Search

Accident scenarios implying the failure of the active and passive reactor protection system are the most severe in their consequences since they are accompanied by the melting of fuel elements, fuel assemblies, and the entire core and, as a consequence, the release of fission products (FP) from the fuel melt and structural materials. The location of reactor facilities near populated areas requires an understanding of the consequences of hypothetical accidents with the destruction of the core. The most important is information on the amount of FP released into the environment. To assess the possible dose load on personnel and the environment in a hypothetical accident, data on the release of radioactive nuclides from the damaged, including molten, core are required. This work presents approaches that can be used to calculate the amount of fission products released from the fuel melt. The proposed approaches are based on general patterns of behavior and release of impurities from liquid solutions. To simulate this process, a system of differential equations is solved. The proposed approaches were implemented in the form of a software module for calculating the release of FP from the melt. Using the developed module, a test problem for the release of FP from a molten oxide fuel was solved, and an analysis of the results of real experiments carried out at the National Laboratory in Oak Ridge was carried out. Satisfactory convergence of the calculated data on the yield of both nonvolatile (Ce, Sr) and volatile (Xe, Kr) fission products is shown.

Reliability assessment of a digital dynamic system using traditional Fault Tree Analysis (FTA) is difficult. This paper addresses the dynamic modeling of safety-critical complex systems such as the digital Reactor Protection System (RPS) in Nuclear Power Plants (NPPs). The digital RPS is a safety system utilized in the NPPs for safe operation and shut-down of the reactor in emergency events. A quantitative evaluation reliability analysis for the digital RPS with 2-out-of-4 architecture using the state transition diagram is presented in this paper. The study assesses the effects of independent hardware failures, Common Cause Failures (CCFs), and software failures on the failure of the RPS through calculating Probability of Failure on Demand (PFD). The results prove the validity of the proposed method in analyzing and evaluating reliability of the digital RPS and also show that the CCFs and longer detection time are the main contributions to the PFD of digital RPS.

RPS (Reactor Protection System) plays a critical role in assuring safety operation and relieves the consequence of accident in Nuclear Power Plant (NPP). With widely use of digital instrumentation and control (I&C) system, since LingAo phase II, Chinese NPP started the introduction of digital I&C system. After ten years of effort, the first domestic independent researched and developed digital I&C system, which named FirmSys, has been deployed in Yang Jiang NPP and intended to export with 3rd generation HPR1000 reactor to the UK. To achieve this export, the method to satisfy generic design assessment (GDA) requirements from the office for nuclear regulation (ONR) of UK is being explored. Statistical test is a recommendation way for independent confidence-building measure (ICBM) and production excellence (PE) of GDA. According to the requirements of statistical test from standard IEC 60880, and with the analysis of current test method limitation in test coverage and operation state simulation, the content and process design is the key point for statistical test in finite test times. For safety critical software in nuclear power plant, whose probability of failure is very small, the critical operation of dealing with accident for avoiding of disaster by user will rarely happen but requires high reliability. Therefore, the common practice of statistical test could not make a sufficient test for the operation during accident happening, and the cost of test is unacceptable. This paper proposes a scenario-based innovation statistical test method for RPS, and describes the test architecture, process, and achievement. This method uses accident scene as test case that focus on the protection functions, it covers parameters, values, operation states, and protection actions. All selected scenes is designed to occur in their relatively probability, target systems are responding in real input and output environment to prove their protection ability as the accident is really happening. Meanwhile, to test the effectiveness of redundant design, channels are randomly selected for success data transform while others are set failure. At last, an engineering practice with this scenario-based test method is made on FirmSys, the pressure water reactor typical accident scenes LOCA, SGTR and MSLB have been successfully simulated, achieves protection sequence verification with high parameters coverage during parameters constantly variation. This method also provides reference for system verification, reliability evaluation and GDA, and be applied in engineering project.

The response time of shutdown of a nuclear reactor is an important parameter of reactor protection systems in nuclear power plants. Furthermore, as a part of a reactor protection system, the point to point communications system mostly influence the response time of shutdown of a nuclear reactor. A new solution to optimizing the response time is introduced, where a point to point communication system is implemented by FPGA technologies. The new designed system could extremely improve the efficiency of communications, which contributes to shortening the response time of shutdown. This paper delivers not only analysis of the response time of shutdown in current systems, but also the design scheme of the FPGA-based system. In addition, the communication system based on FPGA optimizing the response time of shutdown of a nuclear reactor is proved which is applied in reactor protect systems of VVER.

In order to explore the risk assessment method of the multi-unit nuclear power plant site, this paper selects the dual-unit plant nuclear site to analyze lose off-site power accident. By combining and improving the single-unit ET/FT model, to establish the dual-unit ET/FT model. From the analysis of the accident sequence, it can be concluded that the common cause failure of equipment is the main challenge faced by the dual-units. Especially the RPC sub-channel in the reactor protection system and the failure of emergency diesel engine circuit breaker. As can be seen from the high proportion of core CD occurring simultaneously in both uints, it has a great significance to study the risk of mult-units sites.

