Fault Tree Reliability Analysis for Passive Medium Pressure Safety Injection System in Nuclear Power Plant

doi:10.4236/epe.2013.54B051

Paper Menu >>

Journal Menu >>

Energy and Power Engineering, 2013, 5, 264-268

doi:10.4236/epe.2013.54B051 Published Online July 2013 (http://www.scirp.org/journal/epe)

Fault Tree Reliability Analysis for Passive Medium

Pressure Safety Injection System in Nuclear Power Plant

Lengshan Leng, Yun Liu

School of Energy and Environment, Southeast University, Nanjing, China

Email: [email protected]

Received April, 2013

ABSTRACT

Modern nuclear power plants, both newly designed generation 3 and existing generation 2 reactors, make use of passive

safety systems for significant and measurable improvements in safety and reliability. Medium Pressure Safety Injection

System (MP-SIS) in Tianwan Nuclear Power Plant is a typical and very important nuclear safety passive system. This

paper discusses the reliability of MP-SIS on the basis of Fault Tree Analysis (FTA) with unavailability and Minimal

Cut Set (MCS) calculated as two important indicators. The result illustrates that the passive MP-Safety Injection Tank

barely contributes to the system’s unavailability and human interactions with Manual Valves and Motor Operated

Valves have great negative impact on the reliability.

Keywords: Passive Safety System; MP-SIS; FTA; Unavailability; MCS

1. Introduction

The experts of nuclear power industry conclude that the

Passive Safety System makes related safety functions

less dependent on operator and that external energy sup-

ply is potentially more reliable than active system. Be-

cause of its simplicity, reduced human interaction and

hardware failure [1, 2], Passive Safety System has been

mainly designed in the new generation 3 nuclear power

plant under construction. Nevertheless, Passive Safety

System is also installed in the existing generation 2 nu-

clear power plant in use.

Tianwan Nuclear Power Plant, the two 1000MW PWRs

(Pressurized Water Reactors) generation 2+ nuclear

power plant in China, is equipped with High, Medium

and Low pressure safety injection systems separately to

ensure that injecting of boric acid will co ol an d sub merge

the reactor core when the average temperature and pres-

sure of primary loop reduce, a phenomenon caused by a

LOCA (Loss Of Coolant Accident) in primary loop or a

MSLB (Main Steam Line Break) in secondary loop. The

Medium Pressure Safety Injection System (MP-SIS) in-

stalled inside is a typical passive safety system. Without

any active pump, the system is put into operation when

pressure difference between safety injection tank and

core reaches below certain value during the accident.

From this perspective, the passive MP-SIS safety as-

sessment and reliability analysis becomes necessary and

important both for operation of existing plant and design

of new gen era tion nucl e ar power pla nt .

The present paper aims to adopt the FTA (Fault Tree

Analysis) reliability analysis method [2] to build a FT

(Fault Tree) with MP-SIS failure as the Top Event so as

to obtain its unavailability and MCSs. The quantitative

calculation is made according to commonly estimated

and accepted data due to the fact that some of the possi-

bility data in this paper haven’t been released before [3,

4].

2. Description of MP-SIS

The medium pressure safety injection system, MP-SIS

(tag named JNG-2) in the 1000 MW PWR nuclear power

plant operates when the primary loop leaks and the cool-

ant pressure drops to 5.9 MPa. The MP-SIS injects water

with boric acid of 16 g/kg into the primary loop to con-

trol the core into a sub-critical state and make it cooled

down. The system consists of four series (Series JNG50,

JNG60, JNG70, and JNG80) which are independent and

physic-cally isolated from each other. Each series in-

cludes the following components and pipelines [5]. The

Pipe and Instrumentation Diagram (P&ID) of Series

JNG50 is shown in Figure 1.

 MP-Safety Injection Tank: Reception and storage of

boric acid solution.

 Safety Valves Groups: Prevent Injection Tank from

overpressure.

