The Implementation of Diverse Actuation System in ACPR1000 Nuclear Power Plants

In order to improve the capability of dealing with software common cause failure (CCF) of digital reactor protection and monitoring system (RPMS), the diverse actuation system (DAS) is introduced for ACPR1000 nuclear power plants. From economic and feasibility point of view, the solution of DAS sharing with RPMS sensors and actuators is suggested; after capturing the function requirement of DAS, the automatic functions and manual functions assigned to it are determined based on transient analysis of design basic accidents concurrent with software CCF of RPMS.+e independent verification proves that the reactor can be fallen back to and maintained at safety shutdown state, thanks to these DAS functions. Insight into probabilistic safety assessment proves significant reductions of risks are contributed. +e critical technical issues while implementing DAS, such as measures to ensure its diversity from RPMS, precautions for preventing from its spurious actuation, isolation and independency from RPMS, and its testability and maintainability, are deliberately settled to improve its engineering reliability and alleviate the impact on RPMS as far as possible. Field programmable gate array technology that is diversified from RPMS is chosen to build DAS of ACPR1000 nuclear power plant, and the commissioning test verifies that it is capable of performing its designed functions. At last, a set of DAS-specific, paper-based, and event-oriented emergency operating procedure is developed, verified, and validated. Until now, the DAS system has always been successfully operating in all ACPR1000 nuclear power plants for several years.


Background
Anticipated transient without scram (ATWS) is one of the accidents that must be considered in design of nuclear power plants. From the causes point of view, there are two types of ATWS: (1) ATWS caused by mechanical block of control rods, which is generally mitigated by emergency boration function; (2) reactor trip breakers fail to open due to failure of reactor protection and monitoring system (RPMS) or failure of reactor trip breakers themselves; generally a diverse actuation system (DAS) is necessary to alleviate the consequences of this kind of ATWS. At present, nearly all newly built nuclear power plants adopt digital control system (DCS), because of its function-centralization, software-sharing, and widespread use of communication technology, digital RPMS is vulnerable to software common cause failure (CCF), and countermeasures have to be taken while implementing DCS. DAS is considered as one of the most effective methods to deal with such failure.
As for mitigation of ATWS, nuclear regulations worldwide have been putting more emphasis on diversity and defense in depth of instrumentation and control systems in nuclear power plants (EuR organization [1], NRC [2], and IAEA [3]). e United States of America Federal Regulations 10CFR50 [4] clearly requires that "each pressurized water reactor must have equipment from sensor output to final actuation device, that is diverse from the reactor trip system, to automatically initiate the auxiliary (or emergency) feedwater system and initiate a turbine trip under conditions indicative of an ATWS. is equipment must be designed to perform its function in a reliable manner and be independent (from sensor output to the final actuation device) from the existing reactor trip system." Nuclear industry has been also making great efforts to the issue. Preckshot [5] and omas et al. [6] suggested some strategies and methods for performing diversity and defense in depth of instrumentation and control system. IAEA [7] identified and discussed common criteria for the design of DAS at nuclear power plants. Xiao et al. [8] illustrated the design principle and design flow of DAS. Zhan et al. [9] suggested a method to determine protection functions and parameter signals of DAS. Tian et al. [10] analyzed the acceptance criteria for DAS protection signals. As for implementation of DAS, He and Guo [11] proposed a miniaturization method to optimize the scale of DAS. Wang and Sun [12] identified the critical technical issues while implementing DAS. Yan et al. [13] suggested an overall verification method for DAS thanks to simulation technology. Probabilistic risk assessment (PRA) is also introduced into DAS design. Torok [14] investigated benefits and risks associated with DAS thanks to probabilistic analysis. Zhan and Zhang [15] discussed the PRA application in DAS design.
After the Fukushima nuclear accident, it is realized that for nuclear power plants, the beyond-design-basis accidents (BDBA) are also possible to happen and even their probabilities are extremely low (Miller et al. [16] and NNSA [17]).
is prompts the exploration of some new concepts such as accident tolerant fuels and also urges that a series of measures aiming to improve the ability to mitigate BDBAs have been taken for CPR1000 nuclear power plants; that is, the improved ACPR1000 nuclear power plant has come into being. Compared with the limited several special ATWS scenarios taken into account for CPR1000 nuclear power plants (EDF [18] and Zhang et al. [19]), the ATWS scenarios for ACPR1000 nuclear power plant tend to comprehensively cover the scenarios that all design-basis accidents (DBA) concurrent with failure of reactor trip (RT) as long as it may trigger RT or actuate engineered safety features (ESF). is paper gives an overview of the work related to DAS of ACPR1000 nuclear power plant; the scale of DAS is determined after capturing its functional requirements; the detailed design, the implementation, and procedure development on it are discussed. For ACPR1000 nuclear power plant, DAS provides comprehensive and diversified protection for RPMS; it is of great significance to reduce the risk induced by software CCF of RPMS and enhance the safety level.

