ML23291A424
| ML23291A424 | |
| Person / Time | |
|---|---|
| Site: | Susquehanna  |
| Issue date: | 10/24/2023 |
| From: | Susquehanna |
| To: | |
| References | |
| PLA-8081 | |
| Download: ML23291A424 (86) | |
Text
SSES-FSAR Text Rev. 72 7.6 ALL OTHER INSTRUMENTATION SYSTEMS REQUIRED FOR SAFETY 7.6.1a DESCRIPTION This section will examine and discuss the instrumentation and control aspects of the following NSSS systems:
(1) Process Radiation Monitoring System (NSSS)
(2) High Pressure/Low Pressure Systems Interlock Protection System (3) NSSS Leak Detection System (4) Neutron Monitoring System (NMS)
(5) Recirculation Pump Trip System (RPT)
The following are relevant to the evaluation of the instrumentation and control portions of the subject systems.
(1) The systems themselves and their I&C portion serve design bases that are both safety and power generation.
(2) Many systems inherently perform mechanical or containment safety functions but need little I&C protective support.
(3) Many systems provide protective functions in selective minor events and are not required for other major plant occurrence.
(4) Several systems perform safety functions with other parallel and complementary systems in a network protective manner and as such the network, not the individual system, is to be evaluated for redundancy, diversity, and separation considerations.
(5) Several systems have only a small portion of their I&C participating in safety functions.
(6) Most of the I&C systems described in this section are an integral part of the total system function described in other sections.
(7) A system level discussion of the safety aspects is presented in Appendix 15A.
7.6.1a.1 Refueling Interlocks System-Instrumentation and Controls See Subsection 7.7.1.10.
7.6.1a.2 NSSS Process Radiation Monitoring System - Instrumentation and Controls A number of radiation monitors and monitoring subsystems are required for safe shutdown of the plant.
FSAR Rev. 71 7.6-1
SSES-FSAR Text Rev. 72 Of these the NSSS uses only the main steamline radiation monitoring subsystem. The others are used in the non-NSSS systems and are described in Subsection 7.6.1b.2.
7.6.1a.3 High Pressure/Low Pressure Systems Interlock Protection System 7.6.1a.3.1 Function Identification The low pressure systems which interface with the RCPB and the instrumentation which protects them from overpressurization are discussed in this section.
7.6.1a.3.2 Power Sources The power for the interlocks is provided from the essential power supplies for the associated systems, (RHR for the RHR valves and CS for the CS valves).
7.6.1a.3.3 Equipment Design The following high pressure/low pressure interlock equipment is provided:
Process Line Instrumentation Type Valve Parameter Sensed Purpose RHRS Shutdown Supply MO E11-F009 Reactor Pressure Closes on high pressure and MO E11-F008 prevents opening until reactor pressure is low RHRS Shutdown Return & Check E11-F050 NA NA LPCI MO E11-F015 Reactor Pressure Maintains valve closed and/or prevents opening until reactor pressure is low Injection MO E11-F017 Reactor Pressure RHRS Head Spray Check E11-F019 NA NA MO E11-F023 Reactor Pressure Closes on high pressure and prevents opening until reactor pressure is low MO E11-F022 Reactor Pressure CS System Injection Check E21-F006 NA NA MO E21-F004 Reactor Pressure Prevents valves from opening until reactor pressure is low MO E21-F005 Reactor Pressure FSAR Rev. 71 7.6-2
SSES-FSAR Text Rev. 72 7.6.1a.3.3.1 Circuit Description At least two valves are provided in series in each of these lines. The RHR shutdown supply valves, the inboard RHR shutdown return valves (when in the shutdown mode) and the RHR head spray valves are all controlled by independent and diverse interlocks to prevent the valves from being opened when the primary system pressure is above the subsystem design pressure.
The RHR system head spray and shutdown supply valves are interlocked to prevent valve opening, whenever the primary pressure is above the subsystem design pressure, and automatically close whenever the primary system pressure exceeds the subsystem design pressure.
The LPCI injection valves E11-F015 and E11-017 and the Core Spray system injection valves E21-F004 and F005 are interlocked with a reactor pressure low signal which protects the systems from overpressurization by not allowing these valves to open until reactor pressure is below the system design pressure. E11-F015 is a fast opening valve and E11-F017 is a throttling valve.
7.6.1a.3.3.2 Logic and Sequencing There is no logic as such, for the sensor inputs operate the interlocks without logic combination.
7.6.1a.3.3.3 Bypasses and Interlocks There are no bypasses in the high pressure/low pressure interlocks. However, either of the two series motor operated valves can be opened for test if the other is closed.
7.6.1a.3.3.4 Redundancy Each process line has two valves in series which are redundant in assuring the interlock. The RHR shutdown supply valves, the inboard RHR shutdown return valves (when in the shutdown mode) and the RHR head spray valves are all controlled by independent interlocks which close the valves and/or prevent the valves from being opened when the primary system pressure is above the subsystem design pressure.
7.6.1a.3.3.5 Actuated Devices The motor operated valves and air operated valve listed in Subsection 7.6.1a.3.3 are the actuated devices.
7.6.1a.3.3.6 Separation Separation is maintained in the instrumentation portion of the high pressure/low pressure interlocks by assigning the signals for the electrically controlled valves to ECCS separation divisions. The sensors and cabling are in separate ECCS divisions.
7.6.1a.3.3.7 Testability The actuated devices cannot be tested during reactor operation but are verified during startup and shutdown. The sensors can be tested during reactor operation in the same manner that the ECCS sensor are tested. Refer to Subsection 7.3.1.1a.3.9 for a discussion of typical ECCS testing.
FSAR Rev. 71 7.6-3
SSES-FSAR Text Rev. 72 7.6.1a.3.4 Environmental Considerations The instrumentation and controls for the high pressure/low pressure interlocks are qualified as Class 1E equipment. The sensors are mounted on local instrument panels and the control circuitry is housed in panels in the control structure, and are qualified for these environmental conditions.
See Section 3.11 for discussion.
7.6.1a.3.5 Operational Considerations 7.6.1a.3.5.1 General Information The high pressure/low pressure interlocks are strictly automatic. There is no manual actuation capability. If the operator initiates operation of a low pressure system, the interlocks will prevent exposure to the high pressure.
7.6.1a.3.5.2 Reactor Operator Information The status of each valve providing the high pressure/low pressure boundary is indicated in the control room with the exception of the head spray check valve.
7.6.1a.3.5.3 Setpoints Refer to the Technical Requirements Manual for safety trip setpoints and the plant Technical Specifications for the Allowable Values.
7.6.1a.4 NSSS Leak Detection System-Instrumentation and Controls The NSSS Leak Detection System consists of the following subsystems:
(1) Main Steamline Leak Detection (2) RCIC System Leak Detection (3) Recirculation Pump Leak Detection (4) RHR System Leak Detection (5) Reactor Water Cleanup System Leak Detection (6) Safety/Relief Valve Leak Detection (7) Reactor Vessel Head Leak Detection (8) HPCI System Leak Detection 7.6.1a.4.1 System Identification This section discusses the instrumentation and controls associated with the leak detection system.
The system itself is discussed in Subsection 5.2.5.
The purpose of the leak detection system instrumentation and controls is to detect leakage from the reactor coolant pressure boundary before predetermined limits are exceeded and provide the signals necessary to generate an alarm and/or to isolate leakage. Safety and seismic classifications for the Leak Detection Systems are discussed in Sections 3.10 and 3.11.
FSAR Rev. 71 7.6-4
SSES-FSAR Text Rev. 72 7.6.1a.4.2 Power Sources Power Separation is applicable to leak detection signals that are associated with the isolation valve systems. For further discussion, refer to Subsection 7.3.1.1a.2.
7.6.1a.4.3 Equipment Design 7.6.1a.4.3.1 General The systems or parts of systems which contain water or steam coming from the reactor vessel or supply water to the reactor vessel, and which are in direct communication with the reactor vessel, are provided with leakage detection systems.
The main steamlines within the steam tunnel inside the containment are monitored by temperature detectors within the tunnel.
Outside the drywell, the piping within each system monitored for leakage is in compartments or rooms separate from other systems wherever feasible so that leakage may be detected in drains, by area temperature indications, or high process flow.
7.6.1a.4.3.2 Main Steamline Leak Detection The Main Steamline Leak Detection subsystem is discussed in Subsection 7.3.1.1a.2.4.1.12.
7.6.1a.4.3.3 RCIC System Leak Detection 7.6.1a.4.3.3.1 Subsystem Identification The steamlines of the RCIC system are constantly monitored for leaks by the leak detection system. Leaks from the RCIC will cause a change in at least one of the following monitored operating parameters: area temperature, steam pressure, or steam flow rate. If the monitored parameters indicate that a leak may exist, the detection system responds by activating an annunciator and initiating a RCIC isolation trip logic signal.
The RCIC leak detection subsystem consists of three types of monitoring circuits. The first of these monitors ambient and differential temperature, triggering an annunciator when the temperature rises above a preset maximum. Note that the high differential temperature isolation and isolation alarm function have been removed but the above equipment is still located in the field and the pre-isolation alarm is still functional. The second type of circuit utilized by the leak detection system monitors the flow rate (differential pressure) through the steamline, triggering an annunciator when the differential pressure rises above a preset maximum. The third type of circuit utilized by the leak detection system monitors the steamline pressure upstream of the differential pressure element and also is annunciated. Alarm outputs from all three circuits are also used to generate the RCIC auto-isolation signal. For instrument safety trip setpoints, refer to the Technical Requirements Manual, and the plant Technical Specifications for the Allowable Values.
FSAR Rev. 71 7.6-5
SSES-FSAR Text Rev. 72 7.6.1a.4.3.3.2 RCIC Area Temperature Monitoring 7.6.1a.4.3.3.2.1 Circuit Description The area temperature monitoring circuit is similar to the one described for the HPCI area temperature monitoring system. (See Subsection 7.6.1a.4.3.8.2.)
7.6.1a.4.3.3.2.2 Logic and Sequencing Using one-out-of-two logic, the RCIC area temperature monitoring circuit activates an annunciator and initiates a RCIC isolation signal when the temperature rises above a preset limit.
7.6.1a.4.3.3.2.3 Bypasses and Interlocks A bypass/test switch is provided in each logic for the purpose of testing the temperature monitor without initiating RCIC system isolation.
Placing the keyswitch in Bypass position in one division will not prevent operation of the temperature monitor in the opposite division when required for RCIC system isolation. No interlocks are provided from this subsystem.
7.6.1a.4.3.3.2.4 Redundancy and Diversity Two physically and electrically independent channels of leak detection are supplied to those systems designed to isolate upon receipt of the leak detection signal(s) and required to meet the single failure and redundancy criteria.
7.6.1a.4.3.3.3 RCIC Steamline Pressure Monitoring 7.6.1a.4.3.3.3.1 Circuit Description Steamline pressure to the RCIC turbine is monitored to detect gross system leaks that may occur upstream of the dP element (elbow), causing the line pressure to drop to an abnormally low level.
This line pressure is monitored by the pressure sensors (see Subsection 7.4.1.1.3.6).
7.6.1a.4.3.3.3.2 Logic and Sequencing Pressure sensors using two-out-of-two logic detect abnormal low steamline pressure and initiate RCIC isolation signal.
7.6.1a.4.3.3.3.3 Bypasses and Interlocks No bypass or interlock provided.
7.6.1a.4.3.3.3.4 Redundancy and Diversity Redundancy is provided by redundant pressure sensors. No diverse method is employed to detect gross system leaks upstream of the elbow.
FSAR Rev. 71 7.6-6
SSES-FSAR Text Rev. 72 7.6.1a.4.3.3.4 RCIC Flow Rate Monitoring 7.6.1a.4.3.3.4.1 Circuit Description The steamline from the nuclear boiler to the RCIC turbine is instrumented with two differential pressure switches, one connected across each of two elbows in the line. The steam flow rate through the line is monitored by the switches, and a trip (isolation) occurs when leakage creates a steam line high flow condition. A time delay is incorporated to prevent inadvertent isolation. RCIC isolation is discussed in Subsection 7.4.1.1.3.6.
7.6.1a.4.3.3.4.2 Logic and Sequencing Redundant instrumentation consists of one differential pressure switch in each logic, sensing high flow through the RCIC inlet steam line.
Since isolation of the RCIC system is accomplished by independent actuation of either logic, a single failure of a system component in either logic will not prevent the required isolation function.
A 3 sec. time delay in each logic division prevents inadvertent system isolations due to pressure spikes.
7.6.1a.4.3.3.4.3 Bypass and Interlocks No bypasses or interlocks are provided.
7.6.1a.4.3.3.4.4 Redundancy and Diversity Isolation of the RCIC system is accomplished using two separate logics, each feeding their respective inboard and outboard isolation valves. Each logic incorporates a single channel of RCIC high steam flow monitoring instrumentation.
7.6.1a.4.3.4 Recirculation Pump Leak Detection 7.6.1a.4.3.4.1 Subsystem Identification The purpose of the recirculation pump leak detection subsystem is to monitor the rate of coolant seepage or leakage past the pump shaft seals. Excessively high rates of coolant flow past the seal will result in annunciator activation.
There are two recirculation pump leak detection systems, one for each of the pumps in the recirculation loop. The recirculation pump leak detection system consists of two types of monitoring circuits, (Figure 7.6-1). The first of these monitors the pressure levels within the seal cavities, presenting the plant operator with a visual display of the sensed pressure in each of the two cavities. The second type of monitoring circuit utilized by the leak detection system monitors the rate of liquid flow from the seal cavities.
7.6.1a.4.3.4.2 Pump Seal Cavity Pressure Monitoring 7.6.1a.4.3.4.2.1 Circuit Description The pressure levels within seal cavity No. 1 and seal cavity No. 2 are measured with identical instruments arranged similarly. Only one circuit, seal cavity No. 1 pressure monitoring, will be FSAR Rev. 71 7.6-7
SSES-FSAR Text Rev. 72 discussed. The pressure within seal cavity No. 1 is measured using a pressure transmitter. The pressure transmitter, produces an output signal whose magnitude is proportional to the sensed pressure within its dynamic range. This output signal is then applied to pressure indicators for plant operator readout.
7.6.1a.4.3.4.2.2 Logic and Sequencing No action is initiated by the pump seal cavity pressure monitoring circuit.
7.6.1a.4.3.4.2.3 Bypasses and Interlocks No bypass and interlocks are provided.
7.6.1a.4.3.4.2.4 Redundancy and Diversity No redundancy is provided in this monitoring circuit. The pump seal cavity pressure monitoring is a diverse method of leak detection to the seal cavity flow rate monitoring.
7.6.1a.4.3.4.3 Liquid Flow Rate Monitoring 7.6.1a.4.3.4.3.1 Circuit Description All condensate flowing past the recirculation pump seal packings and into the seal cavities is collected and sent by one of two drain systems to the drywell equipment sump for disposal. The first drain system drains the major portion of the condensate collected within the No. 2 seal cavity.
The condensate flow rate through the drain system is measured (high/low) by a flow switch. The point at which the microswitch closes can be adjusted so that switch actuation occurs only above or below certain flow rates.
Excessively high or low flow rates through this drain system will activate an annunciator in the main control room.
The second drain system drains the cavity beyond the No. 2 seal cavity collecting the condensate that has seeped (or leaked) past the outer seal. The condensate flow rate through this drain system is also measured (high), using a flow switch. The physical construction of this switch is similar to the flow switch described above, with only one contact set used to indicate the high flow rate. A high flow rate through this system will activate an annunciator in the main control room.
7.6.1a.4.3.4.3.2 Logic and Sequencing 7.6.1a.4.3.4.3.3 Bypasses and Interlocks The function of the pressure and flow rate instrumentation is to provide indication and annunciation.
There are no bypasses or interlocks associated with this subsystem.
7.6.1a.4.3.4.3.4 Redundancy and Diversity Redundant pressure and flow sensing instrumentation for detecting shaft seal leakage is not provided since the function of this instrumentation is to provide indication and annunciation.
Backup indication of seal leakage is provided, however, by monitoring both seal cavities to allow FSAR Rev. 71 7.6-8
SSES-FSAR Text Rev. 72 verification of seal failure. Excessive shaft seal leakage is collected by the drywell equipment sump.
7.6.1a.4.3.5 RHR System Leak Detection 7.6.1a.4.3.5.1 Subsystem Identification The shutdown cooling suction line of the RHR system is constantly monitored for leaks by the leak detection system. Leaks from the RHR shutdown cooling system are detected by ambient and differential temperature monitoring, flow rate and water level on the floor of the RHR Pump Rooms.
If the monitored parameters indicate a leak may exist the detection system activates an annunciator alarm. If high flow is detected, the system generates an isolation trip signal.
7.6.1a.4.3.5.2 RHR Area Temperature Monitoring 7.6.1a.4.3.5.2.1 Circuit Description Four ambient temperature and four differential temperature sensing circuits monitor the RHR Pump Rooms. Two circuits of each type are installed in each room. The circuits for Pump Room A are in electrical division I and the circuits for Pump Room B are in electrical division II.
7.6.1a.4.3.5.2.2 Logic and Sequencing Using one-out-of-two logic, the RHR area temperature monitor activates an annunciator when the observed temperature exceeds a preset limit.
7.6.1a.4.3.5.2.3 Bypasses and Interlocks No bypasses or interlocks are associated with this subsystem.
