Emergency and Preventive Reactor Protection Systems - Nuclear Power Plant Instrumentation and Control Systems for Safety and Security - page 303

are related to class 4. Each E&PRP system com-
bines purpose and functions of safety systems and
normal operation and relates to safety class 2(А).
Considering that emergency protection is one
of the main emergency prevention means, forming
third level of defense-in-depth in accordance with
NP, 2008,a the strictest requirements specifically
determined by a range of international and national
Ukrainian safety regulatory documents should be
raised upon it. Requirements to emergency reactor
protection function and systems and elements as-
sociated with it, are specified in the international
standards (e.g., IAEA, 2002; IAEA, 2012), USA
standards (e.g. ANSI/IEEE, 1987 and later),
rules and regulations, be in force in Ukraine (e.g.
NP, 2008b).
The requirements to monitoring and control
of process operation functions, in performance of
which E&PRP systems are involved, are provided
in IAEA, 2012 and NP, 2008,b. It is required to
have at least two different and independent sys-
tems of reactor shutdown, each of them should
provide the transition of the core into subcritical
state, in which the value of effective multiplica-
tion factor is less than unity and local criticality
is absent. One of these systems should perform
the emergency protection function and have a
fast response sufficient to shutdown the reactor
from any operational state not violating normal
operation limits. When the reactor is tripped, any
unintentional reactivity rise should be prevented,
however, the ability of personnel reasonable ac-
tions (such as refueling, diluting of boron solution,
neutron poison flow during maintenance, etc.)
leading to raise of reactivity in standby mode,
has not to block (IAEA, 2012).
The emergency reactor protection should be
carried out according to neutron flux density
level and the speed of its growth, and should be
provided over the whole range of neutron flux
density change (from 10 -7 % to 120% of the nomi-
nal value). Other parameters, according to which
the emergency protection should be performed,
are determined in accordance with reactor system

design. The list of such parameters, set-points and
conditions of scrams should be substantiated in
the design in such a way to exclude the possibility
of safety limits violation.
The action started by emergency reactor protec-
tion should be fully performed. Control rods (CR),
which provide reactor shutdown, should be oper-
ated from any working or intermediate positions.
IAEA, 2012 provides a possibility of usage of CR
part to reactivity control (for example, to regu-
late neutron reactor power) in normal operation
modes, provided that the possibility to core shift
to subcritical state is supported regularly and with
a proper allowance. All regulations and standards
point at the necessity to monitor the availability of
emergency function performance, including the
possibility of checking of the protective actions
commands formation and the time required for
their passing (without affecting CR).
In case of normal operation violations, when
the emergency reactor protection scram is not
required, preventive reactor protection is applied.
In accordance with NP, 2008,b the emergency
reactor protection (ERP) system should be sepa-
rated from other I&C systems, in order for the
damages or any element removal of these systems
not to influence the ability of ERP system to per-
form its functions. Upon combining of emergency
reactor protection and normal operation functions
in one system, the priority of emergency reactor
protection should be provided and should be shown
that such combination will not lead to violation
of safety requirements and deterioration of ele-
ments' reliability, performing emergency reactor
protection functions. If the same signals are used
in ERP system and any other I&C system, an
appropriate separation should be provided (for
example, galvanic isolation).
In accordance with IAEA, 2002 and IAEA,
2012, the redundancy and the independence
embedded into ERP system design, should be
sufficient to provide that (1) none of single failure
will not lead to loss of protective function and (2)
removal of any component or channel will not