Experience from Quality Assurance in Nuclear Power Plant Protection System Software Validation

Development of a digital reactor control and protection system

The integrated Protection System (IPS) is intended to perform the protection functions of the Italian Nuclear Power Plants. The IPS is based on a distributed microprocessor system architecture, and is designed to be highly reliable. The reliability is assured, from others, through the use of redundancy and functional diversity. Failures that, in spite of redundancy, can impair the system are the Common Mode Failures (CMF) (1).

The NRC recognizes that a more complete technical basis for understanding and regulating advanced digital technologies in commercial nuclear power plants is needed. A concern is that the introduction of digital safety systems may have an impact on risk. There is currently no standard methodology for measuring digital system reliability. A tool currently used to evaluate NPP risk in analog systems is the probabilistic risk assessment (PRA). The use of this tool to evaluate the digital system risk was considered to be a potential methodology for determining the risk. To test this hypothesis, it was decided to perform a limited PRA on a single dominant accident sequence. However, a review of existing human reliability analysis (HRA) methods showed that they were inadequate to analyze systems utilizing digital technology. A four step process was used to adapt existing HRA methodologies to digital environments and to develop new techniques. The HRA methods were then used to analyze an NPP that had undergone a backfit to digital technology in order to determine, as a first step, whether the methods were effective. The very small-break loss of coolant accident sequence was analyzed to determine whether the upgrade to the Eagle-21 process protection system had an effect on risk. The analysis of the very small-break LOCA documented in the Sequoyah PRA was used as the basis of the analysis. The analysis of the results of the HRA showed that the mean human error probabilities for the Eagle-21 PPS were slightly less than those for the analog system it replaced. One important observation from the analysis is that the operators have increased confidence steming from the better level of control provided by the digital system. The analysis of the PRA results, which included the human error component and the Eagle-21 PPS, disclosed that the reactor protection system had a higher failure rate than the analog system, although the difference was not statistically significant.

Communication independence is one of the key criteria of digital safety I&C system design. This paper mainly analyzes the requirements for communication independence in safety regulations and standards, and then introduces the architecture and design features, including communication failure processing measures, of communication networks of ACPR1000 nuclear power plant safety digital protection system based on FirmSys platform developed by CTEC. The communication design meets the regulations requirements and effectively improves the safety and reliability of the system, and it is successfully applied in reactor protection system (RPS) of Yang Jiang nuclear power plant unit 5&6. In addition this design can provide reference for communication designs of other NPPs and industries.

Experience with the development of nuclear power plant protection systems is discussed. The state of the art in this field is examined, and the problems entailed in demonstrating the safety of these systems are considered. >

Reactor protection system (RPS) plays critical role in digital control system (DCS), and ensures the safety for nuclear power plant (NPP). System test is a necessary step during system development, verification and validation (V&V), which ensure the safety and reliability for RPS. The debugging of test environment and equipment is an important step that ensures the effective and efficiency of test. The system, such as RPS that contains complicated logic and large number of interfaces, cost a lot of time and human resource for debugging. A structured debugging method has been proposed in this paper, this method establishes debugging architecture with a hierarchical model in according to signal transmission path, and it designs the debugging process from down to top. The result from engineering practice show that this method has improved the effective and efficiency of debugging provides the support and reference for system test environment establishment.

The reactor protection system at Sizewell B consists of the Primary Protection System and the Secondary Protection System. Both these systems have been documented and discussed at length in many forums. The purpose of this paper is to briefly summarise each systems' design, before making an examination of each systems' performance and assessing its success from the perspective of the maintenance engineer.

The advanced digital reactor protection system (ADRPS) with diverse dual processors has been developed to prevent common-mode failure (CMF). The principle of diversity is applied to both hardware design and software design. For hardware diversity, two different types of CPUs are used for the bistable processor and local coincidence logic (LCL) processor. The Versa Module Eurocard-based single board computers are used for the CPU hardware platforms. The QNX operating system and the VxWorks operating system were selected for software diversity. Functional diversity is also applied to the input and output modules, and to the algorithm in the bistable processors and LCL processors. The characteristics of the newly developed digital protection system are described together with the preventive capability against CMF. Also, system reliability analysis is discussed. The evaluation results show that the ADRPS has a good preventive capability against the CMF and is a highly reliable reactor protection system.

