ML21278A195
Text
7.11 ANTICIPATED TRANSIENT WITHOUT SCRAM Anticipated Transient Without Scram is an anticipated operational occurrence followed by the failure of the reactor trip portion of the protection system. This protection system automatically initiates the operation of systems, including the reactivity control systems, which assure that specified fuel design limits are not exceeded as a result of anticipated operational occurrences.
Some examples of these occurrences are: loss of power to all reactor coolant pumps in a unit, loss of load, and loss of offsite power (Section 14.1.1.1).
Protection against ATWS events is comprised of three elements: DSS, DTT, and a diverse AFAS. These are all requirements of 10 CFR 50.62. The first two, DSS and DTT, are discussed in this section; AFAS is discussed in Section 7.10.
7.11.1 DIVERSE SCRAM SYSTEM The purpose of the DSS is to provide reactor trip capability that senses high pressurizer pressure and will function separately from the primary reactor trip system (Section 7.3).
7.11.1.1 Design Basis The DSS provides diversity from the existing RPS, electrical independence from sensor output to the final actuation device, isolation of non-safety-related from safety-related circuits, testability at power, environmental qualification for anticipated operational occurrences, and a design to prevent against inadvertent actuation and challenges to other safety systems.
- a. Facility electrical separation is maintained through the use of existing circuitry in the ESFAS sensor, logic, and relay cabinets, which provide physical separation for four sensor channels and two logic and relay channels.
- b. Seismic concerns are met by utilizing existing equipment already in place within the ESFAS sensor, logic, and relay cabinets.
- c. At-power testing is accomplished with the use of a bypass contactor in parallel to the existing CEDM motor-generator load contactor.
- d. Redundancy is not required by 10 CFR 50.62. Both channels of the DSS must trip, opening both of the CEDM motor-generator load contactors in order to cause a reactor trip.
- e. Diversity is provided between the RPS and the DSS through the use of equipment supplied by different manufacturers or designed differently to provide the same function. The DSS interrupts power to the CEDM power supplies by opening the motor-generator load contactors, while the RPS uses the reactor trip switchgear to interrupt CEDM power. The same sensors are used by the DSS and the RPS for pressurizer pressure which is acceptable by 10 CFR 50.62. Sensor output for DSS is made diverse from RPS, as specified by 10 CFR 50.62, through the use of an electronic isolator.
- f. The DSS is powered by inverter feed which are AC power sources that also supply the RPS. The use of common power supplies is acceptable for the DSS and the RPS sensors as they are not within the scope of the ATWS rule, 10 CFR 50.62. The DSS power supplies for each of the four DSS protection channels are independently breakered and fused from a different vital bus. This isolates the DSS power supplies from each of the vital buses in order to prevent common mode failures.
- g. Environmental qualification to accident conditions is provided for DSS equipment installed in the ESFAS cabinets.
CALVERT CLIFFS UFSAR 7.11-1 Rev. 47
7.11.1.2 System Description The DSS is a four channel sensor system which through two-out-of-four logic inputs to two actuation channels. Each actuation channel opens one of the two load contactors on each CEDM motor-generator. Both load contactors on each CEDM motor-generator must open to cause a reactor trip.
The four sensor channels consist of pressurizer pressure sensors (PT-102A, B, C, D) and associated circuits. The output of the sensors, through isolators, provides pressure signals to four high-trip bistables in the ESFAS sensor cabinets. Each bistable provides channel trip annunciation, input to a two-out-of-four logic module in channel "A" of the ESFAS cabinet and input to a two-out-of-four logic module in channel "B" of the ESFAS cabinet. The logic modules energize a relay in each of the ESFAS relay cabinets to open the CEDM motor-generator load contactors.
Both channels must actuate to initiate a reactor trip.
At-power testing is provided through the use of a bypass contactor for the channel in test. The bypass contactor is in parallel with the load contactor and prevents the loss of output when the load contactor opens during testing. Due to the fact that the DSS is not available while the system is in bypass, administrative control will limit the time that the system may remain in bypass.
Annunciation is provided on 1(2)C05 for both "DIVERSE SCRAM SYSTEM TRIP" and "DSS LOAD CONTACTOR BYPASSED."
7.11.2 DIVERSE TURBINE TRIP Main turbine trip circuitry consists of four safety-related instrument control channels which sense CEDM power bus undervoltage. The DSS provides a diverse means of deenergizing the CEDM power bus. This satisfies the ATWS requirement for diverse means of main turbine trip.
CALVERT CLIFFS UFSAR 7.11-2 Rev. 47