Error actuated system

The intrinac self-protection of the reactor, the use of self-actuating systems for shut down and cooling of the reactor in combination with passive principles of action ensure immunity to operator errors and equipment failures. 

An automatic control system is said to be error actuated because the forwardpath components comparator, controller, actuator, znd plant or process) respond to the error signal (Fig. 18.1). The error signal is developed by comparing the measured value of the controlled output to some reference input, and so the accuracy and precision of the controlled output are largely dependent on the accuracy and precision with which the controlled output is measured. It follows then that measurement of the controlled output, accomplished by a system component called the transducer, is arguably the single most important function in an automatic control system. 

An assessment of the final design should be made to verify the adequacy of the test provisions for the protection system, the safety actuation systems and the safety system support features. The results of this assessment should be documented, and those areas of the design that are sensitive to either equipment failure or human error in any aspect of system testing and equipment testing should be identified in the documentation. 

Fig. 4.1 Block diagram of a closed-loop control system. R s) = Laplace transform of reference input r(t) C(s) = Laplace transform of controlled output c(t) B s) = Primary feedback signal, of value H(s)C(s) E s) = Actuating or error signal, of value R s) - B s), G s) = Product of all transfer functions along the forward path H s) = Product of all transfer functions along the feedback path G s)H s) = Open-loop transfer function = summing point symbol, used to denote algebraic summation = Signal take-off point Direction of information flow.

The main characteristics which determine the performance of a wavefront corrector are the number of actuators, actuator stroke and the temporal response. The number of actuators will determine the maximum Strehl ratio which can be obtained with the AO system. The price of a deformable mirror is directly related to the number of actuators. The actuator stroke should be enough to compensate wavefront errors when the seeing is moderately poor. This can be derived from the Noll formula with ao = 1.03. For example, on a 10m telescope with ro = 0.05m at 0.5 m, the rms wavefront error is 6.7 /xm. The deformable mirror stroke should be a factor of at least three times this. It should also include some margin for correction of errors introduced by the telescope itself. The required stroke is too large for most types of deformable mirror, and it is common practice to off-load the tip-tilt component of the wave-front error to a separate tip-tilt mirror. The Noll coefficient a2 = 0.134 and... 

The main error sources are noise in the wavefront sensor measurement, imperfect wavefront correction due to the finite number of actuators and bandwidth error due to the finite time required to measure and correct the wavefront error. Other errors include errors in the telescope optics which are not corrected by the AO system (e.g. high frequency vibrations, high spatial frequency errors), scintillation and non-common path errors. The latter are wavefront errors introduced in the corrected beam after light has been extracted to the wavefront sensor. Since the wavefront sensor does not sense these errors they will not be corrected. Since the non-common path errors are usually static, they can be measured off-line and taken into account in the wavefront correction. 

A fault is understood as an unpermitted deviation of at least one characteristic property or parameter of the system from the acceptable, usual or standard condition. A fault can stem from several origins as depicted by the Figure 1. It can be caused by an unexpected perturbation i.e., a major deviation from one input acting on the system) or by a disturbance i.e., the action of an unknown and uncontrolled input on the system). Another fault origin can be an error of any sensor or actuator, which is a deviation between the measured and the true or specified value. 

Errors that resulted in the component being unavailable when needed—For example, equipment not restored to full operability following maintenance, testing, or inspection. Valves left closed, actuation or protective systems not reconnected, slip-blinds left in the line, or failing to return pump selector switches to the standby auto-start position are common examples. 

The full system input flow continues to feed the vessel while the outlet is partially or totally blocked due to personnel error, valve failure, actuator failure,... 

Bourdon pressure element (receiving element). This part of the system evaluates the signal from the primary element, and converts it into scale readings, chart records, and actuation for the error detector. 

As stated previously, the resulting sensed variable signal is compared at the controller to a desired level, or set point, for that variable. The set point is established by the plant operator or by an upper-level control system. Any error (difference) between these values is used by the controller to compute the correction to the controller output, which is transmitted to the valve or other actuator of the system s parameters. 

