ML19322A791

Chapter 7 of Oconee 1,2 & 3 PSAR, Instrumentation & Control. Includes Revisions 1-6

ML19322A791
Person / Time
Site:	Oconee
Issue date:	12/01/1966
From:	DUKE POWER CO.
To:
References
NUDOCS 7911250009
Download: ML19322A791 (57)

Text

__ - - - - - - - - - - - - -

O

~

=u=l

=

E a

C iix  :

1 2

f k e

1 O l l

O --

98 l l

l 7911250M7 d

O TABLE OF CONTENTS Section Page 7 INSTRUMENTATION AND CONTROL 7-1

! 7.1 PROTECTIVE SYSTEMS 7-1 7.1.1 DESIGN BASES 7-1 7.1.1.1 Vital Functions 7-1 7.1.1.2 Principles of Design 7-2 7.1.1.3 Functional Requirements 7-3 1

, 7.1.1.4 Environmental Considerations 7-4 7.1.2 SYSTEM DESIGN 7-4 7.1.2.1 System Description - Reactor Protective System 7-4 1

7.1.2.2 Description - Engineered Safeguards Protective 7-6 system 7.1.2.3 Design Features 7-6b 7.1.2.4 Summary of Protective Actions 7-9 7.1.2.5 Relationship to Safety Limits 7-10 7.1.3 SYSTEMS EVALUATION 7-10 7.1.3.1 Functional Capability - Reactor Protective 7-10 System 7.1.3.2 Functional Capability - Engineered Safeguards 7-10a Protective System 7.1.3.3 Preoperational Tests 7-12 7.1.3.4 Component Failure Considerations 7-12 7.1.3.5 Operational Tests 7-13 J.2 REGULATING SYSTEMS 7-14 7.2.1 DESIGN BASES 7-14 J i 7.2.1.1 Compensation Considerations 7-14  !

7.2.1.2 Safety considerations 7-15

\

99 7-1

\, CONTENTS (Cont'd)

Section Page 7 2.1 3 Startup Considerations 7-15 7 2.2 SYSTEM DESIGN 7-16 7 2.2.1 Description of Reactivity Control 7-16 7 2.2.2 Integrated Reactor-Boiler-Turbine Control System 7-19 723 SYSTEM EVALUATION 7-21 7231 System Failure Considerations . 7-21 7.2 3 2 Interlocking 7-21 7233 E:cergency Considerations 7-22 f 7 2 3.4 Ioss of Ioad Considerations 7-22 73 IIGTRLHENTATION 7-23 p 731 NUCLEAR HISTRUMENTATION 7-23 G 7 3 1.1 Design 7-23 7 3 1.2 Evaluation 7-25 l

732 NONNUCLEAR PROCESS HISTRLHENTATION 7-26 7 3 2.1 System Design 7-26 7 3 2.2 System Evaluation. 7-27 733 INCORE INSTRLHENTATION 7-27 7331 Design Basis 7-27 7332 System Design 7-27 7333 System Evaluation 7-28 7.4 OPEEATING CONTROL STATIONS 7-29

7. k .*1 GENERAL IAYOUP 7-30 7.h.2 INFORMATION DISPIAY AND CONTROL FUNCTIONS 7-30 7.4 3 SU)enRY OF AIARbE 7-31 (j. 7.k.4 C0)tdUNICATION 7-31 _

7-11 100 i

+

)

, i

! I i i i

CONTENTS (Cont'd) l r

i

Section g 7.k.5 OCCUPANCY 7-31  !

7.4.6 AUXILIARY C0!rI5t0L S11TIO55 7-32 i

7.4 7 SAFM'Y FEATURES 32  !

.l 1

l l

l l

e O

l 1

i-e 1

f .

l .....

101 7-111 I'

I

,__i

LIST CF FIGURES (At Rear of Section)

Figure No. Title 7-1 Reactor Protective System Block Diagram 7-2 Nuclear Instrumentation and Protective Systems 7-3 Typical Control Circuits for Engineered Safeguards System Equipment 7-4 Reactor Power masurement Errors and Control Limits 7-5 Reactor ard Steam Temperatures Vs Reactor Power 7-6 Reactor Control Diagram - Integrated Reactor-Boiler-Turbine Control System 7-7 Automatic Control Rod Groups - Typical Worth Curve Vs Distance Withdrawn 7-8 Boiler-Turbine Control Diagram - Integrated Reactor-Boiler-Turbine Control System 7-9 Nuclear Instrumentation Flux Ranges 7-10 Nuclear Instrumen',ation Detector Locations 7-12 Nonnuclear Instrumentation Schematic i

7-12 Incore Detector Iocations 7-13 Typical Arrangement - Incore Instrumentation Channel 7-14 Control Board Layotit l

I l

1 l

1

[

O U .-

7-iv .

102 1

q

h. 7 H;STRUrcirATION AND CONTROL 71 PRCffECTIVE SYSTD4S The protective systems, which consist of the Reactor Protective System and the Engineered Safeguards Protective System, perform the most important control and safety functions. The protective systems extend from the sensing instruments to the final actuating devices, such as trip circuit breakers and pump or valve motor contactors.

7 1.1 DESIGN BASFS The Reactor Protective System monitors parameters related to safe operation and trips the reactor to protect the reactor core against fuel rod cladding damage caused by departure from nucleate bciling (DNB), and to protect against reactor coolant system damage caused by high system pressure. The Engineered Safeguards Protective System monitors parameters to detect failure of the re-actor coolant system, and initiates reactor building isolation and engineered safeguards operation to contain radioactive fission products in the reactor building.

7.1.1.1 Vital Functicas The Reactor Protective System automatically trips the reactor to protect the reactor core under the following conditions:

a. The reactor power, as measured by Ieutron flux, reaches the limit set by the reactor coolant flow. The reactor coolant flow is determined by the number of operating reactor coolant pumps.

b. The reactor outlet temperature reaches an established mav4=m limit.

c. The reactor pressure reaches an establisi ed mini-m limit.

The Reactor Protective Syatem automatically trips the reactor to protect the reactor coolant system u rie.' the following condition:

a. The recetor p. 're reaches an established maximum limit.

The Engineered Safeguards Protective System automatically performs the follow-ing vital functions:

a. Comands operation of the core emergency injection systems upon de-tection of abnormally low reactor coolant pressure,ur 1; ya ; riter -

_ L . l. These conditions are indicative of a loss-of-coolant accident.

b. Commands operation of the reactor building cooling systems upon de-tection of an abnormally high reactor building pressure.

c. Commands closing of the reactor building isolation valves upon detec-tion of an abnormally high reactor building pressure.

v ._

3 7-1 j]}

7.1.1.1.1 Nonvital Functions The reactor protective system provides an anticipatory reactor trip when the reactor start-up rate reaches specified limits.

7.1.1.2 Principles of Desien The major design criteria are summarized as follows:

7.1.1.2.1 Single Failure

a. No single component failure shall prevent the protective systems from fulfilling their protective functions .4 hen action is required.

b. No single component failure shall initiate unnecessary protective system action, provided implementation does not conflict with the above criterion.

7.1.1.2.2 Redundancy All protective system functions shall be implemented by means of redundant sensors, instrument strings, logic and action devices which combine to form the protective channels.

7.1.1.2.3 Independence Redundant protective channels and their associated elements shall be elec-trically independent and packaged to provide physical separation.

Separate detectors and instrument strings are not, in general, employed for protective system functions and regulation or control. Sharing instrumenta-tion for protection and control functions is accomplished within the frame-work of the stated criteria by the employment of isolation techniques to the multiple outputs of various instrument strings. This may be stated as a corollary to the design criteria, ie, a direct short, open circuit, ground fault or bridging of any two points at the cutput terminals of an instrumcat string having multiple outputs shall not resalt in a significaat disturbance within more than one output.

7.1.1.2.4 Loss of Power

a. A loss of power in the reacter protective system shall cause the affected channel to trip.

b. Availability of power to the engineered safeguards protective system shall be.. continuously indicatzed. The loss of ac instrument power, ie, vital bus power, to the instrument strings and bistables will initiate a trip in the affected channals. System actuation requires control power from only one of the two engineered safeguards de control power busses. Equipment is divided between the redundant engineered safeguards channels in such a way that the loss of one of the de power busses does not inhibit the system's intended safeguards functions.

104 7-2 (Revised 4-1-67)

p 7 1.1.2 5 Manual Trip Each protective system shall have a manual actuating switch or switches in the control room which shall be independent of the automatic trip instrumentation.

The manual switch and circuitry shall be simple, direct acting, and electrically connected close to the final actuating device.

7 1.1.2.6 Equipment Removal The Reactor Protective System stall initiate a trip of the chimnel involved when modules, equipment, or subassemblies are removed. Engineered Safeguards Protective System channels shall be designed to provide for servicing a sir 4 1e channel without affecting integrity of the other redundant channels or without compromising the criterion that no single failure shall prevent actuation.

7 1.1.2 7 Testing Manual testing facilities shall be built .'.nto the protective systems to provide for the following:

a. Preoperational testing to give assurance that the protective systems I can fulfill their required functions.

b. On-line testing to prove operability and to demonstrate reliability.

i 7 1.1 3 Functional Requirements The functional requirements of the protective systems are those specified under vital functions together with interlocking functions.

The functional requirements of the Reactor Protective System are to trip the reactor when:

a. The reactor power, as measured by neutren flux, reaches an allowable limit set by the number of operating reactor coolant pumps.

b. The reactor outlet temperature reaches a preset maximum limit.

c. The reactor coolant pressure reaches a preset maximm limit.

d. The reactor coolant pressure reaches a preset mini = = limit.

e. The reactor startup rate reaches a maximum limit while operating be- l low a preset power level. l Interlocking functions of the Reactor Protective System are to:

a. Bypass the startup rate trip when the reactor power reaches a preset value,

b. Inhibit control rod withdrawal en the occurrence of a preceter:nined startup rate, slower than the rate at which reactor trip is in1+,iated.

O m _

.... 105 7-3

The functional requirements of the Engineered Safeguards Protective System are to:

a. Start operation of the high prescure injection system upon detection of a low reactor coolant system pressure.

b. Start operation of the low pressure injection system upon detection of a very low reactor coolant system pressure, A a lec.: px;;ains

--h ve4,-

c. Operate the reactor building isolation valves upon detecticn of a moderately high reactor building pressure.

d. Start the reactor building emergency cooling units upon detection of a moderately high reactor building pressure.

e. Start the reactor building spray system spon detection of a high re-actol building pressure.

7 1.1.h Environmental Considerations The operating environment for equ nt within the reactor building will nor-

= ally be controlled to less than F. The Reactor Protective System instru-mentation within the reactor building is designed for continuous operation in an environ =ent of 140 F, 60 psig, and 100 per cent relative humidity, and will function with lesser accuracy at the accident temperature.

The environment for the neutron detectors will be limited to 150 F with a rela-tive humidity of lesa than 90 per cent. The detectors are designed for con-tinuous operation in an environment of 175 F, 90 per cent relative humidity, and 150 psig.

The Engineered Safeguards Protsetive System equipment inside the reactor build-ing will be designed to operate under the accident environment of a steam-air mixture. l l

Protective equipment outside of the reactor building and control room is de- i signed for continuous operation in an ambient of 140 F and 90 per cent relative humidity. The control room ambient will be maintained at the personnel comfort I level; however, protective equipment in the control room will operate within I design tolerance up to a temperature of 120 F.

7 1.2 SYSTEM DESIGN 71.2.1 System Description - Reactor Protective System Figure 7-1 is a block diagram of the Reactor Protective System. The system consists of four identical protective channels, each terminating in a nonin-verting bistable and reactor trip relay. In the normal untripped state, each channel functions as an AND gate passing current to the terminating bistable and holding the reactor trip relay energized only if all channel inputs are in the normal, energized. (untripped) state. Should any one or more inputs to a channel become deenergized (tripped), the terminating bistable in that < hnnnel i

7-4 106

O fv) trips, de-energizing the reactor trip relay. Thus, for trip signals each channel becomes an OR gate.

Contacts fr >m the four reactor trip relays are arranged into two identical 2-out-of-4 coincidence networks. Each of these coincidence networks controls the power t) one of the two identical control rod drive power supplies.

The reactor trip circuits are shown in more detail on Figure 7-2 which is an overall diagram showing the Nuc1 car Instrumentation System (7-2A), Reactor Protectivt. System (7-2B) and the Engineered Safeguards Protective System (7-2C). Figure 7-2B shows the circuit breakers controlling input power to the control rod drives and the manner in which the reactor trip relays trip these circuit breakers. ,

Reactor trip is accomplished by interrupting all three-phase input power to the control rod drive assemblies. Each control rod drive power supply re-ceives its input power through two circuit breakers in series so that opening of either interrupts that source of power. As shown in Figure 3-59, control rod drive power supplies operate in parallel so that complementary supplies must be de-energized for the control rods to trip. Circuit breakers No. 1 and No. 2 control primary power to one set of power supplies and circuit breakers No. 3 and No. 4 control powe r to the other complementary set. Thus, reactor trip is accomplished by tripping one circuit breaker in each three-phase input.

