Patent Number: 
Section: description

Referring now to the figures of the drawings in detail and first, particularly, to FIGS. 1 and 2 thereof, there is seen a boiling water reactor and a conventional instrumentation system for monitoring and controlling in accordance with the prior art, which are considered below as a preferred example. FIG. 1 shows a typical configuration of detectors of various nuclear instrumentation systems. Fuel elements distributed over a cross section of a reactor core 1 are combined in each case to form cells 2 of four fuel elements, which are disposed around a common, cruciform control rod 3. The instrumentation includes three systems, specifically for a counter tube range or startup range AD (for a neutron flux P which reaches approximately up to 10xe2x88x925 of a normal flux for which the reactor is constructed), an intermediate range UD (where the neutron flux P is approximately 10xe2x88x926 to 10xe2x88x921) and a power range LD (where the neutron flux P is approximately from 10xe2x88x922), to which a measuring sensitivity of the assigned detectors and evaluation devices are tuned. Usually, a plurality of detectors are respectively disposed in instrument lances in the interior of the reactor core between the fuel elements. The evaluation devices of the systems are respectively combined to form redundantly operating channels in such a way that in the event of failure of a detector or the evaluation device thereof, or of the power supply, at most one channel fails. In that case, the assignment of the detectors and instrument lances to the channels can be linear (for example, FIG. 1 respectively provides three instrument lances 5 and 7 for the system of the counter tube range or startup range AD and the intermediate range UD, having detectors and evaluation units which respectively form a channel). However, it would also be possible to provide a plurality of detectors in each instrument lance and to network the evaluation devices in such a way that each channel is assigned detectors, evaluation devices and power supplies of different instrument lances. That networking is provided for the system of the power range LD. In order to form three monitoring channels, instrument lances 9, which are distributed over the entire cross section of the core, each carry at least three power distributor detectors that are disposed at a different level in each case, and provide measuring signals which can be used for the purpose of measuring the local power in the reactor, and of redundantly determining a three-dimensional power distribution through the use of three independent power distribution channels. In order to obtain an actual value (measuring signal) of a total power for the control or regulation of the reactor, the LD system includes three power range channels in which measuring signals of the power distribution detectors 9 are summed. It is possible in this case to exclude defective detectors or evaluation devices from the formation of the power distribution signals and/or a power range signal, and to compensate a distortion of the signals thereby produced by connecting or disconnecting further detector signals in the corresponding channel. Thus, in FIG. 1 each system is equipped for redundancy reasons with a plurality of mutually independent measuring channels which are similar to one another. In the case of the example shown in FIG. 1, there are three measuring channels per system. FIG. 2 illustrates a typical measuring range for each of those systems of the nuclear instrumentation. The counter tube range or startup range detectors (AD) measure the neutron flux P from the neutron source level (neutron flux of the completely shut down reactor core) up to a reactor power on the order of magnitude of 10xe2x88x925 of the rated power. In the case of irradiated cores, the source level 10 is typically at around 10xe2x88x929 of the rated power. However, in special cases, when many or all fuel elements of the core are fresh or only slightly irradiated, it can also be substantially lower. In the case of startup of a shutdown (subcritical) reactor core, because of repeated partial withdrawal of control rods, the source level continuously rises slightly until finally, a critical state (a self-maintaining chain reaction) is reached within the measuring range of the counter tube range detectors AD. Subsequently, the desired rate of rise of the neutron flux density (positive reactor period) is set by further withdrawal of control rods, in such a way that the measuring signals of the counter tube range detectors AD then indicate an exponential rise in the neutron flux density. The reactor operator can track the signal development over many decades and use it as a basis for his or her control tasks on the basis of a logarithmic signal display selected for the counter tube range detectors AD. If, while rising, the neutron flux density exceeds the magnitude of approximately 10xe2x88x926 of the rated power, the