1、BRITISH STANDARD BS IEC 61497:1998 Nuclear power plants Electrical interlocks for functions important to safety Recommendations for design and implementation ICS 27.120.20BSIEC 61497:1998 This British Standard, having been prepared under the directionof the Engineering SectorCommittee, was published
2、under the authority ofthe Standards Committee andcomes into effect on 15March1999 BSI 05-1999 ISBN 0 580 32090 1 National foreword This British Standard reproduces verbatimIEC61497:1998 and implements it as the UK national standard. The UK participation in its preparation was entrusted to Technical
3、Committee NCE/8, Reactor instrumentation, which has the responsibility to: aid enquirers to understand the text; present to the responsible international/European committee any enquiries on the interpretation, or proposals for change, and keep the UK interests informed; monitor related international
4、 and European developments and promulgate them in the UK. A list of organizations represented on this committee can be obtained on request to its secretary. From 1January1997, all IEC publications have the number60000 added to the old number. For instance,IEC 27-1 has been renumbered as IEC60027-1.
5、For a period of time during the change over from one numbering system to the other, publications may contain identifiers from both systems. Cross-references The British Standards which implement international or European publications referred to in this document may be found in the BSI Standards Cat
6、alogue under the section entitled “International Standards Correspondence Index”, or by using the “Find” facility of the BSI Standards Electronic Catalogue. A British Standard does not purport to include all the necessary provisions of a contract. Users of British Standards are responsible for their
7、 correct application. Compliance with a British Standard does not of itself confer immunity from legal obligations. Summary of pages This document comprises a front cover, an inside front cover, pages i and ii, theCEI IEC title page, page ii, pages 1 to 10, an inside back cover and abackcover. This
8、standard has been updated (see copyright date) and may have had amendments incorporated. This will be indicated in the amendment table on the inside front cover. Amendments issued since publication Amd. No. Date CommentsBSIEC61497:1998 BSI 05-1999 i Contents Page National foreword Inside front cover
9、 Text of CEI IEC 61497 1ii blankBSIEC 61497:1998 ii BSI 05-1999 Contents Page Introduction 1 1 Scope 1 2 Normative references 2 3 Definitions and abbreviations 2 3.1 Definitions 2 3.2 Abbreviations 3 4 Requirements 3 4.1 System requirements 3 4.2 System design 4 4.3 Interlock integrity 5 4.4 Interlo
10、ck equipment 6 4.5 Documentation 7 4.6 Computer-based equipment 7 4.7 Operator actions 8 4.8 Power supplies 8 5 Test methods 8 5.1 Test and monitoring facilities 8 5.2 Automatic test aids 8 5.3 Self-testing and monitoring 9 Annex A (informative) Typical interlocks 10 Annex B (informative) Guidance o
11、n application of single-channel, double-channel or multi-channel interlocks 11BSIEC61497:1998 BSI 05-1999 1 Introduction Interlock functions on nuclear power plants prevent unsafe conditions or operations, protect personnel and prevent hazards. Interlock functions prevent actions which could lead to
12、 or increase danger or damage to the plant, and do not normally take steps to correct conditions. Interlock functions may limit a continuing action in order to prevent a condition developing, or may prevent a possible action and thereby prevent a condition. Interlock functions may generate a permiss
13、ive signal to allow selection of the output of an instrument only when in its operating range, for use by the reactor protection system or a control system for the current power, temperature range or condition. Interlock functions may be provided by mechanical means or by administration, by operator
14、 action or by electrical methods. Administration is under control of the plant management, and involves signatures on permits and records of authority to perform operations, which are not discussed. Such methods may be used to control personnel access to an active area, to permit operator use of a c
15、ontrol, to authorize issue of a key which can release a locked control or which allows access to perform some operation for special or non-routine reasons. Electrical methods include use of the reactor protection system, logic within control systems, logic in computer-based equipment, interconnectio
16、ns in switchgear and dedicated units of relay or solid-state logic. Typical interlock functions and methods of providing electrical interlocks are given inAnnex A. The nuclear safety requirements for interlocks may be in addition to or different from the interlock requirements for fire protection, p
17、ersonnel safety or plant protection. These requirements may conflict and guidance is given on resolution of conflicts. The requirements for classification and for reliability of instrumentation and control systems important to safety are discussed in IEC61226. Electrical interlocks require classific
