Accidents control systems, linked

Limitations in the Soviet manufacturing capacity for specialist equipment such as electronics and control, and the lack of a comprehensive quality assurance system, linked to the pressure to design and build plant that could be manufactured, constructed and commissioned quickly, led to a design which, in both concept and detail, has features which impaired ultimate plant safety. Among the features of the design which appear to be questionable, some of which contributed to the initiation and development of the accident at the Chernobyl 4 reactor, the following merit noting ... 

The second link in the accident sequence is lack of control. This lack of safety management control could be a weak safety systan in place, no safety system standards, noncompliance to the standards, or a total lack of a structured safety management system (SMS). This is often indicated by a negative or nonexistent safety culture. This triggers off the basic causes of accidents. If no formal SMS is in place, this would be classified as an inadequate control system. 

Dutyholders should ensure that they have implemented a competence management system, linked to major accident risk assessment, to ensure that anyone whose work impacts on the control of major accident hazards is competent to do so. 

Process and organisational solutions of design developments shall ensure maximum independence of MHR-T modules during operation and in all possible accidents with radiation emission/release. Links between MHR-T modules and between these modules and process lines and overall infrastructure (control, support and auxiliary systems) shall be determined at the design stage. 

The control of the nuclear and chemical reactivity in case of accidents is insured by the emergency shutdown systems. The safety function devoted to the thermal power extraction from the HYPP is directly linked to the control of the chemical reactivity because the kinetics of chemical reactions increases with the temperature. The HYPP must be cooled by emergency systems, water streaming on equipments, spraying systems, and so on. 

Figure 11.10 shows the remaining links after all these losses. At the time of the accident, there were no complete feedback loops left in the system and the few remaining connections were partial ones. The exception was the connection between the TCAS units of the two aircraft, which were stiU communicating with each other. The TCAS unit can only provide information to the crew, however, so this remaining loop was unable to exert any control over the aircraft. 

This model is wholly compatible with the Bowtie model of the accident process, leading from exposure to hazards, through a central loss of control event to accident consequences Figure 2.7.3). This model links the barriers, preventing the accident process from propagating, which may be hardware barriers or behavioural/procedural barriers, to the management system needed to put them in place and keep them functioning. 

Oral communications between the main control room, the supplementary control rooms, other suitable plant locations and ofif-site emergency services are important to safety, particularly under conditions of anticipated operational occurrences or design basis accidents. Such conunuiucations should normally be provided with two, preferably diverse communication Unks and should be electromagneticaUy compatible with the I C systems (self-powered telephones, battery operated telephones, hand held portable radios). These communication links should be routed in such a way that fires, failures of electrical systems or other applicable PlEs cannot incapacitate both systems simultaneously. 

---