Reactor Protection Systems for the Replacement Research Reactor, ANSTO

IGORR 9: International Group on Research Reactors, 24-28 March 2003, Sydney, Australia Reactor Protection Systems for the Replacement Research Reactor, ANSTO Abstract The 20-MW Replacement Research Reactor Project which is currently under construction at ANSTO will have a combination of a state of the art triplicated computer based reactor protection system, and a fully independent, and diverse, triplicated analogue reactor protection system, that has been in use in the nuclear industry, for many decades. The First Reactor Protection System () consists of a Triconex triplicated modular redundant system that has recently been approved by the USNRC for use in the USA s power reactor program. The Second Reactor Protection System is a hardwired analogue system supplied by Foxboro, the Spec 200 system, which is also Class1E qualified. The is used to drop the control rods when its safety parameter setpoints have been reached. The SRPS is used to drain the reflector tank and since this operation would result in a reactor poison out due to the time it would take to refill the tank the trip setpoints are more limiting. The and SRPS have limited hardwired indications on the control panels in the main control room (MCR) and emergency control centre (ECC), however all and SRPS parameters are capable of being displayed on the reactor control and monitoring system (RCMS) video display units. The RCMS is a Foxboro Series I/A control system which is used for plant control and monitoring and as a protection system for the cold neutron source. This paper will provide technical information on both systems, their trip logics, their interconnections with each other, and their integration into the reactor control and monitoring system and control panels. By Charles R Morris Senior Instrumentation and Controls Engineer Australian Nuclear Science and Technology Organisation New Illawarra Road, Lucas Height, N.S.W., 2234, Australia Email: crm@ansto.gov.au Page 1 of 8

Reactor Protection Systems for the Replacement Research Reactor, ANSTO 1. Introduction The 20-MW Replacement Research Reactor Project, which is currently under construction at ANSTO will have a combination of a triplicated computer based reactor protection system, and a fully independent, and diverse, triplicated analogue reactor protection system. The First Reactor Protection System () consists of a Triconex triplicated modular redundant (TMR) system that has recently been approved by the USNRC for use in the USA s power reactor program. The Second Reactor Protection System is a hardwired analogue system supplied by Foxboro, the Spec 200 system, which is also Class1E qualified and has been installed in many power reactors. The functions of the include control rods insertion when safety parameter setpoints have been reached and containment isolation valves closure on high stack release activity. The SRPS is used to partially drain the reflector vessel, and since this operation would result in a reactor poison out due to the time it would take to refill the tank, the trip setpoints are more limiting. The and SRPS have limited hardwired indications on the control panels in the main control room (MCR) and emergency control centre (ECC), however all and SRPS parameters are capable of being displayed on the reactor control and monitoring system (RCMS) video display units. The RCMS is a Foxboro Series I/A control system which is used for plant control and monitoring and as a protection system for the cold neutron source. This paper will provide technical information for both the and SRPS, their trip logics, their interconnections with each other, and their integration into the reactor control and monitoring system and control panels. 