1. Safety Assessment of General Design Aspects of NPPs (Part 2) IAEA Training Course on Safety Assessment of NPPs to Assist Decision Making Workshop Information IAEA Workshop Lecturer Lesson III 1_2 Lecturer Lesson III 1_2 City, Country XX - XX Month, Year

2. IAEA Training Course on Safety Assessment of NPPs to Assist Decision Making 2 Items for Discussion Review of Single Failure Criterion System Redundancy System Independence System Diversity Concept of Fail-Safe Design System Interactions and Dependencies Conduct of Single Failure Assessments

3. IAEA Training Course on Safety Assessment of NPPs to Assist Decision Making 3 Review of Single Failure Criteria “.. protection system shall be designed for high functional reliability and inservice testability commensurate with safety functions performed.” “Redundancy and independence designed into protection system shall be sufficient to assure: “1. No single failure results in the loss of protective function..” “2. Removal from service of any component or channel does not result in loss of required minimum redundancy unless acceptable reliability of operation of protection system can be otherwise demonstrated.”

4. IAEA Training Course on Safety Assessment of NPPs to Assist Decision Making 4 Review of Single Failure Criteria “..protection system shall be designed to permit periodic testing of its functioning when reactor is in operation, including a capability to test channels independently to determine failures and losses of redundancy that may have occurred.” Taken from US Title 10 Code of Federal Regulations, Part 50 Appendix A, General Design Criteria 21

5. IAEA Training Course on Safety Assessment of NPPs to Assist Decision Making 5 Example of Potential Single Failure

9. IAEA Training Course on Safety Assessment of NPPs to Assist Decision Making 9 System Redundancy System redundancy in all critical components is first step to meet single failure criteria. System redundancy reduces system failure probability thus improving reliability. To be redundant requires individual trains have sufficient capacity (Design Margins) to meet functional requirements. 2 redundant trains alone does not meet single failure criteria. Provisions also needed for: periodic on-line testing, and ability to remove a channel from service.

10. IAEA Training Course on Safety Assessment of NPPs to Assist Decision Making 10 System Redundancy

11. IAEA Training Course on Safety Assessment of NPPs to Assist Decision Making 11 System Redundancy To permit on-line testing and maintenance typically use minimum of 3 redundant trains or channels. To prevent spurious safety system operation (also potential safety concern) it is most common to take 2/3 Coincidence in actuation logic. Current reactor protection systems use either 2/3 or 2/4 coincidence logic. IEEE Std. 279 (1971), IEEE Std. 379 (1988) provide conservative guidance

12. IAEA Training Course on Safety Assessment of NPPs to Assist Decision Making 12 Example of Too Much Redundancy

13. IAEA Training Course on Safety Assessment of NPPs to Assist Decision Making 13 System Independence Single Failure Criteria for redundant systems implies redundant trains (or channels) are physically independent of each other. No common dependencies on power or environmental supports. Cross-connections are isolated to prevent fault in one train failing redundant train. IEEE Std. 384 (1984) provides conservative guidance.

14. IAEA Training Course on Safety Assessment of NPPs to Assist Decision Making 14 Example of Lack of Independence

15. IAEA Training Course on Safety Assessment of NPPs to Assist Decision Making 15 Example of Lack of Independence

16. IAEA Training Course on Safety Assessment of NPPs to Assist Decision Making 16 System Independence Independence is achieved by: Routing cabling in physically separated metal conduits according to electrical design standards, such as IEEE Std. 384 (1984). Cross-connection using qualified electrical isolation devices Use of Optical Isolators NOT resistors Fluid system cross connections isolated via check valves.

17. IAEA Training Course on Safety Assessment of NPPs to Assist Decision Making 17 System Diversity Reliability of redundant, independent safety system becomes limited by potential for common cause failure. Example: 2/4 train ECCS system will typically have failure probability in 10-4 to 10-5 range. It is difficult to mathematically justify common cause failure probability being significantly lower than this range.

18. IAEA Training Course on Safety Assessment of NPPs to Assist Decision Making 18 Common Cause Failures include Common design error or inadequate Design Margins Common manufacturing defects Common testing or system restoration errors Environmental degradation (dirt, grit, moisture)

19. IAEA Training Course on Safety Assessment of NPPs to Assist Decision Making 19 System Diversity Potential significance of common cause failure warrants thorough consideration in safety assessments. Additional redundancy is NOT way to address common cause failure. Component diversity is acceptable way to address common cause failure.

