A PWR hybrid computer model for assessing the safety implications of control systems

As part of the ORNL study of safety-related aspects of control systems, a hybrid computer model was developed to trace the dynamic impact of single and multiple component failures on the control system and remainder of the plant. Since the thrust of this program is to investigate control system behavior, the controls are modeled in detail to accurately reproduce characteristic response under normal and off-normal transients. The balance of the model, including neutronics, thermohydraulics and component submodels, is developed in sufficient detail to provide a suitable support for the control system.The model is being used primarily to address mild to moderate transients that can occur at least partially under action of the non-safety control system. Attention initially focused on overfill events that assumed single or multiple failures of feed valves or the generator low and high level setpoints and trips that regulate the valves. In general, these calculations showed that for single-generator overfeed, water inventory in the affected generator increased to a sufficiently high level to saturate the generator fluid, quench superheat, and inject water into the steam line. Overcooling of the primary side was modest.Other events studied with the model include: insufficient main feedwater cooling induced by a steam generator high level setpoint failing low, potentially drying out the generator; secondary side depressurization induced by turbine bypass valves failing open in loop A or in combination with loop B, at low and high power levels; and steam generator tube ruptures in combination with overcooling incidents.     

Safety implications of stochastic analysis of nuclear reactor transients

A ‘neutron-temperature random process’ is formulated by means of a probability generating function technique. The model accounts for the effect of the negative temperature feedback by treating the temperature as a continuous random variable, thereby making possible the computation of the expected values of the temperature, neutron and cumulative fission densities as well as their standard deviations. The special relationship of the stochastic behavior of the nuclear reactor to safety considerations is discussed. Typical numerical results are presented related to startup accidents and Anticipated Transient Without Scram (ATWS) in thermal reactors.     

Safety approach in the EU test blanket systems design

This paper reveals the safety strategy and approach developed and followed in the design of the two EU TBS describing its objectives, components and implementation. Addressing the safety in the early stage of the conceptual design of nuclear facilities is a well recognized international practice and industrial project-level requirement for the successful completion of the licensing process within expected project cost and schedule. The impact of the early development of the safety approach, its implementation and monitoring in the design of nuclear device like the TBS is not limited to the safety assessment and licensing activities only. Safety approach plays indispensible role in reducing the overall project risk. It infiltrates the entire design process through the unavoidable interfaces between the design features and its safety level. In reality the entire process of the TBS development, design, technological demonstration and implementation is affected by the project team safety culture.     

Integrated operation of diagnostic and control systems

In fusion research the ability to generate and sustain high performance fusion plasmas gains more and more importance. Optimal combinations of magnetic shape, temperature and density profiles as well as the confinement time are identified as advanced regimes. Safe operation in such regimes will be crucial for the success of ITER and later fusion reactors. The operational space, on the other hand, is characterized by nonlinear dependencies between plasma parameters. Various MHD limits must be avoided in order to minimize the risk of a disruption.Sophisticated feedback control schemes help to tackle this challenge. But these in turn require detailed information on plasma state in time to allow proper reaction. Control system and diagnostic systems therefore must establish a symbiotic relationship to carry out such schemes. Today, all major fusion devices implement such a concept.An implementation of such a concept with sustained integration is presented using the example of ASDEX Upgrade. It covers data communication via a real-time network, synchronization mechanisms for data-driven algorithm execution as well as operational aspects and exception handling for failure detection and recovery. A modular distributed software framework offers standardized user algorithm interfaces, automated workflow procedures and the application of various computer and network hardware components. Designed with a special focus on reliability, robustness and flexibility, it is a sound base for exploring ITER-relevant plasma regimes and control strategies.     

The contribution of control systems in LWR safety

The objective of this paper is to estimate the effects of non-safety-grade control systems in light water reactors (LWRs) on the overall likelihood of accidents leading to severe core damage or core melt, as determined from operating experience. One hundred ninety operational events which involve failures of non-safety-grade control systems that have occurred at commercial PWR plants during 1969–1981 and which are considered to be precursors to potential severe core damage have been identified; eighty such events have been identified for BWR plants. These events are treated as initiating or concurrent events to be fit into appropriate event trees, which are then quantified using component failure rates and system unavailabilities taken from available PRA studies to estimate the frequency of severe core damage arising from non-safety-grade control system failures. An example is worked out in detail. Considerable uncertainty is introduced into the results by the choice of system and operator failure rates and the results reported herein are considered preliminary. No allowance is made in these estimates for plant changes made because of operational experience.     

