Abstract: A method is provided of operating a reactor trip system, including: determining whether an automated shutdown of the nuclear plant has been demanded; energizing an interface relay to de-energize an undervoltage coil of a circuit breaker when the automated shutdown has been demanded; energizing an interface relay to energize a shunt trip coil of the first circuit breaker when the automated shutdown has been demanded; de-energizing the undervoltage coil when the manual shutdown has been demanded; energizing the shunt trip coil when the manual shutdown has been demanded; performing a check of a cyclical execution of processors in first and second divisions using separate watchdog timers in each division and determining whether watchdog timer signals have been de-energized in the first and second divisions; and de-energizing the undervoltage coil if the first and second watchdog timer signals have both been actuated.

Abstract: A safety system for a nuclear power plant includes first through fourth sensors; a first division, including a first calculation module that determines first and second calculation results based on signals from the first and second sensors, a first data-sharing module for sharing the first and second calculation results with a second division, and a first voting logic for generating a first safety demand signal based on the first through fourth calculation results; and the second division, including a second calculation module for determining the third and fourth calculation results based on signals from the third and fourth sensors, a second data-sharing module for sharing the third and fourth calculation results with the first division, and a second voting logic for generating a second safety demand signal based on the first, second, third, and fourth calculation results, wherein the first through fourth sensors each monitor the same plant parameters.

Abstract: A safety system for a nuclear power plant includes first through fourth sensors; a first division, including a first calculation module that determines first and second calculation results based on signals from the first and second sensors, a first data-sharing module for sharing the first and second calculation results with a second division, and a first voting logic for generating a first safety demand signal based on the first through fourth calculation results; and the second division, including a second calculation module for determining the third and fourth calculation results based on signals from the third and fourth sensors, a second data-sharing module for sharing the third and fourth calculation results with the first division, and a second voting logic for generating a second safety demand signal based on the first, second, third, and fourth calculation results, wherein the first through fourth sensors each monitor the same plant parameters.