Performance evaluation of a new signal processing system design to improve CANDU SDS1 trip response during large break LOCA events

ABSTRACT

Performance of a recently developed signal processing system for CANDU (Canada Deuterium Uraniu) reactor shutdown system 1 (SDS1) is evaluated in this paper. The evaluation is carried out in MATLAB/Simulink software environment as well as with an existing power measurement and signal processing system. The new signal processing algorithm is obtained based on the synthesis of several first order low pass filters with different delayed time constants. Throughout this paper, a special attention has been paid to compare the new signal processing system with the existing one. The dynamic behavior of the new signal processing system in the practical large loss of coolant accidents (LLOCA) events has also been examined. Simulation results show that during the LLOCA event, the reactor trip time, as well as the peak power, is decreased remarkably. Through the simulation studies, it has convincingly demonstrated that the new signal processing system has significant advantages over the existing system in terms of the improved trip response and accommodation of the spurious trip immunity. This advantage will significantly enhance the safety margin, or will bring economical benefits to nuclear power plants.

KEYWORDS:

• Safety analysis
• CANDU type reactor
• SDS1
• signal processing

1. Introduction

For nuclear power plants all over the world, it is strictly required that the operation must be equipped with safety systems, such that even though any accident happens, the plant operation is preserved without affecting the public safety. Major functions of the nuclear safety systems are to prevent the plant physical barriers from damage and the radioactive substances from releasing. Furthermore, the safety systems have to mitigate the hazard caused by potential accidents in order to reduce or maintain the post-accident impact to a level as low as possible.

For CANDU (Canada Deuterium Uraniu) reactors, the safety philosophy is characterized by a high level of “Defence-in-Depth” based on a combination of redundancy, diversity, separation, and protection [1]. This safety philosophy is applied throughout the plant design, from the reactor regulating system and special safety systems, to the process control systems, and the electrical power supply. Special safety systems perform the main functions to shutdown the reactor, maintain it in a cooled condition, and prevent the release of radioactive material. They are fully automated and triggered without operator's intervention, although they can be activated manually upon request. They consist of: shutdown system 1 (SDS1), shutdown system 2 (SDS2), emergency core cooling system, and containment system. To be coincident with the Defence-in-Depth philosophy, each shutdown system is triggered independently, employing its own sensors, logic, and actuators, with triplicate logic of two-out-of-three and the ability to be tested online. SDS1 terminates the reactor operation and maintains the reactor in a safe condition by inserting 28 spring-assisted shutoff rods from the top of the reactor calandria to the reactor core. The system has sufficient speed and negative reactivity depth to reduce the reactor power to levels consistent with available cooling. SDS2 rapidly injects its high-pressure liquid poison, a strong neutron absorbing solution to perform the shutdown action.

According to the criteria designed by Canadian Nuclear Safety Commission (CNSC), the unavailability of CANDU SDS1 is required to be less than 10⁻³ years per year [2]. The online testing ability is required to ensure the availability of SDS1 such that the testing of SDS1 can be carried out without a reduction in the effectiveness of the system. Sufficient redundancy and independency allow the SDS1 to remain functional when a failure of any single component in the SDS1 happens. On-time actuation of SDS1 is critical to plant safety since the consequence could be much worse with a delayed shutdown in an accident with rapid transient. The response time of SDS1 is the key factor that affects the shutdown speed. The shorter the response time is, the faster the SDS1 can shutdown the reactor, resulting in a lower power surge. Thus, shortening the SDS1 response time could help improve the safety margin of the reactor operation. On the other hand, if the safety margin remains unchanged, shortening the SDS1 response time could help increase the reactor power, which brings more economic benefits for power plants.

