ML15216A411: Difference between revisions

From kanterella
Jump to navigation Jump to search
(Created page by program invented by StriderTol)
(Created page by program invented by StriderTol)
 
(One intermediate revision by the same user not shown)
Line 3: Line 3:
| issue date = 08/04/2015
| issue date = 08/04/2015
| title = TSTF-505: August 4, 2015 Public Meeting
| title = TSTF-505: August 4, 2015 Public Meeting
| author name = Carte N N
| author name = Carte N
| author affiliation = NRC/NRR/DE/EICB
| author affiliation = NRC/NRR/DE/EICB
| addressee name =  
| addressee name =  
Line 18: Line 18:


=Text=
=Text=
{{#Wiki_filter:TSTF-505 TSTF-505 Norbert Carte (NRC/NRR)August42015 August 4 , 2015 Concerns Concerns*MethodologytodeterminewhenalossoffunctionMethodology to determine when a loss of function has occurred is not described.
{{#Wiki_filter:TSTF-505 Norbert Carte (NRC/NRR)
*OperatorswillneedtomakethisdeterminationOperators will need to make this determination within one hour after the components are declared inoperable.
August 4 4, 2015
*Some regulatory requirements may not be explicitly modeled or addressed in the PRA.
 
*Reductions in redundancy and/or coincidence may introduce new events to be protected against.
Concerns
2 When can a RICT be used?
* Methodology to determine when a loss of function has occurred is not described.
*NEI 06-09 does not allow a RICT for a total loss of function, but does not have detailed guidance on what constitutes a total loss of g function*TSTF-505 allows two or more channels to be inoperable
* Operators will need to make this determination within one hour after the components are declared inoperable.
*When Components are shared between protection and control systems, how many need to be PRA Functional or Operable in order fortherenottobeatotallossoffunction?for there not to be a total loss of function?*Two Types of FunctionsIdentifiedinTSTablesforRTS&ESFAS
* Some regulatory requirements may not be explicitly modeled or addressed in the PRA.
-Identified in TS Tables for RTS & ESFAS-Specific functions identified in regulatory requirements
* Reductions in redundancy and/or coincidence may introduce new events to be protected against.
*IEEE 279-1971 3
2
Functional Requirements (StifPttidCtl)(Separa tion o f P ro t ec tion an d C on t ro l)*GDCs 21 & 24
 
*Effectively increases redundancy requirementsIEEE279 1971*IEEE 279-1971-Explicit Requirement to protect against
When can a RICT be used?
*Single Failures of shared equipment (extra redundancy)
* NEI 06-09 does not allow a RICT for a total loss of function, but does not have detailed gguidance on what constitutes a total loss of function
*Events (alternate channels) -Not discussed below
* TSTF-505 allows two or more channels to be inoperable
*IEEE 603-1991SiiltIEEE279 1971-Si m il ar t o IEEE 279-1971 4 GDC 21-Protectionsystemreliability
* When Components are shared between protection and control systems, how many need to be PRA Functional or Operable in order for there not to be a total loss of function?
-GDC 21Protection system reliability
* Two Types of Functions
-"The protection system shall be designed for high functionalreliabilityRedundancyandindependence functional reliability
  -   Identified in TS Tables for RTS & ESFAS
-Redundancy and independencedesigned into the protection system shall be sufficient to assure that (1) no sin gle failure results in loss of the ()gprotection function -"Typical Configurations:
  -   Specific functions identified in regulatory requirements
*1 out of 2
* IEEE 279-1971 3
*2 out of 3
 
