Instrumentation, Control and Electrical Systems in Nuclear Facilities
This domain tests nuclear instrumentation, reactor protection logic, control systems and the electrical supplies that support safety functions.
Core rules
- Neutron flux is measured by source-range, intermediate-range and power-range detectors. Ex-core detectors monitor leakage flux; in-core detectors map local power.
- Protection systems use redundancy, diversity, independence and coincidence voting. A 2-out-of-4 trip logic tolerates one failed channel and reduces spurious trips compared with a 1-out-of-4 logic, but it is less available than 3-out-of-4 for some failure modes.
- Fail-safe design drives equipment to a safe state on loss of power or signal. However, fail-safe is not universal; some functions require continued operation, so fail-danger must be analysed.
- Class 1E electrical systems include offsite power, onsite emergency diesel generators, batteries, inverters and vital buses. Separation and independence prevent a single fire or flood from disabling redundant trains.
- Setpoints require uncertainty analysis covering calibration, drift, accuracy and response time.
Worked example
A trip function uses 2-out-of-4 voting. Each channel has a failure probability of 0.01. What is the probability that the trip logic fails to trip when required, assuming independent channels?
The logic fails only if three or four channels fail. P = C(4,3)p³(1−p) + p⁴ = 4(0.01)³(0.99) + (0.01)⁴ ≈ 3.96×10^-6. The reasoning is combinatorial: any two healthy channels are enough. The spurious trip probability, by contrast, is the probability that at least two channels trip falsely: C(4,2)p²(1−p)² + ... ≈ 5.9×10^-4, which is much larger. This illustrates the availability-versus-spurious-trip trade-off.
Traps
Do not assume more redundancy always means better spurious-trip performance. Do not ignore common cause failure from shared sensors, power supplies or maintenance. Do not treat a fail-safe signal as proof of safety if the process itself is not safe. Do not overlook setpoint drift and calibration uncertainty. Do not mix Class 1E and non-Class 1E loads.
Key points
- Source, intermediate and power ranges cover different flux levels.
- 2oo4 voting tolerates one failed channel.
- Redundancy must be independent and diverse where needed.
- Class 1E supplies support safety functions.
- Setpoints include calibration, drift and response uncertainty.
- Fail-safe design must be assessed function by function.