Regarding how to improve the CANDU reactor safety margin, or the response time of SDS1, some works have been done over its history. A CANDU Owners Group Inc. report has specified the large loss of coolant accidents (LLOCA) safety margins in CANDU reactors with respect to the challenging of it inherent positive void effect [3]. The report particularly describes the continuing efforts and the raised solutions which have been made to potentially improve the safety margin of reactor operation. With respect to the originally conservative CANDU reactor designs, some theoretical methodologies, such as best-estimate and analysis of uncertainty methodology and new break opening modeling are proposed. Moreover, potential improvements in safety margins through physics design change are discussed, such as reducing the peak reactivity during the first few seconds of an LLOCA either through reducing the positive coolant void reactivity or increasing the rate of negative reactivity addition.

In the recent researches, more sight is focused on promoting the SDS1 response time. The response time of SDS1 is composed of sensor response time, trip logic decision-making time, trip relay logic time, and the time needed to fully insert the shutoff rods into the core. Primarily, the field programmable gate array (FPGA) hardware technique is used to reduce the trip logic decision-making time for CANDU reactors. An FPGA-based shutdown system for CANDU6 reactors is designed and implemented in a hardware-in-the-loop (HIL) environment by connecting it to a nuclear power plant simulator [4]. The test results are compared against those of a software-based programmable logic controller implementation of the same trip logic. It is shown that the FPGA implementation can shorten the response time of software-based (shutdown system) SDS implementation by as much as 86.66%. In a follow-up work [5], a CATHENA [6] thermal-hydraulic reactor model is established and used to simulations, which illustrates the functional relationship between the power peak values during a trip transient and the response time of the shutdown systems. Then the potential benefit of improving the safety margin of the reactor operation is quantified through a FPGA-based shutdown system implementation, which is validated by a HIL simulation environment. A review of the current state of FPGA systems in nuclear instrumentation and control is provided in [7]. Research on FPGA applications in shutdown system and online monitoring is reviewed not only for CANDU reactors, but also for pressurized water reactors (PWRs) and boiling water reactors (BWRs).

2. System analysis and proposed approach

SDS1 is one of the most important safety systems in CANDU nuclear power plants since it provides an effective and reversible shutdown process. Due to its importance to the plant safety, the design basis events for SDS1 are: loss of regulation, loss of coolant accidents (LOCA), loss of coolant flow (loss of Class IV power), loss of secondary side heat sinks, and loss of moderator cooling [8]. Within these design basis events, LOCA represents the most severe status of the postulated accident within the core. Among LOCA accidents, LLOCA illustrates the extreme conditions. As it is mentioned above, shortening the SDS1 response time could help improve the safety features in the plant. Therefore, for the purpose of enhancing plant safety, the current research work focuses on how to improve SDS1 fast response performance during LLOCA using software simulation technology.

A new signal processing system to improve the reactor shutdown system trip response during LLOCA events is developed in [9]. The option is to develop a new faster neutronic signal detection system using the existing in-core ion chambers' logarithm rate readings. Implementation of this system requires additional hardware to the existing SDS instrumentation while using the existing in-core ion chambers. Implementation of this option will prove to be very useful as it is an economical solution for already operating CANDU reactors, especially for those units that are more susceptible to reaching prompt criticality in case of LLOCA accidents due to their specific design features of the heat transport system (HTS).

The performance of the new signal processing system will be evaluated in this paper. Through simulations and analysis of the results, the system is to be demonstrated accessible and reliable. MATLAB/Simulink software simulation environment is employed. The simulation results will be compared with the results introduced by the existing system. Sensitivity of the spurious trips particularly for low power levels is analyzed. Figure 1 represents the design procedure of the new signal processing system and its validation against the existing system used in CANDU power plants.

Figure 1. Design procedure of the new signal processing system to improve CANDU SDS1 trip response during LLOCA events.

The structure of this paper is as follows. Section 1 introduces research background and motivation; Section 2 depicts the research objective and scope. Section 3 focuses on illustration of the new signal processing system and its implementation based on MATLAB/Simulink techniques. A comparison between the new and existing system is particularly represented. Section 4 represents the performance evaluation of the new signal processing system. Simulation results of the reactor trip time under different steady state power levels are compared to those of the existing system. Sensitivity analysis respect to the low power levels is performed. Furthermore, potential benefits resulted in by the utilization of the new system are evaluated. Conclusion and discussions are represented in Section 5.