The control rod drive circuit breakers are equipped with undervoltage coils yN

() which mii-t L- energized for the circuit breaker to be closed or to remain c1 0.ed. The holding voltage for the undervoltage coil of each circuit breaker is taken from the line side of tl.2 circuit breaker through a transformer, i Referring to circuit breaker No. 1, the undervoltage coil is energized through

contacts of trip relays RS1, RS2, RS3 and RS4 under normal conditions with all trip relays energized. If trip relays RSl and RS2, RS1 and RS4, RS3 and RS2 or RS3 and RS4 become de-energized, circuit breaker No. 1 undervoltage coil will be de-energized and the circuit breaker will open. The trip relays which will cause circuit breaker No. 2 to open are RS1 and RS3, RS1 and RS4, RS2 and RS3 or RS2 and RS4. Thus any 2-out-of-4 trip relays will cause either circuit breaker No. 1 or circuit breaker No. 2 to open.

The 2-out-of-4 logic to trip circuit breaker No. 3 and circuit breaker No. 4 is identical.

The trip circuits and devices are redundant and independent. Each breaker is independent of each other breaker such that a single failure within one trip circuit does not affect any other trip circuit or prevent trip. By this ar-rangement, each breaker may be tested independently by means of the manual

test switch. One segment of thq manual reactor trip switch is included in each of the circuit breaker trip circuits to implement the " direct action in the final device" criterion.

The power / flow monitor logic details are also shown on Figure 7-2. There are four identical sets of power / flow monitor logic, one associated with each pro-fN -tective channel. Each set of Icgic receives an independent total reactor

r. '

~ ~'

107 7-5 (Revised 4-18-67)-

O coolant flow signal (fF), a " number of pump maters in operation" signal (Pn)>

and three isolated reactor power level signals (C).

The power / flow monitor continuously compares the ratio of the reactor neutron power to the reactor coolant flow. Should the reactor power as measured by the linear power range channels exceed 1.07 times the total reactor coolant flow, a reactor trip is initiated. All measurements are in terms of per cent full flow or full power. When the reactor is operating above a predetermined neutron power, X7. FP, a reactor trip is initiated immediately upon the loss of a single pump. Below this power 1cvel a reactor trip is initiated when the reactor power to reactor coolant flow ratio exceeds 1.07. Thus below a predetermined reactor power there is opportunity for the control system to reduce the reactor power to an acceptable icvel without a reactor trip.

There are four combinations of logic functions within the power / flow monitor which may lead to a reactor trip; refer to Figure 7-2.

The purpose of (A1) is to compare the total reactor coolant flow against the number of operating pump motors,nP . Normally, the loss of a pump will cause an instantaneous decrease in nP with the flow signal lagging. Should the re-verse ever occur, as might be indicative of a lost pump rotor, (A1) will initiate a reactor trip if the reactor power is greater than a predetermined value, X7. FP (E1).

Below X7. FP, the flux-flow comparator (D1) will trip the reactor when the flux to flow ratio exceeds 1.07.

l The (B1) comparator compares the reactor coolant flow against the number of operating pumps to determine that not more than one pump has been coincident-ally lost. Should (BI) detect the coincident loss of more than one pump, the logic is required to determine that the ratios of reactor power to operating pumps (C1) and reactor power to reactor coolant flow (D1) are both less than 1.07. If either of these conditions is not satisfied, a reactor trip results.

The (C1) comparator continuously compares the number of operating pump motors against the reactor power. A reactor trip is immediately initiated upon loss of a pump when the reactor power is above a predetermined value, X7. FP (El).

Below this power level, (C1) will not actuate a trip unless the (B1) compara-tcr detects the . loss of more than one pump.

7.1.2.2 Description - Engineered Safeguards Protective System Figure 7-2C shows the action initiating sensors, bistables and logic for the Engineered Safeguards Protective System. The major differences between this system and the Reactor Protective System are:

l l

a. Each protective action is initiated by two channels of 2-out-of-3 coin-cidence logic between input signals.

b. Either of the two channels is independently capabic of initiating the l desired protective action through redundant safeguards equipment.

c. Protective action is initiated by the application of power to the termi-nating control relays through the coincident logic.

'~

108 7-6 (Revised 4-18-67)

L p '

There are three independent sensors for each input variable. Each sensor teminates in a bistable device. The outputs of the three bistables asso-ciated with each variable are formed into two identical and independent 2-out-of-3 coincident logic networks or channels. Safeguards action is initi-ated when either of the channels associated with a variable becomes energized through the coincident trip action of the associated bistables. The engi-neered safeguards equipment is divided between redundant actuation channels as shown in Figure 7-2C. The division of equipment between channels is based upon the redundancy of equipment and functions. Where two active safeguards valves are connected in redundant manner, each valve will be controlled by a separate engineered safeguards channel as shown in Figure 7-2C. When active and passive (check va'.ve) safeguards valves are used redundantly, the active valve will be equipped with two OR control elements, each driven by one of the safeguards channels. Redundant safeguards pumps will be controlled in the same manner as redundant active valves. Figure 7-2C shows a typical control scheme fer both safeguards valves and pumps.

Figure 7-3 sh;,ws typical control circuits for equipment serving safeguards functions. Each circuit provides for normal start-stop control by the operator as well as automatic actuation. Normal starting and stopping are initiated by momentary contact pushbuttons or control switches.

The control circuit shown for a low pressura injection system pump is typical of the contr-ller of a large pump started by switchgear. There are three low p pressure injection system pumps, of which two are equipped with single con-trol relays, CR1, powered from separate engineered safeguards channels. The third pump is equipped with two control relays, CRl and CR2, each of which is powered from separate engineered safeguards channels. Energizing the con-trol relays through their associated engineered safeguards enannel energizes the pump circuit breaker closing coil and starts the pump.

The control circuit for a building isolation valve is typical of a motor operated valve which is required to close as its engineered safeguards action.

If the valve is employed as one of two active redundant valves, then it is controlled by a single engineered safeguards channel to CRL. If the valve is employed with a passive redundant check valve, then it is controlled by two engineered safeguards channels with CR1 and CR2 connected in an OR configur-ation, i,

The control relays, when energized by their associated engineered safeguards channel, close the valve through contacts which duplicate the manual CLOSE pushbutton and at the same time override any existing signal calling for the valve to open. A valve limit switch opens the control circuit just before the valve seats to permit torque closing.

Air operated engineered safeguards valves automatically go to their engineered safeguards position upon loss of control air. Valves used with active redun-dant valves are equipped with a single electrical actuator for control by a single engineered safeguards channel as shown in Figure 7-2C. Valves used ,

with redundant passive valves are equipped with two electrical actuators, each controlled by a single safeguards channel operating in an OR configuration.

A Engineered safeguards action is initiated when power is applied to the elec-trical actuator.

U  ;

7-6a (Revised 4-18-67) - .---

109 I 1

The control of the Reactor Building spray pumps is by means of single control O

relays in each pump controller. Each pump is controlled by separate engineered safeguards channels. Safeguards action is initiated when the pump control re-lay is energized by its associated engineered safeguards channel. Each chan-nel consists of a 2-out-of-3 coincidence network which is made up of pressure switches designed to sense directly the Reactor Building pressure. Each chan-nel is powered from a separate engineered safeguard cmtrol power bus.

7.1.2.3 Design Features 7.1.2.3.1 Redundancy The reactor protective system is redundant for all vital inputs and functions.

Redundancy begins with the sensor. Each power range input variable is mea-sured four times by four independent and identical instrument strings. Only one of the four is associated with any one protective channel. The total and complete removal of one protective channel and its associated vital instru-ment strings would not impair the function of any other instrument or pro-tective channel.

There are two start-up rate channels and two intermediate range channels, each with its own independent sensor. .

The engineered safeguards protective system is also redundant for all vital inputs and functions. Each input variable is measured three times by three independent and identical instrument strings. The total removal of any one instrument string will not prevent the system from performing its intended functions.

7.1.2.3.2 Independence The redundancy, as described above, is extended to provide independence in the reactor protective system. Each instrument string feeding into one pro-tective channel is operationally and electrically independent of every other instrument string. Each protective channel is likewise functionally and electrically independent of every other channel.

Only in the coincidence output are the channels brought into any kind of common relationship. Independence is preserved in the coincidence circuits through insulation resistance and physical separation of the coincidence net-works and their switching elements.

~

110 -

7-6b (Revised 4-18-67)

The engineered safeguards protective system instrumentation and control have electrically and physically independent. instrument strings. The output of each bistable is electrically independent of every other bistable. Independ-ence is preserved in the coincidence networks through insulation resistance and physical separation of the switching elements.

7.1.2.3.3 Loss of Power i

The reactor protective system initiates trip action upon loss of power. All bistables operate in a normally energized state and go to a de-energized state to initiate action. Loss of power thus automatically forces the bistables into the tripped state. Figure 7-2B shows the system in a de-ener-gized state.

The engineered safeguards protective system instrumentation strings terminate in bistable trip elements similar to those in the reactor protective system.

Loss of instrument power, up to and including the bistables, forces the bistables into the tripped state. Each redundant channel of engineered safe-i guards protective system coincident logic and comand circuits extending to the engineered safeguards equipment controllers is powered either from bat-tery backed engineered safeguards control power bus No. 1 or bus No. 2.

Engineered safeguards equipment such as pump and motor operators and their starting contactors are powered from the appropriate redundant ac power bus-ses described in 8.2.2. Safeguards action is initiated by energizing command circuits rather than by de-energizing. Redundancy of power supply is dis-j cussed in 8.2.2.

7.1.2.3.4 Manual System Trip The manual actuating devices in the protective systems are independent of the automatic trip circuitry, and are not subject to failures which make the 4

~

I11 7-7 (Revised 4-1-67)

automatic circuitry inoperable. The manual trip devices are independent con-O trol switches for each power controller.

7 1.2 3 5 Equipment Removal The removal of modules or subassemblies from vital sections of the Reactor Pro-tective System will initiate the trip normally associated with that portion sf the system. The removal criterion is implemented in two ways: (1) advantage is taken of the inherent characteristics of a normally energized system, and (2) interlocks are provided.

An inherent characteristic is illustrated by considering the power supply for one of the reactor protective channels. Removal of this power nupply auto-matically results in trip action by virtue of the resulting loss of power.

No interlock is required in such cases. Other instances require a system of interlocks built into the equipment to insure trip action upon remov&1 of a portion of the equipment.

The Engineered Safeguards Protective System provides for servicing without af-fecting the inte6rity of the redundant channels.

7 1.2 3 6 Testing The protective systems will meet the testing criterion and its objectives.

The test circuits will take advantage of the systems redundancy, indepen-dence, and coincidence features which make it possible to manually initiate trip signals in any part of one protective channel without affecting the other channels.

J This test feature will allow the operator to interrogate the systems from the input of any bistable up to the final actuating device at any time during re-actor operation without disconnecting permanently installed equipment.

The test of a bistable consists of inserting an analog input and varying the input until the bistable trip point is reached. The value of the inserted test i signal represents the true value of the bistable trip point. Thus the test l verifies not only that the bistable functions, but also that the trip point is correctly set. I Prestartup testing will follow the same procedure as the on-line testing, ex-cept that calibration of the analo6 instrument strings may be checked with less restraint than during reactor operation.

As shown in Figure 7-2B, the power breakers in the reactor trip circuit may also be manually tested during operation. The only limitation is that not more than one power supply may be interrupted at a time without causin6 a reactor trip.

7 1.2 3 7 Physical Isolation The physical arrangement of all elements associated with the protective systems l will reduce the probability of a sin 6 1e physical event impairing the vital func-l tions of the system. For example, pressure measurements of reactor coolant -

7-8 I12

O pressure will be divided between two redundant pressure taps so as to reduce the probability of collective damage to all sensors by a single accident.

System equipment will be distributed between instrument cabinets so as to re-duce the probability of damage to the total system by some single event.

Wiring between vital elements of the system outside of equipment housing will be routed and protected within the unit so as to maiatain the true redundancy of the systems with respect to physical hazards.

7.1.2.3.8 Primary Power Source The primary source of control power for the reactor protective system is the vital busses described in 8.2.2.6. The source of power for the measuring ele-ments in the engineered safeguards protective system is also from the vital busses. Each redundant channel of engineered safeguare. i protective system coincident logic and command circuits extending to the engineered safeguards equipment controllers is powered either from battery backed engineered safe-guards control power bus No. 1 or bus No. 2. Engineered safeguards equipment such as pump and motor operators and their starting contactors are powered from the appropriate redundant ac power busses described in 8.2.2.

7.1.2.3.9 Reliability p Design criteria for the reactor protective system and the engineered safeguards

( protective system have been formulated to produce reliable systems. System design practices, such as redundant equipment, redundant channels and coinci-dence arrangements permitting in-service testing, have been employed to im-plement reliability of protective action. The best grades of commercially available components will be used in fabrication. A system fault analysis will be made considering the modes of failure and determining their effect on the system vital functions. Acceptance testing and periodic testing will be designed to insure the quality and reliability of the completed systems.

7.1.2.4 Summarv of Protective Actions The abnormal conditions which initiate a reactor trip are listed below:

Trip Value or Trip Variable No. of Sensors Normal Range Condition for Trip Neutron Flux 4 0-100% 107.57. of full power Neutron Flux / Reactor 4 Flux 1 to 4 pumps (1) Number of oper-Coolant Flow 16 Reactor Coolant ating coolant pump Pump Monitors motors exceeds 2 Flow Tubes total coolant flow and reactor power exceeds predeter-mined level. l (2) Ratio of reac- )

O tor power to total d reactor coolant flow exceeds 1.07. -

6 7-9 (Revised 4-18-67) .....

