ML20209B568
| ML20209B568 | |
| Person / Time | |
|---|---|
| Site: | Paducah Gaseous Diffusion Plant |
| Issue date: | 06/25/1999 |
| From: | UNITED STATES ENRICHMENT CORP. (USEC) |
| To: | |
| Shared Package | |
| ML20209B564 | List: |
| References | |
| NUDOCS 9907070226 | |
| Download: ML20209B568 (19) | |
Text
.
GDP 99-0115 Page 1 of 19 Certificate Amendment Request Paducah Gaseous Diffusion Plant Letter GDP 99-0115 Removal / Insertion Instructions Remove Pages Insert Pages APPLICATION FOR UNITED STATES NUCLEAR REGULATORY COMMISSION CERTIFICATION VOLUME 1 SAR Section 3.15 SAR Section 3.15 3.15-35/3.15-36 3.15-35/3.15-36 VOLUME 2 SAR Chapter 4, Appendix A SAR Chapter 4, Appendix A 2-5/2-6, 2-6a/2-6b, 2-9/2-10, 2-12a/2-12b, 2-5/2-6, 2-6a/2-6 b, 2-9/2-10, 2-10a/2-10b, 2-12c/2-12d,2-20a/2-20b 2-10c/2-10d, 2-12a/2-12b, 2-12c/2-12d, 2-20a/2-20b Note: Pages which have changed since the CAR submittal can be identified by headers dated June 25,1999.
Pages which are unchanged from the CAR submittal show headers dated February 26,1999.
9907070226 990625 PDR ADOCK 07007001 C
POR
SAR-PGDP February 26,1999 RAC 98C149 (RO) 3.15.1.6.1.a Criticality Accident Alarm Systems (Existing Configuration) l Q Function The Criticality Accident Alarm System (CAAS) is used to detect the elevated levels of gamma radiation that result from the minimum criticality accident of concern and warn plant personnel in the event I
that a criticality accident occurs.
See Section 3.12.6 for a description of tlas system.
Bon =dary The system boundaries for the CAAS cluster unit include:
1.
Gamma detector channel 2.
Cluster logic module 3.
Cluster housing The bounded components of the alarm horn include:
1 1.
Local horn 2.
Nitrogen regulator 3.
Air to nitrogen solenoid valves 4.
Pressure switches for the horn manifold and the nitrogen bottle 5.
Piping from the nitrogen bottle and soleno:J valve to the horn 6.
Backup battery for the clutter 7.
Trouble relays associated with loss of power and loss of air / nitrogen pressure 8.
Nitrogen supply The system boundaries for the Radiation Alarm Cabinet in each building include:
1.
Relay from the clusters 2.
Relay to actuate the building / slave lights and horns 3.
Plant air system, back to the isolation valves 3.15-35
SAR-PGDP June 25,1999 RAC 98Cl49 (R0/RI)
'4.
Building / slave lights and horns 5.
Power supply for the buildmg/ slave lights and horns (120 Volt), back to the first breaker The system boundar~ce for C-300 include:
1.
48 volt power supp!y from the radiation alarm annunciator cabinets (A and B) 2.
Loss of power relays 3.
Loss of power indication on the C-300 console 4.
Building horn control switch.
3.15.1.6.1.b Criticality Accident Alarm Systems (New Configuration)
Q Function The Criticality Accident Alarm System (CAAS) is used to detect the elevated levels of gamma l
radiation that result from the minimum criticality accident of concern and warn plant personnel in the event that a criticality accident occurs.
See Section 3.12.6 for a description of this system.
Boundary The system boundaries for the CAAS cluster unit include:
1.
Gamma detector channel 1
2.
Cluster. logic module 3.
Cluster housing 4.
Backup battery for the cluster 5.
Trouble relays associated with loss of power to radiation alarm clusters The system boundaries for the Radiation Alarm Cabinet and Building Horn Relay Cabinet in each building include:
1.
Relay from the clusters 2.
Relays to actuate the building / slave lights and horns 3.
Loss of horn power relay and indicator light 4.
Power supply for the building / slave lights and horns (120 Volt), back to the first breaker 3.15-36
1 1
i SAR-PGDP Chapter 4, Appendix A February 26,1999 i
RAC 98Cl49 (RO) j 2.5 INSTRUMENTATION AND CONTROL SYSTEMS / FEATURES
{
2.5.1 Criticality Accident Alarm System The Criticality Accident Alarm System (CAAS) is used for warning plant personnel of a criticality j
incident. The system is designed to detect gamma radiation and provide a distinctive, audible signal that will alert personnel to evacuate the areas that are potentially affected.
)
- A block diagram of the overall system configuration is depicted in Fig. 2.5-1. In addition to the devices described in the figurt, one other type of detector is associated with the system. This detector is identified as the argon gammagraph detector. This detector and its logic was not changed or affected by the changes for the HAUP and will not be discussed. For more information on these devices and their functions, refer to Sect. 3.12.7 of the PGDP SAR.
The CAAS was significantly affected by the HAUP due to the additional areas requiring criticality alarm coverage. The entire system will be described and reviewed for acceptability.
2.5.1.1 Principal Design Basis and Criteria The primary input (i.e., principal design criteria) for the CAAS is ANSI /ANS 8.3. The following design criteria support the present bases for CAAS at PGDP.
2.5.1.1.1 Text Deleted 2.5.1.1.2 ANSI /ANS 8.3 l
1.
