Search

Accident scenarios implying the failure of the active and passive reactor protection system are the most severe in their consequences since they are accompanied by the melting of fuel elements, fuel assemblies, and the entire core and, as a consequence, the release of fission products (FP) from the fuel melt and structural materials. The location of reactor facilities near populated areas requires an understanding of the consequences of hypothetical accidents with the destruction of the core. The most important is information on the amount of FP released into the environment. To assess the possible dose load on personnel and the environment in a hypothetical accident, data on the release of radioactive nuclides from the damaged, including molten, core are required. This work presents approaches that can be used to calculate the amount of fission products released from the fuel melt. The proposed approaches are based on general patterns of behavior and release of impurities from liquid solutions. To simulate this process, a system of differential equations is solved. The proposed approaches were implemented in the form of a software module for calculating the release of FP from the melt. Using the developed module, a test problem for the release of FP from a molten oxide fuel was solved, and an analysis of the results of real experiments carried out at the National Laboratory in Oak Ridge was carried out. Satisfactory convergence of the calculated data on the yield of both nonvolatile (Ce, Sr) and volatile (Xe, Kr) fission products is shown.

Reliability assessment of a digital dynamic system using traditional Fault Tree Analysis (FTA) is difficult. This paper addresses the dynamic modeling of safety-critical complex systems such as the digital Reactor Protection System (RPS) in Nuclear Power Plants (NPPs). The digital RPS is a safety system utilized in the NPPs for safe operation and shut-down of the reactor in emergency events. A quantitative evaluation reliability analysis for the digital RPS with 2-out-of-4 architecture using the state transition diagram is presented in this paper. The study assesses the effects of independent hardware failures, Common Cause Failures (CCFs), and software failures on the failure of the RPS through calculating Probability of Failure on Demand (PFD). The results prove the validity of the proposed method in analyzing and evaluating reliability of the digital RPS and also show that the CCFs and longer detection time are the main contributions to the PFD of digital RPS.

The aim of this study is to verify if the reliability of a digital four-channel RPS under the design phase satisfies the specified target and to identify the weakness of system design and potential solutions for system reliability improvement. The event-tree/fault-tree (ET/FT), which is the method used in the current probabilistic safety assessment (PSA) framework of nuclear power plants (NPPs), was adopted to developed reliability modeling for the RPS with the Top Events defined as the system failure to generate reactor trip signal and the system generating spurious trip signal. The evaluation results indicate that the probability of the system failure on demand and the frequency of spurious trip signal generation are 1.47 × 10−6 with a 95% upper bound of 4.63 × 10−6 and 7.94 × 10−4/year with a 95% upper bound of 2.50 × 10−3/year, respectively. The importance and sensitivity analyses were conducted and it was found that undetected unsafe common cause failures (CCFs) of signal conditioning modules (SCMs) dominate the system reliability. Two preliminary optimization schemes relative to reducing periodic test interval and adapting two kinds of diverse SCMs were proposed. Results of the quantitive evaluation of the schemes show that neither of them could determinedly improve the system reliability to the target level. In the future, more detailed optimization analysis shall be required to determine a feasible system design optimization scheme.

Reliability in safety-critical systems and equipment is of vital importance, so the probabilistic safety assessment (PSA) has been widely used for many years in the nuclear industry to address reliability in a quantitative manner. As many nuclear power plants (NPPs) become digitalized, evaluating the reliability of safety-critical software has become an emerging issue. Due to a lack of available methods, in many conventional PSA models only hardware reliability is addressed with the assumption that software reliability is perfect or very high compared to hardware reliability. This study focused on developing a new method of safety-critical software reliability quantification, derived from hardware-software integrated environment testing. Since the complexity of hardware and software interaction makes the possible number of test cases for exhaustive testing well beyond a practically achievable range, an importance-oriented testing method that assures the most efficient test coverage was developed. Application to the test of an actual NPP reactor protection system demonstrated the applicability of the developed method and provided insight into complex software-based system reliability.

