Safety function

The objective of the safety approach shall be to provide adequate means to maintain the plant in a normal operational state to ensure the proper short term response immediately following a PIE and to facilitate the management of the plant in and following any design basis accident, and in those selected accident conditions beyond the design basis accidents. 

To ensure safety, the following fundamental safely functions shall be performed in operational states, in and following a design basis accident and, to the extent practicable, on the occurrence of those selected accident conditions that are beyond the design basis accidents  

An example of a detailed snbdivision of these three fundamental safely functions is 

A systematic approach shall be followed to identify the structures, systems and components that are necessary to fulfil the safety functions at the various times following a PIE. 

---

Event Trees. Event trees use an inductive logic approach to consider the effects of safety systems on an initiating event. The initiating event is propagated through the various safety functions. Branching is dependent upon the success or failure of the safety function. 

Consider again, for example, the case of the flat tire on an automobile. The initiating event in this case is the flat tire. There are two safety functions which can be defined a spare tire and an emergency road patrol. Other safety functions might be included depending on the particular situation. 

In some cases the safety function is meaningless. For the example provided, if the spare tire is successfully mounted, then the safety function for the emergency road patrol is meaningless. In this case the line is drawn directly through the safety function. 

The branching is continued until all of the safety functions are considered. At this point a conclusion is reached about the result. For the flat tire example, only two results are possible the driver is either stranded or back on the road. The circle used to terminate the stranded result is given an X to denote it as an unfavorable outcome. 

It is not coincidental that the top event of the fault tree is the initiating event for the event tree. The fault tree shows how an event is decomposed into basic events whereas an event tree demonstrates the effect of the various safety functions. The disadvantage of event trees is that the outcomes are difficult to predict. Thus the outcome of interest might not arise from the analysis. 

Before the creation of the U.S. DOT in 1967, the now defunct ICC was authorized to prescribe rules and regulations for rad, tmck, and pipeline safety. The Federal Aviation Administration (FAA) was responsible for air safety, and the U.S. Coast Guard for safety on the inland and coastal waterways. Upon estabHshment of DOT in 1967, the FAA and Coast Guard were transferred to the DOT, which assumed the safety functions the ICC formerly adrninistered. 

Being excellent at discrete logic, PLCs are a potential candidate for implementing interlocks. Process interlocks are clearlv acceptable for implementation within a PLC. Implementation of safety interlocks in programmable electronic systems (such as a PLC) is not universally accepted. Many organizations continue to require that all safety interlocks be hard-wired, but implementing safety interlocks in a PLC that is dedicated to safety functions is accepted by some as being equivalent to the hard-wired approach. 

The difference in the nature of process controls and safety interlock systems leads to the conclusion that these two should be physically separated (see Fig. 8-89). That is, safety interlocks should not be piggy-backed onto a process-control system. Instead, the safety interlocks should be provided by equipment, either hard-wired or programmable, that is dedicated to the safety functions. As the process controls become more complex, faults are more likely. Separation means that faults within the process controls have no consequences in the safety interlock system. 

Redundancy. Redundancy is the use of more than the minimum number of items required to accomplish a given safety function. This allows the failure or unavailability of one item to be tolerated without loss of function. 

Function event trees are concerned with depicting functions that must happen to mitigate an initiating event. The headings of the function event tree are statements of safety functions that are required but that may fail in an accident sequence. 

In constructing the event tree, the analyst considers the functions that are required to prevent damage states, health consequences considering the relationships between safety functions. For example, if RCS inventory is not maintained, the heat-removal functions are depicted as failed state.s that may lead to core melt. 

Function event trees include primarily the engineered safety features of the plant, but other systems provide necessary support functions. For example, electric power system failure amid reduce the effectiveness of the RCS heat-removal function after a transient or small UJ( A. Therefore, EP should be included among the systems that perform this safety function. Siipfiort systems such as component-cooling water and electric power do not perform safety functions directly. However, they significantly contribute to the unavailability of a system or group of systems that perform safety functions. It is necessary, therefore, to identify support systems for each frontline ssstcm and include them in the system analysis. 

Classification of accidents by safety function is the starting point for classification by mitigating system. Because of the factors listed below, classification by system usually produces more accident... 

System event trees use the information on the effects of loss of various safety functions identified in the function event trees. However, the sequences in the system event trees are likely to differ somewhat from the function event trees because system faults may fail multiple functions. 

Identify critical locations where fires can cause an initiating event that could fail redundant engineered safety functions, or disable redundant and diverse safety-related equipment. 

The plant internal PSA can be used to identify critical equipment that could be damaged by fire. This form of screening was employed in the fire-risk portions of ZIP. At each location considered, the loss of all the equipment in the zone is postulated regardless of the size or position of the fire in the zone. If this does not show the occurrence of an initiating event (LOCA or transient) or if the safety functions are not damage to required for safe shutdown, the location is eliminated from consideration. If the location is found to be critical, it is considered furilier lot-detailed fire growth and fire suppression analyses. 

Abhitt, J. F., 1969 A Quantitative Approach to the Evaluation of the Safety Function of Operators in Nuclear Reactors, Atomic Health and Safety Board, UK. AHSB(s) R 160. 

C icci, R. H. V., 1980, A Methodology for Evaluating the Probability for Fire Loss of Nuclear Power Plant Safety Functions, Ph.D. Thesis at Rensselaer Poly. Inst., Troy, NY. 

Perform a fault tree analysis to determine tire safety function tliat failed... 

Process Control. The traditional process control will be expanded toward new applications such as nonlinear process control of biosystems. However, in the commodity chemicals industry there will be increased need for synthesizing plantwide control systems, as well as integrating dynamics, discrete events, and safety functions, which will be achieved through new mathematical and computer science developments in hybrid systems. 

The event tree is written from left to right. The initiating event is written first in the center of the page on the left. A line is drawn from the initiating event to the first safety function. At this point the safety function can either succeed or fail. By convention, a successful operation is drawn by a straight line upward and a failure is drawn downward. Horizontal lines are drawn from these two states to the next safety function. 

If a safety function does not apply, the horizontal line is continued through the safety function without branching. For this example, the upper branch continues through the second function, where the operator notices the high temperature. If the high-temperature alarm operates properly, the operator will already be aware of the high-temperature condition. The sequence description and consequences are indicated on the extreme right-hand side of the event tree. The open circles indicate safe conditions, and the circles with the crosses represent unsafe conditions. 

Figure 11-10 The computational sequence across a safety function in an event tree.

The lettering notation in the sequence description column is useful for identifying the particular event. The letters indicate the sequence of failures of the safety systems. The initiating event is always included as the first letter in the notation. An event tree for a different initiating event in this study would use a different letter. For the example here, the lettering sequence ADE represents initiating event A followed by failure of safety functions D and E. 

The event tree can be used quantitatively if data are available on the failure rates of the safety functions and the occurrence rate of the initiation event. For this example assume that a loss-of-cooling event occurs once a year. Let us also assume that the hardware safety functions fail 1% of the time they are placed in demand. This is a failure rate of 0.01 failure/demand. Also assume that the operator will notice the high reactor temperature 3 out of 4 times and that 3 out of 4 times the operator will be successful at reestablishing the coolant flow. Both of these cases represent a failure rate of 1 time out of 4, or 0.25 failure/demand. Finally, it is estimated that the operator successfully shuts down the system 9 out of 10 times. This is a failure rate of 0.10 failure/demand. 

The failure rates for the safety functions are written below the column headings. The occurrence frequency for the initiating event is written below the line originating from the initiating event. 

---