ML17046A412
Text
7.2 REACTOR TRIP SYSTEM 7.2.1 Description 7.2.1.1
System Description
The Reactor Trip System consists of equipment designed to cause or initiate engineered safety features.
All equipment from sensors to the trip breakers or initiation circuits of engineered safety features are part of the Reactor Trip System.
Engineered safety features are discussed in Section 7.3.
Design criteria for this system (refer to Section 7. 1) permit maximum effective use of process measurements both for control and protection functions, thus enhancing the capability to provide an adequate system to deal with the majority of common-mode failures as well as to provide redundancy for critical control functions.
The design approach provides system diversity which has been evaluated for a wide variety of postulated accidents (1).
The Reactor Trip System consists of an aggregate lineup of the following systems.
System descriptions may be found throughout this section and in the associated references:
Nuclear Instrumentation System (2)
Process Control System Solid State Protection System (3)
Figure 7. 2-1 illustrates core limits and shows the maximum trip points which are used for the protection system.
The solid lines indicate a typical locus of departure from nucleate boiling ratio (DNBR) = 1. 30 at four pressures, and the dashed lines indicate maximum permissible trip points for the overtemperature ~T reactor trip.
Actual setpoints (the safety limits are given in the Technical Specifications) are lower to allow for measurement and instrumentation errors.
The overpower
~T reactor trip limits the maximum core power independent of DNBR.
7.2-1 SGS-UFSAR Revision 6 February 15, 1987
Adequate margins exist between the maximum nominal steady state operating point (which includes allowance for temperature, calorimetric, and pressure errors) and required trip points to preclude a spurious trip during design transients.
7.2.1.2 Nuclear Instrumentation The Nuclear Instrumentation System is an integral part of the Reactor Trip System as described in these sections.
The Nuclear Instrumentation System uses information from three separate types of instrumentation channels to provide three discrete protection levels.
Each range of instrumentation (source, intermediate, and power) provides the necessary overpower reactor trip protection required during operation in that range.
The overlap of instrument ranges provides reliable continuous protection beginning with source level through the intermediate and low power level.
As the reactor power increases, the overpower protection level is increased by administrative procedures after satisfactory higher range instrumentation operation is obtained.
Automatic reset to more restrictive trip protection is provided when reducing power.
Various types of neutron detectors, with appropriate solid-state electronic circuitry, are used to monitor the leakage neutron flux from a completely shutdown condition to 120 percent of full power.
The power range channels are capable of recording overpower excursions up to 200 percent of full power.
The neutron flux covers a wide range between these extremes.
Therefore, monitoring with several ranges of instrumentation is necessary.
The lowest range (source range) covers six decades of leakage neutron flux.
The next range (intermediate range) covers eight decades.
Detectors and instrumentation are chosen to provide overlap between the higher portion of the source range and the lower portion of the intermediate range.
The highest range of instrumentation (power range) covers approximately two decades of 7.2-2 SGS-UFSAR Revision 6 February 15, 1987
the total instrumentation range.
This is a linear range that overlaps with the higher portion of the intermediate range.
The system described above provides Control Room indication and recording of signals proportional to reactor neutron flux during core loading, shutdown, startup and power operation, as well as during subsequent refueling.
Startup rate indication for the source and intermediate range channels is provided at the control board.
Reactor trip and rod stop control and alarm signals are transmitted to the Reactor Control and Protection System for automatic plant control.
The Salem design used the Ion-Chamber Current Recorders (NR-41 through NR-44) to record the upper and lower neutron flux of the same detector instead of the upper and lower neutron flux of the diagonally opposite detectors.
A block diagram of the Reactor Trip System showing various reactor trip functions and interlocks is shown on Plant Drawing 221051.
7.2.1.3 Principles of Design The identification of applicable safety criteria is covered in Section 7. 1.
The Reactor Trip System is designed in accordance with IEEE Standard 279-1971. Detailed descriptions of the implementation of these principles are presented here in Sections 7.2 and 7.5.
7.2.1.4 Electrical Isolation The design criterion used to assure electrical isolation is that no analog signal which is required for initiation of reactor protection or engineered safety feature actuation is allowed to leave a set of protection channels. Where protection signal intelligence is required for other than protection functions an isolation amplifier (part of the protection set) is used to transmit the intelligence.
amplifier prevents the The isolation 7.2-3 SGS-UFSAR Revision 27 November 25, 2013
perturbation of the protection channel signal (input) due to any disturbance of the isolated signal (output) which normally could occur near any termination of the output wiring external to the protection racks.
A description of the nuclear instrumentation isolation amplifiers is given in Reference 4.
A description of the Process Control System isolating device is given in Reference 5.
Isolation of the reactor protection and engineered safety feature signals from control signals has been demonstrated.
Tests have confirmed the adequacy of isolation devices in Protection System designs.
7.2.1.5 Protection System Identification All nonrack-mounted protective equipment and components are provided with an identification tag or name electrical components such as relays have name plate.
Small plates on the enclosure which houses them.
All cables are numbered with identification tags.
These numbers are included in the cable control report which specified cable routing.
For protection racks which house the protection rack mounted equipment, a
color coded nameplate on the rack is used to differentiate between protective and non-protective sets.
This provides immediate and unambiguous identification of protection sets.
The color coding of the nameplates is as follows:
Protection Set I
- Green with white lettering Protection Set II - Gray with white lettering Protection Set III - Blue with white lettering Protection Set IV
- Cocoa with white lettering 7.2.1.6 Manual Actuation Means are provided for manual initiation of Protective System action.
Failure in the automatic system does not prevent the 7.2-4 SGS-UFSAR Revision 6 February 15, 1987
manual actuation of protective functions.
Manual actuation is designed to require the operation of a minimum of equipment.
7.2.1.7 Channel Bypass or Removal from Operation The system is designed to permit any one analog channel to be maintained, tested, or calibrated during power operation without system trip.
(Note:
This does not include such backup trips as manual trip and reactor coolant pump breakers open trip.)
During such operation the active parts of the system continue to meet the single failure criterion, since the channel under test is either tripped or makes use of superimposed test signals which do not negate the process signal.
EXCEPTIONS:
- 1. "One-out-of-two" systems are permitted to violate the single failure criterion during channel bypass provided that acceptable reliability of operation can be otherwise demonstrated and bypass time interval is short.
- 2.
Containment spray actuation channels are tested by bypassing or negating the channel under test.
This is acceptable since there are four channels, and the two-out-of-four trip logic reduces to two-out-of-three during the test.
