1

Signal processing system design for improved shutdown system 1

of CANDU reactor in large break of LOCA events 2

3

Hossam A. Gabera,b*, Lingzhi Xiaa, Manir U. Ishama, Vladimir Ponomarevc 4

5 a Faculty of Energy Systems and Nuclear Science, University of Ontario Institute of 6

Technology, 2000 Simcoe Street North, Oshawa, L1H 7K4 ON, Canada 7 b Faculty of Engineering and Applied Science, University of Ontario Institute of 8

Technology, 2000 Simcoe Street North, Oshawa, L1H 7K4 ON, Canada 9 c Megawatt Solutions Inc., Ontario, Canada 10

11

HIGHLIGHTS 12

An innovative scheme of the neutronic signal processing system to improve the CANDU 13

reactor SDS1 performance is proposed. 14

A point kinetic model is developed to fundamentally analyze the CANDU large break of 15

LOCA transient. 16

A MATLAB/Simulink simulation platform is established to model the existing CANDU 17

SDS1 signal processing system and its trip logics. 18

A specific design of the proposed signal processing system for CANDU SDS1 is performed 19

and implemented. 20

21

ABSTRACT 22

For CANDU reactors, several options to improve CANDU nuclear power plant operation 23

safety margin have been investigated in this paper. A particular attention is paid to the 24

response time of CANDU shutdown system number 1 (SDS1) in case of large break loss 25

of coolant accident (LLOCA). Based on point kinetic method, a systematic fundamental 26

analysis is performed to CANDU LLOCA event, and the power transient signal is 27

generated. In order to improve the SDS1 response time during LLOCA events, an 28

innovative power measurement and signal processing system is particularly designed. The 29

new signal processing system is implemented with the input of the LLOCA power transient, 30

and the simulation results of the reactor trip time and signal are compared to those of the 31

existing system in CANDU power plants. It is demonstrated that the new signal processing 32

system can not only achieve a shorter reactor trip time than the existing system, but also 33

accommodate the spurious trip immunity. This will significantly enhance the safety margin 34

for the power plant operation, or bring extra economical benefits to the power plant units. 35

2

36

Keywords: CANDU, SDS1, LOCA, power measurement, signal processing, safety margin, 37

reactor trip 38

39

40

1. Introduction 41

1.1 CANDU reactor safety systems 42

In the world, the nuclear power plant must be equipped with safety systems, such that if 43

any anticipated or unanticipated accident happens, the plant operation is maintained 44

without affecting the public safety. Major functions of the nuclear safety systems are to 45

prevent the plant physical barriers from damage and prevent the radioactive substances 46

from releasing. Furthermore, the safety systems have to mitigate the hazard caused by 47

potential accidents in order to reduce or maintain the post-accident impact to a level as low 48

as possible. 49

Three main objectives of nuclear reactor safety systems are to shutdown the reactor, 50

maintain it in a cooled condition, and prevent the release of radioactive material. For 51

CANDU reactors, the major safety systems are categorized into reactor shutdown systems, 52

emergency core cooling system, and containment systems. Shutdown systems are used to 53

stop the chain reactor and shut down the reactor operation. Emergency core cooling system 54

is used to refill the reactor fuel channels with coolant and remove residual or decay heat 55

from the fuel. Containment systems could prevent radioactivity release, which may escape 56

from the reactor core, to the environment. 57

CANDU reactor designs have a typical positive coolant void coefficient, as well as a small 58

power coefficient. This implies that steam generated in the reactor coolant will increase the 59

reaction rate, which in turn will increase the reactor power and generate more steam. This 60

is usually considered as a negative feature in the power reactor design. The reactivity 61

devices, such as adjustor rods, liquid zone controllers, and mechanical control absorbers 62

are capable to fulfill the responsibility of compensating the positive or negative reactivity 63

so as to control the reactor power in an appropriate rate or maintain the reactor operated 64

within an acceptable power range. However, when an accident happens, the induced 65

reactivity represents a fast change rate and a relatively large change range, which 66

significantly exceeds the regulating ability of those reactivity devices. An extreme scenario 67

is the large break of loss of coolant accident (LLOCA), which induces very fast positive 68

reactivity insertion such that the reactivity devices cannot meet the requirement to quickly 69

resist the reactor power increase [1]. Therefore, the shutdown systems are designed to meet 70

the speed requirements of such a scenario. In CANDU reactors, there are two separate 71

shutdown systems: shutdown system number 1 (SDS1), and shutdown system number 2 72

3

(SDS2). Each of them performs the function of fast shutting down the reactor under 73

LLOCA conditions independently, and both of them are triggered by the 2-out-of-3 (2oo3) 74

redundancy logic from two separate detection systems, respectively. Fig. 1 represents the 75