The Advanced Pressurized Water Reactor (1400) offers greater power output than its predecessor, the Optimized Power Reactor (OPR-1000), hence required increased reliability and design limitations of its protection systems to be licensed for commercial operation. One of these systems is the Reactor Protection System (RPS), a set of subsystems and methods designed to fortify the integrity of the reactor. Compromise of RPS safety could stem from possible failures of subsystems, natural hazards, inadequate application of mitigation measures or human error. Probabilistic Safety Assessment is an effective and indispensable part of Nuclear Safety that is used within the assessment of RPS reliability. Alongside other techniques, it incorporates the use of fault-tree analysis to determine failure rates of top-events, but it requires input data in the form of initiating events. Unfortunately, accurate data on initiating events is hard to obtain and therefore, the use of conservative values was the norm in most studies. This signifies the importance of studying a handful of values around these conservative values. This paper focuses ontheAPR-1400 and aims to investigate the most promising elements to improve the reliability of its Reactor Protection System (RPS). The study was carried out using Risk Spectrum PSA, a tool used in more than 50% of nuclear reactors around the world. From 171 initiating events, trends and case studies for the 3 most sensitive elements in RPS were constructed and discussed. CCF-TCB, Operator and CC-DOP were found to be the most potent events in reducing RPS failure probability. This research should give an insight on how to tackle RPS-enhancements for future designs of Nuclear Power Plants.

The small modular offshore floating reactor is small transportable nuclear power station which combined small nuclear power station with ship engineering. It can be used in marine petroleum exploitation and provide safe and effective energy supply for remote islands. The small modular offshore floating reactor also will be available for high-power ships as well as seawater desalination. The nuclear reactor protection system is crucial of great importance for reliable and safety of nuclear power station. As the system making connection and exchanging information between human and devices, safety control display device is an important component in nuclear reactor protection system. In this paper, a new design of safety control display device applied in small modular offshore floating reactor is introduced, and the new device contains a touch-screen and a customized keyboard which matured the characteristics of devices applied in marine ships. The new designed device features fast operation, protection from misuse, and versatility which is breakthrough innovation in ship and nuclear power industry. This design can popularize on safety display system of marine ships.

Reactor protection systems are one of the most important systems in nuclear power plant instrumentation and control systems. Periodic test plays an important role to maintain reactor protection system at a high level of operational reliability. The periodic test is carried out with every redundant channel independently and cause large fluctuations in the overall reliability of the system, in which the test frequency and test duration are main aspects to study its influence on the reactor protection system reliability. The research simulates the periodic test with direct Monte Carlo method and gets the unavailability curve of the protection system under periodic test.

In a reactor, various reactor instruments inform the operator of changes in the operating conditions. However, until now, the identification of the reactor state from interpretations of the instrumentation reading has been mostly left to the human operators, which sometimes can be flawed depending on circumstances. Therefore, an artificial cognitive system that can recognize the nuclear reactor state is suggested in this paper to aid the operator under severe environmental stress. Two reactor operating states are preliminarily considered: Normal state and loss of coolant accident state. The artificial cognitive system predicts the state of the reactor in real time, and it determines the type of LOCA if the reactor state is determined to be in an accident state. The proposed system uses only reactor protection system monitoring parameters among various available measurements. The proposed system is composed of two dynamic Bayesian models: Reactor State Determination (RSD) Model, and Accident Type Categorization (ATC) Model. When an accident occurs, the RSD model took 0.3 s to recognize it with 100% accuracy. The average accuracy of the ATC model is about 88%. The average accuracy increased more when the model was refined which suggests the model can be further improved in the future.

The safety parameters of the nuclear power plant reactor protection system directly affect the safe operation of the power plant. The application of digital technology in the control system of the nuclear power plant provides the basis for the research and development of the safety parameter management tool SPMS. This paper classifies the safety parameters of the reactor protection system. Based on the maintenance terminal of the digital protection system, the safety parameter management tool SPMS is developed, which realizes the unified online management of the safety parameters. Through the application of SPMS, the power station personnel can control the whole process of parameter management, and achieve the purpose of centralized, efficient and safe management of parameters by modification, storage and comparison.

Safety systems, built on state-of-the-art technology, are essential for achieving acceptable levels of plant safety to minimize hazards to the reactor and the general public. The second shutdown system (SSS) as an engineered safety feature and a part of the reactor protection system (RPS) is a means for rapidly shutting down a nuclear reactor, keeping it in a subcritical state and serving as a backup to the first shutdown system (FSS). In this research, one SSS with two types of optimum chamber designs is proposed that take into account the main current characteristic features of the Tehran research reactor with improvements over earlier designs. They are based on a liquid neutron absorber injection that is preferably different, diverse, and independent from the FSS based on the rod drop mechanism. The major design characteristics of this SSS with two different chambers were investigated using MCNPX 2.6.0 code. The performed calculations showed that the designed SSS is a reliable shutdown system, assuring an appropriate shutdown margin and injection time, with no significant effects on the effective delayed neutron fraction while causing minimal variations to the core structure. Further, the reasonable financial cost and the prolongation of the operation cycle are additional advantages of this design.

