Reactor protection and shutdown systems

Dr. Lise Fortin leads the safety analysis work that supports the setpoints in the technical specifications for TVA's pressurized water reactor fleet. She shows Hana a single table: the reactor trip functions of the reactor protection system with their setpoints and allowable values. “Every line on this page is backed by an analysis,” she says. “For each accident in chapter 15 of the safety analysis report, we show that a trip occurs in time to protect the fuel and the reactor coolant system, using the setpoint and response time on this table, with uncertainties applied in the conservative direction.”

This lesson explains how protection systems are designed: the safety functions they perform, the principles of redundancy, independence, diversity and fail-safe design, the voting logic that balances failure to trip against spurious trips, the derivation of trip setpoints from analytical limits, and testing. The CANDU shutdown systems and the PWR reactor protection and engineered safety features actuation systems are described in turn.

What protection must do

Protection systems detect conditions that could lead to fuel damage or to failure of the pressure boundary or containment and take automatic action to prevent it. The most important action is to shut the reactor down quickly. Others start emergency core cooling, isolate containment, start auxiliary feedwater or emergency power, and close steam lines. Protection systems are designed for high reliability on demand and must work even when the plant is in an abnormal state that the control systems failed to prevent or caused.

The design principles are common to all designs and appear in national and international standards. Redundancy provides more channels than are needed, so a single failure does not prevent the function. Independence separates the channels physically and electrically, so that one fire, flood or fault cannot disable more than one. Diversity uses different measured parameters, different equipment or different physical principles, so that a common cause, such as a design error or a shared environmental stress, does not disable every channel at once. Fail-safe design makes the most likely failures, such as a loss of power or a broken wire, produce a trip rather than block one. And testability lets each channel be tested at power without reducing protection below the required level.

The reactor protection system

A PWR's reactor protection system monitors process and neutron variables in four redundant channels, each in its own instrument cabinet with its own power supply and separate cable routes. Each channel compares its measurements with setpoints and sends a trip signal to the logic trains. Two redundant trains of logic each combine the channel trips on a two-out-of-four basis and open the reactor trip breakers, which cut power to the control rod drive mechanisms so that all rods fall by gravity into the core in about two seconds. The engineered safety features actuation system uses the same kind of channels to start safety injection, containment isolation and spray, auxiliary feedwater and main steam isolation. 10 CFR 50.55a(h) requires protection systems to meet IEEE 279-1971 or IEEE 603-1991, depending on the plant's licensing date, and General Design Criteria 20 to 29 in Appendix A to 10 CFR 50 set the underlying requirements.

Typical reactor trip functions include power range high neutron flux, with a high and a low setpoint; power range flux rate; overtemperature ΔT and overpower ΔT, which protect against departure from nucleate boiling and excessive fuel power using the loop temperature difference with variable setpoints that depend on pressure, temperature and axial flux difference; pressurizer high and low pressure; pressurizer high level; low reactor coolant flow and reactor coolant pump undervoltage or underfrequency; steam generator low-low level; turbine trip above a power threshold; and safety injection actuation. The Anticipated Transients Without Scram rule, 10 CFR 50.62, also requires PWRs to have diverse equipment, independent of the reactor protection system, to trip the turbine and start auxiliary feedwater, often called AMSAC in Westinghouse plants.

Voting logic

A channel can fail in two ways: it can fail to trip when it should, a dangerous failure, or it can trip when it should not, a spurious or safe failure. A one-out-of-one system is vulnerable to both. Adding channels in one-out-of-two improves the chance of tripping but doubles the spurious trip rate; two-out-of-two does the reverse. Two-out-of-three and two-out-of-four logic achieve both: they tolerate one failed channel in either direction. Two-out-of-four has a further advantage: one channel can be bypassed or placed in a tripped state for test or repair and the remaining three still provide two-out-of-three.

# Trip setpoint by square root of the sum of squares, and reliability of 2-out-of-3 and 2-out-of-4 voting.
import math
AL = 120.0                         # analytical limit, % full power (from safety analysis)
terms = {"process measurement": 1.5, "sensor accuracy": 0.5, "sensor drift": 0.8,
         "rack calibration": 0.3, "rack drift": 0.4, "temperature effects": 0.6}
bias = 0.5                         # one-directional term, added directly
srss = math.sqrt(sum(v * v for v in terms.values()))
print(f"channel uncertainty (SRSS): {srss:.2f} %FP, bias {bias} %FP")
print(f"limiting trip setpoint <= {AL - srss - bias:.2f} %FP (analytical limit {AL})")
q = 1.0e-3      # probability one channel fails to trip on demand
s = 1.0e-2      # probability per year one channel trips spuriously
def k_of_n_fail(k, n, p):          # system fails to trip if fewer than k channels trip
    return sum(math.comb(n, j) * (1 - p)**j * p**(n - j) for j in range(0, k))
def k_of_n_spurious(k, n, p):      # spurious trip if at least k channels trip spuriously
    return sum(math.comb(n, j) * p**j * (1 - p)**(n - j) for j in range(k, n + 1))
print(f"{'logic':>6s}{'fail on demand':>16s}{'spurious/yr':>13s}")
for k, n in [(1, 1), (1, 2), (2, 2), (2, 3), (2, 4)]:
    print(f"{k}oo{n}:{k_of_n_fail(k, n, q):16.2e}{k_of_n_spurious(k, n, s):13.2e}")
print(f"2oo4 with one channel bypassed for test behaves as 2oo3: {k_of_n_fail(2, 3, q):.2e}")

channel uncertainty (SRSS): 1.94 %FP, bias 0.5 %FP
limiting trip setpoint <= 117.56 %FP (analytical limit 120.0)
 logic  fail on demand  spurious/yr
1oo1:        1.00e-03     1.00e-02
1oo2:        1.00e-06     1.99e-02
2oo2:        2.00e-03     1.00e-04
2oo3:        3.00e-06     2.98e-04
2oo4:        4.00e-09     5.92e-04
2oo4 with one channel bypassed for test behaves as 2oo3: 3.00e-06