7.6.1a.4.3.5.2.4 Redundancy and Diversity Dual channels of ambient and differential temperature monitoring are provided for leak detection in the RHR system equipment area for each of the two logic trains. A single failure of a system component in either train will not prevent the required alarm.
7.6.1a.4.3.5.3 RHR Flow Rate Monitoring RHR Flow Rate Monitoring is discussed in subsection 7.3.1.1a.2.4.1.14. [Unit 1 only]
7.6.1a.4.3.5.3.1 Circuit Description [Unit 2 only]
Flow rate monitoring is provided on the RHR shutdown cooling suction line.
Flow rates in excess of the predetermined maximum are indicative of a line leak or break, and will generate differential pressure heads of sufficient magnitude to cause dPIS actuation and provide automatic closure of RHR inboard and outboard isolation valves.
FSAR Rev. 71 7.6-9
SSES-FSAR Text Rev. 72 7.6.1a.4.3.5.3.2 Logic and Sequencing [Unit 2 only]
Using one-out-of-one logic for each isolation valve, the flow rate monitoring circuit initiates a signal to isolate RHR inboard and outboard isolation valves when flow rate exceeds a preset limit.
7.6.1a.4.3.5.3.3 Bypasses and Interlocks [Unit 2 only]
There are no bypasses or interlocks in this system.
7.6.1a.4.3.5.3.4 Redundancy and Diversity [Unit 2 only]
Flow monitoring in the shutdown cooling return line utilizes two differential pressure switches, one for each logic. In both cases, RHR isolation is accomplished by independent actuation of either logic; consequently, a single failure in either logic will not prevent the required isolation function.
7.6.1a.4.3.5.4 This section has been deleted 7.6.1a.4.3.5.5 RHR Pump Room Flood (Water Level) Detection [Unit 1 only]
The RHR Pump Room is equipped with level switches to detect and alarm for water level on the floor of the room. The level switches will detect leakage of water from all portions of the RHR system in the Pump Rooms. One switch is installed in each of the two Pump Rooms and will initiate an alarm in the control room if the high level setpoint is reached.
7.6.1a.4.3.6 Reactor Water Clean-up System Leak Detection See Subsection 7.3.1.1a.2.4.1.9.
7.6.1a.4.3.7 Safety/Relief Valve Leak Detection 7.6.1a.4.3.7.1 Subsystem Identification Normally, the safety/relief valves are in the shut tight condition and are all at about the same temperature. Steam passage through the valve will elevate the sensed temperature at the exhaust, causing an "abnormal" temperature reading on the recorder. Switch contacts on the recorder, adjusted to actuate at a predetermined setpoint, close to complete an annunciator circuit.
Safety valve operation usually occurs only after relief valve actuation. Leakage from a valve is usually characterized by a temperature increase on a single input. As discussed in Subsection 18.1.24.3, each of the sixteen safety/relief valves are provided with an acoustic monitoring system to detect flow through the valve.
7.6.1a.4.3.7.2 Safety/Relief Valve Discharge Line Temperature Monitoring 7.6.1a.4.3.7.2.1 Description A temperature element (sensor) is placed in the discharge pipe of each of the sixteen (16) safety/relief valves for remote indication of leakage. The outputs of the temperature elements are sequentially sampled and recorded by one common temperature recorder. Each temperature element is compared against a setpoint value which if exceeded will be annunciated by one common annunciator. Thus, when the annunciator sounds, it is possible to ascertain which specific valve(s) may be leaking by observing the recorder printout.
FSAR Rev. 71 7.6-10
SSES-FSAR Text Rev. 72 7.6.1a.4.3.7.2.2 Logic and Sequencing No action is initiated by the safety/relief valve temperature monitoring circuit.
7.6.1a.4.3.7.2.3 Bypasses and Interlocks There are no bypasses or interlocks associated with this subsystem.
7.6.1a.4.3.7.2.4 Redundancy and Diversity No redundancy or diversity is required for this system.
7.6.1a.4.3.8 HPCI System Leakage Detecting 7.6.1a.4.3.8.1 Subsystem Identification The steamline of the high pressure coolant injection (HPCI) system are constantly monitored for leaks by the leak detection system. Leaks from the HPCI steamline will cause a change in at least one of the following monitored operating parameters: sensed area temperature, steam pressure, or steam flow rate. If the monitored parameters indicate that a leak may exist, the detection system responds by activating an alarm and depending upon the activating parameter, initiates HPCI auto-isolation action.
The HPCI leakage detection system consists of three types of monitoring circuits. The first of these monitors area ambient temperature, triggering the alarm circuit when the temperature rises above the preset maximum. The second type of circuit utilized by the leakage detection system monitors the flow rate, or differential pressure, through the steam line, triggering an alarm circuit when the flow rate exceeds a preset maximum. The third type of circuit utilized by the HPCI leakage detection system monitors the steam line pressure upstream of the differential pressure element.
Alarm outputs from all three circuits are also used to generate the HPCI auto-isolation signal. The ambient temperature monitoring is similar to that described in main steamline leakage detection system. Note that the high differential temperature isolation and isolation alarm function have been removed but the above equipment is still located in the field. The pre-isolation alarm function is still an active alarm.
7.6.1a.4.3.8.2 HPCI Area Temperature Monitoring 7.6.1a.4.3.8.2.1 Circuit Description The HPCI area and tunnel ambient and differential temperature sensing elements are thermocouples. Note that the high differential temperature isolation and isolation alarm function have been removed but the above equipment is still located in the field. Their outputs go to temperature switches set to activate at a preset temperature. Closing the temperature switches will light the point module alarm indicator and sound the high temperature alarm in the main control room. In addition, activation of the tunnel temperature switches will start the timer, which after a suitable delay period, initiates HPCI isolation valve closure. If at any time during the timing cycle, the temperature switch contacts are opened, the timer will automatically reset and no isolation valve closure will result. Before timer timeout, the operator can initiate isolation by depressing pushbutton switch HPCI ISOLATE. This action will bypass the timer circuits and, providing no logic test is in progress, the HPCI isolation valves will close.
FSAR Rev. 71 7.6-11
SSES-FSAR Text Rev. 72 HPCI equipment area ambient temperatures are monitored by local and emergency area cooler inlet temperature sensors.
High ambient temperature from the HPCI area initiates isolation valve closure.
The HPCI isolation valves do not receive an isolation signal for approximately one (1) second following actuation of either HPCI area temperature monitoring system or the tunnel temperature monitoring system. This time delay prevents false isolation signals from being sent to HPCI logic every time the temperature switches are energized.
7.6.1a.4.3.8.2.2 Logic and Sequencing The two division HPCI temperature monitors work on a one out of two logic that initiates the isolation logic. There are five temperature monitors per division which consist of three area (two ambient and one differential) and two tunnel (one ambient and one differential) temperature monitors. The tunnel temperature signals are time delayed before initiating the isolation logic.
Note that the high differential temperature isolation and isolation alarm function have been removed but the above equipment is still located in the field.
7.6.1a.4.3.8.2.3 Bypasses and Interlocks A bypass/test switch is provided in each logic division for the purpose of testing the HPCI logic without initiating HPCI system isolation. Placing the keyswitch in Bypass position in one division will not prevent operation of the temperature monitor in the opposite division when required for HPCI system isolation. No interlocks are provided from this subsystem. Note that the high differential temperature isolation and isolation alarm function have been removed but the above equipment is still located in the field.
7.6.1a.4.3.8.2.4 Redundancy and Diversity There are two independent HPCI leakage detection divisions. The HPCI area ambient temperature monitoring is a diverse method of HPCI leak detection to the HPCI steam line pressure and flow rate (differential pressure) monitoring.
7.6.1a.4.3.8.3 HPCI Steam Flow Monitoring 7.6.1a.4.3.8.3.1 Description The steamline from the nuclear boiler leading to the HPCI turbine is instrumented so that the steam flow rate through it, and its pressure, can be monitored and used to indicate the presence of a leak or break. In the presence of a leak, the HPCI system responds by operating the auto-isolation signal. This portion of the discussion on HPCI system leakage detection is limited to the flow rate instrumentation and does not cover the system isolation procedures. Steam flowing through the steam line will develop a differential pressure head across the elbow located inside the primary containment. The magnitude of the head proportional to the square of the flow rate is measure by a dPIS. Flow rates in excess of the predetermined maximum indicative of a line leak or break will generate differential pressure heads of sufficient magnitude to cause a dPIS actuation. Actuation occurs following a preset time delay to prevent inadvertent isolation. HPCI isolation is discussed in Subsection 7.3.1.1a.1.3.7.
FSAR Rev. 71 7.6-12
SSES-FSAR Text Rev. 72 7.6.1a.4.3.8.3.2 Logic and Sequencing Using one-out-of-two logic, the HPCI steam flow monitoring circuit initiates a HPCI isolation signal when the flow rate exceeds a preset limit.
7.6.1a.4.3.8.3.3 Bypasses and Interlocks See paragraph 7.6.1a.4.3.8.2.3.
7.6.1a.4.3.8.3.4 Redundancy and Diversity There are two independent HPCI leakage detection channels.
7.6.1a.4.3.8.4 HPCI Steamline Pressure Monitoring 7.6.1a.4.3.8.4.1 Circuit Description Steamline pressure to the HPCI turbine is monitored to detect gross system leaks that may occur upstream of the dP element, causing the line pressure to drop to an abnormally low level. Line pressure is monitored by pressure switches, actuating on low pressure to also generate the auto-isolation signal.
7.6.1a.4.3.8.4.2 Logic and Sequencing Using two-out-of-two logic, the HPCI steamline pressure monitoring circuit initiates a HPCI isolation signal when the pressure falls below a preset limit.
7.6.1a.4.3.8.4.3 Bypasses and Interlocks See Subsection 7.6.1a.4.3.8.2.3 for discussion.
7.6.1a.4.3.8.4.4 Redundancy and Diversity There are two independent HPCI leakage detection channels.
7.6.1a.4.4 System and Subsystem Separation Criteria See Section 3.12 for discussion on separation.
7.6.1a.4.5 System and Subsystem Testability The proper operation of the sensor and the logic associated with the leak detection systems is verified during the leak detection system preoperational test and, during inspection tests that are provided for the various components during plant operation. Each temperature switch, both ambient and differential types, is connected to dual thermocouple elements.
Each temperature switch contains a trip light which lights when the temperature exceeds the setpoint. In addition, keylock test switches are provided so that logic can be tested without sending an isolation signal to the system involved. Thus, a complete system check can be confirmed by checking activation of the isolation relay associated with each switch.
FSAR Rev. 71 7.6-13
SSES-FSAR Text Rev. 72 RWCU differential flow leak detection alarm units are tested by inputting a voltage signal to simulate a high differential flow. Alarm and indicator lights monitor the status of the trip circuit.
Testing of flow, reactor vessel level, and pressure leak detection equipment is described in Subsections 7.3.1.1a.1, and 7.3.1.1a.2.
7.6.1a.4.6 System and Subsystem Environmental Considerations The sensors, wiring, and electronics of the leak detection system which are associated with the isolation valve logic are designed to withstand the envelope conditions that follow a LOCA (see Section 3.11).
All portions of the leak detection system which provide for isolation of other systems or portions of systems are environmentally qualified to meet the requirements for Class I electrical equipment (see Section 3.11).
7.6.1a.4.7 System and Subsystem Operational Considerations The operator is kept aware of the status of the leak detection system through meters and recorders which indicate the measured variables in the control room. If a trip occurs, the condition is continuously annunciated in the main control room.
Leak detection system bypass switches are provided on a backrow panel in the main control room to allow bypassing of certain trip functions during testing.
The operator can manually operate valves which are affected by the leak detection system during normal operation. When a trip conditions exists, the isolation logic must be reset before further manual valve operations can be performed. Manual reset switches are provided in the main control room.
There is no vital supporting system which supplies direct support for the leak detection systems.
7.6.1a.5 Neutron Monitoring System-Instrumentation and Controls The neutron monitoring system consists of seven major subsystems:
(1) Source range monitor subsystem (SRM),
(2) Intermediate range monitor subsystem (IRM),
(3) Local power range monitor subsystem (LPRM),
(4) Average power range monitor subsystem (APRM),
(5) Rod block monitor subsystem (RBM), and (6) Traversing in-core probe subsystem (TIP).
(7) Oscillation Power Range Monitor Subsystem (OPRM)
FSAR Rev. 71 7.6-14
SSES-FSAR Text Rev. 72 7.6.1a.5.1 System Identification The purpose of this system is to monitor the power in the core and provide signals to the RPS and the rod block portion of the reactor manual control system. It also provides information for operation and control of the reactor and for post-accident conditions.
The IRM, OPRM and APRM subsystems provide a safety function, and have been designed to meet particular requirements established by the NRC. The LPRM subsystem has been designed to provide a sufficient number of LPRM inputs to the APRM and OPRM subsystems to meet the APRM and OPRM requirements. All other portions of the Neutron Monitoring System have no safety function. The system is classified as shown in Table 3.2-1. The safety-related subsystems are qualified in accordance with Sections 3.10 and 3.11.
7.6.1a.5.2 Power Source The power sources for each system are discussed in the individual descriptions.
7.6.1a.5.3 Source Range Monitor (SRM) Subsystem The SRM is a non-safety subsystem. See Subsection 7.7.1.13.
7.6.1a.5.4 Intermediate Range Monitor (IRM) Subsystem 7.6.1a.5.4.1 Equipment Design 7.6.1a.5.4.1.1 Description The IRM monitors neutron flux from the upper portion of the SRM range to the lower portion of the power range. The IRM subsystem has eight IRM channels, each of which includes one detector that can be positioned in the core by remote control. The detectors are inserted into the core for a reactor startup and are withdrawn after the reactor mode selector switch is turned to RUN.
(1) Power Supply Power is supplied separately from two 24 VDC sources. The supplies are split according to their uses so that loss of a power supply will result in loss of only one trip system of the reactor protection system.
(2) Physical Arrangement Each detector assembly consists of a miniature fission chamber attached to a low-loss, quartz-fiber-insulated transmission cable. When coupled to the signal conditioning equipment, the detector produces a reading of full scale on the most sensitive range with a neutron flux of 4 x 108 nv. The detector cable is connected underneath the reactor vessel to a triple-shielded cable that carries the pulses generated in the fission chamber to the preamplifier.
The detector and cable are located in the drywell. They are movable in the same manner as the SRM detectors and use the same type of mechanical arrangement (see Figures 7.6-5 and 7.6-6 and Reference 7.6-1).
FSAR Rev. 71 7.6-15
SSES-FSAR Text Rev. 72 (3) Signal Conditioning A voltage amplifier unit located outside the drywell serves as a preamplifier. This unit converts the current pulses to voltage pulses, modifies the voltage signal, and provides impedance matching. The preamplifier output signal is coupled by a cable to the IRM signal conditioning electronics (see Figure 7.6-9).
Each IRM channel receives its input signal from the preamplifier and operates on it with various combinations of preamplification gain and amplifier attenuation ratios. The amplification and attenuation ratios of the IRM and preamplifier are selected by a remote range switch that provides 10 ranges of increasing attenuation (the first 6 called low range and the last 4 called high range) acting on the signal from the fission chamber. As the neutron flux of the reactor core increases from 1 x 108 nv to 1.5 x 1013 nv, the signal from the fission chamber is attenuated to keep the input signal to the inverter in the same range.
The output signal, which is proportional to neutron flux at the detector, is amplified and supplied to a locally mounted meter. Outputs are also provided for a remote meter and recorder.
(4) Trip Functions The IRM Scram Trip Functions are discussed in Section 7.2. The IRM trips are shown in Table 7.6-3. The IRM Rod Block Trip Functions are discussed in Subsection 7.7.1.2.6.
7.6.1a.5.4.1.1.1 Bypasses and Interlocks The arrangement of IRM channels allows one IRM channel in each group to be bypassed without compromising intermediate range neutron monitoring.
7.6.1a.5.4.1.2 Redundancy The IRM system consists of 8 IRM channels, four of which are connected to one trip system, and the other four are connected to the other trip system. The redundancy and single failure requirements are met because any single failure with the IRM system cannot prevent needed safety action of the IRM system. (See also Subsection 7.2.1.1.4.2.)
7.6.1a.5.4.1.3 Testability Each IRM channel is tested and calibrated using the procedures listed in the IRM instruction manual as a reference. The IRM detector drive mechanisms and the IRM rod blocking functions are checked in the same manner as for the SRM channels. Each IRM channel can be checked to ensure that the IRM high flux scram function is operable.
7.6.1a.5.4.2 Environmental Conditions The wiring, cables, and connectors located in the drywell are designed for the same environmental conditions as the SRMs.
The IRM pre-amplifier, located in the reactor building and the monitor, located in the control room, are designed to operate under all expected environmental conditions in those areas. The IRM system components are designed to operate during and after certain design basis events such as earthquakes, accidents, and anticipated operational occurrences.
FSAR Rev. 71 7.6-16
SSES-FSAR Text Rev. 72 7.6.1a.5.4.3 Operational Considerations The IRM range switches must be upranged or downranged to follow increases and decreases in power within the range of the IRM to prevent either a scram or a rod block. The IRM detectors must be inserted into the core whenever these channels are needed, and withdrawn from the core, when permitted, to prevent their burnup. The identification scheme for the IRM subsystem is given in Subsection 7.2.2.1.2.3.1.22.