Trip Value or O-Trip Variable No. of Sensors Normal Range Condition for Trip (3) More than one reactor coolant pump motor is lost and reactor power exceeds remaining pump capability by more than 1077..

(4) Reactor power exceeds number of operating pump motors and the reactor power ex-ceeds predetermined level.

Startup Rate 2 0-2 Decades / min 5 Decades / min Reactor Coolant 4 2,100-2,300 2,350 psig Pressure psig 2,050 psig Reactor Outlet 4 520-603 F 610 F Temperature The reactor trip functions of the power / flow monitor logi: are summarized as follows:

Trip Variable No. of Sensors Neutron Flux = 0 4 Reactor Coolant 4 Flow = CF No. of Operating 16 Pumps = Pn Reactor Trip (a) (0 > 1.07Pn) and (0 >X7.)*

(b) (0 > 1.07Pn) and (f F - Pn) = Loss of more than one pump (c) (0 > X%)* and (Pn - f F) = Abnormal relation of Pn > f F (d) (0 > 1.07 f F)

• Predetermined neutror power level to be specified during detail design.

Actions initiated by the engineered safeguards protective system:

Action Trip Condition Normal Value Trip Point High Pressure Reactor Coolant 2,100-2,300 psig 1,800 psig Injection Pressure ,

1 Low Pressure Very Low Rea tor 2,100-2,300 psig 200 psig l Injection Pressure '

' 114 7-9a (Revised 4-18-67) - - - - -

i V Action Trip Condition Normal Value Trip Point Start Reactor High Reactor Atmospheric 4 psig Building Emergency Building Pressure Cooling Unit and Reactor Building Isolation Reactor Building High Reactor Atmospheric 10 psig Spray Building Pressure 7.1.2.5 Relationship to Safety Limits Trip setpoints tabulated in 7.1.2.4 are consistent with the safety limits which have been established from the analyses described in Section 14. The setpoint for each input, which must initiate a trip of the reactor protective system, has been established at a level which will insure that control rods are inserted in sufficient time to protect the reactor core. Likewise, the setpoints for parameters initiating a trip of the engineered safeguards pro-tective system are established at levels which will insure that corrective action is in progress in sufficient time to prevent an unsafe condition.

Factors such as the rate at which the sensed variable can change, instrumenta-tion and calibration inaccuracies, bistable trip times, circuit breaker trip times, control rod travel times, valve travel times and pump starting times have been considered in establishing the margin between the trip setpoints and the safety limits which have been derived.

The flux trip setpoint of 107.5 per cent is based upon the tolerances and error bands shown in Figure 7-4. The incident flux error is the sum of the errors at the output of the measuring channel resulting from rod motion and instru-meet drif t during the interval between heat balance checks of nuclear instru-mentation calibration.

7.1.3 SYSTEMS EVALUATION 7.1.3.1 Functional Capability - Reactor Protective System The reactor protective system has been designed to limit the reactor power to a level within the design capability of the reactor core. In all accident evaluations, the time response of the sensors and the protective channels are considered. Maximum trip timas of the protective channels are listed below.

Since all uncertainties are considered as cumulative in deriving these times, the actual times may be only one-half as long in most cases. Even these max-imum times when added to control rod drop times provide conservative protec-tive action.

a. Temperature - 5 sec

b. Pressure - 0.5 sec

c. Flux - 0.3 sec l

N d. Pump monitor - 1.0 see J

} \

,e 7-10 (Revised 4-18-67) g 1

I

The reactor protective system will limit the power which might result from an O

unexpected reactivity change. Any change of this nature will be detected and arrested by high reactor coolaut temperature, high reactor coolant pressure or high neutron flux protective action.

An uncontrolled rod withdrawal from startup will be detected by the abnormally fast startup rate in the intermediate channels and high neutron flux in the power range channels. A startup rate trip from the intermediate range chan-ncis is incorporated in the reactor protective system.

A rod withdrawal accident at power will immediately result in a high neutron flux trip.

Reduced reactor coolant flow results in a reduced allowable reactor power.

The reactor coolant pump monitor operates to set the appropriate reactor power limit by adjusting the power level trip point. A total loss of flow results in a direct reactor trip, independent of reactor power level.

A loss of reactor coolant will result in a reduction of reactor coolant pres-sure. The low pressure trip serves to trip the reactor for such an occurrence.

A significant secondary steam line rupture is reflected in a drop of reactor coolant pressure. The low reactor pressure trip shuts down the unit for such an occurrence.

7.1.3.2 Functional Capabi!.ity - Engineered Safeguards Protective System The engineered safeguards protective system is a graded protective system.

The progressive actions of the injection systems as initiated by the Engineered O _

116 7-10a (Revised 4-i8-67)

drift during the interval between heat bahnce checks of nuclear instrumenta-tion calibration.

7. 3 SYSTDG EVAIUATION 713 Functional Capability - Reactor Protective System The Reac r Protective System har been designed to limit the re ctor power to a level vi in the design capabiMty of the reactor core. In 11 accident evaluations he time response of the sensors and the protecti,ve channels are considered. ximum trip times of the protective channels,dre listed below.

Since all unce inties are considered as cumulative in deriving these times, the actual times y be only one-half as long in most cas'es. Even these maxi-mum times when add to control rod drop times provide conservative protective action.

_ f3

a. Temperature - see V WG7

b. Pressure - 0 5 s /

c. Flux - 0 3 sec

, d. Pump monitor - 1.0 see The Reactor Protective System will 1 t t)fe power which might result from an unexpected reactivity change. Any chahge/of this nature will be detected and Cj] arrested by high reactor coolant temperafure, high reactor coolant pressure, or high neutron flux protective action.

An uncontrolled rod withdrawal from s rtup wi be detected by the abnormally fast startup rate in the intermediat channels and high neutron flux in the power range channels. A startup ra trip from til intermediate range channels is incorporated in the Reactor Protective System.

/

A rod withdrawal accident at powgr will immediately rest t in a high neutron flux trip.

Reduced reactor coolant flow ryesults in a reduced allowable eactor power. The reactor coolant pump monitor /eperates to set the appropriate reae. tor power limit by adjusting the power level trip point. A total loss of flow results in a di-rect reactor trip, independ'ent of reactor power level.

i A loss of reactor coolan' will result in a reduction of reactor coolant pres-sure. The low pressur trip serves to trip the reactor for such an o'acurrence.

A si6nificant secondary steam line rupture is reflected in a drop of rea tor coolant pressure. Ahe low reactor pressure trip shuts down the unit for auch an occurrence.

7132 Functional Capability - Engineered Safeguards

Protective System i

/] The Engineered Safeguards Protective System is a graded protective system.

V .

The progressive actions of the injection systems as initiated by the Engineered 9

7-11 L17

Safeguards Protective System provide sufficient reactor coolant under all con-ditions while ninimizing the possibility of setting the entire system in op-eration inadvertently.

The key variable associated with the loss-of-reactor-coolant is reactor pres-sure. In a loss-of-reactor-coolant accident, the reactor pressure will fall, starting the high pressure injection system at 1,800 psig. If the high pres-sure injection system does not arrest the pressure drop, then the icy pressure injection system starts upon a signal of 200 psig.

The key variable in the detection of an accident which could endanger Reactor Building integrity is Reactor Building pressure. A Reactor Building pressure of 4 psig initiates operation of the Re tctor Building emergency cooling unit and isolation of the building while a higher pressure of 10 psig initiates operation of the Reactor Building sprays.

7.1.3.3 Preoperational Tests Valid testing of analog sensing elements associated with the protective systems can only be accomplished through the actual manipulation of the measured vari-able and then comparing the results against a standard.

Routine preoperational tests can be performed by the substitution of a cali-brating signal for the sensor except for the Reactor Building spray pumps and valves. Simulated neutron signals may be substituted in each of the start-up, intermediate, and power range channels to check the operation of each channel.

Simulated pressure, temperature, and level signals may be used in a similar fashion. This type of testing is valid for all elements of the system except the sensors. The sensors should be calibrated against atandards during shut-downs for refueling, or whenever the true status of any measured variable cannot be assessed because of lack of agreement among the redundant measure-ments. Routine preoperational tests of the spray systems can be performed by applying the pressure signals direct to the pressure switches.

The final defense against sensor failure during operation will be the operator.

The redundancy of measurements provides more than adequate opportunity for comparative readings. In addition, the redundancy of the systems reduces the consequences of a single sensor failure.

7.1.3.4 Component Failure Considerations The effects of failure can be understood through Figure 7-2B. In the reactor protective system, the failure of any single input in the " tripped" direction places the system in a 1-out-of-3 mode of operation for all variables. Failure of any single .nput in the "cannot trip" direction places the system in a 2-out-of-3 mode of operation for the variable involved, but leaves all other variables in the normal 2-out-of-4 coincidence mode. If the fault were of the

" tripped," open circuit mode, then the system would be able m tolerate a mini-mum of two "cannot trip," short circuit failures within the same measured vari-able before complete safety protection of the variable were lost. With one i18 e -

. 7-12 (Revised 4-1-67)

O C " tripped", open circuit fault, a second identical fault within the same vari-able would trip the reactor.

A similar fault relationship exists between channels as a result of the 2-out-of '+ coincidence output. One " trip" faulted channel places the system in a 1-out-of-3 or single-channel mode. A "cannot trip" faulted channel places the syst m in a 2-out-of-3 mode.

At the final device, a " trip" faulted power breaker does not affect the pro-tective channel mode of operation, reactor trip being dependent upon one of two breakers in the unaffected primary power supply to the control rod drives. A breaker faulted in the "cannot trip" mode leaves the system dependent upon the second breaker in the affected primary power supply.

The Engineered Safeguards Pmtective System is a 2-out-of-3 input type of sys-tem. It can tolerate one f 11t of the "cannot trip" variety in each of the coincidence networks. For this type of fault, all remaining inputs must func-tion correctly. A " tripped" input fault allows any one of the two remaining inputs to initiate action.

Primary power input to both protective systems has been arranged to minimize the possibility of loss of power to either protective system. Each channel of the protective system will be supplied from one of the four vital busses de-scribed in 8.2.2.6. The operator can initiate a reactor trip, independent of the automatic protective action.

t ,

'b' The en61 neered safeguards have been connected to arltiple busses to minimize total loss of safeguard capability. The individual parts of the Engineered Safeguards Protective System can be placed in operation through canual oper-ator controls, independent of the automatic protective equipment.

7 1 '.5 Operational Tests The protective systems are designed and have the facilities for routine manual operational testing.

Most inputs to the protectiv e systems originate from an analog measurement of a particular variable. Every input of this type is equipped with a continuous readout device. A routine check by the operator of each readin6 as compared to the other redundant readinEs available for each variable will uncover measure- ,

ment faults. These elements plus the bistables and relays of the protective l I

systems require a periodic dynamic test. Each system provides for routine test-ing. Each bistable may be manually tripped, and the results of thac trip traced through the system logic and visually indicated to the operator. The trip peint settin6 of each bistable may be verified by the application of an analog siysl t proportional to the measured variable, and that signal may be varied until the bistable element trips.

1 O

jjg -_ ;

7-13

7.2 REGUIATING SYSTEMS 72.1 DESIGN BASES 7.2.1.1 Compensation Considerations Reactor regulation is based upon the use of movable poison (control rods) and chemical neutron poison (boric acid) dissolved in the reactor coolant.

Relatively fast reactivity effects including Doppler, xenon, and moderator tem-perature are controlled by the control rods, which are capable of rapid compen-sation. Relatively slow reactivity effects, such as fuel burnup, fission prod-uct buildup, samarium buildup, and hot-to-cold moderator deficit, are controlled by soluble poison.

It is possible to change the reactor coolant system boric acid concentration to " follow" xenon transients over approxicately 70 per cent of each core cycle without control rod operation. However, to reduce vaste handling requirements resulting from chemical shim operation, control rods are used throughout core life for xenon transient associated with normal power changes. Chemical shim is used in conjunction with control rods to compensate for equilibrium xenon conditions.

At the beginning of first core life when the =oderator temperature reactivity coefficient =ay be zero or slightly positive, the control rod drive assembly response is many tines faster than necessary to maintain the power error within the allowed deadband. Analog co=puter analysis shows that the only change in control response when a positive coefficient exists is an increased frequency of control rod motion.

The reactor controls are designed to maintain a constant average reactor coolant temperature over the load range from 15 to 100 per cent of full power. The steam system operates on constant pressure at all loads. The average reactor coolant temperature decreases over the range from 15 per cent load to zero load.

Figure 7-5 shows the reactor coolant and steam temperatures over the entire load range.

Input signals to the reactor controls include reactor coolant average tempera-ture, megawatt de=and, and reactor power as indicated by out-of-core neutron detectors. The soluble poison dilution is initiated manually and terminated auto =atically or manually. Manual rod control is used below 15 per cent of full power. Automatic or manual rod control may be used above 15 per cent of full power.

Increasing power transients between 20 and 90 per cent power are limited to ramp changes of 10%/ min and step increases of 10 per cent. Power increases above 90 per cent are limited to 5%/ min. Decreasing power transients between 100 and 20 per cent power are limited to ramp changes of 10%/ min and step de-creases of 10 per cent. The turbine bypass system permits a load drop of 40 per cent or a turbine trip from 40 per cent load without safety mye operation.

The turbine bypass system and safety valves permit a 100 per cent load drop without turbine trip to satisfy " blackout" requirements.