Gamma radiation detectors shall be capable of detecting a criticality that produces an absorbed dose j
in free air of 20 rads of combined neutron and gamma radiation at an unshielded distance of 2 m from the fissionable material within 60 seconds. Areas where this requirement is not met must have adequate justification for not providing alarm coverage, it should be noted that this requirement is not applicable to areas containing materialless than I wt % "U.
2 2.
The system shall automatically initiate an evacuation alarm signal within one half second of the alarm setpoint being exceeded. The building evacuation alarm system shall be capable of being manually 1
activated from a central remote location.
3.
Text Deleted 4.
The system shall remain in an alarm condition after initiation regardless of radiation levels returning to normal until a manual reset of the alarm has been accomplished. Reset capability shall be limited in access to preclude inadvertent reset and shall be located outside the area to be evacuated.
5.
Process ?w in which activities will continue during a power outage shall have emer<;ency power supplies for alarm systems or such activities shall be monitored continuously with portable instruments.
6.
The system shall be designed to preclude inadvertent initiation signals to the extent practical to provide system credibility.
2-5
SAR-PGDP Chapter 4, Appendix A June 25,1999 RAC 98Cl49 (R0/RI) 7.
The system shall be designed to provide an indication of system malfunctions for alerting personnel j
of maintenance requirements.
1 n
8.
A means shall be provided to test the response and performance of the system (excluding the sounding of the alarm) without causing an evacuation alann, in addition, the portions of the system not affected by the test shall still remain functional.
9.
The system shall provide sufficient information to the Central Control Facility (CCF) to allow implementation of site emergency response procedures for criticality accidents; this information shall be provided independent of off-site ac power for a minimum of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.
- 10. The alarm signal shall be for immediate evacuation purposes only and of sufficient volume and coverage to be heard in all areas that are to be evacuated.
- 11. The CAAS shall remain operable in the event of seismic shock equivalent to the site-specific design I
basis earthquake or the equivalent value specified by the Unifonn Building Code.
Each of these criteria will be addressed in Sect. 2.5.1.3 by illustrating how the system meets the requirements.
j 2.5.1.2.a System Description (Existing Configuration) l The CAAS is primarily divided into three categories for description. These three areas are the local alarm system, building alarm system, and the Building C-300 CCF alarms and controls. The local alarm system includes the individual cluster unit detectors that provide detection capability for the entire system.
The cluster unit detection system actuates both visual and audible alanns in the affected area (s). The personnel alarms that would be activated consist of:
a local horn (continuous high pitched blast) actuated by plant air or by nitrogen or an electronic horn, building horns (air or electric),
red rotating or strobe beacons located on the outside of buildings, and an audible and visible alarm on the Building C-300 CAAS control panel.
The local and building horns produce a loud, distinctive sound and are used as an emergency signal for immediate evacuation of all personnel from the building or area.
Due to the significant number of changes in this system, the local and building alarm system will be described first. Once the basic concept has been established, each building or area will be discussed in detail to provide information on the specific configuration and how the system is arranged.
2.5.1.2.b System Description (New Configuration)
The CAAS is primarily divided into three categories for description. These three areas are the detection system, building alarm system, and the Building C-300 CCF alarms c.nd controls. The detection system includes the individual cluster unit detectors that provide detection capability for the entire system.
The cluster unit detection system actuates both visual and audible alarms in the affected area (s). The personnel alarms that would be activated consist of:
2-6
SAR-PGDP Chapter 4, Appendix A June 25,1999 RAC 98C149 (R0/RI) _
building horns (air or electric),
red rotating or strobe beacons located on the outside of buildings, and an audible and visible alarm on the Building C-300 CAAS control papel.
The building horns produce a loud, distinctive sound and are used as an emergency signal for immediate evacuation of all personnel from the building or area.
The building alarm system will be described first. Once the basic concept has been established, each building or area will be discussed in detail to provide information on the specific configuration and how the system is arranged.
2.5.1.2.1.a Local alarm system (Existing Configuration Only, New Configuration Will Remove Local Alarm System)
The local alarm system consists of three major devices: the cluster unit, the localjunction/ horn control l
box, and the alarm horn. The cluster unit sends the required input to the building alarm system and to the 1
CCF. The individual local alarm units are located throughout the plant as indicated on Fig. 2.5-2. C-710 l
and C-720 do not have a specific local horn.
i 2-6a
I SAR-PGDP Chapter 4, Appendix A February 26,1999 RAC 98Cl49 (RO) 1 i
l l
Blank Page 2-6b
SAR-PGDP Chapter 4, Appendix A February 26,1999 RAC 98C149 (RO)
Each detector channel has three possible states: normal, fault alarm, and radiation alarm. Pre-determined values of fault alarm and radiation alarm are selected to provide annunciation if the unit falls outside the normal operating range (10 mR/hr radiation). In the normal state, the meter on the front panel of the detector channel indicates a pre-determined normal background reading on the upper scale, and no other alarm indicators are activated. If something in a detector channel fails and causes the signal level to drop to a fault alann point, the detector channel will go into the fault state, actuating the FAULT ALARM light on the front panel. If a detector channel goes into the fault state, the cluster logic module will detect it, then activate an audible alarm and turn on a trouble light at the CAAS console in the CCF.
Radiation levels of 10 mR/h or more above the background reading will exceed the cluster unit's alarm I
setpoint, and the cluster unit will go into the alarm state. In this state, the RAD ALARM light on the front panel of the detector channel will turn on.