18、ation according to that standard to identify basic requirements. Some requirements for safety system interlocks can be derived fromIAEA50-SG-D3, but not for all interlocks important to safety. The system, design, reliability and equipment requirements appropriate to categories A, B and C are develop
19、ed in this standard. Interlock functions exist in many systems on a nuclear plant, which can result in different approaches to their implementation in different systems. They should therefore be implemented in a consistent manner throughout a plant. This standard is concerned with the practical impl
20、ications of electrical interlock design and implementation to meet the levels of performance, reliability and consistency required on nuclear plants. 1 Scope This International Standard provides recommendations for the design and implementation of electrical interlocks used actively or passively to
21、prevent unsafe conditions or to ensure specific safe conditions and states during the operation of nuclear power plants. Safety system interlocks are covered by standards for safety systems. This standard gives design, reliability and test criteria arising from the consideration of interlocks import
22、ant to safety in accordance with IEC61226. It uses categories A, B and C as defined by that document. It takes into account the interlock safety significance and functions, and the role of the operator in some interlocks. Guidance is given on redundancy and on diversity of equipment for implementing
23、 interlocks, where high availability or integrity is involved, or where common mode failure may limit reliability. The use of computer-based equipment for interlock functions is discussed, and recommendations for diversity are given. Requirements for software and for verification and validation are
24、given by reference to IEC60880. The provision of test facilities is discussed together with self-testing and self-monitoring methods. The system of interlocks for a specific function includes the sensors of plant state (e.g., measuring devices and limit switches), the interlock and control power sup
25、plies, the control and instrumentation equipment providing the particular logic function for prevention or limitation of operation, and the cables, electromechanical features, key control and administrative control associated with the function.BSIEC 61497:1998 2 BSI 05-1999 2 Normative references Th
26、e following normative documents contain provisions which, through reference in this text, constitute provisions of this International Standard. At the time of publication, the editions indicated were valid. All normative documents are subject to revision, and parties to agreements based on this Inte
27、rnational Standard are encouraged to investigate the possibility of applying the most recent editions of the normative documents indicated below. Members of IEC and ISO maintain registers of currently valid International Standards. IEC 60231A:1969, First supplement to IEC60231:1967, General principl
28、es of nuclear reactor instrumentation 1) . IEC 60617-12:1997, Graphical symbols for diagrams Part 12: Binary logic elements. IEC 60812:1985, Analysis techniques for system reliability Procedure for failure mode and effects analysis (FMEA). IEC 60880:1986, Software for computers in the safety systems
29、 of nuclear power stations. IEC 60987:1989, Programmed digital computers important to safety for nuclear power stations. IEC 61225:1993, Nuclear power plants Instrumentation and control systems important for safety Requirements for electrical supplies. IEC 61226:1993, Nuclear power plants Instrument
30、ation and control systems important for safety Classification. IEC 61500:1996, Nuclear power plants Instrumentation and control systems important to safety Functional requirements for multiplexed data transmission. IAEA 50-C-D (Rev. 1 ):1988, Code on the safety of nuclear power plants Design. IAEA 5
31、0-SG-D3:1980, Protection system and related features in nuclear power plants. IAEA 50-SG-D8:1985, Safety-related instrumentation and control systems for nuclear power plants. 3 Definitions and abbreviations 3.1 Definitions For the purpose of this International Standard, the following definitions app
32、ly. 3.1.1 availability fraction of time that a system is actually capable of performing its mission (IAEA 50-SG-D8) 3.1.2 category safety category asA, B, C or unclassified, defined for the function, system or equipment by classification to IEC 61226 3.1.3 channel separate path along which informati
33、on flows through a redundant or distributed system. That path may also require redundancy (adapted from IEC61500) 3.1.4 diversity existence of two or more different ways or means of achieving a specified objective. Diversity is specifically provided as a defense against common mode failure. It may b
