Beyond-Design-Basis Initiating Events

To withstand large SG leaks (a postulated rupture of several SG tubes, i.e., a beyond design basis initiating event), the gas system is connected with the passive heat removal system (PHRS) tank. The connection line is blocked by a membrane device designed for rupture under a gas system pressure of 1 MPa that is not dangerous for the reactor mono-block vessel. In the event of membrane rupture, the steam will be condensed in the water of the PHRS tank. In this, the volatile radionuclides of the cover gas remain in the tank water and the radioactive uncondensed gases will be released into the atmosphere via the filtered ventilation system. The radioactivity release will not exceed the permissible levels. 

As demonstrated in Seetion 8.4.3.8, the APIOOO design does not rely on contaimnent spray for post-aceident isotope eontrol. However, the US NRC requires that the APIOOO design include a manually initiated eontainment spray for certain Beyond Design Basis initiating events not only for isotope control but also as an alternate means for flooding the reactor vessel (in-vessel retention), for debris quenching should vessel failure occur and to control containment pressure should the passive contaimnent cooling system fail. 

One solution that was considered for this particular Beyond Design Basis initiating event was to equip tile area surrounding the spent fuel pool with hose stations eapable of spraying the fuel stored in the pool, to provide continued cooling as it becomes uneovered. However, the... 

Given the years of nuclear power plant experience accrued in the U.S., one wc(uld expect a large number of accident sequences that could potentially lead to core damage to have been revealed by incidents involving beyond-design-basis initiators and/or sequences of events. Such incidents are commonly referred to as precursors of severe... 

The design of the plant should be tolerant of human error. To the extent practicable, any inappropriate human actions should be rendered ineffective. For this purpose, the priority between operator action and safety system actuation should be carefully chosen. On the one hand, the operator should not be allowed to override reactor protection system actuation as long as the initiation aiteria for actuation apply. On the other hand, there are simations where operator interventions into the protection system are necessary. Examples are manual bypasses for testing purposes or for adoption of acmation criteria for modifications to the operational state. Furthermore, the operator should have an ultimate possibility, under strict administrative control, to intervene in the protection system for the purposes of managing beyond design basis accidents in the event of major failures within the reactor protection system. 

The feed-and-bleed function for beyond-design-basis events is performed by the use of the Safety Depressurization System (SDS) in conjunction with the Safety Injection System (SIS) as described in CESSAR-DC, Section 6.7. The PAMI also monitors and displays SDS and SIS parameters following initiation of feed-and-bleed. 

Along with the design basis accidents, a wide spectrum of beyond design basis accidents including safety system failures combined with certain initiating events and/or human errors are analyzed. 

At the present stage of development, the list of design basis and beyond design basis accidents for the MARS was defined from operating experience of existing NPPs and is not yet final. Probabilistic analysis of the entire range of possible events has not yet been performed. Typical events initiating a development of transient processes are the loss of heat removal to the secondary circuit and the insertion of positive excess reactivity. 

Design basis accidents and beyond design basis accidents The major initiating events analyzed are as follows ... 

The in-containment fire system already achieves the required reliability for a back-up system that is only required for Beyond Design Basis feult initiating events. 

Along with design basis events, a wide range of beyond design basis accidents, including failures of safety systems coupled with various initiating events and/or mistakes of personnel, were analyzed. 

Below is the list of initiating events for the most severe beyond design basis accidents, covering the situations when the initiating event is aggravated by concurrent multiple failures of the safety systems or human errors that may result in accident progression beyond the design limits ... 

The beyond design basis accidents are characterized by a very low probability of the initiating event to occur however, they are considered to determine the ultimate dangerous states of the reactor and to identify the possible consequences. 

Level F2 safety functions. The safety functions needed to maintain a safe shutdown state beyond 24 hours and up to 72 hours from the initiating events in design basis categories 2, 3 and 4 conditions shall be assigned to level F2. 

This core meltdown is, and was caused by, a rare event a seismically induced tsunami of immense proportions that caused loss of almost all power and control. Thus the initiating event lay outside of the safety analysis envelope of what had been considered at the design stage, beyond the design basis of what had been considered for safety margin, and system and structural design and was more severe than considered in risk assessments for natural hazards. 

The evaluation of design basis events (DBEs) shall include sufficient time beyond the event initiation to assess the potential for more restrictive conditions with respect to power limit determination. 

---