ML20008D780
| ML20008D780 | |
| Person / Time | |
|---|---|
| Site: | Midland |
| Issue date: | 01/13/1969 |
| From: | CONSUMERS ENERGY CO. (FORMERLY CONSUMERS POWER CO.) |
| To: | |
| References | |
| NUDOCS 8007300681 | |
| Download: ML20008D780 (72) | |
Text
.
O I
7 =
O h
I l
O O('*'"'
g:(i S007300
-..-...~. -.
G, TABLE OF COITTENTS v
Section Page 7
INSTRU! CITATION AND CONTROL 7-1 71 REACTOR PROTECTION AND ENGINEERED SAFEGUARDS SYSTHE 7-1 7 1.1 DESIGN PASES 7-1 7 1.1.1 Vital Functions 7-1 7 1.1.2 Principles of Design 7-2 7 1.1 3 Functional Require =ents 7-3 7 1.1.h Environ:: ental Considerations 7-L 7 1.2 SYSTHI DESIGN 7-5 7.1.2.1 System Description - Reactor Protection System 7-5 T.1.2.2 Description - Engineered Safecuards Actuation Syste:
7-6
( n\\
7 1.2 3 Desien Features 7-9 L'!
7 1.2.h Su==ary of Protective Actions 7-lh 7 1.2 5 Relationship to Safety Limits 7-16 713 SYSTHG EVAWATION 7-16 7131 Functicnal Carability - Reactor Protection System 7-16 7132 Functional Capability - Engineered Safeguards Actuation System 7-17 7133 Freoperational Tests 7-17 T.1 3.L Cc=ponent Failure Considerations 7-18 7135 Operational Tests 7-19 7.1 3.6 Seraration of Control and Protection Systems 7-20 72 REGUIATING SYSTEG 7-20 7.2.1 DESIGN BASES 7-20 7 2.1.1 Compensation Considerations 7-20
(
v 00M3
TABLE OF CONTEITS (Contd)
G Section Page 7 2.1.2 Safety Considerations 7-21 7 2.1 3 Start-Up Considerations 7-22 7 2.2 SYSTH4 DESIGN 7-22 7 2.2.1 Descrirtion of Reactivity Control T-22 7.2.2.2 Intecrated Control Syste=
7-25 723 SYSTH4 EVAIDATION 7-28 7231 Syste= Failure Considerations 7-26 7232 Interlocking 7-29 7233 E=ergency Considerations 7-29 7234 Loss-of-Load Considerations 7-29 73 NUCLEAR UNIT INSTRUIEffATION 7-31 g}
('s/
731 NUCLEAR D?STRU?CTIATION 7-31 731.1 Design T-31 7 3 1.2 Evaluation 7-32 732 NONNUCLEAR PROCESS HISTRUE:TATION 7-33 732.1 Syste= Design 7-33 l
7 3 2.lA Failed Fuel Detection 7-3h 7 3 2.2 System Evs1.uation 7-34 l
733 IN-CORE MONIIOREIG SYSTEM T-3La l
7331 Desien Basis 7-3ha 7332 System Desien 7-35 7333 Detection and Control cf xenon Oscillations 7-36 7 3 3.L Syste Evaluation 7-37 7.4 TUREriE AND FROCESS CONTROL SYSTH43 7-35 7.h.1 DESIGN BASES 7-35
[N
()
7.
4.2 DESCRIPTION
AND OPERATION -
7-38 T-il Amendment No. 2 002.M 5/28/o9
l TABLE OF CONTECS (Contd)
Section Page 75 RADIATION MONITORING AND PROTECTION SYSTEM 7-39 751 DESIGN BASIS 7-39 752 DESCRIPTION AND OPERATION 7-40 752.1 Airborne Radiation Monitoring System 7-k0 7 5 2.2 Waterborne Radiation Monitoring System 7-kl 7523 Area Radiation Monitoring System 7 hl 753 SYSTEM EVALUATION 7 kl 7531 Reliability 7 kl 7532 Power Sources System 7-h2 7533 Redundancy 7-h2 7 5.k TESTING AND MAINTENANCE 7-h2 (o)
755 RADIATION PROTECTION (HEALTH PHYSICS) 7-h2 7.6 OPERATING CONTROL STATIONS 7 hh I
7.6.1 GEERAL IAYOUT '
7 hL 7.6.2 INFCEMATION DISPLAY AND CONTROL FUNCIION 7 kh 7.6 3
SUMMARY
OF ALARMS 7-h5 7.6.k COMMUNICATION 7 h5 7.6 5 OCCUPANCY 7-k5 7.6.6 AUXILIARY CONTROL STATIONS 7 h6 7.6.7 ENGIhrrttED SAFEGUARDS 7 h6 I
[
7.6.8 SYSTD1 EVALUATION 7 h7 I.
7 6.8.1 Information Available Post-Accident 7-kT 7.6.8.2 Control Room Availability.
7 h7 o o
\\
1 s.-
00m5 7-111
i i
e 1
i l,
LIST CF FIGI.rnES (At Rear of Section)
?
1
.Fieure No.
Title l
7-1 Reactor Protection Syste= Elock Diagra:
l 7-2A Nuclear Instru=entation and Protection Syste=s 4
7-23 Nuclear Instru=entatien and Protection Systems 7-2C Nuclear Instrumentation and Protection Syste=s
[
7-2D Nuclear Instru=entation and Protection Syste=s 7-3 Typical Control Circuits for Engineered Safeguards Equip =ent 7k Reactor Pcver Measurement Errcrs and Control Li=its 1
5 7-5 Reactor and Stea: Te=peratures Versus Reactor Power 7-6 Reactor Control Diagra - Integrated Control System 3
{f~
7-7 Auto =atic Control-Rod Groups - Typical Worth Curve Versus
- Distance Withdrawn -
g 4
7 Steam Generator and Turbine Control Diagra: Integrated Control Syste 7-9 Nuclear Instru=entation Flux Ranges
.7-10 Nuclear Instru=entation Detector Locatiens l
'7-11 Non-Nuclear Instru=entation Schematic i
}
7-12
,Incore Letector Locations 7-13 Typical Arrange =ent - Incore Instru=entatien Channel t.
I
+
l i
I e
e
.c l
OON 7-iv e
.. --_- - ~ ~... _.~._._...,_.,.. -...,- -,-.,~.,--...,.. _, -._.,-..-..,...... -..
,,,_.....-,r.,,..-.
=- -.
7 INSTRUMENTATION AND CONTROL I
71 REACTOR PROTECTION AND ENGINEERED SAFEGUARDS SYSTEG These protection syste=s, which consist of the reactor protection syste= and the engineered safeguards actaation system, perfor= the most i=portant con-trol and safety functions. The protection syste=s extend from the se:. sing instru=ents to the final actuating devices.
7 1.1 DESIGN BASES The reactor protection syste= monitors para =eters related to safe operation and trips the reactor to protect the reactor core against fuel rod cladding a n ge caused by departure from nucleate boiling (DNB), and to protect against reactor coolant syste= d m ge caused by high system pressure. The engineered safe-guards actuation system monitors parameters to detect failure of the reactor coolant system and initiates reactor building isolation and engineered safe-guards operation to contain radioactive fission products in the reactor building.
7.1.1.1 Vital Functions
-The reactor protection system automatically trips the reactor to protect the reactor core under these conditions:
When the reactor power, as =easured by neutron flux, exceeds a r
a.
j given li=it.
O b.
When the reactor power, as measured by neutron flux, exceeds the li=it set by the reactor coolant flow.
Loss of both reactor coolant pu=ps in one loop.
c.
d.
The reactor outlet te=perature reaches an established =aximu= limit.
.i
- e. -The reactor pressure reaches an established minimum limit.
The reactor protection system auto =atically trips the reactor to protect the 1
reactor coolant syste= under this condition:
- a. -The reactor pressure reaches an ectablished =aximum limit.
The engineered safeguards actuation system automatically performs the following vital functions:
l a.
Co== ands operation of injection emergency core coolant.
b.
Cc== ands operation of the reactor building e=ergency cooling syste=
and the reactor building spray syste=.
Co== ands closing of the reactor building isolation valves, c.
h)
The core flooding syste= is a passive system and does not require engineered
'w safeguards actuation syste= action.
7-1 gycy
7.1.1.1.1 Nonvital Functions The reactor protection syste= provides an anticipatory reactor trip when the reactor start-up rate reaches specified limits.
7 1.1.2 Principles of Desien The protection systems are designed to meet the require =ents of the I proposed " Standard for Nuclear Power Plant Protection Systems" (770 2 Ty,
Revision 10). Prototype and final equipment vill be subject to qualification tests as required by the subject standard. The tests will establish the ade-quacy of equipnent perfor=ance in both normal and accident environ =ents.
The major design criteria are sit m rized in the following paragraphs:
7 1.1.2.1 Single Failure No single co=ponent failure shall prevent the protection systems a.
from fulfilling their protective functions when action is required.
b.
No single component failure shall initiate unnecessary protection syste= action, provided i=plementation does not conflict with the criterion above.
7.1.1.2.2 Redundancy All protection syste functions shall be implemented by redundant sensors, instrument strings, logic, and action devices that combine to for the pro-tection channels.
7 1.1.2.'3 Independence Redundant protection channels and their associated elements are electrically independent and packaged to provide physical separation.
Separate detectors and instrument strings are not, in general, e= ployed for protection system functions and regulation er control. Sharing instrumenta-tion for protection and control functions'is acco=plished within the fra=evork of the separation criteria of the IEF.E Standard by the employ =ent' of isolation a=plifiers in each of the multiple outputs of the analog protection syste=
instru=ent strings.
The isolation a=plifiers are precision operational a=plifiers having a closed loop unity gain and a low dynamic output i=pedance. The effectiveness of the isolation amplifiers has been proven by actual test. These a=plifiers offer no significant i=pedance loss in the forward or analog output direction and are an open circuit in the reverse direction. Virtually any type of fault =ay be i= posed upon the output of an isolation a=plifier and not be reflected or detected at the a=plifier's input.
g
)
v Q Q M.$ Amendment No. 5 T-2 11/3/69
O) t
>4e.. ans. n s.
a..
I S,., 3... -.. _.
s...w
.e, c...,
e.
m.m.,
s,/
4....
.y..
.u.
y....,
s coupled with Otner Signals, cr directly coupled *c a pcVer Scurce (Such as 230 vaa), ***
.".*..b.."*.
a.". a. *. *..' *. g-
- ka
'".y"*.
c'
+.".a.
.iS..'a.i-..a-,..'.'.'.d..- i. -
a
..w, any Vay.
73g.73 4-.
gg 14.r.49e -..
g.
1-~
.a. n.
71 n. o.9 r, c o..
o.+..e O.c 4
n..
y.w;.
s
...r,._.,.
ow
.4wa y.
ws
.y
.a..
.u.
n e.' S E S S o " l a*. *..* Vi+..b.
- e * " c*. e * *..# *
- a',Vc'
- e~ s~.
".k..".
- . S ^.1.* *. 4 ^
- aC"y.' d #.4 a..".e **a.
p.
wa
..a rufS oa.71). a
.c
- w, t.
e
.w
...e a a.c. 4 S+.
....+
4.,,,
S-
.w... a+.. w. a. a.3 s~ a.a.. a.3.,
r y..
w.
s....
... w s..
.o e.c.c.
4yely
. 3 e,.o + e
- s. o..c 4
a c.
4..
um.
.v v.h a.- t. =. *..e c.' *. k..a.
e.v c-*. e.
. o -.....e w.
7"
+ hose casa..e
".h. a. e *,*c*.a. -*.4.^r.
a.". A.
^ ^. *.. - ^ '.ey.e + e S c h ar e a.a' s
.e ' s-...e.'.e
~..
.w.
v.
.w of a co=non crigin, the isolation amplifiers Serve to assure the failure independence of the protecticn SySten. Faults in the contrcl SyS e: can-
- r. a + k e. e '.' e **. e w i n.*i. o
+.h.a.
". o* e ^. +. 4 ^ ".wo =vS.a d
' e -i u..4 * - v.i* h
- .F..a.
-"4 r "u. c.'
C s
.~e w.
w f
v
+k.e 4.c,c.1g+. 4. C" aZ".'.# #i e.", * *.,V
- 8..' *" a. a" *.
4"
- b.a.
.e. 4 ~
- a'
- ya+o u u" *.o ar~d.....'".d..i".g*
b f
4es.
y
+k..e CC.*.*."o' S"Ste
"*V
- ee "*.~^veu o."
- a".' *. *. 4
- ".*..k.w^"a*.
&.#.# a *. *.*
- s~ *e u.ka ". " ^ -
d 4
. w u
y
- ection SyS*e.
- m. w..iS d *. S. g~.7 * *."". 4.S4Ca" -a,v
- v*. c a*.ed as =
^ww^."'.'.'c av *.^
- ..b.a.
4 4
d a. S e-".. * *.* *. a.. d a. -
f.
w w.
"a* Aire,.+. Sw +
wy.n n.4 u4+
g.an A
.ea.,7 +
.a.7 4,g.o e-pw=..
r S m.,.. e a.
a.
v a.
- c. 7eSS +han.),0..,1.S, c
- c. w.4A 4n3 c. a../
...3 c
pv-4..S a.. w n,
+
.~e v
..n..
+.
..v
.y
.~.
i - S C.
a "." C*. e *. * # ^ " S)* S +. a~" ar.al
- nn.7 0*
4 " S ** **""" A ~" *~ S *w *. ** " b b aV*8 ".-S'""'*=4*'*
o"*** -
- a a-a
-=
y 4u 6
-r--
S u a.1 1 n c+..e S. 7 + 4 k
y+S
-4.
a 24e 4r.4CE. d.4S. I.K
.waa e.4.k4
- -.e. w.aam wue
.a mv.
C.J..,,..ya..H "4 e3+.1 5 b.as d** *" S *. *. a'. e d *.h a'.
' h. e "y.*Ct e *.*. i"n
.e"c" +.a." u*.S43" "..# '.l " a. a. *. *
- a.
s d
4*
ou s
o-v f
)
above criteria, sv 4
f%
/
k
\\
%,/
/
.'TA I b h Amendment No. 5
,-ga
.'.' /1/60
O
,V 1
25 Deleted 7.1.1.2.h Loss of Power a.
A loss of power in a reactor protection system channel shall cause the affected channel to trip.
b.
Availability of power to the engineered safeguards actuation system shall be continuously indicated. The loss of instrument power, ie, preferred a-c power, to the instrument strings and trip element will initiate a trip in the affected channels.
Syste= actuation requires control power from one of the two d-c power buses so that loss cf this power does not actuate the system. The system equi; cent is divided between the redundant engineered safeguards channels in such a vay'that the loss of one of the d-c power buses does not inhibit the system's intended engineered safeguards functicns.
7.J.1.2 5 Manual Trip Fach prctection system shall have a tanual actuating switch or switches in the p
eentrol room which shall be independent of the automatic trip instrumentation.
)
Th<.- Lanual switch and circuitry shall be simple, direct-acting, and electrically ectueeted close to the final actuating device.
7.1.1.2.6 Equipment Removc1
~
Tle reactor protection system shall initiate a trip'of the channel involved vben modules, equipctent, or subasse=blies are removed. Engineered safeguards actuation system channels shall be designed to provide for servicing a single channel without affecting integrity of the other redundant channels or with-out_cc= promising the criterion that no single failure shall prrvent actuation.
7 1.1.2.7' Testing
) Manual l testing facilities shall be built-into the protection systems to provide-for:
Preoperational' testing to give assurance' that the protection a.
systems can fulfill their required functions.
(
b.
On-line testing to prove operability and to demonstrate reliability.
7.1.1 3 Functional Requirements l
)~
Tiki functional requirement!s of the protection systems are those - specified under vital functions together with interlockinc functions.
u,].
7-3 O(W50 Amendment No.' 25 2/74' 1
1 The functional require =ents of the reactor protection syste= are to trip the reactor under the folleving conditions:
a.
The reactor pcr.rer, as =easured by neutron flux, reaches an allevable limit set by the cu=ber of operating reactor ecolant p=ps.
b.
We reacter power, as =easured by neutren flux, reaches an allevable li=it set by the =easured reacter coolant flev.
c.
Both reactor coolant pu=ps in one loop are lost.
(This also covers loss of three pu=ps and loss of all pu=ps.)
- d. - The reactor outlet te=perature reaches a preset =axi=== 11=it.
e.
The reactor coolant pressure reaches a preset =axi== li=it.
f.
The reactor coolant pressure reaches a preset =ini== 11=it.
g.
The reactor start-up rate reaches a =axi== li=it while operating below a preset power level.
Interlocking functions of the reactor protection syste= are to:
a.
Bypass the start-up rate trip when the reactor power reaches a preset value.
- b. -Inhibit centrol rod withiraval on the occurrence cf a predete=ined start-up rate, slover tFin the rate at which reactor trip is initiated.
The functional require =ents of the engineered safeguards actuation syste= are to:
a.
Start operation of high-pressure injection upon detection of a icv reactor coolant syste= pressure or high reacter building pressure.
b.
Start operation of low-pressure injection up:n detection of a very low reacter coolant syste= pressure er high reactor building pressure.
Operate the reacter building isolation valves upon detection of a c.
high reactor building pressure, er high radiation level as detailed in 515 d.
Start the reactor building e=ergency cooling units upon detection of a high reacter building pressure.
Start the reactor building spray syste= upon detection of a high e.
reactor building pressure.
7.1.1.4 Enviren= ental Ccnsiderations The operating environ =ent for equip:ent within the reacter building vill nor-
= ally be controlled to less than approxi=ately 120 F.
We reacter prctection syste= instru=entation within the reactor building is designed fer centinuous l operation. in an environ =ent of lho F, 67 psig, and 100 percent relative hu-
=idity, but vill function with less accuracy at the accident te=perature.
.p T-h Amend =ent No.-lk 7/31/70 4
00v.Jx
h The engineered safeguards actuation system equip:ent inside the reactor build-ing is designed to operate under the accident environment of a stea=-air tirture.
