Safety Shutdown System Research Articles

Calculation of core safety parameters and uncertainty analyses during unprotected transients for the ALLEGRO and a sodium-cooled fast reactor

The calculation of the essential core safety parameters in fast spectrum reactors are loaded with large uncertainties due to the particularly large uncertainty of nuclear data, modelling uncertainties and possible mistakes by users. These core safety parameters such as coefficients of reactivity, power peaking factors and point-kinetics parameters play an important role during unprotected transients. The contributions to the uncertainties of the target parameters (e.g. peak cladding temperature) from the core safety parameters can be determined by uncertainty and sensitivity analyses.Three-dimensional models of the ALLEGRO (demonstrator gas-cooled fast reactor) and a sodium-cooled fast reactor (SFR) concept were created in the Serpent Monte Carlo code, and several coefficients of reactivity were calculated. Furthermore, thermal hydraulic analyses with point kinetics were made for the selected transients by the ATHLET code system. An unprotected loss of flow and an unprotected overpower transient were studied at first using the best estimate approach to understand the behaviour of the reactors in these scenarios. In addition, uncertainty analyses were performed applying the GRS method, considering the uncertainties of the coefficients of reactivity, which were taken from benchmark results. Finally, the importance of the uncertain parameters was determined from sensitivity measurement.The results show that the thermal expansion of the core structural elements has a significant effect on the reactivity of these fast spectrum reactors. Moreover, it was found that during unprotected overpower transients the most important uncertain parameters are the Doppler coefficient and the fuel thermal expansion coefficient of reactivity. In addition, the large uncertainty of the positive coolant and cladding temperature coefficients of reactivity have a significant influence on the uncertainty of the calculated peak cladding temperature, especially in the case of unprotected loss of flow transients. The results imply that the uncertainty of some core safety parameters should be reduced. Lastly, the results adumbrate that additional safety shutdown systems are to be applied to mitigate the consequences of unprotected transients.

SIL verification for SRS with diverse redundancy based on system degradation using reliability block diagram

Safety integrity level (SIL) verification is a critical step in safety lifecycle of safety-related systems (SRS). Introducing redundancy into SRS raises two issues: voting group configuration and common cause failures (CCF). In order to minimize CCF, diverse redundancy is widely adopted by SRS. However, in the past, almost all attention of SIL verification has been paid to identical redundancy, this is reflected in IEC 61508, ISA-TR84.00.02 and scientific literatures. Therefore, a novel method for SIL verification of SRS with diverse redundancy based on system degradation is proposed. Key idea of the method is to calculate average probability of dangerous failure on demand (PFDG) at each stage of system degradation, which is caused by failures of redundant channels. To validate proposed method, it has been applied on safety shutdown system of Nuclear Power Control Test Facility, and numerical result is compared with FTA and FRANTIC model. Sensitivity studies and comparison of numerical results indicate that the method has very good consistency with FTA and FRANTIC model. Moreover, two sets of general formulae for PFDG of any MooN(D) group with diverse redundancy are provided. From engineering practice point of view, it makes SIL verification process simpler.

Hybrid reliability model for nuclear reactor safety system

The dependability of critical safety systems needs to be quantitatively determined in order to verify their effectiveness, e.g. with regard to regulatory requirements. Since modular redundant safety systems are not required for normal operation, their reliability is strongly dependent on periodic inspection. Several modeling methods for the quantitative assessment of dependability are described in the literature, with a broad variation in complexity and modeling power. Static modeling techniques such as fault tree analysis (FTA) or reliability block diagrams (RBD) are not capable of capturing redundancy and repair or test activities. Dynamic state space based models such as continuous time Markov chains (CTMC) are more powerful but often result in very large, intractable models. Moreover, exponentially distributed state residence times are not a correct representation of actual residence times associated with repair activities or periodic inspection. In this study, a hybrid model combines a system level RBD with a CTMC to describe the dynamics. The effects of periodic testing are modeled by redistributing state probabilities at deterministic test times. Applying the method to the primary safety shutdown system of the BR2(Belgian Reactor 2)—nuclear research reactor, resulted in a quantitative as well as a qualitative assessment of its reliability.