The method used for identifying power and signal cables and raceways as safety-related equipment, and the identification scheme used to distinguish between redundant cables, raceways, and instrument panels is in accordance with the recommendations of IEEE 279-1971, Paragraph 4.6.
7.6.1a.5.5 Local Power Range Monitor (LPRM) Subsystem 7.6.1a.5.5.1 Equipment Design 7.6.1a.5.5.1.1 Description The LPRM consists of fission chamber detectors, signal conditioning equipment, and trip functions. The LPRM provides outputs to the APRM, the RBM, and the plant computer. One of the LPRM detector assemblies also contains electrodes to measure the electrochemical corrosion potential (ECP) of the reactor water. The LPRM signal processing is performed by the electronic equipment that performs the APRM functions.
(1) Power Supply Detector polarizing voltage for the LPRMs is supplied by eight pairs of redundant LPRM detector DC power supplies, adjustable from 75 to 200 VDC. Each LPRM detector DC power supply pair powers approximately one-eighth of the LPRMs. Power for the LPRM detector DC power supplies comes redundantly from the two 120 Vac buses via intervening DC power supplies.
The LPRM detector DC power supplies are located in the electronic chassis that houses the LPRM signal processing equipment. Each electronic chassis houses one pair of LPRM detector DC power supplies and the electronics for processing approximately one-eighth of the total LPRM detector signals (or approximately one-half of the 43 detectors per APRM/LPRM channel).
The intervening DC supplies are located in a separate power supply chassis. Each power supply chassis contains up to 4 Low Voltage DC Power Supplies (LVPSs). One of the 120 Vac busses provides input power to 2 of the LVPSs in the power supply chassis while the second 120 Vac bus provides input power to the other two LVPSs in the power supply chassis. Two of the LVPSs in the power supply chassis, one operating from each of the two 120 Vac busses, supply auctioned low voltage power to the electronic chassis. If either of the two 120 Vac power busses is lost, or if either of the two LVPSs fail, the remaining LVPSs will continue to supply low voltage power to the electronic chassis.
FSAR Rev. 71 7.6-17
SSES-FSAR Text Rev. 72 The auctioned low voltage power input to the electronic chassis provides power to each pair of LPRM detector DC power supplies in the electronic chassis and the LPRM (and APRM) signal processing hardware in the chassis. The LPRM detector polarizing voltage for all of the detectors processed by the electronic chassis (21 in one chassis and 22 in the other) is normally provided by one of the two LPRM detector DC power supplies in the electronic chassis. If that one DC power supply fails, the second LPRM detector DC power supply is automatically switched in to supply LPRM detector polarizing voltage.
The 75 - 200 Vdc LPRM detector DC power supplies can supply up to 3 milliamperes for each LPRM detector, which ensures that the chambers can be operated in the saturated region at the maximum specified neutron fluxes. The voltage applied to the detectors varies no more than 2 Vdc over the maximum variation of electrical input and environmental parameters.
(2) Physical Arrangement The LPRM includes 43 LPRM detector strings having detectors located at different axial heights in the core; each detector string contains four fission chambers. These assemblies are distributed to monitor four horizontal planes throughout the core. Figure 7.6-3 shows the LPRM detector radial layout scheme that provides a detector assembly at every fourth intersection not containing control crosses of the water channels around the fuel bundles.
Thus, the uncontrolled water gap has either an actual detector assembly or a symmetrically equivalent assembly in some other quadrant. The detector assemblies (see Figure 7.6-10) are inserted in the core in spaces between the fuel assemblies. They are inserted through thimbles mounted permanently at the bottom of the core lattice and penetrate the bottom of the reactor vessel. These thimbles are welded to the reactor vessel at the penetration point. They extend down into the access area below the reactor vessel where they terminate in a flange. The flange mates to the mounting flange on the in-core detector assembly. The detector assemblies are locked at the top end to the top fuel guide by means of a spring loaded plunger. Special water sealing caps are placed over the connection end of the assembly and over the penetration at the bottom of the vessel during installation or removal of an assembly. This prevents loss of reactor coolant water on removal of an assembly and also prevents the connection end of the assembly from being immersed in the water during installation or removal.
Each LPRM detector assembly contains four miniature ion chambers with an associated solid sheath cable. The chambers are vertically spaced in the LPRM detector assemblies in a way that gives adequate axial coverage of the core, complementing the radial coverage given by the horizontal arrangement of the LPRM detector assemblies. Each ion chamber produces a current that is coupled with the LPRM signal conditioning equipment to provide the desired scale indications.
FSAR Rev. 71 7.6-18
SSES-FSAR Text Rev. 72 Each miniature chamber consists of two concentric cylinders, which act as electrodes.
The inner cylinder (the collector) is mounted on insulators and is separated from the outer cylinder by a small gap. The gas between the electrodes is ionized by the charged particles produced as a result of neutron fissioning of the uranium-coated outer electrode.
The chamber is operated at a polarizing potential of approximately 100 VDC. The negative ions produced in the gas are accelerated to the collector by the potential difference maintained between the electrodes. In a given neutron flux, all the ions produced in the ion chamber can be collected if the polarizing voltage is high enough. When this situation exists, the ion chamber is considered to be saturated. Output current is then independent of operating voltage (Reference 7.6-1).
Each assembly also contains a calibration tube for a traversing in-core probe. The enclosing tube around the entire assembly contains holes that allow circulation of the reactor coolant water to cool the ion chambers. Numerous tests have been performed on the chamber assemblies including tests of linearity, lifetime, gamma sensitivity, and cable effects (Reference 7.6-1). These tests and experience in operating reactors provide confidence in the ability of the LPRM subsystem to monitor neutron flux to the design accuracy throughout the design lifetime.
One of the LPRM detector assemblies also contains special electrodes for measuring the electrochemical corrosion potential (ECP) of the reactor water in the lower head area of the reactor vessel. Except for sharing a common housing the ECP electrodes are completely independent of the ion chambers. The electrodes are located below the active core region and do not effect the neutron monitoring design of the LPRM detector assembly nor any of the neutron monitoring description or evaluation contained in this section. The ECP electrodes used solid sheath cable identical to that used for the ion chambers. The cable is brazed to the electrodes to provide a hermetic seal. The cable is brought out of the ECP/LPRM assembly using the same seal design as the ion chamber cables. The ECP electrodes provide analog signals to the Water Chemistry Data Acquisition System.
Although the LPRM assembly with ECP electrodes may be located in any of the 43 LPRM detector assembly locations its specific location is based on ECP monitoring considerations.
(3) Signal Conditioning The current signals from the LPRM detectors are transmitted to LPRM amplifiers located on LPRM Input Modules in the APRM/LPRM electronic chassis in the Lower Relay Room. Each LPRM Input Module provides amplification for up to 5 LPRM detector signals. The current signal from a chamber is transmitted directly to its amplifier through coaxial cable. The amplifier is a linear current amplifier whose voltage output is proportional to the current input and therefore proportional to the magnitude of the neutron flux. The amplifier output is read by the digital processing electronics. The digital electronics apply hardware gain corrections, performs filtering, and applies the LPRM gain factors. The digital electronics provide suitable output signals for the computer, recorders, annunciators, etc. The LPRM amplifiers also isolate the detector signals from the rest of the processing so that individual faults in one LPRM signal path will not affect other LPRM signals.
The LPRM signals are indicated on the unit operating benchboard. Subsection 7.7.1.2.5 describes the indications on the reactor control panel.
FSAR Rev. 71 7.6-19
SSES-FSAR Text Rev. 72 (4) Trip Functions The trip functions for the LPRM provide trip signals to activate annunciators and displays on the Unit operating benchboard. Table 7.6-4 indicates the trips.
The trip levels can be adjusted to within + 0.1% of full-scale deflection and are accurate to
+ 1% of full-scale deflection in the normal operating environment.
7.6.1a.5.5.1.2 Bypasses and Interlocks Each LPRM channel may be individually bypassed.
When the maximum number of bypassed LPRMs associated with an APRM channel has been exceeded, an APRM trouble alarm is generated by that APRM.
If the number of LPRMs available for an OPRM cell is less than the minimum required, the OPRM will no longer use that cell in its calculations. If less than the minimum number of cells is available to an OPRM, an inoperative alarm is generated by that OPRM.
7.6.1a.5.5.1.3 Redundancy The LPRM channels meet the redundancy criterion because of the multiplicity of sensing channels.
The minimum number of LPRMs that must be in service is shown in Dwgs. M1-C51-35, Sh. 1 and M1-C51-35, Sh. 2.
7.6.1a.5.5.1.4 Testability LPRM channels are calibrated using data from previous full power runs and TIP data and are tested with procedures in the applicable instruction manual.
7.6.1a.5.5.2 Environmental Considerations Each individual chamber of the assembly is a moisture-proof, pressure sealed unit. The chambers are designed to operate up to 600oF and 1250 psig. The wiring, cables, and connectors located within the drywell are designed for continuous duty up to 270oF; 100% relative humidity and a 4-hour single exposure rating of 482oF at 100% relative humidity. The LPRMs are capable of functioning during and after certain design basis events such as earthquakes and anticipated operational occurrences.
7.6.1a.5.5.3 Operational Considerations The LPRM is a monitoring system with no special operating considerations.
7.6.1a.5.6 Average Power Range Monitor (APRM) Subsystem (References 7.6-1 through 7.6-4)
FSAR Rev. 71 7.6-20
SSES-FSAR Text Rev. 72 7.6.1a.5.6.1 Equipment Design 7.6.1a.5.6.1.1 Description The APRM subsystem has four APRM channels. The APRM subsystem equipment performs both the APRM and OPRM functions. Each APRM uses input signals from 43 LPRM detectors.
Each of the four APRM channels provides input to four 2-out-of-4 voter channels. Two of the voter channels are associated with each of the trip systems of the Reactor Protection System.
(1) Power Supply Power for the LPRM, associated APRM/OPRM channel, and the RBMs channels is provided by the two independent 120 Vac power sources used for RPS. Each APRM 2-out-of-4 voter channel receives power from one of the two 120 Vac busses with each bus supplying power to two of the voter channels. The APRM, OPRM, LPRM and RBM functions will continue to operate as long as either of the two 120 Vac busses is still available. However, if one of the two 120 Vac busses is lost, the two voter channels supplied by that bus will go to the tripped state resulting in a RPS half scram.
(2) Signal Conditioning The APRM channel uses digital electronic equipment that averages the output signals from a selected set of LPRMs, generates trip outputs via the 2-out-of-4 voter channels (see Section 7.6.1a.5.6.1.1(3)), and provides signals to readout equipment.
Each APRM channel can average the output signals from up to 43 LPRM channels.
Assignment of LPRM channels to an APRM follows the pattern shown in Dwgs. M1-C51-35, Sheets 1 and 2. Position A is the bottom position, Positions B and C are above Position A, and Position D is the topmost LPRM detector position. The pattern provides LPRM signals from all four core axial LPRM detector positions throughout the core. Some LPRM detectors may be bypassed, but the averaging logic automatically corrects for these by removing them from the average.
The APRM flux value is developed by averaging the LPRM signals and then adjusting the average by a digitally entered factor to allow calibration of the APRM to be APRM power. The APRM power is processed through a first order filter with a six second time constant to calculate simulated thermal power. The APRM simulated thermal power upscale rod block and scram trip setpoints are varied as a function of reactor recirculation flow. The slope of the upscale rod block and scram trip response curves is set to track the required trip setpoint with recirculation flow changes. These calculations are all performed by the digital processor and result in a digital representation of APRM power (unfiltered) and simulated thermal power, and of the flow-biased rod block and scram setpoints.
Each APRM channel calculates a flow signal that is used to determine the APRMs flow-biased rod block and scram setpoints (see Dwgs. M1-B31-13, Sheets 2 and 3). Each signal is determined by summing the flow signals from the two recirculation loops.
These signals are sensed from two flow elements, one in each recirculation loop. The differential pressure from each flow element is routed to four differential pressure transducers (eight total). The signals from two differential pressure transducers, one from each flow element, are routed to two inputs to each APRM channels digital electronics.
FSAR Rev. 71 7.6-21
SSES-FSAR Text Rev. 72 Each APRM also includes an OPRM Trip Function. For this function, LPRMs are assigned to up to four OPRM cells, with each cell including 4 LPRMs. The OPRM function combines the signals from each LPRM in an OPRM cell and evaluates that combined cell signal using the OPRM algorithms to detect thermal-hydraulic instabilities.
All APRM channels are powered redundantly, via intervening low voltage DC power supplies, from both of the two 120 Vac RPS power busses. The LPRM signal processing equipment is powered by the same sources as their associated APRM channels.
(3) Trip Function The APRM trip functions are performed by digital comparisons within APRM electronics.
For each RPS trip and rod block alarm, the APRM power or simulated thermal power, as applicable, is compared to the setpoint. If the power value exceeds the setpoint, the applicable trip is issued. Trip signals from each APRM channel are provided via APRM interface hardware directly to the Reactor Manual Control System and via the APRM 2-out-of-4 voter channels to the Reactor Protection System (RPS). APRM system trips are summarized in Table 7.6-5.
An OPRM trip output is generated from an APRM channel when the period based detection algorithm in that channel detects oscillatory changes in the neutron flux, indicated by the combined signals for the LPRM detectors in a cell, with the period confirmations and relative cell amplitude exceeding specific setpoints. One or more cells in a channel exceeding the trip conditions will result in a channel trip. An OPRM trip is also issued from any APRM channel if either the growth rate or amplitude based algorithms detect growing oscillatory changes in the neutron flux from one or more cells in that channel. The OPRM trip output is automatically enabled (not-bypassed) when the APRM STP is equal to or above the OPRM auto-enable power setpoint and recirculation flow is equal to or below the OPRM auto-enable flow setpoint. The OPRM trip output is automatically bypassed when STP and recirculation flow are not within the OPRM trip enabled region. The OPRM trip is active only when the reactor mode switch is in the RUN position. OPRM trips are summarized in Table 7.6-7.
At least two unbypassed APRM channels must be in the APRM high trip or inoperative trip state to cause an APRM/Inop RPS trip output from the APRM 2-out-of-4 voter channels (see Figure 7.6-12a). Similarly, at least two unbypassed APRM channels must be in the OPRM trip state to cause an OPRM RPS trip output from the APRM 2-out-of-4 voter channels. The APRM/Inop and OPRM trips are voted independently. In either of these conditions, all four voter channels will provide a RPS trip output, two to each RPS trip system. If only one unbypassed APRM channel is providing a trip output, each of the four APRM 2-out-of-4 voter channels will have a half-trip, but no trip signals will be sent to the RPS. Trip outputs to the RPS are transmitted by removing voltage to a relay coil, so loss of power results in actuating the RPS trips. A simplified APRM/RPS interface circuit arrangement is shown in Figure 7.2-6-1.
Any one unbypassed APRM can initiate a rod block. Subsection 7.7.1.2, Reactor Manual Control System, describes in more detail the APRM rod block functions.
FSAR Rev. 71 7.6-22
SSES-FSAR Text Rev. 72 In the startup mode of operation, the APRM fixed high trip setpoint is set down to a low level. This trip function is provided in addition to the existing IRM upscale trip in the startup mode.
The trips from one APRM channel can be bypassed by operator action in the control room, which bypasses both the APRM/Inop and OPRM trips from that APRM channel.
(4) Post-Accident Neutron Flux Monitoring Function The APRM System provides redundant post-accident neutron flux monitoring required by Regulatory Guide 1.97, Revision 2, via APRM Channels 1-4.
The use of the conventional NMS to perform the post-accident monitoring function was evaluated from an Emergency Procedure Guideline (EPG) standpoint in NEDO-31558A.
NEDO-31558A provides alternate criteria for the NMS to meet the post-accident monitoring Guidance of Regulatory Guide 1.97. Based on the results of this BWROG report and a SSES specific review, it is concluded that the SSES APRMs will provide the required post-accident neutron flux monitoring capabilities.
7.6.1a.5.6.1.2 Bypasses and Interlocks The APRM amplifier gain can be adjusted by combining fixed resistors and potentiometers to allow calibration. The averaging circuit automatically corrects for the number of unbypassed LPRM amplifiers providing inputs to the APRM.
One of the four APRM channels can be bypassed at any time. None of the APRM 2-out-of-4 voter channels can be bypassed. An interlock circuit provides an APRM trouble alarm whenever the number of LPRM inputs to an APRM or the number of operable OPRM cells is less than the required minimum.
7.6.1a.5.6.1.3 Redundancy Four independent APRM channels monitor neutron flux for both APRM and OPRM trips and each channel provides inputs to all four independent APRM 2-out-of-4 voter channels. A trip condition in any one APRM channel does not cause the APRM 2-out-of-4 voters to initiate a trip in any RPS trip system. The APRM 2-out-of-4 voters must receive a trip signal from at least two unbypassed APRM channels in order to initiate a trip in any RPS trip system.
7.6.1a.5.6.1.4 Testability APRM channels are calibrated using data from previous full power runs and are tested by procedures in the applicable instruction manual. Each APRM channel can be tested individually for the operability of the APRM scram and rod blocking functions by introducing test signals.