Protective equipsent outside of the reactor building, control room, and cable room is designed for continuous operation in an ambient of 120 F and 90 percent relative humidity. The control roo= and cable room ambients vill be maintained 4
at the personnel co= fort level; however, protective equipment in the control room and cable room vill operate within design tolerance up to an ambient temperature of 110 F.
7 1.2 SYSTD4 DESIGN T.1.2.1 System Description - Reactor Protection Syste=
Figure T-1 is a block diagra= of the reactor protection system. The system con-sists of four identical protection channels, each terminating in a acninverting bistable and reactor trip relay.
In the normal untripped state, each channel functions as an AND gate, passing current to the te rinating bistable and hold-ing the reactor trip relay energized only if all channel inputs are in the nor-cal energized (untripped) state. Should any one or more inputs to a channel beco=e de-energized (tripped), the tenninating bistable in that channel trips, de-energizing the reactor trip relay. Thus, for trip signals each chanael becomes an OR gate.
Contacts from the reactor trip relays (RS) are arranged into four identical g
',).
2-out-of-b coincidence networks.
Each pair of these coincidence networks con-trols the power to one of the two identical control rod drive pcVer supplies.
The reactor trip circuits are shown in more detail on Figure T-2, which is an everall diagra= showing the nuclear instrumentation system (T-2A), reactor protection system (T-2B), and the engineered safeguards actuation syste= (7-2C and T-2D). Figure T-2B shows the circuit breakers controlling input power to each control rod drive assembly and the manner in which the reactor trip relays trip these circuit breakers.
Reactor trip is accomplished by interrupting all input power to each drive assembly. Each control rod drive power supply receives its input power through two circuit breakers in series so that opening of either interrupts that source of power. The two control rod drive power supplies operate in parallel so that both cust be de-energized for the control rods to trip. Circuit breakers No. 1 and No. 2 control primary power to one assembly power supply, and circuit breakers No. 3 and No. L control power to the other. Thus, reactor trip is accomplished by tripping one circuit breaker in each of these pairs.
The control rod drive power supply circuit breakers are equipped with under-voltage ec11s which cust be energized for the circuit breaker to be closed or to retain closed. The hciding voltage for the undervoltage coil of each cir-cuit breaker is-taken from the preferred a-c bus.
In each circuit breaker (No.1, 2, 3, and 4), thn undervoltage coils are ener-gized through contacts of their associated trip relays RS1, RS2, RS3, and RSh s
(v) under normal conditions with all trip relays energized.
If trip relays RSl and T-5 OEE
4 4
4
(
RS2, RSl and RS3, RS1 and RSh, RS2 and RS3, RS2 and RSh, or RS3 and RSh become de-energized, each circuit breaker undervoltage coil vill be de-energized, and the circuit breaker will open. Thus any 2-out-of L trip relays will cause each circuit breaker to open, removing power.
The trip circuits and devices are redundant and independent.
Each breaker is independent of each other breaker, so a single failure within one trip circuit does not affect any other trip circuit or prevent trip.
By this arrangement, each breaker =ay be tested independently by the manual test switch. One seg-
=ent of the manual reactor trip switch is included in each of th2 circuit breaker trip circuits to i=plement the " direct action in the final device" criterion.
The power /flov monitor logic details are also shown on Figure T-2B.
There are four identical sets of power / flow monitor logic, one associated with each pro-tection channel. Each set of logic receives an independent total reactor cool-ant flow signal (EF), a " number of pu=p motors in operation" signal (P ), and n
two isolated reactor power level signals (4).
The power / flow monitor continuously compares the ratio of the reactor neutron power to the reactor coolant flow.
Should the reactor power as measured by the linear power range channels exceed 1.07 times the total reactor coolant flow, a reactor trip is initiated. All reasurements are in ter=s of percent full flow or full. (rated) power. When the reactor is operating above a predeter-
=ined neutron power, X percent FP, a reactor trip is initiated icnediately upon the loss of a single pu=p.
Below this power level, a reactor trip is
-s s
'(( )
initiated when the reactor pcVer to reactor coolant flow ratio exceeds 1.07 Thus, below a predeter=ined reactor power, there is opportunity for the control syste= to reduce the reactor power to an acceptable level without a reactor trip.
The flux /pu=p comparator compares the reactor neutron power against the nu=ber of operating pumps. When the. reactor is operating above X percent FP, a re-i actor trip is initiated t= ediately upon loss of a single pu=p.
With the loss of one pump in each loop, the comparator initiates a reactor trip if the re-actor power is greater than 50 percent FP.
The comparator also trips the reactor L:=ediately upon detection of the loss of two pu=ps in a single loop.
1 The reactor protection syste= can also trip the reactor by de-energizing two control circuit contactors which supply SCR gate power for the control rod drives. This trip action is through a 2-out-of-h logic as shown on Figures 3-57 and T-2.
s.
T.1.2.2 Description - Engineered Safeguards Actuation Syster T.1.2.2.1 Ecergency Core Cooling Syste:
Figure T-2C shows the action initiating sensors, trip elements, and logic for the engineered safeguards actuation syste= for emergency core cooling. The
=ajor features of this system are:
a.
Each protective action is initiated by either of two channels with 2-out-of-h coincidence logic between input signals.
b.
Either of the two channels is independently capable of initiating the desired protective: action through redundant engineered safe-guards equipment.
74 00'M
~
f Protective action is initiated by the application of power to the c.
ter=inating centrol relays through the coinciderce logic.
There are four independent senscrs for each input variable. Each senser ter=i-nates in a trip ele =ent device. The outputs of the four trip ele =ents associ-ated with each variable are fer:ed into two identical and independent 2-out-of-k coincident logie netwcrks or channels. Engineered safeguards action is initiated when either of the channels associated with a variable bew;=es ener-giced through the coincident trip action of the associated trip ele =ents.
The engineered safeguards equipment is divided between redundant actuatien chan-nels as shown in Figure T-2C.
The divisien of equip =ent between channels is based upon the redundancy of equip =ent and functions. Where tvc active engi-neered safeguards valves are connected in a redundant =anner, each valve vill be controlled by a separate engineered safeguards channel as shown in Figure 7-2C.
- ' hen active and passive (check valve) engineered safeguards valves are a
used redundantly, the active valve vill be equipped with two OR centrcl ele-
=ents, each driven by one of the engineered safeguards channels. Redundant engineered safeguards pu=ps will be centrolled in the same =anner as redun-ant active valves. Figure 7-2C shcws a typical control sche =e for both engineered safeguards valves and pu=ps.
Figure T-3 shows typical control circuits for equip =ent serving engineeved safe-guards functions. Each circuit provides for norrsl start-stop control by the plant operator as well as autc=atic actuation. Nor=al starting and sto; ping are initiated by =o=entary contact push buttons or control switches.
\\
The control circuit shown for a =akeup pu=p is typical of the controller of a large pu=p started by switchgear. There are three makeup pu=ps, two are equip-ped with single control relays povered frc= separata engineered safeguards actua-tion channels. The third punp is equipped with two control relays, CR1 and CR2, each of which is powered from separate engineered safeguards actuation channels.
Energizing the centrol relays through their associated engineered safeguards actuation channel energines the pu=p circuit breaker closing coil.
The centrol of the decay heat re= oval pu=ps is by =eans of single control relays in each pu=p control circuit. Each pu=p is controlled by separate engineered safeguards channels. Engineered safeguards action is initiated when the pu=p control relay is energized by its associated engineered safeguards channel.
The contrcl circuit for an engineered safeguards valve is typical cf a =ctor-operated valve which is required to operate as its engineered safeguards action.
If the valve is e= ployed as one of two active redundant valves, then it is cen-trolled by a single engineered safeguards actuation channel to CRl. If the valve is e=plcyed with a passive redundant check valve, then the =cter-crerated
- valve is centrolled by tvc engineered safeguards actuatien channels with CR1 o
and CR2 connected in an OR configuration.
- The centrol relays, when energined by their associated engineered safeguards a:tuation channels, operate the valve through contacts which duplicate the =an-ual CLOSE or OPEN push button and at the same ti=e override any existing signal calling for the valve to' operate. After the syste= has been auta=atically ac-tivated, a block function can be used for manual override to centrol varicus
.[
engineere:1 safeguards equip =ent.
x_ l 4
m 7-7 002M
J.ir-operated valves are auto =atically positioned to their engineered safeguards position upon loss of centrol air. Valves used with active redundant valves are d
equipped with a single electrical actuator for centrol by a single engineered safeguards channel as shown in Figure 7-2C.
Scienoid valves used with redundant passive valves are provided with two electrical actuating signals, each cen-trolled by a single engineered safeguards channel operating in an CR configura-tion. Engineered safeguards action is initiated when power is applied to the electrical actuater.
1.1.2.2.2 Reactor Building Cooling, Isolation and Berated Water Storage Tank L:v Level Figure 7-2D shows the initiating sensers and logic for the reactor building cooling and isolation syste:. The control system is designed to initiate auto-
=atically the necessary equip =ent upon the appropriate engineered safeguards signal. To assure reliability, the control system is designed en a two-channel concept with redundancy and physical separation, each channel initiating reacter building isolation and the operation of separate and redundant equi; cent trains.
The syste= is also designed to prevent reopening of the reacter building isola-tien valves unless the reactor building pressure and/or radiation is belev a preset level.
Each critical variable has four sensors utilizing t 2-out-of-L logic to provide reliable operation with a minimum cf nuisance tripping. The fcur sensors are physically isolated and operation of any 2-out-of-b vill initiate the appro-priate safeguards action. This action is provided by combining the four sensors into a relay matrix which provides a dual channel initiation signal.
(Q Ccincident 2-out-of-h high reactor building pressure signals will:
(1) close
/
all reactor building isolation valves not required for emergency safeguards service; (2) start reactor building spray pumps; (3),open reactor building spray valves; (h) initiate operation of reactor building e=ergency cooling and recirculation units.
In like =anner, coincident 2-cut-of L reactor building high radiation signals close all reactor building penetrations open to the reactor building at=cs-phere (Ty'e II).
At least three cut of the four radiation sensors must sense nor=al radiation level and three out of the four pressure sensors cust sense no:::al pressure before the operator can reset the pressure isolation circuits and the radia-tion isolation circuits. Reactor building isolation valves vill remain in g their safety positions after reset of these circuits. However, the operator may open reactor building isolation valves after the circuits have been reset, but only by deliberate operation of the valve control switches.
Coincident 2-out-of-4 lov level sensors in the borated water storage tank will automatically initiate the necessary valve ocerations to cermit shift to the recirculation cede of operation for the low-pressure injection and reactor building spray pu=ps.
A k
')
T-8 Amendment No. 29 4/75 00255
. - _ - _ _ - - - -. =
. ~ - -.
~
l O
7.1.2.2.3 Main Steam lation System Automatic caosure of the main steam and main feedwater isolation valves will be provided by the ! bin Steam Isolation System to protect against the effects of a main steam line rupture. Details of this system will be included in the FSAR.
25 7.1.2.2.4 Auxiliary Feedwater System Automatic starting of the Auxiliary Feedwater System will be provided to protect against the effedts of a main steam line rupture and loss of main feedwater. Details of the automatic starting feature will be provided in the FSAR.
e
'l I
t 1
- e 7-Ba Amendment No. 25 (1072(;
2/74
,,.,.-,.,,,.,,,,-,-n.,_-
n.-_--,.,,
n.n.,.
7 1.2 3 Design Features 7 1.2 3 1 Redundancy The reactor protection syste= is redundant for all vital inputs and fune-tions. Redundancy beings with the sensor. Each power range input variable is =easured by four independent and identical instru=ent strings. Only one of the four is associated with any one protection channel. The total and co=plete re= oval of one protection channel and its associated vital instru-
=ent strings would not Onpair the function of any other instrument or pro-tection channel.
There are two source range channels and two intennediate range channels, each with its evn independent sensor.
The engineered safeguards actuation syste= is also redundant for all vital inputs and functions. Each input variable is =easured by four independent and identical instru=ent strings. The total re= oval of any one instru=ent string vill not prevent the syste= fro: perforcing its intended functions.
7 1.2 3 2 Independence The redundancy, as described above, is extended to provide independence in the reactor protection syste=. Each instru=ent string feeding into one pro-tection channel is operationally and electrically independent of every other w
instru=ent string. Each protection channel is likewise functionally and i
electrically independent of every other channel.
Only in the coincidence output are the channels brought into any kind of co==on relationship.
Independence is preserved in the coincidence circuits through insulation resistance and physical separation of the coincidence networks and their switching elements.
The engineered safeguards actuation syste= instru=entation and control have electrically and physically independent instru=ent strings. The output of each trip element is electrically independent of every other trip element.
Independence is preserved in the coincidence networks through insulation resistance and physical separation of the switching ele =ents.
7 1.2 3 3 Loss of Power The reactor protection syste= initiates trip action upcn loss of power.
All bistables operate in a nor= ally energized state and go to a de-energized state to initiate action. Less of power thus aute=atically ferees the bistables into the tripped state. Figure 7-23 shows the syste= in a de-energized state.
i 7-9
[
i a
i 1
The engineered safeguards actuation system instrumentatien strings ter=inate in trip ele =ents functionally similar to those in the reactor protection systen.
loss of instrument power up to and including the trip elements forces the ele-ments into the tripped state initiating engineered safeguards action. The logic networks and the equip =ent control ele =ents are powered from the d-c power buses.
t Electrical engineered safeguards equipment is povered frem the engineered safe-i guards a-c power buses. Loss of engineered safeguards power to the icgic networks
]
or to the engineered safeguards equipment does not initiate engineered safeguards I
action as described in 71.1.2.4.
)
]
7.1.2 3.h Manual Syste Trip 1
"he manual actuating devices in the protection systems are independent of the i
automatic tm p circuitry and are not subject to failures that take the auto-eatic circuitry inoperable. The manual trip devices are independent control j
switches for each power controller. The independent control switches are l
actuated through a co==on manual trip switch or push button.
j 7.1.2 3 5 Equipment Re= oval 4
The removal of modules or subassemblies frc: vital sections of the reactor 4
protection system vill initiate the trip no= ally associated with that portion of the system.
The removal criterion is implemented in two ways:
(1) advan-j tage is taken of the inherent characteristics of a normally energized system, and (2) intselocks are provided.
An inherent characteristic is illustrated by considering the power supply for one of the reactor protection channels. Removal of this power supply auto-t I.
catically results in trip action by virtue of the resulting loss of power.
No interlock is required in such cases. Other instances req" ire a system of interlocks built into the equi gent to insure trip action upon removal of a j
portion of the equi pent.
t f
The engineered safeguards actuation system provides for servicing wither.t 4
affecting the integrity of the redundant channels.
7 1.2 3.6 Testing-The protection systems =eet the testing criterion and its objectives. The test circuits take advantage of the systems' redundance, independence, and coinci-dence features which make it possible to initiate trip signals manually in any part of one protection channel without affecting the other channels.
This test feature allows the operator to interrogate the syste=s from the input of any trip element up to the final actuating device at any ti=e during reactor operation without disconnecting permanently installed equiment.
4 The test of a trip element consists of inserting an analog input and varying the input *'til the trip point is reached. The value of the inserted 4
s s
coms 7-10 m.---
..-,_- ~,,_._--- -.-~.m
test signal represents the true value of the trip point. Thus, the test verifies not only that the trip ele =ent functions but that the trip point is correctly set.
Prestart-up testing follows the sa=e procedure as the on-line testing except that calibration of the analog instrument strings =ay be checked with less restraint than during reactor operation.
As shown in Figure 7-23, the power breakers in the reactor trip circuit tay also be manually tested during operation. The only lititation is that not
= ore than one power supply =ay be interrupted at a ti=e without causing a reactor trip.
71.237 Physical Isolation The physical arrangement of all ele =ents associated with the protection syste=s reduces the probability of a single physical event i= pairing the vital fune-tions of the syste=. For example, pressure measure =ents of reactor coolant pressure are divided between four redundant pressure taps so as to reduce the probability of collective aamage to all sensors by a single accident.
Syste= equip =ent is physically separated to reduce the probability of datage to the total syste= by some single event.
Wiring between vital elements of the syste= outside of equip =ent housing is routed and protected within the unit so as to =aintain redundancy of the
( (V; syste=s with respect to physical hazards.
7 1.2 3 8 Pri=ary Power source The pri=ary source of control power for the reactor protection syste= is the preferred a-c buses described in 8.2.2.6.
The source of power for the ceasur-ing ele =ents in the engineered safeguards actuation syste= is also frc= the preferred a-c buses.
Cc==and circuits frc= the engineered safeguards actua-tion syste= coincidence logic that extend to engineered safeguards equip =ent controllers are powered fro = the d-c buses. Engineered safeguards equip =ent such as pump and me.or operators and their starting contactors are powered fro = the engineered safeguards a-c buses or the d-c buses.
71.239 Reliability Design criteria for the reactor protection syste= and the engineered safe-guards actuation syste= have been for ulated to produce reliable syste=s.
Syste= design practices, such as redundant equiptent, redundant channels, and coincidence arrangements per=itting in-service testing, have been e=plcyed to implement reliability of protective action. The best grades of co=:ercially available components are used in fabrication. A cyste= fault analysis will be made considering the modes of failure and. deter =ining their effect on the sys-te= vital functions. Acceptance testing and periodic testing vf be designed to insure the quality and reliability of the completed syste=s.
[ A M
J
%J 0059 7-11
l i
4 I
Electrical Co=ponents Electrical c =;cnents within the reactor building required for proper fune-i tioning of the engineered safeguards actuation equi; cent are as follows:
a.
Reactor coolant pressure trans=itters, b.
Reactor building radiation monitors.
I Instrument cables for pressure and radiation instru=ents.
c.
Cc=nonent Operation f
The reactor coolant pressure transmitters need to operate long enough to ini-l tiate action of high-pressure coolant injection at 1,500 psig and low-pressure coolant injection at 200 psig. Cables associated with each of the above j
equi ment need to operate as long as the equi ment is required. All of this equi; cent will be designed to perfom its required function during the reactor building design basis accident.
