|
|
| Line 17: |
Line 17: |
|
| |
|
| =Text= | | =Text= |
| {{#Wiki_filter:TABLE OF CONTENTS Section Title Page 7.0 INSTRUMENTATION AND CONTROLS SYSTEMS 7.1-1 | | {{#Wiki_filter:}} |
| | |
| ==7.1 INTRODUCTION==
| |
| 7.1-1 7.1.1 IDENTIFICATION OF SAFETY-RELATED SYSTEMS 7.1-1 7.1.2 IDENTIFICATION OF SAFETY CRITERIA 7.1-7 7.1.2.1 Regulatory Requirements 7.1-7 7.1.2.2 Regulation Conformance - 10 CFR 50, Appendix A 7.1-8 7.1.2.3 Conformance to IEEE Standards 7.1-11 7.1.2.4 Conformance to Regulatory Guides 7.1-13 7.1.3 PLANT PROTECTION SYSTEM-ELECTRONIC TRIP SYSTEM 7.1-17 7.1.3.1 General Description 7.1-18 7.2 REACTOR TRIP SYSTEM - REACTOR PROTECTION SYSTEM (RPS) 7.2-1 7.
| |
| | |
| ==2.1 DESCRIPTION==
| |
| 7.2-1 7.2.1.1 System Description 7.2-1 7.2.1.2 Design Basis Information 7.2-15 7.2.1.3 Final System Drawings 7.2-21 7.2.2 ANALYSIS 7.2-22 7.2.2.1 Conformance to 10 CFR 50, Appendix A - General Design Criteria 7.2-22 7.2.2.2 Conformance to IEEE Standards 7.2-24 7.2.2.3 Conformance to NRC Regulatory Guides 7.2-33 7.3 ENGINEERED SAFETY FEATURE SYSTEMS 7.3-1 7.
| |
| | |
| ==3.1 DESCRIPTION==
| |
| 7.3-1 7.3.1.1 System Description 7.3-3 7.3.1.2 Design Basis 7.3-60 7.3.1.3 Final System Drawings 7.3-68 7.3.2 ANALYSIS 7.3-68 7.3.2.1 ESF Systems - Instrumentation and Controls 7.3-68 Revision 12 7-i January, 2003
| |
| | |
| TABLE OF CONTENTS (Continued)
| |
| Section Title Page 7.4 SYSTEMS REQUIRED FOR SAFE SHUTDOWN 7.4-1 7.
| |
| | |
| ==4.1 DESCRIPTION==
| |
| 7.4-1 7.4.1.1 Reactor Core Isolation Cooling (RCIC) System 7.4-1 7.4.1.2 Standby Liquid Control System (SLCS) 7.4-6 7.4.1.3 RHRS/Reactor Shutdown Cooling Mode (RSCM) 7.4-8 7.4.1.4 Remote Shutdown System (RSS) 7.4-9 7.4.1.5 Design Basis 7.4-23 7.4.1.6 Final System Drawings 7.4-27 7.4.2 ANALYSIS 7.4-27 7.4.2.1 Conformance to 10 CFR 50, Appendix A - General Design Criteria 7.4-27 7.4.2.2 Conformance to IEEE Standards 7.4-28 7.4.2.3 NRC Regulatory Guide Conformance 7.4-35 7.5 SAFETY-RELATED DISPLAY INSTRUMENTATION 7.5-1 7.
| |
| | |
| ==5.1 DESCRIPTION==
| |
| 7.5-1 7.5.1.1 General 7.5-1 7.5.1.2 Normal Operation 7.5-1 7.5.1.3 Abnormal Transient Occurrences 7.5-2 7.5.1.4 Accident Conditions 7.5-2 7.5.2 ANALYSIS 7.5-11 7.5.2.1 General 7.5-11 7.5.2.2 Normal Operation 7.5-12 7.5.2.3 Abnormal Transient Occurrences 7.5-12 7.5.2.4 Accident Conditions 7.5-12 7.5.2.5 System Drawings 7.5-16 7.5.2.6 Isolation Devices 7.5-16 7.6 ALL OTHER INSTRUMENTATION SYSTEMS REQUIRED FOR SAFETY 7.6-1 7.
| |
| | |
| ==6.1 DESCRIPTION==
| |
| 7.6-1 7.6.1.1 Process Radiation Monitoring System -
| |
| Instrumentation and Controls 7.6-2 7.6.1.2 High Pressure/Low Pressure Interlocks 7.6-2 7.6.1.3 Leak Detection System - Instrumentation and Controls 7.6-3 Revision 12 7-ii January, 2003
| |
| | |
| TABLE OF CONTENTS (Continued)
| |
| Section Title Page 7.6.1.4 Neutron Monitoring System (NMS) -
| |
| Instrumentation and Controls 7.6-10 7.6.1.5 Rod Pattern Control System (RPCS) -
| |
| Instrumentation and Controls 7.6-17 7.6.1.6 Recirculation Pump Trip (RPT) System -
| |
| Instrumentation and Controls 7.6-26 7.6.1.7 Fuel Pool Cooling System (FPC) -
| |
| Instrumentation and Controls 7.6-27 7.6.1.8 Containment Atmosphere Monitoring System -
| |
| Instrumentation and Controls 7.6-30 7.6.1.9 Hydrogen Control System 7.6-32 7.6.1.10 Offgas Building Exhaust System 7.6-33 7.6.1.11 Safety Relief Valves (SRV) - Relief Function 7.6-35 7.6.1.12 Anticipated Transient Without Scram - (ATWS)
| |
| Instrumentation & Controls 7.6-38 7.6.1.13 Design Basis 7.6-41 7.6.1.14 Final System Drawings 7.6-48 7.6.2 ANALYSIS 7.6-48 7.6.2.1 Safety-Related Systems - Instrumentation and Controls 7.6-48 7.6.2.2 Conformance to 10 CFR 50, Appendix A -
| |
| General Design Criteria (GDC) 7.6-48 7.6.2.3 Conformance to IEEE Standards 7.6-50 7.6.2.4 Conformance to NRC Regulatory Guides 7.6-56 7.7 CONTROL SYSTEMS NOT REQUIRED FOR SAFETY 7.7-1 7.
| |
| | |
| ==7.1 DESCRIPTION==
| |
| 7.7-1 7.7.1.1 Reactor Vessel Head Seal Leak Detection 7.7-2 7.7.1.2 Rod Control and Information System (RC&IS) -
| |
| Instrumentation and Controls 7.7-2 7.7.1.3 Recirculation Flow Control System -
| |
| Instrumentation and Controls 7.7-21 7.7.1.4 Feedwater Control System - Instrumentation and Controls 7.7-28 7.7.1.5 Steam Bypass and Pressure Regulating System -
| |
| Instrumentation and Controls 7.7-34 7.7.1.6 Refueling Interlocks - Instrumentation and Controls 7.7-40 7.7.1.7 Design Differences 7.7-43 7.7.1.8 Process Computer System - Instrumentation 7.7-43 7.7.1.9 Reactor Water Cleanup System 7.7-49 Revision 17 7-iii October, 2011
| |
| | |
| TABLE OF CONTENTS (Continued)
| |
| Section Title Page 7.7.1.10 Process Sampling System 7.7-49 7.7.1.11 Gaseous Radwaste System 7.7-49 7.7.1.12 Drywell Vacuum Relief (DVR) System 7.7-49 7.7.2 ANALYSIS 7.7-50 7.7.2.1 Safety Function 7.7-50 7.7.2.2 Failure Modes and Malfunctions 7.7-51 Revision 12 7-iv January, 2003
| |
| | |
| LIST OF TABLES Table Title Page 7.1-1 Design and Supply Responsibility of Safety-Related Systems 7.1-20 7.1-2 Similarity to Licensed Reactors - Safety-Related Systems 7.1-22 7.1-3 Codes and Standards Applicability Index for Controls and Instrumentation 7.1-25 7.1-4 Summary Information Indicating Degree of Compliance with Regulatory Guide 1.97, Rev. 2 (NSSS Design)and (others) 7.1-34 7.2-1 Reactor Protection System Instrumentation 7.2-38 7.2-2 APRM System Trips 7.2-40 7.2-2a OPRM System Trips 7.2-41 7.2-3 Reactor Protection System Response Time Table 7.2-42 7.3-1 Isolation System Instrumentation Response Time Table 7.3-80 7.5-1 Safety-Related Display Instrumentation (Display Instrumentation for Safety-Related Systems) 7.5-17 7.6-1 IRM System Trips 7.6-60 7.6-2 LPRM System Trips 7.6-61 7.6-3 End-of-Cycle Recirculation Pump Trip System Response Time Table 7.6-62 7.7-1 Design and Supply Responsibility for Nonsafety-Related Systems 7.7-52 7.7-2 Similarity to Licensed Reactors for Nonsafety-Related Systems 7.7-53 7.7-3 Refueling Interlock Effectiveness 7.7-54 Revision 12 7-v January, 2003
| |
| | |
| 7.0 INSTRUMENTATION AND CONTROLS SYSTEMS
| |
| | |
| ==7.1 INTRODUCTION==
| |
| | |
| Chapter 7 presents specific detailed design and performance information for instrumentation and control of safety-related and major plant control systems utilized throughout the plant. The design and performance considerations of these systems, safety function and their mechanical aspects are described in other chapters. See <Section 1.7.1>
| |
| for a listing of electrical schematics, <Section 1.2> for plant layout drawings and <Section 3.2> for equipment classification.
| |
| 7.1.1 IDENTIFICATION OF SAFETY-RELATED SYSTEMS The systems presented in Chapter 7 are classified according to the NRC
| |
| <Regulatory Guide 1.70>, Revision 3; namely, Reactor Protection (Trip)
| |
| System, Engineered Safety Feature Systems, Safe Shutdown Systems, Safety-Related Display Instrumentation, Other Systems Required for Safety, and Control Systems Not Required for Safety. <Table 7.1-1>
| |
| lists safety-related systems and identifies the designer and/or the supplier. Nonsafety-related systems are listed in <Table 7.7-1>.
| |
| <Table 7.1-2> identifies instrumentation and control systems that are identical to those of a nuclear power plant of similar design that has recently received NRC design or operation approval through the issuance of either a construction permit or an operating license. Differences are also identified in <Table 7.1-2>.
| |
| The following is a brief description of Reactor Protection (Trip)
| |
| System, Engineered Safety Feature Systems, Safe Shutdown Systems, Safety-Related Display Instrumentation, and Other Systems Required for Safety as described in Chapter 7.
| |
| : a. Reactor Protection (Trip) System (RPS) - instrumentation and controls initiate reactor shutdown by automatic control rods Revision 12 7.1-1 January, 2003
| |
| | |
| insertion (scram) if selected variables exceed pre-established limits. This action prevents fuel damage, limits nuclear system pressure and restricts the release of radioactive material.
| |
| : b. Containment and Reactor Vessel Isolation Control System (CRVICS) -
| |
| instrumentation and controls initiate automatic closure of various reactor pressure boundary and containment isolation valves if monitored system variables exceed pre-established limits. This action limits the loss-of-coolant from the reactor coolant pressure boundary and the release of radioactive materials from either the reactor coolant pressure boundary or the containment.
| |
| : c. Emergency Core Cooling Systems (ECCS) - instrumentation and controls provide automatic initiation and control of specific core cooling systems, namely, High Pressure Core Spray system (HPCS),
| |
| automatic depressurization system (ADS), Low Pressure Core Spray system (LPCS), and the Low Pressure Coolant Injection (LPCI) mode of RHR. This provides adequate core cooling following a loss-of-coolant accident to prevent fuel cladding failure from excessive temperatures.
| |
| : d. Neutron Monitoring System (NMS) - instrumentation and controls use incore neutron detectors to monitor core neutron flux. The neutron monitoring system provides signals to the RPS trip channels to scram the reactor. The Oscillation Power Range Monitors (OPRM) are used to detect and suppress the evidence of reactor thermal-hydraulic instability in a pre-determined region of the core power versus flow map. Average neutron flux or average simulated thermal power (APRM) is used as the overpower indicator during power operation. Intermediate Range Monitors (IRM) are used as power indicators during startup and shutdown. The neutron monitoring system also provides power level indication during planned operation.
| |
| Revision 12 7.1-2 January, 2003
| |
| : e. Process Radiation Monitoring System (PRM) - instrumentation and controls include a number of radiation monitors and monitoring subsystems which are provided on process liquid and gas lines that may serve as discharge routes for radioactive materials.
| |
| : f. Control Complex HVAC System - instrumentation and controls are provided to monitor the habitability of the control complex and to maintain it in a habitable condition by means of recirculation of the control complex air, during abnormal occurrences.
| |
| : g. Emergency Water System (EWS) - consists of the emergency closed cooling system and the emergency service water system.
| |
| Instrumentation and controls provide for manual or automatic initiation of the emergency water system. Emergency water system pumps are provided with remote-manual controls in the control room and external to the control room. Sufficient instrumentation is provided to enable the operator to assess the correct operation of the system.
| |
| : h. Combustible Gas Control System - consists of four subsystems: the hydrogen analysis system, the mixing system, the hydrogen recombination system, and the purge system. Instrumentation and controls are provided to detect the concentration of free hydrogen in the drywell and containment and to reduce the free hydrogen concentrations by dilution, recombination and purging.
| |
| : i. The Reactor Core Isolation Cooling System (RCIC) - instrumentation and controls provide initiation and control of makeup water to the reactor vessel, in the event that the reactor becomes isolated from the main condensers during normal plant operation by a closure of the main steam line isolation valves.
| |
| Revision 12 7.1-3 January, 2003
| |
| : j. The Standby Liquid Control System (SLCS) - instrumentation and controls provide manual initiation of a backup reactivity control system which can shut the reactor down from rated power to the cold condition in the event that all withdrawn control rods cannot be inserted manually by the rod control and information system to achieve reactor shutdown.
| |
| : k. The Leak Detection System (LDS) uses various temperature, pressure, radiation, level, and flow sensors to detect, annunciate and isolate (in certain cases) water and steam leakage paths in selected reactor systems.
| |
| : l. The RHRS Reactor Shutdown Cooling Mode (RSCM) is manually initiated to provide cooling to remove the decay and sensible heat from the reactor vessel so that the reactor can be refueled and serviced.
| |
| : m. The Fuel Pool Cooling System (FPCS) - instrumentation and controls monitor water temperature and controls cooling of the fuel pool.
| |
| : n. Containment Atmospheric Monitoring System - provides instrumentation for detecting and predicting the progression of abnormal occurrences in the containment and for monitoring after postulated accidents. Containment and Drywell temperature and pressure monitoring is provided by instrumentation with adjustable alarm features. The containment atmospheric monitoring system also provides suppression pool temperature monitoring instrumentation.
| |
| Containment atmosphere monitoring for radioactivity and radiation is provided by the process and area radiation monitoring systems.
| |
| Hydrogen analysis instrumentation is provided by the combustible gas control system. Suppression pool level instrumentation is provided by the suppression pool make-up system.
| |
| Revision 12 7.1-4 January, 2003
| |
| : o. Annulus Exhaust Gas Treatment System - Filters, monitors and exhausts any gases leaking from the containment vessel to the annulus by maintaining the area at a slight negative pressure.
| |
| : p. (Deleted)
| |
| : q. The Safety-Related Display Instrumentation is provided to inform the reactor operator when a manual safety action should be taken or is required and allows assessment of safety system status.
| |
| : r. The RHRS - Containment Spray Cooling Mode (CSCM) is an automatic or manually initiated subsystem of the RHR system that is provided to condense steam in the containment following a loss-of-coolant accident.
| |
| : s. The Remote Shutdown System (RSS) provides the capability to assure safe shutdown of the reactor in the event that the control room should become uninhabitable.
| |
| : t. Recirculation Pump Trip (RPT) system - instrumentation and controls are provided to reduce the severity of thermal transients on fuel due to turbine generator trip and load rejection events by tripping the recirculation pumps early in the event, thus rapidly reducing core flow and increasing void content and thereby reducing reactivity in conjunction with the control rod scram.
| |
| : u. RHRS Suppression Pool Cooling Mode (SPCM) is a manually initiated subsystem of the RHR system that is provided to cool suppression pool water to avoid elevated pool temperatures.
| |
| : v. Suppression Pool Makeup System - instrumentation and controls are provided for the transfer of water from the upper fuel transfer pool to the lower suppression pool when required. Suppression pool level monitoring is provided by this system.
| |
| Revision 12 7.1-5 January, 2003
| |
| : w. Pump Rooms Cooling System - provides instrumentation to maintain each of the pump rooms within the design temperature range and provide for the monitoring of airflow and temperature.
| |
| : x. ESF Building and Area HVAC System - provides instrumentation to control and monitor the heating, cooling, ventilation, and purification of areas such as the MCC, switchgear and miscellaneous electrical areas, battery rooms, and diesel generator building.
| |
| : y. Fuel Handling Area Ventilation System - instrumentation and controls monitor and control the supply of filtered and tempered air to various operating areas. Exhaust air is passed through charcoal filters prior to discharge.
| |
| : z. Offgas Building Exhaust System - provides instrumentation to monitor and control exhaust air from potentially contaminated areas such as the steam jet air ejector and various areas in the offgas building.
| |
| aa. Rod Pattern Control System - instrumentation and controls are provided to reduce the consequences of the postulated rod drop accident by preventing control rod movement into unacceptable rod patterns.
| |
| bb. Containment Vacuum Relief System - instrumentation and controls provide valve actuation signals and position indication in the control room for each valve in the vacuum relief lines.
| |
| cc. Standby Power Support Systems - instrumentation and controls ensure the adequacy and availability of the diesel fuel oil and starting air systems. Manual controls for diesel startup are provided locally at the diesel generators and remotely in the control room.
| |
| Revision 12 7.1-6 January, 2003
| |
| | |
| dd. Redundant Reactivity Control System - instrumentation and controls provide detection and actuation logic for input to the recirculation system, feedwater system and the alternate rod insertion function in order to mitigate the potential consequences of an anticipated transient without scram <Section 15.8> and
| |
| <Appendix 15C>.
| |
| ee. Hydrogen Control System is a manually initiated system operated from switches located in the control room, designed to control large amounts of hydrogen by burning it at low concentrations, thereby maintaining the concentration of hydrogen below levels which could potentially threaten containment integrity or equipment survivability.
| |
| 7.1.2 IDENTIFICATION OF SAFETY CRITERIA Instrumentation and control equipment design are based on the need to have the system perform its intended function while meeting the requirements of applicable General Design Criteria (GDC), Regulatory Guides, industry standards, and other documents. Refer to
| |
| <Section 7.2>, <Section 7.3>, <Section 7.4>, <Section 7.5>, and
| |
| <Section 7.6> for discussion of design bases for each safety-related system.
| |
| 7.1.2.1 Regulatory Requirements The plant safety-related systems have been examined with respect to specific regulatory requirements which are applicable to the instrumentation and controls of these systems. These regulatory requirements include:
| |
| : a. Title 10 Code of Federal Regulations, Part 50 <10 CFR 50>
| |
| : b. Industry Codes and Standards Revision 12 7.1-7 January, 2003
| |
| : c. Regulatory Guides The specific regulatory requirements pertaining to each systems instrumentation and control is specified in <Table 7.1-3>. For a discussion of the degree of conformance, see the individual systems analysis portions in <Section 7.2>, <Section 7.3>, <Section 7.4>,
| |
| <Section 7.5>, and <Section 7.6>.
| |
| 7.1.2.2 Regulation Conformance - <10 CFR 50, Appendix A>
| |
| The following is a discussion of those GDCs which apply equally to all safety-related systems described in Chapter 7. Those GDCs which do not apply equally to all safety-related systems are discussed for each system in the analysis portion of <Section 7.2>, <Section 7.3>,
| |
| <Section 7.4>, <Section 7.5>, and <Section 7.6>.
| |
| : a. General Design Criterion 1 - Quality Standards and Records The quality assurance program is discussed in <Chapter 17>.
| |
| Documents are maintained for each safety-related system which demonstrate that all the requirements of the quality assurance program are being satisfied.
| |
| : b. General Design Criterion 2 - Design Bases for Protection Against Natural Phenomena Wind and tornado loadings are discussed in <Section 3.2>, flood design is described in <Section 3.4> and seismic qualification of safety-related instrumentation and electrical equipment is discussed in <Section 3.10>.
| |
| Revision 12 7.1-8 January, 2003
| |
| : c. General Design Criterion 3 - Fire Protection The fire protection system and its design basis are discussed in
| |
| <Section 9.5.1>. Fire protection in safety-related cable systems is described in <Section 8.3.3>.
| |
| : d. General Design Criterion 4 - Environmental and Missile Design Bases The safety-related systems are designed to accommodate the effects of and to be compatible with the environmental conditions associated with normal operation, maintenance, testing, and postulated accidents, including loss-of-coolant accidents.
| |
| The safety-related systems are appropriately protected against dynamic effects including the effects of missiles, pipe whipping and discharging fluids that may result from equipment failures.
| |
| Missile protection is discussed in <Section 3.5>, pipe whip in
| |
| <Section 3.6> and environmental qualification of equipment is discussed in <Section 3.11.2>.
| |
| : e. General Design Criterion 5 - Sharing of Structures, Systems and Components Shared facilities do not impair the ability of safety equipment of the unit to perform its safety functions.
| |
| : f. General Design Criterion 10 - Reactor Design The safety-related systems are designed to monitor certain reactor parameters, sense abnormalities and to initiate protective actions to prevent fuel design limits from being exceeded, and to limit the release of radioactive material during conditions of normal or anticipated operational occurrences.
| |
| Revision 19 7.1-9 October, 2015
| |
| : g. General Design Criterion 13 - Instrumentation and Controls The safety-related instrumentation and controls monitor variables over their anticipated ranges for normal operation, anticipated occurrences and accident conditions and initiate protective systems to limit or prevent fuel damage and maintain the integrity of the reactor coolant pressure boundary.
| |
| : h. General Design Criterion 15 - Reactor Coolant System Design The safety-related systems provide sufficient margin to assure that the design conditions of the reactor coolant pressure boundary are not exceeded during any condition of normal operation, including anticipated operational occurrences. If the monitored variables exceed their predetermined settings, automatic safety actions are provided.
| |
| : i. General Design Criterion 19 - Control Room A centralized location for safely operating the plant is provided by the control rooms.
| |
| : j. General Design Criterion 50 - Containment Design Basis The containment electrical penetrations are designed to accommodate the calculated pressure and temperature conditions resulting from a loss-of-coolant accident. See <Section 7.1.2.3.b>, for discussion of conformance to IEEE Standard 317.
| |
| : k. General Design Criteria 54, 55 and 56 - Isolation Criteria All process lines penetrating the containment are provided with isolation valves in accordance with specified criteria. Refer to
| |
| <Section 6.2>.
| |
| Revision 12 7.1-10 January, 2003
| |
| | |
| 7.1.2.3 Conformance to IEEE Standards The following is a discussion of those IEEE Standards which apply equally to all safety-related systems described in Chapter 7. Those IEEE Standards which do not apply equally to all safety-related systems are discussed for each system in the analysis portion of <Section 7.2>,
| |
| <Section 7.3>, <Section 7.4>, <Section 7.5>, and <Section 7.6>:
| |
| : a. Conformance to IEEE Standard 308 - Class 1E Power Systems for Nuclear Power Generating Stations Conformance to IEEE Standard 308 is described in <Section 8.3>.
| |
| : b. Conformance to IEEE Standard 317 - Electric Penetration Assemblies in Containment Structures Penetration assemblies meet the requirements of IEEE Standard 317 and Criterion 50 of <10 CFR 50, Appendix A>. All containment electrical penetration assemblies used for Class 1E and non-Class 1E circuits are designed to withstand, without loss of containment integrity, the maximum postulated overcurrent versus time conditions. For additional description see
| |
| <Section 8.3.1.4.5>.
| |
| : c. Conformance to IEEE Standard 323 - Qualifying Class 1E Equipment for Nuclear Power Generating Stations Conformance to IEEE Standard 323 is discussed in <Section 3.11>.
| |
| : d. Conformance to IEEE Standard 336 - Installation, Inspection and Testing Requirements for Instrumentation and Electric Equipment During the Construction of Nuclear Power Generating Stations Revision 12 7.1-11 January, 2003
| |
| | |
| Where applicable, purchase and contract specifications define installation, inspection and testing requirements for plant instrumentation and controls. Conformance to IEEE Standard 336 is discussed in <Table 8.1-2>.
| |
| : e. Conformance to IEEE Standard 338 - Periodic Testing of Nuclear Power Generating Stations Conformance to IEEE Standard 338 is presented on a system basis in the analysis portions of <Section 7.2>, <Section 7.3>,
| |
| <Section 7.4>, <Section 7.5>, and <Section 7.6> as part of the discussion of <Regulatory Guide 1.22> compliance, and as modified by Power Systems Branch Technical Position PSB-1 for the degraded voltage protection scheme.
| |
| : f. Conformance to IEEE Standard 344 - Seismic Qualification of Class 1E Equipment All safety-related instrumentation and control equipment is classified as Seismic Category I, designed to withstand the effects of the safe shutdown earthquake (SSE) and remain functional during normal and accident conditions. Qualification and documentation procedures used for Seismic Category I equipment and systems are identified in <Section 3.10>.
| |
| : g. Conformance to IEEE Standard 379 - Application of Single-Failure Criterion to Nuclear Power Generating Stations The extent to which the single failure criteria of IEEE Standard 379 is satisfied is specifically covered for each system in the analysis of IEEE Standard 279, Paragraph 4.2 in
| |
| <Section 7.2>, <Section 7.3>, <Section 7.4>, <Section 7.5>, and
| |
| <Section 7.6>.
| |
| Revision 12 7.1-12 January, 2003
| |
| : h. Conformance to IEEE Standard 384 - Independence of Class 1E Equipment and Circuits The safety-related systems described in <Section 7.2>,
| |
| <Section 7.3>, <Section 7.4>, <Section 7.5>, and <Section 7.6> meet the independence and separation criteria for redundant systems in accordance with IEEE Standard 279, Paragraph 4.6.
| |
| The criteria and bases for the independence of safety-related instrumentation and controls, electrical equipment, cable, cable routing, marking, and cable derating are discussed in
| |
| <Section 8.3.1>. Fire detection and protection in the areas where wiring is installed is described in <Section 9.5.1>.
| |
| : i. Conformance to IEEE Standard 387 - Diesel-Generator Units Applied as Standby Power Supplies for Nuclear Power Generating Stations Conformance to IEEE Standard 387 is discussed in <Section 8.3>.
| |
| 7.1.2.4 Conformance to Regulatory Guides The following is a discussion of regulatory guides which apply equally to all safety-related systems described in Chapter 7. Those Regulatory Guides which do not apply equally to all safety-related systems are discussed for each system in the applicable analysis portion of
| |
| <Section 7.2>, <Section 7.3>, <Section 7.4>, <Section 7.5>, and
| |
| <Section 7.6>, and <Section 1.8>.