2. The First Reactor Protection System The is a Safety Category 1 System, implemented using a Triconex Triple Modular Redundant (TMR) system, qualified for use in nuclear safety shutdown applications. This system initiates the fast insertion of control rods, called a Trip 1 action, via the First Shutdown System whenever the monitored parameters exceed pre-established limits. This action is aimed at avoiding reactor fuel damage and preventing the release of radioactive material from the reactor pool. The also initiates actions to isolate the Reactor Containment in case of the detection of radioactive material in the stack, and incorporates a number of interlocks that prevent reactor start-up when certain systems are unavailable. The is comprised of three redundant and separate trains. A train is made up of measurement channels that monitor various system parameters. Whenever a channel determines that its monitored parameter exceeds the safety limit setting, the train in question is in the tripped state for that parameter. Whenever two out of three trains are in a tripped state, for the same parameter, the reactor is shutdown or a protective action initiated. The inputs information to the Reactor Control and Monitoring System using qualified Class1E isolation devices and Foxboro proprietary data management software (known as the FoxGuard Manager). The trip/interlock and containment isolation parameters are shown in Table 1. As stated above the consists of three independent, redundant measurement channels. Each of these channels comprises of a sensor, a conditioning unit, and a Trip, Voting and Protective Logic Unit (TUVPLU), that is, the Triconex TMR. Analogue field signals are processed by the conditioning units (which produces a 4-20mA output). The outputs of these units are input to the TUVPLU where the channel value is compared to the trip setpoint. If two-out-of-three channels monitoring the same parameter are outside the trip setpoint, a signal from the associated channel is provided to one of the three redundant and independent output conditioning units that generate the required trip signal. This signal is then combined with the other channels signals of the same Function in a two-out-of-three logic to Page 2 of 8

produce the final actuation signal in the First Final Actuation Logic FFAL which causes the initiation of the FSS. For digital field signals, the configuration is similar but without the need for a conditioning unit or trip setpoint comparison. Table 1 Parameters FIRST REACTOR PROTECTION SYSTEM PARAMETERS Description (all signals triplicated) Action First Shutdown System Assembly of First Shutdown System enable Protective Interlock Compressed Air Storage Tank Pressure low Start-up Interlock/Alarm Second Shutdown System SSS Trip SSS Trip Trip FSS Isolation Valve Locked not open Start-up Interlock/Alarm Primary Cooling System Pool Open End Gamma Activity high Trip FSS Pool Water Level low Trip FSS Primary Coolant Flow low Trip FSS Core Pressure Difference low Trip FSS Core Pressure Difference high Trip FSS Core Temperature Difference high Trip FSS Core Inlet Temperature high Trip FSS Reflector Cooling and Purification System Reflector Cooling Flow low Trip FSS Expansion Tank Level v. low Trip FSS Reactor and Service Pool Cooling System* * Rigs Cooling Flow low Trip FSS Rigs Cooling Flow high Trip FSS Flap Valve #1 not closed Trip FSS Flap valve #2 not closed Trip FSS Nucleonic Instrumentation System Start-up Neutron Flux low Trip FSS Start-up Neutron Flux high Trip FSS Wide Range Logarithmic Rate high Trip FSS Wide Range Logarithmic Neutron Flux high Trip FSS Wide Range Logarithmic Flux @ Low Power high Trip FSS Wide Range Logarithmic Flux @ High Power high Trip FSS Seismic