The first digital reactor protection system in China

The reactor protection system (RPS) used in the 10 MW high-temperature gas-cooled reactor is the first digital RPS designed and operated in China. In order to ensure its safety and reliability and to reduce the development risk and cost, some measures had to be taken. The measures adopted in the development process include the architecture of defense-in-depth, commercial grade hardware, prototype development model, separation of safety class software and non-safety class software, deterministic behavior of safety software, etc. The measures adopted in the verification and validation (V&V) process include effective dedication on the commercial grade hardware, emphasis on the assessment of the requirements and specifications, emphasis on the demonstration and testing, thorough testing for the safety function, long period demonstration operation, application of automatic test system to improve the efficiency of V&V processes, etc. As a result, this first digital RPS has passed the safety assessment of the National Nuclear Safety Authority. Its performance and safety are proven to be confident and assuring through the demonstration and testing. Thus, the design and V&V process of the first digital protection system in China was successful.     

Verification and validation benchmarks

Verification and validation (V&V) are the primary means to assess the accuracy and reliability of computational simulations. V&V methods and procedures have fundamentally improved the credibility of simulations in several high-consequence fields, such as nuclear reactor safety, underground nuclear waste storage, and nuclear weapon safety. Although the terminology is not uniform across engineering disciplines, code verification deals with assessing the reliability of the software coding, and solution verification deals with assessing the numerical accuracy of the solution to a computational model. Validation addresses the physics modeling accuracy of a computational simulation by comparing the computational results with experimental data. Code verification benchmarks and validation benchmarks have been constructed for a number of years in every field of computational simulation. However, no comprehensive guidelines have been proposed for the construction and use of V&V benchmarks. For example, the field of nuclear reactor safety has not focused on code verification benchmarks, but it has placed great emphasis on developing validation benchmarks. Many of these validation benchmarks are closely related to the operations of actual reactors at near-safety-critical conditions, as opposed to being more fundamental-physics benchmarks. This paper presents recommendations for the effective design and use of code verification benchmarks based on manufactured solutions, classical analytical solutions, and highly accurate numerical solutions. In addition, this paper presents recommendations for the design and use of validation benchmarks, highlighting the careful design of building-block experiments, the estimation of experimental measurement uncertainty for both inputs and outputs to the code, validation metrics, and the role of model calibration in validation. It is argued that the understanding of predictive capability of a computational model is built on the level of achievement in V&V activities, how closely related the V&V benchmarks are to the actual application of interest, and the quantification of uncertainties related to the application of interest.     

Verification and validation of the HTGR systems CFD code Flownex

Regulatory requirements prescribe extensive verification and validation (V&V) of computer codes that are used in the design and analysis of accident conditions in nuclear plants. Flownex is a dynamic systems CFD code used as the primary thermal-fluid simulation code by the Pebble Bed Modular Reactor Company (PBMR).Stringent quality assurance processes have been implemented to ensure that the code conforms to the set standards. These processes include the comparison of Flownex with analytical results as well as with experimental data.The results of this process are summarized in this paper. Analytical solutions are used to verify Flownex's element models so as to ensure that the basic theory is correctly implemented in the computer code. As part of the analytical V&V effort various well-defined problems are solved using numerical methods implemented in independent computer codes.Comparison with experimental and plant data is a very important feature of the V&V program to validate that the chosen theory is fit for purpose. For this, validation data from the pebble bed micro model (PBMM) is used. In addition to the PBMM experimental data Flownex is compared to a number of small thermal-fluid experiments in which certain specific component phenomena is validated. These experiments were developed in collaboration with North-West University (previously Potchefstroom University).     

