Possible modes of steam generator overfill resulting from control system malfunctions at the Oconee-1 nuclear plant

A study has been made of control system failures which might lead to overfill of the steam generator in Babcock and Wilcox nuclear plants. The steam generator and its control system are described. Only one sequence has been found in which a single failure would lead to overfill, and in that case the final stages of the overfill would proceed rather slowly. Because of high level protective features all other failure sequences we have examined require at least two failures to produce overfill beyond the point of high level protection. Several sequences are described in which high level protection features can be placed in an undetected failed state by a control system failure; a subsequent additional failure, occurring prior to the detection and correction of the first failure, could then produce system overfill. Mechanical damage is identified which might be consequent upon steam generator overfill and water entry into the main steam line. Several ways of reducing the probability of steam generator overfill are suggested. No assessment has been made of the probability of occurrence of any of the sequences