 Nitrogen Inflation Pipeline: Inflating nitrogen gas

from High-pressure Nitrogen System (tag named KRJ) to

Injection Tank.

L. S. LENG, Y. LIU 265

JNG50AA602

JNG50AA601

JNG52AA101

JNG52AA102

JNG51AA101

JNG51AA102

KBA93AA103

JNG50BB001

KBA

KBA93AA101

KBA93AA102

JNG50AA101

JNG50AA602

KTB15AA111

KTB15AA112

KTB10AA106

KTB10AA107

KTB

KRJ11AA103

JNG50AA410

JNG50AA411

Safety Values Groups

JNG50AA420

JNG50AA421

CORE

Check Valves’ Bypass Pipeline

KRJ

Figure 1. P & ID of MP-SIS (Series JNG50).

 Nitrogen Exhausting Pipeline: Exhausting nitrogen

gas from Injection Tank to Exhaust System (tag named

KTB).

 Drainage and Hydrophobic Pipelines: Pipelines

connecting Injection Tank with Volume and Boron Con-

trol Systems (tag named KBJ).

 Injection Pipeline: Connecting Injection Tank with

Core.

 Check Valves’ Bypass Pipelines: Inspection of the

Check Valves’ tightness and heating the Check Valves

nearby pipelines when the system operates.

3. Top Event and Basic Assumptions

Functional failure of JNG-2 system is chosen as the Top

Event to build a FT for MP-SIS. Some ba sic assumptions

are listed as below:

 The MP-SIS studied in this paper includes all the

valves and pipelines. The events of those components

which aren’t involved in the system are treated as Unex-

panded Events.

 Support systems such as KRJ, KTB and KBA are

assumed to operate normally.

 It is assumed that the system would be put into op-

eration under LOCA condition; thus the injection func-

tion would be achi e ve d wi t h ei t her one of t h e fou r seri es.

 The fault state of common components, except for

some large scale equipment and important valves, is set

as Unknown Event which is treated as Basic Event.

 All the components are assumed to have only two

states: failure or normal, without taking intermediate

state into consideration .

4. Fault Tree Building

Functional failure of JNG-2 system is directly caused by

the case that the four series are all fail. As all of the four

series are identical and independent from each other,

only functional failure of Series JNG50 is analyzed in

detail in the pape r.

Start signal (called Signal BB11) failure and MP-SIS

functional failure can directly cause the functional failure

of Series JNG50, and both of the two events are con-

nected to the previous event with an OR-Gate, where the

first event is handled as an Unexpanded Event.

MP-Safety Injection System is expected to direct inject

when LOCA happened because of its passiveness, there-

fore drainag e and pressuri zation should b e pre-completed

in a water-pressure test. Thus fundamental fault for the

functional failure of Series JNG50 is that the pressure of

nitrogen gas fails to in ject the co olan t into Injectio n Tank.

The direct causes are the follow two events: Failure of

drainage and pressurization or Failure of MP-SIS.

The first event can be connected to three failure events

with an OR-Gate, namely,

 Failure of Injection Tank JNG50BB001；

 Failure of Drainage Pipelines；

 Failure of Nitrogen Inflation Pipeline.

The operation of MP-SIS will break when pressure in

Injection Tank drops to lower than 1.15 MPa or the wa-

ter-level drops to 1.7 m. Therefore MP-SIS will fail when

any of the following four events happens:

 Failure of Injection Pipeline;

 Failure of C heck Valves’ Bypass P ipeline;

 Failure of Exhausting Pipeline;

 Failure of Hydrophobic Pipeline.

The concerned FT is shown in F igure 2.

Figure 2. FT for functional failure of Series JNG50.

L. S. LENG, Y. LIU

266

4.1. FT for MP-Safety Injection Tank

The fault state of MP-Safety Injection Tank JNG50BP-

001 belongs to Component Fault, where JNG50BP001’s

improper installation, the Primary Fault, is treated as a

Basic Event; JNG50BP001’s break, the Secondary Fault,

is connected to JNG50BP001’s overpressure and Failure

of Safety Valves Groups with an AND-Gate.

