Reactor protection-processor-to-reactor-trip breaker interface and method for operating the same

Abstract

A method is provided of operating a reactor trip system, including: determining whether an automated shutdown of the nuclear plant has been demanded; energizing an interface relay to de-energize an undervoltage coil of a circuit breaker when the automated shutdown has been demanded; energizing an interface relay to energize a shunt trip coil of the first circuit breaker when the automated shutdown has been demanded; de-energizing the undervoltage coil when the manual shutdown has been demanded; energizing the shunt trip coil when the manual shutdown has been demanded; performing a check of a cyclical execution of processors in first and second divisions using separate watchdog timers in each division and determining whether watchdog timer signals have been de-energized in the first and second divisions; and de-energizing the undervoltage coil if the first and second watchdog timer signals have both been actuated.

What is claimed is: 
     
         1 . A method of operating a reactor trip system, comprising:
 performing a check to determine whether an automated shutdown of the nuclear plant has been demanded;   energizing an interface relay to de-energize an undervoltage coil of a first circuit breaker when the automated shutdown has been demanded, the undervoltage coil being a de-energize-to-actuate circuit configured to open the first circuit breaker, which is configured with other circuit breakers in first and second divisions to shut down a nuclear power plant when opened;   energizing an interface relay to energize a shunt trip coil of the first circuit breaker, when the automated shutdown has been demanded, the shunt trip coil being an energize-to-actuate circuit configured to open the first circuit breaker   performing a check to determine whether a manual shutdown of the nuclear plant has been demanded;   de-energizing the undervoltage coil of the first circuit breaker when the manual shutdown has been demanded;   energizing the shunt trip coil of the first circuit breaker when the manual shutdown has been demanded;   performing a check of a cyclical execution of processors in the first and second divisions which execute the automated shutdown demand, using separate watchdog timers in each division, and determining whether watchdog timer signals have been de-energized in the first and second separate divisions of the nuclear plant; and   de-energizing the undervoltage coil of the first circuit breaker if the first and second watchdog timer signals have both been actuated.   
     
     
         2 . The method of operating a reactor trip system of  claim 1 , wherein the operation of performing a check to determine whether an automatic shutdown has been demanded further comprises:
 receiving a first undervoltage coil control signal from a first automated shutdown demand check circuit;   receiving a diverse undervoltage coil control signal from a diverse automated shutdown demand check circuit;   determining whether the first undervoltage coil control signal and the diverse undervoltage coil control signal are both energized;   determining that the automatic shutdown has not been demanded when it is determined that the first undervoltage coil control signal and the diverse undervoltage coil control signal are not both energized; and   determining that the automatic shutdown has been demanded when it is determined that the first undervoltage coil control signal and the diverse undervoltage coil control signal are both energized.   
     
     
         3 . The method of operating a reactor trip system of  claim 2 , wherein
 the first automated shutdown demand check circuit and the diverse automated shutdown demand check circ uit perform the same logical operations, but are not identical.   
     
     
         4 . The method of operaing a reactor trip system of  claim 1 , wherein the operation of performing a check to determine whether an automatic shutdown has been demanded further comprises:
 receiving a first shunt trip control signal from a first automated shutdown demand check circuit;   receiving a diverse shunt trip control signal from a diverse automated shutdown demand check circuit;   determining whether the first shunt trip control signal and the diverse shunt trip control signal are both energized;   determining that an automatic shutdown has not been demanded when it is determined that the first shunt trip control signal and the diverse shunt trip control signal are not both energized; and   determining that an automatic shutdown has been demanded when it is determined that the first shunt trip control signal and the diverse shunt trip control signal are both energized.   
     
     
         5 . The method of operating a reactor trip system of  claim 4 , wherein
 the first automated shutdown demand check circuit and the diverse automated shutdown demand check circuit perform the same logical operations, but are not identical.   
     
     
         6 . The method of operating a reactor trip system of  claim 1 , wherein the operation of performing a check of the cyclical execution of processors in the first and second divisions further comprises:
 receiving a first watchdog timer signal from a first division in the nuclear plant;   receiving a second watchdog timer signal from a second division in the nuclear plant; and   determining whether the first watchdog timer signal and the second watchdog timer signal are both de-energized.   
     
     
         7 . The method of operating a reactor trip system of  claim 1 ,
 wherein the operations of performing a check to determine whether a manual shutdown of the nuclear plant has been demanded, performing a first and diverse check to determine whether an automated shutdown of the nuclear plant has been demanded, and performing a cyclical processing check of processors in the first and second divisions are continually repeated to open the first circuit breaker and other circuit breakers in the first division.   
     