7.2.1.8 Capability for Test and Calibration The bistable portions of the Protective System (e.g., switches, on-off controllers, etc.) provide trip signals only after signals from analog portions of the system reach preset values.
Capability is provided for calibrating and testing the performance of the bistable portion of protective channels and various combinations of the logic networks during reactor operation.
The analog portion of a protective channel (e. g., sensor and amplifier) provides an analog signal of the reactor or plant parameter.
Any of the following methods for checking the analog portion of a protective channel during reactor operation are used:
7.2-5 SGS-UFSAR Revision 6 February 15, 1987
- 1.
Varying the monitored parameter
- 2.
Introducing and varying a substitute transmitter signal
- 3.
Cross-checking between identical channels or between channels which bear a known relationship to each other and which have readouts available The design provides for administrative control for the purpose of manually bypassing channels for test and calibrating purposes if required.
The design provides for administrative control of access to trip settings, module calibration adjustments, test points, and signal injection points.
7.2.1.9 Information Readout and Indication of The Protective System provides the operator with complete information pertinent to system status and safety.
Indication is provided in the Control Room if some part of the system has been administratively bypassed or taken out of service.
Trips are indicated and identified down to the channel level.
7.2.1.10 Vital Protective Functions and Functional Requirements The Reactor Protection System in conjunction with inherent plant characteristics is designed to prevent anticipated abnormal conditions from exceeding limits established in Sections 3 and 4.
Completion of Protective Action (Interlock)
Where operating requirements necessitate automatic or manual bypass of a protective function, the design is such that the bypass is removed automatically whenever permissive conditions are 7.2-6 SGS-UFSAR Revision 6 February 15, 1987
not met.
Devices used to achieve automatic removal of the of a function are part of the Protect~ve criteria of this section.
and are in accordance with t:he The Protective Systems are so designed that, once initiated, a protective action goes to completion.
Return to normal operation requires action by the operator.
For monitoring nuclear are used.
When a
more restrictive becomes necessary to for a
icular mode of or set of conditions, the Protective as assurance that the more restrictive is used.
The devices used to prevent improper use of less restrictive trip settings are considered a part of the Protective System and are designed in accordance with the criteria presented in this section.
The Reactor the reactor.
limits for these conditions are established during the final For anticipated abnormal conditions, Protective Systems, in conjunction with inherent characteristics and engineered safeguards, are designed t:o assure that limits for energy release to the containment and for radiation exposure (as in 10CFR50.67) are not exceeded.
Transmitted pressure, temperature, etc.) which can lead to a reactor _rip are either indicated or recorded for every channel.
7.2-7 SGS-UFSAR Revision 25 October 26, 2010
All nuclear flux power range currents (top detector, bottom detector, and algebraic difference and average of bottom and top detector currents) are indicated and/or recorded.
Alarms and Annunciators Alarms and annunciators are also used to alert the operator of deviations from normal operating conditions so that he may take corrective action to avoid a reactor trip.
Further actuation of any abnormal rod stop or trip of any reactor trip channel will actuate an alarm.
Alarms and/or annunciators also alert the operator when a
protection channel is placed in the test condition.
There is no audible or visual alarm associated with the Reactor Nuclear Instrumentation System panel doors.
Improper opening of these doors is prevented by administrative control.
Interlocks are provided on the doors of each of the process control analog racks, in all four protection sets, which actuate an alarm in the control room if any door in any protection set is opened.
7.2.1.11 Operating Environment The protective channels are designed to perform their functions when subjected to adverse environmental conditions.
See Section 7.3.1.2.2 for those portions of the Protective System that must operate in a post-accident environment.
7.2.2 Design Basis Information 7.2.2.1 Separation of Redundant Instrumentation and Controls The Reactor Protection System uses four separate and independent channels of instrumentation to provide inputs to two separate logic systems.
The design of the Reactor Protection System incorporates physical and electrical separation of the four channels from the sensing element to the logic systems.
The logic 7.2-8 SGS-UFSAR Revision 6 February 15, 1987
systems' outputs are also separated to preserve the independence of redundant functions.
Redundant instrumentation and control cables are routed through separate containment penetrations to maintain independence.
The four independent channel signals are wired to four separate sets of analog protection racks located in the vicinity of the plant Control Room.
These racks contain the isolation amplifiers which reproduce the sensed signal for use in the plant process control systems.
7.2.2.2 Design Basis for Protection Circuits Both reactor trip and engineered safety features actuation functions are performed by the Solid State Protection System.
Non-protective control type functions are also provided of which several can be classified as equipment protection.
The two redundant reactor trip logic channels are physically separated and electrically isolated from one another.
The Reactor Protection System is comprised of identifiable channels which are physically, electrically, and functionally separated and isolated from one another.
see Reference 3.
For additional information on this topic, The ac power feeds to the Solid State Logic System are in accordance with the split-bus concept shown on Figure 22 of WCAP-7488-L.
The exceptions to the system depicted on Figure 22 with respect to Salem's configuration are: 1) the fuse in series to the DC power supplies via a filter are not in series with the filter.
The DC power supplies are powered directly from the AC vi tal bus feeds.
The fuse is in series with the input relays.
- 2) In Train A, vital instrument Buses I and IV (instead of Buses I and II) provide power to the DC power supplies while in Train B, Buses II and III (instead of Buses III and IV) provide power to the DC power supplies.
- 3)
In Train B, Bus II provides power to the Slave Relays (instead of Bus IV).
Plant Drawing 211370 for the 115 VAC system.
Refer to 7.2-9 SGS-UFSAR Revision 27 November 25, 2013
The electrical supply and control conductors for redundant or backup circuits of the station have such physical separation as is required to assure that no single credible event will prevent operation of the associated function by reason of electrical conductor damage.
Critical circuits and functions include
- power, control, and analog instrumentation associated with the operation of Reactor Protection, Engineered Safeguards, Reactor Shutdown, and Residual Heat Removal Systems.
Credible events include, but are not limited to, the effects of short circuits, pipe rupture, missiles, etc.
General
- 1.
Cables of redundant or backup circuits are run in separate conduits, cable trays, ducts, penetrations, etc.
- 2.
Control and instrumentation cables are not placed in trays with cables operating above 250 V.
- 3.
Low level instrumentation cables are not routed in cable trays containing power or control cables unless a barrier is provided.
Instrumentation cables are shielded.
- 4.
Cables are clearly identified at the terminations as being safety-related and to what separation group they belong.
Specific Systems
- 1.
Reactor Trip System SGS-UFSAR
- a.
