Shutdown systems failure modes

Shutdown Cooling System Failure Modes and Effects Analysis... 

SHUTDOWN COOLING SYSTEM FAILURE MODES AND EFFECTS ANALYSIS... 

For any reliability assessment to be meaningful it is vital to address a specific system failure mode. Predicting the spurious shutdown frequency of a safety (shutdown) system will involve a different logic model and different failure rates from predicting the probability of failure to respond. ... 

Other reports used within facilities record failures of particular interest because of failure mode and system or equipment affected. Some facilities may issue special reports when the plant experiences a shutdown (outage report) or when the occurrence is sufficiently unique or troublesome to warrant further investigation (unusual event report). In general, these reports can be characterized by their relatively restrictive focus (when compared to the maintenance records) and their smaller number. 

The number and severity of failures experienced by the equipment under study must be related to the operations of the facility. It would be inappropriate to assign the same operating histories to a continuously operating system and a system that operates intermittently. The number of hours in different operating modes (for example, 100% production versus shutdown) affect failure rate calculation and service description for taxonomy definition. 

A latching circuit waits for an event to occur. Once that event occurs, the latch output changes state and will ignore any further events until reset. This can be described as a memory element. The latch has many applications in the system. For example, if a failure mode occurs in the system, a shutdown signal may be sent to the latch circuit, which will shut down the system and prevent any further possible damage. The system will remain shut down until the power to the system is recycled. 

In addition, it should be demonstrated analytically that the mechanical systems can withstand a single active failure including failure of any auxiliary electric power source and not prevent delivery of sufficient cooling water to maintain the plant in a safe shutdown condition. A technique suitable for this analysis is a Failure, Modes, and Effects Analysis (FMEA). IEEE Std. 353-1975, "Guide for General Principles of Reliability Analysis of Nuclear Power Generating Station Protection Systems," provides additional guidance on the preparation of FMEAs. 

SIS measurement and trip point and output action Functional relation between process I/O and logic solver Manual shutdown requirements Energize/de-energize to trip requirements Resetting after SIS shutdown Allowable spurious trip Failure mode and desired SIS response Interface between SIS and other systems... 

FAILURE MODE being addressed. Remember that the qualitative feature applies to the safety-related system for a SPECIFIC failure mode. Thus, a design review involving features pertaining only to spurious shutdown would not be relevant where failure to shutdown is the issue. Paragraph No. 

The reactor protection system has "2 out of 4" logic design to improve reliability. Different designs are used for the operation of the primary reactor shutdown system and the backup reactor shutdown system, including the detectors and logic circuits, to reduce the probability of common mode failure. 

The fundamental CANDU HWR safety philosophy has been to provide defence in depth. Verifiable (during operation) numerical targets have been set for the frequency of process failures and for the reliability of the four special safety systems, namely the two shutdown systems the emergency core cooling system and the containment system. For common mode hazards which may extend over a significant area of the plant, a "two group" separation philosophy is used. 

FMEA (failure modes and effects analysis) A technique or procedure used to analyse the likelihood of failure within a process or system. It involves a process of review in assessing and quantifying risks identifying those that are of the greatest concern to the overall process or system, and preventing problems before they arise, saving both time and money. The failure modes are problems that need to be identified and the effects analysis are the consequences of the problems, which may include loss of plant function, equipment damage, plant shutdown, injury, release of materials to the environment, etc. 

The claim that smart positioner systems can reduce redundancy needs in shutdown valves is based on the assumption of increased safe failure fraction as described in paragraph 7.5.4. This conclusion would require thorough reliability analysis for each application before such a claim could be made, but the potential for major savings lies in this approach. What is certain is that frequent proof testing for typically 60% or 70% of possible dangerous failure modes of an actuator and valve combination provides a substantial improvement in PFDavg for the installed valve or valves. This may well be sufficient to deliver the SIL value required without additional measures and it will certainly reduce the required rate of manual proof testing with its attendant risk of production losses. 

Check valves are required in the piping system at any point where backflow of gas after a shutdown has the ability to restart the compressor, running it backwards or, for that matter, even in the normal direction. Reverse rotation is totally bad, as many components of the various compressor types are not designed for reverse rotation, and there is some possibility, generally remote, that the compressor could reach a destructive over speed. Forward rotation is bad primarily because the intent was to stop the compressor, and it is now operating out of control. This is a problem, particularly if the shutdown was caused by a compressor failure indication, and the need to stop was to prevent further damage. In this mode, it is unlikely that the compressor can attain an overspeed condition. An application with a high potential for backflow is the parallel operation of two or more compressors. 

A control system designed to automatically change the operating conditions such that the COP is no longer outside the Never-Exceed-Limit (N-E-L). The system may shutdown the operation or it may change conditions such that operation continues in a different mode. The Safety Interlock System must be independent from the normal control system to avoid "common mode" failure where one failure defeats both the normal control system and the Safety Interlock System. 

PSA systems are moderately reliable. The numerous valves associated with the process can cause unexpected shutdowns. The new PSAs are designed with alternate modes of operation, in which 100% of design capacity can be achieved while bypassing any failed valve or instrument, with only a slight loss of recovery. Failures are automatically detected and bypassed by the microprocessor-based control system. However, stronger and periodic control cycles are required. 

Consistent vrith current practice, active systems are used as first defense level against more probable events. These systems "termed as non-safety systems" establish and m ntain safe shutdown conditions. This requires at least one non-safety AC power source to be available. These systems include the Chemical and Volume Control System (CVCS), the Startup Feed Water System (SFWS), the Normal Heat Removal System (RNS), Spent Fuel pit cooling System (SFS), and the Diverse Actuation System (DAS). The later provides the defense in depth function of system actuation to back up the Safety Monitoring System (PMS) and to protect against common mode failure. 

This process of event classification, in which initiators of all types, both internal and external to the plant, and all modes of operation, including normal operation, shutdown and refuelling, are considered, should lead to a list of different classes of plant specific events to be analysed. Different plant conditions, such as manual control or automatic control, should be investigated. Different site conditions, such as the availability of off-site power or the total loss of off-site power, should also be evaluated, with account taken of the possible interactions between plant manoeuvres and the grid and, where appropriate, possible interactions between different reactor units on the same site. Failures in other plant systems, such as the storage for irradiated fuel and storage tanks for radioactive gas, should also be considered. 

This mode of failure involves a redundant system reducing to a single or 1002 mode of protection. The level of protection remains high and the shutdown rate is very low. Initial installation costs are likely to be higher but the life cycle cost may be lower. 

---