In addition to providing space for mounting the three detector channels and the cluster logic module, the cluster unit housing also provides electronic connections from each detector channel to the cluster logic module. Also mounted on the back of the cluster unit housing is the cluster unit housing / mother board assembly. This assembly provides power supply connections to each detector channel, a connection slot for the cluster logic module printed circuit board, and connections to cable connectors slots 32, J3, J5, and J7 on the cluster unit housing.
If only one detector channel goes into the alarm state, the cluster logic module considers it a malfunction and generates a trouble alarm on the CAAS console at CCF. If two detector channels go into alarm at the same time, the cluster logic module considers it genuine and generates a radiation alarm. If j
two detector channels are already in the fault state and the third detector channel goes into atann, the cluster logic module generates a radiation alarm.
To summarize, a radiation alarm will occur if two or more (any two) detector channels go into the alarm state or if only one goes into the alarm state while the other two are in the fault state. All other combinations of abnormal states will cause a fault alarm.
A radiation alarm signal generated by the above sequence not only turns on the RAD ALARM light on the detector channel but also turns on the ALARM light on the cluster logic module and the 10-mR indicator light or strobe on the CAAS console. In addition to the panel alarm light indicators, a radiation alarm sipal activates red rotating or strobe beacons located on the exterior of the affected building, and a group c,f evacuation horns located in the affected area along with any applicable slave horns.
The cluster logic module for all detector assemblies was replaced with the cluster logic module developed for K-25 alarm system application. The new module operates in the same manner as the original logic module with the exception that two output circuits are available for functional redundancy. The voting logic for detector channel input is identical to the previous module. There are two channels of output relays, K4 and K5. An analysis' was performed on the new module to determine the capability to j
meet the single failure requirements. The results indicated that the logic gates and the relays met the functional single failure requirements. The primary reason for this change is to provide additional protection against single failure in the individual cluster units.
Local horn alarm description (Existing Configuration Only, New Coniiguration Will Remove Local IIorn Alarm)
Local horn alarms are located at each of the cluster unit installations except at C-710 and C-720, The local horns are either electronic or are actuated by plant air during the normal operating mode and by nitrogen (N ) from a dedicated cylinder as a backup if the plant air pressure decreases below a preset value.
2 An exception to the above statement does exist. Plant air is not availab e in Building C-746-Q: therefore, a dual N cylinder manifold serves as the primary source and a single N 2 cylinder serves as the backup 2
for each of the two clusters in this building. C-710 and C-720 have all electric horns with no dedicated local horn.
2-9
i SAR-PGDP Chapter 4, Appendix A June 25,1999 RAC 98Cl49 (RI)
The air-operated local horn alarm consists of a clarion horn, a compressed nitrogen gas cylinder, and a local horn control box which is electrically connected through a junction box to components located in the cluster unit. A simplified (.ectrical schematic of the circuit is shown in Fig. 2.5-10.
The local horn control box is normally mounted on a wall or column just below the cluster unit and junction box; the nitrogen supply, a 2200-psig cylinder, is secured on the floor just below the local horn control box. The horn is mounted several feet higher than the local horn control box. Fig. 2.5-1I shows' a typical field installation of the local horn alarm system unit.
The local horn control box contains a nitrogen pressure regulator, three pressure switches (SS A, S5 B, and j
S6), a double solenoid four.way valve to control pressure to the horn, a plant air connection with a backflow d
check valve, a switch and test socket to accommodate a test / control unit, a terminal block for electrical connections, and miscellaneous hardware. Fig. 2.5-10 shows the electrical schematic circuit, and Fig. 2.5-12 shows the component layout and connections in the local hom control box. Clusters which are located in an outdoor environment are equipped with a low temperature alarm (TSLL-129). The TSLL-129 alarm contacts I
(when installed) are in series with S5A, SSB and S6 and will initiate a CLUSTER TROUBLE alarm in C-300 if the external temperature of the cluster approaches the cluster's specified minimum operating temperature.
)
A pressure regulator regulates the nitrogen pressure at 5 psi below plant air pressure but not higher than 80 psig which is required to provide the necessary sound level from the horn. Pressure switch S5 monitors the regulator pressure through the trouble circuit. One pair of S5 contacts (SSB) is set to open on decreasing pressure at approximately 75 psig, and the other set of contacts (SSA) is adjusted to open on increasing pressure at approximately 135 psig. Pressure switch S6 on the supply cylinder is set to open at or before 900 psig on decreasing pressure. The two pressure switches are connected electrically to give a
)
" FAULT ALARM" indication at the cluster unit and a " CLUSTER TROUBLE" alarm at the CAAS console if the pressure being measured exceeds the prescribed limits.
Solenoid valve val is pilot operated so that inlet pressure aids the plunger movement. For the valve to open, the OFF coil must not be energized, the ON coil must be energized, and there must be at least 10 psig of pressure from the output of the regulator. To reset or close valve val after it has been actuated or out of i
service, the ON coil must be without power and the OFF coil must be energized while there is pressure (10 psig or more) in the valve. Some pressure must be present for the reset action, so a slight loss of nitrogen may be associated with resetting the solenoid valve.
A local horn control box failure is expected to manifest itself as one of the following: outleakage from the high-pressure side of the box, w hich is signaled by a " CLUSTER TROUBLE" alarm at the CA AS console; seat leakage of the cylinder gas regulator causing a pressure incicase in the low-pressure part of the local hom control box, which actuates a " CLUSTER TROUBLE" alarrn at the CAAS console; or failure of the solenoid valve to either open or close when energized.
