The difficulty of testing redundancy systems (validation of a reactor containment system)

This short note cites two problems associated with the validation of the containment of the high flux Australian reactor, HIFAR (a DIDO-class materials test reactor). Neither problem had a significant effect on reactor safety, but each is an interesting illustration of the difficulty of testing a redundancy system. A failure which occurred in an electrical grid provides a further illustration of the same difficulty. HIFAR's reactor containment building (RCB) has a single shell, and each penetration, either static or dynamic, has two seals in series. The dynamic seals are actuated either by the containment isolation system (CIS) or (in the case of the airlocks) manually with interlocks. Routine 'proof' tests were performed to validate the RCB, using alternately only the inner or outer sealing devices of all the dynamic penetrations. Details of the problems are given. The problems arose because of unexpected interactions between the redundant sub-systems. Conclusions are drawn about the testing of redundant sub-systems singly and together. (author)