Bandung TRIGA2000 Reactor, a General Atomic (GA)-made research reactor used for training, research andiIsotope production, has been upgraded to operate at power of 2000 kW using TRIGA fuel rod type. Recently, the TRIGA reactor fuel element producers are going to discontinue the production of TRIGA fuel element. To overcome the unavailability of TRIGA fuel element, BATAN planned to modify TRIGA2000 fuel type from rod-type to U3Si2-Al plate-type fuel with 19.75% enrichment, similar to the domestically fabricated one used in RSG-GAS. The carried out design emphasized on the determination of operation condition limits for setting the reactor protection system in accordance to the reactor safety calculation results. The conceptual design of the innovative fuel plate TRIGA reactor cooling system is expected to remove heat generated by fuels with nominal power of 1 MW up to 2 MW. The design is developed through modelling and safety analysis using COOLOD-N2 validated code. The safety margin is set to its flow instability at transient condition of the fuel plate, which is ≥ 2.38; departure from nucleate boiling ratio ≥1.50; and no onset of nucleate boiling, ΔTONB ≥ 0oC. The primary coolant flow rate accommodating the existing Bandung TRIGA reactor capability is as high as 50 kg/s. The analysis results show that at power of 1 MW, the reactor can safely operate, while at power of 2 MW the safety margin is exceeded. In other words, the plate TRIGA reactor that employs forced convection mode operates safely at 1 MW with excess power 120% of its nominal power.Keywords: 1 MW, Thermalhydraulic design, Steady state condition, TRIGA plate, Constant flowrate

As a clean energy source, Low Temperature Reactor can be used for heating, desalination, industrial steam production, summer cooling, etc. It still has good application prospects at present. The reactor protection system is one of the important safety systems in Low Temperature Reactor, thus improving the reliability of the protection system can enhance the safety level and economic benefits of the reactors. The reliability of the protection system is directly related to its system structure, the quality of its components, and the power supply topology. The effect of the third factor is analyzed in this article. In the aspect of system reliability analysis, the RBD method is widely used and has many public research results. Based on the block diagram of protection system, this article establishes the RBD that considers the operation failure. According to the foregoing RBD, the protection system reliability is calculated, the minimum cut sets that can cause the protection system failure are analyzed, the different importance measures of each device in the protection system is determined, and the occurrence probability of the minimum cut sets and the importance measures are sorted as a basis for subsequent optimization of power supply topology. The Low Temperature Reactor protection system in this article is mainly composed of transducer, set-point comparison unit, logic coincidence unit, and safety trigger unit. The power supply of these units have many possible topological structures, which have different complexity and different reliability levels. Three improvement approaches are proposed for the power supply topological structure of transducer, set-point comparison unit and logic coincidence unit, the reliability of the optimized protection system is calculated and analyzed. The results show that by improving the power supply topology, the reliability of the protection system is improved without increasing the components’ quality and redundancy.

Nuclear Power Plants (NPPs) are physically isolated from external networks and have different operational environments than conventional information technology (IT) systems. Accordingly, NPPs were regarded as safe from external cyber-attacks. However, it was later determined that isolated networks are not safe from cyber-attacks. Malicious data injection attacks on Programmable Logic Controllers (PLCs) deployed in the safety system of NPPs are critical to nuclear facilities, as they were in the Stuxnet attack. It is necessary to monitor the integrity of PLC data and protect the PLCs from cyber threats such as modification of deployed logic or setpoints. To address this problem, this paper proposes a novel system for monitoring data integrity of PLCs using blockchain technologies. Considering the NPP environment, we developed a private blockchain system to monitor the data integrity of PLCs. The new concept that is Proof of Monitoring (PoM) for data integrity of PLCs was proposed to overcome the limitation for applying the private blockchain to the cybersecurity of NPPs. Additionally, we developed an integrity monitoring system for the Reactor Protection System (RPS)—a safety system in NPPs—using the developed blockchain. It can detect cyber-attacks (such as false code injection attacks on PLCs) and monitor which PLC integrity has been compromised in real-time. A validation experiment using a false data injection attack on PLCs was performed on the developed system, and the results confirmed that the developed system successfully monitored the modification of data in the PLCs.