The instrumentation and control (I&C) systems for the Lungmen nuclear power plant (LMNPP) are fully digitized based on microprocessor and software technology, and extensively utilize multiplexing networks. That is, undetectable software faults and common cause failures due to software errors may occur, and that will defeat the redundancy of a nuclear power plant (NPP). A diverse backup implementation for the digital I&C systems is an important means to defense against undetectable software faults. This paper presents system assessment of a quad-redundant reactor protection system (RPS) design for an Advanced Boiling Water Reactor (ABWR) by utilizing the field programmable gate array (FPGA) technology. The FPGA-based RPS has been assessed by using a full-scope engineering simulator for the LMNPP. Accident scenarios and abnormal conditions are inserted into the engineering simulator in order to activate the function of the FPGA-based RPS. In this study, conceptual design of the proposed quad-redundant FPGA-based RPS, including preliminary hardware architecture, software design and system assessment will be presented. The results demonstrate that the FPGA-based RPS system is a practical approach to implement a diverse backup for the digital I&C system of nuclear power plant applications. Also, the sensitivity study of probabilistic risk assessment (PRA) shows that RPS combined with ARI (Alternative Rod Insertion) contributes significant influence on the core damage frequency (CDF) calculation of LMNPP. The PRA sensitivity study is independent of the RPS technology.

SInce 2000, Instrumentation and Control(I&C) systems of Nuclear Power Plant(NPP) based on analog technology began to be applied to the digital technology. NPPs under construction in the country with domestic APR1400 I&C system, most devices were digitalized. Cyber security of NPP I&C systems has emerged as an important issue because digital devices compared to the existing analog equipment are vulnerable to cyber attacks. In this paper, We proposed the risk rating process of cyber security threats in NPP I&C system and applied the proposed process to the Reactor Protection System(RPS) developed through Korea Nuclear Instrumentation & Control System(KINCS) project for evaluating the risk of cyber security threats.

V&V (Verification and Validation) is an important way to assure the safety and reliability of software. Requirement management plays a critical role through the whole process of V&V. Based on the practice on Generation II + pressurized water reactor named CPR1000, this paper establishes requirement management scheme for digital RPS (Reactor Protection System) software V&V, the scheme is applied in typical DCS (Digital Control System) V&V project of nuclear power plant, and enhances the trace efficiency. The successful engineering practice provides efficient requirement management reference for succeed nuclear DCS devices development and test projects.

The Instrument Channel setpoints of the Reactor Protection System(RPS) and the Engineered Safety Feature Actuation System(ESFAS) ensures the safety of Nuclear Power Plants (NPPs), and the actuation of the protection system should be guaranteed on power change condition. The goal of this study is to verify the appropriateness of the sensor drift and rack drift which are important factors for setpoints evaluation and to improve the setpoints margin using the operation data, design specifications and operation manuals of the NPPS.

As the backup systems of RPS (reactor protection system), Diverse Actuation System and ATWS( Anticipated transients without scram) mitigation system are diversely designed from RPS system so as to offer protection for the normal operation of nuclear power plant. Both of the systems bear the function of mitigating the anticipated transients without scram events. Being isolated from RPS system, the design of DAS and ATWS system meeting the requirement of diversity and influences of CCFs (common cause failure) are effectively prevented. This article mainly analyzed the structure and function of the two systems and the similarities and differences between them.

Reactor protection system (RPS) is one of the very important systems in nuclear power plant (NPP). Since the digital technology was used in RPS, for the software development,the quality control (QC) and quality assurance (QA) should be further researched. Based on the CPR1000 digital RPS software development project, this paper discusses the definitions and necessity for QC and QA, illustrates the software life cycle, proposes the practical verification and validation (V&V) activities, describes V&V process through in software development. In each stage of V&V process, the V&V activities that QC and QA works and products implemented by are detailed introduced, provides a practical and efficient reference of QC and QA method for other nuclear digital safety system software development projects.

International audience; Multi-State Physics Modeling (MSPM) provides a physics-based semi-Markov modeling framework for a more detailed reliability assessment. In this work, a three-loop Monte Carlo (MC) simulation scheme is proposed to operationalize the MSPM approach, quantifying and controlling the uncertainty affecting the system reliability model. The proposed MC simulation scheme involves three steps: (i) the identification of the system components that deserve MSPM, (ii) the quantification of the uncertainties in the MSPM component models and their propagation onto the system-level model, and (iii) the selection of the most suitable modeling alternative that balances the computational demand for the system model solution and the robustness of the system reliability estimates. A Reactor Protection System (RPS) of a Nuclear Power Plant (NPP) is considered as case study for numerical evaluation.

Since the digital technology was used in the safety digital I&C (Instrument and Control) system of nuclear power plant (NPP), its safety and reliability have been one of the most important factors to the safety operation of NPP. V&V activity is a significant method to insure the safety and reliability of the nuclear power I&C system software, the system to evaluate the efficient of V&V activity need further research. This paper on the basis of CPR1000 NPP Reactor Protection System (RPS) software development project, use the concept V&V activity for example, make a discussion for the evaluation of V&V activity, including the description of general tasks, definition of the Failure Modes, and analysis of V&V activity by FMEA (Failure Modes Effects Analysis). The results of our evaluation method in project show that the efficiency of V&V activities has been improved, and provide references for the evaluation to other NPP I&C system software development V&V activity.