~

120 7-14 i

O 7 2.1.2 safety consider c ions 7 2.1.2.1 Shutdown Margin The control rods are provided in sufficient number to allow a hot shutdown that is greater than 1 per cent suberitical with the rod of greatest worth fully withdrawn and typical level of soluble poison (Figure 3-1).

7 2.1.2.2 Reactivity Rate Limits The maximum average rate of change of rgactivity that can be inserted by any group of rods does not exceed 5 8 x 10- ok/k/sec. (A discussion of the acci-dental withdrawal of the rod group of greatest worth is presented in Sec-tion 14.)

The maximum ate of pure water addition does not change reactivity worth :: ore than 7 x 10 Ak/k/sec. Reactivity control may be exchanged between rods and soluble poison consistent with the design bases listed above.

7.2.1.2 3 Power Peaking Limits The nominal reactivity available to a power regulating control rod group is limited so that established radial and axial flux-peaking limits are not ex-ceeded with the rod group in any position at power levels up to 100 per cent power.

O V 7 2.1.2.4 Power Ievel Limits The reactor automatic controls incorporate a high limit and a low limit of power level demand to the reactor. Limits are imposed on reactor megawatt de-mand by lack of feedwater flow capability and reactor coolant system flow capability.

7.2.1 3 startup considerations Over the life of the station, startup will occur at various temperature levels and after varying periods of downtime. Examples of regulating system design requirements as related to startup are:

a. Control rod and/or control rod group " withdraw inhibit" on high startup rate (short period) in the source range and intermediate range.

b. Reactor trip on high startup rate in the intermediate range.

c. Startup control mode. This mode prevents automatic rod with-drawal below 15 per cent power.

d. In startup control mode, the controls are arranged so that the steam system follows reactor power rather than turbine system power demand.

O V jg _.

7-15

e. Sufficient control rod worth is provided to override peak xenon and return to power following a hot shutdown or hot standby.

During cold shutdown it will be necessary to increase boron concentration to maintain shutdown margin. Following a cold shutdown, boron concentration changes will be =ade during startup. A number of rods (or groups), sufficient to pro-vide 1 per cent shutdown margin during startup, is required to be withdrawn prior to a dilution cycle,

f. Minimum pressurizer water level conditions cast be met prior to and during startup.

7 2.2 SYSTEM DESIGN 7.2.2.1 Description of Reactivity Control 7.2.2.1.1 General Description The reactor controls =ove control rods to regulate the power output of the re-actor and maintain constant reactor coolant average temperature above 15 per cent full power. As shown in Figure 7-5, the megawatt demand signal is added to the reactor coolant average temperature error to form a reactor power level demand signal. The reactor power level demand signal is compared to the wer-m3e reactor power level measured by the power range detectora in the nuclear instru=entation. When the resulting reactor power level error signal exceeds the deadband, the output signal is a control rod drive " withdraw" or " insert" cor-and to the controlling rod group. For reactivity control limits see 31.2.2.

7.2.2.1.2 Reactivity Control Reactivity control is maintained by =ovable control rods and by soluble poison (boric acid) dissolved in the reactor coolant.

The caderator temperature coefficient (cold to hot critical), as well as long-term reactivity changes caused by fuel burnup and fission product poisoning, are controlled by adjusting soluble poison concentration.

Short-term reactivity changes caused by power change, xenon poisoning, and moderator temperature change from 0 to 15 per cent power are controlled by con-trol rods.

First cycle values of each unit for the reactivity components and control dis- l tribution are listed in Table 3-5 1 l

l Twenty-five of the 69 control rods are assigned to automatic control of reac- '

tor power level. These control rods are arranged in four sy= metrical groups which operate in sequence. The position of one automatic group is used as an  ;

index to soluble poison dilution. Soluble poison adjustment is initiated man- l ually and terminated automatically. The position of this group acts as a j

" permissive" to restrict the start of dilution to a " safe" rod position pattern '

The position of the same group terminates dilution auto =atically.

x 7-16 . . .

122-

D (U During reactor startup, control rods are withdrawn in a predetermined sequence in sy= metrical Groups of four or more rods. The group size is preset, and in-dividual control rod assignments to a group are =ade at a control rod grouping panel. However, the operator can select any individual control rod and any control rod group for motion as required.

A typical control rod group withdrawal scheme is as follows:

(

Group 1 12 rods Group 2 12 rods Group 3 12 rods Group 4 8 rods Group 5 8 rods'

" Regulating Groups 7 d Group 8 4 rods.

An automatic sequence logic unit is used for reactor control with four regulat-ing roi groups in the power range. This unit allows operation of no more than one control rod group simultaneously, except over the last 25 per cent travel of one group and the first 25 per cent travel of the next group when overlap-ping motion of two groups is permitted. This tends to linearize the reactivity insertion from group to group as shown in Figure 7-7

\ As fuel burnup progresses, dilution of the soluble poison is controlled as fol-lows:

When the partially withdrawn active control rod group reaches the fully with- 1 drawn point, interlock circuitry permits setting up a flow path from a demin- )

eralized water tank, in lieu of the normal flow path of borated nakeup, to the reactor coolant system. Demineralized water is fed to the reactor coolant sys-tem, and borated reactor coolant is removed.

The reactor controls insert the active regulating group to compensate for the reduction in poison concentration. When the control group has been inserted to the 75 per cent withdrawn position, the dilution flow is automatically blocked. 'Ihe dilution cycle is also terminated automatically by a preset i timing device, which is independent of rod position. Normally, a dilution cycle is required every several days.

7 2.2.1 3 Reactivity Worth The maximum worth of any group of the four automatic control groups is approxi- .

mately1.2%ok/k. At design speed, a group requires approximately 6 minutes l to tray (l full stroke. This rate of control rod group travel results in a resetivity rate of 5 8 x lo Sak/k/sec.

l The maxi =um rate of reactivity addition with the soluble poison system, i.e.,

in,jecting unborated water fron the makeup system at 70 gpm maximum, is 7.0 x 10- ak/k/sec.

I G _

, 7-17 ,..

Table 3-6 shows a shutdown reactivity analysis. The red worth provided gives a shutdown =argin in excess of 4.0% Ak/k under nor=al conditions, and a margin in excess of 1% Ak/k with the rod of greatest worth stuck in the withdrawn position.

Under conditions where cooldown to reactor building ambient conditions is re-quired, concentrated soluble poison will be added to the reactor coolant to pro-duce a shutdown cargin of at leass J Ak/k. The reactivity changes from hot zero power to a cold condition, and s he corresponding increases in boric acid concentration, are listed in Table 3-6.

7 2.2.1.4 Reactor Controls The reactor controls are made up of analog co=puting equipment with inputs of megawatt demM, core rc r g -power, and reactor coolant average temperature.

The output of the controller is an error signal that causes the control rod drive assembly to be positioned until the error signal is within a deadband.

A block diagram of the reactor control is shown in Figure 7-6.

First, reactor power level demand (Nd ) is computed as a function of the cega-watt demand (Wd ), and of the reactor coolant system average temperature devia-tion (5T) from the set point, according to the following equation:

N, = K1 Wa+K2 IE + $ E dt)

Itgawatt demand is intrcduced as a part of the demand signal through a propor-tional unit having an adjustable gain factor (K1). The temperature deviation is introduced as a part of the decand signal after proportional plus reset (in-tegral) action is applied. For the temperature deviation, K2 is the adjustable gain, and v is the adjustable integration factor.

The reactor power level de=and (N d ) is then compared with the actual reactor power level signal (Ni ), which is derived from the nuclear instru=entation.

The resultant error signal (Nd - Ni) is the reactor power level error signal (Ep ).

When the reactor power level error eige1 (E )p exceeds the deadband settings, the control rod drive assembly receives a co==and that withdraws or inserts rods, depending upon the polarity of the power error signal.

The following additional features are provided with the reactor power control-1er:

a. An adjustable low limit on the megawatt demand signal (W d ) to cut out the automatic reactor control action.

b. A high limit on reactor power level demand (Nd )*

c. An adjustable lov limit on reactor power level de=and (Nd)*

Separate from, but related to, the automatic reactor control system .s the re-actor coolant flow signal c,ystem. Power to each reactor coolant pump motor is monitored as an indication of reactor coolant flow. Iogic units continuously ,

7-1e .....

124

A I \

V compare the number of energized pu=ps to the =easured reactor power to sense that the flow is adequate for the operating power level. If the flow is lov, the reactor power level demand is reduced by the Integrated Reactor-Boiler-Turbine Control System.

7 2.2.2 Integrated Reactor-Boiler-Turbine Control System The Integrated Reactor-Boiler-Turbine Control System maintains constant aver-age reactor coolant temperature and constant steam pressure in the unit during steady state and transient operation between 15 and 100 per cent full power.

Figures 7-6 and 7-8 show the overall system. The system is based on the Inte-l grated Boiler-Turbine concept widely used in fossil fuel-fired utility plants.

It combines the stability of a turbine-following system with the fast response of a boiler-following system. Opti=um overall unit performance is maintained by limiting steam pressure variations; by limiting the unbalance that can exist among the steam generator, turbine, and the reactor; and by limiting the total unit load demand upon loss of capability of the steam generator feed sys-tem, the reactor, or the turbine generator.

Figure 7-6 shows the reactor control portion of the Integrated Reactor-Boiler-Turbine Control System described in 7 2.2.1.4. Figure 7-8 shows the boiler-turbine control portion of the Integrated Reactor-Boiler-Turbine Control Sys-tem. This control receives inputs of megawatt demand, system frequency, and stesm pressure, and supplies output signals to the turbine bypass valve, tur-bine speed changer, and steam generator feedwater flow controls with changing operating conditions.

The turbine and steam genere tor are capable of automatic control from zero power to full power with optional manual control. The reactor controls are designed for manual operation below 15 per cent full power and for automatic or manual operation above 15 per cent full power.

The turbine is operated as a turbine-following unit with the turbine control valve pressure set point varied in proportion to megawatt error. The steam generator is operated as a boiler-following system in which the feedwater flow demand to the steam generator is a su=mation of the megawatt de=and and the steam pressure error.

The Integrated Reactor-Boiler-Turbine Control obtains a load demand signal j from the area load control or from the operator. A frequency loop is added to i I

compensate for the speed droop of the turbine speed controls. The load de-mand is restrained by a maximum load limiter, a minime load limiter, a rate limiter, and a runback limiter. In normal operation the limits would be set as follows:

Maximum load limit 100%

l Minimum load limit 15%

l Rate limit 10%/ min l

The runback limiter acts to limit the load demand if one or more reactor cool-ant pumps are inoperative, or total feedwater flow lags total feedwater demand by more than 5 per cent.

t L _

\

7-19 . .

ID

The output of the limiters is a megawatt demand signal which is applied to the turbine controls, steam generator controls, and reactor controls in parallel.

The reactor controls respond to the megawatt de=and signal as described in 7 2.2.1.4.

7 2.2.2.1 Turbine Controls The megawatt demand is compared with the generator cegawatt output, and the re-sulting megawatt error signal is used to change the steam pressure set point.

The turbine valves then change position to control steam pressure. As the meg-avatt error reduces to zero, the steem pressure set point is returned to the steady state value. By limiting the effect of megawatt error on the steam pressure set point, the system can be adjusted to permit controlled variations in steam pressure to achieve any desired rate of turbine response to megawatt demand.

7 2.2.2.2 Steam Generator Controls Control of the steam generator is based on catching feedwater flow to megawatt decand with bias provided by the error between steam pressure set point and steam pressure. The pressure error increases the feedwater flow de=and if the pressure is lov. It decreases the feedvater flow de=and if the pressure is high.

The basic control actions for parallel steam generator operation are:

a. Megawatt demand converted to feedwater de=and.

b. Steam pressure compared to set pressure, and the pressure error con-verted to feedwater demand.

c. Total feedwater de=and computed from sLm af a and b.

d. Total feedwater flow demand split into feedwater flow demand for each steam generator.

e. Feedwater demand compared to feedwater flow for each steam generator.

The resulting error signals position the feedvater flow controls to match feedwater flow to feedwater demand for each steam generator.

For operation below 15 per cent load, the steam generator controls act to main-tain a preset minimum downcomer water level. The conversion to level control is automatic and is introduced into the feedwater control train through an auctioneer. At lov loads below 15 per cent, the turbine bypass valves will operate to limit steam pressure rise.

ice steam generator controls also provide ratio, limit, and n nback actions as shown in Figure 7-8 which include:

! a. Steam Generator Ioad Ratio Control Under normal conditions the steam generators vill each produce one-half of the total lead. Steam generator load ratio control is JI 7 20 .....

lh i

'd provided to balance reactor coolant temperatures during operation with more reactor toolant pumps in one loop than in the other.

b. Rate Limits Rate limiters restrict loading or unloading rates to those which are compatiblewiththeturbineand/orthesteamgenerator.

c. Water Ievel Limits A maximum water level limit prevents gross overpumping of feedwater and insures superheated steam under all operating conditions.

A minimum vater level limit is provided for low load control.

d. Reactor Coolant Pump Limiters These limiters restrict feedwater demand to catch reactor coolant pumping capability. For example, if one reactor coolant pump is not operating, the mimum feedwater demand to the steam generator in the loop with the inoperative pump is limited to approximately one-half nor=al.

e. Reactor Outlet and Feedwater Iov Temperature Limits These limiters reduce feedwater demand when the reactor outlet tem-

'v perature is low, or the feedwater temperature is lov.

i

f. Feedwater Pump Capability A feedwater pump capability runback signal limits the megawatt de-cand signal whenever total feedwater flov la6s total feedwater de-mand by 5 per cent.

