Reactor Trip Research Articles

Multi-fragmental and multi-phase availability models of the safety-critical I&C systems with two-cascade redundancy

Traditional availability, reliability, and safety models face the dimension problem due to a huge number of components in modern systems, motivating further research in this field. This paper focuses on multi-fragmental and multiphase models for availability and functional safety assessment of the information and control (I&C) systems with two-cascade redundancy considering design faults manifestation during operation. The methodology of the research is based on Markov and semi-Markov chains with the utilization of multi-phase modeling. Several multi-phase models are developed and investigated considering different conditions of operation and failures caused by version faults. The case study of the research is based on the analysis of safety-critical nuclear power plant I&C systems such as the reactor trip systems developed using the programmable platform RadICS.

Verification and validation optimization method for signal quality bits in digital control system application software of nuclear power plant

Abstract The digitalization enhances nuclear power plant (NPP) instrumentation and control (I&C) system performance, while simultaneously introducing safety and reliability challenges. To enhance the stability of distributed control system (DCS), and minimize the dangerous failure rate and safe failure rate of safety system, signal quality bits (SQBs) are widely used in NPP DCS to identify the validity of important signals. However, in the past decade or so, numerous unscheduled turbine shutdowns and/or reactor trips have resulted from incorrect SQB design or settings. Therefore, it is necessary to conduct optimization research on the design methods and setting principles of SQBs, establish an optimization method for DCS application software SQB verification and validation (V&V), then minimize DCS faults attributed to SQB. With the aim, this work conducts an in-depth investigation and analysis of the definition, design, setting and transmission of SQB in NPP. A specific optimization method for software V&V to conduct SQB on NPP safety DCS application software is proposed. Twelve concerns in the SQB V&V work are detailed. The reactor trip system ΔT protection logic is utilized as a case to illustrate the detail implementation process of this optimization method. This work provides an engineering technical reference and operational guidance for SQB software V&V, conducive to ensuring the safe and economical operation of NPPs.

Development of an AI-based remaining trip time prediction system for nuclear power plants

In abnormal states of nuclear power plants (NPPs), operators undertake mitigation actions to restore a normal state and prevent reactor trips. However, in abnormal states, the NPP condition fluctuates rapidly, which can lead to human error. If human error occurs, the condition of an NPP can deteriorate, leading to reactor trips. Sudden shutdowns, such as reactor trips, can result in the failure of numerous NPP facilities and economic losses. This study develops a remaining trip time (RTT) prediction system as part of an operator support system to reduce possible human errors and improve the safety of NPPs. The RTT prediction system consists of an algorithm that utilizes artificial intelligence (AI) and explainable AI (XAI) methods, such as autoencoders, light gradient-boosting machines, and Shapley additive explanations. AI methods provide diagnostic information about the abnormal states that occur and predict the remaining time until a reactor trip occurs. The XAI method improves the reliability of AI by providing a rationale for RTT prediction results and information on the main variables of the status of NPPs. The RTT prediction system includes an interface that can effectively provide the results of the system.

A study on the uncertainty of setpoint for reactor trip system of NPPs considering rectangular distributions

The setpoint of the reactor trip system shall be set to consider the measurement uncertainty of the instrument channel and provide a reasonable and sufficient margin between the analytical limit and the trip setpoint.A comparative analysis was conducted to find out an appropriate uncertainty combination method through an example problem. The four methods were evaluated; 1) ISA-67.04.01 method, 2) the GUM95 method, 3) the modified GUM method developed by Fotowicz, and 4) the modified IEC61888 method proposed by authors for the pressure instrument channel presented in ISA-RP67.04.02 example. The appropriateness of each method was validated by comparing it with the result of Monte Carlo simulation.As a result of the evaluation, all methods are appropriate when all measurement uncertainty elements are normally distributed as expected. But ISA-67.04 method and GUM95 method overestimated the channel uncertainty if there is a dominant input element with rectangular distribution among the uncertainty input elements.Modified GUM95 methods developed by Fotowicz and modified IEC61888 method by authors are able to produce almost the same level of channel uncertainty as the Monte Carlo method, even when there is a dominant rectangular distribution among the uncertainty components, without computer-assisted simulations.

