ML20137X057

Proposed Tech Specs Re Operability Conditions for CRD Trip Breakers & Diverse Trip Devices

ML20137X057
Person / Time
Site:	Three Mile Island
Issue date:	09/30/1985
From:	GENERAL PUBLIC UTILITIES CORP.
To:
Shared Package
ML20137X035	List: ML20137X031 ML20137X047 ML20137X057
References
NUDOCS 8510040450
Download: ML20137X057 (6)

Text

. .

3.5 INSTRUMENTATION SYSTEMS 3.5.1 OPERATIONAL SAFETY INSTRUMENTATION Applicability

' Applies to unit instrumentation and control systems.

Objective To delineate the conditions of the unit instrumentation and safety circuits necessary to assure reactor safety.

Specifications 3.5.1.1 The reactor shall not be in a startup mode or in a critical state unless the requirements of Table 3.5-1, Column ' A' and 'B' are met. Specification 3.0.1 applies.

3.5.1.2 For on-line testing or in the event of a protection instrument or channel failure, a key operated channel bypass switch associated with each reactor protection channel will be used to lock the reactor trip module in the untripped state as indicated by a light. Only one channel shall be locked in this untripped state at any one time. Unit operation at rated power shall be permitted to continue with Table 3.5-1, Column "A". Only one channel bypass key shall be kept in the control room.

3.5.1.3 In the event the number of protection channels operable falls below the limit given under Table 3.5-1, Column "A", operation shall be limited as specified in Column "C". Specification 3.0.1 applies.

3.5.1.4 The key operated shutdown bypass switch associated with each reactor protection channel shall not be used during reactor power operation (except for required maintenance or testing).

3.5.1.5 During START-UP when the intermediate range instruments come on l scale, the overlap between the intermediate range and the source range instrumentation shall not be less than one decade.

3.5.1.6 During START-UP, HOT STANDBY or POWER OPERATION, in the event that a control rod drive trip breaker is inoperable, within one hour place the breaker in trip. Specification 3.0.1 applies.

3.5.1.7 During START-UP, HOT STANDBY or POWER OPERATION, in the event one of the control r'od drive trip breaker diverse trip feature,that s

. (shunt trip or undervoltage trip attachment) is inoperable:

a. Restore to OPERABLE status within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or

b. Within one additional hour place the breaker in trip.

Specification 3.0.1 applies.

h P

Amendment No. 62, 98

, 3-27 L

I i

3.5.1.7.1 Power may be restored through the breaker with the failed trip feature for up to two hours for surveillance testing per T.S. 4.1.1.

3.5.1.8 During. START-UP, HOT STANDBY or POWER OPERATION, in the event that one of the two regulating control rod power SCR electronic trips is inoperable, wit.hin one' hour:

a. Place the inoperable SCR electronic trip in the tripped condition or

b. Remove the power supplied to the associated SCRs.

Specification 3.0.1 applies.

.3.5.1.8.1. Power may be restored through the SCRs with the failed electronic trip for up to~ two hours for surveillance testing per T.S. 4.1.1.

Amendnent No. 62, 98 3-27a E______--__________---______.--________--.--_________---.-- - - - - . - - _ _ - - - _ - - _ - - - - - _ - - - - - - . _ - - -

Bases Every reasonable effort will be made to maintain all safety instrumentation in operation. A startup is not permitted unless three power range neutron instrument channels and two channels each of the following are operable: ~four reactor coolant temperature instrument channels, four reactor coolant flow instrument channels, four reactor coolant pressure instrument channels, four pressure-temperature instrument channels, four flux-imbalance flow instrument channels, four power-number of pumps instrument channels, and four high reactor building pressure instrument channels. The reactor trip, on loss of feedwater may be bypassed below 7% reactor power. The bypass is automatically removed when reactor power is raised above 7%. The reactor trip, on turbine trip, may be bypassed below 20% reactor power. The safety features actuation system must have two analog channels functioning correctly prior to startup.

The anticipatory reactor trips on loss of feedwater pumps and turbine trip have been added to reduce the number of challenges to the safety valves and power operated relief valve but have not been credited in the safety analyses.

Operation at rated power is permitted as long as the systems have at least the redundancy requirements of Column "B" (Table 3.5-1). This is in agreement with redundancy and single failure criteria of IEEE 279 as described in FSAR Section 7.

There are four reactor protection channels. Normal trip logic is two out of four. Required trip logic for the power range instrumentation channels is two out of three. Minimum trip logic on other instrumentation channels is one out of two.