723 SYSTEM EVALUATION 7231 System Failure Considerations Redundant sensors are available to the Integrated Reactor-Boiler-Turbine Cori-trol System. The operator can select any of the redundant sensors from the control room.

Manual reactivity control is available at all power levels.

Loss of reactor controller electrical power reverts reactor control to the manual mode.

7232 Interlocking Control rod withdrawal is prevented on a positive short period below 10 per cent power.

! 7-21 l27 1

The autot,atic sequence logic sets a predetermined insertion and withdrawal pattern of the four regulating rod groups.

Control circuitry allows manually selected operation of any single control rod or control rod group throughout the power range.

An interlock will prevent actuation of both withdrawal and insertion of con-trol rods s1=ultaneously with the insertion signal overriding the withdrawal.

Control rod drive switching circuits allow withdrawal of no more than a single control rod group in the manual mode.

The auto =atic sequence logic limits regulating rod motion to one group out of four at one time, except at the upper and lower 25 per cent of stroke where operation of two groups is per=1tted to linearize reactivity versus stroke.

Maximum and minimum limits on the reactor power level demand signal (N d ) pre-vent the reactor controls from initiating undesired power excursions.

Maximum and minimum levels on the megawatt demand signal (IG d ) prevent the re-actor controls from initiating undesired power excursions.

7233 Emergency Considerations Ioss of power to the rod drive control system initiates a reactor trip.

When emergency conditions arise which exceed the capability of the control sys-tem, the operator can revert to the manual control mode.

7 2 3.4 Ioss of Ioad Considerations The unit is designed to accept 10 per cent step load rejection without safety valve action or turbine bypass valve action. The combined actions of the con-trol system and the turbine bypass valve permit a 40 per cent load reduction, or a turbine trip from 40 per cent load without safety valve action. The com-bined actions of the' control system, the turbine bypass valve, and the safety valves permit a 100 per cent load rejection without turbine trip. This per-mits the unit to ride through a " blackout" condition, i.e., sudden rejection of electrical load down to auxiliary load without turbine trip. (The" black-out" provisions are discussed in Section 14.)

The features which permit continued operation under load rejection conditions include:

a. Integrated Reactor-Boiler-Turbine Control System During normal operation the Integrated Reactor-Boiler-Turbine Con-trol System (see Figure 7-8), controls the unit, load in response to load demand from the automatic load center or from the operator.

Durin6 normal load changes and smil frequency chan6es, turbine con-trol is throu6h the speed chan6er to maintain constant steam pres-sure.

7-22 2+

O U During large load and frequency upsets, the turbine governor takes control to regulate frequency. For these upset conditions, fre-

• quency error at the input to the integrated control system becomes more important in providing load matching.

b. 100 Per Cent Relief Capacity in the Steam System This provision acts to reduce the effect of large load drops on the reactor system.

Consider, for example, a sudden load rejection which is greater than 10 per cent. When the turbine Senerator starts acceleratin6s the governor valves and the intercept valves begin to close to maintain set frequency. At the same time the megawatt demand sig-nal is reduced, which reduces the governor speed changer settin6s feedwater flow demand, and reactor power level demand. As the governor valves close, the steam pressure rises and acts through the control system to reinforce the feedvater flow demand reduction already initiated by the reduced megawatt demand signal. In addi-tion, when the load rejection is of sufficient magnitude, the tur-bine bypass valves open to reject excess steam to the condenser, and the safety valves open to exhaust steam to the atmosphere.

The rise in steam pressure, and the reduction in feedwater flow, causes the average reactor coolant temperature to rise which re-inforces the reactor power level demand reduction, already estab-lished by reduced megawatt demand, to restore reactor coolant tem-(' perature to set value. ,

l As the turbine generator returns to ut frequency, the turbine con-trols revert to steam pressure control rather than frequency control.

This feature holds steam pressure within relatively narrow limits and prevents further large stea.n pressure changes which could impose additional load changes of opposite si6 n on the reactor coolant sys-tem. As a result, the reactor, the reactor coolant system, and the steam system run back rapidly and smoothly to the new load level.

73 INSTRU E EATION 731 HUCIEAR INSTRGERATION The nuclear instrumentation system is shown in Figure 7-2A. Emphasis in the design is placed upon accuracy, stability, and reliability. Instruments are redundant at every level. The design criteria stated in 71.1.2 have been applied to the design of this instrumentation.

7 3 1.1 Design The nuclear instrumentation has eight channels of neutron information divided into three ranges of sensitivity: source range, intermediate range, and power range. The three ran6es combine to give a continuous measurement of reactor p power from source level to approximately 125 per cent of full power or ten Q decades of information. A minimum of one decade of overlapping information is

provided between successive higher ranges of instru=entation. The relation-OT ship between instru=ent ranges is shown in Figure 7-9 The source range instru=entation has two redundant count rate channels originat-ing in two high sensitivity proportional counters. These channels are used over a counting range of 1 to 105 counts /see as displayed on the operator's control console in terms of log counting rate. The channels also measure the rate of change of the neutron level as displayed for the operator in ter=s of startup rste from -1 to +10 decades / min. No protective functions are associated with the source range because of inherent instrumentation limitations encountered in this range. However, one interlock is provided, i.e., a control rod with-draw hold and alarm on high startup rate in either chanel.

The intermediate range instrumentation has two log N channels originating in two identical electrically gnema-compensated ion chambers. Each channel pro-vides seven decades of flux level information in terms of log ion cha=ber cur-rent and startup rate. The ion chamber output range is from 10-11 tol10 4 am-peres. The startup rate range is from -1 to +10 decades per minute. Protec-tive action on high startup rate is provided by these channels. A high start-up rate on either channel causes a reactor trip. Prior to a reactor trip, high startup rate in either channel vill initiate a control rod withdraw hold interlock and alarm.

The power range channels have four linear level channels originating in 12 un-compensated ion chachers. The channel output is directly proportional to re-actor power and covers the range from 0 to 125 per cent of full power. The s system is a precision analog system which employs a digital technique to pro-vide highly accurate signals for instru=ent calibration and reactor trip set point calibration. The gain of each channel is adjustable, providing a means for calibrating the output against a reactor heat balance. Protective action on high flux level consists of reactor trip initiation by the power range chan-nels at preset flux levels.

The following additional features are pertinent to the nuclear instru=entation system:

a. Independent power supplies are included in each channel. Primary power originates from the vital busses described in 8.2.2.6. Where applicable, isolation transformers are provided to insure a stable, high-quality power supply,

b. The proportional counters used in the source range are designed to be secured when the flux level is greater than their useful operat-ing range. This is necessary to obtain prolonged operating life.

c. The inter =ediate range channels are supplied with an adjustable source of ga=ma-compensating voltage.

7 3 1.1.1 Test and calibration Test and calibration facilities are built into the syrtem. The tect facilities will meet the require =ents outlined in the discussion of protective systems testing.

00 7-24

(D i Facilities for calibration of tne various channel amplifiers and measuring equipment will also be a part of the system.

. 731.1.2 Power Range Detectors Twelve uncompensated ionization chambers are used in the power ran6e channels.

Three chambers are associated with each channel, i.e., one near the bottom of the core, a second at the midplane, and a third toward the top of the core.

The outputs of the three chambers are combined in their respective linear am-plifiers. A means is provided for reading the individual chamber outputs as a manual calibration and test function during normal operation.

7 3 1.1 3 Detector Iceations The physical locatien of the neutron detectors is shown in Figure 7-10. The power range detectors are located in four primary positions, 90 degrees apart around the reactor core.

The two source range proportional counters are located on opposite sides of the core adjacent to two of the power range detectors.

The two inter =ediate range compensated icn chambers are also located on opposite sides of the core, but rotated 90 degrees from the source range detectors, p 731.2 Ivaluation

\

\

The nuclear instrumentation will =onitor the reactor over the 10 decade range from at thesource to 125detectors power range per centwill of be fullapproximately power. Thefullpgverneutronfluxlevel 10 nv. The detectors em-ployed will provide a linear response up to approximately !+ x 1010 ny before they are saturated.

The intermediate ran6e channels overlap the source ranSe and the power range channels in an adequate manner, providing the continuity of information needed during startup.

The axial and radial flux distribution within the reactor core will be mea-sured by the incore neutron detectors (7 3 3). The out-of-core detectors are primarily for reactor safety, control, and operation information.

731.2.1 Ioss of Power The nuclear instrumentation draws its primary power from redundant battery-backed vital busses described in 8.2.2.6.

731.2.2 neliability and Component Failure The requirements established for the reactor protective system apply to the nuclear instrumentation. All channel functions are independent of every other channel, and where 6si nals are used for safety and control, electrical isola-tion is employed to meet the criteria of 71.1.2.

O O --

7-25 l3)

r-731.23 Irotective Requirements O-/

The relation of the power range channels to the Reactor Protective System has been described in Section 7.1. To maintain the desired accuracy in trip action, the total error from drift in the power range channels 4111 be held to t.1/2 per '

cent at full power over a 30 day period. Routine tests and recalibration will insure that this degree of deviation is not exceeded. 31 stable trip set points of the power range channels will also be held to an accuracy of t1/2 per cent of full power. The accuracy and stability of the equipment will be verified oy vendor tests.

732 NOUIiUCIZAR PROCSSS IU3TRUICITATION 732.1 System Design The nonnuclear instrumentation measures temperatures, pressures, flows, and icvels in the reactor coolant system, steam system, and auxiliary reactor systems. Process variables required on a continuous basis for the startup, oJeration, and shutdown of the unit are indicated, recorded, and controlled from the centrol rocm. The quantity and types of process instrumentation pro-vided will insure safe and orderly operation of all systems and processes over the full operating range of the plant. The a:: cunts and types of various in-struments and controllers shown are intended to be typical examples of those which will be included in the various systems when final design details have j been ccapleted. The nonnuelcar process instrumentation for the reactor cool-ant is shown in F1 6urc 7-11 c.nd on the auxiliary reactor system drawings in Cections 5, 6, 9, and 11. Process variables are monitored as shosn on the nonnuclear instrumentation and auxiliary reactor system drawings and are as follows:

a. In general, resiutance elements are used for temperature measure-

=cnts. Fast-response resistance elements monitor the reactor out-let temperature. The outputs of these fast-response elements sup-ply signals to the protective system.

b. Pressures are measured by force balance transmitter devices. Pres-sures are measured in the reactor coolant system, the steam system, and the auxiliary reactor systems. Pressure signals for high and low reactor coolant pressures and high reactor building pressure are provided to the protective systems.

c. Reactor coolant pump motor operation is monitored as an indication of reactor coolant flow. This infor=ation is fed to the reactor controls and reactor protective system. In addition, reactor cool-ant flow signals are obtained from one calibrated flow tube and four flow transmitters installed in each reactor coolant loop. Buffered outputs from each of the flow transmitters are employed to provide analog flow signals for the reactor protective system.

d. Flow in the steam system is obtained throu6h the use of calibrated feedwater flow no::les. Flow infor=ation is utilized for control and protective functions in the steam system. Steam generator level

=easurements are provided for control and alarm functions.

7-26 (Revised 4-18-67)

e e. Pressurizer level is =easured by differential pressure transmitters calibrated to operating te=perature and pressure. Zni: 1 ~1 _..f:r

-a

• n ' - f: a ts ,'.m n'~c-~' rf:gu rt ;rct::ti c: 7- + ;The pressurizer level is controlled by the reactor coolant system takeup and letdown flow rate. The letdown flow rate is remote canually con-trolled to the required flow. Pressurizer level signals are pro-cessed in a level controller whose output positions the pressurizer level control valve in the makeup line to =aintain a constant level.

f. Pressurizer and reactor coolant system pressure is maintained by a control system which compares the reactor coolant system pressure with a setpoint, and then energizes pressurizer electrical heaters in banks at preset pressure values below 2,200 psia or actuates spray control-valves if the pressure increases to 2,250 psia.

7 3 2.2 System Evaluation Redundant instrumentation has been provided for all inputs to the protective sys-tems and vital control circuits.

Where wide process variable ranges are required and precise control is involved, both wide range and narrow range instru=entation are provided.

Where possible, all instru=entation components are selected from standard com-mercially available products with proven operating reliability.

(Vg) .

All electrical and electronic instrumentation required for safe and reliable op-eration will be supplied from redundant vital a-c instrumentation busses.

733 IUCORE INSTRUMENTATION 7331 Design Basis The incore instrumentation system provides neutron flux and te=perature detec-tors to monitor core performance. No protective action or direct control func-tions are performed by this system. All high pressure system connections are terminated within the reactor building. Incore, self-powered, neutron detec-tors measure the neutron flux in the core, and temperature detectors measure the core temperature differential to provide a history of power distributions and disturbances during power operating = odes. Data obtained will provide mea-sured power distribution information and fuel burnup data to assist in fuel canagement decisions.

7332 System Design 7 3 3 2.1 System Description l l

The incore instrumentation system consists of assemblies of self-powered neu- l tron detectors, temperature detectors, and support tubes located at 51 prese- '

lected radial positions within the core. Twenty-nine assemblies are positioned within an eighth segment of the core to provide data for a detailed analysis p)

(

of that segment while 22 additional assemblies are distributed throughout the balance of the core to provide data for overall core perfor=ance calculations.