Digital control system (DCS) is the central nervous system of automation monitoring and controlling of nuclear power plant. Safe operation and economic benefits of nuclear reactor units depend heavily on the performance of DCS. DCS consists of hardware and control logic. Mal-Operation Rate and Anti-Operation Rate are two important measures to evaluate the reliability of DCS. Failure Mode and Effects Analysis (FMEA) is now in common use to analyze the failures of hardware and control logic. FMEA has been widely used in assessing DCS of nuclear power plant. Fault Tree Analysis (FTA) is effective in analyzing causes and effects of failures. Based on the top-down analyzing strategy, it can easily identify the basic reason accident. Reactor protection system (RPS) is the most important part of DCS, which is used to guarantee the reactor stay in a safety state. This paper takes Spurious Trip Rate of RPS as example, analyzing how different failure modes affect reliability of RPS based on the method of FMEA and FTA. This method can also apply to analyze engineered safety features actuation system (ESFAS), and even the whole DCS of nuclear power plant, which can provide guidance for the design, operation and maintenance of nuclear power plant.

A high-temperature gas-cooled reactor-pebble bed module (HTR-PM), as a demonstration nuclear power plant (NPP), is now under construction in the Shandong province of China. The reactor protection system (RPS) in an HTR-PM is a safety-related system and is mainly in charge of monitoring safety-related parameters according to the reactor protection requirements. Thus, an RPS is very important to operations during the entire life cycle of an NPP. An RPS for an HTR-PM is completely designed and developed in China, which owns all intellectual property rights. Traditionally, the reliability of an RPS is evaluated based on a failure mode, effects, and criticality analysis (FMECA) and a fault tree analysis (FTA), which are static methods and cannot reflect the reliability of the system's dynamics. In this paper, we propose a dynamic reliability model for the RPS in an HTR-PM based on the Markov chain theory. Using this model, all states and their dynamic transition processes, especially the degradation process from a 2-out-of-4 structure to a 2-out-of-3 structure, are all determined. Moreover, based on this proposed model, an optimal surveillance test interval can be determined.

Safety system testing is one of the most rigorous and time-consuming requirements in the verification and validation process for reactor protection systems (RPSs). This paper presents the development of a test system for the fully digital and field-programmable gate array-based RPS of the solid fuel (SF) thorium-breeding molten salt pebble bed fluoride salt-cooled reactor (TMSR), denoted as the TMSR-SF1 project, developed by the Chinese Academy of Sciences. The test system is applied to the RPS to ensure that it fully meets its designed functions and system specifications. We first introduce the testing principles and methods. Then, the hardware component designs and the software program development of the test system are discussed. Finally, the test process and test results are discussed and summarized.

Techniques for optimizing the frequency of periodic surveillance testing of nuclear power plant (NPP) safety systems have been receiving increased attention and growing importance because of the need to reduce system unavailability and maintenance cost. Economic losses from maintenance human errors should be included in estimating periodic testing and maintenance costs because the losses increase with maintenance human errors. This paper proposes a method for optimizing periodic testing intervals of a digital reactor protection system by balancing risk and cost of periodic surveillance tests, in which maintenance human error and public risk perception have been reflected. The risk and costs were estimated from both plant operator and socio-economic standpoints. This model determines the optimal testing frequency for the minimum value of an objective function that consists of all costs, including the monetary values of the consequence of maintenance human errors and reactor core damage. We present a case study using our model for the OPR1000 plant. The study results show the significance of reducing human errors in periodic testing and maintenance. The proposed method is expected to be useful to NPP operators as well as regulators for evaluating the optimal periodic testing frequency of a nuclear reactor protection system and for obtaining information needed in decision making processes.

Modeling of spurious activations in safety instrumented systems has been studied for over a decade. The spurious activation of a plant protection system in nuclear power plants (NPPs) leads to increased electricity generation cost. An in-depth view on spurious activation of digital plant protection systems of NPPs for human errors in maintenance tasks is presented in this paper. A new model which considers human errors in maintenance and periodic tests to predict component failure rates is presented. The model has been applied to OPR-1000 reactor protection system for quantification of spurious trip frequency by fault-tree analysis. The major causes of spurious activation in a nuclear reactor protection system are identified. A set of case studies has been performed with the variation of magnitudes of human errors probability and maintenance strategies, in which, the human errors in maintenance are found to significantly influence reactor spurious trip frequency. This study is expected to provide a useful mean to designers as well as maintainers of the digital reactor protection system to improve plant availability and safety.

Verification of programmable logic controller (PLC) programs written in IEC 61131-3 function block diagram (FBD) is essential in the transition from the use of traditional relay-based analog systems to PLC-based digital systems. This paper describes effective use of the well-known verification tool VIS for automatic verification of behavioral equivalences between successive FBD revisions. We formally defined FBD semantics as a state-transition system, developed semantic-preserving translation rules from FBD to Verilog programs, implemented a software tool to support the process, and conducted a case study on a subset of FBDs for APR-1400 reactor protection system design.