Separate routing is maintained for the four basic protection channel analog sensing signals, bistable output signals, and power supplies for such systems.
7.2-10 Revision 6 February 15, 1987
- b.
Separate routing of the two reactor trip trains (logic matrix outputs) is maintained.
- 2.
Engineered Safeguards system
- a.
Separate routing is maintained for the four basic safeguards analog sensing signals, bistable output signals, and power supplies for such systems.
- b.
Separate routing is also provided for the automatic actuation, control, and power circuits to retain the redundancy of the multiple "train" concept provided in the system design and power supplies.
- 3.
Shutdown Systems -
Separate routing of control and power circuits associated with boric acid injection capability to retain the redundancies provided in the system design and power supplies is provided.
- 4.
Residual Heat Removal System - Separate routing of control and power circuits associated with residual heat removal capability to retain the redundancies of system design and power supplies is provided.
- 5.
Auxiliary Feedwater System -
Separate routing of control and power circuits associated with auxiliary feedwater capability to retain the redundancies of system design and power supplies is provided.
- 6.
Analog circuits, Paragraph la, and Engineered Safeguards System analog circuits, Paragraph 2a, may be routed in the same wireways provided circuits have the same characteristics such as power supply and channel set identity (I, II, III, or IV).
7.2-11 SGS-UFSAR Revision 6 February 15, 1987
- 7.
Power and Control-Conductors for the Engineered safeguards systems, Paragraph 2b; Shutdown Systems, Paragraph 3; Residual Heat Removal System, Paragraph 4; and Auxiliary Feedwater System, Paragraph 5, may be routed in the same wireways provided circuits have the same characteristics, such as train or power supply.
Pgwer Sgurces These separation criteria ~lao apply to the power supplies to the separate load centers and buses distributing power to redundant components and to the control of these auppliea.
Protective System Independence The Protective System is designed to be independent of the status of the Control
- System, plant data logging
- computer, indicators, recorders, and plant annunciators.
However, these systems and monitors derive signals from the Protective Systems through isolation amplifiers which are part of the Protective Systems.
The isolation amplifiers prevent any perturbation of the protection signal (input) due to disturbances of the isolated signal (output) which could occur near any termination of the output wiring external to the protection and safeguards racks. A detailed discussion of the isolation amplifier is given in References 4 and 5 for unit 1.
Reactor Trip sianal Testing Provisions are made, for process variables, to manually place the output of the bistable in a tripped condition if required for "at power" testing.
Except as noted below, administrative procedure requires that the final element in a trip channel (required during power operation) is placed in the trip mode before that channel is taken out of service for repair or testing, if required, so that the single failure criterion is met by the remaining channels.
7.2-12 SGS-UFSAR Revision 16 January 31, 1998
In the source and intermediate ranges, where the trip logic is one-out-of-two for each range, bypasses are provided for this testing procedure.
Nuclear instrument power range channels are tested by utilizing a test signal generated from within the power range drawer to test the various reactor protection trips.
Required surveillances may be performed by either of the following methods:
- 1.
By superimposing the test signal on the sensor signal so that reactor trip protection is not bypassed, therefore maintaining (2/4) coincident logic during testing, or,
- 2.
By disconnecting the detector signal and utilizing just the drawer test signal, thus reducing the (2/4) trip logic to (2/3) during the short period of the surveillance.
Even considering a single failure of a second power range channel in conjunction with a power excursion during the surveillance test period, sufficient power range channels remain to initiate reactor protection to terminate the event.
Containment spray actuation channels are tested by bypassing or negating the channel under test.
This is acceptable since there are four channels, and the two-out-of-four trip logic reduces to two-out-of-three during the test.
Provision is made for the insertion of test signals in each analog loop.
Verification of the test signal is made by portable instruments at test points specifically provided for this purpose.
This enables testing and calibration of meters and bistables.
Transmitters and sensors are checked against each other and against plant read-out equipment when required during normal power operation.
All analog signals which are used to initiate reactor trip or engineered safeguards are indicated or recorded on devices which are not dependent upon the plant computer.
In addition, a
plant 7.2-13 SGS-UFSAR Revision 11 July 22, 1991
computer program monitors various signals which are derived from process variables used as inputs to the Protection System.
The computer inputs are isolated from the Protection System channels.
A manual trip signal is initiated by the Control Room operator depressing either one of two pushbuttons.
Since either button will actuate both Train A and Train B logic, the manual trip is not testable at power.
7.2-13a SGS-UFSAR Revision 11 July 22, 1991
THIS PAGE INTENTIONALLY BLANK 7.2-13b SGS-UFSAR Revision 11 July 22, 1991
7.2.2.3 Reactor Protection System Testing Process Analog Protection Channel Testing For a
description of the overlap between the typical analog channel and the corresponding logic circuits, see Reference 3.
Each protection rack includes a
test panel containing those switches, test jacks, and related equipment needed to test the channels contained in the rack.
A hinged cover encloses a portion of the test panel.
Opening the cover or placing the test-operate switch in the "TEST" position automatically initiates an alarm.
These alarms are arranged in rack "sets"; the test panel cover is designed such that it cannot be closed (and the alarm cleared) unless the test signal plugs (described below) are removed.
Closing the test panel cover mechanically returns the test switched to the "OPERATE" position.
Test procedures will require the bistable output relays of the channel under test to be placed in the tripped mode prior to proceeding with the analog channel tests.
Placing the bistable trip switch in the tripped mode transfers the bistable output from the logic circuitry and connects it to a proving lamp.
This permits the electrical operation of the bistable to be observed and the bistable setpoint relative to the channel analog signal to be verified.
Upon completion of the test of the analog channel, the bistable trip switches must be manually reset to their operate mode.
Closing the cover of the test panel will not transfer the bistable trip switches from their tripped to their operate position.
Analog channel tests will be accomplished by simulating a process measurement signal, varying the simulated signal over its signal span and checking the correlation of bistable setpoints, channel readouts, and other loop elements with precision portable read-out equipment.
Test jacks are provided in the test panel for injection of the simulated process signal into each process analog 7.2-14 SGS-UFSAR Revision 6 February 15, 1987
protection channel.
Test points are provided in the channel to facilitate an independent means for precision measurement and correlation of the test signal.
This procedure does not require any tool (other than test instruments) nor does it involve in any way the removal of wires in the channel under test.
In general, the analog channel circuits are arranged so the channel power supply is loaded and is providing sensing circuit power during channel test.
Load capability of the channel power supply is thereby verified by the channel test.
