In the higher probability accidents, such as the loss of electrical power to the pumps resulting in a reduction of core cooling, the ability to scram the reactor and to retain sufficient cooling for the removal of decay heat is necessary in order to maintain a safe system. For this reason, considerable redundancy and independence is built into the scram systems. However, if the ability to scram the reactor were lost, then a core disruptive accident would result from a loss of cooling.

The plant protective system is a multilevel redundant system: it has a multiplicity of trip signals (loss of power, loss of flow, high outlet tempera­ture, high power-to-flow ratio), a multiplicity of circuits (redundant com­ponents and independent cables), and a redundant scram system (two inde­pendent, rapid-acting, rod shut-down systems). For this reason the failure to scram is of very low probability and has been estimated in the region of 10-3 to 10~e per reactor year (17, 18). In addition, the probability of the original fault should be combined with this value for the overall probability of the total event.

Nevertheless, at this point in time, a loss of cooling accident and a failure to scram the reactor is considered a representative CDA initiator. This assumption is a direct result of licensing procedure rather than of any credibility in the accident itself, and it is of vital importance both to the fast reactor power industry and to the proper direction of safety evaluation that adequate work be done on the reliability of scram systems to show that the assumption of this accident as a CDA initiator is quite unfounded.