Component and Integration Test of an FPGA-Based PWR Protection Sub-System Using UVM

Field programmable gate arrays (FPGAs) have drawn wide attention from nuclear power industry for digital instrument and control applications (DI&C), because it’s much easier and simpler than microprocessor-based applications, which makes it more reliable. FPGAs can also enhance safety margins of the plant with potential possibility for power upgrading at normal operation. For these reasons, more and more nuclear power corporations and research institutes are treating FPGA-based protection system as a technical alternative. As nuclear power industry requires high reliability and safety for DI&C Systems, the development method and process should be fully verified and validated. For this reason, to improve the application of FPGA in NPP I&C system, the specific test methods are critical for the developers and regulators. However, current international standards and research reports, like IEC 62566 and NUREG/CR-7006, which have demonstrated the life circle of the development of FPGA-based safety critical DI&C in NPPs, but the specific test requirements and methods which are significant to the developers are not provided. In this paper, the whole test process of a pressurized water reactor (PWR) protection sub-system (Primary Coolant Flow Low Protection, Over Temperature Delta T Protection, Over Power Delta T Protection) is described, including detail component and integration tests. The Universal Verification Methodology (UVM) based on System Verilog class libraries is applied to establish the verification test platform. All these tests are conducted in a simulation environment. The test process is driven by the test coverage which includes code coverages (i.e., Statement, Branch, Condition and Expression, Toggle, Finite State Machine) and function coverage. Specifically, Register Transaction Level (RTL) simulation is conducted for Component tests, while RTL simulation, Gate Level simulation, Timing simulation and Static timing analysis are conducted for the integration test. The issues (e.g., the floating point calculation, FPGA resource allocation and optimization) arose in the test process are also analyzed and discussed, which can be references for the developers in this area. The component and integration tests are part of the Verification and Validation (V&V) work, which should be done by the V&V team separated from the development team. The testing method could assure the test results reliable and authentic. It is practical and useful for the development and V&V of FPGA-based safety DI&C systems.

Operating Reliability Assessment of FPGA-Based NPP I&C Systems: Approach, Technique and Implementation

Operating reliability assessment of instrumentation and control systems (I&Cs) is always one of the most important activities, especially for critical domains like nuclear power plants (NPPs). Intensive use of relatively new technologies like field programmable gate arrays (FPGAs) in I&C which appear in upgrades and in newly built NPPs makes task to develop and validate advanced operating reliability assessment methods that consider specific technology features very topical. Increased integration densities make the reliability of integrated circuits the most crucial point in modern NPP I&Cs. Moreover, FPGAs differ in some significant ways from other integrated circuits: they are shipped as blanks and are very dependent on design configured into them. Furthermore, FPGA design could be changed during planned NPP outage for different reasons. Considering all possible failure modes of FPGA-based NPP I&C at design stage is a quite challenging task. Therefore, operating reliability assessment is one of the most preferable ways to perform comprehensive analysis of FPGA-based NPP I&Cs. This paper summarizes our experience on operating reliability analysis of FPGA based NPP I&Cs.

Design of the Communication Independence for ACPR1000 Nuclear Power Plant Digital Safety I&C System

Communication independence is one of the key criteria of digital safety I&C system design. This paper mainly analyzes the requirements for communication independence in safety regulations and standards, and then introduces the architecture and design features, including communication failure processing measures, of communication networks of ACPR1000 nuclear power plant safety digital protection system based on FirmSys platform developed by CTEC. The communication design meets the regulations requirements and effectively improves the safety and reliability of the system, and it is successfully applied in reactor protection system (RPS) of Yang Jiang nuclear power plant unit 5&6. In addition this design can provide reference for communication designs of other NPPs and industries.

