Reactor trip system

EX-CORE The Nuclear Instrumentation System corresponding to previous AKNT RTS The Reactor Trip System corresponding to the HO-1... 

Provide reactor trip system execute features. 

Provide "safety-related" reactor trip systems execute features. 

The reactor trip system was easily defeated by the operators and was, in the event, too slow to prevent the rapid power surge when it was finally activated. In fact the peculiarities of the control rods may have actually triggered the accident through the positive scram effect. 

Fig. 9.47 Fault tree for an automatic reactor trip system (without activation)...

Fig. 9.48 Probability distribution and pdf of the unavailability of the reactor trip system...

One of the most important safety related systems is reactor trip system (RTS). RTS malfunction probability assessment is based on knowledge of malfimction its components and on reliability analysis of its functions. Solution of this task is described in (Fuchs et al. 2007). Input parameters of this task are component failures data (see table 1) and output parameters are malfunction probabilities of RTS functions, see Table 2. 

The next point which makes the digital solution more vulnerable from common causes is eventual aggregation of different safety systems automation into one actuation system - e.g. Reactor Trip System (RTS) and Engineered Safety Features Actuation System (ESFAS), RTS + Reactor Limitation System C S). 

In case of unsafe conditions the reactor protection system takes over and automatically scrams the reactor and actuates the relevant safety systems. The reactor protection system includes the reactor trip system and the engineered safety features actuation system. 

Generic Safety Issue (GSI) A-09 in NUREG-0933 (Reference 1), addresses the issue of assuring that the reactor can attain safe shutdown after incurring an anticipated transient with a failure of the Reactor Trip System (RTS). An ATWS is an expected operational transient (such as a loss of feedwater, loss of condenser vacuum, or loss of offsite power to the reactor) which is accompanied by a failure of the RTS to shut down the reactor. 

In addition to the weaknesses in the RBMK design described above, the detailed implementation of the design also allowed greater freedom of action for the operators than would be normal in a reactor design elsewhere. For example, the operators could override reactor trip systems at the flick of a switch in Western designs, key interlock systems would have prevented this. Also it was essential for the safe operation of the plant that the control rods should never be withdrawn beyond the point at which the control rod reactivity margin became dangerously low, yet this vital aspect was left entirely to the operators, with no automatic trip system. 

The rehability requirements are defined according to the recommendations in INSAG-12 [2]. The Slovak regulations recommend failure rate targets for the reactor trip system of <10 per demand and for the ESFAS system of <10 per demand. 

An essential part of the existing reactor trip system has been designed as a fail-safe system. Special measures were implemented to ensure reactor trip in the case of a failure causing loss of reactor trip capability. Nevertheless, several types of failure remain undetected. They cause a loss of individual measuring channel capability to generate a trip signal. Information and control personnel frequently check and test the system to ensure its high reliability. 

There are two redundancies in the reactor trip system (see also SP (177)). They are independent of each other, of other safety systems and of other plant systems. Power supply sources of redundancies are also independent, as are the HVAC systems of redundancies. Redundant systems are located in physically separated compartments. However, sensors are not qualified for harsh environments. The original seismic qualification is not sufficient for newly obtained seismic input data. 

Selection of initiation criteria does not always guarantee fulfilment of acceptance criteria when the single failure criterion is assumed. The response time became adequate after an adjustment was made to the system. Emergency operating procedures and operator training are satisfactory regarding consideration of failures in the safety systems. Diverse initiation criteria wiU be implemented in the new reactor trip system. 

The fail-safe criterion is not fully implemented for the reactor trip system but will be implemented in the design of the new system. The ESFAS system is designed as fail-safe to the extent possible the same principle will be applied to... 

This section should provide relevant information on the instrumentation and control systems as described in paras 3.65-3.70. The reactor instrumentation senses the various reactor parameters and transmits appropriate signals to the control systems during normal operation and to the reactor trip systems and engineered safety features and systems during anticipated operational occurrences and in accident conditions. The information provided in this section should emphasize those instruments and their associated equipment that constitute the protection systems and those systems rehed upon by operators to monitor plant conditions and to shut the plant down and maintain it in a safe shutdown state after a design basis accident. Information should also be provided on the non-safety-related instrumentation and control systems used to control the plant in normal... 

This subsection should provide relevant information on the reactor trip systems as described in paras 3.65-3.70. In addition, specific information on the following, which are unique to the reactor trip system, should be provided ... 

SAs. By changing the simulation materials loaded in standard SAs, CLEAR-0 can simulate various cores. Meanwhile, two reactor trip systems based on a different mechanism are designed to ensure CLEAR-0 safety. CLEAR-0 has two operation modes one is the critical mode for fast reactor validation and the other one is the subcritical operation mode driven by the accelerator neutron source for ADS validation. 

In view of the redundancy provided in existing reactor trip systems, the equipment required by the ATWS rule did not have to be redundant within itself Also, since the combination of an anticipated operational occurrence, failure of the existing reactor trip system, and a seismic event or an event which results in significant plant physical damage has a low probability, seismic qualification and physical separation criteria were not applied to... 

The reactor protection system (RPS) is a safety-related system that is designed to monitor key operating plant variables and to cause alarms, control rod insertions, or scram, as the occasion may require when off-normal conditions occur. The reactor trip system (RTS) is part of the RPS and includes those power sources, sensors, initiation circuits, logic matrices, bypasses, interlocks, racks, panels, control boards, actuation devices, and actuated devices, that are required to initiate reactor shutdown. The RTS automatically initiates control rod insertion when required to assure that acceptable fuel design limits are not exceeded. It is designed to fail safe for most internal component failures. The RTS can also be actuated manually by operator action. 

Each pressurized water reactor manufactured by Combustion Engineering or by Babcock and Wilcox must have a diverse scram system from the sensor output to interruption of power to the control rods. This scram system must be designed to perform its function in a reliable manner and be independent from the existing reactor trip system (from sensor output to interruption of power to the control rods). 

This was proposed by the Utility Group on ATWS. It consists of equipment to trip the turbine and initiate auxiliary feedwater independent of the reactor trip system. It has the... 

The uncontrolled CR withdrawal is a typical reactivity insertion event. Although the CR withdrawal itself would be stopped at a certain power level by an interlock system independent from the reactor trip system, the CR having the maximum reactivity worth is conservatively assumed to be fully withdrawn. The calculation results starting from the normal operating condition are shown... 

---