measuring range of the intermediate range detectors (UD) is reached and, in addition to the AD measuring channels, the measuring channels of those detectors indicate the respective magnitude and tendency of the neutron flux density. The UD measuring range also extends over many decades up to the power range. In order to raise the measuring accuracy, that large range is subdivided into a sequence of subranges which follow one another in the manner shown in FIG. 2 with pronounced mutual overlapping of measuring range, and are constructed, for example, with a sensitivity grading of 101/2:1 between successive subranges in each case. The switching over of the subranges is separately performed manually by the staff in the event of rising neutron flux density for each UD measuring channel when the signal approaches the upper measuring range limit of the subrange that is currently set. A trigger mark is set up for each subrange of a UD channel near the upper measuring range limit. If that mark is exceeded by the measuring signal, an alarm signal of the reactor protection system is automatically activated by the relevant UD channel as long as the overshooting lasts. If further such alarm systems are added from other UD channels, an emergency reactor shutdown (RESA) is initiated in accordance with an evaluation circuit provided for that purpose in the reactor protection system. In other words, all control rods which are partially or completely withdrawn are quickly inserted into the reactor core. In the process, the core changes over into the subcritical state, and the neutron flux density drops back to the source level. In the case of the example illustrated in FIG. 1, with three redundancies, the initiation of the RESA is generally undertaken whenever the trigger mark is exceeded in any two of the total of three UD channels (xe2x80x9c2 from 3xe2x80x9d evaluation circuit). If, in the case of the planned startup operation being considered, the reactor power approaches the upper measuring range limits of the AD channels of around 10xe2x88x925 of the rated power, the AD detectors are withdrawn downwards from the core for the purpose of extending the measuring range, and positioned below the reactor core in reflector positions with a neutron flux density which is reduced in comparison with the core interior. It may be seen from FIG. 2 that, because of the mutual overlapping of the AD and UD measuring ranges by more than a decade, the withdrawal of the AD detectors must not be instituted until the UD system has reliably taken over the monitoring of the neutron flux density. A suitable interlock device ensures that the AD detectors can in no way be withdrawn earlier from the core. It may be noted that in recent structures the functions of an AD channel and a UD channel are also combined in a so-called xe2x80x9cwide-range channelxe2x80x9d and can be fed by a single wide-range detector (WD). The measuring range of such a WD channel then includes the entire range, which is still divided into the ranges AD and UD in FIG. 2. If the reactor power exceeds the magnitude of approximately 10xe2x88x922 of the rated power, it is detected in addition by the power range channels LD seen in FIG. 2 and indicated for each channel on a linear scale having a measuring range which extends typically from 0% to 125% of the rated power. It is usual for there to be at least three LD channels present which are mutually independent and similar to one another. Each LD channel uses a multiplicity of the neutron-sensitive instrument lances (power distribution detectors xe2x80x9cLVDxe2x80x9d 9) as detectors. They are distributed virtually uniformly over the core volume and have signal contributions in the LD channel, which are calibrated in accordance with the local power density and are summed. The channels are calibrated to the reactor power at a suitable output load point with the aid of a thermal balance. The result thereof is that the accuracy of indication, the so-called xe2x80x9ctrack fidelityxe2x80x9d, of the LD channels for the reactor power is very high even in the case of arbitrary changes in power level and power distribution in the reactor core. The UD measuring channels, which are not able to measure the reactor power with a comparable, high track fidelity as in the LD channels, because of the use of individual detectors disposed locally in the core, are no longer required after and as long as the reactor power exceeds a minimum value which ensures the proper detection of the reactor power by the LD system. This minimum value is frequently fixed at 5% of the rated power. If it is exceeded, the UD channels can be taken out of engagement, for example by withdrawing their detectors from the reactor core and/or by bridging their starting functions. A series of trigger marks is included in the LD system. Of those trigger marks, the undelayed RESA triggering upon the attainment of a fixed overload limit mark typically disposed at approximately 