Safety system design consequence severity

The assessment of severe accidents should account for the full design capabilities of the plant, including the use of some safety and non-safety systems beyond their originally intended function to return the potential severe accident to a controlled state and/or to mitigate its consequences. If credit is taken for extraordinary use of systems, there should be a reasonable basis to assume they can and will be used as analysed. 

Preliminary overnight capital costs (Table XXVI-2) of a 2400 MW(th) AHTR for several exit temperatures were determined relative to other higher temperature reactor concepts [i.e., the S-PRISM and the gas turbine - modular helium reactor (GT-MHR)] based on the relative size of systems and quantities of materials. The economic analysis used the larger size AHTR because the initial studies used the basic S-PRISM facility design where relatively detailed system design and cost information was available. This approach provides relative, but not absolute, costs. Only the construction of multiple reactors can provide reliable absolute costs. The lower capital costs are a consequence of several factors economics of scale [a 2400 MW(th) reactor vs. four 600 or 1000 MW(th) reactors], passive safety in a large reactor system, and higher thermal efficiency. 

Consideration shall be given to the plant s full design capabilities, including the possible use of some systems (i.e. safety and non-safety systems) beyond their originally intended function and anticipated operational states, and the use of additional temporary systems, to return the plant to a controlled state and/or to mitigate the consequences of a severe accident, provided that it can be shown that the systems are able to function in the environmerrtal conditions to be expected. 

Where loss of control could lead to severe consequences, the integrity of the basic process control system and the protective safeguards must be designed, operated and maintained to a high standard. Industry standards such as ANSI/ISA-S84.01 (1996) and IEC 61508 (2000) address the issues of how to design, operate and maintain safety instrumented systems such as high temperature interlocks to achieve the necessary level of functional safety. The scope of these standards includes hardware, software, human factors and management (HSE 2000). 

Intrinsic and passive safety design features are by nature more reliable than design features that depend on a consistent performance of a physical or human system.(2) Passive designs reduce the probability of an occurrence occurring or minimize the severity of the adverse consequences without the requirement for successful operation of devices, con-... 

The design of any SFE system will be a function of the application, and the details will vary depending on the size and the mode of the process (batch or continuous), the nature of the extracted material and the substrate (corrosive, toxic, and benign), and the fluid employed. The only guaranteed commonality with all such systems is the necessity to ensure safe operation. Proper safety precautions must be observed in the handling and maintenance of the required high-pressure equipment the consequences of a failure can be severe. 

Unlike the known designs of integral reactors being under development in many countries where either steam or steam-gas pressurizer is applied, the integral reactors developed by RDIPE use a gas pressurizer. Selection of such solution was motivated by several reasons, firstly, the intention to simplify and, consequently, enhance safety of the primary circuit pressure compensation system by elimination of heaters and sprinkler system. Secondly, this approach is based on our 40-year experience in designing and operation of ship-mounted NSSS with gas pressurizers in the primary circuit. It should be pointed out, however, that in the previous cases the pressurizes wee placed outside the reactor vessel. 

While aU of these Elements of Safety Management Systems are significant in avoiding accidents resulting in severe consequences, the section titled Hazard Identification and Evaluation is principally relevant here. It requires hazard identification and avoidance or mitigation, both on an anticipatory basis in the design process and during all phases of operations. That encompasses both routine and unusual operations. This is how the directive reads ... 

Two types of analytical methods are used to evaluate hazards 1) preliminary hazards analysis (PHA), and 2) failure modes and effects analysis (FMEA). PHA is an accident scenario-based form of analysis. The FMEA is a complementary type of evaluation that utilizes a system failure-based form of analysis. Generally, FMEAs were only accomplished for equipment which was perceived to have a significant safety role, i.e. SSCs which were anticipated to be designated as safety significant in accordance with DOE-STD-3009. Unlike PHA, the first objective of FMEA is to subdivide the facility into several different (and, to the maximum extent possible, independent) system elements. Failure modes of each system element are then postulated and a structured esramination of the consequences of each failure mode follows. However, similar to PHA, FMEA. documents preventive and mitigative features (failure mechanisms and compensation) and anticipated accident consequences (failure effects). This appendix documents the FMEA for the HCF. 

The AP600 design has been confirmed by the results of transient and accident analysis to meet its safety objectives. Core melt down frequency and severe accident evaluation show that the passive systems are effective in mitigating the consequences of design basis accidents. 

---