Nuclear Instrumentation Channel Testing Nuclear Instrumentation System channels are tested by either superimposing the test signal in the actual detector signal or by disconnecting the detector cable and utilizing the drawer test signal only.
The output of the bistable is not placed in a tripped condition prior to testing.
If the channels are tested by superimposing a signal, then a valid trip signal would then be added to the existing test signal, and thereby cause trip at a somewhat lower percent of actual reactor power.
Protection bistable operation is tested by increasing the test signal (level signal) to the bistable trip level and verifying operation at control board alarms and/or at the Nuclear Instrumentation System racks.
A Nuclear Instrumentation System channel which can cause a reactor trip through 1 of 2 protection logic (source or intermediate range) is provided with bypass function which prevents the initiation of a reactor trip from that particular channel during the short period that it is undergoing test.
The power range channels do not require bypass of the reactor trip function for test, since the protection logic is 2 of 4.
If the detector cable is disconnected during testing the protection logic is 2 of 3.
No provision has been made in the channel test circuit for reducing the channel signal level below that signal being received from the Nuclear Instrumentation System detector.
7.2-15 SGS-UFSAR Revision 11 July 22, 1991
Logic Channel Testing The Solid State Protection System logic is designed to be capable of testing at power (3).
Reactor trip breaker testing is accomplished as follows:
normally, reactor trip breakers 52/RTA and 52/RTB are in service, and bypass breakers 52/BYA and 52/BYB are (withdrawn) out of service.
To test reactor trip breaker 52/RTA, as an example, the following is done:
- 1.
Bypass breaker BYA is put into service.
This act closes switchgear relay 52/BYA.
It also interrupts one of the two signals to the Train A "and box" which is necessary to actuate subsequent logic causing turbine trip, feedwater isolation, and safety injection block logic.
- 2.
A simulated trip signal is then applied to Train A only.
This act deenergizes undervoltage coil 52(UV)/RTA and the automatic shunt trip interposing relay which operates reactor trip breaker 52/RTA.
Test pushbuttons are installed to determine and verify each breaker tripping device (shunt coil, undervoltage coil) operated properly.
The reactor is not tripped because the control rods continue to receive rod drive bus power via switchgears 52/BYA and 52/RTB.
In the event that a real trip signal occurs during the testing of 52/RTA trip breaker, Train B will actuate the reactor trip and the logic following the Train B "and box."
SGS-UFSAR Revision 6 February 15, 1987
Auxiliary contacts on the bypass breakers are connected into the alarm system of their respective train such that if either train is placed in test while the bypass breaker of the other train is closed, both reactor trip breaker and the bypass breaker will be automatically tripped by the general warning alarm circuits of the Solid State Protection System.
The General Warning Alarm System is described in Reference 3.
7.2.2.4 Primary Power Source The primary power sources for the Reactor Protection System are described in Section 8.
The source of electrical power for the measuring elements and the actuation of circuits in the engineered safety features instrumentation is also from these buses.
7.2.2.5 Protective Actions Rapid reactivity shutdown is provided by the insertion of rod cluster control assemblies by free fall.
Duplicate series-connected circuit breakers supply all power to the control rod drive mechanisms.
The rods must be energized to remain withdrawn from the core.
Automatic control rod insertion occurs upon the loss qf power to the control rods.
The trip breakers are opened by the undervoltage coils and shunt trip coils on both breakers.
The undervoltage coils which are normally energized become deenergized by any one of the several trip signals.
The shunt trip coil is energized by an interposing relay which is installed in parallel with the undervoltage coils.
The design of the devices providing signals to the circuit breaker undervoltage trip coils is such as to cause these coils to trip the breaker on reactor trip signal.
Certain reactor trip channels are automatically bypassed at low power where they are not required for safety.
Nuclear source 7.2-17 SGS-UFSAR Revision 6 February 15, 1987
range and intermediate range trips are specifically provided for protection at low power or subcritical operation, and at higher power operations they are bypassed by manual action in conjunction with permissives.
During power operation, a sufficient amount of rapid shutdown capability in the form of shutdown control rods is administratively maintained by means of the control rod insertion limit monitors.
Administrative control requires that all shutdown group rods be in the fully withdrawn position during power operation.
A listing of reactor trips, means of actuation, and the coincident logic requirements may be found in Table 7.2-1 with references to interlocks as listed in Table 7.2-2.
Manual Trip The manual actuating devices are independent of the automatic trip circuitry, and are not subject to failures which make the automatic circuitry inoperable.
Actuating either of two manual trip switches located in the Control Room initiates a reactor trip and a turbine trip.
High Neutron Flux (Power Range) Trips These circuits trip the reactor when two-out-of-the-four power range channels read above independent trip settings:
the trip setpoint.
There are two a high and a low setting.
The high trip setting provides protection during normal power operation.
The low setting, which provides protection during startup, can be manually bypassed when two-out-of-the-four power range channels read above approximately 10 percent of full power (P-10).
Three-out-of-the-four channels below 10 percent power automatically reinstates the trip function.
The high setting is always active.
7.2-18 SGS-UFSAR Revision 6 February 15, 1987
High Neutron Flux (Intermediate Range) Trip This circuit trips the reactor when one-out-of-the-two intermediate range channels reads above the trip setpoint.
This trip, which provides protection during reactor startup, can be manually bypassed if two-out-of-four power range channels are above approximately 10 percent of full power (P-10).
Three-out-of-four channels below this value automatically reinstates the trip function.
The intermediate channels (including detectors) are separate from the power range channels.
High Neutron Flux (Source Range) Trip This circuit trips the reactor when one of the two source range channels reads above the trip setpoint.
This trip, which provides protection during reactor startup, can be manually bypassed when one of two intermediate range channels reads above the P-6 setpoint value and is automatically reinstated when both intermediate range channels decrease below this value (P-6).
This trip is automatically bypassed by two-out-of-four high power range signals (P-10). The trip function can also be reinstated below P-10 by an administrative action requiring coincident manual actuation.
The trip point is set between the source range cutoff power level and the maximum source range power level.
Overtemperature ~T Trip The purpose of this trip is to protect the core against departure from nucleate boiling (DNB).
This trips the reactor on coincidence of two-out-of-the-four signals, with one set of temperature measurements per loop.
The setpoint for this reactor trip is continuously calculated for each loop by solving the following equation:
7.2-19 SGS-UFSAR Revision 6 February 15, 1987
where:
The T avg p
= average reactor coolant temperature (F)
= pressurizer pressure (psig)
= setpoint bias (F)
K2, K3 = constants based on the effect of temperature and pressure on the DNB limits (F/F, F/psig).
f(~~) = a function of the flux difference between upper and lower long ion chamber sections (F).