Testing Protection syste: equi; cent specifications require type testing in accordance with the previously referred to e Standard (7.1.1.2) and assurance that the quality of the delivered product meets the standards and performance require-
=ents specified.
l The equircent manufacturer is required to provide qualification test data to i
verify the perfon::ance require =ents of the equ1Icent. Adherence to the equip-l
=ent specifications and qualification test data is assured through monitoring and inspection of the manufacturer's work.
Instrumentation and control ite=s that =ust survive part or all of the IDCA environ =ent are subject to these qualification test verification procedures and requirements.
71.2310 Reactor Protection syste= channel Pypass a
The low reactor coolant pressure trip functions vill be bypassed for reactor start-up and cooldown. This includes the low-pressure reactor coolant trip l of 2,050 psig in the reactor protection syste=, the 1,500 psis high-pressure injection trip and the 200 psig low-pressure injection trip.
Each of the pressure trip bypass functions is identical in its i=ple=entatien i
and differs only at operating point.
In the low-pressure state at start-up, the operator =anually initistes each of 4
the low-pressure trip bypasses separately. Actuation of one cf three =oten-tary switches bypasses the low-pressure reactor trip until the reactor pres-sure reaches 2,100 psig at which time the bypass is automatically re=cved.
Likewise, the low-pressure injection trip becomes active autc=atically at 600 l psig and the high-pressure injection at 1,600 psig.
During cooldown and depressurization, the low-pressure bypasses =ay 've unau-
- ally initiated only within the dead band of the bypass ecui; cent. For the low-pressure reactor trip, the operator can initiate' the bypass only between I
^=end='"ljDd 002.60 7-12
i 1
1 2,100 psig and the 2,050 psig trip point. For high-pressure injection, ini-l tiation of the bypass can occur only between 1,600 psig and 1,500 psig, and for low-pressure injection between LOO psig and 200 psig.
Once a low-pressure trip occurs, the bypass cannot be activated without first l
=anually resetting the low-pressure trip ele =ent.
Each lov-pressure trip ele =ent has an independent bypass circuit associated i
with it; therefore, all ele =ents of the bypass function are a part of the protection syste= and are designed to =eet the IEEE Standard (71.1.2).
l The power / flow and flux /pu=p co=parators are basically " variable" trip bi-stables as described in 7 1.2.1.
The protection syste= bistables may be considered voltage co=parat]rs in which the =easured variable signal voltage is co= pared against a trip po).nt voltage originating within the bistable. When the =easured variable signai equals or exceeds the trip point voltage, the bistable trips. Because of th6 ce=parator action, the bistable trip point can be controlled fran an external' source such as the output of the pu=p contact =cnitor logic.
Icss of the trip point con-trol voltage results in a trip.
i The variable trip bistables =eet the requirements of the IEEE Standard (7.1.1.2) by being part of the redundant and independent logic and =eeting the single failure criteria.
1 l
/
T.1.2 3 11.
Instrumentation for n=ergency core cooling Initiation a
The instrumentation syste =akes use of both physical and electrical isolation.
Hi h-pressure and low-pressure injection is activated by both low reactor cool-6 ant and reactor building pressure signals originating from four pressure trans-
=itters =easuring the reactor coolant syste= pressure, as shown in Figure 7-11, and.four pressure trans=itters =easuring the reactor building pressure.
Two react'r coolant pressure trans=itters are connected to each reactor out-o let pipe. Each transmitter has a separate tap on the reactor coolant piping inside the secondary shield. The trans=itters are physically separated fro =
each other and located outside the secondary shield inside the reactor build-
]
ing. The trans=1tters' electrical outputs leave the reactor building through separate penetrations.
The four reactor building pressure transmitters are connected to the reactor building through independent taps. The trans=itters are physically separated from each other and are located outside the reactor building. The output of each trans=itter provides isolated signals to its associated trip ele =ents.
The trip. elements of a given logic function are physically separated by cab-inet barriers.
Each pressure transmitter and its associated trip ele =ents are powered from separate preferred a-c bus power sources, the same power sources which power the reactor protection channels. Two isolated 125 volt d-c control power sources are used for the power to.the engineered safeguards channels and logic, as shown in Figure 7-2.
Each major _ function is, therefore, activated fro = two independent sources of etatrol power.
Os (j @ N Amendment No. 5 7-13 11/3/69
)
4 (V
The operation of the engineered safeguards channels and the trip relays fo=-
ing the system logic is described in 7.1.2.2.
The high order of syste= redundancy assures cecpliance with the single failure criteria of 7 1.1.2.1.
7 1.2.4 Su::" wry of protective Actions The abnorcal conditions that initiate a reactor trip are as follows:
Steady-State Trip Value or i
Trip Variable No. of Sensors Nomal Range Condition for Trip l
Neutron Flux 4
0-100%
107 5% of full (rated) power.
NeutronFlux/ Reactor h Flux 2 to k Pu=ps (1) Loss of one oper-f Coolant Flov 16 Reactor Coolant ating coolant pu=p Pu=p Monitors motor and reactor neu-2 Flow Tubes tron power exceeds pre-detemined level.
(2) Loss of one oper-ating reactor coolant p p motor in each loop q
and reactor neutron
(
power exceeds 50% FP.
(3) Loss of two oper-ating reactor coolant pumps in one loop.
i (h) Ratio of reactor neutron power to total reactor coolant flow
]
exceeds 1.07 j
Start-Up Rate 2
0-2 Decades / 5 Decades / Min i
Min i
l Reactor Coolant h
2,120-2,250 2,350 Ps'ig 4
Pressure Psig 2,050 Psig Reactor Outlet 4
520-603 F 610 F Te=perature The reactor trip functions of the power /flov =onitor logic are su=narized as follows:
i I
i 00262 g
(
Trip Variable No. of Sensors Neutron Flux = 4 12; L Flux Channels Reactor Coolant Flov = IF 2 Flev Tubes; 8 LP; L IF No. of Operating Pu=ps = P 16; h Pu=p Monitors Reacter Trio (a) Loss of One Pump and & > X%
d (b) Loss of One Pu=p in Each Loop and 4 > 50%
4 i
(c) Loss of'Two Pumps in One Loop (d) ($ > 1.07 IF) 1 Predetermined neutron power level to be specified during detail design.
Actions initiated by the engineered safeguards actuation system are as follows:
Steady-State I~ h Action Trip Condition Normal Value Trip Point b
High-Pressure Low Reactor 2,120 - 2,250 psig 1.500 psis Injection Coolant Pressure or High Beactor Atmospheric Building Pres-sure l
Low-Pressure Very Low Reactor 2,120 - 2,250 psig 200 psig Injection Pressure or High Reactor Atmospheric Building Pres-
. sure Start Reactor High Reactor Atmospheric Building Emer-Building Pres-
-gency Cooling sure Unit and Reactor Building Iso-lation Reactor Building High Reactor Atmospheric Spray Building Pres-sure h
\\,,)
Reactor Building High Reactor
Background
Isolation Building Ra-(Type II) diation 7-15
()()['53[$
knendment No. 5 11/3/69 e
~t 4
,ig.
g,-
- --~
+w qg..
m v9.
-4,-g-
,wew-9y' y
y-9 e g
7.1.2 5 Relationship to Safety Limits e
Trip set points tabulated in 71.2.h are consistent with the safety limits that have been established from the analyses described in Section ik.
The set point for each input, which must initiate a trip of the reactor protection syste=,
has been established at a level that vill insure that control rods are inserted in sufficient time to protect the reactor core. Likewise, the set points for para =eters initiating a trip of the engineered safeguards actuation syste= are established at levels that vill insure that corrective action is in progress in sufficient ti=e to prevent an unsafe condition. Factors such as the rate at which the sensed variable can change, instru=entation and calibration inaccu-racies, trip element trip ti=es, circuit breaker trip times, control rod travel times, valve action ti=es, and pu=p starting ti=es have been con-sidered in establishing the margin between the trip set points and the safety limits that have been derived.
The flux trip set point of 107 5 percent is based upon the tolerances and error bands chown in Figure 7-h.
The incident flux error is the su= of the errors at the output of the measuring channel resulting frc= rod =otien, and instru=ent drift during the interval between heat balance checks of nuclear instru=enta-tion calibration.
713 SYST&S EVALUATION 7131 Functional Capability - Reactor Protection System The reactor protection syste has been designed to limit the reactor power to a level within the design capability of the reactor core. In all accident evaluations, the time response of the sensors and the protective channels is considered. Maximu= trip times of the protection channels are listed below:
a.
Te=perature - 5 s b.
Pressure - 0 5 s c.
Flux - 0 3 s d.
Pu=p Monitor - 0 3 s Since all uncertainties are considered as cu=ulative in deriving these ti=es, the actual ti=es may be only one-half as long in =ost cases. Even these maxi-
=ut times, when added to control rod drop times, provide conservative protec-tive action.
The reactor protection systezt vill limit the pcVer that might result from an unexpected reactivity change. Any change of this nature vill be detected and arrested by high reactor coolant te=perature, high reactor coolant pressure, or high neutron flux protective action.
An uncontrolled rod withdrawal from start-up will be detected by the abno: ally fast start-up rate in the inter ediate channels and high neutron flux in the g'
power range channels. 'A start-up rate trip from the intermediate range channels is incorporated in the reactor protection system.
e 00 V 7-16
n--- ~.
a s a n-w=s
---,e.
a..
s.
-.a u--s.,
a_
- ~.
.u
=...
l i
i 1
i d
)
A red withdrawal accident at pcVer vill i==ediately result in a high neutron flux trip.
Reduced reacter ecclant flev results in a reduced allevatie reacter pcver. Se reacter coolant pu=p =enitor operates to set the appropriate reaeter ;cv- * *-"
i by adjusting the pcVer level trip point. A total less cf flev results in a j
direct reacter trip, independent of reacter pcver level.
Two =ajor =sasure=ents feed the pcVer/flev =eniter:
(a) reacter ecolant flov, 4
and (b) neutren pcser level. The flev tubes which provide the reaeter ecolant j
flev =easure=ent win exhibit no change during the reactor life. A periodic calibratica of the flev trans=itters vill be =ade.
The neutren pcVer level sig-nal vill be recalibrated by ec=parisen with a reutine heat balance. The power range channels use detectors arranged to effectively average the =easure=ent 1
I cver the length of the core as described in 7 31.1.2.
Therefore, their cutput is expected to be within k percent Of the calibrated value during nor=al regu-
[
1 lating red group position changes, and the need fer additional calibration is thereby eli=inated.
A less of reacter coclant vill result in a reduction cf reacter ecolant pres-sure. The icv-pressure trip serves to trip the reacter for such an cecurrence.
A significant turbine-side stea: line rupture is reflected in a drop of reacter ecolant pressure. The lev reacter pressure trip shuts devn the unit for such an cecurrence.
I
"'/*
7132 Functional Carability - Engineered Saferuards I
Actuation Syste:
i The engineered safeguards actuatien syste= is a graded protection syste=. The progressive actions of the injection equi;=ent as initiated by the engineerad safeguards syste provide sufficient reacter ecolant under all conditions while 4
=ini=1:ing the possibility of setting the entire syste= in operatien inadvertently.
t The key variable associated with the less of reacter ecclant is reacter pres-In a less-of-reacter-ecolant accident, the reacter pressure vill fall, sure.
ldoesnotarrestthepressuredrep,thenlev-pressureinjectionstartsupona starting high-pressure injectic: at 1,500 psig.
If high-pressure injection signal of 200 psig. High reacter building pressure is used to provide diversi-ficatien in actuation of both high-pressure injection and lev-pressure injee-tion.
The key variable in the detection cf an accident that could endanger reactor building integrity is reactor building pressure. A high reacter building pres-sure initiates cperation of the reacter building e=ergency eccling u.its, ise-latica of the building and operation of the reacter building sprays.
l T.1 3 3 Precreratienal Tests a
l Valid testing cf anales sensing ele =ents asacciated with the prctection syste=s vill be acec=plished through the actual =anipulation of the =easured variable and ec=; arisen of the results against a standard.
A=end=ent Nc. 5 11/3/69 i
1
,.. _., -....,.... _ -., _...,. _ _,. _. _,..,..,,.,,,,. _,,... _,.. _ - _ _.... -,, -, _,, _... ~.. -... _, - _. _, _,,
bd Ecutine preoperational tests will be perferred by the substitutien cf a cali-brating sig.al for the senser. Simulated neutron signals =ay be substituted in each of the source, inte =ediate, and pcVer range channels to check the operation of each channel. Si=ulated pressure, temperature, and level signals may be used in a similar fashicn. This type of testing is valid fer all ele-cents of the syste= except the sensors. The sensors vill be calibrated during shutdov.s for refueling, or whenever the true status of any measured variable cannot be assessed because of lack of agreement aceng the redundant reasurerents.
The final defense against sensor failu-e during operation vill be the u.it operator. The redundancy of measurements provides core than adequate oppor-tunity for ec=parative readings.
In addition, the redundancy cf the systems reduces the consequences of a single sensor failure.
7 1 3.h Component Failure Considerations The effects of failure can be understood through Figure 7-23.
In the reacter protection system, the failure of any single input in the " tripped" direction places the syste: in a 1-out-of-3 code of operatien for all variables. Failure of any single input in the "cannot trip" direction places the syste in a 2-out-of-3 mode of operation for the variable involved, but leaves all ether variables in the no mal 2-out-of-b coincidence mode. With a " tripped," cpen circuit fault in one channel, the syste: vould be able to tolerate a minimum of two "cannet trip," short circuit failures within the same seasured variable before ec=plete safety protection of the variable was lost. With one " tripped,"
m open circuit fault, a second identical fault within the same variable would trip the reacter.
A similar fault relationship exists between channels as a result of the 2-cut-of L coincidence output. One " trip" faulted channel places the systec in a 1-cut-of-3 cr single channel code. A "carnot trip" faulted channel places the syste= in a 2-out-of-3 mode.
At the final device, a " trip" faulted power breaker does not affect the pro-tection channel mode of operation, reactor trip being dependent upon one of two breakers in the unaffected primary power supply to the control rod drives.
A breaker faulted in the "cannot trip" mode leaves the syste: dependent upcn the second breaker in the affected pri=ary power supply.
The engineered safeguards actuation syste (Figures T-2C and T-2r) Icgie ahead of the 2-channel string is a 2-out-of L input type of systen. A failure in the " tripped" cr "cannot trip" direction results in the same cperatien as described above fer the reacter protection syster.
Primary power input to both protection systers has been arranged to minimize the possibility of 1 css of power to either protecticn system. Each channel of the protection syste= will be supplied from one of the four preferred a-c buses described in S.2.2.8.
The operater can initiate a reacter trip independent of the automatic protection action.
The engineered safeguards equipment is connectee to multiple buses to ~4 4-4 e
total less of engineered safeguards capability. The individual parts of the l'_)
engineered safeguards actuation system can be placed in service through can-V ual operation.
T-18 003J
7135 operational Tests The protection syste=s are designed and have the facilities fer routine =anual operational testing.
Most inputs to the protection syste=s criginate frc= an analog =eas"*a-a"+
cf a p rticular variable. Eve:ry input of this type is equipped with a continuous readout device. A routine check by the operater cf each reading as ca pared to the ether redundant readings available fer each variable vill uncover =ea-surement faults. These ele =ents plus the bistable and relay trip ele =ents of the protection syste=s require a periodic dynamic test.
Each syste: pro-vides for routine testing. Each trip ele =ent may be manually tripped, and the results of that trip traced through the syste: Icgic and visually in-dicated to the operater. The trip point setting of each trip ele =ent =ay be verified by the application of an analog signal propertienal to the =easured variable, and that signal may be varied until the ele =ent trips.
The cperational on-line test sche =es for the reacter protection syste= and the engineered safeguards actuation syste= are si=ilar in concept. Every trip function which originates fro = an analog signal, flux, pressure, te=perature, etc, is tested by substituting an analog test signal for the variable. The test signal is =anually injected into the instrument channel at the input of the first active channel ele =ent in the protection syste cabinets. For the nuclear instruments, the test signal is injected in the neutron detector input while test signals for pressure and te=perature are injected at the linear in-put of their associated trip ele =ents.
Test signals for the pu=p monitor are injected at the input frc= the pump power =cnitors.
Testing an analog channel consists cf varying the ; est signal over the dynamic range of the channel and observing that the channel responds properly and that the associated trip ele =ent not only trips, but trips at the correct set peint.
The on-line test is designed to detect sat point and cero drift er a change in
'he channel response. Calibratien and corrective adjustments =ay be made caring the on-line test.
Since the on-line test actually results in the instru=ent channel tripping its associated protection channel and since it is prohibited to place more than one channel on test at a time, the coincident logic networks where the protec-tion. channels lose their identity are tested by parts. Each legic ele =ent is tripped, observed, and reset. The test scheme depends upon the coincidence action of the logic to prevent a co=plete protection syste= trip during test-ing.
The test sche =e includes ar. interlock within each protection channel. The purpose of this interlock is to trip the protection channel befcre any as-sociated instrument can be tested. Thus, any atte=pt to test elements of two prctection channels at the sa e time vill result in a protection syste=
trip.
Part of the test scheme includes previding readouts of the redundant analog inputs to the protection channels. These readouts will per=it the operator to ec= pare the perfor=ance of like instruments and observe their response to changes in the unit.
7-19
(){}2W
L Each engineered safeguards valve, pump, etc, vill be on-line tested by manually activating the associated engineered safeguards control line and observing that the individual equip::ent responds. Each ite= will be activated only long enough to verify that it perfo:=s its safety function when co==anded to do so and vill be it=ediately restored to its normal state.
713.o separation of Control and protection syste=s The reactor control system receives inputs frc= channels which feed the reactor protection system in the following areas:
a.
Reactor coolant pressure.
b.
Reactor coolant flow.
c.
Reactor coolant pump monitors.
d.
Reactor power level.