On the speed of response of an FPGA-based shutdown system in CANDU nuclear power plants

Several issues in an FPGA based implementation of shutdown systems in CANDU nuclear power plants have been investigated in this paper. A particular attention is on the response time of an FPGA implementation of safety shutdown systems in comparison with operating system based software solutions as in existing CANDU plants. The trip decision logic under “steam generator (SG) level low” condition has been examined in detail. The design and implementation of this logic on an FPGA platform have been carried out. The functionality tests are performed in a hardware-in-the-loop (HIL) environment by connecting the FPGA based system to an NPP simulator, and replacing one channel of Shutdown System Number 1 (SDS1) in the simulator by the FPGA implementation. The response time of the designed system is also measured through multiple tests under different conditions, and statistical data analysis has been performed. The results of the response time tests are compared against those of a software-based implementation of the same trip logic.

Effect of substrate dilution on corrosion of colmonoy-6 weld overlays in nitric acid

In the moderator system of some nuclear power plants, subsequent to the activation of the safety shutdown system, Gd 3+ is removed by ion exchange prior to reactor start-up. During this process, the pH of the system water can get lowered to 3 due to generation of HNO 3 . Colmonoy-6, which is weld-deposited over valve internals, was found to corrode considerably at this pH. This paper presents a detailed study of the corrosion of colmonoy-6 vis-avis its extent of dilution by the stainless steel substrate. The corrosion behaviour of these weld overlays was studied in 1 mM HNO3 at 65°C. The results showed that the extent of dilution affected both the microstructure and hardness of the deposit, its effect being maximum with single layer deposit and the corrosion resistance increased with area fraction of borides and carbides which in turn increased with additional layers.

"3+3 PROCESS" FOR SAFETY CRITICAL SOFTWARE FOR I&C SYSTEM IN NUCLEAR POWER PLANTS

The "3+3 Process" for safety critical software for nuclear power plants' I&C (Instrumentation and Control system) has been developed in this work. The main idea of the "3+3 Process" is both to simplify the software development and safety analysis in three steps to fulfill the requirements of a software safety plan [1]. The "3-Step" software development process consists of formal modeling and simulation, automated code generation and coverage analysis between the model and the generated source codes. The "3-Step" safety analysis consists of HAZOP (hazard and operability analysis), FTA (fault tree analysis), and DV (design validation). Put together, these steps are called the "3+3 Process". This scheme of development and safety analysis minimizes the V&V work while increasing the safety and reliability of the software product. For assessment of this process, validation has been done through prototyping of the SDS (safety shut-down system) #1 for PHWR (Pressurized Heavy Water Reactor).

Modernization of an ammonia plant safety shutdown system

AbstractThe Agrium Redwater Nitrogen Operations Ammonia 2 plant underwent a phased project to upgrade and modernize its automatic safety shutdown system. Agrium incorporated the use of safety integrity levels in the functional design and detailed design of the safety shutdown system to ensure that all required protections were implemented in a safe and cost‐effective manner.This article discusses the methodology used to determine the scope of the system, the methodology used to define the functional design, the implementation strategy chosen and the key lessons learned from the execution of this project. © 2009 American Institute of Chemical Engineers Process Saf Prog 28:282–292, 2009

Critical safe operating parameters: “Never exceed” limit and “never deviate” action

AbstractWhere does the human being fit in the normal operating system and where does he/she fit in the safety shutdown system? Planning ahead can make human interaction inherently safer. This paper offers the following suggestions for managing that interaction: (1) Use inherently safer principles in the design of the process and its layers of protection. (2) Define “Never Exceed” limits for critical safe operating parameters. (3) Define a mandatory action point and a “Never Deviate” action with enough response time to prevent exceeding the Never Exceed limit. (4) Train and drill.

Specification of software for emergency shutdown system of an offshore installation

The process dealt with is the conversion of a rather loose ‘requirement’ for the emergency shutdown (ESD) system of a major offshore installation into a tightly defined specification for the software (SESD) of that system. The procedure is broadly applicable to safety shutdown systems for other kinds of plant. The fusion method of object-oriented analysis is outlined and is applied to a system based on the Tern Alpha platform, whose basic features and shutdown requirement are described. The system requirement that is adopted provides not only several levels of shutdown, each encompassing a wide range of equipment, but also more targeted unit shutdowns. Consideration is given also to the use of ESD data to inform platform operating staff of incipient failures of monitored equipment and of the system SESD itself. The Fusion Method is used to assemble information relating to the installation and shutdown process in a form appropriate for the specification on which the design of the system SESD can be based. Some limitations of the method are identified.

How critical is your control system?