(See s
four Figure 7.2-3)
-1
= lead-lag time constants (sec
)
= Laplace transform variable long ion chamber units separately feed each overtemperature ~T trip channel.
Thus, a single failure neither defeats the function nor causes a spurious trip.
Changes in f(~~)
can only lead to a decrease in trip setpoint.
Initiation of automatic turbine load runback by means of an overtemperature ~T signal is discussed later.
Power Range High Positive Neutron Flux Rate Trip This circuit trips the reactor when an abnormal rate of increase in nuclear power occurs in two-out-of-four power range channels.
7.2-20 SGS-UFSAR Revision 6 February 15, 1987
This trip provides protection against rod ejection accidents of low worth from mid-power and is always active.
Note:
Salem NRC License Amendment 278-261 (Salem 1 and 2, removal of the Flux Rate This function the by the setpoint to a greater value than the Maximum Negative Rate expected (per design change package (DCP) 80094424).
The Negative Flux Rate Trip circuitry has been physically removed from both Unit 1 and 2 per DCPs 80097106 and 80099680.
The purpose of this is to excessive power rod rating protection).
This trips the reactor on coincidence of two-out-of-the-four signals, with one set of temperature measurements per loop.
The setpoint for this reactor trip is continuously calculated for each channel by solving equations of the form:
where:
f (6<1>)
K4 K5, K6 SGS-UFSAR 11 T setpoint is a function of flux difference between upper and lower ion chamber section (F). (See Figure 7.2-3) a manually ustable bias (F) constants relating the effect of Tavg and rate of T
1'.
change of avg on overpower lmlt 7.2-21 Revision 26 May 21, 2012
T avg s
a bias (F) average reactor coolant temperature (F) time constant, (sec-1) transform variable Variables in parentheses are individually low limited to zero.
Initiation of automatic turbine load runback by means of an overpower 6T signal is discussed below.
Low Pressurizer Pressure Trip The purpose of this trip is to protect against excessive core steam voids and to limit the necessary range of protection afforded by the overtemperature 6T trip.
This trips the reactor on coincidence of two-out-of-the-four low pressurizer pressure This is blocked when three-of-the-four power range channels and two of two turbine steamline inlet pressure channels read below 10 percent power (P-7).
Each channel is lead-!ag compensated.
High Pressurizer Pressure Trip The purpose of this trip is to limit the range of required protection from the overtemperature 6T and to protect Reactor Coolant overpressure.
The reactor is tripped on coincidence of two-out-of-the-four high pressure signals.
High Pressurizer Water Level Trip This trip is provided as a backup to the high pressurizer pressure trip.
The coincidence of two-out-of-the-three high pressurizer water level signals trips the reactor.
This is blocked when three-of-the-four power range channels and two of the two turbine steamline inlet pressure channels read below 10 power (P-7).
SGS-UFSAR 7.2-22 Revision 25 October 26, 2010
Low Reactor Coolant Plow Trip This trip protects the core from DNB following-a loss-of-coolant flow. The means of aensinq loss-of-coolant flow are described below.
Low Primary coolant Plow Trip A loop low flow signal is g-enerated by two-out-of-three low flow signals per loop.
Above the P-7 setpoint (approximately 10 percent of full power) low flow in any two loops results in a reactor trip.
Above the P-8 setpoint (approximately 36 percent of full power) low flow in any loop results in a reactor trip.
Reactor Coolant Pump Breaker Position Trip Opening of two reactor coolant pump breakers above the P-7 interlock setpoint, which is indicative of an imminent loss-of-coolant flow, will result in a reactor trip.
Reactor coolant Pump Undervoltage and Underfrequenc:y Trips There is one underfrequency and one undervoltaqe sensor per bus.
A 1/2 logic:
taken twice underfrequenc:y siqnal-direc:tly trips all of the reactor coolant pumps, and also produces a direct reactor trip (interlocked by P-7).
(An indirect trip is produced by the pump breaker-position trip.) Por undervoltage protection, there is an undervoltage sensor on each of the four busses. Reactor trip above P-7 is actuated by a l/2 logic taken twice.
All of these low reactor coolant flow trips are blocked below the P-7 setpoint (approxtmately 10 percent power).
7.2-23 SGS-UFSAR Revision 14 December 29, 1995
Safety Injection System Actuation Trip A reactor trip occurs when the Safety Injection system is actuated.
The means of actuating the Safety Injection System trips are:
- 1.
Low pressurizer pressure (2/3 pressure signals).
permitted by 2/3 low pressurizer pressure
- 2.
High containment pressure (2/3)
Manual block is
- 3.
Two of three low steam line pressure of one line compared to other three lines (high differential pressure)
- 4.
High steam flow in two of four lines (1/2 measurements per line) (two of four lines) in coincidence with low-low T (2/4) or low steam avg line pressure (2/4)
- 5.
Manual (1/2).
These trips are listed in Table 7.2-1.
Reactor Trip on Turbine Generator Trip (Anticipatory)
The reactor trip on a turbine trip is actuated by two-out-of-three logic from the low autostop oil pressure or by all closed signals from the turbine steam stop valves.
A turbine trip causes a direct reactor trip above P-9 and results in a controlled short-term release of steam to the condenser, which removes sensible heat from the Reactor Coolant System and thereby avoids steam generator safety valve actuation. This reactor trip is anticipatory and included as part of good engineering practice and prudent design. No credit is taken in any of the safety analyses for this trip.
The Turbine Control System automatically trips the turbine generator under any of the conditions listed in section 10.2.2.3 and 10.2.2.4.
7.2-24 SGS-UFSAR Revision 16 January 31, 1998
The purpose of this is to prevent a loss of the reactor's heat sink. The is actuated on two-out-of-the-three low-low water level signals in any steam generator.
7.2.2.6 Elbow taps are used on each of the four loops in the Primary Coolant System as an instrument device that indicates the status of the reactor coolant flow. The basic function of this device is to provide information as to whether or not a reduction in flow rate has occurred.
The correlation between flow reduction and elbow tap read-out has been well established by the following equation:
2 tiP/tiP 0 =
(ro/ro0 J,
where tiP 0 is the referenced pressure differential with the referenced flow rate roO and tiP is the pressure differential with the corresponding referenced flow rate ro.
The full flow reference point is established during initial plant startup.
The low flow trip point is then established by extrapolating along the correlation curve.
The technique has been well established in providing core protection against low coolant flow in Westinghouse PWR plants.
