ML21133A082
| ML21133A082 | |
| Person / Time | |
|---|---|
| Site: | Limerick  |
| Issue date: | 04/29/2021 |
| From: | Exelon Generation Co |
| To: | Office of Nuclear Reactor Regulation |
| Shared Package | |
| ML21138A803 | List:
|
| References | |
| Download: ML21133A082 (124) | |
Text
LGS UFSAR 7.6 ALL OTHER INSTRUMENTATION SYSTEMS REQUIRED FOR SAFETY 7.
6.1 DESCRIPTION
This section examines and discusses the instrumentation and control aspects of the safety-related portions of the following plant systems:
- a. Process radiation monitoring systems
- 1. Main steam line radiation monitoring system
- 2. Reactor enclosure ventilation exhaust radiation monitoring system
- 3. Refueling area ventilation exhaust radiation monitoring system
- 4. Control room ventilation radiation monitoring system
- 5. Control room emergency fresh air radiation monitoring system
- 6. Primary containment post-LOCA radiation monitoring system
- 7. RHRSW radiation monitoring system
- 8. North stack effluent radiation monitoring system
- b. High pressure/low pressure systems interlocks
- c. Leak detection systems
- 1. Main steam line leak detection system
- 2. RCIC system leak detection system
- 3. RWCU system leak detection system
- 4. HPCI system leak detection system
- d. Neutron monitoring system
- 1. Intermediate range monitor system
- 2. Local power range monitor system
- 3. Average power range monitor system
- e. Safety/relief valve position indication system
- f. Containment instrument gas system - ADS control
- g. Safeguard piping fill system CHAPTER 07 7.6-1 REV. 20, SEPTEMBER 2020
- h. Redundant reactivity control system Systems not related to safety, and nonsafety-related portions of the above systems, are discussed in Section 7.7.
7.6.1.1 Process Radiation Monitoring Systems - Instrumentation and Controls Radiation monitoring systems are provided on process liquid and gas lines that serve as discharge routes for radioactive materials. These include the following safety-related systems.
(Nonsafety-related systems are described in Section 7.7.1.9.)
This system classification is provided in Table 3.2-1. The locations of radiation monitoring sensors identified in Section 7.6 are provided in Table 7.6-6. Additional discussion of the process radiation monitors is provided in Section 7.3.2.2.2.3.
7.6.1.1.1 Main Steam Line Radiation Monitoring System - Instrumentation and Controls 7.6.1.1.1.1 MSL-RMS Identification High radiation in the vicinity of the main steam lines indicates a gross release of fission products from the fuel.
The high radiation alarm setting is selected high enough above background radiation levels to avoid spurious alarms, yet low enough to promptly detect a gross release of fission products from the fuel.
The objective of the MSL-RMS is to monitor for the gross release of fission products from the fuel and, upon indication of such release, to initiate appropriate alarms.
7.6.1.1.1.2 MSL-RMS Power Sources The 120 V ac RPS buses A and B are the power sources for the MSL-RMS. Two channels are powered from one RPS bus, and the other two channels are powered from the other RPS bus.
7.6.1.1.1.3 MSL-RMS Initiating Circuits Four gamma-sensitive instrument channels monitor the gross gamma radiation from the main steam lines. The detectors are physically located near the main steam lines just downstream of the outboard MSIVs. The detectors are geometrically arranged to detect significant increases in radiation level with any number of main steam lines in operation. Their location along the main steam lines allows the earliest practicable detection of a gross fuel failure.
Each monitoring channel consists of a gamma-sensitive ion chamber and a log radiation monitor, as shown in drawings M-26 and M-41. Capabilities of the monitoring channel are listed in Table 11.5-1. Each log radiation monitor has four trip circuits: one upscale high-high trip and one inoperative trip, either of which results in an alarm and a trip of the mechanical vacuum pump and its suction valve; one upscale high trip and one downscale trip, either of which results in an alarm only. The output from each log radiation monitor is displayed on a meter in the control enclosure.
CHAPTER 07 7.6-2 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.1.1.1.4 MSL-RMS Logic and Sequencing When a significant increase in the main steam line radiation level is detected (high-high condition),
an alarm is given in the control room. At the same time, a trip signal is issued to stop the Mechanical Vacuum Pump and close its input line. This function is not safety related. The logic of pump trip is 1-out-of-2. Failure of one monitoring channel will not prevent a Mechanical Vacuum Pump trip; however, a failure in one monitoring channel in the high-high direction will cause an inadvertent MVP trip.
7.6.1.1.1.5 MSL-RMS Bypasses and Interlocks No operational bypasses are provided with this system; however, the individual log radiation monitors may be bypassed for maintenance or calibration by the use of test switches on each monitor. The main steam line radiation monitors provide trip signals to operate the mechanical vacuum pump and close the vacuum pump line isolation valve.
7.6.1.1.1.6 MSL-RMS Redundancy and Diversity The number of monitoring channels in this system provides the required redundancy and is verified in the circuit description.
The single failure criterion is met in the design by providing redundant sensors, logic channels, and trip systems that are seismically and environmentally qualified. The failure of a single component does not prevent the system from functioning in the event that protective action is required.
There is no diversity of monitoring variables.
7.6.1.1.1.7 MSL-RMS Testability A built-in source of adjustable current is provided to simulate sensor input to each log radiation monitor for test purposes. The operability of each monitoring channel can be routinely verified by comparing the outputs of the channels during power operation.
7.6.1.1.1.8 MSL-RMS Environmental Considerations This system is designed, and has been qualified, to meet the environmental conditions indicated in Section 3.11. In addition, this system is seismically qualified as described in Section 3.10.
7.6.1.1.1.9 MSL-RMS Operational Considerations In the event of a high or low radiation condition detected within any of the channels, the system automatically activates the appropriate alarm annunciator in the control room. Radiation level indication is provided in the auxiliary equipment room. A continuous radiation record for any two selected channels is provided in a 2-pen recorder in the control room.
The panels in the control room, associated with the PCRVICS, are identified by tags that indicate the panel function and identification of the contained logic channels.
The only direct support required for the MSL-RMS is the electrical power system, which is provided from 120 V ac RPS buses A and B as described in Section 7.3.1.1.2.2 and Chapter 8.
CHAPTER 07 7.6-3 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.1.1.2 Reactor Enclosure Ventilation Exhaust Radiation Monitoring System - Instrumentation and Controls 7.6.1.1.2.1 REVE-RMS Identification The purpose of this system is to indicate when excessive amounts of radioactivity exist in the reactor enclosure ventilation exhaust and to provide signals for initiation of appropriate action so that the release of radioactive gases to the environs is limited to levels below guidelines of published regulations. The radiation monitoring system is shown in drawing M-26. Instrument characteristics are given in Table 7.6-1. The system consists of four independent channels monitoring the reactor zone.
Refer to Section 7.3.1.1.9 for a description of the isolation function for this system.
7.6.1.1.2.2 REVE-RMS Power Sources The 120 V ac RPS buses A and B are the power sources for these systems. Two channels receive power from one RPS bus, and the other two channels receive power from the other RPS bus.
7.6.1.1.2.3 REVE-RMS Initiating Circuits Each channel includes a GM-type of detector and an indicator and trip unit. Two channels share a 2-pen strip-chart recorder. All equipment except the detectors is located in the control room and the auxiliary equipment room. The detectors are located in the reactor enclosure HVAC discharge ducts.
7.6.1.1.2.4 REVE-RMS Logic and Sequencing Each channel has an upscale trip as described in Section 11.5.2.
The four upscale trips are arranged into two trip systems, A and B. When both channels of either A or B are tripped, the resultant output of the trip system is an isolation signal that trips fans, closes valves to the vent exhaust system, and initiates the SGTS. The isolation signal also initiates isolation of the following primary containment lines: purge, vent, atmosphere sample containment, and instrument gas suction and discharge lines. There are two isolation valves in each of the above lines. Each trip system operates one or the other of these valves. The two valves in each line are redundant, and one is sufficient to provide isolation.
7.6.1.1.2.5 REVE-RMS Bypasses and Interlocks No operational bypasses are provided, but the trip units for each sensor channel may be bypassed for maintenance or testing. Bypassing the trip unit causes a downscale alarm and actuates the upscale trip for the channel.
7.6.1.1.2.6 REVE-RMS Redundancy and Diversity As discussed in Section 7.6.1.1.2.4, the reactor enclosure ventilation exhaust radiation monitoring system consists of four independent sensors and trip units, sensing a common variable. This CHAPTER 07 7.6-4 REV. 20, SEPTEMBER 2020
LGS UFSAR independence provides sufficient redundancy to ensure that a high radiation condition will be detected and protective action initiated.
No diversity of trip variables is provided.
7.6.1.1.2.7 REVE-RMS Testability The monitors are readily accessible for inspection, calibration, and testing. Operability of the detectors can be verified through use of a portable gamma source.
7.6.1.1.2.8 REVE-RMS Environmental Considerations The environmental considerations are given in Section 3.11.
In addition, this system is seismically qualified for conditions of an SSE as indicated in Section 3.10.
7.6.1.1.2.9 REVE-RMS Operational Considerations 7.6.1.1.2.9.1 REVE-RMS General Information The reactor enclosure ventilation exhaust radiation monitoring system is required to prevent release of radioactive materials to the environs. The isolation function is performed automatically and provides annunciation in the control room to alert operating personnel of the condition.
7.6.1.1.2.9.2 REVE-RMS Reactor Operator Information REVE-RMS and RAVE-RMS radiation alarms are combined in the control room. REVE-RMS and RAVE-RMS channels A/B and C/D share high-high/downscale alarms in the control room. There is an additional upscale alarm shared by all channels of the RAVE-RMS and REVE-RMS. Refer to Table 7.3-5 for system characteristics and display ranges.
7.6.1.1.2.9.3 REVE-RMS Setpoints Refer to the Technical Specifications.
7.6.1.1.3 Refueling Area Ventilation Exhaust Radiation Monitoring System - Instrumentation and Controls 7.6.1.1.3.1 RAVE-RMS Identification The purpose of this system is to indicate when excessive amounts of radioactivity exist in the refueling area ventilation exhaust, and to provide signals for initiation of appropriate action so that the release of radioactive gases to the environs is limited to levels below guidelines of published regulations. The radiation monitoring system is shown in drawing M-26 and its specifications are given in Table 7.3-5. The system consists of four independent channels.
Refer to Section 7.3.1.1.17 for a description of the isolation function.
CHAPTER 07 7.6-5 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.1.1.3.2 RAVE-RMS Power Sources The 120 V ac RPS buses A and B are the power sources for these systems. Two channels receive power from one RPS bus, and the other two channels receive power from the other RPS bus.
7.6.1.1.3.3 RAVE-RMS Initiating Circuits Each channel includes a GM-type detector and an indicator and trip unit. Two channels share a 2-pen strip-chart recorder. All equipment except the detectors are located in the control room and auxiliary equipment room.
7.6.1.1.3.4 RAVE-RMS Logic and Sequencing Each channel has an upscale trip as described in Section 11.5.2.
The four upscale trips are arranged into two trip systems, A and B. When both channels of either A or B are tripped, the resultant output of the trip system is an isolation signal that trips fans, closes valves to the vent exhaust system, and initiates SGTS. The isolation signal also initiates isolation of the following primary containment lines: purge, vent, atmosphere sample containment, instrument gas suction and discharge lines. There are two isolation valves in each of the above lines. Each trip system operates one of the valves. The two valves in each line are redundant, and one is sufficient to provide isolation.
7.6.1.1.3.5 RAVE-RMS Bypasses and Interlocks No operational bypasses are provided, but the trip units for each sensor channel can be bypassed for maintenance or testing. Bypassing the trip unit causes a downscale alarm and actuates the upscale trip for the channel.
7.6.1.1.3.6 RAVE-RMS Redundancy and Diversity As discussed in Section 7.6.1.1.3 the RAVE-RMS consists of four independent sensors and trip units, sensing a common variable. This independence provides sufficient redundancy to ensure that a high radiation condition is detected and protective action initiated.
No diversity of trip variables is provided.
7.6.1.1.3.7 RAVE-RMS Testability The monitors are readily accessible for inspection, calibration, and testing. Operability of the detectors can be verified through use of a portable gamma source.
7.6.1.1.3.8 RAVE-RMS Environmental Considerations The environmental considerations are given in Section 3.11.
In addition, this system is seismically qualified for conditions of an SSE as indicated in Section 3.10.
CHAPTER 07 7.6-6 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.1.1.3.9 RAVE-RMS Operational Considerations 7.6.1.1.3.9.1 RAVE-RMS General Information The RAVE-RMS is required to prevent release of radioactive materials to the environs. The isolation function is performed automatically and provides annunciation in the control room to alert operating personnel of the condition.
7.6.1.1.3.9.2 RAVE-RMS Reactor Operator Information REVE-RMS and RAVE-RMS radiation alarms are combined in the control room. REVE-RMS and RAVE-RMS channels A/B and C/D share high-high/ downscale alarms in the control room. There is an additional upscale alarm shared by all channels of the RAVE-RMS and REVE-RMS. Refer to Table 7.3-5 for system characteristics and display ranges.
7.6.1.1.3.9.3 RAVE-RMS Setpoints Refer to the Technical Specifications.
7.6.1.1.4 Control Room Ventilation Radiation Monitoring System - Instrumentation and Controls 7.6.1.1.4.1 CRV-RMS Identification In the event of an accident in which a significant quantity of radioactive material escapes from the plant, there is a risk that a hazardous quantity of this material could be introduced into the control room and auxiliary equipment room via the intake louvers. In this eventuality, these rooms could become uninhabitable, and the capability of plant shutdown under accident conditions could be curtailed.
The CRV-RMS detects the presence of radioactivity in the intake louvers leading to the control room and auxiliary equipment room. Trip setting is selected at such a level as to close the air intake dampers before the radioactivity level in these rooms reaches a unacceptable level. The emergency fresh air system is also actuated by this trip.
7.6.1.1.4.2 CRV-RMS Power Supplies Power to this monitoring system is supplied from four 120 V ac Class 1E buses, Divisions I, II, III, and IV.
7.6.1.1.4.3 CRV-RMS Initiating Circuits The system initiating circuits are described in Sections 6.4, 7.3.1.1.10, and 9.4.1.
7.6.1.1.4.4 CRV-RMS Logic and Sequencing Four independent sensors and isolation logic channels are provided to ensure protective action when required and to prevent inadvertent isolation resulting from instrumentation malfunctions.
When a predetermined increase in radioactivity above normal background is detected, trip signals are transmitted to the control room dampers and emergency fresh air system. The output trip signal of each radiation detector initiates a logic division trip. The output trip signals are combined CHAPTER 07 7.6-7 REV. 20, SEPTEMBER 2020
LGS UFSAR in a one-out-of-two-twice logic. Logic A or C and B or D are required to initiate control room isolation. Failure of any one channel does not result in an inadvertent isolation action.
7.6.1.1.4.5 CRV-RMS Redundancy and Diversity Redundancy of trip initiation signals for high radioactivity is provided by four independent detectors.
Each radiation signal is associated with one of four logics with different power sources. Diversity of trip initiation signals is neither required nor provided.
7.6.1.1.4.6 CRV-RMS Testability A built-in source for simulating a midrange radioactivity level is provided to simulate sensor input to each radiation detector for test purposes. The operability of each monitoring channel can be routinely verified by comparing the outputs of the channels during power operation.
7.6.1.1.4.7 CRV-RMS Environmental Considerations This system is designed and qualified to meet the environmental conditions under all plant operating conditions. In addition, this system is seismically qualified as described in Section 3.10.
7.6.1.1.4.8 CRV-RMS Operational Conditions Both control trip and annunciation capabilities are provided for by this system.
7.6.1.1.5 Control Room Emergency Fresh Air Radiation Monitoring System - Instrumentation and Controls 7.6.1.1.5.1 CREFA-RMS Identification The CREFA-RMS is subordinated to the control room ventilation monitoring system. If the concentration of radioactive material entering the control room ducts reaches an unacceptable level, the control room radiation monitors trip, close the ventilation dampers, and start up the emergency fresh air system. In this eventuality, the control room radiation monitors are no longer functional, and the CREFA-RMS takes over the function of monitoring the control room ventilation air supply. Most of the noble gases present in the ventilation air pass through the HEPA charcoal filters, where the radioactive particulates and iodines are filtered out. Thus, the CREFA-RMS located downstream of the HEPA charcoal filters, continues to alarm as long as the unacceptable condition persists. If the control room operator judges that the concentration of noble gases entering the control room is unacceptable, the operator shuts off the ventilation system completely.
The CREFA-RMS also provides information as to when the unacceptable condition has ended.
7.6.1.1.5.2 CREFA-RMS Power Supplies Power to this monitoring system is supplied from two 120 V ac Class 1E buses, Divisions III and IV.
7.6.1.1.5.3 CREFA-RMS Initiating Circuits The CREFA-RMS does not initiate any controls.
CHAPTER 07 7.6-8 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.1.1.5.4 CREFA-RMS Logic and Sequencing The CREFA-RMS is comprised of two independent and redundant channels. The trip circuits do not provide any control functions. Alarms annunciate in response to high, high-high, and downscale trips. Failure of either channel does not prevent the alarms or readouts from functioning.
7.6.1.1.5.5 CREFA-RMS Redundancy and Diversity Redundancy of trip signals for high radioactivity is provided by two independent detectors. Each detector is supplied by a separate power source.
7.6.1.1.5.6 CREFA-RMS Testability A built-in source for simulating a midrange radioactivity level is provided to simulate sensor input to each radiation detector for test purposes. The operability of each monitoring channel can be routinely verified by comparing the outputs of the channels during power operation.
7.6.1.1.5.7 CREFA-RMS Environmental Considerations This system is designed and qualified to meet the environmental conditions under all plant operating conditions. In addition, this system is seismically qualified as described in Section 3.10.
7.6.1.1.5.8 Operational Considerations The CREFA-RMS provides only alarm annunciation capability and readouts in the control room.
No control functions are involved.
7.6.1.1.6 Primary Containment Post-LOCA Radiation Monitoring System - Instrumentation and Controls 7.6.1.1.6.1 PCPL-RMS Identification The objective of the PCPL-RMS is to monitor the total intensity of gross radioactivity present inside the containment. In correlation with other points of consideration this information provides a basis for making postaccident decisions.
The PCPL-RMS is shown in drawing M-26and specifications are given in Table 7.6-1.
7.6.1.1.6.2 PCPL-RMS Power Sources Power to this monitoring system is supplied from two 120 V ac Class 1E power buses.
7.6.1.1.6.3 PCPL-RMS Redundancy and Diversity Four physically separated sensors, two in each of two electrical separation channels, provide the required redundancy.
CHAPTER 07 7.6-9 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.1.1.6.4 PCPL-RMS Testability A built-in source of adjustable current is provided to simulate sensor input to each radiation monitor for test purposes. The operability of each monitoring channel can be routinely verified by comparing the outputs of the channels during power operation.
7.6.1.1.6.5 PCPL-RMS Environmental Considerations This system is designed and qualified to meet the environmental conditions under post accident considerations. In addition, this system is seismically qualified as described in Section 3.10.
Under high drywell temperature conditions, Insulation Resistance (IR) leakage current will cause a system error. Because the instrument signal at low radiation levels is very weak, high temperature IR leakage current significantly affects the accuracy of the indicated readings up to a maximum of 112.5 Rad/hr at the maximum design drywell temperature of 340F. As a result, the indicated readings below 112.5 Rad/hr may not be within the factor of two accuracy recommendation of Regulatory Guide 1.97 Rev. 2. The induced error decreases exponentially with drywell temperature and becomes insignificant below 230F. This induced error is significant only under low radiation conditions coincident with high drywell temperatures, whereas the system will operate to perform its principal function under normal and varying temperature conditions during and following an accident.
7.6.1.1.6.6 PCPL-RMS Operational Considerations Continuous radiation levels are recorded on dedicated Class 1E recorders in the control room. Trip and annunciation capabilities are described in Section 11.5.2.3.1.
7.6.1.1.7 Residual Heat Removal Service Water Radiation Monitoring System - Instrumentation and Controls 7.6.1.1.7.1 RHRSW-RMS System Identification The purpose of the RHRSW-RMS is to indicate to operations personnel when the radioactivity of a liquid stream being released to the environs exceeds pre-established limits.
7.6.1.1.7.2 RHRSW-RMS Power Sources The 120 V ac uninterruptible buses are the power sources for this system.
7.6.1.1.7.3 RHRSW-RMS Equipment Design Design of this system is described in Section 11.5. This system is classified as a safety system in order to ensure that it will be functional after an SSE or LOCA in accordance with GDC 64.
7.6.1.1.7.4 RHRSW-RMS Circuit Description The RHRSW-RMS is shown in drawing M-26. Specifications are given in Table 7.6-1. Two channels monitor the common RHRSW discharges from Units 1 and 2 to the cooling pond.
CHAPTER 07 7.6-10 REV. 20, SEPTEMBER 2020
LGS UFSAR Each channel has a scintillation detector and a radiation monitor. Each detector monitors a sample of the process liquid for gamma activity. The sample is drawn from the process system, flows through the shielded sample chamber where it is monitored, and then is returned to the process system.
Indication is provided in the control room.
The RHRSW system provides cooling water for the RHR heat exchangers, which may contain radioactive water from leakage in the heat exchangers. Leaks that could contaminate the service water are detected by the two monitors for the service water effluent. A high radiation signal trips the RHRSW pumps.
7.6.1.1.7.5 RHRSW-RMS Logic and Sequencing The logic is provided in a single high signal. The trip signal shuts off the RHRSW pumps.
7.6.1.1.7.6 RHRSW-RMS Bypass and Interlocks None are provided.
7.6.1.1.7.7 RHRSW-RMS Redundancy and Diversity A single monitor is provided for each of the common RHRSW discharge lines. The loss of monitor operability is annunciated in the Main Control Room. Periodic grab sampling is used following a monitor failure.
7.6.1.1.7.8 RHRSW-RMS Actuated Devices The RHRSW pumps are subject to shutoff.
7.6.1.1.7.9 RHRSW-RMS Separation The channels associated with the common discharge lines are separated in accordance with IEEE 279, paragraph 4.6.
7.6.1.1.7.10 RHRSW-RMS Setpoints Setpoints are such that the instrument will trip the control room annunciator and the RHRSW pump when the radioactive concentration of the RHRSW equals or exceeds ten-times the 10CFR20, Appendix B, Table 2 activity limits (post-1994).
7.6.1.1.8 North Stack Effluent Radiation Monitoring System - Instrumentation and Controls 7.6.1.1.8.1 NSE-RMS System Identification Under an accident condition, the south stack is isolated, but the north stack continues to emit effluents received from the SGTS and other sources. Radioactivity levels in these effluents are monitored continually by means of the north stack monitoring system.
CHAPTER 07 7.6-11 REV. 20, SEPTEMBER 2020
LGS UFSAR Two independent subsystems, the normal range subsystem and the wide range accident monitoring subsystem, are provided as described in Sections 7.6.2.1.8 and 11.5.2.2.1.
7.6.1.1.8.2 NSE-RMS Power Sources Power to the wide range accident monitoring system is provided by one 120 V ac Class 1E bus.
7.6.1.1.8.3 NSE-RMS Redundancy and Diversity Although no redundancy is required, two independent radiation monitors are provided as part of the normal range subsystem. The wide range subsystem provides an extended measuring range designed to function during an accident and to follow decreasing concentrations of noble gases following an accident.
7.6.1.1.8.4 NSE-RMS Testability Built-in radioactive check sources for simulating midrange radiation levels are provided for each channel for test purposes. Remote controlled purge and check source capabilities are provided.
The operability of each monitoring channel can be routinely verified by comparing the outputs of the two monitoring systems during power operation.
7.6.1.1.8.5 NSE-RMS Environmental Considerations The wide range accident monitor has been designed and qualified to meet environmental conditions under all modes of plant operation, including accidents. The normal range monitor is designed to withstand the normal service environment.
7.6.1.1.8.6 NSE-RMS Operational Considerations Annunciation, computation, and recording capabilities are provided for this system. The equipment is located in an area where the radiation environment is sufficiently low to afford personnel access over the range of plant operating conditions. However, the instrumentation is designed for remote operation and control as well as data retrieval.
7.6.1.2 High Pressure/Low Pressure Systems Interlocks - Instrumentation and Controls 7.6.1.2.1 HPLPSI Function Identification The low pressure systems that interface with the RCPB, and the instrumentation that protects them from overpressurization, are discussed in this section.
7.6.1.2.2 HPLPSI Power Sources The power for the interlocks is provided from the essential power supplies for the associated systems.
7.6.1.2.3 HPLPSI Equipment Design At least two isolation valves are provided in series in each line.
CHAPTER 07 7.6-12 REV. 20, SEPTEMBER 2020
LGS UFSAR As discussed in Section 5.4.7.1.1.5, all components which make up the steam condensing mode of the RHR system have either been abandoned in place or physically removed from the plant.
Therefore, this mode is no longer required.
A list of high pressure/low pressure interlock equipment is provided in Table 7.6-7.
The interlocked valves of the HPLPSI meet BTP ICSB 3 in accordance with the following:
Two MOVs in Series (ICSB 3, paragraph 2)
E11-F008 and E11-F009 (RHR shutdown cooling suction outboard and inboard valves, respectively) are two manually activated MOVs in series. Both valves are inhibited from opening and close automatically if primary system pressure is above setpoint. Reactor pressure is also indicated in the control room. The logic components for both valves are independent. Each valve control circuit requires two reactor low pressure permissives before valves can open; this results in a four-out-of-four logic to open the suction line. Removal of one signal (one-out-of-four logic) isolates the line. The pressure permissive components rely on the transmitter trip unit combination which is testable from the control room.
Reactor pressure instrumentation used by the operator (via plant procedures) to initiate shutdown cooling is independent of the interlocks. Procedural controls ensure that the manually initiated shutdown cooling mode is not begun until the reactor pressure is below approximately 75 psig; A safety factor is maintained since the piping in the pump discharge has ratings that vary from 350-500 psig and the suction piping is rated at 190 psig.
Because of the foregoing additional safety design features, diversity of interlocks as suggested by ICSB 3, paragraph 2, has not been implemented for LGS. This is consistent with all other BWR testability (transmitter trip unit) enhanced plants such as Grand Gulf.
MOVs in Series with (Testable) Check Valves (ICSB 3, paragraph 3)
E11-F015A and E11-F015B (RHR shutdown cooling injection outboard valves) are manually activated MOVs in series with E11-F050A and E11-F050B (testable check AOVs),respectively.
These MOVs (loop A and B) are inhibited from opening and close automatically if primary system pressure is above setpoint. Both valves use the same valve control circuit, which requires two reactor low pressure permissives before the valves can open. Removal of one pressure permissive signal will close the valves.
The remaining HPLPSI valves in this discussion are required for ECCS operation. The recommendation of ICSB 3 was followed in evaluating ECCS high pressure/low pressure interlocks on an individual case basis.
Paired MOVs and Air-Operated Check Valves The valves listed below are paired MOVs and air-operated check valves, which isolate low pressure ECCS from higher pressure primary system.
E11-F017A, B, C, and D LPCI injection MOVs are interlocked to prevent opening when differential pressure across the valves exceeds the setpoint. This interlock applies to manual or automatic opening. The P is indicated by a permissive alarm in the control room. The normally closed core spray inboard injection valves (E21-F005 and E21-F037) and the normally open outboard injection CHAPTER 07 7.6-13 REV. 20, SEPTEMBER 2020
LGS UFSAR valves (E21-F004A and E21-F004B) are interlocked by high reactor pressure (one-out-of-two-twice logic) to prevent their receiving an opening signal on automatic system initiation. The inboard injection valve is interlocked by limit switch with outboard injection valve position to permit testing, such that it may be opened manually only if the outboard valve is closed. The outboard valve is interlocked so that during an automatic CS system initiation, the outboard valve close circuit will be disabled.
7.6.1.2.3.1 HPLPSI Circuit Description The RHR shutdown cooling suction valves from the recirculation line have independent interlocks to prevent the valves from opening when the reactor pressure is above the RHR system design pressure. These valves also receive a signal to close when reactor pressure is above the RHR system pressure.
The RHR shutdown cooling suction valve F008 is provided with an additional interlock which prevents a fire-induced open signal from causing it to open simultaneously with valve F009 when the reactor pressure is greater than the design capabilities of the RHR low-pressure piping.
The RHR system shutdown cooling discharge valves have two reactor pressure interlocks. Both of these low pressure permissives must be satisfied in order to open the valves. Each line has a remote testable check valve downstream of the discharge valve.
The RHR system LPCI injection valves open when differential pressure across the valves is low.
There is a remote testable check valve downstream of the injection valve in each loop.
The CS system injection valves open when reactor pressure decreases below the system design pressure. There is a remote testable check valve downstream of each injection valve. There is an additional check valve downstream of the injection valve on loop B.
7.6.1.2.3.2 HPLPSI Logic and Sequencing The RHR shutdown cooling valves are interlocked by reactor pressure in two-out-of-two logic. In all other cases, the sensor inputs operate the interlocks without logic combination.
7.6.1.2.3.3 HPLPSI Bypasses and Interlocks There are no bypasses or interlocks in the high pressure/low pressure interlocks.
7.6.1.2.3.4 HPLPSI Redundancy Each process line has two valves in series that are redundant in ensuring the interlock. The RHR shutdown cooling suction valves have independent interlocks to prevent the valves from opening when the reactor pressure is above the system design pressure.
The RHR shutdown cooling suction valve F008 is provided with an additional interlock which prevents a fire-induced open signal from causing it to open simultaneously with valve F009 when the reactor pressure is greater than the design capabilities of the RGR low-pressure piping.
7.6.1.2.3.5 HPLPSI Actuated Devices The MOVs listed in Section 7.6.1.2.3 and Table 7.6-7 are the actuated devices.
CHAPTER 07 7.6-14 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.1.2.3.6 HPLPSI Separation Separation is maintained between redundant portions of the high pressure/low pressure interlocks by assigning the signals for the redundant electrically controlled valves to separate electrical divisions (Section 7.1.2.2.).
The redundant high pressure interlocked valves are powered by separate essential electrical power. The relay logic, which performs the function of preventing valve opening unless pressure is below setpoint, is the same essential power as that of the associated interlocked valve. The interlocked valves of the HPLPSI are provided in Table 7.6-8.
The sensors that actuate the interlock logic (on pressure below setpoint) are on separate instrument lines and power such that no single failure can prevent core cooling. The electrical separation of the HPLPSI is consistent with the systems of which they comprise a part and represent no deviation from the intent of Regulatory Guide 1.75 as discussed in Section 8.1.6.1.14.
7.6.1.2.3.7 HPLPSI Testability The actuated devices (except those valves kept closed by reactor pressure interlocks) can be tested during reactor operation. The sensors are tested during reactor operation in the same manner that ESF sensors are tested. Refer to Section 7.3.1 for a discussion of testing ESF sensors.
7.6.1.2.4 HPLPSI Environmental Considerations The instrumentation and controls for the high pressure/low pressure interlocks are qualified as Class 1E equipment. The sensors are mounted on local instrument panels and the control circuitry is housed in panels in the auxiliary equipment room and the control room. Refer to Sections 3.10 and 3.11 for details of the qualification testing.
7.6.1.2.5 HPLPSI Operational Considerations 7.6.1.2.5.1 HPLPSI General Information The high pressure/low pressure interlocks are strictly automatic. There is no manual actuation capability. If the operator initiates a low pressure system, the interlocks prevent exposure of the low pressure piping to high pressure.
7.6.1.2.5.2 HPLPSI Reactor Operator Information The status of each valve providing the high pressure/low pressure boundary is indicated in the control room. The state of the reactor pressure and RHR injection valve differential pressure sensors is indicated in the control room.
7.6.1.2.5.3 HPLPSI Setpoints The setpoints for HPLPSI are contained in Chapter 16.
7.6.1.3 Leak Detection System - Instrumentation and Controls CHAPTER 07 7.6-15 REV. 20, SEPTEMBER 2020
LGS UFSAR The LDS consists of the following safety-related subsystems:
- a. Main steam line leak detection system
- b. RCIC leak detection system
- c. RWCU leak detection system
- d. HPCI leak detection system 7.6.1.3.1 LDS Identification This section discusses the instrumentation and controls associated with the safety-related portion of the leak detection system. The nonsafety-related portion is described in Section 7.7.1.16. The LDS itself is discussed in Section 5.2.5.
The purpose of the leak detection system instrumentation and controls is to detect and provide the signals necessary to isolate leakage from the RCPB before predetermined limits are exceeded.
Environmental conditions and qualification for the leak detection system are discussed in Sections 3.10 and 3.11. Seismic qualification of the main steam line break detection subsystem is discussed in Section 7.3.2.2.2.3.1.5.
7.6.1.3.2 LDS Power Sources Separation requirements are applicable to leak detection signals that are associated with the PCRVICS. Four power sources are used to comply with separation criteria. The normal 120 V ac power feed to the equipment associated with Division 1, Division 2, Division 3 and Division 4 is from the safeguard DC/AC Inverters E21-K601A, B, C and D respectively. The alternate 120 V ac power source to the equipment is from safeguard instrument buses A, B, C and D respectively also.