SDS1 and SDS2 located in CANDU reactors [2]. Reactor operation is terminated when a 76

neutronic or process parameter reaches an unacceptable range. Design of two shutdown 77

systems in CANDU reactors represents that postulated accident events coincident with 78

failure of shutdown are incredible, and consequently beyond the design basis. 79

80

81

Fig. 1 CANDU SDS1 and SDS2 [2] 82

83

SDS1 terminates the reactor operation and maintains the reactor in a safe condition by 84

inserting 28 spring-assisted shutoff rods from the top of the reactor calandria to the reactor 85

core. The system has sufficient speed and negative reactivity depth to reduce the reactor 86

power to levels consistent with available cooling. SDS2 rapidly injects its high-pressure 87

liquid poison, a strong neutron absorbing solution to perform the shutdown action. The 88

parameters chosen are different from those used for SDS1. 89

4

1.2 Research motivation 90

As one of the safety systems in CANDU nuclear power plant, SDS1 has to meet strict 91

requirements: shutdown the reactor and keep it subcritical whenever necessary; have high 92

availability; have online testing ability; have enough redundancy and independency; 93

perform its function on time whenever necessary [3]. 94

To obtain the mentioned qualifications, SDS1 is designed to be a triplicate, relay logic 95

applied system [4]. There are a total of three trip channels (D, E, and F) with completely 96

independent and physically separated power supplies, trip parameter sensors, 97

instrumentation trip logic and annunciation. Each trip channel has exactly the same 98

functionality. The reliability and availability criteria are met with the triple redundancy 99

while the online testing ability is allowed by the independence between each channel. 100

Meanwhile spurious trips are also effectively prevented through a two out of three (2oo3) 101

vote of the three outputs of the triple redundant trip channels. This majority voting logic 102

permits the reactor trip signal to be released only when at least two trip channels are on trip 103

status, which reduces the probability of a false trip decision. 104

According to the criteria designed by CNSC, the unavailability of CANDU SDS1 is 105

required to be less than 10-3 years per year [3]. The online testing ability is required to 106

ensure the availability of SDS1 such that the testing of SDS1 can be carried out without a 107

reduction in the effectiveness of the system. Sufficient redundancy and independency allow 108

the SDS1 to remain functional when a failure of any single component in the SDS1 happens. 109

On-time actuation of SDS1 is critical to plant safety since the consequence could be much 110

worse with a delayed shutdown in an accident with rapid transient. The response time of 111

SDS1 is the key factor that affects the shutdown speed. The shorter the response time is, 112

the faster the SDS1 can shutdown the reactor, resulting in a lower power surge. Thus 113

shortening the SDS1 response time could help improve the safety margin of the reactor 114

operation. On the other hand, if the safety margin remains unchanged, shortening the SDS1 115

response time could help increase the reactor operation power, which brings more 116

economic benefits for power plants. 117

With respect to how to improve the CANDU reactor safety margin, or the response time of 118

SDS1, some works have been done over its history. A CANDU Owners Group Inc. (COG) 119

report has specified the large LOCA safety margins in CANDU reactors with respect to the 120

challenging of it inherent positive void effect [1]. The report particularly describes the 121

continuing efforts and the raised solutions which have been made to potentially improve 122

the safety margin of reactor operation. With respect to the originally conservative CANDU 123

reactor designs, some theoretical methodologies such as Best-Estimate and Analysis of 124

Uncertainty Methodology (BEAU) and new break opening modeling are proposed. 125

Moreover, potential improvements in safety margins through physics design change are 126

discussed, such as reducing the peak reactivity during the first few seconds of a LLOCA 127

5

either through reducing the positive coolant void reactivity or increasing the rate of 128

negative reactivity addition. 129

In the recent researches, more sight is focused on promoting the SDS1 response time. The 130

response time of SDS1 is composed of sensor response time, trip logic decision-making 131

time, trip relay logic time, and the time needed to fully insert the shutoff rods into the core. 132

Primarily, the FPGA hardware technique is used to reduce the trip logic decision-making 133

time for CANDU reactors. An FPGA-based shutdown system for CANDU6 reactors is 134

designed and implemented in a hardware-in-the-loop (HIL) environment by connecting it 135

to a nuclear power plant simulator [5]. The test results are compared against those of a 136

software-based PLC implementation of the same trip logic. It is shown that the FPGA 137

implementation can shorten the response time of software-based SDS implementation by 138

as much as 86.66%. In a follow-up work [6], a CATHENA [7] thermal-hydraulic reactor 139

model is established and used to simulations, which illustrates the functional relationship 140

between the power peak values during a trip transient and the response time of the 141

shutdown systems. Then the potential benefit of improving the safety margin of the reactor 142

operation is quantified through a FPGA-based shutdown system implementation, which is 143

validated by a HIL simulation environment. A review of the current state of FPGA Systems 144

in nuclear instrumentation and control is provided in [8]. The research on FPGA 145

applications in shutdown system and online monitoring is reviewed not only for CANDU 146

reactors, but also for PWRs and BWRs. 147

Besides this, another important area, in which the potential benefit will be obtained, is to 148

look for fasting the sensor response time, i.e. improving the in-core flux detector 149

measurements for power transients. B. Arsenault specified the CANDU6 in-core detector 150

systems in [9]. A comprehensive test of the dynamics of the shutdown systems including 151

their flux detectors is performed and reported in [10]. The time required for the signals to 152

