IEEE TRANSACTIONS ON NUCLEAR SCIENCE, VOL. 57, NO. 2, APRIL 2010 807
Integrated Robust and Resilient Control of NuclearPower Plants for Operational Safety and
High PerformanceXin Jin, Student Member, IEEE, Asok Ray, Fellow, IEEE, and Robert M. Edwards
AbstractThis paper presents an integrated robust and resilientcontrol strategy to enhance the operational safety and performanceof nuclear power plants. The objective of robust control is to min-imize the sensitivity of plant operations to exogenous disturbancesand internal faults while achieving a guaranteed level of perfor-mance with a priori specified bounds of uncertainties. On the otherhand, the role of resilient control is to enhance plant recovery fromunanticipated adverse conditions and faults as well as from emer-gency situations by altering its operational envelope in real time. Inthis paper, the issues of real-time resilient control of nuclear powerplants are addressed for fast response during emergency opera-tions while the features of the existing robust control technologyare retained during normal operations under both steady-state andtransient conditions. The proposed control methodology has beenvalidated on the International Reactor Innovative & Secure (IRIS)simulator of nuclear power plants.
Index TermsEmergency operation, nuclear power plant, oper-ational safety, resilient control, robust control.
BIBO Bounded-input bounded-output.
FSM Finite state machine.
IRIS International reactor innovative & secure.
LFT Linear fractional transformation.
LOFA Loss-of-flow accident.
MIMO Multi-input multi-output.
RCP Reactor coolant pump.
SISO Single-input single-output.
The variables that are used in the controller design procedure,described in Sections II and IV-B, are listed below.
Manuscript received November 12, 2009; revised January 24, 2010. Cur-rent version published April 14, 2010. This work was supported in part by theU.S. Department of Energy under NERI-C Grant DE-FG07-07ID14895 and byNASA under Cooperative Agreement NNX07AK49A. Any opinions, findingsand conclusions or recommendations expressed in this publication are those ofthe authors and do not necessarily reflect the views of the sponsoring agencies.
The authors are with the Department of Mechanical and Nuclear Engineering,The Pennsylvania State University, University Park, PA, 16802 USA (e-mail:email@example.com; firstname.lastname@example.org; email@example.com).
Color versions of one or more of the figures in this paper are available onlineat http://ieeexplore.ieee.org.
Digital Object Identifier 10.1109/TNS.2010.2042071
Low pass filter.
Field of complex and real numbers.
Disturbances and uncertainties.
Lower LFT of plant P and controller K.
Strictly proper transfer function.
Minimum-phase stable transfer functionmatrix.
Solution of algebraic Lyapunov equation.
Temperatures of the nuclear power plant.
Outputs of robust and resilient controllers.
Uncertainty input of .
Control action weighting function.
Sensor noise weighting function.
Tracking error weighting function.
Uncertainty in plant modeling.
Measurement of plant output and its estimate.
Output estimation error
Desired plant output following a desiredmodel.
Weighted control action.
Weighted tracking error.
Uncertainty output of .
-norm of a transfer matrix operator.
0018-9499/$26.00 2010 IEEE
808 IEEE TRANSACTIONS ON NUCLEAR SCIENCE, VOL. 57, NO. 2, APRIL 2010
State transition function of the FSM.
Set of all possible uncertainty.
Block structure of plant uncertainties.
Block structure of performance objectives.
Structured singular value.
Vector of adaptive parameters and itsestimate.
N UCLEAR power plants are complex dynamical systemswith many variables that require dynamical adjustmentsto achieve safety and efficiency over the entire operational enve-lope because their stability and performance could be severelylimited by a wide variety of safety requirements, operating con-ditions, internal faults, and exogenous disturbances. To achievethe specified goals, multiple control variables are simultane-ously manipulated for generating the required power and en-abling the plant to exploit alternate decision and control strate-gies. These strategies are often dictated by economy and safetyof plant operations. For example, feedback regulation of non-linear dynamics (e.g., control of reactor power and thermal hy-draulics in the balance of plant) could lead to static bifurcation,which is linked to degeneracy in the systems zero dynamics .