The basic principle of feedback control is shown schematically below. A system is observed by sensors that produce measurements (y) at each time these measurements are compared to the desired performance of the system (r) and the difference between the desired (r) and actual state (y) is used to create an error (c = r — y) a controller, usually implemented on a computer or via analog circuitry, operates on this error to decide which actuation actions (m) should be applied to the system to change its state from where it is to where it should be. 

However, the particle motion depends on the droplet shape and the number of electrodes that the droplet overlays at any given moment. Since this is not known a priori, we use local estimation and control at each time step of our simulation to compute the pressure boundary conditions needed to realize the desired flow field. At each instant in time, the control algorithm is provided with the droplet shape and particle locations, as would be available through a vision sensing system. Any deviation of the particles from their desired trajectories that may arise from thermal fluctuatimis, external disturbances, and actuation errors is corrected using feedback of the particle positions. We now give an overview of our algorithm ... 

The latter two methods can both be utilized with two very different control methods. Some systems that rely on a self-assembly approach in random interactions are used to bring the parts into position, and the parts and assembly environment are designed to create the forces that hold them together. The assembly system is simplified because there is no need for a control system and the associated actuation to guide the parts. However, most systems require the assembly of multiple parts with controlled orientation and sequence. It is difficult to design the bonding and agitation systems that can complete this process reliably without errors. Alternatively, a feedback system can be implemented to control the motion of the components. This facilitates the assembly of more complex systems, but requires more complexity in the assembly equipment. 

A check made during the above mentioned review showed that, on the contrary, for a period of time at the start of core life, the actuation of the safety injection system would have caused a net increase of reactivity, infringing one of the fundamental system specifications. Although the design team had doubts about the credibility of this finding, the error proved to be real and the safety review committee were thanked for their contribution to perfecting the design. 

Although the operator knows that an unnecessary actuation of ADS can cause thermal shock to the reactor vessel, once the level reaches the Top of Active Fuel (TAF), the ADS actuation should no longer be inhibited. In this sequence, it is postulated that the operator continues to inhibit the ADS despite the fact that low pressure system injection is required, due to the level indicator failure. For this reason, inhibition of the ADS is considered an error of commission in this context. 

Based on the PW modulator, the PID controller is designed to control the multi-stacked actuator. The control system is illustrated in Fig. 7.24. The PID controller transforms the error between the command and the feedback signals from the sensor to the command for the PW modulator. The PW modulator transforms the output of the PID controller into a pulse sequence, which is applied to the multi-stacked actuator. 

The multivariable adaptive control algorithm was applied in simulation for the PFR/CSTR reactor system described above. On-line measurement of monomer conversion (via density) and particle size (via light scattering) were assumed. White noise was added to the model inputs and outputs simulating actuator and sensor errors, respectively. 

In the LTOP mode, each SCS relief valve is designed to protect the reactor vessel given a single failure in addition to the failure that i iitiated the pressure transient. The event initiating the pressure transient is considered to result from either an operator error or equipment malfunction. The SCS relief valve system is independent of a loss of offsite power. Each SCS relief valve is a self actuating spring-loaded liquid relief valve which does not require control circuitry. The valve opens when the RCS pressure exceeds its setpoint. 

The design of the plant should be tolerant of human error. To the extent practicable, any inappropriate human actions should be rendered ineffective. For this purpose, the priority between operator action and safety system actuation should be carefully chosen. On the one hand, the operator should not be allowed to override reactor protection system actuation as long as the initiation aiteria for actuation apply. On the other hand, there are simations where operator interventions into the protection system are necessary. Examples are manual bypasses for testing purposes or for adoption of acmation criteria for modifications to the operational state. Furthermore, the operator should have an ultimate possibility, under strict administrative control, to intervene in the protection system for the purposes of managing beyond design basis accidents in the event of major failures within the reactor protection system. 

---