*2 out of 4
Functional Requirements (S
*1 out of 2 taken twice 5
(Separation ti off P   Protection t ti and      dC Control) t l)
GDC 24 -Se paration of protection and control p p"The protection system shall be separated from control systemstotheextentthatfailureofanysinglecontrolsystemsystems to the extent that failure of any single control system component or channel, or failure or removal from service of any single protection system component or channel which is commontothecontrolandprotectionsystemsleavesintactacommon to the control and protection systems leaves intact a system satisfying all reliability, redundancy, and independence requirements of the protection system
* GDCs 21 & 24
."Typical Configurations:
* Effectively increases redundancy requirements
*1outof2 1 out of 2*2 out of 3 vs 1 out of 3
* IEEE 279 279-1971 1971
*2 out of 4
  - Explicit Requirement to protect against
*1 out of 2 taken twice 6
* Single Failures of shared equipment (extra redundancy)
IEEE 279-19714.7, "Control and Protection System Interaction "Clause 4.7.3, "Single Random Failure," states:"Where a single random failure can cause a control system action thatresultsinageneratingstationconditionrequiringprotectivethat results in a generating station condition requiring protective action and can also prevent proper action of a protection system channel designed to protect against the condition, the remaining redundantprotectionchannelsshallbecapableofprovidingtheredundant protection channels shall be capable of providing the protective action even when degraded by a second random failure
* Events (alternate channels) - Not discussed below
.Provisions shall be included so that this requirement can still be met ifachannelisbypassedorremovedfromservicefortestor if a channel is bypassed or removed from service for test or maintenance purposes.Acceptable provisions include reducing the required coincidence, defeating the control signals taken from the redundant channels
* IEEE 603-1991
, or initiatin g a protective action from the ,gpbypassed channel."
  - Similar Si il tto IEEE 279279-1971 1971 4
7 IEEE 279-1971Clause 4.11, "Channel Bypass or Removal from Operation,"states:"The s ystem shall be desi gned to p ermit an y one channel to be ygpymaintained, and when required, tested or calibrated during power operation without initiating a protective action at the systems level.
 
During such operation the active parts of the system shall of themselves continue to meet the single failure criterion
GDC 21 21-Protection Protection system reliability The protection system shall be designed for high functional reliabilityRedundancy reliability Redundancy and independence designed into the protection system shall be sufficient to assure that ((1)) no single g failure results in loss of the protection function Typical Configurations:
.Exception: "One-out-of-two" systems are permitted to violate the single failure criteria during channel bypass provided that acceptable reliability of operation can be otherwise demonstrated.
* 1 out of 2
For example, the bypass time interval required for a test, calibration, or maintenance operation could be shown to be short thtthbbilitffilfthtihlldb th a t the pro b a bilit y o f f a ilure o f th e ac tive c h anne l wou ld b e commensurate with the probability of failure of the "one-out-of-two" system during its normal interval between tests."
* 2 out of 3
8 IEEE279to603Mapping IEEE 279 to 603 MappingIEEE279-1971IEEE603-1991 IEEE 279 1971 IEEE 603 1991Clause 3Clause 4 ClCl0 Clause 4.1 Clause 5.0Clause 4.2Clause 5.1Clause 4.7.1Clause 5.6.3.1(1)Clause472Clause5631(2)
* 2 out of 4
Clause 4.7.2 Clause 5.6.3.1(2)Clause 4.7.3Clause 5.6.3.3Cl474Cl63 Cl ause 4.7.4 Cl ause 6.3 9}}
* 1 out of 2 taken twice 5
 
GDC 24 - Separation p              of p protection and control The protection system shall be separated from control systems to the extent that failure of any single control system component or channel, or failure or removal from service of any single protection system component or channel which is common to the control and protection systems leaves intact a system satisfying all reliability, redundancy, and independence requirements of the protection system.
Typical Configurations:
* 1 out of 2
* 2 out of 3         vs     1 out of 3
* 2 out of 4
* 1 out of 2 taken twice 6
 
IEEE 279-1971 4.7, Control and Protection System Interaction Clause 4.7.3, Single Random Failure, states:
Where a single random failure can cause a control system action that results in a generating station condition requiring protective action and can also prevent proper action of a protection system channel designed to protect against the condition, the remaining redundant protection channels shall be capable of providing the protective action even when degraded by a second random failure.
Provisions shall be included so that this requirement can still be met if a channel is bypassed or removed from service for test or maintenance purposes. Acceptable provisions include reducing the required coincidence, defeating the control signals taken from the redundant channels,, or initiatingg a protective p          action from the bypassed channel.
7
 
IEEE 279-1971 Clause 4.11, Channel Bypass or Removal from Operation, states:
The system y      shall be designed g    to permit p       anyy one channel to be maintained, and when required, tested or calibrated during power operation without initiating a protective action at the systems level.
During such operation the active parts of the system shall of themselves continue to meet the single failure criterion.
Exception: One-out-of-two systems are permitted to violate the single failure criteria during channel bypass provided that acceptable reliability of operation can be otherwise demonstrated.
For example, the bypass time interval required for a test, calibration, or maintenance operation could be shown to be short th t th that the probability b bilit off ffailure il    off th the active ti channel h     l would ld b be commensurate with the probability of failure of the one-out-of-two system during its normal interval between tests.
8
 
