EMC in New Nuclear Plants: Digital I&C, RG 1.180, IEC 62003

The first new reactors in decades in the United States and Western Europe share a feature that older plants did not have when they started up: their instrumentation and control (I&C) is digital, from the input cards to the screen-based control room. That changes the role of electromagnetic compatibility. In an analog plant, interference mostly meant noisy readings. In a digital plant, a disturbance can reset a processor, corrupt a message or cause a spurious actuation in a safety system.

The new builds at a glance

Recent Western projects use two designs: the Westinghouse AP1000 in the United States and the EPR in Europe. Both were designed from the start with microprocessor-based protection and control systems, rather than adding digital equipment to an analog architecture.

Why EMC becomes a safety issue with digital I&C

Analog protection channels usually degrade gracefully: interference adds noise or an offset at a trip comparator, and the error grows with the disturbance. Digital equipment fails differently. A fast transient far below any damage threshold can still cause a malfunction whose effect has no relation to the size of the disturbance.

• Reset or lock-up: a burst on a power or I/O port disturbs a clock or reset line. The watchdog takes the channel out of service or, if the design is poor, the channel freezes at its last output.
• Data errors: corrupted frames on a link between cabinets or divisions. They must be detected and rejected, never acted on.
• Spurious actuation: a false state on a digital input can start a pump or move a valve, which in a safety system is itself an event that has to be analysed.
• Common-cause failure: redundant divisions often run on the same hardware platform. If one disturbance, such as a switching transient on a shared supply or a handheld radio in a corridor, affects all divisions at once, redundancy no longer protects the safety function.

Operating experience in power plants includes spurious signals attributed to handheld radios, welding during outages and switching of large loads. For this reason regulators treat EMC as part of equipment qualification, next to environmental and seismic qualification, and not only as a market-access requirement.

The main requirement documents

NRC Regulatory Guide 1.180 (United States)

RG 1.180, Guidelines for Evaluating Electromagnetic and Radio-Frequency Interference in Safety-Related Instrumentation and Control Systems, describes a method that the NRC staff considers acceptable for showing EMI/RFI compatibility of safety-related I&C. It does not invent new tests. It endorses MIL-STD-461 test methods (for example CE101, CE102, RE101, RE102, CS114, CS115, CS116, RS101 and RS103), alternative IEC 61000-4 methods, and IEEE C62.41 and C62.45 for surges, and it states the emission limits and test levels to use with them. It also endorses IEEE Std 1050 for grounding and installation practice and deals with portable transmitters through exclusion zones.

IEC 62003 (international nuclear I&C)

IEC 62003, prepared by subcommittee SC 45A, sets EMC testing requirements for I&C equipment important to safety in nuclear power plants. It uses the IEC 61000-4 immunity methods and CISPR emission methods familiar from commercial work, but chooses test levels for the plant environment and requires acceptance criteria tied to the safety function. It belongs to the SC 45A family with IEC 61513 (system-level requirements for safety I&C) and IEC 61226 (classification of I&C functions), and it is commonly referenced where licensing follows IEC nuclear standards, as in much of Europe.

IEC 61000-6-5 (power station and substation environment)

IEC 61000-6-5 is a generic immunity standard from TC 77 for equipment used in power stations and substations. It is not nuclear-specific and covers immunity only, but it describes the electromagnetic environment of a generating station by port type and location, including disturbances typical of high-voltage switching. It is useful for balance-of-plant equipment, for equipment without a dedicated product standard, and as a cross-check that the levels chosen for a safety system are not below the general plant environment.

What gets tested and what it represents

The acceptance criterion is where nuclear testing differs most from commercial testing. Commercial immunity standards such as IEC 61000-6-2 accept, for many transient tests, a temporary loss of function that recovers by itself. For a safety function that is usually not acceptable. The test plan typically requires that safety outputs do not change state, that diagnostics may report a fault but must not cause an unintended trip, and that communication errors are detected. The equipment is tested in a representative configuration with its application software running, and every safety output and communication link is monitored during the exposure, not just checked afterwards.

Design measures that work in a plant

• Fibre-optic links between redundant divisions and between safety and non-safety systems. They remove the galvanic path for common-mode transients and support the electrical isolation required between divisions.
• Cable separation by category. Low-level analog signals, digital communication and power cables run in separate trays or with documented separation distances, which also supports the physical independence of safety divisions required by IEEE Std 384.
• Shield termination at the cabinet entry. Cable shields are bonded 360° at the gland plate instead of with pigtails, and the plant grounding concept (for example per IEEE Std 1050) is decided once and applied consistently.
• Protection at the cabinet boundary. Surge protective devices and filters at the entry points divert transients before they reach logic boards, instead of relying on protection deep inside the electronics.
• Fail-safe behaviour, watchdogs and diversity. The AP1000, for example, includes a diverse actuation system so that a common-cause failure of the main protection platform does not remove all protective functions.

Two simple estimates are useful in design reviews: the field strength a handheld radio of known power produces at a given distance, which sets a sensible exclusion distance, and the amplifier power needed to reproduce the qualified field strength in the test chamber. If cabinet shielding is claimed as a measure, it should be verified by an insertion-loss measurement rather than assumed.

Common mistakes and limits

• Assuming that a CE-marked industrial product is already qualified. Its test report shows commercial levels and criteria; the nuclear test plan may require different levels, wider frequency ranges and stricter performance criteria.
• Testing a single card on the bench. Cable lengths, grounding and the software load change the result, so the tested configuration should match the installed one or the differences should be justified.
• Forgetting that the plant keeps changing. A new variable-speed drive, a wireless network or a re-routed cable changes the environment; modifications need an EMC review, and site measurements help confirm the assumed environment.
• Treating EMC as a final test. Separation, grounding and cabinet layout are fixed early in a plant design, and a failure found late in the project costs far more to fix than in a commercial product.