Reactor Protection Architecture for Common-Cause Failure Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Nuclear reactor protection systems face challenges in effectively mitigating common-cause failures and ensuring safe reactor operation due to software or software-developed logic errors, which can defeat safety functions and propagate failures across modules.
Innovation Solution
The implementation of a nuclear reactor protection system with functionally independent modules, including digital and analog components, that utilize a two-tier voting scheme and redundant pathways to determine safety actions, along with manual override and actuation capabilities, to isolate and prevent single failure propagation and ensure safe reactor operation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If software or digital logic is used in reactor protection systems, then automation and control precision are improved, but common-cause failures and software errors can propagate across modules, compromising safety
Solution Approach 1:
The protection system is divided into functionally independent modules (first protection module, second protection module, etc.) that are electrically isolated from each other. Each module processes safety functions independently, preventing failure propagation between modules while maintaining automated protection functions.
Solution Approach 2:
An analog module serves as an intermediary between digital input modules and final actuators. This analog module receives signals from multiple digital modules but implements the final control action in the analog domain, creating a barrier that prevents digital software errors from directly causing actuator misoperation.
2Reliability
If functionally independent modules are implemented, then failure propagation is limited and reliability is improved, but system complexity increases due to multiple digital and analog components
Solution Approach 1:
The analog module performs multiple functions: it receives inputs from multiple digital protection modules, processes analog signals, and controls multiple actuators. This multi-functionality reduces the need for separate dedicated analog circuits for each digital module, thereby reducing overall system complexity while maintaining functional independence.
Solution Approach 2:
Multiple digital protection modules are merged into a single analog module that consolidates the final control function. This merging reduces the number of separate control paths and simplifies the system architecture while preserving the benefits of functional independence and failure isolation.
3Ease of operation
If manual override capability is added, then operational flexibility and ease of operation are improved, but the system becomes more vulnerable to human error and requires additional components
Solution Approach 1:
Manual override switches are implemented as intermediaries between the operator and the protection system. These switches provide manual control capability while being integrated into the existing analog module architecture, allowing override functionality without requiring separate dedicated override circuits for each actuator.
Solution Approach 2:
The analog module is designed to handle both automatic digital control signals and manual override inputs through a unified architecture. This multi-functionality allows the same hardware to support both automated protection and manual intervention without requiring duplicate component sets.
Data Source
AI summary
A nuclear reactor protection system includes a plurality of functionally independent modules, each of the modules configured to receive a plurality of inputs from a nuclear reactor safety system, and logically determine a safety action based at least in part on the plurality of inputs, each of the functionally independent modules comprising a digital module or a combination digital and analog module, an analog module electrically coupled to one or more of the functionally independent modules, and one or more nuclear reactor safety actuators communicably coupled to the plurality of functionally independent modules to receive the safety action determination based at least in part on the plurality of inputs.