| |
| : a. Conformance to <Regulatory Guide 1.6>
| |
| Independence is maintained between redundant (onsite) sources and between their distribution systems in accordance with
| |
| <Regulatory Guide 1.6>. Further discussion is presented in
| |
| <Section 8.3.1>.
| |
| Revision 12 7.1-13 January, 2003
| |
| : b. Conformance to <Regulatory Guide 1.11>
| |
| All instrument lines penetrating or connected directly to the containment atmosphere, which are part of safety-related systems, meet the requirements of Regulatory Position C.1. This is accomplished by redundancy, independence and by allowing for safety system testability, by line orificing or sizing and by including automatic line shutoff capability if line integrity is lost. Refer also to <Section 6.2.4>.
| |
| All other instrument lines that penetrate containment or are connected directly to the containment atmosphere meet Regulatory Position C.2 with the exception of the return lines associated with the Hydrogen Analysis sub-system of the Containment Combustible Gas Control System. The failure state of isolation valves 1M51F0250A/B is in the closed position.
| |
| : c. Conformance to <Regulatory Guide 1.29>
| |
| All safety-related instrumentation and control equipment is classified as Seismic Category I, designed to withstand the effects of the safe shutdown earthquake (SSE) and remain functional during normal and accident conditions. Qualification and documentation procedures used for Seismic Category I equipment and systems are identified in <Section 3.10> and <Section 3.2>.
| |
| : d. Conformance to <Regulatory Guide 1.30>
| |
| The quality assurance requirements of IEEE Standard 336 (see discussion in <Section 7.1.2.3.d>, above) are applicable during the plant design and construction phases and will also be implemented as an operational QA program during plant operation in response to
| |
| <Regulatory Guide 1.30>. The specific requirements of
| |
| <Regulatory Guide 1.30> are met as discussed in <Section 17.2>.
| |
| Revision 15 7.1-14 October, 2007
| |
| : e. Conformance to <Regulatory Guide 1.32>
| |
| The systems are designed to the requirements of
| |
| <Regulatory Guide 1.32> and IEEE Standard 308 <Section 8.3>.
| |
| : f. Conformance to <Regulatory Guide 1.40>
| |
| Conformance to <Regulatory Guide 1.40> is discussed in
| |
| <Section 1.8>, <Section 3.11> and <Section 8.1>.
| |
| : g. Conformance to <Regulatory Guide 1.47>
| |
| The system of bypass indication is designed to satisfy the requirements of IEEE Standard 279, Paragraph 4.13 and
| |
| <Regulatory Guide 1.47>. The design of the bypass indication system allows testing during normal operation and is used to supplement administrative procedures by providing indications of safety systems status.
| |
| The bypass indication system is designed and installed in a manner which precludes the possibility of adverse affects on the plant safety system. These portions of the bypass indication system, which when faulted could reduce the independence between redundant safety systems, are electrically isolated from the protection circuits.
| |
| Typically, the following bypasses or inoperabilities cause actuation of system level (and component level) annunciation for the affected system:
| |
| : 1. Pump motor breaker not in OPERATE position
| |
| : 2. Loss of pump motor control power Revision 12 7.1-15 January, 2003
| |
| : 3. Loss of motor operated valve control power/motive power
| |
| : 4. Logic power failure
| |
| : 5. Logic in test
| |
| : 6. System lineup improper
| |
| : 7. Bypass or test switches actuated Auxiliary supporting system inoperability or bypass resulting in the loss of other safety-related systems will cause actuation of system level annunciators for the auxiliary supporting system as well as those safety-related systems affected.
| |
| : h. Conformance to <Regulatory Guide 1.63>
| |
| See <Section 1.8> and <Section 8.3.1>.
| |
| : i. Conformance to <Regulatory Guide 1.68>
| |
| See <Section 1.8>.
| |
| : j. Conformance to <Regulatory Guide 1.70>
| |
| See <Section 1.8>.
| |
| : k. Conformance to <Regulatory Guide 1.75>
| |
| See <Section 8.1.1>.
| |
| : l. Conformance to <Regulatory Guide 1.80>
| |
| See <Section 1.8>.
| |
| Revision 12 7.1-16 January, 2003
| |
| : m. Conformance to <Regulatory Guide 1.89>
| |
| Qualification of Class 1E equipment is discussed in <Chapter 3>.
| |
| For discussion of conformance, see <Section 3.11.2>.
| |
| : n. Conformance to <Regulatory Guide 1.97>
| |
| Detailed conformance is discussed in <Table 7.1-4>.
| |
| : o. Conformance to <Regulatory Guide 1.100>
| |
| See <Section 1.8>.
| |
| : p. Conformance to <Regulatory Guide 1.105>
| |
| The trip setpoint (instrument setpoint) is contained in the Operational Requirements Manual and the allowable value (technical specification limit) is contained in Perry Technical Specifications. These parameters are all appropriately separated from each other based on instrument accuracy, calibration capability and design drift (estimated) allowance data. The setpoints are within the instrument accuracy range. The established setpoints provide margin to satisfy both safety requirements and plant availability objectives.
| |
| : q. Conformance to <Regulatory Guide 1.118>
| |
| See <Section 1.8>.
| |
| 7.1.3 PLANT PROTECTION SYSTEM-ELECTRONIC TRIP SYSTEM This section is provided to describe the analog transmitter/trip unit system (AT/TU). The AT/TU system is a plant protection system design feature generically applied to the Perry Nuclear Power Plant reactor Revision 12 7.1-17 January, 2003
| |
| | |
| protection (Trip) system, engineered safety feature systems, reactor core isolation cooling system (see GE Licensing Topical Report, NEDO-21617-1, January 1978). The AT/TU is part of the plant protection system instrumentation and controls and, therefore, complies with the regulations, regulatory guides and industry standards applicable to the instrumentation and controls of the plant protection system.
| |
| 7.1.3.1 General Description The AT/TU system uses analog instrument channels to monitor important plant variables, e.g., reactor water level, reactor pressure, drywell pressure, process flow, etc. The analog transmitter converts the process variable sensed to a 4 to 20 mA linear signal. The minimum and maximum process variable level is within the 4 to 20 mA signal range.
| |
| The signal is transmitted to electronic trip units located in the control room. The trip units compare the transmitted signal to a fixed reference signal. When the transmitted signal increases above or decreases below the fixed reference signal, the trip unit trips an associated relay. The relay is selected to either open or to close on receipt of the trip signal.
| |
| The AT/TU system consists of master trip assemblies, slave trip assemblies and calibration units. The master trip unit also contains a panel meter that displays transmitter current and is scaled in the units of the process variable being monitored. A selector switch internal to the master trip unit allows for selection of either high trip point or low trip point. This allows trip relays to be either energized or de-energized during normal operation.
| |
| The slave trip unit is used in conjunction with a master trip unit when different setpoints from a common transmitter are desired. The slave trip unit receives its input signal from the analog output of a master trip unit. There is no direct connection to any 4- to 20-mA transmitter and no analog output signals are generated by the slave unit.
| |
| Revision 12 7.1-18 January, 2003
| |
| | |
| The calibration unit furnishes the means by which an in situ calibration check of the master and slave trip units can be performed. The calibrator contains a stable current source and a transient current source. The stable current is for verification of the calibration point of any given channel. The transient current source is used to provide a step current input into a selected trip unit such that the response time of that channel can be determined.
| |
| Revision 12 7.1-19 January, 2003
| |
| | |
| TABLE 7.1-1 DESIGN AND SUPPLY RESPONSIBILITY OF SAFETY-RELATED SYSTEMS GE GE Design Supply Others Reactor Protection Trip System Reactor Protection Trip System (RP) X X Engineered Safety Features Systems Emergency Core Cooling Systems (ECCS) X X High Pressure Core Spray (HPCS)
| |
| Automatic Depressurization System (ADS)
| |
| Low Pressure Core Spray System (LPCS)
| |
| RHR Low Pressure Coolant Injection (LPCI)
| |
| Containment and Reactor Vessel Isolation Control System (CRVICS) X X X Process Radiation Monitoring System (PRM)
| |
| (Portion used for CRVICS) X X X Emergency Water Systems Emergency Closed Cooling Water (ECCW) X Emergency Service Water (ESW) X Control Complex Heating Ventilation and X Air Condition System Combustible Gas Control System X Annulus Exhaust Gas Treatment System (AEGTS) X ESF Building and Area HVAC and X Purification System Containment Vacuum Relief System X Suppression Pool Makeup System X RHRS Containment Spray Cooling Mode X X RHRS Suppression Pool Cooling Mode X X Standby Power Systems X X X Pump Room Cooling Systems X Fuel Handling Ventilation System X Systems Required for Safe Shutdown Standby Liquid Control System (SLCS) X X RHR Reactor Shutdown Cooling Mode X X Remote Shutdown System (RSS) X X X Reactor Core Isolation Cooling System (RCIC) X X Revision 12 7.1-20 January, 2003
| |
| | |
| TABLE 7.1-1 (Continued)
| |
| GE GE Design Supply Others Safety-Related Display Instrumentation X X X All Other Safety-Related Systems Process Radiation Monitoring System X Neutron Monitoring System X X Intermediate Range Monitor (IRM)
| |
| Average Power Range Monitor (APRM)
| |
| Local Power Range Monitor (LPRM)
| |
| Leak Detection X X X Rod Pattern Control System (RPCS) X X Recirculation Pump Trip (RPT) X X Fuel Pool Cooling System (FPCS) X Offgas Building Exhaust X Containment Atmosphere Monitoring System X High Pressure - Low Pressure Systems Interlocks X X Redundant Reactivity Control System X X Hydrogen Control System X Revision 12 7.1-21 January, 2003
| |
| | |
| TABLE 7.1-2 SIMILARITY TO LICENSED REACTORS - SAFETY-RELATED SYSTEMS Plants Applying for or Having Construction Permit or Instrumentation and Controls Operating Similarity
| |
| ___________System___________ ___License___ of design_
| |
| : 1. Reactor Protection Trip System Grand Gulf See Note(2a);
| |
| see Item 4
| |
| : 2. Containment and Reactor Vessel Grand Gulf See Note(2a)
| |
| Isolation Control System
| |
| : 3. Emergency Core Cooling System Grand Gulf See Note(2a) (2b)
| |
| : 4. Neutron Monitoring System Grand Gulf See Note (2d);
| |
| PNPP has 4 SRM channels Grand Gulf has 6 (2d)
| |
| : 5. Rod Pattern Control System Grand Gulf See Note
| |
| : 6. Process Radiation Monitoring Grand Gulf See Note (2c)
| |
| (differences System due to extent of system)
| |
| (1) (1)
| |
| : 7. Annulus Exhaust Gas See Note See Note Treatment System (AEGTS)
| |
| (1) (1)
| |
| : 8. Control Complex Heating, See Note See Note Ventilating and Air Conditioning System (1) (1)
| |
| : 9. Emergency Water Systems See Note See Note
| |
| : 10. Combustible Gas Control (1) (1)
| |
| System See Note See Note (2a) (2b)
| |
| : 11. Reactor Core Isolation Grand Gulf See Note Cooling System (2a)
| |
| : 12. Standby Liquid Control System Grand Gulf See Note (1) (1)
| |
| : 13. Containment Atmospheric See Note See Note Monitoring System Revision 12 7.1-22 January, 2003
| |
| | |
| TABLE 7.1-2 (Continued)
| |
| Plants Applying for or Having Construction Permit or Instrumentation and Controls Operating Similarity
| |
| ___________System___________ ___License___ of design_
| |
| : 14. Leak Detection Systems Grand Gulf Same for PNPP
| |
| : 15. RHRS - Reactor Shutdown (2b)
| |
| Cooling Mode Grand Gulf See Note (1) (1)
| |
| : 16. Fuel Pool Cooling System See Note See Note
| |
| : 17. (Deleted)
| |
| (2a) (2b)
| |
| : 18. Safety-Related Display Grand Gulf See Note Instrumentation
| |
| : 19. Containment Vacuum Relief (1) (1)
| |
| System See Note See Note
| |
| : 20. RHRS - Containment Spray Grand Gulf See Note (2b) (2c)
| |
| (2e)
| |
| Cooling Mode ; Grand Gulf has one containment spray loop, PNPP has two
| |
| : 21. Remote Shutdown System Hanford Interface valves of significance may vary but same control and instrument functions are provided
| |
| : 22. Recirculation Pump Trip Grand Gulf Same for PNPP (2b) (2c)
| |
| : 23. RHR System - Suppression Pool Grand Gulf See Note Cooling Mode (1) (1)
| |
| : 24. Suppression Pool Makeup System See Note See Note (1) (1)
| |
| : 25. Pump Rooms Cooling System See Note See Note Revision 12 7.1-23 January, 2003
| |
| | |
| TABLE 7.1-2 (Continued)
| |
| Plants Applying for or Having Construction Permit or Instrumentation and Controls Operating Similarity
| |
| ___________System___________ ___License___ of design_
| |
| (1) (1)
| |
| : 26. ESF Bldg & Area HVAC System See Note See Note (1) (1)
| |
| : 27. Fuel Handling Area Ventilation See Note See Note System (1) (1)
| |
| : 28. Offgas Building Exhaust System See Note See Note (1) (1)
| |
| : 29. Standby Power Systems See Note See Note NOTES:
| |
| (1)
| |
| None; new design.
| |
| (2)
| |
| System designs are similar except for/that:
| |
| : a. Differences in instrumentation ranges and/or trip setting to accommodate difference in reactor vessel size. Instrument zero is 363.5 inches (TAF) and 533.00 inches above vessel zero for PNPP and Grand Gulf, respectively.
| |
| : b. Differences in equipment capacity to accommodate difference in reactor vessel size and/or supporting auxiliary equipment.
| |
| : c. Differences in physical configuration and/or the amounts of associated controls. PNPP has two containment spray loops and Grand Gulf has one.
| |
| : d. Differences due to difference in core size.
| |
| : e. Differences due to the use of multifunction equipment that has been sized to accommodate different vessel size. Pump sizing priority is based on the most rigid of duty requirements.
| |
| Revision 12 7.1-24 January, 2003
| |
| | |
| TABLE 7.1-3 CODES AND STANDARDS APPLICABILITY INDEX FOR CONTROLS AND INSTRUMENTATION(1)
| |
| GDC NO.
| |
| 30 29 28 27 26 25 24 23 22 21 20 19 15 13 12 10 5 4 3 2 1 X X X X X X X X X X X X X X X X X Reactor Protection (Trip) System - RPS X X X X X X X X X X X X X X CRVICS X X X X X X X X X X X X X X X X ECCS X X X X X X X X X X X X X X X X NMS X X X X X X X X X X X X Rod Pattern Control System X X X X X X X X X X X X X X Process Radiation Monitoring X X X X X X X Annulus Exhaust Gas Treatment System X X X X X X X X X X X X X Control Complex HVAC X X X X X X X Standby Power Systems X X X X X X X X X X X X X Emergency Water Systems X X X X X X X X X X X X X X X RCIC X X X X X X X X X Standby Liquid Control System X X X X X X X Containment Atmospheric Monitoring System X X X X X X X X X X X X X X Leak Detection Systems X X X X X RHRS Shutdown Cooling Mode X X X X X X X Fuel Pool Cooling System X X X X X X X X Containment Vacuum Relief X X X X X X X X Drywell Vacuum Relief System X X X X X X X X X X X X X RHRS Containment Spray Cooling Mode X X X X X X X X Remote Shutdown System X X X X X X X X X X X X X X Recirculation Pump Trip X X X X X X X X X X X RHRS Suppression Pool Cooling Mode X X X X X X X X X X X X X Suppression Pool Makeup System X X X X X X X X X X X X X Pump Rooms Cooling System X X X X X X X X X X X X X ESF Building and Area HVAC System X X X X X X Fuel Handling Area Ventilation X X X X X X Offgas Building Exhaust System X X X X X X X X X X X X X Combustible Gas Control System Revision 12 7.1-25 January, 2003
| |
| | |
| TABLE 7.1-3 (Continued)
| |
| GDC NO.
| |
| 64 63 61 60 57 56 55 54 50 46 45 43 41 40 38 37 35 34 33 Reactor Protection (Trip) System - RPS X X X CRVICS X X X X X X X ECCS NMS Rod Pattern Control System X Process Radiation Monitoring Annulus Exhaust Gas Treatment System Control Complex HVAC Standby Power Systems X X X X X X Emergency Water Systems RCIC Standby Liquid Control System X Containment Atmospheric Monitoring System X X X Leak Detection Systems X X X X RHRS Shutdown Cooling Mode X X Fuel Pool Cooling System Containment Vacuum Relief Drywell Vacuum Relief System X X X X X X RHRS Containment Spray Cooling Mode Remote Shutdown System Recirculation Pump Trip X X X X RHRS Suppression Pool Cooling Mode X Suppression Pool Makeup System Pump Rooms Cooling System ESF Building and Area HVAC System Fuel Handling Area Ventilation Offgas Building Exhaust System X Combustible Gas Control System Revision 12 7.1-26 January, 2003
| |
| | |
| TABLE 7.1-3 (Continued)
| |
| IEEE IEEE IEEE IEEE IEEE IEEE IEEE IEEE IEEE IEEE 279 308 317 323 336 338 344 379 384 387 X X X X X X X X Reactor Protection (Trip) System - RPS X X X X X X X X CRVICS X X X X X X X X ECCS X X X X X X NMS X Rod Pattern Control System X X X X X Process Radiation Monitoring X X X X X Annulus Exhaust Gas Treatment System X X X Control Complex HVAC X X X Standby Power System X X X X Emergency Water System X X X X X X RCIC X X X X X X Standby Liquid Control System X X X X X X Containment Atmospheric Monitoring System X X X X X X X Leak Detection Systems X X X X X X X X RHRS Shutdown Cooling Mode X X X Fuel Pool Cooling System X Containment Vacuum Relief X Drywell Vacuum Relief System X X X X X X X X RHRS Containment Spray Cooling Mode Remote Shutdown System X X X X X X X X Recirculation Pump Trip X X X X RHRS Suppression Pool Cooling Mode X X X X X X Suppression Pool Makeup System X X X Pump Rooms Cooling System X X X ESF Building & Area HVAC System X X X Fuel Handling Area Ventilation X X X X Offgas Building Exhaust System X X X X X X Combustible Gas Control System Revision 12 7.1-27 January, 2003
| |
| | |
| TABLE 7.1-3 (Continued)
| |
| <Regulatory <Regulatory <Regulatory <Regulatory <Regulatory <Regulatory <Regulatory <Regulatory <Regulatory <Regulatory Guide Guide Guide Guide Guide Guide Guide Guide Guide Guide 1.6> 1.7> 1.11> 1.21> 1.22> 1.29> 1.30> 1.32> 1.40> 1.45>
| |
| X X X Reactor Protection (Trip)
| |
| System - RPS X X X CRVICS X X X X X X ECCS X X NMS Rod Pattern Control System X X X Process Radiation Monitoring X Annulus Exhaust Gas Treatment System X Control Complex HVAC Standby Power Systems X Emergency Water Systems X X X X X RCIC X X Standby Liquid Control System X X Containment Atmospheric Monitoring System X X X X Leak Detection Systems X X X X RHRS Shutdown Cooling Mode X Fuel Pool Cooling System X Containment Vacuum Relief X Drywell Vacuum Relief System X X X X RHRS Containment Spray Cooling Mode Remote Shutdown System X X X Recirculation Pump Trip X RHRS Suppression Pool Cooling Mode Revision 12 7.1-28 January, 2003
| |
| | |
| TABLE 7.1-3 (Continued)
| |
| <Regulatory <Regulatory <Regulatory <Regulatory <Regulatory <Regulatory <Regulatory <Regulatory <Regulatory <Regulatory Guide Guide Guide Guide Guide Guide Guide Guide Guide Guide 1.6> 1.7> 1.11> 1.21> 1.22> 1.29> 1.30> 1.32> 1.40> __1.45>
| |
| X Suppression Pool Makeup System X Pump Rooms Cooling System X ESF Building & Area HVAC System X Fuel Handling Area Ventilation Offgas Building Exhaust System X X X X Combustible Gas Control System Revision 12 7.1-29 January, 2003
| |
| | |
| TABLE 7.1-3 (Continued)
| |
| <Regulatory <Regulatory <Regulatory <Regulatory <Regulatory <Regulatory <Regulatory <Regulatory <Regulatory Guide Guide Guide Guide Guide Guide Guide Guide Guide 1.47> 1.53> 1.56> 1.62> 1.63> 1.67> 1.68> 1.70> 1.73>
| |
| X X X X Reactor Protection (Trip) System - RPS X X X X X CRVICS X X X X X ECCS X X X NMS X Rod Pattern Control System X X X Process Radiation Monitoring X X X X Annulus Exhaust Gas Treatment System X X X X Control Complex HVAC X Standby Power Systems X X X X Emergency Water Systems X X X X X RCIC X X X X Standby Liquid Control System X X Containment Atmospheric Monitoring System X X X Leak Detection Systems X X X X RHRS Shutdown Cooling Mode X X X Fuel Pool Cooling System X X X X Containment Vacuum Relief X X X X Drywell Vacuum Relief System X X X X RHRS Containment Spray Cooling Mode X Remote Shutdown System X X X Recirculation Pump Trip X X X X RHRS Suppression Pool Cooling Mode X X X X Suppression Pool Makeup System X X X X Pump Rooms Cooling System X X X X ESF Building & Area HVAC System X X Fuel Handling Area Ventilation X X Offgas Building Exhaust System X X X X Combustible Gas Control System Revision 12 7.1-30 January, 2003
| |
| | |
| TABLE 7.1-3 (Continued)
| |
| <Regulatory <Regulatory <Regulatory <Regulatory <Regulatory <Regulatory Guide Guide Guide Guide Guide Guide 1.75> 1.78> 1.80> 1.89> 1.95> 1.96>
| |
| X X Reactor Protection (Trip) System - RPS X X CRVICS X X ECCS X X NMS X X Rod Pattern Control System X X Process Radiation Monitoring Annulus Exhaust Gas Treatment System X X Control Complex HVAC Standby Power Systems Emergency Water Systems X X RCIC X X Standby Liquid Control System X X Containment Atmospheric Monitoring System X Leak Detection Systems X X RHRS Shutdown Cooling Mode X Fuel Pool Cooling System Containment Vacuum Relief Drywell Vacuum Relief System X X RHRS Containment Spray Cooling Mode X Remote Shutdown System X X Recirculation Pump Trip RHRS Suppression Pool Cooling Mode X X Suppression Pool Makeup System Pump Rooms Cooling System ESF Building & Area HVAC System Fuel Handling Area Ventilation Offgas Building Exhaust System X X Combustible Gas Control System Revision 12 7.1-31 January, 2003
| |
| | |
| TABLE 7.1-3 (Continued)
| |
| <Regulatory <Regulatory <Regulatory <Regulatory Guide Guide Guide Guide 1.118> 1.105> 1.100> 1.97>
| |
| X X X X Reactor Protection (Trip) System - RPS X X X X CRVICS X X X X ECCS X X X X NMS X X X X Rod Pattern Control System X X X X Process Radiation Monitoring X X X Annulus Exhaust Gas Treatment System X X X Control Complex HVAC X Standby Power Systems X X X X Emergency Water Systems X X X X RCIC X X X X Standby Liquid Control System X X X X Containment Atmospheric Monitoring System X X X Leak Detection Systems X X X RHRS Shutdown Cooling Mode X X X X Fuel Pool Cooling System X X X Containment Vacuum Relief X X X Drywell Vacuum Relief System X X X X RHRS Containment Spray Cooling Mode Remote Shutdown System X X X Recirculation Pump Trip X X X RHRS Suppression Pool Cooling Mode X X X X Suppression Pool Makeup System X X X Pump Rooms Cooling System X X X ESF Building & Area HVAC System X X X Fuel Handling Area Ventilation X X X Offgas Building Exhaust System X X X X Combustible Gas Control System Revision 12 7.1-32 January, 2003
| |
| | |
| TABLE 7.1-3 (Continued)
| |
| BTP BTP BTP BTP BPT Branch Technical Position (BTP) No. 26 22 21 20 3 X X Reactor Protection (Trip) System - RPS X X CRVICS X X X ECCS X X NMS X Rod Pattern Control System X X Process Radiation Monitoring X X Annulus Exhaust Gas Treatment System X X Control Complex HVAC X X Standby Power Systems X X Emergency Water Systems X X RCIC X X Standby Liquid Control System X X Containment Atmospheric Monitoring System X X Leak Detection Systems X X X X RHRS Shutdown Cooling Mode X Fuel Pool Cooling System X X Containment Vacuum Relief X X Drywell Vacuum Relief System X X RHRS Containment Spray Cooling Mode Remote Shutdown System X X X Recirculation Pump Trip X X RHRS Suppression Pool Cooling Mode X X Suppression Pool Makeup System X X Pump Rooms Cooling System X X ESF Building and Area HVAC System X X Fuel Handling Area Ventilation X Offgas Building Exhaust System X X Combustible Gas Control System NOTE:
| |
| (1)
| |
| This table provides information as to the applicability of requirements to the systems. For degree of conformance of those requirements, refer to the analysis portions of <Section 7.2>, <Section 7.3>, <Section 7.4>, <Section 7.5>, <Section 7.6>, or <Section 7.1.2>.
| |
| Revision 12 7.1-33 January, 2003
| |
| | |
| TABLE 7.1-4
| |
| | |
| ==SUMMARY==
| |
| INFORMATION INDICATING DEGREE OF COMPLIANCE WITH
| |
| <REGULATORY GUIDE 1.97>, REV. 2 (NSSS DESIGN)
| |
| Cate- Quali- Quality Redun- Power Variable Type gory(15) fication Assurance(2) dancy Range Supply Display Remarks Reactor Water Level A,B(16)
| |
| Wide Range 1 See Note(1) Yes Three 5 to 230 1E Control Room See Note(29)
| |
| Channels above TAF Panel & ERIS Fuel Zone 1 See Note(1) Yes Three 150 below 1E Control Room See Note(4)
| |
| Channels TAF to 50 Panel & ERIS above TAF Reactor Pressure A,B,C(16) 1 See Note(1) Yes Two 0-1,500 1E Control Room See Note(5)
| |
| Channels psig Panel & ERIS Neutron Flux B Average Power 2 See Note(1) Yes Eight 1012-1014 IE & Control Room See Note(6)
| |
| Range Channels NV (1014 Uninter- Panel & ERIS NV >100 ruptible power)
| |
| Control Rod Pos. B 3 N/A Commercial One Full in Uninter- Control Room Grade Display to Full ruptible Panel & ERIS for Each out Control Rod Drywell Sump B,C 3 N/A Commercial One 0-25 gpm Instr. Control Room See Note(8) (28)
| |
| (Equip. Drain- Grade Channel bus Panel & ERIS Ident.)