The reactor coolant pressure and reactor coolant flow measure =ents have four protection syste=s of which only one channel is connected to control at any given time. If failure in the control syste vere to somehow reflect back into the connected single channel of protection, the three re=aining channels vould meet the single failure criteria. To insure that failures in control do not car', over into the single protection.:hannel, the output to the control syste:
fron the shared sensor and a=plifier is isolated by means of an isolation a=plifier.
The pump monitor circuits use separate contacts for protection and control input signals essentially creating four channels for protection and one channel for Control.
i U
The circuitry for the measurement of power level for reactor control uses an averaging circuit which co= bines the inputs from all four reactor power level
=easurements. To insure that failures in the control syste= cannot produce a failure in the protection system, each signal which goes to control from shared sensors.and a=plifiers is isolated by means of isolation a=plifiers. The result-ing systems meet the requirements for separation of protection and control and
-for single failure specified in IEEE 279, Rev 10, and the AIF interpretation of the AEC General Design Criteria 20, 21, and 22.
72 REGUIATING SYSTDiS 7.2.1 DESIGN BASES 7 2.1.1 Compensation Considerations Reactor regulation is based on the use of movable control rod asse=blies and chemical neutron absorber (boric acid) disselved in the reactor coolant.
Relatively fast reactivity effects including Doppler, xenon, and moderator te=perature are controlled by the control rods, which are capable of rapid i
compensation. Relatively slow reactivity effects, such as fuel burnup, fis-l
'sion product buildup, sa=ariu= buildup, and hot-to-cold =oderator deficit, j
are controlled by soluble boren.
Control rod, rod, and control rod assembly (CRA) are used interchangeably in this section and elsewhere in this report.
7-20
()Qy m.
.,--e.
,m---.,
.,.-w.,
.,y,.-.,#-p
.me, v,,,,..,
v ai -
e--,,w---.
r,ww...
/' N
(
Control rods are used throughout approxitately 90 percent of core life for l
N/
xenon transients associated with normal power changes. Chetical shit is used in conjunction with control rods to compensate for equilibriu: xenon condi-tions.
The reactor controls are designed to maintain a constant average reactor coolant te=perature over the load range frc= 15 to 100 percent of rated Iover. The steam system operates on constant pressure at all loads. The average reactor coolant temperature decreases over the range fro = 15 percent load to zero load.
Figure 7-5 shows the reactor coolant and stea: te=peratures over the entire load range.
Input signals to the reactor controls include reactor coolant average te=pera-ture, unit load demand, and reactor power as indicated by out-of-core neutron detectors. Soluble boron dilution is initiated mannually and ter=inated auto-
=atically or manually. Manual rod control is used below 15 percent of rated power. Automatic or manual rod control may be used above 15 percent of rated power.
Increasing power transients between 20 and 90 percent power are limited to ramp changes of 10 percent / tin and step increases of 10 percent. Power increases from 15-20 percent and above 90 percent are litited to 3 percent /=in, subject to xenon limitations.
Decreasing power transients between 90 and 20 percent power are litited to ramp changes of 10 percent / tin and step decreases of 10 percent. Power decreases between 100-90 and between 20-15 percent are litited to 3 percent / min. The turbine bypass syste= per=its a load drop of LO percent,
/~'T or a turbine trip fro = h0 percent load without safety valve operation. The
/
turbine bypass system and atmosphere dump valves permit a 100 percent load drop without reactor trip.
7 2.1.2 Safety Considerations 7.2.1.2.1 Shutdown Margin The control rods are provided in sufficient number to allow a hot shutdown that is greater than 1 percent suberitical with rod assembly of greatest worth fully withdrawn and a typical level of soluble boron (Figure 3-1).
7 2.1.2.2 Reactivity Rate Limits The maximum average rate of change cf reactivity that can be inserted by any group of rods does not exceed 9 2 x 10-5 (ak/k)/second.
(The accidental with-drawal of the rod group of greatest worth is discussed in 14.1.2.2 and 1h.1.2 3. )
The taximum nor=al rate (70 gpc) cf pure water addition doet not change reac-tivity vorth more than 3 x 10~D (ak/k)/second. Reactivity control may be ex-changed between rods and soluble boron consistent with the design bases listed above. Refer also to 7 2.2.1 3 m
[G 0019 7-21 1
7 2.1.2 3 Power Peaking-Limits The nominal reactivity available to a power regulating control rod group is limited so that established radial and axial flux-peaking limits are not ex-ceeded with the rod group in any position at power levels up to 100 percent power.
7 2.1.2.L Power Level Limits
'The reactor automatic controls incorporate a high limit and a low limit of power level de=and to the reactor. Additional limits are imposed on reactor power demand by reduced feed-water flow capability and reactor coolant syste=
flow capability.
72.13 start-up considerations Over the life of the nuclear unit, start-up will occur at various temperature levels and after varying periods of downtime. Examples of regulating system design requirements as related to start-up are:
Control rod and/or control rod group " withdraw inhibit" on high a.
start,-itp rate (short period) in the source range and intermediate range.
b.
Reactor tr p on high start-up rate in the intemediate range.
1
[' v}
c.
Start-up control mode. This mode prevents automatic rod with-drawal below 1.5 percent power.
d.
In start-up control mode, the controls are arranged so that the steam system follows reactor power rather than turbine or process steam system demand. The controls vill limit steam du=p to the condenser when condenser vacuum is inadequate.
e.
Sufficient control rod worth is provided to override transient xenon following a 50 percent reduction in power during most of core life. During cold shutdown, it vill be necessary to increase boron concentration to maintain shutdown cargin. Following a cold shutdown, boron concentration changes vill be made during start-up.
A number of rod assemblies (or groups), sufficient to provide 1 percent shutdown margin during start-up, are required to be with-drawn before a dilution cycle.
f.
Minimum pressurizer water level conditions must be met before and during start-up.
7.2.2 SYSTD4 DESIGN 7 2.2.1 Description of Reactivity Control 7 2.2.1.1 General Description (O
The reactor controls move control rods to regulate the power output of the
\\v/
reactor and maintain constant reactor coolant average temperatuve above 7-22 002.70
h l
1 15 percent rated power. As shown in Figu-e 7-o., th unit lead de=and signal is added to the reacter coolant average te=perature error to for a reacter j
pcVer level denand signal. The reacter power level de:and signal is cc pared to the reactor pcuer level measured by one of the pcVer range detectors in the nuclear instru=entation. When the resulting reacter pcver level errer l
signal exceeds the dead band, the output signal is a control rod drive "vith-j draw" or " insert" ce==and to the controlling rod group. Fer reactivity con-trol limits, see 3 1.2.2.
7 2.2.1.2 Reactivity Control Reactivity control is caintained by movable control rod assemblies and by scl-i uble boron dissolved in the reactor coolant. The =cderater te=perature coef-ficient (cold to het critical), as well as long-ter: reactivity changes caused by fuel burnup and fission product poisoning, are centro 11ed by adjusting sol-uble boron concentration. Short-te= reactivity changes caused by power change, xenon poisoning, and :oderator temperature change frc= 0 to 15 percent i
power are controlled by control rods 1
Values for the reactivity ec=ponents and control distribution are listed in Tables 3-k and 3-5 i
Twenty-four of the 57 control rod assemblies are assigned to aute=atic control j
of reactor power level during the first core cycle. These control rod asse:-
blies are arranged in three sy=:etrical groups which operate in sequence. The position of one auto =atic group is used as an index to soluble boren dilution.
j Soluble boren adjustment is initiated =anually and teminated aute=atically.
The position of this group acts as a "per=issive" to restrict the start of dilution to a " safe" rod position pattern. The position of the same group terminates dilution autocatically.
One bank of xenon centrol rods consisting of eight rods =ay be used for control of the axial power shape. Withdrawal of these rods is by operater action.
During reactor start-up, control rods are withdrawn in a prvleter=ined sequence in syczeetrical groups of four or more rod asse:blies. The grcup size is pre-set, and individual centrol rod assembly assignments to a group are cade at a control rod grouping panel. However, the operator can =anually contr:1 any I
individual control rod assembly and any rod group for metion as required.
s A typical control red group vithdraval schere is as folicvs:
Group 1.
12 CPA Group 2 5 CRA Group 3 h CRA Group h h CFA G cun 5 S CPA egulating n
Grcup 6 S CPA Group 7 8 C:A Groups i
Group S S CRA Xenon Control Group J
s g Qv j 7 23 NA * #.gL 1'
-.- - _ _ _ - - -,,, _ _ ~,. _ - - -. -,, - ~. _ - _ - _..,
I
.I An auto =atic sequence logic unit is used for reactor control with three regulat-ing rod groups in the power range. This unit allows operation cf no =cre than one control rod group simultaneously except over the last 25 percent travel of one group and the first 25 percent travel of the next group when overlapping motion of two groups is pe m.itted. This tends to linearize the reactivity in-l sertion fro: group to group as shown in Figure 7-7 As fuel burnup progresses, dilution of the soluble boren is controlled as follows:
When the partially withdrawn active control red group reaches the fully withdrawn point, interlock circuitry permits setting up a flov Mth fro:
a de=ineralized water tank, in lieu of the nor=al flow path cf borated
=akeup, to the reactor coolant syste=. Deborated takeup water is fed to l
the reactor coolant syste=, and borated reactor coolant is re=oved.
The reactor controls insert the active regulating rod group to compensate for the reduction in boron concentration. When the control rod group has been inserted to the 75 percent withdrawn position, the dilution flow is automatically blocked. The dilution cycle is also terminated auto =ati-cally by a preset timing device, which is independent of rod position.
Nor= ally, a dilution cycle is required every several days.
I 7 2.2.1 3 Reactivity Worth The maxi =um worth of any group of the three auto =atic control groups is approxi-
)
=ately 1 5 percent ak/k. At design speed, a group requires approxi=ately 5 =in-s utes to travel full stroke. This rate of control rod group travel results in a
=axi=u= reactivity rate of 9 2 x lo-5 (ak/k)/second.
I The max 1=u: rate of reactivity addition with the soluble boron syste=, ie, in-
)
jecting unborated water from the =akeup syste= at 1kO gic =axi=u=, is 7 x 1C-6 (ak/k)/second.
Table 3-5 shows a shutdown reactivity analysis. The rod worth provided gives a hot shutdown =argin of k.7 percent ak/k or more under nomal conditions, and a
=argin in excess of 1 percent ak/k with the CBA of greatest worth stuck in the withdrawn position.
a Under conditions where. cocidown to reactor building ambient conditions is re-i quired, concentrated soluble boroa vill be added to the reactor coolant to pro-4 duce a shutdown =argin of at least 1 percent ak/k. The reactivity changes fro het zero power to a cold condition, and the corresponding increases in borie acid concentration, are listed in Table 3-6.
i 7 2.2.1.4 Reactor Control 1
The reacter control is =ade up of analog co=puting equip =ent with inputs of unit load de=and, core power, and reactor coolant average te=perature. The cutput of the controller is an error signal that causes the control rod drive to be positioned until the error signal is within a dead band. A block diagra= of the reactor control is shown in Figure T-6.
OQ 7-24 007.72
First, reactor power level demand (Nd) is co=puted as a function of the unit 7
load de=and (ULd) and the reactor coolant syste= average te=perature deviation (3) from the set point, according to the following equation:
Nd " kULd + g (3 + [3dt)
Unit load de=and is introduced as a part of the de=and signal through a pro-portional unit having an adjustable gain factor (K ).
The te=perature devia-l tion is introduced as a part of the de=and signal after proportional plus reset (integral) action is applied. For the te=perature deviation, K is the adjust-2 able gain and t is the adjustable integration factor.
The reactor power level de=and (Nd) is then co= pared with the reactor power level signal (N1), which is derived from the nuclear instrumentation. The re-sultant error signal (Nd - Ni) is the reactor power level error signal (Ep).
When the reactor power level error signal (Ep) exceeds the dead band settings, the control rod drive receives a command that withdraws or inserts rods depend-ing upon the polarity of the power error signal.
The following additional features are provided with the reactor power controller:
An adjustable low limit on the unit load demand signal (ULd) to cut a.
out the automatic reactor control action.
O i
/
b.
A high limit on reactor power level de=and (Nd) to cinimize reactor power overshoot under automatic control action.
An adjustable lov limit on reactor power level demand (N ) to minimize c.
d reactor power undershoot under auto =atic control action.
Separate from, but related to, the auto =atic reactor control system is the re-actor coolant flow signal. The reactor coolant flow is measured and HMts the unit load demand and respective steat generator feed-water de=and to within the capability of the available reactor coolant flow.
In addition to measuring the reactor coolant flow, digital logie units contin-ually monitor the number of energized reactor coolant pu=ps and establish a maximum limit on the unit load demand.
7 2.2.2 Integrated Control Syste=
The integrated control syste= caintains constant average reactor coolant te=-
perature and constant steam pressure in the nuclear unit during steady-state and transient operation between 15 and 100 percent rated power. Figures 7-6 and 7-8 show the overall syste=. The syste= is based on the integrated boiler-turbine concept videly used in fossil-fuel-fired utility plants. It co= bines the stability of a turbine-following syste with the fast response of a boiler-following system. Optimum overall unit perfor=ance is maintained by limiting steam pressure variations; by 11=iting the unbalance that can exist between the steam generators, turbine, process steam, and the reactor; and by limiting the 3
)
total unit load demand upon loss of capability of the steam generator feed sys-V tem, the reactor, the turbine generster, or process steam. Unit load demand is the sum of megawatt demand plus process steam demand.
T-25 00273
1 I
Figure 7-6 shows the reactor control portion of the integrated control system (ICS) described in 7.2.2.1.h.
Figure 7-8 shows the steam generator control, turbine control, and process steam control portions of the integrated control syste=.
This control receives inputs of unit load de=and, system frequency, steam pressure, and process stea= de=and and process pressures, and supplies output signals to the turbine by; ass valve, turbine E controls, and stea:
generator feed-water flow controls with changing operating conditions.
I The turbine and steam generator are capable of auto =atic control fro ::ero 1
power to rated power with optional manual control. The reactor controls are designed for =anual operation below 15 percent rated power and for automatic j
or manual operation above 15 percent rated power.
The turbine is operated as a turbine-following unit with the turbine header pressure set point varied in proportion to megawatt error. The steam gen-erator is operated as a boiler-following system in which the feed-water flow demand to the steam generator is a su==ation of the unit load demand and the steam pressure error.
The ICS obtains a load de=and signal from the system dispatch center, and/or the process steam de=and, or from the operator. A frequency loop is added to the megawatt demand to match the speed droop of the turbine speed controls.
The load demand is restrained by a maximum load limiter, a mini =u= load limiter, a rate limiter, and a runback limiter. In nor:a1 operation, the unit load demand (UL ) limits would be set as follows:
d p
Maximu= Icad Limit 100 Percent Minimu= Load Limit 15 Percent Rate Limit 10 Percent / Min The runbacks act to run back and/or li=it the unit load de=and on any of the following conditiers:
One or more reactor ecolant pu=ps are inoperative.
a.
b.
Total feed-water flow and reactor power unbalance by more than 5 percent.
c.
One feed-water pump is inoperative, d.
Assymetric rod withdrawal patterns exist.
e.
The generator separates frc: the 3h5 kV bus.
f.
Loss of stator coolant.
g.
Reduction in reactor coolant flow.
The output of the limiters is a unit load de=and signal which is applied to the steam generator control and reactor contrrl in parallel. The reactor control responds to the unit load demand signal ab described in 7 2.2.1.h.
Dd T-26 cam i
Q Since the stea= supply frc= either nuclear stea= supply (NSS) can be used with Unit 1 turbine, the two ICS are designed identically, and appropriate trans-ferring is provided to adapt the NSS to the turbine 'ceing contr:11ed with or without process stea= flow. When the process extraction turbine is not oper-ating, the ICS will act to control the NSS to meet de= ands of the process stea=.
7.2.2.2.1 Turbine Control The =egavatt de=and is co= pared with the generater =egawatt output, and the resulting =egawatt error signal is used to change the turbine header pressure set point. The turbine valves then change position to change lead and stea:
pressure. As the =egawatt error reduces to zero, the stea= prissure set point is returned to the steady-state value. By li=iting the effect of =egawatt error en the stea= pressure set point, the syste= can be adjusted to permit controlled variations in stea= pressure to achieve any desired rate of turbine r*sponse to =egavatt de=and.
7 2.2.2.2 Stea= Generator Control Control of the stea= generator is based on =atching feed-water flow to unit load de=and with bias provided by the error between stea= pressure set point and stea= pressure. The pressure error increases the feed-vater flev de=and if the pressure is lov.
It decreases the feed-water flev de=and if the pres-sure is high.
The basic control actions for parallel stea= generator operation are:
s a.
Unit load de=and converted to feed-water demand, b.
Steam pressure co= pared to set pressure, and the pressure error converted to feed-water de=and.
c.
Total feed-vater de=and ec=puted frc= su= of a and b.
d.
Total feed-water flow de=and split into feed-water flow de=and for each stea generator.
Feed-water de=an:1 ce= pared to feed-water flow for each stea: gen-e.
erator. The resulting error signals position the feed-water flow controls to catch feed-water flow to feed-water de=and for each stea generator.
Fer operation belov 15 percent lead, the stea: generater control acts to =ain-tain a preset P.inicu= downco=er water level in the stea= generator. The con-version to level control is aute=atic and is introduced into the feed-water control train through an auctioneer. At low leads below 15 percent, the tur-bine bypass valves vill operate to limit stea= pressure rise due to re=oving load free turbine.
The stea: generator control also provides ratio, li=it, and runback actions as shown in Figure 7-8, which include:
N
'w
)
7~.. ~
Stes: Generator Load Ratio Control a.
t Under nor=al conditions, the stea generators vill each produce one-half of the total load. Stea= generator load ratio control is provided to balance reactor inlet coolant te=peratures during operation with more reactor coolant pu=ps in one loop than in the other.
b.
Rate Limits Rate limiters are manually set to restrict loading or unloading rates to those that are co=patible with the turbine, reactor, and/or the steam generator.
1 c.