120% of the neutron flux rated value is of importance with regard to countermeasures in the event of excursions. As in the case of the UD system, the triggering of that limit value by the various mutually redundant LD channels leads to the initiation of the countermeasures in accordance with the prescribed evaluation circuit. In the case of a 3-channel LD system, for example, that is usually likewise a xe2x80x9c2 from 3xe2x80x9d evaluation circuit (or the one already mentioned). The following sequence of an excursion results with the nuclear instrumentation of the nuclear reactor according to the prior art, that was described above by way of example. After attainment of the prompt critical reactor state in the counter tube range or in the intermediate range, for example due to defective withdrawal of control rods, the neutron flux density in the core increases so quickly that the changing over of the UD subranges can no longer keep up therewith (to the extent that the staff attempts that at all in such a case). In rapid sequence, the UD channels will exceed the RESA limit value of their respectively set subrange, and actuate the emergency reactor shutdown in accordance with the prescribed evaluation circuit. Due to the unavoidable delays in the signal processing and in electrical, mechanical and hydraulic components of the emergency shutdown system, the control rods are only inserted into the reactor core after a short delay. The detection of the rapid power rise by the UD channels is performed redundantly, with the result that the failure of a channel does not prevent the initiation of the countermeasures. An emergency reactor shutdown (RESA), or any sort of intervention in the planned startup operation which can be controlled, for example, through the use of a startup program, is intended to be performed in the startup phase (that is to say before the reactor power enters the typical measuring range of the LD detectors, in accordance with the provided startup operation) only if, because of a fault, for example an excursion, the reactor power reaches a limit value Mg which is situated in the measuring range of the detectors of the LD system (for example, 30% of the rated power P). This can be detected, according to FIG. 3, by feeding a reactor power S(t), for example the signal in at least one of the LD channels, to a limit value monitor Gg which activates a corresponding signal A to initiate the countermeasure, upon overshooting of the set limit value Mg. However, an improper overshooting of the limit value Mg during startup must be distinguished from proper operating states in the case of which the startup proceeds according to plan, or normal operation is already present. Consequently, according to FIG. 3, an AND gate AND1 is provided which acts as a filter that prevents such countermeasures in the case of proper operating states. A power band having a lower limit which is defined by a limit mark Mu is consequently placed below the trigger limit (limit value Mg). An output signal Sg in this case leads to the trigger signal A for the countermeasure only when the power band situated therebelow is traversed more quickly than in a prescribed minimum time xcex94tB (filter action of the power band). Although these operations are implemented as a rule as software for the monitoring, regulation and control present in the reactor, this filter action of the power band is represented in FIG. 3. In this case, upon overshooting of the lower limit mark Mu, which is set in a first limit value monitor Gu, the latter outputs a signal that triggers a flip flop K having a time constant that is equal to the minimum time xcex94tB and sending a corresponding pulse to an input of an AND gate AND2 in this time. Another input of this gate is connected to a second limit value monitor Go, which outputs a signal when the measuring signal S(t) for the reactor power exceeds a set upper limiting mark Mo. Thus, if the signal S(t) does not exceed the upper limit mark Mo until after the duration xcex94tB (xe2x80x9cstandby periodxe2x80x9d) has elapsed, the flip flop K (timing element) is already once again in idle state and both gates AND1 and AND2 block, with the result that activation of the trigger signal A by the signal Sg is prevented. If, however, because of an excursion, the power band is traversed quickly, that is to say the upper limit mark Mo is already exceeded inside the standby period xcex94tB, the signal Sg intervenes on the trigger signal A. The circuit layout having two AND gates and separate values for Mg and Mo permits the trigger signal A to be used, for example, to initiate a RESA triggering. However, a different triggering Axe2x80x2 of an output signal of the gate AND2 permits a less dramatic countermeasure to be instituted. Specifically, if only the signal Axe2x80x2 responds, but not the signal A, there can be faults which restabilize themselves even without a reactor shutdown, to the extent, for example, that the