Faults which do not involve, as an initiating event, a breach in the coolant boundary are referred to as pressurised faults. However, the consequent pressure transient may be sufficient to operate the primary cir­cuit pressure relief system or, if steam generator tubes leak, may operate the secondary circuit pressure re­lief system, There is no significant radiological release unless the fault causes substantial fuel clad damage.

Fault progression differs widely with different ini­tiating events and with which additional faults are as­sumed to occur. Reactivity faults have the potential to produce increased fuel temperatures and to cause clad failure. Some of these can be sufficiently severe to cause not only the release of fission products from the fuel/clad gap, but also release some of those nor­mally trapped in the fuel matrix itself. The faults also cause heat-up of the coolant and can increase pressure sufficiently to open the pressure relief valves.

Faults in the secondary side can give rise to radio­logical release. A major steam line break causes de — pressurisation of the secondary coolant and can lead to direct release of steam to atmosphere. The rapid boiling of the secondary coolant leads to its rapid cooldown and, in turn, to rapid transfer of heat in the heat exchangers from the primary to the secondary coolant. The cooldown of the primary coolant in­creases core reactivity (coolant heat-up, the concern in most accidents, has the desirable effect of reducing reactivity — but here the situation is reversed) and, although control rods are automatically inserted, it can actually lead to temporary re-criticality of the reactor.

The extent to which the steam released to atmos­phere carries with it radioactivity depends on the amount and activity of the primary coolant which en­ters the secondary circuit due to steam generator leak­age. Isolating valves are provided in the secondary side to prevent continued release to atmosphere, al­though fault studies include assessment of the con­sequences of one isolating valve failing to close.

Anticipated transients without trip (ATWT) are also studied. ‘Anticipated transients’ are those caused by initiating faults more frequent than about 10_1 per year.

Lower frequency initiating events, coupled with fail­ure to trip control rods into the reactor, need not be studied since failure to trip is assessed to occur with a probability of 10 "6 per demand and such ATWTs would have a frequency of less than 10“7 per year, (i. e., less than 10~1 x 10-6 per year) and hence are beyond the design basis. There are seven initiating faults, the most frequent being inadvertent reactor trip (i. e., receipt of a signal demanding a trip, assumed to occur ten times each year). The most limiting in terms of the required performance of the emergency boration system is the total loss of feedwater to all steam generators. The emergency boration system, a shutdown system diverse to that of the control rods, is initiated if the control rod position monitoring equipment detects that any rod Las failed to enter the core.

The above brief description of PWR faults is in­dicative only of some of the fault studies carried out. The studies are in fact very extensive and the results have been shown to be in conformity with the design

safety criteria. This has not been achieved by chance but by redesign where shortcomings were identified or anticipated.