Engineered Safety Features Actuation System Research Articles

Hazard analysis for identifying common cause failures of digital safety systems using a redundancy-guided systems-theoretic approach

Replacing the existing aging analog instrumentation and control (I&C) systems with modern safety control and protection, digital technology offers one of the foremost means of performance improvements and cost reductions for the existing nuclear power plants (NPPs). However, the qualification of digital I&C systems remains a challenge, especially considering the issue of software common-cause failures (CCFs), which are difficult to address. With the application and upgrades of advanced digital I&C systems, software CCFs have become a potential threat to plant safety because most redundant designs use similar digital platforms or software in the operating and application systems. With complex designs of multilayer redundancy to meet the single-failure criterion, digital I&C safety systems (e.g., engineered safety-features actuation system [ESFAS]) are of a particular concern in the U.S. Nuclear Regulatory Commission (NRC) licensing procedures. This paper applies a modularized approach to conduct redundancy-guided systems-theoretic hazard analysis for an advanced digital ESFAS with multilevel redundancy designs. Systematic methods and risk-informed tools are incorporated to address both hardware and software CCFs, which provide guidance to eliminate the causal factors of potential single points of failure in the design of digital safety systems in advanced plant designs.

PSA model with consideration of the effect of fault-tolerant techniques in digital I&C systems

Digital systems have unique features that are not applied in analog systems, and these features should be considered in a system safety evaluation, especially in safety critical systems such as nuclear power plants (NPPs). Among the distinguishable features of digital systems, fault-tolerant techniques might be one of the most beneficial features to enhance the system safety. If a fault is detected by the fault-tolerant techniques, then the effect of the fault is isolated from the system output to ensure the system safety. In digital instrumentation and control systems in NPPs such as a reactor protection system and an engineered safety features actuation system, multiple fault-tolerant techniques are designed to prevent the undesired system behaviors by faults. However, the effect of fault-tolerant techniques has not been appropriately reflected in the probabilistic safety assessment (PSA) models for NPPs. In this work, a method to develop a PSA model with consideration of the effect of the fault-tolerant techniques in an NPP digital reactor protection system was proposed. Because multiple fault-tolerant techniques have a different inspection range and inspection time, it was proposed to divide the areas according to the inspecting functions. Each area has the specific failure probability and fault detection coverage. For an application, a digital reactor protection system that aims to automatically generate a trip signal in an emergency situation was evaluated. The failure probability and detection methods of each failure mode were identified based on the failure mode and effect analysis (FMEA) data. From the results, it was observed that fault-tolerant techniques have a significant effect on the system reliability. It is expected that more accurate and reasonable digitalized NPP safety evaluation can be achieved using the proposed method.

총채널 불확실도를 적용한 원전 노심출구온도의 운전가능 판정기준

Nuclear power plants are equipped with the reactor trip system (RTS) and the engineered safety features actuation system (ESFAS) to improve safety on the normal operation. In the event of the design basis accident (DBA), a various of post accident monitor(PAM)systems support to provide important details (e.g. Containment pressure, temperature and pressure of reactor cooling system and core exit temperature) to determine action of main control room (MCR). Operator should be immediately activated for the accident mitigation with the information. Especially, core exit temperature is a critical parameter because the operating mode converts from normal mode to emergency mode when the temperature of core exit reaches 649 ℃. In this study, uncertainty which was caused by exterior environment, characteristic of thermocouple/connector and accuracy of calibrator/indicator was evaluated in accordance with ANSI-ISA 67.04. The square root of the sum of square (SRSS) methodology for combining uncertainty terms that are random and independent was used in the synthesis. Every uncertainty that may exist in the hardware which is used to measure the core exit temperature was conservatively applied and the associative relation between the elements of uncertainty was considered simultaneously. As a result of uncertainty evaluation, the channel statistical allowance (CSA) of single channel of core exit temperature was +1.042%Span. The range of uncertainty,╶0.35%Span (╶4.05℃) ~ +2.08%Span(24.25℃), was obtained as the operating criteria of

원전 계측 채널 Drift에 관한 연구

원자력발전소의 원자로보호계통 및 공학적안전설비계통의 계측채널 설정치는 발전소 안전성을 확보하는 데 있으며, 출력조건의 변화시에는 보호계통의 작동이 보장되어야 한다. 본 연구에서는 발전소 운영자료, 시방서 및 운전 매뉴얼등을 사용하여 설정치를 평가하는 데 불확실도의 중요한 요소인 계측기와 process rack drift의 적절성을 확인하고, 설정치 여유가 부족할 경우에 대한 대책을 연구하였다. The Instrument Channel setpoints of the Reactor Protection System(RPS) and the Engineered Safety Feature Actuation System(ESFAS) ensures the safety of Nuclear Power Plants (NPPs), and the actuation of the protection system should be guaranteed on power change condition. The goal of this study is to verify the appropriateness of the sensor drift and rack drift which are important factors for setpoints evaluation and to improve the setpoints margin using the operation data, design specifications and operation manuals of the NPPS.