7.6.1.3.3 LDS Equipment Design 7.6.1.3.3.1 LDS General The systems or parts of systems that contain water or steam coming from the reactor vessel or supply water to the reactor vessel, and which are in direct communication with the reactor vessel, are provided with leakage detection systems.
Outside the primary containment, the piping within each system monitored for leakage is in compartments or rooms separate from other systems wherever feasible, so that leakage may be detected by sump pump monitoring outside of containment, ambient and differential area temperature indications, high process flow, high process differential flow, level alarms, or area radiation indication.
7.6.1.3.3.2 Main Steam Line Leak Detection System - Instrumentation and Controls 7.6.1.3.3.2.1 MSL-LDS Identification CHAPTER 07 7.6-16 REV. 20, SEPTEMBER 2020
LGS UFSAR The main steam lines are constantly monitored for leaks by the LDS. Steam line leaks cause changes in at least one of the following monitored operating variables: area ambient and differential temperature, flow rate, or low water level in the reactor vessel. If a leak is detected, the detection system responds by triggering an annunciator and initiating a steam line isolation trip logic signal.
The MSL-LDS consists of four types of monitoring circuits:
- a. The first two of these circuits monitor the ambient and differential area temperature in the vicinity of the MSIVs and cause an alarm to be initiated when an observed temperature rises above a preset maximum. The ambient area temperature monitors will initiate a main steam line isolation when the observed temperature rises above a preset maximum. The ambient temperature monitors are located along the entire steam line.
- b. The third type of circuit monitors the volumetric rate and initiates an alarm and closure of isolation valves when the monitored flow rate exceeds a preset maximum.
- c. The fourth type of circuit monitors reactor vessel water level and sends a trip signal to the isolation valve logic when the level decreases below a preselected setpoint.
The MSL-LDS has no manual bypass switch because the MSIV isolation logic is A or C and B or D. This permits testing of a single channel without affecting the isolation function or causing inadvertent isolation. Annunciation of "Reactor isolation system out-of-service inboard" and "Reactor isolation system out-of- service outboard" is manually provided by individual "NORM-INOP" switches. Each MSL-LDS temperature monitor point has bypass capabilities, but this function is not used.
7.6.1.3.3.2.2 Main Steam Line Temperature in Outboard MSIV Room and Turbine Enclosure Main Steam Tunnel Monitoring Subsystem - Instrumentation and Controls 7.6.1.3.3.2.2.1 Identification High ambient temperature in the areas in which the main steam lines are located outside of the primary containment could indicate a leak in a main steam line. Each main steam line isolation logic channel is tripped by high ambient temperature in the outboard MSIV room or main steam tunnel. The automatic closure of various valves prevents the excessive loss of reactor coolant and the release of a significant amount of radioactive material from the RCPB.
High temperature in the vicinity of the main steam lines is detected by dual element thermocouples located above the main steam lines between the primary containment wall and the turbine. The detectors are located or shielded so that they are sensitive to air temperature and not the radiated heat from hot equipment.
The temperature sensors give an input to temperature indicating switches.
The temperature detection system is designed to detect steam leaks equivalent to 5 gpm. A total of 4 main steam line high ambient temperature channels are provided in the outboard MSIV room and 32 are provided on the main steam line in the turbine enclosure. Each main steam line CHAPTER 07 7.6-17 REV. 20, SEPTEMBER 2020
LGS UFSAR isolation logic channel is tripped by high ambient temperature in the outboard MSIV room, or in the turbine enclosure.
Refer to Section 7.3 for a description of the isolation function.
7.6.1.3.3.2.2.2 Power Supplies Power supplies are discussed in Section 7.3.1.1.2.
7.6.1.3.3.2.2.3 Initiating Circuits Four ambient temperature sensing circuits monitor the outboard MSIV room, and thirty-two monitor the turbine enclosure. The temperature elements are connected to four separate instrumentation channels. The 36 ambient temperature elements are physically located near the main steam lines in the outboard MSIV room and the turbine enclosure. The locations of the temperature elements provide the earliest practicable detection of a main steam line leak.
7.6.1.3.3.2.2.4 Logic and Sequencing When a predetermined increase in ambient temperature is detected, trip signals are transmitted to the PCRVICS. The PCRVICS initiates closure of all main steam line isolation and drain valves.
Four instrumentation channels are provided to ensure protective action when needed and to prevent inadvertent isolation resulting from instrumentation malfunctions.
The output trip signal of each logic channel initiates a trip logic division trip. The output trip signals of the trip logic divisions are combined in one-out-of-two-twice for the MSIVs or two-out-of-two logics for the main steam line drains. Logic channels A or C and B or D are required to initiate main steam line isolation. Logic channels A and B or C and D are required to initiate main steam line drain isolation. Thus, failure of any one division does not result in inadvertent action.
7.6.1.3.3.2.2.5 Redundancy and Diversity Redundancy of trip initiation signals for high ambient temperature is provided by 16 thermocouples installed at different locations within the main steam line tunnel. The temperature indicating switches associated with each thermocouple provides an input to one of four logic channels.
Ambient temperature indicating switches A, B, C and D are normally powered by 120 V ac from the safeguard DC/AC Inverters E21-K601A, B, C and D respectively. The alternate power source to these switches is from the 120 V ac safeguard instrument buses A, B, C and D respectively also.
Diversity of trip initiation signals for a main steam line leak is provided by main steam line tunnel ambient temperature, main steam line high flow, and steam line low pressure instrumentation. An increase in ambient temperature, main steam line flow, or a decrease in pressure initiates main steam line and main steam line drain valve isolation.
7.6.1.3.3.2.2.6 Bypasses and Interlocks There are no bypasses associated with this system or interlocks to other systems from a main steam line tunnel high temperature trip. Each MSL-LDS temperature monitor point has bypass capabilities, but this function is not used.
CHAPTER 07 7.6-18 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.1.3.3.2.2.7 Testability Testability is the same as discussed in Section 7.3.1.1.2.11.
7.6.1.3.3.2.2.8 Environmental Considerations This system is designed and qualified to meet the environmental conditions indicated in Section 3.11. This subsystem, except for the sensors located in the reactor enclosure, is installed in the turbine enclosure. Seismic qualification of the subsystem is discussed in Section 7.3.2.2.2.3.1.5.
7.6.1.3.3.2.3 Main Steam Line High Flow Monitoring Subsystem - Instrumentation and Controls 7.6.1.3.3.2.3.1 Identification Main steam line high flow could indicate a breach in a main steam line. Automatic closure of isolation valves prevents excessive loss of reactor coolant and release of significant amounts of radioactive material from the RCPB.
The main steam line high flow trip setting is high enough to permit isolation of one main steam line for test at rated power without causing an automatic isolation of the other steam lines, yet low enough to permit early detection of a steam line break.
High flow in each main steam line is sensed by four indicating differential pressure sensors that sense the pressure difference across the flow element in each line.
Refer to Section 7.3.1 for a description of the isolation function.
7.6.1.3.3.2.3.2 Power Supplies Refer to Figures 7.3-1 and 7.3-2.
7.6.1.3.3.2.3.3 Initiating Circuits Sixteen differential pressure indicating switches, four for each main steam line, monitor the main steam line flow. Four differential pressure indicating sensors are installed on each main steam line and provide the earliest practicable detection of a main steam line break. One differential pressure circuit for each main steam line is associated with each of four logics.
7.6.1.3.3.2.3.4 Logic and Sequencing When a significant increase in main steam line flow is detected, trip signals are transmitted to the PCRVICS. The PCRVICS initiates closure of all main steam line isolation and drain valves on any significant main steam line break.
Four instrumentation logics are provided to ensure protective action when required and to prevent inadvertent isolation resulting from instrumentation malfunctions. The output trip signal of each instrumentation channel initiates a division logic trip. The output trip signals of the logic divisions are combined in one-out-of-two-twice and two-out-of-two logics is shown in Figures 7.3-1 and 7.3-2. Logic divisions A or C and B or D are required to initiate main steam line isolation. Logic CHAPTER 07 7.6-19 REV. 20, SEPTEMBER 2020
LGS UFSAR divisions A and B or C and D are required to initiate main steam line drain isolation. Failure of any one logic does not result in inadvertent action.
7.6.1.3.3.2.3.5 Redundancy and Diversity Redundancy of trip initiation signals for high flow is provided by two groups of redundant differential pressure sensors for each main steam line. Each differential pressure sensor for each main steam line is associated with one of four logic divisions. Two differential pressure trip channels for each main steam line are supplied from 120 V ac RPS bus A, and two are supplied from 120 V ac RPS bus B.
Diversity of the trip initiation signals for a main steam line break is provided by main steam line high flow, main steam line tunnel ambient temperature and main steam low pressure. An increase in main steam line flow, ambient temperature or a decrease in pressure initiates main steam line drain valve isolation.
7.6.1.3.3.2.3.6 Bypasses and Interlocks There are no bypasses associated with this system or interlocks to other systems from main steam line high flow trip signals.
7.6.1.3.3.2.3.7 Testability Testability is discussed in Section 7.3.1.1.2.11.
7.6.1.3.3.2.3.8 Environmental Considerations This system is designed and qualified to meet the environmental conditions indicated in Section 3.11. In addition, this subsystem is seismically qualified as described in Section 3.10.
The main steam line leak detection containment isolation function is discussed in Section 7.3.1.
7.6.1.3.3.3 RCIC Leak Detection System - Instrumentation and Controls 7.6.1.3.3.3.1 RCIC-LDS Identification The steam lines of the RCIC system are constantly monitored for leaks and breaks by the following types of monitoring circuits:
- a. Equipment area and pipe chase area ambient and differential temperature monitoring (leaks)
- b. RCIC steam flow rate monitoring (pipe break)
- c. RCIC steam line pressure monitoring (pipe break)
Setpoints are predetermined which indicate a possible leak. If the setpoint is reached, an RCIC autoisolation signal is initiated and an annunciator activated in the control room.
CHAPTER 07 7.6-20 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.1.3.3.3.2 RCIC-LDS Power Sources Refer to Sections 7.4.1.1.2 and 7.6.1.3.2.
7.6.1.3.3.3.3 RCIC Equipment Area and Pipe Chase Area Ambient and Differential Temperature Monitoring Subsystem - Instrumentation and Controls 7.6.1.3.3.3.3.1 Circuit Description RCIC area temperatures are monitored by instrumentation of the LDS. Monitored temperatures include the following:
- a. RCIC pipe chase area temperatures
- b. RCIC compartment ambient temperature
- c. RCIC area ventilation air differential temperature 7.6.1.3.3.3.3.2 Initiating Circuits For Unit 1, ten ambient temperature elements are installed in the RCIC pipe chase areas. Five sensors are associated with each autoisolation logic division. For Unit 2, eight ambient temperature elements are installed in the RCIC pipe chase areas. Four sensors are associated with each autoisolation logic division. Seven temperature elements are installed in the RCIC equipment compartment. Four of these elements form two differential temperature pairs which monitor high ventilation air differential temperature. One pair is associated with one logic division and the other pair is associated with the other logic division. The other three temperature elements monitor the RCIC pump compartment ambient temperature. One ambient temperature element is associated with one logic division and the other two ambient temperature elements are associated with the other logic division.
7.6.1.3.3.3.3.3 Logic and Sequencing When any one monitored temperature reaches its setpoint, an RCIC autoisolation signal is initiated and an annunciator activated in the control room.
Closure of the outboard RCIC steam supply isolation valve and steam line warm-up isolation valve is controlled by one logic division and the inboard steam supply isolation valve by the other logic division.
Two instrumentation channels are provided to ensure protective action when required.
In order to close both the inboard and outboard isolation valves, both logic divisions must trip.
Protection against inadvertent isolation due to instrumentation malfunction is not required or provided.
The manual bypass switch bypasses the temperature leak detection signal from the RCIC isolation logic. The RCIC isolation is arranged such that a trip of any one of the temperature indicating switches results in RCIC isolation and RCIC turbine trip. The bypass switch allows testing without isolating the RCIC system. Administrative control is provided by a two-position key-lock bypass CHAPTER 07 7.6-21 REV. 20, SEPTEMBER 2020
LGS UFSAR switch, with the key removable in the normal position. Separate switches are provided for each of the redundant divisions.
Each RCIC-LDS temperature monitor point has bypass capabilities, but this function is not used.
Divisional level of bypass is indicated automatically in the control room when the respective divisional switch is placed in bypass position. System level annunciation of "RCIC system out-of-service" is automatically annunciated in the control room when either of the bypass switches is placed in the bypass position.
The RCIC isolation function will still be available from the redundant logic. Manual capability to actuate system level annunciation of "RCIC system out-of-service" is provided by separate NORMAL-INOP switches for the redundant divisions. Annunciation will occur when either of the divisional switches is placed in the INOP position. The RCIC bypass switch and the RCIC system is in conformance to Regulatory Guide 1.47. The HPCI leak detection system has a bypass switch that serves the same capacity as the RCIC bypass switch. All of the comments made for the RCIC system are applicable to the HPCI system. The HPCI system conforms to all of the requirements of Regulatory Guide 1.47.
7.6.1.3.3.3.4 RCIC Steam Flow Rate Monitoring Subsystem - Instrumentation and Controls 7.6.1.3.3.3.4.1 Circuit Description The RCIC steam line connecting the nuclear boiler and the RCIC turbine is monitored by differential pressure sensors which signal a high steam flow rate condition.
7.6.1.3.3.3.4.2 Initiating Circuits Two differential pressure sensors are installed on separate taps of a venturi flow element inside the primary containment. Steam flow rate in excess of a predetermined setpoint indicates a possible steam line break and initiates a sensor trip signal.
Spurious system isolations are precluded by a time delay that prevents short-term flow peaks from initiating system isolation. At the end of the timing period, system isolation will occur only if the initiating signal remains above the trip setpoint. Time delay will reset each time signal drops below setpoint.
7.6.1.3.3.3.4.3 Logic and Sequencing The autoisolation logic utilizes one-out-of-two logic. Closure of the outboard RCIC steam supply isolation valve and steam line warm-up isolation valve is controlled by one logic division and the inboard steam supply isolation valve by the other logic division.
7.6.1.3.3.3.5 RCIC Steam Line Pressure Monitoring Subsystem - Instrumentation and Controls 7.6.1.3.3.3.5.1 Circuit Description The RCIC steam line connecting the nuclear boiler and the RCIC turbine is monitored by four pressure sensors which signal a low steam supply pressure condition.
CHAPTER 07 7.6-22 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.1.3.3.3.5.2 Initiating Circuits Four pressure sensors are installed on the steam pipe. Steam pressure below a predetermined setpoint indicates a possible line break and initiates a sensor trip signal.
7.6.1.3.3.3.5.3 Logic and Sequencing The autoisolation logic utilizes two-out-of-two logic in each logic division. Closure of the outboard RCIC steam supply isolation valve and steam line warm-up isolation valve is controlled by one logic division and the inboard steam supply isolation valve by the other logic division.
7.6.1.3.3.3.6 RCIC Turbine Exhaust Diaphragm Pressure Monitoring Subsystem - Instrumentation and Controls 7.6.1.3.3.3.6.1 Circuit Description The RCIC turbine exhaust diaphragm is monitored by pressure sensors which signal a high pressure condition.
7.6.1.3.3.3.6.2 Initiating Circuits Four pressure sensors monitor the turbine exhaust diaphragm. If monitored pressure exceeds a predetermined setpoint, indicating a possible diaphragm rupture, a sensor trip signal occurs.
7.6.1.3.3.3.6.3 Logic and Sequencing The autoisolation logic utilizes two-out-of-two logic in each logic division. Closure of the outboard RCIC steam supply isolation valve and steam line warm-up isolation valve is controlled by one logic division, and the inboard steam supply isolation valve by the other logic division.
7.6.1.3.3.3.7 RCIC-LDS Bypasses and Interlocks Each RCIC-LDS temperature monitor point has bypass capabilities, but this function is not used.
The trip signals from the leak detection area temperature monitors can be bypassed by a manual bypass switch. This switch permits testing of the temperature monitors without initiating system isolation. Bypassing the temperature trip signals in one logic division will not prevent proper operation of the other division. No other bypasses or interlocks are provided.
7.6.1.3.3.3.8 RCIC-LDS Redundancy and Diversity For Unit 1, redundancy of trip initiation for high ambient temperature is provided by 10 ambient temperature elements installed in RCIC pipe chase areas. Five temperature sensors are associated with each logic division.
For Unit 2, redundancy of trip initiation for high ambient temperature is provided by 8 ambient temperature elements installed in RCIC pipe chase areas. Four temperature sensors are associated with each logic division.
Redundancy of trip initiation signals for high ventilation air differential temperature and RCIC area high ambient temperature is provided by seven temperature elements. Four of these elements form two differential temperature pairs which monitor high ventilation air differential temperature.
One pair is associated with one logic division and the other pair is associated with the other logic division. The other three temperature elements monitor the RCIC pump compartment ambient CHAPTER 07 7.6-23 REV. 20, SEPTEMBER 2020
LGS UFSAR temperature. One ambient temperature element is associated with one logic division and the other two ambient temperature elements are associated with the other logic division.
Redundancy of steam flow monitoring is provided by two differential pressure sensors, each associated with different logic divisions. Redundancy of RCIC steam supply low pressure monitoring is provided by two pairs of sensors in the RCIC steam supply line, each pair of sensors associated with different logic divisions. Turbine exhaust diaphragm pressure monitoring is provided by two pairs of sensors, each pair associated with different logic divisions.
Diversity of leak detection is provided by monitoring equipment area and pipe chase area ambient and differential temperature monitoring, steam flow rate monitoring, steam line pressure monitoring, and turbine exhaust diaphragm pressure monitoring.
7.6.1.3.3.3.9 RCIC-LDS System Testability Testability is discussed in Sections 7.3.1.1.2.11.
7.6.1.3.3.3.10 RCIC-LDS Environmental Considerations This system is designed and has been qualified to meet the environmental conditions indicated in Section 3.11. In addition, this system is seismically qualified as described in Section 3.10.
7.6.1.3.3.4 Reactor Water Cleanup Leak Detection System - Instrumentation and Controls 7.6.1.3.3.4.1 RWCU-LDS Identification The purpose of this part of the leak detection system is to monitor the RWCU system components and isolate the system should a leak of sufficient magnitude occur.
The RWCU-LDS consists of the following two subsystems:
- a. RWCU system high differential flow (Leakage monitoring by the flow comparison of RWCU system water inlet and outlet flow rate)
- b. RWCU system area high temperature and differential temperature The RWCU-LDS uses no manual bypass switch. Annunciation of RWCU isolation system out-of-service is by manual switches. The logic used results in isolation if the flow sensor or if any of the temperature sensors trip. Testing can cause isolation of the RWCU system. This does not present a problem because isolation of the RWCU system does not prevent any safety function.
7.6.1.3.3.4.2 RWCU System High Differential Flow Monitoring Subsystem 7.6.1.3.3.4.2.1 Circuit Description The RWCU system inlet flow is compared to RWCU outlet flow. A flow element, flow transmitter, and square root converter for each of these three lines provide signals to a common flow summer that trips two differential flow alarm units on a high differential flow condition. Each flow alarm unit starts a timer that, after a time delay to avoid spurious trips, activates an alarm and isolation. Flow and differential flow indications are provided in the control room.
CHAPTER 07 7.6-24 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.1.3.3.4.2.2 Logic and Sequencing Using one-out-of-two logic, the RWCU flow comparison monitoring circuit initiates an RWCU system isolation signal after a time delay from the time the flow rate difference exceeds a preset limit.
7.6.1.3.3.4.2.3 Bypasses and Interlocks Each time a high differential flow condition exists, the alarm unit initiates a 45 second time delay to delay the alarm and isolation signal during the normal operation system surge, i.e., pump startup, valving changes, etc; if the high differential flow condition still exists upon timer expiration, then alarm and isolation are initiated. The RWCU system high differential flow monitoring subsystem has no bypass capabilities.
7.6.1.3.3.4.2.4 Redundancy and Diversity RWCU system isolation redundancy is accomplished by independent actuation of the inboard and outboard isolation valves from their respective logic channels. Actuation signals to the inboard and outboard isolation valves are derived from two separate logic channels using individual trip units.
Diversity is accomplished through isolation by the following monitored variables: high differential flow, and ambient and differential temperature.
7.6.1.3.3.4.3 RWCU Area High Temperature and Differential Temperature Monitoring Subsystem 7.6.1.3.3.4.3.1 Identification High temperature in the equipment room areas of the RWCU system could indicate a breach of the RCPB portion of the RWCU system. High ambient temperature and high differential temperature in the equipment area ventilation system initiates isolation of the RWCU system.
Refer to Section 7.3.1.1.2 for a description of isolation function of this system.
7.6.1.3.3.4.3.2 Power Supplies Trip logic channels for the inboard and outboard valves are supplied from RPS 120 V ac bus A and B, respectively.
7.6.1.3.3.4.3.3 Initiating Circuits Twelve ambient temperature and 12 differential temperature sensing circuits monitor the RWCU system area temperatures. Six ambient and 6 differential temperature circuits are associated with each of two instrumentation channels. Six ambient temperature elements are located in the pump-room and the heat exchanger room. Six pairs of temperature elements are located in the ventilation supply and exhaust areas of the above locations. The locations of the temperature elements provide the earliest practicable detection of any RWCU system high temperature leak.
7.6.1.3.3.4.3.4 Logic and Sequencing CHAPTER 07 7.6-25 REV. 20, SEPTEMBER 2020
LGS UFSAR When a significant increase in RWCU system area ambient or differential temperature is detected, trip signals are transmitted to the PCRVICS. The PCRVICS initiates closure of all RWCU system isolation valves.
Two independent instrumentation trip channels are provided to ensure protective action when required. The output trip signal of each instrumentation channel initiates a logic channel and closure of either the inboard or outboard RWCU system isolation valve. In order to close both the inboard and outboard isolation valves, both logic channels must trip. Protection against inadvertent isolation due to instrumentation malfunction is neither required nor provided.
7.6.1.3.3.4.3.5 Redundancy and Diversity Redundancy of trip initiation signals for high ambient temperature is provided by two ambient temperature elements and associated temperature indicating switches installed in each RWCU system area, with each associated with a different logic channel.
Redundancy of trip initiation signals for high differential temperature is provided by two pairs of differential temperature elements and associated temperature indicating switches in each RWCU system area. Each pair of temperature elements and its temperature indicating switch are associated with one of two logic channels.
Diversity is discussed in Section 7.6.1.3.3.4.2.4.
7.6.1.3.3.4.3.6 Bypasses and Interlocks RWCU system high ambient and differential temperature trips have no automatic bypasses.
There are no interlocks to other systems from the RWCU system ambient and differential temperature trip signals.
Each RWCU-LDS temperature monitor point has bypass capabilities, but this function is not used.
7.6.1.3.3.4.3.7 Testability Testability is discussed in Section 7.3.1.1.2.11.
7.6.1.3.3.4.3.8 Environmental Considerations This subsystem is designed and qualified to meet the environmental conditions indicated in Section 3.11. In addition, this subsystem is seismically qualified as described in Section 3.10.
7.6.1.3.3.5 HPCI System Leak Detection System - Instrumentation and Controls 7.6.1.3.3.5.1 HPCI-LDS Identification The steam line of the HPCI system is constantly monitored for leaks and breaks by the following types of monitoring circuits:
- a. Equipment area and pipe chase area ambient and differential temperature monitoring (leaks)
CHAPTER 07 7.6-26 REV. 20, SEPTEMBER 2020
- b. HPCI steam flow rate monitoring (pipe break)
- c. HPCI steam line pressure monitoring (pipe break)
Setpoints are predetermined which indicate a possible leak. If a setpoint is attained, an HPCI autoisolation signal is initiated and an annunciator is activated in the control room.
7.6.1.3.3.5.2 HPCI-LDS Power Sources Refer to Section 7.6.1.3.2.
7.6.1.3.3.5.3 HPCI Equipment Area and Pipe Chase Area Temperature Monitoring Subsystem -
Instrumentation and Controls 7.6.1.3.3.5.3.1 Circuit Description HPCI area monitored temperatures include the following:
- a. HPCI pipe chase area ambient temperatures
- b. HPCI compartment ambient temperature
- c. HPCI area ventilation air differential temperature 7.6.1.3.3.5.3.2 Initiating Circuits Eight ambient temperature elements are installed in the HPCI pipe chase areas. Four sensors are associated with each autoisolation logic division. Seven temperature elements are installed in the HPCI equipment compartment. Four of these elements form two differential temperature pairs which monitor high ventilation air differential temperature. One pair is associated with one logic division and the other pair is associated with the other logic division. The other three temperature elements monitor the HPCI pump compartment ambient temperature. One ambient temperature element is associated with one logic division and the other two ambient temperature elements are associated with the other logic division.
7.6.1.3.3.5.3.3 Logic and Sequencing When any one monitored temperature reaches its setpoint, an HPCI autoisolation signal is initiated and an annunciator activated in the control room.
Closure of the outboard HPCI steam supply isolation valve and the steam line warm-up isolation valve is controlled by one logic division and the inboard steam supply isolation valve by the other logic division.
Two instrumentation channels are provided to assure protective action when required.
CHAPTER 07 7.6-27 REV. 20, SEPTEMBER 2020
LGS UFSAR In order to close both the inboard and outboard isolation valves, both logic divisions must trip.
Protection against inadvertent isolation due to instrumentation malfunction is not required or provided.
HPCI-LDS is also described in Section 7.6.1.3.3.3.3.3.
7.6.1.3.3.5.4 HPCI Steam Flow Rate Monitoring Subsystem - Instrumentation and Controls 7.6.1.3.3.5.4.1 Circuit Description The HPCI steam line connecting the nuclear boiler and the HPCI turbine is monitored by differential pressure sensors which signal a high steam flow rate condition.
7.6.1.3.3.5.4.2 Initiating Circuits Two differential pressure sensors are installed on separate taps of a venturi flow element inside the primary containment. Steam flow rate in excess of a predetermined setpoint indicates a possible steam line leak and initiates a sensor trip signal.
Spurious system isolations are precluded by a time delay that prevents short-term flow peaks from initiating system isolation. At the end of the timing period, system isolation will occur only if the initiating signal remains above the trip setpoint. Time delay will reset each time signal drops below setpoint.
7.6.1.3.3.5.4.3 Logic and Sequencing The autoisolation logic utilizes one-out-of-two logic to isolate the HPCI steam line. Closure of the outboard HPCI steam supply isolation valve and steam line warm-up isolation valve are controlled by one logic division and the inboard steam supply isolation valve is controlled by a different logic division. Each logic division requires a two-out-of-two pressure signal to isolate the valves.
7.6.1.3.3.5.5 HPCI Steam Line Pressure Monitoring Subsystem - Instrumentation and Controls 7.6.1.3.3.5.5.1 Circuit Description The HPCI steam line connecting the nuclear boiler and the HPCI turbine is monitored by four pressure sensors which signal a low steam supply pressure condition.
7.6.1.3.3.5.5.2 Initiating Circuits Four pressure sensors are installed on the steam pipe. Steam pressure below a predetermined setpoint indicates a possible line break and initiates a sensor trip signal.
7.6.1.3.3.5.5.3 Logic and Sequencing The autoisolation logic utilizes two-out-of-two logic in each logic division. Closure of the outboard HPCI steam supply isolation valve and steam line warm-up isolation valve is controlled by one logic division and the inboard steam supply isolation valve by the other logic division.
CHAPTER 07 7.6-28 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.1.3.3.5.6 HPCI Turbine Exhaust Diaphragm Pressure Monitoring Subsystem - Instrumentation and Control 7.6.1.3.3.5.6.1 Circuit Description The HPCI turbine exhaust diaphragm is monitored by pressure sensors which signal a high pressure condition.
7.6.1.3.3.5.6.2 Initiating Circuits Four pressure sensors monitor the HPCI turbine exhaust diaphragm. If monitored pressure exceeds a predetermined setpoint, indicating a possible diaphragm rupture, a sensor trip signal occurs.
7.6.1.3.3.5.6.3 Logic and Sequencing The autoisolation logic utilizes two-out-of-two logic in each logic division. Closure of the outboard HPCI steam supply isolation valve and steam line warm-up isolation valve are controlled by one logic division and the inboard steam supply isolation valve is controlled by the other logic division.
7.6.1.3.3.5.7 HPCI-LDS Bypasses and Interlocks Each HPCI-LDS temperature monitor point has bypass capabilities, but this function is not used.
The trip signals from the leak detection area temperature monitors can be bypassed by a manual bypass switch. This switch permits testing of the temperature monitors without initiating system isolation. Bypassing the temperature trip signals in one division will not prevent proper operation of the other division. No other bypasses or interlocks are provided.
7.6.1.3.3.5.8 HPCI-LDS Redundancy and Diversity Redundancy of trip initiation for high ambient temperature is provided by 8 ambient temperature elements installed in the HPCI pipe chase areas. Four temperature sensors are associated with each logic division.
Redundancy of trip initiation signals for ventilation air high differential temperature and HPCI area high ambient temperature is provided by seven temperature elements. Four of these elements form two differential temperature pairs which monitor high ventilation air differential temperature.
One pair is associated with one logic division and the other pair is associated with the other logic division. The other three temperature elements monitor the HPCI pump compartment ambient temperature. One ambient temperature element is associated with one logic division and the other two ambient temperature elements are associated with the other logic division.
Redundancy of steam flow monitoring is provided by two differential pressure sensors, each associated with different logic divisions. Redundancy of HPCI steam supply low pressure monitoring is provided by two pairs of sensors in the HPCI steam supply line, each pair of sensors associated with different logic divisions. Redundancy of turbine exhaust diaphragm pressure monitoring is provided by two pairs of sensors, each pair associated with different logic divisions.
CHAPTER 07 7.6-29 REV. 20, SEPTEMBER 2020
LGS UFSAR Diversity of leak detection is provided by monitoring equipment area and pipe chase area ambient and differential temperature monitoring, steam flow rate monitoring, steam line pressure monitoring, and turbine exhaust diaphragm pressure monitoring.
7.6.1.3.3.5.9 HPCI-LDS Testability Testability is discussed in Sections 7.3.1.1.2.11.
7.6.1.3.3.5.10 HPCI-LDS Environmental Considerations This system is designed and has been qualified to meet the environmental conditions indicated in Section 3.11. In addition, this system is seismically qualified as described in Section 3.10.
7.6.1.4 Neutron Monitoring System - Instrumentation and Controls The NMS consists of the following safety- related systems:
- a. IRM system
- b. LPRM system
- c. APRM system The nonsafety-related portion is described in Section 7.7.1.6.
The NMS FCD is shown in Figure 7.6-4, and the ranges of the systems are shown in Figure 7.6-8.
7.6.1.4.1 NMS Identification The purpose of this system is to monitor power generation in the core and provide signals to the RPS, the RRCS, and the rod block portion of the RMCS. It also provides information for operation and control of the reactor.
The IRM and APRM systems provide a safety function and are designed to meet particular requirements established by the NRC. The LPRM system is designed to provide a sufficient number of LPRM inputs to the APRM system to meet the APRM requirements. All other portions of the NMS have no safety function. The system is classified as shown in Table 3.2-1. The safety-related systems are seismically and environmentally qualified as described in Sections 3.10 and 3.11 (Section 7.2.1).
7.6.1.4.2 NMS Power Sources The power sources for each system are discussed in the individual circuit descriptions that follow.
7.6.1.4.3 Intermediate Range Monitor System 7.6.1.4.3.1 IRM Equipment Design 7.6.1.4.3.1.1 IRM Circuit Description CHAPTER 07 7.6-30 REV. 20, SEPTEMBER 2020
LGS UFSAR The IRM monitors neutron flux from the upper portion of the SRM range to the lower portion of the APRM range. The IRM system has eight IRM channels, each of which includes one detector that can be positioned in the core by remote control. The detectors are inserted into the core for a reactor startup and are withdrawn after the reactor mode selector switch is turned to RUN.
- a. Power supply Power is supplied separately from the two 120 V ac RPS sources. The channels are arranged so that loss of a power supply results in the loss of only one trip system of the RPS.
- b. Physical arrangement Each detector assembly consists of a miniature fission chamber attached to a low loss, quartz/fiber insulated transmission cable. When coupled to the signal conditioning equipment, the detector produces a reading of full-scale on the most sensitive range with a neutron flux of 4x108 nv. The detector cable is connected underneath the reactor vessel to a triple-shielded cable that carries the pulses generated in the fission chamber to the preamplifier.
The detector and cable are located in the drywell. They are movable in the same manner as the SRM detectors and use the same type of mechanical arrangement (Figures 7.6-2 and 7.6-3).
- c. Signal conditioning A voltage amplifier unit located outside the drywell serves as a preamplifier. This unit converts the current pulses to voltage pulses, modifies the voltage signal, and provides impedance matching. The preamplifier output signal is coupled by a cable to the IRM signal conditioning electronics (Figure 7.6-5).
Each IRM channel receives its input signal from the preamplifier and operates on it with various combinations of preamplification gain and amplifier attenuation ratios.