The four reactor protection channels were provided with key operated bypass switches to allow on-line testing or maintenance on only one channel at a time during power operation. Each channel is provided alarm and lights to indicate when that channel is bypassed. There will be one reactor protection system bypass switch key permitted in the control room.

Each reactor protection channel key operated shutdown bypass switch is provided with alarm and lights to indicate when the shutdown bypass switch is being used.

Power is normally supplied to the control rod drive mechanisms from two separate parallel 460 volt sources. Redundant trip devices are employed in each of these sources. The AC Trip Breaker is one means to trip a source.

The redundant means is a parallel configuration consisting of two DC Trip Breakers and five SCR power supplies. The SCRs are turned off by the

" electronic trip relays."

Diverse trip features are provided on each breaker. These are the undervoltage relay and shunt trip attachment. Each trip feature is tested separately. Failure of one breaker trip feature does not result in loss of redundancy and a reasonable time limit is provided for corrective action.

Amendment No. 78 3-28 u _ _ - _ _ _ _ _ _ _ _ _ _ _ - _ _ - _ _ _ _ _ _

. . . . . g Failure in the untripped state of a breaker or SCR electronic trip results in loss of redundancy and prompt action is required. Failure of both trip features on one breaker is considered failure of the breaker.

Power may be restored through the failed breaker (SCRs) for a limited time to perform required testing.

Reference FSAR, Section 7.1 J

f Amendment No. 78 3-28a

1

.**g Channels subject only to " drift" errors induced within the instrumentation itself can tolerate longer intervals between calibrations. Process system instrumentation errors induced by drift can be expected to remain within acceptance telerances if recalibration is performed at the intervals of each refueling period.

Substantial calibration shifts within a channel (essentially a channel failure) will be revealed during routine checking and testing procedures.

Thus, minimum' calibration frequencies set forth are considered acceptable.

Testing On-line testing of reactor protection channels is required monthly on a rotational basis. The rotation scheme is designed to reduce the probability of an undetected failure existing within the system and to minimize the likelihood of the same systematic test errors being introduced into each redundant channel.

The rotation schedule for the reactor protection channels is as follows:

Channels A, B, C & D Before Startup, when shutdown greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />

Channel A One Week After Startup Channel B Two Weeks After Startup Channel C Three Weeks After Startup

, Channel D Four Weeks After Startup The reactor protection system instrumentation test cycle is continued with one i channel's instrumentation tested each week. Upon detection of a failure that prevents trip action in a channel, the instrumentation associated ~with the protecticn parameter failure will be tested in the remaining channels. If actuation of a safety channel occurs, assurance will be required that actuation was within the limiting safety system setting.

The protection channels coincidence logic, the control rod drive trip breakers and the regulating control rod power SCRs electronic trips, are trip tested

' monthly. The trip test checks all logic combinations and is to be performed on a-rotational basis. The logic and breakers of the four protection channels and the regulating control rod power SCRs shall be trip tested prior to startup when the reactor has been shutdown for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

Discovery of a failure that prevents trip action requires the testing of the instrumentation associated with the protection parameter failure in the remaining channels.

Amendment No. 78 4-2

TABLE 4.1-1 INSTRUMENT SURVEILLANCE REQUIREMENTS l CHANNEL DESCRIPTION CHECK TEST CALIBRATE REMARKS

1. Protection Channel NA M NA Coincidence Logic

2. Control Rod Drive Trip NA M NA Includes independent. testing of s, hunt trip and Breaker & Regulating Rod undervoltage trip features.

Power SCRs

3. Power Range Amplifier D(1) NA (2) (1) When reactor power is greater than 15%.

(2) When above 15% reactor power run a heat balance check once per shift. Heat balance calibration shall be performed whenever heat balance exceeds indicated neutron power by more than 2%.

$ 4. Power Range Channel S M M(1)(2) (1) When reactor power is greater than 60% verify imbalance using incore instrumentation.

(2) When above 15% reactor power calculate axial l offset upper and lower chambers after each startup if not done within the previous 7 days.

S. Intermediate Range Channel S(1) P NA (1) When in service.

I

6. Source Range Channel S(1) P NA (1) When in service. -

E 7. Reactor Coolant Temperature S M R j

Channel 2 8. High Reactor Coolant S M R

. Pressure Channel w

. 9. Low Reactor Coolant 5 M R Pressure Channel E3 l

l