Pressure control system failure

Overpressure Blocked or restricted outlet Inflow exceeds outflow Gas blowby (upstream component) Pressure control system failure Thermal expansion Excess heat input High pressure... 

Underpressure (vacuum) Withdrawals exceed inflow Thermal contraction Open outlet Pressure control system failure Low pressure... 

Abnormal transients Decrease in core coolant flow rate Partial loss of reactor coolant flow Loss of offsite power Abnormality in reactor pressure Loss of turbine load Isolation of main steam line Pressure control system failure Abnormality in reactivity Loss of feedwater heating Inadvertent startup of AFS Reactor coolant flow control system failure Uncontrolled CR withdrawal at normal operation Uncontrolled CR withdrawal at startup Accidents... 

The covering of all major abnormal transients by these proposed models are confirmed by comparing the results obtained by them with results obtained from detailed fuel rod analyses modeling each abnormal transient event. The following eight abnormal transient events are analyzed for confirmation inadvertent startup of the auxiliary feedwater system (AFS) loss of feedwater heating loss of load without turbine bypass withdrawal of control rods at normal operation main coolant flow control system failure pressure control system failure partial loss of reactor coolant flow and loss of offsite power. 

The CR assembly misalignment and drop is representative of the radial power distribution abnormality. However, it cannot be analyzed because only the single channel model and point kinetics are used here. The change of the radial power distribution is expected to affect the cladding temperature distribution as it affects the departure from nucleate boiling ratio distribution of PWRs. The depressurization of core cooling system transient is not analyzed because it will be almost the same as the pressure control system failure transient It should be remembered that reactor depressurization does not threaten the Super LWR safety as is described in Sect 6.3. 

Failure of compo- Ensure all system components, including flexible nents in connectors are rated for maximum feasible subatmospheric vacuum conditions pressure convey-, Ensure adequate pressure control system and ing operations. back-up (e.g., vacuum relief devices) API 2000 CCPS G-3 CCPS G-11 CCPS G-22 CCPS G-29 CCPS G-3 9... 

Figure 4 shows an example of the semi-dynamic simulation test result simulating a failure of reactor pressure control system. 

The function of the ROPS is to reduce the reactor pressure at the postulated beyond design basis accident related with a control system failure. The system consists of two parallel trains which are connected to the PZR through a single pipeline. Two trains are also combined to a single pipeline connected to the internal shielding tank. Each train is equipped with... 

Zone 2A active damper Ap control system (Provides active Ap adjustment for control of contamination from Zone 2A to Zone 2 and HEPA input air filtration.) Fail closed causes increased Ap to from Zone2A Zone 2 Mechanical failure of active damper, loss of air pressure for damper pneumatic actuator, programmed control system failure, or plugged filter Control and monitoring system indications and periodic maintenance inspections Leak rate through airlock doors and Room 109 shielded door may increase to reduce Ap somewhat No effect to positive effect since reduced flow may extend residence time in Zone 2A HEPA and charcoal exhaust filters... 

The present case study deals with the risk assessment and management due a possible toxic release fiwm a chemical plant, which is expected to cause fatalities in a nearby population (Fig. 1). The accidental scenario considered in this study is the catastrophic rupture of a tank containing a gaseous toxic industrial chemical (TIC), caused by the failure of the pressure control system of the tank. After the rupture, a toxic cloud is formed instantly and dragged by the wind over the local population. 

Time after failure of pressure control system (hours)... 

FIGURE 10.13 Example of a preincident event tree (for failure of a pressurized liquid storage vessel pressure control system resulting in release from a pressure safety valve). 

Connection to a higher pressure system and control system failure... 

In the other types of abnormalities, the event classification follows those of LWRs because the components such as the valves and the control rod drives are expected to be similar to those of PWRs or BWRs. In the category of the reactivity abnormality, the incidents related to the control rods are taken from those of PWRs. The loss of feedwater heating is taken like BWRs. Most of the incidents of the pressure abnormality are taken from BWRs because the Super LWR also adopts the direct steam cycle. The reactor depressurization is taken from PWRs. The abnormalities categorized into the inadvertent start or malfunction of core cooling system are taken from those of PWRs or BWRs. The inadvertent startup of AFS of the Super LWR corresponds to the inadvertent startup of ECCS of PWRs. The core coolant flow control system failure is the same as the feedwater control system failure for the Super LWR while the two incidents are different in BWRs due to the recirculation system. All the accidents categorized into the loss... 

