Safety cases features

When new plants are constructed or when modifications are needed in existing plants, detailed process designs are required. These designs must include special safety features to protect the system and operating personnel. The following case histories emphasize the importance of these special safety design features. 

The regulatory environment is changing in Victoria with introduction from March 2000 of the Major Hazard Facilities Regulations, based on the Seveso II Directives. These are expected to flow on to the other states considered in this chapter. The key requirement of these regulations is the preparation of a Safety Case, which must demonstrate, among other requirements, that the risk from the new plant has been reduced to as low as is reasonably practicable - ALARP . The plants will incorporate a number of design features intended to reduce the risk from the facilities and demonstrate compliance with this criterion. 

Training is generally a less effective control but that doesn t mean its delivery or otherwise can be ignored. Human factor controls can be difficult to evidence so when time and effort are put into a robust training progranune its features form useful material for the safety case. 

First, the philosophy requires that control of radionuclides be accomplished with minimal reliance on active systems or operator actions. By minimizing. the need to rely on active systems or operator actions, the safety case centers on the behavior of the laws of physics and on the integrity of passive design features. Arguments need not center on an assessment of the reliability of pumps, valves and their associated services or on the probability of an operator taking various actions, given the associated uncertainties involved in such assessments. 

Similar to the Final Safety Analysis Report in the U.S., a frmdamental feature of the British regulatory system is the requirement for each licensee to demonstrate the safety of its proposed operation in a document known as the safety case. The Nil also enforces safety and health regulations related to non-nuclear hazards at licensed sites. This role is perhaps comparable with those of the U.S. Environmental Protection Agency and state safety and health authorities. The relationship between the U.K. licensees and the safety authorities is generally less antagonistic than that found in the U.S. The majority of discrepancies found by Nil inspectors are addressed at the individual... 

Safety. Most SMRs make extensive use of inherent safety features and passive safety systems. Such systems are appropriate to SMRs and are harder, if not impossible, to engineer on large reactors. They tend to be simpler than active systems resulting in a simpler safety case and easing the problems of public acceptability. 

The M42 ATM project was the first major HA project to require an lEC 61508 safety programme and a formal safety case. This paper has described the risk assessment methodology that was developed to suit the particular features of the motorway environment. This methodology differed somewhat from the examples given in most safety standards, for the following reasons ... 

Intrinsic variation exists whenever there is more than one argumentation style to support the safety claims of a particular product-line instance. Extrinsic variation, in contrast, is more peculiar to product-line safety cases. The source of this type of variation is not the product-line safety case itself but rather the reusable assets referenced in the safety case from product-line models such as the feature and reference architectural models. This is because many of these assets are expected to vary in how they are developed, configured and composed. This variation may change the contribution of these assets to safety and therefore may change the way in which the safety of the system is justified in the safety case. To this end, it is important that extrinsic... 

One final concern with the use of the feature model is its central role in deciding what reusable artefacts are included. If the feature model is incorrect, it has consequences for the validity of the hazard assessment, the safety claims and the entire safety case. To offset this concern, we note our assumptions that ... 

This chapter shows how the operational aspects of the APIOOO relate to the design and are a crucial part of the safety case. The AP1000 already has operational arrangements in place ready to be developed by the UK licensee prior to completion of construction. These are based initially on mature arrangements used on existing PWRs and are well tested. There are some developments which have yet to be proven on AP 1000 specific features, and this chapter outlines how that will be achieved. 

---