| |
| Drywell Sump B,C 3 N/A Commercial One 0-5 gpm Instr. Control Room See Note(8) (28)
| |
| (Floor Drain- Grade Channel bus Panel & ERIS Unindent.)
| |
| Revision 12 7.1-34 January, 2003
| |
| | |
| TABLE 7.1-4 (Continued)
| |
| Cate- Quali- Quality Redun- Power Variable Type gory(15) fication Assurance(2) dancy Range Supply Display Remarks 6
| |
| Feedwater Flow D 3 N/A Commercial One 0-20x10 Instr. Control Room Grade Channel lb/hr bus Panel & ERIS (Two loops summed)
| |
| Containment Spray D 2 See Note(1) Yes One 0-10,000 1E Control Room See Note(9)
| |
| Flow Channel gpm, Panel & ERIS per loop open/closed Safety Relief D 2 See Note(1) Yes One Open/ 1E Control Room Valve Position Channel closed Panel & ERIS per SRV RCIC System Flow D 2 See Note(1) Yes One 0-800 125 Vdc Control Room Channel gpm 1E Panel & ERIS HPCS System Flow D 2 See Note(1) Yes One 0-10,000 1E Control Room Channel gpm Panel & ERIS LPCS System Flow D 2 See Note(1) Yes One 0-10,000 1E Control Room Channel gpm Panel & ERIS RHR System Flow & D 2 See Note(1) Yes One 0-10,000 1E Control Room See Note(9)
| |
| Low Pressure Channel gpm Panel & ERIS Coolant Injection per loop System Flow Standby Liquid D 2 See Note(1) Yes One 1E Control Room See Note(11)
| |
| Control System Channel 0-1,800 Panel & ERIS Pressure psig Standby Liquid D 2 See Note(1) Yes One 0-5,300 gal. 1E Control Room Control System Channel outlet Panel & ERIS Tank Level nozzle to overflow nozzle Revision 12 7.1-35 January, 2003
| |
| | |
| TABLE 7.1-4 (Continued)
| |
| Cate- Quali- Quality Redun- Power Variable Type gory(15) fication Assurance(2) dancy Range Supply Display Remarks (1)
| |
| RHR System D 2 See Note Yes One 0-10,000 1E Control Room See Note(12)
| |
| Service Water Channel gpm Panel & ERIS Flow per loop BWR Core B,C 1 N/A N/A N/A N/A N/A N/A See Note(18)
| |
| Thermocouple Revision 12 7.1-36 January, 2003
| |
| | |
| TABLE 7.1-4 (Continued)
| |
| | |
| ==SUMMARY==
| |
| INFORMATION INDICATING DEGREE OF COMPLIANCE WITH
| |
| <REGULATORY GUIDE 1.97>, REV. 2 (OTHERS)
| |
| Cate- Quali- Quality Redun- Power Variable Type gory(15) fication Assurance(14) dancy Range Supply Display Remarks Containment and A,C(16) 1 See Note(1) Yes Two 0-10 H2 1E Control Room Drywell Hydrogen Channels Panel & ERIS Concentration (four locations each)
| |
| Drywell Pressure A,B,C,D(16)
| |
| Narrow Range 1 See Note(1) Yes Two 10 Hg to 1E Control Room Channels 5 psig Panel & ERIS Wide Range 1 See Note(1) Yes Two 30 Hg to 1E Control Room Channels 35 psig Panel & ERIS Suppression Pool A,D(16) 1 See Note(1) Yes Two 30-230F 1E Control Room Water Temperature Channels Panel & ERIS (eight locations each)
| |
| See Note(23)
| |
| Suppression Pool A,C,D(16)
| |
| Water Level Narrow Range 1 See Note(1) Yes Two 16.0-19.0 1E Control Room Channels ft Panel & ERIS Wide Range 1 See Note(1) Yes Two 2.0-24.0 ft 1E Control Room Channels Panel & ERIS Primary Contain- A,B,C ment Pressure Normal Range 1 See Note(1) Yes Two 10 Hg to 1E Control Room Channels 20 psig Panel & ERIS Wide Range 1 See Note(1) Yes Two 10 Hg to 1E Control Room Channels 60 psig Panel & ERIS Revision 12 7.1-37 January, 2003
| |
| | |
| TABLE 7.1-4 (Continued)
| |
| Cate- Quali- Quality Redun- Power Variable Type gory(15) fication Assurance(14) dancy Range Supply Display Remarks (1)
| |
| Primary Contain- B 1 See Note Yes Two valves, Open/Closed 1E Control Room See Note(7) (22) ment Isolation open & Panel & ERIS Valve Position closed switches each valve Containment C 3 N/A Commercial One 10-6-10-2 Diesel Control Room See Note(25)
| |
| Effluent Grade Channel µCi/cc backed Panel & ERIS Radioactivity-Noble non 1E Gases Radiation Exposure C 2 See Note(1) Yes Two 1-107 R/hr 1E Control Room See Note(24)
| |
| Rate (inside bldgs. Channels Panel & ERIS or areas which are in direct contact with primary containment where penetrations and hatches are located)
| |
| Effluent Radiation C 2 See Note(1) Yes One 10-6-105 1E Control Room See Note(17) (25)
| |
| Noble Gases Channel Ci/cc See Panel & ERIS See Note(25) Note(17)
| |
| Condensate Storage D 3 N/A Commercial One 20,000-470,000 Uninter- Control Room Tank Level Grade Channel gal. ruptible Panel & ERIS Drywell Atmosphere A,D 1 See Note(1) Yes Two 40-440F 1E Control Room Temperature Channels Panel & ERIS (three locations each)
| |
| Containment Atmos- A 1 See Note(1) Yes Two 50-300F 1E Control Room phere Temperature Channels Panel & ERIS (Four locations each)
| |
| Revision 12 7.1-38 January, 2003
| |
| | |
| TABLE 7.1-4 (Continued)
| |
| Cate- Quali- Quality Redun- Power Variable Type gory(15) fication Assurance(14) dancy Range Supply Display Remarks High Radioactivity D Liquid Tank Level Fuel Pool Filter/ 3 N/A Commercial One 0-10,000 Uninter- ERIS Demineralizer Grade Channel gal. ruptible Backwash Receiver Tank Condensate Filter 3 N/A Commercial One 0-10,000 Uninter- ERIS Backwash Receiver Grade Channel gal. ruptible Tank RWCU Filter/ 3 N/A Commercial One 0-3,300 Uninter- ERIS Demineralizer Grade Channel gal. ruptible Backwash Receiver Tank Safety-Related D 2 See Note(1) Yes Two 0-300 1E Control Room Supply Pressure Channels psig Panel & ERIS to ADS Cooling Water D Temperature to ESF Systems Components Emergency Closed 2 See Note(1) Yes One 50-150F 1E Control Room Cooling Loop Channel Panel & ERIS Temperature per loop ESW Loop Inlet 2 See Note(1) Yes One 0-100F 1E Control Room Temperature Channel Panel & ERIS per loop Emergency Vent D 2 See Note(1) Yes Open & Open/Closed 1E Control Room Damper Position closed Panel & ERIS switches each damper Revision 12 7.1-39 January, 2003
| |
| | |
| TABLE 7.1-4 (Continued)
| |
| Cate- Quali- Quality Redun- Power Variable Type gory(15) fication Assurance(14) dancy Range Supply Display Remarks (1)
| |
| Status of Standby D 2 See Note Yes One Various: 1E Control Room Power and Other Channel Voltage & Panel & ERIS Energy Sources per energy Current, &
| |
| Important to Safety source Breaker Status Primary Containment E 1 See Note(1) Yes Two 1-107 R/hr 1E Control Room Area Radiation Channels Panel & ERIS Hi-Range Reactor Building E 1 See Note(1) Yes Two 1-107 R/hr 1E Control Room Area Radiation Channels Panel & ERIS Radiation Exposure E 3 N/A Commercial One 10-4-104 Diesel Control Room See Note(21)
| |
| Rate (inside bldgs. Grade Channel R/hr backed Panel & Local or areas where non 1E access is required to service equipment important to safety)
| |
| Airborne Radioactive E 2 See Note(1) Yes One 10-6-105 1E Control Room See Note(17) (25)
| |
| Materials Released Channel Ci/cc See Panel & ERIS From Plant See Note(25) Note(17)
| |
| Particulates and E 3 N/A Commercial One 10-3-102 Diesel None See Note(25)
| |
| Halogens all Grade Channel Ci/cc backed Identified non 1E Plant Release Points with Onsite Analysis Capability Radioactivity C 3 N/A Commercial N/A 1/2 Tech Uninter- None See Note(27) (31)
| |
| Concentration or Grade (Sample) Spec Limit ruptible Radiation Level to 100 times in Circulating Tech Spec Primary Coolant limit, R/hr Revision 13 7.1-40 December, 2003
| |
| | |
| TABLE 7.1-4 (Continued)
| |
| Cate- Quali- Quality Redun- Power Variable Type gory(15) fication Assurance(14) dancy Range Supply Display Remarks Accident Sampling See Note(32)
| |
| Capability Analysis of Primary C 3 N/A Commercial N/A 10 Ci/gm- Uninter- None See Note(20) (31)
| |
| Coolant Grade (Sample) 10 Ci/gm or ruptible TID 14844 source term in coolant volume Cooling Water Flow D to ESF Systems Components Emergency Closed 2 See Note(1) Yes One 0-2,500 gpm 1E Control Room Cooling Loop Flow Channel Panel & ERIS per loop ESW Flow to ECCS 2 See Note(1) Yes One 0-3,000 gpm 1E Control Room HX Channel Panel & ERIS per loop ESW Flow to HPCS 2 See Note(1) Yes One 0-1,000 gpm 1E Control Room Diesel HX Channel Panel & ERIS ESW Flow to Stdby 2 See Note(1) Yes One 0-1,200 gpm 1E Control Room Diesel HX Channel Panel & ERIS per loop Airborne E 3 N/A Commerical Three Air sampling N/A None Radiohalogens and Grade Portable 10-9-10-3 Particulates Portable Units µCi/cc at Sampling with On-site analysis Analysis Capability facility Plant & Environs E 3 N/A Commercial Two 10-3-104 N/A None Radiation (Portable Grade Portable R/hr Instrumentation) Detector Units Revision 13 7.1-41 December, 2003
| |
| | |
| TABLE 7.1-4 (Continued)
| |
| Cate- Quali- Quality Redun- Power Variable Type gory(15) fication Assurance(14) dancy Range Supply Display Remarks Plant & Environs E 3 N/A Commercial One Unit Multi- Instr. Local Radioactivity Grade Channel bus Gamma Ray Spectrometer Meteorology E Wind Direction 3 N/A Commercial System A 0-540 N/A Control Room, See Note(30)
| |
| Grade System B Local Plant Computer System Wind Speed 3 N/A Commercial System A 10m, N/A Control Room, See Note(30)
| |
| Grade System B 0-100 mph, Local Plant 60m, Computer System 0-100 mph Estimation of 3 N/A Commercial System A -20 to 100F N/A Control Room, See Note(30)
| |
| Atmospheric Grade System B Delta T Local Plant Stability -6 to +12F Computer System (60-10m)
| |
| Containment & C 1 N/A N/A N/A N/A N/A N/A See Note(13)
| |
| Drywell Oxygen Concentration Drywell Spray D 2 N/A N/A N/A N/A N/A N/A See Note(26)
| |
| Flow Isolation Condenser D 2 N/A N/A N/A N/A N/A N/A See Note(19)
| |
| System Shell-Side Water Level Isolation Condenser D 2 N/A N/A N/A N/A N/A N/A See Note(19)
| |
| System Valve Position Radiation Exposure E - N/A N/A N/A N/A N/A N/A See Note(18)
| |
| Meters (Continuous Indication at Fixed Locations)
| |
| Revision 13 7.1-42 December, 2003
| |
| | |
| TABLE 7.1-4 (Continued)
| |
| NOTES:
| |
| (1)
| |
| Environmental and seismic qualification of Category 1 and 2 variables is in accordance with the PNPP Equipment Qualification Program.
| |
| (2)
| |
| Yes indicates that quality assurance is in accordance with NEDO-11209, NEBG BWR QA Program Description.
| |
| (3)
| |
| (Deleted).
| |
| (4)
| |
| Two existing fuel zone monitors have been upgraded to Category 1 requirements and one additional fuel zone monitor has been included.
| |
| (5)
| |
| Pressure indicating switches located on control room backpanels H13-P693 or H13-P694 will be utilized to verify reactor vessel pressure when the two channel readings disagree.
| |
| (6)
| |
| Neutron flux monitoring instrumentation (average power range), at PNPP is installed in accordance with the requirements set forth for Type B, Category 2 variables. This was determined to be acceptable per NEDO-31558-A (March 1993), CEI letter PY-CEI/NRR-1669L dated February 7, 1994, and NRC letter from J. B. Hopkins to R. A. Stratman dated February 23, 1994.
| |
| (7)
| |
| Primary containment isolation valve position is displayed in the Control Room by in/out lights. Recorders are not utilized for display of this variable.
| |
| (8)
| |
| Drywell sump level or drywell drain sump level (identified/unidentified leakage) is not considered a key variable since they neither automatically initiate safety-related systems nor do they alert the operator to take safety-related actions. The level of the drain sumps can be a direct indication of breach of the reactor coolant system pressure boundary, but may be ambiguous because there is water in the sumps during normal operation. There is other instrumentation required by <Regulatory Guide 1.97> that would indicate leakage in the drywell, such as, drywell pressure, drywell temperature and primary containment area radiation.
| |
| <Regulatory Guide 1.97> requires instrumentation to function during and after an accident. The drywell sump systems are deliberately isolated at the primary containment penetration upon receipt of an accident signal to establish containment integrity.
| |
| Therefore, by design, drywell level instrumentation serves no useful accident-monitoring function. Based on the above, this variable will be implemented at PNPP in accordance with Category 3 instead of Category 1 requirements.
| |
| (9)
| |
| RHR system valve position lineup will be displayed in the Control Room to verify flow through the containment spray flow loops.
| |
| Valve position instrumentation will also be implemented using Catetory 2 design criteria.
| |
| (10)
| |
| (Deleted)
| |
| (11)
| |
| Stand-by liquid control system discharge pump pressure and SLCS tank level, in lieu of flow, will be monitored at PNPP simultaneously to meet the intent of <Regulatory Guide 1.97>.
| |
| (12)
| |
| RHR service water flow will be monitored in lieu of RHR heat exchanger outlet temperature to verify system operation. Heat exchanger bypass valve position will also be verified by Control Room display.
| |
| Revision 13 7.1-43 December, 2003
| |
| | |
| TABLE 7.1-4 (Continued)
| |
| NOTES: (Continued)
| |
| (13)
| |
| The containment and drywell oxygen concentrate variable is not applicable to PNPPs design since PNPP does not utilize an inerted containment. Therefore, this variable will not be implemented per <Regulatory Guide 1.97>, Rev. 2.
| |
| (14)
| |
| Instruments designated as yes implements applicable Regulatory Guide requirements for Quality Assurance in <Regulatory Guide 1.97>, Rev. 2.
| |
| (15)
| |
| All Category 1 variables shall have at least one channel continuously recorded.
| |
| (16)
| |
| Variables, identified as Type A, have been selected based on developed BWROG generic emergency operating procedures.
| |
| (17)
| |
| A portion of the channel will utilize an existing monitor with a range of 10-6 to 10-2 µCi/cc which is designed nonsafety-related, non-Class 1E. This monitor is provided with diesel backed non-Class 1E power. (Revision 2 of <Regulatory Guide 1.97>, Subnote 9, permits the preceding.) Instrumentation for the remaining portion of the channel utilizes 2 monitors which expand the range from 1.7 x 10-3 to 105 Ci/cc, and which are designated safety-related, Class 1E.
| |
| (18)
| |
| BWR core thermocouples and radiation exposure meters (continuous indication at fixed locations) will not be implemented based on direction provided by Supplement 1 of <NUREG-0737>.
| |
| (19)
| |
| The isolation condensor system shell-side water level and valve position variables are not applicable to PNPPs design.
| |
| (20)
| |
| The Postaccident Sampling System, as designed to Category 3 requirements, will be utilized for this variable.
| |
| (21)
| |
| Existing instrumentation (10-1mR/hr to 104mR/hr) will be utilized for the lower end of the required range. Portable survey instruments (10-1R/hr to 104R/hr) will be utilized for the entire range specified in <Regulatory Guide 1.97>.
| |
| (22)
| |
| The primary containment isolation valve position variable is covered by both the NSSS and the BOP scope.
| |
| (23)
| |
| Suppression pool water temperature has eight sub-channels of temperature individually monitored on each recorder.
| |
| (24)
| |
| Area radiation Hi-Range monitors located in the Primary Containment are utilized to meet the requirements of this variable.
| |
| (25)
| |
| Each channel monitors the following four plant vents: Turbine Bay/Heater Bay exhaust vent, Offgas Building Vent Pipe, Unit 1 exhaust vent, and Unit 2 exhaust vent. Each channel consists of 3 detectors as described in Note 17.
| |
| (26)
| |
| The drywell spray flow variable is not applicable to PNPPs design.
| |
| (27)
| |
| <Regulatory Guide 1.97> specifies measurement of the radioactivity of the circulating primary coolant (coolant in active contact with the fuel) as the key variable in monitoring fuel cladding status during isolation of the NSSS. The subject of concern in the
| |
| <Regulatory Guide 1.97> requirement is assumed to be an isolated NSSS. This assumption is justified as current monitors in the condenser offgas and main steam lines provide reliable and accurate information on the status of fuel cladding when the plant is not isolated. Based on the above, the postaccident sampling system (PASS), designed to Category 3 requirements, will provide an accurate status of coolant radioactivity.
| |
| Revision 13 7.1-44 December, 2003
| |
| | |
| TABLE 7.1-4 (Continued)
| |
| NOTES: (Continued)
| |
| (28)
| |
| Drywell sump equipment and floor drain leakage will be displayed in the control room as a leakage rate instead of level.
| |
| (29)
| |
| Instrumentation meeting Category 3 design requirements is considered adequate to monitor water levels above the top of the wide range instruments.
| |
| (30)
| |
| Reference USAR <Section 2.3.3.1>, <Section 2.3.3.2> and <Section 2.3.3.3> for a description of the preoperational program and
| |
| <Section 2.3.3.4> for a description of the current operational program.
| |
| (31)
| |
| Samples obtained via the Postaccident Sampling System (PASS) can be analyzed by use of either onsite or offsite analytical instruments.
| |
| (32)
| |
| Refer to <Table 1A-1>, Item II-B.3 for an explaination of this postaccident sampling capability.
| |
| Revision 13 7.1-45 December, 2003
| |
| | |
| 7.2 REACTOR TRIP SYSTEM - REACTOR PROTECTION SYSTEM (RPS) 7.
| |
| | |
| ==2.1 DESCRIPTION==
| |
| | |
| 7.2.1.1 System Description
| |
| : a. RPS Function The RPS is designed to cause rapid insertion of control rods (scram) to shut down the reactor when specific variables exceed predetermined limits.
| |
| A completely separate and diverse system, the redundant reactivity control system, is provided to mitigate the effects of a postulated Anticipated Transient Without Scram <Section 7.6.1.12>.
| |
| : b. RPS Operation Schematic arrangements of RPS mechanical equipment and information displayed to the operator are shown in <Figure 7.2-1> (RPS IED).
| |
| The RPS instrumentation is shown in <Table 7.2-1>. Sensor channel arrangements are shown in <Figure 7.2-1>. RPS elementary diagrams are listed in <Section 1.7.1>; plant layout drawings are shown in
| |
| <Section 1.2>. The RPS power supply is discussed in <Chapter 8>.
| |
| The RPS instrumentation is divided into trip channels, trip logics and trip actuator logics.
| |
| During normal operation, all trip channel relays essential to safety are energized; channels, logics and actuators are energized.
| |
| There are at least four trip channels for each variable. The trip channels are designated as A, C, B, and D. Each trip channel is associated with the trip logic of the same designation.
| |
| Revision 12 7.2-1 January, 2003
| |
| | |
| Trip logics A and C outputs are combined in a one-out-of-two logic arrangement to control the A pilot scram valve solenoid in each of the four rod groups (a rod group consists of approximately 25 percent of the total of control rods). Trip logic B and D control the B pilot scram valve solenoids in each of the four rod groups.
| |
| When a trip channel relay de-energizes, the trip logic de-energizes the trip actuator logic which de-energizes the pilot scram valves associated with that trip actuator logic. The other pilot scram valves for each rod must also be de-energized before the scram valves provide a reactor scram.
| |
| There is one dual coil pilot scram valve and two scram valves for each control rod. The pilot scram valve is solenoid operated, with the solenoids normally energized. The pilot scram valve controls the air supply to the scram valves for each control rod. With either pilot scram valve coil energized, air pressure holds the scram valves closed. The scram valves control the supply and discharge paths for control rod drive water.
| |
| When trip logics A or C and B or D are tripped, air is vented from the scram valves and allows control rod drive water to act on the control rod drive piston. Thus, all control rods are scrammed.
| |
| The water displaced by the movement of each rod piston is exhausted into a scram discharge volume.
| |
| To restore the RPS to normal operation following any single actuator logic trip or a scram, the trip actuators must be reset manually. After a 10-second delay, reset is possible only if the conditions that caused the scram have been cleared. The trip actuators are reset by operating switches in the control room.
| |
| Four reset switches (1 per trip channel) are provided.
| |
| Revision 12 7.2-2 January, 2003
| |
| | |
| There are two 125 Vdc solenoid operated backup scram valves that provide a second means of controlling the air supply to the scram valves for all control rods. When the solenoid for either backup scram valve is energized, the associated backup scram valve vents the air supply for the scram valves. This action initiates insertion of any withdrawn control rods regardless of the action of the scram pilot valves. The backup scram valves solenoids are energized (initiate scram) when trip logic A or C and B or D are both tripped.
| |
| Sensor trip channel inputs to the RPS causing reactor scram are discussed in the following paragraphs:
| |
| : 1. Neutron Monitoring System (NMS)
| |
| Neutron flux is monitored and initiates a reactor scram when predetermined limits are exceeded.
| |
| NMS instrumentation is described in <Section 7.6>. The NMS sensor channels are part of the NMS and not the RPS; however, the NMS logic is part of the RPS. Each NMS-IRM logic receives its signals from one IRM channel, each APRM logic receives its signal from one APRM channel and each OPRM logic receives its signals from one OPRM channel. The output logic of the OPRM, APRM and the IRM are individually connected to actuate the RPS trip circuit.
| |
| The NMS logics are arranged so that failure of any one logic cannot prevent the initiation of a high neutron flux or simulated thermal scram. As shown in <Figure 7.6-2(1)>,
| |
| eight NMS logics are associated with the reactor protection system. Each reactor protection system trip channel receives inputs from two neutron monitoring system logics.
| |
| Revision 12 7.2-3 January, 2003
| |
| | |
| For the initial fuel load, high-high flux trip inputs from each SRM are combined with IRM and APRM trips to produce a noncoincident reactor neutron monitoring system trip.
| |
| Following the initial fuel loading, this noncoincident trip is removed.
| |
| The NMS logic contacts for IRM, APRM, and OPRM can be bypassed by selector switches located in the control room. APRM Channels A, C, E, and G bypasses are controlled by one selector switch and Channels B, D, F, and H bypasses are controlled by a second selector switch. Each selector switch will bypass only one APRM channel at any time.
| |
| IRM Channels A, C, E, and G and Channels B, D, F, and H are bypassed in the same manner as the APRM channels.
| |
| Each OPRM (A through H) bypass has a separate bypass switch and is independent of the others.
| |
| Bypassing either 1 (out of 4) OPRM, or 1 (out of 4) APRM or 1 (out of 4) IRM channel will not inhibit the neutron monitoring system from providing protective action when required.
| |
| (a) Intermediate Range Monitors (IRM)
| |
| The IRMs monitor neutron flux between the upper portion of the SRM range to the lower portion of the APRM range.
| |
| The IRM detectors are positioned in the core by remote control from the control room.
| |
| The IRM is divided into two groups of four IRM channels.
| |
| Two IRM channels are associated with each of the trip channels of the RPS. The arrangement of IRM channels allows one IRM channel in each group to be bypassed.
| |
| Revision 12 7.2-4 January, 2003
| |
| | |
| Each IRM channel includes four trip circuits. One trip circuit is used as an instrument trouble trip. It operates on three conditions: (1) when the high voltage drops below a preset level, (2) when one of the modules is not plugged in or (3) when the OPERATE-CALIBRATE switch is not in the OPERATE position. Each of the other trip circuits is specified to trip when preset downscale or upscale levels are reached.
| |
| The trip functions actuated by the IRM trips are indicated in <Table 7.6-1>. The reactor mode switch determines whether IRM trips are effective in initiating a reactor scram. With the reactor mode switch in REFUEL or STARTUP, an IRM upscale or inoperative trip signal actuates a neutron monitoring system trip of the RPS.
| |
| Only one of the IRM channels must trip to initiate an NMS trip of the associated RPS trip channel.
| |
| (b) Average Power Range Monitors (APRM)
| |
| The APRM channels receive and average input signals from the Local Power Range Monitor (LPRM) channels and provide a continuous indication of average reactor power from a few percent to greater than rated reactor power.
| |
| The APRMs supply trip signals to the RPS. <Table 7.2-2>
| |
| lists the APRM trip functions. The APRM upscale thermal power scram trip setpoints vary as a function of reactor recirculation loop flow. Each APRM channel receives a flow signal representative of total recirculation flow.
| |
| This signal is provided by summing the flow signals from the two recirculation loops. These flow signals are sensed from four pairs of elbow taps, two in each recirculation loop. The APRM signal for the thermal Revision 12 7.2-5 January, 2003
| |
| | |
| power scram trip is passed through a circuit with specified time constant to simulate thermal power. A faster response (approx. 0.09 seconds) APRM upscale trip has a fixed setpoint, not variable with recirculation flow. Any APRM upscale or inoperative trip initiates a neutron monitoring system trip in the RPS. Only the trip logic associated with that APRM is affected. At least one APRM channel in each trip system of the RPS must trip to cause a scram. The operator can only bypass one APRM channel in each trip system of the RPS.
| |
| In addition to the IRM upscale trip, an instantaneous APRM trip function with a setpoint of 15 percent power is active when the reactor mode switch is in the startup position.
| |
| Diversity of trip initiation for excursions in reactor power is provided by the neutron monitoring system trip signals and reactor vessel high pressure trip signals.
| |
| An increase in reactor power will initiate protective action from the neutron monitoring system as discussed in the above paragraphs. This increase in power results in a reactor pressure increase due to a higher rate of steam generation. The turbine control valve will stay open until the load limit of the turbine generator occurs.