When faced with unanticipated situations, such as equipmentfailures or large exogenous disturbances to the plant controlsystem, the human operators are required to carry out diag-nostic and corrective actions. Even experienced operators couldbe overwhelmed by the sheer number of display devices andsensor outputs to be monitored. An intelligent decision and con-trol system with a large degree of autonomy could enhance theoperational safety and performance of nuclear plants by allevi-ating the burden of human operators and simultaneously miti-gating the adverse consequences at an incipient stage.
Several researchers have reported intelligent decision andcontrol methods (e.g., optimal control , fuzzy logic ,neural networks , and model predictive control ) to en-hance operational safety and performance of nuclear powerplants. Along this line, robust control techniques have also beeninvestigated , , where the role of a robust controller isto achieve disturbance rejection by reducing sensitivity of theplant control system (i.e., plant plus controller) to exogenousdisturbances and internal faults. The task is to synthesize arobust decision and control law on an infinite-time horizon by:
Mitigation of the detrimental effects of uncertainties andexogenous disturbances;
Trade-offs between plant stability and performance withinspecified bounds of uncertainties .
However, stability and performance robustness of such con-trol algorithms may not be assured beyond the a priori speci-fied bounds of uncertainties and disturbances; usually larger arethe bounds, lower is the plant performance and plant instability
is less likely. Therefore, the bounds of structured and unstruc-tured uncertainties are usually specified design parameters fortrade-off between stability and performance, and are often basedon nominal and off-nominal plant operations that may include atmost a few anticipated abnormalities. In the event of a plant acci-dent, the deviations from the nominal plant operating conditionsmay significantly exceed these uncertainty bounds. Hence, im-mediate actions beyond the regime of robust control are neededfor operational safety and subsequent restoration of normalcy tothe original operational mode or to a gracefully degraded mode.
Guo et al.  have investigated resilient propulsion controlof aircraft to determine on how engine control systems can im-prove safe-landing probabilities under adverse conditions. Thekey idea is as follows: In emergency situations, the conserva-tive procedure of engine control may not be suitable for aircraftsafety; it may be advantageous to compromise the engine healthto save the aircraft. The aim of their research is to develop adap-tive engine control methodologies to operate the engine beyondthe normal domain for emergency operations to enhance safelanding at the expense of possibly partial damage in the aircraft.Motivated by this idea, resilient controllers can be designed fornuclear power plants to ensure the operational safety by sacri-ficing performance under adverse conditions. Recently, Hov-akimyan and coworkers  have reported a control algorithmcalled -adaptive control to address the issues in Integrated Re-silient Aircraft Control (IRAC) that is an active area of researchin National Aeronautics and Space Administration (NASA). Itis noted that the notion of resilience, introduced in the presentcontext, is entirely different from being non-fragile or insensi-tive to some errors in the nominal state-space matrices of con-troller during implementation .
The role of the proposed resilient control in a nuclear powerplant is to enhance recovery of the control system from unan-ticipated adverse conditions and faults as well as from emer-gency situations by altering its operational envelope in real time. Resilient decision and control laws are synthesized on afinite-time horizon as augmentation of robust decision and con-trol with the objectives of:
Reliable and fast recovery from adverse conditions andemergency situations;
Restoration of the control configuration upon returning tonormalcy or upon graceful degradation within design spec-ifications.
This paper addresses the issues of real-time resilient con-trol of nuclear power plants for fast response during emergencyoperations while the features of the existing robust controllerare retained during normal operating conditions. The goal is toformulate and validate resilient and reconfigurable control al-gorithms toward deployment of real-time controllers for emer-gency recovery of nuclear plants from expected and unexpectedadverse conditions.
The integrated robust and resilient control strategy, developedin this paper, has been tested on the International Reactor Inno-vative & Secure (IRIS) simulator ,  that is built uponone of the next generation nuclear reactor designs for a mod-ular pressurized water reactor with an integral configuration.Currently, IRIS is in the stage of pre-application licensing withNuclear Regulatory Commission (NRC); its safety testing for
JIN et al.: INTEGRATED ROBUST AND RESILIENT CONTROL OF NUCLEAR POWER PLANTS 809
Design Certification (DC) is expected to be completed by 2010with deployment in the 20152017 time frame.
