A systematic approach to the analysis of double faults within design basic accident methodology - 14501
Within the UK there is a general trend towards adopting Design Basis Accident (DBA) methodology for the assessment of radiological hazards, including criticality. DBA is a single fault methodology and comprises identifying the initiating event, its frequency and consequence. A fault with a very low initiating event frequency will not require further analysis. A fault sequence that terminates in a sub-critical configuration would also not require further analysis; although the identified passive features ensuring sub-criticality are subjected to engineering substantiation. Where faults do not pass this initial screening, two safety measures are generally required to ensure the fault does not progress to a criticality incident. This methodology provides a robust approach to single faults ensuring that an appropriate level and range of plant measures are identified and subjected to appropriate substantiation. However, a criticality is a cliff-edge effect and is dependent on multiple parameters. It is entirely possible under DBA to evaluate several single fault sequences and conclude that no measures are required because the single faults terminate in a sub-critical configuration. Importantly, for criticality safety, under DBA, there is no requirement to prevent important parameters from deviating from normal or upper bound 'safe' levels leaving the plant at greater risk in the event that further faults initiate. The combination of two faults could lead to a criticality incident but there is no current driver within DBA methodology to analyze these coincident or double faults. There is, therefore, potential to significantly under estimate the risk of criticality. This understanding is embodied within other methodologies such as the Double Contingency Principle. However, within the UK the DBA methodology has so significantly improved the analysis of single faults that, in some instances, consideration of double faults has taken a back seat. This is despite the UK regulator stating that 'criticality safety cases should employ the double contingency approach'. This paper presents a systematic approach to ensure that the potential for double faults or multiple parameter deviations to result in a criticality is effectively evaluated within the wider DBA methodology. The methodology determines which faults may be screened out from double fault analysis on the grounds of being 'unlikely' to initiate and being present for a 'short' duration. For those faults screened into double fault analysis, this guidance sets out the potential means of determining acceptable risk. These means include the specific evaluation of the risk of two criticality control parameters deviating simultaneously, the definition of additional safety measures and the definition of the boundary of safety for multiple parameters and the risk of exceeding this boundary. (authors)