| |
| Once the pressure control limits are reached, reactor pressure will increase until the resulting reactor vessel high pressure trip. These variables are independent of one another and provide diverse protective action for this condition.
| |
| Revision 12 7.2-6 January, 2003
| |
| | |
| (c) Oscillation Power Range Monitor (OPRM)
| |
| The OPRM channels receive input signals from the LPRM channels and provide continuous monitoring of the reactor core for evidence of thermal-hydraulic instability.
| |
| Above a pre-determined thermal power level and below a pre-determined core flow value, the OPRM system will provide a scram signal to the RPS if the instability is of sufficient magnitude.
| |
| The OPRM system consists of four (4) trip channels, each channel consisting of two (2) OPRM modules, located in the control room. Each OPRM channel receives existing LPRM signals. These LPRM signals are grouped together such that the resulting OPRM response provides adequate coverage for monitoring regional oscillations. The two modes of oscillation observed in operating BWRs are core-wide and regional oscillations. The core-wide oscillations (where the entire core oscillates in phase) are readily detected by the APRMs. The regional oscillations are detected by the OPRMs. For example, a simple case of regional oscillations in which one-half the core oscillates 180 out-of-phase with the other half, results in the cancellation of the low and high LPRM signals at the APRMs and consequently the APRMs produce a non-conservative representation of the local power range magnitudes surrounding the fuel bundles.
| |
| During low power operations less than 23.8% rated thermal power, oscillations are not probable in the region of the core where the LPRMs are not sufficiently on-scale to detect. If instability were to occur, the instability would not be expected to develop large enough to threaten the Minimum Critical Power Ratio (MCPR) safety limit.
| |
| Revision 14 7.2-7 October, 2005
| |
| | |
| The OPRM system is designed with sufficient redundancy, independence and separation, equipment qualification, testing/calibration capability and other criterions to meet industry standards and regulatory requirements.
| |
| This is documented in detail in the ABB-Combustion Engineering, Generic Topical Report for an ABB Option III OPRM system, dated May 1995.
| |
| The OPRMs provide trip signals to the RPS.
| |
| <Table 7.2-2a> of the USAR lists the OPRM trip functions.
| |
| : 2. Reactor Vessel High Pressure A reactor vessel pressure increase during reactor operation compresses the steam voids and results in increased reactivity; this causes increased core heat generation that could lead to fuel barrier failure and reactor overpressurization. A scram counteracts a pressure increase by quickly reducing core fission heat generation. The reactor vessel high pressure scram works in conjunction with the pressure relief system to prevent reactor vessel pressure from exceeding the maximum allowable pressure. The reactor vessel high pressure scram setting also protects the core from exceeding thermal hydraulic limits that result from pressure increases during events that occur when the reactor is operating below rated power and flow.
| |
| Reactor pressure is monitored by four redundant pressure transmitters, each of which provides a reactor high pressure signal input to one of the four RPS trip logics.
| |
| Revision 12 7.2-8 January, 2003
| |
| : 3. Reactor Vessel Low Water Level Decreasing water level while the reactor is operating at power decreases the reactor coolant. Should water level decrease too far, fuel damage could result as steam voids form around fuel rods. A reactor scram reduces the fission heat generation within the core.
| |
| Reactor vessel water level is monitored by four redundant differential pressure transmitters each of which provides a reactor vessel low water level (Trip Level 3) signal input to one of the four RPS trip logics.
| |
| Diversity of trip initiation for breaks in the reactor coolant pressure boundary is provided by high drywell pressure trip signals.
| |
| An operating bypass of the Level 3 scram signal is provided by 4 keylock Emergency Operating Procedure (EOP) control switches (1C71A-S10A-D) located on panels 1H13P0691-P0694 (one control switch per panel). These control switches will be positioned to the NORMAL position during plant operation. These control switches will have no effect on the plant when positioned to NORMAL. If any of these switches are taken to the BYPASS position, an annunciator will alarm. This is to alert the operator at the controls of the EOP switch position.
| |
| The 4 EOP control switches will have no effect on the RPS logic circuits unless the mode switch is in the SHUTDOWN position. An operating bypass of the reactor vessel low water level trip is provided with the EOP keylock switches in the BYPASS positions and the mode switch in the SHUTDOWN position. The interlock wit the mode switch will ensure that the reactor is in the shutdown condition prior to Revision 15 7.2-9 October, 2007
| |
| | |
| bypassing the reactor water level 3 scram. The RPS reactor water level 3 scram function is required during plant power operation.
| |
| : 4. Reactor Vessel High Water Level Increasing water level while the reactor is at power indicates an increase in feed water flow and impending power increase.
| |
| The high water level trip causes scram prior to significant power increase, limiting neutron flux and thermal transients so that fuel design basis is satisfied.
| |
| Reactor vessel high water level is monitored by four redundant differential pressure transmitters each of which provides a reactor vessel high water level (Trip Level 8) signal input to one of the four RPS trip logics. These are the same transmitters that provide the reactor vessel low water level trip.
| |
| Revision 14 7.2-9a October, 2005
| |
| | |
| Diversity of trip initiation for reactor vessel high water level is provided by reactor vessel high pressure trip signals and neutron monitoring system trip signals.
| |
| An operating bypass of the reactor vessel high water level trip is provided in all reactor operating modes, except RUN.
| |
| : 5. Turbine Stop Valve Position A turbine trip will initiate closure of the turbine stop valves which can result in a significant addition of positive reactivity to the core as the reactor vessel pressure rise causes steam voids to collapse. The turbine stop valve closure scram initiates a scram earlier than either the neutron monitoring system or reactor vessel high pressure to provide required margin below core thermal-hydraulic limits for this category of abnormal operational transients. The scram counteracts the addition of positive reactivity caused by increasing pressure by inserting negative reactivity with control rods. Although the reactor vessel high pressure scram, in conjunction with the pressure relief system, is adequate to preclude overpressurizing the reactor system, the turbine stop valve closure scram provides additional margin to the reactor vessel pressure limit.
| |
| Turbine stop valve closure inputs to the RPS originate from eight redundant valve stem position switches mounted on the four turbine stop valves. Each switch opens before the valve is closed more than as specified in Technical Specifications to provide positive indication of closure. Each switch provides an input signal to one of the four RPS sensor trip channels. The logic is arranged so that closure of three or more valves is required to initiate a scram. The switches are arranged so that no single failure can prevent a turbine stop valve closure scram.
| |
| Revision 12 7.2-10 January, 2003
| |
| | |
| Diversity of trip initiation for increases in reactor vessel pressure due to termination of steam flow by turbine stop valve or control valve closure is provided by reactor vessel high pressure and high neutron flux trip signals.
| |
| Turbine stop valve closure trip bypass is effected by four pressure transmitters sensing turbine first stage pressure.
| |
| The turbine stop valve closure scram is automatically bypassed if the turbine first stage pressure is less than that corresponding to approximately 38 percent of rated reactor power. The bypass is automatically removed above 38 percent of reactor power.
| |
| : 6. Turbine Control Valve Position Generator load rejection with the turbine power above approximately 38 percent power or a turbine trip automatically initiates fast closure of the turbine control valves which results in a significant addition of positive reactivity to the core as nuclear system pressure rises. The turbine control valve fast closure scram initiates a scram earlier than either the neutron monitoring system or reactor vessel high pressure to provide required margin below core thermal-hydraulic limits for this category of abnormal operational transients. The scram counteracts the addition of positive reactivity resulting from increasing pressure by inserting negative reactivity with control rods. Although the reactor vessel high pressure scram, in conjunction with the pressure relief system, is adequate to preclude overpressurizing the reactor vessel, the turbine control valve fast closure scram provides additional margin to the reactor vessel pressure limit. The turbine control valve fast closure scram setting is selected to provide timely indication of control valve fast closure.
| |
| Revision 12 7.2-11 January, 2003
| |
| | |
| Turbine control valve fast closure inputs to the RPS originate from oil line pressure switches on each of four fast acting control valve hydraulic mechanisms. Each pressure switch provides an input signal to one of the four RPS trip channels.
| |
| If hydraulic oil pressure is lost, a turbine control valve fast closure scram is initiated.
| |
| Automatic turbine control valve fast closure scram bypass is provided as described above for the turbine stop valve.
| |
| : 7. Main Steam Line Isolation Valves Position The main steam line isolation valve closure can result in a significant addition of positive reactivity to the core as reactor vessel pressure rises.
| |
| Two redundant position switches mounted on each of the eight main steam line isolation valves provide a main steam line isolation valve closure signal to the RPS. Each switch is arranged to open before the valve is closed at or greater than the setpoint specified in Perry Technical Specifications to provide the earliest positive indication of closure. Either of the two channels sensing isolation valve position signal valve closure.
| |
| Each RPS sensor trip channel receives signals from the valves associated with two steam lines. The arrangement of signals within each channel requires partial closure of at least one valve in each of the two steam lines associated with that logic to cause a trip of that logic. Closure of at least one valve in three or more steam lines is required to initiate a scram.
| |
| Revision 12 7.2-12 January, 2003
| |
| | |
| At plant shutdown and during plant startup, a bypass is required for the main steam line isolation valve closure scram trip in order to properly reset the reactor protection system.
| |
| This bypass is in effect when the mode switch is in the SHUTDOWN, REFUEL or STARTUP position. The bypass allows plant operation when the main steam line isolation valves are closed during low power operation. The operating bypass is removed when the mode switch is placed in RUN.
| |
| Diversity of trip initiation due to main steam isolation is provided by reactor vessel high pressure and reactor power trip signals.
| |
| : 8. Scram Discharge Volume Water Level Water displaced by the control rod drive pistons during a scram goes to the scram discharge volume. If the scram discharge volume fills with water so that insufficient capacity remains for the water displaced during a scram, control rod movement would be hindered during a scram. To prevent this situation, the reactor is scrammed when the water level in the discharge volume is high enough to verify that the volume is filling up, yet low enough to ensure that the remaining capacity in the discharge volume can accommodate a scram.
| |
| Four non-indicating float type level switches (one for each channel) provide scram discharge volume (SDV) high water level inputs to the four RPS channels. In addition, a level transmitter and trip unit for each channel provide redundant SDV high water level inputs to the RPS. This arrangement provides diversity, as well as redundancy, to assure that no single event can prevent a scram caused by high SDV water level.
| |
| Revision 12 7.2-13 January, 2003
| |
| | |
| The scram discharge volume high water level trip bypass is controlled by the manual operation of four keylocked bypass switches and the model switch. The mode switch must be in the SHUTDOWN or REFUEL position to allow manual bypass of this trip. This bypass allows the operator to reset the reactor protection system scram relays so that the scram discharge volume may be drained. Resetting the trip actuators opens the scram discharge volume vent and drain valves. An annunciator in the control room indicates the bypass condition.
| |
| : 9. Drywell Pressure High pressure inside the drywell may indicate a break in the reactor coolant pressure boundary. Scram is initiated to minimize the possibility of fuel damage.
| |
| Drywell pressure is monitored by four pressure transmitters.
| |
| Each transmitter provides an input to one of the four RPS trip logics.
| |
| : 10. Main Steam Line Radiation Monitors Monitor input to the scram function has been deleted based on analysis presented in NEDO-31400A.
| |
| : 11. Manual Scram A scram can be initiated manually. There are four manual scram switches (A, B, C, and D); one for each of the four RPS trip channels. Activating manual scram switch A or C will de-energize the A scram pilot solenoid for all rods.
| |
| Activating manual scram switch B or D will de-energize the B scram pilot solenoid for all rods. To manually initiate a full scram, manual scram switch A or C and B or D must be Revision 12 7.2-14 January, 2003
| |
| | |
| activated. By operating the manual scram switch for one logic at a time and then resetting that logic, each actuator logic can be tested for manual scram capability.
| |
| : 12. Reactor Mode Switch Manual Scram Even though the action is not a safety function, reactor scram can be initiated by placing the mode switch in the shutdown position. The mode switch consists of four electrically independent contact blocks. A Shutdown position contact from each of the four contact blocks provide an input to one of the four RPS trip channels. The scram signal, initiated by placing the mode switch in SHUTDOWN, is automatically bypassed after 10 seconds by a timer which allows the control rod drive hydraulic system valve lineup to be restored to normal before the control room operator can reset the RPS trip logic.
| |
| 7.2.1.2 Design Basis Information The RPS is designed to provide timely protection against the onset and consequences of conditions that threaten the integrity of the fuel barrier and the reactor coolant pressure boundary. <Chapter 15>
| |
| identifies and evaluates events that jeopardize the fuel barrier and reactor coolant pressure boundary. The methods of assessing barrier damage and radioactive material releases, along with the methods by which abnormal events are identified, are presented in <Chapter 15>.
| |
| The Technical Specifications require that numerous Reactor Protection Instrumentation channels meet response time criteria. <Table 7.2-3>
| |
| provides the acceptable response times for these channels along with any clarifying information.
| |
| Revision 12 7.2-15 January, 2003
| |
| | |
| The following variables are monitored in order to provide protective actions to the RPS indicating the need for reactor scram:
| |
| : a. Variables Monitored to Provide Protective Actions.
| |
| : 1. Neutron Flux
| |
| : 2. Reactor Vessel High Pressure
| |
| : 3. Reactor Vessel Low Water Level
| |
| : 4. Reactor Vessel High Water Level
| |
| : 5. Turbine Stop Valve Closure
| |
| : 6. Turbine Control Valve Fast Closure
| |
| : 7. Main Steam Line Isolation
| |
| : 8. Scram Discharge Volume High Level
| |
| : 9. Drywell High Pressure The plant conditions which require protective action involving the RPS are described in <Chapter 15> and <Appendix 15A>.
| |
| : b. Location and Minimum Number of Sensors Neutron flux is the only essential variable of significant spatial dependence that provides inputs to the reactor protection system.
| |
| Revision 12 7.2-16 January, 2003
| |
| | |
| The basis for the number and locations is discussed below.
| |
| Two transient analyses are used to determine the minimum number and physical location of required LPRMs for each APRM.
| |
| The first analysis is performed with operating conditions of 100 percent reactor power and 100 percent recirculation flow using a continuous rod withdrawal of the maximum worth control rod. In the analysis, LPRM detectors are mathematically removed from the APRM channels. This process is continued until the minimum numbers and locations of detectors needed to provide protective action are determined for this condition.
| |
| The second analysis is performed with operating conditions of 100 percent reactor power and 100 percent recirculation flow using a reduction of recirculation flow at a fixed design rate. Again, LPRM detectors are mathematically removed from the APRM channels.
| |
| This process is continued until the minimum numbers and locations of detectors needed to provide protective action are determined for this condition.
| |
| The results of the two analyses are analyzed and compared to establish the actual minimum number and location of LPRMs needed for each APRM channel. A minimum of 14 LPRMs per APRM channel and a minimum of 2 LPRM inputs per level are required to provide adequate protective action.
| |
| : c. Prudent Operational Limits Prudent operational limits for each safety-related variable trip setting are selected with sufficient margin so that a spurious scram is avoided. It is then verified by analysis that the release of radioactive material, following postulated gross failures of the Revision 12 7.2-17 January, 2003
| |
| | |
| fuel or the reactor coolant pressure boundary, is kept within acceptable bounds. Design basis operational limits are based on operating experience and constrained by the safety design basis and the safety analyses. The selection of tentative scram trip settings has been developed through analytical modeling, experience, historical use of initial setpoints, and adoption of new variables and setpoints as experience was gained. The initial setpoint selection method provided for settings which were sufficiently above the normal operating levels (to preclude the possibilities of spurious scrams or difficulties in operation), but low enough to protect the fuel barrier and RCPB. As additional information became available or systems were changed, additional scram variables were provided using the above method for initial setpoint selection. The selected scram settings are analyzed to verify that they are conservative and that the fuel barriers and RCPB are adequately protected. In all cases, the specific scram trip point selected is a conservative value that prevents damage to the fuel or reactor coolant pressure boundary.
| |
| : d. Margin The margin between operational limits and the limiting conditions of operation (scram) for the reactor protection system are accounted for in Technical Specifications.
| |
| : e. Levels Levels requiring protective action are provided in Technical Specifications.
| |
| Revision 12 7.2-18 January, 2003
| |
| : f. Range of Transient, Steady-State and Environmental Conditions Environmental conditions for proper operation of the RPS components are discussed in <Section 3.11>. The RPS power supply range of steady-state and transient conditions are provided in <Chapter 8>.
| |
| : g. Malfunctions, Accidents and Other Unusual Events Which Could Cause Damage to Safety Systems Unusual events are defined as malfunctions, accidents and others which could cause damage to safety systems. <Chapter 15> and
| |
| <Appendix 15A> describe the following credible accidents and events; floods, storms, tornadoes, earthquakes, fires, LOCA, pipe break outside containment, feedwater line break, and missiles.
| |
| Each of these events is discussed below for the RPS.
| |
| All components essential to the operation of the RPS are designed, fabricated and mounted into appropriate seismically qualified structures. However, even though the sensors initiating reactor scram which monitor turbine stop valve position and turbine control valve fast closure are designed and purchased to Quality Class 1, Seismic Class I, they are physically mounted on equipment which is not Seismic Class I/Quality Class 1, and are located in the turbine generator building which is not Seismic Class I. For this reason, other diverse variables (reactor pressure and neutron flux trips) can be relied upon for reactor scram if components in the turbine generator building fail.
| |
| : 1. Floods The buildings containing RPS components have been designed to meet the PMF (Probable Maximum Flood) at the site location.
| |
| This ensures that the buildings will remain water tight under PMF including wind generated wave action and wave runup.
| |
| Revision 12 7.2-19 January, 2003
| |
| : 2. Storms and Tornadoes The buildings containing RPS components except the turbine generator building have been designed to withstand all credible meteorological events and tornadoes as described in
| |
| <Section 3.3>.
| |
| : 3. Earthquakes The structures containing RPS components except the turbine building have been seismically qualified as described in
| |
| <Section 3.7> and <Section 3.8> and will remain functional during and following a safe shutdown earthquake (SSE).
| |
| : 4. Fires To protect the RPS in the event of a postulated fire, the system has been divided into four separate panels. If a fire were to occur within one of the panels or in the area of one of the panels, the RPS functions would not be prevented by the fire. Use of separation and fire barriers ensures that, even though some portion of the system may be affected, the RPS will continue to provide the required protective action
| |
| <Section 9.5.1>.
| |
| : 5. LOCA The following RPS system components are located inside the drywell and would be subjected to the effects of a design basis loss-of-coolant accident (LOCA).
| |
| (a) Neutron monitoring system (NMS) cabling from the detectors to the control room.
| |
| Revision 12 7.2-20 January, 2003
| |
| | |
| (b) MSIV (inboard) position switches.
| |
| (c) Reactor vessel pressure and reactor vessel water level instrument taps and sensing lines, which terminate outside the drywell.
| |
| (d) Drywell pressure instrument taps.
| |
| These items have been environmentally qualified to remain functional during and following a LOCA as discussed in
| |
| <Section 3.11>.
| |
| : 6. Pipe Break Outside Secondary Containment Protection is described in <Section 3.6>.
| |
| (a) Feedwater Line break This condition will not affect the operation of the RPS.
| |
| : 7. Missiles Protection from missiles is described in <Section 3.5>.
| |
| : h. Minimum Performance Requirements See Technical Specifications.
| |
| 7.2.1.3 Final System Drawings The instrument and electrical drawings have been provided for the RPS in this section.
| |
| RPS elementary diagrams are listed in <Section 1.7.1> and plant layout drawings are shown in <Section 1.2>.
| |
| Revision 12 7.2-21 January, 2003
| |
| | |
| 7.2.2 ANALYSIS The RPS is designed such that loss of plant instrument air, a plant load rejection or a turbine trip will not prevent the completion of the safety function.
| |
| 7.2.2.1 Conformance to <10 CFR 50, Appendix A> - General Design Criteria The following is a discussion of conformance to those General Design Criteria which apply specifically to the RPS. Refer to
| |
| <Section 7.1.2.2> for a discussion of General Design Criteria which apply equally to all safety-related systems.
| |
| : a. General Design Criterion 12 - Suppression of Reactor Power Oscillations The system design provides protection from excessive fuel cladding temperatures and protects the reactor coolant pressure boundary from excessive pressures which threaten the integrity of the system. Abnormalities are sensed, and, if protection system limits are reached, corrective action is initiated through an automatic scram.
| |
| : b. General Design Criterion 15 - Reactor Coolant System Design The RPS provides sufficient margin to assure that the design conditions of the reactor coolant pressure boundary are not exceeded during any condition of normal operation, including anticipated operational occurrences. If the monitored variables exceed their predetermined settings, the system automatically responds to maintain the variables and systems within allowable design limits.
| |
| Revision 12 7.2-22 January, 2003
| |
| : c. General Design Criterion 20 - Protection System Functions The RPS monitors the appropriate plant variables to maintain the fuel barrier and reactor coolant pressure boundary and initiates a scram automatically when the variables exceed predetermined limits.
| |
| : d. General Design Criterion 21 - Protection System Reliability and Testability The RPS is designed with two groups of redundant trip channels and four independent and separated output channels. No single failure can prevent a scram, and removal from service of any component or channel will not result in loss of required minimum redundancy.
| |
| : e. General Design Criterion 22 - Protection System Independence The redundant portions of the RPS are separated, except the turbine scram inputs which originate from the non-seismic category turbine building, such that no single failure or credible natural disaster can prevent a scram. Reactor pressure and power are diverse to the turbine scram variables. In addition, drywell pressure and vessel water level are diverse variables.
| |
| : f. General Design Criterion 23 - Protection System Failure Modes The RPS is designed (including logic and actuated devices) to be fail safe. A loss of RPS electrical power or RPS air supply will result in a reactor scram. Postulated adverse environments will not prevent a scram.
| |
| Revision 12 7.2-23 January, 2003
| |
| : g. General Design Criterion 24 - Separation of Protection and Control Systems The RPS has no common components with any plant control system whose failure would significantly impair safety. The RPS does receive inputs from the reactor mode switch and the neutron monitoring system which also provide inputs to plant control systems through isolation devices.
| |
| : h. General Design Criterion 25 - Protection System Requirements for Reactivity Control Malfunctions The RPS provides protection against the onset and consequences of conditions that threaten the integrity of the fuel barrier and the reactor coolant pressure boundary. Any monitored variable which exceeds the scram setpoint will initiate an automatic scram and not impair the remaining variables from being monitored, and if one channel fails, the remaining portions of the Reactor Protection System will function.
| |
| : i. General Design Criterion 29 - Protection Against Anticipated Operational Occurrences The RPS is highly reliable and will provide a reactor scram in the event of anticipated operational occurrences.
| |
| 7.2.2.2 Conformance to IEEE Standards The following is a discussion of conformance to those IEEE standards which apply specifically to the RPS system. Refer to <Section 7.1.2.3>
| |
| for a discussion of IEEE standards which apply equally to all safety-related systems. The non-essential RPS power and its electrical protection assembly (EPA) are discussed in <Section 8.3.1.1.5.1>.
| |
| Revision 12 7.2-24 January, 2003
| |
| : a. IEEE Standard 279 Criteria for Protection Systems for Nuclear Power Generating Stations - The RPS design complies with the requirements of IEEE-279. The following is a discussion of specific conformance.
| |
| : 1. General Functional Requirement (IEEE Standard 279, Paragraph 4.1)
| |
| The RPS automatically initiates the appropriate protective actions, whenever the conditions described in
| |
| <Section 7.2.1.1.b> reach predetermined limits, with precision and reliability assuming the full range of conditions and performance discussed in <Section 7.2.1.2>.
| |
| : 2. Single Failure Criterion (IEEE Standard 279, Paragraph 4.2)
| |
| Each of the conditions (variables) described in
| |
| <Section 7.2.1.1.b> is monitored by redundant sensors supplying input signals to redundant trip logics.
| |
| Independence of redundant RPS equipment, cables, instrument tubing, etc. is maintained and single failure criteria preserved through the application of the PNPP separation criteria as described in <Section 8.3.1> to assure that no single credible event can prevent the RPS from accomplishing its safety function.
| |
| : 3. Quality of Components and Modules (IEEE Standard 279, Paragraph 4.3)
| |
| For a discussion of the quality of RPS components and modules, refer to <Section 3.11>.
| |
| Revision 12 7.2-25 January, 2003
| |
| : 4. Equipment Qualification (IEEE Standard 279, Paragraph 4.4)
| |
| All safety-related equipment as defined in <Section 3.10> and
| |
| <Section 3.11> is designed to meet its performance requirements under the postulated range of operational and environmental constraints. Detailed discussion of qualification is contained in <Section 3.10> and
| |
| <Section 3.11>.
| |
| : 5. Channel Integrity (IEEE Standard 279, Paragraph 4.5)
| |
| For a discussion of RPS channel integrity under all extremes of conditions described in <Section 7.2.1.2>, refer to
| |
| <Section 3.10>, <Section 3.11>, <Section 8.2.1>, and
| |
| <Section 8.3.1>.
| |
| : 6. Channel Independence (IEEE Standard 279, Paragraph 4.6)
| |
| RPS channel independence is maintained through the application of the PNPP separation criteria as described in
| |
| <Section 8.3.1>.
| |
| : 7. Control and Protection System Interaction (IEEE 279, Paragraph 4.7)
| |
| See <Section 7.2.2.1.g>.
| |
| : 8. Derivation of System Inputs (IEEE Standard 279, Paragraph 4.8)
| |
| The RPS trip variables are direct measures of a reactor over-pressure condition, a reactor over-power condition, a Revision 12 7.2-26 January, 2003
| |
| | |
| gross fuel damage condition, or abnormal conditions within the reactor coolant pressure boundary except as follows:
| |
| (a) Due to the normal throttling action of the turbine control valves with changes in the plant power level, measurement of control valve position is not an appropriate variable from which to infer the desired variable, which is rapid loss of the reactor heat sink.
| |
| Consequently, measurement of a control valve fast closure trip is used as the trip signal (indicative of a load rejection).
| |
| (b) Protection system design practice has discouraged use of rate sensing devices for protective purposes. In this instance, it was determined that detection of hydraulic actuator operation would be a more positive means of determining fast closure of the control valves.
| |
| (c) Loss of hydraulic pressure in the EHC oil lines which initiates fast closure of the control valves is monitored. These measurements provide indication that fast closure of the control valves is imminent.
| |
| (d) This measurement is adequate and a proper variable for the protective function taking into consideration the reliability of the chosen sensors relative to other available sensors and the difficulty in making direct measurements of control-valve fast closure rate.
| |
| : 9. Capability for Sensor Checks (IEEE Standard 279, Paragraph 4.9)
| |
| Refer to the discussion of <Regulatory Guide 1.22> in
| |
| <Section 7.2.2.3.a>.
| |
| Revision 12 7.2-27 January, 2003
| |
| : 10. Capability for Test and Calibration (IEEE Standard 279, Paragraph 4.10)
| |
| Refer to the discussion of <Regulatory Guide 1.22> in
| |
| <Section 7.2.2.3.a>.