This is a typical flow increasing transient. The demand of the main coolant flow rate is assumed to rise stepwise up to 138% of the rated flow as is assumed in the feedwater control system failure of Japanese ABWRs. Since increase in the core coolant flow rate is mild in ABWRs due to the large recirculation flow, the feed-water flow rate is assumed to increase stepwise. This assumption is too conservative for the Super LWR. The main coolant flow rate is gradually increased by the control system in the safety analysis. The calculation results are shown in Fig. 6.31. The reactor power increases with the flow rate due to water density feedback. A scram signal is released when the reactor power reaches 120% of the rated power. The maximum power is 124% while the criterion is 182%. The increase in the pressure is small. The sensitivity analysis is summarized in Table 6.15. 

Abnormality type Typical ATWS event Density coefficient (dk/k/(g/cm )) Loss of flow Loss of offsite power AMCST (°C) Pressurization Loss of turbine load without bypass " Peak pressure (MPa)/peak power (%) Reactivity insertion Uncontrolled CR withdrawal Peak fuel enthalpy (cal/g) Flow increase Main coolant flow control system failure Peak power (%)... 

No No Flow Cooling water control system failure Eventual runaway reaction through reactor high temperature and/or high pressure Add Shortstop. Depressurize reactor SIS (Pressure safety relief valve sized for this event) Use LOPA to determine required SIL ... 

Failure of Individual Control Valve - The following individual control valve failures should be included in the analysis of control systems for determination of pressure rehef requirements ... 

When analyzing such individual control valve failures, one should consider the action of other control valves in the system. In the first two cases above, credit may be taken, where applicable for the reduction in pressure of a high-pressure source due to net inventory depletion during the period that the downstream equipment pressure is rising to relieving pressure. However, the pressure relieving facilities must be sized to handle the calculated peak flow conditions. 

Thermoelectric flame failure detection Analog burner control systems Safety temperature cut-out Mechanical pressure switch Mechanic/pneumatic gas-air-ration control Thermoelectric flame supervision Thermal combustion products, discharge safety devices Electronic safety pilot Electronic burner control systems Electronic cut-out with NTC Electronic pressure sensor/transmitter Electronic gas-air-ration control with ionisation signal or 02 sensor Ionisation flame supervision Electronic combustions product discharge safety device... 

A mismatch between operator procedures and the automatic control system of the reactor (see also Table 17) was the first active failure identified in this scenario. This precursor was still present mainly due to a shortage of people. Literally it was said that the pressure relief valve would open if the wrong value was inserted into the reactor s control system. The second precursor was the failure of the pressure relief valve (see also Table 17), which was not known to the responsible person who decided to ignore the difference between procedures and control system. The pressure relief valve failed, because resins stuck in the valve after it was used for the first time. Consequently the second time the valve was opened it was at a much higher pressure due to the build up of resins in the valve. If this second precursor had not been observed in time by damp on the pipes situated above the pressure relief valve or by the alarms in the control room a possible accident scenario existed. This was especially dangerous as the alarms in the control room are often ignored because of the high incidence of false alarms (see also Table 17), which was the third precursor present. 

In addition to the basic control loops, all processes have instrumentation that (1) sounds alarms to alert the operator to any abnormal or unsafe condition, and (2) shuts down the process if unsafe conditions are detected or equipment fails. For example, if a compressor motor overloads and the electrical control system on the motor shuts down the motor, the rest of the process will usually have to be shut down immediately. This type of instrumentation is called an interlock. It either shuts a control valve completely or drives the control valve wide open. Other examples of conditions that can interlock a process down include failure of a feed or reflux pump, detection of high pressure or temperature in a vessel, and indication of high or low liquid level in a tank or column base. Interlocks are usually achieved by pressure, mechanical, or electrical switches. They can be included in the computer software in a computer control system, but they are usually hard-wired for reliability and redundancy. 

The first measure is to use the evaporative cooling or controlled depressurisation to keep the reaction mass under control. The distillation system must be designed for such a purpose and has to function, even in the case of failure of utilities. A backup cooling system, dumping of the reaction mass, or quenching could also be used. Alternatively, a pressure relief system may be used, but this must be designed for two-phase flow that may occur, and a catch pot must be installed in order to avoid any dispersion of the reaction mass outside the equipment. Of course, all these measures must be designed for such a purpose and must be ready to work immediately after the failure occurs. The use of thermal characteristics of the scenario for the choice of technical measures is presented in detail in Chapter 10. 

---