Passive trip system

A good example for a simple system structure is the passive trip system presented in the following section. 

Case study 4.1 Experimental investigation of the passive trip system In [16] experiments are described which were carried out with the reactor of Fig. 4.4. The laboratory reactor has a volume of 10 1. Amongst others the exothermic esterification of acetic anhydride with methanol according to the following chemical reaction equation was investigated ... 

The availabilities of an emergency discharge system, an inhibitor system, a pressure relief system and a passive trip system are compared with one another. The pertinent fault tree models are established and quantified. 

The design and function of the passive trip system were already explained in Sect. 4.22. The corresponding fault tree is presented in Fig. 9.61. 

Fig. 9.61 Fault tree for the passive trip system of the reactor of Fig. 4.4...

In what follows the principle of a passive safety measure is explained using the design and functioning of the passive emergency trip system shown in Fig. 4.4 as an example [15]. 

Table 9.55 Minimal cut sets, unavailabilities and system unavailability for the passive trip...

Although many engineers provide only the minimum adequate vessel design to minimize costs, it is inherently safer to minimize the use of safety interlocks and administrative controls by designing robust equipment. Passive hardware devices can be substituted for active control systems. For example, if the design pressure of the vessel system is higher than the maximum expected pressure, an interlock to trip the system on high pressure or temperatures may be unnecessary. 

Reactivity control a) Reactor regulatmg system b) Shutoff rods (28) c) Poison mjecnon d) Loss of DjO moderator Active Active/Passive Passive Passive power changes-set back and trip I Fail safe principle, redundancy Fail-safe prmciple, redundancy Loss of D20 moderator leads to subcrihcality ... 

From the safety standpoint, the thermal capacity and strong negative temperature coefficient of reactivity also work to passively mitigate reactivity and loss of coolant accidents. Nevertheless, a safety-related reactor trip and safety features monitoring systems are included... 

On positive reactivity addition or loss of reactor heat removal following reactor trip by the electromechanical protection system or the emergency boron injection system, the core residual heat removal is effected by the passive emergency heat removal system. The amount of water in the tanks of the system ensures reactor cooling for at least 72 hours (seven days with two tanks and three days with one tank available). 

Functional safety relies on active part, not on passive part. For example, a fire resistant door prevents a hazard, but is not safe instrumentation for functional safety. On the contrary, a flame scanner/switch in a utility boiler is an active system as it protects closes the fuel flow and trip master fuel relay in the event of flame failure (through logic). From the previous discussions, it is clear that there is handshaking relationship of SIS with functional safety. These cause effect relationship of functional safety and SIS can be ... 

A single start-up feed water pump are capable of delivering sufficient flow to both steam generators in the period following a reactor trip from full power to remove the fission product heat and preclude the need for actuation of the passive core cooling system. 

Steam generator water level - for reactor trip and passive residual heat removal actuations, and for overfill prevention by manual actuation of the automatic depressurisation system... 

The diverse actuation system is provided to automatically actuate selected systems such as the passive residual heat removal, the core make-up tank, the passive containment cooling system, reactor trip, and containment isolation. In addition, the system provides alarms and information to the main control room for manual actuation of these systems. 

One of the most important safety components on any high pressure compressed gas system is the flow restrictor. There are two t5q)es of flow-restricting devices an excess flow switch and a flow restrictor. The excess flow switch can be either mechanical or electromechanical and has an excess flow sensor which trips a valve, shutting off gas flow when a preset limit is exceeded. The restrictor is a passive device (limiting orifice) which is sized to limit the flow of gas to a predetermined rate. 

The sees includes two trains each train may remove 100% of the core decay power. In an accident causing the reduction of the core coolant flow (such as station black-out or primary pump trip), activation is automatic (without intervention either by the operator or by the control and supervision system, because the PSC interception valves are kept in a closed position by forces from the primary coolant flow and start opening when this flow decreases below a set-point value) the operation of the system is completely passive. 

In case of design basis accidents, the IMR detects abnormal condition and trips the control rods. Since the IMR has no soluble boron system as a chemical shim, control rod worth is enough to maintain cold shutdown conditions. Additionally, in case of a trip failure, stand-by shutdown systems inject borated water to shutdown the reactor. Residual heat is removed by a passive stand-alone direct heat removal system (SDKS). The SDKS works without operator action and external supports and keeps core conditions within the safety criteria. 

A passive reactor auxiliary cooling system inside the reactor module allows the total removal of decay heat in case of a steam generator trip at temperatures below 1000 K. 

The reactor trips due to low pressure in the pressurizer. It is assumed that the emergency core coolant system does not operate during the transient. It is also assumed that there is not auxiliary feed water to the steam generators and no steam dump to the condenser. Only the accumulators participate in the sequence, since they are passive elements their discharge is only produced when vessel breaches, as, until this moment, the primary pressure is over the setpoint of the accumulator valves. Under these conditions the transient leads to core damage and melt-down. 

The inherent safety characteristic against postulated events is the most remarkable superiority of a liquid metal cooled reactor (LMR) to other type of reactors. One of the major threats to the safety of LMR is a loss of flow event accompanied a failure of reactor shutdown systems. This situation is usually referred to as an unprotected loss of flow (ULOF). The inherent safety of the Korean Advanced Liquid Metal Reactor (KALIMER) during the ULOF [I] has been assessed for the situation of all pump trips followed by coastdown. It was assumed that the decay heat is removed by four intermediate heat exchangers (IHXs) and the safety grade system of passive safety decay heat removal system (PSDRS). The results showed that the power was stabilized by the reactivity feedback of the system even though the effect of the gas expansion module (GEM) was not taken into account. 

---