How Ageing Nuclear Plants Replace Their Safety Systems
Engineers designing a reactor that started up in 1979 chose control equipment from the early 1970s. Analogue relays. Hard-wired logic. Paper chart recorders. Much of that hardware is still in service, and the engineers who designed it have long since retired.
That is the quiet problem facing a large share of the world’s nuclear fleet. Not the reactor itself, which is a pressure vessel and concrete, but the nervous system attached to it.
How many plants this affects
The International Atomic Energy Agency counted 417 operational reactors across 31 member states at the end of December 2024, supplying 377 GW(e) of capacity. Those figures come from the agency’s Reference Data Series No. 2, which is the authoritative annual count.
Age is the relevant variable. The IAEA publishes a breakdown of the fleet by years in service, and the distribution skews old, because utilities commissioned most of the world’s reactors during one construction wave, running from the mid-1970s to the late 1980s.
Operators facing the end of an original 40-year design life have three options. Shut down. Build new. Or run the plant longer, which means convincing a regulator that the safety case still holds. That argument increasingly turns on the protection and monitoring systems.
What makes this equipment different
The general category is industrial control systems, spanning everything from a factory PLC to a reactor protection system that can trip a plant automatically when a monitored parameter crosses a threshold.
Nuclear versions carry an extra demand: they must keep working correctly when part of themselves has already failed. A single-failure criterion, redundant channels, physical and electrical separation between those channels, and independent diagnostics all follow from that requirement. The IAEA sets out the expectations in its safety standard for I&C systems important to safety.
Those standards bind no country automatically. National regulators reference them, which makes them the closest thing the industry has to a shared technical baseline, and gives a project built to them credibility across borders.
It is also why a nuclear I&C upgrade takes years where a factory automation project takes months. Showing that a system behaves correctly under normal conditions is the easy half. Showing how it behaves while failing is the work.
The software problem, and one way around it
Digital upgrades introduce a difficulty analogue systems never had. Identical software running on redundant channels can fail identically, at the same moment, for the same reason. Redundancy stops protecting you when every channel shares the same latent defect.
This common-cause failure question is why regulators scrutinise digital I&C so heavily. The US Nuclear Regulatory Commission maintains a dedicated digital I&C programme and has spent years modernising the regulatory infrastructure around it, on the principle that requirements stay constant between analogue and digital while the guidance for demonstrating compliance differs substantially.
One engineering response is to avoid the microprocessor entirely. A field-programmable gate array implements logic in configurable hardware rather than as instructions executing on a processor. No operating system, no scheduler, no interrupts — which removes whole categories of software failure from the safety argument. The NRC lists FPGA technologies alongside conventional software-based systems among the approaches it expects operating reactors to adopt.
Ukraine’s RPC Radiy Kropyvnytskyi is one of a small number of suppliers built around that FPGA approach. The company states it has worked on watchdog timer boards for emergency protection systems at Canada’s Darlington and Pickering stations, supplied circulation pump speed sensors at Argentina’s Embalse plant, and delivered a reactor control and protection system during modernisation at Bulgaria’s Kozloduy. Treat those as company-published claims rather than independently verified records. Few firms operate in this niche, and outside verification is correspondingly thin.
Why the work is incremental
What that project list illustrates is the shape of the sector. Modernisation is rarely a wholesale replacement.
One job is a component swap, replacing a board whose semiconductors nobody manufactures any more. Another is a subsystem, such as a set of sensors on a pump. A third is a complete protection system. All three sit under the same safety framework, and all three share a constraint: the rest of the plant keeps operating.
Obsolescence drives more of this than performance does. When a manufacturer stops producing a component, spares eventually run out, and an operator holding no replacement for a safety-related board has a regulatory problem rather than a maintenance one.
Where this goes next
The pressure is not easing. Reactors continue to age faster than new ones come online in most regions, and every long-term operation licence renewal reopens the same question about the plant’s protection systems.
There is an unresolved tension underneath all of it. Regulators want the diagnostic capability and self-testing that digital systems provide. They also want the simplicity of a system whose failure modes can be enumerated exhaustively. Those two wants pull in opposite directions, and the choice between processor-based and hardware-logic designs is where the industry is still arguing about the balance.
Observer Voice is the one stop site for National, International news, Sports, Editor’s Choice, Art/culture contents, Quotes and much more. We also cover historical contents. Historical contents includes World History, Indian History, and what happened today. The website also covers Entertainment across the India and World.
