ML20151X461

From kanterella
Jump to navigation Jump to search
Forwards Div 671128 Rept on Instrumentation for Diablo Canyon for ACRS Review
ML20151X461
Person / Time
Site: Diablo Canyon, 05000000
Issue date: 11/30/1967
From: Morris P
US ATOMIC ENERGY COMMISSION (AEC)
To: Palladino N
Advisory Committee on Reactor Safeguards
Shared Package
ML20151W779 List:
References
FOIA-88-156 NUDOCS 8808250364
Download: ML20151X461 (16)
v • d • e


Text

,

pg r101 t ' il0 F U UI 'l-s gi ivin . UOL. Ulit.1 -

y Distributier:

Suppl. f

?I-B-5 Readin; Orid: 37r:nuth P. S. Boyd Docket No. 50-275 M/ 3 01:a Mr. Nunr.ie J. PallaA %

Chairnea, Advisory Casumittee en Reacter Safeguards U. 8. Atomic Energy Commission Wash.ington, D. C. 20545

Dear Mr. Palladine:

Twenty-four copies of a report prepared by the Division of Reactor Licensing are transmitted for the review by the Camaittee. The report is the section en Instrumentation for the Diable Ctayon report transmitted on November 28, 1967 Sincerely yours, Peter A. Norris, BLrecter DLvision of Reacter Licensing belesure:

ACRS Report (24 cys) e tr.h C0**"

ct.o t.;&#* % , _ _ ......---- -~

e -- -..... Lg.n.: t riciCf dasdit*M

,,J K CIN i l iI?r nut y w i m m,. v a viu r

]

on u > _N B.)- /.DRL... .DSL;M D% $2._...... _D3 / ._.. . . . _ . . . . . . . _ - _ . .

su=*mt >

Ifi6/dh/dr SLevine

-- RSSoyd P/J: orris 11

_ out> 11/.29../. 67

. . . _ . . ..1..11/... /67

.... . . ... ../. . /67 .. 11/

..-J j /.. 67 ..--

FWm A PIC-818 (Rev. D &D u s mam m m . ie tt. u 8808250364 000721 PDR FOIA NCNILLAOU-156 PDR

s .

m

(( 1[ T  ;

o ,

NOV 3 01967 50 Instrumentation and Control 31 Reactor Protection System The reactor protection system monitors signals from nuclear and process When an instrumentation which are indicative of reactor plant operation.

unsafe condition is sensed, the reactor protection system trips the reactor.

The Diablo Canyon reactor protection system vill differ from that provided It vill also differ for the San Onofre and Connecticut Yankee reactors.

The from that described in recent PSAR's for Vestinghouse designed plants.

changes were made to comply tetter with the provisions of the Proposed IEEE Standard, Nuclear Fover Plant Protection Systems and as the result of the Because of the high power density core and the use of partial length reds.

kncvn design changes, we specifically asked for additional information for our review of the Diatlo Canyon facility. This additional information was presented in Amendnent No. 7 Our reviev is based on the information as The results sub:itted and from subsequent discussions with the applicant.

of these discussions vill be documented at a later date.

The reactor protection system vill be designed on a channelized basis Isolation of to provide for isolation between redundant protection channels.

redundant analc6 channels villi ori6 nate at the sensors and continue bac through the field viring and containment penetrations to the analog protection racks. Isolation of field viring vill be achieved using separate wire vays, cable trays, conduit runs, and containment penetrations for each redundant channel. Redundant analog equipment vill be isolated by locating the equipment in four sepa 9te protection racks. The four racks of equipment vill be energized from separate a.c. power sources.

Each reactor protection system inctrument channel vill terminate in a

- OFFECHAL USE ONLT-

(YL b hfkh1 2

reactor trip bistable counted in one of the four protection racks. The trip The bistable is the final operational cospor.ent in the analog channel.

transition from reactor protection instrument channel identity to logic chanr.el Each identity vill be made at the logic relay coil / relay contact interface.

bistable vill drive two logic relays (C&D).- The contacts from the "C" relays are interconnected to form the required actuation logic for Trip Breaker No. 1 through d.c. power source No. 1. This logic network is duplicated for Trip Breaker No. 2 using d.c. power cource No. 2 and the contacts from the "D" relays. The tripping of either breaker vill trip the reactor. The two logic channels vill be mounted in separate racks thus providing good physical and electrical separation. The only electrical connections between the logic channels are at the bistable to relay inter connections. The minimum physical separation vill probably be in the manual trip switch circuit. The final design of this portion of the circuit vill be evaluated in detail at the operating license review for adequacy of channel separation.