HTR-10数字化保护系统的验证与确认

10MW高温气冷实验堆(HTR-10)验证与确认(VerificationandValidation,简称V&V)过程的特点是:和开发过程紧密配合,特别重视设计说明书的V&V、安全软件的V&V、系统功能的完整测试等环节。从而使数字化保护系统成功地通过安全审查并被批准应用于HTR-10上。     

百万千瓦级核电厂~(16)N监测仪系统验证和确认

为保证百万千瓦级核电厂~(16)N监测仪系统中软件的可靠性和安全性,引入了验证和确认(VV)技术。本文阐述了~(16)N监测仪的开发过程中是如何建立VV组织和体系,高质量地执行VV活动,研究了执行VV活动新的方法和工具,评估了VV活动的质量,可为其他1E级设备的VV活动提供指导和参考。     

Main control system verification and validation of NPP digital I&C system based on engineering simulator

Full-scope digital instrumentation and controls system (I&C) technique is being introduced in Chinese new constructed Nuclear Power Plant (NPP), which mainly includes three parts: control system, reactor protection system and engineered safety feature actuation system. For example, SIEMENS TELEPERM XP and XS distributed control system (DCS) have been used in Ling Ao Phase II NPP, which is located in Guangdong province, China. This is the first NPP project in China that Chinese engineers are fully responsible for all the configuration of actual analog and logic diagram, although experience in NPP full-scope digital I&C is very limited. For the safety, it has to be made sure that configuration is right and control functions can be accomplished before the phase of real plant testing on reactor. Therefore, primary verification and validation (V&V) of I&C needs to be carried out. Except the common and basic way, i.e. checking the diagram configuration one by one according to original design, NPP engineering simulator is applied as another effective approach of V&V. For this purpose, a virtual NPP thermal-hydraulic model is established as a basis according to Ling Ao Phase II NPP design, and the NPP simulation tools can provide plant operation parameters to DCS, accept control signal from I&C and give response. During the test, one set of data acquisition equipments are used to build a connection between the engineering simulator (software) and SIEMENS DCS I/O cabinet (hardware). In this emulation, original diagram configuration in DCS and field hardware structures are kept unchanged. In this way, firstly judging whether there are some problems by observing the input and output of DCS without knowing the internal configuration. Then secondly, problems can be found and corrected by understanding and checking the exact and complex configuration in detail. At last, the correctness and functionality of the control system are verified. This method is also very convenient for expansion to other type digital I&C V&V. This paper is mainly focused on V&V of closed-loop control systems in full-scope DCS and several detailed reactor control (RRC) systems, including pressurizer pressure and water level control, steam generator water level control. The V&V works were carried out by applying engineering simulator. This paper describes the structure and function of the simulator, V&V procedure, results analysis and problems identified. Through the actual on-line virtual closed-loop testing on Ling Ao Phase II NPP project, many problems of DCS configuration were found and solved. And it proved that V&V based on engineering simulator enables significant time saving, improves economics and safety in the phase of engineering debugging.     

The Application of Fluid Structure Interaction Techniques Within Finite Element Analyses Of Water-filled Transport Flasks

Abstract

Historically, finite-element (FE) analyses of water-filled transport flasks and their payloads have been carried out assuming a dry environment, mainly due to lack of robust fluid structure interaction (FSI) modelling techniques. Recent years have seen significant improvements in FSI techniques. These FSI techniques have been used to investigate the effects of assuming a wet environment for the regulatory drop test within a recent Rolls-Royce Naval Marine licence renewal application. This paper will present the FSI capabilities available within various FE codes. The required structural aspects of the FE codes will also be discussed, in particular material models, as these also influence the final code selection. Two explicit dynamic FE codes were finally identified, LS-DYNA, which was used in the extant dry analyses, and RADIOSS, which was used to provide additional confidence in the FSI calculations. Fluid flow and pressure vary significantly during an impact and the effects on the contents become complex when water is incorporated into the flask analyses. Therefore, a verification and validation (V&V) exercise was undertaken to underpin the FSI techniques eventually used. Modelling a fluid environment within the entire flask to capture the explicit effects of fluid on a complex structure is impractical. A good understanding of the FSI techniques and assumptions regarding the fluid boundaries is therefore required for a representative FSI model. A number of V&V problems are presented which test key features required for analysing the payload in a water environment. In conclusion the paper will discuss FSI technology, lessons learnt, limitations of FSI techniques and further possible applications.     