The local horn can be reset by two methods. The first method involves manually moving the piston of solenoid valve VA-1. This manipulation is done by removing the end caps and pushing the pistons to the reset position. The second method is by connecting a Reset Module, w hich has a red push-button switch, to Pins 13 and 14 oftest Connector J-3 on the cluster unit housing. This Reset Module is available in each building from maintenance personnel. The module was designed and fabricated by the PGDP Instrument Maintenance Department. The module resets the alarm by depressing the switch and applying 24-V de to the OFF solenoid and resetting the valve.
The nitrogen supply cylinder is capable ofdelivering nitrogen to the horn for at least two minutes should the plant air system fail. This would provide sufficient warning to personnel in the affected area.
2.5.1.2.1.b Detection system (New Configuration)
The detection system consists of the local cluster units. The cluster unit sends the required input to the building alarm system and to the CCF.
2-10
SAR-PGDP Chapter 4, Appendix A June 25,1999 RAC 98Cl49 (RI)
Cluster unit description A cluster unit consists of three major subassemblies: three identical detector channels, a cluster logic module, and the cluster unit housing. The modular design of a cluster unit allows for egick, straightforward removal of all major assemblies. Any one of the detector channels may be removed or replaced without affecting the reliability of the remaining units. A block diagram of the cluster unit with the three detector channels and the cluster logic module located in the cluster unit housing is shown in Fig. 2.5-3.
{
Cluster units, Model GCM-650 gamma criticality monitors, are the heart of the CAAS. These units detect J
gamma radiation from criticality events and initiate evacuation alarms and other indications pertinent to j
operations and maintenance. Each cluster unit consists of three independent and fully redundant detector channels that are electrically connected in a cluster " voting" logic. Each detector channel is powered by ac line power, and this source is backed up by an internal battery and regulating charger to enable operation for 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> in case of an ac power line failure.
The modular design of the cluster units allows selective removal of any one of a cluster unit's detector channels for changeout or repair without affecting the detection capability of the remaining two detector 1
channels. This design also pennits universal substitution of calibrated detector channels requiring no adjustment for operation in a particular station in the unit. The cluster unit has input and output connections provided by connectors mounted on the right side of the cluster unit.
Each of the three detector channels in a cluster unit consists of a detector assembly w hich contains the following: a gamma detector tube assembly; a power supply and signal processing printed circuit boards; a battery backup power supply pack; fuses for both ac and battery power supplies; two light-emitting diode (LED) lights to indicam FAULT ALARM or RAD ALARM status when appropriate; and a front panel with indicators and self-test electronic controls to use for the diagnosis of any malfunction or for the calibration, adjustment, and testing of the cluster unit. These components are shown in Figs. 2.5-4 and 2.5-5. The three detector channels are interconnected through the mother board to the cluster logic module. Each channel is also designed to function as a self-contained gamma mcnitor.
An important part of the detector channel is the detector assembly. This assembly detects gamma radiation from a criticality event and provides an amplified alarm signal from a buffer amplifier to the electronic circuits in the cluster unit. The detector assembly tube uses a plastic scintillator coupled to a photomultiplier tube (PMT) and buffer amplifier. Gamma radiation impinging on the scintillator generates a photon oflight, which is converted to an electrical signal and amplified by the PMT. PMT output is amplined and shaped by a buffer amplifier, which then drives the signal processing circuitry. The signal processing circuitry contains circuits that make a level comparison to the preset alann and fault setpoints, if the gamma radiation field intensity is large enough that the signal exceeds the alann setpoint, the detector channel sends an alarm status signal to the cluster logic module. The logic circuit in the cluster logic module compares the inputs from the three redundant detector channels according to a preset " voting" scheme and causes an alarm output if appropriate.
The detector channel contains provisions for continually determining whether the detector tube and associated electronic circuits are in good working order. An LED light source in contact with the scintillator is used to create a simulated input signal. The PMT and associated electrical circuits process this simulated input in the same way it would process a gamma-initiated signal. By monitoring the proper handling of this signal, the operating status of the detector channel can be determined. If for any reason a fault has occurred, a fault status signal is generated and sent to the cluster unit's electronics for reporting system status to the CAAS console.
Past experience has demonstrated that PMT gain shifts can occur with excursions of ambient temperature or with high-voltage supply drift. The detector channel incorporates a gain stabilization technique to limit such gain shifts to values well within the specification. The LED light source mentioned earlier is pulsed and used as a stabilized reference light source. Since the amplitude is compensated for temperature shifts, the output of the light source is a stable, reliable reference. The control electronics use this input to measure the gain performanceof the system and adjust the PMT high-voltage supply to regulate the system gain. The reference 2-10a
SAR-PGDP Chapter 4, Appendix A June 25,1999 RAC 98C149 (RI) signal is ac coupled and direct current (de) restored and is therefore not foiled by slowly rising or falling radiation fields. The LED light source can be pulsed at low repetition rates below background or can be pulsed faster to simulate higher background rates. The light source can also be used to simulate still higher rates for test purposes. Controls to accomplish these functions are located on the detector channel front panel, which is accessible through a hinged door on the front of the detector channel (refer to Figs. 2.5-4 and 2.5-7). The meter and meter switching controls can be used to monitor alann level setpoint, fault level setpoint, high-voltage setting, battery test, and analog output signal.
