Reactor Protection System Research Articles

Cabinet Module Design and Evaluation

The reactor protection system (RPS) in nuclear power plants plays the roles of generating the reactor trip signal and the engineered safety features (ESF) actuation signal when the monitored plant processes reach the predefined limits. The cabinet of the RPS is used for the RPS integrity testing and monitoring by maintenance operators and is equipped with a flat panel display (FPD) with a touch screen capability as a main user interface for the RPS operation. This paper describes the human factors activities involved in the development process of the RPS: conceptual design, design guidance, and evaluation.

On the optimal scheduling of periodic tests and maintenance for reliable redundant components

Periodically, some m of the n redundant components of a dependable system may have to be taken out of service for inspection, testing or preventive maintenance. The system is then constrained to operate with lower ( n− m) redundancy and thus with less reliability during these periods. However, more frequent periodic inspections decrease the probability that a component fail undetected in the time interval between successive inspections. An optimal time schedule of periodic preventive operations arises from these two conflicting factors, balancing the loss of redundancy during inspections against the reliability benefits of more frequent inspections. Considering no other factor than this decreased redundancy at inspection time, this paper demonstrates the existence of an optimal interval between inspections, which maximizes the mean time between system failures. By suitable transformations and variable identifications, an analytic closed form expression of the optimum is obtained for the general ( m, n) case. The optimum is shown to be unique within the ranges of parameter values valid in practice; its expression is easy to evaluate and shown to be useful to analyze and understand the influence of these parameters. Inspections are assumed to be perfect, i.e. they cause no component failure by themselves and leave no failure undetected. In this sense, the optimum determines a lowest bound for the system failure rate that can be achieved by a system of n-redundant components, m of which require for inspection or maintenance recurrent periods of unavailability of length t. The model and its general closed form solution are believed to be new [2,5]. Previous work [1,4,10] had computed optimal values for an estimation of a time average of system unavailability, but by numerical procedures only and with different numerical approximations, other objectives and model assumptions (one component only inspected at a time), and taking into account failures caused by testing itself, repair and demands (see in particular [6,7,9]). System properties and practical implications are derived from the closed form analytical expression. Possible extensions of the model are discussed. The model has been applied to the scheduling of the periodic tests of nuclear reactor protection systems.

Branduolinio reaktoriaus valdymo ir apsaugos sistemos modeliavimas

Ignalina NPP RBMK-1500 reactor control and protection system (RCPS) logic, which was implemented in code QUABOX/CUBBOX-HYCA, is described in the paper. Analysis of numerical simulation results shows, that logic of RBMK-1500 RPSS is adequate to logic as described in technical literature. Simulation results obtained by code QUABOX/CUBBOX-HYCA were compared with simulation results obtained us­ing STEPAN code. The conclusion was made that RCPS operation sequences and response are analogical. The complement the code QUABOX/CUBBOX-HYCA with full realistic RCPS logic allows to simulate the transient processes and accidents, which have place in the reactor core of Ignalina nuclear power plant.

Software safety analysis of function block diagrams using fault trees

As programmable logic controllers (PLCs) are often used to implement safety–critical embedded software, safety demonstration of PLC code is needed. In this paper, we propose a fault tree analysis technique on Function Block Diagrams (FBDs) which is one of the most widely used PLC programming languages. FBD is currently being used to develop Reactor Protection System (RPS) for a nuclear power plant in South Korea. Our approach to fault tree analysis, which combines fault-oriented and cause/effect-oriented viewpoints, is easy to understand and offers systematic guidelines to ensure safety of PLC code. Domain experts found the approach to be useful through a case study on RPS, and this paper compares completeness and comprehensiveness of the semi-automatically generated fault trees using the proposed approach against the one manually prepared by nuclear safety engineers.

Reliability Analysis of the Reactor Protection System with Fault Diagnosis

The main function of a reactor protection system (RPS) is to maintain the reactor core integrity and reactor coolant system pressure boundary. The RPS consists of the 2-out-of-m redundant architecture to assure a reliable operation. The system reliability of the RPS is a very important factor for the probability safety assessment (PSA) evaluation in the nuclear field. To evaluate the system failure rate of the k-out-of-m redundant system is not so easy with the deterministic method. In this paper, the reliability analysis method using the binomial process is suggested to calculate the failure rate of the RPS system with a fault diagnosis function. The suggested method is compared with the result of the Markov process to verify the validation of the suggested method, and applied to the several kinds of RPS architectures for a comparative evaluation of the reliability. (orig.)

Synthesis of FBD-based PLC design from NuSCR formal specification

NuSCR is a formal specification language to document requirements for real-time embedded software with nuclear engineering applications in mind. Domain experts actively participated in selecting how to best represent various aspects. It uses tabular notations to specify required computations and automata to document state- or time-dependent behavior. As programmable logic controllers (PLCs) are widely used to implement real-time embedded software, synthesis of PLC code from a formal specification is desirable if transformation rules can be rigorously defined. In addition to improved productivity, results of safety analysis performed on requirements remain valid. In this paper, we demonstrate how NuSCR specification can be translated into semantically equivalent function block diagram (FBD) code. The process, except the initial phase where user provides information on missing or implicit details, is automated. Since executable code can be automatically generated using CASE tools from FBD, much of software development is automated. Proposed technique is currently being used in developing reactor protection system (RPS) for nuclear power plants in Korea, and experience to date has been positive. We demonstrate the proposed approach using the fixed set-point rising trip which is one of the most complex trip logics included in the RPS.

