Scram system failures

Totally 104 failures have occurred over a total operation period. The abnormal operation events due to equipment and system failures resulted in 28 plant shutdowns of which 18 shutdowns involved reactor scrams (5 events involved manual reactor emergency shutdowns). In the remainder the plant power reductions took place. 

Stop feed water at 100% power Scram + active trains of emergency heat removal systems failure NN VL... 

Scram + all trains ot emergency heat removal system failure Restoration of one heat removal train 4 -5 h... 

The nuclear system protection system initiates the rapid insertion of the control rods to shut down the reactor. The system is of the fail-safe design where it will trip on loss of electrical power but will not trip and cause a scram on the loss of a single power source. The four trip channels are physically separated from each other and from other equipment precluding the possibility of interactions that could cause possible false scrams or failure to scram. The logic requires a manual reset by the operator, which is automatically inhibited for 10 s. One reset switch is used for each trip channel. Failure of a single trip channel, division logic, or a system component will not prevent the normal protective action of the nuclear system protection system. 

The reactor is designed for a near-zero reactivity bum-up swing such that the safety rod system is vested with minimal positive reactivity at Beginning of Life (BOL) full power. A safety rod scram system provides a first line of defence for reactivity initiators. Moreover, passive reactivity feedbacks and passive self adjustment of natural circulation flow could maintain reactor power to flow ratio in a safe operating range even with failure to scram this safe passive response applies for all out-of-reactor vessel initiated events, i.e., for any and all events communicated to the reactor through the flibe intermediate loop. Periodic in situ measurements would be made to confirm the operability of these passive feedbacks. 

The transient overpower (TOP) due to a control rod withdrawal, the loss of primary flow (LOT) and the loss of heat sink (LOHS) due to a loss of the heat removal capability of the secondary system are commonly postulated as accident scenarios for power reactors. Even though the loss of external power is commonly superposed on these events, this does not lead to any serious problem if the reactor is safely tripped. Severe accidents, where the failure of a scram system is superposed on the abovementioned accidents, are surveyed below, for the LSPR. The analytical methods employed are described in [XXV-7]. 

For severe accident analysis, a reactivity insertion of 0.3 %5K/K was assumed, coupled with the failure of the B4C based control rod scram system. As shown in Fig. XXX-6, the maximum fuel temperature is 1100°C, which is also below I500°C temperature limit for fuel... 

SS 18 Potential failure of the scram system due to loss of discharge volume (BWR)... 

Figures G-21 and G-22 illustrate the consequences of a nuclear excursion with failure of both automatic scram systems. The...

The sequence group regarding the loss of electric supply to primary pumps causing core damage has a probability of 3.65x 10 yr provided the initiating event is followed by failure of both the automatic and the additional scram systems. 

The less stringent requirements as for the insertion time in comparison with the SGHWR, which permit the scram system to rely on gravity only without the need of a pressure drive, are due to a different approach to some safety problems. In fact, for the CIRENE reactor, one does not admit the sudden loss of flow due to pump failure since the pumps are provided with fly-wheels. Other emergency cooling means are also foreseen in case of pump failure,... 

The NRC prepared two detailed reports ("Report on the Browns Ferry 3 Partial Failure to Scram Event on June 28, 1980," dated July 30, 1980, and "Report on the Interim Equipment and Procedures at Browns Ferry to Detect Water in the Scram Discharge Volume," dated September 1980. The various aspects of the BWR scram systems were studied further by the NRC, the BWR licensees, and General Electric. 

The ultimate shutdown system (USS) located at the center of the core is a self-actuated shutdown system. The USS is actuated passively when the temperature of the primary sodium reaches the Curie point. The USS drops neutron absorbers by gravity as a means to bring the reactor to cold critical conditions in the event of a complete failure of the normal scram system and after the inherent reactivity feedbacks have brought the core to a safe, but critical state at an elevated temperature. 

This is a typical flow increasing transient. The demand of the main coolant flow rate is assumed to rise stepwise up to 138% of the rated flow as is assumed in the feedwater control system failure of Japanese ABWRs. Since increase in the core coolant flow rate is mild in ABWRs due to the large recirculation flow, the feed-water flow rate is assumed to increase stepwise. This assumption is too conservative for the Super LWR. The main coolant flow rate is gradually increased by the control system in the safety analysis. The calculation results are shown in Fig. 6.31. The reactor power increases with the flow rate due to water density feedback. A scram signal is released when the reactor power reaches 120% of the rated power. The maximum power is 124% while the criterion is 182%. The increase in the pressure is small. The sensitivity analysis is summarized in Table 6.15. 

