Abstract:
A controller for producing a nuclear reactor shutdown system trip signal in response to at least one detector signal. The controller includes a signal conditioning module receiving the at least one detector signal and outputting a measured flux signal. A rate module generates a rate signal from the measured flux signal. A comparator circuit compares the rate signal to a trip setpoint and generates a first trip signal.

Description:
RELATED APPLICATIONS 
       [0001]    This application claims priority to U.S. Provisional Patent Application No. 61/384,130, filed Sep. 17, 2010, the entire contents of which are incorporated herein by reference. 
     
    
     BACKGROUND 
       [0002]    The present invention relates to nuclear reactor safety systems. More particularly, the invention relates to trip signals that are especially effective at high power for reactor safety shutdown systems. 
         [0003]    Modern nuclear reactors commonly include one or more automatic safety systems that are designed to quickly and safely shutdown the reactor in the event of a casualty such as a loss of coolant accident (LOCA) or uncontrolled power excursion. These automatic safety systems are tripped when one or more parameters reach corresponding thresholds, or setpoints. The design of trip logics for automatic safety shutdown systems must accommodate two conflicting requirements: the systems must be tripped quickly enough to minimize the extent of the casualty, while being immune to spurious trips during conditions that do not require reactor shutdown. 
       SUMMARY 
       [0004]    In some embodiments, the invention provides a method of controlling a nuclear reactor shutdown system. A parameter related to a fission rate within a core of the reactor is detected with a sensor providing an output signal corresponding to the fission rate. A measured flux signal is determined from the output signal with a signal processing device. The measured flux signal corresponds to a percentage of a power of the reactor. A first derivative of the measured flux signal is calculated with a rate module. The rate module outputs a rate signal related to a percentage of reactor power per unit of time. The rate signal is compared to a rate signal setpoint with a comparator module. The comparator module generates a trip signal if the rate signal is greater than the rate signal setpoint. 
         [0005]    In other embodiments, the invention provides a shutdown system for a nuclear reactor having a reactor core. A sensor is associated with the reactor core and operable to detect a parameter related to a fission rate within the core and generate an output signal related to the fission rate. A signal conditioning module is operable to generate a measured flux signal based on the output signal. The measured flux signal corresponds to a percentage of a power of the nuclear reactor. A shutdown system trip controller includes a rate module operable to generate a rate signal from the measured flux signal and a comparator module operable to compare the rate signal to a trip setpoint and generate a trip signal if the rate signal is greater than the trip setpoint. A shutdown apparatus is operable to absorb neutrons within the reactor core upon receipt of the trip signal. 
         [0006]    In yet other embodiments, the invention provides a controller for producing a nuclear reactor shutdown system trip signal in response to at least one sensor signal. A signal conditioning module is operable to receive the at least one detector signal and output a measured flux signal. A rate module is operable to generate a rate signal from the measured flux signal. A comparator module is operable to compare the rate signal to a trip setpoint and generate a first trip signal if the rate signal is greater than the trip setpoint. 
         [0007]    In still other embodiments, the invention provides a method of controlling a nuclear reactor shutdown system. A parameter related to a fission rate within a core of the reactor is detected with a sensor. The sensor provides an output signal corresponding to the fission rate. A measured flux signal is determined from the output signal with a signal processing device. The measured flux signal corresponds to a percentage of a reactor power. A first derivative of the measured flux signal is calculated with a rate module. The rate module outputs a rate signal related to a percentage of reactor power per unit of time. The rate signal is biased with a bias signal component to produce a biased signal. A gain is applied to the biased signal to produce a rate-based signal component. The rate-based signal component and measured flux signal are summed to produce a rate-assisted flux signal corresponding to a percentage of a reactor power. The rate assisted flux signal is compared to a trip setpoint with a comparator module. The comparator module generates a trip signal if the rate assisted flux signal is greater than the trip setpoint. 