A study on the effects of ESFAS STI modification on the unavailability of ESF actuated components

The nuclear industry has made so great efforts to attain safe and economically viable Nuclear Power Plants all over the world. Probabilistic Safety Assessment (PSA) applications are required now more than ever in order to operate Nuclear Power Plants. In this paper, the unavailability model of Engineered Safety Feature (ESF) actuated components, which is part of the Korean Standard Nuclear Power Plant (KSNPP) PSA model, is used to analyze the effects of Surveillance Test Interval (STI) extension of Engineered Safety Feature Actuation System (ESFAS) on the unavailability of the ESF actuated components. To develop a more accurate and realistic PSA model, the loop controller modules of Plant Control System (PCS) are also modeled on the KSNPP PSA model. The fault tree developed by each ESF actuated component includes the component failure, ESFAS signal failure, and loop controller module failure of PCS. When the ESFAS STI is extended from one month to three months, the unavailability of ESF actuated components partially increased by 10%. This shows the STI extension of ESFAS has minor effects on the unavailability of the ESF actuated components. The effects of ESFAS STI extension of KSNPP on the unavailability of the ESF actuated components as well as Core Damage Frequency (CDF) and Large Early Release Frequency (LERF) is less than expected. That result indirectly indicates that the ESFAS in KSNPP is designed well enough to extend the ESFAS STI.

Main control system verification and validation of NPP digital I&C system based on engineering simulator

Abstract Full-scope digital instrumentation and controls system (I&C) technique is being introduced in Chinese new constructed Nuclear Power Plant (NPP), which mainly includes three parts: control system, reactor protection system and engineered safety feature actuation system. For example, SIEMENS TELEPERM XP and XS distributed control system (DCS) have been used in Ling Ao Phase II NPP, which is located in Guangdong province, China. This is the first NPP project in China that Chinese engineers are fully responsible for all the configuration of actual analog and logic diagram, although experience in NPP full-scope digital I&C is very limited. For the safety, it has to be made sure that configuration is right and control functions can be accomplished before the phase of real plant testing on reactor. Therefore, primary verification and validation (V&V) of I&C needs to be carried out. Except the common and basic way, i.e. checking the diagram configuration one by one according to original design, NPP engineering simulator is applied as another effective approach of V&V. For this purpose, a virtual NPP thermal-hydraulic model is established as a basis according to Ling Ao Phase II NPP design, and the NPP simulation tools can provide plant operation parameters to DCS, accept control signal from I&C and give response. During the test, one set of data acquisition equipments are used to build a connection between the engineering simulator (software) and SIEMENS DCS I/O cabinet (hardware). In this emulation, original diagram configuration in DCS and field hardware structures are kept unchanged. In this way, firstly judging whether there are some problems by observing the input and output of DCS without knowing the internal configuration. Then secondly, problems can be found and corrected by understanding and checking the exact and complex configuration in detail. At last, the correctness and functionality of the control system are verified. This method is also very convenient for expansion to other type digital I&C V&V. This paper is mainly focused on V&V of closed-loop control systems in full-scope DCS and several detailed reactor control (RRC) systems, including pressurizer pressure and water level control, steam generator water level control. The V&V works were carried out by applying engineering simulator. This paper describes the structure and function of the simulator, V&V procedure, results analysis and problems identified. Through the actual on-line virtual closed-loop testing on Ling Ao Phase II NPP project, many problems of DCS configuration were found and solved. And it proved that V&V based on engineering simulator enables significant time saving, improves economics and safety in the phase of engineering debugging.

Development and diversity and defense-in-depth application of ABWR feedwater pump and controller model

This work developed an advanced boiling water reactor (ABWR) feedwater pump and controller model, which was incorporated into Personal Computer Transient Analyzer (PCTran)-ABWR, a nuclear power plant simulation code. The feedwater pump model includes three turbine-driven feedwater pumps and one motor-driven feedwater pump. The feedwater controller includes a one-element/three-element water level controller and a specific feedwater speed controller for each feedwater pump. The performance tests, including step change of dome pressure, feedwater pumps transfer, inadvertent closure of all turbine control valves, and one feedwater pump trip at 100% power, demonstrate the feasibility of dynamic response of stand-alone model and incorporated model. Furthermore, a diversity and defense-in-depth analysis is performed to demonstrate the feasibility for motor-driven feedwater pump as an emergency core cooling system (ECCS) automatic diverse back-up. In Lungmen nuclear power plant (NPP), a diverse manual initiation means for the high pressure core flooder (HPCF) loop C is designed as the back-up of digitalized engineered safety features actuation system (ESFAS). If the motor-driven feedwater pump (MDFWP) can be an automatic digital diverse back-up for ESFAS, Lungmen NPP would be more robust to defend against software common-cause failure (CCF).

Quantitative evaluation of safety-critical software at the early development stage: an interposing logic system software example

In order to produce highly reliable software, designers and developers pay particular attention to the early development phases, that is, the requirement phase and the design phase. In this work, a few novel quantitative measures are suggested for estimating how much influence the development methods at the early stage have on the reliability elevation. Three complexity measures are suggested in this work, which are Operation Complexity, Interface Complexity, and Micro-Complexity. These measures are based on the entropy concept. The entropy-based complexities need information on probability distributions. For this purpose, the operational profile for Operation Complexity, the relative frequencies of module couplings for Interface Complexity, and the relative frequencies of module strengths for Micro-Complexity are introduced. We further developed estimation standards for these complexities. In order to demonstrate the utility of these standards, the software design of a digital Interposing Logic System (ILS) of an Engineered Safety Feature Actuation System (ESFAS) in nuclear power plants has been evaluated using the standards presented in this work. The results show that the proposed standards are useful in developing more reliable softwares and minimizing the efforts or costs for coding, testing, etc.

Engineered Safety Features Actuation System Follow-Up System Logic

This paper presents an overview of some of the safety related control logics for follow-up systems of an engineered safety features actuation system (ESFAS) for a pressurized water nuclear power plant. The logics are designed for operation of engineered safety features systems up to their component levels to perform the required safety functions during the course of an accident.