7.6.1a.5.6.2 Environmental Considerations All APRM equipment is installed and operated in the control structure environment as described in Table 3.11-1. The APRM system is capable of functioning during and after certain design basis events such as earthquakes and anticipated operational occurrences.
FSAR Rev. 71 7.6-23
SSES-FSAR Text Rev. 72 7.6.1a.5.6.3 Operational Considerations The APRM system is a monitoring system which has no special operational considerations.
The method used for identifying power and signal cables and raceways as safety-related equipment, and the identification scheme used to distinguish between redundant cables, raceways, and instrument panels is in accordance with the requirements of IEEE 279-1971, Paragraph 4.6.
7.6.1a.5.7 Rod Block Monitor (RBM) Subsystem See Subsection 7.7.1.11.
7.6.1a.5.8 Traversing In-Core Probe Subsystem The TIP system is discussed in Subsection 7.7.1.6.
7.6.1a.6 Rod Block Trip System - Instrumentation and Controls See Subsection 7.7.1.2.6.
7.6.1a.7 Rod Sequence Control System (RSCS) - Instrumentation and Controls See Subsection 7.7.1.2.7.
7.6.1a.8 Recirculation Pump Trip (RPT) System - Instrumentation and Controls 7.6.1a.8.1 System Identification The recirculation pump trip system includes the sensors, logic circuitry, switches and circuit breakers that cause main power to be disconnected from both recirculation pumps upon closure signals from the turbine stop valves or turbine control valve in the event of a turbine trip or generator load rejection.
The recirculation trip system is designed to aid the RPS in protecting the integrity of the fuel barrier.
Turbine stop valve closure or turbine control valve fast closure will initiate a scram and concurrent recirculation trip in order to keep the core within the thermal hydraulic safety limits during operational transients.
7.6.1a.8.1.1 Safety Classification The recirculation pump trip (RPT) system is a Class 1E system.
7.6.1a.8.1.2 Reference Design The RPT system is not similar to any previous design although it does share certain redundant sensors and logic circuitry with the reactor protection system (RPS).
FSAR Rev. 71 7.6-24
SSES-FSAR Text Rev. 72 7.6.1a.8.2 Power Sources The RPT system utilizes the 120 VAC RPS power supplies for the instrumentation sensors and RPS relays. The RPT system utilizes 125 VDC for the logic and the breaker trip coils. The 125 VDC is supplied by two separate divisions of Class 1E station batteries.
7.6.1a.8.3 Equipment Design 7.6.1a.8.3.1 Initiating Circuits Initiating circuitry is shown on Dwgs. M1-C72-22 Sheets 6, 7, 8, 9 and 17. RPS inputs sense turbine stop valve closure (turbine trip) or turbine control valve fast closure (load rejection). These inputs utilize four-division RPS logic and are combined into the two-divisional two-out-of-two systems utilized for RPT function. The devices utilized to sense turbine trip and full load rejection are discussed in Subsection 7.2.1.1.4.4.2.
7.6.1a.8.3.2 Logic The basic logic arrangement is shown in Dwgs. M1-C72-2, Sh. 1, M1-C72-2, Sh. 2, M1-C72-2, Sh. 3 and M1-C72-2, Sh. 4. RPT Logic is a Two Divisional Two-out-of-two once design for both the control and stop valve logic.
The logic functions such that:
(1) The closing of one Turbine Stop Valve will not cause an RPT trip.
(2) The closing of two Turbine Stop Valves may or may not cause an RPT trip depending on which stop valves are closed.
(3) The closing of three or more Turbine Stop Valves will always yield a RPT trip.
A Permissive for Equivalent Reactor Power above 26% equated to Turbine First Stage Pressure is in series with the combined Turbine Valve Logic Train. Initiation requires confirmation by sensors located in two RPS Divisions and represents an energize to actuate circuit.
There are four RPT Breakers. Each division of RPT logic controls two breakers. Of these two breakers, one is in series with each Recirculation Pump Motor Power Supply such that a single division RPT Actuation will trip both Recirc Pumps. See Subsection 7.7.1.3.3.2.1 for a discussion of ATWS trip.
7.6.1a.8.3.3 Instrument Piping Instrument piping is not required except for system bypass by main turbine first stage pressure which is described in Subsection 7.2.1.1.4.4.2. Cables from sensors and power cables are routed such that no single event involving a single panel, cabinet, or raceway can disable the RPT function.
FSAR Rev. 71 7.6-25
SSES-FSAR Text Rev. 72 7.6.1a.8.3.4 Actuated Devices The actuator logic allows current to flow into the breaker trip coils when a trip signal is received.
The breakers interrupt the main power supply to each Recirculation Pump Motor when the coil is energized.
7.6.1a.8.3.5 Separation Sensors utilized to monitor for turbine trip and full load rejection are incorporated in the reactor protection system, where they are combined into a two-divisional system for input to the RPT system. All system wiring outside the cabinets is run in accordance with applicable separation requirements.
7.6.1a.8.3.6 Testability See Subsection 7.2.1.1.4.8.
7.6.1a.8.4 Environmental Considerations The electrical modules and sensors are located in the control structure and/or the turbine building.
The environmental conditions for these areas are shown in Section 3.11.
7.6.1a.8.5 Operational Considerations 7.6.1a.8.5.1 General Information Actuator logic is designated A, B, C, and D and actuation devices (breaker trip coil) by Divisions 1 and 2. During normal operation the conditions of sensors and logic devices is shown in Dwgs. M1-C72-2, Sh. 1, M1-C72-2, Sh. 2, M1-C72-2, Sh. 3 and M1-C72-2, Sh. 4.
7.6.1a.8.5.2 Reactor Operator Information (1) Indicators
- a. Trip initiate indicators, wired across the trip contacts, extinguish when actuator logic closes the contact to the breaker trip coil. These indicators also monitor the continuity of the trip coils when the breaker is closed.
- b. Breaker tripped indicators are energized when the breaker is physically open (i.e., tripped).
(2) Annunciators
- a. Trip initiate annunciation is indicated by trip channel monitoring.
- b. Trip condition of the breakers is annunciated.
7.6.1a.8.5.3 Setpoints Initiate signals are provided by the RPS and are covered under Subsection 7.2.1.1.6.3.
FSAR Rev. 71 7.6-26
SSES-FSAR Text Rev. 72 7.6.1a.8.6 IEEE-279 Design Basis Considerations IEEE Standard 279-1971 Section 3 Paragraphs 1 through 9 defines the design-basis requirements.
A listing of each of these requirements and its applicability to the RPT system is as follows:
(1) Document the Generating Station conditions which require protective action - RPT is a system which assists to suppress the magnitude of the reactor power rise as a result of a turbine or generator trip and resulting reactor high pressure condition. No additional conditions requiring protective action are involved.
(2) Generating station variables - the RPT system monitors turbine stop valve position, turbine control valve position, and reactor power level.
(3) Documentation of minimum number and location of sensors required to monitor adequately.
(a) The RPT system is based on two separate trip divisions, each of which has at least two sensors.
(b) Location of sensors is described under Subsection 7.2.2.1.2.3.1.
(4) Operational Limits (a) Turbine Stop Valve Normal operation is with valve fully open.
(b) Turbine control Valve Normal operation is from fully open to fully closed.
(5) Margin between Operational Limit and Unsafe Condition (a) Turbine Stop Valve Closure The start of the turbine stop valve closure event is defined as the beginning of turbine stop valve motion from its original fully open position.
(b) Turbine Control Valve Fast Closure The start of the turbine control valve fast closure event is defined as the change of state of the control valve hydraulic pressure switch.
(6) Levels that, when reached, will require protective action.
(a) Turbine Stop Valve Closure The trip setpoint is a fixed valve position less than 100% open but greater than 90%
open. This has no effect below 26% equivalent reactor power, when the trip function is bypassed.
(b) Turbine Control Valve Fast Closure The trip setpoint is the start of control valve fast closure. This has no effect below 26% equivalent reactor power, when the trip function is bypassed.
FSAR Rev. 71 7.6-27
SSES-FSAR Text Rev. 72 (7) Document the Range of Transient and Steady State Conditions Throughout Which the System Must Perform - See Subsections 8.3.1, 8.3.2, 3.10 and 3.11.
(8) Document the Malfunctions, Accidents and Other Unusual Events which could cause Damage - see Subsections 7.2.1.2.8, and 7.3.1.2.8.
(9) Document minimum performance requirements - see Table 7.2-1.
7.6.1a.9 Process Computer System-Rod Worth Minimizer (RWM) - Instrumentation and Controls See Subsection 7.7.1.2.8 7.6.1b DESCRIPTION The following discussion describes non-NSSS, safety-related instrumentation and controls:
(1) Containment atmosphere monitoring (2) Process and effluent radiological monitoring system (3) Diesel generator initiation (NSSS to non-NSSS interlock)
(4) Drywell entry purge (air purge) system 7.6.1b.1 Containment Monitoring - Instrumentation and Controls The following variables are monitored:
a) Containment drywell and suppression chamber pressures b) Containment drywell atmosphere and suppression chamber atmosphere temperatures c) Suppression pool level d) Containment airborne particulate radioactivity e) Suppression Pool Temperature f) Primary containment radiation (high range) g) Safety/Relief Valve Position Indication System 7.6.1b.1.1 Primary Containment Drywell and Suppression Chamber Pressure Monitoring System 7.6.1b.1.1.1 System Identification This system is designed to monitor the pressure in the primary containment and in the suppression chamber during normal plant operation and after a LOCA. The specific instruments used for normal operation as well as those used for accident conditions are discussed below.
Pressure monitoring within the containment provides an indirect method of leakage detection.
Refer to Subsection 3.8.1.1 for description of the primary containment.
7.6.1b.1.1.2 Safety Evaluation The instrumentation for post-accident monitoring is safety related.
Two redundant, divisionalized, LOCA range and two redundant, divisionalized Hi Accident range pressure sensing circuits are provided for the primary containment drywells for accident monitoring in accordance with NUREG 0578, Subsection 2.1.9.b. Two redundant divisionalized, LOCA range FSAR Rev. 71 7.6-28
SSES-FSAR Text Rev. 72 pressure sensing circuits are also provided for accident monitoring of the suppression chamber pressure.
Redundant indicating recorders are used for indication and historical record of the four LOCA range and the two Hi Accident range, post-accident, pressure measurements. These indicating recorders are located in the main control room.
For normal operation, one indicating meter is located in the control room, measuring the narrow range pressure of either the primary containment drywell or the suppression chamber. Another meter is located on the Remote Shutdown panel, measuring the narrow range pressure of the drywell. These measurements for normal operation are not safety related.
7.6.1b.1.1.3 Power Supply Post-accident monitoring instrumentation is powered by separate divisionalized Class 1E buses.
7.6.1b.1.1.4 Equipment Design The LOCA and Hi Accident ranges are provided for post-accident monitoring and the narrow range is provided for normal operation monitoring. Main Control Room safety grade recorders will provide monitoring and verification of suppression chamber pressure and drywell pressures.
Electronic Alarm Switches initiate high or low pressure alarms in the Main Control Room. The alarm contacts provide isolation of the annunciator which is not safety grade.
See Table 7.5-3 for details of safety-related instrumentation.
7.6.1b.1.1.5 Redundancy Redundancy, where required, is provided by the divisionalization of the instrumentation.
7.6.1b.1.1.6 Separation Redundant circuits are physically and electrically separate.
7.6.1b.1.1.7 Operational Considerations The primary containment drywell and the suppression chamber pressure monitoring system is designed for the following operating modes:
a) Initial purging and pressurization of the containment.
b) During normal reactor operation to monitor pressure of containment drywell and suppression chamber.
c) Indication and historical record of pressure after an accident.
d) Indication of containment drywell pressure on the remote shutdown panel.
FSAR Rev. 71 7.6-29
SSES-FSAR Text Rev. 72 7.6.1b.1.1.8 Environmental Consideration The pressure transmitters located outside the primary containment are designed and qualified to withstand all anticipated environmental conditions in accordance with IEEE-323-1974 and IEEE-344-1975.
7.6.1b.1.2 Primary Containment Drywell and Suppression Pool Temperature Monitoring System 7.6.1b.1.2.1 System Identification The Primary Containment Drywell and Suppression Pool systems are designed to monitor the temperature of the primary containment and suppression pool during normal plant operations and after a LOCA. The specifics of using the process computer to monitor the average suppression pool temperature are discussed in Section 7.6.1b.1.2.4.2.
7.6.1b.1.2.2 Safety Evaluation The indication of containment temperatures in the control room is required for post-accident monitoring and is safety related. The initiating contacts for the automatic start of the drywell fans are derived from electronic switches in the temperature sensing loop. This function is not safety-related. However, the system design conforms to all applicable criteria for physical separation and divisionalization. Refer to Subsection 7.3.1.1b. The hardcopy timeplot of the containment temperatures is operating history only and is not safety related. However, redundant systems are provided.
The indication of suppression pool temperature in the control room is required to ensure that the plant is always operating within the technical specification limits. Manual operator action is required to maintain the plant within the specifications. Suppression pool temperature is also required for post-accident monitoring and remote shutdown. All of these safety-related functions are performed by the Suppression Pool Temperature Monitoring System (SPOTMOS.
The system design conforms to all applicable criteria for physical separation and divisionalization.
Refer to Subsection 7.3.1.1b.
The Suppression Pool Temperature Monitoring system includes redundant chassis, displays, and recorders that are divisionalized. Hardcopy plotting of suppression pool temperature operating history is not safety related and is available offline.
Each system provides a continuous, isolated signal to the remote shutdown panel (RSP) which does not require any transfer action in the Control Room. Two indicators are provided at each RSP and are divisionalized.
The primary Containment and suppression pool temperature elements and temperature indicators will be qualified to operate following a DBA.
7.6.1b.1.2.3 Power Sources The safety-related instrumentation is powered from divisionalized power sources. Division I Class 1E bus powers Loop A, Division II Class 1E bus powers Loop B.
FSAR Rev. 71 7.6-30
SSES-FSAR Text Rev. 72 7.6.1b.1.2.4 Equipment Design 7.6.1b.1.2.4.1 Equipment Design-Containment Temperature Four dual element RTDs per redundant system are located in the primary containment to sense the temperature at the following elevations:
a) Reactor pressure vessel head b) Upper platform c) Lower platform d) Drywell (below reactor pressure vessel).
Two redundant temperature elements monitor the suppression chamber air space temperature.
The selected location for the temperature sensors helps the operator to define the area of the heat source within the primary containment.
The signal from the RTD elements is amplified by electronic temperature transmitters to drive meters, recorder channels, and alarm switches in the control room.
Two redundant recorders, for the primary containment are located in the main control room. The initiating contacts for the high speed start of the drywell cooling fans (refer to system description in Section 9.4) are derived from the two redundant temperature sensing elements located in the service area of the fans. If the standby fan is in "Auto High" and high temperature condition is detected or the operating drywell cooler fails (resulting in loss of air flow), then the electronic switches or the PDSLs will initiate high speed operation of standby drywell unit cooler.
Electronic signal converters with full electrical input-output isolation are placed between safety-related instrumentation and the input channels to the recorders.
Two redundant multipoint recorders for the primary containment pool temperature monitoring system provide a permanent history of all RTD measurements to the operator in the control room.
Each temperature sensing circuit is equipped with alarm switches and initiate one control room alarm per redundant channel.
One temperature indicator for the primary containment is located on the remote shutdown panel.
Refer to Subsection 7.4.1.4 for system description. Instrument ranges are defined in Section 7.5.
7.6.1b.1.2.4.2 Equipment Design-Suppression Pool Temperature SPOTMOS monitors suppression pool temperature with two redundant systems, each of which performs as described below.
Eight RTDs per redundant system are located in the suppression pool approximately six inches below the minimum pool water level. These sensors are located around the pool in order to provide a good spatial distribution of pool temperature. Refer to Table 7.6-9 for exact location of these sensors. These RTDs are referred to as the upper level RTDs.
In addition there are four RTDs (Division 1 only) that are located sixteen feet below minimum pool water level. These sensors are located around the pool in order to provide a good spatial distribution of pool temperature. These RTDs are referred to as the lower level RTDs.
FSAR Rev. 71 7.6-31
SSES-FSAR Text Rev. 72 All of the RTDs are Class 1E. The four lower level RTDs are not seismically qualified. The lower RTDs are designated Class 1E and designed as affiliated circuits.
In addition to these eight upper-level RTD sensors, there are four additional sensors located sixteen feet below the minimum water level. These sensors are located in each quadrant of the pool for a good spatial distribution of pool temperature. The bottom-level RTDs only input into the Division I SPOTMOS system. The eight upper-level RTDs are Class IE, but the bottom-level RTDs are not seismically qualified.
The signals from the sensors are processed by an electronic unit located on a main control room back panel. The electronic unit converts the RTD signals into degrees Fahrenheit and calculates three averages of suppression pool temperatures. The three averages are: SPOTMOS average temperature, bottom average temperature, and bulk pool temperature. SPOTMOS average temperature is a single average of the eight upper-level RTDS. This average is valid if at least six of the eight upper-level RTDs are operable with at least one sensor in each quadrant. Bottom average temperature is a simple average of the four bottom-level RTDs. This average is valid if at least three of the four bottom-level RTDs are operable. Bulk pool temperature is weighted average of the SPOTMOS average temperature and the bottom average temperature. Bulk pool temperature is valid when both the SPOTMOS average temperature and bottom average temperature are valid. Bulk pool temperature may be manually calculated if there is no test or transient in progress that adds heat to the containment.
