Scram failure

All (6) CRCs withdrawal at reactor start up Scram failure NN VL... 

The results of the designer s failure analyses of protection systems for random independent failures show that the systems are generally resistant to such failures. The probability of scram failure can be demonstrated to be quite low (less than 10 per demand) if only these random failure events are considered. This is due to the highly redundant nature of the protection systems and the testability provided in their designs. 

An anticipated transient without scram (ATWS) is defined as an abnormal transient followed by failure of a reactor scram. Since the Super LWR is a simplified LWR, the probability of an ATWS is expected to be on the same order as that of LWRs. An ATWS of the Super LWR is classified as a beyond design basis event (BDBE). A deterministic evaluation of an ATWS is a global requirement because it is a potential safety issue that may lead to core damage under postulated conditions. Also, it is expected that inherent safety characteristics of nuclear reactors, not only reactivity feedback but also reactor system dynamics, can be clearly identified at ATWS conditions due to a scram failure. Therefore, deterministic ATWS analyses are carried out for the Super LWR in Sect. 6.7 as well as the abnormal transients and accidents. 

Example Given there have been 200,000 scram tests and scram actuations with no failure. With 90% confidence, what is the probability of failure on demand ... 

LOCA, is presented in Table 3.4.5-1. In preparing the event tree, reference to the reactor s design determines the effect of the failure of the various systems. Following the pipe break, the system should scram (Figure 3.4.5-2, node 1). If scram is successful, the line following the node goes up. Successful initial steam condensation (node 2 up) protects the containment from initial overpressure. Continuing success in these events traverses the upper line of the event tree to state 1 core cooled. Any failures cause a traversal of other paths in the evL-nl tree. 

If scram fails, the core melts regardless of other successes. Scram can succeed but the core melts by failure of the core cooling. Slow melt occurs if the long-term core cooling fails. Sequences 5, 9, and 10 have missing nodes to indicate inapplicability of ECl, C02, and ECR for the cases shown. 

A long evolving use of PSA was for Anticipated Transients without Scram (ATWS) which extended over 15 years to culminate in NUREG-0460 which was upset by the Salem failure-to-scram incident and the subsequent SECY Letter 83-28. Other special studies have been (a) value-impact analysis (VIA.) studies of alternative containment concepts (e.g., vented containment, NUREG/CR-0165), (b) auxiliary feedwater studies, (c) analysis of DC power requirements, (d) station blackout (NUREG/CR-3220), and (e) precursors to potential core-damage accident.s (NUREG/CR-2497), to name a few of the NRC sponsored studies. 

The Canadian licensing philosophy requires that each accident, together with failure of each safety system in turn, be assessed (and specified dose limits met) as part of the design and licensing process. In response, designers have provided CANDUs with two independent dedicated shutdown systems, and the likelihood of anticipated transients without scram is negligible. 

The safety concept considers two nuclear shutdown systems, a set of six reflector rods for reactor scram and power control and a KLAK system of small absorber balls for cold and long-term shutdown. Decay heat removal is made via the heat exchanger, an auxiliary cooling system, and the panel cooling system inside the concrete cavern, or, in case of a failure of these systems, passively by heat transfer via the surface of the reactor vessel. 

Totally 104 failures have occurred over a total operation period. The abnormal operation events due to equipment and system failures resulted in 28 plant shutdowns of which 18 shutdowns involved reactor scrams (5 events involved manual reactor emergency shutdowns). In the remainder the plant power reductions took place. 

Abnormal shutdown Abnormal shutdown circumstances are those where the reactor is scrammed down After the cause of the shutdown has been determined and the reactor is Judged to be safe, then the shutdown caxi be considered normal For example, if the reactor was scrammed due to an electrics, power failure, the abnormal shutdown would last until BPA power was restored and primary pumping equipment returned to operation ... 

The linear rate system should be Interlocked to bypass the exponential rate trips of the Intermediate Range Monitor after a power level of 10 has been reached This will reduce the possibilities of a failure in the Intermediate Range Monitor period func tlon causing a spurious scram when the Instrument Is no longer needed for exponentleil rate protection. 