3. Proposed system design

3.1 Schematic description of the new signal processing system

The options discussed in this research are limited to potential improvement to the SDS1, which includes the addition of new faster SDS trips specifically designed for LLOCA events. To address the poor signal-to-noise ratio (SNR) of neutronic signals, especially at low reactor power level, and insufficient speed of trip signal generation in case of LLOCA, a new neutronic signal processing algorithm is proposed. A modified relative rate trip concept is represented, which does not cause significant delays nor has substantial SNR restrictions. Schematic representation of the trip logic is shown below in Figure 2. Secondary side parameters (boiler level, feedwater flow rate, etc.) and HTS parameters (HTS pressure, etc.) are shown for illustration purposes as being part of the SDS1 control logics and will not be discussed here.

Figure 2. Schematic representation of the trip logic based on the new signal processing algorithm.

A signal processing unit is developed by using the detection of LLOCA signals with specific characteristics from the background noise. In the real environment with variable SNR, the single processing algorithm is adjusted with changing reactor power and SNR values to avoid the risk of affecting the accepted (predetermined) rate of false positive and false negative detections of LLOCA events. Simulation of the signal processing algorithm will confirm that in case of LLOCA the trip signal is generated in a shorter period than with the existing nuclear instrumentation based on neutronic flux measurement. Implementation of this option will prove to be very useful as it is an economical solution for already operating CANDU reactors, and to have important reference significance to other types of nuclear power plants such as PWR and BWR operation.

3.2 Comparison between the new and existing systems

In the existing CANDU nuclear power plant, SDS1 is the governing equipment to promptly terminate reactor operation when certain parameters exceed specified limits. SDS1 employs an independent triplicate logic system, which perceive the signal for reactor trip and release the spring assisted gravity drop shutoff rods. When LLOCA happens, the high log rate power trip dominates the reactor shutdown. Three ion chambers are provided to measure the log rate reactor power for SDS1 and convert the neutron flux signal to an effective current signal. The amplifiers are used to convert the ion chamber signal current into low source impendence voltage signals compatible with the regulating and protective system equipment for use in reactor power monitoring and control.

The output current from each ion chamber goes to an amplifier, which produces log neutron power, linear neutron power, and log rate signals. The log and linear power signals are used for conditioning and trip setpoint selection for other trip parameters. For the log rate signal trip signal, the log power signal is first differentiated and then smoothed by the second-order filter with a delayed time constant, since the result of differentiating a log power signal is a very noisy signal.

Figure 3 illustrates the design intention of the new signal processing system and its comparison to the existing system. There are two loops marked by different colors in this figure. One shows the existing trip system; the other represents the new designed system. “Power transient” is provided by the arranged LLOCA results, which represents power transient without a trip during LLOCA accident. Reactor power transient includes three typical noise levels which commonly exist in the nuclear power plants. “Scale” magnifies the power transient signal based on the 1.0 full power unit (FPU), as far as lower steady state power levels are included. “Log Voltage” represents a converting algorithm from input power signal to the output voltage signals. Considering the imperfect feature of the log amplifier due to the diode capacitance at low currents, a time delay represented by a 40 ms first order low pass filter is included. After that, for the existing system, the input signal is differentiated and smoothed by the second order filter. As for the comparison, in the new system, the input signal is smoothed by three first order low pass filters with respect to different time constants such as 50 ms, 20 ms, and 5 sec respectively; then two filtered signals from the 50 ms and 20 ms filters are compared to the other filtered signal from the 5 sec filter, and eventually their relative deviation from the 5 sec filtered signal are used to trigger the predetermined setpoint. “Switch” is used to execute the reactor trip logic. In the normal operations, the output signal is put as “0”; while when the trip happens (the input signal is over the setpoint); the output signal is put as “1.” “.AND.” logic is used to guarantee when trip happens to both loops, the eventual trip signal is generated; otherwise, resulting signal will be treated as a spurious trip signal. In this way, this system's spurious trip immunity ability is enhanced.