Ageing Inspection for Cross-Linked Polyolefin Insulation Cable in NPP Using Dielectric Property

The paper use a new dielectric frequency response method to measure the cable insulation’s complex dielectric spectrum at wide frequency domain. During the experiment, Cross-linked polyolefin insulated cables are accelerate aged under thermal and irradiation environment, and measured with elongation at break, Fourier transform infrared spectrum, oxidation induced temperature, and dielectric spectrum as well, to study the property degradation rule. The result indicate that the thermal ageing mechanism is similar to irradiation ageing, of which is the degradation due to polymer molecular chain unlinking, oxidizing material increase and additives content reduce. This chemical constituent changing in insulation could not result traditional electric property change but could be monitored by dielectric loss spectrum curve among wide frequency domain, which stayed stable but shifted to lower frequency as cable degradation. Finally, the paper discussed the main mechanism of cross-linked polyolefin dielectric property changing while ageing according to the electrophysical characteristic of solid insulation, and provided some suggestions about the non-destructive techniques for nuclear power plant cables using dielectric spectrum.

A Quantitative Approach for Reliability Evaluation of Safety I&C Systems in Nuclear Power Plants

The probability that the safety I&C system fails to actuate or advertently actuates RT or ESF functions, in part, essentially determines whether a nuclear power plant could operate safely and efficiently. Since more conservative assumptions and simplifications are introduced during the analysis, this paper achieves solid results by performing the modeling and calculation based on a relatively simple approach, the reliability block diagram (RBD) method. A typical safety I&C platform structure is involved in the model presented in this paper. From the perspective of conservation and simplicity, some assumptions are adopted in this paper. A group of formulas is derived in this paper based on Boolean algebra, probability theory, basic reliability concepts and equations, to facilitate the calculations of probabilities that the safety I&C system fails to actuate or advertently actuates RT or ESF functions. All the inputs of the analysis and calculation in this paper, which includes the I&C platform structure, the constitution of the hardware modules, and reliability data, are referenced to the nuclear power plant universal database where applicable. Although the conclusion drawn in the paper doesn’t apply to the I&C platform assessment for a specific plant, the method of modeling and process of analysis provides an illustration of an alternative quantitative reliability assessment approach for a typical safety I&C system installed in the nuclear power plant.

Development of Instrumentation and Control Systems for UK ABWR

This paper introduces the Instrumentation and Control (I&C) system for the proposed UK Advanced Boiling Water Reactor (UK ABWR) offered by Hitachi-GE Nuclear Energy, Ltd (Hitachi-GE). Hitachi-GE has been progressing the UK Generic Design Assessment (GDA) licensing process over the last 3 years. This is the process through which the Office for Nuclear Regulations (ONR) assesses the UK ABWR for suitability from a nuclear safety, security, environmental protection and waste management perspective and it is the first step towards proceeding with the construction phase in the UK. ONR’s regulatory expectations setting out relevant good practice are described in the Safety Assessment principles (SAPs), which are considered into the I&C design for UK ABWR. In addition, it has also been designed to take into account relevant good practices and regulations. In accordance with expectations derived from SAPs, the UK ABWR I&C systems are categorized and classified as required by IEC 61513 and IEC 61226. In addition, the overall I&C architecture, including all associated Human-Machine Interfaces (HMIs), abides by the principles independence and diversity of safety measures, segregation and separation of the protection and control systems. As a result, the UK ABWR I&C architecture is composed of major eight sub-systems. The eight sub-systems are: -Safety System Logic and Control system (SSLC) -Hardwired Backup System (HWBS) -Safety Auxiliary Control System (SACS) -Plant Control System (PCntlS) -Reactor/Turbine Auxiliary Control System (RTACS) -Plant Computer System (PCS) -Severe Accident Control and Instrumentation system (SA C&I) -Other dedicated C&I systems. The features for each sub-system such as redundancy of safety train or segregation among divisions are specified so that each sub-system will achieve its reliability as well as increase availability. While in the Japanese ABWR safety I&C system, the main protection system (SSLC), is microprocessor-based from the decades of successful operating experience in the past BWR, to meet the UK regulatory regime expectation on diversity between Class 1 platform and non-Class 1 platform, the SSLC (Class 1) for the UK ABWR is by Field Programmable Gate Array (FPGA). This system is currently under development and complies with IEC 62556. Its safety integrity level is planned to be SIL 3 (as a single division) and SIL 4 (as a four division system) as defined in IEC 61508. The HMIs which constitute an integral part of the I&C systems are also designed to comply with the I&C architecture regarding their categorization and classification with consideration of Human Factors (HF) modern methods taken into accounts.