Water Level Limits A =aximum water level limit prevents gross overpu= ping of feedvater and insures superheated steam under all operating conditions.
A minimum water level li=it is provided for low load control and insures a mini =u vater inventcry under all operating conditions, d.
Reactor Coolant Pump Liniters These li=iters restrict feed-water de=and to catch reactor coolant
]
pu= ping capability. For exa=ple, if one reactor coolant pu=p is not y\\ ()
operating, the maximu= feed-water de=and to the stea: ger.erator in the loop with the inoperative pu=p is limited to approximately one-half normal.
e.
Stea= Generator Pressure Limits The limiters reduce feed-vater de=and when the pressure in the stea generator beco=es high.
f.
Reactor Outlet and Feed-Water Lov Temperature Licits These limiters reduce feed-water de=and when the reactor outlet temperature or the feed-water temperature is lov.
6 Feed-Water Pu=p Capability A feed-water pu=p capability runbach signal limits the unit load demand signal whenever total feed-water flow lags total feed-water de=and by 5 percent.
723 SYSTIM EVALUATION T.2 3 1 Syste: Failure Considerations Redundant sensors are available to the integrated control syste=, for those
. parameters with sensors that cannot be readily =aintained or replaced. The
~
4 operator can select any of the redundant sensors fro: the control roc =.
,V 7-28 OO M;
_ _ - _ _ _ _ =
i 1
i' {
Manual reactivity control is available at all power levels.
Less of electrical power to the aute=atic controller reverts reactor control to the =anual mode.
7232 Interlocking Control rod withdrawal is prevented on the occurrence of a positive short period belov 10 percent power.
The automatic sequence logic sets a predeter=ined insertion and withdrawal pattern of the three regulating rod groups and the xenon control rods.
1 Control circuitry allows manually selected operation of any single contre'. rod asse=bly or control rod group throughout the power range.
i An interlock vill prevent actuation of both withdrawal and insertion of control rod simultaneously with the insertion signal overriding the withdrawal.
Control rod drive switching circuits allow withdrawal of no more than a single control rod group in the manual mode.
The automatic sequence logic limits regulating rod motion to one group except at the upper and lower 25 percent of stroke where operation of two groups is
~
permitted to linearize reactivity versus stroke.
Maxi =u: and minimum limits on the reactor power level de=and signal (N ) P#*~
d vent the reactor controls fro initiating undesired power excursions 1
Maxi =u= and =inimum levels on the unit load demand signal (UL ) prevent the d
reactor controls fro: initiating undesired power excursions.
7233 E=ergency Considerations Loss of power to the control rod drives initiates a reactor trip.
When conditions arise due to =alfunctioning of the control system, the operator can revert to the manual control mode.
t 7 2 3.h Loss-of-Load Considerations Each nuclear unit is designed to accept 10 percent step load rejection without safety valve action or turbine bypass valve action. The ec=bined actions of the control syste= and the turbine bypass valve permit a LO percent load re-duction or a turbine trip from h0 percent load without atmospheric du=p er safety valve action. The controls will limit stea du=p to the condenser when condenser vacuum is inadequate, in which case the atmosphere dump or safety valves may operate. The combined actions of the control system, the turbine byInss valve, and the du=p valves permit a 100 percent load rejection without reactor trip.
The feature that permits continued operation under load rejection conditions includes:
7-29
, ~.,
(
a.
Integrated Contrcl Syste=
During ner=al operation, the ICS (see Figre T-3) centrols the unit load in response to lead de=and fro = the syste= dis; etch center, and/or frc= process stea de=and, or frc= the operater.
During nor=al lead changes and s=all frequency changes, turbine control is through the EH control syste= to =aintain constant stea= header pressure and =eet the demand load. During opera-tion without the turbine generater, the process flev de=and and pressure control are assigned to the stea= generator and reacter.
During large lead and frequency upsets, the turbine governor takes control to regulate frequency. For these upsets, frequency droep signal into the integrated centrol syste: becc=es =cre i=pertant in providing load =atching between the ICS and the turbine EH control.
b.
100 Percent Relief Capacity in the Stea= Syste=
This provision acts to reduce the effect of large load drops on the reactor syste=.
Consider, for exa=ple, a sudden load rejection greater than 10 percent.
'n' ben the turbine generator starts accelerating, the governor valves begin to close to =aintain set frequency. At
~N the sa=e ti=e, the =egawatt de=and signal is reduced, thus re-(.
ducing the unit 1 cad de=and which decreases the de=and to the turbine EH control, feed-vater flev de=and, and reacter power level demand. As the governer valves close, the stea= pressure rises and acts through the control syste= to reinforce the feed-water flow de=and reduction already initiated by the reduced
=egawatt de=and signal. In addition, when the load rejection is of sufficient magnitude to cause an excess pressure condition, the turbine bypass valves open to reject excess stea= to the con-denser. For continuing higher pressure, the du=p valves cpen to exhaust steam to the at=osphere. Tne rise in stea: pressure and the reduction in feed-vater flow cause the average reacter cool-ant te=perature to rise which reinferees the reacter power level de=and reduction, already established by reduced unit lead de-cand, to restore reactor coolant te=perature to set value. As a result, the reactor, the reactor ccolant syste=, and the stea= syste: run back rapidly and s=octhly to the new load level.
As the turbine generater returns te set frequency, the turbine controls revert to lead and stea= pressure control rather than frequency control. This feature holds stea pressure. vit hin relatively narrev li=its and prevents further large stea pressure changes.
n Nf
)
\\.
T-30 002?8
73 NUCLEAR UNTT INSTRQC!TATION 731 NUCLFAR INSTRU'CFATION The nuclear instru=entatien syste= is shown in Figure 7-2A.
E:phasis in the design is placed upon accuracy, stability, and reliability.
Instruments are redundant at every level.
The design criteria stated in 7 1.1.2 have been applied to the design cf this instrumentation.
7 3 1.1 Design The nuclear instrumentation has eight channels of neutron infer =ation divided into three ranges of sensitivity:
source range, intermediate range, and power range. The three ranges co=bine to give a continuous ceasure=ent of reactor power frc= source level to approxicately 125 percent of rated pcVer er ten decades of infer =atien. A tini=u= of one decade of overlapping infor=ation is provided between successive higher ranges of instrumentation. The relationship between instrument ranges is shown in Figure 7-0 The source range instrumentation has two redundant count rate channels origi-nating in two high sensitivity proportional counters.
These channels are used over a counting range of 1 to 105 counts /s as displayed on the operatcr's con-trol console in terms of log counting rate. The channels also ceasure the rate of change of the neutron level as displayed for the operator in ter=s of start-up rate fro: -1 to +10 decades /=in.
No protective functions are asso-
'(s ciated with the source range because of inherent instrumentatien limitations encountered in this range. However, one interlock is provided, ie, a control rod withdrav hold and alar = on high start-up rate in either channel.
The inter =ediate range instru=entation has tvc log N channels originating in two identical electrically gar-n-cc=pensated ion cha=bers. Each channel pro-vides seven decades of flux level infor ation in ter=s cf log ion chamber cur-rent and start-up rate. The ion chatber output range is fro: 10-11 to lO-b a peres. The start-up rate range is frc: -1 to +10 decades per cinute. Pro-tective action on high start-up rate is provided by these channels. A high start-up rate on either channel causes a reactor trip. Pricr to a reactor trip, high start-up rate in either channel vill initiate a control rod with-draw hold interlock and alar =.
The power range channels have four linear level channels criginating in 12 un-compensated ion chambers. The channel output is directly proportional to re-aeter power and covers the range fro: 0 to 125 percent of rated pover. The syste= is a precision analog system which e= ploys a digital technique to pro-vide highly accurate signals for instrument calibration and react 0r trip set point calibration. The gain of each channel is adjustable, providing a means
~for calibrating the output against a reactor heat balance. Protective action on high flux level consists of reactor trip initiation by the pcVer range channels at preset flux levels.
Additional features pertinent to the nuclear instrumentation syste= are as follows:
r'N
'J 7-31 Qg.g
1
('
Independent pcuer supplies are included in each channel. Primary a.
pcVer originates frc the preferred a-c buses described in 5.2.2.5.
Where applicable, isolation transfer:ers are previded to insure a stable, high-qual;ty power supply.
b.
The propertienal counters used in the source range are designed te be secured when the flux level is greater than their useful operating j
range. This is necessary to obtain prolcnged cperating life.
t The inter ediate range channels are supplied with an adjustable source c.
of ga-a-ce:pensating voltage.
7 3 1.1.1 Test and Calibration Test and calibration facilities are built into the syste=.
The test facilities vill =eet the requirements cutlined in the discussien of prctectice systems testing.
Facilities for calibration of the various channel amplifiers and ceasuring equipment will also be a part cf the system, t
7 3 1.1.2 pcver P.ange Detecters Twelve unec=pensated ionization chambers are used in the power range channels.
Three chaibers are associated with each channel, ie, one near the bottc= cf the core, a second at the tidplane, and a third toward the top cf the core.
The outputs of the three cha=bers are ceibined in their respective linear a:-
3 plifiers. A means is provided for reading the individual chamber outputs as a =anual calibration and test function during ncrtal operation.
7 3 1.1 3 Detector Locations a
i The physical locations of the neutren detecters are shewn in Figure 7-10.
The power range detectcrs are located in fcur pri=ary positiens,-90 degrees apart arcund the reactor core.
The two source range proportional counters are located on cpposite sides cf the core adjacent to two cf the power range detect 0rs.
The two intermediate range cc pensated ion cha:bers are also located en oppo-site sides of the core, but rotated 90 degrees frem the source range detectors.
4 7 3 1.2 Evaluation The nuclear instrumentation vill teniter the reacter over the 10-decade range frc= scurce to 125_ percent of rated pcVer. The full pcVer neutren flux level at the power range detectors will be approxicately 101 nv.
The de+ectors e -
4 plcyed vill provide a linear response up to approximately b x 1010 ny before they are saturated.
The inter =ediate range channels cverlap the source range and the power range channels in an adequate canner, providing the continuity of infor:ation needed during start-up, s_J 7-32 00330
/m
'I
(!\\s /
The axial and radial flux distributien within the reacter core vill be neasured by the in-c:re neutron detecters (7 3 3). Ite cut-ef-ecre detecters are pri-marily for reacter safety, contrel, and cperation infcrmation.
731.2.1 Less of Pever The nuclear instrumentation draws its prinary pcVer frc: redundant battery-backed preferred a-c buses described in 5.2.2.5.
7 3 1.2.2 Reliability and Cc penent Failure The requirements established for the reacter protection system apply tc the nuclear instrumentation. All channel functicns are independent of every cther channel, and where signals are used for safety and contrcl, electrical isola-tien is employed to meet the criteria cf 7 1.1.2.
732 IiC CL*C' JAR PROCESS ESTIFJIE';TATIC?i 7 3 2.1 syster Design The nonnuclee. instru=entation ceasures temperatu2vs, pressures, fl0vs, and levels in the reacter coolant syste=, stea syste=, reactor auxiliary systems, and process stea: syste:. Process variables required en a continuous basis for the start-up, operation, and shutdevn of the nuclear unit are indicated, reccrded, and contrclled frc= the control roc:. The quantity and types of
-(3 process instrumentation provided vill insure safe and crderly operatien cf all
)
systems and processes ever the full operating range cf the unit. The a=ounts and types of various instruments and centrollers shown are intended to be typi-cal examples of those that vill be included in the various systers when final design details have been ec=pleted. The nonnuclear process instrumentation for the reacter coolant is shown in Figure 7-11 and en the reacter auxiliary system drawings in Sections 5, 6, 9, and 11.
Process variables are tenitered as ch0Vn en the nonnuclear instrumentation and reacter auxiliary syste:
drawings and are as fellevs:
In general, resiste.nce elements are used for te=perature =easurements.
a.
Fast-response resistance ele ents senitor the reactor cutlet tempera-ture. The outputs of these fe.st-response elements supply signals to the protection syste:.
b.
Pressures are ceasured in the reacter cc01 ant syste=, the stest sys-te=, the reacter auxiliary syste=s, and the process steam system.
\\ r<w s
t
-%/
7-33 00%' " '
l
,s I
~ Pressure signals for high and low reactor coolant pressures and high s-reactor building pressure are provided to the protection syste=s.
c.
Reactor coolant pu=p motor operation is monitored as a ceasure of the nu=ber of pu=ps in operation. In addition, reactor coolant flow signals are obtained and indicated by means of reactor coolant flov meters. This information is fed to th r reactor protection system.
Reactor control also receives infor=ation of the number of pumps in operation.
l d.
Flow in the stea= system and process steam system is inferred fro feed-water flow. Flow infor=ation is utilized for control and pro-tective functions in the steam system. Stea= generator level tea-surements are provided for control and alar = functions.
e s Pressurizer level is measured by differential pressure trans=itters calibrated to operating te=perature and pressure. The pressurizer level is a function of the reactor coolant syste= cakeup and letdown flow rste. The letdown flow rate is remote manually controlled to the' required flow. Pressurizer level signals are processed in a level controller whose output positions the makeup control valve in the makeup line to maintain a constant level.
f.
Reactor coolant system pressure ic maintained by a control syste=
that energizes pressurizer electrical heaters in banks at preset
- /-
pressure values below 2,175 psig er actuates spray control valves
\\.
if the pressure increases to 2,230 psig.
7.3.2.lA Failed Puel Detection A process radiation monitor is provided in the letdown line.
(Figure 9-2)
A study is currently being carried out by B&W to deter =ine the source strengths of the various isotopes released to allow an evaluation of the required sensi-tivity of this monitor for detecting rapid fuel failures.
7 3 2.2 System Evaluation Redundant instrumentation has 'oeen provided for all inputs to the protection systems and vital control circuits.
Where wide process variable ranges are required and precise control is involved, both wide-range and narrow-range instrumentation are provided.
Where possible, all instrumentation components are selected fro = standard com-cercially available products with proven operating reliability.
All electrical and electronic instrumentation required for safe and reliable operation will be supplied fra redundant preferred a-c buses.
i n'O 002W.
7-3h Amendment No. 2 5/28/69
.~
~.
c 7.3.3 IN-CORE MONITORING SYSTzM 7.3.3.1 Design Basis The in-core monitoring system provides neutron flux detectors to monitor core performance. No protective action or direct control functions are perfomed I
by this system. All high-pressure system conmedtions are ter=inated within the reactor building. In-core, self-powered neutr:n detectors measure the neutron flux in the core to provide a history of power distributions and disturbances during power operating modes.
T-3ka Amendment No. 2 00dN*
The in-core =onitoring syste= is not connected to the reactor protection syste:
or the reactor centrol. The syste= is provided pri=arily to ecliect data for effective ad=inistratica of the fuel =anage=ent progrn= and secondarily to pro-vide the operator with confir=ing infor=atica regarding pcVer distribution in the reacter cere.
During nertal operation, the in-core instru=entation is not needed to provide the operator with any infer =ation en which he =ust take corrective centrol action, because core power distribution should follow previously calculated values. The in-core instru=entation, hcVever, is expected to alert the reactor operator whenever xenon oscillations exist, because it is only during xenon oscillation that undesirable =aximu=-to-average power conditions can occur.
Xenon oscillations, however, can only occur at higher power levels under pre-dictable circu= stances, which lend the=selves to analytical dete=nination.
The required analyses vill be performed during the design of the reacter and a xenon oscillation threshold power versus core life curve vill be developed.
However,.there is so=e power level belev which significant xenon oscillations can never occur.,
7332 Syste= Design 7 3 3 2.1 syste: Descriptian The in-core'=cnitoring syste= consists of asse=blies of self-powered neutron detectors located at 46 preselected radial positicus within the core. The in-
- (
core monitoring locations are shown on Figure 7-12.
In this arrange =ent, an T _e in-core detector assembly, consisting of five local flux detectors and one s
background detector, is installed in the instru=entation tube of each of h6 fuel assemblies (Figure 3-52). The locai detectors are positioned at five diffeient axial elevations to provide the axial flux gradient. The outputs of the local flux detectors are referenced to the background. detector cutput so that the differential signal is a true teasure of neutron flux.
~ As shown in Figure 7-12, eight detector asse=blies are located to act as sy==e-try =ocitors. The re=aining 38 detector asse=blies, plus two.of the eight sy==etry =enitors, provide monitoring of every type of fuel asse=bly in the core when' quarter core sy==etry exists.
I
' When' the reactor is depressuriced, the in-ccre detector asse=blies can be in-i serted or withdrawn through guide tubes which criginate at a shielded area in the reactor building as shown in Figure 7-13 These guide tubes, after c0=-
pleting twS 90 degree turns, enter the botto= head of the reacter vessel where internal guides extend up to the instru=entatien tubes of h6 ' selected fuel as-se=blies. The instru=entation tube then serves as the guide for the in-core detector asta=bly. The in-core detecter asse=blies are fully withdrawn only for r; place =ent.
During refueling operations, the in-ccre detector assemblies are withdrawn approximately 13 feet to allev fre? transfer cf the fuel asse=-
blies. After the fuel asse=blies are placed in their new locations, the in-core detector asse=blies are returned to their fully inserted positions in the core, and the high-pressure seals are secured.
4 x[ ;
\\v
- in 7-35
()ll,3.-@:
Cl L-y
.m-r
,.,-e
. - ~
7 3 3 2.2 Calibration Techniques The nature of the detecters permits the manufacture of nearly identical detec-tors which vill produce a high relative accuracy between individual detectors.
The detector signals cust be compensated for burnup of the neutron sensitive material and this will be done periodically based on burnup.
Calibration of detectors will not be required. The in-core self-powered detec-tors can be controlled to very precise levels of initial sensitivity by quality control during the manufacturing stage. The sensitivity of the detector changes over its lifetime due to such factors as detector burnup, control rod position, fuel burnup, etc. Experimental progra=s have been ec=pleted to determine the magnitude of these factors. The results of these experiments have been incor-porated into calculations which will be used to continuously co=pensate the output of the in-core detectors for these factors. Operation of detectors in both power and test reactors has demonstrated that this compensation progra=,
i when coupled with the precise levels of initial sensitivity, provides detector g
readout accuracies sufficient to eliminate the need for a calibration syste=.