         [0008]    In other embodiments, the invention provides a shutdown system for a nuclear reactor having a reactor core. A sensor is associated with the reactor core and operable to detect a parameter related to a fission rate within the core and generate an output signal related to the fission rate. A signal conditioning module is operable to generate a measured flux signal based on the output signal. The measured flux signal corresponds to a percentage of a reactor power of the nuclear reactor. A shutdown system trip controller includes a rate module operable to generate a rate signal from the measured flux signal. A biasing component is operable to generate a biased signal. An amplifier module is operable to apply a gain to the biased signal to produce a rate-based signal component. A summing module is operable to apply the rate-based signal component to the measured flux signal to produce a rate-assisted flux signal. A comparator module is operable to compare the rate-assisted flux signal to a trip setpoint. The comparator module generates a trip signal if the rate-assisted flux signal is greater than the trip setpoint. A shutdown apparatus is operable to absorb neutrons within the reactor core upon receipt of the trip signal. 
         [0009]    In yet other embodiments, the invention provides a controller for producing a nuclear reactor shutdown system trip signal in response to a sensor signal. A signal conditioning module receives the sensor signal and outputs a measured flux signal. A rate module is operable to generate a rate signal from the measured flux signal. A biasing component is operable to generate a biased signal. An amplifier module is operable to apply a gain to the biased signal to produce a rate-based signal component. A summing module is operable to apply the rate-based signal component to the measured flux signal to produce a rate-assisted flux signal. A comparator module is operable to compare the rate-assisted flux signal to a trip setpoint and generate a trip signal. 
         [0010]    In still other embodiments, the invention provides a method of controlling a nuclear reactor shutdown system. A first parameter related to a fission rate within a core of the reactor is detected with a first sensor. The first sensor provides a first output signal corresponding to the fission rate. A second parameter related to the fission rate within the core of the reactor is detected with a second sensor. The second sensor provides a second output signal corresponding to the fission rate. At least the first output signal and the second output signal are processed into at least a first measured flux signal and a second measured flux with a signal processing device. The first measured flux signal and the second measured flux signal each correspond to a percentage of a reactor power. An average flux signal is calculated from the first measured flux signal and the second measured flux signal with an averaging module. A second derivative of the average flux signal is calculated with a rate module. The rate module outputs an average flux acceleration signal related to a percentage of reactor power per unit of time, per unit of time. The average flux acceleration signal is compared to an acceleration signal setpoint with a comparator module. The comparator module outputs a trip signal if the average flux acceleration signal is greater than the acceleration signal setpoint. 
         [0011]    In other embodiments, the invention provides a shutdown system for a nuclear reactor having a reactor core. A first sensor is associated with the reactor core and operable to detect a first parameter related to a fission rate within the core and generate a first output signal related to the fission rate. A second sensor is associated with the reactor core and operable to detect a second parameter related to the fission rate within the core and generate a second output signal related to the fission rate. A signal conditioning module is operable to receive the first output signal and the second output signal and generate a first measured flux signal and a second measured flux signal. The first measured flux signal and the second measured flux signal each corresponding to a percentage of a reactor power of the nuclear reactor. A shutdown system trip controller includes an averaging module operable to receive at least the first measured flux signal and the second measured flux signal and to calculate an average flux signal. A rate module is operable to calculate a second derivative of the average flux signal and to output an average flux acceleration signal related to a percentage of reactor power per unit of time, per unit of time. A comparator module is operable to compare the average flux acceleration signal to a flux acceleration setpoint. The comparator generates a trip signal if the average flux acceleration signal is greater than the flux acceleration setpoint. A shutdown apparatus is operable to absorb neutrons within the reactor core upon receipt of at least the trip signal. 
         [0012]    In yet other embodiments, the invention provides a controller for producing a nuclear reactor shutdown system trip signal in response to at least a first sensor output signal and a second sensor output signal. A signal conditioning module receives at least the first sensor output signal and the second sensor output signal and generates a first measured flux signal and a second measured flux signal. The first measured flux signal and the second measured flux signal each corresponding to a percentage of a reactor power of the nuclear reactor. An averaging module is operable to receive at least the first measured flux signal and the second measured flux signal and to calculate an average flux signal. A rate module is operable to calculate a second derivative of the average flux signal and to output an average flux acceleration signal related to a percentage of reactor power per unit of time, per unit of time. A comparator module is operable to compare the average flux acceleration signal to a flux acceleration setpoint. The comparator generates a first trip signal if the average flux acceleration signal is greater than the flux acceleration setpoint. 
         [0013]    Other aspects of the invention will become apparent by consideration of the detailed description and accompanying drawings. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0014]      FIG. 1  is a cutaway perspective view of nuclear reactor. 