This paper summarizes an in-depth review of the US nuclear operating experience with the first generation of digital reactor protection systems. The accumulated operating experience from 1984 to 2006 on these first generation digital reactor protection system functions exceeds 1.27 million hours (∼145.5 yr). A review of failure event reports identified 141 specific events associated with these systems on seven US nuclear power plants. Twenty-six of these events involved some type of common cause failure mechanism (predominantly redundant sensors/channels being out of calibration), which temporarily rendered redundant portions of the overall trip function degraded. Most of these failures were found not to be unique to digital systems. Six of the common cause failure events were more severe and involved situations where incorrect addressable constant data sets were systematically loaded into all redundant computer channels due to personnel errors. One of these events involved a latent software design change error introduced during a software update, which would prevent proper operation, given an unlikely event involving failure of three out of four sensors of one type. Based upon this review of digital system operating experience, a series of risk assessment calculations were performed to evaluate the safety significance of the observed failure events. From the insights gained in this work, it is possible to develop a framework for establishing digital reactor protection system reliability requirements that can be related back to regulatory safety goal objectives and operating experience.

A series of evaluations for an inadvertent control rod withdrawal event has been performed to identify the appropriateness of the reactor protection system of a 65 MWt advanced integral reactor by using the Transients And Setpoint Simulation/System-integrated Modular Reactor (TASS/SMR) code. Evaluation results show that, if considering only a high core power trip function as the reactor protection system for the limitation of a core power increase, the occurrence of an inadvertent control rod withdrawal event at the lower core power levels under a high speed mode of a main coolant pump (MCP) results in a significant deterioration in the safety margin. Specially, a violation of a safety limit is possible under the MCP middle and low speed modes due to an unsuitable setpoint of the high core power trip function. To enhance the safety margin, a variable overpower trip (VOPT) function having multiple ceilings according to the MCP speed mode has been implemented into the reactor protection system for the 65 MWt advanced integral reactor. Reassessments by considering the VOPT function with multiple ceilings show that a safety enhancement in the case of an inadvertent control rod withdrawal event is obtained by a timely initiation of a reactor trip.

High Temperature Gas-Cooled Reactor-Pebble bed Module (HTR-PM) Nuclear Power Plant (NPP) is one of the most important projects in the National Science & Technology Major Project during the Eleventh Five-Year Plan period. HTR-PM digital Reactor Protection System (RPS) is one of the key research subjects in the HTR-PM NPP supported by the National S&T Major Project. The research on software reliability of digital RPS plays an important role to improve the reliability of RPS. Based on analyzing the fault data set collected during the software development of HTR-PM RPS, a new software reliability model involved the fault severity was studied and established.

Events initiated by common-cause-failure (CCF) can significantly affect the availability and reliability of nuclear power plant safety systems. In recognition of this, CCF data are systematically collected and analysed in the International Common-Cause Data Exchange (ICDE) Project, which was initiated in August 1994. Since April 1998, the NEA has formally operated the project. Currently eleven countries participate in the project. The ICDE collects all events where two or more identical, redundant components of a group, fulfilling the same function, have failed or were impaired due to a shared cause (ICDE events). Complete CCFs, i.e. failure of all identical, redundant components in the group due to a shared cause are an important subset of the collected data. Currently, data exchange and analysis covers the following components: centrifugal pumps, diesel generators, motor-operated valves, safety and relief valves, check valves, reactor protection system components (level measurement, control rod drives, etc), circuit breakers, and batteries. The main findings of the ICDE reports issued by 2005 show averaged over all components that about two thirds of all complete CCF events involve faulty actions by plant personnel and contractors. The single largest contribution is from faulty testing and maintenance work due to deficient and/or incomplete procedures. Other important causes are insufficient testing and requalification of components or systems after maintenance, repair, modifications or backfitting work, as well as operator errors of commission. The probability that a reported ICDE event is a complete CCF decreases strongly with increasing number of redundant components, demonstrating the effectiveness of redundancy as a powerful defence against CCFs. However, complete CCFs cannot be completely prevented by high redundancy only.

Sensors are part of the protection system in a nuclear power plant. They are the first link in the chain with influence to the protection system. It is therefore important that the sensors fulfil the demands of reliability and response time. Dynamic investigations of the sensor systems are possible to perform during operation of the plant with the aid of advanced signal analysis. Correctly performed, such an investigation indicates if any sensor with attached sensing lines deviates from the expected dynamic behaviour. The paper presents results from Ringhals 1 in Sweden where snubbers (pulsations dampers with exchangeable needles) were used in the sensing lines to differential pressure sensors. The dynamic influence of the needles was equivalent to a time constant = 0.55 s. It was clear that the response time was longer than the demanded response time with respect to the sensors task in the safety system. By eliminating the needles the demand on the response time was fulfilled. The deviation lead to a report to the Swedish Nuclear Power Inspectorate (equivalent to a Licensee Event Report) with INES level 1. The title of the report is “Too long response time caused by not correct installed pulsation dampers in swelling transmitters”. The paper proves convincingly that signal analysis of multiple sensor signals is a fruitful way to observe dynamic deviations in measurement systems in nuclear power plants.

Making software dependable is one of most important aspects in safety-critical system such as a nuclear power plant. Dependable programming techniques to get rid of undependable properties, such as ambiguity, wrong uses of elements, discordance, etc., help engineers reduce the faults in programs. This paper proposes the practice guidelines for function block diagram (FBD) which is a programming language for programmable logic controllers (PLC) widely used in industry. The guidelines show that what cases cause undependable properties and how the properties should be eliminated to be dependable ones in FBD programs. The paper introduces the application of guidelines to the trip (shutdown) logic of bistable processor (BP) in reactor protection system (RPS) developed in the Korea Nuclear Instrumentation and Control System RaD Center (KNICS). The application describes that the guidelines eliminates undependable properties in the trip logic.