drop to a predesigned trip fraction is plotted as a function of the detectors’ position. This 153

provides a good reference for researchers to potentially improve the shutdown system by 154

optimizing the detectors’ position. For PWR reactors, a new type of inconel self-powered 155

neutron detector is designed to replace the current Pt in-core detectors [11]. This inconel 156

detector shows good signal-to-noise ratio, which also helps to increase the detector’s 157

response time so as to improve the shutdown system performance. Several filtering 158

methods are used to compensate the delayed signals of Rhodium self-powered neutron 159

detectors in PWR [12-14]. Based on these works, three digital dynamic compensation 160

methods using robust filtering are investigated and manipulated with respect to improving 161

both Rhodium and Vanadium self-powered neutron detectors’ performance, such that they 162

can provide an apparent response speed with the noise suppressed [15-16]. This helps to 163

perform an accurate on-line monitoring function for reactor core surveillance. However, 164

for reactor shutdown process with a very fast response, these methods cannot be 165

significantly taken into account. 166

6

1.3 Objectives and approaches 167

SDS1 is one of the most important safety systems in CANDU nuclear power plants since 168

it provides an effective and reversible shutdown process. Due to its importance to the plant 169

safety, the design basis events for SDS1 are designated as: loss of regulation (LOR), loss 170

of coolant accidents (LOCA), loss of coolant flow (loss of Class IV power), loss of 171

secondary side heat sinks, and loss of moderator cooling [17]. Within these design basis 172

events, LOCA represents the most severe status of the postulated accident within the core. 173

Among LOCA accidents, LLOCA illustrates the extreme conditions. As it is mentioned 174

above, shortening the SDS1 response time could help improve the safety features in the 175

plant. Therefore, with a purpose of enhancing plant safety, the current research work 176

focuses on how to improve SDS1 fast response performance during LLOCA using software 177

simulation and digital hardware implementation technology. 178

An innovative idea to improve the reactor power measurement sensitivity during large 179

LOCA accident transients is proposed [18]. The option is to develop a new faster neutronic 180

signal processing system using the current in-core neutron detectors’ log rate readings. 181

Implementation of this system requires additional hardware to the existing SDS 182

instrumentation; however it still uses the existing in-core neutron flux detectors and ion 183

chambers. Implementation of this option will prove to be very useful as it is an economical 184

solution for already operating CANDU reactors, especially for those units that are more 185

susceptible to reaching prompt criticality in case of LLOCA accidents due to their specific 186

design features of the Heat Transport System (HTS). 187

The design of the faster neutronic signal detection system will be detailed. The procedure 188

is to build a software simulation platform which is used to demonstrate the accessibility 189

and reliability of the proposed idea. MATLAB/Simulink software simulation environment 190

is employed. Implementation and commissioning will be performed. The simulation results 191

will be compared with the results introduced by the existing system. This will demonstrate 192

the advantaged performance of the new signal processing systems. 193

The structure of this paper is as follows. Section 1 introduces the CANDU safety status and 194

the motivation of this research, as well as the proposed research scope and methodology. 195

Section 2 focuses on the numerical simulation and analysis of the CANDU reactor power 196

transients during the LLOCA event. Point kinetic method is employed. Section 3 illustrates 197

the function of the existing signal processing system. MATLAB/Simulink simulation 198

platform is established to generate the trip signal when LLOCA happens. Section 4 199

represents the specific design of the new signal processing system and its implementations. 200

Simulation result of the reactor trip time is compared to that of the existing system. 201

Furthermore, potential benefits resulted in by the new system are evaluated. Conclusion 202

and discussions are represented in Section 5. 203

7

2. Power transient studies during the large break of LOCA (LLOCA) 204

event 205

2.1 Interpretation of the LLOCA event 206

A typical LLOCA event of CANDU reactors is referenced in [1]. The case particularly 207

describes the normalized peak bundle power following a 100% break in a coolant pump 208

suction pipe. Accident description starts with some assumed unfavorable conditions as 209

required by licensing, and at the same time the thermal-hydraulics analytical models are 210

chosen to be conservative to produce the maximum coolant void reactivity. 211

Within 2 seconds following a large break steam is produced in the reactor core and coolant 212

is ejected from both reactor inlet and outlet headers. Trip signals including high neutron 213

flux and high log rates are issued in about 400 milliseconds. Peak reactivity is +4.3 mk at 214

900 milliseconds. Following this event, the reactor shut-down rods begin to enter the core 215

at 900 milliseconds. It takes the shut-down rods 2 seconds to drop into the reactor core till 216

it is fully inserted to perform the maximum negative reactivity compensation, -80 mk. It is 217

mentioned that, shutdown system decreases the reactor reactivity to -69 mk at 3.16 seconds. 218

In other words, the net positive reactivity (internal feedback) of the core at this time can be 219

evaluated. Furthermore, it is also represented that, the total positive reactivity addition at 220

the time of 10 seconds is about +15mk, which should be removed by the shutdown rods. 221

Thus, the reactor is rendered safe. During this transient process, a peak power of 3.5 full 222

power unit (FPU) arrives at 1.16 seconds. 223

2.2 Point kinetic reactor modeling for the LLOCA transient 224

There are several methods to deal with modeling and simulation for CANDU reactor 225

