Abstract
This paper discusses progress in the design of the control, interlock and safety systems of the Tokamak Cooling Water System (TCWS) for the ITER fusion reactor. The TCWS instrumentation and control (I&C) is one of approximately 200 separate plant I&C systems (e.g., vacuum system I&C, magnets system I&C) that interface to a common central I&C system through standardized networks. Several aspects of the I&C are similar to the I&C of fission-based power plants. However, some of the unique features of the ITER fusion reactor and the TCWS (e.g., high quasi-static magnetic field, need for baking and drying as well as cooling operations), also demand some unique safety and qualification considerations. The paper compares the design strategy/guidelines of the TCWS I&C and the I&C of conventional nuclear power plants. Issues such as safety classifications, independence between control and safety systems, sensor sharing, redundancy, voting schemes, and qualification methodologies are discussed. It is concluded that independence and separation requirements are similar in both designs. However, the voting schemes for safety systems in nuclear power plants typically use 2oo4 (i.e., 4 divisions of safety I&C, any 2 of which is sufficient to trigger a safety action), while 2oo3 voting logic - within each of 2 independent trains - is used in the TCWS I&C. It is also noted that 2oo3 voting is also acceptable in nuclear power plants if adequate risk assessment and reliability is demonstrated. Finally, while qualification requirements provide similar guidance [e.g., both IEC 60780 (invoked in ITER-space), and IEEE 323 (invoked in fission power plant space) provide similar guidance], an important qualification consideration is the susceptibility of I&C to the magnetic fields of ITER. Also, the radiation environments are different. In the case of magnetic fields the paper discusses some options that are being considered.