This paper presents an approach for the evaluation of risk impact of Surveillance Requirement changes addressing identification, treatment and analysis of uncertainties in an integrated manner, which is intended to be used in an optimization context. It is also presented an example of application of the methodology to study a SF change of the Reactor Protection System of a Nuclear Power Plant.

An anticipated transient without scram (ATWS) is an anticipated operational occurrence (AOO) followed by failure of the automatic reactor trip function of the reactor protection system. The failure of the reactor to shut down during the certain AOOs can lead to increase in reactor coolant system (RCS) pressure and decrease in departure from nucleate boiling ratio (DNBR) margin for a pressurized water reactor (PWR). Japanese standard PWRs are equipped with ATWS mitigation system which consists of a diverse mitigation system which is independent from the reactor trip system. The ATWS mitigation system automatically initiates isolation of the main steam line flow and the auxiliary feed water system under condition indicative of an ATWS. Mitsubishi Heavy Industries, Ltd. (MHI) applies 3D coupled code, SPARKLE-2 [1] [2], to the ATWS evaluation. SPARKLE-2 is a 3D coupled code developed by MHI and consist of the PWR system transient analysis code M-RELAP5, the 3D neutron kinetics code COSMO-K [3] and the 3D core thermal-hydraulics code MIDAC [4]. SPARKLE-2 implements the 3D characteristics such as local moderator feedback and change in 3D power distribution during transient. Thanks to gain from the 3D calculation, the analysis results show that the plant transients are effectively mitigated by the ATWS mitigation system and the RCS pressure and the minimum DNBR meet the safety criteria. These results also show that operational margins are increased, which enables more flexible design of the reload core.

This paper briefly introduces the safety instrumentation and control (I&C) system (Teleperm® XS) designed for the nuclear power plant in Mochovce units 3 and 4 (Slovak Republic). The overall I&C architecture of the concerned nuclear power plant is shortly introduced as well. An overview is given on the different test phases for the hardware and software I&C modules. The integrated I&C test concept and its implementation is presented as well as the description of the integrated test phase in the test bay in Erlangen (Germany). After a successful completion of the integrated test phase for unit 3, the Factory Acceptance Test (FAT) and the erection phase have been started for the concerned I&C safety systems (e.g., the Reactor Protection System and the Reactor Power Limitation System). This paper will also present the significant advantages and specifics of performing the concerned I&C tests in the aforementioned test bay.

A special Markov reliability model is used to simulate the effects of frequency of testing and allowable bypass time of the analog channels and logic trains on the performance of a pressurized water reactor, reactor protection system (RPS). The effects of these technical specifications (TSs) on the unavailability of the RPS and on the frequencies of spurious scrams, core damage, anticipated transients without scram, and large early releases are assessed. The use of these results to support decision making concerning changing the TSs in light of the relevant policy statement by the U.S. Nuclear Regulatory Commission on risk-informed decision making is demonstrated. The analysis includes point-value calculations sensitivity and uncertainty analysis.

The dynamic safety system (DSS) is a computer based reactor protection system that has dynamic self-testing feature and fail-safe nature inherently. The dynamic self-testing and fail-safe features provide a high level of reliability and low spurious trip rate. The time and human efforts maintaining the system can also be reduced by virtue of those features. In order to apply the DSS for PWR, however, some modification is required because there exist many differences between PWR and AGR for which the DSS was first tested and installed. These differences are trip algorithms, monitored parameters, trip logics, and other conditions. In this work, the DSS algorithm is modified for PWR. The modified DSS has several new features which are required for applying DSS technology to PWR. Then, the modified DSS is implemented in a programmable logic controller (PLC) and tested. It is shown that, from the results, the modified DSS generates correct output in all test cases.

The Qinshan Nuclear Power Plant phase 1 unit (QNPP-1) has a power rating of 320 MWe generated by a pressurized water reactor that was designed and constructed by China National Nuclear Corporation (CNNC). The TELEPERM XS I&C system (TXS) is to be implemented to transform analog reactor protection system (RPS) in QNPP-1. The paper mainly describes the function, structure and characteristic of RPS in QNPP-1. It focuses on the outstanding features of digital I&C, such as strong online self-test capability, the degradation of the voting logic processing, interface improvements and CPU security. There are some typical failures during the operation of reactor protection system in QNPP-1. The way to analyze and process the failures is different from analog I&C. The paper summarizes typical failures of the digital RPS in the following types: CPU failure, communication failure, power failure, Input and output (IO) failure. It discusses the cause, risk and mainly processing points of typical failure, especially CPU and communication failures of the digital RPS. It is helpful for the maintenance of the system. The paper covers measures to improve the reliability of related components which has been put forward effective in Digital reactor protection system in QNPP-1. It will be valuable in nuclear community to improve the reliability of important components of nuclear power plants.

