e-learning view The Manual here
Defence in depth: reactors




  • A fault in instrument supplies caused main feed valves to shut in one loop and caused the primary steam driven coolant pump to stop
  • The fault also caused the reactor control system to not work
  • Temperatures rose and the reactor tripped
  • No post-trip primary circuit cooling was available because of instrument supply failure
  • Reactor temperatures stabilized due to natural circulation
  • After 20 min, operators restored supplies and cooling


This event took place at a gas cooled reactor. A single phase fault in the instrument power supply to Reactor 1 was not cleared automatically and persisted until supply was changed over manually. The fault caused both high pressure and low pressure feed trip valves to close on one boiler, leading to rundown of the corresponding steam driven gas circulator. Much of the instrumentation and automatic control of the boilers and of Reactor 1 was lost. Manual rod insertion was possible and was attempted, but the rate was insufficient to prevent rising temperatures resulting in Reactor 1 being automatically tripped on high fuel element temperature (approximately 16°C rise).

The battery backed essential instrumentation and the reactor protection system remained functional, together with some of the normal control and instrumentation systems.

All gas circulators ran down as the steam to their turbines deteriorated. The instrument power supplies fault prevented engagement of gas circulator post trip motors either automatically or manually. Low pressure feed was maintained throughout to three out of four boilers and was restored to the fourth boiler by manual action. After the initial transient, which led to the reactor tripping, fuel element temperatures fell but then rose as forced gas circulation failed. These temperatures stabilized at about 50°C below normal operational levels before falling once again when gas circulator post trip motors were started on engagement of stand by instrument supplies. Reactor 2 was unaffected and operated at full output throughout. Reactor 1 was returned to power the following day.

INES procedure (click the highlighted flowchart items to follow the procedure)

Figure 9, page 150 of the Manual

Determine the initiator frequency

This event needs to be considered in two parts, click on the tabs to consider each part.

The first initiator was the transient caused by loss of feed to one boiler, together with loss of indications. This challenged the protection system.
This was expected.

Return to flowchart

This event needs to be considered in two parts, click on the tabs to consider each part.

The second initiator was the reactor trip and rundown of the steam driven gas circulators. This challenged the safety function ‘cooling of the fuel’.
This was expected.

Return to flowchart

Determine the safety function operability

The protection system was still fully available.

Return to flowchart

The operability of the 'cooling of the fuel' was less than the minimum required by OL&C, but more than adequate, as natural circulation provided effective cooling, and forced circulation was restored before temperatures could have risen to unacceptable levels.

Return to flowchart

Determine the basic rating

This part of the event would, therefore, be rated at Below scale/Level 0

Check the answer

This part if the event would give a basic rating of Level 2 or Level 3

Check the answer


The level chosen depends on the extent to which the operability is greater than just adequate. In this event, there was natural circulation available and there was limited time when forced circulation was unavailable.

The loss of primary circuit cooling would be rated at Level 2.