7333 Detection and Control of Xenon Oscillations Under normal operating conditions, h6 strings of in-core detectors vill be supplying information to the operator in the control room. The information will be in a for= such that, if an oscillation is detected, the operator can refer to the operating procedures for this particular case and act accordingly
'N to damp out the disturbance..The stability analysis of the core has shown that s,
axial oscillations are possible, azi=uthal oscillations are unlikely, and radial oscillations vill not occur. The in-core monitoring system has been designed in this context. The system is not a part of the reactor protection syste=.
Each individual detector will measure the neutron flux at its locality which will be used to determine the local power density. The individual power densi-ties vill then be averaged permitting the peak-to-average power ratios to be calculated.
The application of this system for detection of xenon oscillation and its mini-mu= sensitivity is being examined through the analysis of experimental data.
The analysis should be ec=p eted by the end of 1968. However, previous perfor-
=ance data are available. A series of Physics Verification Program Reports developed under AEC Contract No. AT(30-1)-36h7 and B&W Contract No. L1-2007 has previously been submitted to the Co==ission for review. Much of the data compiled was taken by self-powered detectors and shows the performance capa-bilities of the detectors. Upon initial installation, the self-powered detector has the capability to measure the
- elative flux within 5 percent of the true flux when used in conjunction viti, an adjacent background detector. The sensi-tivity of the detector will uecrease with exposure to neutron flux due to trans=utation of the emitter in the detector. However, by use of integrated current inventories, it is felt that the additional inaccuracies shall be no more than' 1 percent per year for the average flux conditions.
,p)
' \\.
7-36 f)(f2'SES
.=
)
7 3 3.h Syste= Evaluation 7 3 3 4.1 operating Experience The AECL has been operating in-core, self-powered neutron detectors at Chalk River since 1962. They have been successfully applied to both the HRX and NEU reactors and have been operated at fluxes beyond those expected in nomal pres-surized water reactor service.
7 3 3.h.2 B&W Experience Self-powered, in-core neutron detectors have been asse= bled and irradiated in the B&W Development Progra= that began in 1964. Results fro = this progra=
have produced confidence that self-powered detectors used in an in-core instru-
=ent system for pressurized water reactors vill perfom as well as, if not better than, any system of in-core instrumentation currently in use.
The B&W Development Progra= includes these tests:
a.
Parametric studies of the self-powered detector.
b.
Detector ability to withstand PWR environ =ent.
c.
Multiple detector asse=bly 1rradiation tests.
d.
Background effects.
k e.
Readout syste= tests.
f.
Mechanical withdrawal-insertion tests.
g.
Mechanical high-pressure seal tests.
h.
Relationship of flux =easurement to power distribution experi=e its.
Preliminary conclusions drawn from the results of the test progra=s at the B&W Lynchburg Pool Reactor, the B&W Test Reactor, and the Big Rock Point Nuclear Plant are as follows:
a.
The detector sensitivity, resistivity, and te=perature effects are satisfactory for use.
b.
A multiple detector asse=bly can provide axial flux data in a single channel and can withstand reactor environ =ent.
An asse=bly of six local flux detectors, three background detectors, and two ther=o-couples has been successfully operating in the Big Rock Point Reac-ter since May 1966.
c.
Background effects vill not prevent satisfactory operation in a PWR environment.
Irradiation of detector asse=blies and evaluation of performance data are con-wO{
tinuing to provide detailed design information for the in-core instrumentation
(,
syste=.
I 7-37 gyp 4
7.h TURBINE AND PROCESS CONTROL SYSTHG 7.h.1 DESIGN PASES The turbine and process control systems are designed to control each turbine generator and the process stea= supply to meet operating conditions.
7.h.2 DESCRIPTIC i AND OPERATION The turbine generator control syste= (or electrohydraulic control syste=)
combines electronics and high-pressure hydraulics to control steam flow through the turbine. The control system consists of the following four ma,)or parts:
(1) Control console containing the electrical control circuits.
(2) Emergency trip syste=.
(3) Hydraulic power supply system.
(h) Electric power supply system.
The control circuits in the console include the speed control unit, the load control unit, and the flow control units. The speed control unit uses speed signals produced by pickups that are placed over a toothed wheel on the tur-bine shaft. The pulses from these pickups are translated into d-c voltages
(
proportional to speed and compred to a speed reference.
The load control unit co= bines the speed error signal derived from the speed control unit with the load reference and special biases used to achieve full-are admission operation during start-up and initial loading, and partial-are admission for nomal operation.
The desired ter=inal lot.d is set on one knob, and the loading rate is set on a second knob. The turbine generator increases load at the selected rate, and transfers from full-are admission to partial-are ad=ission, and vice versa, automatically, at a preselected load and transfer rate.
The load control system includes provision for possible future connection to an automatic load dispatching system. For normal operation under load as controlled by a dispatching system, pulse signals are accepted to control the load reference.
The outputs of the load control unit are three flow signals, respectively, for the main stop valves, the control valves and the combined inte mediate valves.
The flow: control units position the main stop valves, control valves and com-bined intermediate valves. The flow signals fro: the load control unit are amplified in servo a=plifiers suitable for the particular valves. The output of the servo a=plifiers operates servo valves which ad=it high-pressure fluid i
to the respective rams that operate the corresponding valves.
(
The valve positions are fed back to the flow control units by means of suit-(
- able feedback circuits.
T-38 007 9 bus m
__,_,______________,_.._,,__________._________________.____________._,________________m.______m_______._m..__m_
_____,__.___m
The emergency trip syste= is entirely independent cf the operating control syste= and operates the =ain stop and co=bined inter =ediate valves by means of a hydraulic relay syste= with high-pressure fluid. Malfunctions or faults which cause trips include turbine overspeed, loss cf condenser vacuu=, thrust bearing wear, and generator / electrical faults.
The hydraulic power supply syste= is completely separate from the bearing oil system and uses fire-resistant fluid. Two full-size high-pressure pumps driven by a-c motors are located on the fire-resistant fluid tank. Each of these pu=ps delivers enough flow for the operation of the system; the second pump serves as a standby.
Accumulators located near the valve operators are used to provide high flow capacity for transients, and as a brief flow reserve in case a-c power to both pumps is momentarily lost.
The hydraulic system contains the necessary filters, heating and cooling provisions; the tank and piping are =ade of stainless steel.
The electric power supply system contains electronic circuits that transfor=
either 120 V a-c line power or h20 Hz a-c power from the per=anent =agnet generator into the d-c voltages necessary to operate the control and logic circuits.
Process steam pressures are regulated to within 110 percent of the nominal values stated in Section 10.
The 675 psia process steam pressure is auto-
=atically controlled by the pressure reducing station.
The 197 psia process stea: is nor= ally taken from the Unit 1 moisture separators.
Backup pressure reducing stations supply the 197 psia stea= vhen the Unit 1 turbine is out of service or when the station electrical load de=and is too lov for the Unit 1 turbine to furnish the required pressure. The control sys-tem closes the process nonreturn valves -in response to a signal initiating =ain steam flow to the backup pressure reducing station. The nonreturn valves are controlled to prevent reopening until the pressure in the moisture separator exceeds the pressu-e in the 197 psia process stea= line. This prevents back-flow of 197 psia steam into the turbine cycle at lov loads and when the Unit 1 turbine is out of service.
75 RADIATION MONITORING AND PROTECIION SYSTDi 751 DESIGN BASIS The radiation monitoring system is designed to:
i (1) Continuously detect and record the level of radioactivity in the plant effluent released to the environ =ent.
l
.s O
7-39 A=endment No. 2 5/28/69 00258 i
.4
_.._.,--x,,--
[mj (2) Provide operating personnel with a continuous indication and Ns/
record of the ga==a radiation levels in selected plant areas.
(3) Protect operating personnel from exposure to radiation levels or radioactive concentrations in excess of the maxi =u= per=issible litits of 10 CFR 20 by alar = annunciation or automatic action in the event that such limits are exceeded.
T.5 2 DESCRIPTION AND OPERATION To fulfill its design basis, the radiation tonitoring syste= for both units consists of interrelated subsyste=s as described below. These are identified as the airborne radiation monitoring syste=, waterborne radiation monitoring syste= and area radiation tonitoring systet.
7 5 2.1 Airborne Radiation Monitoring Syste=
The airborne radiation monitoring syste= monitors the gross activity of the stack-gas, reactor. building atmosphere, vaste gas, and auxiliary building ventilation air.
The stack-gas monitor initiates an alar = vhenever the su= of the ratios of each gaseous isotopes actual concentration to its maximu= pe missible concentration exceeds unity. The absence of heavy particulate and halogen isotopes vill be
-detonstrated by laboratory analysis of fixed integrating filters.
7
/7 The reactor building atmosphere toniter initiates an alam whose set point is
()
equivalent to the gaseous isotopic concentration which would cause a maxi =u=
per=issible release at the stack, if the purge fans were in operation. The particulate constituent of the reactor building atmosphere is collected on integrating filters for laboratory analysis.
The vaste gas monitor alar =s and automatically isolates the vaste gas discharge header whenever a concentration proportional to a fraction of the =axi=u= per-
=issible release at the stack is detected.
The auxiliary building ventilation air tonitor alarms and automatically directs the exhaust airflow from potentially contaminated areas through the charcoal filters upon the detection of high activity in these areas.
In~ addition to the above monitors, the air ejector off gas is continuously monitored.
Similar per=anently installed tonitors are 'also e= ployed to monitor the ven-tilation air of the engineered safeguards areas whenever safeguards equipment must operate under less-of-coolant accident conditions.
By implementation of this syste=, the significantly probable sources of air-borne radioactivity are detected at levels equal to or less than the =aximum allovable release limit of the plant.
\\./
i 7 h0 A=end=ent No. 5.
^1/3/69 00'M9
7 5 2.2 Waterborne Radiation Mcnitoring System f'
)
The waterborne radiation =0nitoring syste: onitors the possible sources of radioactive liquids released to the envirens as well as the point of release
.s to the environment itself. The gross activity in the dilution water, service water and radvaste liquids discharge line is monitored.
e point-of-release =cnitor en the dilution water alar:s when the =c=entary level is slightly above the maxima: per=issible limit, but the moniter is supple:ented by a sampling syste: so that laboratory analysis of the effluent de:cnstrates that the actual integrated release was considerably belev the maxima: level.
The service water =enitor alar:s when the gross activity level in the service water would result in a fraction of the naximum release to the environment.
The radvaste liquids =enitor alar:s and terminates the release when the gross activity level in the radvaste effluent line vould result in a fraction cf the taximu= per=issible release to the environment.
In addition, continuous monitors are provided for process steam and ec=ponent cooling water.
Supplementing the continuous conitoring, sa=ples are taken from the ec=ponent cooling water, service water, radvaste, condensate and primary coolant syste=s for laboratory verification that the grcss activity levels are within per=is-sible limits.
({V}
7523 Area Radiation Monitoring Syste=
The cultichannel area radiation monitoring system monitors the radiation in-tensity of areas in the plant where it is possible for operating personnel to be subjected to ga=ma radiation. The selection and number cf points are coor-dinated with the plant access control so that operating personnel are not able to enter an un=onitored area in which they could be exposed to a dose in ex-cess of the limits of 10 CFR 20.
All channels of the radiation monitoring and protection syste: consist of re-motely counted detectors connected to panel mounted readout, control and power supply instru=entation in the =ain control roo=.
Except for the detectors, which contain Geiger-Mueller and photomultiplier tubes, the instru=entation is co=pletely solid state. The operational reliability of each channel can be verified by control room actuation of radioactive check sources at each detec--
ter.
Loss of sa=ple flew, less of signal or loss of power supply causes an alar: annunciation. All detector signals are reccrded on a potenticzetric strip chart recorder.
7.5.3 SYSTEM D'ALL'ATION 7.5.3.1 Reliability Each component of each system is designed to meet its maximum environ = ental cenditions of pressure, temperature, and relative humidity. In addition, the react r building radiation sensors for ESFAS, control roer. intake vent radia-29 tion monitor, and the fuel pool room exhaust vent radiation monitor are designed to Seismic Category I requirements.
,s
/
\\
k/
7 h1 m
Arendrent No. 29 4/75
()():' JK)
OV Each channel shall have a down scale alar = set below the natural background counting rate so that any loss of this natural signal vill cause annunciation.
7532 Power Sources System To the maximum extent practicable, the monitoring syste=s take advantage of process pressures and flows to extract a sample taking external pumping power unnecessary. The power load of the solid-state electronics is lov enough that it can be supported by the battery-backed preferred a-c supply. The pumping systems that do require pcVer are connected to the instrument bus backed up by e=ergency diesel generators.
7533 Redundancy Redundancy is accomplished by the canner in which the process radiation moni-toring systems are interrelated to survey potentially radioactive processes at the source within the plant and again at the point of release to the environs.
The area radiation monitors in the reactor building, which provide signals for reactor building isolation, back up the reactor building airborne radiation monitor and are capable of maintaining operatica in the event of an IOCA.
T.5.h TESTING AND MAINTENANCE Except for those systems which require a sa=ple pu=p, there are ao moving Iarts in the radiation monitoring equipment; therefore, maintenance is minimal. Ad-justment of circuit parameters can be accomplished from the main control room.
~ '
The operational reliability of each system can be tested by use of check sources operated by push button in the main control room. Within reasonable limits of accuracy, this check source simulates a calibration reference for the system.
755 RADIATION PROTECTION (HEALTH PhTSICS)
The methods and techniques of personnel monitoring that have been successfully utilized since 1962 at the Big Rock Point Nuclear Plant and that were adopted for use at the Palisades Plant are generally adopted for use at the Midland Plant. The day-by-day control is accomplished through the use of self-reading pocket dosimeters issued to al:
rsonnel while long-ter= control and records rely upon film badges. Film b, service is purchased from a qualified sup-plier and includes monthly prot of beta-gama badges, neutron badges and finger badges.
I Personnel radiation dose records art co= piled on a daily basis utilizing the pocket dosimeter readings. The daily dosi=eter accu =ulations are checked against the monthly fil= badge results.
Nor:::al protective clothing such as coveralls, shoe covers, head covers and i
gloves is provided for work in potentially contaminated areas. Protective equircent for use in airborne contamination areas consists of respirators for i
short-ter= entries and e=ergencies, and full face, fresh air or canister tasks for longer occupancy. Laundry and deconta=ination of protective clothing and equiIcent are performed on site.
t m
Ta2 00M
t
' O)
The spread of radioactive conta=ination is controlled by utilizing protectiva I
g(
clothing, step-off pads and "frisker" stations at the entrance to the conta:1-nated areas, and by requiring all personnel to pass through a central access control roc = when entering or departing frc: the controlled portion of the plant.
Radiation protection technicians will conduct daily surveys to determine the status of each area as to floor and air contamination and radiation levels.
The technicians provide guidance to plant personnel and others as to the cen-dition of plant areas and the protective ceasures needed to cope with observed conditions.
Control of entry into "high radiation" areas is by locked and/or alart-conitored doors, radiation vork permits (7 hen applicable) and other administrative pro-3 cedures.
personnel decontatination facilities include a shower and sink in the access control root. Equiptent decontatination is accomplished at a decontamination center provided to clean equipment prior to moving the equiptent to the ma-chine shop or a clean area.
The radiation protection technicians vill occupy an area adjacent to the access control room and have at their disposal the necessary counting equiptent, por-table monitoring equipcent and records.
A calibration facility (with appropriate radioactivity sources) is provided
' (
to per=it calibration and testing of portable ga-a and neutron monitoring
'd equiptent.
Sufficient beta-ga==a, neutron and GM tube-type portable radiation survey instruments are provided to allow plant personnel to conduct both routine and emergency activities with r complete knowledge of radiation levels.
A portal monitor is provided at the plant entrance to serve as a final check l-en personnel leaving the site.
'Trisker" stations are set up at appropriate locations to minimize the potential spread of contacination to other areas.
i A counting room equipped with counting equipment including a cultichannel analyzer is provided to allow detailed and accurate analyses of radioactivity in air, water and gas samples from plant activities and processes.
A redical examination program is prescribed fer all Cp Co e=ployees. This progra: is being continuously reevaluated, but currently provides for complete medical examination upon hiring or termination cf employ =ent.
This standard Company medical progra is augnented at Big Ecek point with special examina-tions including slit la:p tests and blood count tests for radiation verkers.
Annual _ urinalysis, a whole body counting progra=, or a combination of the two provides a basis for the bicassay program. Special treatment is given to personnel suspected of ingesting significant a= cunts of radioactive caterial.
The program for Midland plant generally follows the Big Rock point progra=.
A hospital in the vicinity of the Nddland plant vill be contacted and a pro-hj gra= established which assures adequate medical treatment of injured person-nel with possible contacination. This progras will be reviewed with the hospital periodically.
T-k3
()()I'.lk-
Periodic calibration checks of the area radiation =cnitors and portable radia-tion tonitors are made to insure that these instruments re=ain operational.
Effectiveness of the shielding provided th oughout the plant is checked thor-oughly during the initial step-by-step approach to full power operation.
Routine radiation surveys will provide a continuing check on the shielding adequacy during plant operation.
76 OPERATING CONTROL STATIONS All control panels, switches, controllers, and indicators necessary to start up, operate, and shut down both units are located in one centrol room. Control functions necessary to maintain safe conditions after a loss-of-coolant acci-dent can be initiated fro the centrally located control room although =any of these are initiated auto =atically. Essential engineered safeguards functions can be controlled and conitored at locations other than the main control root.
Controls for certain other auxiliary syste=s are located at re=ote control stations when the system controlled does not directly involve power generation control, such as radvaste and screen wash.
7.6.1 GEF:RAL IAYOUT The control root is designed so that one can can supervise operation of the plant during nor=al eteady-state conditions. During other than nor=al operating conditions, other operators are utilized to assist the control operator. Perti-nent instrumentation and control devices for start-up, shutdown and nor=al and (n
emergency operation are located on the control console and the vertical control panel. Most of the essential instru=ents and controls for power operation are on the control console.