If the electronic unit detects an input RTD signal failure, an alarm is generated and the failed RTD is automatically bypassed in the average temperature calculations. The average temperatures are displayed on digital displays located on the electronic unit and on a digital recorder at the main control board. The SPOTMOS average temperature is displayed on a vertical meter located on the RSP. The digital displays on the electronic unit allow the operator to display and trend any individual temperature input in addition to the averages. The operator may also bypass any RTD signal manually.
A high temperature alarm is generated by comparing the SPOTMOS average temperature to several internally stored setpoints. The alarm condition is displayed by the digital displays on the electronic unit and the recorder at the main control board. The digital recorder stores the operating history (time / date stamped) of the system, which can be displayed and/or downloaded for remote storage and hard-copy printing. Storage capability of the digital recorder is sufficient to capture pre-event and post-event historical data. The electronic unit has a self checking diagnostic system that provides an error alarm if a failure is detected in any part of the system.
Electrically isolated digital signals are provided to interface with other plant information systems and the annunciator system on the main control board. Electrically isolated analog signals are provided to interface with indicators on the RSP.
The lower-level RTD signals are input into Division I. The signals are passed to Division II via an isolated fiber optic link between the electronic units. The individual RTD sensor data, SPOTMOS average temperature, bottom average temperature, and bulk pool temperature are passed to the plant process computer (PICSY) via a serial data link. A qualified isolator located at the electronic unit provides isolation of the safety-related electronic unit from the non-safety related process computer.
FSAR Rev. 71 7.6-32
SSES-FSAR Text Rev. 72 The plant process computer displays temperature data received from SPOTMOS. The process computer performs checks to insure valid data is transmitted across the serial data link. The process computer interfaces with the same annunciator that interfaces with the SPOTMOS electronic units (Suppression Pool Avg. Temp Hi). The plant process computer will generate high temperature alarms (based on SPOTMOS average temperature) when fixed setpoints are exceeded.
A trouble alarm is initiated if the number or position of the RTDs falls below the above criteria. If the minimum number of RTDs in a quadrant is not met, then the calculated SPOTMOS average temperature, bottom average temperature and bulk pool temperature are also uniquely identified as invalid.
For the purpose of monitoring suppression pool temperature, the SPOTMOS average temperature or bulk pool temperature displayed by either PICSY or SPOTMOS can be used. However, bulk pool temperature should be the primary indicator, when available, since it provides a more accurate representative of Suppression Pool Average Temperature and reduces the frequency of suppression pool cooling operation. During off normal or accident conditions, when the suppression pool is challenged, the SPOTMOS average temperature is used as the measurement of suppression pool temperature.
Instrument ranges and accuracies are defined in Table 7.5-3.
7.6.1b.1.2.5 Redundancy Redundant instrumentation is provided for the safety-related portions of the containment and suppression pool temperature monitoring system.
7.6.1b.1.2.6 Separation Physical and electrical separation is provided for the safety-related instrumentation. Non-safety circuits are isolated by Qualified Isolation Methods.
7.6.1b.1.2.7 Operational Consideration The system is designed to function during normal plant operation and after a DBA.
7.6.1b.1.2.8 Environmental Consideration All temperature sensing elements located inside the containment are designed to operate in the normal operating environment, during and after a LOCA. All electronic equipment and indicating devices are located within the control structure. Expected environmental conditions are defined in Chapter 3.
7.6.1b.1.3 Suppression Pool Water Level Monitoring System 7.6.1b.1.3.1 System Identification The instrumentation for suppression pool water level monitoring is designed to provide indication and a record in the control room of the suppression pool level during normal plant operation and in accident conditions, including a LOCA.
FSAR Rev. 71 7.6-33
SSES-FSAR Text Rev. 72 7.6.1b.1.3.2 Safety Evaluation Suppression pool water level indicating meters and recorders in the control room are used for post-accident monitoring and are safety related.
7.6.1b.1.3.3 Power Sources Safety-related instrument circuits are powered from their respective divisionalized Class 1E power buses.
Non-safety instruments are energized by the unit instrument power bus.
7.6.1b.1.3.4 Equipment Design Four redundant level transmitters, two of them calibrated for normal operation (narrow range) and two of them calibrated for post-accident monitoring (wide range), are continuously sensing the water level of the suppression pool. Each narrow range transmitter provides the signal for the divisionalized level indicating meter in the control room. Both level ranges provide input to the recorder input channels.
Suppression pool water level indication is provided for the remote shutdown panel. Refer to Subsection 7.4.1.4 for system description.
Instrument ranges are defined in Section 7.5.
7.6.1b.1.3.5 Redundancy The system is designed with redundant instrument circuits.
7.6.1b.1.3.6 Separation Full physical and electrical separation is maintained for safety-related instrumentation.
7.6.1b.1.3.7 Operational Considerations The suppression pool water level monitoring instrumentation is functional during normal plant operation and provides level indication and recording for accident monitoring.
7.6.1b.1.3.8 Environmental Considerations Level sensing instruments are located in the reactor building and are designed to operate in the normal operating environment, during and after a high energy line break. Signal conditioning and recording equipment are located in the control structure. Expected environmental conditions are defined in Chapter 3.
7.6.1b.1.4 Primary Containment and Suppression Chamber Airborne Particulate Radioactivity Monitoring System - Instrumentation and Controls See Subsection 5.2.5.1.2.3.
FSAR Rev. 71 7.6-34
SSES-FSAR Text Rev. 72 7.6.1b.1.5 Primary Containment Radiation Monitoring System (High Range) 7.6.1b.1.5.1 System Identification This system is designed to monitor the radiation (gamma) in the primary containment during LOCA.
7.6.1b.1.5.2 Safety Evaluation The instrumentation for post-accident monitoring is safety related.
Two redundant high range divisionalized radiation sensing circuits are provided for the primary containment drywell. In accordance with NUREG 0578 and 0737, redundant indicating recorders are used for indication and historical record in the main control room.
7.6.1b.1.5.3 Power Supply Post-accident monitoring instrumentation is powered by separate divisionalized Class 1E buses.
7.6.1b.1.5.4 Equipment Design The wide range is provided for post-accident monitoring. Main Control Room safety grade recorders will provide radiation level data from 1 R/hr to 107 R/hr. Electronic alarm switches in containment initiate high radiation in the Main Control Room. The alarm contacts provide isolation of the annunciator, which is not safety grade.
See Table 7.5-3 for details of safety-related instrumentation.
7.6.1b.1.5.5 Redundancy Redundancy, where required, is provided by the divisionalization of the instrumentation.
7.6.1b.1.5.6 Separation Redundant circuits are physically and electrically separate.
7.6.1b.1.5.7 Operational Considerations The primary containment radiation monitoring system (high range) is designed for the following operating modes:
(a) Monitoring of containment radiation during and after a LOCA (or other accident).
(b) Alarm of high radiation levels, annunciated in the Main Control Room.
(c) Indication and historical record of radiation during and after an accident.
7.6.1b.1.5.8 Environmental Consideration The radiation transmitters located within the primary containment are designed and qualified to withstand all anticipated environmental conditions in accordance with IEEE-323-1974 and IEEE-344-1975.
FSAR Rev. 71 7.6-35
SSES-FSAR Text Rev. 72 7.6.1b.1.6 Safety/Relief Valve Position Indication System 7.6.1b.1.6.1 System Identification The Safety/Relief Valve Position Indication System is designed for monitoring the safety/relief positions and to provide the operator with unambiguous indication of valve position (open or closed) during normal plant operation and in accident conditions, including a LOCA.
7.6.1b.1.6.2 Safety Evaluation The SRV Position Indication System is safety related and, although not qualified for the post-accident environment, the equipment is designed to withstand the postulated post-LOCA conditions in accordance with the guidance of Regulatory Guide 1.97. The SRV Position Indication System is seismically qualified for the maximum postulated load combinations, including hydrodynamic loads. Because only low-energy instrumentation circuits are located in the primary and secondary containment areas, no failure of SRV position indication system components due to post-accident harsh environments can affect the integrity of the Class 1E power sources.
7.6.1b.1.6.3 Power Sources The SRV Position Indication System is powered from divisionalized power sources. Division I Class 1E bus (120 VAC) supplies power to the 8 "A" safety/relief valves. Division II Class 1E bus (120 VAC) supplies power to the 8 "B" safety/relief valves.
7.6.1b.1.6.4 Equipment Design Piezoelectric vibration elements are strapped to each discharge pipe in proximity to the safety/relief valve. The flow through the valve generates acoustical levels or vibrations which are easily detected by these piezoelectric accelerometers. By using the relationship between valve flow rate and the corresponding vibration level set up, a determination of valve position can be made.
The piezoelectric accelerometers produce a charge that is proportional to the acceleration level.
The delta charge produced by a change in flow and therefore a change in the vibration level is amplified by a charge sensitive feedback amplifier located inside the containment. These amplifiers do not require cabling to bring power to them because they are powered by current superimposed on the output signal. This current is provided by the electronics in the control room.
The control room electronics consists of modular units that are housed in instrument bins located in Panels 1C-690 A&B. Each bin contains all the modules necessary for eight SRV Position Indication Channels including power supplies. Each Channel provides independent monitoring and alarm contact status. One module processes the signal from the amplifiers and displays valve flow with a LED (light emitting diode) bargraph. This module determines if the valve flow is in excess of the setpoint and outputs alarm signals to LED annunciators located in Panel 1C-601 (one annunciator per Safety/Relief Valve) and a ganged alarm annunciator located in Panel 1C-601 (common to all 8 channels). If an SRV should open, the alarm condition would be shown by a LED in one of the bins located in Panels 1C-690 A&B, the LED alarm annunciators located in Panel 1C-601 and the ganged alarm annunciators located in Panel 1C-601.
The alarm setpoint is factory set at 25% of valve rated flow. However this setpoint can be changed to other valve flow rate values (refer to the System's Manual).
FSAR Rev. 71 7.6-36
SSES-FSAR Text Rev. 72 7.6.1b.1.6.5 Redundancy None required.
7.6.1b.1.6.6 Separation Divisions A and B (each consisting of 8 SRV Position Indication Channels) are physically and electrically separated.
7.6.1b.1.6.7 Operational Considerations The SRV Position Indication System is designed to function during normal plant operation and after a DBA.
7.6.1b.1.6.8 Environmental Considerations The SRV Position Indication System is designed to function in the normal operating environment, during and 30 days after a LOCA. Although the equipment is not environmentally qualified, the equipment is designed to withstand the postulated post-LOCA conditions in accordance with the guidance of Regulatory Guide 1.97. The Regulatory Guide recommends, but does not require environmental qualification (Category 2 Instrumentation should be qualified in accordance with Regulatory Guide 1.89), and none is required for this application. The SRV Position Indication system provides no post-accident monitoring function important to safety and only low-energy instrumentation circuits are located in the primary and secondary containment (harsh environment) areas. Because the indication is not important to safety and no failure of SRV position indication system components due to post-accident harsh environments can affect the integrity of the Class 1E power sources, environment qualification for postulated post-accident harsh environments is not required.
7.6.1b.2 Non-NSSS Process Radiation Monitoring System - Instrumentation and Controls (1) Refueling floor wall exhaust radiation monitoring subsystem (2) Refueling floor high exhaust radiation monitoring subsystem (3) Railroad access shaft exhaust radiation monitoring subsystem (Unit 1 only)
(4) Emergency outside air intake radiation monitoring subsystem (5) Standby gas treatment system exhaust vent radiation monitoring subsystem The Main Steamline Radiation Subsystem is discussed in Subsection 7.3.1.1a.
Refer to Section 11.5 for Process Radiation Monitoring System description.
7.6.1b.2.1 Refueling Floor Wall Exhaust Radiation Monitoring Subsystem This system is used to initiate reactor building isolation as described in Subsection 7.3.1.1b.6.
The instrumentation and controls of this system are described in Subsection 11.5.2.1.5.
7.6.1b.2.2 Refueling Floor High Exhaust Radiation Monitoring Subsystem The description for this system is provided in Subsection 11.5.2.1.6.
FSAR Rev. 71 7.6-37
SSES-FSAR Text Rev. 72 The objective of this system is to detect excessive radiation levels above the fuel pool and initiate reactor building isolation as described in Subsection 7.3.1.1b.6.
7.6.1b.2.3 Railroad Access Shaft Exhaust Radiation Monitoring Subsystem The radiation monitoring instrumentation is described in Subsection 11.5.2.1.7.
The initiation for reactor building isolation is documented in Subsection 9.4.2.1.
7.6.1b.2.4 Emergency Outside Air Intake Radiation Monitoring Subsystem The instrumentation for this system is described in Subsection 11.5.2.1.8.
The emergency intake air supply system for the control structure is initiated by this system and is described in Subsection 7.3.1.1b.7.
7.6.1b.2.5 Standby Gas Treatment System Exhaust Vent Radiation Monitoring Subsystem The description of the instrumentation and its function is provided in Subsection 11.5.2.1.4.
7.6.1b.3 Diesel Generator Initiation - Instrumentation and Controls Interlocks between NSSS systems and non-NSSS systems in Unit 1 and 2 provide the initiation for the start of the diesel generators and are identified as follows:
Diesel Generator A Start Signal (one signal each from Units 1 and 2)
Diesel Generator B Start Signal (one signal each from Units 1 and 2)
Diesel Generator C Start Signal (one signal each from Units 1 and 2)
Diesel Generator D Start Signal (one signal each from Units 1 and 2)
Note: Whenever Diesel Generator 'E' is aligned for Diesel Generator A, B, C or D, Diesel Generator 'E' receives the start signal in place of the substituted diesel generator.
7.6.1b.3.1 Initiation The initiation circuit for the diesel generator start signal originates in the NSSS system logic. High drywell pressure and/or low reactor water level, arranged in two instrument channels taken twice, will initiate each of the start circuits of the four aligned diesel generators. NSSS components in the RHR and core spray systems are utilized. Manual initiation of a RHR or core spray system will start the diesel associated with that system. Loss of offsite power also automatically initiates diesel start.
Individual manual start is also provided on the plant operating benchboard.
7.6.1b.3.2 Logic Two NSSS instrument channels for each diesel must detect LOCA conditions to operate a NSSS output relay which in turn actuates the non-NSSS relay causing the diesel start.
FSAR Rev. 71 7.6-38
SSES-FSAR Text Rev. 72 7.6.1b.3.3 Bypasses It is possible to bypass a diesel start actuation signal using a manual jack and a keylock switch.
This action makes it possible to test the instrument sensing components and logic.
This action, which disables an automatic start of the diesels, is indicated on the bypass indication system panel. Refer to Subsection 7.5.1b.7.
7.6.1b.4 Drywell Entry Purge - Instrumentation and Controls (non-safety related function)
The drywell purge system is available in each unit for combustible gas control of the primary containment and suppression chamber. The system function is described in Subsection 6.2.5 and is not a safety related function other than containment isolation.
This system is manually operated by opening the air purge supply valves from the reactor building HVAC system. After opening the respective containment inboard isolation valves, the atmosphere of the primary containment and the suppression chamber can be exhausted through the 2 in. vent lines to the standby gas treatment system.
Operational considerations:
The containment air purge system can be used as:
a) A system to reduce the hydrogen content after a loss of coolant accident by venting the containment atmosphere. This operating function is not safety related except the valves required to isolate containment.
b) The primary containment re-entry purge system for personnel access during shutdown and maintenance. This operating function is not safety related.
7.6.1b.4.1 Initiating Circuits, Logic, and Bypasses All valves required for the containment air purge system can be controlled from the main control room. The valve logic is designed with momentary pushbuttons and electromechanical relays.
No bypass capability is provided.
7.6.1b.4.2 Interlocks All valves are part of the containment isolation function which is discussed in Section 7.3. The containment isolation signal will dictate the closure of these valves.
7.6.1b.4.3 Sequencing, Redundancy, and Diversity No sequencing is provided. Redundancy and diversity is not a requirement for the containment air purge system.
FSAR Rev. 71 7.6-39
SSES-FSAR Text Rev. 72 7.6.2a ANALYSIS FOR NSSS - SYSTEMS 7.6.2a.1 Refueling Interlocks System - Instrumentation and Controls See Subsection 7.7.2.10.
7.6.2a.2 Process Radiation Monitoring System - Instrumentation and Controls 7.6.2a.2.1 Main Steamline Radiation Monitoring Subsystem The analysis for the Main Steamline Radiation Monitoring subsystem is discussed in Subsection 7.1.2a.1.11.1.
7.6.2a.2.1.1 General Functional Requirement Conformance Refer to Subsection 7.1.2a.1.11.1.
7.6.2a.2.1.2 Specific Regulatory Requirement Conformance Refer to Subsection 7.1.2a.1.11.1.2.
7.6.2a.3 High Pressure/Low Pressure Interlock Protection and Control System 7.6.2a.3.1 General Functional Requirements Conformance The high pressure/low pressure interlocks provide an interface between low pressure systems and reactor pressure. When reactor pressure is low enough as to not be harmful to the low pressure systems, the valves open exposing the low pressure system to reactor pressure. The interlocks are automatic and the operator is given indication of their status.
