ML20054C164
| ML20054C164 | |
| Person / Time | |
|---|---|
| Site: | Maine Yankee |
| Issue date: | 04/12/1982 |
| From: | Maine Yankee |
| To: | |
| Shared Package | |
| ML20054C161 | List: |
| References | |
| NUDOCS 8204200157 | |
| Download: ML20054C164 (2) | |
Text
f In the reactor protective system, four independent and redundant channels monitor each safety parameter.
If any one of the four channels deviates from a pre-selected range, a trip signal is initiated.
For any safety parameter, a trip signal from any two of the four protective channels will cause a reactor trip.
If one of the four channels is taken out of service for maintenance, the protective system for that parameter is changed to a two out of three coincidence for a reactor trip by bypassirg the removed channel.
When a second channel is taken out of service, the trip module for that channel is placed in the trip mode, and the resultant logic for that parameter is one out of two.
Thus, with one or two channels removed from service for that parameter, protective action is initiated when required and the effectiveness of the reactor protection system is retained.
The operating requirements for the reactor protective system are shown in Table 3.9-1.
Although no credit is taken for the high rate-of-change-of-power channel in the Maine Yankee accident analysis, operability of this channel at low power levels provides back up assurance against excessive power rate increases.
Temperature feedback effects protect against excessive power rate increases at higher power levels.
Redundant sensors and logic are provided for the initiation of all engineered safeguards systems.
In both the containment isolation and containment spray systems, two identical subsystems are used in each system.
In the safety injection actuation systems diverse sensors are used for the initiation of two identical subsystems.
Each of these three engineered safeguards systems may be operated as shown in Table 3.9-2 without jeopardizing safeguards initiation.
One subsystem may be removed from service for a limited time for purposes of maintenance or testing because it is highly unlikely that a failure of the coerable subsystem would occur concurrent with an accident requiring engineered safety features actuation.
The safety injection actuation system is initiated by two out of four pressure sensor channels.
When three sensors are operable the degree of redundancy, as defined in the definitions section, is one.
This degree of redundarcy is also provided when two sensors are operable with a third sensor placed in a configuration which simulated the tripped condition.
The minimum number of operable channels for the accident monitoring instrumentation is given in Table 3.9-3.
The accident monitoring instrumentation is used to evaluate and aid in mitigating the consequences of an accident.
3.9-2 8204200157 820412 PDR ADOCK 05000309 p
TABLE 3.9-2 Instrumentation Ooerating Recuirements for Engineered Safeguards Systems Minimum Operable Sensors Bypass Initiation No.
Functional Unit Per Subsystem Conditions Set Points 1
Safety Injection:
A.
Manual 1
B.
High Containment Pressure 3(a) less than 5 psig C.
Low Pressurizer Pressure 3(a) greater than
- 1585 psig 2.
Containment Spray:
A.
Manual 1
B.
High Containment Pressure 2/ set (b) less than 20 psig 3
Containment Isolation:
A.
Manual 1
8.
Containment High Pressure 2/ set (b) less than 5 psig l
(a) Two operable sensors is acceptable, provided one of the inoperable sensors is placed in a configuration which simulates the tripoed condition.
(b) Each subsystem is initiated by two out of three pressure sensors.
The minimum degree of redundancy in each subsystem is one.
i Reactor coolant pressure less than 1685 psig.
l l
l l
l 3.9-4 l
- -.