The amplification and attenuation ratios of the IRM and preamplifier are selected by a remote range switch that provides 10 ranges of increasing attenuation (the first six called low range and the last four called high range) acting on the signal from the fission chamber. As the neutron flux of the reactor core increases from 1x108 nv to 1.5x1013 nv, the signal from the fission chamber is attenuated to keep the input signal to the inverter in the same range. The output signal, which is proportional to neutron flux at the detector, is amplified and supplied to a locally mounted meter.
Outputs are also provided for a remote meter and recorder.
- d. Trip functions The IRM scram trip functions are discussed in Section 7.2. The IRM trips are shown in Table 7.6-2. The IRM rod block trip functions are discussed in Section 7.7.
7.6.1.4.3.1.1.1 IRM Bypasses and Interlocks CHAPTER 07 7.6-31 REV. 20, SEPTEMBER 2020
LGS UFSAR The arrangement of IRM channels allows one IRM channel in each group of four channels (A, C, E, and G, and B, D, F, and H) to be bypassed without compromising intermediate range neutron monitoring.
7.6.1.4.3.1.1.2 IRM Redundancy The IRM system consists of eight IRM channels, four of which are connected to one RPS trip system and the other four are connected to the other RPS trip system. The redundancy and single failure requirements are met because any single failure with the IRM system cannot prevent needed safety action of the RPS (Section 7.2.1.1.4.1).
7.6.1.4.3.1.1.3 IRM Testability Each IRM channel is tested and calibrated using written procedures. The IRM detector drive mechanisms and the IRM rod blocking functions are checked in the same manner as the SRM channels. Each IRM channel can be checked to ensure that the IRM high flux scram function is operable.
7.6.1.4.3.1.2 IRM Environmental Considerations The wiring, cables, and connectors located in the drywell are designed for the same environmental conditions as the SRMs.
The IRM preamplifier, located in the reactor enclosure, and the monitor, located in the control room, are designed to operate under all expected environmental conditions in those areas. These IRM system components are designed to operate during and after design basis events, including earthquakes, and anticipated operational occurrences (Sections 3.10 and 3.11).
7.6.1.4.3.1.3 IRM Operational Considerations The IRM range switches are upranged or downranged to follow increases and decreases in power within the range of the IRM to prevent either a scram or a rod block. The IRM detectors are inserted into the core whenever these channels are needed, and withdrawn from the core, when permitted, to prevent their burnup. The identification scheme for the IRM system is given in Section 7.2.
7.6.1.4.4 Local Power Range Monitor System 7.6.1.4.4.1 LPRM Equipment Design 7.6.1.4.4.1.1 LPRM Circuit Description The LPRM consists of fission chamber detectors, signal conditioning equipment, and trip circuits.
The LPRM provides outputs to the APRM, the RBM, and the process computer. The LPRM signal processing is performed by the same electronic equipment that performs the APRM functions.
- a. Power supply Power for the LPRM, associated APRM channel, and channelized RBMs is provided by two independent 120 V ac buses, each of which is supplied by a UPS.
Detector polarizing voltage for the LPRMs is supplied by eight pairs of redundant CHAPTER 07 7.6-32 REV. 20, SEPTEMBER 2020
LGS UFSAR LPRM detector DC power supplies, adjustable from 75 to 200 VDC. Each LPRM detector DC power supply pair powers approximately one-eighth of the LPRMs.
Power for the LPRM detector DC power supplies comes redundantly from the two 120 Vac buses via intervening DC power supplies.
The LPRM detector DC power supplies are located in the electronic chassis that houses the LPRM signal processing equipment. Each electronic chassis houses one pair of LPRM detector DC power supplies and the electronics for processing approximately one-eight of the total LPRM detector signals (or approximately one-half of the 43 detectors per APRM/LPRM channel).
The intervening DC supplies are located in a separate power supply chassis. Each power supply chassis contains up to 4 Low Voltage DC Power Supplies (LVPSs).
One of the 120 Vac busses provides input power to 2 of the LVPSs in the power supply chassis while the second 120 Vac bus provides input power to the other two LVPSs in the power supply chassis. Two of the LVPSs in the power supply chassis, one operating from each of the two 120 Vac busses, supply auctioned low voltage power to the electronic chassis. If either of the two 120 Vac power busses is lost, or if either of the two LVPSs fail, the remaining LVPS will continue to supply low voltage power to the electronic chassis.
The auctioned low voltage power input to the electronic chassis provides power to each of the pair of LPRM detector DC power supplies in the electronic chassis, and the LPRM (and APRM) signal processing hardware in the chassis. The LPRM detector polarizing voltage for all of the detectors processed by the electronic chassis (21 in one chassis and 22 in the other) is normally provided by one of the two LPRM detector DC power supplies in the electronic chassis. If that one DC power supply fails, the second LPRM detector DC power supply is automatically switched in to supply LPRM detector polarizing voltage.
The 75 - 200 Vdc LPRM detector DC power supplies can supply up to 3 milliamperes for each LPRM detector which ensures that the chambers can be operated in the saturated region at the maximum specified neutron fluxes. The voltage applied to the detectors varies no more than 2 Vdc over the maximum variation of electrical input and environmental parameters.
- b. Physical arrangement The LPRM includes 43 LPRM detector assemblies having detectors located at different axial heights in the core. Each detector assembly contains 4 fission chambers. These assemblies are distributed to monitor four horizontal planes throughout the core. Figure 7.6-6 shows the LPRM detector radial layout scheme that provides a detector assembly at every fourth intersection not containing control crosses of the water channels around the fuel bundles. Thus, the uncontrolled water gap has either an actual detector assembly or a symmetrically equivalent assembly in some other quadrant. The LPRM assembly consists of 4 neutron detectors permanently installed in a housing (Figure 7.6-6). The assemblies are installed and removed through the top of the vessel (when the head is removed).
The upper end of the assembly is held to the top of the fuel guide by a spring-loaded plunger. A permanently installed sleeve (incore guide tube and incore housing) locates and constrains the assembly below the lower core plate and provides a sealing surface under the reactor vessel. Special sealing caps are CHAPTER 07 7.6-33 REV. 20, SEPTEMBER 2020
LGS UFSAR placed over the connection end of the assembly and over the penetration at the bottom of the vessel during installation or removal of an assembly. This prevents loss of reactor coolant water on removal of an assembly and also prevents the connection end of the assembly from being immersed in the water during installation or removal.
Each LPRM detector assembly contains 4 miniature ion chambers with an associated solid sheath cable. The chambers are vertically spaced in the LPRM detector assemblies in a way that gives adequate axial coverage of the core, complementing the radial coverage given by the horizontal arrangement of the LPRM detector assemblies. Each ion chamber produces a current that is coupled with the LPRM signal conditioning equipment to provide the desired scale indications.
Each miniature chamber consists of 2 concentric cylinders that act as electrodes.
The inner cylinder (the collector) is mounted on insulators and is separated from the outer cylinder by a small gap. The gas between the electrodes is ionized by the charged particles produced as a result of neutron fissioning of the uranium-coated outer electrode. The chamber is operated at a polarizing potential of approximately 100 V dc. The negative ions produced in the gas are accelerated to the collector by the potential difference maintained between the electrodes. In a given neutron flux, all the ions produced in the ion chamber can be collected if the polarizing voltage is high enough. When this situation exists, the ion chamber is considered to be saturated. Output current is then independent of operating voltage.
Each assembly also contains a calibration tube for a TIP. The enclosing tube around the entire assembly contains holes that allow circulation of the reactor coolant water to cool the ion chambers. Numerous tests have been performed on the chamber assemblies, including tests of linearity, lifetime, gamma sensitivity, and cable effects. These tests and experience in operating reactors provide confidence in the ability of the LPRM system to monitor neutron flux to the design accuracy throughout the design lifetime.
- c. Signal conditioning The current signal from the LPRM detectors are transmitted to LPRM amplifiers located on LPRM Input Modules in the APRM/LPRM electronic chassis in the Auxiliary Equipment Room. Each LPRM Input Module provides amplification for up to 5 LPRM detector signals. The current signal from a chamber is transmitted directly to its amplifier through coaxial cable. The amplifier is a linear current amplifier whose voltage output is proportional to the current input and therefore proportional to the magnitude of the neutron flux. The amplifier output is read by the digital processing electronics. The digital electronics applies hardware gain corrections, performs filtering, and applies the LPRM gain factors. The digital electronics provide suitable output signals for the computer, recorders, annunciators, etc. The LPRM amplifiers also isolate the detector signals from the rest of the processing so that individual faults in one LPRM signal path will not affect other LPRM signals.
The LPRM signals can be read by the operator on the reactor console on either the APRM ODAs or the RBM ODAs. LPRM readings can be read on the APRM ODAs CHAPTER 07 7.6-34 REV. 20, SEPTEMBER 2020
LGS UFSAR by selecting summary LPRM displays. When a control rod is selected for movement, LPRM readings can be read on the RBM ODAs for the 16 LPRM detectors nearest to the selected rod (see Figure 7.7-14).
- d. Trip functions The trip functions for the LPRM provide trip signals to activate annunciators and displays on ODAs. Table 7.6-3 indicates the trips.
The trip levels can be adjusted to within +0.1% of full-scale deflection and are accurate to +1% of full- scale deflection in the normal operating environment.
7.6.1.4.4.1.1.1 LPRM Bypasses and Interlocks Each LPRM channel may be individually bypassed. When the maximum number of bypassed LPRMs associated with any APRM channel has been exceeded, an APRM trouble alarm is generated by that APRM.
7.6.1.4.4.1.1.2 LPRM Redundancy The LPRMs are divided into four groups for separation purposes. The LPRMs are separated so that in the event of a single failure under permissible APRM bypass conditions, a scram signal can be generated in the RPS when required.
7.6.1.4.4.1.1.3 LPRM Testability LPRM channels are calibrated using data from previous full power runs and TIP data and can be tested with written procedures. The update uncertainty assigned to the LPRMs is twice the update uncertainty value specified in GE topical licensing report NEDC-32694P-A, "Power Distribution Uncertainties for Safety Limit MCPR Minimum Critical Ratio Evaluations, dated August 1999.
7.6.1.4.4.1.2 LPRM Environmental Considerations Each individual chamber of the assembly is a moisture-proof, pressure-sealed unit. The chambers are designed to operate up to 600F and 1250 psig. The wiring, cables, and connectors located within the drywell are designed for continuous-duty up to 150F at 90% relative humidity and a single exposure to a peak temperature of 340F at 100% relative humidity. The LPRMs are capable of functioning during and after design basis events such as earthquakes and anticipated operational occurrences (Sections 3.10 and 3.11).
7.6.1.4.4.1.3 LPRM Operational Considerations The LPRM is a monitoring system with no special operating considerations.
7.6.1.4.5 Average Power Range Monitor System (References 7.6.1 through 7.6.4) 7.6.1.4.5.1 APRM Equipment Design CHAPTER 07 7.6-35 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.1.4.5.1.1 APRM Circuit Description The APRM System has four APRM channels. Each APRM uses input signals from 43 LPRM detectors. Each of the four APRM channels provides input to four 2-out-of-4 voter channels. Two of the voter channels are associated with each of the trip systems of the Reactor Protection System.
- a. Power supply Power for the LPRM, associated APRM channel, and channelized RBMs is provided by two independent 120 Vac buses, each of which is supplied by a UPS.
Each APRM 2-out-of-4 voter channel receives power from one of the two 120 Vac busses with each bus supplying power to two of the voter channels. The APRM, LPRM and RBM functions will continue to operate as long as either of the two 120 Vac busses is still available. However, if one of the two 120 Vac busses is lost, the two Voter Channels supplied by that bus will go to the tripped state resulting in a RPS half scram.
- b. Signal conditioning The APRM channel uses digital electronic equipment which averages the output signals from a selected set of LPRMs, generates trip outputs via the 2-out-of-4 voter channels (see Section 7.6.1.4.5.1.1.c), and provides signals to readout equipment.
Each APRM channel can average the output signals from up to 43 LPRM channels.
Assignment of LPRM channels to an APRM is shown in Table 1A and 1B on Figure 7.6-1 (Sheets 2 and 4) with the distribution through the core shown in Figure 7.2-9.
The letters at the detector locations in Figure 7.6-1 refer to the axial positions of the detectors in the LPRM detector assembly. Position A is the bottom position, positions B and C are above position A, and position D is the top most LPRM detector position. The pattern provides LPRM signals from all four core axial LPRM detector positions throughout the core. Some LPRM detectors may be bypassed, but the averaging logic automatically corrects for these by removing them from the average.
The APRM flux value is developed by averaging the LPRM signals and then adjusting the average by a digitally entered factor to allow calibration of the APRM to be APRM power. The APRM power is processed through a first order filter with a six second time constant to calculate simulated thermal power. The APRM simulated thermal power upscale rod block and scram trip setpoints are varied as a function of reactor recirculation flow. The slope of the upscale rod block and scram trip response curves is set to track the required trip setpoint with recirculation flow changes. These calculations are all performed by the digital processor and result in a digital representation of APRM and simulated thermal power, and of the flow-biased rod block and scram setpoints.
Each APRM channel calculates a flow signal which is used to determine the APRMs flow-biased rod block and scram setpoints (see Figure 7.6-1). Each signal is determined by summing the flow signals from the two recirculation loops. These signals are sensed from two flow elements, one in each recirculation loop. The differential pressure from each flow element is routed to four differential pressure CHAPTER 07 7.6-36 REV. 20, SEPTEMBER 2020
LGS UFSAR transducers (eight total). The signals from two differential pressure transducers, one from each flow element, are routed to two inputs to each APRM digital electronics.
Each APRM also includes an OPRM Upscale Function. For this function, LPRMs are assigned to up to four OPRM cells with each cell including 4 LPRMs (see Figure 7.2-17). The OPRM function combines the signals from each LPRM in an OPRM cell and evaluates that combined cell signal using the OPRM algorithms to detect thermal-hydraulic instabilities.
All APRM channels are powered redundantly, via intervening low voltage DC power supplies, from both of the two APRM 120 Vac UPS power busses. The LPRM signal processing equipment is powered by the same sources as their associated APRM channels.
- c. Trip function The APRM trip functions are performed by digital comparisons with APRM electronics. For each RPS trip and rod block alarm, the APRM power of simulated thermal power, as applicable, is compared to the setpoint. If the power value exceeds the setpoint, the applicable trip is issued. Trip signals from each APRM channel are provided, via APRM interface hardware directly to the Reactor Manual Control System and via the APRM 2-out-of-4 voter channels to the Reactor Protection System (RPS). Table 7.6-4 lists the APRM trip functions and trip settings.
An OPRM upscale trip output is generated from an APRM channel when the period based detection algorithm in that channel detects oscillatory changes in the neutron flux indicated by the combined signals for the LPRM detectors in a cell with the period confirmations and relative cell amplitude exceeding specific setpoints. One or more cells in a channel exceeding the trip conditions will result in a channel trip.
An OPRM upscale trip is also issued from any APRM channel if either the growth rate or amplitude based algorithms detect growing oscillatory changes in the neutron flux from one or more cells in that channel. The OPRM upscale trip output is automatically enabled (not-bypassed) when the combined APRM STP is equal to or above the OPRM auto-enable power setpoint and recirculation flow is below the OPRM auto-enable flow setpoint. The OPRM upscale trip output is automatically bypassed when STP and/or recirculation flow are not within the OPRM trip enabled region. The OPRM upscale trip is active only when the reactor mode switch is in the RUN position.
At least two unbypassed APRM channels must be in the APRM upscale trip or inoperative trip state to cause an APRM/Inop RPS trip output from the APRM 2-out-of-4 voter channels (see Figure 7.6-7). Similarly, at least two unbypassed APRM channels must be in the OPRM upscale trip state to cause an OPRM RPS trip output from the APRM 2-out-of-4 voter channels. The APRM/Inop and OPRM trips are voted independently. In either of these conditions, all four voter channels will provide a RPS trip output, two to each RPS trip system. If only one unbypassed APRM channel is providing a trip output, each of the four APRM 2-out-of-4 voter channels will have a half-trip, but no trip signals will be sent to the RPS. Trip CHAPTER 07 7.6-37 REV. 20, SEPTEMBER 2020
LGS UFSAR outputs to the RPS are transmitted by removing voltage to a relay coil, so loss of power results in actuating the RPS trips. A simplified APRM/RPS interface circuit arrangement is shown in Figure 7.2-6.
Any one unbypassed APRM can initiate a rod block. Subsection 7.7, Reactor Manual Control System, describes in more detail the APRM rod block functions.
In the startup mode of operation, the APRM fixed upscale trip setpoint is set down to a low level. This trip function is provided in addition to the existing IRM upscale trip in the startup mode.
The trips from one APRM can be bypassed by operator action in the control room, which bypasses both the APRM/Inop and OPRM trips from that APRM channel.
- d. RRCS interface APRM signal levels are sent to the RRCS to enable the initiation of the logic if additional reactivity control is necessary following an ATWS event. The use of this signal is discussed in Section 7.6.1.8.
7.6.1.4.5.1.1.1 APRM Bypasses and Interlocks One of the four APRM channels can be bypassed at any time. None of the APRM 2-out-of-4 voter channels can be bypassed. An interlock circuit provides an APRM trouble alarm whenever the number of LPRM inputs to an APRM is less than the required minimum.
7.6.1.4.5.1.1.2 APRM Redundancy Four independent channels of APRMs monitor neutron flux and each channel provides inputs to all four independent APRM 2-out-of-4 voter channels. A trip condition in any one APRM channel does not cause the APRM 2-out-of-4 voters to initiate a trip in any RPS trip system. The APRM 2-out-of-4 voter must recieve a trip signal from at least two unbypassed APRM channels in order to initiate a trip in any RPS trip system.
7.6.1.4.5.1.1.3 APRM Testability APRM channels are calibrated using data from previous full power runs and are tested by written procedures. Each APRM channel can be tested individually for the operability of the APRM scram and rod blocking functions by introducing test signals.
7.6.1.4.5.2 APRM Environmental Considerations All APRM equipment is installed in the control structure and operated in the environment as described in Section 3.11. The APRM system is capable of functioning during and after the design basis events, including earthquakes and anticipated operational occurrences (Sections 3.10 and 3.11).
7.6.1.4.5.3 APRM Operational Considerations The APRM system is a monitoring system that has no special operational considerations.
CHAPTER 07 7.6-38 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.1.5 Safety/Relief Valve Positions Indication System - Instrumentation and Controls 7.6.1.5.1 SRVPI System Identification A positive and reliable OPEN/NOT OPEN indication of the SRVs alerts the operator to abnormal valve position which could cause release of reactor coolant.
The SRVPI system provides an indication and alarm of SRV position through the use of acoustic sensors. Accelerometers, two per valve, are mounted on piping downstream of the SRV. When an SRV is actuated, the accelerometer produces a signal proportional to the flow noise through the valve. This signal is then amplified and transmitted to a signal conditioning unit.
Each SRV is instrumented with two channels (active and passive) of in-containment equipment, consisting of accelerometers and connecting cables. The signals from both channels are routed to the SRVPI preamplifier where the active signal is amplified and routed to the SRVPI cabinet in the control room and used for alarm and indication, while the passive signal is available if needed.
7.6.1.5.2 SRVPI Power Supplies The SRVPI system is powered from a 120 V ac UPS.
7.6.1.5.3 SRVPI Initiating Circuits The SRVPI system senses steam flow through the valve and indicates OPEN/NOT OPEN status of the SRVs. It does not interface with, or provide actuation for any other system.
7.6.1.5.4 SRVPI Logic and Sequencing Logic and sequencing do not apply to the SRVPI system.
7.6.1.5.5 SRVPI Bypasses and Interlocks There are no bypasses or interlocks associated with this system.
7.6.1.5.6 SRVPI Redundancy and Diversity Each SRV is provided with an active and a passive instrumentation channel. Each channel consists of an accelerometer and associated cables. The active and passive channel signals are routed to the preamplifier. The active channel signal is amplified, routed to the SRVPI cabinet in the control room and used for alarm and indication.
The passive channel signal is available for use at the preamplifier outside containment if a component of the active channel should fail. The SRV temperature monitoring system (Section 7.7.1.16.7) provides a backup for the SRVPI system. It senses valve opening through a diverse means. Another diverse means of valve position indication is provided by the redundant safety-grade suppression pool temperature monitoring system, powered from a Class 1E power source.
7.6.1.5.7 SRVPI Testability CHAPTER 07 7.6-39 REV. 20, SEPTEMBER 2020
LGS UFSAR Proper operation of each SRVPI channel can be checked during plant operations.
7.6.1.5.8 SRVPI Environmental Considerations The SRVPI system is designed to operate under both environmental and seismic conditions as outlined in Sections 3.11 and 3.2.
7.6.1.5.9 SRVPI Operational Considerations 7.6.1.5.9.1 General Information The SRVPI system uses acoustic sensors (accelerometers) to monitor steam flow through the SRV. When the signal generated from the sensor reaches a predetermined level, alarms in the control will actuate to alert the operator of an open SRV.
7.6.1.5.9.2 SRVPI Reactor Operator Information The OPEN/NOT OPEN/WAS OPENED status of each SRV is provided for the operator in the control room, as well as a common annunciator indicating an open SRV.
7.6.1.5.9.3 SRVPI Setpoints The setpoints for SRVPI are determined individually for each SRV using information obtained during system installation and initial plant testing. Cross-talk measurements are conducted to ensure that an alarming SRV will not cause another SRV to alarm.
7.6.1.6 Containment Instrument Gas System - Automatic Depressurization System Control -
Instrumentation and Controls 7.6.1.6.1 CIGS-ADS Description The CIGS-ADS consists of nitrogen bottles, pressure controls, and instrumentation and associated piping which tie into the two instrument gas supply headers to the ADS valves as shown in Section 9.3.1.3 and drawing M-59.
In the event that the nonsafety-related CIGS header is unable to supply gas to its ADS valves for use during long-term shutdown cooling or vessel venting, the gas supply for that header is automatically switched to its CIGS-ADS gas bottles. The CIGS-ADS gas bottles must be connected at all times during normal operation. Each CIGS-ADS header supplies instrument gas to its respective ADS valves. One set of ADS valves and its gas supply will meet the requirements for the backup long-term shutdown cooling path.
7.6.1.6.2 CIGS-ADS Initiating Circuits The CIGS-ADS is initiated by a pressure switch which senses low pressure in the respective ADS gas supply header. The system can also be initiated manually.
7.6.1.6.3 CIGS-ADS Logic In the event that low pressure is sensed in an ADS gas supply header, a pressure switch causes a solenoid-operated valve in the supply line from the CIGS to close and a solenoid-operated valve in CHAPTER 07 7.6-40 REV. 20, SEPTEMBER 2020
LGS UFSAR the CIGS-ADS supply to that header to open. Those actions may be controlled manually from the control room.
7.6.1.6.4 CIGS-ADS Bypasses There are no bypasses in the CIGS-ADS.
7.6.1.6.5 CIGS-ADS Interlocks The CIGS-ADS is interlocked with the nonsafety-related CIGS so that only one system at a time will provide instrument gas to the ADS valves.
7.6.1.6.6 CIGS-ADS Redundancy and Diversity Diversity is not required for the CIGS-ADS. The CIGS-ADS is redundant in that each header is supplied by its own gas supply and separate divisional safeguard power.
7.6.1.6.7 CIGS-ADS Actuated Devices The solenoid-operated shutoff valves in the CIGS supply line and the solenoid-operated shutoff valves in the CIGS-ADS supply line are actuated by this system.
7.6.1.7 Safeguard Piping Fill System - Instrumentation and Controls 7.6.1.7.1 SPFS Description The SPFS pumps take suction from the suppression pool by way of the core spray suction line and discharge into the ECCS pump discharge lines to maintain these lines in a full condition. In this capacity, they are a backup to the condensate transfer system, which is the primary water source for keeping the ECCS discharge lines full. The SPFS pumps also discharge into the feedwater lines to provide a water seal in the event of any line break other than a feedwater line break inside containment. The SPFS is a supporting system to the ECCS.
7.6.1.7.2 SPFS Initiating Circuits The SPFS is manually operated.
7.6.1.7.3 SPFS Logic The SPFS pumps are started and stopped manually from the main control room. The shutoff valves to the feedwater lines are manually operated from the main control room. Refer to drawing M-52FD for logic diagram.
7.6.1.7.4 SPFS Bypasses and Interlocks There are no bypasses or interlocks in the SPFS.
7.6.1.7.5 SPFS Redundancy and Diversity CHAPTER 07 7.6-41 REV. 20, SEPTEMBER 2020
LGS UFSAR There are two pumps powered from separate Class 1E buses in different divisions. Distribution of fill water from each pump is in accordance with redundancy of the ECCS (i.e., the A SPFS pump delivers fill water to RCIC, RHR loops A & C, etc.).
Each pump can provide seal water to either or both of the feedwater lines. There is a shutoff valve to each feedwater line from each pump. The shutoff valves from each pump are in the same division as their associated pump.
No diversity is provided for this system.
7.6.1.7.6 SPFS Actuated Devices There are no actuated devices in this system.
7.6.1.8 Redundant Reactivity Control System - Instrumentation and Controls 7.6.1.8.1 RRCS System Identification The RRCS is designed to mitigate the potential consequences of an ATWS event. The system consists of control panels, their associated ATWS detection and actuation logic, and the necessary interface logic to the recirculation system, the feedwater system, the SLCS, and the ARI components of the CRD system required to perform specific functions in response to an ATWS event.
7.6.1.8.2 RRCS Power Sources RRCS Division 1, channels A and B are powered by the 125 V dc Bus A (Division 1), and RRCS Division 2, channels A & B are powered from 125 V dc Bus B (Division 2). The power supplies to the RRCS functions are available during all potential ATWS initiating events, including those events involving loss of normal power supplies.
7.6.1.8.3 RRCS Equipment Design The RRCS consists of vessel pressure and level sensors, solid-state logic, control room cabinets and indications, and interfaces with several systems actuated to mitigate an ATWS event (Figure 7.6-10). The solid-state logic is divided into Divisions 1 and 2, each of which is subdivided into channels A and B. The logic is energized to trip, and both channels A and B of either division must be tripped to initiate the RRCS protective actions. The system can be manually initiated by depressing two push buttons (tripping both channels A and B) in the same division. This manual initiation function is designed so that no single operator action can result in an inadvertent initiation.
The push button collar must be rotated to arm the switch before depressing will trip the logic. The manual initiation push buttons are located in the control room near the RPS manual scram push buttons. There are four RRCS manual initiation push buttons.
The RRCS logic monitors reactor dome pressure and water level. The logic will cause the immediate energization of the ARI valves when either the reactor high pressure trip setpoint or low water level 2 setpoint is reached, or the manual push buttons are armed and depressed (Table 7.6-5). Energization of the RRCS ARI valves depressurizes the scram air header independent of the logic and vent valves of the RPS system (Figure 7.6-11). The valves are sized to allow insertion of all control rods to begin within 15 seconds. Additional immediate RRCS response to the initiation signals include recirculation system pump motor breaker trip immediately if reactor CHAPTER 07 7.6-42 REV. 20, SEPTEMBER 2020
LGS UFSAR high pressure is received or 9 seconds after a low water level 2 signal is received. The high pressure initiation signal will initiate a feedwater runback after 25 seconds whether the feed pumps are in automatic or manual if the APRM not downscale trip signal is present. If power is not downscale after a 118 second time delay from the beginning of the ATWS event, the RWCU system will be isolated and the SLCS will be automatically initiated. Ten minutes after the SLCS initiation, the RRCS can be reset, provided that RRCS actuation parameters have reset and the RRCS manual reset push buttons are depressed.
The RRCS is continually checked by a solid-state microprocessor based self-test system. This self-test system checks the RRCS sensors, logic, and protective devices and itself.
7.6.1.8.3.1 RRCS Alternate Rod Insertion The RRCS signal to insert the control rods is generated in either of two separate divisions (two-out-of-two logic in a given division) and results in the energization of eight valves. Two of these, F160A and B, vent the scram air supply line downstream of the F110A and B backup scram valves (Figure 7.6-11). These RRCS valves also act to block the supply of air to the scram header.
Check valves F161A and B provide an air flow path around the F160 valves in the event one or more of the valves fails. Four additional RRCS valves (F162A, B, C, and D) vent the A and B scram header to the atmosphere. As the header depressurizes, the scram valves at each HCU will spring open, scramming the rods. Two RRCS valves (F163A and B) vent the scram air header to the SDV drain and vent valves, closing these valves and isolating the SDV. All eight RRCS ARI valves are normally de-energized. Positive position of the ARI solenoid valves is shown by voltage and plant air indications.
The ARI signal can be reset after a 30 second time delay, provided that the high reactor pressure, low water level 2, and manual initiation signals no longer exist.
7.6.1.8.3.2 RRCS Recirculation System Trips The ATWS RPT contributes to the mitigation of the consequences of an ATWS event by tripping the recirculation pumps early in the event, reducing core flow and thereby reducing the core power generation.
Low water level 2 or high reactor pressure RRCS signals cause a trip of the recirculation pump drive motor breakers 3A, 3B, 4A, and 4B. There are two separate divisions of instrumentation with divisional power sources, each one with two pressure sensors and two level sensors. A reactor vessel high dome pressure signal from either division will immediately trip both recirculation pump motors. A reactor vessel low water level signal from either division will trip both recirculation pump motors after a 10 second delay. This reduction in core flow protects the vessel and fuel during the ATWS event by limiting core power during the time required for the scram air header to depressurize sufficiently to open the scram valves.
Both sensors in either division (i.e., two level sensors in one division or two pressure sensors in one division) are required to generate a trip signal. The ATWS RPT pump breakers are the same ones used in the EOC RPT. There are two breakers in series in each pump motor feed; the control logic of each breaker is assigned to a separate safety division.
CHAPTER 07 7.6-43 REV. 20, SEPTEMBER 2020
LGS UFSAR Manual initiation of RRCS without reactor high pressure or reactor low level 2 does not trip the recirculation pump drive motor breaker; however, after manual initiation of RRCS, the breaker trip will occur if either reactor high pressure or low level 2 occur.
The ATWS RPT trip circuitry is separate from and independent of the EOC RPT trip circuitry.
Separate trip coils are used in each breaker (one for ATWS RPT and one for EOC RPT). The trip coils are fed from RPS power supplies.
The trip circuits, including the sensors and the pump breakers, are Class 1E. The entire trip circuits may be tested during plant operation, except for opening of the pump breakers. ATWS RPT circuitry is separated from non-Class 1E circuitry in accordance with the LGS separation criteria.
Indicators and annunciators in the control room provide the status of the trip coils and the mechanical position of the pump circuit breakers. Actuation of the ATWS-RPT is recorded in the control room.
7.6.1.8.3.3 RRCS Feedwater Runback The feedwater runback function mitigates the consequences of an ATWS event by stopping feedwater flow into the vessel, which reduces the core subcooling, thereby reducing the core power generation.
Reactor high pressure combined with a 25 second time delay and APRM power not downscale will initiate a feedwater runback. Feedwater flow will be reduced to 0% within 15 seconds. The logic to initiate feedwater runback is energized to trip and can be manually overridden 30 seconds after runback initiation. The runback reduces the input of cooler water flowing to the vessel. As average core coolant temperature increases, voids increase, reactivity decreases, and power is reduced.
The RRCS feedwater runback will occur whether the feed pumps are in automatic or in manual mode of control. The normal loss of signal interlock that prohibits changes in feedwater pump output during loss of signal conditions is disabled during ATWS.
7.6.1.8.3.4 Standby Liquid Control System Initiation Low water level 2, reactor high pressure, or manual initiation of the RRCS immediately starts a timer. A signal will be sent to initiate the SLCS if, at the expiration of a 118 second time delay, the core power is not downscale as measured by the APRM system. Initiation of the SLCS requires start signals from both channels A and B of either division of RRCS. Receipt of these signals starts the two in-service pumps and causes the associated squibs to fire, opening the explosive valves.
Both pumps will inject borated water into the vessel until the storage tank low level sensors, arranged in two-out-of-two logic, trip the pumps.
The SLCS pump control switches can be used to manually stop SLCS pump injection.
7.6.1.8.3.5 RRCS Impact on Other Systems 7.6.1.8.3.5.1 Reactor Water Cleanup System Isolation CHAPTER 07 7.6-44 REV. 20, SEPTEMBER 2020
LGS UFSAR When the SLCS is initiated to inject the neutron absorber into the reactor, the inboard isolation valve of the RWCU system is automatically closed from the SLCS Division 1 or 3 logic and the outboard valve is closed from the SLCS Division 2 logic. This RWCU isolation prevents removal and dilution of the neutron absorber.
7.6.1.8.3.5.2 Nuclear Boiler Instrumentation Nuclear boiler system instrumentation is provided to monitor the reactor parameters required for ATWS mitigation and to provide signals that are indicative of a potential ATWS event. The instrumentation is provided to monitor reactor vessel high dome pressure and low vessel water level. The sensors, transducers, and trip units are Class 1E, independent from the RPS, and environmentally qualified to perform their protective function during ATWS events.