LOCA, is presented in Table 3.4.5-1. In preparing the event tree, reference to the reactor s design determines the effect of the failure of the various systems. Following the pipe break, the system should scram (Figure 3.4.5-2, node 1). If scram is successful, the line following the node goes up. Successful initial steam condensation (node 2 up) protects the containment from initial overpressure. Continuing success in these events traverses the upper line of the event tree to state 1 core cooled. Any failures cause a traversal of other paths in the evL-nl tree. 

The Canadian licensing philosophy requires that each accident, together with failure of each safety system in turn, be assessed (and specified dose limits met) as part of the design and licensing process. In response, designers have provided CANDUs with two independent dedicated shutdown systems, and the likelihood of anticipated transients without scram is negligible. 

The safety concept considers two nuclear shutdown systems, a set of six reflector rods for reactor scram and power control and a KLAK system of small absorber balls for cold and long-term shutdown. Decay heat removal is made via the heat exchanger, an auxiliary cooling system, and the panel cooling system inside the concrete cavern, or, in case of a failure of these systems, passively by heat transfer via the surface of the reactor vessel. 

The linear rate system should be Interlocked to bypass the exponential rate trips of the Intermediate Range Monitor after a power level of 10 has been reached This will reduce the possibilities of a failure in the Intermediate Range Monitor period func tlon causing a spurious scram when the Instrument Is no longer needed for exponentleil rate protection. 

The performance of control rod drive mechanism (CRDM) has been satisfactory with friction force within limits and drop time less than 400 ms. An on-line system to monitor the drop time of control rod (CR) during scram was commissioned. Similarly a system was developed to measure friction force of CR during power operation. The 3 s interlock on CR raise movement, which was introduced before the first criticality was deleted as it was giving rise to large time in raising power and high start up duty demand on CRDM motors. The lower parts of two CRDM were replaced, one due to failure of translation bellows, and another due to failure of gripper bellows. Leaky silicone bellows of one CRDM was replaced in-situ. 

The VSR system strength is such that a wet, xenon-free reactor can be held sub-critical by the VSR s alone,with at least 90 per cent of the system control strength effective on demand in two and a half seconds or less. The VSR s may be scrammed into the reactor at any time, even from a partially withdrawn position, The failure or malfunction cf any single rod, or group of rods, does not interfere with the operation of the remainder of the system. 

Anticipated transients without scram are the most significant group of BDBAs. These include failures of the reactor protection system in addition to the following anticipated operational occurrences ... 

For heat-removal accidents, with complete loss of all means for heat removal the primary circuit remains leak-tight for approximately 5 hours (reactor scrammed). For loss-of-integrity accidents, with complete failure of water injection, there is a time reserve of approx.. 3 hours. To prevent these accidents the systems described above in item 2 may be used, as well as a special water supply system to the reactor cavity thus providing for cooling the reactor vessel from outside. 

Turbine trip from turbine design power, failure of direct scram on turbine stop valve closure, failure of the steam bypass system, and reactor scrams from an indirect scram... 

Each steam line has two containment isolation valves, one inside and one outside the containment barrier. The isolation valves are spring-loaded pneumatic piston-operated globe valves designed to fail closed on loss of pneumatic pressure or loss of power to the pilot valves. Each valve has an air accumulator to assist in the closiue of the valve upon loss of the air supply, electrical power to the pilot valves, and failure of the loaded spring. Each valve has an independent position switch initiating a signal into the reactor protection system scram trip circuit when the valve closes. 

Any such failure wo l5 ecram the reactor. Only after the system pressure had dropped to 350 pai, could emergency coolant enter. The time required for such a series of events would assure that the reactor would be scrammed and be subcrltlcal be fore the cold water could enter. 

Failure or partial failure of the river cooling water system secondary loop eyetem or primary loop system will lead to fuel melting unless the reactor power level Is reduced. Instarumentatlon has been provided to either reduce reactor power level automatically or scram the reactor when cooling capaclllty is Insufficient. 

---