Simulation-based design process for the verification of ITER remote handling systems

The work behind this paper takes place in the EFDA's European Goal Oriented Training programme on Remote Handling (RH) “GOT-RH”. The programme aims to train engineers for activities supporting the ITER project and the long-term fusion programme. One of the projects of this programme focuses on the verification and validation (V&V) of ITER RH system requirements using digital mock-ups (DMU). The purpose of this project is to study and develop efficient approach of using DMUs in the V&V process of ITER RH system design utilizing a System Engineering (SE) framework. Complex engineering systems such as ITER facilities lead to substantial rise of cost while manufacturing the full-scale prototype. In the V&V process for ITER RH equipment, physical tests are a requirement to ensure the compliance of the system according to the required operation. Therefore it is essential to virtually verify the developed system before starting the prototype manufacturing phase. This paper gives an overview of the current trends in using digital mock-up within product design processes. It suggests a simulation-based process design centralized around a simulation lifecycle management system. The purpose of this paper is to describe possible improvements in the formalization of the ITER RH design process and V&V processes, in order to increase their cost efficiency and reliability.     

COSINE软件包物理系统V&V策略研究

软件验证（verification）和确认（validation）（简称V&V）是保证软件质量的重要手段,合理高效的V&V策略可事半功倍,COSINE软件包全称为堆芯物理-热工设计及系统安全分析软件包,其中的物理程序包括组件参数计算程序LATC、堆芯物理分析程序CORE、中子动力学程序KIND。本文以LATC、CORE、KIND为对象,以科学计算软件V&V研究为基础,提出了基于模块的验证方法和基于功能的确认方法,共同组成COSINE软件包物理系统V&V策略。     

The real-time functional test facility for advanced instrumentationand control in nuclear power plants

Testing and validation of the functions and performance of the digital instrumentation and control (I&C) system should be done prior to installation in nuclear power plants. The objective of the I&C Functional Test Facility (FTF) is to test and validate the functions of developed digital control and various monitoring systems. The FTF provides the simulated testing environment as an experimental test bed. The FTF software consists of a mathematical modeling program which simulates a three-loop 993 MWe pressurized water reactor and a supervisory program that comprises all the instructions necessary to run the FTF. The hardware equipment provides an interface between a host computer and a simple test panel or the developed target systems to be tested. The graphical user interface supports an easy and friendly interface between the FTF and users. It is implemented through a Picasso-3 graphic tool developed by the Halden Reactor Project. The FTF is applied to an advanced I&C system prototype, such as an automatic start-up intelligent control system, dynamic alarm system, accident identification system, and intelligent logic tracking system, to test its algorithm or performance. The results of the test show good operational performance of the FTF in normal and transient conditions     

Development of a consensus standard for verification and validation of nuclear system thermal-fluids software

