Patent Number: 056217765
Section: summary

FIELD OF THE INVENTION This invention relates generally to protection systems for shutting down a system and maintaining it in a safe condition in the event of a system transient or malfunction. In particular, the invention relates to protection systems for shutting down a nuclear reactor and maintaining it in a safe condition in the event of a system transient or malfunction that could cause damage to the nuclear fuel core, most likely from overheating, or a release of radiation, endangering the public. BACKGROUND OF THE INVENTION Conventional reactor control systems have automatic and manual controls to maintain safe operating conditions as the demand is varied. The several control systems control operation of the reactor in response to given demand signals. Computer programs are used to analyze thermal and hydraulic characteristics of the reactor core for the control thereof. The analysis is based on nuclear data selected from analytical and empirical transient and accident events, and from reactor physics and thermal-hydraulic principles. In the event of an abnormal transient event, the reactor operator is usually able to diagnose the situation and take corrective action based on applicable training, experience and judgment. Whether the manual remedial action is sufficient or rapid enough depends upon the event and upon the operator's knowledge and training. If the event is significant (i.e., challenges any of the reactor safety limits), a reactor trip (also referred to as reactor shutdown, scram, or insertion of all control rods) may be required. Some transient events may occur quickly, i.e., faster than the capability of a human operator to react. In such an event, a reactor trip will be automatically effected. A conventional nuclear reactor protection system comprises a multi-channel electrical alarm and actuating system which monitors operation of the reactor, and upon sensing an abnormal event initiates action to prevent an unsafe or potentially unsafe condition. The conventional protection system provides three functions: (1) reactor trip which shuts down the reactor when certain monitored parameter limits are exceeded; (2) nuclear system isolation which isolates the reactor vessel and all connections penetrating the containment barrier; and (3) engineered safety feature actuation which actuates conventional emergency systems such as cooling systems and residual heat removal systems. An essential requirement of a nuclear reactor protection system is that it must not fail when needed. Therefore, unless the operator promptly and properly identifies the cause of an abnormal transient event in the operation of the reactor, and promptly effects remedial or mitigating action, conventional nuclear reactor protection systems will automatically effect reactor trip. However, it is also essential that reactor trip be avoided when it is not desired or necessary, i.e., when there is an error in the instrumentation or when the malfunction is small enough that reactor trip is unnecessary or when one shutdown function fails, the reactor protection system must not perform the next shutdown function if to do so would be unsafe. SUMMARY OF THE INVENTION The present invention is a reactor protection system (RPS) having four divisions, with quad redundant sensors for each scram parameter providing input to four independent microprocessor-based electronic chassis. Each electronic chassis acquires the scram parameter data from its own sensor, digitizes the information, and then transmits the sensor reading to the other three RPS electronic chassis via optical fibers. To increase system availability and reduce false scrams, the RPS employs two levels of voting on a need for reactor scram. The electronic chassis perform software divisional data processing, vote 2/3 with spare based upon information from all four sensors, and send the divisional scram signals to the hardware logic panel, which performs a 2/4 division vote on whether or not to initiate a reactor scram. Each chassis makes a divisional scram decision based on data from all sensors. Each RPS division performs independently of the others (asynchronous operation). All communications between the divisions are asynchronous. The reactor protection system logic is designed to provide fault tolerance, enhanced reliability, increased availability and improved separation. Features of this system include the ability to have a failed sensor without reducing the level of protection or increasing the likelihood of an inadvertent reactor trip. The design in accordance with the present invention eliminates the need for manual bypasses, virtually eliminates the need for operator action, and achieves fault tolerance without custom design components. The RPS is designed to withstand multiple failures in almost all of its components. Its logic has the following major performance enhancement characteristics: First, the exchange of sensor readings and multiple sensor voting capability within each division provides high scram reliability. This can be seen by considering the case where a scram condition exists in the reactor, which is picked up by any three sensors, assuming all sensors and their data are good and not outside the failed sensor limits. For this case, the RPS would generate scram signals in all four divisions, a highly reliable reactor scram configuration. Most conventional protection systems would only generate a scram signal in three divisions. Scram reliability is also high for scram scenarios involving good sensors that indicate scram, and failed sensors that have even failed low, since for such scenarios the RPS produces scram signals based on good sensors, and is not inhibited by failed low sensors. Second, multiple sensor voting within each division provides discrimination against spurious scrams due to sensor malfunctions. Thus, if a sensor of one scram variable erroneously indicates scram in one division, and a sensor of a second variable erroneously indicates scram in another division, the RPS would vote out the erroneous readings and would not generate a scram signal. Third, automatic detection and discrimination against failed sensors allows the RPS to automatically enter a known state when such failures occur. There is no uncertainty as to whether the sensors have failed high or low, or whether the operator has taken the correct manual bypass action. Fourth, cross communication of sensor readings allows comparison of the four theoretically "identical" values. This permits identification of sensor errors such as drift or malfunction. A diagnostic request for service is issued for errant sensor data. Fifth, automated self test and diagnostic monitoring, sensor input through output relay logic, virtually eliminate the need for manual surveillance testing. This provides an ability for each division to cross-check all divisions and to sense failures of the hardware logic.