7.6.2a.3.2 Specific Regulatory Requirements Conformance 7.6.2a.3.2.1 General Design Criteria Conformance There are no General Design Criteria that apply to the high pressure/low pressure interlocks.
7.6.2a.3.2.2 IEEE Standards Conformance 7.6.2a.3.2.2.1 Conformance to IEEE Standard 279-1971 The interlocks are designed in accordance with the single failure criterion, redundancy requirements, and testability criterion.
7.6.2a.3.2.2.2 Conformance to IEEE Standard 338-1971 The design of the interlocks is such that they can be tested during reactor operation except for the actuated devices (valves). The valves can be tested during startup and shutdown.
FSAR Rev. 71 7.6-40
SSES-FSAR Text Rev. 72 7.6.2a.3.2.2.3 Conformance to IEEE Standard 379-1972 Two valves in each low pressure system process line and separate actuation paths assure that the interlocks comply with the single failure criterion.
7.6.2a.3.2.3 Regulatory Guide Conformance 7.6.2a.3.2.3.1 Conformance to Regulatory Guide 1.22 See Subsection 7.6.2a.3.2.2.2 on conformance to IEEE Standard 338-1971.
7.6.2a.3.2.3.2 Conformance to Regulatory Guide 1.53 See Subsection 7.6.2a.3.2.2.3 on conformance to IEEE Standard 379-1972.
7.6.2a.4 NSSS Leak Detection System - Instrumentation and Controls 7.6.2a.4.1 General Functional Requirements Conformance The part of NSSS leak detection system instrumentation and controls that is related to the various subsystem isolation circuitry is designed to meet requirements of the containment and reactor vessel isolation control systems cited in Subsection 7.3.2a.2.
7.6.2a.4.2 Specific Regulatory Requirements Conformance 7.6.2a.4.2.1 Regulatory Guides Conformance Regulatory Guide 1.22 (2/72)
The portion of the leak detection subsystem that provides outputs to the system isolation logic is designed so that complete periodic testing of the isolation system actuation function is provided.
This is accomplished by tripping the leak detection system one channel at a time from the backrow leak detection panel in the main control room. An indicator lamp is provided to show that the particular channel is tripped. Discussion is provided in Subsection 7.3.2a.2.2.1.2.
Regulatory Guide 1.47 (5/73)
The leak detection system annunciates all bypass conditions. Discussion is provided in Subsection 7.3.2a.2.2.1.5.
Regulatory Guide 1.53 (6/73)
The leak detection system complies with this guide. Discussion is provided in Subsection 7.3.2a.2.1.6.
7.6.2a.4.2.2 Regulation Conformance 10CFR50 Appendix A Discussion is provided in Subsection 7.3.2a.2.2.2.
FSAR Rev. 71 7.6-41
SSES-FSAR Text Rev. 72 Criterion 13 The leak detection sensors and associated electronics are designed to monitor the reactor coolant leakage over all expected ranges required for the safety of the plant.
Automatic initiation of the system isolation action, reliability, testability, independence, and separation have been factored into leak detection design as required for isolation systems.
Criterion 19 Controls and instrumentation are provided in the control room.
Criterion 20 Leak detection equipment senses accident conditions and initiates the containment and reactor vessel isolation control system when appropriate.
Criterion 21 Protection related equipment is arranged in two redundant divisions and maintained separately.
Testing is covered in the conformance discussion for Regulatory Guide 1.22.
Criterion 22 Protection related equipment is arranged in two redundant divisions so no single failure can prevent isolation. Functional diversity of sensed variables is utilized.
Criterion 23 MSIV and Other Isolation Valves: The system logic and actuator signals are fail safe. The motor operated valves will fail "as-is" on loss of power, steam leak subsystem temperature switches excluded. Temperature switches fail open (non fail-safe), to negate spurious closure of isolation valves. Reliance is placed on other leak detection instruments.
Criterion 24 The system has no control functions.
Criterion 29 No anticipated operational occurrence can prevent an isolation.
Criterion 30 The system provides means for detection and generally locating the source of reactor coolant leakage.
Criterion 33 The leak detection total leakage limitations are confined to conservative levels far below the coolant makeup capacity of the RCIC system.
FSAR Rev. 71 7.6-42
SSES-FSAR Text Rev. 72 Criterion 34 Leak detection is provided for the RHR shutdown cooling and RCIC lines penetrating the drywell.
Criterion 35 ECCS leak detection is augmented by the sump monitoring system portion of the leak detection system. ECCS leaks can easily be identified by operator correlation of various flow, pressure and reactor vessel level signals transmitted to the control room.
Criterion 54 Leak detection is provided for main steam, HPCI, RCIC, RHR shutdown cooling and reactor water cleanup lines penetrating the drywell. Sump fill rate monitoring provides leak detection for other pipes penetrating the drywell and reactor buildings.
7.6.2a.4.2.3 Industry Standards Conformance IEEE 279-1971 and 379-1972 Leak detection system isolation functions compliance with IEEE 279-1971 and 379-1972 is included in the IEEE 279 and 379 compliance discussions of the PCRVICS, Subsections 7.3.2a.2.2.3.1 and 7.3.2a.2.2.3.6, for which this system provides logic trip signals.
Compliance to IEEE-279-1971 for HPCI and RCIC Leak Detection is discussed in Sections 7.3.2a.1.2.3.1.2 and 7.4.1.1.3.6.
IEEE 323-1971 Leak detection compliance is shown in Subsection 7.1.2.5.3.
IEEE 338-1971 Leak detection complies with IEEE 338-1971. All active components of the leak detection system associated with the isolation signal can be tested during plant operation.
IEEE 344-1971 Leak detection system compliance is shown in Section 3.10.
7.6.2a.5 Neutron Monitoring System - Instrumentation and Controls 7.6.2a.5.1 Source Range Monitor Subsystem The SRM is a non-safety subsystem. See Subsection 7.7.2.13.
FSAR Rev. 71 7.6-43
SSES-FSAR Text Rev. 72 7.6.2a.5.2 Intermediate Range Monitor Subsystem 7.6.2a.5.2.1 General Functional Requirements Conformance The analysis for the RPS trip inputs from the Intermediate Range Monitor Subsystem are discussed in Subsection 7.2.2.
The IRM is the primary source of information as the reactor approaches the power range. Its linear steps (approximately a half decade) and the rod blocking features on both high flux level and low flux level require that, unless one channel is bypassed, all the IRMs are on the correct range as core reactivity is increased by rod withdrawal. The SRM overlaps the IRM. The sensitivity of the IRM is such that the IRM is on scale on the least sensitive (highest) range with approximately 15% reactor power.
The number and locations of the IRM detectors have been determined to provide sufficient intermediate range neutron flux level information under the worst permitted bypass conditions.
To assure that each IRM is on the correct range, a rod block is initiated any time the IRM is both downscale and not on the most sensitive (lowest) scale. A rod block is initiated if the IRM detectors are not fully inserted in the core unless the reactor mode switch is in the RUN position. The IRM scram trips and the IRM rod block trips are automatically bypassed when the reactor mode switch is in the RUN position.
The IRM detectors and electronics have been tested under operating conditions and verified to have the operational characteristics described. They provide the level of precision and reliability required by the RPS safety design bases.
7.6.2a.5.2.2 Specific Regulatory Requirement Conformance IEEE 279-1971 The IRM design is shown to comply with the design requirements of IEEE-279 in Subsection 7.2.2.1.2.3.1.
IEEE 323-1971 IRM compliance is shown in Subsection 7.1.2.5.3.
IEEE 338-1971 IRM compliance with IEEE 338 is shown in Subsections 7.2.2.1.2.3.1.9 and 7.2.2.1.2.3.1.10 under IEEE 279 Conformance.
IEEE 344-1971 The IRMs are qualified for seismic events. Compliance is further shown in Section 3.10.
IEEE 379-1972 IRM signal separation, cabinet separation, use of isolation circuitry, and number of channels per trip system are methods used to meet the single-failure criterion. Convenient test and calibration circuits permit frequent checks for undetected failures.
FSAR Rev. 71 7.6-44
SSES-FSAR Text Rev. 72 Regulatory Guide 1.22 (2/72)
The portion of the IRM subsystem that provides outputs to the Reactor Protection System is designed to provide complete periodic testing of Protection System Actuation Function as desired.
The provision is accomplished by initiating an output trip of one IRM channel at any given time which will result in tripping one of the two RPS trip systems. Details are provided in Subsection 7.2.2.1.2.1.2.
Operator indication of IRM bypass is provided by indicator lamps.
Regulatory Guide 1.47 (5/73)
The IRM complies with this Guide. Discussion is provided in Subsection 7.2.2.1.2.1.5.
Regulatory Guide 1.53 (6/73)
The IRM complies with this guide. Discussion is provided in Subsection 7.2.2.1.2.1.6.
10CFR50 Appendix A Criteria 13, 19, 20, 21, 22, 23, 24, and 29 The IRM detectors and associated electronics are designed to monitor the in-core flux over all expected ranges required for safety of the plant.
Automatic initiation of protection system action, reliability, testability, independence, and separation have been factored into the IRM design as required for protection systems.
7.6.2a.5.3 Local Power Range Monitor Subsystem 7.6.2a.5.3.1 General Functional Requirement Conformance The LPRM provides detailed information about neutron flux throughout the reactor core. The number of LPRM assemblies and their distribution is determined by extensive calculational and experimental procedures. The division of the LPRM into various groups for AC power supply allows operation with one AC power supply failed or out of service without limiting reactor operation. The LPRM power is derived redundantly from the two AC power supplies, one from each RPS 120 Vac bus, so that all LPRM signals continue to be available even with the complete loss of one AC power source. Individual failed chambers can be bypassed. Neutron flux information for a failed chamber location can be interpolated from nearby chambers. A substitute reading for a failed chamber can be derived from an octant-symmetric chamber, or an actual flux indication can be obtained by inserting a TIP to the failed chamber position. Each output is electrically isolated so that an event (grounding the signal or applying a stray voltage) on the reception end does not destroy the validity of the LPRM signal. Tests and experience attest to the ability of the detector to respond proportionally to the local neutron flux changes (Reference 7.6-1).
FSAR Rev. 71 7.6-45
SSES-FSAR Text Rev. 72 7.6.2a.5.3.2 Specific Regulatory Requirement Conformance IEEE 279-1971 The large number of individual LPRM channels, physical separation of groups of LPRMs, and electrical separation of these groups of LPRMs allow the LPRM system to meet single failure, channel independence, and separation requirements. Equipment quality requirements are met by the qualification of the LPRM equipment.
IEEE 323-1971 LPRM equipment is qualified per the requirements of this standard.
IEEE 338-1971 LPRM equipment is designed so that individual channels may be taken out of service for test or calibration without affecting the remaining channels.
IEEE 344-1971 The LPRM equipment is designed and qualified to function during and after the design basis seismic event. See Section 3.10a.1 for further discussion of Seismic Qualification Criteria.
IEEE 379-1972 The LPRM equipment is designed so that a single failure will not prevent needed safety functions.
Regulatory Guide 1.66 (10/73)
The LPRM assembly dry tube will be nondestructively examined in accordance with ASTM and ASME requirements; however, it is exempt from the requirements of Regulatory Guide 1.66 under note 3 of Section C.
7.6.2a.5.4 Average Power Range Monitor Subsystem The analysis for the Average Power Range Monitor Subsystem is discussed in Subsection 7.2.2.
7.6.2a.5.4.1 General Functional Requirement Conformance Each APRM derives its signal from LPRM information. The assignment, power separation, cabinet separation, and LPRM signal isolation are in accord with the safety design bases of the RPS.
There are four APRM channels with the Reactor Protection System trip outputs from each routed to each of four APRM 2-out-of-4 voter channels. Two voter channels are associated with each Reactor Protection System trip system. This configuration allows one APRM channel to be bypassed plus one failure while still meeting the Reactor Protection System safety design basis.
FSAR Rev. 71 7.6-46
SSES-FSAR Text Rev. 72 Above a plant power level defined by Technical Specifications, the APRM power (and simulated thermal power) is adjusted periodically based on heat balance. This adjustment is made regularly at a rate sufficient to compensate for LPRM burnup and the related change in APRM values. However, coolant flow changes, control rod movements, and failed or bypassed LPRM inputs can also affect the relationship between APRM measured flux and reactor power. These predictable APRM variations are included in the analysis performed to determine minimum number of LPRM inputs required to be operable in order for the APRM channel to be operable.
The analysis is performed, considering worst case combinations of failed LPRM inputs, at rated conditions by assuming both continuous withdrawal of the maximum worth control rod and reduction of recirculation flow to 40% of rated flow. The minimum number of LPRM inputs for an APRM is determined such that the average of the remaining operable LPRM inputs still allows the APRM to track power excursions within the acceptance criteria assumed in plant safety analysis. If the number of operable LPRMs is less than the required minimum, the APRM channel is declared inoperable.
There is also a minimum cells requirement applied to the OPRM upscale function. The minimum number of OPRM cells per APRM channel is established to ensure that thermal-hydraulic instabilities can be detected within the limits of the OPRM licensing methodology. If the number of cells is less that the required minimum, an OPRM/APRM trouble alarm is provided and the channel is declared inoperable.
The flow-referenced APRM scram Setpoint does not perform a protective function as demonstrated in Chapter 15.0.
7.6.2a.5.4.2 Specific Regulatory Requirement Conformance Regulatory Guide 1.22 The portion of the APRM subsystem that provides outputs to the Reactor Protection System is designed to provide complete periodic testing of Protection System Actuation Functions. This provision is accomplished by initiating an output trip of one APRM channel at any given time which will result in tripping one of the two RPS trip systems. Details are provided in Subsection 7.2.2.1.2.1.2.
Operator indication of APRM bypass is provided by indicator lamps.
Regulatory Guide 1.47 The APRM complies with this guide. Discussion is provided in Subsection 7.2.2.1.2.1.5.
10CFR50, Appendix A Criteria 13, 19, 20, 21, 22, 23, 24, and 29 The APRM detection and associated electronics are designed to monitor the in-core flux over all expected ranges required for safety of the plant.
Automatic initiation of protection system action, reliability, testability, independence, and separation have been factored into the APRM design as required for protection systems.
FSAR Rev. 71 7.6-47
SSES-FSAR Text Rev. 72 IEEE 279-1971 The APRM design is shown to comply with the design requirements of IEEE-279 in Subsection 7.2.2.1.2.3.1.
IEEE 323-1971 APRM compliance is shown in Subsection 7.1.2.5.3.
IEEE 338-1971 APRM compliance with IEEE 338 is shown in Subsections 7.2.2.1.2.3.1.9 and 7.2.2.1.2.3.1.10 under IEEE 279 Conformance.
IEEE 379-1972 LPRM signal separation, cabinet separation, use of isolation circuitry and number of channels per trip system are methods used to meet the single failure criterion. Convenient test and calibration circuits permit frequent checks for undetected failures.
7.6.2a.5.5 Rod Block Monitor Subsystem See Subsection 7.7.2.11.
7.6.2a.5.6 Traversing In-Core Probe Subsystem (TIPS)
The analysis for the Traversing In-Core Probe Subsystem is discussed in Subsection 7.7.2.6.
7.6.2a.6 Rod Block Trip - Instrumentation and Controls See Subsection 7.7.2.2.3.
7.6.2a.7 Not Used 7.6.2a.8 Recirculation Pump Trip System 7.6.2a.8.1 General Functional Requirements Conformance The RPT system is designed to aid the RPS in protecting the integrity of the fuel barrier. Turbine stop valve closure or turbine control valve fast closure will initiate a scram and recirculation pump trip in time to keep the core within the thermal-hydraulic safety limit during operational transients (see Table 7.2-1 and the Technical Specifications). The response time requirements for these variables are identified in Table 7.6-10.
Recirculation pump trip is a two-out-of-two logic system for the turbine control valve and the turbine stop valve with a permissive for reactor power above 26% rated. Each of the logic channels is initiated by logic from the RPS system, which requires a two-out-of-two confirmation of the sensed variable. A trip of the sensed variable in any two divisions will result in a trip initiate signal for all recirculation pumps.
FSAR Rev. 71 7.6-48
SSES-FSAR Text Rev. 72 Failure to repair in a single RPS division will not violate single-failure criteria. Channel bypass switches will be provided. The switches will provide a "tripped" input to the recirculation pump trip logic. Sensors, channels, and logics of the RPT system are not used directly for automatic control or process systems. Therefore, failure in the controls and instrumentation of process systems cannot induce failure of any portion of the system. Design of the system to safety class requirements and the redundance of Class 1E power supplies as breaker trip sources assures actuation of the pump trip function if required during design-basis earthquake ground motion.
Operator verification that two-pump trip has occurred may be made by observing one or more of the following functions:
(1) recirculation flow indicators in the control room (2) breaker trip indicating lights on the Reactor Protection System Divisional Logic Control Panels (3) recirculation pump trip System A and System B trip annunciation (two windows) 7.6.2a.8.2 Specific Regulatory Requirement Conformance (IEEE 279-1971)
General Functional Requirement (IEEE 279-1971, Paragraph 4.1)
Two instrument channels are connected to both division logics. In the division logics, the channels lose their identity since they are combined. The combination is two-out-of-two. When both instrument channels inputting a common divisional logic and monitoring the same variable exceed their setpoint, RPT will occur if an inhibit is not present (see 7.2.1 and the Technical Specifications).