Total Loss of Feedwater Analysis of Pressurized Water Reactor Using RELAP5

Abstract In Europe, the design extension conditions (DEC) were introduced after the Fukushima Dai-ichi accident as preferred method for giving due consideration to the complex sequences and severe accidents without including them in the design basis conditions. The objective of the study is to determine available elapsed time before core uncovery and needed DEC safety features for total loss of all feedwater (TLOFW) in a two-loop pressurized water reactor. RELAP5/MOD3.3 computer code has been used for calculations. The initiating event for TLOFW is multiple failures in which, in addition to the loss of main feedwater, the auxiliary feedwater is also lost. The scenarios without DEC safety features and the scenarios with DEC safety feature assumed have been simulated. The results showed that after TLOFW event initiation, it is very important to trip the reactor as soon as possible. In case of loss of offsite power, the reactor coolant pumps stop, and the reactor very quickly trips on low reactor coolant pump flow. When normal operation systems are assumed, the reactor trip occurs on low-low steam generator narrow level few tens of seconds after accident initiation, resulting in less time available before core uncovery occurence. The results for TLOFW scenarios with normal operation systems and DEC safety features assumed demonstrated that secondary side bleed and feed can prevent core uncovery in case when no operator actions are credited in the first 30 min of event. When primary side bleed and feed is used, less time is available for operator actions.

Cyber hardening of Nuclear Power Plants with real-time nuclear reactor operation, 1. Preliminary operational testing

Maintaining and extending the lifetime of the domestic Nuclear Power Plant fleet is predicated on digitalization. However, digitalization also gives rise to increasing vulnerabilities. This paper is the first in a body of novel research at the Idaho Falls Center for Higher Education focusing on the cyber hardening of currently operating and aging Nuclear Power Plants that uses the Western Services Corporation Generic Pressurized Water Reactor real-time operational platform. The Western Services Corporation platform was used here natively to collect data during atypical plant events that could be initiated by cyberattacks. The goals of this first phase of work is to identify data ‘fingerprints’ unique to each of the initiating events, determine when or if the reactor trips, and suggest operator actions that could mitigate the cyberattack and possibly avoid a trip and maintain operations. First, a cyber-informed Preliminary Hazards Analysis was conducted to determine plant systems most vulnerable to a cyberattack. Then, the associated malfunction as an analogue to a potential cyberattack on the selected system was executed during operation of the reactor. Relevant data was collected during these events until the reactor tripped. The data was then processed to determine if a fingerprint could be crafted, and mitigating operator actions were formulated. Finally, we demonstrate a proof-of-concept for simulating cyberattacks on the Western Services Corporation platform in real-time during reactor operation. This development will open possibilities for ‘Red Team/Blue Team’ exercises for cyber hardening of the domestic Nuclear Power Plant fleet.

Study on the digitalization of trip equations including dynamic compensators for the Reactor Protection System in NPPs by using the FPGA

Advanced reactors, such as Small Modular Reactors or existing Nuclear Power Plants, often use Field Programmable Gate Array (FPGA) based controllers in new Instrumentation and Control (I&C) system architectures or as an alternative to existing analog-based I&C systems. Compared to CPU-based Programmable Logic Controllers (PLCs), FPGAs offer better overall performance. However, programming functions on FPGAs can be challenging due to the requirement for a hardware description language that does not explicitly support the operation of real numbers. This study aims to implement the Reactor Trip (RT) functions of the existing analog-based Reactor Protection System (RPS) using FPGAs. The RT equations for Overtemperature delta Temperature and Overpower delta Temperature involve dynamic compensators expressed with the Laplace transform variable, ‘s’, which is not directly supported by FPGAs. To address this issue, the trip equations with the Laplace variable in the continuous-time domain are transformed to the discrete-time domain using the Z-transform. Additionally, a new operation based on a relative value for the equation range is introduced for the handling of real numbers in the RT functions. The proposed approach can be utilized for upgrading the existing analog-based RPS as well as digitalizing control systems in advanced reactor systems.