programmed startup operation is only slowed down or stopped. However, a simplification is achieved when the same upper limit mark is used for Mo and Mg. It is then possible in the case of a hardware circuit to dispense with the limit value monitor Gg and the gate AND1. In other words, no distinction is then made between strong excursions in the case of which both the power band (Moxe2x88x92Mu) is traversed more quickly than the time xcex94tB and the trigger limit Mg is exceeded, and weak excursions in which only the rise criterion is fulfilled but the trigger limit is not reached. The limit marks can be prescribed as a function of the respective control program (that is to say, for example, the selected control rods) or the power signal S(t) or can be prescribed in some other way as a function of operation. In the limit value monitors Gu and Go, the respective limit value Mu and/or Mo for limiting the power band is advantageously independent of operation. In this case, the power band is advantageously situated in the lower third, preferably in the lower quarter, of the rated power of the reactor. The width, that is to say the difference Moxe2x88x92Mu, and/or the minimum time xcex94tB is preferably prescribed in an operationally independent manner. It generally amounts to less than one third, preferably less than one fifth, of the rated power. The above-described diversitary excursion monitoring is preferably constructed separately for each LD channel. In accordance with an electronic evaluation provided for this purpose, the excitations possibly arriving from the various LD channels, which are mutually redundant, lead to initiation of the excursion countermeasure. The emergency reactor shutdown preferably comes into consideration as such a countermeasure. The following points of view are important in establishing the position and width of the power band and of the standby period xcex94tB, for the purpose of uniquely distinguishing between excursions and startup operations which are according to plan and possibly accelerated. The power band is expediently to be fixed in such a way that power rises of planned startup operations in any case have either already stabilized themselves below the band due to the reactivity feedback effects which are relevant in this case, or stabilize themselves at the latest within the power band, while it is traversed largely undamped in the case of all excursions. This condition is best fulfilled by the lowermost part of the measuring range of the LD channels which is useful for setting limit marks. The width of the power band (that is to say the power difference Moxe2x88x92Mu) is to be so large that the power band with the highest load change rate which can be realized in this power range in the case of normal operation is traversed on the order of magnitude of approximately one minute. It is then possible to select the length of the standby time period xcex94tB which is suitable for unambiguously distinguishing between excursions and planned startup procedures, from a relatively large time range 1 s less than xcex94t less than 1 min. Upon the observance thereof in terms of control engineering, it is then unnecessary to place any further high accuracy requirements. A parameter combination with Mu=5% of the rated power Mo=20% of the rated power xe2x80x83xcex94tB=20 s may be specified as an example which in general fulfills the optimization criteria described above. It would not be damaging if primary excursions occur which are already restabilized in a few fractions of a second and are therefore virtually not detected, for example, due to unavoidable inertias and dead times of hardware (detectors) and software (electronic evaluation). This is also not necessary, since the countermeasure must be initiated only when a measurable rise in power occurs over relatively long times (for example above one second). This is illustrated symbolically in FIG. 3 by a filter for the signal S(t), for example a smoothing filter F at the input of the limit value monitor Gu. FIG. 4 initially indicates a limit value M(LD) which is already prescribed in the prior art for the corresponding signal S(t) of the power range channels, in order to undertake a reactor shutdown in normal operation, for example in the case of power fluctuations which are caused by hydraulic instabilities, or in the case of similar malfunctions. A typical limit value M(LD) is, for example, 120% of the rated power P of the reactor. FIG. 4 also illustrates the power band by showing the upper limit mark Mo and the lower limit mark Mu. It is also assumed that at an instant t1 a primary excursion and any consequent excursions triggered thereby lead to a rise in the power in the reactor indicated by the signal S(t) even before the reactor should actually reach a power of approximately 5% of the rated power, on the basis of the planned startup procedure. The reactor is therefore in a state in which the UD systems according to the prior art