High Temperature gas-cooled Reactor-Pebble bed Module (HTR-PM) Reactor Protection System (RPS) is a dedicated system to be designed and developed according to HTR-PM Nuclear Power Plant reactor protection specifications. HTR-PM RPS has the framework of four redundant channels and has two independent and diverse subsystem x and subsystem y to perform different protection functions, which would decrease the potential common cause failure caused by software and increase the system reliability.Copyright © 2013 by ASME

Atucha II is a 745 MW Argentine Power Nuclear Reactor constructed by ENACE SA, Nuclear Argentine Company for Electrical Power Generation and SIEMENS AG KWU, Erlangen, Germany. A preliminary modular logic analysis of RPS (Reactor Protection System) signals was performed by means of the well known Swedish professional risk and reliability software named Risk-Spectrum taking as a basis a reference signal coded as JR17ER003 which command the two moderator loops valves. From the reliability and behavior knowledge for this reference signal folloos an estimation of the reliability for the other 97 RPS signals. Because the preliminary character of this analysis Main Important Measures are not performed at this stage. Reliability is by the statistic value named unavailability predicted. The scope of this analysis is restricted from the measurement elements to the RPS buffer outputs. In the present context only one redundancy is analyzed so in the Instrumentation and Control area there no CCF (Common Cause Failures) present for signals. Finally those unavailability values could be introduced in the failure domain for the posterior complete Atucha II reliability analysis which includes all mechanical and electromechanical features. Also an estimation of the spurious frequency of RPS signals defined as faulty by no trip is performed.

The impact of alarm section failures for EDM reactor protection system (RPS) modules is studied.Also their interaction with the conventional alarm system (CAS).Unavailabilities for RUU (And gate one negated input) and RSP (Memory) modules are evaluated.

The microprocessor-based reactor protection system (RPS) combining a fail-safe configuration and an on-line diagnosis is presented. This combination further enhances the maintainability and reliability. The signal processing unit which judges the scram action has fail-safe and diagnosis functions. The load driver which drives the scram pilot valves is diagnosed in an on-line state. A failure in any component of the RPS which is insured a majority voting function is by-passed. The failed component is repaired based on the results of an on-line diagnosis and a fail-safe action. A latch circuit is needed to hold a scram action. A configuration of the latch circuit which can fulfill the fail-safe function and its quick response has been proposed. An on-line diagnosis method for the load driver has been developed in which the RPS functions are not interfered with, even if a single failure occurs in the diagnosis circuits. A diagnosis circuit checks a switching element which is a component of the load driver. The test pulse that is outputted from the diagnosis circuit forces the switching element to the open-state rapidly without activating the scram pilot valves. The rapid execution of the fail-safe function and the on-line diagnosis of the load driver was validated by experiments that simulated failures.

Probabilistic fire safety assessment (Fire PSA) of the Finnish nuclear power plant TVO I/II has been extended to include the detailed investigation about the fire risks induced by the unwanted function of the reactor protection system (RPS). This paper describes the main features of RPS as well as the assumptions and the simplifications made during the study. The most important qualitative and quantitative results are told and a number of examples about the fire safety improvements already implemented are given. In the plant with four redundant safety systems and the 2-out-of-4 voting logic in RPS spurious activations of safety related components seem to dominate the risk increasing effect.

Union Fenosa, a utility company in Spain, has performed research on pressurized water reactor (PWR) safety with respect to the development of a best-estimate methodology for the analysis of anticipated transients without scram (ATWS), i.e., those anticipated transients for which failure of the reactor protection system is postulated. A scientific and technical approach is adopted with respect to the ATWS phenomenon as it affects a PWR, specifically the Zorita nuclear power plant, a single-loop Westinghouse-designed PWR in Spain. In this respect, an ATWS sequence analysis methodology based on published codes that is generically applicable to any PWR is proposed, which covers all the anticipated phenomena and defines the applicable acceptance criteria. The areas contemplated are cell neutron analysis, core thermal hydraulics, and plant dynamics, which are developed, qualified, and plant dynamics, which are developed, qualified, and validated by comparison with reference calculations and measurements obtained from integral or separate-effects tests.

Existing nuclear power generation facilities are currently seeking to replace obsolete analog Instrumentation and Control (I&C) systems with contemporary digital and processor based systems. However, as new technology is introduced into existing and new plants, it becomes vital to assess the impact of that technology on plant safety. From a regulatory point of view, the introduction or consideration of new digital I&C systems into nuclear power plants raises concerns regarding the possibility that the fielding of these I&C systems may introduce unknown or unanticipated failure modes. In this paper, we present a fault injection based safety assessment methodology that was applied to a commercial safety grade digital Reactor Protection System. Approximately 10,000 fault injections were applied to the system. This paper presents a overview of the research effort, lessons learned, and the results of the endeavor.