7.6.1.8.3.5.3 Neutron Monitoring System The APRMs through the APRM interface hardware, provide a not downscale trip signal to the RRCS permissive logic. This signal is Class 1E and contains all available channels of input.
APRM signals from NMS Divisions 1 and 2 are routed to RRCS Division 1 through isolators, and APRM signals from NMS Divisions 3 and 4 are sent to RRCS Division 2 through isolators. Loss of power to an APRM channel or an APRM INOP condition will result in an RRCS permissive signal.
Bypassing an APRM channel will prevent the bypassed APRMs not downscale or INOP trip from supplying a permissive. Only one APRM at a time can be bypassed.
7.6.1.8.3.6 RRCS Reset Each RRCS channel can be manually reset by depressing the RRCS reset push buttons (four, one for each tripped channel), provided that a specified time delay has elapsed since RWCU isolation and SLCS initiation. When the RRCS is reset, the following seal-in signals are broken:
- a. RWCU isolation
- b. Low water level 2
- c. Manual initiation
- d. High reactor pressure
- e. Feedwater runback signal
- f. SLCS initiation The RRCS ARI function is reset by the RRCS ARI reset push buttons. This second set of four push buttons (one for each channel) will enable the reset of the ARI logic 30 seconds after initiation of ARI, provided that initiating signals have cleared. This 30 second time delay before the ARI reset permissive appears is designed to ensure that the RRCS ARI scram goes to completion.
7.6.1.8.3.7 RRCS Bypass There is no RRCS bypass or operating bypass.
7.6.1.8.3.8 Separation CHAPTER 07 7.6-45 REV. 20, SEPTEMBER 2020
LGS UFSAR The RRCS is a two-divisional system. Separation is maintained between the redundant divisions of the system to ensure compliance with the separation and single failure criteria. This separation is done to satisfy the single failure criterion. The two divisions of RRCS logic are designed so that either can cause ARI, recirculation pump motor trip, feedwater runback, RWCU isolation, and SLCS injection when a sufficient power reduction has not occurred. The RRCS meets IEEE 279 (1971) and Regulatory Guide 1.75 (Rev 1).
7.6.2 ANALYSIS 7.6.2.1 Process Radiation Monitoring Systems - Instrumentation and Controls 7.6.2.1.1 Main Steam Line Radiation Monitoring System The analysis for this system is discussed in Section 11.5.4.
7.6.2.1.2 Reactor Enclosure Ventilation Exhaust Radiation Monitoring System The analysis for this system is discussed in Section 7.3.2.2.2.3.1.
7.6.2.1.3 Refueling Area Ventilation Exhaust Radiation Monitoring System The analysis for this system is discussed in Section 7.3.2.2.2.3.1.
7.6.2.1.4 Control Room Ventilation Radiation Monitoring System 7.6.2.1.4.1 CRV-RMS General Functional Requirements Conformance The control room ventilation system is provided with instrumentation and controls to ensure that it remains habitable in order to ensure the capability of plant shutdown under accident conditions.
Instrumentation and controls for this purpose are safety-graded and selected to be operable under worst case environmental and seismic conditions at their respective locations.
The use of different divisional power for the redundant radiation monitoring system ensures that the system will be operational upon loss of a single divisional power source.
7.6.2.1.4.2 CRV-RMS Specific Regulatory Requirements Conformance 7.6.2.1.4.2.1 CRV-RMS Conformance to Regulatory Guides 7.6.2.1.4.2.1.1 CRV-RMS - Regulatory Guide 1.22 (1972) - Periodic Testing of Protection System Actuation Functions (Safety Guide 22)
The system is designed for periodic testing in accordance with IEEE 279.
7.6.2.1.4.2.1.2 CRV-RMS - Regulatory Guide 1.29 (1978) - Seismic Design Classification The radiation monitoring system is qualified to seismic Category I criteria, in accordance with IEEE 344. Refer to Section 3.10.
CHAPTER 07 7.6-46 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.1.4.2.1.3 CRV-RMS - Regulatory Guide 1.89 (1974) - Qualification of Class 1E Equipment for Nuclear Power Plants The radiation monitoring system is qualified in accordance with IEEE 323 (1974).
7.6.2.1.4.2.1.4 CRV-RMS - Regulatory Guide 1.97 (1980) - Instrumentation for Light-Water-Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident Section 7.5.2.5.1.1.2 contains a discussion of the degree of conformance.
7.6.2.1.4.2.1.5 CRV-RMS - Regulatory Guide 1.100 (1977) - Seismic Qualification of Electrical Equipment for Nuclear Power Plants See Section 3.10 for a discussion of the degree of conformance.
7.6.2.1.4.2.1.6 CRV-RMS - Regulatory Guide 1.105 (1976) - Instrument Setpoints See Section 7.1.2.5.25 for a discussion of the degree of conformance.
7.6.2.1.4.2.1.7 CRV-RMS - Regulatory Guide 1.118 (1978) - Periodic Testing of Electric Power and Protection Systems See Section 7.1.2.5.26 for a discussion of the degree of conformance.
7.6.2.1.4.2.2 CRV-RMS Conformance to 10CFR50, Appendix A, General Design Criteria 7.6.2.1.4.2.2.1 CRV-RMS - GDC 1 - Quality Standards and Records The radiation monitoring system is constructed in accordance with a documented quality assurance program.
7.6.2.1.4.2.2.2 CRV-RMS - GDC 2 - Design Bases for Protection Against Natural Phenomena The system is designed to survive SSEs.
7.6.2.1.4.2.2.3 CRV-RMS - GDC 3 - Fire Protection The system is designed to be fire resistant.
7.6.2.1.4.2.2.4 CRV-RMS - GDC 4 - Environmental and Dynamic Effects Design Bases Redundancy of the system affords protection against missile damage.
7.6.2.1.4.2.2.5 CRV-RMS - GDC 5 - Sharing of Structures, Systems, and Components Control room monitoring is common to both units of the plant, but a malfunction in either unit does not inhibit the function of this system.
7.6.2.1.4.2.2.6 CRV-RMS - GDC 13 - Instrumentation and Control CHAPTER 07 7.6-47 REV. 20, SEPTEMBER 2020
LGS UFSAR Instrumentation and controls are provided to monitor the control room atmosphere over the anticipated range of radiation levels for normal and accident conditions.
7.6.2.1.4.2.2.7 CRV-RMS - GDC 19 - Control Room This system ensures the habitability of the control room under accident conditions.
7.6.2.1.4.2.2.8 CRV-RMS - GDC 20 - Protection System Functions This system is designed to automatically initiate the control room protection controls in response to accident conditions.
7.6.2.1.4.2.2.9 CRV-RMS - GDC 21 - Protection System Reliability and Testability This system is designed to incorporate adequate reliability and testability so that no single failure results in the loss of its protective function.
7.6.2.1.4.2.2.10 CRV-RMS - GDC 22 - Protection System Independence The four channels are independent so that bypassing any one channel does not result in the loss of the system's protective function.
7.6.2.1.4.2.2.11 CRV-RMS - GDC 23 - Protection System Failure Modes Redundancy ensures that failure of one channel does not prevent the system from carrying out its trip function. The system is designed to fail-safe on loss of power to the CRV-RMS.
7.6.2.1.4.2.2.12 CRV-RMS - GDC 24 - Separation of Protection and Control Systems Protection and control systems are separated so that the loss of any one channel does not prevent a safety-related function.
7.6.2.1.4.2.2.13 CRV-RMS - GDC 29 - Protection Against Anticipated Operational Occurrences The system is protected against anticipated operational occurrences.
7.6.2.1.4.2.2.14 CRV-RMS - GDC 64 - Monitoring Radioactivity Releases This system provides an indirect method of monitoring the plant environs in that the radioactivity level of incoming air from the plant environment is continually measured during all operational occurrences including accidents.
7.6.2.1.4.2.3 CRV-RMS - Conformance to Industry Codes and Standards 7.6.2.1.4.2.3.1 CRV-RMS - IEEE 279 (1971) - Criteria for Protection Systems for Nuclear Power Generating Stations 7.6.2.1.4.2.3.1.1 CRV-RMS - IEEE 279 (1971), Paragraph 4.2 - Single Failure Criterion CHAPTER 07 7.6-48 REV. 20, SEPTEMBER 2020
LGS UFSAR The radiation monitoring system consists of four independent channels. The failure of any one of these channels does not prevent this system from carrying out its safety-related functions of isolation and alarming.
7.6.2.1.4.2.3.1.2 CRV-RMS - IEEE 279 (1971), Paragraph 4.3 - Quality of Components and Modules Components of the radiation monitoring system are carefully selected on the basis of suitability for the specific application. A quality control and assurance program is implemented and documented by the equipment vendor with the intent of complying with the requirements set forth in 10CFR50, Appendix B.
7.6.2.1.4.2.3.1.3 CRV-RMS - IEEE 279 (1971), Paragraph 4.4 - Equipment Qualification See Section 7.6.2.1.4.2.2.
7.6.2.1.4.2.3.1.4 CRV-RMS - IEEE 279 (1971), Paragraph 4.5 - Channel Integrity The radiation monitoring system is designed to maintain its functional capability under the environmental conditions and malfunctions that may occur in the design basis LOCA.
7.6.2.1.4.2.3.1.5 CRV-RMS - IEEE 279 (1971), Paragraph 4.6 - Channel Independence Channel independence of sensors is provided by electrical and mechanical separation. Physical separation is maintained between each of the four channels.
7.6.2.1.4.2.3.1.6 CRV-RMS - IEEE 279 (1971), Paragraph 4.7 - Control and Protection System Interaction The four channels are independent, so that a single failure does not prevent the system from carrying out its safety-related function.
7.6.2.1.4.2.3.1.7 CRV-RMS - IEEE 279 (1971), Paragraph 4.9 - Capability for Sensor Checks The detectors used in the radiation monitoring system are equipped with check sources and can be checked one at a time during normal plant operation.
7.6.2.1.4.2.3.1.8 CRV-RMS - IEEE 279 (1971), Paragraph 4.10 - Capability for Testing and Calibration Testing is achieved by check sources. There are no valves or moving parts in the radiation monitoring system requiring periodic testing. Instrument setpoints are tested by simulated signals to verify that the setpoints are within limits. Calibration sources are provided for periodic calibration.
7.6.2.1.4.2.3.1.9 CRV-RMS - IEEE 279 (1971), Paragraph 4.11 - Channel Bypass or Removal from Operation The system design of four redundant and independent channels permits the removal from operation of one channel for testing, calibration, or maintenance without preventing the remaining three channels from being operated to perform their protective function.
CHAPTER 07 7.6-49 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.1.4.2.3.1.10 CRV-RMS - IEEE 279 (1971), Paragraph 4.13 - Indication of Bypasses A downscale alarm annunciates in the control room when a channel is bypassed.
7.6.2.1.4.2.3.1.11 CRV-RMS - IEEE 279 (1971), Paragraph 4.14 - Access to Means for Bypassing The control module in the control room requires a key for bypassing its function. This key is controlled by Operations.
7.6.2.1.4.2.3.1.12 CRV-RMS - IEEE 279 (1971), Paragraph 4.15 - Multiple Setpoints Setpoints of the monitoring system may be changed only by the control room operator by use of both his key and a code number to activate the microprocessor.
7.6.2.1.4.2.3.1.13 CRV-RMS - IEEE 279 (1971), Paragraph 4.18 - Access to Setpoint Adjustments, Calibration, and Test Points Access to setpoint adjustments, calibration points, and test setpoints is available to qualified plant personnel by means of the access key and code number.
7.6.2.1.4.2.3.1.14 CRV-RMS - IEEE 279 (1971), Paragraph 4.19 - Identification of Protective Actions Initiation of shutoff of the control room ventilation system and startup of the emergency fresh air system is indicated in the control room.
7.6.2.1.4.2.3.1.15 CRV-RMS - IEEE 279 (1971), Paragraph 4.20 - Information Readout Meters located in the control room provide indications of radiation levels in the ventilation ducting.
Indicator lights actuated when setpoints are exceeded provide information on alarm conditions.
Trending is available on demand at the RMDS display consoles (Section 11.5.6) in the control room.
7.6.2.1.4.2.3.1.16 CRV-RMS - IEEE 279 (1971), Paragraph 4.21 - System Repair The system is designed to provide quick recognition of malfunction through check procedures.
Accessibility is provided for the detectors and controls to facilitate repairs or adjustment.
Malfunctioning components can easily be replaced.
7.6.2.1.4.2.3.1.17 CRV-RMS - IEEE 279 (1971), Paragraph 4.22 - Identification of Protection Systems Nameplates identify each module and instrument panel of the radiation monitoring system.
7.6.2.1.4.2.3.2 CRV-RMS - IEEE 308 (1974) - Criteria for Class 1E Electrical Systems for Nuclear Power Generating Stations Refer to Section 7.1.2.7.2.
7.6.2.1.4.2.3.3 CRV-RMS - IEEE 323 (1971) - IEEE Trial Use Standard: General Guide for Qualifying Class 1 Electric Equipment for Nuclear Power Generating Stations CHAPTER 07 7.6-50 REV. 20, SEPTEMBER 2020
LGS UFSAR The Class 1E equipment qualification is demonstrated by the vendor by the type-tests on actual equipment in accordance with the purchase specification. Qualification documentation is maintained.
Refer to Section 3.10.
7.6.2.1.4.2.3.4 CRV-RMS - IEEE 336 (1971) - Installation, Inspection, and Testing Requirements for Instrumentation and Electric Equipment During the Construction of Nuclear Power Generating Stations Installation, inspection, and testing provisions are in accordance with Class 1E requirements.
7.6.2.1.4.2.3.5 CRV-RMS - IEEE 338 (1975) - Criteria for the Periodic Testing of Nuclear Power Generating Station Protection Systems Provisions are made for the periodic testing of this system in accordance with IEEE Class 1E requirements.
7.6.2.1.4.2.3.6 CRV-RMS - IEEE 344 (1971) - Guide for Seismic Qualification of Class 1 Electric Equipment for Nuclear Power Generating Stations Capability of the instruments and controls to meet seismic requirements is demonstrated by the vendor. Documentation is maintained to verify that the equipment is seismically qualified.
Refer to Section 3.10.
7.6.2.1.4.2.3.7 CRV-RMS - IEEE 379 (1972) - Guide for the Application of the Single Failure Criterion to Nuclear Power Generating Station Protection Systems This system is designed in accordance with the single failure criterion for safety-related equipment.
7.6.2.1.4.2.3.8 CRV-RMS - IEEE 384 (1974) - Criteria for Separation of Class 1E Equipment and Circuits Channel separation and electrical wiring separation are designed in accordance with IEEE 279 requirements.
7.6.2.1.4.3 CRV-RMS Preoperational Checkout Preoperational tests are conducted prior to initial startup. The tests ensure functioning of all controls and active components. System reference characteristics such as setpoints are documented during preoperational testing and used as base points for measurements obtained during subsequent calibrations.
7.6.2.1.4.4 CRV-RMS Operational Tests During plant operation, components of this system can be inspected at any time. Test frequency is consistent with the requirements of the plant Technical Specifications.
CHAPTER 07 7.6-51 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.1.5 Control Room Emergency Fresh Air Radiation Monitoring System 7.6.2.1.5.1 CREFA-RMS General Functional Requirements Conformance The CREFAS provides for the habitability of the control room when the main control room ventilation system is shut down. Radiation monitors in the normal control room ventilation system are not functional in this circumstance, so the CREFA-RMS provides for continued surveillance of the control room atmosphere.
7.6.2.1.5.2 CREFA-RMS Specific Regulatory Requirements Conformance 7.6.2.1.5.2.1 CREFA-RMS Conformance to Regulatory Guides 7.6.2.1.5.2.1.1 CREFA-RMS - Regulatory Guide 1.22 (1972) - Periodic Testing of Protection System Actuation Functions (Safety Guide 22)
The system is designed for periodic testing in accordance with IEEE 279.
7.6.2.1.5.2.1.2 CREFA-RMS - Regulatory Guide 1.29 (1978) - Seismic Design Classification The CREFA-RMS is qualified to seismic Category I criteria, in accordance with IEEE 344. Refer to Section 3.10.
7.6.2.1.5.2.1.3 CREFA-RMS - Regulatory Guide 1.89 (1974) - Qualification of Class 1E Equipment for Nuclear Power Plants The CREFA-RMS is qualified in accordance with IEEE 323 (1974).
7.6.2.1.5.2.1.4 CREFA-RMS - Regulatory Guide 1.97 (1980) - Instrumentation for Light-Water-Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident Conformance is discussed in Section 7.5.2.5.1.1.2.
7.6.2.1.5.2.1.5 CREFA-RMS - Regulatory Guide 1.100 (1977) - Seismic Qualification of Electric Equipment for Nuclear Power Plants See Section 3.10 for a discussion of the degree of conformance.
7.6.2.1.5.2.1.6 CREFA-RMS - Regulatory Guide 1.105 (1976) - Instrument Setpoints See Section 7.1.2.5.25 for a discussion of the degree of conformance.
7.6.2.1.5.2.1.7 CREFA-RMS - Regulatory Guide 1.118 (1978) - Periodic Testing of Electric Power and Protection Systems See Section 7.1.2.5.26 for a discussion of the degree of conformance.
7.6.2.1.5.2.2 CREFA-RMS Conformance to 10CFR50, Appendix A, General Design Criteria CHAPTER 07 7.6-52 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.1.5.2.2.1 CREFA-RMS - GDC 1 - Quality Standards and Records The radiation monitoring system is constructed in accordance with a documented quality assurance program.
7.6.2.1.5.2.2.2 CREFA-RMS - GDC 2 - Design Bases for Protection Against Natural Phenomena The system is designed to survive SSEs.
7.6.2.1.5.2.2.3 CREFA-RMS - GDC 3 - Fire Protection The system is designed to be fire resistant.
7.6.2.1.5.2.2.4 CREFA-RMS - GDC 4 - Environmental and Dynamic Effects Design Bases Redundancy of the system affords protection against missile damage.
7.6.2.1.5.2.2.5 CREFA-RMS - GDC 5 - Sharing of Structures, Systems, and Components Control room monitoring is common to both units of the plant, but a malfunction in either unit does not inhibit the function of this system.
7.6.2.1.5.2.2.6 CREFA-RMS - GDC 13 - Instrumentation and Control Instrumentation and controls are provided to monitor the control room atmosphere over the anticipated range of radiation levels for normal and accident conditions.
7.6.2.1.5.2.2.7 CREFA-RMS - GDC 19 - Control Room This system ensures habitability of the control room under accident conditions.
7.6.2.1.5.2.2.8 CREFA-RMS - GDC 21 - Protection System Reliability and Testability This system is designed to incorporate adequate reliability and testability so that no single failure results in the loss of its monitoring function.
7.6.2.1.5.2.2.9 CREFA-RMS - GDC 22 - Protection System Independence The two channels are independent so that bypass of either channel does not affect the other channel.
7.6.2.1.5.2.2.10 CREFA-RMS - GDC 23 - Protection System Failure Modes Failure of either channel does not inhibit the function of the other.
7.6.2.1.5.2.2.11 CREFA-RMS - GDC 29 - Protection Against Anticipated Operational Occurrences The system is protected against anticipated operational occurrences.
CHAPTER 07 7.6-53 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.1.5.2.2.12 CREFA-RMS - GDC 64 - Monitoring Radioactivity Releases This system provides an indirect method of monitoring the plant environs in that the radioactivity level of incoming air from the plant environment is measured while the emergency fresh air system is functioning during accident conditions.
7.6.2.1.5.2.3 CREFA-RMS Conformance to Industry Codes and Standards 7.6.2.1.5.2.3.1 CREFA-RMS - IEEE 279 (1971) - Criteria for Protection Systems for Nuclear Power Generating Stations 7.6.2.1.5.2.3.1.1 CREFA-RMS - IEEE 279 (1971), Paragraph 4.2 - Single Failure Criterion The CREFA-RMS consists of two independent channels. The failure of either of these channels does not prevent this system from carrying out its functions of readout and alarming.
7.6.2.1.5.2.3.1.2 CREFA-RMS - IEEE 279 (1971), Paragraph 4.3 - Quality of Components and Modules Components of the radiation monitoring system are carefully selected on the basis of suitability for the specific application. A quality control and assurance program is implemented and documented by the equipment vendor with the intent of complying with the requirements set forth in 10CFR50, Appendix B.
7.6.2.1.5.2.3.1.3 CREFA-RMS - IEEE 279 (1971), Paragraph 4.4 - Equipment Qualification The equipment is qualified to meet the standards of IEEE 323 (1974).
7.6.2.1.5.2.3.1.4 CREFA-RMS - IEEE 279 (1971), Paragraph 4.5 - Channel Integrity The radiation monitoring system is designed to maintain its functional capability under the environmental conditions and malfunctions that may occur in the design basis LOCA.
7.6.2.1.5.2.3.1.5 CREFA-RMS - IEEE 279 (1971), Paragraph 4.6 - Channel Independence Channel independence of sensors is provided by electrical and mechanical separation. Physical separation is maintained between the two channels.
7.6.2.1.5.2.3.1.6 CREFA-RMS - IEEE 279 (1971), Paragraph 4.9 - Capability for Sensor Checks The detectors used in the CREFA-RMS are equipped with check sources, and can be checked one at a time during normal plant operation.
7.6.2.1.5.2.3.1.7 CREFA-RMS - IEEE 279 (1971), Paragraph 4.10 - Capability for Testing and Calibration Testing is achieved by check sources. There are no valves or moving parts in the CREFA-RMS requiring periodic testing. Instrument setpoints are tested by simulated signals to verify that the setpoints are within limits. Calibration sources are provided for periodic calibration.
CHAPTER 07 7.6-54 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.1.5.2.3.1.8 CREFA-RMS - IEEE 279 (1971), Paragraph 4.11 - Channel Bypass or Removal from Operation The system design of two redundant and independent channels permits the removal from operation of one channel for testing, calibration, or maintenance without preventing the remaining channel from operating normally.
7.6.2.1.5.2.3.1.9 CREFA-RMS - IEEE 279 (1971), Paragraph 4.13 - Indication of Bypasses Indication of bypass is provided by the extinguishing of the normal operation light when a channel is inoperative for test, calibration, or maintenance. The downscale alarm annunciates in the control room under this condition.
7.6.2.1.5.2.3.1.10 CREFA-RMS - IEEE 279 (1971), Paragraph 4.14 - Access to Means for Bypassing The control module in the control room requires a key for the bypassing of its function. This key is controlled by Operations.
7.6.2.1.5.2.3.1.11 CREFA-RMS - IEEE 279 (1971), Paragraph 4.15 - Multiple Setpoints Setpoints of the CREFA-RMS is controlled by the control room operator by use of both the key and a code number to activate the microprocessor.
7.6.2.1.5.2.3.1.12 CREFA-RMS - IEEE 279 (1971), Paragraph 4.18 - Access to Setpoint Adjustments, Calibration, and Test Points Access to setpoint adjustment, calibration points, and test setpoints is limited to qualified plant personnel by means of control of the access key and code number.
7.6.2.1.5.2.3.1.13 CREFA-RMS - IEEE 279 (1971), Paragraph 4.20 - Information Readout Meters located in the control room provide indications of radiation levels in the ducting. Indicator lights actuated by setpoints provide information on alarm conditions. Trending is available on demand at the RMDS display consoles (Section 11.5.6) in the control room.
7.6.2.1.5.2.3.1.14 CREFA-RMS - IEEE 279 (1971), Paragraph 4.21 - System Repair The CREFA-RMS is designed to provide quick recognition of malfunction through check procedures. Accessibility is provided for the detectors and controls to facilitate repairs or adjustments. Malfunctioning components can readily be replaced.
7.6.2.1.5.2.3.1.15 CREFA-RMS - IEEE 279 (1971), Paragraph 4.22 - Identification of Protection Systems Nameplates identify each module and instrument panel of the CREFA-RMS.
7.6.2.1.5.2.3.2 CREFA-RMS - IEEE 323 (1971) - IEEE Trial Use Standard: General Guide for Qualifying Class 1 Electric Equipment for Nuclear Power Generating Stations CHAPTER 07 7.6-55 REV. 20, SEPTEMBER 2020
LGS UFSAR Class 1E equipment qualification is demonstrated by the vendor by type-tests on actual equipment in accordance with the purchase specification. Qualification documentation is maintained.
7.6.2.1.5.2.3.3 CREFA-RMS - IEEE 336 (1971) - Installation, Inspection, and Testing Requirements for Instrumentation and Electric Equipment During the Construction of Nuclear Power Generating Stations Installation, inspection, and testing provisions are in accordance with IEEE Class 1E requirements.
7.6.2.1.5.2.3.4 CREFA-RMS - IEEE 338 (1975) - Criteria for the Periodic Testing of Nuclear Power Generating Station Protection Systems Provisions are made for the periodic testing of this system in accordance with IEEE Class 1E requirements.
7.6.2.1.5.2.3.5 CREFA-RMS - IEEE 344 (1971) - Guide for Seismic Qualification of Class 1 Electric Equipment for Nuclear Power Generating Stations Capability of the instruments and controls to meet seismic requirements is demonstrated by the vendor. Documentation is maintained to verify that the equipment is seismically qualified.
Refer to Section 3.10.
7.6.2.1.5.2.3.6 CREFA-RMS - IEEE 379 (1972) - Guide for the Application of the Single Failure Criterion to Nuclear Power Generating Station Protection Systems This system is designed in accordance with the single failure criterion for safety-related equipment.
7.6.2.1.5.2.3.7 CREFA-RMS - IEEE 384 (1974) - Criteria for Separation of Class 1E Equipment and Circuits Channel separation and electrical wiring separation are designed in accordance with IEEE 279 requirements.
7.6.2.1.5.3 CREFA-RMS Preoperational Checkout Preoperational tests are conducted prior to initial startup. The tests ensure functioning of all components and controls. System reference characteristics such as setpoints are documented during preoperational testing and used as base points for measurements obtained during subsequent calibrations.
7.6.2.1.5.4 CREFA-RMS Operational Tests During plant operation, components of the CREFA-RMS can be operationally tested at any time.
Test frequency intervals are established by plant staff.
7.6.2.1.6 Primary Containment Post-LOCA Radiation Monitoring System 7.6.2.1.6.1 PCPL-RMS General Functional Requirements Conformance The primary containment is provided with gamma-sensitive radiation monitors to maintain continuing surveillance of the containment atmosphere under postaccident conditions.
CHAPTER 07 7.6-56 REV. 20, SEPTEMBER 2020
LGS UFSAR The description in Section 11.5.2.3.1 demonstrates how the PCPL- RMS meets the safety design bases identified in Section 7.1.2.1.11.6.
7.6.2.1.6.2 PCPL-RMS Specific Regulatory Requirements Conformance 7.6.2.1.6.2.1 PCPL-RMS Conformance to Regulatory Guide 7.6.2.1.6.2.1.1 PCPL-RMS - Regulatory Guide 1.22 (1972) - Periodic Testing of Protection System Actuation Functions (Safety Guide 22)
The system is designed for periodic testing in accordance with IEEE 279.
7.6.2.1.6.2.1.2 PCPL-RMS - Regulatory Guide 1.29 (1978) - Seismic Design Classification The radiation monitoring system is qualified to seismic Category I criteria, in accordance with IEEE 344. Refer to Section 3.10.
7.6.2.1.6.2.1.3 PCPL-RMS - Regulatory Guide 1.89 (1974) - Qualification of Class 1E Equipment for Nuclear Power Plants The radiation monitoring system is qualified in accordance with IEEE 323 (1974).
7.6.2.1.6.2.1.4 PCPL-RMS - Regulatory Guide 1.97 (1980) - Instrumentation for Light-Water-Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident Conformance is discussed in Section 7.5.2.5.1.1.2.
7.6.2.1.6.2.1.5 PCPL-RMS - Regulatory Guide 1.100 (1977) - Seismic Qualification of Electric Equipment for Nuclear Power Plants Conformance is discussed in Section 3.10.
7.6.2.1.6.2.1.6 PCPL-RMS - Regulatory Guide 1.105 (1976) - Instrument Setpoints See Section 7.1.2.5.25 for a discussion of the degree of conformance.
7.6.2.1.6.2.1.7 PCPL-RMS - Regulatory Guide 1.118 (1978) - Periodic Testing of Electric Power and Protection Systems See Section 7.1.2.5.26 for a discussion of the degree of conformance.
7.6.2.1.6.2.2 PCPL-RMS Conformance to 10CFR50, Appendix A, General Design Criteria This system is designed to conform to the following criteria of 10CFR50, Appendix A:
7.6.2.1.6.2.2.1 PCPL-RMS - GDC 1 - Quality Standards and Records A quality assurance program is established for the design and production of this system.
7.6.2.1.6.2.2.2 PCPL-RMS - GDC 2 - Design Bases for Protection Against Natural Phenomena CHAPTER 07 7.6-57 REV. 20, SEPTEMBER 2020
LGS UFSAR This system is designed and tested to meet seismic Category I requirements.
7.6.2.1.6.2.2.3 PCPL-RMS - GDC 3 - Fire Protection Fire resistant components are used throughout.
7.6.2.1.6.2.2.4 PCPL-RMS - GDC 4 - Environmental and Dynamic Effects Design Bases Redundancy of the system provides for missile damage.
7.6.2.1.6.2.2.5 PCPL-RMS - GDC 5 - Sharing of Structures, Systems, and Components No components are shared between the unitized systems.
7.6.2.1.6.2.2.6 PCPL-RMS - GDC 13 - Instrumentation and Control Operating ranges of the instrumentation are compatible with anticipated accident conditions.
7.6.2.1.6.2.2.7 PCPL-RMS - GDC 21 - Protection System Reliability and Testability The system is designed for high functional reliability and inservice testability.
7.6.2.1.6.2.2.8 PCPL-RMS - GDC 22 - Protection System Independence System redundancy and separation of channels provides for protection system independence.
7.6.2.1.6.2.2.9 PCPL-RMS - GDC 23 - Protection System Failure Modes Loss of either channel in this system does not impair the function of the other.
7.6.2.1.6.2.2.10 PCPL-RMS - GDC 24 - Separation of Protection and Control Systems The two channels are separated in accordance with IEEE 279 (1971).
7.6.2.1.6.2.2.11 PCPL-RMS - GDC 29 - Protection Against Anticipated Operational Occurrences The system is designed to ensure functional reliability in the event of an anticipated operational occurrence.
7.6.2.1.6.2.2.12 PCPL-RMS - GDC 64 - Monitoring Radioactivity Releases The requirement for the monitoring of the containment atmosphere is fulfilled.
7.6.2.1.6.2.3 PCPL-RMS Conformance to Industry Codes and Standards 7.6.2.1.6.2.3.1 PCPL-RMS - IEEE 279 (1971) - Criteria for Protection Systems for Nuclear Power Generating Stations 7.6.2.1.6.2.3.1.2 PCPL-RMS - IEEE 279 (1971), Paragraph 4.2 - Single Failure Criterion CHAPTER 07 7.6-58 REV. 20, SEPTEMBER 2020
LGS UFSAR The design based on two electrical separation channels, each containing two monitoring channels, does not meet the single failure criterion. However, only two monitoring channels are required in accordance with Section 1.13.
7.6.2.1.6.2.3.1.3 PCPL-RMS - IEEE 279 (1971), Paragraph 4.3 - Quality of Components and Modules A quality assurance program is adhered to in the production of this system.
7.6.2.1.6.2.3.1.4 PCPL-RMS - IEEE 279 (1971), Paragraph 4.4 - Equipment Qualification The system is qualified in accordance with IEEE 323 (1974).
7.6.2.1.6.2.3.1.5 PCPL-RMS - IEEE 279 (1971), Paragraph 4.5 - Channel Integrity The system is designed to meet the most extreme environmental conditions anticipated.
7.6.2.1.6.2.3.1.6 PCPL-RMS - IEEE 279 (1971), Paragraph 4.6 - Channel Independence The two redundant channels are independent and separate.
7.6.2.1.6.2.3.1.7 PCPL-RMS - IEEE 279 (1971), Paragraph 4.7 - Control and Protection System Interaction The system serves no control function. However, the separation and independence of the two channels satisfies the remaining requirements of this section.
7.6.2.1.6.2.3.1.8 PCPL-RMS - IEEE 279 (1971), Paragraph 4.8 - Derivation of System Inputs System inputs are derived from radioactivity measurements inside the containment.
7.6.2.1.6.2.3.1.9 PCPL-RMS - IEEE 279 (1971), Paragraph 4.9 - Capability for Sensor Checks Check signals are provided for the detectors. However, no check sources are provided.
7.6.2.1.6.2.3.1.10 PCPL-RMS - IEEE 279 (1971), Paragraph 4.10 - Capability for Testing and Calibration The check signal provides capability for testing during power operation. Calibration capabilities are discussed in Section 11.5.2.3.1.
7.6.2.1.6.2.3.1.11 PCPL-RMS - IEEE 279 (1971), Paragraph 4.11 - Channel Bypass or Removal from Operation Either channel can be bypassed for checking or servicing without impairing the functions of the other channel.