With the resurgence of nuclear power and increased interest in advanced nuclear reactors as an option to supply abundant energy without the associated greenhouse gas emissions of the more conventional fossil fuel energy sources, there is a need to establish internationally recognized standards for the verification and validation (V&V) of software used to calculate the thermal–hydraulic behavior of advanced reactor designs for both normal operation and hypothetical accident conditions. To address this need, ASME (American Society of Mechanical Engineers) Standards and Certification has established the V&V 30 Committee, under the jurisdiction of the V&V Standards Committee, to develop a consensus standard for verification and validation of software used for design and analysis of advanced reactor systems. The initial focus of this committee will be on the V&V of system analysis and computational fluid dynamics (CFD) software for nuclear applications. To limit the scope of the effort, the committee will further limit its focus to software to be used in the licensing of High-Temperature Gas-Cooled Reactors. Although software verification will be an important and necessary part of the standard, much of the initial effort of the committee will be focused on the validation of existing software and new models that could be used in the licensing process. In this framework, the Standard should conform to Nuclear Regulatory Commission (NRC) and other regulatory practices, procedures and methods for licensing of nuclear power plants as embodied in the United States (U.S.) Code of Federal Regulations and other pertinent documents such as Regulatory Guide 1.203, “Transient and Accident Analysis Methods” and NUREG-0800, “NRC Standard Review Plan”. In addition, the Standard should be consistent with applicable sections of ASME NQA-1-2008 “Quality Assurance Requirements for Nuclear Facility Applications (QA)”. This paper describes the general requirements for the proposed V&V 30 Standard, which includes: (a) applicable NRC and other regulatory requirements for defining the operational and accident domain of a nuclear system that must be considered if the system is to be licensed, (b) the corresponding calculation domain of the software that should encompass the nuclear operational and accident domain to be used to study the system behavior for licensing purposes, (c) the definition of the scaled experimental data set required to provide the basis for validating the software, (d) the ensemble of experimental data sets required to populate the validation matrix for the software in question, and (e) the practices and procedures to be used when applying a validation standard. Although this initial effort will focus on software for licensing of High-Temperature Gas-Cooled Reactors, it is anticipated that the practices and procedures developed for this Standard can eventually be extended to other nuclear and non-nuclear applications.     

Verification and validation procedures of calculation codes for determining corrosive conditions in the BWR primary cooling system based on water radiolysis and mixed potential models

Corrosive conditions in the BWR primary cooling system are usually expressed by the corrosion index, ECP. In order to determine ECP at any location in the primary cooling system, ECP should be evaluated by computer simulation codes consisting of water radiolysis models to determine the concentrations of corrosive radiolytic species and mixed potential models to determine ECP based on corrosive species. Measures for mitigation of SCC crack growth rate by decreasing ECP are authorized by the JSME Standards; however, measures for mitigation of ECP by hydrogen addition have not been authorized yet. In the paper, standard procedures to authorize the computer simulation codes based on the verification and validation (V&V) method are proposed. The numerical justification of every code applied as a standard code should be verified and its accuracy and applicability for plant analysis should be validated. Benchmark analysis for verification procedures is proposed while a comparison of the calculated results with the measured ones for the evaluated plant is also proposed for the validation procedures. It is strongly recommended that the results of V&V evaluation of the codes that might be applied for evaluation of corrosive conditions in operating power plants are published in a peer-reviewed journal before their application.     

Processing dynamic scenarios from a reliability analysis of a nuclear power plant digital instrumentation and control system

This paper illustrates a method for processing accident scenarios generated in a dynamic reliability analysis of a Nuclear Power Plant (NPP) equipped with digital Instrumentation and Control (I&C).The method is based on a Fuzzy C-Means clustering algorithm for classification, which takes into account not only the system states reached at the end of the scenarios but also the timing and magnitude of the occurred failure events, and the characteristics of the process evolution.An illustrative case study is considered, regarding the fault scenarios of the digital I&C of the Lead–Bismuth Eutectic eXperimental Accelerator Driven System (LBE-XADS). A SIMULINK model of the system has been embedded within a Monte Carlo (MC) sampling procedure for injecting faults at random times and of random magnitudes. The accident scenarios thereby generated are classified on the basis of three different system end states, which relate to the value reached by the diathermic oil secondary coolant temperature with respect to maximum and minimum safety threshold values set to avoid primary coolant thermal shocks and degradation of the oil physical and chemical properties.     

