Single failure criterion

The SFC shall be applied to each assembly of equipment which performs all actions required to fulfil a level FI function for a given initiating event in order that the limits specified in the design basis for that event are not exceeded. The need to apply SFC to level F2 functions will be determined on a case-by-case basis. 

for a particular safety function, it is necessary to operate various systems simultaneously or successively, a single failure shall be postulated in any one of the systems in turn, but not simultaneously in more than one of them. 

In the single failure analysis, the failure may not need to be assumed of a passive component designed, manufactured, installed, inspected and maintained in service to a high quality level. However, when it is assumed that a passive component does not fail, such an approach shall be justified, taking into account the total period of time that the component is required after the initiating event. 

The treatment of certain components sometimes considered passive, such as check valves, should be based on a realistic assessment, rather than on prescriptive rules. Thus, single failures should be assumed for check valves that have to change state unless sufficient evidence exists to show, in relation to their implicit reliability, that this is unduly conservative. 

In certain cases it may not be necessary to consider the combination of an event or hazard with a single faUure when the probability of the combination is very low (e.g. aircraft crash). 

---

A single failure criterion is used in all quadrants of o,-02 space instead of the segments in separate quadrants for the Tsai-Hill failure criterion because of different strengths in tension and compression. 

Fault-tolerance (including single failure criterion) SPINLINE 3 can meet any redundancy requirements. 

The requirement for compliance of the I C safety systems with the single failure criterion is stated from two perspectives ... 

Exemptions from the conformance to the single failure criterion under extraordinary situations could be considered by the regulatory authority on a case-by-case basis this, however, does not apply to regularly occurring situations such as periodic surveillance testing. Separate diverse protection systems if implemented within the I C system refurbishment project are not required to meet the single failure criterion. 

In order to solve a protective task at least two mutually independent measures have normally to be implemented. Thus, if there is a failure in one of them (including dependent failures) at least one protective measure is still available (single failure criterion, principle of redundancy). It has to be observed that there may be a failure in any element of a protective measure (sensor, amplifier etc.), i.e. the redundancy has to exist all the way through. 

It is a characteristic of the method that all components of a system are covered and that the consequences of the failure of an individual component are treated. Hence, it is suited to check the compliance with the so-called single failure criterion. This criterion implies that the failure of a single component must not lead to a hazardous state of the system. 

IEEE 379, "Standard Application of the Single Failure Criterion to Nuclear Power Generating Station Class IE Systems."... 

Single failure criterion in the form chosen (similar to the one of the IAEA criteria, that is applied to the group of systems which have to cope with an accident condition). 

AR340 1.53 Application of the single-failure criterion to nuclear power plant protection systems,... 

In IAEA the single failure criterion is formulated in a general and articulated way in GDC it is specifically inserted in various criteria The concept of fail safe is inserted in criterion GDC 23... 

A single failure is a failure that results in the loss of capability of a component to perform its intended safety function(s), and any consequential failure(s) which result from it. The single failure criterion is a criterion (or requirement) applied to a system such that it must be capable of performing its task in the presence of any single failure. 

Radiation doses and limits on radioactive releases for accident conditions. Guidelines for deterministic safety analyses, including guidelines for single failure criterion, redundancy, diversity and separation. 

What are the consequences of a failure appropriately taking into account the single failure criterion ... 

In the application of the single failure criterion, any failure which could occur as a consequence of the PIE should be identified and included in the starting point for the single failure analysis. 

DEFICIENCY IN THE REGULATIONS GOVERNING DBA AND SINGLE FAILURE CRITERION - DAVIS BESSE... 

After the Three Mile Island Unit 2 accident, the NRC reviewed auxiliary feedwater system designs with respect to timely initiation, as described in 10 CFR 50, Appendix A, (GDC 20), (Reference 3). Upon completion of the review, the NRC determined that new guidance identified in NUREG-0737, (Reference 4) was necessary in order to assure a timely start of the AFW system after a design basis event (e.g., loss of main feedwater). Among this new guidance was automatic system initiation, environmental and seismic equipment qualification, and single failure criterion. 

The ESF actuation system is composed of redundant trains A, B, C, and D. The instrumentation and controls of each train are physically and electrically separate and independent. The ESF actuation system can sustain the loss of an entire train and still provide its required protective action. Specific ESF design criteria are addressed for environmental and seismic equipment qualification, single failure criterion, and minimum equipment and system response times. 

Single failure criterion must be taken into account for the design of the SICl and SIC2 safety I C systems by using adequate solutions from all of the following ... 

The application of the single failure criterion to hardware random failures is straightforward [1, 11] no single failure should result in loss of the safety functions. However, in software this criterion is difficult to meet, since a faidt that causes a software failure is necessarily present in all the replicas of this software (see para. 3.13). 

After separation, the non-safety functions and components may be implemented with less restrictive or more resource intensive methods. In addition, the separation of safety functions and components can also be beneficial in satisfying the single failure criterion, because failures in the non-safety functions and components would have no impact on the safety functions and components. However, care should be taken to ensure that the separation is in fact achieved. 

INTERNATIONAL ATOMIC ENERGY AGENCY, Application of the Single Failure Criterion, Safety Series No. 50-P-l, IAEA, Vienna (1990). 

The CCWS is a safety grade system satisfying the single failure criterion. 

A single failure in the PMS does not prevent an actuation of the ESFs when the monitored condition reaches the preset value that requires the initiation of an actuation signal (see subsection 7.3.2.2.2 of Reference 6.1). The single failure criterion is met even when one division of the ESF coincidence logic is being tested, as discussed in subsection 7.1.2.9 of Reference 6.1, or when there is a bypass condition in connection with test or maintenance of the PMS. 

The single failure criterion, to ensure that no single failure or single maintenance action or any other single human action could disable a safety function ... 

---