7.6.2.1.6.2.3.1.12 PCPL-RMS - IEEE 279 (1971), Paragraph 4.13 - Indication of Bypasses CHAPTER 07 7.6-59 REV. 20, SEPTEMBER 2020
LGS UFSAR The bypassing of a channel results in downscale alarm in the control room.
7.6.2.1.6.2.3.1.13 PCPL-RMS - IEEE 279 (1971), Paragraph 4.14 - Access to Means for Bypassing Administrative controls are provided as the means to remove a channel from service.
7.6.2.1.6.2.3.1.14 PCPL-RMS - IEEE 279 (1971), Paragraph 4.15 - Multiple Setpoints This requirement is not applicable.
7.6.2.1.6.2.3.1.15 PCPL-RMS - IEEE 279 (1971), Paragraph 4.18 - Access to Setpoint Adjustments, Calibration, and Test Points Access to setpoints is available in the control module. However, to change a setpoint necessitates the use of a supervisory key to prevent unauthorized adjustments.
7.6.2.1.6.2.3.1.16 PCPL-RMS - IEEE 279 (1971), Paragraph 4.20 - Information Readout Readouts are provided in the control room. Indication of the variable and monitor status are provided.
7.6.2.1.6.2.3.1.17 PCPL-RMS - IEEE 279 (1971), Paragraph 4.21 - System Repair The system is modular to facilitate quick repair or component replacement.
7.6.2.1.6.2.3.1.18 PCPL-RMS - IEEE 279 (1971), Paragraph 4.22 - Identification of Protection Systems Suitable system and component identification is provided.
7.6.2.1.6.2.3.2 PCPL-RMS - IEEE 323 (1971) - IEEE Trial Use Standard: General Guide for Qualifying Class 1 Electric Equipment for Nuclear Power Generating Stations The Class 1E equipment qualification is demonstrated by the type- tests on actual equipment.
Qualification documentation is maintained.
7.6.2.1.6.2.3.3 PCPL-RMS - IEEE 336 (1971) - Installation, Inspection, and Testing Requirements for Instrumentation and Electric Equipment During the Construction of Nuclear Power Generating Stations Installation, inspection, and testing provisions are in accordance with Class 1E requirements.
7.6.2.1.6.2.3.4 PCPL-RMS - IEEE 338 (1975) - Criteria for the Periodic Testing of Nuclear Power Generating Station Protection Systems Provisions are made for the periodic testing of this system in accordance with IEEE Class 1E requirements.
CHAPTER 07 7.6-60 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.1.6.2.3.5 PCPL-RMS - IEEE 379 (1972) - Guide for the Application of the Single Failure Criterion to Nuclear Power Generating Station Protection Systems Refer to Section 7.6.2.1.6.2.3.1.2.
7.6.2.1.6.2.3.6 PCPL-RMS - IEEE 384 (1974) - Criteria for Separation of Class 1E Equipment and Circuits Channel separation and electrical wiring separation are designed in accordance with IEEE 384 requirements.
7.6.2.1.6.3 PCPL-RMS Preoperational Checkout Preoperational tests are conducted prior to initial startup. The tests ensure functioning of all components and controls. System reference characteristics such as setpoints are documented during preoperational testing and used as base points for measurements obtained during subsequent calibrations.
7.6.2.1.6.4 PCPL-RMS Operational Tests During plant operation, components of the PCPL-RMS can be operationally tested at any time.
Test frequency is consistent with the requirements of plant Technical Specifications.
7.6.2.1.7 RHR Service Water Radiation Monitoring System 7.6.2.1.7.1 RHRSW-RMS General Functional Requirements Conformance Service water piping from the RHR heat exchangers is provided with radiation monitors for detecting evidence of leakage through the interface between the service water and the RHR system. If significant radioactivity is detected in the service water, the radiation monitors provide signals to trip the RHRSW pumps. Alarm signals are annunciated in the control room.
7.6.2.1.7.2 RHRSW-RMS Specific Regulatory Requirements Conformance 7.6.2.1.7.2.1 RHRSW-RMS Conformance to Regulatory Guides 7.6.2.1.7.2.1.1 RHRSW-RMS - Regulatory Guide 1.21 (1974) - Measuring, Evaluating, and Reporting Radioactivity in Solid Wastes and Releases of Radioactive Materials in Liquid and Gaseous Effluents from Light-Water-Cooled Nuclear Power Plants The RHRSW monitor is designed to keep an ongoing record should any radioactive material be released via the RHRSW system.
7.6.2.1.7.2.1.2 RHRSW-RMS - Regulatory Guide 1.22 (1972) - Periodic Testing of Protection System Actuation Functions (Safety Guide 22)
The system is designed to be periodically tested in accordance with IEEE 279.
7.6.2.1.7.2.1.3 RHRSW-RMS - Regulatory Guide 1.100 (1977) - Seismic Qualification of Electric Equipment for Nuclear Power Plants See Section 3.10 for a discussion of the degree of conformance.
CHAPTER 07 7.6-61 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.1.7.2.1.4 RHRSW-RMS - Regulatory Guide 1.105 (1976) - Instrument Setpoints See Section 7.1.2.5.25 for a discussion of the degree of conformance.
7.6.2.1.7.2.1.5 RHRSW-RMS - Regulatory Guide 1.118 (1978) - Periodic Testing of Electric Power and Protection Systems See Section 7.1.2.5.26 for a discussion of the degree of conformance.
7.6.2.1.7.2.2 RHRSW-RMS Conformance to 10CFR50, Appendix A, General Design Criteria 7.6.2.1.7.2.2.1 RHRSW-RMS - GDC 1 - Quality Standards and Records Quality standards and records are maintained for this system.
7.6.2.1.7.2.2.2 RHRSW-RMS - GDC 2 - Design Bases for Protection Against Natural Phenomena The system is designed to seismic Category I criteria.
7.6.2.1.7.2.2.3 RHRSW-RMS - GDC 3 - Fire Protection The system is designed to be fireproof.
7.6.2.1.7.2.2.4 RHRSW-RMS - GDC 4 - Environmental and Dynamic Effects Design Bases Redundancy and component separation of this system provide protection against missile damage.
7.6.2.1.7.2.2.5 RHRSW-RMS - GDC 5 - Sharing of Structures, Systems, and Components One monitoring channel is dedicated to each of the two common return lines of the RHRSW system. The two monitoring channels are shared by both units. However, this does not impair the function of the monitoring system because of the separation and independence of the two channels.
7.6.2.1.7.2.2.6 RHRSW-RMS - GDC 13 - Instrumentation and Control The instrumentation is designed to cover the anticipated range of abnormal conditions.
7.6.2.1.7.2.2.7 RHRSW-RMS - GDC 20 - Protection System Functions The system is designed to sense abnormal occurrences and to initiate operation of components important to safety.
7.6.2.1.7.2.2.8 RHRSW-RMS - GDC 21 - Protection System Reliability and Testability The system is designed for high functional reliability and testability.
7.6.2.1.7.2.2.9 RHRSW-RMS - GDC 22 - Protection System Independence The system provides independence of function.
CHAPTER 07 7.6-62 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.1.7.2.2.10 RHRSW-RMS - GDC 23 - Protection System Failure Modes Failure of one channel does not prevent the system from carrying out its protective function.
7.6.2.1.7.2.2.11 RHRSW-RMS - GDC 24 - Separation of Protection and Control Systems Redundancy ensures that the failure of one channel does not prevent the system from carrying out its trip function.
7.6.2.1.7.2.2.12 RHRSW-RMS - GDC 29 - Protection Against Anticipated Operational Occurrences The system is designed to ensure the high probability of carrying out its safety functions in the event of anticipated operational occurrences.
7.6.2.1.7.2.2.13 RHRSW-RMS - GDC 30 - Quality of Reactor Coolant Pressure Boundary The system provides a means of detecting and identifying a source of reactor coolant leakage.
7.6.2.1.7.2.2.14 RHRSW-RMS - GDC 34 - Residual Heat Removal The system provides leak detection of the RHR system.
7.6.2.1.7.2.2.15 RHRSW-RMS - GDC 38 - Containment Heat Removal The system provides a means of leak detection and isolation of the RHR system.
7.6.2.1.7.2.2.16 RHRSW-RMS - GDC 40 - Testing of Containment Heat Removal System The system provides one of the means for testing the integrity of the RHR system.
7.6.2.1.7.2.2.17 RHRSW-RMS - GDC 60 - Control of Releases of Radioactive Materials to the Environment This system provides a means for controlling releases of radioactive materials to the environment.
7.6.2.1.7.2.2.18 RHRSW-RMS - GDC 64 - Monitoring Radioactivity Releases This system monitors radioactivity releases from normal operations, operational occurrences, and from postulated accidents.
7.6.2.1.7.2.3 RHRSW-RMS Conformance to Industry Codes and Standards 7.6.2.1.7.2.3.1 RHRSW-RMS - IEEE 279 (1971) - Criteria for Protection Systems for Nuclear Power Generating Stations 7.6.2.1.7.2.3.1.1 RHR-RMS - IEEE 279 (1971), Paragraph 4.1 - General Functional Requirement The RHRSW-RMS automatically alarms and trips the appropriate RHRSW pumps whenever the effluent radiation levels exceed a preset level.
CHAPTER 07 7.6-63 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.1.7.2.3.1.2 RHRSW-RMS - IEEE 279 (1971), Paragraph 4.2 - Single Failure Criterion The monitoring system consists of one monitor dedicated to each of the common service water return lines. The failure of either channel is alarmed in the Main Control Room. Following the failure of a channel, grab sampling is performed on a periodic basis. Should a high radiation level be detected, the RHRSW pumps may be tripped and the appropriate RHR heat exchangers isolated by manual operator actions. Thus, the safety related function of detection and isolation are maintained.
7.6.2.1.7.2.3.1.3 RHRSW-RMS - IEEE 279 (1971), Paragraph 4.3 - Quality of Components and Modules Components of the radiation monitoring system are carefully selected on the basis of suitability for the specific application. A quality control and assurance program is implemented and documented by the equipment vendor with the intent of complying with the requirements set forth in 10CFR50, Appendix B.
7.6.2.1.7.2.3.1.4 RHRSW-RMS - IEEE 279 (1971), Paragraph 4.4 - Equipment Qualification The equipment is qualified in accordance with IEEE 323, except that no aging test conditions have been imposed.
7.6.2.1.7.2.3.1.5 RHRSW-RMS - IEEE 279 (1971), Paragraph 4.5 - Channel Integrity The radiation monitoring system is designed to maintain its functional capability under the environmental conditions and malfunctions that occur in the design basis LOCA.
7.6.2.1.7.2.3.1.6 RHRSW-RMS - IEEE 279 (1971), Paragraph 4.6 - Channel Independence Channel independence of detectors is provided by electrical and mechanical separation. Physical separation is maintained between each of the two channels (both units).
7.6.2.1.7.2.3.1.7 RHRSW-RMS - IEEE 279 (1971), Paragraph 4.7 - Control and Protection System Interaction The two channels (both units) are independent, so that a single failure does not prevent the system from carrying out its safety- related function.
7.6.2.1.7.2.3.1.8 RHRSW-RMS - IEEE 279 (1971), Paragraph 4.8 - Derivation of System Inputs Trip control signals are derived from measurement of activity levels in the RHRSW. Trip logic is not necessary.
7.6.2.1.7.2.3.1.9 RHRSW-RMS - IEEE 279 (1971), Paragraph 4.9 - Capability for Sensor Checks The detectors used in the radiation monitoring system are equipped with check sources and can be checked one at a time during normal plant operation.
7.6.2.1.7.2.3.1.10 RHRSW-RMS - IEEE 279 (1971), Paragraph 4.10 - Capability for Testing and Calibration Testing and calibration are achieved by means of check sources.
CHAPTER 07 7.6-64 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.1.7.2.3.1.11 RHRSW-RMS - IEEE 279 (1971), Paragraph 4.11 - Channel Bypass or Removal from Operation The system permits removal from operation of one channel for calibration, testing, or maintenance.
With a channel bypass, the protective function is performed by periodic grab sampling of the service water.
7.6.2.1.7.2.3.1.12 RHRSW-RMS - IEEE 279 (1971), Paragraph 4.13 - Indication of Bypasses A downscale alarm annunciates in the control room when a channel is bypassed.
7.6.2.1.7.2.3.1.13 RHRSW-RMS - IEEE 279 (1971), Paragraph 4.14 - Access to Means for Bypassing Means for channel bypass is limited to the control module in the auxiliary equipment room.
7.6.2.1.7.2.3.1.14 RHRSW-RMS - IEEE 279 (1971), Paragraph 4.15 - Multiple Setpoints Setpoints of each monitoring channel may be changed in the control module located in the auxiliary equipment room.
7.6.2.1.7.2.3.1.15 RHRSW-RMS - IEEE 279 (1971), Paragraph 4.18 - Access to Setpoint Adjustments, Calibration, and Test Points Access to setpoint adjustments is limited to control room personnel who have access to the rear of the control module in the auxiliary equipment room.
7.6.2.1.7.2.3.1.16 RHRSW-RMS - IEEE 279 (1971), Paragraph 4.19 - Initiation of Protective Actions Initiation of shutoff of the RHRSW pumps is indicated in the control room.
7.6.2.1.7.2.3.1.17 RHRSW-RMS - IEEE 279 (1971), Paragraph 4.20 - Information Readout Rate meters located in the auxiliary equipment room and recorders located in the control room provide indications of activity levels in the RHRSW. Indicator lights actuated when setpoints are exceeded provide information on alarm conditions.
7.6.2.1.7.2.3.1.18 RHRSW-RMS - IEEE 279 (1971), Paragraph 4.21 - System Repair The system is designed for quick recognition of malfunction through check procedures.
Accessibility to the monitoring racks and controls is provided to facilitate repair or adjustment.
7.6.2.1.7.2.3.1.19 RHRSW-RMS - IEEE 279 (1971), Paragraph 4.22 - Identification of Protection Systems Nameplates identify each module and instrument panel of the radiation monitoring system.
CHAPTER 07 7.6-65 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.1.7.2.3.2 RHRSW-RMS - IEEE 323 (1971) - IEEE Trial Use Standard: General Guide for Qualifying Class 1 Electric Equipment for Nuclear Power Generating Stations Aging test requirements in IEEE 323 (1971) were not complied with because this equipment was procured before the effective date of Regulatory Guide 1.89. Qualification documentation is maintained.
7.6.2.1.7.2.3.3 RHRSW-RMS - IEEE 336 (1971) - Installation, Inspection, and Testing Requirements for Instrumentation and Electric Equipment During the Construction of Nuclear Power Generating Stations Provisions are made for the installation, inspection, and testing of this system in accordance with Class 1E requirements.
7.6.2.1.7.2.3.4 RHRSW-RMS - IEEE 338 (1975) - Criteria for the Periodic Testing of Nuclear Power Generating Station Protection Systems The system is periodically tested in accordance with a standard recalibration and functional test program.
7.6.2.1.7.2.3.5 RHRSW-RMS - IEEE 344 (1971) - Guide for Seismic Qualification of Class 1 Electric Equipment for Nuclear Power Generating Stations Capability of the instruments and controls to meet seismic requirements is demonstrated by the vendor. Documentation is maintained to verify that the equipment is qualified. Refer to Section 3.10.
7.6.2.1.7.2.3.6 RHRSW-RMS - IEEE 379 (1972) - Guide for the Application of the Single Failure Criterion to Nuclear Power Generating Station Protection Systems Redundancy of the system ensures that a single failure does not prevent the system from carrying out its safety-related function.
7.6.2.1.7.2.3.7 RHRSW-RMS - IEEE 384 (1974) - Criteria for Separation of Class 1E Equipment and Circuits The channels of this system are separated in accordance with IEEE 279.
7.6.2.1.7.3 RHRSW-RMS Preoperational Checkout Preoperational tests are conducted before initial startup. These tests ensure functioning of all controls and active components. System reference characteristics such as setpoints are documented during preoperational testing and are used as base points for measurements obtained during subsequent calibrations.
7.6.2.1.7.4 RHRSW-RMS Operational Tests During plant operation, components of this system can be inspected at any time. Test frequency is consistent with the requirements of plant Technical Specifications.
7.6.2.1.8 North Stack Effluent Radiation Monitoring System CHAPTER 07 7.6-66 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.1.8.1 NSE-RMS General Functional Requirements Conformance Two independent monitoring subsystems are provided:
- a. Normal range plant subsystem
- b. Wide range accident monitoring subsystem Subsystem (a) is designed to monitor the north stack effluents under normal plant operating conditions. Subsystem (b) is designed to monitor the north stack effluents under normal plant operation, accident, and postaccident condition. Section 11.5.2.2.1 describes the system and shows how the design bases identified in Section 7.1.2.1.11.6.1 are met.
7.6.2.1.8.2 NSE-RMS Specific Regulatory Requirements 7.6.2.1.8.2.1 NSE-RMS Conformance to Regulatory Guides 7.6.2.1.8.2.1.1 NSE-RMS - Regulatory Guide 1.21 (1974) - Measuring, Evaluating, and Reporting Radioactivity in Solid Wastes and Releases of Radioactive Materials in Liquid or Gaseous Effluents from Light-Water-Cooled Nuclear Power Plants Ongoing inventories of radiation particulates, iodines, and noble gases are provided for the preparation of Regulatory Guide 1.21, Appendix B reports.
7.6.2.1.8.2.1.2 NSE-RMS - Regulatory Guide 1.22 (1972) - Periodic Testing of Protection System Actuation Functions (Safety Guide 22)
The system will be periodically tested in accordance with IEEE 279 (1971).
7.6.2.1.8.2.1.3 NSE-RMS - Regulatory Guide 1.29 (1978) - Seismic Design Classification Subsystem (b), the wide range accident monitor is qualified to seismic Category I criteria to ensure the integrity of its Class 1E power source. The sampling nozzles and lines of the wide range accident monitor are designed to seismic Category II. Subsystem (a), the normal plant operation monitor, is designed to meet seismic Category II requirements.
7.6.2.1.8.2.1.4 NSE-RMS - Regulatory Guide 1.89 (1974) - Qualification of Class 1E Equipment for Nuclear Power Plants To ensure its functionability during and after an accident, Subsystem (b) is qualified to meet IEEE 323 (1974) requirements.
7.6.2.1.8.2.1.5 NSE-RMS - Regulatory Guide 1.97 (1980) - Instrumentation for Light-Water-Cooled Nuclear Power Plants to Access Plant and Environs Conditions During and Following an Accident Refer Section 7.5.2.5.1.1.2 for degree of compliance.
7.6.2.1.8.2.1.6 NSE-RMS - Regulatory Guide 1.100 (1977) - Seismic Qualification of Electric Equipment for Nuclear Power Plants CHAPTER 07 7.6-67 REV. 20, SEPTEMBER 2020
LGS UFSAR See Section 3.10 for a discussion of the degree of conformance.
7.6.2.1.8.2.1.7 NSE-RMS - Regulatory Guide 1.105 (1976) - Instrument Setpoints See Section 7.1.2.5.25 for a discussion of the degree of conformance.
7.6.2.1.8.2.1.8 NSE-RMS Regulatory Guide 1.118 (1978) - Periodic Testing of Electric Power and Protection Systems See Section 7.1.2.5.26 for a discussion of the degree of conformance.
7.6.2.1.8.2.2 NSE-RMS Conformance to 10CFR50, Appendix A, General Design Criteria 7.6.2.1.8.2.2.1 NSE-RMS - GDC 1 - Quality Standards and Records Quality assurance has been provided for the wide range accident monitor commensurate with its importance to safety in accordance with the guidelines of Regulatory Guide 1.97 (1980).
7.6.2.1.8.2.2.2 NSE-RMS - GDC 2 - Design Bases for Protection Against Natural Phenomena The wide range accident monitor is designed to meet seismic Category I requirements as discussed in Section 7.6.2.1.8.2.1.3.
7.6.2.1.8.2.2.3 NSE-RMS - GDC 3 - Fire Protection Fire resistant components are used throughout.
7.6.2.1.8.2.2.4 NSE-RMS - GDC 4 - Environmental and Dynamic Effects Design Bases No provision is made for protection against missiles.
7.6.2.1.8.2.2.5 NSE-RMS - GDC 5 - Sharing of Structures, Systems, and Components The wide range accident radiation monitoring subsystem is shared by both units of the plant. The system is designed to perform its safety function in the event of an accident in one unit and during the orderly shutdown and cooldown of the other unit.
7.6.2.1.8.2.2.6 NSE-RMS - GDC 13 - Instrumentation and Control Operating ranges of the instrumentation cover normal plant operations, accident conditions, and postaccident conditions.
7.6.2.1.8.2.2.7 NSE-RMS - GDC 21 - Protection System Reliability and Testability This system is designed for high functional reliability and inservice testability.
7.6.2.1.8.2.2.8 NSE-RMS - GDC 22 - Protection System Failure Modes Two independent systems are provided. Within their operating ranges, redundancy and channel separation are provided, however only one system is provided for high range accident and postaccident conditions.
CHAPTER 07 7.6-68 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.1.8.2.2.9 NSE-RMS - GDC 60 - Control of Releases of Radioactive Materials to the Environment Surveillance is maintained of release of radioactive materials to the environment; however, remedial action is initiated by control room personnel.
7.6.2.1.8.2.2.10 NSE-RMS - GDC 64 - Monitoring Radioactive Releases The requirement for monitoring radioactive releases from normal operations, anticipated operational occurrences, and from postulated accident is fulfilled.
7.6.2.1.8.2.3 NSE-RMS Conformance to 10CFR50, Appendix I This system is equipped with instruments capable of state-of-the- art sensitivity to provide control room personnel with real-time information needed for restricting release of radioactive materials to limits as-low-as-practicable.
7.6.2.1.8.3 NSE-RMS Conformance to Industry Codes and Standards 7.6.2.1.8.3.1 NSE-RMS - IEEE 323 (1971) - IEEE Trial Use Standard: General Guide for Qualifying Class 1 Electric Equipment for Nuclear Power Generating Stations The wide range accident monitor is qualified to IEEE 323 (1974).
7.6.2.1.8.3.2 NSE-RMS - IEEE 344 (1971) - Guide for Seismic Qualifications of Class 1 Electric Equipment for Nuclear Power Generating Stations The wide range accident monitor is qualified for seismic Category I as discussed in Section 7.6.2.1.8.2.1.3. Refer to Section 3.10.
7.6.2.1.8.3.3 NSE-RMS - IEEE 384 (1974) - Criteria for Separation of Class 1E Equipment and Circuits The wide range accident monitor is designed in accordance with IEEE 384 (1974).
7.6.2.1.8.4 NSE-RMS Preoperational Checkout Preoperational tests are conducted prior to initial startup. The tests ensure functioning of all components and controls. System reference characteristics such as setpoints are documented during preoperational testing and used as base points for measurements obtained during subsequent calibrations.
7.6.2.1.8.5 NSE-RMS Operational Tests During plant operation, components of the NSE-RMS can be operationally tested at any time. Test frequency is consistent with the requirements of plant Technical Specifications.
7.6.2.2 High Pressure/Low Pressure Systems Interlocks - Instrumentation and Controls 7.6.2.2.1 HPLPSI General Functional Requirements Conformance For conformance discussion, refer to Sections 7.3.2.1, 7.3.2.4, and 7.4.2.3.
CHAPTER 07 7.6-69 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.2.2 HPLPSI Specific Regulatory Requirements Conformance 7.6.2.2.2.1 HPLPSI Conformance to Regulatory Guides 7.6.2.2.2.1.1 HPLPSI - Regulatory Guide 1.22 (1972) - Periodic Testing of Protection System Actuation Functions (Safety Guide 22)
Refer to Section 7.1.
7.6.2.2.2.1.2 HPLPSI - Regulatory Guide 1.29 (1978) - Seismic Design Classification For compliance to Regulatory Guide 1.29, see Section 7.1.2.5.6.
7.6.2.2.2.1.3 HPLPSI - Regulatory Guide 1.30 (1972) - Quality Assurance Requirements for the Installation, Inspection, and Testing of Instrumentation and Electric Equipment (Safety Guide 30)
For compliance to Regulatory Guide 1.30, see Section 8.1.6.1.5.
See Section 7.6.2.2.2.3.3 on conformance to IEEE 338 (1971).
7.6.2.2.2.1.4 HPLPSI - Regulatory Guide 1.47 (1973) - Bypassed and Inoperable Status Indication for Nuclear Power Plant Safety Systems Refer to Section 7.1.2.5.11.
7.6.2.2.2.1.5 HPLPSI - Regulatory Guide 1.53 (1973) - Application of the Single Failure Criterion to Nuclear Power Plant Protection Systems See Section 7.6.2.2.2.3.4 on conformance to IEEE 379 (1972).
7.6.2.2.2.1.6 HPLPSI - Regulatory Guide 1.68 (1978) - Preoperational and Initial Startup Test Programs for Water-Cooled Power Reactors Conformance is discussed in Section 14.2.
7.6.2.2.2.1.7 HPLPSI - Regulatory Guide 1.75 (1978) - Physical Independence of Electric Systems See Section 7.1.2.5.19 on conformance to Regulatory Guide 1.75.
7.6.2.2.2.1.8 HPLPSI - Regulatory Guide 1.100 (1977) - Seismic Qualification of Electric Equipment for Nuclear Power Plants See Section 3.10 for conformance to Regulatory Guide 1.100.
7.6.2.2.2.1.9 HPLPSI Regulatory Guide General Conformance Statement Refer to Section 7.1.2.5 for a general conformance statement for Regulatory Guides 1.11, 1.45, 1.89, 1.105, and 1.118.
CHAPTER 07 7.6-70 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.2.2.2 HPLPSI Conformance to 10CFR50, Appendix A, General Design Criteria There are no general design criteria that apply to HPLPSI.
7.6.2.2.2.3 HPLPSI Conformance to Industry Codes and Standards 7.6.2.2.2.3.1 HPLPSI - IEEE 279 (1971) - Criteria for Protection Systems for Nuclear Power Generating Stations The interlocks are designed in accordance with the single failure criterion, redundancy requirements, and testability criteria.
7.6.2.2.2.3.2 HPLPSI - IEEE 336 (1971) - Installation, Inspection, and Testing Requirements for Instrumentation and Electrical Equipment During the Construction of Nuclear Power Generating Stations Conformance is discussed in Section 7.1.2.7.5.
7.6.2.2.2.3.3 HPLPSI - IEEE 338 (1971) - Criteria for the Periodic Testing of Nuclear Power Generating Station Protection Systems The design of the interlocks is such that they can be tested during reactor operation except for the actuated devices (valves). The valves can be tested during startup and shutdown.
7.6.2.2.2.3.4 HPLPSI - IEEE 379 (1972) - Guide for the Application of the Single Failure Criterion to Nuclear Power Generating Station Protection Systems The low pressure process lines are protected as defined in Section 7.6.1.2.3. Where two redundant MOVs are used, the valves are interlocked with independent pressure transmitters and trip units so that not more than one redundant interlock is disabled by a single failure. The RHR shutdown cooling suction valve F008 is provided with an additional interlock which prevents a fire-induced open signal from causing it to open simultaneously with valve F009 when the reactor pressure is greater than the design capabilities of the RHR low-pressure piping. When only one MOV is used, a check valve is used in series with the MOV. The check valve will not open until reactor pressure has decreased to a value less than the low pressure process line design value.
7.6.2.2.2.3.5 HPLPSI IEEE General Conformance Statement Refer to Section 7.1.2.7 for a general conformance statement for IEEE 308 (1974), 323 (1971), 344 (1971), and 384 (1974).
7.6.2.3 Leak Detection System - Instrumentation and Controls 7.6.2.3.1 LDS General Functional Requirements Conformance The safety-related portions of the leak detection system are part of the PCRVICS, and conform to the design basis requirements for the PCRVICS as described in Section 7.3.1.1.2.1.
7.6.2.3.2 LDS Specific Regulatory Requirements Conformance 7.6.2.3.2.1 LDS Conformance to Regulatory Guides CHAPTER 07 7.6-71 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.3.2.1.1 LDS - Regulatory Guide 1.22 (1972) - Periodic Testing of Protection System Actuation Functions (Safety Guide 22)
The portion of the LDS that provides outputs to the system isolation logic is designed so that complete periodic testing of the isolation system actuation function is possible. This is accomplished by tripping the leak detection system one channel at a time from the leak detection panel in the control room. An indicator lamp is provided to show that the particular channel is tripped.
7.6.2.3.2.1.2 LDS - Regulatory Guide 1.29 (1978) - Seismic Design Classification All equipment that performs an isolation function is qualified to seismic Category I criteria (Section 3.10). The application of this equipment in the turbine enclosure is discussed in Section 7.3.2.2.2.3.1.5.
7.6.2.3.2.1.3 LDS - Regulatory Guide 1.30 (1972) - Quality Assurance Requirements for the Installation, Inspection, and Testing of Instrumentation and Electric Equipment (Safety Guide 30)
For conformance discussion refer to Section 7.1.2.5.7.
7.6.2.3.2.1.4 LDS - Regulatory Guide 1.47 (1973) - Bypassed and Inoperable Status Indication for Nuclear Power Plant Safety Systems The LDS annunciates all bypass conditions.
7.6.2.3.2.1.5 LDS - Regulatory Guide 1.53 (1973) - Application of the Single Failure Criterion to Nuclear Power Plant Protection Systems The portions of the LDS that provide outputs to system isolation logic comply with this guide.
Discussion is provided in Section 7.1.2.5.12 under Regulatory Guide 1.53.
7.6.2.3.2.1.6 LDS - Regulatory Guide 1.68 (1978) - Preoperational and Initial Startup Test Programs for Water-Cooled Reactor Power Reactors The degree of conformance is discussed in Section 7.1.2.5.
7.6.2.3.2.1.7 LDS - Regulatory Guide 1.75 (1978) - Physical Independence of Electric Equipment For a conformance discussion see Section 7.1.2.5.19.
7.6.2.3.2.1.8 LDS - Regulatory Guide 1.89 (1974) - Qualification of Class 1E Equipment for Nuclear Power Plants The degree of conformance is discussed in Section 7.1.2.5.
7.6.2.3.2.1.9 LDS - Regulatory Guide 1.100 (1977) - Seismic Qualification of Electric Equipment for Nuclear Power Plants See Section 3.10 for discussion of the degree of conformance.
CHAPTER 07 7.6-72 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.3.2.1.10 LDS - Regulatory Guide 1.105 (1976) - Instrument Setpoints See Section 7.1.2.5.25 for a discussion of the degree of conformance.
7.6.2.3.2.1.11 LDS - Regulatory Guide 1.118 (1978) - Periodic Testing of Electric Power and Protection Systems See Section 7.1.2.5.26 for the discussion of the degree of conformance.
7.6.2.3.2.2 LDS Conformance to 10CFR50, Appendix A, General Design Criteria 7.6.2.3.2.2.1 LDS - GDC 1 - Quality Standards and Records A quality assurance program for the LDS is established and implemented in order to provide adequate assurance that the system will satisfactorily perform its safety functions.
7.6.2.3.2.2.2 LDS - GDC 2 - Design Bases for Protection Against Natural Phenomena For a conformance discussion, refer to Section 7.1.2.6.2.
7.6.2.3.2.2.3 LDS - GDC 3 - Fire Protection For a conformance discussion, refer to Section 7.1.2.6.3.
7.6.2.3.2.2.4 LDS - GDC 4 - Environmental and Dynamic Effects Design Bases For a conformance discussion, refer to Section 7.1.2.6.4.
7.6.2.3.2.2.5 LDS - GDC 10 - Reactor Design The LDS is designed with an appropriate margin to monitor leakage from the RCPB.
7.6.2.3.2.2.6 LDS - GDC 13 - Instrumentation and Control The leak detection sensors and associated electronics are designed to monitor the reactor coolant leakage over all expected ranges required for the safety of the plant.
Automatic initiation of the system isolation action, reliability, testability, independence, and separation are factored into leak detection design as required for isolation systems.
7.6.2.3.2.2.7 LDS - GDC 19 - Control Room Controls and instrumentation are provided in the control room.
7.6.2.3.2.2.8 LDS - GDC 20 - Protection System Functions Leak detection equipment senses accident conditions and initiates the PCRVICS when appropriate.
7.6.2.3.2.2.9 LDS - GDC 21 - Protection System Reliability and Testability CHAPTER 07 7.6-73 REV. 20, SEPTEMBER 2020
LGS UFSAR Protection-related equipment is arranged in two redundant divisions and maintained separately.
Testing is covered in the conformance discussion for Regulatory Guide 1.22.
7.6.2.3.2.2.10 LDS - GDC 22 - Protection System Independence Protection-related equipment is arranged in two redundant divisions so that no single failure can prevent isolation. Diversity of sensed variables is utilized.
7.6.2.3.2.2.11 LDS - GDC 23 - Protection System Failure Modes Signals provided are such that isolation logic is fail-safe.
7.6.2.3.2.2.12 LDS - GDC 24 - Separation of Protection and Control Systems The system has no control functions.
7.6.2.3.2.2.13 LDS - GDC 29 - Protection Against Anticipated Operational Occurrences No anticipated operational occurrence can prevent an isolation.