           [0015]      FIG. 2  is a cutaway perspective view of safety shutdown systems (SDS) associated with the nuclear reactor of  FIG. 1 . 
           [0016]      FIG. 3  is a schematic illustration of an ion chamber detector of the nuclear reactor shown in  FIG. 1 . 
           [0017]      FIG. 4  is a schematic illustration of an in-core flux detector of the nuclear reactor shown in  FIG. 1 . 
           [0018]      FIG. 5  is a block diagram of an algorithm for a neutron flux rate-based SDS trip signal. 
           [0019]      FIG. 6  is a block diagram of an algorithm for an average neutron flux rate-based SDS trip signal. 
           [0020]      FIG. 7  is a block diagram of an algorithm for a rate-assisted neutron flux-based SDS trip signal. 
           [0021]      FIG. 8  is a block diagram of an algorithm for an average neutron flux-acceleration based SDS trip signal. 
       
    
    
     DETAILED DESCRIPTION 
       [0022]    Before any embodiments of the invention are explained in detail, it is to be understood that the invention is not limited in its application to the details of construction and the arrangement of components set forth in the following description or illustrated in the following drawings. The invention is capable of other embodiments and of being practiced or of being carried out in various ways. 
         [0023]      FIG. 1  illustrates a nuclear reactor, such as a pressurized heavy water reactor  10  (e.g., a Canadian Deuterium Uranium (CANDU) type nuclear reactor). The reactor  10  is installed within a reinforced vault  14 . The vault  14  is one of several layers of containment vessels that surround the reactor. This nuclear reactor environment and application is presented by way of example only, it being understood that the present invention is applicable for use in other types, sizes, and constructions of nuclear reactors. For example, the invention is also applicable for use in pressurized light water reactors, boiling water reactors, and liquid metal reactors. 
         [0024]    In general, nuclear reactors generate energy from a nuclear chain reaction (i.e., nuclear fission) in which a free neutron is absorbed by the nucleus of a fissile atom in a nuclear fuel, such as Uranium-235 ( 235 U). When the free neutron is absorbed, the fissile atom splits into lighter atoms and releases more free neutrons to be absorbed by other fissile atoms, resulting in a nuclear chain reaction. Thermal energy released from the nuclear chain reaction is converted into electrical energy through a number of other processes. 
         [0025]    The reactor  10  includes a number of fuel channels  18  within which fissile-material loaded fuel bundles (not shown) are positioned. The fuel channels  18  are arranged horizontally within a cylindrical reactor vessel known in a CANDU reactor as a Calandria  22 . In a CANDU reactor, the Calandria  22  is filled with a heavy water moderator. The fuel channels  18  within the Calandria  22  form a reactor core  26 . Feeder pipes  30  supply sub-cooled heavy-water reactor coolant to each of the fuel channels  18 . The feeder pipes  30  and fuel channels  18  form a portion of a primary reactor coolant transport loop that also includes a number of steam generators, reactor coolant pumps, and associated piping. 
         [0026]      FIG. 1  also illustrates several aspects of instrumentation, control, and safety systems associated with the reactor  10 . Vertically oriented control rods  34  are controllably inserted or withdrawn from the reactor core  26  to vary reactivity by absorption of neutrons within the core  26 . The control rods  34  may be manually and automatically controlled to vary reactivity within the reactor core  26  during operation of the reactor. 
         [0027]    As shown in  FIG. 2 , two independent reactor safety shutdown systems, SDS 1  and SDS 2 , are provided. Each shutdown system, acting alone, is designed to shut the reactor down and maintain it in a safe shutdown condition. The shutdown systems SDS 1  and SDS 2  are independent of a reactor control system and are also independent of each other. In general, reactor operation is terminated by the shutdown systems SDS 1  or SDS 2  when multiple indications of a neutronic or process parameter enter unacceptable ranges (i.e., exceed a setpoint). 