take over the monitoring of the reactor. According to the invention, however, the signal S(t) of the LD channels is used for monitoring. For this purpose, upon overshooting of the lower limit mark Mu for the standby time period xcex94tB, a monitoring logic circuit is firstly activated. Upon overshooting of the upper limit mark Mo which simultaneously represents the triggering limit for the countermeasure, this triggers the corresponding monitoring signal with the aid of which the countermeasure is initiated. As a result of this countermeasure (for example a shutdown in the case of which all control rods are once again inserted completely into the core), the reactor power decays again without having reached a dangerous value. The operating staff can then once again cancel the countermeasure and institute a new startup procedure according to a better planned program, or resume the startup procedure interrupted by the countermeasure, in a planned manner. In this planned startup procedure, the reactor power then grows according to the plan and reaches the values at which the LD systems supply a display of the reactor power which has track fidelity, and the signal S(t) is therefore monitored by the LD systems according to the prior art. In this case, the LD signal S(t) once again overshoots the lower limit mark Mu at an instant t2. However, this limit mark is in a power range (for examplexe2x89xa75%) in which a reactor that has been started in a planned manner and appropriately heated up exhibits no more excursions. During the planned power increase, the signal S(t) now traverses the power band at a correspondingly low rate of rise which does not lead to overshooting of the upper limit mark Mo until an instant t3, that is to say long after expiration of the standby time period xcex94tB. FIG. 5A and FIG. 5B initially illustrates the AD channel detectors and instrument lances 5 provided for the counter tube range or startup range, having signals that can be evaluated, documented and displayed on monitors, for example in a startup electronic monitoring unit 51. The intermediate range channels UD with lances and detectors 7 can likewise have corresponding monitors 52. These channels furthermore have a device 53 for stepwise reduction of the measuring sensitivity of these channels. This device 53 is indicated in FIG. 5A and FIG. 5B by a symbol of a divider. A corresponding reduction factor for the sensitivity of operating staff is changed, for example, as soon as it can be detected on the monitors 52 that the corresponding signal of the UD channels exceeds the currently set sensitivity range (see FIG. 2). The conventional monitoring of the startup procedure through the use of the UD channels includes a logic circuit monitoring device 54 which outputs a signal in each case upon overshooting of the sensitivity range (which is measurable, for example, in each case by one limit value monitor 55 for each of the three UD channels illustrated). If, in the case of the installed number n of UD channels (in this case: n=3), at least one prescribed number m (in this case: m=2) reports such range overshooting, a corresponding xe2x80x9cm from nxe2x80x9d circuit (in this case: a xe2x80x9ctwo from threexe2x80x9d circuit 56) outputs a signal a with the aid of which an intervention is made into the control of the reactor. This reactor control is symbolized in FIG. 5A and FIG. 5B as a corresponding control and regulation device 60 having a controller 61 and an actual-value arithmetic circuit 62. For example, a control center can be provided with a display or monitor 83 for the reactor power. A +/xe2x88x92 switch is operated by the staff in order to insert the control elements into the core or extract them from it when a lower or higher desired power value is targeted. All desired values and parameters for the planned control of the reactor are set at this device 60. Actuating signals for the corresponding manipulated variables of the reactor operation are largely program-controlled in the device 60 and formed automatically through the use of a plenitude of actual values determined in the reactor and actuator check-back signals which are symbolized in FIG. 5 by actual values S1, S2 and S3 that are formed by sensors and detectors of the LD channels. The actuating signals themselves are relayed to a corresponding actuating device 70 which, in addition to other actuating devices (for example coolant pumps for a coolant loop), chiefly controls drives for inserting and extracting the control rods into and from the reactor. Therefore, if the monitoring device 54 of the UD channels supplies a corresponding signal a in the prior art, an intervention is made into the reactor operation controlled by the device 60. That is done, for example, by having the controller 61 change to a shutdown program, or by using a computer initially to change directly in the device 70 from the programmed control of the control rods to shutting down the reactor by inserting