LLOCA transient. Usually, Canadian industry units, such as AECL or Candu Energy Inc. 226

employ the industry standard toolset (IST) software, such as CATHENA to perform the 227

deterministic safety analysis [7]. The analysis involves the modeling and simulation for 228

reactor components, loop dynamics, postulated accident events, and the invoked 229

mathematical or logic algorithms during the transients. The original idea to create 230

CATHENA is producing a modeling and simulation software system as generically as 231

possible for wide range of applications, which includes either the thermal-hydraulic 232

simulation or the deterministic safety analysis. Furthermore, its oriented objective is not 233

purely limited to CANDU reactors. Therefore, the code system defines different systematic 234

and functional modules, such that it is easy for users to build the models by inputting the 235

formatted records as per the requirements. However, for the industry commercial analysis, 236

it requires about tens of thousands records to detail the nuclear power plant systems 237

including reactor dynamic model, reactor regulating system, primary heat transport system, 238

8

main steam supply system, and so on. Apparently, this is neither affordable, nor necessary 239

for the application in this research, since the investigated target is mainly focused on the 240

reactor shutdown system. Therefore, the problem should be simplified to simulate the 241

essential modules. 242

The objective of this research is to evaluate and improve the power measurement and its 243

related signal processing sensitivity which is committed to shorten the reactor trip time 244

during LLOCA event. It is suggested that a typical LLOCA transient is simulated and the 245

power transient curve can be referenced for the following analysis works. The reasonable 246

and accessible method is to employ a point kinetic reactor model equipped with the 247

approximated internal and external reactivity inputs. By this means, it prevents the 248

simulation from the utilizations of large commercial software such as CATHENA; while 249

the alternative option such as MATLAB/Simulink software simulation could be adopted, 250

which additionally provides more generic profile to researchers in other areas. 251

The point kinetic reactor model in this research refers to the CATHENA theory manual 252

[19]. Considering single energy (thermal) group and six groups of delayed neutron 253

precursors, the model equations can be represented by 254

𝑑𝑛

𝑑𝑡=𝑘(1−𝛽)−1

𝜏𝑛 + ∑ 𝜆𝑖𝐶𝑖

6𝑖=1 (1) 255

𝑑𝐶𝑖

𝑑𝑡=𝛽𝑖𝑘

𝜏𝑛 − 𝜆𝑖𝐶𝑖 (2) 256

where n is the normalized reactor power at time t; Ci is the ith group delayed neutron 257

concentration; βi is the ith group delayed neutron fraction; λi is the ith group delayed neutron 258

decay constant; β=Σβi for i= 1, 2, 3, . . . ,6; k = (1-ρ×10−3)-1, where ρ is the total reactivity; 259

τ is the mean prompt neutron lifetime, 0.000902 second [19]. 260

Since LLOCA represents very fast dynamic response, the Xenon effect is ignored in this 261

simulation. This is reasonable, because usually the time magnitude of Xenon effect 262

accumulation is much longer than the LLOCA transient range, several seconds. 263

2.3 MATLAB/Simulink modeling and simulation for the LLOCA 264

transient 265

In order to borrow the MATLAB’s advanced features such as fast and large amount of 266

matrix manipulation and calculation, the reactor kinetic model equations (1) and (2) can be 267

vectorized to 268

𝑑𝑛

𝑑𝑡=(

1

1−𝜌×10−3)(1−𝛽)−1

𝜏𝑛 + (𝜆1 … 𝜆6) (

𝐶1⋮𝐶6

) (3) 269

9

𝑑

𝑑𝑡(𝐶1⋮𝐶6

) =(

1

1−𝜌×10−3)

𝜏𝑛(𝛽1⋮𝛽6

) − (𝜆1

⋱𝜆6

)(𝐶1⋮𝐶6

) (4) 270

As far as the initial condition is considered, the initial reactor power is 1.0 FPU. The 271

accident starts from the referenced reactor operation condition, i.e., the equilibrium core 272

under the full power operation. Thus, 273

𝑛0 = 1.0 (5) 274

where 𝑛0 is the initial value of the reactor power. 275

In this way, the initial condition of delayed neutron precursors concentration can be 276

calculated by defining the left side of equation (4) to be zero, such that 277

(𝐶1⋮𝐶6

)

0

=

(

𝛽1

𝜆1𝜏

⋮𝛽6

𝜆6𝜏)

(6) 278

The neutronic parameters are represented in Table 1. 279

280

Table 1 Point reactor neutronics data for CANDU equilibrium fuel [19] 281

282

Group Delayed Neutron Fractions (βi) Decay Constants, λi(s-1)