System Seismic level high Trip FSS Reactor Control and Monitoring System RCMS Availability not available Trip FSS Reactor Containment System Stack Particulate Activity high Containment Isolation Stack Iodine Activity high Containment Isolation Stack Noble Gases Activity high Containment Isolation Stack Particulate Activity Rate high Containment Isolation Stack Iodine Activity Rate high Containment Isolation Stack Noble Gases Activity Rate high Containment Isolation Electrical Supply Loss of Off Site Power trip Trip FSS Facilities Cold Neutron Source Protection System trip Trip FSS Hot Neutron Source (Reserved) trip Trip FSS * The rigs cooling flow signals are logically combined with the flap valve position status and the operational mode to determine if a reactor trip is required. Page 3 of 8

3. The Second Reactor Protection System The SRPS is a Safety Category 1 System that is a hard-wired analogue system that initiates the partial draining of heavy water from the reflector vessel, called a Trip 2. The Trip 2 is initiated via the Second Final Actuation Logic (SFAL) which causes the partial draining of the reflector vessel whenever the SRPS monitored parameters exceed pre-established limits. This action is aimed at avoiding reactor fuel damage thereby preventing the release of radioactive material from the reactor pool. The SRPS is an independent and diverse safety system from the. They share no components in common thereby fulfilling the imposed diversity requirements. The SRPS, like the has three redundant and independent trains, and inputs its information to the Reactor Control and Monitoring System (RCMS) via qualified isolation devices. The SRPS is based on the Foxboro Spec 200 line of components that have been in operation in operating nuclear plants for many decades. Similar to the Triconex, the SRPS field sensors will generate 4-20mA input signals to the Spec 200 equipment via signal conditioning units. Internally, the Foxboro Spec 200 system converts the current signal to a voltage signal of 0-10Volts. This is the standard working signal for Spec 200. All signal manipulations, comparisons and modulations are done at this level. The outputs whether on/off or variable are accomplished using qualified output isolators. The SRPS trip parameters are shown in Table 2. Table 2 SRPS Parameters SECOND REACTOR PROTECTION SYSTEM PARAMETERS Description (all signals triplicated) Action First Shutdown System Failure of First Shutdown System Fail Trip SSS Primary Cooling System Core Outlet Temperature high Trip SSS Core Pressure Difference low Trip SSS Pool Water Level (evacuation) v. low Trip SSS Reflector Cooling and Purification System Heavy Water Make Up Pump enable Protective Interlock Reflector Vessel Temperature high Trip SSS Nucleonic Instrumentation System Power Neutron Flux Rate high Trip SSS Power Neutron Flux Log (Low Power Mode) high Trip SSS Power Neutron Flux Linear high Trip SSS Seismic System Seismic Level high Trip SSS 4. Main Control Room and Emergency Control Room and SRPS Displays The consoles displaying the and SRPS in the Main Control Room (MCR) and Emergency Control Centre (ECC) are basically identical with the exception of a lack of power mode switches on the ECC panels. The control consoles are pictured in Figure 1 and show that hardwired indication has been kept to a minimum. Page 4 of 8