Prediction of Automatic Scram during Abnormal Conditions of Nuclear Power Plants Based on Long Short-Term Memory (LSTM) and Dropout

A deep-learning model was proposed for predicting the remaining time to automatic scram during abnormal conditions of nuclear power plants (NPPs) based on long short-term memory (LSTM) and dropout. The proposed model was trained by simulated condition data of abnormal conditions; the input of the model was the deviation of the monitoring parameters from the normal operating state, and the output was the remaining time from the current moment to the upcoming reactor trip. The predicted remaining time to the reactor trip decreases with the development of abnormal conditions; thus, the output of the proposed model generates a predicted countdown to the reactor trip. The proposed prediction model showed better prediction performance than the Elman neural network model in the experiments but encountered an overfitting problem for testing data containing noise. Therefore, dropout was applied to further improve the generalization ability of the prediction model based on LSTM. The proposed automatic scram prediction model can provide NPP operators with an alert to the automatic scram during abnormal conditions.

Integral-Effect Test for Loss of Residual Heat Removal System During Mid-Loop Operation in ATLAS Facility

A test called B4.2 in the OECD-ATLAS2 project was performed to simulate loss of the residual heat removal system (RHRS) during mid-loop operation (MLO) using a thermal-hydraulic (T-H) integral-effect test facility: the Advanced Thermal-Hydraulic Test Loop for Accident Simulation (ATLAS). The main purpose of this test was to investigate a T-H transient in the reactor coolant system (RCS) during loss of the RHRS and to evaluate the effectiveness of reflux condensation and the capability of a safety injection tank (SIT) on shutdown coolability. The initial and boundary conditions for the B4.2 test were appropriately determined according to a state of MLO corresponding to 65 h after reactor trip in the Advanced Power Reactor 1400 MW(electric) (APR1400). During the loss of RHRS accident transient simulation, major T-H parameters such as system pressures, temperatures, and collapsed water levels in the RCS were measured, and unique T-H phenomena such as reflux/cocurrent condensations, off-take, countercurrent flow, and countercurrent flow limitation were investigated. In this paper, the overall T-H behavior in the RCS during a simulated loss of the RHRS with SITs is highlighted to provide a better understanding of T-H phenomena regarding coolability with reflux condensation.

Design of novel fractional order FPGA based reactor protection and safety controllers for ACP1000 nuclear power plant in LabVIEW

In this research work, an advanced most modern ACP1000 Nuclear Power Plant is addressed. An enhanced fractional order model of ACP1000 nuclear power plant is adopted with an addition of protection and safety systems. The whole plant model is developed by using innovative hybrid technology of Visual Basic, LabVIEW, Fractional Order and Field Programmable Gate Array (FPGA). A reactor trip system is designed and modeled using FPGA technology in LabVIEW. Plant parameters are systematically modeled and panels are designed in LabVIEW for reactor protection controllers. Twenty one reactor trip controllers are designed and modeled based on complex digital logics using FPGA programming in LabVIEW. Two fractional order trip controllers are designed for over temperature protection and over power protection in LabVIEW. FPGA based safety controllers are designed for Engineered Safety Features (ESF) in LabVIEW. For enhanced model of ACP1000 nuclear power plant, 374 systems are modeled in modular form in Visual Basic Environment. Nine process controllers are configured in ANFIS framework in LabVIEW. In this research work, process controllers are used in conjunction with protection and safety controllers using FPGA. The parametric display of simulations is carried out in Visual Basic. The closed loop performance of proposed protection controllers is evaluated under reactor trip and turbine trip while that of safety controllers are evaluated under inadvertent opening of safety valves of pressurizer. Various parameters are simulated for severe transient conditions and the results are evaluated and validated against reference design data and Final Safety Analysis Report (FSAR) of ACP1000 nuclear power plant. All the results are well within the trip and safety systems design bounds under abnormal and severe operating conditions.