1 0.000295 0.000612

2 0.001165 0.03155

3 0.001033 0.1218

4 0.00235 0.3175

5 0.00078 1.389

6 0.000197 3.784

283

The reactivity, ρ, contains two parts: one is the internal reactivity feedback induced by the 284

varying of reactor variables such as Xenon concentration, fuel temperature, coolant 285

temperature, and coolant density (void fraction); the other is the external dynamic reactivity 286

which is introduced by the reactivity devices such as liquid zone controllers, adjuster rods, 287

and mechanical absorbers, or the shutdown systems such as SDS1 and SDS2. For LLOCA, 288

the most concerned reactivity parts are the internal reactivity feedback by coolant density, 289

and the external dynamic reactivity caused by shutdown rods. In this simulation, the 290

Simulink Look-up table skill is employed to simulate the reactivity change using a time 291

series reactivity table. Two tables representing the internal and external reactivity change 292

are represented in Table 2 and Table 3. 293

10

294

Table 2 Reactivity change due to insertion of shutdown rods [19] 295

296

Time Reactivity (mk)

0.0 0.0

0.4 -2.0

0.6 -5.46

0.8 -9.10

1.0 -13.64

1.2 -30.28

1.4 -47.36

1.6 -64.24

1.8 -80

297

Table 3 Internal reactivity change with time [1] 298

Time Reactivity (mk)

0.0 0.0

0.9 4.3

3.16 11

10 15

299

Then, the reactor dynamic model is simulated by MATLAB/Simulink. Fig. 2 represents the 300

simulation model for CANDU reactor LLOCA accident. Powers transient simulation 301

results with and without the reactor trip are shown in Fig. 3. It is basically consistent with 302

the power transient curve revealed by the COG report [1], except that the peak power is a 303

bit lower and the downstream inflection point shows a bit later. This explains that the 304

approximated internal reactivity table still cannot accurately reflect the real situation in the 305

reactor core when large LOCA happens. Another potential factor is that, the COG report 306

shows the peak bundle power transient, which is essentially different from the reactor bulk 307

power. 308

309

11

s

1

[ ]'i

( )jdiag

n

][ iC

3

1

1 10

s

1

Reactivity Table 2.2

Reactivity Table 2.3

3

1( )(1 ) 11 10

i

internal

external

[ ]i

1

310

311

Fig. 2 Block diagram of the reactor model using a point kinetic method 312

313

Fig. 3 Power transient of CANDU reactor LLOCA event (with and without reactor 314

trip) 315

316

3. SDS1 trip logic simulation for the LLOCA event 317

With manipulation of 28 mechanical shutoff rods, SDS1 is the preferred shutdown system 318

to quickly terminate reactor operation when certain parameters exceed specified limits. 319

This preference is with the economic consideration resulting from plant unavailability 320

following the use of SDS2. SDS1 employs an independent triplicate logic system, which 321

senses the requirement for reactor trip and de-energizes the direct current clutches to release 322

0 1 2 3 4 5 60

0.5

1

1.5

2

2.5

3

3.5

4

Time (Sec)

Norm

aliz

ed r

eacto

r p

ow

er

(FP

U)

without trip

with trip

12

the spring assisted gravity drop shutoff rods. 323

Fig. 4 represents the brief structure of one of the three CANDU SDS1 channels, which 324

consists of sensors for system variable measurement, trip computer for trip logic processing, 325

relay logic for 2oo3 voting, and the shutoff rods for reactor trip [20]. 326

327

Sensors Amplifier PDC(Trip Computer)

Conditioning

Signals

Relay

Shutoff Rods

Monitoring

Computer

Sampling Delay Decision Making Relay delay Rods Dropping

Display/Test

ComputerTest Signals

Gain

328

329

Fig. 4 Signal architecture of SDS1 330

331

From the above SDS1 signal architecture figure it can be seen that, the time spent by a 332

shutdown process is the summation of the time consumed in each of the four sections. The 333

shutdown process can be speeded up by reducing the consumed time of any of these parts. 334

In this research, the attempt is focused on the first two parts, i.e. reducing the consumed 335

time on sensor sampling delay and the trip decision making during the LLOCA accident. 336

In order to achieve this objective, decomposition of these two blocks is performed. 337

Design objectives of the shutdown systems are obtained by considering which mechanisms 338

may lead to violation of the derived criteria and by setting conservative objectives to meet 339

the criteria. The considerations are expressed in terms of design basis initiating events. 340

LOCA is one of the main designed basis events. The design objective for LLOCA is to 341

maintain the integrity of the primary heat transport system. This requires that the integrity 342

of fuel channels be maintained. Channel integrity at high pressure is maintained providing 343

that fuel elements do not contact a pressure tube. For LLOCAanalysis the prevention of 344

fuel breakup is chosen as the trip effectiveness criterion for SDS1. 345

The selection of trip parameters is such that there are adequate measurements for all process 346

failures identified. Trip parameters, setpoints, and protective coverage of LLOCA are 347

shown in Table 4. 348

349

13

Table 4 SDS1 Trip Parameters and Setpoints for LLOCA 350

351

No. Trip Parameters Detector type Setpoint

1 High Neutron Power Vertical in-core detectors

ROPT-HSP-1 122% FP

ROPT-HSP-2 109.3% FP

ROPT-HSP-3 83.3% FP

2 High Log Rate

Neutron Power Ion chambers 10% pp/sec

352

The overpower trip provides a quickly responding trip signal for LLOCA accidents where 353