Basic process control systems are used to regulate the process during normal operation. Safety shutdown system, alarm systems, and other monitoring systems provide for plant safety. This paper addresses the question: “Is the process control system a critical safety system?” The answer depends upon its use. Integration of the alarm system and critical information functions may make the control system critical to the safety of the process. The criticality of the process control system can be analyzed using process hazards analysis methods. The criticality can be reduced by isolating shutdown functions, alarms, and critical monitoring functions from the basic regulatory control functions. And proper choice of equipment and configuration can improve the total reliability of the control system.

Comparative study of quantitative models for hardware, software and human reliability assessment

AbstractVarious models which may be used for quantitative assessment of hardware, software and human reliability are compared in this paper. Important comparison criteria are the system life cycle phase in which the model is intended to be used, the failure category and reliability means considered in the model, model purpose, and model characteristic such as model construction approach, model output and model input. The main objective is to present limitations in the use of current models for reliability assessment of computer‐based safety shutdown systems in the process industry and to provide recommendations on further model development. Main attention is given to presenting the overall concept of various models from a user's point of view rather than technical details of specific models. A new failure classification scheme is proposed which shows how hardware and software failures may be modelled in a common framework.

Balancing Reliability Requirements for Field Devices and Control Logic Modules in Safety Systems

The paper provides guidelines for the definition of reliability requirements for computerized safety shutdown systems in the process industries. The main question discussed is how to derive safety system requirements which ensure that the reliability of field devices and control logic modules is balanced from a safety point of view.Reliability figures of example safety systems are presented for various configurations of sensors, input/output cards. Central Processing Units (CPUs), and actuating elements. The figures are based on quantitative reliability analyses using a model and methodology for probabilistic safety assessment developed by SINTEF. The main new feature of this model compared to other models is that the effect of all types of failures occurring during field operation is considered in an integrated manner. Thus, failures due to excessive environmental stresses and human-made mistakes during engineering and operation are included in addition to failures due to natural aging of components (inherent failures). The effect of self-test is also included in the model.

Self-checking safety interlock system

A novel electrical self-checking interlock system for the petrochemical industry is discussed that meets the goals of eliminating fire, explosion, and chemical releases by providing more reliable safety shutdown systems. The design, operating principles, and performance characteristics of the microprocessor-based self-checking safety interlock system are described. With some modification the system can be programmed to verify functionality of the final interlock elements for additional safety improvement.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>

A computer aided shutdown system analysis and design procedure

A procedure is developed for designing safety shutdown systems. Shutdown system configurations using different types of hardware are evaluated. The probability of the failure modes of each configuration is evaluated using failure mode analysis techniques. Unless predefined failure probability levels are met, the method evaluates iteratively various forms of part redundancy for each configuration until the specified failure probabilities are satisfied. Then the achieved risk reduction from the use of each configuration is quantified and the corresponding total life cost is estimated. The configuration which presents the highest risk reduction and the least total life cost is selected. The proposed method is applied to the design of a shutdown system for a turbine driven compressor of an oil refinery.

Multipath circuits for control and safety shutdown systems

Multipath circuits for control and safety shutdown systems

Accident and self-regulation studies of pulsed fast reactors

A previously developed theory of pulsed fast reactor kinetics, inclusive of feedback effects, is reduced to a simple form and a standard method is applied to obtain a numerical description of pulsed excursions. This method is embodied in a fortran computer programme which executes the arithmetic for any desired number of cases and presents all physical variables of interest as a function of the time during a pulse. The main qualitative ideas underlying the theory are illustrated by numerical examples, in particular, the competition for dominance between a prompt positive Doppler and delayed axial thermal fuel expansion effect and the excitation of elastic waves in the fuel slugs are both brought out clearly. It is shown that, in accident conditions, a fast pulsed reactor similar to the proposed Euratom system sora possesses a strong net negative feedback which makes the system self-regulating with respect to the fuel temperature, but that such feedback does not appreciably raise the reactivity pulse amplitudes responsible for serious damage. The effect of drifts in the base reactivity is discussed and the reaction of the safety shutdown system is considered. It is concluded that systems similar to the sora reactor have to be designed so that all possible drifts are far below 2 % Δk/sec. In connexion with the general question of the choice of the fuel material for a pulsed fast reactor, it is shown that, from the safety viewpoint, the value of the coefficient of thermal expansion of the fuel can be ignored. Thus, all other things being equal, a ceramic is as good as a metallic fuel.