Reactor protection system is one of the most important safety systems in nuclear power plant and shall be designed with very high reliability. Digital computer-based Reactor Protection System (RPS) takes great advantages over its conventional counterpart based on analog technique and faces the issues how to effectively demonstrate and confirm the completeness and correctness of the software that performs reactor safety functions in the same time. It is commonly accepted that the essential way to solve safety software issues in a digital RPS is to pass a strict and independent Verification and Validation (V&V) process, in which integrated RPS testing play an important role to form a part of the overall system validation. Integrated RPS testing must be carried out rigorously before the system is delivered to nuclear power plant. The integrated testing are often combined with the factory acceptance test (FAT) to form a single testing activity, during which the RPS is excited by emulated static and dynamic input signals. The integration testing should simulate normal operation, anticipated operational occurrences and accident conditions, as well as anticipated faults on the inputs to the DRPS such as sensors out of range or ambiguous input readings. All safety function requirements of digital RPS should be confirmed by representative testing. The design and development of a test facility to carry out the integrated RPS testing are covered in this paper, which is merged in the research on a digital RPS engineering prototype for a nuclear power plant. The test facility is based on PXI platform and LabVIEW software development environment and its architecture design also takes into account the test functions future extensions such as hardware upgrades and software modules enhancement. The test facility provides the digital RPS with redundant, synchronized and multi-channel emulated signals that are produced to emulate all protection signals from 1E class sensors and transmitters with time varied value within their possible ranges, which would put integrated RPS testing into practice to confirm the digital RPS has fully met its predefined safety functionality requirements. The designed test facility can provide an independent verification and validation process for the research of digital RPS with scientific methods and authentic data to evaluate the RPS performance thoroughly and effectively, such as measuring threshold precision and trip response time, analyzing system statistical reliability and so on.Copyright © 2010 by ASME

This paper reports on typical reactor trip setpoints which established for the reactor protection system may be unduly restrictive, depending on how the uncertainties are handled in the plant safety analyses. The current deterministic approaches to establishing specific setpoints contain a substantial amount of conservatism, which can be reduced through the use of a statistical combination of uncertainties process. Using this approach for Three Mile Island Unit 1 indicates that the flux/flow trip setpoint can be relaxed to 1.1 from the existing technical specification value of 1.08. This provides an increased plant operating margin and reduction in the probability of spurious scrams.

In China, more and more Nuclear Power Plant (NPP) will be constructed in the near future years, and Main Control Room (MCR) will introduce digital Instrumentation and Controls systems (I&C) technique. I&C system of nuclear power plant consists of Control Systems, Reactor Protection System and Engineered Safety Feature (ESF) Actuation System. For example, I&C system of LinAo Phase II NPP has adopted SIEMENS TXP and TXS I&C, which is being constructed in Guangdong province, China. In this engineering project, Chinese engineers are responsible for all the configuration of actual analog and logic diagram. Before the phase of real plant testing on the reactor, engineers want to make sure that configuration is right and control functions can be accomplished, so primary Verification and Validation (V&V) of I&C works were done. One way is checking the diagram configuration one by one according to the original design. There are two main disadvantages. One is diagram is so complex that workload is very large and engineers will make mistake. Another is even engineers have read every logic, but they still cannot know the final results and function of a complex control system. So another effective V&V way is applying NPP engineering simulator to do virtual test. According to LinAo Phase II NPP design, we develop one simulator to construct a virtual NPP model as a basis, which can provide plant operation parameters and can also accept control signal from I&C, then give response to it. Through this way, we don’t need to know the exact diagram, and just observe input and output of I&C to make sure that the final results is right and functions have been accomplished. In this way, it is need to transfer signals between simulator and I&C. For keeping the original software and hardware structures of SIEMENS Distributed Control System (DCS), we use one set of data acquisition (DAQ) equipments to build a connection between the engineering simulator (software) and SIEMENS DCS I/O cabinet (hardware), and the interface is standard 4–20mA direct current and 0–48V direct voltage. This way is convenient for expansion to other digital I&C V&V. After these two V&V works, we can then build the confidence of digital I&C control function. As an application research, we mainly focus on V&V of digitalized control systems and selected several Reactor Control (RRC) systems as examples, including pressurizer pressure and water level control, steam generator water level control. In this paper, we will introduce the way of applying engineering simulator to do V&V works, the structure of our simulator, the function of different block, and primary V&V results. Moreover, we will have ideas on the future application of this methodology to V&V of Reactor Protection System and ESF Actuation System.

Taking as an example the nuclear power plant Mulheim-Karlich whose nuclear steam supply system is based on an American license, basic differences between the American and the German practice of licensing nuclear installations are discussed. By comparing concrete licensing requirements for the design of specific safety and operating systems, i.e. the reactor protection system, the unit control system, the pressurizer and relief system and the emergency cooling system, the resulting measures of adaptation are shown and substantiated. On the basis of this experience, goals are identified for an internationally harmonized set of requirements.

The Paks full-scope training simulator has been in service since 1988. In the last almost two decades practically every element of the simulator has been upgraded, replaced because the fast development of the computer techniques made the solution a great amount earlier unsolvable problems possible. Moreover, the requirements against the simulator have also changed. Originally the simulator was used only for training the operating personnel of the Paks Nuclear Power Plant, but now it is used as a "test bed" for new systems prior their installation on the real plant, too. The first such testing was the replacement of the Reactor Protection System with a new computerized one. For this reason the scope of the models had to be extended to cover the severe accidents, which needed a much more powerful simulator computer than the original one. The outdated control room interface system had to be replaced by a new one, because spare parts became unattainable and its service required very high cost. Only the instructor's system remained in its original form. Now the old Instructor's system has been replaced as well. All the old functions were realised by convenient full-graphic Man-Machine Interface tools. The paper describes in detail the newly added functionalities of he Instructor's system, too