ML15216A411
| ML15216A411 | |
| Person / Time | |
|---|---|
| Site: | Diablo Canyon  |
| Issue date: | 08/04/2015 |
| From: | Norbert Carte NRC/NRR/DE/EICB |
| To: | |
| References | |
| TSTF-505 | |
| Download: ML15216A411 (9) | |
Text
TSTF-505 TSTF-505 Norbert Carte (NRC/NRR)
August 4 2015 August 4, 2015
Concerns Concerns
- Methodology to determine when a loss of function Methodology to determine when a loss of function has occurred is not described.
- Operators will need to make this determination Operators will need to make this determination within one hour after the components are declared inoperable.
- Some regulatory requirements may not be explicitly modeled or addressed in the PRA.
- Reductions in redundancy and/or coincidence may introduce new events to be protected against.
2
When can a RICT be used?
NEI 06-09 does not allow a RICT for a total loss of function, but does not have detailed guidance on what constitutes a total loss of g
function TSTF-505 allows two or more channels to be inoperable When Components are shared between protection and control systems, how many need to be PRA Functional or Operable in order for there not to be a total loss of function?
for there not to be a total loss of function?
Two Types of Functions Identified in TS Tables for RTS & ESFAS Identified in TS Tables for RTS & ESFAS Specific functions identified in regulatory requirements IEEE 279-1971 3
Functional Requirements (S
ti f P t
ti d C t
l)
(Separation of Protection and Control)
- GDCs 21 & 24 Effectively increases redundancy requirements IEEE 279 1971
- Explicit Requirement to protect against Single Failures of shared equipment (extra redundancy)
Events (alternate channels) - Not discussed below
- IEEE 603-1991 Si il t IEEE 279 1971
- Similar to IEEE 279-1971 4
GDC 21-Protection system reliability GDC 21 Protection system reliability The protection system shall be designed for high functional reliability Redundancy and independence functional reliabilityRedundancy and independence designed into the protection system shall be sufficient to assure that (1) no single failure results in loss of the
( )
g protection function Typical Configurations:
- 1 out of 2
- 2 out of 3
- 2 out of 4
- 1 out of 2 taken twice 5
GDC 24 - Separation of protection and control p
p The protection system shall be separated from control systems to the extent that failure of any single control system systems to the extent that failure of any single control system component or channel, or failure or removal from service of any single protection system component or channel which is common to the control and protection systems leaves intact a common to the control and protection systems leaves intact a system satisfying all reliability, redundancy, and independence requirements of the protection system.
Typical Configurations:
- 1 out of 2 1 out of 2
- 2 out of 3 vs 1 out of 3
- 2 out of 4
- 1 out of 2 taken twice 6
IEEE 279-1971 4.7, Control and Protection System Interaction Clause 4.7.3, Single Random Failure, states:
Where a single random failure can cause a control system action that results in a generating station condition requiring protective that results in a generating station condition requiring protective action and can also prevent proper action of a protection system channel designed to protect against the condition, the remaining redundant protection channels shall be capable of providing the redundant protection channels shall be capable of providing the protective action even when degraded by a second random failure.
Provisions shall be included so that this requirement can still be met if a channel is bypassed or removed from service for test or if a channel is bypassed or removed from service for test or maintenance purposes. Acceptable provisions include reducing the required coincidence, defeating the control signals taken from the redundant channels, or initiating a protective action from the g
p bypassed channel.
7
IEEE 279-1971 Clause 4.11, Channel Bypass or Removal from Operation, states:
The system shall be designed to permit any one channel to be y
g p
y maintained, and when required, tested or calibrated during power operation without initiating a protective action at the systems level.
During such operation the active parts of the system shall of themselves continue to meet the single failure criterion.
Exception: One-out-of-two systems are permitted to violate the single failure criteria during channel bypass provided that acceptable reliability of operation can be otherwise demonstrated.
For example, the bypass time interval required for a test, calibration, or maintenance operation could be shown to be short th t th b bilit f f il f th ti h
l ld b that the probability of failure of the active channel would be commensurate with the probability of failure of the one-out-of-two system during its normal interval between tests.
8
IEEE 279 to 603 Mapping IEEE 279 to 603 Mapping IEEE 279-1971 IEEE 603-1991 IEEE 279 1971 IEEE 603 1991 Clause 3 Clause 4 Cl Cl 0
Clause 4.1 Clause 5.0 Clause 4.2 Clause 5.1 Clause 4.7.1 Clause 5.6.3.1(1)
Clause 4 7 2 Clause 5 6 3 1(2)
Clause 4.7.2 Clause 5.6.3.1(2)
Clause 4.7.3 Clause 5.6.3.3 Cl 4 7 4 Cl 6 3 Clause 4.7.4 Clause 6.3 9