The meter on the detector channel has two scales. The upper scale has 50 divisions that represent 0 to 50 mR/h. The circuits have been adjusted for a predetermined normal background no-signal meter reading j
on the upper scale. The lower scale of the meter has 30 divisions and is labeled V dc. During " battery test,"
i the range is 0 to 30 V dc. During "high voltage" test, the range is 0 to 3000 V dc.
Also located just below the meter are two LED lights to indicate FAULT ALARM or RAD ALARM status when appropriate. Fuses for both power supplies, the ac and the battery backup, are located at the bottom of the unit.
A battery pack is also provided for each of the three detector channels in a cluster unit. The pack, which j
provides backup power for its detector channel in the event of an ac power failure, is located on the underside of the detector channel chassis beneath the printed circuit boards and the detector tube assembly (see Fig. 2.5-5). The batteries are tested periodically as indicated in Sect. S to verify their operable status. They are replaced when the acceptance criteria for operability are not met.
The batteries, if defective (open, shorted, or discharged), will not afTect the operation of the unit if ac is present. In the event ofloss of power, however, a defective battery will cause failure of the detector channel in which it is contained. Provided one detector channel contains an operable battery, the cluster logic module will continue to correctly report the status of the unit.
The front panel of the cluster logic module (Fig. 2.5-9) contains a master reset switch, ALARM RESET, for resetting all channels, and a large red ALARM lamp to signal alarm status. Also on the front panel is a key-lock MODE switch, which, when in the TEST position, allows the operator to test the cluster alarm circuits. The key can be removed only when the lock has been returned to the NORMAL position, in the NORMAL position, any detector channel can be self-tested by manual switches located on the unit. During this type of testing, the cluster unit will not initiate an alann signal unless the unit is actually subjected to a true radiation level exceeding the preset alarm setpoint.
The cluster logic module also contains the cluster " voting" logic and the relays that are an integral part of the CAAS alarm and control systems. The three detector channels are connected to the cluster logic module through a mother board in the cluster logic module, which is mounted on the inside back panel of the cluster housing. The " alarm" and " fault" signals generated in the detector channels are fed to the cluster logic module where a logic matrix evaluates signals from the three detector channels and determines through a " voting" logic matrix if an alarm signal is to be generated and transmitted to the alann control circuits that operate the waming beacons, the horns, and the alarna monitors in the CCF or if a " fault" alann signal is to be generated to indicate an operational malfunction in the detector channel.
Cable connections from the cluster unit to the evacuation alarm systems and the indicator / control systems of the CAAS console are located on the right side of the cluster unit housing. Connections for these cables are shown in Fig. 2.5-9.
The cluster logic module monitors the status of the three detector channels and serves as an arbitrator to determine if a radiation alarm should be activated or if a fault in the system has occurred and should be reported as a fault alarm.
2-10b
r 1
\\
SAR-PGDP Chapter 4, Appendix A June 25,1999 i
RAC 98C149 (R0/R1)
Each detector channel has three possible states: normal, fault alann, and radiation alarm. Pre-determined values of fault alarm and radiation alarm are selected to provide annunciation if the unit falls outside the 1
normal operating range (10 mR/hr radiation). In the nonnal state, the meter on the front panel of the detector
{
channel indicates a pre-determined normal background reading on the upper scale, and no other alarm indicators are activated. If something in a detector channel fails and causes the signal level to drop to a fault alarm point, the detector channel will go into the fault state, actuating the FAULT ALARM light on the front panel. If a detector channel goes into the fault state, the cluster logic module will detect it, then activate an audible alarm and turn on a trouble light at the CAAS console in the CCF. Radiation levels of 10 mR/h or more above the background reading will exceed the cluster unit's alann setpoint, and the cluster unit will go into the alarm state. In this state, the RAD ALARM light on the front panel of the detector channel will turn on.
In addition to providing space for mounting the three detector channels and the cluster logic module, the J
cluster unit housing also provides electronic connections from each detector channel to the cluster logic
{
module. Also mounted on the back of the cluster unit housing is the cluster unit housing / mother board assembly. This assembly provides power supply connections to each detector channel, a connection slot j
for the cluster logic module printed circuit board, and connections to cable connectors slots J2, J3, J5, and J7 j
on the cluster unit housing.
1 Ifonly one detector channel goes into the alarm state, the cluster logic module considers it a malfunction and generates a trouble alann on the CAAS console at CCF. If two detector channels go into alanu at the same time, the cluster logic module considers it genuine and generates a radiation alann. If two detector channels are already in the fault state and the third detector channel goes into alann, the cluster logic module generates a radiation alarm.
j To summarize, a radiation alarm will occur if two or more (any two) detector channels go into the alarm i
state or ifonly one goes into the aktrm state while the other two are in the fault state. All other combinations of abnormal states will cause a fault alarm.
A radiation alarm signal generated by the above sequence not only turns on the RAD ALARM light on the detector channel but also turns on the ALARM light on the cluster logic module and the 10-mR indicator light or strobe on the CAAS console. In addition to the panel alarm light indicators, a radiation alarm signal activates red rotating or strobe beacons located on the exterior of the affected building, and a group of evacuation horns located in the affected area along with any applicable slave horns.
