Nuclear safety: operational aspects. 5. Data Communication in a Nuclear Digital I and C System-The Korean Experience

Full-scale use of a microprocessor-based digital instrumentation and control (I and C) system for the control of nuclear power plants (NPPs) in Korea has spanned >14 yr and has covered eight plants. Experience gained from these applications is substantial. In this paper, the discussion centers on the design experience of the data communication portion of the digital I and C system along with the associated nuclear licensing issues. The data communication designs of the eight plants (four operating and four under construction) have changed from project to project and from supplier to supplier. The first two of the eight plants, Yonggwang NPP (YGN) Units 3 and 4 (YGN-3 and 4) included only the on/off (binary) controls in the digital I and C system. The subsequent six plants had a fully expanded scope of plant controls including both on/off controls as well as continuous (analog) controls. These latter six plants are Ulchin NPP (UCN) Units 3 and 4 (UCN 3 and 4), YGN Units 5 and 6 (YGN 5 and 6), and UCN Units 5 and 6 (UCN 5 and 6) in the order of their construction start dates. The digital system suppliers are Forney for YGN 3 and 4 and UCN 5 and 6; and Eaton for UCN 3 and 4 and YGN 5 and 6. The Forney system uses bus network architecture, while the Eaton system is based on a ring network configuration. The design differences, advantages, disadvantages, and specific licensing issues of these two configurations unique to the NPP operating environment are discussed in the abstract. The discussions are organized into two parts: the Forney system of YGN 3 and 4 and the Eaton system of YGN 5 and 6. The Forney system of UCN 5 and 6 is still in its early stage of design and manufacture, and it is basically similar to the design of YGN 3 and 4 except for the system upgrade from a 16- to a 32-bit system and the addition of an analog plant monitoring and control function. The Eaton system of UCN 3 and 4 is essentially identical to that of YGN 5 and 6 except that the YGN 5 and 6 system has incorporated design enhancements made to the UCN 3 and 4 system based on operating experience feedback. There was no significant licensing issue raised for the data communication network of the YGN 3 and 4 system other than the requirement imposed by the Korean licensing authority for the licensee to perform a verification testing to demonstrate the design capability that the ESFAS function would not be degraded when the data communication network is disabled. The testing was conducted and witnessed by the licensing auditors, which proved that the ESFAS function was not affected by a network failure. The licensing authority showed great concern for the network independence between cabinets because of the very nature of the network architecture for the UCN 3 and 4 system, which in turn affected the YGN 5 and 6 system. During the startup testing, the concern became real when a network fault failed to isolate and bypass the faulted cabinet. Moreover, the same fault caused a failure of the other path of the redundant network, creating a common-mode failure situation. This prompted the licensing authority to require the licensee to incorporate hardwired direct connections for all ESFAS and important plant signals. In addition, the licensing authority required the licensee to implement a hardwired backup system to provide a defense-in-depth and diversity design to address the common-mode failure probability of a digital I and C system and to comply with the requirements of NRC SECY-93-087, II.Q. Both suppliers stated that their system response times are bounded by a fixed amount, and hence, the system is deterministic. Both suppliers submitted testing results to prove their statements. Both suppliers also defined their systems as state based and not event driven in compliance with the prerequisite licensing requirement of USNRC NUREG/CR-6082. Based on the experience from YGN 3 and 4, UCN 3 and 4, and YGN 5 and 6, it is clear that digital data communication enhances operability by providing system performance status and diagnostic surveillance data on a real-time basis. The PERFORM Net of UCN 3 and 4 and YGN 5 and 6 showed superior system response time characteristics over the bus network used in YGN 3 and 4. But, the PERFORM Net has a weakness in maintaining network independence and preventing propagation of a network fault condition. Because of safety concerns over a common-mode failure resulting from a data communication failure, hardwiring of the safety and important signals is currently a viable conservative approach to mitigate the consequence of a design-basis event and to correctly assess the plant status. This will undoubtedly change in the future when more confidence is gained over the reliability of the data communication system in NPP safety applications, and it may not be long before a multilayered data communication configuration becomes a common use in NPPs. (authors)