| |
| : 11. Channel Bypass or Removal from Operation (IEEE Standard 279, Paragraph 4.11)
| |
| The following RPS trip variables have no provision for sensor removal from service because of the use of valve position limit switches as the channel sensor:
| |
| (a) Main steam line isolation valve closure trip (b) Turbine stop valve closure trip During periodic test of any one trip channel, a sensor or trip unit may be removed from service and returned to service under administrative control procedures. Since only one sensor or trip unit is removed from service at any given time during the test interval, protective action capability for RPS automatic initiation is maintained through the remaining redundant instrument channels.
| |
| A sufficient number of IRM channels has been provided to permit any one IRM channel in a given trip system to be manually bypassed and still ensure that the remaining operable IRM channels comply with the IEEE Standard 279 single failure design requirements.
| |
| One IRM manual bypass switch has been provided for each RPS trip system. The mechanical characteristics of this switch permit only one of the four IRM channels of that trip system Revision 12 7.2-28 January, 2003
| |
| | |
| to be bypassed at any time. In order to accommodate a single failure of this bypass switch, electrical interlocks have also been incorporated into the bypass logic to prevent bypassing of more than one IRM in that trip system at any time.
| |
| Consequently, with any IRM bypassed in a given trip system, three IRM channels remain in operation to satisfy the protection system requirements.
| |
| In a similar manner, one APRM manual bypass switch has been provided for each RPS trip system to permit one of the four APRMs to be bypassed at any time. Mechanical interlocks have been provided with the bypass switch and electrical interlocks have been provided in the bypass circuitry to accommodate the possibility of switch failure. With the maximum number of APRMs bypassed by the switches, sufficient APRM channels remain in operation to provide the necessary protection for the reactor.
| |
| The mode switch produces operating bypasses which need not be annunciated because they are removed by normal reactor operating sequence.
| |
| : 12. Operating Bypasses (IEEE Standard 279, Paragraph 4.12)
| |
| For a discussion of RPS operating bypasses, refer to
| |
| <Section 7.2.1.1.b.1>, <Section 7.2.1.1.b.4>,
| |
| <Section 7.2.1.1.b.5>, <Section 7.2.1.1.b.6>,and
| |
| <Section 7.2.1.1.b.7>.
| |
| : 13. Indication of Bypasses (IEEE Standard 279, Paragraph 4.13)
| |
| For a discussion of bypass and inoperability indication, refer to <Section 7.1.2.4.g> <Regulatory Guide 1.47>.
| |
| Revision 12 7.2-29 January, 2003
| |
| : 14. Access to Means for Bypassing (IEEE Standard 279, Paragraph 4.14)
| |
| Access to means of bypassing any safety action or function for the RPS is under the administrative control of the control room operator. The operator is alerted to bypasses as described in <Section 7.1.2.4.g> <Regulatory Guide 1.47>.
| |
| Control switches which allow system bypasses are keylocked.
| |
| All keylock switches in the control room are designed such that their key can only be removed when the switch is in the safe position. All keys will normally be removed from their respective switches during operation and maintained under the control of the shift supervisor.
| |
| : 15. Multiple Setpoints (IEEE Standard 279, Paragraph 4.15)
| |
| The reactor mode switch implements more restrictive scram trip setpoints when it is shifted from RUN to STARTUP. As the mode switch is moved to STARTUP . . .
| |
| (a) The APRM upscale neutron scram trip is replaced by the restrictive APRM setdown scram trip at 15 percent power.
| |
| (b) The IRM range switch dependent scram trips are enabled.
| |
| Each IRM range switch enables successively more restrictive scram trip setpoints as it is ranged down.
| |
| In addition to the mode switch dependent multiple setpoints, the flow channels which supply control and reference signals for the APRM upscale thermal scram continually vary the scram setpoint as flow changes. A sensed reduction in flow results in more restrictive scram trip setpoints.
| |
| Revision 12 7.2-30 January, 2003
| |
| | |
| The devices used to prevent improper use of the less restrictive setpoints (the mode switch, IRM range switches, the IRM and APRM signal conditioning equipment, and the flow channels) are designed in accordance with criteria regarding the performance and reliability of protection system equipment.
| |
| : 16. Completion of Protective Action Once it is Initiated (IEEE Standard 279, Paragraph 4.16)
| |
| Once the RPS trip logic has been de-energized as a result of a trip channel becoming tripped, or the actuation of a manual scram switch, the trip-logic seal-in contact opens and completion of protection action is achieved without regard to the state of the initiating sensor trip channel.
| |
| After initial conditions (variable trip and logic de-energization) return to normal, deliberate operator action is required to return (reset) the RPS logic to normal (energized).
| |
| : 17. Manual Initiation (IEEE Standard 279, Paragraph 4.17)
| |
| Refer to the discussion of <Regulatory Guide 1.22> in
| |
| <Section 7.2.2.3.a>.
| |
| : 18. Access to Setpoint Adjustments, Calibration and Test Points (IEEE Standard 279, Paragraph 4.18)
| |
| During reactor operation, access to setpoint or calibration controls is not possible for the following RPS trip variables:
| |
| (a) Main steam line isolation valve closure trip Revision 12 7.2-31 January, 2003
| |
| | |
| (b) Turbine stop valve closure trip (c) Turbine control valve fast closure trip Access to setpoint adjustments, calibration controls and test points for all other RPS trip variables are under the administrative control of the control room operator.
| |
| : 19. Identification of Protective Actions (IEEE Standard 279, Paragraph 4.19)
| |
| When any one of the RPS sensed variables exceeds its trip unit setpoint value, a control room annunciator is initiated to identify that variable and a typed record is available from the process computer.
| |
| : 20. Information Readout (IEEE Standard 279, Paragraph 4.20)
| |
| The RPS is designed to provide the operator with accurate and timely information pertinent to its status. It does not give anomalous indications confusing to the operator.
| |
| : 21. System Repair (IEEE Standard 279, Paragraph 4.21)
| |
| During periodic testing of the RPS sensor channels (except as noted below) the operator can determine defective components and replace them during plant operation.
| |
| During reactor operation, the control room operator is able to determine failed sensors for the following RPS trip variables, but subsequent repair can only be accomplished during reactor shutdown:
| |
| (a) Main steam line isolation valve closure trip.
| |
| Revision 12 7.2-32 January, 2003
| |
| | |
| (b) Neutron monitoring (APRM) system trip.
| |
| (c) Neutron monitoring (IRM) system trip.
| |
| (d) Neutron monitoring (OPRM) system trip.
| |
| Replacement of IRM and LPRM detectors must be accomplished during plant shutdown. Repair of the remaining portions of the neutron monitoring system may be accomplished during plant operation by appropriate bypassing of the defective instrument channel. The design of the system facilitates rapid diagnosis and repair.
| |
| : 22. Identification of Protection Systems (IEEE Standard 279, Paragraph 4.22)
| |
| The identification scheme for the RPS system is discussed in
| |
| <Section 8.3.1>.
| |
| 7.2.2.3 Conformance to NRC Regulatory Guides The following is a discussion of conformance to those Regulatory Guides which apply specifically to the RPS. Refer to <Section 7.1.2.4> for a discussion of Regulatory Guides which apply equally to all safety-related systems.
| |
| : a. <Regulatory Guide 1.22> - Periodic Testing of Protection System Actuation Function The RPS can be tested during reactor operation by the following separate tests:
| |
| The manual scram test. The total test verifies the ability to de-energize the scram pilot valve solenoids without scram by using Revision 12 7.2-33 January, 2003
| |
| | |
| the manual scram push button switches. By actuating the manual scram switches, the trip logic is de-energized, opening contacts in the trip actuator logic. After the first trip channel is reset, the second trip channel is tripped manually and so forth for the four manual scram switches. In addition to control room annunciator and computer printout indications, scram group indicator lights verify that the trip actuator contacts have opened and interrupted power to the scram solenoids.
| |
| The single rod scram test verifies capability of each rod to scram.
| |
| It is accomplished by operating two toggle switches on the hydraulic control unit for the particular control rod drive.
| |
| Timing traces can be made for each rod scrammed.
| |
| The sensor test involves applying a test signal to each RPS sensor or trip unit in turn and observing the trip channel trip results.
| |
| The test signals can be applied to the processing sensing instrumentation (pressure and differential pressure) through calibration taps.
| |
| A test of individual scram discharge volume water level sensors can be performed during full power operation by valving out the sensor and injecting water into a test tap. At plant shutdown, the level sensors may be calibrated by introducing a fixed volume of water into the discharge volume and observing that all level sensors operate at the specified trip points.
| |
| During plant operation, the operator can set the turbine stop valve or MSIV closure logic test switch in test position and actuate the other valve which completes the respective channel trip with annunciation and computer logging. The operator can then confirm that the main steam line isolation and turbine stop valve limit switches operate during valve motion, from full open to full closed and vice versa. This may be accomplished by comparing the time Revision 12 7.2-34 January, 2003
| |
| | |
| that the RPS channel trip occurs with the time that the valve position indicator lights in the control room signal that the valve is fully open and fully closed. This test does not confirm the exact setpoint, but does provide the operator with an indication that the limit switch operates between the limiting positions of the valve. During reactor shutdown, calibration of the main steam line isolation and turbine stop valve limit switch at a valve position of less than or equal to 15 and 10 percent (analytical limit) closure respectively is possible by physical observation of the valve stem.
| |
| During reactor operation, a test and calibration of the individual EHC oil line pressure sensors associated with turbine control valve fast closure when the plant is operating above 40 percent of rated power may be accomplished by valving one sensor out-of-service at a time and introducing a test pressure input.
| |
| The APRMs are calibrated to reactor power by using a reactor heat balance. Information pertaining to single recirculation loop operation is provided in <Appendix 15F>. LPRM gain settings are determined from the local flux profiles measured by the TIP system once the total reactor heat balance has been determined. The OPRMs are calibrated using cycle specific analysis data and Technical Specifications provide the appropriate system trip parameters.
| |
| The gain adjustment factors for the LPRMs are produced as a result of the process computer nuclear calculations involving the reactor heat balance and the TIP flux distributions. These adjustments, when incorporated into the LPRMs permit the nuclear calculations to be completed for the next operating interval and establish the APRM calibration relative to reactor power.
| |
| Operation of the reactor mode switch from one position to another may be employed to confirm certain aspects of the RPS trip channels Revision 12 7.2-35 January, 2003
| |
| | |
| during periodic test and calibration at shutdown only. During tests of the trip channels, proper operation of the mode switch contacts can be easily verified by noting that certain sensors are connected into the RPS logic and that other sensors are bypassed in the RPS logic in an appropriate manner of the given position of the mode switch.
| |
| In the STARTUP and RUN modes of plant operation, procedures may be used to confirm that scram discharge volume high water level trip channels cannot be bypassed as a result of the operating bypass switch. In the SHUTDOWN and REFUEL modes of plant operation, a similar procedure may be used to bypass all four scram discharge volume trip channels. In the STARTUP, REFUEL and RUN modes of plant operation, procedures may be used to confirm that reactor water low (Level 3) trip channels cannot be bypassed as a result of the operating bypass switches. In the SHUTDOWN mode of plant operation, a similar procedure may be used to bypass all four reactor water low (Level 3) trip channels. Due to the discrete on-off nature of the bypass function, calibration is not meaningful.
| |
| Administrative control must be exercised to valve one turbine first stage pressure sensor out-of-service for the periodic test. During this test, a variable pressure source may be introduced to operate the sensor at the setpoint value. When the condition for bypass has been achieved on an individual sensor under test, the control room annunciator for this bypass function will be initiated. If the RPS trip channel associated with this sensor had been in its tripped state, the process computer will log the return to normal state for the RPS trip logic. When the plant is operating above approximately 38 percent of rated power, testing of the turbine stop valve and control valve fast closure trip channels will confirm that the bypass function is not in effect.
| |
| Revision 14 7.2-36 October, 2005
| |
| | |
| A manual scram switch permits each individual trip logic and trip actuator logic to be tested on a periodic basis. Operation of the reset switch following a trip of each RPS trip channel will confirm that the switch is performing its intended function. (Calibration of the time response of the trip channel, relays and trip actuators may be accomplished by connection of external test equipment.)
| |
| : b. <Regulatory Guide 1.53> - Application of the Single-Failure Criterion to Nuclear Power Plant Protection Systems See the discussion of IEEE Standard 279, Paragraph 4.2, in
| |
| <Section 7.2.2.2>.
| |
| : c. <Regulatory Guide 1.62> - Manual Initiation of Protective Actions Means are provided for manual initiation of the RPS at the system level through the use of four armed pushbutton switches located on the control room benchboard.
| |
| Operation of two switches (one in each trip system) accomplishes the initiation of all actions performed by the automatic initiation circuitry.
| |
| Placing the reactor mode switch in the SHUTDOWN position will also cause a system level initiation.
| |
| Revision 14 7.2-37 October, 2005
| |
| | |
| TABLE 7.2-1 REACTOR PROTECTION SYSTEM INSTRUMENTATION Normal Calibrated Number Scram Instrument of Function Instrument __Range___ Channels Reactor Vessel Pressure 0-1,500 psig 4 High Pressure Sensor Drywell High Pressure 4 psig 4 Pressure Sensor Reactor Vessel Level 165-230 4 Low Water Sensor Level 3 Reactor Vessel Level 165-230 4 High Water Sensor Level 8 Scram Discharge Level Volume High Sensor Water Level
| |
| : a. Trip unit 0-56 in. 4
| |
| : b. Level switch 0-2.31 in. 4 Turbine Stop Position 0-100% 4(1)
| |
| Valve Closure Sensor Turbine Control Pressure 300-1,100 4 Valve Fast Sensor psig Closure Main Steam Line Position 0-100% 4(2)
| |
| Isolation Valve Sensor Closure Neutron Monitoring <Section 8 System 7.6.1.4>
| |
| Revision 12 7.2-38 January, 2003
| |
| | |
| TABLE 7.2-1 (Continued)
| |
| Normal Calibrated Number Scram Instrument of Function Instrument __Range___ Channels Bypass Function Discharge Volume N/A N/A High Water Level Trip Bypass Turbine Stop Valve Pressure 0-701.5 psig 4 and Control Valve Switch equivalent to Fast Closure 0-100% reactor Trip Bypass power Main Steam Line Pressure N/A N/A Isolation Valve Switch Closure Trip Bypass Reactor Vessel N/A N/A 4 Low Water Level 3 NOTES:
| |
| (1)
| |
| Two (2) sensors per channel.
| |
| (2)
| |
| Four (4) sensors per channel.
| |
| Revision 14 7.2-39 October, 2005
| |
| | |
| TABLE 7.2-2 APRM SYSTEM TRIPS Trip Function Trip Point Range Action APRM downscale 2% to full scale Rod block, annunciator, white light display APRM upscale Setpoint varied Rod block with flow, slope annunciator, adjustable, inter- amber light display cepts separately adjustable APRM upscale(1) Setpoint varied Scram, annunciator, with flow, slope red light display adjustable, inter-cepts separately adjustable APRM upscale 2% to full scale Scram, annunciator, red light display APRM Calibrate switch Scram, rod block, inoperative or few inputs annunciator, white light display APRM bypass Manual switch White light display APRM upscale 2% to full scale Rod block, alarm (not in annunciator, amber RUN mode) light display NOTE:
| |
| (1)
| |
| APRM signal passes through a specified time constant circuit to simulate heat flux.
| |
| Revision 12 7.2-40 January, 2003
| |
| | |
| TABLE 7.2-2a OPRM SYSTEM TRIPS Trip Function Trip Point Range Action OPRM Trip Thermal Power >23.8% RTP and Scram, Annunciator, recirculation drive flow Red Light Displayed
| |
| < the value corresponding to on module 60% of core flow and one of the three detection algorithms sensing a valid oscillation which exceeds OPRM setpoints/variables.
| |
| OPRM Alarm Thermal Power >23.8% RTP and Annunciator, Amber recirculation drive flow Light Displayed on
| |
| < the value corresponding to module 60% of core flow and oscillation detection algorithm (ODA) exceeding OPRM alarm count variable.
| |
| OPRM Bypass Bypass Switch in Bypass Annunciator OPRM INOP Operate/Test switch in Annunciator, Red Test or insufficient valid Light Displayed on inputs or failure of OPRM module module self test routine.
| |
| OPRM Trip Enable Thermal Power >23.8% RTP and Annunciator, Green recirculation drive flow Light Displayed on
| |
| < the value corresponding to module 60% of core flow.
| |
| Revision 14 7.2-41 October, 2005
| |
| | |
| TABLE 7.2-3 REACTOR PROTECTION SYSTEM RESPONSE TIME TABLE Functional Unit Response Time (seconds) Notes
| |
| : 1. Average Power Range Monitors: See Note(1)
| |
| : a. Flow Biased Simulated Thermal Power - High 0.09 See Note(2)
| |
| : b. Neutron Flux - High 0.09
| |
| : 2. Reactor Vessel Steam Dome Pressure - High 0.35 See Note(3)
| |
| : 3. Reactor Vessel Water Level -
| |
| Low, Level 3 1.05 See Note(3)
| |
| : 4. Reactor Vessel Water Level -
| |
| High, Level 8 1.05 See Note(3)
| |
| : 5. Main Steam Line Isolation Valve - Closure 0.06
| |
| : 6. Turbine Stop Valve - Closure 0.06
| |
| : 7. Turbine Control Valve Fast Closure, Valve Trip System Oil Pressure - Low 0.07 See Note(4)
| |
| : 8. Oscillation Power Range Monitors 0.450 See Note(5)
| |
| NOTES:
| |
| (1)
| |
| Neutron detectors are exempt from response time testing. Response time shall be measured from the detector output or from the input of the first electronic component in the channel.
| |
| (2)
| |
| Not including the simulated thermal power time constant specified in the COLR.
| |
| (3)
| |
| The sensor is not included in the response time testing for these circuits. Response time testing for the remaining channel including trip unit and relay logic is required.
| |
| (4)
| |
| Measured from start of turbine control valve fast closure.
| |
| (5)
| |
| Neutron detectors are exempt from response time testing. The LPRM amplifier cards inputting to the OPRM are excluded from the OPRM response time testing.
| |
| Revision 12 7.2-42 January, 2003
| |
| | |
| 7.3 ENGINEERED SAFETY FEATURE SYSTEMS 7.
| |
| | |
| ==3.1 DESCRIPTION==
| |
| | |
| Section 7.3 describes the instrumentation and controls of the following plant Engineered Safety Features (ESF) systems:
| |
| : a. Emergency Core Cooling Systems (ECCS)
| |
| : b. Containment and Reactor Vessel Isolation Control Systems (CRVICS)
| |
| : c. (Deleted)
| |
| : d. RHRS-Containment Spray Cooling Mode (RHRS-CSCM)
| |
| : e. RHRS-Suppression Pool Cooling Mode (RHRS-SPCM)
| |
| : f. Emergency Water Systems (EWS)(1)
| |
| : g. Control Complex HVAC System(1)
| |
| : h. ESF Building and Area HVAC System(1)
| |
| : i. Annulus Exhaust Gas Treatment System (AEGTS)
| |
| : j. Pump Room Cooling System(1)
| |
| : k. Containment Combustible Gas Control System
| |
| : l. Suppression Pool Makeup System
| |
| : m. Containment Vacuum Relief
| |
| : n. Standby Power Support Systems(1)
| |
| Revision 12 7.3-1 January, 2003
| |
| : o. Fuel Handling Area Exhaust Subsystem(2)
| |
| NOTE:
| |
| : 1. The following systems are considered to be ESF support systems not ESF systems in accordance with the guidance provided in
| |
| <NUREG-0800>, Section 7.3. These systems will continue to be treated as safety-related for design, construction, maintenance, testing, and other operational purposes.
| |
| Independent actuation of any one of these systems will not be reported per <10 CFR 50.73(a)(2)(iv)>.
| |
| : a. Emergency Closed Cooling Water (ECC) (P42)
| |
| : b. Control Complex Chilled Water (CCCW) (P47)
| |
| : c. ESF Building and Area HVAC Systems (M23)(M24)(M43)
| |
| : d. Pump Room Cooling Systems (M28)(M32)(M39)
| |
| : e. Standby Power Support Systems (R44)(R45)(R46)(R47)(R48)
| |
| : 2. Only the exhaust subsystem of the fuel handling area ventilation system is ESF.
| |
| The sources which supply power to the engineered safety feature systems originate from onsite ac and/or dc safety-related busses or, as in the case of the CRVICS failsafe logic, from the nonsafety-related RPS MG sets. Refer to <Chapter 8> for a complete discussion of the ESF systems power sources.
| |
| Revision 12 7.3-2 January, 2003
| |
| | |
| 7.3.1.1 System Description 7.3.1.1.1 Emergency Core Cooling Systems (ECCS) - Instrumentation and Controls The Emergency Core Cooling System is a network of the following subsystems <Section 6.3.1> and <Section 6.3.2>.
| |
| : a. High Pressure Core Spray System (HPCS).
| |
| : b. Automatic Depressurization System (ADS).
| |
| : c. Low Pressure Core Spray System (LPCS).
| |
| : d. Low Pressure Coolant Injection (LPCI) mode of the Residual Heat Removal System (RHRS).
| |
| The purpose of ECCS instrumentation and control is to initiate appropriate responses from the system to ensure that the fuel is adequately cooled in the event of a design basis accident (DBA). The cooling provided by the system restricts the release of radioactive materials from the fuel by preventing or limiting the extent of fuel damage following situations in which coolant is lost from the reactor coolant pressure boundary.
| |
| The ECCS instrumentation detects a need for core cooling systems operation, and the trip systems initiate the appropriate response.
| |
| Included in this section is a discussion of protective considerations which are taken between the high pressure reactor coolant system and the low pressure ECCS system. The high pressure/low pressure interlocks are examined in <Section 7.6.1.2>.
| |
| Revision 12 7.3-3 January, 2003
| |
| | |
| The following plant variables are monitored and provide automatic initiation of the ECCS when these variables exceed predetermined limits:
| |
| : a. Reactor Vessel Water Level A low water level in the reactor vessel could indicate that reactor coolant is being lost through a breach in the reactor coolant pressure boundary and that the core is in danger of becoming overheated as the reactor coolant inventory diminishes. Refer to
| |
| <Figure 5.1-3> for a schematic arrangement of reactor vessel instrumentation.
| |
| : b. Drywell Pressure High pressure in the drywell could indicate a breach of the reactor coolant pressure boundary inside the drywell and that the core is in danger of becoming overheated as reactor coolant inventory diminishes.
| |
| 7.3.1.1.1.1 High Pressure Core Spray (HPCS) System -
| |
| Instrumentation and Controls
| |
| : a. HPCS Function The HPCS system supplies sufficient coolant flow following a reactor scram in the event of a loss-of-coolant accident. The HPCS system supplies makeup water to the reactor vessel in the event of reactor isolation and failure of the reactor core isolation cooling (RCIC) system <Section 6.3.2.2.1>.
| |
| : b. HPCS Operation Schematic arrangements of system mechanical equipment are shown in
| |
| <Figure 6.3-7>. HPCS system component control logic is shown in Revision 12 7.3-4 January, 2003
| |
| | |
| <Figure 7.3-1>. Elementary diagrams are listed in <Section 1.7.1>.
| |
| Plant layout drawings are shown in <Section 1.2>. Operator information displays are shown in <Figure 6.3-7> and
| |
| <Figure 7.3-1>.
| |
| The HPCS is initiated automatically by either reactor vessel low water level (Trip Level 2) or drywell high pressure. The system is designed to operate automatically for at least 10 minutes without any actions required by the control room operator. Once initiated, the HPCS logic seals-in and can be reset by the operator if reactor water level has been restored even if the high drywell pressure condition exists. Refer to <Figure 7.3-1> for a schematic representation of the HPCS system initiation logic.
| |
| Reactor vessel water level (Trip Level 2) is monitored by four redundant level transmitters. Each transmitter provides an input to a trip unit. The trip unit relay contacts are arranged in a one-out-of-two twice logic arrangement to assure that no single event can prevent the initiation of the HPCS.
| |
| Initiation diversity is provided by drywell pressure which is monitored by four redundant pressure transmitters. The trip unit relay contacts are electrically connected in a one-out-of-two twice logic arrangement to assure that no single instrument failure can prevent the initiation of the HPCS.
| |
| The HPCS components respond to an automatic initiation signal as follows (actions are simultaneous unless stated otherwise):
| |
| : 1. The HPCS diesel generator is signaled to start.
| |
| : 2. Following an initiation signal and if no loss of offsite power has occurred, the HPCS pump is automatically started after a time delay. If a loss of offsite power occurs concurrent with Revision 12 7.3-5 January, 2003
| |
| | |
| an initiation signal, the HPCS pump is automatically started immediately, once power is available at the bus.
| |
| : 3. The pump suction from the condensate storage tank valve E22F001, is signaled to open, provided the suppression pool suction valve E22F015 is not full open.
| |
| : 4. The test return valves E22F010, E22F011 and E22F023 are signaled closed.
| |
| : 5. The HPCS injection valve E22F004 is signaled to open.
| |
| The HPCS pump discharge flow and pressure are monitored by pressure transmitters. If pump discharge pressure is normal but discharge flow is low enough that pump overheating may occur the minimum flow return line valve E22F012 is signaled open. The valve is automatically closed if flow is normal. The HPCS reaches its rated flow in 27 seconds.
| |
| If the water level in the condensate storage tank falls below a predetermined level, the suppression pool suction valve E22F015 automatically opens. When E22F015 is fully open, the condensate storage tank suction valve E22F001 automatically closes. Two level transmitters are used to detect low water level in the condensate storage tank. Either transmitter can cause automatic suction transfer. The suppression pool suction valve also automatically opens if high water level is detected in the suppression pool. Two level transmitters monitor suppression pool water level and either transmitter can initiate opening of the suppression pool suction valve. During the automatic CST to suppression pool suction transfer, to prevent losing suction to the pump, the suction valves are interlocked so that the suppression pool suction valve must be open before the CST suction valve automatically closes.
| |
| Revision 15 7.3-6 October, 2007
| |
| | |
| The HPCS provides makeup water to the reactor until the vessel water level reaches the high level trip (Trip Level 8) at which time the injection valve E22F004 is automatically closed even if a high drywell pressure signal still exists. The pump will continue to run on minimum flow recirculation. The injection valve will automatically reopen if vessel level again drops to the low level (Trip Level 2) initiation point.
| |
| The HPCS pump motor and injection valve are provided with manual override controls. These controls permit the reactor operator to manually control the system following automatic initiation.
