ML19256D300
| ML19256D300 | |
| Person / Time | |
|---|---|
| Site: | Crane  |
| Issue date: | 05/15/1971 |
| From: | US ATOMIC ENERGY COMMISSION (AEC) |
| To: | |
| Shared Package | |
| ML19256D301 | List: |
| References | |
| NUDOCS 7910170810 | |
| Download: ML19256D300 (7) | |
Text
_
T.!r2
P P.0T P.CTIC.1 CT 'T.'OL /2? ? T 27.CTMG' PC" 5?S TF'.7 Protection nad Control Svrters Generr.1 The Proposed IEEE Criteria for Nuclear Feuer Plant Protection Syctets (IEEE No. 279) and the Cc micaien's Ceneral Design Criteria cerved, where appliccble, as our baces for judging the cdequacy of the protectica systc=.
The protection system design is substantially the scr.c for Oconee Unit No. 1.
There is a minor difference relating to the separation of control and protection functionc uhich is discussed later in this report.
Since the basic protectica syctem design was reviewed extensively during the Oconce licensing process, our TMI-l review hac e=phasized those itccs which are unique to this station (including design variations by the architect-engincar within the constraints of the basic design), or fer which new information has been received, or which have been generic concerns.
Our review hcs included a detailed study of the following protection system schematic diagrans :
(1) Reactor Trip, (2) High Pressure Injection, (3) Low Pressure Injection, (4) Containment Spray, (5) Fan Coolers, and (6) Contained Isolation.
It is presently anticipated that the site visit by Electrical Systems Branch staf f members will take place in September.
pod 1450 256
_2_
S c? - - t ' c D ! n.~. r: =
Our rcvicu of the Tacetor Trip (Scrcn) cycten echc=ctics indicated thct,
with ca: pcceible enc 2ptien, the syct:= saticfied IEEC-270. Tac enc 2pti:n relatea to the lack of informatien availchle to un ccncerninr, the bynaccing of ir.strucant channel: during pc cr cperation. Uc unders tand th: th arc are two key-cparcted bypass s titches at each protection channel. The adequacy of the ad=inistrative control over these bypcsces, including suitable centrol roo= indicatica, is not clear to us at present. We ar:
continuing to pursue this =atter with the applicant and vill report to the Co==ittee later.
Our review of the engine 2 red safety feature sche =atice indic:tes that, in addition to being properly designed in split-bus arrangcLents and otherwise satisfying IEEE-279 and the CDC, the circuits have a high degree of on-line testability. This results fro: the fact that functions which cannot be simultaneously acco:plished on-line are controlled by separate rolays which can be tripped individually. For exa=ple, the High Pressure Injection Systc= has test provisions for initiating the pu=ps but not the valves.
The valves can be enercised independently of the pu=ps.
There is one exception to the split-bus design: one contain=ent ventilation f an =ust swing between two redundant a-c e=crgency buses in order to satisfy the single f ailure criterion. We have reviewed the design and concur with the applicant that no single f ailure will per=it the swing bus to inter-connect the two redundant and non-s;nchroni:cd ecergency buses. While we 1450 257
. would preft. a c;; ten thich eaticf/.c E.r.r; C
- de 5, ua beli
- :hr this cc;ign, in :uch as it catic fia; the cin;1c fcilure criterien, is 2
accept:.ble f or this plar.: and that bachfi: is not r2 q ui re d.
Cur rcvicu cf the red contrcl syste schc=ctics indicates that a sin ~1c electrical fail:re could per=it an c::tra rod crcup to be inadvertently with deran. We concur with the applicant that such a transient would be succeccfully ter=inated by the p;ctection system. We belie <c that this aspect of the dasign is acceptable.
A design feature of the rod control systcc provides the capability to patch the various rods into various control stations. The purpose of this feature is to per=it the assignsent of roda to red groups as desired. This feature, however, creates ' 3 administrative problem of ensuring that the intended rod is, in f act, ccatrolled by the intended statica. The problem arises frca the f act that a " wrong" red will give indications to the operator which are indistinguishable frca those which would be given by the " correct rod".
There are coarse position indicators (0-257.-50%-75"-100%) for each rod which are independent of the patching circuits; i.e., the coarse indicators are "hard-virad".
Whenever ant
- patching is acco=plished, these lights can be used for comparisen with the indicators at the control stations to ensure that the rods are connected properly.
l450 258
~
- Ec b alluvs. t'a p ::h t:3 c c'.v.n2 can be s faly impl;r_.. tid prc.
'.:d ti 1-era strin unt aiinh trative pre:chr;.: te sucrd ancin :: error:.
T. c pro clur2: uill be included in the :2chnical epccifientiens which cr2 nov under revicv.
Apart from our ona concern relating to proccetice systen bypae:ca, our review of the preccetion systc= schc=atic diagrc=s uncovered no other deficiencies.
Qualification Testing a.
LOCA Conditions Protection system instru=cnts which would be subjected to a LOCA or ctcam line breck accident environ =:nt arc designed to withstand the envirorcent for the length of time they would be required to operate under these conditions.
Design conditiens range upwards to 60 peig,100% humidity and a dose of 10,000 R.
Qualification tests under simulated LOCA and secam line break ecnditions have been perforced and are analyzed in the E5W topical report "Quali-fication Teoting of Protection System Instrumentation (BAU-10003)".
Our review of this document is incomplete at this time. We vill report the results of our review to the Co=mittee later.
b.
Scismic Conditiens The protcetion system instrunants are designed to function normally during and af ter the design basis earthquake.
}k)0 259
. S ulc ai: q tt.l' ficc-ica t;.: ts ha. : b2 n cend;;*.-
rad cre :ls o c: 1 - _.
in S/.* ?-1D M ",. Thecs c.ar.lyncs ar2 b d:q ra ri:'cd.
