Plant emergencies functional safety

The plant control system provides for non safety plant control functions. The Diverse Actuation System provides for an alternative means for initiating the reactor trip and the emergency safety features by integrating a complete diverse actuation system within the plant control system. 

Finally, safety systems like the trip system or the emergency power supply have to be mentioned. These are essential for avoiding the destmction of a plant and the consequential major accident. It goes without saying that they must be highly available. If the components of these systems must function for a certain period of time in order to fulfil their mission, they must additionally have a high probability of survival. 

The Paks Nuclear Power Plant (NPP) experience with respect to development of symptom-based emergency operating procedures (EOPs) was reported. These symptom based EOPs improve the performance of the plant in the event of an incident or accident because they provide a framework within which all critical safety functions can be monitored and appropriate actions taken. They provide a complement to event-based procedures because it isn t possible to anticipate all plant events, particularly combinations of individual events. The Paks NPP staff have integrated the existing event-based procedures with symptom-based EOPs to provide a comprehensive framework to appropriately respond to all abnormal and emergency conditions. 

They are those procedures addressing emergency situations that can t be readily diagnosed. These procedures will be based on monitoring as well as restoring plant safety Function Restoration Guidelines (FRGs)... 

The objective of the event-independent part of the Emergency Operating Procedures (EOPs) is to provide means to evaluate and restore the plant nuclear safety. The concept is based on the premise that radiation release to the environment can be minimised if the barriers to activity release are protected (barriers of defence in depth). In order to accomplish this goal, a set of functions has been defined which are critical from the plant nuclear safety point of view. These are the Critical Safety Functions. To be able to evaluate the status of these functions. Status Trees have been designed, one per CSF. Once the state of the CSF is evaluated, based on their state and the rules of priority one can designate a Function Restoration Guideline to be implemented for restoring CSF (see Appendix 3). 

The status of safety-related systems and fiinctions is presented in a similar way, in accordance with the organization of the Emergency Operation Procedures (EOP). The parameters that are of immediate interest in a disturbance situation, are presented in a direct form. This means that the reactor pressure vessel with in- and outflow connections, together with neutron flux, water level, and reactor pressure, as well as control rods fiilly in (or not), are displayed directly. Other safety functions are indicated as normal, disturbed or failed in a similar way as for the plant overview, with detailed information at the reactor operator s desk. In this context, it can be noted that the computer-based reactor scram function via the reactor protection system (RPS) has been supplemented by a scram backup system that is implemented in hard-wired equipment. 

The plant design incorporates an Emergency Feedwater System which provides an independent safety-related means of supplying quality feedwater to the steam generator(s) for removal of heat and prevention of reactor core uncovery during emergency phases of plant operation. The EFW System is a dedicated safety-related system which has no functions for normal plant operation (See CESSAR-DC, Section 10.4.9). 

Provision of a plant safety parameter display console was made a requirement by 10 CFR 50.34(f), (Reference 2). The functional criteria and design requirements for the SPDS were defined in NUREG 0737 (Supplement 1) (Reference 3). The primary function of the SPDS and the display console is to help operating personnel in the control room make quick assessments of plant safety status during abnormal and emergency conditions. 

After the Three Mile Island Unit 2 accident the NRC reviewed the auxiliary feedwater system for availability and reliability of components and decay heat removal capability. In particular, the EFW system was scrutinized with regard to the potential for failure under a variety of loss of main feedwater conditions. The safety concern was that a total loss of feedwater, i.e., loss of both main and emergency feedwater, could result in loss of core cooling. The NRC requested operating plants and plants under construction to review both the reliability and the capability of the EFW system to perform its intended safety function i.e., core decay heat removal. The evaluation by the plants was divided into three parts as discussed below. 

SIS This is the first automatic protection layer to BPCS and second overall layer of protection. It is desired that this shall be independent of BPCS. Even if these are combined it is necessary to ensure that single failure does not take toll of safety. SIS may stop part of plant operation and/or diverts some flow safely, etc. It may have separate set of instrumentation to detect and take safety action in the event of instrument/system failure. It has to be more aggressive than BPCS for safety functions. Under SIS, there will be several interlocks and protections to save the system and in many places like off shore design, ESD is considered as last resort or emergency plan achievable through PEs. 

---