Function Requirement of DAS
ACPR1000, as an improved generation II nuclear power plant derived from CPR1000 nuclear power plant, the implementation of DAS for it needs to be considered from the aspects of economy and feasibility. For ACPR1000, if DAS is set up in pursuit of absolute independency from RPMS just like that of AP1000 nuclear power plants (Westinghouse [20,21]), it is obviously unrealistic as a large number of DAS-specific instruments and actuators, such as circuit breakers and valves, have to be properly equipped with. Considering that DAS aims to deal with software CCF of digital RPMS and the CCF will not lead to unavailability of RPMS existing instruments and actuators if special precautions are reasonably taken, it is principally acceptable for DAS to share these instruments and actuators with RPMS (Zhou et al. [22]). erefore, ACPR1000 DAS is authorized to focus on dealing with software CCF of digital RPMS and is exempted from failure of RPMS instruments and process equipment; then, any addition of instruments and process equipment dedicated to DAS is avoided, which minimizes the impact on relative process systems at the same time.
As for digital RPMS, special measures have to be taken to ensure that probability of software CCF is extremely low (IEC [23]); functional diversity and equipment diversity are adopted to lower the probability to as low as an order of 10 −3 per reactor year. DAS, as the backup of RPMS, scale should be as small as reasonable; that is, the functions assigned to it should be as reduced as reasonable; its architecture and external interfaces should be as simplified as reasonable also. As a DBA concurrent with software CCF of RPMS is taken as a BDBA, the systems and equipment involved in mitigating the consequence of it need not meet the single-failure criterion (IEEE [24]), which means that the redundancy of them is avoided; therefore, for the purpose of minimizing DAS scale, the automatic functions and manual functions assigned to it should actuate only one train of the process systems and equipment, which are necessary to mitigate the consequences of ATWS; however, if transient analysis proves that both two trains of the process system and equipment are necessary to meet acceptance criteria of accident analysis, then DAS should be assigned to actuate both the train A and train B process systems and equipment. e following aspects are concerned to minimize the interactions with RPMS: (1) To ensure the independency of RPMS, sufficient physical and electrical isolation are carried out between DAS and RPMS (2) As spurious actuation of DAS may disturb operation of process systems, which may eventually result in actuation of RPMS, effective measures are taken to reduce the possibility of spurious actuation of DAS (3) In case of a DBA, if RPMS has actuated correctly, measures are taken to ensure that DAS will not actuate repeatedly In terms of human-machine interface (HMI), the function and scale of auxiliary control panel (ACP) is not changed after DAS is implemented; original manual controls and display signals on ACP are not changed either, because any change of ACP, as the only safety-classified HMI in ACPR1000 nuclear power plant, may implicate conclusions promised in safety analysis report (Sun and Jiang [25]).