Based on Human Behavior Process of Human Error Defensive Management Research for NPP

According to the research of nuclear power plant human error management, it is found that the traditional human error management are mainly based on the result of human behavior, the event as the point cut of management, there are some drawbacks. In this paper, based on the concept of the human performance management, establish the defensive human error management model, the innovation point is human behavior as the point cut, to reduce the human errors and accomplish a nip in the bud. Based on the model, on the one hand, combined with observation and coach card, to strengthen the human behavior standards expected while acquiring structured behavior data from the nuclear power plant production process; on the other hand, combined with root cause analysis method, obtained structured behavior data from the human factor event, thus forming a human behavior database that show the human performance state picture. According to the data of human behavior, by taking quantitative trending analysis method, the P control chart of observation item and the C control chart of human factor event is set up by Shewhart control chart, to achieve real-time monitoring of the process and result of behavior. At the same time, development Key Performance Indicators timely detection of the worsening trend of human behavior and organizational management. For the human behavior deviation and management issues, carry out the root cause analysis, to take appropriate corrective action or management improvement measures, so as to realize the defense of human error, reduce human factor event probability and improve the performance level of nuclear power plant.

Studies on Safety Assessment Method for Operating License Extension of Nuclear Power Plants in China

It’s the trend to extend the operating license time, called Operating License Extension (OLE) in China, of nuclear power plants (NPPs) in the future. It needs to be adequately demonstrated by licensees and approved by the regulator to gain an extended license time, such as 20 years. The demonstration methods for OLE are different among countries due to the different management systems for NPPs. Safety assessment, environment effect evaluation and update of the final safety analysis report (FSAR) will be the main aspects during OLE demonstration of NPPs in China according to the technical policy issued by National Nuclear Safety Administration (NNSA). Technical methods for scoping and screening, aging management review and time-limited aging analyses, which are the main contents of safety assessment are established based on the technical policy drafted by NNSA and international experiences in order to assist the operators to implement the safety assessment for OLE of NPP.

Research on Special Analysis of Verification and Validation in Nuclear Power Instrument and Control System

At present, there is still lack of detailed software V&V guidance standards in China, while a number of US nuclear power units and I&C platform are introduced and applied. So the software verification and validation work in our country usually cited the methods in IEEE 1012. With reference to the requirements of IEEE 1012, the V&V process of the software can be mainly divided into three forms: audit evaluation, special analysis and testing. This paper focuses on these parts and gives a detailed description and annotations of the technical methods and their life cycle stages in IEEE 1012, which cover multiple V&V phases. At the same time, the author puts forward his own understanding of the special analysis approach and procedure, such as criticality analysis, interface analysis, traceability analysis, hazard analysis, risk analysis and security analysis, and gives his own experience and related recommendations.

Study of AP1000 Protection System Based on FirmSys

In order to design AP1000 protection system based on the FirmSys platform of CTEC, the AP1000 protection system based on CommonQ platform is analyzed and researched. Through the comparison of the FirmSys platform and the CommonQ platform, it is found that the number of cabinets should be increased largely if the protection system design based on the FirmSys platform refers to Westinghouse AP1000 protection system architecture. So that the cabinets can not be laid out in the electrical room due to the AP1000 electrical room space constraints. In order to solve this problem and to achieve the required reliability, the optimization of the emergency reactor trip and engineered safety features actuation control method based on FirmSys platform is studied. At last a new protection system architecture design is completed. It is proved that the optimized protection system architecture, in which the number of cabinets is reduced and the reliability is improved, not only can solve the cabinet layout problem, but also can meet the design requirements of AP1000.