         [0028]    The measurement of each parameter that can result in initiation of a safety shutdown is at least triplicated (i.e., at least three detectors per parameter, per shutdown system SDS 1  and SDS 2 ). Each safety shutdown system, in turn, includes three separate and independent trip channels (e.g., channels D, E and F for SDS 1  and channels G, H and J for SDS 2 ) with a requirement that two of the three trip channels must exceed their respective setpoints before a safety shutdown is initiated. This “two out of three” logic reduces the possibility of spurious trips causing a reactor shutdown. It should also be noted that equipment used on shutdown systems is allocated exclusively to reactor shutdown protection and for no other purposes. In addition, interlocks may be provided such that if a shutdown system SDS 1  or SDS 2  has been operated, it is not possible to insert any positive reactivity into the reactor core by, for example, withdrawing one or more control rods  34 . This further reduces the possibility of the reactor power increasing while the original fault condition still exists. 
         [0029]    As shown in  FIG. 2 , SDS 1  includes a plurality (twenty eight, for example) of spring-assisted shutoff rods  38 . The shutoff rods drop into the core  26  upon receipt of least two trip signals from channels D, E, or F. The shutoff rods  38  absorb neutrons within the core  26  to quickly lower reactivity and thereby terminate reactor power operation and maintain the reactor  10  in a safe shutdown condition. SDS 1  has sufficient speed and negative reactivity to reduce the reactor power to levels consistent with available cooling. 
         [0030]    SDS 2  provides a second independent method of quickly shutting down the reactor in the event of a serious process excursion by injecting a strong neutron absorbing solution (e.g., gadolinium nitrate) into the moderator. As shown in  FIG. 2 , six perforated nozzles  42  run horizontally across the Calandria  22 . Each nozzle  42  is connected to a poison tank  46  filled with the neutron absorbing solution. A high-pressure helium tank  50  is selectively coupled to the poison tanks  46  via a single automatic isolation valve  54 . When any two out of three channels (G, H, or J) produce a trip signal, the automatic isolation valve  54  is opened, pressurizing the poison tanks  50  and thereby injecting the neutron absorber solution into the reactor core  26 . 
         [0031]    The monitoring and control of a nuclear reactor requires instrumentation for a wide range of neutron flux levels. Flux within a reactor&#39;s operating range (full shutdown to rated full power) can be considered as varying from 10 7  to 10 14  N/(cm 2 s)—or seven “decades” of neutron flux. Referring back to  FIG. 1 , ion chambers  58  and in-core flux detectors (ICFDs)  62  provide for measurement of neutron flux throughout the reactor core and throughout operating range. Ion chambers  58  and ICFDs  62  are utilized by both SDS 1  and SDS 2 , as well as for routine reactor control. 
         [0032]    Three ion chambers  58  are located on each side of the Calandria  22 . The ion chambers  58  assigned to SDS 1  are located on one side of the reactor and those for SDS 2  are on the opposite side, to achieve systems separation. There are three ion chambers  58  assigned to each of SDS 1  and SDS 2 , with one ion chamber  58  per trip channel D, E, F, and G, H, J, respectively. 
         [0033]    At low reactor power levels, say below 15% full power, indication of bulk neutron flux, as opposed to localized (i.e., regional) neutron flux, is important. Ion chambers, because of their fast response time and high sensitivity are used for low power neutron flux detection. The ion chambers  58  are located outside of the reactor core  10  (hence their reading is often referred to as “out of core”) and will generate a signal in the range from 10 −5  to 100 μA over seven decades of neutron flux. 
         [0034]      FIG. 3  is a schematic illustration of an ion chamber  58 . An ion chamber  58  consists of an insulated electrode  66  sealed within a gas tight housing  70 . An ionizing gas  74  that is chemically stable under irradiation, such as hydrogen, is used to fill the chamber. The electrode  66  and housing  70  are coated with boron-10 ( 10 B) to provide neutron sensitivity. When  10 B absorbs a neutron, an ionizing alpha particle is released. A polarizing voltage supply  78  (approximately 600 Volts) is applied across the electrode  66  to produce a small current signal on the order of a micro-amp as a function of the flux level. As described in greater detail below, the micro-amp output signal is processed and compared with a setpoint to generate a single channel trip signal. Because ion chambers are utilized over such a wide range of neutron flux, output signals from ion chambers are often processed to produce a logarithmic signal. However, signals from ion chambers may also be expressed linearly. 