, The incere monitoring locations are shown by Figure 7-12. -l 9

7-27 }N

Each of the 51 incore detector assemblies consists of four local flux detec- '

tors, one background detector, two (inlet and outlet) temperature detectors, and a calibration tube. The local detectors are positioned at four different axial elevations to provide the axial flux gradient. The outputs of the local flux detectors are referenced to the background detector output so that the differential signal is a true measure of neutron flux. The te=perature detec-tors, one located at the top of the fuel assembly and the other positioned just below the bottom of the fuel assembly, measure the temperature difference across the core to verify hot channel calculations and flow distribution in the Core.

Readout for the incore detectors is performed by the data reduction system rather than by individual indicators. This system sounds ala=s if local flux conditions exceed predetermined values.

When the reactor is depressurized, the incore detector assemblies can be insert-ed or withdrawn through guide tubes which originate at a shielded area in the reactor building as shown in F16ure 7-13 These guide tubes, after completing two 90 degree turns, enter the bottom head of the reactor vessel where internal guides extend up to the e=pty centar tubes of 51 selected fuel assemblies. The center tube then serves as the guide for the incore detector assemblies. The incore detector assemblies are fully withdrawn only for replacement. During refueling operations, the incore detector assemblies are withdrawn approximate-ly 13 feet to allow free transfer of the fuel asse=blies. After the fuel as-semblies are placed in their new locations, the incore detector assemblies are returned to their fully inserted position in the core, and the high pressure seals are secured.

7 3 3 2.2 Calibration Techniques The nature of the proposed detectors permits the manufacture of nearly identi-cal detectors which vill produce a high relative accuracy between individual detectors. The detector signals must be compensated for burnup of the neutron sensitive material. The data handling system integrates each detector output current, and Senerates a burnup correction factor to be applied to each detec-tor signal before printing out the corrected signal in te ms of per cent of full power. The data handling system computes an average power value for the  ;

entire core, nor=alized to the reactor heat balance. This average power value is compared to each neutron detector signal to provide the core power distribu-tion pattern.

~~-

G 4 ..... 2 - ,:=tuu d;t;; tar  : p; & = :2 out of : ra. ..+ alative -

- tq;A. c 1 lim .. ;f . . 2....~. _a m._Zia m ...s su m .  % 4mt

- spt L 14th;nal.

7333 system Evaluation 73331 operating Experience l

The AECL has been operating incare, self-powered, neutron detectors at Chalk River since 1962. They have bee.:2 successfully applied to both the NEX and NRU reactors. They have been operated at fluxes beyond those expected in nor-mal pressurized water reactor service.

Y . ....

134 1 7-28

O b 73332 B&W Experience Self-powered, incore, neutron detectors have been assembled and irradiated in The Babcock & Wilcox Company Development Program which started in 3964. Re-sults from this program have produced confidence that self-powered detectors used in an incore instrument system for pressurized water reacters will per-fonn as well if not better than any system of incore instrumentation currently in use.

The B&W Development Program includes these tests:

a. Parametric studies of the self-powered detector.

b. Detector ability to withstand PWR environment.

) c. Multiple detector assembly irradiation tests.

d. Back6round effects.

e. Readout system tests.

f. Mechanical withdrawal-insertion tests.

g. Mechanical high pressure seal tests.

h. Relationship of flux measurement to power distribution experiments.

d The following preliminary conclusions have been drawn from the results of the i test pro 6 rams at the B&W Lynchburg Pool Reactor, the B&W Test Reactor, and the Big Rock Point Nuclear Power Plant:

a. The detector sensitivity, resistivity, and temperature effects are i satisfactory for use.

b. A multiple detector assembly can provide axial flux data in c single channel and can withstand reactor environment. An assembly of six local flux detectors and two thermocouples has been successfully operating in the Big Rock Point Reactor since May 1966.

I

c. Data collection syste=s are successful as read-out systems for incore monitors.

d. Background effects vill not prevent satisfactory operation in a PWR environment.

Irradiation of detector assemblies and evaluation of performance data are con-tinuin6 to provide detailed design information for the incore instrumentation system.

7.h OPERATING CONTROL STATIONS .

Following proven power station design philosophy, all control stations, switches, controllers, and indicators necessary to start up, operate, snd shut down the C units vill be located in one control room. Control functions necessary to _

7-29 ,

335

l

=aintain safe conditions after a loss-of-coolant accident vill be initiated from the centrally located control room. Controls for certain auxiliary sys-91 te=s may be located at remote control stations when the system controlled does  ;

not involve unit control or emergency functions. )

7 4.1 GENERAL LAYOUT  !

i The control room vill be designed so that one man can supervise operation of both units during normal steady state conditions. During other than nor=al operating conditions, other operators vill be available to assist the control i operator. Figure 7-14 shows the control room layout for the station. The con- )

trol board is divided into relative areas to show the location of control sta- 1 tions and infor=ation display pertaining to various sub-syste=s. i 7 4.2 INF01W.ATION DISPLAY AND CONTROL FUNCTIONS Consideration is given to the fact that certain syste=s nor= ally require more attention from the operator. The integrated reactor-boiler-turbine control system vill therefore be located nearest the center line of the boards (Sections 1, 2, and 3 on Figure 7-14).

On Section 1 of the control board, one indicator vill be provided for each group of control rods. Fault detectors in the rod drive control system vill be used to alert the operator should an abnomal condition exist for any individ-ual control rod. Switches will be provided to allow the 6perator to monitor any single control rod position on a co= mon indicator. Displayed in this sa=e area vill be li=it lights for each control rod group and all nuclear instrumen-tation infor=ation required to start up and operate the reactor. Control rods are to be =anipulated from the bench position of Section 1. Computer readout facilities for alarm monitorin6 and sequence monitoring vill be located here to aid the operator in safe and reliable operation.

A process computer vill be used on each unit for alam monitoring, perfor=ance monitoring, data logging, sequence monitoring, and contrF. of some functions during startup and shutdown of the turbine-generator. Any of the monitoring and display functions of the computer which deal with safety aspects of the nu-clear steam supply system will be duplicated elsewhere in the control room.

, This scope of computer application has been successfully applied to units pres-ently in operation on the Duke system. One or both of these ec=puters will be used to perform on-site fuel manage =ent calculations.

Variables associated with operation of the secondary side of the station vill be displayed and controlled from Section 2 of the control board. These vari-ables include steam pressure and te=perature, feedvater flow r.nd temperature, electrical load, and other signals involved in the integrated control system.

Section 3 of the control board vill contain provisions for indication and con-trol of the reactor coolant system. Redundant indication is incorporated in

! the system design since pressure and te=perature variables of the reactor cool-l ant vill be used to initiate safety features.

The engineered safeguards system vill be controlled and monitored from Section k of the control board. Valve position indicating lights vill be provided as a = cans of verifying the proper operation of the control and isolation valves __

' ^

06 7-30 ,-

g h following initiation of the engineered safeguards. Control switches located on this panel allow manual operation or test of individual units. Also located on this section vill be the control switches, indicating lights, and meters for i

fans and pu=ps required for e=ergency conditions.

Control and display equipment for station auxiliary systems vill be located on Section 5 of the control board.

Reactor coolant pump control located on Section 6 of the control board vill consist of the pump controls and auxiliary instru=entation required for pump operation. Also =ounted on this section vill be auxiliary electrical system controls required for manual switching between the various power sources de-scribed in 8.2.2 3 Controls and indications for all ventilation syste=s except the Reactor Build-ing system vill be located en Section 7 of the control board.

In order to maintain the desired accessibility for control of the station, =is-cellaneous recorders not required for station control vill be located on the vertical recorder board where they vill be visible to the operator. Radiation monitoring information vill also be indicated there.

s 743 Stm ARY OF ALAES Visible and audible alarm units vill be incorporated into the control board to varn the operator if unsafe conditions are approached by any system. Audible

, ) Reactor Building evacuation alarms are to be initiated from the radiation mon-itoring system and from the source rance nuclear instrumentation. Audible alarms vill be sounded in appropriate areas throughout the station if high ra-diation conditions are present.

s 7.4.4 COE M ICATION Station telephone and paging syste=s vill be provided with redundant power sup-plies to provide the control room operator with constant co==unication with all areas of the station. Acoustic booths will be supplied in areas where the background noise level is high. Co=munication outside the station vill be through the Southern Bell Telephone & Telegraph Company system and the Duke private telephone and microwave systems.

745 OCCUPANCY Safe occupancy of the control room during abnor=al conditions vill be provided for in the design of the auxiliar/ building. Adequate shielding vill be used to maintain tolerable radiation levels in the control room for =aximum hypo-thetical accident conditions. The control room ventilation system vill be pro-vided with radiation detectors and appropriate ala ms. Provisions vill be made for the control room air to be recirculated throuBh absolute and charcoal filters. E=ergency lighting vill be provided.

The potential magnitude of a fire in the control roo= vill be limited by the following factors:

C'

( ,) a. The control room construction vill be of noncombustible materials. _

t t

7-31

b. Control cables and switchboard viring vill be constructed such that they have passed the fla=e test as described in Insulated Power Cable Engineers Association Publication S-61-402 and National Electrical Manufacturers Association Publication WC 5-1961.

c. Furniture used in the control room vill be of =etal construction.

d. Combustible supplies such as legs, records, procedures, =anuals, etc.,

vill be limited to the amounts required for station operation.

e. All areas of the control room vill be readily accessible for fire ex-tinguishing.

f. Adequate fire extinguishers vill be provided.

g. The control room vill be occupied at all times by a qualified person who has been trained in fire extinguishing techniques.

The only fla==able materials inside the control room vill be:

a. Paper in the form of logs, records, procedures, manuals, diagrams, etc.

b. Approxi=ately 35 coaxial cables required for nuclear instrumentation.

c. Small :: aunts of combustible =aterials used in the manufacture of various electronic equipment.

The above list indicates that the fla==able =aterials vill be distributed to the extent that a fire vould be unlikely to spread. Therefore, a fire, if started, would be of such a s=all ca.gnitude that it could be extinguished by the operator using a hand fire extinguisher. The resulting smoke and vapors vould be re=oved by the ventilation system.

Essential auxiliary equipment vill be controlled by either stored energy, closing-type, air circuit breakers which will be accessible and can be =anually closed in the event d-c control power is lost, or by a-c motor starters which have individual control transformers.

7 4.6 AUXILIARY CONTROL STATIONS Auxiliary control stations vill be provided where their use simplifies control of auxiliary syste=s equipment such as vaste evaporator, sa=ple valve selectors, chemical addition, etc. The control functions initiated from local control sta-tions vill not directly involve either the engineered safeguards system or the reactor control system. Sufficient indicators and alarms vill be provided so that the central control room operator is made aware of abnormal conditions in-volving re=ote control stations.

747 SAFLTI FEATURES Primary objectives in the control room layout will be to provide'the necessary controls to start, operate and shut down the units with sufficient information display and alarm monitoring to insure safe and reliable operation under 138

^

i. 7-32

nomal and accident conditions. Special e:ghasis vill be 6 1ven to maintaining

control during accident conditions. The layout of the engineered safeguards section of the control board vill be designed to minimize the time required for the operator to evaluate the system perfor=ance under accident conditions. The station co=puter vill be used to perform high priority prograns to verify proper operation of all engineered safeguards functions. Any deviations from prede-termined conditions will be alar =ed so that corrective action may be taken by the operator using redundant controls provided on the control panel.

4 l

. 1 4

I 4

f O _

7-33 jg

w. , ., . - ,, - , . - ., , - , -,c. ,

O ___________q CHANNEL I CHANNEL CHANNEL CHANNEL 1

g 2 3 4 i

HIGH FLUX  ; I HIGH TEMP. '

l HIGH PRESSURE OR* g

'OR' 'OR" "Of

GATE GATE GATE GATE FOR l FOR FOR FOR LOW PRESSURE TRIP g TRIP TRIP TRIP l

STARTUP RATE LOSS OF FLOW l l

I INPUTS TYPICAL OF ALL FOUR CHANNELS I I

I BISTABLE BISTABLE BISTABLE BIST ABLE I

I A B C D

_______ _ __ _ .J l

2/4 2/4 REV: 4 67 COINCIDENCE COINCIDENCE  !

CHANGED FROM LOSS OF PU M P TO LOSS OF FLOW y y ROD DRIVE ROD DRIVE )

POWER SOURCE No. 1 POWER SOURCE No. 2 BREAKERS BREAKERS FIGURE 7-1 i REACTOR PROTECTIVE SYSTEM BLOCK DIAGRAM i40

R

> > , -. . . . . ., .., as.c ma . ,acr... rs,

~..a

. . . . . . . . . , ~ . -. a.

,0 c./;>0 <.. n

--p = {r'^ M?" .e ,

s s

%--~'  ; >----g[

x

~ Ng~ " l, g  : >;14'*:" '

.18 .

C.

,! V V V V -,-$-.

y m (r -

_ __ , _r _

-~i

.~ . m G O < -)@ .

%>-. ~b= i .:,.

l h:.= .,wN% w 's.' ,m['N=;Lll'Nf=.:

y- J,, IA ml!

< - *

• l C-3

_ _,,, l \/ V L' V / QN-* l'\Dy r~l - 15, ,.,,

,- ;.,j _.. ,

q9

.,. T..

7 (T h 4<> ..

I

~

.J b. . T -

r

' .-.-.,1, T m

.4 a

V- L/ as L. ~.-

-s 1..