The expected absolute accuracy of the channel is within +/- 10 and field results have shown the repeatability of the trip point to be within +/- 1 percent.
The analysis of the loss of flow transient in Section 15 assumes instrumentation error of +/- 3 percent.
7.2-25 SGS-UFSAR Revision 18 April 26, 2000
7.2.3 System Evaluation 7.2.3.1 Reactor Protection System and Departure from Nucleate Boiling The following is a description of how the Reactor Protection System prevents departure from nucleate boiling (DNB).
The plant variables affecting the DNBR are:
- 1.
Thermal power
- 2.
Coolant flow
- 3.
Coolant temperature
- 4.
Coolant pressure
- 5.
Core power distribution Figure 7.2-1 illustrates the core limits for which DNBR for the hottest fuel rod is 1.3 and shows the overpower and overtemperature AT reactor trips locus as a function of Tavg and pressure.
This illustration is derived from the inlet temperature versus power relationships.
Reactor trips for a fixed high pressurizer pressure and for a fixed low pressurizer pressure are provided to limit the pressure range over which core protection depends on the overpower and overtemperature AT trips.
Reactor trips on nuclear overpower and low reactor coolant flow are provided for direct, immediate protection against rapid changes in these parameters.
However for all cases in which the calculated DNBR approaches 1.3, a reactor trip on overpower and/or overtemperature AT would also be actuated.
7.2-26 SGS-UFSAR Revision 6 February 15, 1987
For the postulated abnormal conditions, the exact combination of conditions (reactor coolant pressure, temperature and core power, instrumentation inaccuracies, etc.) will not cause a DNBR to go below 1.30 before a reactor trip.
The simultaneous loss of power to all of the reactor coolant pumps is the accident condition most likely to approach a DNBR of 1. 30 for the calculated worst fuel rod.
In any event, the DNBR is near 1.30 for only a few seconds.
The aT trip functions are based on the differences between measured hot leg and cold leg temperatures.
These differences are proportional to core power.
The 6.T trip functions are provided with a nuclear differential flux feedback to reflect a measure of axial power distribution.
This will assist in preventing an adverse axial distribution which could lead to exceeding the allowable core conditions.
In the event of a difference between the upper and lower ion chamber signals that exceeds the desired range, automatic feedback signals are provided to reduce the overpower-overtemperature trip setpoints, which in turn block rod withdrawal and reduce the load to maintain appropriate operating margins.
7.2.3.2 Specific Control and Protection Interactions Nuclear Flux Four power-range nuclear flux channels are provided for overpower protection.
Isolated outputs from all four channels are auctioneered for automatic rod control.
If any channel fails in such a way as to produce a low output, that channel is incapable of proper overpower protection.
In principle, the same failure may cause rod withdrawal and hence, overpower.
Two-out-of-four overpower trip logic will ensure an overpower trip if needed even with an independent failure in another channel
- 7.2-27 SGS-UFSAR Revision 6 February 15, 1987
In addition, the Control System will respond only to rapid changes in indicated nuclear flux; slow changes or drifts are compensated by the temperature control signals.
Finally, an overpower signal from any nuclear channel will block automatic rod withdrawal.
The setpoint for this rod stop is below the reactor trip setpoint.
Coolant Temperature One hot-leg and one cold-leg temperature reading is provided from each coolant loop to use for protection.
Narrow-range thermowell resistance temperature detectors (RTDs) are provided for each coolant loop.
In the hot legs, sampling scoops are used because the flow is stratified; that is, the fluid temperature is not uniform over a cross section of the hot leg.
One dual-element RTD is mounted in each of the three sampling scoops associated with each hot leg.
The scoops extend into the flow stream at locations 120 degrees apart in the cross-sectional plane.
Each scoop has five orifices which sample the hot-leg flow along the leading edge of the scoop.
Outlet ports are provided in the scoops to direct the sampled fluid past the sensing element of the RTDs.
One of each RTD' s dual elements is used for protection, while the other is an installed spare.
Three protection readings from each hot leg are averaged to provide a hot-leg reading for that loop.
One dual-element RTD is mounted in a thermowell associated with each cold leg.
No flow sampling is needed because coolant flow is well mixed by the reactor coolant pumps.
As is the case with the hot leg, one element is used while the other is an installed spare.
Certain control signals are derived channels through isolation amplifiers.
from individual protective The isolation amplifiers are classified as part of the protective system.
The reactor control system uses the highest of four isolated Tavg signals.
The RTDs are a fast-response design which conforms to applicable IEEE standards and 10CFR50.49 requirements.
7.2-28 SGS-UFSAR Revision 10 July 22, 1990
The main requirement for reactor protection is that the temperature difference between the hot leg and cold leg varies linearly with power.
All 8T setpoints are in terms of the full power nT; thus, absolute AT measurements are not required.
Linearity of AT with power will be verified during startup tests.
Reactor protection logic using reactor coolant loop temperatures is 2/4, with one channel per reactor coolant loop.
This complies with all applicable IEEE Standard 279-1971 criteria.
Since reactor control is based on the highest average temperature from the four loops, the control rods are always moved based upon the most pessimistic temperature measurement with respect to margins to DNB.
A spurious low average temperature measurement from any loop temperature control channel will cause no control action.
A 7.2-29 SGS-UFSAR Revision 11 July 22, 1991
spurious high average temperature measurement will cause rod insertion (safe direction).
Channel deviation signals in the Control System will give an alarm if any temperature channel deviates significantly from the auctioneered (highest).
Automatic rod withdrawal blocks will also occur if any one of four nuclear channels indicates an overpower condition, or if any two of four temperature channels indicate an overtemperature or overpower condition.
Two-out-of-four (2/4) trip logic is used to ensure that an overtemperature or overpower ~T trip will occur if needed, even with an independent failure in another channel.
Finally, as shown in Section 15.1, the combination of trips on nuclear overpower and high pressurizer pressure also serves to limit an excursion for any rate of reactivity insertion.
7.2-30 SGS-UFSAR Revision 10 July 22, 1990
For operation with a loop out of service, only one safety-related setpoint must be manually reset to a more restrictive value.
The setpoint involved is the overtemperature 4T reactor trip.
The setpoint change must be made to one protection channel for each of the operating loops.
If the overtemperature 4T aetpoints can be reset (lowered) before turning off one pump, the setpoint should be reset during operation with all loops in service.
If the overtemperature 4T setpoints cannot be reset without causing a reactor trip before turning off one pump, reactor power should be reduced below the setpoint of P-8, the affected pump turned off, and the setpoints reset. Any time one pump is turned off or trips off when above P-8, an automatic reactor trip will occur.