Cd>1 Ir.a toll.-:t en We have revicued the applicant's criteria.-id2 resp:ct to the installs:ica of raduadent pcuer, control and protection systen cables and concur trith the criteria. We will review the installed syst2m during a site visit.
Separation of Control and Protection Srstens At Ocence, the control syst:n inputs arc derivcd fres channels that cro within the protection systec or independent of the protection system. At TMI-1, the input can be derived only from protection, system channels; however, only one channel at a tica cca be selected for concurrent protection-control systcu functions.
The safety inplications of this design difference are not significant.
In all cases, the control systems are isolcted from the protcetion system and, in addition, any failure of a connon elenent (e.g., a sensor) would leave intact a redundant protection system as required by Section 4.7 of IEEE-279.
We oclieve that the design, since it confor=s to Section 4.7 of IEEE-279, provides adequate defense against randos f ailures. Connon mode f ailures which affect the interaction of control and protection systens are being reviewed on a gencric basis.
1450 2?60
~
...p,
- 7..,.__
Co, r,1 The Cenniscica's General Design Criteria, IEEL ~ 0 5, and Safe ty Gui!a; 6 and 9 cerved, uhere appliccble, as the bases for jut:ing the cd_quccy of the cecrgenc'* po.cr sy tcn.
Offcite Erer ency pcrer Svnten Pcwcr la brought to the switchyard over tue diverger.t rights-of.ay.
The riitchyard breakers are arranged in a breckcr-n'd-a-half configuratica.
Each br2aker has two trip coils (for fault clearing,) controlled by redundant circuits. Power frem the switchyard is fed to the plant via two startup trans fo r=c rs.
Stability studies show that the grid can withstand the sudden loss of the TMI-l generator or the most critical unit on the grid.
We are asking the applicant to determine if a turbine trip followed by a single failure in the switchyard (e.g., bus, breaker, battery) will cause the loss of all access to offsite pcwcr. Our concern is that the single failure might require isolatien of the entire switchyard by external fault-clearing devices in order to isolate the nonitoring generator.
Apart '. rom this ene concern which we crpect to discuss with the Con =ittec
~
later, we conclude that the offsite emergency power system sa:isfies the applicable criteria and is acceptabic.
1450 261
^
'~n
~'
C.'~.
~~~-
Uit':
t' 2 2::c2; tic: 0 - cnt :,.f r; b = ct : n -. '. G ta l - 1 r. a l, d ! c r.. -
.u previcL11, cl.: 2-c pcrtion of the on;ito sy;ter 1; red 1.. 'n cnd :- li.
f thrcu?.cet in n:..;:4.::c2 vith 5.icty Cui 'a 6.
M; ;in a dicral ;.:. ::..:::
leadin3 in the ev2at of cn cecid:nt is 2513 hU which is belet-the 20i0 hour rating of the diascis in accordance with Safo:y Guida 7.
The diesels cra located in separate roces and cra individually started by less of vcitags at their respectiva buscs. The offsita sur. ply brechers to cach enargency bus are respectively cponed (in rasponse to undarvcitraA) by control circuits en2rgi:2d f res the d-c subsys ta= assigacd to that b us.
The starting of a diesel is in no way conditioned by oper:tica of the other.
There are two station batterics located in separate, adj accat roo=s.
With the exception of a _ single sving bus, the d-c systen is also split through-out and is cer;atible with the split a-c sys tc=.
Althcugh the swing bus decs not conform to Safety Guida 6, our review indicatcc that the accociated circuits are adequately fused to prevent a single fault fron dischling both d.c. systers. For this reason, we believe that the design is adaquete for this plant and that backfit is not required.
The batteries are located in separate rcons. The rooms are ventilated by redundant supply and exhaust f 2ns which shara a ecc=cn duct enternal to the roo=3.
The f ans are energized frca the ccargency a-c buses.
We conclude the design of the ensite energency pcuer systc= is accepenble.
We uill review the installed systc= during our forthecting site visit.
e
-. _q. s. 7 _;,,
~.
c.1 4
\\-
~. g.
L. h.
...,.c..
..a r'. ;
r MAY 15 1971 P. A. Merris, Director, Division of Rametor Licensing SAFETT EVALUATI0tl, PRDIECTION, CDtqTROL AND DGutCENCY
- TEMS,
'murt MILE ISLAND NUCLEAR STATION, UNIT 1; DOCKET NO.Q--2 89 The safety evel==srh relating to the protection, control, and emergemey power systems for the Three Mile Island Nmelaar Station, Unit 1 is ame1==ed.,
[i
.. - ~
,,. o-
..u.-
.c
.6
- c
b.
i' -
OdginalSigned By.
.s E. G. Case y.
~,.
(; e
-(1,
E. C. Case, Direr: tor.
'. _,. mq ~ ~ -
. Division of Ba=eror Standards l
s f'
',r,i y'
l n=elaeurs:
.s C
Safety Evaluatism j
ec w/enel
'+
- 3. Ranamer, ER I
~~
~
i R. DeYoung. DEL
% Boyd, DEL D. Skovbolt. DEL l
C. Iomg, DEL V. Moors, DRS D. Rees, DEL D. Sullives,-DRS Dis tr': -
~
DR RF DRS RF ESB RF 1450 263 I
i t
CRESS nMhg DRS:ESR I
omer > DRS 4, 11 D,,S,gl,1.@yan,,,
,ECqh'V summur >
e l
ocr> 5/13/71' ~
Sh71 5[g71 Fore AEC.Sta tRev.9-53) AECM 0240 a u s oevemat mmr a oreca 1 +r t wis-ea s v'
jg s
. ~.-
.a-s.".. _ a. -.i.....
2, i