The German BWR nuclear power plant, Philippsburg 1, has upgraded its independent bunkered shutdown system called "USUS" (a German acronym for "independent sabotage and accident control system") with TELEPERM^TM XS digital instrumentation and control (I&C) equipment. The new equipment, in operation since June 2001, completed its trial run in December 2001.

Winfried Leider, Philippsburg Project Manager, commented: "One of the main factors contributing to the success of the project was the fruitful cooperation between the teams from Philippsburg and Framatome ANP. This enabled us to install a technically mature and well-balanced system. Framatome ANP's competence, not only in considering the requirements associated with the I&C equipment but also in mastering all aspects involved in successful integration into the plant, made a major contribution towards fulfilling the ambitious goals of the project. Through the acceptance and startup tests conducted by the nuclear supervisory authority and its authorized inspectors as well as the operating experience gained so far, it was demonstrated that a project can be optimally executed by consistently applying modern project and quality management systems."

Safety Played the Main Role

Today's nuclear codes and standards as well as a recommendation from the German Reactor Safety Commission (RSK) call for measures to prevent malfunctions in safety I&C equipment resulting from externally introduced voltages. During a periodic safety review conducted at the plant, it was discovered that the existing reactor protection system, located in the switchgear building, no longer met all of the requirements for interference control and decoupling of redundant trains. A backfitting project was initiated to bring the plant in line with today's safety requirements.

Detailed Planning Ensured Smooth Execution

Framatome ANP was contracted in June 1999 to perform the modernization project. Objectives called for a solution tailored to the specific needs of Philippsburg 1. First, a conceptual study was performed with the goal of upgrading the USUS as a complete redundancy to the existing reactor protection system.

This initial study was followed by a preliminary planning phase, in the course of which an as-built analysis of the existing I&C and process-engineering systems and their logic gating and connections to other systems was conducted. The plant operator also contributed his knowledge and expertise gleaned from over 20 years plant operation and maintenance experience.

The Best Solution, Based on Pre-Tested and Proven Systems, Concepts and Modules

Cabinet wiring was carried out by the proven TERMI-POINT technique in which the wires are terminated to the posts with clips using air-powered tools

The digital safety I&C system TELEPERM XS was used to achieve the desired upgrade objectives. Electrical isolation within the redundant trains and from the USUS control station was cost-effectively achieved by utilizing the in-circuit isolation functions of the TELEPERM XS input and output modules. Fiberoptic cables were implemented for isolation between the redundant trains. By keeping the existing Geamatic-based drive control system, the existing cabling between the control interface, switchgear and peripheral equipment could be used.

Interconnection of the "old" and "new" equipment systems was tested in a test bed and system interactions were reviewed, including electromagnetic compatibility. Prior to executing the backfits at Philippsburg 1, the TELEPERM XS software was loaded onto the plant's systems training simulator and subjected to extensive testing, to aid in completing system planning. As a result, the extensive scope of new I&C equipment and software was installed during two refueling outages. Plant operating personnel received advance training in the new systems and operating tasks.

Additional System Upgrades Also Were Performed

Extensive process-engineering measures were required in addition to the I&C system work, such as establishment of a diverse initiation criterion for actuation of the residual heat removal systems, as well as other measures designed to ensure fulfillment of the defined safety objectives. Further improvements included erecting a new recirculation air cooling unit, upgrading the ventilation ducts and improving the fire protection concept for the control station, cable runs, and replacing the fire alarm system.

On-Time Performance Ensured Smooth Plant Operation

Preparatory work was performed during the 1999 refueling outage. Upgrading of the first USUS redundant train was started in 2000 during power operation of the plant and was completed on schedule in the subsequent refueling outage. This work schedule was possible because a USUS redundant train is allowed to be unavailable for a maximum period of four weeks according to the operating manual. Extensive planning was required to maintain this schedule. Work was subdivided into 1,800 individual activities and precisely coordinated with the plant operator's outage planning.

With the completion of the upgrade of the second redundant train during the 2001 refueling outage, the entire project was finished. The authorized inspector, in his statement to the nuclear supervisory authority, declared that "the TELEPERM XS control system is suitable for safety tasks of the highest category and it has proven in this project that active safety system I&C tasks can also be performed on the basis of functional group engineering."

By completely isolating the two existing redundant USUS trains electrically from each other as well as from the existing reactor protection system, and by expanding existing protective functions, two new reactor protection system redundancies were created. The three existing redundant trains in the switchgear building are considered to be unavailable for safe shutdown and long-term residual heat removal for the new postulated external voltage event. The redundant USUS trains form two further redundancies for meeting the new requirements. However, the reactor scram function was assured in its original form owing to the failsafe design previously implemented.

Main Benefits for the Customer

• Simplification and reduction of the number of in-service inspections
• Improvement of documentation by forward planning and engineering
• Simplification of maintenance and repairs through in-service inspection and diagnostics systems
• Clearer and more consistent I&C system configuration.