Emergency and Preventive Reactor Protection Systems - Nuclear Power Plant Instrumentation and Control Systems for Safety and Security - page 306

preventive protection, is selected before each fuel
campaign considering core loading.
Preventive reactor protection PRP1 causes
successive lowering of CR groups in the design
sequence with working speed 20 mm·s -1 . An
exception is the fifth group (used for xenon oscil-
lation suppression, the movement of which is not
provided by the PRP1 commands). Lowering of
CR groups into core leads reactor power reduction
(during PRP1 performance the automatic power
control is switched off). When the conditions of
the protection actuation are eliminated, PRP1
command is cancelled and CR groups lowering
is stopped.
Preventive reactor protection PRP2 forbids the
increase of reactor power, i.e. upward movement of
any CR or CR group (except the fifth one). When
the conditions set for the protection actuation are
eliminated, PRP2 command is cancelled and, thus,
allows to increase the reactor power.
Initialization of commands of emergency
reactor protection and preventive reactor protec-
tion realizes by software-hardware complex SHC
E&PRP, Initialization of commands of reactor
accelerated preventive protection - by software-
hardware complex SHC RPwCUL&APP (see
Chapter 8). The actuation system, which performs
functions, initiated by noted commands, is rod
group and individual control (RG&IC) system
(see Chapter 10).
Conditions of protection actuation are deter-
mined by the design for each power unit. They
had some differences for different power units
caused, in particular, by the features of used
neutron flux monitoring system (sending signals
on exceeding of neutron power setpoints and the
neutron half-life), and also differences in the
limit parameters, which determine conditions of
protection actuation).
The design determines the limits of power
level and unit operating time in case of failure of
emergency and preventive equipment:

• Failure of one set of SHC E&PRP, lead-

ing to impossibility of emergency reactor
protection function Initialization by this set
and / or removal of one set of SHC E&PRP:
power level is not restricted, operating time
is not more than 8 hours;

• Failure of one channel in one of SHC

E&PRP sets: power level is not restricted,
operating time is not more than 8 hours;

• Failure of indication of reason alarm ERP

in one of the SHC ERP sets: power level is
not restricted, operating time is not more
than 8 hours;

• Failure of two set SHC E&PRP lead-

ing to impossibility of PRP1 function
Initialization: power level is not more than
50% of the nominal, operating time is not
more than 8 hours;

• Failure of indication of reason alarm in two

SHC E&PRP sets: operation on power is
forbidden.

Upon the expiration of allowable operating
time and before the elimination of the fault, the
unit shutdown was provided, during which the
technological equipment is in an availability state,
its parameters are close to operational parameters,
and it is required 2-3 hours to gain power.
Technical solutions applied in a typical design
(before modernization) of WWER-1000 reactor
protection system, was based on unconditional
(“hard wired”) logic principles implemented on
micropower (КMOS) integrated circuits and did
not provide the use of programmed computing
systems (e.g. microprocessors, etc.) for the imple-
mentation of the specified functions.
From the other principles of the typical design
it is primarily required to mention the ones that
remain also in the new reactor protection systems:

• Presence of two SHC sets located in dif-

ferent rooms and completely autonomous,
each of them can perform all protection
functions provided by the design;