F  != 5-c :D >..

--=;~ t-"

-, (; ,o - --Go i

~ .-_

n. .-,,. ~ . . - ..

g;< .

a .\.. [ N. .. 1 ,

t-O F ,, ~

l

~~

l 5 c.

L . , $%'.'

• • t-C I-O

&- 4, E >,.

=.. s - =*

c,

3. .

1

./:r__ * ._.I

--v" .. ','

aw .- j ~

..: = , . - . . , .. .

\ , . . . . -

t ,

C N .. &, @ $

d -(

n .

A y 1 le 1b.-..1

,o e m ...,.

. . i s

i g,,. j g - m ..<

g J ,.- ; i. p.,e dg c.,-..

• ',. I , . . _ . . .....

C N_., . _ .. t-1 i m-c4!rm ~. . .

eNIE1 c ,2 ,

rej

/ 4o . - -  % .- }g,.

4

. . . .. ~ 7 .; = p , ' g =. s =

1 L L.,. %

T , TL. . 7 '

. . . , -a, e. .,,. 5.1, . .. .. . -

gr.d_ . .#: , .

c1 W ,,- s c, 1 _ ..

e

,a

s. t-d i cy;

/ ,1 . . . . ,

g.j

_,.d_o 4..  ;+e 2

,,.... i ,p ' e g;

- ~ mri

-y , T7 i-' T" . -

-0. 1,g t- -

T, .....

N TF1 I.  :- {

Gi .. A i cw  : L--;. > g .

,Q e**- .. ,

Q' [/ h ggj d.a  %~ 4... . < ' .3 =. .

> - e : g.,_.3..

e.w.s s. . . . . > a =. =

r . . ..

a.~~....- 7-2A o,.,,..,,..

e e ~. -,~ ..

~..=.:.n..,.=-----

-- - m, gh .~

~ . - . -

= =e.: ...u=.

. ..... .n an go. . e. T. s .M

=.. .

M .~ .. - ~ W. ...

~-

,,=.P.r y::. 7. ,

I . @t f_ 2 ;_,,...._ .

i .

... 141 l

o

}

i

.I l

i

,.. , _ . . . . , . l 1::==_ t. : "J/,_

o *

m;,* ,' ,~

• wg y. o ,,.e, .u ,, -es -,,c,,ar m,,a

" ' ~

--. _r -r-l l

s =* l l

e, j= .  ; a-

.4 c-3_.

..~ j.

O q 4,, a, a .. a. l

. _ o . ..-.

0

~]-.9.j]!.e r 7r

+~

..n,,.,;. 31 ,

4,.

y- < f~

c,.,

~

n,.,

1-l

_._--  : _' e_ _

1 T

3,,

T.',., ::, ___ _ ______________________

~, ,f~., , b.,  :  %~~~ 4,, ..

- k-

{y .

{

,, f.. ..

3- g,, 3 , .,- G ,:'.. &-in

- ., ( Qa

^ ^

.I ml. . R.. ._. %,. + , , ,

,. ,,, ,,, e j

_ _ _,,_ _ =_ _ _ _ _ .4 g_

u .. u .. u

' 0

,., c, . . c..

i(

+ "

. ". a 14, ____ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

U "* 8 @ 5 c, E, W*"

, e p, p.

5 2.

l@ y.. .,

O =.. =~. -.~,'.~. = '

,,,,_,,,,.,: - ~rr.:: _~_~

9-

..,c, ,

, ,o j

-e yo o e,,,

! g.;, 4. }

l. 1 ___ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _

77, . .

1 T

=

~

... 1., t

= . _e , U--O -$ G--I

. 1- r- I 4 ,,, $ .,,,..,,. ._.

e .,.

I. J %w{ W i 1,* 1~ t-1, I  !?  : .f -O.~ 1--FM l

i

-e.'. -

T* T'~ T'-

. -.g,~-.

m

' ~ , .

ag ,_ -. '.

f-fg l ?5~ T5.* H *'

?lC co ... sdD *'

_x (b s-3=s, V Y.,

^ ,,~. , NUCLEAR INSTRUMENTATION

> [- V. . * *

• AND x PROTECTIVE SYSTDS

-- , p3,, -

osu ra e OCONEE NUCLEAR STATION FIGURE 7-2 142 ,

b

1 a

\

/

rreiCAL ne^erOn s wto m s i3 a ariov m vf CoNreal Cix Cuir (CsM:

^

N in# _

o

,,C VAL VE ^

er No?D4

^

\- 18 si

_ r O

b

,P is fG BE M

(+)

H -,

.6- IC j

=

z a-e-eo c - r,<ro ,%  :

Sueca**c3 cni .:wr w <o3 ,Catj -- l 3 morecrwr perferwr 3Y371M y

39'372M . ~--y oa

,, yown .S 7

C 243 8 pCLOSED A

,gg , tac yp C,

,, a, em .srarm sor?sse

~y Close 443 U rec,

/6 73 )

& --.,_i_ C

1. 1. l is I ,t v,

.i. - o- ((

_ y f 6L3qnr W"g 7L3 343 t173 a

- n - o

~,f( ,, (~>

3N,,CN,, -, c - ,A c ,s .C - - ,- ~ f ,N - L - , - gyg,s nz; C - MAIN CONTACroM, Cias/N3 CKZ- CON 7MOL M!LA r 0 - MAIN CONTACTOM, Oo/NsNG CC - CtMCuir s? FAT?g CAI COM7MOL MPL A Y TC- CiMCJir B M Agfg CFZ-Cour<1 MELAY 73- Tongut 3H/TCM 30 * /N37ANTANfCkJ3 L 3/

• 7tMf OvfMCs/MMgr gj. gJM/7 JHjTCH fcz.C,MCair

< C/MCs//7 6<fA<rM srearn a

/M */daa nt<Y TM/W Nort: CRC, snewy &

OvtY MntN A'rDuxw Mf9L//RfD LAMir SMITCH C047ACT DNHLQPMfNr vntv2 nrtM*VDur! vnLVe Covr/CT ALL O*k'N VMVf 5C3/7434 C4KL CLO3fo f4/NCf/OH t CLO3ro oprH 43 Pen . Sis 4*M/

2 CLCsto Osw=N corn oorn suo LT 3 o*fM CLo32D C6 032 D M N LeMor 4 OP2N CLO32D CLQ3fD 3PA M2 3 open OWN CLo3fD b %sk' 3H 8 M 33 G O*VM TEN CLOstD clO$fD N O LtdMT 1 CtosIO ClosIO o*'tw W SN dr/MS3

$ (4D510 CL CLS f C OPtH ht3LD M C/MCwf O*YtwwG TDMGkJR 3/4/7CM* Q*YN3 QV MfCMANiCAL 5 OVdMsO*C sk 0*fMMG D!KPCT'04 CLO3ING TOMM SJVITcN

• De*dMS QW MACMAN/C44 Y C;WDM6adC w CLossNo OsArcitOH i 143 i

I f

1 k

, f4 y o CONTROL GMCu/r FOR AJAC7CbM ds//LD/NG JPl<AfMD (MJ70M SAM 74K C M 7M04) gr O h w ^m ,, --

mmg ee Maro<

CT e in TW ^^

an

1. J# JJ11 77rif 3

3/ J/

a #

STOP "Q2 u L M

^

.L 3/

~~

PMM =

l FNGIN!! mfd FMo*2 FMS 2CfD CAI

• E

?!

"f n CM/

ZA?!G4/AMD3 CSI gygg ypyg mrtc7N4 ., _/8" 3f370."?

SYjrfed --

C e,.

- 3 1

peoM Js r$

g 403 N)  % 18 5 m?rc7me SY37tM f g ,,

) M e---* 'n' di Q

/ DffNEQGotfD fC3/7/OW (CN TA cyg SWoovN IN DffNfgG/Z@ -03/ 7/M CA/

• COvfMOL MfLAY cgoging cost M - MA/N CONTA CTOR 7M/9 Coss vsMcsMErr AraY d 4ELA r' REV: 4-1-67 ftwt.m JMPCn CHANGED E SPS FROM ENERGIZED TO DE-ENERGIZED SYSTEM m/aa ev $ N?rcH T!L N JP7tD, /3 cAS/D v7 Cov7406 /5 TYPICAL CONTROL CIRCUITS FOR ENGJNEERED SAFEGUARDS SYSTEM EQUIPMENT nu ron e OCONEE NUCLEAR STATION FIGURE 7-3 144  :

i

)

o

b U

108 114 De sig n

- 107.5 r Overpower

. 107 -II3 N,a Reactor Pyxer Level Demand

_ MW = Megawatt Deman - 112

- 111

- 108 - !!O

-107.5  ;

- 107 - 109

- 10 2 N c

- 108 Limit I

u

- 107 u

W100 -

- 108 - 106 5 ^

-107.5 E_ -

107 105 t*

- 10 2 N Q. .

- 104 7 Limit j E- - -

- 103 o u u e o i -

u u

u

- 100 6 -

- 108 - 102 i.

a w w -107.5

/n) t - s -

s - -107 - 101 1 g s

%] .

=

= c 3 5- ]: -

j - 102 N Limit W

- 100 MW L:mit q -  ; -

- 99 i $ $ C 1 g- g - g - 100 g - - 98 I s y y .c

+- - 97 1

- O 01 1 O. . -

3 - 70 3 - 3 3* -102 Na - 96 l l l t$ Limit 1

1- 1

?-

1

?- tj -

1 6

- 95 s 3 t - t -

8- tuc - 100  ;? - 94

. a u v 3 ,

=

2-

=

- x

- 22 -

d '~

3 - 93 j - 92 s

90 I - i T-

~

13 -

i i  %%

j- j-j- jf - 5 - 91 1 3 5 3+ H REACTOR TRIP at 107.5%

• 0.5 % INDICATED POWER I

REACTOR c)OWER MEASUREMENT ERROR 5 AND CONTROL LIMITS juhm OCONEE NUCLEAR STATION

'~' v FIGURE 7-4 -I l

145 l, i

)

I O

l l

l 620 pREACTOR OUTLET TEMPERATURE j 600 i j STEAM TEMP.

. 580 F \ ,

8-REACTOR AVERAG$ \

f TEMPERAT URE \ '

s N

$ 560 O a b / REACTOR INLET TEMPERATURE x 540 - - _ _ . ,_

Ts at AT 925 PSIA 520 0 20 40 60 80 100 REACTOR POWER, %

REACTOR AND STEAM TEMPERATURES VERSUS RE ^.CTOR POWER OCONEE NUCLEAR STATION l

FIGURE 7-5 _

...... 146

l s

_ vo et-en comemos too ceiva onowes

- _ _ - -am vameC = - - wm yg , ,

6otsC i

' i I

l l  : s t a a.4 1 ^

l t _L i

l StaaM Sta as.a.4,s. maacrom ca .aM aron f aaDWatah w "

eso. 3 wo.e w ratonatam i

i -p =o ,

[

l

1. e_9 l * *vaAAGa - '

! I

' ) '

N i '

~ g -v)e i L___s-___La..oL t_ c ea.. 1 _ co=Taob

~ , .p_ _ 'r;;"

go ,,,,,

~

LOO =o.1 O e

I

- \ 't)

I } I "

f,. y l8-avamaca L-4 ih I %n k er LE. GENO

- manCToe Cooka=7 SYStaM

- Sta*M SYSTEM

= = CO=TRO6 Sv$7aN vg. manctos cooka=v svstaM co6o Lao ta-eemaruna The es&CTom Coo 64.e? SYStaM emo? lag Tausseatuea

? . avsmaca maacton coosa r SvStaM teuesearuna D . eev ar.o= os avenaos re-penaeuma emo.e seveo.=v s,. saacroa oowan 6 eves ammon,=,.=t e.. aoo weboC tv eewa=o

} g . waoa. ave on .=o

=s . maacron powse 6svas REACTOR CONTROL DIAGRAM eq . anaevoa sowse kava6 oe===o INTEGRATED REACTOR-BOILER-TURBINE CONTROL SYSTEM Rev: 6-16-67 Deleted Flux Averaging Ckt a ce rima OCONEE NUCLEAR STATION FIGURE 7-6

. . . I47

gG b

4. 0 t

3. 5 f 3o _ Max. Differential Worth = 13. 95 x 10~' (%/k)/In , f

2. 5 a f o 2. 0 //

O W 1. 5 /

H [

)

O i

0. 5 f

0 0 25 50 75 100 0 25 50 75 100 GROUP 5 POSITION GROUP 7 POSITION 0 25 50 75 100 0 25 50 75 100 GROUP 6 POSITION GROUP 8 POSITION DISTANCE WITHDR AWN, %

AUTOMATIC CONTROL ROD GROUPS TYPICAL WORTH CURVE VERSUS DISTANCE WITHDRAWN OCONEE NUCLEAR STATION N, )

FIGURE 7-7 -<

148

l l

N

[: Mgr 1 1

$'3 h ,"M71 1

i .,_>.h.

... e,so., p 5 ,

\

r.L

- -~. - . - -

1 g_ _ .. . . . !

.. is .v _ ,-- L .,s i

y,y;,*.' , , , ,

.as, ,,oe coa..w

- < ~ . . . 1 I

7 - - .~ 7 s e

.  ?

