Nuclear reactor protection systems and methods
A nuclear reactor protection system includes a plurality of functionally independent modules, each of the modules configured to receive a plurality of inputs from a nuclear reactor safety system, and logically determine a safety action based at least in part on the plurality of inputs, each of the functionally independent modules comprising a digital module or a combination digital and analog module, an analog module electrically coupled to one or more of the functionally independent modules, and one or more nuclear reactor safety actuators communicably coupled to the plurality of functionally independent modules to receive the safety action determination based at least in part on the plurality of inputs.
1 . A nuclear reactor protection system, comprising:
a first logic circuit configured in hardware to derive a first safety determination associated with an estimated condition of a nuclear reactor or a portion thereof, the first logic circuit receiving input from a first set of sensors wherein the first logic circuit comprises a combination of a first digital module and a first analog module and wherein the first analog module is configured to override operations of the first digital module;
a second logic circuit that is diverse from the first logic circuit and configured in hardware to derive a second safety determination, the second logic circuit receiving input from a second set of sensors that is separate from the first set of sensors,
wherein the second safety determination is redundantly associated with the estimated condition and separate from the first safety determination; and
a first display interface module coupled to the first logic circuit and configured in hardware to provide driver functionalities for displaying the first safety determination or the processing result thereof on one or more directly connected display panels; and
a second display interface module coupled to the second logic circuit and configured in hardware to provide driver functionalities for displaying the second safety determination on the one or more directly connected display panels, wherein the first display interface module and second display interface module have differences that preserve one or more forms of diversity in processing the first and second safety determinations.
2 . The nuclear reactor protection system of claim 1 , wherein the first display interface module and second display interface module are preconfigured in hardware settings and/or connections between circuit components therein to generate panel drive signals based on processing the first and second safety determinations, wherein the panel drive signals are configured to operate the one or more display panels to communicate the first and second safety determinations.
3 . The nuclear reactor protection system of claim 2 , wherein the first display interface module, the second display interface module, or a combination thereof comprises a field-programmable gate array (FPGA) configured in hardware to generate the panel drive signals.
4 . The nuclear reactor protection system of claim 2 , wherein the first display interface module and second display interface module are configured in hardware to generate the panel drive signals without executing software instructions.
5 . The nuclear reactor protection system of claim 4 , wherein the first display interface module and second display interface module comprise dedicated hardware configured to generate the panel drive signals, the dedicated hardware being unable to selectively implement a different function.
6 . The nuclear reactor protection system of claim 2 , wherein the first logic circuit, the second logic circuit, and the first display interface module and second display interface module are physically separate and independently operated circuits that are configured in hardware to operate without interacting with a common or centralized processor for reducing hardware-based single-point limitations.
7 . The nuclear reactor protection system of claim 2 , wherein the first display interface module and second display interface module are configured in hardware to serve as a display driver for the one or more display panels.
8 . The nuclear reactor protection system of claim 1 , further comprising:
a control circuit communicatively coupled to receive the first and second safety determinations and configured to generate a safety action signal based on the first and second safety determinations, wherein
the safety action signal is configured to control a nuclear reactor safety actuator to address the estimated condition; and
wherein the first display interface module and second display interface module are configured to generate one or more panel drive signals configured to operate the one or more display panels to communicate the estimated condition of the nuclear reactor safety actuator according to the first and second safety determinations.
9 . The nuclear reactor protection system of claim 8 , further comprising:
a monitoring and indication bus (MIB) communicatively coupled to the first logic circuit, the second logic circuit, and the first display interface module and second display interface module, wherein the MIB is configured to communicate status and/or diagnostics information associated with the nuclear reactor protection system to the first display interface module and second display interface module for displaying on the one or more display panels, wherein the status and/or diagnostics information includes the first and second safety determinations or representations thereof.
10 . The nuclear reactor protection system of claim 9 , further comprising an MIB communication circuit configured in hardware to operate as a dedicated master for the MIB by controlling communication of data exchanged over the MIB.
11 . The nuclear reactor protection system of claim 9 , wherein:
the first logic circuit includes two or more circuit groupings, wherein one of the circuit groupings is configured to logically derive the first safety determination and remaining of the circuit groupings is configured to logically derive one or more redundant determinations associated with the estimated condition;
the control circuit is configured to generate the safety action signal according to a majority of values indicated by the first safety determination and the one or more redundant determinations;
further comprising:
a safety function bus including two or more bus paths, wherein each of the two or more bus paths (1) individually couple one of the two or more circuit groupings to the control circuit, (2) is isolated from other paths in the safety function bus, and (3) is separate and independent from the MIB.
12 . The nuclear reactor protection system of claim 11 , wherein the first display interface module and second display interface module are configured to generate a panel drive signal based on a mismatch between the first safety determination and the one or more redundant determinations, wherein the panel drive signal represents a diagnostics information associated with the estimated condition.