Light-water reactors (LWRs) thumb|right|324px| Before the core of a light-water nuclear reactor can be damaged, two precursor events must have already occurred: A limiting fault (or a set of compounded emergency conditions) that leads to the failure of heat removal within the core (the loss of cooling). Low water level uncovers the core, allowing it to heat up. Failure of the emergency core cooling system (ECCS). The ECCS is designed to rapidly cool the core and make it safe in the event of the maximum fault (the design basis accident) that nuclear regulators and plant engineers could imagine. There are at least two copies of the ECCS built for every reactor. Each division (copy) of the ECCS is capable, by itself, of responding to the design basis accident. The latest reactors have as many as four divisions of the ECCS. This is the principle of redundancy, or duplication. As long as at least one ECCS division functions, no core damage can occur. Each of the several divisions of the ECCS has several internal "trains" of components. Thus the ECCS divisions themselves have internal redundancy – and can withstand failures of components within them.
Light-water reactors (LWRs) thumb|right|324px| Before the core of a light-water nuclear reactor can be damaged two precursor events must have already occurred A limiting fault (or a set of compounded emergency conditions) that leads to the failure of heat removal within the core (the loss of cooling) Low water level uncovers the core allowing it to heat up Failure of the emergency core cooling system (ECCS) The ECCS is designed to rapidly cool the core and make it safe in the event of the maximum fault (the design basis accident) that nuclear regulators and plant engineers could imagine There are at least two copies of the ECCS built for every reactor Each division (copy) of the ECCS is capable by itself of responding to the design basis accident The latest reactors have as many as four divisions of the ECCS This is the principle of redundancy or duplication As long as at least one ECCS division functions no core damage can occur Each of the several divisions of the ECCS has several internal "trains" of components Thus the ECCS divisions themselves have internal redundancy – and can withstand failures of components within them