| |
| 7.3.1.1.1.2 Automatic Depressurization System (ADS) -
| |
| Instrumentation and Controls
| |
| : a. ADS System Function The automatic depressurization system is designed to provide automatic depressurization of the reactor vessel by activating eight safety/relief valves. These valves vent steam to the suppression pool in the event that the HPCS cannot maintain the reactor water level following a LOCA. ADS reduces the reactor pressure so that flow from the RHRS-LPCI mode and LPCS, can inject into the reactor vessel in time to cool the core and limit fuel barrier temperature. Refer also to <Section 6.3.2>. Refer to
| |
| <Section 7.6.1.11> for the relief function of the safety/relief valves.
| |
| : b. ADS Operation Schematic arrangements of system mechanical equipment are shown in
| |
| <Figure 5.1-3>. ADS component control logic is shown in
| |
| <Figure 7.3-3>. Elementary diagrams are listed in <Section 1.7.1>.
| |
| Revision 12 7.3-7 January, 2003
| |
| | |
| Plant layout drawings are shown in <Section 1.2>. Operator information displays are shown in <Figure 5.1-3> and
| |
| <Figure 7.3-3>.
| |
| The ADS consists of two redundant and independent trip systems, trip systems A and B. The ADS trip system A actuates the A solenoid air pilot valve on each ADS safety/relief valve.
| |
| Similarly, the ADS trip system B actuates the B solenoid air pilot valve on each ADS safety/relief valve. Actuation of either solenoid pilot valve causes the ADS safety/relief valve to open and provide depressurization. To prevent inadvertent actuation of the ADS, two channels of logic for each ADS trip system (A & B) are used. Both channels must be activated to actuate an ADS trip system.
| |
| One channel of each trip system includes two differential pressure transmitter inputs monitoring reactor vessel low water level (Trip Level 3 and Trip Level 1). The low water Level 3 trip provides confirmation of a reactor vessel low water level condition. The second channel is redundant except the low water level confirmation signal is omitted. A manual inhibit switch is provided to allow the operator to prevent automatic ADS initiation.
| |
| To assure that adequate makeup water is available after the vessel has been depressurized, each trip channel includes a pump discharge pressure permissive signal indicating LPCI or LPCS system availability for vessel water makeup. Any one of the three LPCI pumps or the LPCS pump available for reactor coolant makeup is sufficient to permit automatic depressurization.
| |
| After receipt of the initiation signals and after a delay provided by timers, each of the two solenoid air pilot valves are energized.
| |
| This allows pneumatic pressure from the accumulator to act on the air cylinder operator. Each ADS trip system has a time delay that Revision 12 7.3-8 January, 2003
| |
| | |
| can be reset manually to delay system initiation. The time delay is selected to be within a period that allows the HPCS to perform its function prior to ADS initiation. In the event of HPCS failure, the time delay period is selected to allow initiation of ADS, LPCI and LPCS in time to maintain the fuel barrier temperature within acceptable limits. If reactor vessel water level is restored by HPCS prior to the end of the time delay, ADS initiation will be prevented.
| |
| Once initiated, the ADS logic seals-in and can be reset by the control room operator only when vessel water level returns to normal.
| |
| Two control switches (one for each trip system solenoid) are located in the control room for each safety/relief valve associated with the ADS. Each switch controls one of the two solenoid pilot valves.
| |
| 7.3.1.1.1.3 Low Pressure Core Spray (LPCS) - Instrumentation and Controls
| |
| : a. LPCS Function The purpose of the LPCS is to provide low pressure reactor vessel core spray following a loss-of-coolant accident when the vessel has been depressurized and vessel water level has not been restored by the HPCS. The LPCS is functionally diverse to the LPCI mode of the residual heat removal system <Section 6.3.2>.
| |
| : b. LPCS Operation Schematic arrangements of system mechanical equipment are shown in
| |
| <Figure 6.3-8>. LPCS component control logic is shown in
| |
| <Figure 7.3-4>. Elementary diagrams are listed in <Section 1.7.1>.
| |
| Revision 12 7.3-9 January, 2003
| |
| | |
| Plant layout drawings are shown in <Figure 1.2>. Operator information displays are shown in <Figure 6.3-8> and
| |
| <Figure 7.3-4>.
| |
| The LPCS is initiated automatically by either reactor vessel low water level (Trip Level 1) and/or drywell high pressure. The system is designed to operate automatically for at least 10 minutes without any actions required by the control room operator. Once initiated, the LPCS logic seals-in and can be reset by the control room operator only when the initial conditions return to normal.
| |
| Refer to <Figure 7.3-4> for a schematic representation of the LPCS system initiation logic.
| |
| Reactor vessel water level (Trip Level 1) is monitored by two redundant level transmitters. Drywell pressure is monitored by two redundant pressure transmitters. The vessel level trip unit relay contacts and the drywell pressure trip unit relay contacts are connected in a one-out-of-two twice logic arrangement so that no single instrument failure can prevent initiation of LPCS (i.e.,
| |
| LPCS will be initiated when either both level channels, both pressure channels, or one level channel and one pressure channel are tripped).
| |
| The LPCS components respond to an automatic initiation signal simultaneously (or sequentially as noted) as follows:
| |
| : 1. The Division 1 diesel generator is signaled to start.
| |
| : 2. The normally closed test return line to the suppression pool valve E21F012 is signaled closed.
| |
| Revision 14 7.3-10 October, 2005
| |
| : 3. Following a LOCA initiation signal and if no loss of offsite power has occurred, the LPCS pump is automatically started after a time delay. If a loss of offsite power occurs concurrent with a LOCA initiation signal, the LPCS pump is automatically started immediately, once power is available at the bus.
| |
| Revision 14 7.3-10a October, 2005
| |
| : 4. Reactor pressure is monitored by a pressure transmitter which senses pressure on the vessel side of the LPCS injection valve E21F005. When the pressure is low enough to protect the LPCS from overpressure and power is available to the pump motor bus, the injection valve is signaled to open. A blue indicating lamp, labeled Pressure Permissive, is installed above the LPCS injection valve manual control switch which will illuminate to inform the operator that the injection pressure is low enough to prevent over pressurization of the LPCS piping.
| |
| The LPCS pump discharge flow is monitored by a differential pressure transmitter. When the pump is running and discharge flow is low enough to cause pump overheating to occur, the minimum flow return line valve E21F011 is opened. The valve is automatically closed if flow is normal.
| |
| The LPCS pump suction from the suppression pool valve E21F001 is normally open, the control switch is keylocked in the open position, and thus requires no automatic open signal for system initiation.
| |
| The LPCS pump and injection valve are provided with manual override controls. These controls permit the operator to manually control the system subsequent to automatic initiation.
| |
| 7.3.1.1.1.4 RHRS - Low Pressure Coolant Injection (LPCI) Mode -
| |
| Instrumentation and Controls
| |
| : a. LPCI Function Low pressure coolant injection (LPCI) is an operating mode of the residual heat removal system (RHRS) <Section 5.4.7>. The purpose Revision 12 7.3-11 January, 2003
| |
| | |
| of the LPCI system is to provide low pressure reactor vessel coolant makeup following a loss-of-coolant accident when the vessel has been depressurized and vessel water level is not restored by the HPCS <Section 6.3.2>.
| |
| : b. LPCI Operation Schematic arrangements of system mechanical equipment is shown in
| |
| <Figure 5.4-13>. LPCI component control logic is shown in
| |
| <Figure 7.3-5>. Elementary diagrams are listed in <Section 1.7.1>.
| |
| Plant layout drawings are shown in <Section 1.2>. Operator information displays are shown in <Figure 5.4-13> and
| |
| <Figure 7.3-5>.
| |
| The LPCI system is initiated automatically by either reactor vessel low water level and/or by drywell high pressure. The system is designed to operate automatically for at least 10 minutes without any actions required by the control room operator. Once initiated, the LPCI logic seals-in and can be reset by the control room operator only when initial conditions return to normal.
| |
| Reactor vessel water level (Trip Level 1) is monitored by two redundant differential pressure transmitters. Drywell pressure is monitored by two redundant pressure transmitters.
| |
| To initiate the Division 2 LPCI (Loops B and C), the vessel level trip unit relay contacts and the two drywell pressure trip unit relay contacts are connected in a one-out-of-two-twice arrangement so that no single instrument failure can prevent initiation of LPCI (i.e., LPCI will be initiated when either both level channels, both pressure channels, or one level channel and one pressure channel are tripped).
| |
| The Division 1 LPCI (Loop A) receives its initiation signal from the LPCS logic.
| |
| Revision 14 7.3-12 October, 2005
| |
| | |
| The LPCI system components respond to an automatic initiation signal simultaneously (or sequentially as noted) as follows (the loop A components are controlled from the Division 1 logic; the loop B and C components are controlled from the Division 2 logic):
| |
| : 1. The Division 2 diesel generator is signaled to start from the loop B and C initiation logic.
| |
| : 2. When the offsite power or the diesel generators are providing power to the pump motor buses, sequential loading is provided.
| |
| This is accomplished by delaying the start of LPCI pumps A and B by 5 seconds while allowing the LPCI pump C to start immediately. The LPCS pump start is delayed when offsite power is providing power to the bus. If power is supplied by the diesel generators, the LPCS pump will start immediately.
| |
| : 3. The following normally closed valves are signaled closed to ensure proper system lineup:
| |
| (a) (Deleted)
| |
| (b) The RHR heat exchanger flush to suppression pool valves E12F011 A, B.
| |
| (c) (Deleted)
| |
| (d) (Deleted)
| |
| (e) The test return line to the suppression pool valves E12F024 A, B and E12F021.
| |
| (f) The containment spray valves E12F028 A, B.
| |
| Revision 12 7.3-13 January, 2003
| |
| : 4. Reactor pressure is monitored by pressure transmitters which sense pressure on the vessel side of LPCI injection valves.
| |
| When the pressure is low enough to protect the LPCI lines from overpressure and power is available to the pump motor buses, the injection valves are signaled to open. A blue indicating lamp, labeled Pressure Permissive, is installed above the LPCI injection valve manual control switch which will illuminate to inform the operator that the injection pressure is low enough to prevent over pressurization of the LPCI piping.
| |
| The heat exchanger bypass throttle valves E12F048 A, B and the heat exchanger outlet throttle valves E12F003 A, B are signaled to fully open after 110 second time delay. The open signal is automatically removed 10 minutes after system initiation to allow the operator to manually control these valves. This automatic opening function is designed to operate whenever these valves are controlled from the control room. The automatic opening function does not operate when control of these valves is transferred to the remote shutdown station.
| |
| Each LPCI pump discharge flow is monitored by a differential pressure transmitter which, when the pump is running and following an 8 second time delay, opens the minimum flow return line valve E12F064 A, B, C if flow is low enough that pump overheating may occur. The valve is automatically closed if flow is normal.
| |
| The three RHR pump suction valves from the suppression pool valves E12F004 A and B and F105 have their control switches keylocked in the open position, and thus require no automatic open signal for system initiation. The RHR heat exchanger Revision 12 7.3-14 January, 2003
| |
| | |
| inlet valves E12F047 A and B are administratively controlled to ensure that they are open and therefore do not require an automatic signal.
| |
| The upper pool shutdown cooling valves E12F037 A, B, the two series RHR heat exchanger vent valves E12F073 A and F074 A, B and the RHR shutdown cooling mode suction valves E12F006A, B are all normally closed and thus require no automatic close signal for system initiation. RHR heat exchanger vent valve 1E12F073B is normally open and thus requires an automatic signal to close.
| |
| The LPCI pump motors and injection valves are provided with manual override controls. These controls permit the operator to manually control the system subsequent to automatic initiation.
| |
| 7.3.1.1.2 Containment and Reactor Vessel Isolation Control System (CRVICS) - Instrumentation and Controls
| |
| : a. CRVICS Function The CRVICS, also known as nuclear steam supply shutoff system (NSSSS), includes the instrument channels, trip logics and actuation circuits that automatically initiate valve closure providing isolation of the containment and/or reactor vessel, and initiation of systems provided to limit the release of radioactive materials.
| |
| See <Section 6.2.4> and <Table 6.2-32> for a complete description of primary containment and reactor vessel process lines and isolation signals applied to each. The Technical Specifications require that several CRVICS Instrumentation channels for the Main Revision 12 7.3-15 January, 2003
| |
| | |
| Steam Line Isolation Valves meet response time criteria.
| |
| <Table 7.3-1> provides the acceptable response for these channels along with any clarifying information.
| |
| : b. CRVICS Operation Schematic mechanical arrangements of containment isolation valves and other components initiated by CRVICS are shown in
| |
| <Figure 5.4-13>, <Figure 5.1-3>, <Figure 5.4-16>, and
| |
| <Figure 5.4-2>. CRVICS component control logic is shown in
| |
| <Figure 7.3-3>, <Figure 7.3-5> and <Figure 7.3-6>. Elementary diagrams are listed in <Section 1.7.1>. Plant layout drawings are shown in <Section 1.2>. Operator information displays are shown in
| |
| <Figure 5.1-3> and <Figure 7.3-3>.
| |
| During normal plant operation, the isolation control system sensors and trip logic that are essential to safety are energized. When abnormal conditions are sensed, instrument contacts open, de-energize the trip logic and initiate an isolation. Once initiated, the CRVICS trip logics seal-in and may be reset by the operator only when the initial conditions return to normal.
| |
| Each main steam line isolation valve (MSIV) has two control solenoids. Each solenoid receives inputs from two redundant logics.
| |
| A signal from either can de-energize the solenoid. For any one valve to close automatically, both of its solenoids must be de-energized.
| |
| The main steam line isolation valve logic has a minimum of four redundant instrument channels for each measured variable. One channel of each variable is connected to one trip logic. One group of redundant logics (A, C) is used to control one solenoid of both inboard and outboard valves of all four main steam lines and the other group of redundant logics (B, D) is used to control the other Revision 12 7.3-16 January, 2003
| |
| | |
| solenoid of both inboard and outboard valves. The four CRVICS trip logics are arranged in a one-out-of-two twice logic combination (Trip Logic A or C and B or D).
| |
| Except for the main steam line drain valves and RHR isolation valves (reactor vessel pressure) the remaining containment and vessel isolation valves also operate in pairs. The remaining inboard isolation valves close if both of the Division 2 and Division 3 logics (B and C) are tripped, and the outboard valves close if the Division 1 and Division 4 logics (A and D) are tripped.
| |
| Main steam line drain outboard valves close if Channels A and D isolation logic is tripped, while an inboard valve closes if Channels B and C logic is tripped. The RHR outboard valves close if Channel A or D isolation logic is tripped, while the inboard valves close if Channel B or C logic is tripped.
| |
| The following variables provide inputs to the CRVICS logics for initiation of reactor vessel and containment isolation, as well as the initiation or trip of other plant functions when predetermined limits are exceeded. Combinations of these variables, as necessary, provide initiation of various isolating and initiating functions as described in <Table 6.2-32> and below:
| |
| : 1. Reactor Vessel Low Water Level A low water level in the reactor vessel could indicate that reactor coolant is being lost through a breach in the reactor coolant pressure boundary and that the core is in danger of becoming overheated as the reactor coolant inventory diminishes.
| |
| Revision 12 7.3-17 January, 2003
| |
| | |
| Reactor vessel low water level initiates closure of various valves. The closure of these valves is intended to isolate a breach of the pipelines, conserve reactor coolant by closing off process lines, and limit the escape of radioactive materials from the containment through process lines that communicate with the primary coolant boundary or containment.
| |
| Reactor vessel water level is monitored by four redundant level transmitters. Each instrument provides a low water level input to one of the four CRVICS trip channels.
| |
| Three reactor vessel low water level isolation trip settings are used to complete the isolation of the containment and the reactor vessels. The first (and highest) Level 3 reactor vessel low water level isolation trip setting initiates closure of RHR isolation valves, the second reactor vessel low water level (Level 2) initiates closure of all valves in major process pipeline except the main steam lines and associated drains, the nuclear closed cooling system isolation valves and the instrument air system isolation valves for the MSIVs air supply. The main steam lines are left open to allow the removal of heat from the reactor core. The third, and lowest (Level 1) reactor vessel low water level, completes the isolation of the containment and pressure vessel by initiating closure of the main steam line isolation valves, main steam line drain valves, nuclear closed cooling system isolation valves, and the instrument air system isolation valves for the MSIVs air supply.
| |
| The instrument air containment isolation valve 1P52-F200 and drywell isolation valve 1P52-F646 are provided with manual override control. This control permits the operator to override the RHR LOCA isolation signal to open the valves as directed by the Emergency Operating Procedures (EOPs). The reactor Revision 15 7.3-18 October, 2007
| |
| | |
| vessel low water level (Level 1) MSIV isolation signal can be bypassed manually in accordance with the Emergency Operating Procedures (EOPs) from the control room by actuating four keylocked switches.
| |
| Diversity of trip initiation for low reactor vessel water level from pipe breaks inside the drywell is provided by drywell high pressure.
| |
| : 2. Drywell High Pressure High pressure in the drywell could indicate a breach of the reactor coolant pressure boundary inside the drywell and that the core is in danger of becoming overheated as reactor coolant inventory diminishes.
| |
| Drywell pressure is monitored by four redundant pressure transmitters. Each transmitter trip unit provides an input to one of the four trip channels.
| |
| : 3. Main Steam Line-High Radiation The main steam line radiation monitoring senses the gross release of fission products from the fuel and initiates alarms and automatic actions to contain the released fission products. Monitor input to isolate MSIVs and associated drain valves has been deleted based on analysis presented in NEDO-31400A.
| |
| Four redundant detectors monitor the gross gamma radiation from the main steam lines. Each provides an input to one of the four CRVICS trip channels.
| |
| Revision 15 7.3-19 October, 2007
| |
| | |
| Each radiation monitoring channel consists of a gamma-sensitive ion chamber and a log radiation monitor. Each log radiation monitor has four alarm/trip circuits. One upscale trip circuit is used to initiate an alarm and a trip signal to the associated CRVICS trip logic. The second circuit is used for an alarm and is set at a level below that of the first circuit. The third circuit is a downscale trip that actuates an instrument trouble alarm. The fourth circuit is the instrument inoperative trip which produces an alarm and a trip signal to the associated CRVICS trip logic.
| |
| Annunciator indicating lights are located in the control room.
| |
| When the main steam line radiation level exceeds a predetermined value, CRVICS initiates closure of the reactor water sample valves. The high radiation or instrument inoperative trip signals from main steam line radiation monitors A or C also trip the offgas system mechanical vacuum pump(s) and isolate the mechanical vacuum pump lines.
| |
| : 4. Main Steam Line-Tunnel and Pipe Routing in Turbine Building High Ambient Temperature and Differential Temperature High ambient temperature in the tunnel and pipe routing areas in the turbine building in which the main steam lines are located outside of the primary containment could indicate a leak in a main steam line. Such a leak may also be indicated by high differential temperature between the outlet and inlet ventilation air for the MSL tunnel. The automatic closure of valves prevent the excessive loss of reactor coolant and the release of a significant amount of radioactive material from the reactor coolant pressure boundary.
| |
| Four redundant main steam line high ambient temperature sensors are provided in the main steam tunnel and four in the Revision 12 7.3-20 January, 2003
| |
| | |
| steam line area of the turbine building. Four redundant differential temperature sensors monitor the outlet and inlet ventilation air ducts of the main steam line tunnel. Each main steam line trip isolation logic is de-energized by high ambient temperature in the main steam tunnel or the steam line area of the turbine building. Four other ambient temperature sensors are located in the turbine power complex and provide alarm capability.
| |
| When a predetermined increase in main steam line tunnel ambient temperature, or the steam line area of the turbine building temperature is detected, trip signals initiate closure of all main steam line isolation and drain valves. In addition, MSL tunnel high ambient temperature will cause RWCU and RCIC system isolation initiations.
| |
| Diversity of trip initiation signals for main steam line tunnel ambient temperature is provided by main steam line high flow, and steam line low pressure instrumentation.
| |
| : 5. Main Steam Line-High Flow Main steam line high flow could indicate a breach in a main steam line. Automatic closure of isolation valves prevents excessive loss of reactor coolant and release of significant amounts of radioactive material from the reactor coolant pressure boundary.
| |
| Sixteen redundant differential pressure transmitters, four for each main steam line, monitor the main steam line flow. Four differential pressure transmitter trip units for each main Revision 15 7.3-21 October, 2007
| |
| | |
| steam line provide inputs to each of the four trip channels.
| |
| When a significant increase in main steam line flow is detected, trip signals initiate closure of all main steam line isolation and drain valves.
| |
| : 6. Main Turbine Inlet - Low Steam Pressure Low steam pressure at the turbine inlet while the reactor is operating could indicate a malfunction of the nuclear system pressure regulator in which the turbine control valves or turbine bypass valves become fully open, and causes rapid depressurization of the reactor vessel.
| |
| Four redundant pressure transmitters, one for each main steam line, monitor main steam line pressure and each provides an input to one of the four trip channels.
| |
| When a decrease in main steam line pressure below a preselected value is detected, the CRVICS initiates closure of all main steam line isolation and drain valves.
| |
| The main steam line low pressure trip is bypassed by the reactor mode switch in the Shutdown, Refuel and Startup modes of reactor operation. In the Run mode, the low pressure trip function is operative.
| |
| : 7. Containment and Drywell Purge and Vent Exhaust Radiation Monitor The containment and drywell purge and vent exhaust radiation monitor consists of four sensor and trip units. Each channel has two trips. The upscale trip indicates high radiation and the downscale trip indicates instrument trouble.
| |
| Revision 12 7.3-22 January, 2003
| |
| | |
| The containment and drywell purge and vent exhaust radiation monitor senses reactor building exhaust to the release point.
| |
| In the event that radiation levels exceed predetermined limits, the containment and drywell purge system inboard and outboard isolation valves are closed.
| |
| : 8. Reactor Water Cleanup (RWCU) System-High Differential Flow High differential flow in the reactor water cleanup system could indicate a breach of the system pressure boundary of the cleanup system. The flow at the inlet to the system (suction from recirculation lines) is compared with the flow at the outlets of the system (flow return to feedwater or flow to the main condenser and/or radwaste).
| |
| Two redundant differential flow sensors compare the reactor water cleanup system inlet-outlet flow. Each of the flow monitoring sensors provides an input to one of the two (inboard or outboard) logic trip channels.
| |
| When an increase in reactor water cleanup system differential flow is detected, the CRVICS initiates closure of all reactor water cleanup system isolation valves.
| |
| Diversity of trip initiation signals for reactor water cleanup system line break is provided by instrumentation for reactor water level, differential flow, and ambient or differential temperature in RWCU equipment areas.
| |
| The reactor water cleanup system high differential flow trip is bypassed by an automatic timing circuit during normal reactor water cleanup system surges. This time delay bypass prevents inadvertent system isolations during system operational changes.
| |
| Revision 12 7.3-23 January, 2003
| |
| : 9. Reactor Water Cleanup (RWCU) System-Area High Ambient Temperature and Differential Temperature High temperature in the equipment room areas of the reactor water cleanup system could indicate a breach in the reactor coolant pressure boundary in the cleanup system.
| |
| Sixteen ambient temperature and sixteen differential temperature instruments monitor the RWCU system area temperatures. Eight ambient and eight differential temperature switches are associated with the same logic channel. The remaining instrument channels are associated with a different logic channel. Two ambient temperature elements are located as shown in <Figure 7.6-1>. Two pairs of differential temperature elements are appropriately located to measure inlet and outlet temperatures of the above locations.
| |
| When a significant increase in reactor water cleanup system area ambient temperature is detected the CRVICS initiates closure of all reactor water cleanup system isolation valves.
| |
| The output trip signal of each sensor initiates a channel trip and closure of either the inboard or outboard reactor water cleanup system isolation valve.
| |
| Diversity of trip initiation signals for temperature is provided by two ambient temperature elements for each reactor water cleanup system area. One differential temperature element and its differential temperature switch and an ambient temperature element and its temperature switch in an RWCU area are associated with one of two logic channels.
| |
| Revision 15 7.3-24 October, 2007
| |
| | |
| The RWCU isolation signals can be bypassed manually from the control room by actuating a keylocked switch.
| |
| : 10. RHR System-Area High Ambient Temperature and Differential Temperature See Section 7.6.1.3.
| |
| Revision 14 7.3-25 October, 2005
| |
| : 11. High Temperature at the Outlet of the RWCU Nonregenerative Heat Exchanger A high temperature signal for coolant at the discharge of the nonregenerative heat exchanger indicates the potential for damage to the filter demineralizer resins.
| |
| A temperature controller monitors nonregenerative heat exchanger temperature and provides an output signal to a CRVICS trip channel for closing outboard RWCU isolation valve G33-F004.
| |
| : 12. SLCS Actuation Based on the need to prevent removal of the boron solution from the vessel after SLCS injection, RWCU isolation valves G33-F001 and G33-F004 are actuated closed by the CRVICS logic on inputs from SLCS pump A and pump B actuation respectively.
| |
| : 13. Reactor Vessel Pressure Operation of the RHR system at a high reactor vessel pressure could result in exceeding the design pressure of the system resulting in damage to piping and components and loss of reactor coolant.
| |
| Reactor vessel pressure is monitored by four redundant pressure transmitters. Each transmitter trip unit provides an input to one of the four trip channels.
| |
| Revision 14 7.3-26 October, 2005
| |
| : 14. Main Condenser Vacuum Trip The main turbine condenser low vacuum signal could indicate a leak in the condenser. Initiation of automatic closure of various valves will prevent excessive loss of reactor coolant and the release of significant amounts of radioactive material.
| |
| Four redundant pressure transmitters monitor the main condenser vacuum. The output trip signal of each instrument channel initiates a channel trip. The output trip signal of the channel logics are combined in one-out-of-two twice logic for MSIVs and two-out-of-two logic for drain valves.
| |
| When a significant decrease in main condenser vacuum is detected, the CRVICS initiates closure of all main steam line isolation and drain valves.
| |
| Main condenser low vacuum trip can be bypassed manually from the control room by actuating a keylocked switch.
| |
| 7.3.1.1.3 (Deleted) 7.3.1.1.4 RHRS-Containment Spray Cooling Mode (RCSCM) -
| |
| Instrumentation and Controls
| |
| : a. Containment Spray Cooling Mode Function The containment spray cooling mode is an operating mode of the RHR system. It is designed to provide the capability of condensing steam in the containment atmosphere, removing fission products Revision 12 7.3-27 January, 2003
| |
| | |
| (primarily radioactive iodine in the containment atmosphere) and reducing the suppression pool temperature. The system is automatically or manually initiated when necessary.
| |
| : b. Containment Spray Cooling Mode Operation Schematic arrangements of system mechanical equipment is shown in
| |
| <Figure 5.4-13>. RHR system component control logic is shown in
| |
| <Figure 7.3-5>. Elementary diagrams are listed in <Section 1.7.1>.
| |
| Plant layout drawings are shown in <Section 1.2>. Operator information displays are shown in <Figure 5.4-13> and
| |
| <Figure 7.3-5>.