Operator actions evaluation for MSGTR accident mitigation

The safety assessment of nuclear power plants for multiple failure accidents such as Multiple Steam Generator Tube Rupture (MSGTR) and the verification of the suitability of accident management measures have gained prominence in the nuclear engineering field after the Fukushima accident. Compared to Steam Generator Tube Rupture (SGTR), the MSGTR accident progresses rapidly due to the high break flow rate, and thus appropriate operator actions are essential to prevent the release of radioactive materials into the environment. It is crucial for the operators to identify the MSGTR early and perform each operator action within the allotted time in order to mitigate the accident successfully. In this study, a reference analysis model for MSGTR is developed, differences from SGTR are analyzed, and the required time for major operator actions are derived through various sensitivity analyses. In conclusion, the operator can confirm that there is a high possibility of MSGTR occurring through the changes in the subcooling degree at the hot-leg and the Pressurizer (PZR) water level. The appropriate time to be initiated for major operator actions are as follows: (1) Reactor Coolant Pump (RCP) manual trip within 10 min after the reactor trip, (2) Reactor Coolant System (RCS) temporary-cooldown operation through Main Steam Isolation Bypass Valve (MSIBV) and Steam Bypass Control System (SBCS) within 15 min after the reactor trip, (3) PZR spray operation – RCS temporary-cooldown operation in progress, and (4) RCS controlled-cooldown operation using Atmospheric Dump Valve (ADV) within 15 min after the end of the RCS temporary-cooldown operation. Additional possible action is the restart of RCP, but the execution of this action depends on the operator’s judgment. The results of this investigation have significant implications which can be utilized for improving the accident mitigation strategies and the operator training for MSGTR.

Bayesian belief network-based human reliability analysis methodology for start-up and shutdown operations in nuclear power plants

Human-induced unplanned reactor trips during start-up and shutdown operations can impair the safety condition of the plant or threaten important plant safety functions. Despite the need for efforts to reduce such human errors through human reliability analysis (HRA), most existing HRA focuses on emergency or full-power operations. To address this, the current study proposes an HRA methodology for start-up and shutdown operations in which a quantitative evaluation is performed using a Bayesian belief network (BBN) model based on a developed quantification framework for the start-up and shutdown operation tasks. Before the evaluation, general operating procedure (GOP) analysis, simulation-based screening analysis, and task analysis are performed. To demonstrate the process of proposed methodology and its effectiveness, a case study with a GOP is conducted. Then to verify the feasibility of the proposed methodology, two comparison cases are conducted with BBN model evaluation and actual events that occurred in Korean NPPs.

Dynamic simulation and analysis of steam dump valve failure using secondary side model of PWR

The safety system reliability is a key issue for the nuclear power plant (NPP), and the steam dump system (SDS) is an important pressure stabilizing system used in Hualong Pressurized Reactor (HPR1000) to enable nuclear steam supply system to accept loss of load without incurring a reactor trip and to remove stored energy and decay heat following a reactor trip without actuation of the steam generator safety valves. The SDS is consisted of many steam dump valves, and its reliability is dominated by the reliability of steam dump valves. During the steam dump interlock inspection test of a NPP, the pressure of the main steam pipe in the second loop appeared shock, which triggered the protection signal because of the high main steam pressure difference between the second and other main steam pipes. The purpose of this study is to simulate the failures and explore the mechanism of SDS failure process. A dynamic simulation model is developed with APROS version 6.10, which includes components between the steam generator (SG) and the main steam valves of NPP. The compressed air leakage failure for the steam dump valve, which causes valve position reduction (0%, 10% and 20%) and adjust speed change, is included in the dynamic simulation, and it causes fluctuations and steady-state errors in system parameters such as the main steam pressure and valve opening position. In the case of 10% and 20% valve position reduction, the main steam pressure fluctuates between 7.3 MPa and 7.45 MPa, and the steady-state errors are about 0.02 MPa. Then, the safety valve will jump in the fluence of water hammer due to the unsteady mass flow rate of condensate water. The pressure can drop to 6.75 MPa caused by safety valve jump, and the safety injection system will be triggered to form a serious accident reaction if the take-off action sustains over 0.13 s. Results of this study would be helpful for the understanding of the SDS failures process and dynamic characteristics of the SDS for nuclear power units, and provide guidance for failure identification and safety system improvement work.