S. - r.,, dT S:::  ;!

c i

- t., \ :, ,. I

,~:':" T ii S i s.f',~r=~

.- ! 4.). t Q

m3 n 6 i -

ha L , - ,,, I

-rm,n -,,a,-

i-,.i ! m.,.i u.

i I

l v~ .#.,sg iftco~ T4,,, I s= }

, ,.n. n. ,.; n I

... grrrrW% ..> i i ,.. .i l

.s 6g.'!2l g.;. .I ,

, w.ev. cau..

e .-e.c~

~

~.a sn

.m., ~

,,,,.a.,.,

a_,.., .. ,, ,. ~,-a:~ ~

e-:3.,- - -- w ; ,

d.,

,.=7,. a-4Os ,Os, .,._cd..._.w I f Ear *= % D f jaa.we.=*.g

,w mn ui ,

i i i &., 4,5. N'Q tv1s} .r.,s== or****; _ _

4 i

..w = . 5 =J.,

IAQ Q t_i__

es %.e.: .::

+l  : wi I  !

,_~

c:,. . ,

. .,1i ..- i ,

,., r.~. ., !

e' e'

~ ,. ~

., . . , . =,

JT.a.J,.,4,*e4 J,da' J,w* 's.

i

.: .*a *,v.o sc . . . . .,.e ca n.,s s , .*

e.....,,,<,

s.,,-,,,

BOILER-TURBINE CONTROL DIAGRAM sa,.'*w~

- "' -'es *'

INTEGRATED REACTOR-BOILER-TURBINE

• ~

, . ' "'O,' CONTROL SYSTEM

,. e ,,., .-,

r *.e =,,e sA s:. *-s on.,e u s,e* < c so,*r 9 out t' ente OCONEE NUCLEAR STATION FIGURE 7-8 _,

i49

O

(

DETECTOR NEUTRON FLUX , nv E E - E E E E E E E E E E g u w + w w n w a g I l l l l l l 1 I i i l l l l 8 I I I I I I I I I I Z

C O

t' M

h COUNTS PER SEC.

2 SOURCE I l l I l I

$ RANGE I I I I I I y - o o o o o C N " *

• E M

Z H

d O o O

M t*

C INTERMEDIATE R ANGE I I

LOG ION CURRENT (AMPERES) l I

~

i I

I I

~

I I

l __

I o o o o o o E o 8

Z

$ L L O

6 L k L L L Z ~

Q O n M 52 M C C

. :D O m"  % FULL POWER y 5 b

C POWER RANGE

-- l l l l --

-~

g - E ==

z * * **

i __ - . . - ..

O t

PC CIC UCIC UCIC

.' : . .. ,

• s .*.

' *** 11... I:'.

d:-  ::*;.

,* t' i ', . .-

1,* . ,:

l

/

.*. E' ,

• ..' ,l'a, -----

N ,'.* # -

O . . :>w. . , . .

UCIC UCIC CIC PC LEGEND PC - PROPORTIONAL COUNTER - SOURCE RANGE DETECTOR CIC - COhiPENSATED ION CHAhf BER - INTERhiEDIATE RANGE DETECTOR UCIC - UNCOhiPENSATED ION CHAh1BER - POWER RANGE DETECTOR NUCLEAR INSTRUMENTATION DETECTOR LOCATIONS 1

OCONEE NUCLEAR STATION.

s.

FIGURE 7-10 __

151

y 4

. . _ _ _ e . _ _ _ . .,

5 b  !

hR4Y j, VALV E g 1

0 61 . M' PG ESSURiZ E R I

,- 1 e W g 8

Qwi N7 ,

'-p

- /;%~'

60 s

0 1

e eu, i e UW =- ---3.,__., _____

l ..wS- i I

v .

I 8

, _ _ _ h. . _ _ 8 V i I

, _ d PUMP MONiTO]R l

f F _ G_ _ 1.0

[C ,, l 8 I A s Y*

g l

I l l 6N' :staNA"' PU M l

' ric- aam' rescw l; l g ( -----

e SAFECsdARD*J t PCECIVE e PRO'KT .

IVE P, ' P UMPMONilvRl e

1

- *t 8

8 0"-

'Lt_YS_TJEM '

a, L _3_1_S.T p_EM. J g-____s____, e i ' _ _ - _ _ _ _ _ .;, _ _,t._. . _ _ ;  ; I , ,

! MMMM  ! 6N"' C&NGhh"i ~

M l l V U V, i ,

~

t l

I 1

Qui .y_s g

I vl0 's )

I l /fhwi l i 1

Gb 1 rigwi j l_~,_ ,,

i ______

g LOj ) , iw7gggg7 I Hn ' 'g l lI REN.TS I a- . . _ _--- ---* TURSi l CONTAj

, _ .i _ _

,,r4 ACTOR,i ,

r - -lL-a seTe

• g a

s puc'ECT%_ - . _ _ _ _ . _ _ _ - __._< >__ -- s i i y L .

l , ____.) g g

, - -]RJMP MONITOR l

!s h -

l /vNa' ~E NA"'

A, Y l

i l 1 t

l 1

-- _ dPUMP MONeTOR l g

,

• 7 PEITSSORiTER

_ _ _ = *> *4 Lt vtL CONTROL f I

• vagv e I I I I MAKEUP

' I

' . w= Tea /M ' atM Xlhwi i

!, U "v

' ) no,e: 1

~ - _ _ _ _ _ _ _ _ _ _ _ . _ _ _ . _ _ _ - . _

FOR LEGEND NOMENCLATURE SEE F4 SORE 9-6 L

l 1

( __ _ .

152 I

7 I

60  %

tai t

[ '

f l A r+ a.. ! Y, v vu. +

i 6 .l-_-!.

l l

e f l S'EAM 8 l

8 s J a4 RAioR , g

, i i i , I I e I

' t l l Op- - - - , i l

. , - . ~ - , -

1 FttNaf tR '

l l l 1 VALVE b --

• M M M 94 " .% g i

i I

i _F4_  !, VLo 1iI l l

,v-

'i! .

l ll i,

3 I FtfNaTER 8 ' 4 l VA'VE e 8

1 l l g i e

' f ' Il

"'j , l F E EDuTE R g

g"'- #c 8 I i 14

!l

- -l - - g - - - - - , , , ,, -l,- - - - - - - - - - l g - - -

, g i ll Pt#,4P 3,,ocx1TORS,NE A

3<,

pi a 6 8 I e ie g l l

O .o l

l j;

l l p - - -- - - - -- -- , ' ,;

, I O

' LJ- '

..I, 8 l

O

• r -INTEC A " .-Q AT ED ' ' l1 ter l go. A'

• l l

e. ,- O ,.,. _ _ _ _ _ _ , J _ _ _ ,l m 1u e.cToa.. ca. se: . _ _ _ _ _ ,_ _ _ _ _ _' _ J l

' ' couTeot : i  !!!

,l i

' . Q e l system __, s

' - - - ~

--f, d  ; -- rrr-

- _ _ _'_ _. g _ f,,i _ __ ___ ___ _}. .cou 3;'.','c. __

Y,gug,imaa

.J . ,i . .

l - 3 ea i i l,___'_______,' i

/w.,e n mTo= ' 'i ,

l l It t '

l l

_ weestaze_. _

$-"Il FEt h &TER s'

..<,,3

-p_.-- _ ,,,

-ll

' - __ _ _ _ _ _ __ _ _ _ _ __ _ _ coe %= Tea au m Tu ae =e saico ca ,aats 5

STARTup FEED 4TER NONNUCLEAR INSTRUMENTATION v ,E SCHEMATIC NN OCONEE NUCLEAR STATION FIGURE 711 153

W e

f i.___-A v .._..i g _

n i

x  : ano 1"v'e IVo U oT t i 0

LO LO Q**' PRESSJA' Z E R 1

vx l

l{,.J_--.a_.-

" ?"

',g

- Q.. '

/r.h--

l i i i I Vo e

om i i P vw -- : -q____.A_____j l wc i v .

t Q ,

e t" v "';. V  !. l l

-_ y e , m iToal l '

L_ G_ _

vo

____..' ,, l

,A,

, o . . . ,,,

l r ...a0. ;

i v" g,,, ;eacrecive 'r _.j l l

. ,_______,t t _v.$'m.:  ; ,-hep = =1

, . w.iNe e seo . v, , g e

, l s. rec.o.=os ' - _ ___,__ .,_- . ,

i i i e i , ,

i . enoveoive i '

i

! , i M 37 e

l  !' Svb7EM l l l l 6 e

,,,, Qp 4, A. r,'h.,4 i

• Y Y Y Y Y ' Y '" l rs;Km g;g y;ih

, i

, m i

' i EM In l

( ' C5~, ' l [ Um U<o'; j l

n ,! :  ;  ; -

a

.Al i

. l l

, v3,,,

a T ':l . l._ ._'____s__-Y*:

I  !

l

, V a T, 'i.

, e--,-----

i - _

_. . _ _. _ _ _ _ .. _ _ _ + ,% eg eo

@ l e CONTROL

. .r _ .  ; , - ~ ~ . $v5 Tea

, ' - - ~ ~ ~ ~ -

• i e

,N,e.

iR@tCT e _

e a

w--_-_ s

, , L. - _,

,1 ~-

I g g I 1

- - f8udP MONnTOR l C _

_! ,A, Y i,

liv-v/N* & A*

1

' _ _ ]EUMP MON 8TDR l V , - -+ xm..

i 1

1 i

A, i

'  : e, i w aa /fX=513'Q -

i v v S }

NOTE:

FOR LEGEND NOMENCLATURE

( Sgt Fi(aoRE: 9l s

\

I54 1..

um O

1 T

4 Vo p '. LO e X

8

• / STEAM e

I

e g f- , 5 l '

/G.Y l,- - ';l i v5 a

• 8

}

-. -- 3 l

STE 4M [',

adda'OR ' ,

s 8 l 8

l l

l ', w Fsc.vea m~c. l <

< 1 e

l s

I - r.v

~

l Fi t Db.a'E m

, I

. mw_,n ,,,

8) t l

8 i ,

,, .l 3, i i i

I i ig ,

l s

e '

t ,

ll, s e

I

.-------.--g_,----_____s

' I S tae t vP /

gl

\ ' ~ ~'

g,,, w------.-...y_---

i l" '[ ' =,

Fit D aT E R vatw 1 lf

,e ,

t i

i I

8 ll jg rE EDaTE R PUMP TU8tB.NE 8

• _ s _ _s _ _ ___,,__$_3__,

t 8 l ,' ' '

kN

• i i i . .,

, i l I i SPEED.cocaots o ,

g lI l1, }g ,, - 7 _ _ _ _ _ - _ I 1, X

l ,6 a e

,Is ,g

.e 1

. . . . . i e e ;

e

/ ST E AM I (

h - f-l--l----l s I g l g _

~

---

__r-- u.t a-( iNtec,saign s*

Q I i lll l

3 L 1- 8 Uw I'-~~~'-t__~_],

_ ^

co.cax .-- ' -,_-____.idl

• $m  :  ; ig  !::

: w__,

Lia 1 l ,

ER g ~[

_____;,,_,--_,______-.,cm f ,

---

ea a 3 --.

i: i' i . .

D &

llIi - - _ f,_ _ _ _ _ -. _. e # new; . . . . . ,

iip

• ADDED 3 entssunt Sgusops

) 'll ] Fon ESP 5 a ADDef toonas

~ ~

/ Svat StNSons t watra ,

WEENI'3P _-

p ', i g 43 VALVE S afv: 4- se . e7 884 1 g

~

s Fif MER ADDED a C Flow DE TEC TORS

'st see w en

[p- - - - - - -

l' w vee

- w- . SPEED COMeoLS

, ,s I

b STA3It TOP Fit DwAf f R WwC NONNUCLEAR INSTRUMENTATION SCHEMATIC EN OCONEE NUCLEAR STATION FIGURE 7-11 155 .

k T-e'

(~')

(/ _

l O O O O O O O O O O O 00 000 00 0 O O O O 000 OOO 0 0 00 0 0 O O O OO O O 0 0 0 O O O O O O

O INCORE MONITOR ASSEMBLY O' j L i:

i E g E a AXIAL FLUX E SHAPE ACTIVE CORE

LENGTH i

=

I

=

=

-b 1 1

/ i,

.i

- LOCAL FLUX DETECTORS BACKGROUhT DETECTOR TEMPERATURE MONITORS INCORE DETECTOR LOCATIONS d

e j OCONEE NUCLEAR STATION FIGURE 7-12 -

l i

.... 156

V

/

CAUSRA T/ON i

f 7v88 COvnECTOM o

CLECTR/ cal.

, CONHec 708

/N-COKE flux f/v10/v/708 ASSY O, , \ ESoo". SEAL

(~

/NNER 7U82 l 00718 72Jdd /N.57KUMAN7 g a CAudRAT/CN t DE 7'A /L -A .~ sses s

(Us -

l J *

- -_ _ _1 l

=p .. . , , ,

a l l l

'. .' ourg,

/

russ

,i , ,

-_ h (' ,

3 s( +

, . . ~$ 1 .. ,

, 4

/ t' 6

m m$wn O '

OCONEE NUCLEAR STATION FIGURE 7-13 _

157

O

' VERTICAL CONTROL BOARD -

2 i 2 \\

[/ I UNIT 2 UNIT I 5 2 5

5 O =

7 7 VERTICAL RECORDER BOARD i i OCONEE NUCLEAR STATION CONTROL BOARD LAYOUT l

ar ront OCONEE NUCLEAR STATION FIGURE 7-14

. 158