The vertical control panel contains instrumentation less frequently used than that which norcally requires the operator's attention during start-up, before the reactor is critical, and during shutdown. The instru=entation is arranged in functional groups on the panels.
7.6.2 INFORMATION DISPIAY AND CONTROL FUNCTION The necessary infomation for routine conitoring of each nuclear stea= supply syste= and the balance of the plant vill be displayed on the operator's console and the various vertical boards located within the control root.
Infor=ation display and control equip:ent frequently e= ployed on a routine basis, or pro-tective equip:ent quickly needed in case of an emergency, vill be =ounted on the desk-type console sections. Recorders and radiation monitoring equip =ent vill be counted on the separate vertical panel sections located behind the consoles. Infrequently used equip =ent, such as indicators and controllers used primarily during start-up and shutdown, vill be counted on vertical panels.
Infor=ation available in the control room vill include the following:
a.
Information fro: inside reactor building.
(1) Reactor coolant pressure NO (2) ' Reactor coolant flow.
O (3) Reactor coolant te=perature.
7_a 00 9
p/
(h) Pressurizer level.
sU (5) Stea= generator level.
(6) Stea= generator pressure.
(7) Core flooding tank level.
(8) Core flooding tank pressure.
(9) Reactor building e=ergency su=p level.
(10) Reactor building te=perature.
b.
Infomation fro outside reactor bdilding.
(1) Reactor building pmssure.
(2) Feed-water flow.
(3) Reactor building spray flow.
(4) High-pressure injection flow.
(5) Low-pressure injection flow.
(6) Berated veter storage tank level.
7.6 3 SINARY OF AIARMS Visible and audible alam units vill be incorporated into the control room to varn the operator if unsafe conditions are approached by any syste=. Audible reactor building evacuation ala ms are to be initiated from the radiation moni-toring syste=, or =anually by the operator. Audible alar =s vill be sounded in appropriate areas throughout the plant if high radiation conditions are present.
7.6.h COMMUNICATION i
b/
Station telephone and paging syste=s are provided with independent power supplies to provide the control roo= operator with constant co==unication with all areas of the plant. An interco==unications system co=on to the control roo=, the fuel pool area and inside the reactor building per=its talking between these points as an aid in the fuel handling operation.
Co=unications outside the plant are through the local telephone co=pany.
7.6 5 OCCUPANCY Safe occupancy of the control roo= during abnomal conditions is provided for in the design of the auxiliary building. Adequate shielding is used to =aintain tolerable radiation levels in the control roo= for MEA conditions. Provisions are made for the control roo= air to be recirculated with =akeup air filtered through high-efficiency and charcoal filters. E=ergency lighting is provided.
The potential =agnitude of a fire in the control room is limited by the following factors:
a.
The control-room construction is of noncombustible materials.
b.
Control cables and switchboard viring are used which meet the flame test as described in Insulated Power Cable Engineers Association Publication S-61-hC2 and National Electrical Manufacturers Asso-ciation Publication WC 5-1968.
t,O c.
Furniture used in the control room is of =etal construction.
\\ )
7 L5 00*M
/G l
\\_./
d.
Combustible supplies, such as records, logs, procedures, manuals, etc, are limited to the amounts required for station operation.
a e.
All areas of the control room are readily accessible for fire extinguishind.
f.
Adequate fire extinguishers are provided.
g.
The control room is occupied at all times by a qualified person who has been trained in fire extinguishing techniques.
The only fla==able materials inside the control room are:
a.
Paper in the form of records, legs, procedures, manuals, diagrams, etc.
b.
Stall amounts of combustible caterials used in the canufacture of various electronic equipment.
The above list indicates that the fla==able materials are distributed to the extent that a fire is unlikely to spread. Therefore, a fire, if started, vill 3
be of such a small magnitude that it can be extinguished by the operator using a hand fire extinguisher. The resulting smoke and vapors vill be removed by the ventilation system.
' T.6.6 AUXILIARY CONTROL STATIONS O
Centralized controls are located in the one control room. All controls and 1
- instrumentation essential for safe operation of the plant during nor=al and abnormal conditions are located therein. Essential engineered safeguards func-tions can be controlled and monitored outside of the control room in the un-likely event the control room becoces uninhabitable.
Auxiliary control stations are provided where their use simplifies control of certain auxiliary systems such as radvaste, screen wash, chemical addition, etc. Sufficient indicators and alarms are provided so that the central control room operator is made aware of abnor=al conditions involving remote control stations.
T.6.7 ENGINEERED SAFEGUARDS
- The primary objectives in the control room layout are to provide the necessary controls to start, operate,.and shut down each nuclear unit with sufficient infor=ation display and alarm monitoring to insure safe and reliable operation under nomal and accident conditions. Special e=phasis will be given to cain-taining control integrity during accident conditions. The layout of the engi-neered safeguards section of the control board will be designed to minimize the time required for the operator to evaluate the syste perfomance under accident conditions. Deviations from predetemined conditions will be alarmed so that the operator may take corrective action using tne. controls provided on the control panel.
A t
- xJ 7 h6 y
(P
[
7.6.8 sysTm EVAWATION T.6.8.1 Infor=ation Available Post-Accident The infor=ation available to the operator in the control roc = following an LOCA vill depend en its source and the extent of the post-accident damage. All in-for=ation available frc= cutside the reactor building (7.6.2) vill be available post-accident. Infor=ation frc= within the reacter building =ay be available following the accident, 7 6.8.2 Centrol Roo= Availability 1
No. al operation of the power plant is from the control roo=.
This room is specifically designed to pemit the operator to perfor= his duties under all credible accident conditions. The forced abandon =ent of the roo is not dee=ed credible for the following reasons:
The control roc = has been given a high priority for shielding frc=
a.
external radiation frc= any area in the plant.
s.
b.
Nonfin m ble construction is used in construction =aterials and all interior co=ponents, ie, control boards, furniture, etc.
Adequate fire-fighting equi; cent is available in the control roo and c.
operators have received fire-fighting training.
O 4
d.
Self-contained air-breathing equiIrent is available in the control
(\\
room for operator use.
Cables and switchboard viring have passed fla=e tests as required e.
by IPCEA Publication S-61-hC2 and NEMA WC 5-1968.
f.
Cc=bustible =aterials in the control roo= are kept to the =inicu=
required for nor=al operation reference and records. Pe=anent plant records and nonessential reference are stored elsewhere.
g.
Accessibility to the control roo= is frc= three points, thus insuring entry for e=ergency personnel.
h.
Fireproef or fire-resistant doors are installed on all rec =s adjcin-ing the control roc = vhere significant a= cunts of ec=bustible caterials are stored.
1.
The control rec = has its own independent recirculated ventilation syste= with provisions to supply =akeup air through high-efficiency and charcoal filters upon incidence of high airborne activity ex-ternal to the centrol roo=.
k a c m a e.
Y th e JO 7-h7 i
i
_,3
O i
CHANNEL g
CH ANNE L CHANNEL CHANNEL 1
2 3
4 I
HIGH NEUTRCN FLUX HIGH REACTOR OUTLET TEMP HIGH RE ACTOR "0R" "0R" "0R" "0R" COOLANT PRESSURE i
g GATE GATE GATE LCW REACTOR FOR FOR FOR FOR COOL ANT PRESSURE TRIP l
TRIP TRIP TRIP HIGH REACTOR START-l UP R ATE (celan 10 g
per cent rated pwr.)
1
=
LDSS OF RE ACTOR g
COOL ANT PUMPS I
INPUTS TYPICAL OF l
L/
ALL FOUR CHANNELS I
I TRIP I
TRIP TRIP TRIP RELAYS I
RELAYS RELAYS RELAYS A
I B
C 0
1 l
l
_J 2 OUT Or 4 2 OUT OF 4 COINCIDENCE COINCIDENCE F
o R00 ORIVE ROD ORIVE I
P0tER SOURCE NO 1 POWER SOURCE NO 2 BREAKERS BREAKERS l
(A}
REACTOR PROTECTION SYSTEM BLOCK OI AGR AM l
(){}))/
Figure 7-1
[f. fili lf tllltllllljll$1]lf jllfilij allif tl!lIl.j j)1
{,'*1..l llllljjjllllllgllll]
w e.m i
i i
j l
4 H
G 1
F W g E
SERVICE WATER IN f
d i -- 1r D
1 C
B
> J e a,8 3
1 x
l 1
I 6
i a
e
Fil1111!J1)!!!!!
FI'! ! ! ! ! ! ! J ! ! !
t r"1 mt j
I I
i t
4 r
CERCSOR B UI L DING CODE 8% UPd T3 G
J
%.)
m m x
l
-e F
b
+
SE RVICC WATER
~
_U
)
m
-e s
v s
" ~
9 9:;
r C
-e B
WCLAND PLANT CONSUMiss POwtB COMPANY OG?.99 rue miaca> =
A p[KTDR BiADN~, CCCLNG SYSTEM
=
F1G '6 '5 g
I
- 'I gu ce tot 4:
a o
u
,-0.... a.
A-
, - -.. ' -. c;
/-
h[
i PC.i t L
aavi s,-PP t,
.c,
@ 'I
'2
-T-
- 10..
0......
a PRE bdP ase t s,, [ B t u t,410s
,,0....a....
P0=( 8 SuPPt f patt LOG e
,, a.
.P o s... <
- , 4) g..
SU PL1 s
P i
I 0,,,.
i o.,
apet g y g g e g
ta t, a109 E'
e, 3 timite=Egn ait pasGEI P0ett 70 t ? d RE CONCEE RAI!
- hPPL,
~
P0 met
$UP PL T f"
i 0,,, i._
es-a
,,g,,, g e g
ta rt a f00 0
l I
(,ette.tos art sauss i
8 P0ef t lisPPLT a
70 P0eti avEaast atCOR0fl adCT, TEE
'~
4 auf Ra=E P
a k
- :,j e
q
- Listat P0st Post e l P0eER F
$UPPt T w
g L, stat 70ett h
kf l P0ett Meet l
SU plt P
-C POtf 8 844GE Chaam(LS
(
8I 1,,f Lssf as Poete g
70=f e P T H
i 7
g LLtetta Po O
}g f
e PCett
- 1 PCs..
1
,s' 003. 0
-PP,u 0
4 t
E
~
\\
G I
i 3
i. ? I s..,,.~
I m
9/
t i. :i-
.i,,..,.,....,
i
?
=
- I II'
. :i 3-
.o.s fe.f.
Cl>#vT 0.=ICfED TO a $i.EtE, sat a f10 ou T,.f fD
@'t"EII e 6.at t El CDs.ECTsC.
siestl ' SQL af ED D.7,8 T. a
.T
.JFf E.
Q I
/
I
- . ;.1 u....~
+
1 0
- M p
I l
Se. a 3 Elm i
O*
Co.l.0L f.e
,0.f.
Q)D 5
.. 0.,$,
.T9 45 w
ps-s to es @
l 00
..su.
i
,4-
....5, r
vp a5 p... @
-s e.<....
e -.... <-m
. C.
n.
h
- FO. CO.T..af ro. 5tE Fisu.E,-2.
4 H D 7,'"',
- z..,. - e O-
- ! *HD T,%
...e.. e
_ Co.,-.
'".TT" NUCLEAR INSTRUMENTATION AND 003CdROTECTl0N SYSTEMS
.. Figure 7.-2A
E e
s I
e
.C l
l
...e
=,
=
se0. i,0 t.,
e.
=,
.C
.s..'.'
,, - - =,
.C to l>=>
..C m _-
4.
=. - w m
I i
1.
I C'
i f---{'.')I[I i
{.s.
=: ce l
.0L,.6,f I
I Cl I
.C i
L
[T.a.rgues 1,
t.
t,s m._,_g e.....
1
, n-t-
T -,
g._.._...ys ;.;
1,,,
==.
I
.c
..D..
.C
[
l a-
_.., a. -
y
.... ses. 6
}
+
00P.02 i
s
.r-e-n.r
~ <
w
.e--,,-,
c-
-r, y
r, a v e,w-,
--.e-,.
,<r
,v.-,
r es,-
a e
}
I
}-
... :,;. cm.
, k e t.m,,, s 56.,
_.p
--La
- :.,..o J
h
(>
O l
......c,i-i..-
.u.
.m.
- u... t,m.,
..:u e
.,,os..
0 J
g q >
,3;.:...,
ii.
. Ff.19
,0 f.
g g
tua
- r,'
,o, s
n
,,~
1 1.,,- 1 l
....m f.0 4., E
. 01.,.tg.w I
I.,,
" N *"=
[I,,",
' " ' ~ " " -
I '" I,',',
!"s0>..g4
~ "'
o I
T.,
7.I i
co 7
i y.n
.,4
.o
.n 1
i
......d
.. i
.u,<
.a =
,......a,.,..<.,,.,
9_,g i,,._
e
,a
- 1 1"
1 1
I...' I..".
a I.,, ;,,.,
S G'>.g.*
=-
,I..
I.,,, I,.,
e.,
7 i
,..m.,
i
.n
.s.
+.
,, u.m.i..,...,
c;;,* *;r;r x%*
ll0 "."TP."."L,
,u.
au -
o
,m,,,,....,.-m.,
..m.1,.....,,,...
(3
.......... m,.oem m.......,
, JC
[CI.1.C,0. C0s t NUCLEAR INSTRUMENTATION AND PROTECTION SYSTEMS' Figure 7-2B I'
00303
E
(.
PtiftRRED P0=tt 50usCE o I t ultitRLD 1as ( c.; &a ps PR[Flas[D Postt $h tCE e 2 O,
C Ok p
Pe[FitaED poser $0cRCE s 3
,,, it.re,e.rt see.ce..
9; Hl IF n -.
t_
Ri R.
111 2Al RI E
l F-1l n4 R2 RIO g2 IA2 2A2 n-T T
ll il LJ R2 Rn R3 143 243 T
ll ll n-.
LJ Ru R12 R4 114 2 14 Los RE ACTCR PRE 55URE 1 D M'0_ _ - - _ _
S Hi l!
R$
R9 188 258 it 11 g
is il g
R6 RIO R6 II2 202 r.,
i; U
R Rii iB3 283 p
11 g
i t, u
R8 Rf2 I8a 284 g
lcm Reactor PRissuRE
< 200 P SIG R9.R,0.R it R12 TRIP OPtn OR MiGM
~-
Ri&CTOR Bu tteikG PRESSURE s.
00304 3
J l
a EEGitEERED spEGuato$
CosTROL FCutR PBEFERRED P02E4 g,,,
$3uRCE 8 2 9
Bl$1 ABLE TRIP Limit h
In0EPEnDENT REDUn? Auf CNAnnELS TO EWIPMEnT C0hTR06 REtat$
2/4 LOGIC l
REL ATS I
148,842.113,144 wi PRE $$gRE isJECiton I
y,,,, 1 1
e e..,
EITutR/CR 3
PUMP I 3 2/# LOGIC 2Al, A2 3,2A4 MB PRESSURE imJECTion A_
l l
8 2
l 2/4 LOGIC I
RELAYS 18 f, l B2.183,184 Lou PRES $URE luJECTION i
3 ElinER/OR 2
l 1
I Ya
- e~
TYPICAL ESPS VALVE CONTROL ARRANGEMDT 2/14 LOGIC
'#ELATS 2Bl.292.283,28is LOW PRES $URE IEJECTION NUCLEAR INSTRUMENTATION
' AND PROTECTION SYSTEMS 9-00M5 Figure 7-2!
O
I u",, i v ; i,( i f *.,,.. i.r. ' f.l.. !.! '.... r. !.' t.! '. !.! '
{1 I ! I 1 l I.!.I.I I I I I I,' k i
- ~~
c=
I H
G PT N
f"
'T F
PT Mi'# RE ACTOR bv1LDWG PEE 55URE E
RY
~
R1 y
RT C
HIGH RE AC10R BUILCNG R ADLATION 8
A n n
- 7 4 '5 "'
UUe ii.O
\\
1 l
7 l
6 l
E
~
l
.f
.I f
.1 4,i.i
.l.i -l *,!,i
[,~
i I
.t
.t l ) l l
,g
{
- [rrq
,t
,i 5:2t 8 r
m 2_
I l
i H
STARI RE ACIDR buiL D44G G
SPR Av PUMP $
~
r,E ACTO 3 0'JLDNG H'3M W8 $1ont f,IAfri RE Acygg C tm NctCI NC E BUIL DF6 g
EVER5 CGfrERS
?
~%
F 1
&[ N REAC1CR BUILDING SPRAY WALVE S E
CLOSE RE ACTOR BUIL DING iSOL ATION BALD E S D
REACTOR BUILDING CLOSE RE ACTOR hGH RADiAflON BUILDING CCINCM NCE iS OL ATICN 2/4 VALVES (TYPE !! I x
C NUCLEAR INSTRUMENTATION AND PROTECTION SYSTEM FIGURE 7-20 8
mDLAND PLANT CONSUMit$ POwlt COMPANY NUCLE AR INSTRUMENTAfiON &
PRCTECTION SYSf EM g
FI6 7-20 u
s i
4 l
3 l
2 i
i
m l l !.'.: ! ! ! !j._. d.'
i.
i i
I l
l 4
H TYPCAL Et A:' A thDu KT 4 >E 6 4tE C :50L A' o. vAlv t CL
!eC N.
- p 4
- \\
lf-.-
- y
- \\
l }C_
I O
H F--
,,o IF 0
11 11 b.-
F rm 1
T s Ow e- - -,
scu r
ENr,i'eE E R E O E u CERED
~
SArEGOAR;s
- gni, WELA%5 p; AC%s'C%
ACT VAT m v
$Y$7E M l
5 f 5'E M
+4 Q C*E N SitiS u j
I Q CtosE t E
,i ii II+ L 5 W ll STCF CLOSE 78 T 5 m>m =
. d.
ll 3
'~~
~
C o?