         [0035]    Although ion chambers are very accurate neutron detectors, their relatively large size, requirement for polarizing voltage and delicate construction make them impractical to be used to detect flux distribution inside the reactor. For this purpose, simple and relatively inexpensive in-core flux detectors (ICFDs) have been developed. ICFDs are self-powered devices that produce a small current signal on the order of a micro-amp proportional to the fission rate within the reactor. ICFDs are selected for indication over the last decade of neutron flux to provide a linear measurement signal from approximately 5% to 100% of full power. As illustrated in  FIG. 4 , an ICFD  62  includes an Inconel™ outer sheath  82  and an inner emitter wire  86 . Various materials can be used for the emitter wire  86 , the most common being vanadium and platinum. The outer sheath  82  and emitter wire  86  are separated by a layer of insulation  90  such as magnesium oxide, MgO. 
         [0036]    In the illustrated reactor  10  of  FIG. 1 , there are fifty-four vertically oriented ICFDs  62  for SDS 1 , and forty-eight horizontally oriented ICFDs  62  for SDS 2 . The ICFDs  62  are distributed among the various shutdown system logic channels: channels D, E and F (SDS 1 ) contain eighteen detectors each, channels G, H, and J (SDS 2 ) contain sixteen detectors each. 
         [0037]    As mentioned previously, when a neutron flux is received by a flux detector such as an ion chamber or ICFD, the resulting output signal is a small current signal on the order of a micro-amp at full reactor power. Before the output signals can be utilized as inputs by either SDS 1  or SDS 2 , the signals must be converted. The output signal of an ICFD is initially converted to a voltage, amplified and then processed with analog circuitry called a Dynamic Signal Compensator (DSC), to match the heat flux. This DSC corrects the difference between the transient response of the ICFD and the corresponding change in the power (heat) generation in the fuel. The resulting voltage signal represents a percentage of a full power (% FP). 
         [0038]      FIG. 5  is a block diagram of a flux-rate trip algorithm  92  for a safety shutdown system such as SDS 1  or SDS 2 . A signal  94  representing % FP is received by the algorithm  92 . A rate signal  98 , expressed in % FP per unit of time, and based on a first derivative of the signal  94 , is generated by a rate module  102 . The rate module  102  may be a portion of a micro-processor or may include, for example, a differentiator circuit. 
         [0039]    The rate signal  98  is then passed through a noise filter module  106 . In the illustrated example, the noise filter module  106  is a 2 nd  order low pass filter, where τ is a filter time constant. The filter time constant τ is an independent design parameter determined by analysis of experimental and operational data. A large value of τ reduces peak noise, but also results in a slower trip for a given trip setpoint. Determining the filter constant τ and trip setpoints is a balance between spurious trip immunity and response time. 
         [0040]    After passing through the noise filter module  106 , a filtered rate signal  110  enters a comparator module  114 . Within the comparator module  114 , the filtered rate signal  110  is compared to a preset trip setpoint  118 . If the filtered rate signal  110  is greater than the trip setpoint  118 , a trip signal  122  results for that channel. As described previously, in at least some embodiments, one or more other trip signals on another channel associated with the same shutdown system would be required before reactor shutdown. 
         [0041]      FIG. 6  is a block diagram for a rate of the ICFDs&#39; average trip algorithm  124 . Unlike the trip algorithm  92  described with respect to  FIG. 5 , the rate of the ICFDs&#39; average trip algorithm  124  receives neutron flux inputs  126  from n ICFD detectors on a single channel. For example, if Channel D has eighteen ICFDs, then the trip algorithm for SDS 1  channel D receives inputs from all eighteen ICFDs associated with that channel. The n signals are numerically averaged in an averaging module  130  to produce an average measured flux signal  134 . The average measured flux signal  134  then passes through a rate module  138  to produce a rate of the ICFDs&#39; average signal  142 . The rate module  138  may be a portion of a micro-processor or may include, for example, a differentiator circuit. 
         [0042]    Signal  142  is then passed through a 2 nd  order low pass filter module  146 , with time constant τ. Like the circuit of  FIG. 5 , the time constant τ is determined by analysis. A filtered rate of the ICFDs&#39; average signal  150  then enters a comparator module  154 . Within the comparator module  154 , the filtered rate of the ICFDs&#39; average signal  150  is compared to a preset trip setpoint  158 . If the filtered rate of the ICFDs&#39; average signal  150  is greater than the trip setpoint  158 , a trip signal  162  results for that channel. 
