IEEE Transactions on Nuclear Science, Vol. NS-30, No. 1, February 1983 COMPUTER CONTROL OF POWER IN A NUCLEAR REACTOR Asok Ray The Charles Stark Draper Laboratory, Inc. 555 Technology Square Cambridge, Massachusetts 02139 John A. Bernard David D. Lanning Massachusetts Institute of Technology 77 Massachusetts Avenue Cambridge, Massachusetts 02139 Abstract A signal validation methodology has been simul- taneously applied to the on-line fault diagnosis of neujtron flux detectors, primnary coolant flow and temperature sensors, and to the computer control of power in an operating nuclear reactor. A CRT display presents the validated data and sensor diagnostics. The feedback signal to the controller is a digitally processed, weighted average of several valid power sensor signals where the weights are not a priori fixed but dependent on the a posteriori probabilities of failure of individual sensors computed on the basis of past and current observations. Introduction Sensor redundancy is generally provided for measuring safety-related variables in nuclear power plants. If such redundancy is not adequate, the set of sensors can often be augmented by analytical meas- urements generated from the physical relationships that exist among the plant variables. Computer-aided signal validation schemes can be designed to exploit these redundancies for reliable information display and control of plant parameters. Signal validation techniques,1'2'3 when combined with the memory and computational capability of a minicomputer, provide estimates of plant conditions and feedback signals for plant control that are more accurate and more reliable than those available from single sensors. In a con- tinuing series of experiments, signal validation meth- odologies have been developed and demonstrated for on-line fault diagnostics, information display, sensor calibration, and measurement estimation of power- related instrumentation such as neutron flux detec- tors, primary coolant flow, and temperature sensors in the 5 MWt fission research reactor, MITR-II, that is operated by the Massachusetts Institute of Technol- ogy. Presently, the reactor power is being digitally controlled, under steady-state operations, via feed- back of a validated estimate obtained from a set of power sensors. The objectives of this paper are to report (1) how the (MITR-II) reactor power has been digitally controlled on-line, (2) what safety procedures have been adopted to protect against possible computer malfunction and other accidents, and (3) some poten- tial applications of the signal validation and control techniqujes. While these techniques are being demon- strated on a research reactor, they are applicable to both commercial power reactors and other industrial processes. Background of the Signal Validation Methodology The signal validation methodology provides a unified procedure for (1) fault detection and isola- tion (FOI), and (2) sensor calibration and measurement estimation. The FOI decisions are made on the basis of relative consistencies among all redundant measure- ments; the major assumption is that a measurement is normal if it does not exceed the true value by a spec- ified error bound. The task of sensor calibration and measurement estimation is performed on-line in the framework of the aforesaid FDI technique via sequen- tial tests that rely on both current and past measure- ment s. If the process variables being measured are time-dependent and if either the redundant sensors are installed in different spatial locations (e.g., neu- tron flux detectors) or if analytic measurements4 are used to supplement the sensor redundancy (e.g., thermal power balances), the measurements of the given process variable may exhibit deviations from each other after a length of time even though the sensors are functioning normally. In a nuclear reactor, these differences could be caused by changes in the spatial flux distribution, changes in moderator temperature, time delays, etc. Consequently, somne of the sensors may be erroneously deleted unless they are periodical- ly recalibrated. On the other hand, failure to iso- late a degraded sensor may adversely affect the esti- mate of the measured variable. These difficulties can be circumvented in a nultiply redundant sensor system as follows: (1) All consistent measurements are simulta- neously compensated on-line such that their residuals are minimized. (2) The weights of individual measurements for computing the validated estimate are updated on-line on the basis of their respective a 0018-9499/83/0200-0820$01.00 ( 1983 IEEE 820