| |
| The containment spray cooling mode is initiated automatically or manually. LPCI flow is diverted to the containment by opening valves E12F028A and B, E12F537A and B, and closing E12F042A, B, E12F048A, B, E12F024A and B.
| |
| The following conditions must exist before containment spray can be initiated automatically:
| |
| : 1. The LOCA signal which automatically initiated LPCI must still exist.
| |
| : 2. Drywell high pressure is monitored by two redundant pressure transmitters. One of the two transmitters must indicate high pressure.
| |
| : 3. The containment pressure must equal or exceed 9 psig.
| |
| : 4. A 10-minute delay after LOCA is detected.
| |
| Initiation of the containment spray automatically closes the LPCI injection valve E12F042 A, B.
| |
| Revision 12 7.3-28 January, 2003
| |
| | |
| Manual initiation is provided at the system level by separate armed push button switches. High drywell pressure sensors in a one out of two configuration provide a permissive for the manual initiation. Manual bypass of the high drywell pressure permissive is provided by keylocked bypass switches in the control room.
| |
| Bypass operation is also annunciated in the control room.
| |
| The start of the B loop is delayed while the A loop starts immediately after initiation, to preclude simultaneous starting of both loops.
| |
| 7.3.1.1.5 RHRS Suppression Pool Cooling Mode (RSPCM) -
| |
| Instrumentation and Controls
| |
| : a. RHRS-SPCM Function The suppression pool cooling mode is an operating mode of the residual heat removal system. It is designed to prevent suppression pool temperature from exceeding predetermined limits following a reactor blowdown of the ADS or safety/relief valves.
| |
| : b. SPCM Operation Schematic arrangements of system mechanical equipment is shown in
| |
| <Figure 5.4-13>. Component control logic is shown in
| |
| <Figure 7.3-5>. Plant layout drawings and elementary diagrams are identified in <Section 1.7.1>. Operator information displays are shown in <Figure 5.4-13> and <Figure 7.3-5>.
| |
| The suppression pool cooling mode is initiated by the control room operator either during normal plant operation or following a LOCA, when the containment atmosphere monitoring system <Section 7.6.1.8>
| |
| indicates that suppression pool temperature may exceed a predetermined limit.
| |
| Revision 20 7.3-29 October, 2017
| |
| | |
| During normal plant operation, the operator initiates the SPCM as follows:
| |
| : 1. The RHR Pump (A or B) is started. The emergency service water pump is started and the RHR heat exchanger service water discharge valve is opened.
| |
| : 2. The RHR test return line valve E12F024 A, B is opened.
| |
| : 3. The RHR heat exchanger inlet and outlet valves E12F047 A, B and E12F003A, B are open. The heat exchanger bypass valve E12F048 A, B and valve E12F003 A, B are throttled as necessary.
| |
| Subsequent to a LOCA, the operator initiates the SPCM as follows:
| |
| : 1. Once reactor vessel water level has been restored, the LPCI flow must be terminated by closing the LPCI injection valve E12F042 A, B. Closing the injection valve causes the LOCA initiation logic to be overridden and allows operator control of the valve.
| |
| : 2. The RHR test return line valve E12F024 A, B control logic also has LOCA signal override provisions. This allows the operator to open the valve. The valves have provisions for throttling capability in order to support the operation of the M51 combustible gas mixing compressors. The After Coolers for these compressors are cooled using the RHR system.
| |
| : 3. The RHR heat exchanger inlet and outlet valves E12F047 A, B and E12F003 A, B are open. The heat exchanger bypass valve E12F048 A, B, can be closed after a time delay (a ten minute timer keeps this valve open following a LOCA).
| |
| Valves E12F003 A, B are throttled as necessary (the same ten minute timer keeps this valve open following a LOCA).
| |
| Revision 19 7.3-30 October, 2015
| |
| | |
| 7.3.1.1.6 Emergency Water System (EWS) Instrumentation and Controls
| |
| : a. EWS Function The purpose of the emergency water systems instrumentation and controls is to initiate appropriate responses from the systems to ensure the ECCS system receives adequate cooling water in the event of a design basis accident. The emergency water systems consists of two subsystems:
| |
| : 1. Emergency Service Water (ESW) System
| |
| : 2. Emergency Closed Cooling (ECC) System Emergency water systems are also used during plant shutdown, hot standby condition and when running the RHR pumps and diesel generators.
| |
| : b. ESW System Operation The control and instrumentation equipment for the emergency service water system is located in the auxiliary building, diesel-generator building, service water pumphouse, and the intermediate building
| |
| <Figure 9.2-1>. The emergency service water system consists of three independent loops A, B and C, each with one pump and strainer. Loop A and loop B are automatically initiated with the automatic initiation of the RHR or LPCS systems. Loop A is also automatically initiated with automatic initiation of RCIC system.
| |
| Loop A supports the RCIC, RHR and LPCS, while loop B supports the RHR only (LPCI mode). Loop C is automatically initiated with the automatic initiation of HPCS. When shutting down loop operation, the initiation signal is remote-manually initiated.
| |
| Revision 12 7.3-31 January, 2003
| |
| | |
| The motor-operated isolation valves from the RHR heat exchangers are operated remote-manually by a selector switch in the control room (loop A valves can also be controlled at the remote reactor shutdown panel) and open automatically upon receipt of a signal from ECCS or ESW pump start. The pump discharge isolation valves operate from the same remote-manual signal or the automatic signal used to initiate pump operation. Motor-operated sluice gates are automatically opened upon receipt of a signal from level switches in the emergency service water pumphouse forebay. When elevated lake temperatures may cause the ESW forebay temperature to approach its maximum allowable design limit of 85F, the sluice gate seals are inflated and the automatic opening feature is disabled.
| |
| Differential pressure switches across the emergency service water strainers start the strainer backwash operation on high differential pressure.
| |
| The flow, temperature and pressure transmitters are used to provide flow, temperature and pressure indication in the control room.
| |
| Flow, temperature and pressure switches are provided to give alarms in the control room. Radiation monitors provide alarm signals in the event there is a leak of radioactive water into the emergency service water system (loop A and loop B) from the RHR heat exchangers.
| |
| : c. ECC System Operation The ECC system provides the required cooling water for the emergency core cooling support components, i.e., RHR pump and room coolers, LPCS room cooler, RCIC room cooler, control complex chillers and the hydrogen analyzers. The system is designed to provide the required cooling without compromising the independence of the redundant core cooling systems.
| |
| Revision 13 7.3-32 December, 2003
| |
| | |
| The control and instrumentation equipment for the emergency closed cooling system is located in the intermediate building, auxiliary building, control complex building, and the control room
| |
| <Figure 9.2-3>.
| |
| The ECC system automatic initiation circuits (ESF) are interlocked with the ECCS automatic initiation circuit (ESF). Whenever an automatic signal (ESF signal) is provided to initiate the ECCS, the emergency closed cooling system is initiated. When shutting down loop operation, the signal is remote-manually initiated. The level in each ECC system surge tank is maintained automatically by an air operated makeup valve. The solenoid valve that supplies air to the water makeup valve is actuated by high and low level switches on each ECC system surge tank.
| |
| An electro-hydraulic operator positions a three-way valve at the inlet of each ECC heat exchanger. The electro-hydraulic operator controls this valve based on the ECC system water temperature downstream of the heat exchangers so as to maintain the ECC water temperature within acceptable limits.
| |
| The outlet of each control complex chiller contains a flow element that supplies a differential pressure signal to a flow switch.
| |
| Each flow switch trips the individual chiller when the ECC system flow rate to that particular chiller reaches a predetermined low value.
| |
| The bypass provided around the control complex chillers is employed only during maintenance and testing conditions. At all other times, both trains of the ECCW system are aligned in their post Revision 13 7.3-33 December, 2003
| |
| | |
| accident configuration. The following events occur automatically after a LOOP or LOCA signal:
| |
| : 1. Emergency service water pumps start to supply cooling water to ECC system heat exchangers.
| |
| : 2. ECC system pumps start.
| |
| : 3. Motor-operated valves on nuclear closed cooling system supply and return lines to the fuel pool coolers are closed (0P42-F380A, B, 0P42-F440, 0P42-F390A, B, and 0P42-F445).
| |
| The valves associated with the fuel pool heat exchangers have isolation functions only. Stroke times associated with these valves are not dependent upon other interactions.
| |
| Revision 19 7.3-34 October, 2015
| |
| | |
| No operator action is required on the ECC system for 10 minutes following initiation of a LOOP or LOCA signal. At the end of the 10 minute period, the system continues to run. Manual control of the ECC pumps may be assumed at any time by operating their control switch. The operator cannot change the position of any motor operated valve that receives a LOCA or a LOOP signal until after the signal has been cleared.
| |
| 7.3.1.1.7 Control Complex HVAC System
| |
| : a. System Function The purpose of the control complex HVAC system instrumentation and controls is to monitor the control complex atmosphere and to initiate appropriate responses from the system to ensure the continued habitability of the control complex. The instrumentation and controls for this system are shown on <Figure 6.4-1>,
| |
| <Figure 9.4-1> and <Figure 9.4-20>.
| |
| The Control Complex HVAC System consists of two subsystems:
| |
| : 1. Control room HVAC system
| |
| : 2. Control complex chilled water system
| |
| : b. System Operation The control room HVAC system consists of two independent control loops; the power for each loop is supplied from the Class 1E electrical system.
| |
| The control room HVAC system is normally manually initiated.
| |
| Change over to the emergency recirculation mode is manually or automatically initiated by high drywell pressure, low reactor water Revision 12 7.3-35 January, 2003
| |
| | |
| level, high radiation signal from the system radiation monitor, or as a result of a LOOP condition. Change over to the smoke clear mode is manually initiated.
| |
| Status lights on the control panel indicate that the motor driven fans are energized. All dampers are provided with limit switches to provide indication of their opened or closed position on the control panel. During emergency recirculation mode of operation, one or both of the fans operate continuously.
| |
| The instrumentation and controls for the control complex chilled water system are shown in <Figure 9.4-20>.
| |
| The control complex chilled water system has two loops. Loop A provides chilled water to the control room cooling coil A, and motor control center area and miscellaneous areas cooling coil A.
| |
| Loop B provides chilled water to the control room cooling coil B, and the motor control center area and miscellaneous areas cooling coil B. The two loops (A and B) are served by three 100 percent capacity circulating pumps and three 100 percent capacity chillers (A, B and C).
| |
| The circulating pumps and associated chillers are powered from the Class 1E electrical system.
| |
| A control complex chilled water chiller is automatically shut down upon loss of chilled water or cooling water flow through the chiller.
| |
| The Control Complex Chilled Water C chiller which is not diesel backed can be operated as a front line chiller, and chiller A and B can be used as standby chillers. During a LOOP/LOCA event, the Revision 12 7.3-36 January, 2003
| |
| | |
| Control Complex Chilled Water C chiller and its associated pump are tripped. The A and B chiller and pumps are automatically started upon receiving a LOOP/LOCA signal.
| |
| The system valve lineup and operation will be the same for normal and post-LOOP or LOCA conditions.
| |
| The operation of the system, with the exception of the automatic chiller shutdowns, is remote-manual.
| |
| Separation within the control complex chilled water system is such that no single failure will cause the complete loss of the chilled water system. The circulating pumps and associated chiller and control equipment have the following power division arrangements:
| |
| Division 1 (Unit 1) Division 2 (Unit 1) Division 1 (Unit 2)
| |
| Circulating Pump A Circulating Pump B Circulating Pump C Chiller A Chiller B Chiller C Controls & Instr. A Controls & Instr. B Controls & Instr. C 7.3.1.1.8 ESF Building and Area HVAC System - Instrumentation and Control
| |
| : a. System Function The ESF building and area HVAC systems provide and maintain suitable environmental conditions for ESF or ESF supporting Revision 13 7.3-37 December, 2003
| |
| | |
| equipment building compartments. The ESF Building and Area HVAC system consist of:
| |
| : 1. Motor control center (MCC), switchgear and miscellaneous electrical equipment area HVAC System.
| |
| : 2. Battery room exhaust system.
| |
| : 3. Diesel generator building ventilation system.
| |
| : b. System Operation The MCC, switchgear and miscellaneous electrical equipment area HVAC system consists of two redundant trains of fans, filters, plenums, and ductwork Refer to <Figure 9.4-1>.
| |
| The MCC, switchgear and miscellaneous electrical equipment area HVAC system is normally manually initiated from a local panel.
| |
| During normal operation, one of the two trains of redundant components operate continuously. A LOOP or combined LOCA signal consisting of low reactor water level or high drywell pressure will automatically initiate the standby train. In addition, automatic switch over to the standby train on low flow is provided as an operator convenience during normal operation.
| |
| Smoke detectors are installed in each supply and return fan discharge duct to give alarm indication on the local panel and to alarm in the control room upon detection of smoke.
| |
| Each room (total of 21 rooms) is provided with a temperature element which alarms and indicates on a temperature monitoring system in the control room. In addition, all fan motors are provided with status indicating lights in the control room.
| |
| Revision 12 7.3-38 January, 2003
| |
| | |
| The battery room exhaust system consists of two redundant subsystems or trains <Figure 9.4-1>.
| |
| The battery room exhaust system is normally manually initiated from a local panel. During normal operation, one of the two trains of redundant components operate continuously. A LOOP or a combined LOCA signal consisting of low reactor water level or high drywell pressure will automatically initiate the standby train. In addition, automatic switchover to the standby train on low flow is provided as an operator convenience during normal operation.
| |
| Smoke detector in the outlet duct of each fan to give alarm indication on the local panel and to alarm in the control room upon detection of smoke.
| |
| All components are controlled from a local panel. All fan motors are provided with indicating or status lights in the control room.
| |
| The diesel generator building ventilation system has two 100 percent capacity redundant supply fans for each division diesel generator room <Figure 9.4-14>.
| |
| The diesel generator building ventilation system is normally idle, except for the auxiliary exhaust fan, which operates automatically when the diesel is not operating to promote further cooling in the diesel generator room. The system is automatically initiated when the respective diesel generator is started. See <Chapter 8> for diesel generator initiation signals. The supply fans can be started and stopped remote-manually from the control room. All of the DGBVS fans are interlocked to prevent their operation when the fire protection CO2 system is activated.
| |
| Revision 14 7.3-39 October, 2005
| |
| | |
| Each diesel generator room is provided with two 100 percent capacity redundant supply fans. Each system is supplied power from the diesel generator it serves. Because cooling is not required, unless the diesel generator is operating, redundant power supplies are not required.
| |
| The diesel generator building ventilation system supply fans are remote-manually controlled from the control room. The mixing and exhaust louvers are interlocked with their respective fans. The mixing louvers are modulated by a temperature controller when the corresponding fan is running and assume their failed positions when the fan is stopped. When both fans are stopped, the mixing louvers modulate to promote natural ventilation. The exhaust louvers open when either supply fan is running and close when both supply fans stop. However, the exhaust louver closest to the auxiliary exhaust fan is maintained open during exhaust fan operation. The supply fans and exhaust louvers are provided with status lights. Control room switches permit operation of the ventilation systems independently of the diesel generators for testing or other purposes. The auxiliary exhaust fans operate automatically when the diesel generator is not operating to promote further cooling in the associated diesel room, and can be started and stopped manually from their local control panels.
| |
| The indications and alarms provided in the control room allow the operator to monitor and control the operation of each system. The redundant supply fans in each diesel generator room permit maintenance and testing without affecting diesel generator availability.
| |
| Revision 14 7.3-40 October, 2005
| |
| | |
| 7.3.1.1.9 Annulus Exhaust Gas Treatment System (AEGTS)
| |
| : a. System Function The AEGTS maintains a negative pressure differential between the containment vessel annulus and the outside so that leakage from the containment vessel will be detained in the annular space, mixed with the annulus space air, diluted with air leakage into the annular space, and filtered before release to the unit vent
| |
| <Section 6.5.3>.
| |
| : b. System Operation The AEGTS consist of two independent and redundant systems. One system operates during normal plant operation and the standby system is automatically initiated by a LOCA signal or abnormal low air flow.
| |
| During normal operation, the system creates a small negative pressure in the annular region, exhausting gases which may leak from the containment through the filter system to the plant vent thereby eliminating the possibility of uncontrolled ground level releases of radioactive gases through containment leaks. Each system is powered from a separate Class 1E power supply.
| |
| Two pressure differential transmitters, spaced 180 apart, transmit signals to record in the control room the pressure differential between the annulus and the outdoor air. The differential pressure transmitters also transmit signals to a differential pressure signal modifier which is wired to a controller located in the control room. The differential pressure signal modifier selects the least pressure differential signal and transmits a signal to the controller which sequentially modulates the discharge damper and the recirculation damper in order to maintain a (negative)
| |
| Revision 12 7.3-41 January, 2003
| |
| | |
| pressure differential in the annulus of 0.66 inch w.g. The 0.66 inches of water gauge pressure differential is provided to maintain the 0.25 inches of water gauge minimum pressure differential required due to instrument location, to meet plant post-LOCA conditions, and to adjust for all environmental conditions. The controller, located in the control room, has an AUTO/MANUAL switch to allow manual operation of the motor-operated dampers in case of controller malfunction.
| |
| The AEGTS operation will be under administrative control so that the units may be maintained as required by the maintenance schedule and procedures. Low flow alarms, pressure drop indicators, temperature indicators, and radiation monitor indicators are located in the control room and will give indication of the performance of the operational unit.
| |
| The AEGTS can be controlled remote-manually from the control room.
| |
| All dampers and fan motors are provided with status indicating lights in the control room.
| |
| 7.3.1.1.10 Pump Room Cooling System - Instrumentation and Controls
| |
| : a. System Function The purpose of the pump room cooling systems instrumentation and controls is to provide indication of proper cooling operation and to provide controls to put the cooling system into operation.
| |
| The instrumentation for the following systems is shown on
| |
| <Figure 9.4-11>, <Figure 9.4-12>, and <Figure 9.4-13>.
| |
| Revision 12 7.3-42 January, 2003
| |
| : b. System Identification The pump rooms cooling system consists of the following subsystems:
| |
| : 1. The emergency core cooling system pump room cooling systems (ECCSCS)
| |
| (a) High pressure core spray pump room cooling system.
| |
| (b) Low pressure core spray pump room cooling system.
| |
| (c) Residual heat removal C pump room cooling system.
| |
| (d) Residual heat removal pump A room and residual heat removal pump A heat exchanger room cooling system.
| |
| (e) Residual heat removal pump room B and residual heat removal pump B heat exchanger room cooling system.
| |
| (f) Reactor core isolation cooling pump room cooling system.
| |
| : 2. The emergency service water pumphouse ventilation system (ESWVS).
| |
| : 3. The emergency closed cooling pump area cooling system (ECPCS).
| |
| The power supplied to each system instrumentation and controls is the same as the associated pump.
| |
| Revision 12 7.3-43 January, 2003
| |
| : c. System Operation
| |
| : 1. ECCSCS The fan cooling unit for the reactor core isolation cooling pump room will run in conjunction with the RCIC pump because it is interlocked with the RCIC turbine steam admission valve.
| |
| The other ECCS pump room fan cooling units are interlocked with their respective pump motor circuits and will run whenever their associated pump runs.
| |
| A temperature element in each ECCS pump room and heat exchanger room alarms and gives readout in the control room when a preset high temperature is exceeded.
| |
| A differential pressure switch across each fan alarms in the control room and indicates locally on low air flow with the fan in operation.
| |
| : 2. ESWVS The electric motor-operated outside and return air dampers in each fan mixing box are controlled by a temperature controller. The outside air dampers fail closed and the return air dampers fail open on loss of control signal. When the corresponding fan is stopped, the dampers are in their fail position. When the corresponding fan is started, the dampers are permitted to modulate.
| |
| A differential pressure switch across each fan alarms in the control room on low air flow as a result of high or low differential pressure with fan in operation.
| |
| Revision 12 7.3-44 January, 2003
| |
| | |
| Temperature elements in the pump area alarm in the control room when the room temperature falls below or rises above a preset low and high temperature set points.
| |
| The fan cooling units are interlocked with the corresponding pump motor circuits and will run whenever their associated pump runs.
| |
| The power for the instrumentation and controls on each fan cooling unit is provided from the same ESF division as the corresponding ESW pump.
| |
| : 3. ECPCS The fan cooling units are interlocked with the associated pump motor circuits and will run whenever their associated pump runs.
| |
| Temperature elements in the pump area alarm and give readout in the control room when a preset high temperature is exceeded.
| |
| A differential pressure switch across each air handling unit fan alarms in the control room and indicates low air flow on local panel with the fan or associated pump in operation.
| |
| The power supply to the instrumentation and controls for each fan cooling unit is from the same ESF division as the corresponding pump.
| |
| Revision 12 7.3-45 January, 2003
| |
| | |
| 7.3.1.1.11 Containment Combustible Gas Control System
| |
| : a. Containment Combustible Gas Control System Function The purpose of the combustible gas control in containment system is to monitor for the presence of free hydrogen gas within the drywell and containment following the unlikely event of a LOCA and to provide a means of controlling the buildup of this gas in the containment. Upon the detection of predetermined concentrations of hydrogen, the mixing system, and recombiner system will be manually started to mix the atmosphere within the drywell and containment, and to reduce the concentration of hydrogen within the drywell and containment. The combustible gas purge system can also be manually placed in operation from the control room to vent the drywell
| |
| <Figure 6.2-62> and <Figure 7.3-8>.
| |
| The CCGCS consists of four subsystems:
| |
| : 1. Hydrogen Analysis System
| |
| : 2. Hydrogen Mixing System
| |
| : 3. Hydrogen Recombination System
| |
| : 4. Combustible Gas Purge System
| |
| : b. System Operation The hydrogen analysis system consists of two completely redundant hydrogen analyzers each with control room recorders and switch stations. One is located in the auxiliary building at Elevation 620-6 and the other in the intermediate building at Elevation 654-6 <Figure 1.2-5> and <Figure 1.2-7>. One is supplied by Division 1, the other by Division 2. Each analyzer Revision 12 7.3-46 January, 2003
| |
| | |
| samples from four redundant sample lines: one from above the suppression pool, one from the space between the reactor vessel head and the drywell dome, one from the top of the drywell area, and one from the top of the dome of the containment vessel
| |
| <Figure 7.3-8>.
| |
| Each sample point is manually selected for continuous sampling.
| |
| After passing through the analyzers, the gas samples and any associated moisture are returned to the containment in an area above the suppression pool <Figure 7.3-8>. Each analyzer has the capability to measure a range of 0-10% hydrogen concentration and is provided with reference and calibration gases as required. Each analyzer has alarms to annunciate in the control room for the following conditions; high and high-high hydrogen concentration, low sample flow, and system failure. The sample isolation valves are closed during normal plant operation. They are opened by an administratively controlled key operated switch prior to starting the hydrogen analyzers following a LOCA.
| |
| The hydrogen mixing system consists of two completely independent redundant systems located in adjacent quadrants of the containment building. Each system consists of one air compressor and related ductwork.
| |
| Low discharge pressure for the compressor will be annunciated in the control room. Isolation valves between the drywell and containment vessel are motor-operated and have position indication in the control room. The compressor discharge control valve is interlocked to open when the compressor is started and closed when the compressor is stopped. Selector switches in the control room are provided for remote-manual control of these valves.
| |
| Revision 12 7.3-47 January, 2003
| |
| | |
| The system is normally idle except for periodic testing. Following a LOCA, each mixing system is started manually on high hydrogen concentration in the drywell. Manual initiation is acceptable because high hydrogen concentration will not be reached for at least a number of hours after the LOCA.
| |
| The hydrogen recombination system consists of two completely redundant systems located in the containment. Each system consists of a recombiner unit, a power supply cabinet and control panel which are separately mounted. The power supply cabinet and control panel are located outside containment. A wattmeter and thermocouple readout are provided on the control panel to monitor performance.
| |
| The hydrogen recombiners are remote-manually initiated from the control complex. Except for periodic testing, the recombiners are idle during normal operation.
| |
| The combustible gas purge system is designed to aid in the cleanup of hydrogen. This purge system is manually operated from the control room. The system is designed to utilize the annulus gas treatment unit to exhaust the hydrogen laden air from the drywell/containment. The system is provided with two containment isolation valves and a flow control valve failed in the open position which allows straight through flow to the AEGTS filters.
| |
| The AEGTS is normally in service. The combustible gas purge system is normally used for drywell pressure control during plant startup and operation. For additional hydrogen control, refer to
| |
| <Section 7.6.1.9>, Hydrogen Control System.
| |
| Revision 12 7.3-48 January, 2003
| |
| | |
| 7.3.1.1.12 Suppression Pool Makeup (SPMU) System - Instrumentation and Controls
| |
| : a. System Function The suppression pool makeup (SPMU) system instrumentation and controls are designed to allow transfer of a portion of the water from the upper pool to the suppression pool. It will ensure long term drywell vent water coverage for all conceivable postaccident entrapment volumes, by gravity flow from the upper pool in accordance with the design basis described in <Section 6.2.7>.
| |
| : b. System Operation Four motor operated valves are furnished, two for each line, along with appropriate piping to route water from the upper pool to the suppression pool when the occasion demands it. Four narrow range (16-19 ft) suppression pool level measuring sensors are provided which will signal the need for water when the low-low water level (LLWL) is reached following a LOCA. Additionally, automatic makeup occurs following a LOCA plus a time delay. System logic is shown in <Figure 7.3-9>. For system P&ID, see <Figure 6.2-67>.
| |
| <Section 7.5.1.4.2.4.d> provides a further discussion of the suppression pool water level instrumentation.
| |
| One narrow range channel per division is indicated and recorded in the control room. In addition, the LLWL set point both annunciates and provides a signal to actuate the suppression pool makeup flow.
| |
| Level sensor actuation signals for suppression pool makeup in a single electrical division are parallel such that either level sensor provides a signal to open the series valves on only the suppression pool makeup line in the same electrical division as the level sensors.
| |
| Revision 12 7.3-49 January, 2003
| |
| | |
| Each level sensor is a differential pressure cell. The instrument water level sensing lines run from the suppression pool to the sensors located outside of containment with the sensor static reference lines returning to containment atmosphere.
| |
| The suppression pool makeup system is not required for normal operations. The suppression pool level instrumentation channels will provide the operator with suppression pool level information during normal operation, and will also be available for postaccident tracking of suppression pool level.
| |
| The suppression pool makeup system controls do not require operator action to initiate the correct responses. However, the control room operator can manually initiate the system in modes requiring use. Alarms and indications in the control room allow the operator to interpret any situation that requires the suppression pool makeup system and to verify the responses of the system.
| |
| 7.3.1.1.13 Containment Vacuum Relief (CVR) System
| |
| : a. System Function The CVR system is provided to limit the buildup of negative pressure inside the containment vessel in the event that one or both of the containment spray loops are inadvertently actuated
| |
| <Figure 7.3-10>.