Figure 3. Design of the new signal processing system and its comparison to the existing system for LLOCA events.

In order to provide a hardware simulation environment which is consistent with the existing power plant design, an electronic voltage signal is used to represent the input for transient power levels. As it is stated previously, ion chambers are used to measure the reactor power in LLOCA events. The measured neutron flux signal is converted to the ion chamber current. The full power ion chamber current is within magnitude of 10⁻⁴ A. The SDS1 ion chamber will be required to monitor the rate of log neutron power from 10⁻⁷ to 200% of full power (%FP). This requirement sets the amplifier input current range from 10⁻¹¹ A to 10⁻⁴ A. The very high ratio of minimum to maximum current levels (7 decades) necessitates the use of logarithmic gain conversion in the amplifier. The log conversion gain is 0.4 volt per decade of input current. Therefore with the initial voltage level, 0.5 volts allocated for 10⁻¹¹ A (10⁻⁷%FP), 10⁻⁴ A (200%FP) is equal to 4.22 volts. The amplifier is equipped with a differentiating stage which provides the derivative of the logarithmic signal. The signal is used to detect power level transients and rate of increase in power level. In this way, the algorithm converting the input power level to voltage output is summarized in Table 1. The corresponding algorithm equation illustrating the relationship between the input of power level and the output of log amplifier is shown as below: (1) $$\begin{array}{c}\hfill \mathrm{Log}\mathrm{Amplifier}\mathrm{Voltage}(V)\\ \hfill =(\mathrm{Lo}{\mathrm{g}}_{10}\left(\mathrm{Reactor}\mathrm{Power}(\%\mathrm{FP})\right)+7)\times 0.4+0.5\end{array}$$(1)

Table 1. The algorithm of converting reactor power to log amplifier voltage output.

Reactor power (% FP)	Log of reactor power	Log amplifier output (V)
below 0.0000001	←7	<0.5
0.0000001	−7	0.5
0.000001	−6	0.9
0.00001	−5	1.3
0.0001	−4	1.7
0.001	−3	2.1
0.01	−2	2.5
0.1	−1	2.9
1	0	3.3
10	1	3.7
100	2	4.1
200	2.3	4.22
1000	3	4.5

In the current CANDU6 design, the high log rate setpoint is allocated as 10% present power per second (pp/sec) for LLOCA events. That means, during the LLOCA events when the reactor power keeps increasing till one time spot, at which the reactor power changing rate reaches 10% pp/sec, the trip mechanism will be automatically triggered and the reactor operation will be shutdown promptly. As a comparison, principles of both the existing and new systems' trip setpoints are illustrated in Figure 4. In Figure 4, the curve represents the reactor power transient, P₀ to P, within the time infinitesimal of Δt = T₁–T₀. Subsequently, the reactor power changing rate can be represented by (2) $$\frac{1}{{\mathrm{P}}_{\mathrm{o}}}\frac{\mathrm{dP}}{\mathrm{dt}}=\frac{1}{{\mathrm{P}}_{\mathrm{o}}}·\frac{\mathrm{P}-{\mathrm{P}}_{\mathrm{o}}}{\Delta \mathrm{t}}.$$(2)

Figure 4. Schematic diagram of the new trip setpoint designation.

It can be seen that, when the reactor power arrives at P at the time spot of T₁, the dynamic response values of the filters F₂ (50 ms) and F₃ (20 ms), are very close to P, due to their prompt time response characteristics; while the dynamic response value of the filter F₁ (5 sec), is approximate to P₀, due to its slow time response characteristic. For the new system, its dynamic response characteristics can be evaluated by (F₂–F₁)/F₁ and (F₃–F₁)/F₁. The related setpoint can be designated to the value of (P–P₀)/P₀, when the existing system is tripped at its high log rate setpoint, 10% pp/sec.