The voting table shows why two-out-of-three is the minimum used for reactor trip and why two-out-of-four is attractive. Two-out-of-three reduces the failure-on-demand probability from 10⁻³ to 3 × 10⁻⁶ while cutting the spurious trip probability by a factor of about 30. These numbers assume independent channel failures. Real systems also have common cause failures, which lesson 9 shows can dominate; the voting arithmetic only holds if independence is real.

From analytical limit to trip setpoint

The safety analysis shows that a trip at a certain value of a parameter, the analytical limit, protects the fuel or the pressure boundary in the limiting event. The instrument channel, however, has uncertainties: in the process measurement itself, in sensor accuracy and drift, in rack electronics, in temperature and radiation effects, and in calibration. The trip setpoint must be placed far enough from the analytical limit that, even with all these uncertainties, the channel trips before the analytical limit is reached. ANSI/ISA-67.04.01 sets out the method, which Regulatory Guide 1.105 endorses. Independent random uncertainties are combined by the square root of the sum of their squares, and known biases are added algebraically:

where LTSP is the limiting trip setpoint, AL the analytical limit, u_i the random uncertainty components and b_j the biases. The code applies this to a neutron overpower trip with an analytical limit of 120 percent of full power, giving a limiting setpoint near 117.6 percent. Plants usually set the actual setpoint with some further margin. They also define an allowable value, the furthest a setpoint may be found during a periodic test before the channel is declared inoperable, which accounts for the uncertainties that are not tested, such as the process measurement and the sensor's own drift.

Testing and maintenance

Each reactor protection channel is tested at power through channel functional tests, in which test signals are injected to confirm that the bistable trips and the logic responds, with the channel in bypass or tripped as the technical specifications allow. Reactor trip breakers are tested periodically, including their undervoltage and shunt trip attachments; the 1983 Salem events, in which both trip breakers failed to open on demand because of undervoltage attachment failures and the reactor was tripped manually, showed why. Response time tests confirm that each function acts within the time assumed in the safety analysis. The maintenance rule, 10 CFR 50.65, requires the licensee to monitor the performance of these systems against goals.

Engineered safety features actuation

The engineered safety features actuation system starts the systems that mitigate accidents. Safety injection starts on low pressurizer pressure, high containment pressure or low steam line pressure; containment isolation and containment spray start on rising containment pressure; main steam isolation on low steam line pressure or high steam flow; and auxiliary feedwater on low-low steam generator level, loss of main feed pumps or loss of offsite power. Each function uses redundant channels and voting similar to the reactor trip. Many ESFAS signals also trip the reactor, so that the reactor is shut down whenever a safety system starts.

Manual trip and bypasses

Every protection system includes a manual trip, so that operators can shut the reactor down at any time without depending on the automatic logic. Manual trip switches act directly on the final trip devices, bypassing as much of the logic as practical, so that a failure in the logic cannot prevent a manual trip. Operating bypasses are also needed: some trips must be blocked during start-up or shutdown, for example a low-power trip that would prevent raising power, or a low-flow trip during cold shutdown. Such bypasses are permitted only under defined plant conditions and are removed automatically when those conditions no longer hold, and their status is indicated in the control room.

Protection in the safety case

Protection systems connect directly to the safety analysis. For each event, the analysts assume the trip occurs at the analytical limit plus the channel's response time, using conservative assumptions about reactivity insertion rates, feedbacks and initial conditions. The results determine whether the fuel, the pressure boundary and containment stay within their acceptance criteria. If a setpoint, a response time or a detector arrangement changes, the analysis must be checked. Lise tells Hana that her group spends as much time confirming that installed equipment matches the analysis as it spends on the analysis itself. “The analysis protects the plant only if the hardware matches it,” she says.

Spurious trips also matter. Each unnecessary trip is a thermal and mechanical transient for the plant, a challenge to the safety systems and a loss of production. Two-out-of-three and two-out-of-four logic, well-designed signal conditioning and careful setpoint margins keep spurious trips rare without weakening protection. Plants track both kinds of failure, and the regulator does too.

Hana asks Lise why CANDU plants have two complete shutdown systems while light-water plants have one protection system with a diverse backup for anticipated transients. Lise explains that the CANDU design accepted a positive coolant void coefficient and a large core in exchange for natural uranium fuel and on-power refueling, and the designers chose two fast, independent, fully capable shutdown systems so that a large loss-of-coolant accident would be terminated even if one system failed. Light-water reactors rely on strong negative feedback for many events and on a highly redundant single protection system, with diverse mitigation added after the analysis of anticipated transients without scram. Both approaches meet the same goal: the reactor is shut down whenever it must be, with a very high probability.