14.7 - Fault and Protection Schedule - EDF Hinkley Point

PRE-CONSTRUCTION SAFETY REPORT
CHAPTER 14: DESIGN BASIS ANALYSIS
SUB-CHAPTER : 14.7
PAGE : 13 / 48
Document ID.No.
UKEPR-0002-149 Issue 02
3.4. SET OF I&C FUNCTIONS
3.4.1. NUSO functions
When two I&C functions, with the same classification, perform opposing actions within the same
safety system, the one which has priority over the other one is called Non-unequivocally Safety
Oriented (NUSO). All other I&C functions are called Unequivocally Safety Oriented (USO).
The faulty actuation of NUSO, during many events, significantly lessens or impairs the actual
plant safety level, because it prevents from the action of an other I&C function which is needed
to mitigate the accident.
Due to their potential negative impact on safety when spuriously actuated, the NUSO I&C
functions shall be designed in a way to minimise the probability of spurious action.
3.4.2. Setpoints scales
Setpoints result from the hierarchical organisation of I&C functions described above.
The overall I&C design approach to ensure a high level of plant safety is based on:
• consideration of the channel accuracy,
• consideration of the response time of the I&C function,
• the threshold margin to ensure plant reliability in case of failure of the dedicated I&C
function,
• application of the single failure criterion to I&C systems,
• priority requirements between different I&C functions.
In Sub-chapter 14.7 - Figures 1 and 2, examples of setpoint scales with the corresponding
actions are shown.
3.5. RESET OF AUTOMATIC PROTECTION FUNCTIONS
3.5.1. Definition
A reset is an operator action to clear the memory of a stored automatic signal. It may be
necessary to inhibit an automatic signal to cancel actions initiated by the signal. In most cases, a
reset does not imply any automatic action but only allows a manual control of the system. When
actuators receive commands from the protection system, these commands have priority over
manual actions. In this case, the reset of the protection system command is necessary to allow
manual operation of the actuators in the control room in a post-accident situation on the safe
path.
Note
As mentioned above, in general there is priority of automatic commands generated in PS
over manual commands performed by the operator.