Monte Carlo estimation of the differential importance measure: application to the protection system of a nuclear reactor

In this paper, we perform a reliability/availability analysis by means of the Monte Carlo simulation method and illustrate a perturbation method, inherited from the particle transport field, which allows to compute first-order, differential sensitivity indexes with little additional computational effort. The proposed method is illustrated first on a simple case study and, successively, on a nuclear safety system, the reactor protection system. In these applications, the sensitivity indexes are used to compute the differential importance measure, recently introduced to respond to the need of the analyst/decision maker to get information about the importance of changes in the stochastic properties of system components.

A formal software requirements specification method for digital nuclear plant protection systems

This article describes NuSCR, a formal software requirements specification method for digital plant protection system in nuclear power plants. NuSCR improves the readability and specifiability by providing graphical or tabular notations depending on the type of operations. NuSCR specifications can be formally analyzed for completeness, consistency, and against the properties specified in temporal logic. We introduce the syntax and semantics of NuSCR and demonstrate the effectiveness of the approach using reactor protection system, digital protection system being developed in Korea, as a case study.

03/02282 The first digital reactor protection system in China: Li, F. et al. Nuclear Engineering and Design, 2002, 218, (1–3), 215–225

03/02282 The first digital reactor protection system in China: Li, F. et al. Nuclear Engineering and Design, 2002, 218, (1–3), 215–225

Availability Evaluation for Architectures of the Reactor Protection System

The Reactor Protection System (RPS) generates the signal to trip the reactor automatically whenever plant status exceeds the predefined limits. The protection system consists of the k-out-of-m redundant architecture to assure a reliable action. In this paper, the availability analysis method using the binomial process is presented to evaluate the MTBFO (Mean Time Between Forced Outage) ofthe k-out-of-m structure. The suggested method is compared with the result ofthe Markov process to verify the validation of the suggested method, and applied to several kinds of RPS architectures for comparative evaluation ofthe system level reliability.

Development of an Advanced Digital Reactor Protection System Using Diverse Dual Processors to Prevent Common-Mode Failure

The advanced digital reactor protection system (ADRPS) with diverse dual processors has been developed to prevent common-mode failure (CMF). The principle of diversity is applied to both hardware design and software design. For hardware diversity, two different types of CPUs are used for the bistable processor and local coincidence logic (LCL) processor. The Versa Module Eurocard-based single board computers are used for the CPU hardware platforms. The QNX operating system and the VxWorks operating system were selected for software diversity. Functional diversity is also applied to the input and output modules, and to the algorithm in the bistable processors and LCL processors. The characteristics of the newly developed digital protection system are described together with the preventive capability against CMF. Also, system reliability analysis is discussed. The evaluation results show that the ADRPS has a good preventive capability against the CMF and is a highly reliable reactor protection system.

An analysis of safety-critical digital systems for risk-informed design

This paper quantitatively presents the results of a case study which examines the fault tree analysis framework of the safety of digital systems. The case study is performed for the digital reactor protection system of nuclear power plants. The broader usage of digital equipment in nuclear power plants gives rise to the need for assessing safety and reliability because it plays an important role in proving the safety of a designed system in the nuclear industry. We quantitatively explain the relationship between the important characteristics of digital systems and the PSA result using mathematical expressions. We also demonstrate the effect of critical factors on the system safety by sensitivity study and the result which is quantified using the fault tree method shows that some factors remarkably affect the system safety. They are the common cause failure, the coverage of fault tolerant mechanisms and software failure probability.

The first digital reactor protection system in China

The reactor protection system (RPS) used in the 10 MW high-temperature gas-cooled reactor is the first digital RPS designed and operated in China. In order to ensure its safety and reliability and to reduce the development risk and cost, some measures had to be taken. The measures adopted in the development process include the architecture of defense-in-depth, commercial grade hardware, prototype development model, separation of safety class software and non-safety class software, deterministic behavior of safety software, etc. The measures adopted in the verification and validation (V&V) process include effective dedication on the commercial grade hardware, emphasis on the assessment of the requirements and specifications, emphasis on the demonstration and testing, thorough testing for the safety function, long period demonstration operation, application of automatic test system to improve the efficiency of V&V processes, etc. As a result, this first digital RPS has passed the safety assessment of the National Nuclear Safety Authority. Its performance and safety are proven to be confident and assuring through the demonstration and testing. Thus, the design and V&V process of the first digital protection system in China was successful.