Safety analysis of multiple-failure of passive safety systems in SBWR-1200 SBLOCA

The design of the simplified boiling water reactor (SBWR-1200) is characterized by utilizing fully passive safety systems. The emergency core cooling is realized by the gravity driven core cooling system, and the decay heat removal is done by the passive containment cooling system and isolation condenser system. All of the systems have multiple units and could be partially failed. The objective of this paper is to analyze the system response under the multiple malfunctions of passive safety systems in the SBWR-1200.

The chosen accident scenario is a small break loss of coolant accident with one of three gravity driven core cooling system drain lines blocked and one of three passive containment cooling system condensers disabled. An integral test has been carried out in the PUMA facility for 16 h. The facility is designed for low pressure, long term cooling operation with the multiple safety related components; therefore, it has the flexibility to demonstrate the asymmetric or multiple-failure effects with the combination of disability of safety systems. The test initial conditions at 1 MPa (150 psi) are obtained from RELAP5/MOD3.2 code simulation for the SBWR-1200 with appropriate scaling considerations.

Comparisons have been first made between the multiple-failure test and a single-failure test preformed previously. It shows that the core has been covered with liquid coolant during all of accident transient even though there is an apparent coolant inventory reduction in the multiple-failure test. The decay heat removal has no significant difference because the remaining two passive containment cooling condensers increase their cooling capacities, and even the drywell pressure is slightly lower due to the cold water injection from the suppression pool. Comparisons have also been made between the scaled-up test data and the code simulation at the prototypic level. The prototypic simulation is done by RELAP5/MOD3.2. Agreements between the code simulation and the scaled-up test data confirm the code applicability and the facility scalability for this accident scenario.     

Improving VVÉR-440 reactor control systems

Translated from Atomnaya Énergiya, Vol. 67, No. 4, pp. 281–288, October, 1989.     

Safety assessment for computerized nuclear reactor protection systems: The Markov approach

In reactor protection systems based on minicomputers a central role is played by the diagnostic capability of selfchecking programs. It is thus of great importance to determine the efficiency that such programs must have with respect to fault detection in order to meet a certain reliability goal. Even though the content of this report is part of the safety study on a particular plant (Tapiro Research Reactor in service at C.S.N. Casaccia) it allows one to reach more general conclusions about the reliability of computerized protection systems. Another major aim of this paper is to point out the methodological difficulties met in the safety qualification of these systems.     

High level integration of remote handling control systems at JET

To reduce the timescale of the JET Enhanced Performance 2 (EP2) shutdown, two multi-jointed Booms instead of one will be used for maintenance and upgrades inside the JET vessel. To fully utilize this new configuration, the control systems of the Booms have been modified at a high level to allow quick and safe interactions between them. This paper will discuss how the control systems of the Booms have been integrated to exploit the increased mechanical functionality of the Octant 1 Boom, and will demonstrate how this has improved safety, utility and efficiency for the remote handling operators during the EP2 shutdown. Other operational streamlining functions will be mentioned, as well as a look to the future of Remote Handling at JET.     

Subcritical space nuclear system without most movable control systems

This paper describes the design and analysis of advanced space nuclear reactor (ASNR) whose design combines the advantages of radioisotope thermoelectric generator (RTG) and space nuclear reactor (SNR). As opposed to current SNRs designs, ASNR is a subcritical system driven by ²³²U–Be neutron source to generate thermal power continuously. Most movable control systems in the SNR design are removed. The detailed neutronic calculations by MCNPX (Monte Carlo N-Particle eXtended), including k_eff, flux, burn-up, loss-ratio of neutron source and immersion reactivity, show that ASNR has higher criticality safety and more compact structure to bear the risk of immersion accident compared with the past SNRs, and the new system can provide more thermal power than RTG. Furthermore, the neutron source efficiency is optimized to improve the utilization of ²³²U–Be neutron source with the improvement of criticality safety. Compared with the past designs of space nuclear power, ASNR could provide enough thermal power and avoid the occurrence of serious immersion accident in the case of total control system failure. ASNR has potential for future deep space missions.