Krško NPP Experience with RTD Bypass Elimination

This paper describes Krško experience and problems that had to be resolved with RTD Bypass Elimination project (RTDBE). Following RTD bypass manifold isolation valve leak in 2008, Krško decided to perform RTDBE modification on reactor coolant system narrow range temperature measurement system. The installation was performed during Outage 2013. Soon after the plant returned to power, newly configured measurement channels showed that OPΔT reactor trip was oversensitive to spikes caused by auxiliary relay operation in the cabinets nearby. The solution was to reconfigure OPΔT trip filtering constants to filter out short-term spikes in the signal. After almost full operating cycle of trouble-free operation, RTD failures started occurring on reactor coolant system cold leg, which was caused by the high frequency vibrations (3-5 kHz) induced by reactor coolant pumps. To resolve RTD failures, Krško ordered re-design of the RTDs to add robustness and specific qualification in high-frequency vibration operating environment. Improved RTDs were installed in Outage 2016 and were operating one full cycle with minor deviations.

Optimization of OPDT protection for overcooling accidents

Overcooling accidents are typically resulting in power increase due to negative moderator feedback. There are more protection set points responsible for terminating power increase. OPDT protection set point is typically protection from exceeding fuel centre line temperature due to reactivity and power increase. It is important to actuate reactor trip signal early enough, but to be able to filter out events where actuation is not necessary. Different concepts of coolant temperature compensation as part of OPDT set point protection were studied for decrease of feedwater temperature accident and for small main steam line breaks from full power for NPP Krško. Computer code RELAP5/mod 3.3 was used in calculation. The influence of different assumptions in accident description as well as nuclear core characteristics were described.

Analysis of Manual Reactor Trip of NEK NPP in APROS Computer Code

The Slovenian Krško Nuclear Power Plant (NEK) model was built in using APROS - Advanced PROcess Simulation environment. The basis for the this model was the RELAP5/MOD3.3 Engineering Handbook, the model was updated to the 26th cycle and also includes the upflow conversion modification. A detailed model nodalisation was created for each system and every system was separately validated. The current model covers the primary circuit with the core kinetics model, the secondary circuit and their control systems. The steady state of the APROS NEK model already having been validated, the plan now is to validate the model for some transients and design basis accidents. In this article the plant behaviour after the manual reactor trip is analysed in detail. Two scenarios of the manual reactor trip transient are performed, where either the Main Steam Isolation Valve (MSIV) closes after 60s – case A, or remains open – case B. After the manual reactor trip from the 100% power, the control system signal actuations and their times were followed and then the responses of different affected systems were being observed. All those recorded values were then compared with the identical transient performed on the similar NEK model with the RELAP5/MOD3.3 system code. This procedure allowed to bring the current APROS NEK model one step forward towards being assured to have accurate calculations.

Hazard Analysis of Fixed‐Tube‐Sheet Shell‐and‐Tube Heat Exchangers

AbstractFixed‐tube‐sheet shell‐and‐tube heat exchangers (FTHEs) are widely used in process plants to enhance energy efficiency and to control temperature levels of unit operations. Even moderate temperature differences between shell and tube bundle of FTHEs can lead to failure mechanisms induced by thermal stress. To avoid equipment failure, design codes require an analysis of the transient response of an FTHE during special operating conditions. This work presents a modular‐hierarchical approach for the dynamic simulation of FTHEs, which is applied to special operating scenarios such as a loss of tube‐side flow, a shell‐side steaming‐out (cleaning procedure to remove hydrocarbon residues with steam) and a reactor trip (sudden stop of exothermic reaction).