Single-Failure Criterion (IEEE 279-1971, Paragraph 4.2)
The design complies.
Quality of Components and Modules (IEEE 279-1971, Paragraph 4.3)
Individual components are procured to specifications which satisfy the applicable operational and environmental conditions. Sensors and associated equipment are highly reliable and the components are of a quality that is consistent with minimum maintenance requirements and low failure rate. The primary trip channels and division logic elements incorporate high reliability relays.
See the Susquehanna SES Environmental Report for Class 1E Equipment.
Equipment Qualification (IEEE 279, Paragraph 4.4)
Manufacturer and plant startup test data or reasonable engineering extrapolation based on test data is available to verify that equipment which must operate to provide protection system action will meet, on a continuing basis, the performance requirements determined to be necessary for achieving the system requirements. See the Susquehanna SES Environmental Qualification Report for Class 1E Equipment.
Channel Integrity (IEEE 279-1971, Paragraph 4.5)
The logic system complies with this requirement.
FSAR Rev. 71 7.6-49
SSES-FSAR Text Rev. 72 Channel Independence (IEEE 279, Paragraph 4.6)
The two-division arrangement meets this requirement.
Control and Protection System Interaction (IEEE 279, Paragraph 4.7)
The two division logics are totally separate from any non-protection system. Due to the design of this output and separation of the cabling, there is no interaction with control systems of the plant.
The actuator logic has no interaction with any other plant system, and the breaker trips are physically separate and electrically isolated from the other portions of the recirculation pump power supply. Consequently, this design requirement is met by this equipment. Any system interlocks to control systems will only be isolated such that no failure or combination of failures will have any effect on RPT.
Derivation of System Inputs (IEEE 279, Paragraph 4.8)
This design requirement is met by the use of sensors that detect valve motion or valve hydraulic pressure switch charge of state.
Capability for Sensor Checks (IEEE 279, Paragraph 4.9)
The system input sensors and four division system logics are capable of being checked one channel or division at a time. The sensors and logic test or calibration during power operation does not initiate pump trip action at the system level.
Capability for Test and Calibration (IEEE 279, Paragraph 4.10)
Capability is provided for testing and calibrating the system logic quarterly and circuit breakers once per refueling outage.
Channel Bypass or Removal from Operation (IEEE 279, Paragraph 4.11)
Refer to Subsection 7.2.2.1.2.3.1.11.
Operating Bypasses (IEEE 279, Paragraph 4.12)
Refer to Subsection 7.2.2.1.2.3.1.12.
Indication of Bypasses (IEEE 279, Paragraph 4.13)
This design requirement is complied with by annunciation of bypass and system out of service.
Access to Means for Bypassing (IEEE 279, Paragraph 4.14)
This design requirement is complied with by use of key-lock switches.
Multiple Setpoints (IEEE 279, Paragraph 4.15)
There are no multiple setpoints associated with the RPT.
FSAR Rev. 71 7.6-50
SSES-FSAR Text Rev. 72 Completion of Protective Action Once It Is Initiated (IEEE 279, Paragraph 4.16)
Once the RPT relays are tripped, they in turn trip the trip coils of the recirculation pump breakers.
Manual Actuation (IEEE 279, Paragraph 4.17)
Manual activation is provided in the recirculation system.
Access to Setpoint Adjustments, Calibration, and Test Points (IEEE 279, Paragraph 4.18)
This design requirement is met. See Subsection 7.2.2.1.2.3.1.18.
Identification of Protective Actions (IEEE 279, Paragraph 4.19)
Control room annunciators are provided to identify the tripped portions of RPT in addition to the previously described instrument channel annunciators associated with the RPS:
(1) Division 1 logic tripped, and (2) Division 2 logic tripped.
These same functions are connected to the process computer to provide a typed record of the system status.
Information Readout (IEEE 279, Paragraph 4.20)
The Recirculation Pump Trip system is designed to provide the operator with accurate, complete and timely information pertinent to the system status. Indicators and annunciators are provided for system input trip signals, initiation signal at system level, the status of trip coils and the mechanical position of the circuit breakers.
Systems Repair (IEEE 279, Paragraph 4.21)
The Recirculation Pump Trip System is designed to facilitate the recognition, location, replacement, repair, or adjustment of malfunctioning components or modules.
Identification of Protection Systems (IEEE 279, Paragraph 4.22)
Refer to Subsection 7.2.2.1.2.3.1.22.
IEEE 308 - 1974 This does not apply to the logic system, which is fail safe. Its power supplies are thus unnecessary for RPT. A Class 1E system is required to energize the breaker trip coils.
IEEE 323 - 1971 See Subsection 7.1.2.5.
IEEE 338 - 1971 Refer to Subsection 7.2.2.1.2.3.6.
FSAR Rev. 71 7.6-51
SSES-FSAR Text Rev. 72 IEEE 344 - 1971 All Class 1E Equipment will meet the requirements of Subsection 3.10.
IEEE 379-1972 These requirements are satisfied by consideration of the different types of failure and carefully designing all violations of the single-failure criterion out of the system. An exception is imposed during periodic logic testing.
Regulatory Guides Regulatory Guide 1.22 The system is designed so that it may be tested during plant operation from sensor device to final actuator logic. Circuit breaker shall be tested as per the plant Technical Specifications.
Regulatory Guide 1.47 Regulatory Positions C.1, C.2 and C.3 Annunciation will be provided to indicate a part of a system is not operable. The system has annunciators lighting and sounding whenever one or more instrument channels are manually bypassed. Bypassing is not allowed in the trip logic or actuator logic.
All bypass and inoperability annunciators both at the division level and the component level will be grouped for operational convenience. As a result of design, preoperational testing, and startup testing, no erroneous bypass indication is anticipated.
These indication provisions serve to supplement administrative controls and aid the operator in assessing the availability of component and system level protective actions. This indication does not perform functions that are essential to the health and safety of the public.
All circuits will be electrically independent of the plant safety systems to prevent the possibility of adverse effects. The annunciator initiation signals are provided through isolation devices and can in no way prevent protective actions. Testing will be included on a periodic basis when equipment associated with the annunciation is tested.
Regulatory Guide 1.53 Compliance with Regulatory Guide 1.53 is by specifying, designing, and constructing the reactor protection system to meet the single-failure criterion (Section 4.2 of IEEE 279-1971 and IEEE 379-1972). Redundant sensors are used and the logic is arranged to ensure that a failure in a sensing element or the division logic or an actuator will not prevent RPT. Separate channels are employed, so that a fault affecting one channel will not prevent the other channel from operating properly. Specifications are provided to define channel separation for wiring not included with NSSS supplied equipment.
FSAR Rev. 71 7.6-52
SSES-FSAR Text Rev. 72 10CFR50 Appendix A - General Design Criteria (1) Criterion 13 - Each system input is monitored and annunciated.
(2) Criterion 19 - Controls and instrumentation are provided in the control room.
(3) Criterion 20 - The system constantly monitors the appropriate plant variables and initiates an RPT automatically when the variables exceed setpoints.
(4) Criterion 21 - The system is designed with four independent and separated instrument channels and two independent and separate output divisions. No single failure or operator action can prevent RPT. The instrument and logic can be tested during plant operation to assure its availability.
(5) Criterion 22 - The redundant portions of the system are separated such that no single failure or credible natural disaster can prevent a trip.
(6) Criterion 23 - Where the system is not fail safe, redundant Class 1E sources are utilized.
Loss of an air supply will not prevent a scram. Postulated adverse environments will not prevent a scram.
(7) Criterion 24 - The system has no control function. Signals for control room annunciation are isolated.
(8) Criterion 29 - The system is highly reliable so that it will trip in the event of the anticipated operational occurrences.
7.6.2a.9 Process Computer System-Rod Worth Minimizer (RWM) - Instrumentation and Controls See Subsection 7.7.2.2.5.
7.6.2a.10 Additional Design Considerations Analyses 7.6.2a.10.1 General Plant Safety Analyses The examination of the subject safety systems at the plant safety analyses level is presented in Chapter 15 and Appendix 15A.
7.6.2a.10.2 Cold Water Slug Injection Refer to Subsection 15.5.1.
7.6.2a.10.3 Refueling Accidents Refer to Subsection 15.7.4.
7.6.2a.10.4 Overpressurization of Low Pressure System Refer to Subsection 7.6.1a.3.
FSAR Rev. 71 7.6-53
SSES-FSAR Text Rev. 72 7.6.2b ANALYSIS FOR NON-NSSS SYSTEMS 7.6.2b.1 General Functional Requirement Conformance a) Containment Atmosphere Monitoring System This system does not perform any controlling function; it does provide indications and alarms in the control room.
b) Process and Effluent Radiological Monitoring System The radiation monitoring systems described in Subsection 7.6.1b.2 are monitoring the radiation releases to the environment. In this function they provide the initiation signal for reactor building isolation and start the emergency outside air intake system.
c) Diesel Generator Initiation This system, initiated by NSSS system variables, starts each of the four aligned diesel generators and is designed to meet the requirements of an ESF system.
d) Drywell Entry Purge System This system does not perform a safety-related function and is manually operated. The components used for this operation are designed for safety to conform to requirements for a containment isolation system.
e) Primary Containment High Radiation Monitoring System This system monitors gross-gamma radiation during and after an accident in the primary containment.
Indication and recording are provided in the Control Room.
7.6.2b.2 Specific Requirements Conformance The following discussions outline the conformance of non-NSSS systems to federal regulations, regulatory guides, and applicable standards.
a) 10CFR50 Appendix A Criterion 1: All non-NSSS systems required for safety are designed and built in accordance with an established quality assurance program.
Criterion 2: Not applicable.
Criterion 3: All systems are designed to minimize the probability and effects of fires and explosions using non-combustible and heat-resistant materials.
Criterion 4: The structures and components of the systems are adequately protected against all expected environmental impact. Refer to Chapter 3 for definition of environmental conditions.
FSAR Rev. 71 7.6-54
SSES-FSAR Text Rev. 72 Criterion 5: The containment atmosphere monitoring system, the process radiation monitoring and the drywell re-entry system are unitized. No structures, systems, and components are shared.
The diesel generators are common to both units. The initiation can occur from either unit.
For load-sharing refer to Chapter 8.
Criteria 10, 11, and 12: Not applicable.
Criterion 13: Instrumentation and controls are selected to operate within expected ranges required for safety of the plant for all anticipated operational considerations. Refer to Subsections 7.5.1b and 7.5.2b for details.
Criteria 14, 15, and 16: Not applicable.
Criteria 17 and 18: Refer to Chapter 8 for description of conformance to these criteria.
Criterion 19: All non-NSSS safety-related instrumentation can be controlled and monitored from the main control room. For display instrumentation refer to Subsections 7.5.1b and 7.5.2b.
Criterion 20: The process radiation monitoring and the diesel generator initiation circuits are initiating the operation of systems and components important to safety.
Criterion 21: High functional reliability and in-service testability are implemented in the design by redundant instrumentation.
Criteria 22-24: The responses to these criteria are described in the requirements of IEEE 279.
Criteria 25-40: Not applicable.
Criteria 41-43: The containment atmosphere monitoring system assists during containment atmosphere cleanup.
Criteria 44-46: Not applicable.
Criteria 50-57: Not applicable.
Criterion 60: The process and effluent radiation monitoring system is designed to control the releases of radioactive materials to the environment.
Criterion 61: The radiation monitoring equipment for the refueling floor and the refueling pool is designed in conformance with this criterion.
Criteria 62 and 63: Not applicable.
Criterion 64: The containment radiation monitoring system continuously samples the containment atmosphere to detect radioactivity.
FSAR Rev. 71 7.6-55
SSES-FSAR Text Rev. 72 The containment high range radiation monitoring system detects gross-gamma radiation inside the containment during and after an accident.
b) IEEE Standard 279-1971 Requirements 4.1 General Functional Requirements The diesel generator initiation system does automatically initiate appropriate protective action.
4.2 Single Failure Criterion The initiation circuits for the diesel generators are meeting the single failure criteria.
4.3 Quality of Components Components for all safety-related instrumentation are designed to achieve a high level of quality. Quality control during design, manufacturing, inspection, calibration, and tests are performed to meet this requirement.
4.4 Equipment Qualification Refer to Chapter 3.
4.5 Channel Integrity Not applicable.
4.6 Channel Independence All safety-related systems are divisionalized, where Division I is physically and electrically separate from Division II.
4.7 Control and Protection System Interaction Controls and protection systems are separated. No interaction is possible.
4.8 Derivation of System Inputs Inputs to the diesel generator initiation circuits are derived from NSSS systems output relays and off-site power monitors.
4.9 Capability of Sensor Checks Sensors can be checked by perturbing the monitored variable, and by cross-checking between redundant instruments.
FSAR Rev. 71 7.6-56
SSES-FSAR Text Rev. 72 4.10 Capability for Test and Calibration All instrument circuits can be tested and calibrated after bypassing of the signal.
4.11 Channel Bypass and Removal from Operation See Subsection 7.6.1b for description of bypasses.
4.12 Operating Bypasses No operating bypasses are performed.
4.13 Indication of Bypasses Refer to Section 7.5.1b.7 for description of the bypass indication system for non-NSSS systems.
4.14 Access for Means of Bypasses Refer to description in Section 7.5.1b.7.
4.15 Multiple Setpoints Not used.
4.16 Completion of Protective Action Once It Is Initiated This applies to the diesel generator initiation.
4.17 Manual Initiation Refer to diesel generator initiation description in Subsection 7.6.1b.3.
4.18 Access to Setpoint Adjustment All setpoints can be calibrated in the system panels.
4.19 Identification of Protective Action Refer to Subsections 7.3.2a and 7.3.2b.
4.20 Information Read-Out All safety-related displays are listed in Subsections 7.5.1b and 7.5.2b.
4.21 System Repair The system's instrumentation uses modules and components that can be easily replaced and repaired.
FSAR Rev. 71 7.6-57
SSES-FSAR Text Rev. 72 4.22 Identification All equipment, panels, modules, components, and cables of ESF and support systems are identified by tag numbers. Interconnecting cables are color coded on a division basis.
c) IEEE Standard 308-1974 The compliance with this standard is discussed in Chapter 8.
IEEE's Standard 308-1980 The Diesel Generator 'E' Facility is designed in accordance with IEEE 308-1980.
d) Conformance to Regulatory Guide 1.21 The radiation monitoring equipment is designed to measure the quantity of radioactive gases released, iodine releases, and particulate releases as required by this guide.
7.
6.3 REFERENCES
7.6-1 Morgan, W.R., "In-Core Neutron Monitoring System for General Electric Boiling Water Reactors," APED-5706, November, 1968 (Rev. April, 1969).
7.6-2 Hatch 1 Amendment 7, June 24, 1969, pp. 7-3.0-1 and 7-5.0-1.
7.6-3 NEDC-32410P-A, Nuclear Measurement Analysis and Control Power Range Neutron Monitor (NUMAC-PRNM) Retrofit Plus Option III Stability Trip Function, October 1995.
7.6-4 NEDC-32410P-A Supplement 1, Nuclear Measurement Analysis and Control Power Range Neutron Monitor (NUMAC-PRNM) Retrofit Plus Option III Stability Trip Function, November 1997.
7.6-5 NEDO-31960-A and NEDO-31960-A, Supplement 1, "BWR Owners Group Long-Term Stability Solutions Licensing Methodology, November 1995.
7.6-6 NEDO-32465-A, "BWR Owners Group Long-Term Stability Detect and Suppress Solutions Licensing Basis Methodology And Reload Applications, August 1996.
FSAR Rev. 71 7.6-58
SSES-FSAR TABLE 7.6-3 IRMTRIPS Normal Set Trip Function (1 ) Point* Trip Action IRM Upscale Scram, annunciator, red light display (Trip) or IRM inoperative Scram, rod block, annunciator, red light display IRM upscale Rod block. annunciator, amber light display (Alarm)
IRM downscale Rod block (exception on most sensitive scale),
annunciator amber light display 1
IRM bypassed White light display Note: IRM is inoperative if module interlock chain is broken, operate-calibrate switch is not in operate position, or detector polarizing voltage is below 80 V.
- See the Technical Specifications 1
( > Trip functions all provide input to the plant computer Rev. 54, 10/99 Page 1 of 1
SSES-FSAR Table Rev. 36 TABLE 7.6-4 LPRM SYSTEM TRIPS TRIP SET*
TRIP FUNCTION TRIP RANGE TRIP ACTION POINT LPRM downscale 0% to full scale ODA indication and annunciator LPRM upscale 0% to full scale ODA indication and annunciator ODA indication and APRM averaging LPRM bypass Manual switch compensations
- See the Technical Specifications FSAR Rev. 63 Page 1 of 1
SSES-FSAR Table Rev. 55 TABLE 7.6-5 APRM SYSTEM TRIPS(1)
TRIP FUNCTION TRIP POINT RANGE ACTION APRM Downscale Rod Block (4) 0% to full-scale Rod block, annunciator, APRM ODA, white light APRM Simulated Thermal 7% to 27% Rod Block, annunciator, Power(2) - Upscale (Setdown) APRM ODA, amber light Rod Block (4)
APRM Neutron Flux - Upscale 10% to full scale Rod Block annunciator, Rod Block (4) APRM ODA, amber light APRM Simulated Thermal Varied with flow; intercept Rod Block, annunciator, Power(2) - Upscale Rod Block (4) and slope adjustable APRM ODA, amber light APRM Simulated Thermal Varied with flow; intercept Scram, annunciator, Power(2) -High Trip (4) and slope adjustable APRM ODA, red light APRM Neutron Flux - High Trip (4) 10% to full scale Scram, annunciator, APRM ODA, red light APRM Neutron Flux - High 10% to 30% Scram, annunciator, (Setdown) Trip (4) APRM ODA, red light APRM Inoperative Trip (4) Chassis mode switch, Scram, rod block, module interlocks open, or annunciator, APRM self-test ODA, red light APRM Bypass (4) Manual switch White light (1)
See plant Technical Specifications for setpoints.