         [0043]    Basing a trip signal  162  on a rate of the ICFDs&#39; average signal  142  rather than individual signals from each ICFD has several advantages. First, the peak noise value of the average flux signal is much lower than the noisiest detector in a trip channel. Lower noise allows the use of lower trip setpoints, which in turn results in a more effective (faster) trip signal. Unlike prior art trip signals, which utilize the single highest detector reading in a safety channel, this trip logic uses signals from all detectors, thus making it more immune to spurious trips. Furthermore, this trip requires only a single rate circuit  138  and a single meter in the main control room per channel to inform a reactor operator, as opposed to a rate circuit and a meter for each detector. 
         [0044]      FIG. 7  is a block diagram of a rate-assisted regional over power (RAROP) trip algorithm  166 . The RAROP trip algorithm  166  is based on individual ICFD signal readings plus a component based on the rate of change (i.e., first derivative) of the individual ICFD signals. A measured flux signal  170 , expressed as a % FP, enters a rate module  174 , in order produce a flux rate signal  178  (% FP/s). The flux rate signal  178  is then filtered in a 2 nd  order noise filter module  182  to produce a filtered flux rate signal  186 . A bias  190  is then compared with the filtered flux rate signal  186 . If the filtered flux rate signal  186  is greater than the bias  190 , then a flux rate difference  194  will be positive (i.e., greater than zero). A gain K, expressed in seconds, is multiplied by the flux rate difference  194  to amplify the rate-assisted component  198  expressed in % FP. The rate-assisted component  198  is added to the original measured flux signal  170  to produce a rate-assisted flux signal  202 . The rate-assisted flux signal  202  is compared with a preset trip setpoint  206  in a comparator module  210 . If the rate-assisted flux signal  202  is greater than the trip setpoint  206 , a trip signal  214  results. 
         [0045]    The RAROP trip algorithm takes advantage of the fact that following a LOCA, the ICFDs&#39; rate signals increase faster than the flux increase measured by the detectors. Thus, the RAROP trip algorithm  166  is expected to significantly reduce trip times in major reactor casualties such as a large LOCA. The faster trip time is expected to reduce peak reactivity, maximum fuel centerline temperature, and peak sheath temperature. 
         [0046]      FIG. 8  is a block diagram of an acceleration of the ICFDs&#39; average trip algorithm  218 . This trip is based on the acceleration (second derivative) of the average flux measured by ICFDs and takes advantage of the fact that following a LOCA, the second derivative of a flux signal increases much more quickly than the flux signal itself. An averaging module  222  receives signals from n ICFD detectors to produce an average flux signal  226 . The average flux signal  226  is then processed by a first rate module  230  to produce an average flux rate signal  234 . The average flux rate signal  234  is processed by a second rate module  238  to produce an average flux acceleration signal  242 . The first rate module  230  and second rate module  238  may be implemented as a single rate module including, for example, one or more differentiator circuits. The average flux acceleration signal  242  is then filtered by an N th  order noise filter module  246 . A filtered average flux acceleration signal  250  is then received by a comparator module  254  and compared to a preset trip setpoint  258 . If the filtered average flux acceleration signal  50  is greater than the trip setpoint  258 , a trip signal  262  results. 
         [0047]    A trip based on the acceleration of the ICFDs&#39; average in a shutdown system channel has a number of advantages. Although the average flux acceleration is slower than the fastest flux acceleration, a trip based on the average is actually faster because lower noise values allow the use of a much lower trip setpoint. Furthermore, spurious trip immunity is increased because an average flux acceleration is highly insensitive to noise spikes or other unusual behavior in any single detector. 
         [0048]    The trip setpoints  118 ,  158 ,  206 ,  258  described with respect to  FIGS. 5-8  may be predetermined values determined by analysis of experimental and operational data. A trip setpoint at any given time may be one of a plurality of predetermined values optimized for different operational conditions. The trip setpoint may be manually or automatically selected for a given operating condition from a plurality of trip setpoints, or may be a variable determined by one or more input parameters including an operational condition. Operating conditions that may factor into the trip setpoint include, for example, reactor coolant pump speeds or operation, reactor coolant pressure or temperature, and the current reactor power. 
         [0049]    The trips herein could be implemented either on analog, CPU based computer, or Field Programmable Gate Array (FPGA) platforms. 
         [0050]    Thus, the invention provides, among other things, a trip algorithm for reactor shutdown systems. Various features and advantages of the invention are set forth in the following claims.