Fault Schedule

Thus, the required resources make unfeasible the simulation of all possible faults. As a consequence, it turns essential a fault injection plan review to just introduce the possible realistic faults. Currently, we are focused on introducing an automatic fault scheduling generator. This tool will improve considerably the efficiency of the platform. 

Lifecycle Safety Report Fault Schedule Cat/Class Report Safe Operating Envelope Safe and Simple (Genesis) Report Internal Hazards External Hazards Human Factors Electrical Power... 

The postulated fault conditions are defined in a fault schedule, and the engineering safety features are demonstrated to limit core damage and release of radioactive material within the safety limits defined. 

The WEC UKP-GW-GLR-003 Rev. 0, APIOOO Fault Schedule for the United Kingdom (reference 1.4)] identifies credible initiating events within the APIOOO design basis (together with large loss of coolant accident, which is outside the design basis), and shows that safety measures are in place to provide adequate protection. 

WEC, UKP-GW-GLR-003 Rev. 0, APIOOO Fault Schedule for the United Kingdom, September 2009. 

Faults arising due to plant failures within the Design Basis (as presented in the APIOOO fault schedule)... 

For Design Basis fault conditions, as identified in the APIOOO Fault Schedule (see Chapter 5), design requirements are derived based on the SSCs maintaining the safety functions during and following fault conditions (i.e. safety measures). This process is summarised in sub-seetion 4.3.2. 

The APIOOO fault schedule presents the Design Basis initiating events that are identified by the fault identification process. For each fault, it also provides the following information ... 

An overview of the fault schedule, including identification of the safety measures claimed and those systems that can provide additional defence in depth, is presented in Chapter 5. 

The fault schedule has been used as the basis for the derivation of the design requirements associated with design basis fault conditions as it identifies the plant failure related initiating events that are within the Design Basis of the plant. 

The fault schedule identifies the systems involved in the provision of specific safety measures and defence in depth roles... 

The safety assessment, and particularly the fault analysis, is imderpinned by the API000 Fault Schedule (Reference 5.1), which identifies the challenges to the design ofthe APIOOO, as well as the lines of protection that are available. The fault schedule is discussed further in subsection 5.2. 

The Design Basis Analysis (DBA) of the faults in the fault sehedule is then described in subsection 5.3. The DBA aims to demonstrate, through thermal-hydraulie and radiological analysis of bounding fault sequences, the efifeetiveness of the proteetion identified for each of the faults in the fault schedule. 

The fault schedule (Reference 5.1) is a key document in the DBA. The fault schedule presents the postulated faults, and the identified protection for each of the Key Safety Functions (KSFs). The fault schedule describes the response of the APIOOO to initiating events in the following categories ... 

For every fault in each of the above categories, the fault schedule lists the reactor trip signals generated and engineered safety features actuated, as well as the mitigating features available. 

The application ofthe N18.2 checklist has been reviewed against the APIOOO design and PRA, and been appropriately updated to reflect the plant s specific design features. On this basis, while potential Anticipated Transient Without Scram (ATWS) faults are included in ANSI N 18.2, for the APIOOO no causes for these have been identified within the Design Basis (i.e. the initiating event frequency is less than 10-5 per reactor year). These faults are addressed via PRA and Severe Accident Analysis (as described in Section 5.4 and 5.5 of this chapter). This issue is discussed in sub-section 4.4.1.3 ofthe APIOOO Fault Schedule (Reference 5.1). 

The fault schedule demonstrates that for each fault at least one safety measure composed of safety signifieant SSCs (primarily Safety Class 1 engineered safety features) is provided to maintain control over reactivity and heat removal, allowing the plant to be brought to safe and controllable shut down state with containment integrity intact. The following subsections summarise the plant... 

The Class 1 engineered safety features claimed in the fault schedule for reactivity control are ... 

Immediately following reactor trip, which has in turn tripped the turbine and set the steam circuit to the turbine by-pass line, duty systems would be deployed as defence in depth to manage the fault by controlling reactor pressure, tempeiatuie and inventory, thereby avoiding actuation of the engineered safety features (ESFs). The duty systems are not claimed in the fault schedule - they are providing additional defence in depth. 

For loss of coolant accident (LOCA) scenarios core makeup tarrk (CMT) draining will signal actuation of the first three stages of the automatic depressurisation system (ADS), depressurising the reactor and allowing the accumulators to inject more borated water into the RCS. If the pressure falls further, the residual heat removal system (RNS) can also be ahgned to remove heat. This latter action provides additional defence in depth but is not claimed in the fault schedule. 

During shutdown, the combination of Class 1 safety measures claimed will differ, depending on the plant state, eg. depending whether the RCS boundary is open or if fuel is being moved this is addressed in the fault schedule. 

In addition to the principal safety systems listed above, the fault schedule demonstrates that there is at least one safety measure (which may be a Class 1 system that is not claimed in the analysis, or a non-Class 1 system) available to enhance control over the KSFs. Because the non-Class 1 systems are, like the duty systems, electrically powered and actuated by the PLS there is diversity between the claimed safety systems and the defence in depth. 

The fault schedule underpins the DBA. It defines the faults to be analysed, and describes the engineered safety features to be credited in the analysis. 

The plant systems and components credited for mitigation of accident effects are defined in the fault schedule, and are listed in subsection 5.2.3. The fault schedule presents both those systems credited in the safety analysis (which are, in general, robust Class 1 systems) and systems which are not eredited in the analysis but which provide defence in depth. 

This subsection provides a summary of the analysis results for the fault schedule fault categories defined in subsection 5.2. Also included is a discussion of any significant analysis assumptions that differ from, or are supplemental to, the generic assumptions described in subsection 5.3.3. 

A signal to trip the reactor spuriously or inadvertently (fault 4.1.1 in the fault schedule) could arise from the following causes ... 

The fault schedule identifies the following faults within this category (where more than one sequence is modelled, the modelled sequences are shown in brackets) ... 

Feedwater system malfunctions causing a reduction in feedwater temperature (low-pressure heater train or a high-pressure heater train out of service or bypassed). This is fault 4.2.1 in the fault schedule. 

Feedwater system malfunctions causing an increase in feedwater flow (two cases were modelled the accidental opening of one feedwater control valve with the reactor just critical at zero load conditions and the accidental opening of one feedwater control valve with the reactor in automatic control at full power). This fault models the failure of one protection division as the limiting single failure. This is fault 4.2.2 in the fault schedule. 

Turbine trip. This is fault 4.3.3 in the fault schedule. 

Inadvertent closure of main steam isolation valves (results in, and is therefore bounded by, a turbine trip). This is fault 4.3.4 in the fault schedule. 

Uncontrolled rod cluster control assembly (RCCA) bank withdrawal from a subcritical or low-power startup condition. This is fault 4.6.1 in the fault schedule. 

Startup of an inactive reactor coolant pump at an incorrecttemperature. This is feult 4.6.4 in the fault schedule. 

---