IEEE 279 to 603 Mapping IEEE 279-1971 279 1971         IEEE 603-1991 603 1991 Clause 3              Clause 4 Cl Clause 4.1           Cl Clause 5.0 0
Clause 4.2            Clause 5.1 Clause 4.7.1          Clause 5.6.3.1(1)
Clause 4 4.7.2 72          Clause 5 5.6.3.1(2) 6 3 1(2)
Clause 4.7.3          Clause 5.6.3.3 Cl Clause 4 4.7.4 74          Cl Clause 6 6.3 3
9}}

Latest revision as of 09:29, 31 October 2019

TSTF-505: August 4, 2015 Public Meeting
ML15216A411
Person / Time
Site: Diablo Canyon  Pacific Gas & Electric icon.png
Issue date: 08/04/2015
From: Norbert Carte
NRC/NRR/DE/EICB
To:
References
TSTF-505
Download: ML15216A411 (9)


Text

TSTF-505 Norbert Carte (NRC/NRR)

August 4 4, 2015

Concerns

  • Methodology to determine when a loss of function has occurred is not described.
  • Operators will need to make this determination within one hour after the components are declared inoperable.
  • Some regulatory requirements may not be explicitly modeled or addressed in the PRA.
  • Reductions in redundancy and/or coincidence may introduce new events to be protected against.

2

When can a RICT be used?

  • NEI 06-09 does not allow a RICT for a total loss of function, but does not have detailed gguidance on what constitutes a total loss of function
  • When Components are shared between protection and control systems, how many need to be PRA Functional or Operable in order for there not to be a total loss of function?
  • Two Types of Functions

- Identified in TS Tables for RTS & ESFAS

- Specific functions identified in regulatory requirements

Functional Requirements (S

(Separation ti off P Protection t ti and dC Control) t l)

  • GDCs 21 & 24
  • Effectively increases redundancy requirements

- Explicit Requirement to protect against

  • Single Failures of shared equipment (extra redundancy)
  • Events (alternate channels) - Not discussed below

- Similar Si il tto IEEE 279279-1971 1971 4

GDC 21 21-Protection Protection system reliability The protection system shall be designed for high functional reliabilityRedundancy reliability Redundancy and independence designed into the protection system shall be sufficient to assure that ((1)) no single g failure results in loss of the protection function Typical Configurations:

  • 1 out of 2
  • 2 out of 3
  • 2 out of 4
  • 1 out of 2 taken twice 5

GDC 24 - Separation p of p protection and control The protection system shall be separated from control systems to the extent that failure of any single control system component or channel, or failure or removal from service of any single protection system component or channel which is common to the control and protection systems leaves intact a system satisfying all reliability, redundancy, and independence requirements of the protection system.

Typical Configurations:

  • 1 out of 2
  • 2 out of 3 vs 1 out of 3
  • 2 out of 4
  • 1 out of 2 taken twice 6

IEEE 279-1971 4.7, Control and Protection System Interaction Clause 4.7.3, Single Random Failure, states:

Where a single random failure can cause a control system action that results in a generating station condition requiring protective action and can also prevent proper action of a protection system channel designed to protect against the condition, the remaining redundant protection channels shall be capable of providing the protective action even when degraded by a second random failure.

Provisions shall be included so that this requirement can still be met if a channel is bypassed or removed from service for test or maintenance purposes. Acceptable provisions include reducing the required coincidence, defeating the control signals taken from the redundant channels,, or initiatingg a protective p action from the bypassed channel.

7

IEEE 279-1971 Clause 4.11, Channel Bypass or Removal from Operation, states:

The system y shall be designed g to permit p anyy one channel to be maintained, and when required, tested or calibrated during power operation without initiating a protective action at the systems level.

During such operation the active parts of the system shall of themselves continue to meet the single failure criterion.

Exception: One-out-of-two systems are permitted to violate the single failure criteria during channel bypass provided that acceptable reliability of operation can be otherwise demonstrated.

For example, the bypass time interval required for a test, calibration, or maintenance operation could be shown to be short th t th that the probability b bilit off ffailure il off th the active ti channel h l would ld b be commensurate with the probability of failure of the one-out-of-two system during its normal interval between tests.

8

IEEE 279 to 603 Mapping IEEE 279-1971 279 1971 IEEE 603-1991 603 1991 Clause 3 Clause 4 Cl Clause 4.1 Cl Clause 5.0 0

Clause 4.2 Clause 5.1 Clause 4.7.1 Clause 5.6.3.1(1)

Clause 4 4.7.2 72 Clause 5 5.6.3.1(2) 6 3 1(2)

Clause 4.7.3 Clause 5.6.3.3 Cl Clause 4 4.7.4 74 Cl Clause 6 6.3 3

9