are closed and isolate the high pressure circuit with respect to the reactor. The pneumatic valves W.sub.1, W.sub.2, W.sub.3 are open. One of the circulation pumps K.sub.1 operates and maintains the boric acid in movement through the low and high pressure circuits forcing it to pass through a heating apparatus M to avoid the local crystal precipitation of boric acid at cooler locations. The functional logics E.sub.1.sup.c, E.sub.2.sup.c, E.sub.3.sup.c circuits transmit alarm signals of "borification" which result in: the closing of the corresponding pneumatic valves W.sub.1, W.sub.2, W.sub.3 ; the stopping of the circulation pumps K.sub.1, K.sub.2, K.sub.3, isolating the low pressure circuit from the high pressure circuit. Simultaneously, the output signals of the circuits E.sub.1.sup.c, E.sub.2.sup.c, E.sub.3.sup.c start the injection pumps F.sub.1, F.sub.2, F.sub.3 and open the motorized valves X.sub.1, X.sub.2, X.sub.3. At this moment, 12% boric acid is injected into the reactor which suppresses the neutron flux. The group U.sup.c shown in FIG. 4 is in fact an OR functional circuit. It is obviously possible to conceive of other variations of this U.sup.c group, for example, to use only two outputs (for example, the circuits E.sub.1.sup.c and E.sub.2.sup.c) keeping in reserve the third (E.sub.3.sup.c) for substituting it for one or other of E.sub.1.sup.c or E.sub.2.sup.c during the tests. In this latter case, triple redundancy is reduced to double redundancy. The installation according to the invention has a very high security due to the fact that each control is at least duplicated. It has the advantage of avoiding the untimely emergency stops due to a defect in the logic circuit train because these trains are duplicated for each command chain and connected by functional AND logic circuits. As these logic circuit trains can be very complex, conformity surveillance circuits Y can be provided between corresponding points of the two trains connected by an AND circuit. The Y circuits can activate for example, indicators on a surveillance board. In FIG. 1, a conformity surveillance circuit Y is represented which compares the outputs of the selector circuits V.sub.1 associated with the logic circuit trains C.sup.2 and C.sub.2. Other Y circuits can be associated with other characteristic points corresponding to the circuits C.sup.2 and C.sub.2 as symbolically shown by the oblique lines. In reality, such Y circuits are associated to each pair of logic circuit trains C.sup.1, C.sub.1 ; C.sup.2, C.sub.2, C.sup.3, C.sub.3. All of the Y circuits associated with a pair of logic circuit trains can additionally be connected between themselves in a manner known in and of itself by a general security control device signalling the absence of conformity in any one of the Y circuits associated with the pair of logic circuit trains in question. The general control device can, for example, constitute a circuit according to French Pat. No. 1,466,050 to the inputs of which are connected the outputs of all of the Y circuits associated with the same pair of logic circuit trains. It is possible to test the installation without endangering either normal operation, or its security nor even its availability in case of simple failure. In effect, as each physical characteristic is measured by three different sensors, a defect in one sensor or one of the elements R.sub.1 ' . . . R.sub.n ', S.sub.1 ' . . . S.sub.n ', T.sub.1 ' . . . T.sub.n ' or R.sub.1 .degree. . . . R.sub.n .degree., S.sub.1 .degree. . . . S.sub.n .degree., T.sub.1 .degree. . . . T.sub.n .degree. can be detected by the comparison of the corresponding inputs R.sub.1 .degree. . . . R.sub.n .degree., S.sub.1 .degree. . . . S.sub.n .degree., T.sub.1 .degree. . . . T.sub.n .degree. of any one of the six logic circuit trains C.sup.1 to C.sub.3. Further, each of the six logic circuit trains C.sup.1 to C.sub.3 can be individually tested while at the same time permitting the normal operation of the five remaining circuits. As the test of a single logic circuit train C.sup.1 to C.sub.3 necessitates several hours, this safeguard requirement of the security and of the availability of the installation is hardly superfluous. In order to take into account also defects in one or the other electric feed systems the logic circuit trains of the same pair can be attached to different feeds. In this case, the AND logic functional circuit terminals of this pair can transmit the alarm by the absence of electric signal, that is to say when the two feeds break down. On the contrary, if the identical circuit logic trains of the same pair are fed by the same source of electric current, the alarm is transmitted only by the presence of an electric signal. In a general manner, as the control installation of a nuclear power plant comprises normally four feed systems, one can provide either on the one hand pairs of logic circuit trains in which the two trains are fed by the same source of current but a feed by sources of different currents for the pairs of the different logic circuit trains, or by pairs of logic circuit trains in which each train is fed by a source of different current. Under the conditions described hereinabove, and if the OR functional circuits are "two of three" majority decision circuits, the process control installation activates an emergency control only if simultaneously two of three feed systems used break down. It is apparent that in each case one uses, among the electric feed systems available, the three most reliable. While the invention has been described, it will be understood that it is capable of further modifications and this application is intended to cover any modifications, uses or adaptations of the invention following in general the principles of the invention and including such departures from the present disclosure as come within known or customary practice in the art to which the invention pertains, and as may be applied to the essential features hereinbefore set forth and as fall within the scope of the invention or limits of the appended claims.