     
         8 . A reactor protection-processor-to-reactor-trip breaker interface of a nuclear plant, comprising:
 a breaker, configured to control shutdown of the nuclear plant, the breaker including
 an undervoltage coil connected between an undervoltage input node and ground, the undervoltage coil being configured to open the breaker when it is de-energized, and 
 a shunt trip coil connected between a shunt trip input node and ground, the shunt trip coil being configured to open the breaker when it is energized; 
   a manual activation switch having
 an undervoltage switch contact connected between a power source and a first node, the undervoltage switch contact being configured to open when a manual activation switch indicates a reactor shutdown is required, and close when the manual activation switch indicates that no reactor shutdown is required, and 
 a shunt trip switch contact connected between the first node and the shunt trip input node, the shunt trip switch contact being configured to close when the manual activation switch indicates a reactor shutdown is required, and open when the manual activation switch indicates that no reactor shutdown is required; 
   an energize-to-activate undervoltage control circuit including first and diverse undervoltage switches connected in parallel between the first node and a second node, the first undervoltage switch being configured to open when a first undervoltage signal indicates the reactor shutdown is required, and close when the first undervoltage signal indicates that no reactor shutdown is require, the second undervoltage switch being configured to open when a diverse undervoltage signal indicates the reactor shutdown is required, and close when the diverse undervoltage signal indicates that no reactor shutdown is require   an energize-to-activate shunt trip control circuit including first and diverse shunt trip switches connected in series between the first node and the shunt trip input node, the first shunt trip switch being configured to close when a first shunt trip signal indicates a reactor shutdown is required, and open when the first shunt trip signal indicates that no reactor shutdown is required, and the second shunt trip switch being configured to close when a diverse shunt trip signal indicates the reactor shutdown is required, and open when the diverse shunt trip signal indicates that no reactor shutdown is required;   a watchdog timer circuit including a first watchdog timer switch in a first division and a second watchdog timer switch in a second division different from the first division, the first watchdog timer switch and the second watchdog timer switch being connected in parallel between the second node and the undervoltage input node, the first watchdog timer switch being configured to open when a first watchdog timer signal indicates that cyclical execution of a processor in the first division has failed, and close when the first watchdog timer signal indicates that the cyclical execution of the processor in the first division has not failed, and the second watchdog timer switch being configured to open when a second watchdog timer signal indicates that cyclical execution of a processor in the second division has failed, and close when the second watchdog timer signal indicates that the cyclical execution of the processor in the second division has not failed, the watchdog timer circuit thereby indicating that a reactor shutdown is required when both the first watchdog timer signal indicates that the cyclical execution of the processors in the first division has failed, and the second watchdog timer signal indicates that the cyclical execution of the processor in the second division has failed.   
     
     
         9 . The reactor protection-processor-to-reactor-trip breaker interface of  claim 8 , further comprising:
 a first controller configured to energize a first undervoltage coil interface relay based on an automated shutdown demand, the first undervoltage coil interface relay and the first controller being energize-to-actuate circuits;   a second controller configured to energize a second undervoltage coil interface relay based on an automated shutdown demand, the second undervoltage coil interface relay and the second controller being energize-to-actuate circuits;   a third controller configured to energize a first shunt trip coil interface relay based on an automated shutdown demand, the first shunt trip coil interface relay and the third controller being energize-to-actuate circuits;   a fourth controller configured to energize a second shunt trip coil interface relay based on the automated shutdown demand, the second shunt trip coil interface relay and fourth controller being energize-to-actuate circuits;   a first watchdog timer in the first division configured to de-energize a third undervoltage coil interface relay based on a disturbance in a cyclical execution of the automated shutdown demand processing, the third undervoltage coil interface relay and the first watchdog timer being de-energize-to-actuate circuits;   a second watchdog timer in the second division configured to de-energize a fourth undervoltage coil interface relay based on a disturbance in the cyclical execution of the automated shutdown demand processing, the fourth undervoltage coil interface relay and the second watchdog timer being de-energize-to-actuate circuits; and   an interconnection of the first division and second division watchdog timers via the third and fourth undervoltage coil interface relays, where both divisions must de-energize to actuate the undervoltage coil circuits of each circuit breaker.   
     
     
         10 . The reactor protection-processor-to-reactor-trip breaker interface of  claim 8 , wherein
 the first undervoltage signal is generated based on an undervoltage input signal provided to a first signal path,   the diverse undervoltage signal is generated based on the undervoltage input signal provided to a second signal path separate from the first signal path,   the first shunt trip signal is generated based on a shunt trip input signal provided to a third signal path, and   the diverse shunt trip signal is generated based on the shunt trip input signal provided to a fourth signal path separate from the third signal path.   
     
     
         11 . The reactor protection-processor-to-reactor-trip breaker interface of  claim 8 , wherein
 the manual activation switch with undervoltage and shut trip switch contacts, the first and second undervoltage switches, the first and second shunt trip switches, and the first watchdog timer switch are all in a first division of the nuclear plant, and   the second watchdog timer switch is in a second division of the nuclear plant.   
     