A reactor protection system (RPS) in a boiling water reactor (BWR) is a unique system since it represents high redundancy compared with other safety-related systems in the BWR. Owning to its high redundancy, NUREG-5500 vol.3 showed that unreliability of the General Electric BWR4-type RPS is dominated by common-cause failures (CCFs) in its highly redundant components. Since the staggered test scheme can reduce the period of latent CCF states of redundant standby components, the scheme is a good candidate to improve the reliability of the RPS. However, the scheme is impracticable for the RPS because of its high redundancy. In this paper, a new concept of a “multi-group staggered test scheme” for a highly redundant system is proposed. In the multi-group staggered test scheme, components are arranged into several groups, and all components in a group are tested simultaneously. This paper presents a preliminary example of the new scheme that is applied to control rod notch tests, in which all withdrawn control rods are moved at least one notch. It is shown that the new scheme can reduce the CCF risk in RPS.

The Sizewell B control and protection systems represent the most advanced implementations of such systems in an operating nuclear power station. The unique requirements of a nuclear power station have resulted in an approach to the control and protection systems which is both novel but applicable to any application where high integrity is a basic system requirement. The following discusses the implementation of the control and data processing system and reactor protection systems at Sizewell B.

A safety class field programmable gate array based system in nuclear power plant has been developed to improve the diversity. Testbench is necessary to satisfy the technical reference, IEC-62566, for verification and validation of register transfer level code. We use the open verification methodology(OVM) developed by standard body. We show that our testbench can use random input for test. And also we show that reusability of block level testbench for the integration level testbench, which is very efficient for large scale system like nuclear reactor protection system.

An accident scenario-based statistical test method for RPS in nuclear power plant

Direct or indirect lightning strikes have caused reactor trips in nuclear power generating stations. If nuclear power generating stations do not have adequate lightning protection and grounding, such stations may be exposed to greater risk of loss of offsite power, fire, and damage to redundant trains of engineered safeguard equipment. The loss of offsite power is an important initiating event for design basis accidents. I studied the effects of lightning strikes on reactor trips or misoperation of the equipment from January 1984 through September 2000. From this study, I found that most of the lightning strikes operated the overvoltage protection devices for the control rod drive system. In others, the lightning strikes had partially damaged the main/startup transformers, tripped the switchyard breakers or tripped the transmission lines and, by that, affected the availability of the required stable offsite power sources to the nuclear power generating stations. Direct lightning strikes, electrostatic discharges, lightning electromagnetic impulse can disrupt the electrical and electronic equipment used in the reactor protection system and the other safety systems. The use of the integrated protection and microprocessor-based systems in simplified passive advanced light water reactors and the digital systems replacing the existing analog systems may be more vulnerable to a lightning strike. The protection from lightning could include the installation of lightning dissipation arrays, installation of ferrite shields, installation of a secondary shield or the addition of a short time delay on the power supply monitoring card to allow the transients to dissipate. The instruments and computer grounding system may be grounded through a separate radial grounding system that may be connected to the station grounding grid at only one point to avoid circulating currents. Advanced surge protection devices that include gas discharge tubes, Zener diodes for accurate and fast( picoseconds) voltage control, and metal oxide varistors can be used to protect the electrical and electronic safeguard equipment from high voltage transients associated with lightning.

Uncertainties in the Power Alignment at the Jordan Research and Training Reactor

The realization method is presented for a logic configuration of the reactor protection system (RPS) for BWRs which enhances their reliability.Higher reliability requires a majority voting logic even when a single logic component has been bypassed. Furthermore the load driver of the RPS on the output side must actuate two separate operation objects. To fulfill the above conditions, a general realization of the 2-out-of-4 logic with a minimum hardware component is proposed. Then, the structure of the microprocessor-configured RPS employing this logic is presented.The reliability of the above RPS is evaluated by computations. The results show that the average frequency of improper operation is less than that with the conventional 1-out-of-2-twice logic under the conditions that the repair rate is 0.1 and the failure detection rate is above 92%. The average probability of failure to operate is reduced by two orders of magnitude under the above conditions.