Control Engineering Europe – March 2019

Figure 1

MONITORING

the adoption of MEMS (Micro Electro-
Mechanical Systems) devices in a wide
range of sensing applications. These
devices offer a low frequency response
and exhibit the required dynamic range
for strong motion seismic monitoring.
MEMS devices have been widely
used in civil engineering applications
since the 1990’s, their relative low
cost and small size suite applications
where many measurement points are
required on structures for a limited
period of time. However, adoption of
this technology has been slow for the
seismic protection market, where stated
reliability and maintainability are the
key requirements.
How can you verify that an installed
strong motion sensor is working
correctly, when for most of the time
there is nothing to measure? This
situation is exacerbated by the sensor
installation which is normally difficult to
access. With broadband seismometers
it is common to have a secondary coil
arrangement which can be excited
and therefore stimulate movement of
the mass to verify calibration without
physical shaking.
Sensonics has incorporated a similar
mechanism into its piezo electric based
seismic sensors to ensure the measuring
element is operating to the correct
sensitivity; this self-test feature is a
critical requirement which will become
apparent when we look at the overall
system design.
It is common to utilise redundant
sensor configurations in the overall
monitoring system concept
(See figure 1) for a detailed functional
block diagram of a modern day seismic
monitoring and protection system.
Three separate physical locations are
monitored with triaxial sensors capable
of measuring acceleration in the three
orthogonal axes.
The acceleration of each sensor is
processed by a trip amplifier with the
overall triaxial unit performing a one
out of three (1oo3) logic operation
to derive the location OBE alarm. The
trip alarms from each location are fed
back to the central control panel which

performs a subsequent two out of three

logic operation to determine the final

trip result. In this example the voting

logic is also redundant to enhance

reliability and maintainability. The final

element of the system is connected to

the specific plant circuit breakers or to

the emergency shutdown system to

complete the safety loop.

For redundancy, a simple one out of

two (1oo2) system should meet with

the reliability requirements, in fact

demonstrating a higher reliability than

the 2oo3 system. However, this system

configuration offers no protection

against spurious trips which can result

from mechanical interference or

sensor failure. Two out of two (2oo2)

is an alternative option that can be

considered, however on failure of a

channel the system defaults to a 1oo1

system, whilst the 2oo3 option on

channel failure can revert to either

2oo2 or 1oo2, both of which are

preferred over 1oo1, making the 2oo3

system the norm for nuclear protection

applications.

Proof-tested design

Combine these channels with dual

voting arrangements and the sensor

inbuilt test function results in a

system design that can be fully proof

tested whilst on line, maximising the

availability of the system. Each voting

circuit can be isolated and tested in

turn through signal injection of each

sensor, a critical aspect of the system

performance being the sensor will still

respond to an real seismic event even

whilst under test.

The avoidance of smart devices

within the protection loop also eases

the analysis burden to meet with the

safety requirements and is the preferred

solution for most clients. Separating

the protection and event recording

functions is a logical step which enables

the latest technologies and features to

be utilised for the seismic waveform

recording without impacting on the

protection safety case.

Use of proven technologies in

combination with measurement

redundancy tends to be the industrial

norm for modern day nuclear

applications; with self-testing features

and spurious trip performance being of

particular importance in relation to the

automatic shutdown systems.

Adopting this best practice has

become standard for new installations

and should also be considered

for obsolete seismic monitoring

equipment on existing sites. A

stated and demonstrated reliability,

minimal spurious trip occurrence,

full measurement loop proof

testing, maximum design life and

maintainability combined with a low

demand and high integrity shutdown

system is now the expected norm.!

System Panel

Channel B2oo3 Vote (^)
AlarmRelays (^)
Uninterruptible Power Supply 1
Channel A2oo3 Vote (^)
Safety Critical Functions
Sensors Logic Final element
Supporting Functions
Uninterruptible Power Supply 2
X
Y
Z
OutputDual
Seismometer 2
X
Y
Z
OutputDual
Seismometer 1
X
Y
Z
OutputDual
Seismometer 3
Trip Test &Calibration Ch A status Indicator
Record Replay Print Ch BIndicator status
Fault sAnnunciatortatus AnnunciatorTrip status
Control Engineering Europe http://www.controlengeurope.com March 2019 27