We believe that the channelized approach and the proposed electrical isolation and physical separation ir adequate and meets the intent of the Proposed IEEE Standard, Nuclear Fover Flant Protection Systems (Sec. 4.6).

The tvo, three pole reactor trip circuit breakers are connected in series between two paralleled three phase, 260 volt, rod drive MG sets and the rectifier d.c. power supplies. The trip breakers control a.c. power to four rectifier d.c. power cupplies. The rod magnets are divided between four d.c.

buser each of which is supplied by one of the d.c. power supplies. The opening of either trip breaker de-energizes all four d.c. buses and causes all of the leds (except the part length rods) to fall into the core. The applicant believes that the large a=ount of power required by the rod magnets essentially 4Weht USE ONLY L

~

JCLJEA1!n015 ONLY e

ales out the possibility of a failure to trip due to a fault which applies a voltage source to the rod =sanet circuit. We agree that the power requirecents reduce the probability. We believe, however, that the multiple d.c. buses are important in assuring that the first detectable failure does not fall the system. There is a single three phase a.c. bus between the trip breakers and the d.c. power supplies. The applicant has stated that this bus vill consist of totally enclosed bus bars. We believe that the voltage and current requirenent (about 400 KVA at 260 volts three-phase) and the enclosed bus arrangement provides adequate assurance of meeting the single failure criterion.

We vill review the final bus arrangement in detail at the operating license evaluation.

The individual reactor protection channels feeding reactor trip signals into the logic channels are as follows:

Coincidence logic Trip Farameter High Nuclear Flux (source range) One out of two

- high level High Nuclear Flux (intermediate ran6e) - high level Cne out of two High Nuclear Flux (pover range) low power trip Two out of four High Nuclear Flux (pover range) high power trip Two out of four Lov pressurizer pressure Two out of four High pressurizer pressure Two out of four High pressuricer water level Two out of three Turbine trip Two out of three Two out of three in any one loop Lov reactor coolant flow above 75% power Two out of three in any two loops above 10% power

  1. M_OII.A_U wa . U_IE ONII3 1

k\b b 4- .

Reactor coolant pump breaker One out of one it any one loop opening above 75% power One out of one in any two loops above 10% power Loss of feed water flow One out of two steam-feed flow mismatch vith one out of two lov level in any stea= generator.

Lov steam generator level Two out of three low-low water level in any steam generator Overpowerd T Two out of four Over temperature dT Two out of four Manual scram The nuclear instz'amentation used for reactor protection is an out-of-core system. It consists of two source range channels, two internediate range channels, and four power ran6e channels. The power ra::ge detectors are long ionization chambers in which the center electrode is divided in two equal-sections. Each icng detector is in effect two detectors each equal in length to about half the len6th of the core. The ion current from the halves of each power ran6e detector is sumned to indicate reactor power and to supply signals for the high flux, trips. The ion current from each detector half is displayed The to provide the operater with a gross indication of flux distribution.

functional adequacy of the out-of-core nuclear instrumentation is covered elsewhere in this report.

The difference between the ion current in the upper and lover half of each power range detector vill also be measured. If the difference exceeds a given level, a si6 cal vill be transmitted to the over power AY and the over te=perature AT protection channels. This feature is provided for Diablo Canyon to protect the hi6h power density core by reducin6 the overpoverAT and over temperaturedT reactor trip settings if the power is unequally distributed.

17f O M A M U V O.pplT(l"3U

.o L11o - a wa va ue-

g\{

The overpower 6T protection is basically a fixed 6T trip. A hot leg and

e. cold le6 resistance thermometer in each loop supplies 4T information to a channel of overpower AT protection. The trip point is lovered upon measured differences in upper and lover signals of a power ran6e detector. Each of the four power range detectors supplies a signal to a different overpower AT channel.