Recently, a new fuzzy fault tree analysis (FFTA) has been developed to propagate and quantify the epistemic uncertainties occurring in qualitative data such as expert opinions or judgments. It is well known that the weakest triangular norm (Tw) based fuzzy arithmetic operations preserve the shape of the fuzzy numbers, provide more exact fuzzy results and effectively reduce uncertainty range. The objective of this paper is to develop a novel Tw-based fuzzy importance measure to identify the critical basic events in FFTA. The proposed approach has been demonstrated by applying it to a case study to identify the critical components of the Group 1 of the U.S. Combustion Engineering Reactor Protection System (CERPS). The obtained results are then compared to the results computed by the existing well-known importance measures of conventional as well as FFTA. The computed results confirm that the proposed Tw -based importance measure is feasible to identify the critical basic events in FFTA in more exact way.

The reactor protection system (RPS) in a research reactor is a well-known conventional setpoint-based protection system. The RPS performs protective actions with the generation of alarms when the measurement values exceed the setpoints. The RPS has disadvantages in that alarms are not generated before the measurement values exceed the setpoints; they are generated at the time of protection actions are performed. In addition, each alarm has a direct relation with signals, not accidents, so it is difficult to identify the accident type quickly. Thus, new methods are required to diagnose and classify accidents. We propose a deep-learning-based alarm system. The proposed alarm system is modeled with convolutional and fully connected neural networks. The proposed scheme is designed from safety analysis in the safety analysis report. We prepare various datasets and scenarios for training and test. The results show that the proposed alarm system provides fast diagnosis alarms with probability values.

Solid-moderated cores of the Kyoto University Critical Assembly (KUCA) have an emergency shutdown system to avoid any reactivity-initiated accidents. When a reactor protection system of KUCA detect...

RPS (Reactor Protection System) plays a critical role in assuring safety operation and relieves the consequence of accident in Nuclear Power Plant (NPP). With widely use of digital instrumentation and control (I&C) system, since LingAo phase II, Chinese NPP started the introduction of digital I&C system. After ten years of effort, the first domestic independent researched and developed digital I&C system, which named FirmSys, has been deployed in Yang Jiang NPP and intended to export with 3rd generation HPR1000 reactor to the UK. To achieve this export, the method to satisfy generic design assessment (GDA) requirements from the office for nuclear regulation (ONR) of UK is being explored. Statistical test is a recommendation way for independent confidence-building measure (ICBM) and production excellence (PE) of GDA. According to the requirements of statistical test from standard IEC 60880, and with the analysis of current test method limitation in test coverage and operation state simulation, the content and process design is the key point for statistical test in finite test times. For safety critical software in nuclear power plant, whose probability of failure is very small, the critical operation of dealing with accident for avoiding of disaster by user will rarely happen but requires high reliability. Therefore, the common practice of statistical test could not make a sufficient test for the operation during accident happening, and the cost of test is unacceptable. This paper proposes a scenario-based innovation statistical test method for RPS, and describes the test architecture, process, and achievement. This method uses accident scene as test case that focus on the protection functions, it covers parameters, values, operation states, and protection actions. All selected scenes is designed to occur in their relatively probability, target systems are responding in real input and output environment to prove their protection ability as the accident is really happening. Meanwhile, to test the effectiveness of redundant design, channels are randomly selected for success data transform while others are set failure. At last, an engineering practice with this scenario-based test method is made on FirmSys, the pressure water reactor typical accident scenes LOCA, SGTR and MSLB have been successfully simulated, achieves protection sequence verification with high parameters coverage during parameters constantly variation. This method also provides reference for system verification, reliability evaluation and GDA, and be applied in engineering project.

The response time of shutdown of a nuclear reactor is an important parameter of reactor protection systems in nuclear power plants. Furthermore, as a part of a reactor protection system, the point to point communications system mostly influence the response time of shutdown of a nuclear reactor. A new solution to optimizing the response time is introduced, where a point to point communication system is implemented by FPGA technologies. The new designed system could extremely improve the efficiency of communications, which contributes to shortening the response time of shutdown. This paper delivers not only analysis of the response time of shutdown in current systems, but also the design scheme of the FPGA-based system. In addition, the communication system based on FPGA optimizing the response time of shutdown of a nuclear reactor is proved which is applied in reactor protect systems of VVER.

