Reactor protection and shutdown systems

Dr. Lise Fortin leads the safety analysis work that sets the trip setpoints for the Darlington CANDU station. She shows Hana a single page from the safety report: a list of the trip parameters for shutdown system 1 and shutdown system 2, side by side. “Every line on this page is backed by an analysis,” she says. “For each accident we analyse, we show that each shutdown system on its own trips the reactor in time, using at least two different trip parameters, with the most effective rods or nozzles assumed unavailable. That is what two fully capable, independent and diverse shutdown systems means.”

This lesson explains how protection systems are designed: the safety functions they perform, the principles of redundancy, independence, diversity and fail-safe design, the voting logic that balances failure to trip against spurious trips, the derivation of trip setpoints from analytical limits, and testing. The CANDU shutdown systems and the PWR reactor protection and engineered safety features actuation systems are described in turn.

What protection must do

Protection systems detect conditions that could lead to fuel damage or to failure of the pressure boundary or containment and take automatic action to prevent it. The most important action is to shut the reactor down quickly. Others start emergency core cooling, isolate containment, start auxiliary feedwater or emergency power, and close steam lines. Protection systems are designed for high reliability on demand and must work even when the plant is in an abnormal state that the control systems failed to prevent or caused.

The design principles are common to all designs and appear in national and international standards. Redundancy provides more channels than are needed, so a single failure does not prevent the function. Independence separates the channels physically and electrically, so that one fire, flood or fault cannot disable more than one. Diversity uses different measured parameters, different equipment or different physical principles, so that a common cause, such as a design error or a shared environmental stress, does not disable every channel at once. Fail-safe design makes the most likely failures, such as a loss of power or a broken wire, produce a trip rather than block one. And testability lets each channel be tested at power without reducing protection below the required level.

Two shutdown systems

CANDU reactors have two shutdown systems, each fully capable of shutting the reactor down for every design basis event on its own, and each independent of the other and of the regulating system. CSA N290.1 sets the requirements, and REGDOC-2.5.2 requires two diverse, separate and independent means of shutdown. Shutdown system 1 uses spring-assisted shutoff rods, cadmium sandwiched in stainless steel, held above the core by electromagnetic clutches; when the clutches are de-energized, the rods drop vertically into the moderator, fully inserting in about two seconds. Shutdown system 2 injects a concentrated solution of gadolinium nitrate under helium pressure into the moderator through horizontal nozzles that cross the calandria; the poison disperses through the moderator within about a second. The two systems are physically separated, enter the core from different directions, use different measured signals where possible, and were deliberately designed by different teams.

Each shutdown system has three channels, D, E and F for SDS1 and G, H and J for SDS2. A channel trips when any of its parameters exceeds its setpoint, and the system trips when two of its three channels trip. Since 1990 the trip logic at Darlington has been implemented in dedicated shutdown system computers, programmable digital comparators that read the sensors, compare them with setpoints and open relays, with a simple, rigorously verified software design that is separate from the regulating system computers. The trip parameters include neutron overpower from in-core detectors, high log rate from ion chambers, high and low heat transport pressure, low core flow or low pump speed, low boiler level, low pressurizer level, high moderator level or temperature, low boiler feedline pressure and high reactor building pressure.

Voting logic

A channel can fail in two ways: it can fail to trip when it should, a dangerous failure, or it can trip when it should not, a spurious or safe failure. A one-out-of-one system is vulnerable to both. Adding channels in one-out-of-two improves the chance of tripping but doubles the spurious trip rate; two-out-of-two does the reverse. Two-out-of-three and two-out-of-four logic achieve both: they tolerate one failed channel in either direction. Two-out-of-four has a further advantage: one channel can be bypassed or placed in a tripped state for test or repair and the remaining three still provide two-out-of-three.

# Trip setpoint by square root of the sum of squares, and reliability of 2-out-of-3 and 2-out-of-4 voting.
import math
AL = 120.0                         # analytical limit, % full power (from safety analysis)
terms = {"process measurement": 1.5, "sensor accuracy": 0.5, "sensor drift": 0.8,
         "rack calibration": 0.3, "rack drift": 0.4, "temperature effects": 0.6}
bias = 0.5                         # one-directional term, added directly
srss = math.sqrt(sum(v * v for v in terms.values()))
print(f"channel uncertainty (SRSS): {srss:.2f} %FP, bias {bias} %FP")
print(f"limiting trip setpoint <= {AL - srss - bias:.2f} %FP (analytical limit {AL})")
q = 1.0e-3      # probability one channel fails to trip on demand
s = 1.0e-2      # probability per year one channel trips spuriously
def k_of_n_fail(k, n, p):          # system fails to trip if fewer than k channels trip
    return sum(math.comb(n, j) * (1 - p)**j * p**(n - j) for j in range(0, k))
def k_of_n_spurious(k, n, p):      # spurious trip if at least k channels trip spuriously
    return sum(math.comb(n, j) * p**j * (1 - p)**(n - j) for j in range(k, n + 1))
print(f"{'logic':>6s}{'fail on demand':>16s}{'spurious/yr':>13s}")
for k, n in [(1, 1), (1, 2), (2, 2), (2, 3), (2, 4)]:
    print(f"{k}oo{n}:{k_of_n_fail(k, n, q):16.2e}{k_of_n_spurious(k, n, s):13.2e}")
print(f"2oo4 with one channel bypassed for test behaves as 2oo3: {k_of_n_fail(2, 3, q):.2e}")

channel uncertainty (SRSS): 1.94 %FP, bias 0.5 %FP
limiting trip setpoint <= 117.56 %FP (analytical limit 120.0)
 logic  fail on demand  spurious/yr
1oo1:        1.00e-03     1.00e-02
1oo2:        1.00e-06     1.99e-02
2oo2:        2.00e-03     1.00e-04
2oo3:        3.00e-06     2.98e-04
2oo4:        4.00e-09     5.92e-04
2oo4 with one channel bypassed for test behaves as 2oo3: 3.00e-06