The P-8 acta essentially as a high neutron flux reactor trip when operating with one loop not in service.
The P-8 setpoint will normally be set in such a way that the DNBR is above 1.30 (for anticipated transients) even without resetting the overtemperature 4'1' trips to the values appropriate for operation a loop out of service. setting P-8 in this way restricts the operating power level with a loop out of service to a value considerably lower than that which can be safely allowed after resetting the overtemperature 4T setpoints. After the overtemperature 4'1' setpoints have been reduced to the values required for operation with a loop out of service, the P-8 setpoint will be increased to the maximum value allowed consistent with maintaining the DNBR above 1.30 during all anticipated transients.
Setpoints appropriate for operation with one loop out of service have been included in the Technical specifications. The resetting of the 4'1' trip will be carried out under prescribed administrative procedures and only under the direction of authorized supervision.
7.2-31 SGS-tiFSAR Revision 6 February 15, 1987
Pressurizer Pressure The four p~essurizer pressure protection channel signals are used for high and low pressure protection and a~ inputs to the overtemperature AT trip protection and relief valv~s actuation functions (Figure 7.2-4).
Isolated output signals from these channels are used for pressure control.
These are used to control pressurizer spray and heaters.
Pressurizer pressure is sensed by fast response pressure transmitters with a time response of better than 0. 2 second.
A 1-second response time is used I which is more than adequate to cover the response characteristics of the tripping channels.
A spurious high pressure signal from one channel can cause low pressure by actuation of the spray valve.
Additional redundancy is provided in the Protection System to ensure low pressure protection, i.e., two-out-of-four low pressure reactor trip logic and two-out-of-three logic for safety injection.
The pressurizer heaters are incapable of overpressurizing the Reactor Coolant System.
Maximum steam generation rate with heaters is about 15,000 lb/hr, compared with a total capacity of 1,260,000 lb/hr for the three safety valves and a total capacity of 420,000 lb/ hr for the two power-operated relief valves.
Therefore, overpressure protection is not required for a pressure control failure; however, two-out-of-four high pressure trip logic is used.
In addition, either of the two relief valves can easily maintain pressure below the high pressu~e trip point.
The two relief valves are controlled by separate inputs from the same protection channel signals used for high pressure protection.
A two-out-of~two actuation logic is provided for each relief valve.
Finally, the rate of pressure rise achievable with heaters is slow, and ample time and pressure alarms are available for operator action.
7.2-32 SGS-UFSAR Revision 25 October 26, 2010
Pressurizer Level Three pressurizer 2/3 high level).
level channels are used for reactor trip Isolated signals from these channels are used for pressurizer water level control, increasing or decreasing the pressurizer water level as required.
A failure in the Level Control System could fill or empty the pressurizer at a slow rate (in the order of half an hour or more).
(See Figure 7. 2-5.)
The design of the pressurizer water level instrumentation is a slight modification of the usual tank level arrangement using differential pressure between an upper and a lower tap.
(See Figure 7.2-6.)
The modification consists of the use of a sealed reference leg instead of the conventional open column of water.
Experience has shown that hydrogen gas can accumulate in the upper part of the condensate pot on conventional open reference leg systems in pressurizer water level service.
At Reactor Coolant System operating pressures, high concentrations of dissolved hydrogen in the reference leg water are possible.
On sudden depressurization accidents, it has been hypothesized that rapid effervescence of the dissolved hydrogen could blow water aut of the reference leg and cause a large level error, measuring higher than actual level.
To eliminate the possibility of such effects, a bellows is used in a pot at the top of the reference leg to provide an interface seal and prevent dissolving of hydrogen gas into the reference leg water.
The reference leg is uninsulated and will remain at local ambient temperature.
This temperature will vary somewhat over the length of the reference leg piping under normal operating conditions but will not exceed approximately 140°F.
During a blowdown accident, any reference leg water flashing to steam will be confined to the condensate steam interface in the condensate pot at the top of the temperature barrier leg and will have only a small (about l-inch) effect on measured level.
Some additional error may be expected due to effervescence of hydrogen in the temperature barrier water.
7.2-33 SGS-UFSAR Revision 6 February 15, 1987
However, even if complete loss of this water is assumed, the error will be less than 1 foot and can be tolerated.
The first pressurizer level channel utilizing the sealed reference leg was installed and checked at the R. E.
Ginna Plant in March 1970. Operational accuracy has been verified by long-term use of the sealed reference leg system in parallel with an open reference leg channel.
No effects of operating pressure variation on either the accuracy or integrity of the channel have been observed.
Calibration of the sealed reference leg system is done in place after installation by application of known pressure to low pressure side of the transmitter and measurement of the height of the reference column.
The effects of static pressure variations are predictable.
The largest effect is due to the density change in the saturated fluid in the pressurizer itself.
The effect is typical of level measurements in all tanks with two-phase fluid and is not particular to the sealed reference leg technique.
In the sealed reference leg, there is a slight compression of the fill water with increasing pressure, but this is taken up by the flexible bellows.
A leak of the fill water in the sealed reference leg can be detected by comparison of redundant channel readings on-line and by physical inspection of the reference leg off-line with the channel out of service.
Leaks of the reference leg to atmosphere will be immediately detectable by off-scale indications on the control board.
Further detection of leakage is provided by the plant computer alarms for deviation between redundant channels.
High Level A reactor trip on pressurizer high level is provided to prevent filling the pressurizer in the event of a rapid thermal expansion of the reactor coolant.
A rapid change from high rates of steam relief to water relief could be damaging to the safety valves, relief piping, and pressure relief tank.
However, a level control 7.2-34 SGS-UFSAR Revision 6 February 15, 1987
failure cannot actuate the valves because the high pressure reactor is set below the valve set pressure.
With the slow rate of available, overshoot in pressure before is effective is much less than the difference between reactor trip and safety valve set pressures.
Therefore, a control failure does not require Protection System action.
In addition, ample time and alarms are available for operator action.
For control failures which tend to empty the for action.
time and alarms exist Steam Generator vilater Level Feedwater Flow Before describing control beneficial to review the Figure 7. 2-7.)
and protection interaction for these channels, it is Protection System basis for this instrumentation.
(See The basic function of the reactor level and low feedwater flow is for removal of residual heat.
with no
- action, the steam circuits associated with low steam to preserve the steam generator heat sink Should a complete loss of feedwater occur generators would boil dry and cause an overtemperature-overpressure excursion in the reactor coolant.