The over temperature &T is provided to protect the reactor by respondin6 I

i tob T, avera6e temperature, and pressurizer pressure in the following manner:

A T Trip : O T constant -X y Tavs f y The trip point of the overtemperature AT protection is reduced upon unequal l

l flux distribution in the same manner as in the overpover 4T piotection.

l The functional adequacy of the overpower 6T and over temperature 6T s protection vill te evaluated after the final desi6n and analysis is completed.

Each instrumentation channel, both nuclear and process, which supplies a signal for reactor portection is read out in the control room. The read-cut allows the operator to detect failures in the analog portion of protection ,

I channels by cross comparing channels monitoring the same variable and those monitoring variables having a known relation to each other.

The applicant has stated that the reactor protection system vill te designed, built and tested in accordance with the Proposed IEEE StLciard for Naclear Power Plant Protection Systems (Rev. 9). We have examined the applicant's preliminary design to evaluate the ability to comply with the following sections of the Proposed IEEE Standard:

Single failure criterion (Section 4.2)

Channel independence and isolation (Section 4.6)

Control and protection interaction (Section 4 7) m epnpan n enm men ur

" %Fu' M' MbdMO a UDD N$N=8 N

l IFA 0 4L U_MY l 1

6 Periodic on.line testing (Section4.10)

Channel bypass (Section4.11)

Operating bypasses (Section4.12)

Multiple trip settings (Section4.15)

Manual actuation (Section4.17)

Single Failure Criterion - Section 4.2 requires that no single component failure shall prevent the protection system fro:n fulfilling its protective function when required. Our review of the applicant's proposed design indicates that he can meet the single failure criterion by redundancy of reactor protection channels. The previously tabulated itst of reactor trips shows that each parameter listed is monitored by redundant instrumentation channels capable of meetin6 the single failure criterion. We believe the The proposed logic can be designed to meet the single failure criterion.

proposed channel redundancy and the preliminary design of the logic provide adequate assurance that the single failure criterion can be met in the final desi64.

Channel Independence and Isolation - Section 4.6 requires that redundant protec-tion system channels and their associated ele =ents shall be ele.ctrically independent and packaged to provide physical separation. The evaluation of this section is contained atove with the description of the channelized approach to the system design and equipment layout.

Control and Protection System Interaction - Section 4 7 of the Proposed IEEE Standard addresses the condition where a plant transient which requires I

protective action can be brought on by a failure or malfunction of a control system and the same event prevents proper action of a protection system channel or channels designed to protect

  • gainst the resultant unsafe condition.

AUDIT /1"Hf A if t' f e M /fh M U V .

'vaaave6L4709 vaw_

h5 U Section 4.7 requires that after such a malfunction the remaining portion of the protection system independently meet the single failure criterion.

Plant designs in which the protection system and control systems are not interconnected comply with Section 4.7 vithout further design provisions.

The Diablo Canyon design, like others in which control and protection systems are interconnected, require s specific evaluation. The applicant stated that only sensors vill be shared by the protection system and control systems.

Isolation has been provided to prevent the contro' systems from interactin6 vith the protection system. Temperature, pressure, and nuclear flux sensors, for example, supply protection system signals and signals to the automatic rod control. The instrumentation channels used to trip the reactor on lov steam generator level are also used to control steam generator level.

We believe that the requirements of Section 4 7 can be cet where control and protection systems are interconnected by the proposed isolation and the use of greater than minimm rec.ndancy in the protection system. This is the method used in the Diablo Canyon design where four instrumentation channels are used in a 2 of 4 reactor trip logic. An ir.strument channel failure which might initiate an accident vould affect only one protection channel. After such an unsafe failure the protection logic would be 2 of 3, which provides adequate redundancy.

There are three instances where control and protection ere interconnected and only miniaxn redundancy is provided. These are the high pressurizer vater level, loss of feedvater flow, and lov steam generator level reactor trips. These are evaluated in the two paragraphs belov. The two steam generator reactor trips are evaluated together because of their similarity.