The cluster logic module for all detector assemblies was replaced with the cluster logic module developed for K-25 alarm system application. The new module operates in the same manner as the original logic module with the exception that two output circuits are available for functional redundancy. The voting logic for detector channel input is identical to the previous module. There are two channels of output relays, K4 and KS. An analysis' was performed on the new module to determine the capability to meet the single failure requirements. The results indicated that the logic gates and the relays met the functional single failure requirements. The primary reason for this change is to provide additional protection against single failure in the individual cluster units.
2.5.1.2.2.a Building alarm system (Existing Configuration)
Figure 2.5-1 is an overall layout drawing of the cluster locations and connections of the basic components of the CAAS. Each covered area contains building horns that provide audible warnings inside the buildings. Rotating or strobe red beacons located on the outside of the rJTected buildings serve as a visible warning not to enter the building. Local radiation alarm cabinets (RACs) to which the outputs of all the cluster units in the alanned area 2-10c
S 4
s e
SAR-PGDP Chapter 4, Appendix A June 25,1039 RAC 98C149 (R1) l Blank Page l
l 2-10d l
1
)
SAR-PGDP Chapter 4, Appendix A June 25,1999 RAC 98C149 (R0/R1)
- 5 IIz difference (502 vs.497 liz) establishes a " beat" of 5 IIz that is noticable in areas around the air whistles.
This adds another distinguishable characteristic of the warning signal. The addition of an adequate number of horns with sufficient signal amplitude and a distinguishable frequency provide audibility in the areas now deficient, including the areas of the clusters. This removed the necessity for local horns so they have been disconnected and abandoned in place or removed. In areas such as the building area control rooms (ACR),
maintenance shops, locker rooms, and C-746Q, where the installation of air whistles was impractical due to the amplimJe of the whistle signal at large distances, electronic horns were installed which have a frequency of 470 liz. The most likely failure mode of the air whistles is an obstruction of the flow path causing a degraded output signal. The most likely failure mode of the electronic horns is an electronic component failure causing the horn to fail to produce the required output signal. Failure of the air whistles and electronic horns is protected against by performing quarterly functional testing to detect any component degradation prior to failure and identify any failures of components which have occurred. These components are then replaced and retested prior to declaring the system operable.
The building air whistles and electronic horns are actuated by two W relays which energize the horn ON solenoids and electronic homs. All of the horns are energized by either of the W relays if any cluster in the area initiates an alarm signal. This redundancy ensures the horns will actuate even if one of the relays fails. The building air whistles are deenergized by dual X relays which energize the horn OFF solenoids. The W and X relays are located in new Building IIorn Relay Cabinets (except in C-333A, C-360, C-400, C-710, C-720, and C-746Q) located adjacent to the Radiation Alarm Cabinets in each building. In C-333A, C-360, C-400, C-710, C-720, and C-746Q the 'W and X relays are located in the Radiation Alami Cabinet. The possible failure modes of these relays are contact failure or coil failure which would prevent the horns from being actuated. These failures are protected against by providing two relays which can perform the same function independently and by performing quarterly functional testing to detect any component degradation prior to failure and identify any failures of components which have occurred. These components are then replaced and retested prior to declaring the system operable.
1 The Building liom Relay Cabinets in each building also contain a loss of power relay and indicating light.
j The purpose of this relay and light is to provide an alarm signal upon a loss of power to the CAAS building horns. The alarm signal is indicated by a cluster trouble alarm at C-300 and a loss of power light inside the Building llorn Relay Cabinet. The possible failure modes of these components are contact failure, coil failure, i
or the lamp burning out. Any of these failures would prevent an alarm signal, due tc interruption of power to the building horns, from producing a C-300 cluster trouble alarm or a visible alarm at the Building fiorn Relay Cabinet. These failures are protected against by performing quarterly functional testing to detect any component degradation prior to failure and identify any failures of components which have occurred. These components are then replaced and retested prior to declaring the system operable.
The air whistles are actuated by four-way double acting solenoid valves which are actuated by 120 VAC or 120 VDC. For the valve to open, the OFF coil must not be energized, the ON coil must be energized, and there must be at least 35 psig of pressure from the output of the regulator. To reset or close the valve after it has been actuated or out of service, the ON coil must be without power and the OFF coil must be energized while there is pressure in the valve. The ON coils are energized by the above mentioned W relays and the OFF coils i
are energized by dual X relays. These solenoid valves are housed in solenoid panels which are located in the vicinity of the air whistles that they serve. The possible failure modes of the solenoid valves are a stuck solenoid, a coil failure, piping leaks, or valve leaks. Any of these failures could cause loss of proper air flow to the whistle resulting in a degraded output signal and loss of air resulting in failure of the horns to blow for the required time at the required flow rate. These failures are protected against by perfonning preventive maintenance of the solenoids and by performing quarterly functional testing to detect any component degradation prior to failure and 2-12a
SAR-PGDP Chapter 4, Appendix A June 25,1999 RAC 98C149 (R0/RI) identify any failures of components which have occurred. These components are then replaced and retested prior to declaring the system operable. Also, leakage is protected against by a pressure switch installed on the air header between the accumulators and the pressure regulators which sends in a low pressure alarm if the system pressure falls below a set pressure which is slightly above the accumulator pressure limit for 2 minute operation of the air whistles.