In order to explore the risk assessment method of the multi-unit nuclear power plant site, this paper selects the dual-unit plant nuclear site to analyze lose off-site power accident. By combining and improving the single-unit ET/FT model, to establish the dual-unit ET/FT model. From the analysis of the accident sequence, it can be concluded that the common cause failure of equipment is the main challenge faced by the dual-units. Especially the RPC sub-channel in the reactor protection system and the failure of emergency diesel engine circuit breaker. As can be seen from the high proportion of core CD occurring simultaneously in both uints, it has a great significance to study the risk of mult-units sites.

The safety video display unit (SVDU), as the display machine of the reactor protection system, performs the functions of displaying the reactor’s safety parameters and sending safety control commands. In order to meet the needs of nuclear power safety-level digital control system (DCS), like designing verification, operator training, and accidental drills, for the SVDU in the NASPIC platform developed independently by China National Nuclear Corporation, a virtual embedded system technology based on the micro x86 industrial host is proposed to make software simulation to the SVDU physical controller with exactly the same hardware appearance of the original one. The SVDU stimulator realized by this research can achieve 100% simulation of the logical functions of the SVDU physical equipment and the synchronized upgrading function between stimulator and the real equipment. With the development of multiple engineering application requirements, such as configuration verification and operator training, this stimulator has been applied in several virtual security level DCS projects.

Safety analysis for Pressurized Heavy Water Reactor (PHWR) is carried out for various postulated initiating events as per regulatory requirement and may be categorized into normal operation, anticipated operational occurrences and design basis events etc. The analyses of these events are carried out with the objective of verifying that acceptable design limits are not exceeded for these categories. The safety analysis report is made based on the above-mentioned analyses. However, certain special transients are also analyzed to confirm the behavior of the reactor during such events to be within acceptable design limits. In present paper, we have analyzed certain reactivity-initiated plant transients like loss of regulation (LOR) incident for initial distorted flux shape, local change in reactivity due to pressure tube-calandria tube (PT-CT) break and inadvertent entry of fuel locator into coolant channel for 700 MWe PHWR, which allows boiling at the exit of coolant channel. The above transients have been carried out for the first time for Indian PHWRs with 3 dimensional transient code IQS3D based on improved quasi-static (IQS) approach coupled with thermal hydraulic computer code ATMIKA-T. The analysis results show that fast power rise during transients get terminated by reactor protection system and slow power transients are controlled by Reactor regulation system (RRS) and all safety parameters are within acceptable limits.

In recent years, the rapid progress of digital technology to safety-critical systems such as the digital reactor protection system (RPS) is increased. The proposed method aims to make a quantitative evaluation model for the reliability analysis of digital RPS with 2-out-of-4 architecture using the state transition diagram to be sure that Nuclear power plants (NPP) will be in a state to perform a required tasks under given conditions over a time interval. The detection time of the failure, the repair time of failed components and Mean Time to Repair (MTTR) are used in this study. The Probability of Failure on Demand (PFD) of the digital RPS caused by independent hardware failure is calculated and the effect on the system is analyzed. The results show that the proposed method is more effectiveness and appropriate to model the digital RPS and to analyze reliability than conventional Fault Tree Analysis (FTA) method.

Certain safety-critical systems, such as nuclear instrumentation and control (I&C) systems, must be ensured to be correct. One of the approaches of doing this is formal verification and, in particular, model checking, which thoroughly examines the state space of the formal model of the system. To make model checking computationally feasible, many simplifying assumptions, often referred to as abstractions, are made. One of such abstractions is the assumption of discrete time. However, when I&C systems are considered working in the real world, where communication delays and failures are possible, this assumption becomes less realistic, calling for the need for richer formalisms.In this paper, using timed automata, we extend our previous model checking approach for nuclear I&C systems to account for continuous time. We apply our approach to a reactor protection system case study and show that continuous-time verification is in general feasible, although proving the satisfaction of certain system properties still remains a computational challenge.