(2)
APRM signal passes through a 6 +/- 1 second time constant filter simulate heat flux prior to comparison.
(3)
Same red light display.
(4)
Trip function provides input to the plant computer.
FSAR Rev. 63 Page 1 of 1
SSES-FSAR Table Rev. 37 Table 7.6-7 OPRM SYSTEM TRIP TRIP FUNCTION TRIP POINT RANGE ACTION OPRM Trip Period Based Detection Algorithm Scram, annunciator, based on cycle-specific analysis, APRM ODA, red-light documented in the COLR display Backup trip algorithm setpoints Scram, annunciator, are documented in the red-light display Technical Requirements Manual OPRM Bypass(1) Keylock Switch White light OPRM Inoperative Same as APRM inoperative. See Table Annunciator 7.6-5 OPRM Alarm High Confirmation count (20) Annunciator, APRM ODA (1)
OPRM bypass accomplished using APRM bypass switch.
FSAR Rev. 63 Page 1 of 1
SSES-FSAR TABLE 7.6-9 Suppression Pool Temperature Sensor Locations Azimuth Radius 36°30' 34'-6° 38° 34'-6" 100030' 44' 102° 44' 141°30' 34'-6" 143° 34'-6" 179° 44' 180°30' 44' 216°30' 34'-6" 218°
- 34 1 -6 11 268°30' 44 1 270° 44' 318° 34'-6" 319°30' 34'-6" 348°30' 44' 3500 44' Rev. 35, 07/84
SSES-FSAR TABLE 7.6-10 END-OF-CYCLE RECIRCULATION PUMP TRIP SYSTEM RESPONSE TIME TRIP FUNCTION RESPONSE TIME (Milliseconds}
- 1. Turbine Stop Valve-Closure l $ 175*
i
- 2. Turbine Control Valve-Fast Closure $ 175
.,, Twehty milliseconds allotted for initial valve motion to valve limit switch initiation.
Rev. 53, 04/99 Page 1 of 1
MOTOR Pl Pi NO. 2 SEAL CAVITY NO. 1 SEAL CAVITY POWER SUPPLY RECIRCULATION PUMP POWER SUPPLY FS FS PUMP SEAL OUTER SEAL ELEMENT STAGING FLOW FLOW DETECTION (HIGH/LOW) (HIGHI
" - TO DRYWELL EQUIPMENT SUMP
_/
FSAR REV.65 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT RECIRCULATION PUMP LEAK DETECTION BLOCK DIAGRAM FIGURE 7.6-1, Rev 49 AutoCAD: Figure Fsar 7_6_1.dwg
AMBIENT REACTOR WATER CLEANUP SYSTEM
_o_N_L_v_-~RECORDER.,__-11.
TEMPERATURE SWITCH ELEMENTS RECORDER SWITCH ......,_--<
RHR SYSTEM ISOLATION SIGNALS TO C & RVICS TEMPERATURE LEAK DETECTION _ _ _ _ _ _ _,.._
ELEMENTS PANEL AMBIENT (SEE NOTE 1) ONLY POINT SELECTOR METER T MODULES SWITCH MODULE METER RCIC SYSTEM OPERATOR TEMPERATURE CONTROL ELEMENTS PANEL MAINSTEAM LINE PIPE TUNNEL A. POINT SELECTOR METER . &T TEMPERATURE ONLY MODULES SWITCH MODULE ELEMENTS METER LEAK DETECTION P A N E L ' - - - - - - - - - -
ISOLATION SIGNALS TO C & RVICS NOTE:
- 1. UNIT 1 RHR PERFORMS ALARM ONLY.
FSAR REV.65 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT RHR AREA TEMPERATURE MONITORING SYSTEM BLOCK DIAGRAM FIGURE 7.6-2, Rev 50 AutoCAD: Figure Fsar 7_6_2.dwg
57 o+ +o+ +o+ +o+
+ + + + + + + +
S3 G 49 +o+ +o+ +o+ +o+
+ XA+ + + + + + xe+
41--
37-
+ +o+ +o+ +o+ +o+ +o+ +o+
+ + + + + + + + + + + + +
[fil m
- o:
33--
+ +o+ +o+ +o+ +o+ +o+ +o+ +o+
+ + + + + + + + + + + + + + + 90" 29 III III
+ + + + + + + + + + + + + + +
25--
+ +o+ +o+
0
+ + + +
0 0 +o+ 0+
21 xo + xc+ +
17--
+ +o+ +o+ +o+ +o+ +o+ +o+
+ + + + + + + + + + + +
- o:
13 [E] @]
+. + + +o+ + + +o+
0
+o+ + + +o+ +
+ + + + + + +
I I I I I I 20 28 36 08 24 32 40 48 56 DETECTOR AND CONTROL ELEMENT ARRANGE ME.NT ITOP VIEW OF CORE)
+
)(
CONTROL ROO SAM DETECTOR 141 IFIM DETECTOR 18) 0 POWER RANGE DETECTOR ASSEMBLIES WITH LPRM DETECTORS USEO IN FIEACTOFI PAO"fECTION SYSTEM TRIP SYSTEM A 1211 0 POWER RANGE DETECTOR ASSEMBLIES WITH LPAM DETECTORS USED IN REACTOR f>ROTECTION SYSTEM TRIP SYSTEM B (221 TOTAL PENETRATIONS FOR NUCLEAR INSTRUMENTS [551 FSAR REV.65 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT VESSEL PENETRATIONS FOR NUCLEAR INSTRUMENTATION FIGURE 7.6-3, Rev 49 AutoCAD: Figure Fsar 7_6_3.dwg
FIGURE 7.6-4-1 REPLACED BY DWG. M1-C51-35, SH. 1 FSAR REV. 65 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT FIGURE 7.6-4-1 REPLACED BY DWG. M1-C51-35, SH. 1 FIGURE 7.6-4-1, Rev. 49 AutoCAD Figure 7_6_4_1.doc
FIGURE 7.6-4-2 REPLACED BY DWG. M1-C51-35, SH. 2 FSAR REV. 65 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT FIGURE 7.6-4-2 REPLACED BY DWG. M1-C51-35, SH. 2 FIGURE 7.6-4-2, Rev. 49 AutoCAD Figure 7_6_4_2.doc
BOTTOM IF TDP GUIDE LOCATION OF DETECTOR DURING NORMAL REACTOR START UP ACTIVE FUEL ACTIVE LENGTH OF FUEL 72 REF DRY TUBE REACTOR VESSEL INUffl.l..,,,..nf!Q.UDC " ' "***
'0' RING IN-CORE HOUSING AND GUIDE TUBE
'0' RING FLANGE <SEE NOTE 3)
DRIVE MOUNT BEARING LOAD ADJUSTMENT MOTOR AND SW ITCH LOADS FSAR REV.65 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT SRM/IRM NEUTRON MONITORING UNIT FIGURE 7.6-5, Rev 49 AutoCAD: Figure Fsar 7_6_5.dwg
MONITOR CIRCUITRY DRIVE CONTROL POSITION SWllCHES MOlOR FLEXIBLE CABLE
~
FSAR REV.65 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT DETECTOR DRIVE SYSTEM SCHEMATIC FIGURE 7.6-6, Rev 49 AutoCAD: Figure Fsar 7_6_6.dwg
FIGURE 7.6-7-1 REPLACED BY DWG. M1-C51-2, SH. 1 FSAR REV. 65 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT FIGURE 7.6-7-1 REPLACED BY DWG. M1-C51-2, SH. 1 FIGURE 7.6-7-1, Rev. 49 AutoCAD Figure 7_6_7_1.doc
FIGURE 7.6-7-2 REPLACED BY DWG. M1-C51-2, SH. 2 FSAR REV. 65 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT FIGURE 7.6-7-2 REPLACED BY DWG. M1-C51-2, SH. 2 FIGURE 7.6-7-2, Rev. 49 AutoCAD Figure 7_6_7_2.doc
FIGURE 7.6-7-3 REPLACED BY DWG. M1-C51-2, SH. 3 FSAR REV. 65 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT FIGURE 7.6-7-3 REPLACED BY DWG. M1-C51-2, SH. 3 FIGURE 7.6-7-3, Rev. 49 AutoCAD Figure 7_6_7_3.doc
FIGURE 7.6-7-4 REPLACED BY DWG. M1-C51-2, SH. 4 FSAR REV. 65 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT FIGURE 7.6-7-4 REPLACED BY DWG. M1-C51-2, SH. 4 FIGURE 7.6-7-4, Rev. 49 AutoCAD Figure 7_6_7_4.doc
FIGURE 7.6-7-5 REPLACED BY DWG. M1-C51-2, SH. 5 FSAR REV. 65 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT FIGURE 7.6-7-5 REPLACED BY DWG. M1-C51-2, SH. 5 FIGURE 7.6-7-5, Rev. 49 AutoCAD Figure 7_6_7_5.doc
FIGURE 7.6-7-6 REPLACED BY DWG. M1-C51-2, SH. 6 FSAR REV. 65 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT FIGURE 7.6-7-6 REPLACED BY DWG. M1-C51-2, SH. 6 FIGURE 7.6-7-6, Rev. 49 AutoCAD Figure 7_6_7_6.doc
FIGURE 7.6-7-7 REPLACED BY DWG. M1-C51-2, SH. 7 FSAR REV. 65 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT FIGURE 7.6-7-7 REPLACED BY DWG. M1-C51-2, SH. 7 FIGURE 7.6-7-7, Rev. 49 AutoCAD Figure 7_6_7_7.doc
O~!Uf11JUI O*l**IMJttll a.Luu*~,
e~ lilt lW11J1l1t*n ..'
IMIICIUOI FSAR REV.65
.t llfMOI GIN!UIUI IOUI FIGURE 7.6-8, Rev 49 rllll)0.1111 SUSQUEHANNA STEAM ELECTRIC STATION llltU"!..,
AutoCAD: Figure Fsar 7_6_8.dwg FUNCTIONAL BLOCK DIAGRAM 1111111 IOCIIIW ,i111,1111u t,--o--+.} Ill~ I
,..,, _. PIIIIOII
- ~"'"
,L._ _ _ _ _,,, lOCII I llr UNITS 1 & 2
- 1tm~*u.1m 1 r,IIIIT I f f-1 IIIPI ~} ~:fci 11,*-111, OF SRM CHANNEL I~ , ... u,
~,,.,, lOCAl l..,.
-}'"" *-tll'III
~ '"' D l ~~~~~ Ml,
,.,.,u r**ur l0Ut * -
FINAL SAFETY ANALYSIS REPORT l*HIWI \".llJITMIII
~ ,~, C :=:=:}:ifrt... 111(1 tUY *llw ~ ~ 1110*ICAU1
+20v 111r1
, , } OulPul
+24V *20V "IOI. Utt NV.
'-----~1-----
- 24V ::::::::L__ UII l(CIJIAIOI POU11J*P11 i~-*-:i:-.:.::~IVI(
CO* I OClt. ,,_,
111,_
II 111, A } UUO'HI IH OPil 1 11 tll
'--------'1 - - - - - + , :~;:-m~v IIIGUI.£ o>l('-!OC*I
OPERATIONAL AMPLIFIER FISSION AMPLIFIER MEAN SQUARE OPERATE AND CHAMBER AND INVERTER ANALOG CALIBRATE SI/ITCH DETECTOR ATTENUATOR FSAR REV.65 LOIi LEVEL REMOTE
.} RECORDER CALIBRATE AND DETECTOR DIODE LOGIC DRIVE UNIT COM FIGURE 7.6-9, Rev 49 SUSQUEHANNA STEAM ELECTRIC STATION FLEXIBLE BIOLOGICAL DRIVE OPERATE AND SHIELD SHAFT CALIBRATE REF SI/ITCH AutoCAD: Figure Fsar 7_6_9.dwg FUNCTIONAL BLOCK DIAGRAM RANGE SI/ITCH>-----~
MOTOR MODULE UNITS 1 & 2 LOCAL LAMP TRIP RESET I T TRIP D I --0----}TRIP D OUTPUT UPSCALE OF IRM CHANNEL * <HI-HI TRIP ON LEVEL>
REMOTE LOCAL LAMP DRIVE CONTROL I .L.: }TRIP C OUTPUT UPSCALE FINAL SAFETY ANALYSIS REPORT TRIP C <Hl>ALARM ON LEVEL>
LOCAL LAMP
+15 -15 I I~ TRIP B ~ } TRIP B OUTPUT DOWN
+2OV SCALE ALARM ON LEVEL
+24V VOLTAGE H. V.
-24V PREREGULATOR -2OV TRIP SET*
COM REGULATOR POI/ER SUPPLY COM TRIP A } TRIP A OUTPUT
'----j OPERATE AND INSTRUMENT INOPERATIVE REF CALIBRATE SI/ITCH I - - - -
TIP CALIBRATION TUBE
~ ----=-
CONTROL ROO BLADE
TOP OF CORE
""2in.
......_.__ -f-
--i-D LPRM DETECTOR c_ _ -t36 in.
-t LENGTH J6in. OF ACTIVE FUEL l"IP CALIBRATION "tlJIII:
e_ _
36 in.
DETECTOR THIMBLE 18in.
ELEVATION t
FSAR REV.65 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT POWER RANGE MONITOR DETECTOR ASSEMBLY LOCATION FIGURE 7.6-10, Rev 49 AutoCAD: Figure Fsar 7_6_10.dwg
P&ID - REACTOR RECIRCULATION SYSTEM FSAR REV. 65 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT P&ID - REACTOR RECIRCULATION SYSTEM FIGURE 7.6-11-1, Rev. 48 AutoCAD Figure 7_6_11_1.doc
FIGURE 7.6-11-2 REPLACED BY DWG. M1-B31-13, SH. 2 FSAR REV. 65 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT FIGURE 7.6-11-2 REPLACED BY DWG. M1-B31-13, SH. 2 FIGURE 7.6-11-2, Rev. 49 AutoCAD Figure 7_6_11_2.doc
FIGURE 7.6-11-3 REPLACED BY DWG. M1-B31-13, SH. 3 FSAR REV. 65 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT FIGURE 7.6-11-3 REPLACED BY DWG. M1-B31-13, SH. 3 FIGURE 7.6-11-3, Rev. 49 AutoCAD Figure 7_6_11_3.doc
APRM 120 Vac Bus A APRM 120 Vac Bus B S3 S3 S3 S3 APRM APRM APRM APRM 2 out of 4 2 out of 4 2 out of 4 2 out of 4 Voter A1 Voter A2 Voter B1 Voter B2 KIAL KIEL K4AL K4E KICL KIGL K4CL K4G KIBL KIFl K4BL K4F KIDL KIHL K4DL K4H FSAR REV.65 FIGURE 7.6-12, Rev 56 SUSQUEHANNA STEAM ELECTRIC STATION AutoCAD: Figure Fsar 7_6_12.dwg ARM CIRCUIT ARRANGEMENT lKIA lKIE lKIC lKIG lKIB lKIF lKID lKIH FOR REACTOR PROTECTION IK4A IK4E IK4C IK4G IK4B IK4F IK4D IK4H UNITS 1 & 2 SYSTEM INPUT FINAL SAFETY ANALYSIS REPORT To RPS Logic A1 To RPS Logic A2 To RPS Logic B1 To RPS Logic B2 NOTE: Contacts are shown in normal operationposition.
LEGEND: K1A, K1B, K1C, K1D, K1E, K1F, K1G, K1H = (APRM Neutron Flux - High or APRM Simulated Thermal Power - High or APRM lnop) and (APRM Not Bypassed)
K4A, K4B, K4C, K4D, K4E, K4F, K4G, K4H = (OPRM Trip or APRM lnop) and (OPRM Not Bypassed)
S3 = APRM Bypass Switch
z -~ - 100 2
u ct a:
I-w a: a:
3 >- - i-- w a
Q. - ,o i--
z 0
i: .
w Q
a::
(!)
z
] ,ot t _ u w j::
<( en X ct
.:i C: ~ w 0.1 w :i:.
- u. a: >-
z -'
- i 0
a:: u. a::
1- w
- J i--
w z_, - 0 .01
~
Cl.
1-
<( z
- it w C: (.)
a::
w
- c: w c..
1-w 0
<(
109
- I a::
w
<(
- -~*
,os 1
...a::,
a.
0 w
a:
w
"'~ "'
..J
..J
- 1
- J u.
- I
!05 SOURCE
- SEE PARAGRAPH 7.7.2.13.1 .1 FOR OISCOSSZON OF SRM/!RM OVERLAP.
FSAR REV.65 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT RANGES OF NEUTRON MONITORING SYSTEM FIGURE 7.6-13, Rev 49 AutoCAD: Figure Fsar 7_6_13.dwg