Nuclear reactor protection systems and methods
A nuclear reactor protection system includes a plurality of functionally independent modules, each of the modules configured to receive a plurality of inputs from a nuclear reactor safety system, and logically determine a safety action based at least in part on the plurality of inputs; and one or more nuclear reactor safety actuators communicably coupled to the plurality of functionally independent modules to receive the safety action determination based at least in part on the plurality of inputs.
1. A nuclear reactor protection system, comprising:
a first logic circuit configured as a first set of hardware components that include multiple redundant circuits and a voting circuit, the first logic circuit configured to:
receive a first set of inputs from a first set of one or more sensors for a nuclear power system; and
logically derive a first safety determination based on the first set of inputs, wherein the first safety determination is made by the voting circuit based on a majority of outputs received from the multiple redundant circuits, the first safety determination associated with a transient event of a nuclear reactor or a portion thereof,
a second logic circuit configured as a second set of hardware components different from the first set of hardware components to:
receive a second set of inputs from a second set of one or more sensors for the nuclear power system, wherein the second set of inputs include measured parameters different from the first set of inputs; and
logically derive a second safety determination based on the second set of inputs, wherein the second safety determination is associated with the transient event; and
a safety actuator configured to actuate in response to the first and second safety determinations and address the transient event.
2. The nuclear reactor protection system of claim 1 , wherein the first and second logic circuits are preconfigured in hardware settings to derive the first and second safety determinations, respectively, without software instructions.
3. The nuclear reactor protection system of claim 1 , wherein:
the first logic circuit includes a first field-programmable gate array (FPGA) configured in hardware to logically derive the first safety determination; and
the second logic circuit includes a second FPGA configured in hardware to logically derive the second safety determination.
4. The nuclear reactor protection system of claim 3 , wherein the first and second FPGAs have independent processing configurations for determining the transient event.
5. The nuclear reactor protection system of claim 1 , wherein the nuclear reactor protection system is configured to incorporate human diversity, design diversity, software diversity, functional diversity, signal diversity, equipment diversity, or a combination thereof.
6. The nuclear reactor protection system of claim 1 , wherein:
the first logic circuit includes a first state machine configured to logically derive the first safety determination;
the second logic circuit includes a second state machine configured to logically derive the second safety determination; and
the nuclear reactor protection system is configured to control the safety actuator without a kernel or an operating system.
7. The nuclear reactor protection system of claim 1 , wherein: the multiple redundant circuits includes
a first circuit configured to generate a first determination output corresponding to a logical determination associated with the transient event,
a second circuit configured to generate a second determination output corresponding to a first redundant logical determination associated with the transient event,
a third circuit configured to generate a third determination output corresponding to a second redundant logical determination associated with the transient event, wherein
the first, second, and third circuits are electrically separate and operate independently from each other; and
the voting circuit is configured to determine the first safety determination in response to a majority of values indicated by the first, second, and third determination outputs.
8. The nuclear reactor protection system of claim 7 , further comprising:
a first data bus path coupling the first circuit to the voting circuit;
a second data bus path coupling the second circuit to the voting circuit; a third data bus path coupling the third circuit to the voting circuit;
a first communications module configured to function as a master for the first data bus path by controlling communication of data over the first data bus path;
a second communications module configured to function as a master for the second data bus path by controlling communication of data over the second data bus path; and
a third communications module configured to function as a master for the third data bus path by controlling communication of data over the third data bus path, wherein
the first, second, and third data bus paths are separate and independent from each other.
9. The nuclear reactor protection system of claim 7 , further comprising:
a third logic circuit communicatively coupled to receive a third set of inputs from a third set of one or more sensors for the nuclear power system, the third logic circuit configured in hardware to logically derive a third safety determination based at least in part on the third set of inputs, wherein
the third safety determination is associated with the transient event, and the third set of inputs include different measured parameters than one or both of the first and second sets of inputs; and
the voting circuit is communicatively coupled to the third logic circuit and is configured to determine the safety action based on a first-tier voting output and a second-tier voting output, wherein
the first-tier voting output corresponds to the first safety determination and is generated as the majority of values indicated by the first, second, and third determination outputs, and
the second voting output corresponds to a minimum number of matching values indicated by the first, second, and third safety determinations.