(a) Only three channels of pressuriter level instrumentation are proposed.

n ?*w eMg y Cmmrw a nE W uwus%b LJN va w .

f 1

I Q 9 /

.e - \

of.e of which $ s used to control level via the charC ng ipumps.

' These same three channels are used in 2 of 3 logic to trip the reactor on high level. If the high level reactor trip vere required for reactor safety, the design vould not meet Section 4 7 and vould not be acceptable. The applicant', however, stated that the high pressurizer level reactor trip is provided to reduce the probabil-ity of operatin6 the safety valves. This reactor trip is not i required to protect the reactor. The safety valves have adequate capacity to relieve full charging pump flow. The proposed pressurizer level control and protection is adequate, provided the final design analysis shova that a reactor trip on high pressurizer level is not required to protect the reactor.

(b) The lo61 c of the less of feedvater flow rea: tor trip is 1 of 2 steam-feed flow mismatch coincident vith 1 of 2 lov level for any stess Generator. The instruments which supply the trip signals vill also be used to control feed flow and steam generator level.

The low-lov steam Senerator level reactor trip uses a 2 of 3 logic from any steam generator. One of the three level channels used for the reactor trip can be selected to control the level of the steam generator. The applicant believes that each of these two reactor trips meets Section 4 7 of the IEEE proposed Standard. His basis is that an instrument channel failure cannot cause the control system to initiate tha accident the protection channels are desigced to prevent. A comparator which blocks automatic control when the control channel deviatec from Another channel must be relied upon to prevent accident initiation. We believe that reliance upon a Aemm A p pimm em nr A

%va. a'li@ure whia Milu.a h

e (( ..yijpHL\U ff T@i2

--a //~hMif V component in a control system is not a satisfactory means of meeting Section 4.7 We telieve that the proposed design of the loss of feedvater flow and the lov low stesa generator level reactor trips are acceptable only if they are not required for reactor safety. The applicant stated that these reactor trips are provided to prevent stesa generator damage. Low level in one steam generator does not constitute a loss of heat sink. Any calfunction which cou11 cause ' te loss of level in all steam generators is independent of the flov and level si6nals used in the protection system. The proposed loss of feedvater flow and low-lov steam Senerator level reactor trips are acceptable provided the final analysis shows that the loss of level in one steam Senerator does not require a reactor trip to protect the reacter.

Periodic On-Line Testing - A means has been provided to test the protection system while operating at power. Testing of the protection system, with the exception of the sensors, is ac:onplished in two sters. The first tests the analog channels to the trip bistable outputs and the second tests the logic channels down to and ir.cluding the main trip breakers. The operational availability of sensors is determined by cross checking between readouts of redundant channels.

Each protection rack vik include an e.nalog test panel containing the necessary switches, test sacks and recorders required to test those channels i contained within the rack. Each test panel vill have a hinged cover which, when opened, vill initiate an alarm inuicating that that protection rack is under test. This test panel cover design vill, (1) precluio closing the neem n it n me ont F

%VC C 1%rWhLs %JGD %VA% 0 s

s

-v " tnh s9 %it;su YSm ePTP

@k,% b U ^

cover unless the test plu6s are removed, and (2) sechanicetlly return all test switches, except the bistable trip switches, to operate. The bistable trip svitches must be manually reset after test.

The testing of an analog channel consists of (1) piscing the output relays in a tripped condition, (2) interrupting the sensor circuit, and (3) substitutin6 a test input for the sensor . The test input vill be varied until the bistable trips /as shown by an indicator light). The trip level can be detemined from the readout on the control panel or from a plug-in test, meter.

The logic channels are tested one at a time using the test panels provided for each logic channel. For illustration, the testin6 of logic channel no.1 is descrited below. Bypass breaker no.1 is racked in so as to parallel .

trip breaker no.1 in order to prevent tripping the reactor during the los;ic test (Bypass breaker no.1 is tripped by loS i c no. 2 if an actual trip signal is received durin6 testin6). Trip breaker no.1 is tripped. 14gic no. 1 is tested by simulatin6 each combination of trip inputs by operating test switches which de-ener612e relays in the logic catrix. An event recorder confirms which combination de-energizes the trip breaker undervoltage coil. At the conclusica of the test the b;;;*ss breaker is racked out leaving the nomal circuit configuration.