Deterministic Method for DAS Functions.
For ACPR1000 nuclear power plant, dimension of DAS is technically based on the results of transient analysis of ATWS, as suggested in [1], the scope of transient analysis covers each Category II, III, and IV operating conditions listed in safety analysis report as long as it may trigger RT or actuate ESF; software CCF of RPMS is considered as a cumulative failure under these operating conditions. Full power operation is assumed as the initial condition as it represents the most possible operation condition during the whole lifespan of nuclear power plant. From the point of view of limiting DAS scale, analysis method of best estimation is chosen and realistic assumptions and calculation modes are adopted, conservative assumptions and calculation models while performing DBA safety demonstration are abandoned, because it may underestimate the ability of process systems (especially nonclassified systems) responding to initial events, and then some useful recovery strategies may be ignored.
In the event of a DBA concurrent with software CCF of RPMS, thanks to automatic and manual functions assigned to DAS, the reactor should be brought to and maintained at safety shutdown state (Zhao et al. [26]); that is, (1) the core maintains at subcritical state; (2) residual heat of the core can be continuously removed; and (3) radioactive release into the environment is within the limit. For ACPR1000 nuclear power plant, acceptance criteria of ATWS long-term accident analysis to safety shutdown state can be decoupled as follows: (1) For small break loss-of-coolant accidents (LOCA) and non-LOCA accidents, connection of residual heat removal system (RHRS) can guarantee longterm cooling of reactor; then it can be considered as reaching to safety shutdown state (2) For medium-or large-break LOCA, it is necessary to verify that operation of low-pressure safety injection system and containment spray system can effectively remove decay heat in a long time e grace period of operator's intervention is determined to be 20 minutes (Liu et al. [27]); that is, when a DBA concurrent with software CCF of RPMS occurs, if the interval from giving a clear accident indication in main control room to starting the required mitigation action is within 20 minutes, then the mitigation action should be actuated automatically; otherwise, it is assigned to be actuated manually by operator. For ACPR1000 nuclear power plant, critical safety functions assigned to DAS and their actuation types are shown in Table 1. e automatic protection logics and related set points are determined based on ATWS transient analysis at the same time, in order to prevent DAS from actuating RT and ESF before RPMS actuation when there is no software CCF existing in RPMS, as shown in Table 2, set points initialized in DAS are slightly higher or lower than those in RPMS so as to delay the automatic actuation of DAS, the time of delay ensures that DAS automatic action will not be triggered or will be automatically locked before actuation if RPMS works normally, locking signals directly come from feedback signals of relevant actuators, which are not affected by software CCF of RPMS.
Considering that software CCF of RPMS will also lead to failure of the nonprotection functions localized on safetyclassified DCS platform, such as flow rate control of auxiliary feedwater, regulating control of air dumping valves, etc., these functions are also necessary for the reactor to be fallen back to and to be maintained at safety shutdown state after the accidents, hence are assigned to DAS also.
As for alarm signals representing occurrences of the accidents, as well as indications of physical parameters monitoring reactor state and critical safety functions, they are necessary for post-accident diagnosis and orientation and thus are deployed on DAS, such as the radioactive alarm signals of steam generators and the indication of subcooling margin of coolant at core outlet, etc. (Wang et al. [28] and He et al. [29]). Considering that calculation process of reactor pressure vessel water level (RPVL) measurement based on differential pressure between the upper and lower extremities of the vessel is very complicated (He et al. [30]), RPVL measurement is not assigned to DAS to cut cost and limit its scale, monitoring of post-accident core cooling state on DAS is then depending on subcooling margin and temperature at core outlet (Wang et al. [31]), which has certain influence on development of accident mitigation strategy on DAS.

Independent Verification of DAS Functions.
Independent verification, aiming to verify that the reactor can be brought to and maintained at safety shutdown state thanks to DAS functions after DBAs concurrent with software CCF of RPMS, is performed by individuals not involved in DAS design. e typical transients, including loss of offsite power, feedwater line break, steam line break (SLB), steam generator tube rupture, and LOCA, are analyzed using CATHARE code. As an example, Table 3 shows the sequence of SLB concurrent with RPMS failure, after DAS automatic actions have made the reactor achieve a controlled state, the operator begins to manually cool and depressure primary system in a controlled way, as shown in Figure 1, the reactor is smoothly fallen back to conditions of RHRS connected (primary pressure below 3.2 MPa and temperature at core outlet below 180°C) and reaches safety shutdown state eventually.

Insight into PRA.
PRA is used to demonstrate and evaluate merits of DAS functions quantitatively. e core damage frequency (CDF) and large release frequency (LRF) without and with DAS functions are compared, as shown in Table 4, relatively significant reductions of CDF and LRF are earned with DAS functions, as these functions diversify reactor protection functions such as RT and ESF actuation; hence, the reliability of protection functions and capability of response to the accidents is improved considerably.