JNG50BP001’s overpressure is a System Fault, with

Pressure measurement fault and Wrong pressure signal as

the Direct Causes. Pressure measurement fault is con-

nected to Pressure-device’s fault and Signal transmis-

sion’s fault, and both are treated as Basic Events.

Safety Valves Groups include two groups: Monitor

Group with JNG50AA410 series connecting with JNG-

50AA411 and Running Group with Check Valve JNG-

50AA420 series conn ecting with JNG50AA42 1. The two

groups’ both failing can lead to Failure of Safety Valves

Group.

From the above, FT for Failure of Injection Tank is

built as shown in Figure 3.

4.2. FT for Nitrogen Inflation Pipeline

The pipeline is installed with a Motor Operated Valve

KRJ11AA103, which keeps opening during the pressuri-

zation process until the pressure in Injection Tank reach-

es 5.9MPa. Therefore, Failure of Nitrogen Inflation Pipe-

line equals to Failure of Motor Operated Valve

KRJ11AA103.

Figure 3. FT for injection tank.

4.3. FT for Hydrophobic Pipeline

Motor Operated Valves KBA93AA101 and KBA93AA-

102 are installed in series in the pipeline. As KBA Sys-

tem is considered as success, either of the valves’ failure

will cause Failure of Hydrophobic Pipeline.

4.4. FT for Injection Pipeline

Motor Operated Valves JNG50AA101 and JNG50AA-

102 installed in the pipelin e keep opening unless the wa-

ter-level or pressure of the Injection Tank is below cer-

tain valve to prevent nitrogen gas flowing into the core.

Meanwhile, Check Valves JNG50AA601 and JNG50A-

A602 are installed to preven t coolant in the primary loop

flowing into Injection Tan k.

The four Valves are connected in series, so events

about the valves’ failure are regarded as the input event

connected with Failure of Injection Pipeline by an OR-

Gate.

4.5. FT for Check Valves’ Bypass Pipelines

Bypass Pipeline for Check Valves JNG50AA601 is in-

stalled with JNG51AA101 and JNG51AA102, while

Bypass Pipeline for Check Valves JNG50AA602 with

JNG52AA101 and JNG52AA102.

FT for Failure of Check Valves’ Bypass Pipelines is

built as shown as Figure 4.

4.6. FT for Nitrogen Exhausting Pipeline

The pipeline is used for decompression during the pri-

mary loop’s cooling ; however, if the pipeline fails during

the MP-Safety injection, JNG-2 System will lose its

function.

Manual Valves KTB15AA111, KTB15AA112, KTB-

10AA106 and KTB10AA107 is installed; FT for Failure

of Nitrogen Exhausting Pipeline is built similar to that of

Injection Pipeline.

Figure 4. FT for check valve s’ bypass pipelines.

L. S. LENG, Y. LIU 267

4.7. FT for Drainage Pipeline

Similar to Nitrogen Inflation Pipeline, Drainage Pipeline

has only a Motor Operated Valve KBA93AA103 in-

stalled in the same way.

4.8. FT for Valves

Valves in MP-SIS can be divided into three types: Motor

Operated Valve, Manual Valve and Check Valve, and FT

building with deferent modes for these valves can be

referred to Table 1.

5. Calculation and Analysis

Risk-Spectrum program of Windows version developed

by Swedish RELOOP-AB is chosen to calculate the

reliability of the Medium Pres sure Safety injection system.

The program is approved by China National Nuclear

Safety Administration (NNSA) as one sort of PSA

analysis software tool, which applies top-down algorithm

to obtain the MCSs [6].

The Unavailability of series JNG50 is calculated as

6.28 × 10-4. The unavailability of the main components

and pipeline as well as its contribution to the system’s

unavailability is shown in Table 2.