The air supply from the air accumulators to the air whistles is controlled by individual pressure control valves which maintain supply pressure to the air whistles at their design pressure of approximately 80 psig from the accumulator supply which is at approximately 150 psig. These control valves are located in the air line between the accumulators and each solenoid valve. These control valves are spring loaded, diaphragm actuated valves. The valves are opened by spring pressure and closed by control air pressure, therefore they fail open on loss of control air pressure. The safety fmiction of the pressure control valves is to provide flow control and isolation over all expected system pressures. The possible failure modes of the pressure control valves are sticking of the valve and valve leakage. These failures could result in improper supply pmssure to the whistles which could cause inadequate output sound from the hom and failure of the system to sound the horns for the required two minutes. These failures are protected by the procurement and dedication process of the components as Q items. Also, the system is tested quarterly to detect any component degradation prior to failure and identify any failures of components which have occurred and the valve settings are checked annually. These components are then replaced and retested prior to declaring the system operable.
The power for the air whistles is supplied from a dedicated air supply system. The piping is routed to a main air supply header which is then routed to an accumulator (air storage tank) located outside of the building.
The accumulators are maintained at a pressure of approximately 150 psig. The supply to the whistles is j
maintained at the whistle design pressure necessary to blow the horns, 80 psig. The minimum pressure in the accumulators necessary to blow the horns for a minimum of two minutes is dependent on the capacity of the i
accumulators. The accumulator capacity can be changed by taking one or more tanks out of service for i
maintenance or inspection. Maintaining the minimum pressure, based on the number of accumulators in service, above that necessary to blow all the horns for a minimum of two minutes ensures that sufficient air capacity is j
available. 'Ihe accumulators are designed to fulfill the requirements of Section VIII, Division 1, of the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code. They have a maximum allowable working pressure (MAWP) of 175 psig at 150 *F. They are connected to a common header which runs inside of the building. Local pressure and temperature indicators are installed at the tanks for monitoring. The accumulators each nave a pressure relief valve which is set to relieve at 175 psig. An overpressure condition in the accumulators could be caused by a failure of the compressor control system preventing the compressor from turning off at its high pressure cutout. The relief valves are designed to relieve pressure to prevent accumulator pressure from exceeding 110% ofits MAWP when filling at the compressor flow rate. The possible failure modes of the accumulators are fracture or rupture. This is protected against by fabrication and testing of the accumulators in accordance with ASME code requirements and pressure relief valve protection. The l
possible failure modes of the pressure relief valves are sticking of the valve open or shut, valve structure failure, spring failure, and orifice obstruction. These failures are protected against by performing preventive maintenance on the relief valves and by performing pre-installation testing and inspection of the valves. Also, system leakage is protected against by a pressure switch installed on the air header between the accumulators and the pressure regulators which sends in a low pressure alarm if the system pressure falls below a set pressure which is slightly above the accumulator pressure limit for 2 minute operation of the air whistles. Isolation valves are available to isolate one or more of the accumulators from the system to perform corrective or preventive maintenance as necessary.
2-12b
\\
o SAR-PGDP Chapter 4, Appendix A June 25,1999 RAC 98C149 (R0/RI)
The accumulators are filled using an air compressor located inside the building. The input to the air compressor is from the plant air system at 90 psig nominal pressure. The output is directly into the accumulator.
The accumulators are monitored for pressure such that the compressors recharge the accumulators at approximately 150 psig and turn off at approximately 160 psig. If the system falls below a set pressure which is slightly above the accumulator pressure limit for 2 minute operation of the air whistles, a cluster trouble alarm is generated in the Central Control Facility (C-300). The air compressor installation is designed such that quick
]
removal and replacement can be accomplished with a spare compressor should replacement become necessary.
When CAAS surveillances or post-maintenance testing is performed it is necessary to sound all CAAS alanns in the affected area and ensure all horns are functional. This depletes the CAAS accumulators below the pressure j
necessary to blow the air whistles for two minutes. The time to recharge the accumulators above this pressure has been estimated at greater than five hours using the permenantly installed compressors alone. To reduce this recovery time a temporary connection is ins f;d to allow the connection of a portable air compressor with enough capacity to recharge the accumulators 'n approximately one hour This reduces CAAS outage time necessary to perfomi surveillances and post-maintenance testing.
The Radiation Alarm Cabinet (RAC) and Building Horn Relay Cabinet (BHRC) contains control relays that, in conjunction with other control circuits in the Radiation Alarm Annunciator Cabinet and the CAAS console, provide the warning signals and related operator controls for CAAS. The relays that control operation of the
{
building horns and rotating or strobe beacons for a particular building (or area) are located in the RACs and BHRCs of that building. Fig. 2.5-14a is a simplified schematic of the relay control circuits.
Fig. 2.5-14a illustrates the three detector channels' connection to an alarm logic matrix located in the cluster logic module within the cluster unit. The output of the matrix goes to alarm control relay circuits in the RAC and BHRC. The alarm control relays control the operation of the building horns and rotating or strobe beacons.
When the cluster unit is exposed to a radiation level that is higher than 10 mR/h above background, an alami signal from the cluster unit energizes relay Z, which in turn energizes relays W and Y. Relays W and Y energize 1
the building horns and beacons, respectively. A hom control switch on the CAAS console at the CCF can be f
moved to the OFF position to energize relay X to tum off the building horns. The beacons cannot be turned off j
from the CAAS console because of a holding circuit for relay Y. The beacons are turned off by pushing the BUILDING LIGHTS RESET switch on the RAC located in the same building as the beacons. Actuating this switch breaks the holding circuit for relay Y. The horn control switch can also be positioned at either ON or AUTO. At the ON position, the building horns can be activated; however, the HORN PERMISSIVE switch must be in the ON position for the horns to be energized. In the AUTO position (normal position), the horns and beacons are actuated automatically when an alarm signal is received from a cluster unit through the action of relay Z. Each cluster unit will have a Z relay but there will be only one relay Y and two X and Z relays for each building RAC/BHRC. The W and X relays are located in the BHRC (except in C-333A, C-360, C-400, C-710, C-720, and C-746Q where they are in the RAC) and the Y and Z relays are located in the RAC.