Figure 1 Control Panel Layout The Main Console is divided into functional areas: 1 2 3 4 5 6 7 8 9 Module 1: VDU Alarms Module 2: RPS Module 3: VDU Operation Module 4: Control Rods Module 5: VDU Operation Module 6: Communications Module 7: VDU General - Radioprotection Module 8: VDU General - Electricity. Module 9: VDU Irradiations Facilities Figure 2 RPS Hardwired Panel Module 2 WR LOG. NEUTRON FLUX () WR LOG. NEUTRON FLUX () WR Log Neutron Flux SAFETY TRAIN 1 SAFETY TRAIN 1 SAFETY TRAIN 2 SAFETY TRAIN 2 SAFETY TRAIN 3 SAFETY TRAIN 3 WR Log Neutron Flux Rate 2-10 2-20 2-30 2-10 2-20 2-30 PCS Flow PRIMARY COOLING F SAFETY TRAIN 1 SAFETY TRAIN 2 SAFETY TRAIN 3 F F (71) (71) 202-10 202-20 202-30 F (71) Core P DIFFEREN. SAFETY TRAIN 1 (63) SAFETY TRAIN 2 (63) SAFETY TRAIN 3 (64) (64) 203-10 203-20 203-30 (63) (64) Core Outlet Temp SRPS OUTLET SRPS SAFETY TRAIN 1 SAFETY TRAIN 2 SAFETY TRAIN 3 OULET OULET (19) (19) 204-10 204-20 204-30 OULET (19) Trip 2 Indication panel 2 CONTROL RODS 1 2 2 ASSEMBLY 1 Trip 1 210 (11) (8) 211 (9) 212 (31) 213 (50) 214 (22) CONTAINMENT VALVES CERS CTMT Iso Valves 1 2 215 217 (100) (101) 4 FIRE (CP-04) (CP-48) (CP-04) 221 223 225 227 (103) (104) (105) (106) TRANSFER TRAIN IN OPERATION HOLD SELECTED MANUAL TRAIN 1 TRAIN 2 239 240 241 236 (88) (85) (90) (91) HEATER IN OPERATION Ctmt Energy Removal Sys ENABLE DISABLE 216 (100) 218 222 224 226 (101) (103) (104) (105) 235 (92) 237 (97) 238 (98) Reactor Ops States Reactor Operational States OPERATION SHUT (32) (33) Reactor Operational Modes POWER POWER 247 248 (34) (35) Reactor Ops Modes 245 266 Page 5 of 8

POOL WATER EVACUAT. 121 EVACUATION MANUAL EVACUAT. 128 WIDE RANGE LOG NEUTRON FLUX REACTOR BUILDING DE CPGS1-1 EXTERNAL 155 162 140 REACTOR POOL OPEN END GAMMA ACTIVITY 142-5 GAMMA ACTIVITY 144 146 148 SERV. POOL WATER STACK NOBLE GASES ACTIVITY CPGS2-1 EXTERNAL EXTERNAL EXTERNAL EXTERNAL EXTERNAL 156 163 REACTOR CPGS2-2 157 164 EMWS CPGS3-1 158 165 CHIMNEY WATER F 122 129 123 ROD 1 130 124 125 CONTROL RODS ROD 3 131 ROD 5 132 CPGS4-1 159 166 PRIMARY FLAP VALVES VALVE 1 VALVE 2 126 ROD 4 133 REACTOR HALL GAMMA ACTIVITY HEAVY WATER STORAGE TANK CPGS4-2 160 167 141 FAILURE ELEMENT GAMMA ACTIVITY 143 STACK IODINE ACTIVITY 145 147 149 127 ROD 2 134 STACK PARTICULATE ACTIVITY CPGS5-1 EXTERNAL 161 168 ROD 1 1 2 SET 8 SFAL 2 10 TANK REFLECTOR TEMP 17 30 S. SHUT SYSTEM LOCKED 37 1 SET 50 CNS REQUEST 52 SEISMIC 59 ACTIVITY 92 1 ROD 3 2 MANUAL 11 POOL WATER 18 CONTROL RODS ENABLE ASSEMBLY 31 n FLUX START UP IN RANGE 38 FFAL REQUEST 53 RCMS UNAVAIL. 60 H. WATER EXP. TANK 66 67 STACK NOBLE GASES COOLING CIRCUIT 93 2 SYSTEM F. SHUT FAILURE OULET OPERATION IN RANGE CHANNEL 73 74 75 85 86 87 HEATER TEMP 2 CONTROL RODS ROD 5 94 STATE SHUT RANGE FLUCTUAT. 39 40 MANUAL REQUEST 54 MAIN POWER SUPPLY UNAVAIL. WATER POOL START UP n FLUX LOG INLET F 68 69 STACK PARTICULATE ACTIVITY RETURN CIRCUIT TRANSFER MANUAL 95 FIRE 100 101 102 103 3 12 19 32 61 n FLUX WIDE RANGE ROD 4 4 13 20 33 55 62 76 88 RIGS COOLING ROD 2 5 LOG 14 21 MODE SELECTION POWER POWER 34 TANK CTRL. ROD 41 56 63 F 70 ACTIVITY 77 96 4 F TRAIN 1 TRAIN 2 89 90 IN OPERATION ENABLE 97 F DISABLE CP-04 CP-48 CP-04 104 POWER n FLUX IODINE STACK SELECTED 15 22 35 42 WIDE RANGE n FLUX PWR MODE 57 6 64 PRIMARY COOLING POOL SERVICE FLAP VALVES VALVE 1 71 72 OPEN END POOL GAMMA ACT. 78 79 105 MAKE UP HEAVY WATER PUMPS DISABLED 7 2 9 16 SEISMIC 23 36 VALVE 2 43 1 51 PWR MODE 58 65 REFLECTOR COOLING HOLD 91 98 106 Reactor Protection Systems for the Replacement Research Reactor, ANSTO There are hardwired cabinets in both the MCR, and ECC that have individual alarms for all the and SRPS trip parameters for all three trains, see figure 3 below. Also on this panel are the two trains of the Post Accident Monitoring system which share some signals with the (nucleonic and reactor pool top area radiation monitors). The PAM system like the SRPS is based on the qualified Foxboro Spec 200 system components. Figure 3 RPS Wall Mounted Indication Panels SAFETY TRAIN 1 OPERATIONAL STATUS SRPS INTERLOCKS PAM 1 MONITOR SRPS S 120 PARAMETERS STATUS OPERATIONAL STATES INTERLOCKS WARNING S CONTAINMENT CERS CONTAINMENT VALVES PAM INDICATION PANEL (IP) SAFETY TRAIN Nº1 (OF2) RPS INDICATION PANEL (IP) SAFETY TRAIN Nº1 (OF 3) Note The above indication panels are still undergoing detailed Human Factors design review and there will be modifications to what is shown above. 