20. IAEA Training Course on Safety Assessment of NPPs to Assist Decision Making 20 Diversity Can Be Achieved By Use of different physical operating principles (e.g. : steam and electric driven pumps) Use of different component manufacturers to eliminate common manufacturing defects. Use of different technicians to test, maintain, or restore operating equipment.

21. IAEA Training Course on Safety Assessment of NPPs to Assist Decision Making 21 Concept of Fail-Safe Design “Fail-safe” concept originated with military concerns over accidental launch of missiles or detonation of weapons. Fail-safe concept requires systematic identification of safe outcome of system failure (e.g. no missile launch!). Central issue of Fail-safe concept typically identification of de-energized state of systems and components.

22. IAEA Training Course on Safety Assessment of NPPs to Assist Decision Making 22 Application of Fail Safe Concept to NPPs Control Rod Clutches, electrical breakers should be designed to TRIP on loss of control power. Relay logic should TRIP on loss of power. Reactor protection system should be designed to TRIP on loss of power supply. ECCS recirculation valves should typically fail as-is. Pneumatic Valves should be assessed which is safest state for loss of air pressure. Solenoid operated valves should be assessed which is safest state for loss of power.

23. IAEA Training Course on Safety Assessment of NPPs to Assist Decision Making 23 Systems Dependencies & Systems Interactions Most NPP designs have redundant protection systems supported by redundant support systems (e.g. AC/DC Power, cooling water, HVAC, etc.) Failure of one train of these individual support systems can lead to very complicated transient events involving sudden loss of ½ of all systems. World operating experience has shown these events can be very severe.

24. IAEA Training Course on Safety Assessment of NPPs to Assist Decision Making 24 Systems Dependencies & Systems Interactions Systems Interactions caused by single failures (steam line rupture in a compartment, inadvertent automatic fire suppression operation) can cause significant components to fail simultaneously. Faults initiated by failed support systems and system interaction events should be considered in Single Failure Assessments.

25. IAEA Training Course on Safety Assessment of NPPs to Assist Decision Making 25 Conduct of Single Failure Assessment Excellent guidance on performing single failure assessments can be found in: IAEA 50-SP-1, IEEE Std. 352 (1987). Single Failure Assessment is deterministic in nature and documented as FMEA. Probability only considered in dispositioning of “incredible faults”. Purpose: document Single Failure Criteria compliance for safety systems credited in Accident Analysis. Inputs are comparable to those needed for PSA (frequently FMEA conducted in parallel with PSA)

26. IAEA Training Course on Safety Assessment of NPPs to Assist Decision Making 26 Conduct of Single Failure Assessment Documentation required: All Electrical Schematics, Piping & Instrument Drawings, Isometrics (fluid systems only). Equivalent Schematics for all Support Systems. All Electrical/Mechanical Specifications. System descriptions. Operating Manuals and Operating Procedures. Test/Maintenance Procedures. Operating History Reports for similar equipment at other NPPs.

27. IAEA Training Course on Safety Assessment of NPPs to Assist Decision Making 27 Conduct of Single Failure Assessment Systematic identification of PIEs or Postulated Initiating Events. Identification of systems credited (timing, operation mode) in Accident Analysis. Collapse credited systems, support systems into single list of credited functions. Support system FMEA used to identify any systems interaction transients requiring further accident analysis as new PIEs.

28. IAEA Training Course on Safety Assessment of NPPs to Assist Decision Making 28 Conduct of Single Failure Assessment Single Failure Assessments are LARGE Independent review by Regulatory Body or other external organizations necessitates systematic, auditable documentation. Typical Format is via: Failure Modes and Effects Analysis Table Content of FMEA Table found in 50-SP-1 or IEEE Std. 352 (1987).

29. IAEA Training Course on Safety Assessment of NPPs to Assist Decision Making 29 Documentation of Single Failure Assessment Specific component identification - Component function - Failure mode - Effect of the failure on the system - Methods available to detect/correct the failure - Any relevant further comments - –FMEA Table systematically documents:

30. IAEA Training Course on Safety Assessment of NPPs to Assist Decision Making 30 Example of Actual FMEA

31. IAEA Training Course on Safety Assessment of NPPs to Assist Decision Making 31

32. IAEA Training Course on Safety Assessment of NPPs to Assist Decision Making 32 Comments from Personal Experience Single Failure assessments and PSA complement each other as tools to investigate safety. Both tools have identified design weaknesses Single Failure assessment provides a more legal proof of regulatory compliance to Regulatory Body than does a PSA –because no faults are hidden from consideration. Support System FMEAs frequently used as critical input to PSA for identifying Special Initiators.