7.6.2.3.2.2.14 LDS - GDC 30 - Quality of Reactor Coolant Pressure Boundary The system provides means for the detection and general location of the source of reactor coolant leakage.
7.6.2.3.2.2.15 LDS - GDC 34 - Residual Heat Removal Leak detection is provided for RHR lines penetrating the drywell.
7.6.2.3.2.2.16 LDS - GDC 35 - Emergency Core Cooling ECCS leak detection is augmented by the sump monitoring system portion of the leak detection system. ECCS leaks can be identified by operator correlation of various flow, pressure, and reactor vessel level signals transmitted to the control room.
7.6.2.3.2.2.17 LDS - GDC 54 - Piping Systems Penetrating Containment Leak detection is provided for main steam, RCIC, and RWCU lines penetrating the containment.
7.6.2.3.2.3 LDS Conformance to Industry Codes and Standards 7.6.2.3.2.3.1 LDS - IEEE 279 (1971) and 379 (1972) - Guide for the Application of the Single Failure Criterion LDS isolation functions compliance with IEEE 279 (1971) and 379 (1972), is included in the IEEE 279 and 379 compliance discussions of the PCRVICS Section 7.3.2.2.3.1, for which this system provides logic trip signals.
7.6.2.3.2.3.2 LDS - IEEE 323 (1971) - IEEE Trial Use Standard: General Guide for Qualifying Class 1 Electric Equipment for Nuclear Power Generating Stations CHAPTER 07 7.6-74 REV. 20, SEPTEMBER 2020
LGS UFSAR Leak detection compliance is shown in Section 7.1.2.7.4.
7.6.2.3.2.3.3 LDS - IEEE 336 (1971) - Installation, Inspection, and Testing Requirements for Instrumentation and Electric Equipment During the Construction of Nuclear Power Generating Stations For a conformance discussion, refer to Section 7.1.2.7.5.
7.6.2.3.2.3.4 LDS - IEEE 338 (1971) - Criteria for the Periodic Testing of Nuclear Power Generating Station Protection Systems Leak detection complies with IEEE 338 (1971). All active components of the LDS associated with the isolation signal can be tested during plant operation.
7.6.2.3.2.3.5 LDS - IEEE 344 (1971) - Guide for Seismic Qualification of Class 1 Electric Equipment for Nuclear Power Generating Stations Leak detection system compliance is shown in Section 3.10.
7.6.2.3.2.3.6 LDS - IEEE 379 (1972) - Guide for the Application of the Single Failure Criterion to Nuclear Power Generation Station Protection Systems The degree of conformance is discussed in Section 7.1.2.7.8.
7.6.2.3.2.3.7 LDS - IEEE 384 (1977) - Criteria for Separation of Class 1E Equipment and Circuits For an assessment, refer to Section 7.1.2.7.11.
7.6.2.4 Neutron Monitoring System - Instrumentation and Controls 7.6.2.4.1 Intermediate Range Monitor System 7.6.2.4.1.1 IRM General Functional Requirements Conformance The analysis for the RPS trip inputs from the IRM system are discussed in Section 7.2.2.
7.6.2.4.1.2 IRM Power Generation Design Basis The IRM is the primary source of information as the reactor approaches the power range. Its linear steps (approximately a half decade) and the rod blocking features on both high flux level and low flux level require that all the IRMs be on the correct range as core power is increased. The SRM overlaps the IRM. The sensitivity of the IRM is such that the IRM is on scale on the least sensitive (highest) range with approximately 15% reactor power.
The number and locations of the IRM detectors provide sufficient intermediate range neutron flux level information under the worst permitted bypass conditions. To ensure that each IRM is on the correct range, a rod block is initiated any time the IRM is both downscale and not on the most sensitive (lowest) scale. A rod block is initiated if the IRM detectors are not fully inserted in the core, unless the reactor mode switch is in the RUN position.
CHAPTER 07 7.6-75 REV. 20, SEPTEMBER 2020
LGS UFSAR The IRM scram trips and the IRM rod block trips are automatically bypassed when the reactor mode switch is in the RUN position.
The IRM detectors and electronics have been tested under operating conditions and verified to have the operational characteristics described. They provide the level of precision and reliability required by the RPS safety design bases.
7.6.2.4.1.3 IRM Specific Regulatory Requirements Conformance 7.6.2.4.1.3.1 IRM Conformance with Regulatory Guides 7.6.2.4.1.3.1.1 IRM - Regulatory Guide 1.22 (1972) - Periodic Testing of Protection System Actuation Functions (Safety Guide 22)
The portion of the IRM system that provides outputs to the RPS is designed to allow complete periodic testing of protection system actuation function as desired. The provision is accomplished by initiating an output trip of one IRM channel at any given time, which results in tripping one of the two RPS trip systems. Details are provided in the discussion of IEEE 279 (Section 7.2.2.1.2.3.1).
Indication of IRM bypass to operators is provided by indicator lamps.
7.6.2.4.1.3.1.2 IRM - Regulatory Guide 1.29 (1978) - Seismic Design Classification All devices and circuitry from sensor to trip output are classified Category I (Section 7.1.2.5.6).
7.6.2.4.1.3.1.3 IRM - Regulatory Guide 1.30 (1972) - Quality Assurance Requirements for the Installation, Inspection, and Testing of Instrumentation and Electric Equipment (Safety Guide 30)
For compliance with Regulatory Guide 1.30, see Section 8.1.6.1.
7.6.2.4.1.3.1.4 IRM - Regulatory Guide 1.47 (1973) - Bypassed and Inoperable Status Indication for Nuclear Power Plant Safety Systems The IRM complies with this guide. Discussion is provided in Section 7.2.2.1.2.
7.6.2.4.1.3.1.5 IRM - Regulatory Guide 1.53 (1973) - Application of the Single Failure Criterion to Nuclear Power Plant Protection Systems The IRM complies with this guide. Discussion is provided in Section 7.2.2.1.2.1.8 under Regulatory Guide 1.53.
7.6.2.4.1.3.1.6 IRM - Regulatory Guide 1.68 (1978) - Preoperational and Initial Startup Test Programs for Water-Cooled Power Reactors For conformance discussion refer to Section 7.1.2.5.16.
7.6.2.4.1.3.1.7 IRM - Regulatory Guide 1.75 (1978) - Physical Independence of Electric Systems For conformance discussion refer to Section 7.1.2.5.19.
CHAPTER 07 7.6-76 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.4.1.3.1.8 IRM - Regulatory Guide 1.89 (1974) - Qualification of Class 1E Equipment for Nuclear Power Plants The IRM complies with this guide. Discussion is provided in Section 7.2.2.1.2.
7.6.2.4.1.3.1.9 IRM - Regulatory Guide 1.100 (1977) - Seismic Qualification of Electric Equipment for Nuclear Power Plants The IRM complies with this guide. Discussion is provided in Section 7.2.2.1.2.
7.6.2.4.1.3.1.10 IRM - Regulatory Guide 1.105 (1976) - Instrument Setpoints The IRM complies with this guide. Discussion is provided in Section 7.2.2.1.2.
7.6.2.4.1.3.1.11 IRM - Regulatory Guide 1.118 (1978) - Periodic Testing of Electric Power and Protection Systems The IRM complies with this guide. Discussion is provided in Section 7.2.2.1.2.
7.6.2.4.1.3.2 IRM Conformance with 10CFR50, Appendix A, General Design Criteria 7.6.2.4.1.3.2.1 IRM - GDC 1 - Quality Standards and Records The IRM, as an input to the RPS, complies with these criteria as discussed in Section 7.2.2.1.2.2.1.
7.6.2.4.1.3.2.2 IRM - GDC 2 - Design Bases for Protection Against Natural Phenomena The IRM, as an input to the RPS, complies with these criteria as discussed in Section 7.2.2.1.2.2.2.
7.6.2.4.1.3.2.3 IRM - GDC 3 - Fire Protection The IRM, as an input to the RPS, complies with these criteria as discussed in Section 7.2.2.1.2.2.3.
7.6.2.4.1.3.2.4 IRM - GDC 4 - Environmental and Dynamic Effects Design Bases The IRM, as an input to the RPS, complies with these criteria as discussed in Section 7.2.2.1.2.2.4.
7.6.2.4.1.3.2.5 IRM - GDC 10 - Reactor Design The IRM, as an input to the RPS, complies with these criteria as discussed in Section 7.2.2.1.2.2.5.
7.6.2.4.1.3.2.6 IRM - GDC 12 - Suppression of Reactor Power Oscillations The IRM, as an input to the RPS, complies with these criteria as discussed in Section 7.2.2.1.2.2.6.
7.6.2.4.1.3.2.7 IRM - GDC 13 - Instrumentation and Control The IRM detectors and associated electronics are designed to monitor the incore flux over all expected ranges required for the safety of the plant.
CHAPTER 07 7.6-77 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.4.1.3.2.8 IRM - GDC 19 - Control Room The IRM detectors and associated electronics are designed to monitor the incore flux over all expected ranges required for the safety of the plant.
7.6.2.4.1.3.2.9 IRM - GDC 20 - Protection System Functions The IRM detectors and associated electronics are designed to monitor the incore flux over all expected ranges required for the safety of the plant.
7.6.2.4.1.3.2.10 IRM - GDC 21 - Protection System Reliability and Testability Automatic initiation of protection system action, reliability, testability, independence, and separation are factored into the IRM design as required for protection systems.
7.6.2.4.1.3.2.11 IRM - GDC 22 - Protection System Independence Automatic initiation of protection system action, reliability, testability, independence, and separation are factored into the IRM design as required for protection systems.
7.6.2.4.1.3.2.12 IRM - GDC 23 - Protection System Failure Modes Automatic initiation of protection system action, reliability, testability, independence, and separation are factored into the IRM design as required for protection systems.
7.6.2.4.1.3.2.13 IRM - GDC 24 - Separation of Protection and Control Systems Automatic initiation of protection system action, reliability, testability, independence, and separation are factored into the IRM design as required for protection systems.
7.6.2.4.1.3.2.14 IRM - GDC 25 - Protection System Requirements for Reactivity Control Malfunctions Automatic initiation of protection system action, reliability, testability, independence, and separation are factored into the IRM design as required for protection systems.
7.6.2.4.1.3.2.15 IRM - GDC 29 - Protection Against Anticipated Operational Occurrences Automatic initiation of protection system action, reliability, testability, independence, and separation are factored into the IRM design as required for protection systems.
7.6.2.4.1.3.3 IRM Conformance to Industry Codes and Standards 7.6.2.4.1.3.3.1 IRM - IEEE 279 (1971) - Criteria for Protection Systems for Nuclear Power Generating Stations The IRM design is shown to comply with the design requirements of IEEE 279 in Section 7.2.2.1.2.3.1.
CHAPTER 07 7.6-78 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.4.1.3.3.2 IRM - IEEE 317 (1972) - Electric Penetration Assemblies in Containment Structures for Nuclear Power Generating Stations IRM conformance with IEEE 317 (1972) is endorsed by Regulatory Guide 1.63 (1978). For compliance to Regulatory Guide 1.63, see Section 8.1.6.1.
7.6.2.4.1.3.3.3 IRM - IEEE 323 (1971) - IEEE Trial Use Standard: General Guide for Qualifying Class 1 Electric Equipment for Nuclear Power Generating Stations Written procedures and responsibilities are developed for the design and qualification of all Class 1E equipment. This includes preparation of specifications, qualification procedures, and documentation. Whenever possible, qualification testing or analysis is accomplished prior to release of the engineering design for production. Standards manuals are maintained and contain specifications, practices, and procedures for implementing qualification requirements; an auditable file of qualification documents is available for review.
7.6.2.4.1.3.3.4 IRM - IEEE 336 (1971) - Installation, Inspection, and Testing Requirements for Instrumentation and Electric Equipment During the Construction of Nuclear Power Generating Stations IEEE 336 (1971) is endorsed by Regulatory Guide 1.30 (1972). For compliance to Regulatory Guide 1.30, see Section 8.1.6.1.
7.6.2.4.1.3.3.5 IRM - IEEE 338 (1971) - Criteria for the Periodic Testing of Nuclear Power Generating Station Protection Systems IRM compliance with IEEE 338 is provided in Section 7.2.2.1.2.3.1 under IEEE 279, Paragraphs 4.9 and 4.10.
7.6.2.4.1.3.3.6 IRM - IEEE 344 (1971) - Guide for Seismic Qualification of Class 1 Electric Equipment for Nuclear Power Generating Stations The IRMs are qualified for seismic events. Compliance is further shown in Section 3.10.
7.6.2.4.1.3.3.7 IRM - IEEE 379 (1972) - Guide for the Application of the Single Failure Criterion to Nuclear Power Generating Station Protection Systems IRM signal separation, cabinet separation, use of isolation circuitry, and number of channels per trip system are methods used to meet the single failure criterion. Convenient tests and calibration circuits permit frequent checks for undetected failures.
7.6.2.4.1.3.3.8 IRM - IEEE 384 (1977) - Criteria for Separation of Class 1E Equipment and Circuits For conformance discussion refer to Section 7.3.2 7.6.2.4.2 Local Power Range Monitor System 7.6.2.4.2.1 LPRM General Functional Requirement Conformance The LPRM provides detailed information about neutron flux throughout the reactor core. The number of LPRM assemblies and their distribution is determined by extensive calculational and CHAPTER 07 7.6-79 REV. 20, SEPTEMBER 2020
LGS UFSAR experimental procedures. The division of the LPRM into various groups for ac power supply allows operation with one ac power supply failed or out-of-service without limiting reactor operation.
Individual failed chambers can be bypassed. Neutron flux information for a failed chamber location can be interpolated from nearby chambers. A substitute reading for a failed chamber can be derived from an octant-symmetric chamber, or an actual flux indication can be obtained by inserting a TIP to the failed chamber position. Each output is electrically isolated so that an event (grounding the signal or applying a stray voltage) on the reception end does not destroy the validity of other LPRM signals. Tests and experience attest to the ability of the detector to respond proportionally to the local neutron flux changes.
The LPRM design conforms with the provisions of the safety design basis in that there are sufficient LPRM detectors to ensure that under worst case LPRM bypass conditions the APRM is capable of generating a trip signal to prevent fuel damage. The LPRM system utilizes 43 detector assemblies, each assembly monitoring all four axial planes in the core. Sufficient LPRM channels are assigned to each APRM channel to provide a valid signal for average core flux, even with the maximum number of channels bypassed. When more than the maximum allowable number of LPRM channels associated with an APRM channel are bypassed, an APRM trouble alarm occurs.
The LPRM design conforms to the provisions of the power generation design basis as follows:
- a. The LPRM signals are proportional to the local neutron flux at various locations in the core. The LPRM subsystem utilizes 43 detector assemblies, each assembly consisting of four fission chambers located in different axial positions. The detector output characteristic is linear with neutron flux in the power range.
- b. The LPRM system has trips for LPRM downscale and upscale. The trips are annunciated in the control room.
- c. The LPRM provides signals to the process computer system which, utilizing additional inputs, computes local power densities for each fuel assembly, core power distribution, core thermal limits, and fuel exposure.
- d. The LPRM provides signals to the RBM for the rod block trip function. When the averaged LPRM signal exceeds the rod block setpoint, control rod withdrawal is inhibited.
7.6.2.4.2.2 LPRM Specific Regulatory Requirements Conformance 7.6.2.4.2.2.1 LPRM Conformance to Regulatory Guides 7.6.2.4.2.2.1.1 LPRM - Regulatory Guide 1.22 (1972) - Periodic Testing of Protection System Actuation Functions (Safety Guide 22)
Refer to Section 7.1.2.5.5b for a general conformance statement for Regulatory Guide 1.22.
7.6.2.4.2.2.1.2 LPRM - Regulatory Guide 1.30 (1972) - Quality Assurance Requirements for the Installation, Inspection, and Testing of Instrumentation and Electric Equipment (Safety Guide 30)
For compliance to Regulatory Guide 1.30, see Section 8.1.6.1.
CHAPTER 07 7.6-80 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.4.2.2.1.3 LPRM - Regulatory Guide 1.66 (1973) - Nondestructive Testing of Nuclear Products This regulatory guide has been withdrawn by the NRC. The LPRM assembly dry tube was nondestructively examined in accordance with ASTM and ASME requirements; however, it was exempt from the requirements of Regulatory Guide 1.66 under note 3 of section C.
7.6.2.4.2.2.1.4 LPRM - Regulatory Guide 1.89 (1974) - Qualification of Class 1E Equipment for Nuclear Power Plants Refer to Section 7.1.2.5.21 for a general conformance statement for Regulatory Guide 1.89.
7.6.2.4.2.2.2 LPRM Conformance to Industry Codes and Standards 7.6.2.4.2.2.2.1 LPRM - IEEE 279 (1971) - Criteria for Protection Systems for Nuclear Power Generating Stations 7.6.2.4.2.2.2.1.1 LPRM - IEEE 279 (1971), Paragraph 4.1 - General Functional Requirement The LPRMs continuously supply flux level signals to the assigned APRM channel, which will automatically initiate the appropriate protective action whenever the core average flux reaches the trip setpoint.
7.6.2.4.2.2.2.1.2 LPRM - IEEE 279 (1971), Paragraph 4.2 - Single Failure Criterion The LPRM is divided into four separate groups such that even in the event of a single failure under permissible APRM bypass conditions a scram signal can be generated in the RPS. Physical panel barriers and electrical isolation provides independence between groups. Redundant wiring and trip logic is physically separated to prevent a single failure from impairing a protective action.
7.6.2.4.2.2.2.1.3 LPRM - IEEE 279 (1971), Paragraph 4.3 - Quality of Components and Modules LPRM signals are processed by modules and components used on previous GE BWR plants which have exhibited high quality and reliability.
The detectors and related drive equipment as well as the trip logic circuitry are also of high quality and reliability.
7.6.2.4.2.2.2.1.4 LPRM - IEEE 279 (1971), Paragraph 4.4 - Equipment Qualification Qualification tests of LPRM equipment are conducted to confirm their adequacy for service.
Environmental qualification is discussed in detail in Section 3.11.
7.6.2.4.2.2.2.1.5 LPRM - IEEE 279 (1971) Paragraph 4.5 - Channel Integrity All components of LPRM are designed to operate under abnormal conditions of environment, power supply, and accidents.
7.6.2.4.2.2.2.1.6 LPRM - IEEE 279 (1971), Paragraph 4.6 - Channel Independence CHAPTER 07 7.6-81 REV. 20, SEPTEMBER 2020
LGS UFSAR The redundant channels of LPRM monitoring circuitry are physically separated from one another in conformance with this requirement.
7.6.2.4.2.2.2.1.7 LPRM - IEEE 279 (1971), Paragraph 4.7 - Control and Protective System Interaction The LPRM output signals to the APRM are isolated from the output to the RBM. A failure in the RBM circuitry will not affect the output signal necessary for proper functioning of the APRM or RPS.
Furthermore the APRM is designed such that a fault in any single LPRM output will not affect any other LPRMs supplying inputs to the same APRM channel.
7.6.2.4.2.2.2.1.8 LPRM - IEEE 279 (1971), Paragraph 4.8 - Deviation of System Inputs The LPRM detector directly measures local neutron flux, which is a direct measure of local core power density.
7.6.2.4.2.2.2.1.9 LPRM - IEEE 279 (1971), Paragraph 4.9 - Capability for Sensor Checks Proper detector operation can be verified during normal power operation by comparing detector response with TIP system response.
7.6.2.4.2.2.2.1.10 LPRM - IEEE 279 (1971), Paragraph 4.10 - Capability for Testing and Calibration The gain adjustments for LPRMs are determined from process computer computations based on TIP flux measurements and reactor heat balance data.
7.6.2.4.2.2.2.1.11 LPRM - IEEE 279 (1971), Paragraph 4.11 - Channel Bypass or Removal from Operation Each LPRM channel can be individually bypassed. When more than the permissible number of LPRM channels associated with an APRM channel is bypassed, an APRM trouble alarm is generated by that APRM.
7.6.2.4.2.2.2.1.12 LPRM - IEEE 279 (1971), Paragraph 4.12 - Operating Bypasses There are no operating bypass circuits provided for the LPRM or the APRM systems.
7.6.2.4.2.2.2.1.13 LPRM - IEEE 279 (1971), Paragraph 4.13 - Indication of Bypasses ODAs in the control room indicate bypassed LPRM channels.
7.6.2.4.2.2.2.1.14 LPRM - IEEE 279 (1971), Paragraph 4.14 - Access to Means for Bypassing Manual bypassing of LPRM channels is accomplished by manual entry of settings in the NUMAC electronics, which are under the administrative control of the operator.
7.6.2.4.2.2.2.1.15 LPRM - IEEE 279 (1971), Paragraph 4.15 - Multiple Setpoints The LPRM has no varying or multiple setpoints.
CHAPTER 07 7.6-82 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.4.2.2.2.1.16 LPRM - IEEE 279 (1971), Paragraph 4.16 - Completion of Protective Action Once It Is Initiated See Section 7.2.2.1.2.3.1.16.
7.6.2.4.2.2.2.1.17 LPRM - IEEE 279 (1971), Paragraph 4.17 - Manual Initiation See Section 7.2.2.1.2.3.1.17.
7.6.2.4.2.2.2.1.18 LPRM - IEEE 279 (1971), Paragraph 4.18 - Access to Setpoint Adjustments, Calibration, and Test Points Access to LPRM setpoint adjustments, calibration controls, and test setpoints is under the administrative control of plant supervisors.
7.6.2.4.2.2.2.1.19 LPRM - IEEE 279 (1971), Paragraph 4.19 - Identification of Protective Actions See Section 7.2.2.1.2.3.1.19.
7.6.2.4.2.2.2.1.20 LPRM - IEEE 279 (1971), Paragraph 4.20 - Information Readout The LPRM provides signals to the APRM for display of neutron flux level. Signals are also provided to the process computer, which, utilizing additional inputs, computes local power densities for each fuel assembly, core power distribution, core thermal units, and fuel exposure. LPRM upscale, downscale, and inoperative signals are annunciated in the control room.
7.6.2.4.2.2.2.1.21 LPRM - IEEE 279 (1971), Paragraph 4.21 - System Repair Replacement of LPRM detectors must be accomplished during plant shutdown. Repair of the LPRM circuitry can be accomplished during plant operation by bypassing the affected channel.
The design of the system facilitates rapid diagnosis and repair.
7.6.2.4.2.2.2.1.22 LPRM - IEEE 279 (1971), Paragraph 4.22 - Identification of Protective Systems Each system cabinet is marked and the particular division is indicated on a marker plate. Cabling outside the cabinet is distinctively marked as are cable trays and racks.
7.6.2.4.2.2.2.2 LPRM - IEEE 317 (1972) - Electric Penetration Assemblies for Containment Structures for Nuclear Power Generating Stations IEEE 317 (1972) is endorsed by Regulatory Guide 1.63 (1978). For compliance to Regulatory Guide 1.63, see Section 8.1.6.1.
7.6.2.4.2.2.2.3 LPRM - IEEE 323 (1971) - IEEE Trial Use Standard: General Guide for Qualifying Class 1 Electric Equipment for Nuclear Power Generating Stations The LPRM equipment is qualified per the requirements of the standard.
7.6.2.4.2.2.2.4 LPRM - IEEE 336 (1971) - Installation, Inspection, and Testing Requirements for Instrumentation and Electric Equipment During the Construction of Nuclear Power Generating Stations CHAPTER 07 7.6-83 REV. 20, SEPTEMBER 2020
LGS UFSAR IEEE 336 (1971) is endorsed by Regulatory Guide 1.30 (1972). For conformance to Regulatory Guide 1.30, see Section 8.1.6.1.5.
7.6.2.4.2.2.2.5 LPRM - IEEE 338 (1971) - Criteria for the Periodic Testing of Nuclear Power Generating Station Protection Systems LPRM equipment is designed so that individual channels can be taken out-of-service for test or calibration without affecting the remaining channels.
7.6.2.4.2.2.2.6 LPRM - IEEE 344 (1971) - Guide for Seismic Qualification of Class 1 Electric Equipment for Nuclear Power Generating Stations The LPRM equipment is designed and qualified to function during and after an SSE. Refer to Section 3.10.
7.6.2.4.2.2.2.7 LPRM - IEEE 379 (1972) - Guide for the Application of the Single Failure Criterion to Nuclear Power Generating Station Protection Systems The LPRM equipment is designed so that a single failure does not prevent needed safety functions.
7.6.2.4.2.2.2.8 LPRM - IEEE 384 (1974) - Criteria for Separation of Class 1E Equipment and Circuits Refer to Section 7.1.2.7.11.
7.6.2.4.2.2.2.9 LPRM Conformance to 10CFR50, Appendix A, General Design Criteria The degree of conformance is discussed in Section 7.6.2.4.3.2.2.
7.6.2.4.3 Average Power Range Monitor System 7.6.2.4.3.1 APRM General Functional Requirements Conformance Each APRM derives its signal from LPRM information. The assignment, power separation, cabinet separation, and LPRM signal isolation are in accord with the safety design bases of the RPS.
There are four APRM channels with the Reactor Protection System trip outputs from each routed to each of four APRM 2-out-of-4 voter channels. Two voter channels are associated with each Reactor Protection System trip system. This configuration allows one APRM channel to be bypassed plus one failure while still meeting the Reactor Protection System safety design basis.
Above a plant power level defined by Technical Specifications, the APRM power (and simulated thermal power) is adjusted periodically based on heat balance. This adjustment is made regularly at a rate sufficient to compensate for LPRM burnup and the related change in APRM values.
However, coolant flow changes, control rod movements, and failed or bypassed LPRM inputs can also affect the relationship between APRM measured flux and reactor power. These predictable APRM variations are included in the analysis performed to determine minimum number of LPRM inputs required to be operable in order for the APRM channel to be operable. The analysis is performed, considering worst case combinations of failed LPRM inputs, at rate conditions by CHAPTER 07 7.6-84 REV. 20, SEPTEMBER 2020
LGS UFSAR assuming both continuous withdrawal of the maximum worth control rod and reduction of recirculation flow to 40% of rated flow. The minimum number of LPRM inputs for an APRM is determined such that the average of the remaining operable LPRM inputs still allows the APRM to track power excursions within the acceptance criteria assumed in plant safety analysis. If the number of operable LPRMs is less than required minimum, the APRM channel is declared inoperable.
There is also a minimum cells requirement applied to the OPRM upscale function. The minimum number of OPRM cells per APRM channel is established to ensure that thermal-hydraulic instabilities can be detected within the limits of the OPRM licensing methodology. If the number of cells is less than the required minimum, an OPRM/APRM trouble alarm is provided and the channel is declared inoperable.
The flow-referenced APRM scram setpoint is adequate to prevent fuel damage during an abnormal operational transient, as demonstrated in Chapter 15.
The APRM design conforms with the provision of the safety design bases in that under worst case LPRM bypass conditions the APRM is capable of generating a trip signal to prevent fuel damage.
The APRM logic circuitry which interfaces with the RPS is discussed in Sections 7.2.1.1.4.2, 7.2.2.1.2.3.1.2, and 7.2.2.1.2.3.1.6.
The APRM design conforms to the provisions of the power generation design basis as follows:
- a. Continuous indication of average reactor power is provided for the range of neutron flux from 0% to 125%.
- b. An APRM upscale condition, or inoperative condition, or an APRM downscale condition, or a recirculation flow upscale condition, or less than the minimum number of LPRMs initiates a rod block. The rod block inhibits erroneous control rod motion to prevent circumstances that require a RPS protective action, and inhibits rod withdrawal when an APRM channel is disabled or unable to monitor core response.
- c. Neutron flux level data are utilized by the process computer to compute power distribution and fuel exposure.
- d. One primary APRM channel and one alternate APRM channel provide the reference reactor power signal for each RBM.
7.6.2.4.3.2 APRM Specific Regulatory Requirements Conformance 7.6.2.4.3.2.1 APRM Conformance to Regulatory Guides 7.6.2.4.3.2.1.1 APRM - Regulatory Guide 1.22 (1972) - Periodic Testing of Protection System Actuation Functions (Safety Guide 22)
The portion of the APRM system that provides output to the RPS, the APRM 2-out-of-4 voters, is designed to allow complete periodic testing of protection system actuation functions. This provision is accomplished by initiating an output trip of one APRM 2-out-of-4 voter channel at any given time, which results in tripping one of the two RPS trip systems. Details are provided in Section 7.2.2.1.2.3.1 under IEEE 279 (1971).
CHAPTER 07 7.6-85 REV. 20, SEPTEMBER 2020
LGS UFSAR Indication of APRM bypass to operators is provided by indicator lamps and ODA displays.
7.6.2.4.3.2.1.2 APRM - Regulatory Guide 1.29 (1978) - Seismic Design Classification For conformance discussion refer to Section 3.1.2.
7.6.2.4.3.2.1.3 APRM - Regulatory Guide 1.30 (1972) - Quality Assurance Requirements for the Installation, Inspection, and Testing of Instrumentation and Electric Equipment (Safety Guide 30)
For compliance to Regulatory Guide 1.30, see Section 8.1.6.1.
7.6.2.4.3.2.1.4 APRM - Regulatory Guide 1.47 (1973) - Bypassed and Inoperable Status Indication for Nuclear Power Plant Safety Systems The APRM complies with these guides. Discussion is provided in Section 7.2.2.1.2.1.7 under Regulatory Guide 1.47.
7.6.2.4.3.2.1.5 APRM - Regulatory Guide 1.53 (1973) - Application of the Single Failure Criterion to Nuclear Power Plant Protection Systems For conformance discussion refer to Section 7.1.2.5.12.
7.6.2.4.3.2.1.6 APRM - Regulatory Guide 1.68 (1978) - Preoperational and Initial Startup Test Programs for Water-Cooled Power Reactors For conformance discussion refer to Section 7.1.2.5.16.
7.6.2.4.3.2.1.7 APRM - Regulatory Guide 1.75 (1978) - Physical Independence of Electric Systems For conformance discussion refer to Section 7.1.2.5.19.
7.6.2.4.3.2.1.8 APRM - Regulatory Guide 1.89 (1974) - Qualification of Class 1E Equipment for Nuclear Power Plants Refer to Section 7.1.2.5.21.
7.6.2.4.3.2.1.9 APRM Regulatory Guide 1.97 (1980) - Instrumentation for Light-Water-Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident Section 7.5.2.5.1.1.2 contains a discussion of the degree of conformance.
7.6.2.4.3.2.1.10 APRM - Regulatory Guide 1.100 (1977) - Seismic Qualification of Electric Equipment for Nuclear Power Plants See Section 3.10 for conformance.
7.6.2.4.3.2.1.11 APRM - Regulatory Guide 1.105 (1976) - Instrument Setpoints For conformance discussion refer to Section 7.1.2.5.25.
CHAPTER 07 7.6-86 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.4.3.2.1.12 APRM - Regulatory Guide 1.118 (1978) - Periodic Testing of Electric Power and Protection Systems For conformance discussion refer to Section 7.1.2.5.26.
7.6.2.4.3.2.2 APRM Conformance to 10CFR50, Appendix A, General Design Criteria 7.6.2.4.3.2.2.1 APRM - GDC 1 - Quality Standards and Records For conformance discussion see Section 7.1.2.6.1.
7.6.2.4.3.2.2.2 APRM - GDC 2 - Design Bases for Protection Against Natural Phenomena For conformance discussion see Section 7.1.2.6.2.
7.6.2.4.3.2.2.3 APRM - GDC 3 - Fire Protection For conformance discussion see Section 7.1.2.6.3.
7.6.2.4.3.2.2.4 APRM - GDC 4 - Environmental and Dynamic Effects Design Bases For conformance discussion see Section 7.1.2.6.4.
7.6.2.4.3.2.2.5 APRM - GDC 10 - Reactor Design For conformance discussion refer to Section 7.1.2.6.6 and 7.2.2.1.2.2.5.
The APRM detection system and associated electronics are designed to monitor the incore flux over all expected ranges required for safety of the plant.
Automatic initiation of protection system action, reliability, testability, independence, and separation are factored into the APRM design as required for protection systems.
7.6.2.4.3.2.2.6 APRM - GDC 12 - Suppression of Reactor Power Oscillations Refer to Section 7.1.2.6.7 and 7.2.2.1.2.2.6.
7.6.2.4.3.2.2.7 APRM - GDC 13 - Instrumentation and Control The APRM detection system and associated electronics are designed to monitor the incore flux over all expected ranges required for safety of the plant.
Automatic initiation of protection system action, reliability, testability, independence, and separation are factored into the APRM design as required for protection systems.
7.6.2.4.3.2.2.8 APRM - GDC 19 - Control Room The APRM detection system and associated electronics are designed to monitor the incore flux over all expected ranges required for safety of the plant.
CHAPTER 07 7.6-87 REV. 20, SEPTEMBER 2020
LGS UFSAR Automatic initiation of protection system action, reliability, testability, independence, and separation are factored into the APRM design as required for protection systems.
7.6.2.4.3.2.2.9 APRM - GDC 20 - Protection System Functions The APRM detection system and associated electronics are designed to monitor the incore flux over all expected ranges required for safety of the plant.
Automatic initiation of protection system action, reliability, testability, independence, and separation are factored into the APRM design as required for protection systems.