5. The Reactor Control and Monitoring System The Reactor Control and Monitoring System is a Safety Category 2, computer-based, high availability system based on the Foxboro I/A Series Distributed Control System. The RCMS monitors all plant and reactor parameters, and displays them in the Main Control Room, Emergency Control Centre, and at local supervision centres (see Figure 4 below). The Reactor Control and Monitoring System functions include control of the reactor operation, process control, and overall information management. The RCMS is not part of the reactor protection systems however all signals from the and SRPS are input into the RCMS (via qualified isolators) so that these parameters are available for the operators at all RCMS visual display unit locations. There are 6 VDUs on the main console in the MCR and 4 on the main console of the ECC, which can be reconfigured by the operators to display any available screen. The RCMS includes the following systems: Page 6 of 8

Automatic Reactor Power Regulation System Radiation Monitoring System Vibration Monitoring System Facilities Control and Monitoring Systems Cold Neutron Source Protection System These systems cover all necessary automatic and manual functions to operate and monitor the facility in normal conditions, and to ensure that safety actions are executed under interlock conditions or when limits are exceeded. The RCMS, and SRPS are functionally, physically and electrically independent. and SRPS signals are sent to the RCMS, without feedback, using IEEE 384 qualified isolation devices. The RCMS does not perform any Safety Category 1 functions. The RCMS is continuously running self-check routines that indicate a failure within the system. In case a fault or malfunction affects normal operation, a hard-wired trip request signal is sent to the for a reactor trip 6. Expected Performance The Triconex system to be used in the, has only recently been qualified as Class 1E, however its use in highly critical safety systems world wide, has shown it to be a proven performer, with over 140,000,000 hours of operation without a false signal. These systems are typically used in offshore oil drilling platforms and at oil refineries where errors can be catastrophic. The Foxboro Spec 200 systems used in the SRPS and PAM have been in service from the mid 1960s and are a robust and well proven performer in the nuclear power industry. The Foxboro I/A system has been in use for many years in a wide variety of industrial applications. Recently it has been chosen as the system for the upgrade of the SCADA systems for the South Korean nuclear power program. ANSTO believes that because the above suppliers are all part of the Invensys group the integration of these systems will be far easier then if different vendors had been chosen. Page 7 of 8

Figure 4 RCMS Architecture Rack mounted Desktop Pedestal/Wall Panel RCMS Main Console Shift Facilities Supervisor Radioprot. NAA FCMS PTS Irradiation Facility Building 23 Reactor Mngr Heath Physics AW51E Local Supervision Units (Ethernet) AW51D CBLIFT CBLIFT Emergency Console AW51D NTD Radioprot. NTD Neutron Beam CNS Level +13 +0-5 REACTOR +10 RPS 2 PAM 004 103 006 CP101 CP102 CP103 CP104 CP105 CP106 105 005 007 003 401 008 502 404 009 507 001 RPS 1 (Tricon) Fo xg uar d Modbus Serial Interfaces (Integrator 30) CP107 CP108 CP109 503 402 101 010 504 403 102 505 Irradiation Facility 506 NBF & CNS CNS-PS DIESEL GENERATORS 901 902 COOLING TWR 601 AUX. BDG 702 703 705 704 SUBSTATION 706 708 710 711 Page 8 of 8