Model extension and improvement for simulator-based software safety analysis

One of the major concerns when employing digital I&C system in nuclear power plant is digital system may introduce new failure mode, which differs with previous analog I&C system. Various techniques are under developing to analyze the hazard originated from software faults in digital systems. Preliminary hazard analysis, failure modes and effects analysis, and fault tree analysis are the most extensive used techniques. However, these techniques are static analysis methods, cannot perform dynamic analysis and the interactions among systems. This research utilizes “simulator/plant model testing” technique classified in (IEEE Std 7-4.3.2-2003, 2003. IEEE Standard for Digital Computers in Safety Systems of Nuclear Power Generating Stations) to identify hazards which might be induced by nuclear I&C software defects. The recirculation flow system, control rod system, feedwater system, steam line model, dynamic power-core flow map, and related control systems of PCTran–ABWR model were successfully extended and improved. The benchmark against ABWR SAR proves this modified model is capable to accomplish dynamic system level software safety analysis and better than the static methods. This improved plant simulation can then futher be applied to hazard analysis for operator/digital I&C interface interaction failure study, and the hardware-in-the-loop fault injection study.     

Thermohydraulic and safety analysis on China advanced research reactor under station blackout accident

A thermohydraulic and safety analysis code-TSACC has been developed using Fortran90 language to evaluate the transient thermohydraulic behavior of the China advanced research reactor (CARR) under station blackout accident (SBA). For the development of TSACC, a series of corresponding mathematical and physical models were applied. Point reactor neutron kinetics model was adopted for solving the reactor power. All possible flow and heat transfer conditions under station blackout accident were considered and the optional correlations were supplied. The usual finite difference method was abandoned and the integral technique was adopted to evaluate the temperature field of the plate type fuel elements. A new simple and convenient equation was proposed for the resolution of the transient behaviors of the main pump instead of the complicated four-quadrant model. Gear method and Adams method were adopted alternately for a better solution to the stiff differential equations describing the dynamic behavior of the CARR. The computational result of TSACC showed the adequacy of the safety margin of CARR under SBA. For the purpose of Verification and Validation (V&V), the simulated results of TSACC were compared with those of RELAP5/MOD3 and a good agreement was obtained. The adoption of modular programming techniques enables TASCC to be applied to other reactors by easily modifying the corresponding function modules.     

Conservative availability analyses including dependent failures in redundant I&C-systems with recurrent tests

In this paper analytic formulae are derived to estimate conservatively the unavailability of a two out of four digital safety Instrumentation and Control (I&C) system with recurrent tests. The analytic formulae disclose the influence of the different parameters on the system’s unavailability. In particular, the choice of a proper test interval is essential to guarantee the required low unavailability. The extraordinary self-checking capabilities of digital systems are taken into account by use of an appropriate failure model together with the treatment of dependent failures of the integrated software–hardware system. The underlying methodology is approved by licensing experts of nuclear facilities in Germany.     

A Petri net design of FPGA-based controller for a class of nuclear I&C systems

This study is concerned with a FPGA-based controller design for the lack of FPGA-based solutions in the nuclear industry. An efficient design procedure is proposed to achieve simpler and affordable verification and validation (V&V) of system efforts by explicitly modeling the interactions among processes. In the present approach, both of state diagram (SD) concept and Petri nets (PNs) are used to model the concurrent processes. An illustrative example of automatic seismic trip system (ASTS) is provided. Synthesis results demonstrate that the proposed design is feasible and easy to implement.     

The HTR module pressure vessel unit, design criteria and safety philosophy

A modular-helium-cooled high temperature reactor system for the cogeneration of electricity and process heat has been developed by Siemens—Interatom.Design, manufacture and operation of the pressure vessel unit will conform to German nuclear codes and standards for LWR's, some deviations or peculiarities for their application to HTR's are unavoidable. These are for instance:

• - The main steam nozzle, through which the steam line at 530°C penetrates the steam generator pressure vessel with a nominal design temperature of 350°C.

• - The pressure test concept in which the preservice pressure test will be performed in complete accordance with the codes and standards at 1.3 times the design pressure of 70 bar using water. Afterwards, the presence of graphite structures, ceramic insulation and, of course, the pebble bed core has to be considered. Pneumatic pressure tests are performed at 1.1 times design pressure accompanied by more detailed ultrasonic examinations.