4. System implementation

4.1 Simulation

Figure 5 represents the transfer function algorithms to show the new system's principles. Three first-order low pass filters represented by F₁, F₂, and F₃ are used. Their time constants T₁, T₂, and T₃ are respectively 5 seconds, 50 milliseconds, and 20 milliseconds. The time constant of the log amplifier, T, which is negligible at high powers, is 40 milliseconds. In this design, two loops are designated to dispose the output signals from three filters. In each loop, “Comparator” is used to compare two output signals from filters and generate an output error signal; “Proportioner” is used to produce a ratio output signal based on the input error signal and the output signal from filter F₁. Then each ratio signal is compared with the trip setpoint to generate a trip signal; and an “.AND.” logic is used to combine both trip signals to generate the eventual trip signal. In this way, the potential spurious trip signal in each loop will be eliminated.

Figure 5. Transfer function chart of new signal processing system for LLOCA event.

Based on the transfer function illustrations, a MATLAB/Simulink simulation platform is created, in which the voltage input signal corresponding to the transient power level is incorporated. Reactor power transient includes three types of noises: sine wave of 60 Hz, 1000 Hz, and random noise of 200 Hz. The amplitude of the noises is 1.0% FPU.

Power transient is induced from the theoretical analysis of LLOCA event. Considering the delay effect of filters particularly as the proposed low pass filter with 5 second time delay, the response of the filters is observed. It takes more than 50 seconds for the 5 second low pass filter to reach a new steady state level. Therefore, in order to maintain the initial condition of full power steady state operation before the LLOCA event is issued, full power operation steady states of 60 seconds are pre-arranged. After 60 seconds, the LLOCA event is induced. For the existing system, power setpoint is designated by 10% pp/s. If the induced signal is over 10%pp/s, the output signal will be on 1; otherwise, the output will be still on 0.For the new system, three low pass filters F₁, F₂, and F₃ with time constant of 5 seconds, 50 milliseconds, and 20 milliseconds are used to process the power transient signal. Since the response of F₁ filter is much slower than the other two filters, it can be taken into account as a constant value in a very short time. Therefore, in the same time period, equations of (F₂–F₁)/F₁ and (F₃–F₁)/F₁ are used to measure the relative deviations between the fast filters F₂, F₃ and the slow filter, F₁. Based on these measurements, an internal setpoint can be designated, which is corresponding to the existing system's setpoint, 10% pp/s.

4.2 Performance evaluation of the new signal processing system

Simulation results about the trip time regarding the existing and new systems are represented in Table 2. In order to show comprehensive investigation from a design based point of view, simulations in terms of lower power levels such as 80% FP, 50% FP and 30% FP are included. From Table 2 it can be seen that for all the power levels the trip time induced by the new signal processing systems is shorter than that of the existing trip logic. Furthermore, no spurious trips show up to both trip logics. Therefore, it is concluded that, the new signal processing system achieves the faster trip response than the existing design in the same trip setpoint condition, and meanwhile suppresses the spurious trips. Subsequently, the new system will significantly enhance the power plant operation safety margin.

Table 2. Simulation results about the trip time regarding the existing and new signal processing systems.

	Trip time (millisecond)
		The new system
Initial power level (%FP)	The existing system	(F2–F1)/F1	(F3–F1)/F1	“AND”	Spurious trips in the new system
100	225.6	118.3	101	118.3	NO
80	225.4	117.7	100.6	117.7	NO
50	224.9	116.2	99.5	116.2	NO
30	223.9	113.4	97.2	113.4	NO

4.3 Sensitivity analysis

In order to evaluate the performance of the new signal processing system when reactor is operated in lower power levels, sensitivity cases are analyzed when reactor power is 20% FP, and 10% FP respectively. Simulation results are represented in Table 3. From the simulation results it can be seen that, for these low power levels, spurious trips will happen to the new signal processing system's each loop, such as (F₂–F₁)/F₁, and (F₃–F₁)/F₁. Therefore, the eventual trip signal also shows some spurious trips. Consequently, when the reactor is operated at the lower levels, more spurious trips show up.

