NUCLEAR POWER PLANT DEFENSE-IN-DEPTH SAFETY APPARATUS HAVING DIVERSITY

[0001] The present invention relates to a defense-in-depth safety apparatus with diversity in a nuclear power plant.

[0002] A safety system for a nuclear power plant plays a critical role in operating the nuclear power plant safely.

[0003] With digitalization of the nuclear power plant, the safety system is also controlled by a digitalized control device. However, the digital control device is operated by a computer program made of complex software and thus there is a possibility to incur errors in the digital control device. For this problem, countries including the United States require thorough verification of safety of such a digital device.

[0004] Accordingly, an object of the present invention is to provide a defense-in-depth safety apparatus with diversity in a nuclear power plant.

[0005] The object of the present invention can be accomplished by providing a diverse defense-in-depth safety apparatus with diversity in a nuclear power plant, the apparatus including: an analog-type first controller configured to generate an operation signal for a safety system; a digital-type second controller configured to generate an operation signal for the safety system; and a component interface module (CIM) configured to receive the operation signal from the first controller and the operation signal from the second controller, and apply first the operation signal from the first controller to the safety system as a top priority.

[0006] The operation signal from the second controller may include an engineered safety feature component control system signal (ESF-CCS) and a diversity protection system signal.

[0007] The safety system may include at least one of a safety injection system, a main steam isolation system, a containment spray system, or a steam generator auxiliary feedwater system.

[0008] The first controller may be not affected from a common mode failure of the second controller.

[0009] The first controller may include a selector that allows an operator to select operation by the first controller.

[0010] The apparatus may further include a selector that allows the operator to select operation by the first controller.

[0011] The apparatus may further include a display unit that is not affected from a common mode failure of the second controller and displays an emergency operation state.

[0012] The first controller, the second controller, and the display unit may be installed inside a main control room.

[0013] According to the present invention, there is provided a defense-in-depth safety apparatus with diversity in a nuclear power plant. With this apparatus, it is possible to safely maintain the nuclear power plant in any case, thereby preventing a severe accident, corresponding a beyond design basis accident, in advance and securing economic effects thereby.

[0017] Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

[0018] The accompanying drawings correspond to merely an example shown to illustrate technical scope of the present invention more detail, and the scope of the present invention is not limited to the accompanying drawings. In addition, for explanation of a relationship between elements, size and spacing may be shown differently from actual implementation.

[0019] With reference to FIGS. 1 and 2, a defense-in-depth safety apparatus according to a first embodiment of the present invention will be described.

[0020] FIG. 1 is a diagram showing configuration of the defense-in-depth safety apparatus according to the first embodiment of the present invention, and FIG. 2 is a diagram showing physical arrangement of the defense-in-depth safety apparatus according to the first embodiment of the present invention.

[0021] A safety apparatus 1 according to the first embodiment of the present invention includes a first controller 10, a second controller 20, a component interface module (CIM) 40, and a display unit 50.

[0022] The first controller 10 and the second controller 20 generate operation signals to operate a safety system. The first controller 10 is operated in an analog type. That is, the first controller 10 generates an operation signal according to direct manipulation of an operator. The second controller 20 is operated in a digital type. That is, the second controller 20 generates an operation signal by a computer program, and manipulation by an operator is allowed in this course.

[0023] The second controller 20 generates an engineered safety feature component control system signal (ESF-CCS) and a diversity protection system signal to operate the safety system. The ESF-CCS relates to safety of systems excluding a reactor at an emergency, and the diversity protection system signal is to stop the rector at the emergency. The ESF-CCS and the diversity protection system signal are generated from different platforms. These platforms are operated by computer software, and failure may occur in the platforms. However, a common mode failure may occur in these platforms, and, in this case, the second controller 20 does not generate an operation signal that enables the safety system to operate properly.

[0024] Meanwhile, the first controller 10 is operated in an analog type and not affected from the common mode failure of the second controller 20. Thus, although the common mode failure occurs in the second controller 20, the first controller 10 is able to generate a normal operation signal.

[0025] The first controller 10 includes a selector 11. The selector 11 may be provided in a physical analog switch form or in a digital form. The selector 11 may enable selecting operation of the safety system by the first controller 10, and may be manipulated by an operator.

[0026] The CIM 40 receives operation signals from the first controller 10 and the second controller 20, and transmits one of the operation signals to the safety system by a predetermined logic. If an operation signal is generated in the first controller 10 and or if the selector 30 is operated to select an operation signal from the first controller 10, the CIM 40 transmits only the operation signal from the first controller 10 to the safety system. That is, the CIM 40 transmits first the operation signal from the first controller 10 to the safety system as a top priority.

[0027] The CIM 40 may be configured as an analog electronic card module

[0028] The display unit 50 receives measurement data on an operation state of the safety system such as temperature or pressure so as to inform an operator. It is possible to monitor a reactor core cooling state, an emergency situation or the like through the display unit 50. The display unit 50 is not affected by a common mode failure or the like of the second controller 20 and thus able to display a plant status even in an emergency situation.

[0029] The safety system includes at least one of a safety injection system, a main steam isolation system, a containment spray system, or a steam generator auxiliary feedwater system.

[0030] All of the first controller 10, the second controller 20, and the CIM 40, and the display unit 50 may be positioned within a main control room.

[0031] The aforementioned components may be physically located as follows: as shown in FIG. 2, a large display panel is disposed on one side of the main control room, the first controller 10 and the display unit 50 are disposed at a first location, and the second controller 20 is disposed at a second location spaced apart from the first location. Specifically, the first controller 10 and the display unit 50 may be positioned at the first location as a safety control panel. The position of the CIM 40 is not limited and thus omitted in the drawings.

[0032] Hereinafter, an operation method using the safety apparatus 1 will be described.

[0033] When it is difficult to operate the safety system using the second controller 20 due to a common mode failure or the like, an operator operates the selector 11. When the selector 11 is operated to select the first controller 10, the CIM 40 may apply first a signal from the first controller 10 to the safety system as a top priority.

[0034] The operator operates the safety system through the first controller 10 while monitoring an operation state. Accordingly, even when digital devices malfunction, the safety system is able to be safely operated in an analog type through the first controller 10 and therefore a severe accident may be prevented in advance.

[0035] In another embodiment, if an operation signal is generated in the first controller 10 by manipulation by an operator, without additional operation of the selector 11, the interface module 40 may apply first the signal from the first controller 10 to the safety system as a top priority. In this case, the selector 11 may be omitted.

[0036] As such, according to the present invention, a severe accident is prevented in advance, thereby significantly improving reliability and safety of an instrumentation and control system in a nuclear power plant. In addition, since the first controller 10 is configured in an analog type, the present invention may be easily implemented with reduced manufacturing costs and high reliability.

[0037] With reference to FIG. 3, a defense-in-depth safety apparatus according to the second embodiment of the present invention will be described. FIG. 3 is a diagram showing configuration of the defense-in-depth safety apparatus according to the second embodiment of the present invention.

[0038] According to the second embodiment, a selector 30 is provided separately from a first controller 10. Using the selector 30, it is possible to select one of the first controller 10 and a second controller 20 to operate a safety system. In this case, the selector 30 may be located at the first location shown in FIG. 3, but not limited thereto.

[0039] The above-described embodiments are illustrative of the present invention, and the present invention is not limited thereto. Since numerous variations and modifications will become apparent to those skilled in the art once the above disclosure is fully appreciated, the scope and spirit of the invention come within the scope of the appended claims.