Small modular reactors (SMRs) are factory-built transportable nuclear power plants (NPPs) that can generate up to 300 MWe and support new applications for nuclear energy such as hydrogen production, industrial heat generation, and water desalination. SMRs are poised for near-term deployment in the United States and offer improvements over existing NPPs such as passive safety features, greater plant site flexibility, reduced construction costs, load-following operations, and extended refueling cycles. However, in order to realize the benefits of SMRs, there are several challenges related to instrumentation and control (I&C) system components that must be addressed. The I&C systems of an SMR ensure its safe and efficient operation. I&C sensors measure process parameters such as temperature, pressure, level, flow, and neutron flux and provide input to the Reactor Protection System (RPS) to initiate a rapid shutdown if necessary. The performance of these safety-related I&C sensors and systems must be periodically verified to ensure they meet the plant technical specifications for accuracy and response time. In addition, the associated I&C cabling (which includes low-voltage cable assemblies for sensors, Control Rod Drive Mechanisms (CRDMs), and Rod Position Indication (RPI) Systems) is tested as part of normal plant maintenance activities or in support of aging management programs. Over time, exposure to harsh environmental conditions in the plant can result in degradation and failure of I&C sensors and cables. This is especially true for the I&C sensors and cables in SMRs which will be subjected to elevated temperatures, high radiation, and a vacuum atmosphere within the containment vessel during normal plant operation. These conditions lead to excessive Ohmic heating within the cables which further accelerates damage to the cable insulation material and results in premature failure. Frequent cable replacement due to premature degradation is not practical or economical for SMR plant owners. To combat these environmental stressors, the ampacity of the cable must be derated. However, there is limited experience to date with cable derating in vacuum, and no experience with cable derating in vacuum at high temperature and radiation. As a result, Analysis and Measurement Services Corporation (AMS) is conducting a study on several common NPP I&C cables to determine how various insulation materials perform at conditions that emulate those anticipated in the containment of an SMR. The on-going effort is funded under a research and development (R&D) grant awarded to AMS by the U.S. Department of Energy (DOE). In addition, AMS is partnering with the Oak Ridge National Laboratory (ORNL) to conduct specialized testing in support of this study under a separate initiative called the Gateway for Accelerated Innovation in Nuclear (GAIN). The goal of this R&D is to develop technical guidance and technologies to support initial startup and subsequent operation of SMRs through specialized testing services and condition monitoring technologies. Preliminary results of this R&D are provided in this paper. AMS will continue to investigate challenges associated with I&C systems for SMR applications in support of the timely deployment of the first U.S.-based SMR by the mid-2020s.

Periodic safety reviews (PSRs) are conducted on operating nuclear power plants (NPPs) and have been mandated also for research reactors in Korea, in response to the Fukushima accident. One safety review tool, the probabilistic safety assessment (PSA), aims to identify weaknesses in the design and operation of the research reactor, and to evaluate and compare possible safety improvements. However, the PSA for research reactors is difficult due to scarce data availability. An important element in the analysis of research reactors is the reactor protection system (RPS), with its functionality and importance. In this view, we consider that of the AGN-201K, a zero-power reactor without forced decay heat removal systems, to demonstrate a risk-informed safety improvement study. By incorporating risk- and safety-significance importance measures, and sensitivity and uncertainty analyses, the proposed method identifies critical components in the RPS reliability model, systematically proposes potential safety improvements and ranks them to assist in the decision-making process. Keywords: Research reactor, Reactor protection system, Probabilistic safety assessment, Risk-informed design, Unavailability analysis, Sensitivity analysis

As Function Block Diagram (FBD) programs are used to implement safety-critical systems such as nuclear reactor protection systems, it is crucial to generate effective test cases. FBD programs are running on programmable logic controllers (PLCs) that execute the programs repeatedly within a particular scan time. Among the elements of FBD programs, function blocks and feedback variables save the inputs or outputs of the previous scan cycle into internal memories. The data stored in the internal memory are used to operate the function blocks of the next scan cycle. Researchers have recently developed an automated test generation technique aiming to satisfy several structural test coverage criteria for FBD programs. Among them, Jee et al.'s approach has an advantage of generating tests from FBD programs without requiring any intermediate models. However, test sequence generation for FBD programs with internal memory states was not fully automated in Jee et al.'s approach. This paper extends Jee et al.'s work by generating test sequences from FBD programs with internal memory states in a fully automated manner. The key technique involves explicitly unwinding FBD programs and solving the test requirements using an SMT solver. We conduct experiments on increasing the coverage of test requirements by unwinding cycles and evaluating the effectiveness of the test set using mutation analysis with several subject programs, including a real-world reactor protection system. The experimental results show that the proposed approach is able to generate effective test sequences for FBD programs. To demonstrate the efficiency of the proposed approach, we compared the test sequence generation time required for our approach with those for other approaches. The comparison results show that even excluding the generation time of test models of other approaches, the proposed approach increased the time-efficiency by more than 11 times.