The voting table shows why two-out-of-three is the minimum used for reactor trip and why two-out-of-four is attractive. Two-out-of-three reduces the failure-on-demand probability from 10⁻³ to 3 × 10⁻⁶ while cutting the spurious trip probability by a factor of about 30. These numbers assume independent channel failures. Real systems also have common cause failures, which lesson 9 shows can dominate; the voting arithmetic only holds if independence is real.

From analytical limit to trip setpoint

The safety analysis shows that a trip at a certain value of a parameter, the analytical limit, protects the fuel or the pressure boundary in the limiting event. The instrument channel, however, has uncertainties: in the process measurement itself, in sensor accuracy and drift, in rack electronics, in temperature and radiation effects, and in calibration. The trip setpoint must be placed far enough from the analytical limit that, even with all these uncertainties, the channel trips before the analytical limit is reached. ANSI/ISA-67.04.01 sets out the method. Independent random uncertainties are combined by the square root of the sum of their squares, and known biases are added algebraically:

where LTSP is the limiting trip setpoint, AL the analytical limit, u_i the random uncertainty components and b_j the biases. The code applies this to a neutron overpower trip with an analytical limit of 120 percent of full power, giving a limiting setpoint near 117.6 percent. Plants usually set the actual setpoint with some further margin. They also define an allowable value, the furthest a setpoint may be found during a periodic test before the channel is declared inoperable, which accounts for the uncertainties that are not tested, such as the process measurement and the sensor's own drift.

Testing and maintenance

Each shutdown system channel is tested routinely at power. Because the systems trip on two of three channels, a single channel can be tripped deliberately to test its logic and actuation without shutting the reactor down; the other two channels still provide one-out-of-two protection while the test is under way. SDS1 rod drop tests and SDS2 injection valve tests are done on a schedule, with full actuation tests during outages. Unavailability of each shutdown system is calculated from test results and failure records, and REGDOC-2.6.1 requires reliability targets; for each shutdown system, the target unavailability is typically less than 10⁻³ years per year.

Engineered safety features actuation

Besides the two shutdown systems, a CANDU station has special safety systems for emergency core cooling and containment, each with its own instrumentation and logic. The emergency core cooling system starts on a combination of low heat transport pressure with a confirming signal such as high reactor building pressure or high moderator level, injecting water first from high-pressure accumulators or pumps and then recirculating from the building sump. Containment isolation closes ventilation dampers and valves on high building pressure or high radiation, and the vacuum building at a multi-unit station such as Darlington receives steam and air through pressure relief ducts. These systems follow the same principles as the shutdown systems: redundancy, separation, testing and independence from control, with requirements in the CSA N290 series.

Manual trip and bypasses

Every protection system includes a manual trip, so that operators can shut the reactor down at any time without depending on the automatic logic. Manual trip switches act directly on the final trip devices, bypassing as much of the logic as practical, so that a failure in the logic cannot prevent a manual trip. Operating bypasses are also needed: some trips must be blocked during start-up or shutdown, for example a low-power trip that would prevent raising power, or a low-flow trip during cold shutdown. Such bypasses are permitted only under defined plant conditions and are removed automatically when those conditions no longer hold, and their status is indicated in the control room.

Protection in the safety case

Protection systems connect directly to the safety analysis. For each event, the analysts assume the trip occurs at the analytical limit plus the channel's response time, using conservative assumptions about reactivity insertion rates, feedbacks and initial conditions. The results determine whether the fuel, the pressure boundary and containment stay within their acceptance criteria. If a setpoint, a response time or a detector arrangement changes, the analysis must be checked. Lise tells Hana that her group spends as much time confirming that installed equipment matches the analysis as it spends on the analysis itself. “The analysis protects the plant only if the hardware matches it,” she says.

Spurious trips also matter. Each unnecessary trip is a thermal and mechanical transient for the plant, a challenge to the safety systems and a loss of production. Two-out-of-three and two-out-of-four logic, well-designed signal conditioning and careful setpoint margins keep spurious trips rare without weakening protection. Plants track both kinds of failure, and the regulator does too.

Hana asks Lise why CANDU plants have two complete shutdown systems while light-water plants have one protection system with a diverse backup for anticipated transients. Lise explains that the CANDU design accepted a positive coolant void coefficient and a large core in exchange for natural uranium fuel and on-power refuelling, and the designers chose two fast, independent, fully capable shutdown systems so that a large loss-of-coolant accident would be terminated even if one system failed. Light-water reactors rely on strong negative feedback for many events and on a highly redundant single protection system, with diverse mitigation added after the analysis of anticipated transients without scram. Both approaches meet the same goal: the reactor is shut down whenever it must be, with a very high probability.