The AP1000 is an advanced pressurised water reactor (PWR) capable of producing approximately 1100MWe output, which received Final Design Approval from the US Nuclear Regulatory Commission (USNRC) on 13 September 2004. Design Certification is expected later in December 2005. The AP1000 design has been assessed by BNFL and British Energy for UK deployment and has been determined to be a viable option for the UK. The AP1000 features passive safety systems which use only natural forces, such as gravity, natural circulation, and compressed gas, to provide driving forces for the systems to assure safety following an accident without the need for operator action or the use of electrically driven devices.

The passive safety systems, in combination with the highly reliable control systems, provide significant safety improvements as measured by probabilistic risk analysis. The passive safety systems significantly reduce bulk commodities, and active components requiring stringent performance testing and safety qualifications. These reductions not only simplify the plant design, thereby reducing capital costs, but also reduce maintenance and operations testing, and their associated costs. In addition to being simpler, the passive safety systems do not require the large network of safety support systems needed in current generation nuclear plants, such as ac power, heating ventilation and air conditioning, cooling water systems, and the associated seismic buildings to house these components. These reductions in systems led to the elimination of the need to designate the onsite diesel generators and their support systems as safety-grade against USNRC classification requirements. This also led to significant reductions in the size and complexity of C&l systems classified by the USNRC as safety-grade. The C&I systems for the AP1000 are based on advanced digital technology and the use of processorbased systems.

The principal C&l systems are:

• The protection and safety monitoring system detects off-nominal conditions and actuates appropriate safety functions necessary to achieve and maintain the plant in a safe condition

• The plant control system provides the functions necessary for normal operation of the plant, as well as control of the non-safety defence-in-depth systems.

• The diverse actuation system provides an alternate means of initiating reactor trip and actuating selected engineered safety features and providing plant information to the operator.

This article describes the passive safety systems of the AP1000, the C&l architecture, and the design of the principal C&I systems. The paper focuses on how the concepts of diversity and defence-in-depth are used to meet USNRC and EPRI (US utility) safety goals