7.6.2.4.3.2.2.10 APRM - GDC 21 - Protection System Reliability and Testability Refer to Section 7.1.2.6.12.
The APRM detection system and associated electronics are designed to monitor the incore flux over all expected ranges required for safety of the plant.
Automatic initiation of protection system action, reliability, testability, independence, and separation are factored into the APRM design as required for protection systems.
7.6.2.4.3.2.2.11 APRM - GDC 22 - Protection System Independence The APRM detection system and associated electronics are designed to monitor the incore flux over all expected ranges required for safety of the plant.
Automatic initiation of protection system action, reliability, testability, independence, and separation are factored into the APRM design as required for protection systems.
7.6.2.4.3.2.2.12 APRM - GDC 23 - Protection System Failure Modes The APRM detection system and associated electronics are designed to monitor the incore flux over all expected ranges required for safety of the plant.
Automatic initiation of protection system action, reliability, testability, independence, and separation are factored into the APRM design as required for protection systems.
7.6.2.4.3.2.2.13 APRM - GDC 24 - Separation of Protection and Control Systems The APRM detection system and associated electronics are designed to monitor the incore flux over all expected ranges required for safety of the plant.
Automatic initiation of protection system action, reliability, testability, independence, and separation are factored into the APRM design as required for protection systems.
7.6.2.4.3.2.2.14 APRM - GDC 25 - Protection System Requirements for Reactivity Control Malfunctions For conformance discussion refer to Section 7.1.2.6.16.
CHAPTER 07 7.6-88 REV. 20, SEPTEMBER 2020
LGS UFSAR The APRM detection system and associated electronics are designed to monitor the incore flux over all expected ranges required for safety of the plant.
Automatic initiation of protection system action, reliability, testability, independence, and separation are factored into the APRM design as required for protection systems.
7.6.2.4.3.2.2.15 APRM - GDC 29 - Protection Against Anticipated Operational Occurrences Refer to Section 7.1.2.6.
The APRM detection system and associated electronics are designed to monitor the incore flux over all expected ranges required for safety of the plant.
Automatic initiation of protection system action, reliability, testability, independence, and separation are factored into the APRM design as required for protection systems.
7.6.2.4.3.2.3 APRM Conformance to Industry Codes and Standards 7.6.2.4.3.2.3.1 APRM - IEEE 279 (1971) - Criteria for Protection Systems for Nuclear Power Generating Stations The APRM design is shown to comply with the design requirements of IEEE 279 in Section 7.2.2.1.2.3.1 and Subsection 4.4.1.1 of NEDC-32410P-A.
7.6.2.4.3.2.3.2 APRM - IEEE 317 (1972) - Electric Penetration Assemblies in Containment Structures for Nuclear Power Generating Stations IEEE 317 (1972) is endorsed by Regulatory Guide 1.63 (1978). For compliance to Regulatory Guide 1.63, see Section 8.1.6.1.
7.6.2.4.3.2.3.3 APRM - IEEE 323 (1971) - IEEE Trial Use Standard: General Guide for Qualifying Class 1 Electric Equipment for Nuclear Power Generating Stations APRM compliance is discussed in Section 7.1.2.7.4.
7.6.2.4.3.2.3.4 APRM - IEEE 336 (1971) - Installation, Inspection, and Testing Requirements for Instrumentation and Electric Equipment During the Construction of Nuclear Power Generating Stations IEEE 336 (1971) is endorsed by Regulatory Guide 1.30. For compliance to Regulatory Guide 1.30, see Section 8.1.6.1.
7.6.2.4.3.2.3.5 APRM - IEEE 338 (1971) - Criteria for the Periodic Testing of Nuclear Power Generating Station Protection Systems APRM compliance with IEEE 338 is shown in Section 7.2.2.1.2.3.1 under IEEE 279, Paragraphs 4.9 and 4.10.
7.6.2.4.3.2.3.6 APRM - IEEE 344 (1971) - Guide for Seismic Qualification of Class 1 Electric Equipment for Nuclear Power Generating Stations CHAPTER 07 7.6-89 REV. 20, SEPTEMBER 2020
LGS UFSAR APRM compliance is as shown in Section 7.1.2.7.7.
7.6.2.4.3.2.3.7 APRM - IEEE 379 (1972) - Guide for the Application of the Single Failure Criterion to Nuclear Power Generating Station Protection Systems APRM signal separation, cabinet separation, use of isolation circuitry, and number of channels per trip system are methods used to meet the single failure criterion. Convenient test and calibration circuits permit regular checks for undetected failures.
7.6.2.4.3.2.3.8 APRM - IEEE 384 (1977) - Criteria for Separation of Class 1E Equipment and Circuits For conformance discussion refer to Section 7.1.2.7.11.
7.6.2.5 Safety/Relief Valve Position Indication System - Instrumentation and Controls 7.6.2.5.1 SRVPI General Functional Requirements Conformance The system provides alarm and indication of SRV position in the control room and provides a means to test the monitoring channels during system operation.
7.6.2.5.2 SRVPI Specific Regulatory Requirements Conformance 7.6.2.5.2.1 SRVPI Conformance to Regulatory Guides 7.6.2.5.2.1.1 SRVPI - Regulatory Guide 1.29 (1978) - Seismic Design Classification Conformance is discussed in Section 7.6.2.5.2.1.5.
7.6.2.5.2.1.2 SRVPI - Regulatory Guide 1.30 (1972) - Quality Assurance Requirements for the Installation, Inspection, and Testing of Instrumentation and Electric Equipment (Safety Guide 30)
Conformance is discussed in Section 8.1.6.1.
7.6.2.5.2.1.3 SRVPI - Regulatory Guide 1.89 (1974) - Qualification of Class 1E Equipment for Nuclear Power Plants The SRVPI equipment is qualified for the environment expected during SRV discharge to the suppression pool and for 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after a LOCA.
7.6.2.5.2.1.4 SRVPI - Regulatory Guide 1.97 (1980) - Instrumentation for Light-Water-Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident Conformance is discussed in Section 7.5.2.5.1.1.2.
7.6.2.5.2.1.5 SRVPI - Regulatory Guide 1.100 (1977) - Seismic Qualification of Electric Equipment for Nuclear Power Plants CHAPTER 07 7.6-90 REV. 20, SEPTEMBER 2020
LGS UFSAR The SRVPI instrument is qualified to seismic Category I criteria in accordance with IEEE 344 (1975) and is mounted on seismic Category I equipment. The signal and power raceways for the system are routed through seismic Category I structures and are designated seismic Category IIA.
Refer to Section 3.10.
7.6.2.5.2.2 SRVPI Conformance to 10CFR50, Appendix A, General Design Criteria 7.6.2.5.2.2.1 SRVPI - GDC 1 - Quality Standards and Records The SRVPI is a nonsafety-related system designed and manufactured in accordance with approved documented procedures. A documented quality assurances program which complies with the pertinent quality assurance requirements of 10CFR50, Appendix B, is followed for installation of the instrumentation.
7.6.2.5.2.2.2 SRVPI - GDC 2 - Design Bases for Protection Against Natural Phenomena Conformance is discussed in Section 7.6.2.5.2.1.5.
7.6.2.5.2.2.3 SRVPI - GDC 3 - Fire Protection Fire resistant components are used throughout the SRVPI system.
7.6.2.5.2.2.4 SRVPI - GDC 4 - Environmental and Dynamic Effects Design Bases Conformance is discussed in Section 7.1.2.6.4.
7.6.2.5.2.2.5 SRVPI - GDC 13 - Instrumentation and Control The SRVPI system components are designed to provide indication during normal and accident conditions.
7.6.2.5.2.3 SRVPI Conformance to Industry Codes and Standards 7.6.2.5.2.3.1 SRVPI - IEEE 323 (1971) - IEEE Trial Use Standard: General Guide for Qualifying Class 1 Electric Equipment for Nuclear Power Generating Stations Conformance is discussed in Section 7.6.2.5.2.1.3.
7.6.2.5.2.3.2 SRVPI - IEEE 338 (1977) - Criteria for the Periodic Testing of Nuclear Power Generating Station Protection Systems Provisions are made for the periodic testing of this system in accordance with IEEE Class 1E requirements.
7.6.2.5.2.3.3 SRVPI - IEEE 344 (1975) - Guide for Seismic Qualification of Class 1 Electric Equipment for Nuclear Power Generating Stations Conformance is discussed in Section 7.6.2.5.2.1.5.
CHAPTER 07 7.6-91 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.6 Containment Instrument Gas System - ADS Control - Instrumentation and Controls 7.6.2.6.1 CIGS-ADS General Functional Requirements Conformance The following analysis demonstrates how the CIGS-ADS meets the safety design bases identified in Section 7.1.2.1.29.
The CIGS-ADS provides a backup supply of instrument gas to the ADS valves in the event that the non-safety-related CIGS equipment is not available. This function is safety-related. The ADS valves must be available for long-term operation. The ADS valves require a safety-related, seismic gas supply. The remainder of CIGS is non-safety-related, non-seismic.
7.6.2.6.2 CIGS-ADS Specific Regulatory Requirements Conformance 7.6.2.6.2.1 CIGS-ADS Conformance to Regulatory Guides 7.6.2.6.2.1.1 CIGS-ADS - Regulatory Guide 1.29 (1978) - Seismic Design Classification All controls for the CIGS-ADS are seismic Category 1.
7.6.2.6.2.1.2 CIGS-ADS - Regulatory Guide 1.30 (1972) - Quality Assurance Requirements for the Installation, Inspection, and Testing of Instrumentation and Electric Equipment (Safety Guide 30)
See Section 8.1.6.1.
7.6.2.6.2.1.3 CIGS-ADS - Regulatory Guide 1.47 (1973) - Bypassed and Inoperable Status Indication for Nuclear Power Plant Safety Systems A low pressure alarm in the control room alerts the operator to low pressure in either set of nitrogen bottles.
7.6.2.6.2.1.4 CIGS-ADS - Regulatory Guide 1.53 (1973) - Application of the Single Failure Criterion to Nuclear Power Plant Protection Systems Compliance is discussed in Section 7.1.2.5.12.
7.6.2.6.2.1.5 CIGS-ADS - Regulatory Guide 1.89 (1974) - Qualification of Class 1E Equipment for Nuclear Power Plants Compliance is discussed in Section 8.1.6.1.
7.6.2.6.2.1.6 CIGS-ADS - Regulatory Guide 1.97 (1980) - Instrumentation for Light-Water-Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident Section 7.5.2.5.1.1.2 contains a discussion of the degree of conformance.
7.6.2.6.2.1.7 CIGS-ADS - Regulatory Guide 1.100 (1977) - Seismic Qualification of Electric Equipment for Nuclear Power Plants CHAPTER 07 7.6-92 REV. 20, SEPTEMBER 2020
7.6.2.6.2.2 CIGS-ADS Conformance to 10CFR50, Appendix A, General Design Criteria 7.6.2.6.2.2.1 CIGS-ADS - GDC 1 - Quality Standards and Records This system is built in accordance with an established quality assurance program.
7.6.2.6.2.2.2 CIGS-ADS - GDC 2 - Design Bases for Protection Against Natural Phenomena Compliance is discussed in Section 7.1.2.6.2.
7.6.2.6.2.2.3 CIGS-ADS - GDC 3 - Fire Protection Compliance is discussed in Section 7.1.2.6.3.
7.6.2.6.2.2.4 CIGS-ADS - GDC 4 - Environmental and Dynamic Effects Design Bases Compliance is discussed in Section 7.1.2.6.4.
7.6.2.6.2.2.5 CIGS-ADS - GDC 20 - Protection System Functions The transfer from the instrument gas compressors (CIGS) to the CIGS-ADS as the gas source for the ADS valves is initiated automatically by a low pressure sensor in the respective header.
7.6.2.6.2.2.6 CIGS-ADS - GDC 21 - Protection System Reliability and Testability The system is redundant on a system level; i.e., each gas source supplies sufficient ADS valves to accomplish the safety function. Testing during normal operation is possible without disrupting operation of the CIGS.
7.6.2.6.2.2.7 CIGS-ADS - GDC 22 - Protection System Independence Diversity is not required for this system.
7.6.2.6.2.2.8 CIGS-ADS - GDC 23 - Protection System Failure Modes On loss of instrument air or electric power, the system fails into an alignment that supplies nitrogen to the ADS valves.
7.6.2.6.2.2.9 CIGS-ADS - GDC 24 - Separation of Protection and Control Systems The CIGS-ADS has no plant control functions.
7.6.2.6.2.2.10 CIGS-ADS - GDC 29 - Protection Against Anticipated Operational Occurrences The CIGS-ADS is designed to withstand anticipated operational occurrences by seismic and environmental qualification as described in Sections 3.10 and 3.11.
CHAPTER 07 7.6-93 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.6.2.3 CIGS-ADS Conformance to Industry Codes and Standards 7.6.2.6.2.3.1 CIGS-ADS - IEEE 279 (1971) - Criteria for Protection Systems for Nuclear Power Generating Stations 7.6.2.6.2.3.1.1 CIGS-ADS - IEEE 279 (1971), Paragraph 4.1 - General Functional Requirement On low supply pressure from the CIGS receivers, automatic transfer is effected to the CIGS-ADS gas bottles. The system is effective over the range of environmental conditions cited below:
- a. Power supply voltages - Equipment is designed to operate within the range of voltages specified in Section 8.3.1.
- b. Power supply frequency - Equipment is designed to operate within the range of power supply frequencies specified in Section 8.3.1.
- c. Temperature - The system is operable at all temperatures that can result from a design basis LOCA.
- d. Humidity - The system is operable at all humidities, including steam, that can result from a LOCA.
- g. Vibration - The system will tolerate the conditions stated in Section 3.10.
- h. Malfunction - The system will tolerate a single failure proof at the system level.
- i. Accidents - The system will continue to operate during and following any DBA.
- j. Fire - The system will tolerate raceway fires in a single division.
- k. Explosions - Explosions are not defined in design bases.
- l. Missiles - The system will tolerate any single missile destroying raceway, cabinet, or equipment in one division.
- m. Lightning - Lightning damage to the electrical division powering the outboard isolation will render the system inoperative if the valve is closed on loss of power.
- n. Floods - The plant is not subject to flooding, as discussed in Section 3.4.
- o. Earthquake - The system will tolerate conditions stated in Section 3.10.
- p. Wind and Tornado - All control equipment is located in a seismic Category 1 structure. See Section 3.3 for wind loadings.
CHAPTER 07 7.6-94 REV. 20, SEPTEMBER 2020
- q. System response times - The system response times are within the need to initiate alternate gas supply to the ADS valves.
- r. System accuracies - Accuracies are within those needed for correct action.
- s. Abnormal ranges of Sensed variables - Sensors are designed for the expected ranges and rates of change of variables.
7.6.2.6.2.3.1.2 CIGS-ADS - IEEE 279 (1971), Paragraph 4.2 - Single Failure Criterion A single active or passive electrical or control failure will not prevent the CIGS-ADS from performing its design safety function.
7.6.2.6.2.3.1.3 CIGS-ADS - IEEE 279 (1971), Paragraph 4.3 - Quality of Components and Modules All safety-related components are selected on the basis of suitability for the application. A quality assurance program is implemented.
7.6.2.6.2.3.1.4 CIGS-ADS - IEEE 279 (1971), Paragraph 4.4 - Equipment Qualification The CIGS-ADS safety-related controls and instrumentation are qualified according to the requirements outlined in IEEE 323 (1971) as highlighted in Section 7.1.2.7.4. The qualifications criteria are identified in Sections 3.10 and 3.11. The parameters identified cover normal, abnormal, and accident environments.
7.6.2.6.2.3.1.5 CIGS-ADS - IEEE 279 (1971), Paragraph 4.5 - Channel Integrity The CIGS-ADS meets the channel integrity objective by using the design features described in the other paragraphs of this section.
7.6.2.6.2.3.1.6 CIGS-ADS - IEEE 279 (1971), Paragraph 4.6 - Channel Independence The CIGS-ADS is a two train system. The control, instrumentation, and power circuits to each train of the system are physically and electrically separate from electrical channels in another division.
7.6.2.6.2.3.1.7 CIGS-ADS - IEEE 279 (1971), Paragraph 4.7 - Control and Protection System Interaction The CIGS-ADS has no interaction with the plant control systems. Control room annunciator circuits taking input from this system are electrically isolated from the system and cannot impair its operability.
7.6.2.6.2.3.1.8 CIGS-ADS - IEEE 279 (1971), Paragraph 4.8 - Derivation of System Inputs The CIGS-ADS is initiated by low pressure in the normal ADS gas supply header, from a pressure switch in each header.
7.6.2.6.2.3.1.9 CIGS-ADS - IEEE 279 (1971), Paragraph 4.9 - Capability for Sensor Checks CHAPTER 07 7.6-95 REV. 20, SEPTEMBER 2020
LGS UFSAR The pressure sensors for the CIGS-ADS can be checked by introducing a substitute input and observing system initiation.
7.6.2.6.2.3.1.10 CIGS-ADS - IEEE 279 (1971), Paragraph 4.10 - Capability for Testing and Calibration The pressure sensors used for system initiation can be tested and calibrated during power operation.
7.6.2.6.2.3.1.11 CIGS-ADS - IEEE 279 (1971), Paragraph 4.11 - Channel Bypass or Removal from Operation The two CIGS-ADS trains are separate electrically and physically. Removal of a component for maintenance prevents the operation of one train; however, operation of the other train is unaffected. The CIGS-ADS cannot be bypassed because all control is manual.
7.6.2.6.2.3.1.12 CIGS-ADS - IEEE 179 (1971), Paragraph 4.12 - Operating Bypasses There are no operating bypasses.
7.6.2.6.2.3.1.13 CIGS-ADS - IEEE 279 (1971), Paragraph 4.13 - Indication of Bypasses A system out-of-service annunciator will be manually brought up by administrative procedures whenever system tests are performed.
7.6.2.6.2.3.1.14 CIGS-ADS - IEEE 279 (1971), Paragraph 4.14 - Access to Means for Bypassing Access to components of the CIGS-ADS is controlled by administrative procedures.
7.6.2.6.2.3.1.15 CIGS-ADS - IEEE 279 (1971), Paragraph 4.15 - Multiple Setpoints This paragraph is not applicable.
7.6.2.6.2.3.1.16 CIGS-ADS - IEEE 279 (1971), Paragraph 4.16 - Completion of Protective Action Once It Is Initiated The CIGS-ADS, once initiated, will perform its protective action to completion. The operator must reset the system to normal status.
7.6.2.6.2.3.1.17 CIGS-ADS - IEEE 279 (1971), Paragraph 4.17 - Manual Initiation The CIGS-ADS can be manually initiated.
7.6.2.6.2.3.1.18 CIGS-ADS - IEEE 279 (1971), Paragraph 4.18 - Access to Setpoint Adjustments, Calibration and Test Points Access is controlled by administrative procedures.
7.6.2.6.2.3.1.19 CIGS-ADS - IEEE 279 (1971), Paragraph 4.19 - Identification of Protective Actions CHAPTER 07 7.6-96 REV. 20, SEPTEMBER 2020
LGS UFSAR The positions of valves in the CIGS-ADS is indicated in the control room. Low gas supply header pressure is alarmed.
7.6.2.6.2.3.1.20 CIGS-ADS - IEEE 279 (1971), Paragraph 4.20 - Information Readout Valve position and low gas supply header pressure provides information to assure the operator of correct operation.
7.6.2.6.2.3.1.21 CIGS-ADS - IEEE 279 (1971), Paragraph 4.21 - System Repair Malfunctioning components will be identified during periodic testing. The control logic is not complex, therefore location of a failed component is straightforward. The components are mounted to facilitate removal and replacement.
7.6.2.6.2.3.1.22 CIGS-ADS - IEEE 279 (1971), Paragraph 4.22 - Identification of Protection Systems Controls for the CIGS-ADS are located in control panels distinctively identified with nameplates that identifies them as having safety-related equipment. Cables and cable trays are color coded and tagged to identify them as being a separate channel.
7.6.2.6.2.3.2 CIGS-ADS - IEEE 323 (1971) - IEEE Trial Use Standard: General Guide for Qualifying Class 1 Electric Equipment for Nuclear Power Generating Stations See Section 3.11.
7.6.2.6.2.3.3 CIGS-ADS - IEEE 336 (1971) - Installation, Inspection, and Testing Requirements for Instrumentation and Electric Equipment During the Construction of Nuclear Power Generating Stations See Section 8.1.6.1 in the discussion of conformance to Regulatory Guide 1.30, which endorses/modifies this IEEE standard.
7.6.2.6.2.3.4 CIGS-ADS - IEEE 338 (1975) - Criteria for the Periodic Testing of Nuclear Power Generating Station Protection System The operability of the CIGS-ADS can be verified and failures are detectable through testing during normal plant operation. The input sensor and setpoint are checked by the application of simulated signals.
7.6.2.6.2.3.5 CIGS-ADS - IEEE 344 (1971) - Guide for Seismic Qualification of Class 1 Electric Equipment for Nuclear Power Generating Stations See Section 3.10.
7.6.2.6.2.3.6 CIGS-ADS - IEEE 379 (1972) - Guide for the Application of the Single Failure Criterion to Nuclear Power Generating Station Protection Systems This system is not required to meet the single failure criterion.
CHAPTER 07 7.6-97 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.6.2.3.7 CIGS-ADS - IEEE 384 (1974) - Criteria for Separation of Class 1E Equipment and Circuits This standard is not applicable to CIGS-ADS.
7.6.2.6.2.4 CIGS-ADS Additional Design Considerations Analysis As identified in Regulatory Guide 1.70 (1978), paragraph 7.6.2, the following accidents are addressed:
- a. Cold water slug injections - CIGS-ADS has no function in preventing or mitigating the consequences of this accident.
- b. Refueling accidents - CIGS-ADS has no function in preventing or mitigating the consequences of these accidents.
- c. Over-pressurization of low pressure systems - CIGS-ADS has no function in preventing or mitigating the consequences of this accident.
- d. Fire - CIGS-ADS has no function in preventing or mitigating the consequences of fires.
7.6.2.7 Safeguard Piping Fill System - Instrumentation and Controls 7.6.2.7.1 SPFS General Functional Requirements Conformance The following analysis shows how the SPFS meets the safety design bases identified in Section 7.1.2.1.41.1.
The SPFS provides water to the discharge lines of the ECCS pumps to maintain these lines in a full condition. The SPFS is normally on standby (not operating) and provides a safety-related backup to the condensate transfer system, which keeps the ECCS lines full during normal plant operation, through different piping connections. If the water level in the ECCS lines starts to drop, level instrumentation on the high point vents will annunciate an alarm in the control room, and the operator can start the SPFS pumps. The SPFS also provides water to the feedwater lines to maintain a water seal against discharge of containment atmosphere into the reactor enclosure in the event of any line break other than a feedwater line break inside containment. The SPFS is a supporting system to the ECCS. Once the fill system pumps are started, they operate continuously until they are turned off by the operator.
The SPFS is designed with redundancy as described in Section 7.6.1.7.5 so that no single active or passive electrical or control failure will prevent the SPFS from meeting its safety-related objective.
7.6.2.7.2 SPFS Specific Regulatory Requirements Conformance 7.6.2.7.2.1 SPFS Conformance to Regulatory Guides 7.6.2.7.2.1.1 SPFS - Regulatory Guide 1.22 (1972) - Periodic Testing of Protection System Actuation Functions (Safety Guide 22)
CHAPTER 07 7.6-98 REV. 20, SEPTEMBER 2020
LGS UFSAR The SPFS pumps can be functionally tested during normal plant operation. The fill-water supply to feedwater line shutoff valves can be opened from the control room to verify operability.
7.6.2.7.2.1.2 SPFS - Regulatory Guide 1.29 (1978) - Seismic Design Classification The SPFS is qualified to seismic Category I criteria, in accordance with IEEE 344. Refer to Section 3.10.
7.6.2.7.2.1.3 SPFS - Regulatory Guide 1.30 (1972) - Quality Assurance Requirements for the Installation, Inspection, and Testing of Instrumentation and Electric Equipment (Safety Guide 30)
See Section 8.1.6.1.
7.6.2.7.2.1.4 SPFS - Regulatory Guide 1.53 (1973) - Application of the Single Failure Criterion to Nuclear Power Plant Protection Systems A single failure within the SPFS will not prevent the SPFS from performing its safety function.
7.6.2.7.2.1.5 SPFS - Regulatory Guide 1.89 (1974) - Qualification of Class 1E Equipment for Nuclear Power Plants The SPFS is qualified to meet Class 1E requirements.
7.6.2.7.2.1.6 SPFS - Regulatory Guide 1.100 (1977) - Seismic Qualification of Electric Equipment for Nuclear Power Plants Conformance with this regulatory guide is discussed in Section 3.10.
7.6.2.7.2.2 SPFS Conformance to 10CFR50, Appendix A, General Design Criteria 7.6.2.7.2.2.1 SPFS - GDC 1 - Quality Standards and Records See Section 7.1.2.6.1.
7.6.2.7.2.2.2 SPFS - GDC 2 - Design Bases for Protection Against Natural Phenomena See Section 3.1.
7.6.2.7.2.2.3 SPFS - GDC 3 - Fire Protection See Section 3.1.
7.6.2.7.2.2.4 SPFS - GDC 4 - Environmental and Dynamic Effects Design Bases See Section 3.1.
7.6.2.7.2.2.5 SPFS - GDC 5 - Sharing of Structures, Systems, and Components No portions of the SPFS are shared between units.
CHAPTER 07 7.6-99 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.7.2.2.6 SPFS - GDC 13 - Instrumentation and Control Indicating lights are provided in the main control room to indicate operation of the SPFS pumps and to indicate the positions of the shutoff valves to the feedwater lines. Low pressure in the pump discharge lines is annunciated. The fill pumps are manually started and stopped from the control room. Low level in the ECCS pump discharge lines is annunciated in the control room by level instrumentation that is located on the vents at the high points of the lines. Feedwater line pressure is indicated in the control room so that the operator can determine if there has been a feedwater line break inside containment. If so, the operator can isolate the fill system from the broken line and still provide fill system water to the other (intact) feedwater line.
7.6.2.7.2.2.7 SPFS - GDC 20 - Protection System Functions The SPFS is manually initiated.
7.6.2.7.2.2.8 SPFS - GDC 21 - Protection System Reliability and Testability The components used in the SPFS are selected to ensure high functional reliability. The system can be tested and failures determined during normal plant operation.
7.6.2.7.2.2.9 SPFS - GDC 22 - Protection System Independence The two SPFS trains are independent and physically separated with separate instruments to provide assurance that the protective function is not lost.
7.6.2.7.2.2.10 SPFS - GDC 23 - Protection System Failure Modes The system is designed to tolerate a single active or passive electrical or control failure.
7.6.2.7.2.2.11 SPFS - GDC 29 - Protection Against Anticipated Operational Occurrences The SPFS is designed to remain functional during anticipated operating occurrences.
7.6.2.7.2.3 SPFS Conformance to Industry Codes and Standards 7.6.2.7.2.3.1 SPFS - IEEE 279 (1971) - Criteria for Protection Systems for Nuclear Power Generating Stations 7.6.2.7.2.3.1.1 SPFS - IEEE 279 (1971), Paragraph 4.1 - General Functional Requirement The SPFS is manually initiated. It is effective over the full range of environmental conditions cited below:
- a. Power supply voltages - Equipment is designed to operate within the range of voltages specified in Section 8.3.1.
- b. Power supply frequency - Equipment is designed to within the range of power supply frequency specified in Section 8.3.1.
CHAPTER 07 7.6-100 REV. 20, SEPTEMBER 2020
- c. Temperature - The system is operable at all temperatures that can result from a design basis LOCA.
- d. Humidity - The system is operable at all humidities, including steam, that can result from a LOCA.
- g. Vibration - The system will tolerate the conditions stated in Section 3.10.
- h. Malfunction - The system will tolerate any single component failure.
- i. Accidents - The system will operate during and following any DBA.
- j. Fire - The system will tolerate raceway fires in a single division.
- k. Explosion - Explosions are not defined in design bases.
- l. Missiles - The system will tolerate any single missile destroying raceway, cabinet, or equipment in one division.
- m. Lightning - The system will tolerate lightning damage to one electrical division.
- n. Flood - The plant is not subject to flooding as discussed in Section 3.4.
- o. Earthquake - The system will tolerate conditions stated in Section 3.10.
- p. Wind and Tornado - All control equipment is located in seismic Category 1 structure. See Section 3.3 for wind loadings.
- q. System response times - The system is manually initiated.
- r. System accuracies - Accuracies are within those needed for correct action.
- s. Abnormal range of sensed variables - No variables are sensed.
7.6.2.7.2.3.1.2 SPFS - IEEE 279 (1971), Paragraph 4.2 - Single Failure Criterion A single active or passive electrical or control failure will not prevent the SPFS from meeting its safety-related objective.
7.6.2.7.2.3.1.3 SPFS - IEEE 279 (1971), Paragraph 4.3 - Quality of Components and Modules All safety-related components are selected on the basis of suitability for the application. A quality assurance program is implemented.
7.6.2.7.2.3.1.4 SPFS - IEEE 279 (1971), Paragraph 4.4 - Equipment Qualification CHAPTER 07 7.6-101 REV. 20, SEPTEMBER 2020
LGS UFSAR The SPFS safety-related controls and instrumentation have been qualified according to the requirements outlined in IEEE 323 (1971) as highlighted in Section 7.1.2.7.4, identified in Sections 3.10 and 3.11. The parameters identified cover normal, abnormal, and accident environments.
7.6.2.7.2.3.1.5 SPFS - IEEE 279 (1971), Paragraph 4.5 - Channel Integrity The SPFS meets the channel integrity objective by using the design features described in the other paragraphs of this section.
7.6.2.7.2.3.1.6 SPFS - IEEE 279 (1971), Paragraph 4.6 - Channel Independence The control, instrumentation, and power circuits to each SPFS pump and its associated feedwater shutoff valves are physically and electrically separated from the other pump and associated valves.
7.6.2.7.2.3.1.7 SPFS - IEEE 279 (1971), Paragraph 4.7 - Control and Protection System Interaction The SPFS has no interaction with the plant control systems. Control room annunciator circuits taking input from this system are electrically isolated from the system and cannot impair its operability.
7.6.2.7.2.3.1.8 SPFS - IEEE 279 (1971), Paragraph 4.8 - Derivation of System Inputs There are no system inputs.
7.6.2.7.2.3.1.9 SPFS - IEEE 279 (1971), Paragraph 4.9 - Capability for Sensor Checks There are no sensed inputs to the SPFS.
7.6.2.7.2.3.1.10 SPFS - IEEE 279 (1971), Paragraph 4.10 - Capability for Testing and Calibration The SPFS pumps and feedwater shutoff valves can be tested during normal plant operation.
7.6.2.7.2.3.1.11 SPFS - IEEE 279 (1971), Paragraph 4.11 - Channel Bypass or Removal from Operation The two SPFS trains are separate electrically and physically. Removal of a component for maintenance prevents the operation of one train; however, operation of the other train is unaffected. The SPFS cannot be bypassed because all control is manual.
7.6.2.7.2.3.1.12 SPFS - IEEE 279 (1971), Paragraph 4.12 - Operating Bypasses All control for the SPFS is manual.
7.6.2.7.2.3.1.13 SPFS - IEEE 279 (1971), Paragraph 4.13 - Indication of Bypasses A common annunciator is provided in the control room to indicate low pump discharge pressure in either train of the SPFS, which may be a consequence of pump stoppage, whether by deliberate action or other reasons.
CHAPTER 07 7.6-102 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.7.2.3.1.14 SPFS - IEEE 279 (1971), Paragraph 4.14 - Access to Means for Bypassing Access to components of the SPFS is procedurally controlled by administrative means.
7.6.2.7.2.3.1.15 SPFS - IEEE 279 (1971), Paragraph 4.15 - Multiple Setpoints This paragraph is not applicable to the SPFS.
7.6.2.7.2.3.1.16 SPFS - IEEE 279 (1971), Paragraph 4.16 - Completion of Protective Action Once It Is Initiated The SPFS operates continuously once started by the operator and until stopped by the operator.
7.6.2.7.2.3.1.17 SPFS - IEEE 279 (1971), Paragraph 4.17 - Manual Initiation The SPFS is manually initiated.
7.6.2.7.2.3.1.18 SPFS - IEEE 279 (1971), Paragraph 4.18 - Access to Setpoint Adjustments, Calibration, and Test Points This paragraph is not applicable to the SPFS.
7.6.2.7.2.3.1.19 SPFS - IEEE 279 (1971), Paragraph 4.19 - Identification of Protective Actions The status of SPFS pumps and feedwater shutoff valves is shown by indicating lights on the control room panels.
7.6.2.7.2.3.1.20 SPFS - IEEE 279 (1971), Paragraph 4.20 - Information Readout The SPFS pumps status and feedwater valve position provides information to assure the operator of correct operation.
7.6.2.7.2.3.1.21 SPFS - IEEE 279 (1971), Paragraph 4.21 - System Repair Recognition of failed components is accomplished during testing of the system. During system operation, low discharge pressure is indicative of a failed pump. The control logic is not complex, therefore, location of a failed component is straightforward. The components are mounted to facilitate removal and replacement.