Diversity Design.
In order to prevent it from being affected by software CCF of RPMS, diversity between DAS and RPMS from sensor inputs (excluding sensors) to final outputs (excluding actuators) is comprehensively concerned, including the following: Science and Technology of Nuclear Installations (1) Sensor signals shared by DAS and RPMS are distributed to DAS before being inputted into RPMS; conventional analog circuits are adopted for these distribution modules (2) DAS is constructed with equipment and platform diversified from RPMS (3) Different from RT of RPMS by opening the reactor trip breakers, the RT signal emitted by DAS is sent to the power cabinets of rod control and position monitoring system, and RT is realized by directly cutting off the power supply of control rod drive mechanism

Prevention of Spurious Actuation.
To avoid spurious actuation caused by any credible single failure, the following measures are taken in DAS design: (1) "Energizing-actuation" design to prevent spurious actuation caused by power loss or component failure (2) Redundant input channels which distributed from protection groups are equipped to participate in voting logic, so that single-channel failure or channel bypass will not lead to spurious automatic actuation    (5) All manual operations on DAS are in the manner of "Operation + Release" to minimize the probability of triggering manual action by mistake (6) To avoid spurious actuation caused by fire in main control room, all manual and automatic operations on DAS are blocked after transferring over to remote shutdown station (7) DAS as a whole meets the seismic Class I requirements, which means it can withstand the safety shutdown earthquake

Isolation and
Independency. DAS has to be physically and electrically isolated from RPMS, the following measures are taken: (1) DAS cabinets and RPMS cabinets are arranged in different rooms, which belong to different fire zones (2) Sensor signals shared by DAS and RPMS are isolated. e isolation modules (relays, optic couplers, etc.) are planted in RPC and IDC cabinets which belong to safety-classified DCS, as shown in Figure 2 Figure 2. Meanwhile, DAS automatic action logic has redundant subsystems and the "2 out of 2" logic can prevent DAS spurious actuation while singly testing one subsystem. e bypass switch can bypass the fault input channel individually to ensure that DAS functions normally during maintenance. Figure 3, DAS is architecturally divided into two levels: field control level (Level 1) and human-machine interface level (Level 2). Level 1 is composed of field control stations (FCS), which perform the functions of signal processing such as acquisition and calculation. Level 2 is composed of DHP and server cabinet, which performs information management and humanmachine interaction function.

Field Control Level.
Applying field programmable gate array (FPGA) technology to instrument and control system of nuclear power plant has been becoming one of the hot research topics in recent years, many institutions and organizations have been actively exploring and studying in this topic (IEC [34], Bobrek et al. [35], J. Naser [36], Bobrek et al. [37], Chen et al. [38], Xiao et al. [39], and Wei et al. [40]). Considering that FPGA technology has been successfully practiced in quite a number of nuclear power plants around the world (Westinghouse [41], Liu et al. [42], and Ma et al. [43]), it is decided that DAS of ACPR1000 nuclear power plant is built based on FPGA technology. e Level 1 design keeps to traditional distributed control concept and aims to achieve high integration and simplification as far as reasonable. By performing function analysis and allocation, primary functions and secondary functions are allocated to different FPGA cards, thus reducing the coupling degree of each processing unit. A single FCS can support as much as 400 input variables to participate in protection and monitoring. FCS includes automatic logic cabinets and manual logic cabinets, both of which are possessed of functional redundancy configuration. Two automatic logic cabinets collect sensor signals conditioned and distributed by RPMS and generate automatic RT signal and ESF actuation signals after thresholds comparison and voting logic; "2 out of 2" logic is carried out to actuate RT and drive ESF. Two manual logic cabinets are functioning to realize equipment-level manual control logic and alarm management, manual control of regulating valves, as well as periodic test interface with other systems.

Human-Machine Interface Level.
e server in Level 2, which is nonredundant, performs information management, logging and archiving, as well as calculation functions. LDU is used for server normal maintenance, periodic test, and operating status display. Analog hardware and digital  interface are ergonomically arranged on DHP, analog hardware includes hand controllers necessary for operators to perform manual operations, digital interface is an operator work station with VDU, which provides system flowcharts and monitoring display, as well as control of equipment of process systems.