Reactor trips on temperature and pressure will trip the unit before there is any damage to the core or Reactor Coolant System.
Redundant auxiliary feedwater pumps are provided to prevent residual heat after from thermal expansion and discharge of the reactor coolant through the pressurizer relief valves.
Reactor act before the steam generators are dry to reduce the and time these pumps and to minimize the thermal transient on the Reactor Coolant of and steam generators.
for the reason:
7 SGS-UFSAR circuits are for each steam generator Revision 25 October 26, 2010
Should severe mechanical damage occur to the feedwater line to one steam generator, it is difficult to ensure the functional integrity of level and flow instrumentation for that unit.
For instance, a major pipe break between the feedwater flow element and the steam generator would cause high flow through the flow element.
The rapid depressurization of the steam generator would drastically affect relation between downcomer water level and steam generator water inventory.
A spurious high signal from the feedwater flow channel being used for control would cause a reduction in feedwater flow and prevent that channel from tripping.
A reactor trip on low-low water
- level, independent of indicated feedwater flow, will ensure a reactor trip if needed.
In addition, the three-element feedwater controller incorporates reset on level, such that with expected controller settings a rapid increase in the flow signal would cause only a small decrease in level before the controller reopened the feedwater valve.
A slow decrease in the feedwater signal would have no effect at all.
A spurious low steam flow signal would have the same effect as a high feedwater signal, discussed above.
A spurious high water level signal from the protection channel used for control will tend to close the feedwater valve.
This level channel is independent of the level and flow channels used for reactor trip on low flow coincident low level.
- 1.
A rapid increase in the level signal will completely stop feedwater flow and lead to an actuation of a reactor trip on low feedwater flow coincident with low level.
7.2-36 SGS-UFSAR Revision 6 February IS. 1987
- 2.
A slow drift in the level signal may not actuate a low feedwater signal.
Since the level decrease is slow, the operator has time to respond to low level alarms.
Since only one steam generator is affected, automatic protection is not mandatory and reactor trip on two-out-of-three low-low level is. acceptable.
Steam Line Pressure.
Three pressure channels per steam line are used for steam line break protection.
These are combined with other signals as shown in Table 7.2-1. Two-out-of*four 1(2/4) high steam flow in coincidence with 2/4 low-low Tavg or 2/4 low steam line prebsure will actuate safety injection.
7.2.3.3 Reactor Trip Breakers Trip breaker failure in Unit 1 occurred on February 22 and 25, 198*3. Following these events a comprehensive corrective action plan was developed by Public Service Electric & Gas (I?SE&G) and submitted to the NRC by letters dated April 8 and 28, 1983
{Uderitz to Eisenhut).
PSE&G subsequently engaged the BETA Corporation to review the corrective action plan.
BETA's report (6) and findings were submitted to the NRC by letter dated May 31, 1983 (Oderitz to Eisenhut)
- In response to the Unit l event, the NRC issued Generic Letter 83-28 addressing a number of broad implications.
In addition to information in the corrective action plan, PSE&G responded specifically to Generic Letter 83-28 by letters dated July 22, 1983 and November 7, 1983 (both Liden to Varga). Subjects discussed in these documents which are reflected in other sections of the FSAR are as follows:
Subject Vendor Manuals Preventive Maintenance Reactor Trip Breaker ATWS Event
.SGS-UFSAR 7.2-37 FSAR Section 13.5.3 13.5.3 Appendix 7A Revision 23 October 17, 2007
The effects of the comprehensive preventive maintenance program resulting from the February 1983 event has been an increase in the reliability of the reactor trip breakers in performing their function (i.e., open).
Continued assurance of reactor trip breaker and reactor trip bypass breaker operability is provided by the performance of periodic maintenance on these breakers on a semiannual basis as follows:
- 1.
Response time testing, (3 times) {visicorder) trend data
- 2.
Trip bar lift force measurements
- 3.
o.v. output force measurement
- 4.
Dropout voltage check
- 5.
Servicing/lubrication/adjustments -
If during such maintenance a reactor trip breaker or reactor trip bypass breaker fails, (1) with.:::_300 grams of weight added to the breaker trip bar or ( 2) with a response time that results in an overall reactor trip system time response exceeding the Technical Specification limit, such that a Technical Specification Action is entered, then a Special Report to the NRC shall be submitted within 30 days as per Technical Specification 6. 9. 2.
{Reference Technical Specification Table 3. 3-l Notation HID.
- 6.
Repeat items 1 through 4 following any necessary actions resulting from item 5.
7.2.3.4 Tests and Inspections A plan for periodic component and system testing and material examinations was prepared for use throughout plant life, Requirements for inspection and testing of reactor trip and bypass breakers are outlined in correspondence from R. A. Oderitz to D. G. Eisenhut dated March 14, 1983; April 8, 1983; April 28, 1983; and May 31, 1983.
7.2-38 SGS-OFSAR Revision 23 October 17, 2007
NOTE:
Technical Specification amendments 114 (Unit 1) and 96 (Unit 2) have changed NRC reporting requirements for reactor trip breaker surveillance failures.
Reporting recommendations referenced in the April 8, 1983 letter from R.A. Uderitz to D.G. Eisenhut are effectively void as they have been superceded by these Technical Specification Amendments.
7.2.4 References for Section 7.2
- 1.
Burnett, T. W. T., "Reactor Protection System Diversity in Westinghouse PWR's," WCAP-7306, April 1969.
- 2.
Lipchak, J. B. and Stokes, R. A., "Nuclear Instrumentation system," WCAP-7380-L (Proprietary), December 1970 and WCAP-7669 (Nonproprietary), April 1971.
- 3.
Katz, o. N., "Solid State Logic Protection system Description," WCAP-7488-L (Proprietary), January 1971 and WCAP-7672 (Nonproprietary), June 1971.
- 4.
"Test Report-Nuclear Instrumentation system Isolation Amplifier," WCAP-7819-Rl-A, Revision 1
- 5.
Bruno, J., "Isolation Tests-Process Instrumentation Isolation Amplifier, Westinghouse Computer and Instrumentation Division, Model 131-110, WCAP-7509-L (Proprietary), April 1970 and WCAP-7824 (Nonproprietary), December 1971.
- 6.
Basic Energy Technology Associates (BETA),
"A Review of Public Service Electric and Gas Company Corrective Action Program Related to Reactor Trip Breaker Failures at Salem Generating Station, Unit No. 1," May 27, 1983.
7.2-39 SGS-UFSAR Revision 15 June 12, 1996