Emergency and Preventive Reactor Protection Systems - Nuclear Power Plant Instrumentation and Control Systems for Safety and Security - page 305

It is pertinent to note that diversity requirement
is less actual with regard to the peripheral (as a rule,
industrial) items, as a major part of faults can be
detected and eliminated at the development stage,
and properties of developed and industrial items
can be fully checked and validated during testing.
Moreover, as a rule, the utilized peripheral items
approbated by a long-term practice of operation
at NPPs to an adequate degree (different systems
use same type sensors, normalizing transducers,
actuators, and other peripheral equipment), that
is why during modernization of I&C systems
most often only central part (SHC) is changed,
peripheral equipment of the modernized system
and connecting cables are not changed often.
Regulations NP, 2000 and NP, 2008,b provide
requirements for obligatoriness of system diversity
performing reactor emergency protection (shut-
down) function, while for I&C systems and SHC,
which are not engaged in emergency protection
function performance, requirement for observance
of diversity principle is not obligatory, but can
be set by the operating organization. At the same
time, international standard IAEA, 2002 provides
a possibility of diversity usage not only in safety
systems, but also in normal operation systems
along with other measures of additional reliabil-
ity growth, and also as a way of compensation
of difficulties, which appear if there is a need to
prove a reliability of, for example, reserved and
(or) computer systems, reliability of which can
be restricted by such factors as common cause
failures. Design defects, production defects,
operating errors and maintenance errors are said
to be the most probable reasons of such failures.
Similar recommendations concerning usage of
diversity as a way of effective error protection
(especially for complex systems, which are not
enough approbated during operation) are provide,
for example, in IEC, 2006 and IEC, 2011 standards.
However, IEC, 2009 specifies that the usage of
two or more systems, built on different principles
is necessary, if a really achievable reliability of
category A functions and equipment connected
to it, taking into account the common cause

failures, cannot provide the safety performance
requirements. Diversity requirement applicable
to safety control systems is also included into
USA documents (NUREG, 2002), Russia (NP,
1997), Germany (КТА, 1985) and implemented,
for example, in emergency protection systems at
Sizewell B NPP (UK) new power units, Temelin
NPP (Czech Republic), etc., as well as during
modernization of E&PRP systems at Ukrainian
power units.

CONSTRUCTION PRINCIPLES

For WWER-1000 reactors, the design provides
four types of protection.
Emergency reactor protection (ERP) initiates
the disconnecting of power supply of all control
rod drives that leads to their simultaneous fall-
ing into the lowermost position driven by their
own weight, which, in turn, causes fast (within
1.5 s-4 s) transition of the reactor in subcritical
state. The subcritical state remains even after the
elimination of the conditions that caused ERP
actuation until the personnel send command ERP
RESTART.
Reactor accelerated preventive protection
(RAPP) operates, when the nuclear reactor
power is 75% over the nominal. RAPP increases
the power unit dynamic resistance and provides
reactor sparing regimen in case of abnormal
disconnection of technical equipment due to fast
power reduction. For this purpose, RAPP initi-
ates CR drives disconnecting of power supply
of the previously selected CR group that causes
simultaneous fall of all constituent control rods
and, due to this, fast (within 1.5 s—4 s) power
reduction to 30%—40% of the nominal. At the
same time the signal is sent (with a 4 s delay) to
turbine control system (TCS) upon which tur-
bogenerator power is reduced to (350-450) MW
level with the speed (20-30) MW·s -1 . The lift of
dropped CR is possible only after the personnel
send a special command RAPP RESTART. CR
group, which should perform reactor accelerated