• - The position of operational material irradiation surveillance specimens has to be chosen carefully. Design postulates concerning the incrase of ΔRT_NDT will pe confirmed in a separate program.

In general, the requirements of the assured safety concept, aimed to rule out catastrophic failure of the pressure vessel unit during lifetime are fulfilled.     

ENEA activities on seismic isolation of nuclear and non-nuclear structures

Work on seismic isolation of nuclear and non-nuclear structures was started by ENEA in cooperation with ISMES in 1988. The first activity consisted of a proposal for guidelines for seismically isolated nuclear plants using high-damping, steel-laminated elastomer bearings. This is being performed in the framework of an agreement with General Electric Company. Furthermore, research and development (R&D) work has been defined and recently initiated to support development of the seismic isolation guidelines as well as that of qualification procedures for seismic isolation systems in general. The present R&D work includes static and dynamic experiments on single bearings, shake table tests with multi-axial simultaneous excitations on reduced-scale mockups of isolated structures supported by multiple bearings, and dynamic tests on large-scale isolated structures with on-site test techniques. It also includes the development and validation of finite-element nonlinear models of the single bearings, as well as those of simplified design tools for the analysis of the isolated structures' dynamic behavior. Extension of this work is foreseen in a wider national frame.     

The use of energy absorbers to protect structures against impact loading

When a flying missible impacts a fixed structure, the interface loading is dependent on the deformation characteristics of both impacting and impacted bodies. If both are too rigid to accommodate the amount of gross deformation required to neutralize the incoming kinetic energy, or if such energy absorption has a chance to proceed in uncontrolled and unreliable ways, then there is a need to interpose a specifically designed “energy absorber” between missile and structure, from which a well-defined load time history can be derived during the course of impact.

The required characteristics of such an energy absorption material are:

• the capability to accommodate large permanent deformation without structural failure; and

• the reliable and controlled “load-deformation” (or “stress-strain”) behaviour under dynamic conditions, with an aim at an optimal square shape curve.

Consideration must also be given to environmental or other disturbing effects, like temperature, humidity, and “out of plane” loading. A short survey is presented of the wide range of energy absorbers already described in technical papers or used in a number of practical safety applications within varied engineering fields (from vehicle crash barriers to high energy pipe whipping restraints). However, with such open a literature, information is usually lacking in the specific data required for design analysis.

The following “energy absorption” materials and processes have thus been further experimentally investigated, with an a aim at pipe whipping restraint application for nuclear power plants:

1. (1) plastic extension of austenitic stainless steel rods;

2. (2) plastic compression of copper bumpers; and

3. (3) punching of lightweight concrete structures.

Dynamic “stress-strain” characteristics have been established for stainless steel bars at several temperatures under representative loading conditions. For this purpose, a test rig has been specifically designed to incorporate a number of adjustable parameters and to behave as a representative “slice” of an actual pipe whipping restraint; typical strain rates are in the 10 sec⁻¹ range. The behaviour of copper bumpers has been compared under static and dynamic conditions (using a conventional drop weight test (DWT) machine); as no significant strain rate effects were emphasized, only static tests have been further developed. The DWT rig was used again to investigate crushing or punching of cellular concrete under varying geometries and loading conditions. To remedy certain deficiencies of the regular commercial grades of cellular concrete, special lightweight mixtures have been studied to optimize material toughness and provide a wider range of specific resistance.Results of this experimental program are presented and discussed. The use of energy absorbers is then illustrated for a few typical pipe whipping restraints. The design of restraints is based on real dynamic characteristics of “energy absorption” material as produced by the test program. To derive design loads of restraints, a number of methods can be used ranging from a simplified “energy balance” graph to sophisticated plastodynamic computer analysis. Typical results are presented and discussed to compare the efficiency of these alternative methods.