REACTOR REGULATING SYSTEM RRS FOR 540MWe PHWRs

1
REACTOR REGULATING SYSTEM (RRS) FOR 540MWe PHWRs

• B.B.BISWAS
• HEAD
• REACTOR CONTROL DIVISION
• BHABHA ATOMIC RESEARCH CENTRE
• INDIA

2
Functions of RRS

• Automatic Control of Reactor Global Regional
  Power
• Demand Power maneuvering
• Power Measurement and Calibration
• Neutron Flux profile monitoring and control
• Execution of Setback Stepback
• Provide Xenon override capability
• Supervised withdrawal of Shut-off rods during
  reactor startup

3
RRS Input, Output
R R S
IC, SPND Pow (Neutronic signals)
Triplicated
Bulk Power, EPE, Demand Power,
Thermal Power, Combined Zone Pow (ICMS)
Triplicated
bank IN/OUT ind, bank enable, SFC, Rod drive
enable,
Rod, Damper Pos (Reactivity Devices)
Duplicated
Valve lift for ZCC, ZCC level
ZCC Level, (LZCS)
Duplicated
Window ann., lamp ind.
Valve Pos (LZCS)
Single
Trip, Clutch test, Setback, Stepback signals
Flux Mapping System
Triplicated
HS, PB other Contact Inputs
Plant Info System
Triplicated
4
RRS System Requirements

• 1043 Contact Inputs
• 253, 632,141 Analog Inputs
• 56 Analog, 150 Relay Outputs
• Class IB system
• Fault tolerance, fail safe philosophy
• Architecture
• To meet Functional specification, Response times
• To increase Availability
• Without compromising safety
• Failsafe action
• Single failure criteria

5
RRS ARCHITECTURE

• Multi nodal Distributed Architecture
• Three Input Nodes (IPN) for Data Acquisition
• Two Main Processing Nodes (MPN) for executing
  control algorithm
• Two Output Nodes (OPN) for field outputs
• All the above are Embedded Nodes
• Two Operator Consoles (OCN) for operator
  interaction- PC based
• Dual Redundant Data Links

6
RRS ARCHITECTURE- fig
7
Other Architectures

• Triple Modular
• Each Module gets only 1 signal
• mean/median cannot be computed
• 2/3 or median selector required at the output
• In our system, this will be voluminous (56 A/O
  150 R/O)
• Meets single failure criteria
• Single Sensor failure means node failure
• Dual Hot-standby
• Acts on 2/3
• All 3 channel I/P has to be brought to each
  system
• Independence of channels compromised
• System I/O handling and processing power has to
  be very high to satisfy the requirements

8
Advantages of Multinodal

• Divide and Rule philosophy
• Three I/P nodes taking care of 3 instrumented
  channel signals respectively
• Channel independence intact
• Control algorithm on validated signals (2/3)
• Redundancy for control nodes, output nodes
• Functionality, Response times (performance
  requirement) achieved using simple hardware
• Indigenous hardware , proven design
• Improved reliability

9
Reliability Advantage of Multinodal Approach
MPN
OPN
MPN
OPN

• Hardware Volume v/2
• Failure Rate f/2
• Combined Failure Rate of 2 redundant units
• f 2 /4

• Hardware Volume v
• Failure Rate f
• Combined Failure Rate of 2 redundant units
• f 2

Four-fold improvement in Reliability
10
Fault Tolerance wrt Architecture

• Full functionality of the system is assured with
• Single failure
• Any 1 node of a type OR 1 Network
• Double Failure
• Any 2 Nodes of different types
• Any 1 Node and 1 Network
• Multiple Failure-(upto 5 failures)
• 1 Node each of different types and 1 Network
• In CTU- module-wise switching
• The availability of the system is increased many
  folds

11
RRS- Failsafe output

• Failsafe output leads to safe shutdown of
  reactor
• System is unavailable
• failsafe output results from both OPNs
• Double failure of same type of node
• both networks failure

12
NETWORK in RRS

• Dual redundant network
• Card level redundancy
• Not limited to link level
• Equivalent to 2 different networks
• Ethernet, 10Mbps
• Twisted pair, RJ45
• Connection through Hub/Switch

13
Network Load

• No of nodes 9
• No of logical connections- 29 per network
• IPN-MPN 6 regular I/P data 450 bytes each
• MPN-OPN 4 regular O/P data 300 bytes each
• MPN-OCN 4 regular data 2400 bytes each
• IPN-OCN 6 diagnosis data
• MPN-OCN 4 diagnosis data, operator actions
• OPN-OCN 4 diagnosis data
• OCN-OCN 1 operator actions
• Point-to-point- 25 connections!!
• 44,000 regular data bytes per sec (including
  acknowledge)
• 4 network load

14
Network Protocol

• Subset of TCP/IP protocol with Ethernet MAC
• Every data is sent and acknowledged
• Reliable communication with retransmit
• Absence of a node/card is detected annunciated
• Co-existence of embedded nodes with PC based
  nodes
• On change of Ethernet boards, OS takes care
• Any OS with TCP/IP stack on PC

15
Network- Determinism Response

• Small network 9 nodes
• Less than 4 load- low load
• Subset of TCP/IP modified for realtime response
• Data transmitted on both net
• Data received on both net
• Latest data is taken for processing, by the
  application layer
• All the above contribute to Realtime Response of
  the system

16
Other Modern aspects

• Demand Power Maneuvering through OCN
• Operator interacts thro Operator console for
  power maneuvering
• Manual operation of Reactivity devices through
  OCN
• All the reactivity devices are operated in
  Computer-Manual by commands from Operator Console
• RRS system wise
• SR withdrawal on startup
• ZCC devices control
• Reactivity devices position measurement
• Reactivity devices movement trouble detection
• Setback, Stepback actions

17
Hardware

• Simple, Proven design
• CPU, Memory, I/O cards
• Multilayer cards, low density
• Modular cards- 1 card fault affects few signals
• Separate Motherboards for CPU signals, for I/O
  signals
• Passive motherboard
• Address on card, placable at any location
• Hot pluggable
• Detection of card absence by NMI
• Powerfail detection by NMI

18
Features of Cards

• Isolation for input from field
• Isolation between input signals
• Isolation for output between field and system
• Isolation for output between signals
• Diagnosis facility provided
• Reference signals on analog input cards
• FITing for digital I/P
• Readback on digital/relay output cards
• Readback on analog output cards

19
Hardwired Interlock Unit-HIU

• To limit the positive reactivity addition rate
• At the output of each OPN
• Interlocks checked at MPN in software, after
  processing
• Checked at OPN in software, before output
• HIU checks O/P from OPN for interlock violation
• Inhibits OUT movement of devices on error
• Also checks its own functioning on error
• Inhibits all outputs
• gives feedback to OPN

20
Software

• Full Software development life cycle followed as
  per standard
• Highly modular simple modules with minimum
  coupling, maximum cohesion
• C language used with safe-subset
• maintainability
• In-house built simple Real-Time Executive
• No COTS OS
• Detects fault in cards to provide
  failsafe/fault-tolerance
• Does re-configuration on card insertion
• VV as per AERB-D-25

21
Thank You