7.6.2.7.2.3.1.22 SPFS - IEEE 279 (1971), Paragraph 4.22 - Identification of Protection Systems Controls for the SPFS are located in control panels distinctively identified with nameplates that identifies them as being a safety system. Cables and cable trays are color coded and tagged to identify them as being a separation channel.
7.6.2.7.2.3.2 SPFS - IEEE 323 (1971) - IEEE Trial Use Standard: General Guide for Qualifying Class 1 Electric Equipment for Nuclear Power Generating Stations See Section 3.11.
CHAPTER 07 7.6-103 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.7.2.3.3 SPFS - IEEE 336 (1971) - Installation, Inspection, and Testing Requirements for Instrumentation and Electric Equipment During the Construction of Nuclear Power Generating Stations See Section 8.1.6.1 for a discussion of conformance with Regulatory Guide 1.30, which endorses/modifies this IEEE standard.
7.6.2.7.2.3.4 SPFS - IEEE 344 (1971) - Guide for Seismic Qualification of Class 1 Electric Equipment for Nuclear Power Generating Stations See Section 3.10.
7.6.2.7.2.3.5 SPFS - IEEE 379 (1972) - Guide for the Application of the Single Failure Criterion to Nuclear Power Generating Station Protection Systems A single failure within the SPFS will not prevent the SPFS from performing its safety function.
7.6.2.7.2.3.6 SPFS - IEEE 384 (1974) - Criteria for Separation of Class 1E Equipment and Circuits See Section 7.1.2.7.11.
7.6.2.7.2.3.7 SPFS - IEEE 338 (1975) - Criteria for the Periodic Testing of Nuclear Power Generating Station Protection Systems The SPFS pumps and feedwater shutoff valves can be tested during normal plant operation. A failure of one valve during testing does not prevent the other valve from functioning.
7.6.2.7.2.4 SPFS Additional Design Considerations Analysis As identified in Regulatory Guide 1.70 (1978), paragraph 7.6.2, the following accidents are addressed:
- a. Cold water slug injection - SPFS has no function in preventing or mitigating the consequences of this accident.
- b. Refueling accidents - SPFS has no function in preventing or mitigating the consequences of these accidents.
- c. Overpressurization of low pressure systems - The SPFS has no function in preventing or mitigating the consequences of this accident.
- d. Fires - SPFS has no function in preventing or mitigating the consequences of fires.
7.6.2.8 Redundant Reactivity Control System - Instrumentation and Controls 7.6.2.8.1 RRCS General Functional Requirements Conformance CHAPTER 07 7.6-104 REV. 20, SEPTEMBER 2020
LGS UFSAR The sensors, transmitters, trip units, and other assigned associated logic for the RRCS are Class 1E, separate and independent from the RPS, and environmentally qualified to expected ATWS conditions.
The RRCS is diverse from the RPS. No credible common mode failure can prevent both normal scram and ATWS prevention or mitigation functions. The RRCS is designed to independently monitor reactor pressure and water level and to shut down the nuclear chain reaction if these variables reach their respective trip setpoint. This shutdown is accomplished in the first few seconds after the trip by signals that cause rapid recirculation flow reduction and simultaneously open the ARI valves venting the air supply holding the scram valves shut.
Twenty-five seconds after the RRCS trip, additional core reactivity reduction is provided by a rapid termination (runback to 0%) of feedwater flow if the initiating signals include high pressure and core power is not downscale. Reactor high pressure is a symptom of loss of primary heat sink and is indicative of vessel isolation. The RRCS recirculation trips and feedwater runback serve to reduce core power below the steam flow capability of the SRVs.
7.6.2.8.2 RRCS Specific Regulatory Requirements Conformance General exceptions to and positions taken on the regulatory guides, and the revision to the guide that is followed, are discussed in Sections 1.8 and 7.1.2.5. Specific applications of selected guides to the RRCS instrumentation and controls are discussed in this section.
7.6.2.8.2.1 RRCS Conformance to Regulatory Guides 7.6.2.8.2.1.1 RRCS - Regulatory Guide 1.6 (1971) - Independence Between Redundant Standby (Onsite) Power Sources and Between Their Distribution System (Safety Guide 6)
The RRCS electrically powered safety loads are separated into load groups such that loss of any one group will not prevent the minimum safety functions from being performed. Division I RRCS logic is powered by 125 V dc from Bus A Division I. Division II logic is powered by 125 V dc from Bus B Division II.
7.6.2.8.2.1.2 RRCS - Regulatory Guide 1.22 (1972) - Periodic Testing of Protection System Actuation Functions (Safety Guide 22)
The RRCS equipment is designed so that integrated system testing can be performed to verify overall system performance.
7.6.2.8.2.1.3 RRCS - Regulatory Guide 1.29 (1978) - Seismic Design Classification The sensors, transmitters, trip units and associated logic for the RRCS are classified as seismic Category I. The feedwater pump trip contacts are high quality but not necessarily safety-grade.
7.6.2.8.2.1.4 RRCS - Regulatory Guide 1.30 (1972) - Quality Assurance Requirements for the Installation, Inspection, and Testing of Instrumentation and Electric Equipment (Safety Guide 30)
See Sections 1.8 and 7.1.2.5.
CHAPTER 07 7.6-105 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.8.2.1.5 RRCS - Regulatory Guide 1.32 (1977) - Criteria for Safety-Related Electric Power and Protection Systems for Nuclear Power Plants See Sections 1.8 and 7.1.2.5.
7.6.2.8.2.1.6 RRCS - Regulatory Guide 1.47 (1973) - Bypassed and Inoperable Status Indication for Nuclear Power Plant Safety Systems There is no RRCS bypass or operating bypass.
The following annunciators are provided to communicate system status to the operating personnel in the control room.
- a. RRCS MANUAL INITIATION ARMED Division I/II
- c. 1A RECIRC PUMP MOTOR ATWS TRIP CIRCUIT POWER FAILURE 1B RECIRC PUMP MOTOR ATWS TRIP CIRCUIT POWER FAILURE
- d. 1A RECIRC PUMP MOTOR TRIP 1B RECIRC PUMP MOTOR TRIP
- e. RWCU ISOLATED
- f. RRCS OUT OF SERVICE Division I (test fault, ATM calibration or gross failure)
RRCS OUT OF SERVICE Division II (test fault, ATM calibration or gross failure)
- g. RRCS CONFIRMED ATWS Division I/II (timer has timed out and APRM power is not downscale, SLCS injection initiation signal is present)
- h. RRCS CHANNEL ACTIVATED Division I/II
- i. RRCS MANUAL INITIATION Division I/II Additional operator interface with RRCS is provided by the following status lights. Each status light consists of a pair of bulbs for redundancy and an individual lamp test switch for each pair. These status lamps are repeated for Division II. All lamps are amber.
RRCS ARI INITIATION Division I RRCS MANUAL INITIATION Division I RRCS ARI READY FOR RESET Division I RRCS READY FOR RESET Division I RRCS TEST FAULT Division I RRCS LOSS OF DC POWER Division I Channel A RRCS LOSS OF DC POWER Division I Channel B RRCS FEEDWATER RUNBACK INITIATED Division I RRCS MANUAL INITIATION ARMED Division I HIGH DOME PRESSURE Division I Channel A HIGH DOME PRESSURE Division I Channel B CHAPTER 07 7.6-106 REV. 20, SEPTEMBER 2020
LGS UFSAR LOW WATER LEVEL 2 TRIP Division I Channel A LOW WATER LEVEL 2 TRIP Division I Channel B RRCS POTENTIAL ATWS Division I RRCS RWCU ISOLATED Division I RRCS CONFIRMED ATWS Division I RRCS ATM CALIBRATION OR GROSS FAILURE Division I RRCS TROUBLE Division I RRCS RECIRCULATION PUMPS TRIPPED Division I 7.6.2.8.2.1.7 RRCS - Regulatory Guide 1.53 (1973) - Application of the Single Failure Criterion to Nuclear Power Plant Protection Systems The RRCS meets the requirements of IEEE 279 (1971) and IEEE 379 (1972) (Section 7.6.2.8.2.3.1.2 and Section 7.6.2.8.2.3.6).
7.6.2.8.2.1.8 RRCS - Regulatory Guide 1.62 (1973) - Manual Initiation of Protective Actions Means are provided for manual initiation of the RRCS protective actions. The RRCS ARI function and, after time delays, the SLCS are initiated upon depression of the RRCS manual initiation push button. The RRCS RPT and feedwater runback are not initiated by manual initiation of RRCS.
These may be manually initiated at the respective system control panels using system breaker control switches.
7.6.2.8.2.1.9 RRCS - Regulatory Guide 1.68 (1978) - Preoperational and Initial Startup Test Programs for Water-Cooled Power Reactors The RRCS meets Regulatory Guide 1.68 and will undergo preoperational and initial startup tests as described in Section 14.2.
7.6.2.8.2.1.10 RRCS - Regulatory Guide 1.75 (1978) - Physical Independence of Electric Systems The RRCS meets Regulatory Guide 1.75. Methods for compliance with conditions involving the physical independence of electrical systems are discussed in Section 8.1.6.1.
7.6.2.8.2.1.11 RRCS - Regulatory Guide 1.89 (1974) - Qualification of Class 1E Equipment for Nuclear Power Plants The RRCS equipment is qualified to meet IEEE 323 (1974), IEEE 344 (1975) and Regulatory Guide 1.89.
7.6.2.8.2.1.12 RRCS - Regulatory Guide 1.100 (1977) - Seismic Qualification of Electric Equipment for Nuclear Power Generating Stations The RRCS equipment is qualified to meet IEEE 344 (1975) and Regulatory Guide 1.100. Refer to Section 3.10.
7.6.2.8.2.1.13 RRCS - Regulatory Guide 1.105 (1976) - Instrument Setpoints Instrument setpoints (accuracy, margin, and drift) for reactor power, water level, and pressure are described in the plant Technical Specifications.
CHAPTER 07 7.6-107 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.8.2.1.14 RRCS - Regulatory Guide 1.118 (1978) - Periodic Testing of Electric Power and Protection Systems The RRCS is continually checked by a solid-state microprocessor based self-test system that is part of the analog trip units. This system checks the RRCS sensors, logic, protective devices, and itself.
7.6.2.8.2.2 RRCS Conformance to 10CFR50, Appendix A, General Design Criteria GDC that are generally applicable to all safety-related systems, are discussed in Section 3.1.
Those with specific impact on the RRCS are described in this section.
7.6.2.8.2.2.1 RRCS - GDC 1 - Quality Standards and Records See Section 7.1.2.2.
7.6.2.8.2.2.2 RRCS - GDC 2 - Design Bases for Protection Against Natural Phenomena See Section 7.1.2.2.
7.6.2.8.2.2.3 RRCS - GDC 3 - Fire Protection See Section 7.1.2.2.
7.6.2.8.2.2.4 RRCS - GDC 4 - Environmental and Dynamic Effects Design Bases See Section 7.1.2.2.
7.6.2.8.2.2.5 RRCS - GDC 19 - Control Room See Section 7.1.2.2.
7.6.2.8.2.2.6 RRCS - GDC 10 - Protection System Functions The RRCS is completely automatic.
7.6.2.8.2.2.7 RRCS - GDC 21 - Protection System Reliability and Testability The RRCS is designed for high functional reliability, and its logic can be tested for the safety functions to be performed. No single failure in this two divisional, four-channel protection system will result in the loss of the protective functions.
7.6.2.8.2.2.8 RRCS - GDC 22 - Protection System Independence The RRCS is a two division Class 1E system separate and diverse from the RPS. It has functional diversity via ARI, RPT, and feedwater runback.
7.6.2.8.2.2.9 RRCS - GDC 24 - Separation of Protection and Control Systems CHAPTER 07 7.6-108 REV. 20, SEPTEMBER 2020
LGS UFSAR The RRCS protection system interfaces with control systems through isolation devices.
Specifically, the RRCS signals to the recirculation system pump and the signal to the feedwater system to initiate runback both pass through isolators. This ensures that electrical failures in the control systems cannot propagate back into the RRCS system and therefore cannot prevent other channels in the RRCS divisions from performing their protective functions.
7.6.2.8.2.2.10 RRCS - GDC 29 - Protection Against Anticipated Operational Occurrences The RRCS is highly reliable because it is redundant, Class 1E, functionally diverse and has continuous self-test capability.
7.6.2.8.2.3 RRCS Conformance to Industry Codes and Standards 7.6.2.8.2.3.1 RRCS - IEEE Standard 279 (1971) - Criteria for Protection Systems for Nuclear Power Generating Stations 7.6.2.8.2.3.1.1 RRCS - IEEE Standard 279 (1971), Paragraph 4.1 - General Functional Requirement The RRCS will automatically initiate the appropriate protective actions whenever reactor high pressure or low water level 2 are received. These actions include tripping of the recirculation pump motor breakers, initiating a feedwater runback and RWCU system isolation.
7.6.2.8.2.3.1.2 RRCS - IEEE Standard 279 (1971), Paragraph 4.2 - Single Failure Criterion The RRCS is two divisional with two channels (A and B) in each division. The RRCS protective action will be initiated when both channel A and channel B in either division are tripped. Different water level and pressure sensors feed each of the four channels of trip logic. Trip signals to trip the recirculation pump act on independent breakers. The feedwater runback and RWCU system isolation are capable of being initiated from either division. In this manner, any single failure within RRCS cannot prevent the protective actions at the system level from taking place.
7.6.2.8.2.3.1.3 RRCS - IEEE Standard 279 (1971), Paragraph 4.3 - Quality of Components and Modules RRCS components and modules, and equipment in non-Class 1E systems supporting the RRCS (such as the recirculation system pump motor breaker ATWS trip coils), are Class 1E electrical, suitable for and consistent with the low failure rates required for nuclear power station safety-related equipment, except as noted below. High quality, although not necessarily safety-grade equipment shall be used to meet the feedwater control runback ATWS reliability requirements.
7.6.2.8.2.3.1.4 RRCS - IEEE Standard 279 (1971), Paragraph 4.4 - Equipment Qualification Type test data or reasonable engineering extrapolation based on test data is available to verify that the RRCS can meet its performance requirements on a continuing basis.
7.6.2.8.2.3.1.5 RRCS - IEEE Standard 279 (1971), Paragraph 4.5 - Channel Integrity RRCS channels and components meet the necessary functional requirements of the environmental conditions for components listed in the tables in Section 3.11.
CHAPTER 07 7.6-109 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.8.2.3.1.6 RRCS - IEEE Standard 279 (1971), Paragraph 4.6 - Channel Independence Each channel, A and B, of each division of logic is independent and physically separated from the other channel. Separate sensors provide signals of reactor pressure and water level for each channel of each division. Signals are routed through separate cabling to separate ATMs and RRCS logic. Actuation signals also travel to the trip-actuated devices via divisionally separated cabling. This design effectively decouples the effects of unsafe environmental factors, electrical transients, and physical accident consequences.
7.6.2.8.2.3.1.7 RRCS - IEEE Standard 279 (1971), Paragraph 4.7 - Control and Protection System Interaction The transmission of signals from RRCS protection system equipment for control system use is accomplished through isolation devices that are classified as part of the protection system and meet all the requirements of this standard. No credible failure at these isolators will prevent the associated protection system channel from meeting its design requirements.
7.6.2.8.2.3.1.8 RRCS - IEEE Standard 279 (1971), Paragraph 4.8 - Derivation of System Inputs The RRCS system inputs, reactor pressure, and water level are derived from pressure and level transmitters that produce signals that are to the extent, feasible and practical, direct measures of these desired variables.
7.6.2.8.2.3.1.9 RRCS - IEEE Standard 279 (1971), Paragraph 4.9 - Capability for Sensor Checks The RRCS self-test unit automatically checks the RRCS level and pressure sensors. The automatic check determines if the sensor output is downscale, within normal operating bounds, or too high. If the sensor output is found to be abnormal, an alarm is sounded. The sensor output can be observed and compared at the middle bay of the RRCS cabinet where the ATM diagnostic display is mounted.
7.6.2.8.2.3.1.10 RRCS - IEEE 279 (1971), Paragraph 4.10 - Capability for Testing and Calibration Each RRCS sensor provides input to an analog trip module. The ATM electrically monitors the incoming sensor signal level and provides the appropriate output to the RRCS logic if that sensor signal level goes beyond its trip setpoints. Sensor signal level can be read at the ATM and compared to the known characteristics of the transmitter. Trip setpoint can be adjusted at the ATM, and the operability of this trip module is checked repeatedly by the RRCS self-test unit.
RRCS sensors, logic, timers, and actuated devices are continuously checked by the RRCS self-test unit, thus meeting paragraph 4.10.
7.6.2.8.2.3.1.11 RRCS - IEEE 279 (1971), Paragraph 4.11 - Channel Bypass or Removal from Operation The RRCS is designed such that portions may be removed from service for maintenance or testing without initiating the RRCS protective actions at the system level. Removal of portions of the RRCS for service will not result in protective actions because the system is normally de-energized.
7.6.2.8.2.3.1.12 RRCS - IEEE 279 (1971), Paragraph 4.12 - Operating Bypasses There is no operating bypass affecting the RRCS.
CHAPTER 07 7.6-110 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.8.2.3.1.13 RRCS - IEEE 279 (1971), Paragraph 4.13 - Indication of Bypasses There is no manual bypass of the RRCS.
7.6.2.8.2.3.1.14 RRCS - IEEE 279 (1971), Paragraph 4.14 - Access to Means for Bypassing The RRCS cannot be manually bypassed.
7.6.2.8.2.3.1.15 RRCS - IEEE 279 (1971), Paragraph 4.15 - Multiple Setpoints There are no multiple setpoints applicable to the RRCS.
7.6.2.8.2.3.1.16 RRCS - IEEE 279 (1971), Paragraph 4.16 - Completion of Protective Action Once It Is Initiated The RRCS protective actions are sealed in by the solid-state logic. The RRCS ARI function cannot be reset for 30 seconds after its initiation. This ensures that the scram will go to completion because the ARI valves are designed to vent the scram air header to cause all rods to begin scramming within 15 seconds. All other RRCS protective actions cannot be reset for at least 10 minutes. Operator control of the feedwater system can be regained 30 seconds after initiation of the RRCS feedwater runback. Because the runback is designed to bring feedwater flow to 0%
within 15 seconds, this protective function will also go to completion.
7.6.2.8.2.3.1.17 RRCS - IEEE 279 (1971), Paragraph 4.17 - Manual Initiation The RRCS can be manually initiated by depressing the manual initiation push buttons. The manual initiation signal is immediately sealed into the RRCS ARI logic.
7.6.2.8.2.3.1.18 RRCS - IEEE 279 (1971), Paragraph 4.18 - Access to Setpoint Adjustments, Calibration, and Test Points The design of RRCS permits the administrative control of access to all setpoint adjustments, module calibration adjustments, and test setpoints via enclosing the ATMs and logic in key-locked cabinets.
7.6.2.8.2.3.1.19 RRCS - IEEE 279 (1971), Paragraph 4.19 - Identification of Protective Actions RRCS protective actions are indicated and identified down to the channel level by status lights and annunciators.
7.6.2.8.2.3.1.20 RRCS - IEEE 279 (1971), Paragraph 4.20 - Information Readout The RRCS provides the operator with pertinent information as to its condition via status lights and annunciators. This includes indication of the various stages of the RRCS logic actuation such as RPT, feedwater runback, and both potential and confirmed ATWS. An RRCS trouble annunciator is provided to signal a test fault, ATM in calibration or gross failure. Loss of power to RRCS is signaled by the RRCS trouble annunciator.
7.6.2.8.2.3.1.21 RRCS - IEEE 279 (1971), Paragraph 4.21 - System Repair CHAPTER 07 7.6-111 REV. 20, SEPTEMBER 2020
LGS UFSAR The RRCS system is designed to facilitate the recognition, location, replacement, repair, or adjustment of malfunctioning components or modules. The use of the analog trip module facilitates the calibration, adjustment, or repair of the trip system. The modules are plug-in units that can be easily replaced. RRCS logic is separated by division and channel onto individual cards that can be easily replaced by spares.
7.6.2.8.2.3.1.22 RRCS - IEEE 279 (1971), Paragraph 4.22 - Identification of Protection Systems The RRCS protection system equipment is identified distinctively as being in the protection system, and its equipment is marked to clearly indicate divisional separation. Panels are labeled with distinctive marker plates.
7.6.2.8.2.3.2 RRCS - IEEE 308 (1974) - Criteria for Class 1E Electrical Systems for Nuclear Power Generating Stations The RRCS meets IEEE 308. The logic is in two divisions. Each division has separate Class 1E power. RRCS components are energized to trip, therefore loss of power to one division will not affect protective actions of the RRCS.
7.6.2.8.2.3.3 RRCS - IEEE 323 (1971) - IEEE Trial Use Standard: General Guide for Qualifying Class 1 Electric Equipment for Nuclear Power Generating Stations The RRCS is in conformance with IEEE 323 as shown in Section 3.11.
7.6.2.8.2.3.4 RRCS - IEEE 338 (1975) - Criteria for the Periodic Testing of Nuclear Power Generating Station Protection Systems RRCS compliance with IEEE 338 is demonstrated in Section 7.6.1.8.2, ATM self-test capability and in 7.6.2.8.2.3.1, paragraphs 4.9 and 4.10.
7.6.2.8.2.3.5 RRCS - IEEE 344 (1975) - Guide for Seismic Qualification of Class 1 Electric Equipment for Nuclear Power Generating Stations The RRCS is qualified for seismic events shown in Section 3.10.
7.6.2.8.2.3.6 RRCS - IEEE 379 (1972) - Guide for the Application of the Single Failure Criterion to Nuclear Power Generating Station Protection Systems RRCS signal separation, cabinet separation, use of isolation circuitry, and number of channels per trip system are methods used to meet the single failure criterion. The RRCS self-test system eliminates nondetectable failures by continually checking RRCS sensors, logic, and trip devices.
7.6.2.8.2.3.7 RRCS - IEEE 384 (1974) - Criteria for Separation of Class 1E Equipment and Circuits The RRCS meets IEEE 384 as discussed in Section 7.1.2.7.11. The RRCS meets Regulatory Guide 1.75 as discussed in Section 7.6.1.8.2. Physical independence of electrical systems is discussed in Section 8.3.1.4.
7.6.2.9 Additional Design Considerations Analyses CHAPTER 07 7.6-112 REV. 20, SEPTEMBER 2020
LGS UFSAR 7.6.2.9.1 General Plant Safety Analyses The examination of the subject safety systems at the plant safety analyses level is presented in Chapter 15.
7.6.2.9.2 Cold Water Slug Injection Refer to Section 15.5.1.
7.6.2.9.3 Refueling Accidents Refer to Section 15.7.4.
7.6.2.9.4 Overpressurization of Low Pressure System Refer to Section 7.6.1.2.
7.
6.3 REFERENCES
7.6-1 NEDC-32410P-A, Nuclear Measurement Analysis and Control Power Range Neutron Monitor (NUMAC-PRNM) Retrofit Plus Option III Stability Trip Function, October 1995.
7.6-2 NEDC-32410P-A, Supplement 1, Nuclear Measurement Analysis and Control Power Range Neutron Monitor (NUMAC-PRNM) Retrofit Plus Option III Stability Trip Function, November 1997.
7.6-3 NEDO-31960-A and NEDO-31960-A, Supplement 1, BWR Owners Group Long-Term Stability Solutions Licensing Methodology, November 1995.
7.6-4 NEDO-32465-A, BWR Owners Group Long-Term Stability Detect and Suppress Solutions Licensing Basis Methodology and Reload Applications, August 1996.
7.6-5 NEDE-32465, Supplement 1P-A, Revision 1, "Migration to TRACG04/PANAC11 from TRACG02/PANAC10 for Reactor Stability Detect and Suppress Solutions Licensing Basis Methodology for Reload Applications," October 2014.
CHAPTER 07 7.6-113 REV. 20, SEPTEMBER 2020
LGS UFSAR Table 7.6-1 PROCESS RADIATION MONITORING SYSTEMS - INSTRUMENT CHARACTERISTICS INSTRUMENT SCALE TRIPS PER MONITORING SYSTEM INSTRUMENT RANGE (DECADE LOG) UPSCALE MSL-RMS 1 to 106 mR/hr 6 2(1)
REVE-RMS 10-2 to 102 mR/hr 4 2(1)
RAVE-RMS 10-2 to 102 mR/hr 4 2(1)
CRV-RMS 10-6 to 10-1 Ci/cc 5 2(1)
CREFA-RMS 10-6 to 10-1 Ci/cc 5 2(2)
PCPL-RMS 10o to 108 R/hr 8 1(3)
RHRSW-RMS 10 to 106 cpm 5 1(1)
NSE-RMS 10-7 to 105 Ci/cc 12 2(3)
(1) A safety-related control trip is provided to shut off plant components.
(2) No control trip is provided. The trip provides annunciator alarm only.
(3) A nonsafety-related control trip is provided to shut off plant components.
CHAPTER 07 7.6-114 REV. 13, SEPTEMBER 2006
LGS UFSAR Table 7.6-2 IRM SYSTEM TRIPS TRIP FUNCTION NORMAL SETPOINT TRIP ACTION IRM upscale 120/125 FS Scram, annunciator, red light display IRM inoperative (1) Scram, annunciator, red light display IRM upscale 85/125 FS Rod block, annunciator, amber light display IRM downscale 3/125 FS Rod block (exception on most sensitive scale),
annunciator, white light display IRM bypassed - White light display (1) IRM is inoperative if module interlock chain is broken, operate/calibrate switch is not in operate position, detector polarizing voltage is below 80 V, or negative 20 V dc supply is lost.
CHAPTER 07 7.6-115 REV. 13, SEPTEMBER 2006
LGS UFSAR Table 7.6-3 LPRM SYSTEM TRIPS TRIP FUNCTION TRIP RANGE TRIP SETPOINT TRIP ACTION LPRM 0% to full 3% ODA inication and downscale Scale annunciator LPRM 0% to full 100% ODA indication and Upscale Scale annunciator LPRM Manual - ODA indication and bypass selection APRM averaging compensation CHAPTER 07 7.6-116 REV. 13, SEPTEMBER 2006
LGS UFSAR Table 7.6-4 APRM SYSTEM TRIPS TRIP FUNCTION TRIP POINT RANGE NOMINAL SETPOINT ACTION APRM Downscale Rod Block 0% to full-scale To be provided in the Technical Rod block, annunciator, Specifications APRM ODA, white light APRM Simulated Thermal Power - Upscale (Setdown) 10% to 30% To be provided in the Technical Scram, annunciator, Trip Specifications APRM ODA, red light APRM Simulated Thermal Power - Upscale (Setdown) 7% to 27% To be provided in the Technical Rod block, annunciator, Rod Block Specifications APRM ODA, amber light APRM Simulated Thermal Power - Upscale Trip:
- Two Recirculation Loop Operation Varied with flow; intercept To be provided in the Technical Scram, annunciator, and slope adjustable Specifications APRM ODA, red light
- Single Recirculation Loop Operation Varied with flow; intercept To be provided in the Technical Scram, annunciator, and slope adjustable Specifications APRM ODA, red light CHAPTER 07 7.6-117 REV. 13, SEPTEMBER 2006
APRM SYSTEM TRIPS TRIP FUNCTION TRIP POINT RANGE NOMINAL SETPOINT ACTION APRM Simulated Thermal Power - Upscale Rod Block:
- Two Recirculation Loop Operation Varied with flow; intercept To be provided in the Technical Rod Block, annunciator, and slope adjustable Specifications APRM ODA, amber light
- Single Recirculation Loop Operation Varied with flow; intercept To be provided in the Technical Rod Block, annunciator, and slope adjustable Specifications APRM ODA, amber light APRM Neutron Flux - Upscale Trip 10% to full-scale To be provided in the Technical Scram, annunciator, Specifications APRM ODA, red light APRM Neutron Flux - Upscale Rod Block 10% to full-scale To be provided in the Technical Rod Block, annunciator, Specifications APRM ODA, amber light APRM Inoperative Trip Chassis mode switch, Not in operate mode or critical Scram, rod block, module interlocks open, or self-test fault annunciator, APRM self-test ODA, red light CHAPTER 07 7.6-118 REV. 13, SEPTEMBER 2006
APRM SYSTEM TRIPS TRIP FUNCTION TRIP POINT RANGE NOMINAL SETPOINT ACTION OPRM Upscale *** Period based detection To be provided in the Technical Scram, annunciator, algorithm (PBDA) - Specifications APRM ODA Confirmation Count: 2-25 Amplitude: 1.00-1.30 Amplitude based algorithm Not applicable **** Scram, annunciator, (ABA): 1.05-1.50 APRM ODA Growth rate algorithm Not applicable **** Scram, annunciator, (GRA): 1.00-1.50 APRM ODA APRM Bypass Manual switch White light
- This trip can only occur when the reactor mode switch is in the RUN position, and the plant is operating within the OPRM trip enabled region of the power-flow map (reactor is operating at or above the lower power limit and below the upper flow limit).
- The ABA and GRA are not credited in the safety analysis.
CHAPTER 07 7.6-119 REV. 13, SEPTEMBER 2006
LGS UFSAR Table 7.6-5 RRCS TRIP LOGIC RESPONSE 25 Seconds After 118 Seconds After 10 Minutes and 9 Seconds Initiation 30 Seconds Initiation and 118 Seconds After RRCS After After And APRM Not After APRM Not Initiation and APRM Signal Immediate Initiation Downscale Initiation Downscale Not Downscale Reactor High ARI Feedwater ARI reset SLCS Initiation Reset possible Pressure Recirc Pump Runback permissive RWCU isolation if initiation Motor Trip available 10 minute signals have Start 30, timer started cleared 25, and 118 second timers Reactor water ARI Recirc Pump ARI reset SLCS Initiation Reset possible Low Level 2 Motor Trip permissive RWCU isolation if initiation available 10 minute signals have timer started cleared Start 9, 30, and 118 second timers Manual ARI ARI reset SLCS Intiation Reset possible Intiation Start 30 permissive RWCU isolation if initiation And 118 available 10 minute signals have second timer started cleared timers CHAPTER 07 7.6-120 REV. 13, SEPTEMBER 2006
LGS UFSAR Table 7.6-6 RADIATION MONITORING SYSTEM SENSOR LOCATION Monitor Location(1)
Main steam line Main steam tunnel Reactor enclosure ventilation exhaust Reactor enclosure Refueling floor ventilation exhaust Reactor enclosure Control room ventilation Control enclosure Control room emergency fresh air supply Control enclosure Primary containment post-LOCA Primary containment RHRSW Diesel generator enclosure North stack effluent Reactor enclosure roof (1) All of these locations are safety-related structures.
CHAPTER 07 7.6-121 REV. 13, SEPTEMBER 2006
LGS UFSAR Table 7.6-7 HIGH PRESSURE/LOW PRESSURE INTERLOCK EQUIPMENT PARAMETER Process Line Type Valve Sensed Purpose RHR shutdown MO HV51-F009 Reactor Prevents valve cooling supply MO HV51-F008 pressure opening until (4) reactor pressure is low RHR shutdown Check HV51-F050A,B N/A N/A Cooling return MO HV51-F015A,B Reactor Prevents valve pressure opening until reactor pressure is low AO HV51-151A,B (1) (1)
Check 51-1200A, B N/A N/A RHR LPCI line AO HV51-142A,B, (1) (1)
C,D Check HV51-F041A,B, N/A N/A C, D MO HV51-F017A,B, Differential Prevents valve C, D pressure opening until across valve differential pressure is low CS Check HV52-F006A,B N/A N/A system Check HV52-108 N/A N/A MO HV52-F005 Reactor Prevents valve MO HV52-F004A,B pressure opening until MO HV52-F037 reactor pressure is low AO HV52 F039A,B (1) (1)
CHAPTER 07 7.6-122 REV. 15, SEPTEMBER 2010
LGS UFSAR Table 7.6-7 (Cont'd)
PARAMETER (1) No parameter sensed because the valves are opened solely by remote momentary push buttons, to equalize pressure across the check valve discs to permit testing of the opening of the check valves.
(2) Not used.
(3) Not used.
(4) The RHR shutdown cooling suction valve F008 is provided with an additional interlock which prevents a fire-induced open signal from causing it to open simultaneously with valve F009 when the reactor pressure is greater than the design capabilities of the RHR low-pressure piping.
CHAPTER 07 7.6-123 REV. 15, SEPTEMBER 2010
LGS UFSAR Table 7.6-8 INTERLOCKED VALVES ON THE HPLPSI SYSTEM VALVE POWER RHR E11-F008 ESS 2 E11-F009 ESS 1 E11-F050A, B ESS 1 E11-F015A, B ESS 2 E11-F017A ESS 1 E11-F017B ESS 2 E11-F017C ESS 3 E11-F017D ESS 4 CS E21-F004A ESS 1 E21-F004B ESS 2 E21-F005 ESS 1 E21-F037 ESS 2 CHAPTER 07 7.6-124 REV. 13, SEPTEMBER 2006