Relay Y tums on the outside beacons and the W and X relays operate the building horns if any cluster unit within the designated waming zone goes into alarm (see Fig. 2.5-14a).
Field wiring connects the CAAS console at C-300 to the cluster units, the warning devices, the RAC, and the BHRC located in each building; the wiring is channeled through two radiation alarm master terminal cabinets located in the basement of Building C-300. The tenninal connections in these master terminal cabinets are configured to allow connection flexibility in the CAAS. This flexibility derives from the capability to interconnect in the master terminal cabinet relay contacts associated with the cluster relays to the desired horn and beacon control relays located in the RACs and BHRCs.
2-12c
SAR-PGDP Chapter 4, Appendix A February 26,1999 RAC 98C149 (RO)
The building horns can be manually controlled by the hom control switch operating in conjunction with the llORN PERMISSIVE switch, both of which are located on the CAAS console in Building C-300. These switches are also used to disable the building horns during testing or maintenance to prevent unwanted alarm signals.
Slave building horns are located in buildings that do not have a cluster unit but where evacuation of plant personnel is required when a cluster unit in the affected area of coverage is activated, refer to Table 2.5.la for more information.
Clusters which are located in an outdoor environment are equipped with a low temperature alann (TSLL-129). The TSLL-129 alarm contacts (when installed) will initiate a CLUSTER TROUBLE alarm in C-300 if the external temperature of the cluster approaches the cluster's specified minimum operating temperature, Beacons The red rotating or strobe beacons are operated in the same manner as the horns for the building except that relay Y provides the initiation. The beacons, mounted on the exterior of the monitored building, can be turned off after an alarm or a test by using the key-operated BUILDING LIGHTS RESET switch located on the RAC in the affected building. These lights are powered from a local 120 V ac source within the affected building.
l 2.5.1.2.3 Central control facility Changes were also made in C-300 for the CAAS. These changes and their descriptions are provided in Sect. 2.5.2.
2.5.1.2.4 Spare equipment It wi!! be necessary to take the local alarm horns out of service to perform testing and/or maintenance on a periodic basis. In addition, some failure within these components is expected to occur. Therefore, portable alarm units will be available for quickly locating to an existing area to allow continued operation in accordance with the TSRs. These units will be similar to the existing units with the exception that they will be portable to allow maneuverability. The portable clusters are equipped to be operated as standalone units or replacements for a fixed cluster. For details on operability requirements, refer to the TSRs.
2.5.1.3 System Analysis The system analysis will address each point of the criteria in the same sequence they are provided in Sect.
2.5.1.1. The analysis will show how the system meets the specific requirements and/or provide justification for not meeting the requirements.
The CAAS is required to provide coverage of areas in accordance with Sect. 4.2 of ANSI /ANS 8.3'. The range of detection for each cluster is based on the minimum accident of concern indicated in ANSI /ANS 8.3.
The individual plant areas requiring coverage during normal and abnormal operations were identified. Fig. 2.5-2 indicates the individual clusters that are provided to detect a criticality accident. Plant areas that may contain 2
enriched material greater than or equal to I wt % "U during nonroutine operating conditions will require a minimum of one CAAS unit to be stationed in each area where the material will be processed. NCS will be required to approve the location of the alarms before operation.
2-12d
I 9
g 1
l SAR-PGDP Chapter 4, Appendix A June 25,1999 RAC 98Cl49 (R0/RI)
Table 2.5-la. Criticality clusters and building alarms (New Configuration) l l
Building Clusters / alarms Nates l
C-310/310-A G and H Building horns and lights.
l
)
C-331 J, K, and L Building horns and lights. Clusters will also l
actuate horns and lights associated with the C-l l
331/335 tie line.
l C-333 Z and AJ Building horns and lights. Either cluster will also I
actuate horns and lights at C-333A.
l C-333-A AA and AB Building horns and lights. Either cluster will also l
actuate building horns and lights in C-333 l
C-335 A, B, C,and AF Building horns and lights. Clusters will also l
actuate horns and lights associated with the C-l 331/335 tie line.
l C-337 T,U,V,W,X, Building horns and lights. Clusters in C-337 will l
Y, and AK also actuate building horns and lights in C-337-A l
C-337-A N
Building horns and lights. Cluster N in C-337-A l
will actuate building horns and lights in C-337 and l
horns associated with the C-337A/360 tie line.
l C-360 R and S Building horns and lights.
l C-400 D and E Building horns and lights. Either cluster will also l
actuate building horns in C-420.
l C-409 P and AE Building horns and lights.
l C-710 AM, AN, AP, Building horns.
l AQ.AR l
C-746-Q AC and AD Building horns and lights.
l C-720 AL Nilding horn.
l l
2-20a
SAR-PGDP Chapter 4, Appendix A February 26,1999 RAC 98C149 (RO)
Blank Page l
2-20b 1
1