Reactor Trip as a safety function must be done upon each initiating event through insertion of enough negative reactivity. Successful reactor trip guarantees the reduction of reactor power down to decay heat level and maintains it, in order to avoid excess power generation and consequent Core Damage (CD). In contrast, failure to trip the reactor culminates in Anticipated Transient Without Scram (ATWS), as one of the most sever CD endstates. Reactor Protection System (RPS) is responsible to generate valid trip signal(s), open the reactor trip breakers (RTBs), interrupt the electrical power to the control rod drive mechanisms (CRDMs) and results in control rods fall down to the core. If more than a certain number of control rods sticks and fails to fully insert into the core, reactor trip (RT) will be failed. In this study, MCNP and SAPHIRE are employed together, to probabilistically model ATWS sequences upon loss of offsite power (LOOP); the former to evaluate the success criteria of trip function and the latter to estimate the ATWS induced core damage frequency, regarding the evaluated success criteria. MCNP outcomes will reveal the least requisite number of control rods which is enough to insert adequate negative reactivity, and SAPHIRE is used to develop Probabilistic Safety Assessment (PSA) model and estimate the induced core damage frequency (CDF). Sensitivity cases are also defined regarding the variation of core parameters to study different situations.

The neutron measurement system (NMS) used in research reactors to measure thermal neutron flux emitted from the reactor core, provides the neutron power signal that controls the reactor power with control rods. The neutron power signals from NMS are key components of the reactor protection system (RPS) and the reactor regulating system (RRS). Therefore, the NMS having accuracy and reliability is a significant component in the reactor operation. In particular, the linearity in the transition range between the pulse count and Campbell signal, as well as, the log power and linear power signal is considered a top requirement for reactor power control. However, analogue-based NMS has had difficulties in fitting the curve of different signals, such as, the pulse count and Campbell signal. Moreover, the full power alignment cost much trial and error. Digital NMS in research reactors, herein, which are being applied to Jordan Research and Training Reactor (JRTR), can improve the linearity performance and save time by using implemented calibration method. Herein, the detailed calibration of digital NMS is introduced and the implementation method is described in detail with actual test results.

The failure of such systems leads to the catastrophic effects, including injury or death to humans, and harm to the environment. Petri nets (PNs) have been widely used for verification and validation of real-time systems. However, the existing approaches do not consider the critical aspects of reliability and safety that include nonliveness, deadlock, stability, and throughput. In this paper, we introduce these as metrics of reliability and safety for safety critical real-time systems. This paper also proposes an innovative methodology for analysis of nonliveness, deadlock, stability, and throughput metrics by linear programming using PN modeling. The application of the proposed techniques has been validated by applying it on four different safety critical systems, running in six nuclear power plants and shown for reactor protection system.

The Reactor Protection System (RPS) is designed and installed in the nuclear power plants (NPPs) to ensure both safety and economy. Nowadays the RPS adopts the digital techniques which consist of different digital modules. Therefore, this paper focuses on evaluating the reliability performance of the digital RPS using the Colored Petri Net (CPN) considering the module repair time whenever it fails and the Common Cause Failure (CCF). The module repair is considered as it takes some time to repair or replace the failed module and during the repair duration the digital RPS is operated in the degraded configuration and the common cause failure would severely impact the system in the event of occurrence. By studying the failure phenomenon and mechanism, the random probability shock model is adopted for CCF. Using the proposed model, the Monte Carlo simulation is carried out. Consequently, the indicators such as Mean Time To Repair (MTTR), Mean Time Between Failures (MTBF), Probability of Failure on Demand (PFD) and Probability of Spurious Trip (PST) are calculated. Following main conclusions are drawn i.e., i) the CCF is the main contribution to the PFD and PST. So the countermeasure for the CCF must be designed for the digital RPS; ii) the CCF has no effect on the MTTFF, MTBF, MTTR and subsystem unavailability; iii) the failure detection time has adverse effect on the system. Therefore, the digital system should shorten the detection time or decrease the coverage for the failures that take long time to be detected.