The performance of control rod drive mechanism (CRDM) has been satisfactory with friction force within limits and drop time less than 400 ms. An on-line system to monitor the drop time of control rod (CR) during scram was commissioned. Similarly a system was developed to measure friction force of CR during power operation. The 3 s interlock on CR raise movement, which was introduced before the first criticality was deleted as it was giving rise to large time in raising power and high start up duty demand on CRDM motors. The lower parts of two CRDM were replaced, one due to failure of translation bellows, and another due to failure of gripper bellows. Leaky silicone bellows of one CRDM was replaced in-situ. 

The reactor normally contains a steam-water mixture so that any fast increase in pressure produces steam condensation, an increase of the water mass present and, because of the negative void coefficient for safety reasons, an increase in the core reactivity. It is easily seen that in a BWR the ATWS accident (transients with failure to scram) is particularly serious and represents one of the dominant severe accidents in overall risk evaluations. An accident caused by the spurious and complete closure of isolation valves on steam... 

The presence of a signiflcant neutron flux together with a fast shutdown actuation signal (Anticipated Transient Without Scram (ATWS) case, that is a transient with the failure of the scram to operate). 

Although very good reliability records exist for scram excitation, some failures of the gravity-driven control rod insertion have been recognized. The failures occurred for the different reasons in particular, the cases of insertion speed reduction and incomplete insertion due to fuel assembly deformation have been reported during last ten years (see for example [3]). Besides, some failure modes may be considered which could prevent all the control rods to insert, and it was the basis for designers to analyze Anticipated Transient Without Scram events. 

At the K Reactors, spline breakage is a major problem. These failures have been attributed to the fact that the coolant port of the inlet nozzle is directly below the spline, whereas, in the other reactor areas, the water enter/s on the side. This demonstrates how an apparently inconsequential difference between reactors can result in operating problems (such as scrams and outage time to retrieve broken splines). 

The VSR system strength is such that a wet, xenon-free reactor can be held sub-critical by the VSR s alone,with at least 90 per cent of the system control strength effective on demand in two and a half seconds or less. The VSR s may be scrammed into the reactor at any time, even from a partially withdrawn position, The failure or malfunction cf any single rod, or group of rods, does not interfere with the operation of the remainder of the system. 

Anticipated transients without scram are the most significant group of BDBAs. These include failures of the reactor protection system in addition to the following anticipated operational occurrences ... 

Various transients analysed are one primary or secondary or boiler feed water pump trip, one primary or secondary pump seizure, rupture of one primary pump discharge pipe, offsite power failure, uncontrolled withdrawal of a control and safety rod, total loss of feed water to SG, one primary or secondary pump acceleration from 20 % power and feed water flow increase to 125 % in one loop. Based on these studies reactor scram and LOR parameters are identified. Reactor is scrammed, i.e., by gravity drop of all control safety rods (CSR) and diverse safety rods (DSR), only for events involving fast transients and flow blockage in the core. For all the other events LOR (lowering of all the control and safety rods) is used for the reactor shutdown. The safety criteria is to ensure the availability of two diverse reactor trip parameters for every DBE (fig 9). 

A maximum hypothetical accident (MHA) has been studied which presumes an unidentified 2.00/see ramp reaetivity insertion of indefinite size and duration, coupled with a failure to scram. This then triggers the maximum sodium voiding reactivity effect of 1.60 which is assumed to take place in 0.1 sec. 

A meltdown accident has also been analyzed (which turned out to be greater than the foregoing hypothetical accident) to set an outer bound on explosive energy that the reactor can produce. A reactivity excursion was coupled with failure to scram and loss of flow, so that sodium loss and meltdown occurred. 

There is the prospect that loss of coolant and hence core meltdown can be made incredible and that eventually designs will be released from these serious limitations. However, in the current work, the aim has been to determine how seriously the design is handicapped even if you allow for the unbelievable. Public acceptability of the first large, fast reactors may well require designs that meet the consequences of the meltdown accident. In this context, then, we must strive to understand the reactivity implications of voiding in sodium-cooled reactors. The first reactor of this class will establish failure statistics of control drives, demonstrate independence of different sources of failure, and thereby permit subsequent assertion that failure to scram is impossible. 

Scram + all trains ot emergency heat removal system failure Restoration of one heat removal train 4 -5 h... 

---