We believe the preliminary design of the test circuits for the protection system meets the ID2 Proposed Standard Section 4.10. We believe that the protection system can be tested adequately at power. The use of local coincidence necessitates a two step test scheme to insure proper operation from sensor to trip breaker. The circuits are necessarily more complex than vould be required with general coincidence, but ve believe they vill permit a

_ ntwrm"u"m^

wn n wif T

._C P; g y ]

/r m"OnAE 111GtW fntin y n .xwwru ww m...-- ,

11-adequate testing. The use of the same channelized equipment arrangement for the test cir;uit as for the protection system should provide assurance that test circuit failures vill not cause the loss of protection functions.

Channel Bypass - There are provisions to switch any protection channel to a tripped mode. The coincidence and redundancy to be designed into the system allows a channel to be evitched into the trip mode without tripping the reactor or violating the single failure criterion. These features allov any channel to be saintsined or testei during power operation without tripping the reactar or violating the single failure criterion. We believe these An proposed features are adequate and meet the intent of Section l+.11.

indication of a bypassed channel is provided in the main control room.

Operating Bypasees - Belov tre listed those trip functions which are autecatie-ally or manually typassed due to operational necessity:

Trip Function Condition Defeated at power High nuclear flux icv power trip (powerrange)

Defeated telov 10% power low pressurizer pressure Defeated telow 10% power High pressurizer vater level Defeated below 10% power Turbine trip Defeated belev 75% power 14v reactor coolant flow (two out of three in any one loop)

L%latedbelov10% power Lov reactor coolant flov (two out of three in any two loops)

Reactor coolant pu=p breaker opening Defeatedbelov75% power (one out of one in any one loop)

Reactor coolant pu=p treaArr opening Defeated belov 10% pover (one out of one in any two loops)

The above centioned trip functions which are bypassed are automatically reinstated whenever the permissive coniitions are not met. The means thTI7.

m. nUPU uuA wII UT@U w - -- O MII.V

hbb hhb hhkb 12-provided to achit:ve this vill be desi6ned to met the provisions of the IEEE  :

Proposed Standard. We believe the proposed desi6n can neet Section 4.12 aD1 vill be adequate. In addition ts the above listed operational bypasses, the source ran6e level trip and the intemediate range level trip must be bypassed as the flux level is increased during startup. The operator is prev ented frw bypassing the source range trip until the flux is in the intemediate range. He is similarly prevented fro: bypassing the intemedia*.e range trip until the flux is in the power range. Ve have not revieved the logic of the circuits which perforn this pemissive function. There is, If however, sufficient redundancy to meet Section 4.12 in these circuits.

the fina) acclyLis shows that either the sou-ce er intermediate range level trip is required for safety, its bypass circuit vill be required to reeet Section 4.12 of the IEEE Proposed Standard. .

Multiple Trip Settings . The protection syste: contains fixed trip settings except for the overpower 6T and overtemperature 4T channels in which the set point is vsried as a function of plant variables. The channelized arrar#,;ement of the proposed design should assure thst a single failure could We not prevent the more restrictive setting from teing used if required.

beliave that the proposed design vill meet Section 4.15 and vill be adequate.

Manual Actuation e Manually actuated switch (es) vill be provided to initiate protection system action by simitaneously interrupting the d.c. power sources tc the undervohage coils of the trip breakers. The very mini 2 sum of equipment is fequired to initiate a manual trip (a pushbutton and a trip breaker).

The applicant has not completed the design to the extent of determining whether ona or two evitches vill te used, however, the final design should satisfy Section 4.l! of the IEEE Proposed Standard.

4- T ,g w r5U A - n~U~T _C T (r h m. ,. _ V

-nr , si ar -- -

M U A IT li @

! @ (FBW 4 ' l ,

W y 64w v u w e ws c 52 Engineered Safety Features The applicant stated that the circuits which actuate engineered safety features will be designed to the IEEE Proposed Staniard. He also stated that tne same channelized approach vill be used for these circuits as is proposed for the reactor protection system.