Verification and Validation. Verification and validation
of DAS equipment is performed during factory test and commissioning test. Factory test includes unit testing, integration testing, and system testing, which are carried out progressively. Unit testing focuses on individual unit such as input and output channel etc., integration testing addresses functions assigned on DAS such as automatic RT, ESF, etc., while system testing aims to verify the overall response capability of DAS such as response time, fault monitoring, etc.
Commissioning test aims to verify the capability of DAS performing its designed functions under designed conditions, that is, to validate the design requirement by comparing the conformity between test results and test criteria deduced from the designed function. Commissioning test is carried out from simple to complex and from the local to the whole, after finishing DAC cabinet function test and DHP function test, the automatic and manual logic test is carried out, and finally the combined logic test and system performance test are performed. By this, all the functions of DAS, including safety functions and operating functions, are thoroughly verified.

Procedure Development on DAS
Emergency operating procedure (EOP) is used to guide operators to control and fall back reactor to safety shutdown state after accidents (Mišák [44]). As DHP only supports a limited number of functions, and considering that some nonclassified functions can still be controlled on KIC when DAS is activated, these nonclassified functions are beneficial to control reactor state after accidents to some extent (e.g., normal spray on KIC can be used to depressure primary coolant system effectively); they are thus reasonably considered while developing EOP on DAS.
Different from the state-oriented EOP for KIC and ACP, a set of DAS-specific, simplified, paper-based, and eventoriented EOP is developed. After DAS is activated, RPMS fault alarm (KDS400KA/AA) will appear both on KIC and on DHP at the same time, following guidance of alarm sheet, the operation team will confirm RPMS failure and then initiate initial orientation to direct to appropriate accident mitigation strategy, thanks to which the reactor is fallen back to and maintained at safety shutdown state. During this period, safety state of the reactor is kept under constant surveillance by safety technical engineer, which constructs the defense in depth of emergency operating on DAS, as shown in Figure 4. After software CCF of RPMS has been repaired, the emergency organization will decide whether to exit DAS emergency operation after estimating the reactor state thoroughly. e set of EOP has been verified and  Science and Technology of Nuclear Installations validated on full-scope simulator of ACPR1000 nuclear power plant.

Conclusion
Implementation of DAS can specifically mitigate the consequences of DBA concurrent with software CCF of digital RPMS, for commercial mature nuclear power plants, a balance between cost and benefit has to be sought while implementing DAS. As for ACPR1000 nuclear power plant, the solution that DAS sharing instruments and actuators with RPMS can reduce the impact on existing process systems as reasonable as possible and achieve the purpose of coping with software CCF of RPMS effectively with as low cost as possible.
We hope that the reactor can be fallen back to and maintained at safety shutdown state thanks to DAS in case of DBA concurrent with software CCF of RPMS. In order to limit the scale of DAS, DAS should, unless necessary, only actuate one train of the process systems and equipment necessary to mitigate the consequences of ATWS as far as possible. According to a grace period of 20 minutes for operator intervention, the automatic protection functions including their set points and manual functions to be assigned to DAS are discriminated based on transient analysis of ATWS; the other functions to be assigned to DAS to meet the goal of accident mitigation are also screened out, the independent verification performed by individuals not involved in DCS design proves that the reactor can be fallen back to and maintained at safety shutdown state thanks to these DAS functions; what is more, PRA demonstrates significant reductions of risks are contributed. While designing and implementing DAS, special precautions are taken to ensure its diversity, to prevent its spurious actuation, to realize its isolation and independency from RPMS, and to support its testability and maintainability. FPGAbased technology that is diversified from RPMS is chosen to build DAS of ACPR1000 nuclear power plant, which involves the specific implementation of field control level and human-machine interface level. Finally, a set of paper-based and event-oriented EOP dedicated to DAS is developed. At present, the DAS has always been successfully operating in all ACPR1000 nuclear power plants for several years; it also provides a technical reference for DAS design of the generation III nuclear power plant HPR1000.   Data Availability e data used in this paper are part of the plant operation data, which are proprietary and cannot be disclosed.