OPE N 3Le 1775 Hl 4
- j W j
=
' - +w 5Ls
$N1?C45 ANO CONTACTS SHOWN #7H bAL<E P4 FULL O'tN NSITIDN C-Mard CONTACTOR ClosN 0-MAeN COMACTCF CPEMNG C8'-CONT TA REL Av CR2-CON r,OL sE LAW i
TS ?ORWE $wf?CH LS4 MT SMTC M R-?*eE RMAL O.'EDLCAO RE L Af 1MT 5MTCH CONTACT DE v'tLOPMt NT h ALVE tNTE RME D4TE j vAte t CONTACT CCNTACT!FtA t CPEN vat #E PCSITION rutt CLOSED rm:Tr*
i T
iCLOM D CPE N OPE N T MM 5W EPA55 g
2
!CtOSE D OPE N OPEN SPAEE a
3 i 36E N CL%ED CLO*ED C* t N L MT 4
.r*E N C(C5EC CQQC CtCg_0_WO t1 5
C'E N OPE N
. CLOSE D TORAE $* 95 M55 I
6 CPEN 08E N IqtC Ep
?ME I
7 C LD'{ D CLOSE D t OPE N 59Aet l
9 C LOSED CLO'iD i O*E N PEN $NDif OPEN*S TORQd $#TCH-OPENS ON MECHANCAi l
37 i
owe RLCAD IN OPE **NG 0*E CTON p
CLOS 6NG TONQUE 5*liCM YENS O'd MECHA% CAL i
gg CvEE LCAD sN Ct05WG DrEE CTK'N u
1
^
.)
00108 8
t 7
l 6
M I I i
5
,,,i,' f
,f
,1.!.I
,I 7 i !
I i 1 I iii r[T rT1 1
,I
.i
,i lizt E I
e I
I t
\\
H r
CPN1ROL Ci CUf7 FCA A MA* E UP Pump l
k bE ACLE BLEb $9A f PUt4P 04 DL C Ar ME A? ItE W)wAL PtpaP CT C1 R
rp mn l
m,.
MOTOR Cf G
m L
50 50 h
50 51 51
)
l F
E-a+ 1 1-@
+
1 1
CR1
- j;CR2 2 51
-j FRW il E wwr0
- es
_ Se h
SArEGAROS pi; i
- ig6
'~ 15g ACTUAfl0N L
$v$1E M
_l L
l
+ - -,
j 125 v DC F Rou ! TAT ON E
+ 146 E NW E RE D i
BAT TE 5Pr 1AFEGu RDS d kN'
@ OL ACTUAtl0N I
SY51EM
[
(C)52 cc)si O'"
11
--U T*
T' 4-3 D
CONTAC1$ $HOAN IN THE OE EMRUCED POSCON CRT ff0NTROL REL Af CR2-t ONTROL REL Af CC. CIRCUlf BRE AKER CLD5tNG COL TC CIRCUT BRE AMER 1 RIP Cost 50-IM1At+1ANE OUS OVE RCURRTN1 RE L Av 51 -14 ChE RCURE NT RE L Af N CACuif BRE AKER CONTRot
$wtTCH 52CC-C8Culf bHf AKER Ct?seO Cat MIC-(sRC'JI EWEAnER TR9 CCIL
=[ th -CtRC'JT BRE ARER AuxILLAFtY CONTACTS
'52-EhCL.AT BRE APIR AUWRLARY SMTCH 18 6-IdJX L IARY Il@'PtNG REL At C
50$$-F45T GROUND SE NSCA NOTE CR2 SHOWN DCTTED is USED
' ONLV WHEN REDUNDANT CONTROL IS REQUIRED PCAL COHTROL CIRCUITS FOR ENGINEERED SAFEGUARDS EQUIPMENT FtGURE 7-3 8
mlDL AND PL ANT CONSUMEt$ PowtR COMPANY
- } f ITPICAL CONTROL CIRCulTS FOR v...
EWNEERED SAFE 6UARDS EQUIPMENI P
A FIGURE 7-3 5
l 4
1 3
l 2
l i
N 1
)
%/
108
- 114 Design Overac er
-107 5
- 107 N
Reactor P:aer Level De. nan:
- 113 g=
us-. Weg:aa t! Derand
- 114
- 111 105
- 110
- 107 5
=
103 N o 107
- 103
- 1. i m i t
- 103 o
- 107 d - 100
- 103
- 100 5
-107 5 e
- 107
- 105
_ - 101 N O
O o
m _
timit i ra I
e e
e a
v u
u 1 03
=, -
=., -
=.,
n n
n a
- 100
?
108
- 102 (V
)
0 0
2
- 107 5 s.
I I -
- - 103 Nd
- 107
- 1 01 Limit 2
~
~
i -
6 -
- 100 Yad l'mit n
5 S
a -
- 99
_ m
- 98 i
Y - 100 O
O O
O J o.
a.
a.
a.
=n A; - 103 N
- 97 o -
g o
u U
U W
4 2 - 90 0 -
2 -
2~-
L
- - 96
(
=
=
=
= -
o x
g V
V c
u yg g - 35 3
y -
n n
n n +
=
U U
U U
6 6 -
65 _ 100 E - 31 6
=
=
=
= -
l l
- 93 i
i
- 90 02
- 91 l
i 9eactor Trio at 107 55 : 0 5', heica ted Poaer T
RE ACTOR PCuER 4EASUREVENT xv ERRORS AND CONTROL Ll4lTS 00 ~. il risure 7-1
O 620 Reactor Du t ie t Temperature 600 I
S team Temp.
s 580
\\
l I. Reactor Average h
~
Temperature a
b)i 5
560
~
[
Reactor Inlet Temperature 540 T
at 925 psia sat 520 0
20 40 00 80 100 Rated Reactor Powe r ( 2. 45 2 MW t),
f, REACTOR AND STEAM TEMPERATURES h)
VERSUS REACTOR POWER
%.J OOT111.
Figure 7-5
o I
\\
TO OTMER C0hTROL POD ORIVE G50VP5 AU TOMAT IC CONT ROL ROD
---~
SEQUENCE DRIVE GROUP F---
LOGIC e
\\
l l
Top Teg i
i I
STEAM l
STEM GENERATM RE ACTOR GENERATOR ge 4 l
FEEDeATER go, g l
l j
Tc 3e
- 2e i.
l AVERAGE l l
R; j
UL, I
I N
A7
{
- d p
d ggg gg y COWPARE
~ --
gop,m R DE A C B Alg.
0 0:11.2 h
i i
l t
I t
STEAM L EGEN D
- RE ACTOR COOL ANT SYSTD4 STEAM SYSTEM
~-
CONTROL SYSTEM Tc. RE ACTOR COOL ANT SYST EM COLD LEG TEMPERATURE Th. REACTOR C00L AhT SYSTEM H0T LEG TEMPERATURE FEEDIATER T AVERAGE REACTOR COOL ANT SYSTEM TEuPER ATURE IT - DEVI ATION OF AVERAGE TD4PER ATURE FROM SETP0lNT E,.1E ACTOR PonER LEVEL ERROR.Nd.Nj 3d. ROD VELOCITY DEMAND Ujd* UNIT LOAD DEMAND
~1e N) - REACTOR POWER LEVEL Ng - RE ACTOR POWER LEVEL DEum0 t00P No. 1 Th g II AVERAGE Te,
y I
__ __J AVERAGE AND COMPARE LOOP NO. 2 Th g
2 l
I2 AVERAGE Tc T
2a ET
'*2 REACTOR CONTROL DIAGRAM -
INTEGRATED CONTROL SYSTEM 00'MT$
Figure 7-6
i O
i 4
/
i a
1 e
2
/
E L
2 1
5
~
[
0 t
I t
I 1
t I
t 0
25 50 75 100 0
25 50 75 100 GROUP 5 POSITION GROUP 7 POSITION t
I t
I t
0 25 50 75 100 t
GROUP S POSITION Distance #ithd rawn. e
/
AUTOMATIC CONTROL R00 GROUPS-TYPjCAL WORTH CllRVE VERSUS DISTANCE WITHORAWN 00?i.4
" " ' ' 7-2
s e---
{
p s
f.$
l m
t_.._
L CS5 0F l' a 'O' I CM '* * -
1055 Of f f C'# C L C&;
.g a*
- c. C00t aa f f tce siffeatge sgae.ta tcp Peet* uala seCl 21PLlt
-~f~wR f,
r3
(
A A
f C0s e0LLff j f Contpott[a
_q v
1 i
....i.,
.'f ail 3Pif D C % M v aa f T st a e ca ccA ant !
a acJ,
i.i c. i ~ r r...:,. <,.. i I? j at i g i t'*f 8 &'v 3
}
LOe filkatga f 7,
l Tfis*(tais t tivitj e
8 7 8[11*;t! L w.f l
c c.-,.,
)
~
ITf aw Cf.f ear;a
(,
l Livt t t owet I __
_A oo,+,n; s r
\\
sitD ta.*E
- '845 l
t%F tXP l
y ua q
[..
7 ',
'i f's
~~1
,,,s,,,.
i IC L_C.a r_i.* *
.n o.0.. l 1
l
_a.3,
.., i....,
ee 6.e a r t r g es.3 Im
- e.,, o p i -. n..r.
3,
_l
.....m..,..,,.,......
A s s,wf !. i. etg
.im3a c e i I Gt 4; 6,4 1 6 ta? Cf.t; 5x. $ist[w D,$P a *Cn (g ett.
j
.....,,.i.:.
,,.,,..., s s.,
l P
. S't as s[ht D A'M P.8 5S AL l
,,...c a ss....;,. c,,,,,s..,...c.
- e..,, e., i,.. ;
n et sue. u.. a
.,it:.....
,,c.
1 m
, wa te n, 111 PC i t'
)
. &. wan a. A gt s.es t t (
L
, $116e GE st.aYpe (g yt g j
I.
t
..f t;YC. outt g f it.sP t. at u tt St[*$,,m..
i
> Fit pos't. f t..f eatw.t J
I'
< ot a, f if t. A T E. Ot w.*'-
.f i. 4 4C10. C00t att sto.
f.t havet. Strg$t.ip f 3 at t ia to L OOP t shD 100 2
,i. ua..~.
lD taf ie C0e t.0i
._._/- ',
...o;. m.. -
.ic
,,c....,,
IL n
i
{....., m..,,.... ;, m
., r 7
i
~
k LQ]
- u. en:....
......., m. 3 l
.. ~,
1
..n I
l j
- c.,. s. o.
l
- 3.,.. a i..,4 1,
,,.i. o.,
STEAM GENERATOR AND TURBINE CONTROL i
DI AGR AM INTEGRATED CONTROL SYSTEM j... ;.44.
i c. ~ " ' ="
...e.m..
F.igure 7 8 t
.e7 h344,i. o J
- _ _ = _ _ _ ~.-
1 l
i ji
)
1 I
10 10 1
1
-10' 125 109-100 j
-5
-10 g
0 10 10 o
.1 a.
l 6 4
=
7 10 1
a --
1 1
e 10-7 6
ea 10
.e i
. 8
=
g c
10' o
[o g
-- 106
[
a 0-9 o
10
-o 105 3-40-10 E
3
.E.
10 4
3 10
_.10-11 5
10' oea 3
U 10 10
~
=a 2
10 E
1 eo0 10
-1
=
10 1
2
.2 y
10
=
n
=
a:
-. _ 0.1 e
=
B E
2 ou o
the o
O M M E if q
\\
NUCLEAR INSTRUWENTATION FLUX RANGES Figure 7-9 1
OORt7
O i
PC CIC UCIC
- UCIC
/
. ', a 4
4
'O 4 &
,p 9
e, p-4" 44=
4
?-
UCIC UCIC CIC PC LEGEND PC - PROP 0Ril0NA L COUNT ER - SOURCE R ANGE DETECTOR CIC - COMPENS ATED ION CHAMBER - INT ERMEDI ATE RANGE DETECTOR UCIC - UNCOMPENSATED 10N CHAMBER - POWER RANGE DETECTOR NUCLEAR INSTRUMENTATION OETECTOR LOCATIONS Figure 7-10
()D;l i 8
E
.31 i
i i
i c
m...
9 l
8 u...
- o J
e,r :,3 c
+
a A
(.
Q t,
.4
+-.4 1
-.6 J
- 8 p.
, m Y
='
L$.
g
%a
'. s
. nu.
- ;'/al rv n - ((~:
5,,
e e
V 6.
8,
s &
f,_**
- ~v***
C I
f g
4 fe A,
'... d e
p.
.:r.,
se
\\ Jsr
.n a
Y i
a u,s, e
r-i a-I O
,e, e
t t
pg,,er',.e
'"**I g
s gg
.a
~ ~
d
,.i.,...--
,r--
v ie,
u.----..-
i
......__.-,---c.--,
,s.--.c.-.
i i s.....
'. d..... >)..
i e
a e
e.
y t '.s t s.e s
e I
e e
e 8
e t
q e
l 5f g.
l u...'.....a p.. m...., o.s a,2
- g-
.y.
3y. g (f. 7l. j f. ;
j 8-l 1
1 1
1-,,
e
,j
- 't
,.. 4*
m n..
8 i
s.,,
I
. e.
tw],
p ve h.
e e
l V
(X n
(
{-
t r.......,
l
--4,-...._._
I 5"l's.
6 L..
t 6
c j,
i
-e i
l I'
,,9 4
g 6
8 e
l g
e 6
i j
t 8
i 0
e 1
l l
0 l
e
.+ ---- ---
.l.
a e
0 s
l I
f l
MH l
4
+
I l
e e
L 1
f i
i
.n.
.,y,,,
I ta h,.m '
I a
y I
i 0
4 e
l
'.-.4r
.4. me 'w y
l
,- --;;f w.m..
L l
~...
G.A g
~
8 l
se.
i 8
4...--------------------.
k 4
I h h i,. kj e,,
I
~
I I
i o
i i
i u
a s
s.
~s-
~
+
w
.~...r.
.~
's
^l=.:
.. T,:
',.m..' rwp,.g$.
.~ e-l
~... ~,
4 t
r y
\\
.e Fes s
i f
I p - :m ** :
i W-. ll..
vi e I
i i
i 1
i
=
l 3 se
- a. es.
l l! t i. - -
+
g 1
f h'..l {, C '.
i
-4
{'y i
j
' -a f
.'y--
j.
g
}
D'..
j l
b
.ve.
l i
}
I i
e 8
l I
i 1
.-.S.
i
,.)
1, j
i i
- ~
e n se.n o
- m.
me i
i 3
j A
e tsei.se 9
(L.. _* *ia:s. _.,_' L.
I i
+
i.=
a c. m. a r
l'
_ _ J.,,l e,
s.
{,
Y. -.... _ _.. _ _ _(_ / s ~
' l n i.e. e.,
,, - 1
-+
,1
.... f a
i f.' A ' -
l m
ll
-: =*
1 Q'
/
l'ae er T
n,e= to i
.I
.s d i
i e,
t
,3 l
t i
. - _. - -.. _ { 2,....... s[ _ _,
u' s' '
s.
r l 8 I
e 5 g s
e 4s i
I a
[
.ll l
8 e
l i
i i
l l
l., '
I a,
e
..i i
l l ' i 1
e se 4
..L..,,
! "C:
U y
4 l
e s
4 :
i l,8 l
I
\\,-in I!'
i,
s l
8
+v"lT~*
I M4 W:
^
e lj
- i 1
Q 4 Wl s,e W
,i l'
l e
t
- e i.
s,
s i
l r _ L _2. L t, l,'
M l. ',
.e I
t m* t.
,i
~~
. - - ~ ~
v Wi
.,a e
.*i wes
}; ' \\ _, -
_. -.k_ _ _, y my 7, - - - 7 'l.
e' su se
.a m,m S
ll Q*.-
m _ _ _,, _ j
'7
.. ___"._p r
,j
, - - - - * * *
- se.. e.s m
t;j v is
( A,,,
3
.r..
/
]
a,$_J.
.; c
,.._________-i
.t y
j
. i 7
......_......',t i[.. s
- f. A
__.e.____..
,,.m..
n, lv.
'Y,
3 y
- +
x l.,
i......
i
- m....
,i s.,,
1 -
m..
I
+
1 x
NON-NUCL EAR INSTRUMENTATI ON SCHEMATI C Figure 7-11 00?d0
O i
I i le, !
'Gi
! i !
l
! j 19 0
!@i i i
, Tetai core reniters l
'O I i ! 19! I I I basec en 1 4 core IS 99l l l lG! ! !
s ymme t r y G O 19
!91 1 ! !@l ! l 9
!,9:
i it; ! ! je!
jej j l9l j j jel O syneetry nonitors 19l !
9 el i I l9 I
9 Ol lG! _ _
.J l l9lO: !
I it!
I I ~9; I ! i e
I i !G i ;9l! Ii i combination total core
,p
! !O!
O!GlO! ! !O, and sonetry moniters l9: i
! l I iOl
{ l l 1 i M
o M
Is a
M
- itlAL FLUX s
g
{:
SHAPE ACTIVE CORE j
LENGTH i
s E
I T
4 4,
j EACKCR0ut40 DETECT 03 I
L OC A L F Lill DETECTORS 1
l ItJCOR E DE TE CT OR t}ly ? ]j.
L OC AT l at:S Figure 7-12
__ _..___,_.__._______ _____ _ ____ _____.___ _.._.__ _ __ d
_ ~. -... _.. - -
~
l.
i 2
I I
i I
l i
j q
4 I
l t
i
.s i
{
e l
g
., 7 (LitfRICAL Comu(CT M 1
s'
+
2500 PSI stat i
3
-J l
1 m':L Wi Jb1LM i
I I Ij e suin run l'.
J 5
l
/,,
i 6
c j
=
...(
3 s
4 i
i l
i 1
I.
l l
i 1,
I I
l.
TYPIC AL ARR ANGEMENT -
INCORE INSTRUMENT ATION CHANNEL 00R'N.
Figure 7-13 1
..... -,.. ~ - _ - - _.... ~, - _. - -, _. - _ -,,.
..__,..a...-.-.,_-.__._..-_.,,,.,..-.-.-,........____...._..__.._.