Safety injection is initiated when there is indication of low pressurizar level coincident with lov pressurizer pressure or vh'en high containment pressure is sensed. Three coincidence trip devices are each fed by a channel of pressurize. .d a channel of pressurizer pressure. A coincidence trip device trips then its level and pressure channels both supply trip signals. The tripping of any one of the three coincidence trip devices vill actuate safety injection. An indication of high containment pressure from any two of three instrument channels vill initiate safety injection independent of the pressurizer instrumentation. Attuation of safety injection from precsurizer instrumentation and from containment instrumentation vill each be desi6ned to meet the sin 61e failure criterion. The proposed design which actuates safety injection from either pressurizer or containment instrumentation provides desired diversity. We believe the safety injection actuation circuits 2

are adequate because of the diversity provided and because of compliance wit 1 the Proposed IEEE Standard.

Containment isolation is actuated ~.sy a coincidence of two of three indications of containment hiSh pressure. The channels of containment pressure instrumentation which actuate containment iClatica are not the same channels used to actuate safety injection. Since tne applicant is designing this circuit to the Proposed IEEE Standard, we believe it to be acceptable.

The contsinment spray actuation circuit itilizes the contairaent pressure carli A U UT -

V

+----

u u avulu.a ww@!@w

., o n e m -n n? e

%dffLbilhi %iRTO MvD 5

instruments used in both the safety injection circuit and the containment riod.

isolation circuit. Containment spray actuation requires trippind of tvo est j sf three of the channele vai-b ectuste safety injection and two of the three channels which actuate containment isolation. The added coincidence makes lux this circuit somewhat more prone to failure than either the safety injection

.t the or containment isol.ation circuit. The circuit can, however, be designed to it.

neet the single failure cri erion. We believe that this circuit, which vill

.ng be designed to the Proposed IEEE Standard, is Latisfactory.

>id We have had discu:,sions with the applicant concernin6 the ability of

&neouS the engineered safety feature electrical equipment to perforn its function the in an accident environment. We believe that, before plant operation, data tactor should be available to prove the capability of this equipment to function this in the combined temperature, pressure, humility environment associated with erator the desiga basis accident. This equipment includes cables, motors, detectors, and vs17e operators located inside the containment which are associated with e

the engineered safety features. The applicant has agreed to have data

.elieve available to prove the operability of the engineered safety feature equip. ment.

Where appropriate data exists, it vill be made available. Where such data does not now exist, the required environment tests vill be performed. Where rovide the equipment tested is not identical to the installed equipment, the extrapolation vill be justified.

3 Instrumentation

.1 Nuclear Instrumentation roup.

A major change in the propoced nuclear instrumentation design is the 172) which complete absence of period or startup rate information. This is the first he power reactor we know of to be designed with no period or startup rate ation

.#hCDUOUAU svu a uvacuus wUe T@U ^W L V ANILsII

igipptren o n U TAM AMU N l A a avank %#vu a we a should agree with the individual (actual) position indication un~ ess a malfunction causes the rod drive not to respond to the pulses.

The display provided for the operator consists of a recdout for each group position and a single indicator with a selector evitch for reading out the actual position of any selected rod. Based upon discussion tith the applicant a deviation alarm circuit is also included which compares each individual rod position indication with its group indication. An alarm is actuated at any time an~1ndividual indication deviates from its group's position by more than a preset amount. By usin6 the selector switch and individual indicator, the operator can determine which red is out of position.

We believe that the rod position indication is adequate since two malfunctions are required for a rod to be in a position other than its indicated position without the operator's knowled6e. The two failures are the incorrect covement of the rod and failure of the individual rod position indication. A failure in either an individual indication circuit or a group indicator would be detected by the deviation alarm circuit.

- neentr59 A U ww a uuunu UTQT vun (("hM.

- ]U

Retrieved from "https://kanterella.com/w/index.php?title=ML20151X461&oldid=2962116"