ML15216A411

TSTF-505: August 4, 2015 Public Meeting

ML15216A411
Person / Time
Site:	Diablo Canyon
Issue date:	08/04/2015
From:	Norbert Carte NRC/NRR/DE/EICB
To:
References
TSTF-505
Download: ML15216A411 (9)

Text

TSTF-505 Norbert Carte (NRC/NRR)

August 4 4, 2015

Concerns

• Methodology to determine when a loss of function has occurred is not described.

• Operators will need to make this determination within one hour after the components are declared inoperable.

• Some regulatory requirements may not be explicitly modeled or addressed in the PRA.

• Reductions in redundancy and/or coincidence may introduce new events to be protected against.

2

When can a RICT be used?

• NEI 06-09 does not allow a RICT for a total loss of function, but does not have detailed gguidance on what constitutes a total loss of function

• TSTF-505 allows two or more channels to be inoperable

• When Components are shared between protection and control systems, how many need to be PRA Functional or Operable in order for there not to be a total loss of function?

• Two Types of Functions

- Identified in TS Tables for RTS & ESFAS

- Specific functions identified in regulatory requirements

• IEEE 279-1971 3

Functional Requirements (S

(Separation ti off P Protection t ti and dC Control) t l)

• GDCs 21 & 24

• Effectively increases redundancy requirements

• IEEE 279 279-1971 1971

- Explicit Requirement to protect against

• Single Failures of shared equipment (extra redundancy)

• Events (alternate channels) - Not discussed below

• IEEE 603-1991

- Similar Si il tto IEEE 279279-1971 1971 4

GDC 21 21-Protection Protection system reliability The protection system shall be designed for high functional reliabilityRedundancy reliability Redundancy and independence designed into the protection system shall be sufficient to assure that ((1)) no single g failure results in loss of the protection function Typical Configurations:

• 1 out of 2

• 2 out of 3

• 2 out of 4

• 1 out of 2 taken twice 5

GDC 24 - Separation p of p protection and control The protection system shall be separated from control systems to the extent that failure of any single control system component or channel, or failure or removal from service of any single protection system component or channel which is common to the control and protection systems leaves intact a system satisfying all reliability, redundancy, and independence requirements of the protection system.

Typical Configurations:

• 1 out of 2

• 2 out of 3 vs 1 out of 3

• 2 out of 4

• 1 out of 2 taken twice 6

IEEE 279-1971 4.7, Control and Protection System Interaction Clause 4.7.3, Single Random Failure, states:

Where a single random failure can cause a control system action that results in a generating station condition requiring protective action and can also prevent proper action of a protection system channel designed to protect against the condition, the remaining redundant protection channels shall be capable of providing the protective action even when degraded by a second random failure.

Provisions shall be included so that this requirement can still be met if a channel is bypassed or removed from service for test or maintenance purposes. Acceptable provisions include reducing the required coincidence, defeating the control signals taken from the redundant channels,, or initiatingg a protective p action from the bypassed channel.

7

IEEE 279-1971 Clause 4.11, Channel Bypass or Removal from Operation, states:

The system y shall be designed g to permit p anyy one channel to be maintained, and when required, tested or calibrated during power operation without initiating a protective action at the systems level.

During such operation the active parts of the system shall of themselves continue to meet the single failure criterion.

Exception: One-out-of-two systems are permitted to violate the single failure criteria during channel bypass provided that acceptable reliability of operation can be otherwise demonstrated.

For example, the bypass time interval required for a test, calibration, or maintenance operation could be shown to be short th t th that the probability b bilit off ffailure il off th the active ti channel h l would ld b be commensurate with the probability of failure of the one-out-of-two system during its normal interval between tests.

8

IEEE 279 to 603 Mapping IEEE 279-1971 279 1971 IEEE 603-1991 603 1991 Clause 3 Clause 4 Cl Clause 4.1 Cl Clause 5.0 0

Clause 4.2 Clause 5.1 Clause 4.7.1 Clause 5.6.3.1(1)

Clause 4 4.7.2 72 Clause 5 5.6.3.1(2) 6 3 1(2)

Clause 4.7.3 Clause 5.6.3.3 Cl Clause 4 4.7.4 74 Cl Clause 6 6.3 3

9