34、e achieved by providing systems that are physically different from each other, or by functional diversity, where similar systems achieve the specified objective in different ways (seeclause 3 ofIEC61226) 3.1.5 electrical interlocks auxiliary contacts or equipment electrically associated with the con
35、trolled apparatus and reacting upon the control circuit or equipment to ensure the equipment operates safely and in the required manner or sequence 3.1.6 integrity a quality of completeness, dependability and freedom from defects 3.1.7 interlocks single-channel, double-channel and multi-channel inte
36、rlocks Single-channel interlocks use a single channel of sensors, logic units and an actuation item such as a contactor or relay. Double-channel interlocks use two channels of equipment and sensors, arranged so that each channel is capable, on its own, of preventing the unsafe condition or state. Th
37、e channels may consist of two sets of essentially identical equipment. An alternative is two different channels which perform the interlock functions differently, or two similar channels, one in normal operation and the other in backup operation to prevent an unsafe condition or state if the first c
38、hannel fails. 1) This standard contains valuable technical advice, but is not maintained by IEC and is not therefore fully normative.BSIEC61497:1998 BSI 05-1999 3 Multi-channel interlocks use several channels of equipment and sensors. They are arranged so that each channel is capable, on its own, of
39、 preventing the unsafe condition or state. One failed channel cannot block actions which prevent unsafe conditions or states. Use of multi-channel systems can provide benefits due to allowing on-line maintenance and avoiding the need for a channel bypass. 3.1.8 interlock functions functions implemen
40、ted as part of the instrumentation and control system of the plant, which prevent unsafe conditions or operations, protect personnel and prevent hazards 3.1.9 redundancy provision of more than the minimum number of (identical or diverse) elements or systems, so that the loss of any one does not resu
41、lt in the loss of the required function of the whole (IAEA50-C-D) 3.1.10 safety interlock system that part of the protection system which prevents certain operations which may affect the safety of the reactor unless all prescribed conditions are met 3.1.11 interlock system important to safety that p
42、art of the electrical and instrumentation and control systems important to safety which prevents or limits certain operations which may affect the safety of the reactor, unless all prescribed conditions are met 3.1.12 software programs, procedures, rules and any associated documentation pertaining t
43、o the operation of a computer system (see2.16 ofIEC60880) 3.2 Abbreviations 4 Requirements 4.1 System requirements 4.1.1 Interlock functional requirements The interlock functions shall be defined and documented, and their safety role determined. The functions, systems and equipment for interlocks sh
44、all be classified using the criteria ofIEC61226 to assign them to a category (A, B, C or unclassified) and to determine the requirements for assurance of functionality, reliability, performance, environmental durability, and quality assurance and control. Interlocks functions may be used: a) to prev
45、ent an unsafe or incorrect operation being taken by an operator or by an automatic system; b) to prevent conditions developing which are unsafe or incorrect by restricting a control action; c) to inhibit the progress of a sequence of operations until conditions are safe or correct; d) to generate a
46、permissive signal to allow selection of the output of the instrument when it is in its operating range; e) to prevent operation of equipment in one operating mode when it is only safe to operate it in another operating mode; f) to permit the operation of the equipment beyond its intended function or
47、 design basis, if the operation would enhance nuclear safety in beyond design basis conditions; g) to prevent hazards such as fire and dropped load from causing an unsafe condition or state. Operational interlock functions typically provide stopping and starting a pump, stopping of valve actuators a
48、t valve limits, prevention of pump start against closed valves and similar control or conditioning functions. Plant protection interlock functions prevent motor or actuator overload, plant operation outside its normal envelope and prevent plant damage. These functions shall be included in the interl
49、ock classification process. Typical interlock functions important to safety and significant to operation are given, for information, in Annex A, with a cross reference to the above types of function. The expression of requirements should be verified by reference to the safety analysis of the plant. Animation or modelling of the logic are tools for the verification process. PIE Postulated initiating event PLC Programmable logic controllerBSIEC 61497:1998 4 BSI 05-1999 4.1.2 Interlock reliability requirements The reliability and integrity requireme