Table 3. Sensitivity analysis to the trip performance of the new signal processing system at low reactor power levels.

	Trip time (millisecond)
		The new system
Initial power level (%FP)	The existing system	(F2–F1)/F1	(F3–F1)/F1	“AND”	Spurious trips in the new system
20	222.8	110^1	90.8^1	110^1	Yes^1
10	218.8	73.8^1	37.2^1	73.8^1	Yes^1

1: Two spurious trips happen in the steady state period.

In order to investigate the influence of the noise level to the spurious trips, more simulations are performed using lower noise level with half of the original noise amplitude, which is acceptable according to the current CANDU nuclear power plant noise analysis [10]. Simulations results are summarized in Table 4. It can be seen that, the spurious trips are essentially suppressed.

Table 4. Sensitivity analysis to the trip performance of the new signal processing system at low reactor power levels (noise amplitude is half of its original).

	Trip time (millisecond)
		The new system
Initial power level (%FP)	The existing system	(F2–F1)/F1	(F3–F1)/F1	“AND”	Spurious trips in the new system
20	224.5	113.6	97	113.6	NO
10	222.8	108.5	74.5	108.5	NO

4.4 Discussion and analysis of the benefit

The new signal processing system will bring the economic benefit to the industrial utilizations by reducing the reactor trip time during the LLOCA event. With respect to the new system's implementation, CANDU LLOCA analysis is performed and its induced benefit is evaluated by reactor kinetic modeling with the assistance of MATLAB/Simulink's simulation environment. Figure 6 represents the power transient curves corresponding to both the existing and new systems during the LLOCA event. Conservatively assuming the reactor trip time is decreased by 100 ms which is caused by implementation of the new signal processing system, the reactor peak power is reduced from 3.06 FPU to 2.61 FPU during the LLOCA event when the reactor is operated at the 1.0 FPU initial steady state condition. If the reactor is operated at a lower power such as 0.5 FPU, the peak power during the LLOCA event will be decreased from 1.53 FPU to 1.30 FPU. Then the reactor operation safety margin is significantly increased. In other words, if the reactor operation safety margin is not changed, the reactor operation power level could be considerably increased. For example, through a “core conversion” procedure, Bruce Power B units have been increased from 0.90 FPU to 0.93 FPU. Combining all four Bruce B units, this is a 100 megawatt increase in generation, enough electricity to power 100,000 Ontario homes [11]. Therefore, if the new signal processing system is equipped, the potential operation power level of Bruce B units could be very close to 1.0 FPU (other limitations are considered). This is an extra 200 megawatt increase in generation, which is equal to an economic benefit of about 0.2 million dollars per hour.

Figure 6. Estimation of the reactor peak power decrease during the LLOCA event caused by the new signal processing system.

5. Conclusions

Performance evaluation of a new signal processing system for CANDU reactor SDS1 is carried out in a MATLAB/Simulink based simulation platform. Using the developed simulation platform, the reactor trip response can be monitored during LLOCA tests. The test results are also validated against results from an existing CANDU plant SDS. It can be concluded that the developed new signal processing system produces faster reactor trip than that from the existing power plant SDS. At the same time, it immunizes the potential spurious trips. It also can be concluded that, through the equipment of the new signal processing system, it will provide enhanced safety margin for the existing power plant operation; or bring extra economical benefits for the units by increasing the current operation power level when the original safety margin is maintained.

Acknowledgments

This work was supported by the Natural Sciences and Engineering Research Council of Canada (NSERC) under grant number 210772.

Disclosure statement

No potential conflict of interest was reported by the authors.