Table 1. Failure mode of valves.

Type Failure

Mode a Basic/Unexpected Event

Breakage of parts

FR Power supply failure

Mechanical reasons

Power supply failure FF

Human error

No open/close signal

Connecting cable damaged

(Remote)

Operating switch damaged

Operator miss to open/close

Operator open/close other valves

Motor

Operated

Valve

FS(Local)

Operator miss to open/close

Leakage

Blockage

Operator error close/open valve

Unable to detect failure

Manual

Valve

SF Miss to close/open the valve after test

Breakage of parts

Check

Valve FW Blockage

Table 2. Unavailability and contribution.

Component/Pipeline Unavailability Contribution

Injection Tank 1.12×10-7 0.0165%

Nitrogen Inflation Pipeline 3.32×10-5 5.29%

Hydrophobic Pipeline 6.64×10-5 10.6%

Injection Pipeline 6.07×10-5 9.66%

Check Valves’ Bypass Pipelines 1.29×10-4 20.5%

Nitrogen Exhausting Pipeline 3.56×10-4 56.7%

Drainage Pipeline 3.32×10-5 5.29%

It is also calculated that the Unavailability of Manual

Valves is 9.32×10-5, that of Motor Operated Valves is

3.32×10-5 and that of Check valves is 3.10×10-7.

The table illustrates that Nitrogen Exhausting Pipeline

has the greatest impact on the system’s reliability, as the

pipeline has four Manual Valves, the most unreliably

components, installed. Meanwhile, check valves’ by-

pass Pipeline installed with several active Motor Oper-

ated Valves also has a great contribution to system’s un-

availability.

Oppositely, Injection Tank, a passive component, has

almost no negative influence to the system. However,

Injection Pump as an active component in High Pressure

Safety System, has a relative high unavailability, th us the

active system is certainly more unreliably than MP-

Safety System.

The table illustrates that the top 10 MCSs are all con-

cerned with human interactions and that their contribu-

tion to the system’s unavailability reaches about 49.4%.

It can be inferred that the potential faults can be elim-

inated by enhancing the operating personnel’s serious

and responsible work attitude, which can ultimately en-

sure the proper operation of Medium Pressure Safety

Injection System.

6. Conclusions

This paper focuses on the reliability analysis conducted

on passive Medium Pressure Safety Injection System in

Tianwan Nuclear Power Plant. The Fault Tree for func-

tional failure of JNG-2 system was built and the calcula-

tion was performed with the help of Risk-Spectrum pro-

gram. The result shows that the passive components such

as Injection Tank are ben eficial to improving the reliabil-

ity of the system and unavoidable human interactions

with Manual Valves and Motor Operated Valves make a

L. S. LENG, Y. LIU

268

great contribution to the system’s unavailability.

REFERENCES

[1] E. Zio and N. Pedroni, “Monte Carlo Simulation-based

Sensitivity Analysis of the Model of a Thermal-hydraulic

Passive System,” Reliability Engineering and System

Safety, Vol. 107, 2012, pp. 90-106.

doi:10.1016/j.ress.2011.08.006

[2] A. K. Nayak, M. R. Gartia, A. Antony, G. Vinod and R.

K. Sinha, “Passive System Reliability Analysis Using the

APSRA Methodology,” Nuclear Engineering and Design,

Vol. 238, No. 6, 2008, pp. 1430-1440.

doi:10.1016/j.nucengdes.2007.11.005

[3] USURC, “NUREG-75/014. WASH-1400”, 1975.

[4] NNSA, “Probabilistic Safety Assessment Report Prob-

abilistic Safety Assessment (PSA) Qinshan CANDU Pro-

ject，12. 98-03600-PSA-001,” 2003.

[5] G. Y. Jiang, “WWER-1000 Nuclear Power Plant Equip-

ment and System,” 1st Edition, Atomic Energy Press,

2009.

[6] A. B. Relcon, “Risk Spectrum Theory Manual,” 1998.