Study of rod ejection accident at hot zero power condition in a PWR using RELAP5

The core reactivity and power distribution within the core of a pressurized water reactor (PWR) are controlled for safe and efficient operation of the reactor. Several postulated events, however, can alter the core reactivity and power distribution and disrupt reactor operation. Such those events are the reactivity accidents. Among the different expected reactivity accidents, the control rod ejection accident (REA) is of a particular concern. This accident can occur in PWRs by mechanical failure of the control rod drive mechanism or due to inadvertent operator action. There are two cases of REA; REA at hot zero power condition, and REA at power condition. This accident results in reactivity addition, and based on the rate of reactivity addition, the reactor power may increases to levels large enough to endanger the fuel assemblies faster than the automatic protective actions.In the current work, RELAP5 code is used to study the consequences of REA at Hot Zero Power Condition in a standard four loop Westinghouse PWR reactor. A reactivity insertion of up to 75 pcm/sec is assumed in the analysis due to the rod movement. This value is consistent with the withdrawal of two control rod banks. A RELAP5 input file is prepared to simulate the reactor core and primary system. In this file, the core is simulated by two channels, a hot channel represents a one fuel assembly and an average channel represents the rest of the core. RELAP5 reactor kinetics model is used to determine the power generation with time including the core feedback effects; i.e., Doppler reactivity and moderator reactivity. The reactor is set to trip when it reaches 35% of full power, the low setting reactor trip assumed to be initiated by power range high neutron flux. The initial power level was assumed to be below the power level expected for any shutdown condition (10−9 of nominal power).Results of the study including the peak power, maximum fuel pellet temperature and fuel pellet enthalpy are presented. The effects of the rod ejection rate on REA consequences are also studied.

Development of a new control rod drive mechanism design for the ISU AGN-201M reactor

The Aerojet General Nucleonics (AGN) model 201-Modified, known as the AGN-201M reactor, plays an essential role in the educational and research activities at Idaho State University (ISU). The ISU AGN-201M's original Control Rod Drive Mechanism (CRDM) has been in operation for more than fifty years with no large-scale redesigns. The CRDM is required to eject the fuel rods within one second during a SCRAM event (also known as a 'reactor trip') and adjust the control rods' insertion speed, and keeps the rod insertion sequence correct. The existing control rod drive mechanisms meet these criteria but experience a few concerns due to aging. Concerns include complex maintenance and costly repairs for old electromechanical components, rod position feedback errors, and the impediment of the plate during a SCRAM due to binding of the lead screws of the existing mechanism. During a binding event, the drive mechanism becomes locked, preventing the control rod's magnetic plate from moving in or out under the reactor's normal and emergency operating conditions. Although, the binding has no effect on the ability of the rod to exit the core during the SCRAM. To counteract the concerns and issues with the current CRDM, a new design has been proposed using newer components and a simplified design.The new design utilizes more advanced electric and mechanical components that are commercially available. The new CRDM system is divided into four main aspects: (1) control rod movement design (motor, lead screw, guide rods), (2) control rod ejection (springs, electromagnet), (3) control rod position and feedback (position transducer, microswitches), and (4) material selection and structural analysis. The new design aims to reduce the overall complexity and probability of failure to improve the reactor's overall reliability. With proper material selection and improved structural design, the new drives are lighter with little to no change in structural integrity. The new control rod drive mechanism eliminates binding scenarios by using a single lead screw and implementing additional guide rods. An advanced linear position sensor and microswitches replace the existing and aging synchro system for accurate rod position feedback resulting in better reactivity control. The new design meets the reactor's operational limits by having an average reactivity insertion of 0.065% Δk/k per second, which corresponds to a total control rod insertion time of 19.23 s, while the control rod's ejection time remains less than one second during a SCRAM event. The new design ensures the reactor's long-term viability for educational and research activities by increasing the reliability and safety of operation for years to come.

A Redundancy-Guided Approach for the Hazard Analysis of Digital Instrumentation and Control Systems in Advanced Nuclear Power Plants

Digital instrumentation and control (I&C) upgrades are a vital research area for the nuclear industry. Despite their performance benefits, deployment of digital I&C in nuclear power plants (NPPs) has been limited. Digital I&C systems exhibit complex failure modes including common cause failures (CCFs), which can be difficult to identify. This paper describes the development of a redundancy-guided application of the Systems-Theoretic Process Analysis and fault tree analysis for the hazard analysis of digital I&C in advanced NPPs. The resulting Redundancy-Guided Systems-Theoretic Hazard Analysis (RESHA) is applied for the case study of a representative state-of-the-art digital reactor trip system. The analysis qualitatively and systematically identifies the most critical CCFs and other hazards of digital I&C systems. Ultimately, the RESHA can help researchers make informed decisions for how, and to what degree, defensive measures such as redundancy, diversity, and defense in depth can be used to mitigate or eliminate the potential hazards of digital I&C systems.