Application of a fault-tolerant microprocessor-based core-surveillance system in a German fast breeder reactor

For the fast breeder reactor KNK II at Karlsruhe, Germany, a microprocessor-based safety shut-down system is built. Analogue to the triple modular instrumentation it consists of TMR hardware. Functionally it is split into four blocks which operate in cascade-like fashion. The main functions are mean value calculation, current limit control, trend control, and final evaluation. In order to secure correctness, several constructive and analytical methods are applied for fault avoidance, like formal specification languages, programming guidelines, software quality assurance plan, validation, verification, and testing. Since additional means for correct and safe operation are still necessary, fault-tolerance and error-detection techniques are applied. These include self-checking programs, plausibility checks, control data, information exchange and control between the redundancies, and especially diversity. This diversity refers to different teams for the different development phases as well as to different tools and environments, like different programming languages for the application software. Three separate but functional identical programs will be implemented in Iftran, Pascal and PL/M. These will not only be used during the extensive testing period, but also during final operation