     
         12 . The reactor protection-processor-to-reactor-trip breaker interface of  claim 8 , wherein
 the undervoltage switch contact of the manual activation switch, the first undervoltage switch, the diverse undervoltage switch, the first watchdog timer switch, and the second watchdog timer switch are all configured to be closed when there is no demand for a reactor shutdown and open when there is a demand for a reactor shutdown   the shunt trip contact of the manual activation switch, the first shunt trip signal, and the diverse shunt trip signal are all configured to be open when there is no demand for a reactor shutdown and closed when there is a demand for a reactor shutdown.   
     
     
         13 . A reactor protection-processor-to-reactor-trip breaker interface, comprising:
 an energizing circuit configured to de-energize an undervoltage coil, the undervoltage coil being a de-energize-to-actuate circuit configured to open a reactor trip circuit breaker when de-energized;   an energizing circuit configured to energize a shunt trip coil, the shunt trip coil being an energize-to-actuate circuit configured to open the reactor trip circuit breaker when energized;   a first manual shutdown circuit configured to de-energize the undervoltage coil when manual shutdown has been demanded;   a second manual shutdown circuit configured to energize the shunt trip coil when the manual shutdown has been demanded;   a first main automatic shutdown circuit configured to de-energize the undervoltage coil if the automatic shutdown has been demanded;   a first diverse automatic shutdown circuit configured to de-energize the undervoltage coil when the automatic shutdown has been demanded;   a second main automatic shutdown circuit configured to energize the shunt trip coil when the automatic shutdown has been demanded;   a second diverse automatic shutdown circuit configured to energize the shunt trip coil when the automatic shutdown has been demanded; and   a cyclical execution check circuit configured to de-energize the undervoltage coil when both first and second watchdog timer signals in separate first and second divisions, respectively, have been actuated indicating that cyclical execution processing has failed in both the first and second divisions.   
     
     
         14 . The reactor protection-processor-to-reactor-trip breaker interface of  claim 13 , wherein the manual shutdown check circuit is further configured to:
 receive a manual reactor trip signal   determine whether a manual push button has been energized based on the manual reactor trip signal;   continue processing when it is determined that the manual push button is not energized; and   de-energize the undervoltage coil, energize the shunt trip coil and end processing when it is determined that the manual push button is energized.   
     
     
         15 . The reactor protection-processor-to-reactor-trip breaker interface of  claim 13 , wherein the first automatic shutdown circuit is further configured to:
 receive a first undervoltage coil control signal from a first automated shutdown demand check circuit;   receive a diverse undervoltage coil control signal from a diverse automated shutdown demand check circuit;   determine whether the undervoltage output signal and the diverse undervoltage coil control signal are both energized;   continue processing when it is determined that the undervoltage output signal and the diverse undervoltage coil control signal are not both energized; and   de-energize the undervoltage coil and end processing when it is determined that the undervoltage output signal and the diverse undervoltage output signal are both energized.   
     
     
         16 . The reactor protection-processor-to-reactor-trip breaker interface of  claim 13 , wherein the second automatic shutdown circuit is further configured to:
 receive a first shunt trip coil control signal from a first automated shutdown demand check circuit;   receive a diverse shunt trip coil control signal from a diverse automated shutdown demand check circuit;   determine whether the shunt trip coil control signal and the diverse shunt trip coil control signal are both energized;   continue processing when it is determined that the shunt trip coil control signal and the diverse shunt trip coil control signal are not both energized; and   energize the shunt trip coil and end processing when it is determined that the shunt trip coil control signal and the diverse shunt trip coil control signal are both energized.   
     
     
         17 . The reactor protection-processor-to-reactor-trip breaker interface of  claim 13 , wherein the first automatic shutdown circuit is an energize-to-actuate circuit. 
     
     
         18 . The reactor protection-processor-to-reactor-trip breaker interface of  claim 13 , wherein the diverse automatic shutdown circuit is an energize-to-actuate circuit. 
     
     
         19 . The reactor protection-processor-to-reactor-trip breaker interface of  claim 13 , wherein the cyclical execution check circuit is further configured to:
 receive a first watchdog timer signal from a first division in the nuclear plant;   receive a second watchdog timer signal from a second division in the nuclear plant;   determine whether the first watchdog timer signal and the second watchdog timer signal are both de-energized;   continue processing when it is determined that the first and second watchdog timer signals are not both de-energized; and   de-energize the undervoltage coil and end processing when it is determined that the first and second watchdog signals are both de-energized.   
     
     
         20 . The reactor protection-processor-to-reactor-trip breaker interface of  claim 13 , wherein:
 the first main automatic shutdown circuit performs a same operation as the first diverse automatic shutdown circuit,   the first main automatic shutdown circuit is not identical to the first diverse automatic shutdown circuit,   the second main automatic shutdown circuit performs a same operation as the second diverse automatic shutdown circuit,   the second main automatic shutdown circuit is not identical to the second diverse automatic shutdown circuit.