Safeguarding a new OPAL reactor

A $350 million OPAL reactor is soon to produce neutrons for eight neutron beam instruments (NBI) that will enable scientists to investigate the atomic structure of new materials, chemical reaction kinetics and biological processes. The instruments will operate almost continuously and demand from the international scientific community for access is already keen.

Australian Nuclear Science and Technology Organisation (ANSTO) electrical project engineer Frank Darmann and his team were responsible for the solution.

The safety system begins with the science itself. Neutrons from the reactor are directed at the materials under investigation to see how they scatter, revealing the materials' atomic structures. Three shutters control the flow of particles along the neutron beam guide. A primary shutter sits at the reactor face and a secondary shutter at the guide hall interface, which is closed when access to the shielded areas is needed. A third sample shutter is attached to each instrument.

Access to the instrument area is interlocked with the sample and secondary shutters, using Fortress gate locks. The positions of another 76 moveable radiation-shielding blocks are detected by dual channel limit switches. An array of light curtains, sirens, dual channel safety switches and 78 emergency stops add to the security of the NBI. It adds up to a complex system with some 1200 inputs and outputs (I/O).

Coordinating them are five Pilz Programmable Safety Systems (or safety PLCs), each one dedicated to a separate safety zone. This configuration is easily justified, says Darmann.

"The mean time between failures (MTBF) to a safe condition - that is, a failure that only affects operations, not safety - of this myriad of devices with a Pilz PSS overseeing them would be 3.4 years," he said.

"Otherwise, we would have needed a complex web of interconnections and the MTBF to a safe condition would have been less than six months."

The reliability of the Pilz PSS was also matched with powerful diagnostic software, so that even if a failure did occur, down time would be minimised.

"Locating a fault in a maze of 100 relays would be difficult and time consuming but the PSS indicates the malfunctioning unit or circuit exactly on a touch screen," Darmann said. "Circuitry is automatically and continually checked for welded contacts and short circuits instead of once a year or never."

Other benefits include the ability of the logic-based system to be readily expanded, reconfigured and upgraded, resulting in a reduction of about 70% in control cabinet real estate.

"The web of complex physical wiring interconnections is also eliminated, which makes tweaking the system to match changing and demanding operational requirements much easier, and also simplifies fault finding, documentation and change management processes.

The Safety Interlock System (SIS) and Instrument Control System (ICS) remain separate for maximum safety.

"Each has independent logic elements, power supplies and cabling. Opto-isolation of logic between the two systems ensures electrical separation," Darmann said.

"There are, however, some interfaces between them to assist the smooth operation of the instrument. For example, the ICS has access to all of the logic states that exist within the NBI SIS so that computer control of the instrument does not commence until the SIS deems it is safe. In addition, the ICS can make a limited number of requests of the NBI SIS, such as closing or opening a shutter after the furnace temperature is met, which it is free to deny."

The result is a safety system that complies with Australian Standards AS4024.1, the NHMRC code of practice stipulated by the regulator, ARPANSA, and state regulations, yet performs unobtrusively.