The Determination of the Neutron Sensitivity of Suspensions of Chambers for Transport Nuclear Reactor Control and Protection Systems

A method of determining the neutron sensitivity of ionisation chambers and suspensions of ionisation chambers, used in transport nuclear-power plant control and protection systems is considered. Measured values of the sensitivity for type KNK-53M and KNK-16 ionisation chambers are given.

A Channel for Neutron Flux Measurement

The design principles of a channel for measuring fluxes of thermal neutrons in a nuclear-reactor control and protection system are considered. The channel consists of a fission chamber, a set of boron-containing gas-filled ionization chambers, and an electronic unit that ensures a counting rate of fission pulses of up to ∼1 × 106 s–1. It is shown that the widest linear range is achieved in channels equipped with a fission chamber and a gas-filled ionization chamber with electrodes coated with natural boron. The channel allows for measurements of the thermal-neutron flux density in a range of 0.5 to 5 × 1011 cm–2 s–1.

Safety evaluation of the inherent and passive safety features of the smart design

SMART (system-integrated modular advanced reactor) is a 330 MWt advanced integral PWR, which is under development at KAERI for seawater desalination and electricity generation. The conceptual design of the SMART desalination plant produces 40,000 m 3/day of potable water and generates about 90 MW of electricity, which are assessed as sufficient for a population of about 100,000. The SMART enhances safety by adopting the inherent safety design features such as the elimination of large break loss of coolant accidents, substantially large negative moderator temperature coefficients, etc. In addition, the safety goals of the SMART are achieved through the adoption of passive engineered safety systems such as an emergency core cooling system, passive residual heat removal system, safeguard vessel, and reactor and containment overpressure protection systems. This paper describes the design concept of the major safety systems of the SMART and presents the results of the safety analyses using a MARS/SMR code for the major limiting accidents including transient behaviors due to desalination system disturbances. The analysis results employing conservative initial/boundary conditions and assumptions show that the safety systems of the SMART conceptual design adequately remove the core decay heat and mitigate the consequences of the limiting accidents, and thus secure the plant to a safe condition.

Benchmark analysis of main circulation pump trip events at the Ignalina NPP using RELAP5 code

The state-of-the-art code RELAP5/MOD3 was originally designed for PWRs. Because of unique RBMK designs the application of this code to RBMK-1500 encountered several problems. A successful best estimate RELAP5 model of the Ignalina NPP has been developed. This model includes the reactor main circulation circuit (MCC) and reactor control and protection system required for this kind of transient analysis. Benchmark analysis of all operating main circulation pump (MCP) trip events was performed. During the analysis the characteristics of isolation control valves and MCP throttling regulating valves were established. Comparison of calculated and measured parameters was also used to establish realistic resistances of different MCC components and realistic behaviour of the controllers of the reactor systems. Calculations performed with the RELAP5 model, which includes these modifications, compare favourably with plant data.

Risk-Informed Assessment of the Technical Specifications of PWR RPS Instrumentation

A special Markov reliability model is used to simulate the effects of frequency of testing and allowable bypass time of the analog channels and logic trains on the performance of a pressurized water reactor, reactor protection system (RPS). The effects of these technical specifications (TSs) on the unavailability of the RPS and on the frequencies of spurious scrams, core damage, anticipated transients without scram, and large early releases are assessed. The use of these results to support decision making concerning changing the TSs in light of the relevant policy statement by the U.S. Nuclear Regulatory Commission on risk-informed decision making is demonstrated. The analysis includes point-value calculations sensitivity and uncertainty analysis.

Diversity in computerized reactor protection systems

Based on engineering judgement, the most important measures to increase the independency of redundant trains of a computerized safety instrumentation and control system (I&C) in a nuclear power plant are evaluated with respect to practical applications. This paper will contribute to an objective discussion on the necessary and justifiable arrangement of diversity in a computerized safety I&C system. Important conclusions are: (i) diverse equipment may be used to control dependent failures only if measures necessary for designing, licensing, and operating a computerized safety I&C system homogeneous in equipment are neither technically nor economically feasible; (ii) the considerable large operating experience in France with a non-diverse equipment digital reactor protection system does not call for equipment diversity. Although there are no generally accepted methods, the licensing authority is still required to take into account dependent failures in a probabilistic safety analysis; (ii) the frequency of postulated initiating events implies which I&C functionality should be implemented on diverse equipment. Using non-safety I&C equipment in addition to safety I&C equipment is attractive because its necessary unavailability to control an initiating event in teamwork with the safety I&C equipment is estimated to range from 0.01 to 0.1. This can be achieved by operational experience.

Application of Algebraic Specification to Verify the Design of Safety Logic in Nuclear Power Plants

A formal verification method using an algebraic specification technique is proposed, and its effectiveness is studied. A computerized automatic verification system, which utilizes an algebraic specification to describe system requirements and to prove an inductive theorem based on a term-rewriting technique for verification, is built and evaluated through experimentally verifying the logic design of a digital reactor protection system in boiling water reactors. The results show that the proposed method can mathematically correctly verify the logic design in a limited time, thereby improving accuracy and reducing person-hours for the verification.