the induced void reactivity rate or depth exceeds the capability of the reactor regulating 354

system to maintain power constant. The high log rate power trip is also designed to give 355

protection against the LLOCA event. A trip setpoint of 10% present power per second (pp/s) 356

with a system response time of less than 1 second is required. This can be achieved with a 357

second-order rate filter with time constants of approximately 0.16 seconds. The high log 358

rate power trip dominates the LLOCA event, which means its trip time is faster than the 359

overpower trip. 360

Reactor flux power measurements for the regional overpower trip are provided by Pt-clad 361

in-core flux detectors, located in vertical in-core flux monitoring assemblies. Reactor 362

power measurements for the log rate neutron power trips are provided by ion chambers, 363

located on the inaccessible side of the calandria. The Pt-clad in-core detectors are 364

characterized with a response which is approximately 90% prompt to neutron flux. The 365

overall response is a good representation of the power-to-fuel dynamic characteristics of a 366

CANDU reactor. An amplifier converts the detector current to a suitable voltage range. 367

This voltage signal is compensated to account for the delayed component of the detector 368

signal. The time constants of this compensation are adjusted so that the output signal 369

closely matches the fuel power. Three uncompensated ion chambers are provided to 370

measure the log rate reactor power for SDS1. The output current from each ion chamber 371

goes to an amplifier, which produces log neutron power, linear neutron power, and log rate 372

signals. The log rate signal is a direct trip parameter. The log and linear power signals are 373

used for conditioning and trip setpoint selection for other trip parameters. 374

Since the high log rate trip dominates the LLOCA event, it is focused on analysis in this 375

research. The decomposition of the trip initiation delays in instrumentation and estimated 376

measurement is performed. For this trip signal, the log power signal is first differentiated 377

and then smoothed by two first order filters with a delayed time constant. The filtering is 378

used because the result of differentiating a noisy signal is a very noisy signal. The pure 379

delay resulting from the second order filter depends on the characteristics of the input. The 380

relay delay, clutch delay, and so on, will be the same as for the high power trip, which is 381

not discussed in this research. The time constant of the log amplifier, which is negligible at 382

14

high powers, is 40 milliseconds. This time constant is usually modeled as a function of 383

power, to account for its increase in magnitude at very low powers. 384

A transfer function flow chart for high log rate trip logic of LLOCA event is shown in Fig. 385

5, where T1 is the delay time constant of the amplifier, and T2 is the delay time constant of 386

the filter. 387

Trip

setpoint

Neutron

fluxln Comparator

Trip

signal1

1

1 T s

du

dt2

2

1

(1 )T s 388

389

Fig. 5 Transfer function chart of high log rate trip logic for LLOCA event 390

391

Reactor power transient includes three types of noises: sine wave of 60 Hz, 1000 Hz, and 392

random noise of 200 Hz [21]. The amplitude of the noises is 0.5%FPU. Trip setpoint is 393

designated by 10% pp/s. If the induced signal is over 10%pp/s, the output signal will be on 394

1; otherwise, the output will be still on 0. The simulation result of the trip signal is provided 395

in Fig. 6. From the picture it can be shown that the reactor high log rate trip happens at 396

222.3 milliseconds. 397

398

Fig. 6 Simulation result of trip signal for existing trip system 399

400

0 0.2 0.4 0.6 0.8 10

1

Time (Sec)

Tri

p s

ign

al

15

4. The proposed new signal processing system 401

4.1 Schematic presentation of the new signal processing system 402

To address the poor signal-to-noise ratio of neutronic power measurement signals, 403

especially at low reactor power, and insufficient speed of trip signal generation in case of 404

LLOCA, a new neutronic signal processing system is developed. An improved relative rate 405

trip concept is provided that it neither causes significant delays nor has substantial signal-406

to-noise ratio restrictions. Schematic representation of the system and trip logic is shown 407

below in Fig. 7. 408

Neutron

Flux

Detector(s)

Amplifiers

Variable Set

Point

FRate

ModuleF

Signal

Processing

Unit

F

Tri

p L

og

ic

Legend: F - filter 409

Fig. 7 Simplified schematic representation of the new neutronic signal processing 410

system for LLOCA 411

412

A test to low pass filters following a power pulse transient is performed by Simulink. Three 413

first-order low pass filters are provided with delay time constants of 5 second, 50 414

milliseconds, and 20 milliseconds, respectively. Power transient and three filters’ transient 415

characteristics are represented by Fig. 8. It can be seen from the figures that, during the 416

power transient process, the filter with a longer delay time constant represents a relatively 417

prolonged time characteristics, although all of the filters’ responses will arrive at the 418

designated power level eventually. This is coincident with the anticipation. 419

16

420

Fig. 8 Power step response for first-order low pass filters with different time 421

constants ((a) –power step trajectory; (b) – 5 seconds; (c) – 50 milliseconds; (d) – 20 422

milliseconds) 423

424

4.2 Software design and implementation of the new signal processing 425

system 426

Inspired by the above power step response characteristics of different first-order low pass 427

filters, a specified design of the new signal processing system corresponding to Fig. 7 is 428

provided. Fig. 9 represents the transfer function blocks of the new designed system’s 429

principles. Again, three first-order low pass filters are used. Their time constants are 430

respectively 5 seconds, 50 milliseconds, and 20 milliseconds. 431

432

0 5 10 15 200

0.2

0.4

0.6

0.8

1

Time (Sec)