10. The nuclear reactor protection system of claim 1 , wherein the first logic circuit and the second logic circuit are physically separated.
11. A nuclear reactor protection system, comprising:
a first logic circuit configured as a first set of hardware components that include multiple redundant circuits and a voting circuit, the first logic circuit configured to:
receive a first set of inputs from a first set of one or more sensors for a nuclear power system; and
logically derive a first safety determination based on the first set of inputs, wherein the first safety determination is made by the voting circuit based on a majority of outputs received from the multiple redundant circuits, the first safety determination associated with a transient event of a nuclear reactor or a portion thereof;
a second logic circuit configured as a second set of hardware components different from the first set of hardware components to:
receive a second set of inputs from a second set of one or more sensors for the nuclear power system, wherein the second set of inputs include measured parameters separate from the first set of inputs;
logically derive a second safety determination based on the second set of inputs, wherein the second safety determination is associated with the transient event; and
a safety actuator configured to actuate in response to the first and second safety determinations and address the transient event.
12. A method of operating a nuclear reactor protection system, the method comprising:
receiving a first set of inputs and a second set of inputs wherein the second set of inputs include measured parameters separate from the first set of inputs, the first and second sets of inputs from a first set of one or more sensors and a second set of one or more sensors, respectively, for a nuclear power system;
using a first logic circuit configured as a first set of hardware components that include multiple redundant circuits and a voting circuit, logically determining a first safety determination based at least in part on the first set of inputs, wherein the first safety determination is made by the voting circuit based on a majority of outputs received from the multiple redundant circuits, the first safety determination associated with a transient event of a nuclear reactor or a portion thereof;
using a second logic circuit configured as a second set of hardware components different from the first set of hardware components, logically determining a second safety determination based at least in part on the second set of inputs, wherein the second safety determination is associated with the transient event; and
based on the first and second safety determinations, controlling actuation of a safety actuator for the nuclear power system to address the transient event.
13. The method of claim 12 , wherein:
logically determining the first safety determination includes processing the first set of inputs according to preconfigured connections between hardware components within the first logic circuit; and
logically determining the second safety determination includes processing the second set of inputs according to preconfigured connections between the second set of hardware components, wherein the preconfigured connections within the second logic circuit is different from those in the first logic circuit.
14. The method of claim 12 , wherein:
the first logic circuit includes a first state machine configured to logically derive the first safety determination;
the second logic circuit includes a second state machine configured to logically derive the second safety determination; and
the safety actuator is controlled using the first and second safety determinations and without a kernel or an operating system.
15. The method of claim 12 , wherein:
the first logic circuit comprises a first field-programmable gate array (FPGA); and
the second logic circuit comprises a second FPGA.
16. The method of claim 12 , wherein receiving the first and second sets of inputs, logically determining the first and second safety determinations, and actuating the safety actuator includes incorporating human diversity, design diversity, software diversity, functional diversity, signal diversity, equipment diversity, or a combination thereof.
17. The method of claim 12 , further comprising:
receiving a third set of inputs from a third set of one or more sensors for the nuclear power system;
using a third logic circuit, logically determining a third safety determination based at least in part on the third set of inputs, wherein
the third safety determination is associated with the transient event, and
the third set of inputs include different measured parameters than one or both the first and second sets of inputs; and wherein an activation state of the actuator is controlled according to a minimum number of matching values indicated by the first, second, and third safety determinations.
18. The method of claim 17 , wherein actuating includes preventing or recovering from a single point hardware-related failure.
19. The method of claim 18 , wherein:
controlling the activation state includes using the voting circuit to determine that the minimum number of matching values are indicated by the first, second, and third safety determinations; and further comprising:
communicating the first, second, and third safety determinations to the voting circuit over respective first, second, and third bus paths that are separate and independent from each other.