The major contributions of the paper are delineated below: Introduction of the innovative concept of resilient control
in nuclear plant control for fast recovery from unantici-pated adverse conditions and emergency situations.
Extension of the concept of robustness by integration withresilience for control of nuclear power plants under bothnormal operations and emergency situations.
Validation of the concept of integrated robust and resilientcontrol of nuclear power plants on the IRIS simulator.
The paper is organized in five sections including the presentone. Section II presents underlying principles of robust con-trol and resilient control. Section III addresses integration of ro-bust control and resilient control strategies. Section IV presentstesting and validation of these strategies on the IRIS simulator.The paper is summarized and concluded in Section V.
II. ROBUST AND RESILIENT CONTROL
This section introduces the underlying principles of multi-variable robust control and resilient control for nuclear powerplants, where robust controllers are designed by the -based
-synthesis method  and resilient controllers are designedby -adaptive output feedback algorithm . A finite statemachine is then used to integrate the above two controllers fornormal operation and emergency recovery from both expectedand unexpected adverse conditions while bumpless transferbetween the control modes is assured by usage of smoothingfilters.
A. Robust Multivariable Control Using -Synthesis
In this paper, a -synthesis robust control approach is used tosynthesize the feedback controller. The plant uncertainties, in-cluding the effects of unmodeled dynamics, linearization, andmodel reduction, are characterized and estimated. Based on thespecified uncertainties, robust multivariable controllers are de-signed using D-K iteration  based on the stability and perfor-mance specifications. The order of the synthesized controllersis then reduced to an acceptable level by Hankel norm approxi-mation .
1) Uncertainty Modeling: Uncertainties due to the inabilityto model relevant dynamics in an actual plant and the simplifi-cation to achieve a mathematical representation, including lin-earization and model reduction, are taken into consideration forsynthesis of robust controllers. Consequently, robustness of thesynthesized controller is dependent on the type and size of theuncertainties.
In the controller design for nuclear power plants, Shyu andEdwards  considered three types of uncertainties due to un-modeled dynamics, linearization, and model reduction, respec-tively. These uncertainties contribute to the deviation betweenthe real plant and its reduced-order linear model, based on whichthe robust controller is synthesized. The unmodeled uncertain-ties are obtained from the modeling process where the governingequations are derived to represent the plant dynamics includingthe errors induced by linearization and model reduction.
Unstructured uncertainties, represented by the difference ofthe magnitude of input-output frequency response at each fre-
Fig. 1. Closed-loop system interconnection diagram.
quency point, are used in this paper. This bound is defined by thenorm of the uncertainty matrix. The overall uncertainty boundis chosen to cover the summation of all uncertainties consideredabove, i.e.,
where is bound of the overall uncertainty, is theoverall uncertainty which is the summation of the magnitudesof linearization uncertainty , model reduction uncertainty
, and unmodeled uncertainty .The uncertainty bounds are defined as in (2) in a diagonal
matrix form to cover the overall uncertainty. For the purpose ofrobust controller design, it is advantageous to normalize uncer-tainty with a frequency dependent weighting function :
where , and.
2) Performance Specifications: Selection of weighting func-tions and interconnection of the closed-loop system is an essen-tial step in the synthesis of a robust controller. The weightingfunctions that specify the plant uncertainty and performancespecifications invariably need to be adjusted iteratively. Fig. 1shows the block diagram of closed-loop control system with per-formance specifications, as explained below.
The uncertainty weighting function represents the in-tegrated uncertainty bound.
The tracking error weighting function specifies the per-formance requirements, which is chosen in such a way thatthe steady-state tracking errors in both channels should besmall (e.g., on the order of 0.01 or less).
The control action weighting function is used to atten-uate the control action efforts. That is, if the control actionis excessive, is tuned offline to penalize the control ef-forts, and conversely if the plant response is sluggish.
The sensor noise weighting function represents the fre-quency-dependent effects to filter the measurement noise.
Upon selection of the above weighting functions, the nom-inal plant model can be interconnected with the weightingfunctions (i.e., , , , and ) to generate the aug-mented plant , as shown in Fig....