Pow

er

(FP

U)

(a)

0 5 10 15 200

0.2

0.4

0.6

0.8

1

Time (Sec)

Pow

er

(FP

U)

(b)

0 5 10 15 200

0.2

0.4

0.6

0.8

1

Time (Sec)

Pow

er

(FP

U)

(c)

0 5 10 15 200

0.2

0.4

0.6

0.8

1

Time (Sec)

Pow

er

(FP

U)

(d)

17

Trip

setpoint

Neutron

fluxln

Comparator

Trip

signal

1

1 Ts

2

1

1 T s

1

1

1 T s

3

1

1 T s

Proportioner

Comparator

Comparator

Proportioner Comparator

Trip

setpoint

.AND.

433

434

Fig. 9 Transfer function chart of new designed signal processing system for LLOCA 435

event (T1, T2, and T3 are respectively 5 seconds, 50 milliseconds, and 20 436

milliseconds) 437

438

A MATLAB/Simulink simulation platform is established to model the new designed signal 439

processing system. Power transient is induced from the theoretical analysis which is 440

illustrated in Section 2.2. Considering the delay effect of filters particularly as the proposed 441

low pass filter with 5 second time delay, the response of the filters is observed. It takes 442

more than 50 seconds for the 5 second low pass filter to reach a new steady state level. 443

Therefore, in order to maintain the initial condition of full power steady state operation 444

before the LLOCA event is issued, full power operation steady states of 60 seconds are pre-445

arranged. 446

Reactor power transient includes three types of noises: sine wave of 60 Hz, 1000 Hz, and 447

random noise of 200 Hz. The amplitude of the noises is 0.5%FPU. Three low pass filters 448

with time constant of 5 s, 50 ms, and 20 ms are used to process the power transient signal. 449

Since the response of 5 s filter is much lower than other two filters, it can be taken into 450

account as a constant value in a very short time. Therefore, in the same time period, 451

equations of (F2-F1)/F1 and (F3-F1)/F1, where F1, F2, and F3 represent the response 452

values of 5 s, 50 ms, and 20 ms filters respectively, can be used to measure the relative 453

deviations between fast filters and the 5s filter. Based on these measurements, an internal 454

setpoint corresponding to the original setpint, 10 pp/s can be designed, as far as the 455

proposed trip time reducing objective is concerned. 456

Simulation results about the reactor trip signals respect to both the existing and new 457

designed systems are represented in Fig. 10. The reactor trip time under the action of the 458

new designed signal processing system is 138 ms, which is significantly shorter than the 459

old one, 222 ms. Furthermore, no spurious trips happen to both trip systems. Therefore, the 460

conclusion is that, the new designed signal processing system achieve the faster trip logic 461

in the same trip setpoint condition as the existing design, and meanwhile suppress the 462

18

spurious trips happening. Subsequently, the new designed systems will significantly 463

enhance the power plant operation safety margin. 464

465

Fig. 10 Simulation results of reactor trip signals for existing and new trip systems 466

467

4.3 Discussions and analysis 468

The new neutronic signal processing system will bring the economic benefit to the 469

industrial utilizations by reducing the reactor trip time during the LLOCA event. 470

Conservatively assuming the reactor trip time is decreased by 80 ms which is caused by 471

implementation of the new signal detection system, the reactor peak power is reduced from 472

3.06 FPU to 2.695 FPU during the LLOCA event. Then the reactor operation safety margin 473

is significantly increased. Fig. 11 represents the power transient curves corresponding to 474

the existing and new systems during the LLOCA event. If the reactor operation safety 475

margin is maintained same as before, the reactor operation power level could be 476

considerably increased. For example, through a “core conversion” procedure, Bruce Power 477

B units have been increased from 0.90 FPU to 0.93 FPU. Combining all four Bruce B units, 478

this is a 100 megawatt increase in generation, enough electricity to power 100,000 Ontario 479

homes [22]. Furthermore, with the application of the new designed system, the potential 480

power operation level of Bruce B units could be very close to 1.0 FPU. This is an extra 200 481

megawatt increase in generation, which is equal to an economic benefit of about 0.2 million 482

dollars per hour. 483

484

0 0.2 0.4 0.6 0.8 10

1

Time (Sec)

Tri

p s

ign

al

existing system

new system

19

485

Fig. 11 Estimation of the reactor peak power decrease during the LLOCA event 486

caused by the new signal processing system 487

488

5. Conclusion 489

An innovative neutronic signal processing system for CANDU reactor SDS1 manipulation 490

is proposed, and its detailed design based on software simulations is performed. 491