the control rods. The LD channels are illustrated in FIG. 5A and FIG. 5B by the corresponding instrument lances and detectors 9. The signals of defective sensors are suppressed in a corresponding electronic evaluation device 80 by using plausibility criteria, in order to network in a corresponding signal interconnection unit 81 only plausible measuring signals from the sensors distributed over the volume of the reactor core, and to respectively form in a subsequent summing circuit 82 an aggregate signal for each LD channel which respectively detects the local distribution of the power in the reactor as a signal S1, S2 and S3 for the power of the reactor. Each signal S1, S2 and S3 of these redundant power range channels is monitored in a limit value monitor 84 for overshooting of the limit value M(LD). If at least two of the three signals (in general: at least one number m from the number n of the limit monitor signals) exceed this limit value, an appropriate evaluation circuit 85, that is to say a xe2x80x9ctwo from threexe2x80x9d circuit (in general: xe2x80x9cm from nxe2x80x9d circuit) outputs a corresponding signal b. With the aid of the signal b it is possible to activate a shutdown program (or another suitable countermeasure) in the control device 60 or, as illustrated in FIG. 5A and FIG. 5B, to intervene directly in the actuating device 70 for the control elements, in order to interrupt the normal startup procedure and, if appropriate, to initiate an emergency shutdown. It is not illustrated that signals, combined by the signal interconnection unit 81 in power distribution channels, from detectors of the instrument lances 9 are likewise monitored in three redundant channels for local oscillations. They can likewise trigger the signal b, in order to detect the three-dimensional power distribution. The power range monitoring by the evaluation device 80 therefore serves the purpose of redundantly monitoring corresponding measuring signals, in accordance with the prior art. The measuring signals are continuously formed by a plurality of power range channels and detect the reactor power. However, such a redundancy with the aid of the signals S1, S2 and S3 is also provided for the monitoring according to the invention in the counter tube range. The actuating device 70 has a corresponding input A with the aid of which it is possible, at least during the startup operation, to apply a trigger signal supplied by an appropriate device to the actuating device 70. Therefore, in accordance with FIG. 6 each of these signals S1, S2 and S3 is assigned a device C1, C2 and C3 corresponding to FIG. 3. Consequently, their signals A1, A2 and A3 and, if appropriate, their signals Axe2x80x21, Axe2x80x22 and Axe2x80x23 as well, are also likewise combined by an xe2x80x9cm from nxe2x80x9d circuit 91 or 92 to form a corresponding signal A0 or Axe2x80x20 with the aid of which the trigger signal A can be set. The reactor power is therefore continuously detected through the use of measuring signals of a plurality of power range channels, and redundantly monitored. The invention can be used to replace the conventional monitoring of the startup through the use of the signal a by monitoring through the use of a signal A, and A1, A2, A3 or A0, respectively, that is to say by a monitoring which uses other sensors and other channels. However, this monitoring of the startup is advantageously used as diversitary monitoring. Thus, in addition to the monitoring through the use of the power range channels and their detectors 9, the signals of the neutron flux detectors 7 are also monitored through the use of the signal a and, if appropriate, used for a countermeasure in order to limit the rise in power. These additionally used neutron flux detectors already monitor the neutron flux of the reactor core according to the prior art in the manner shown in FIG. 2, for observance of a current maximum value which is prescribed as a function of operation, as long as the rods are drawn out of the core and the reactor power is still in the intermediate range. This maximum value is virtually the upper limit of the measuring range respectively prescribed in FIG. 2 for each sensitivity stage. In accordance with the invention, it is possible to achieve a high reliability in the counter tube range on the basis of a prescribed redundancy. In accordance with FIG. 5B, for example, such a redundancy resides in the fact that a plurality of redundantly operating logic circuits connected to an evaluation circuit process the signals of the power range channels. The further redundancy due to the use as a diversitary system is important for the monitoring device 54. The actuator 70 for the control rods can therefore be activated not only by the signal of a monitoring device according to FIG. 3 or FIG. 6, but additionally also by the monitoring device 54 which is connected to the neutron flux detectors 7 and is constructed by using other physical principles and detectors.