Implementation of the new signal processing system represents a shorter trip time during 492

the LLOCA event than the existing power plant system. Furthermore, the proposed 493

algorithms and their implementation are proved to be able to accommodate both trip 494

effectiveness and spurious trip immunity. Implementation of the new designed signal 495

processing system will provide enhanced safety margin for the existing power plant 496

operation; or bring extra economical benefits for the units by increasing the current 497

operation power level when the original safety margin is maintained. 498

Acknowledgments 499

The authors would like to acknowledge the financial support from the NSERC for the work 500

reported in this paper. 501

502

503

0 1 2 3 4 50

0.5

1

1.5

2

2.5

2.6950

33.0649

3.5

Time (Sec)

Rea

ctor

Pow

er

(FP

U)

Existing system

New system

20

Reference 504

[1] Muzumdar, A., Meneley, D., 2009. Large LOCA margins in CANDU reactors – an 505

overview of the COG report. In: Proceedings of the 30th Canadian Nuclear Society Annual 506

Conference, Calgary, AB, May 31-June 3, 2009. 507

[2] AECL, 2005. CANDU 6 technical summary. Atomic Energy of Canada Limited. 508

[3] AEBC, 1991. Requirements for shutdown systems for CANDU nuclear power plants. 509

Regulatory Documentation R-8. Atomic Control Board Canada. 510

[4] CNSC, 2006. Trip parameter acceptance criteria for the safety analysis of CANDU 511

nuclear power plants. Office of Communications and Regulatory Affairs. 512

[5] She, J., Jiang, J, 2011. On the speed of response of an FPGA-based shutdown system 513

in CANDU nuclear power plants. Nuclear Engineering and Design 241, 2280-2287. 514

[6] She, J., Jiang, J, 2011. Potential improvement of CANDU NPP safety margins by 515

shortening the response time of shutdown systems using FPGA based implementation. 516

Nuclear Engineering and Design 244, 43-51. 517

[7] Hanna, B., 1998. CATHENA: A thermalhydraulic code for CANDU analysis. Nuclear 518

Engineering and Design 180, 113-131. 519

[8] McNelles, P., Lu, L., A Review of the Current State of FPGA Systems in Nuclear 520

Instrumentation and Control. In: Proceeding of the 2013 21st International Conference on 521

Nuclear Engineering, vol. 6, March 2013. 522

[9] Hanna, B., 2015. Core monitoring in Candu reactors using in-core detectors. Available 523

online at:http://mathematicsandcomputation.cowhosting.net/PHYSOR-524

2000/physor/276.pdf . 525

[10] Glockler, O., 2013. Testing the dynamics of shutdown systems instrumentation in 526

reactor trip measurements. Progress in Nuclear Energy 54, 91-96. 527

[11] Alex, M., Ghodgaonkar, M., 2007. Development of an inconel self powered neutron 528

detector for in-core reactor monitoring. Nuclear Instruments and Methods in Physics 529

Research 547, 127-132. 530

[12] Auh, G. 1994. Digital dynamic compensation methods of rhodium self-powered 531

neutron detector. Journal of the Korean Nuclear Society 26(2), 205-211. 532

[13] Park, M., Kim, Y., Cha, K., 1999. H∞ filtering for dynamic compensation of self-533

powered neutron detectors - a linear matrix inequality based method. Annals of Nuclear 534

Energy 26(18), 1669-1682. 535

[14] Park, M., Kim, Y., Lee, K., 2008. Experimental demonstration of H∞ filter 536

performance for dynamic compensation of rhodium neutron detectors. Annals of Nuclear 537

Energy 35(2), 340-344. 538

[15] Peng, X., Li, Q., Zhao, W., 2014. Robust filtering for dynamic compensation of self-539

powerd neutron detectors. Nuclear Engineering and Design 280, 122-129. 540

[16] Peng, X., Li, Q., Wang, K., 2015. Dynamic compensation of Vanadium self powered 541

neutron detectors based on Luenberger form filter. Progress in Nuclear Energy 78, 190-542

195. 543

21

[17] Cai, J., Sen, S., Barkman, N., 1999. Safety systems and safety analysis of the Qinshan 544

Phase III CANDU nuclear power plant. Nuclear Power Engineering 20, 519-525. 545

[18] Ponomarev, V., Ponomaryov, P., 2014. Options for improvement of the reactor power 546

measurement sensitivity during transients. In: the 19th Pacific Basin Nuclear Conference, 547

Vancouver, BC, Canada, August 2014. 548

[19] Beuthe, T., Hanna, B., Mcgee, G., 2005. CATHENA MOD-3.5D Theory Manual. 549

Chalk River Laboratories, Chalk River, ON, Canada, December 2005. 550

[20] Ichiyen N., Fieguth, W., 1983. Digital-computers in CANDU safety systems: part I 551

history and concepts. IEEE Transactions on Nuclear Science 30, 1908-1911. 552

[21] Nasimi, E., Gabbar, H., 2014. Signal de-noising methods for fault diagnosis and 553

troubleshooting at CANDU stations. Nuclear Engineering and Design 280, 481-492. 554

[22] Bruce Power, 2013. Performance review of Bruce A and Bruce B: a supplemental 555

submission in support of license renewal. Bruce Power, October 2013. 556