| |
| : b. System Operation The check valves are normally closed while the motor operated isolation valves are normally open. Both valves can be operated from the control room. The motor-operated isolation valve is closed automatically by a containment isolation signal. If vacuum relief is required during containment isolation, differential Revision 12 7.3-50 January, 2003
| |
| | |
| pressure devices provide an isolation override and automatically open the valve as required. The control logic for this system is shown in <Figure 7.3-11>. Isolation valve position indicating lights and system bypassed, inoperative alarms in the control room provide the operator sufficient information to monitor the status of the system and its devices.
| |
| 7.3.1.1.14 Drywell Vacuum Relief (DVR) System Refer to <Section 7.7.1.12>
| |
| 7.3.1.1.15 Standby Power Support Systems - Instrumentation and Controls The standby power support systems consist of the HPCS and standby diesel generator support systems <Section 8.3.2>.
| |
| : a. System Function The purpose of the diesel generator support system instrumentation and control is to ensure the availability of an adequate fuel oil supply and starting air pressure to start and operate the diesel generators and to ensure that the ventilation fans are available to carry away heat from the diesel generators and prevent heat buildup in the room. Additionally, lubricating oil level and temperature and coolant temperature are maintained and monitored to assure quick start capability. The diesel generator ventilation system is discussed in <Section 7.3.1.1.8>.
| |
| The diesel generator support systems for each of the standby and HPCS diesel generators include the following five subsystems:
| |
| : 1. Diesel generator fuel oil system.
| |
| Revision 12 7.3-51 January, 2003
| |
| : 2. Diesel generator starting air system.
| |
| : 3. Diesel generator ventilation system.
| |
| : 4. Lubricating oil system.
| |
| : 5. Cooling water system.
| |
| : b. System Operation
| |
| : 1. Diesel Generator Fuel Oil System The instrumentation and controls for the diesel generator fuel oil storage and transfer system are provided to ensure that fuel is always available in the day tank and to alert the plant operators to any conditions which might jeopardize that objective so that corrective action can be taken.
| |
| Level switches are provided to automatically start and stop the fuel transfer pumps to maintain the fuel oil level in the day tanks within predetermined limits. Abnormal level conditions within the fuel tanks are annunciated in the control room. Pressure and level indicators are provided locally at the equipment as shown on <Figure 9.5-8>.
| |
| The diesel generator fuel oil transfer system has two motor-driven fuel transfer pumps per day tank. These pumps are normally operated automatically, although manual operation is possible from the local control panel for functional checkout or instrumentation calibration. In the automatic mode, a low level switch on the day tank starts the primary online pump. A separate low-low level switch starts the standby pump and annunciates this condition on the standby diesel generator local control panel and in the control room Revision 12 7.3-52 January, 2003
| |
| | |
| by actuating the general diesel generator trouble alarm. Both pumps are stopped by individual high level switches.
| |
| Additional level switches on the day tanks annunciate alarms on the standby diesel generator local control panel and in the control room if the tank level should continue to rise past the high level pump cutoff point or drop below the standby pump start level. Overflow is diverted back to the main storage tank.
| |
| Level switches are provided on the main storage tank to annunciate when fuel oil inventory drops below minimum required levels. Separate alarms are provided, both on the standby diesel generator local control panel and in the main control room, for level corresponding to a seven day supply of fuel oil and for level corresponding to a 24 hour supply of fuel oil. Alarms are also provided for the standby diesel generators only on the local diesel generator control panel for fuel oil transfer pump strainer high pressure drop.
| |
| Actuation of any of the alarms on the local control panel annunciate the diesel generator trouble alarm in the control room.
| |
| Control room indication is provided for the storage and day tank levels. Local indication is provided for transfer pump discharge pressure, fuel oil strainer pressure drop and standby diesel generator day tank level.
| |
| A discussion of diesel generator engine protection interlocks is contained in <Section 8.3>. The detailed description of the fuel oil day tanks, storage tank and fuel transfer system is provided in <Section 9.5.4> for the standby diesel generator, and <Section 9.5.9.1> for the HPCS diesel generators.
| |
| Revision 12 7.3-53 January, 2003
| |
| : 2. Diesel Generator Starting Air System The diesel generator starting air system instrumentation and controls are provided to ensure that an adequate supply of compressed air is always available during plant operation.
| |
| Alarms are provided to alert the plant operators to lack of adequate air pressure in either of each diesels redundant air start systems so that corrective action can be taken. The starting air system is completely described in <Section 9.5.6>
| |
| for the standby diesel generators and <Section 9.5.9.3> for the HPCS diesel generators and is shown on <Figure 9.5-10>.
| |
| Control of each engines two independent air compressors is through controls mounted on a local panel. The compressor may be operated manually by use of a selector switch but the normal mode is automatic operation. The automatic controls cycle the compressor as required to maintain the required receiver tank pressure. A local pressure indicator is provided for each receiver tank.
| |
| To provide for monitoring of starting air availability and interfacing with the standby diesel generator engine controls, a pressure sensing line is routed from just upstream of each pair of air admission solenoid valves on the engine to the local diesel generator control panel. In the control panel these lines connect to the following instrumentation:
| |
| (a) Pressure switches, two pair of switches per air start system, one pair of switches will actuate common starting air pressure low alarms on the local diesel generator control panel and in the control room if either air start receiver reaches the low setpoint. Actuation of the local alarm also actuates the diesel generator trouble alarm in the control room. The second pair of switches Revision 12 7.3-54 January, 2003
| |
| | |
| will actuate the diesel generator out of service alarm in the control room if either air start receiver reaches the low low setpoint.
| |
| (b) Pressure switches, one per air start system, which interlock with the diesel generator LOCA and bus under/degraded voltage start circuit. Inadequate starting air pressure will prevent the corresponding start air admission solenoid valves from opening. This condition is applicable to LOCA and bus under/degraded voltage starts.
| |
| (c) Pressure switches, one per air start system, which control each air compressor.
| |
| (d) Pressure gauges, one per air start system.
| |
| A discussion of engine generator protection interlocks is contained in <Section 8.3>.
| |
| : 3. Diesel Generator Lubrication System The diesel engine lubrication oil system is provided with sensors, controls and alarms as required to ensure complete monitoring of satisfactory system performance, safe engine operation and to alert the plant operators to abnormal conditions requiring investigation and corrective action. For the standby diesel generators, this system is instrumented as shown on <Figure 9.5-11>. For the standby diesel generators, instrumentation and controls are provided to monitor system pressures at important points, lubrication oil temperatures in and out of the engine, sump tank level, and provide automatic operation of the keepwarm circulating pump and heater. The HPCS diesel generator lubricating oil system is detailed in
| |
| <Section 9.5.9.4>.
| |
| Revision 15 7.3-55 October, 2007
| |
| | |
| To alert the plant operators of abnormal conditions which should be investigated for corrective action on the standby diesel generators, alarms are provided for the following parameters:
| |
| (a) Sump Tank Level Low (b) Lube Oil Pressure Low (c) Right Bank Turbocharger Oil Pressure Low (d) Left Bank Turbocharger Oil Pressure Low (e) Lube Oil Filter Pressure Drop High (f) Lube Oil Strainer Pressure Drop High (g) Lube Oil into Engine Temperature Low (h) Lube Oil into Engine Temperature High (i) Lube Oil from Engine Temperature Low (j) Lube Oil from Engine Temperature High (k) Keepwarm Oil Pump/Heater Control Switch not in AUTO (l) Engine Trip due to Low Lube Oil Pressure (m) Engine Trip due to Low Turbocharger Oil Pressure (n) Engine Trip due to High Lube Oil Temperature Revision 12 7.3-56 January, 2003
| |
| | |
| With the exception of the Control Switch not in Auto alarm (Item k.), each condition annunciates a separate alarm on the local diesel generator control panel. The local alarm for Item k. is shared with other control switches which are normally to be in an AUTO position. Actuation of any of the local alarms also annunciate a common diesel generator trouble alarm in the control room. Additionally, those parameters which cause an engine trip (Items l, m, n) are separately annunciated in the control room.
| |
| The three engine trip functions (low lube oil pressure, low turbocharger oil pressure, high lube oil temperature) are only available when the engine is started for non-emergency purposes, e.g., periodic surveillance testing, and serve to trip the engine during normal operation long before damage might occur. When the engine is started by a LOCA or a bus under/degraded voltage signal these three trips are de-activated but not their corresponding alarms. This allows the plant operators to evaluate the operating condition of the engine against overall plant requirements and then make a decision as to whether or not to shut down the diesel generator.
| |
| A bypass of the nonessential trips for the Division 1 diesel generator is provided by a keylock switch (1R43-S122SS) in the Division 1 Engine Control Panel (1H51P054A). This bypass switch will be positioned in the OFF position during normal plant operation. This switch will have no effect on the plant when positioned in the OFF position because this causes the switch contacts to be in an open condition. The switch will be placed in the ON position in the event of a Control Room fire, or there is a need to restart the diesel generator following a high temperature trip.
| |
| Revision 18 7.3-57 October, 2013
| |
| | |
| On the standby diesel generator, the keepwarm oil pump is provided with controls permitting automatic or manual operation. Except for testing or maintenance situations the pump is operated in the AUTO mode and is interlocked with the diesel generator so that the pump runs whenever the diesel generator is not running. The keepwarm heater control is interlocked with the pump so that the heater can only be energized when the pump is running.
| |
| When the standby diesel generator keepwarm pump is running, the heater cycles on and off as demanded by a lubricating oil thermostat located on the engine.
| |
| Revision 17 7.3-57a October, 2011
| |
| | |
| Separate indicators are provided on the standby diesel generator local control panel for lubricating oil pressure, right bank and left bank turbocharger oil pressure and lubricating oil filter differential pressure. Thermocouples in the lubricating oil piping feed signals corresponding to lubricating oil temperature into and from the engine to the multiple position selector switch on the local control panel.
| |
| Through the use of this switch, which also receives signals from the combustion air intake and exhaust system and the engine cooling water system, these temperatures may be displayed on the digital temperature indicator on the local control panel.
| |
| Another set of thermocouples in the lubricating oil piping feed oil temperature in and out of the engine signals to a slow speed temperature recorder in the local control panel.
| |
| This recorder operates continuously and provides a continuous record of important engine temperature for performance monitoring, trending and engine diagnostics.
| |
| : 4. Diesel Generator Cooling Water System The diesel engine cooling water system is designed to remove the heat loads of the engine air intercooler, oil cooler and water jacket. Additional information on this system is provided in <Section 9.5.5> for the standby diesel generators and <Section 9.5.9.2> for the HPCS diesel generators.
| |
| Revision 12 7.3-58 January, 2003
| |
| | |
| 7.3.1.1.16 Fuel Handling Area Exhaust Subsystem The Fuel Handling Area Exhaust Subsystem (FHAES) is a subsystem of the Fuel Handling Area Ventilation System (FHAVS). The FHAES is an ESF System.
| |
| : a. FHAES Function The purpose of the exhaust subsystem is to exhaust air from potentially contaminated areas. The air is filtered and passed through a charcoal filter train prior to discharge to atmosphere via the unit vent.
| |
| : b. FHAES Operation The exhaust subsystem consists of three-50 percent capacity exhaust fans and three-50 percent capacity charcoal filter trains. These filter trains include demisters, roughing filters, electric heating coils, HEPA prefilters, charcoal filters, and HEPA after-filters.
| |
| Schematic arrangements of mechanical equipment and instrumentation for the ESF and non-ESF portions of the Fuel Handling Area Ventilation System are shown on <Figure 9.4-4>.
| |
| Fuel Handling Area Exhaust Subsystem instrumentation is provided for indication in the control room of the following:
| |
| : 1. Indication of which exhaust fans are energized (status light).
| |
| : 2. Low air flow with exhaust fan in operation (alarm).
| |
| : 3. Smoke in exhaust fan common discharge ducts (alarm).
| |
| : 4. High radiation in the exhaust duct (alarm).
| |
| Revision 12 7.3-59 January, 2003
| |
| : 5. High and high-high temperature in the charcoal beds (alarm).
| |
| : 6. FHB HVAC system overload/power lost (alarm).
| |
| : 7. Continuous carbon bed temperature indication on panel H13-P904.
| |
| : 8. Exhaust air high moisture (alarm).
| |
| This system is manually initiated from the control room. During normal operation one supply fan and two exhaust fans operate. High radiation upstream of the charcoal exhaust units alarms in the control room and shuts down the supply fan. The exhaust units continue to run exhausting air through the charcoal filter units.
| |
| 7.3.1.2 Design Basis The ESF systems are designed to provide timely protection against the onset and consequences of conditions that threaten the integrity of the fuel barrier and the reactor coolant pressure boundary. <Chapter 15>
| |
| identifies and evaluates events that jeopardize the fuel barrier and reactor coolant pressure boundary. The methods of assessing barrier damage and radioactive material releases, along with the methods by which abnormal events are identified, are presented in that chapter.
| |
| : a. Variables Monitored to Provide Protective Action The following variables are monitored in order to provide protective actions to the ESF systems:
| |
| : 1. HPCS (a) Reactor Vessel Low Water Level (Trip Level 2)
| |
| Revision 12 7.3-60 January, 2003
| |
| | |
| (b) Drywell High Pressure
| |
| : 2. ADS (a) Reactor Vessel Low Water Level (Trip Level 3)
| |
| (b) Reactor Vessel Low Water Level (Trip Level 1)
| |
| : 3. LPCS and LPCI (a) Reactor Vessel Low Water Level (Trip Level 1)
| |
| (b) Drywell High Pressure
| |
| : 4. CRVICS (a) Reactor Vessel Low Water Level (Trip Level 3)
| |
| (b) Reactor Vessel Low Water Level (Trip Level 2)
| |
| (c) Reactor Vessel Low Water Level (Trip Level 1)
| |
| (d) Main Steam Line High Radiation (e) Main Steam Line Area High Ambient and Differential Temperature (MSL Tunnel), MSL Area High Ambient Temperature (Turbine Bldg).
| |
| (f) Main Steam Line High Flow (g) Turbine Inlet Low Steam Pressure (h) Containment and Drywell Purge and Vent Exhaust High Radiation Revision 12 7.3-61 January, 2003
| |
| | |
| (i) RWCU High Differential Flow (j) RWCU Area High Ambient Temperature and Differential Temperature (k) RHR Area High Ambient Temperature and Differential Temperature (l) Main Condenser Low Vacuum (m) High Drywell Pressure (n) RWCU Heat Exchanger Outlet High Temperature (o) SLCS Actuation (p) Reactor Vessel Pressure
| |
| : 5. (Deleted)
| |
| : 6. RHRS-CSCM (a) Drywell High Pressure (b) Reactor Vessel Water Level (Trip Level 1)
| |
| (c) Containment High Pressure
| |
| : 7. RHRS-SPCM (a) Suppression Pool Temperature (b) Drywell High Pressure Revision 12 7.3-62 January, 2003
| |
| | |
| (c) Reactor Vessel Low Water Level (Trip Level 1)
| |
| : 8. Emergency Water Systems: ESW and ECC (a) RHR, LPCS, RCIC, or Diesel Generator Start (b) HPCS Start (just Loop C of ESW is needed)
| |
| : 9. Containment Combustible Gas Control System (a) Containment hydrogen concentration
| |
| : 10. Standby Power Systems (a) HPCS and Standard Diesel Generator Systems (1) Refer to <Section 8.3.2>
| |
| (b) Diesel Generator Support Systems (1) Fuel Oil Day Tank Level (2) Fuel Oil Main Storage Tank Level (3) Starting Air Receiver Pressure (4) Standby or HPCS Diesel Start
| |
| : 11. Annulus Exhaust Gas Treatment System (AEGTS)
| |
| (a) Reactor Vessel Low Water Level (Trip Level 1)
| |
| (b) Drywell High Pressure Revision 18 7.3-63 October, 2013
| |
| | |
| (c) Annulus to Outside Air Differential (AEGTS only)
| |
| (d) Low Flow (Fan Failure) on the Operating Train
| |
| : 12. Suppression Pool Makeup System (a) Reactor Vessel Low Water Level (Trip Level 1)
| |
| (b) Drywell High Pressure (c) Suppression Pool Low-Low Level
| |
| : 13. Containment Vacuum Relief System (a) Reactor Vessel Low Water Level (Trip Level 2)
| |
| (b) High Drywell Pressure (c) Low Containment to Outside Air Differential Pressure
| |
| : 14. ESF Building and Area HVAC System (a) Reactor Vessel Low Water Level (Trip Level 1)
| |
| (b) High Drywell Pressure (c) Diesel Generator Start Signals (Diesel Generator Building Ventilation System only)
| |
| : 15. Pump Room Cooling Systems (a) ECCS Pump Motor Running (b) RCIC Steam Admission valve Open. (RCIC Pump Room only)
| |
| Revision 12 7.3-64 January, 2003
| |
| : 16. Control Complex HVAC (a) Reactor Vessel Low Water Level (Trip Level 1)
| |
| (b) Drywell High Pressure (c) High Radiation (d) Loss of Offsite Power
| |
| : 17. Fuel Handling Area Ventilation System (a) Charcoal Filter Inlet High Radiation The plant conditions which require protective action involving the ESF systems are described in <Chapter 15> and <Appendix 15A>.
| |
| : b. Location and Minimum Number of Sensors Where applicable in Technical Specifications, the minimum number of sensors is specified to monitor safety-related variables. There are no sensors in the ESF systems which have a spatial dependence.
| |
| : c. Prudent Operational Limits Operational limits for each safety-related variable trip setting are selected with sufficient margin so that a spurious ESF system initiation is avoided. It is then verified by analysis that the release of radioactive materials, following postulated gross failures of the fuel or the nuclear system process barrier, is kept within acceptable bounds.
| |
| Revision 12 7.3-65 January, 2003
| |
| : d. Margin The margin between operational limits and the limiting conditions of operation of ESF systems are accounted for in Technical Specifications.
| |
| : e. Levels Levels requiring protective action are established in Technical Specifications.
| |
| : f. Range of Transient, Steady-State and Environmental Conditions Environmental conditions for proper operation of the ESF components are discussed in <Section 3.11>.
| |
| : g. Malfunctions, Accidents and Other Unusual Events Which Could Cause Damage to Safety System
| |
| <Chapter 15> describes the following credible accidents and events: floods, storms, tornadoes, earthquakes, fires, LOCA, pipe break outside containment. Each of these events is discussed below for the ESF systems.
| |
| : 1. Floods The buildings containing ESF systems components have been designed to meet the PMF (Probable Maximum Flood) at the site location. This ensures that the buildings will remain water-tight under PMF conditions including wind generated wave action and wave runup. For a discussion of internal flooding protection, refer to <Section 3.4.1> and <Section 3.6>.
| |
| Revision 12 7.3-66 January, 2003
| |
| : 2. Storms and Tornadoes The buildings containing ESF systems components have been designed to withstand meteorological events described in
| |
| <Section 3.3>.
| |
| : 3. Earthquakes The structures containing ESF systems components have been seismically qualified as described in <Section 3.7> and
| |
| <Section 3.8>, and will remain functional during and following a safe shutdown earthquake (SSE). Seismic qualification of instrumentation and electrical equipment is discussed in
| |
| <Section 3.10>.
| |
| : 4. Fires To protect the ESF systems in the event of a postulated fire, the redundant portions of the systems are separated by fire barriers. If a fire were to occur within one of the sections or in the area of one of the panels, the ESF systems functions would not be prevented by the fire. The use of separation and fire barriers ensures that even though some portion of the systems may be affected, the ESF systems will continue to provide the required protective action.
| |
| : 5. LOCA The ESF systems components functionally required during and/or following a LOCA have been environmentally qualified to remain functional as discussed in <Section 3.11>.
| |
| Revision 12 7.3-67 January, 2003
| |
| : 6. Pipe Break Outside Secondary Containment This condition will not affect the ESF systems. Refer to
| |
| <Section 3.6>.
| |
| : 7. Missiles Protection for safety-related components is described in
| |
| <Section 3.5>.
| |
| : h. Minimum Performance Requirements Minimum performance requirements for ESF instrumentation and controls are provided in Technical Specifications.
| |
| 7.3.1.3 Final System Drawings The final system drawings, including piping and instrumentation diagrams, flow diagrams and functional control diagrams control logic diagrams, have been provided or referenced for the ESF systems in this section.
| |
| ESF systems elementary diagrams are listed in <Section 1.7.1>.
| |
| 7.3.2 ANALYSIS 7.3.2.1 ESF Systems - Instrumentation and Controls
| |
| <Chapter 15> evaluates the individual and combined capabilities of the ESF systems.
| |
| The ESF systems are designed such that a loss of instrument air, a plant load rejection or a turbine trip will not prevent the completion of the safety function.
| |
| Revision 12 7.3-68 January, 2003
| |
| | |
| 7.3.2.1.1 Conformance to <10 CFR 50 Appendix A>
| |
| The following is a discussion of conformance to those General Design Criteria which apply specifically to the ESF systems. Refer to
| |
| <Section 7.1.2.2> for a discussion of General Design Criteria which apply equally to all safety-related systems.
| |
| : a. Criterion 33 See <Section 7.3.1.1.1> (HPCS).
| |
| : b. Criterion 34 See <Section 7.3.1.1.1> (ECCS) and <Section 7.3.1.1.6> (EWS).
| |
| : c. Criterion 35 See <Section 7.3.1.1.1> (ECCS) and <Section 7.3.1.1.6> (EWS).
| |
| : d. Criterion 37, 46 See <Section 7.3.2.1.3> <Regulatory Guide 1.22>.
| |
| : e. Criterion 38 See <Section 7.3.1.1.4> (RHRS-CSCM), <Section 7.3.1.1.5>
| |
| (RHRS-SPCM) and <Section 7.3.1.1.6> (EWS).
| |
| : f. Criterion 40 See <Section 7.3.1.1.4> (RHR-CSCM) and <Section 7.3.1.1.5>
| |
| (RHRS-SPCM).
| |
| Revision 12 7.3-69 January, 2003
| |
| : g. Criterion 41 See <Section 7.3.1.1.11> (CCGC) and <Section 7.3.1.1.9> (AEGTS).
| |
| : h. Criterion 44 See <Section 7.3.1.1.6> (EWS)
| |
| : i. Criterion 64 See <Section 7.3.1.1.4> (CRVICS).
| |
| 7.3.2.1.2 Conformance to IEEE Standards The following is a discussion of conformance to those IEEE standards which apply specifically to the ESF systems. Refer to <Section 7.1.2.3>
| |
| for a discussion of IEEE standards which apply equally to all safety-related systems.
| |
| : a. IEEE Standard 279 Criteria for Protection Systems for Nuclear Power Generating Stations
| |
| : 1. General Functional Requirement (IEEE Standard 279, Paragraph 4.1)
| |
| The ESF systems automatically initiates the appropriate protective actions, whenever the parameters described in
| |
| <Section 7.3.1.2.a> reach predetermined limits, with precision and reliability, assuming the full range of conditions and performance discussed in <Section 7.3.1.2>.
| |
| Revision 12 7.3-70 January, 2003
| |
| : 2. Single Failure Criterion (IEEE Standard 279, Paragraph 4.2)
| |
| ESF systems are not required to meet single failure criteria on an individual system (division) basis. However, on a network basis, the single failure criteria does apply to assure the completion of a protective function. Redundant sensors, wiring, logic, and actuated devices are physically and electrically separated such that a single failure will not prevent the protective function. Refer to <Section 8.3.1.4>
| |
| for additional discussion of the PNPP separation criteria.
| |
| : 3. Quality Components (IEEE Standard 279, Paragraph 4.3)
| |
| For a discussion of the quality of ESF system components and modules, refer to <Section 3.11>.
| |
| : 4. Equipment Qualification (IEEE Standard 279, Paragraph 4.4)
| |
| Qualification tests of the relay panels are conducted to confirm their adequacy for this service. In situ operational testing of these sensors, channels and other entire protection system will be performed during the preoperational test phase.
| |
| For a complete discussion of ESF equipment qualification, refer to <Section 3.2>, <Section 3.10> and <Section 3.11>.
| |
| : 5. Channel Integrity (IEEE Standard 279, Paragraph 4.5)
| |
| For a discussion of ESF systems channel integrity under all extremes of conditions described in <Section 7.3.1.2>, refer to <Section 3.10>, <Section 3.11>, <Section 8.2.1>, and
| |
| <Section 8.3.1>.
| |
| Revision 12 7.3-71 January, 2003
| |
| : 6. Channel Independence (IEEE Standard 279, Paragraph 4.6)
| |
| ESF systems channel independence is maintained through the application of the PNPP separation criteria as described in
| |
| <Section 8.3.1.4>.
| |
| : 7. Control and Protection Interaction (IEEE Standard 279, Paragraph 4.7)
| |
| There are no ESF system and control system interactions.
| |
| : 8. Derivation of System Inputs (IEEE Standard 279, Paragraph 4.8)
| |
| The ESF variables are direct measures of the desired variables requiring protective actions. Refer to <Section 7.3.1.1>.
| |
| : 9. Capability of Sensor Checks (IEEE Standard 279, Paragraph 4.9)
| |
| Refer to <Section 7.3.2.1.3>, <Regulatory Guide 1.22>.
| |
| : 10. Capability for Test and Calibration (IEEE Standard 279, Paragraph 4.10)
| |
| Refer to <Section 7.3.2.1.3>, <Regulatory Guide 1.22>.
| |
| : 11. Channel Bypass or Removal from Operation (IEEE Standard 279, Paragraph 4.11)
| |
| During periodic test of any one ESF system channel, a sensor or trip unit may be taken out-of-service and returned to service under the administrative control procedures. Since only one sensor or trip unit is taken out-of-service at any Revision 12 7.3-72 January, 2003
| |
| | |
| given time during the test interval, protective action capability for ESF system automatic initiation is maintained through the remaining redundant instrument channels.
| |
| : 12. Operating Bypasses (IEEE Standard 279, Paragraph 4.12)
| |
| The ESF systems contain the following operating bypasses.
| |
| The CRVICS has four bypasses:
| |
| (a) Main steam line low pressure operating bypass which is imposed by means of the mode switch. In all modes except run, the mode switch cannot be left in this position above 10 percent of rated power without initiating a scram. Therefore, the bypass is removed by the normal reactor operating sequence.
| |
| (b) The low condenser vacuum bypass which is imposed by means of a manual bypass switch.
| |
| (c) The RWCU bypass which is imposed by means of a manual bypass switch. This bypass applies to the RWCU isolation signal originating from the leak detection system.
| |
| (d) The reactor vessel low water (Level 1) MSIV isolation bypass which is imposed by means of manual key locked bypass switches.
| |
| : 13. Indication of Bypasses (IEEE Standard 279, Paragraph 4.13)
| |
| For a discussion of bypass and inoperability indication, refer to <Section 7.1.2.4>, <Regulatory Guide 1.47>.
| |
| Revision 12 7.3-73 January, 2003
| |
| : 14. Access to Means for Bypassing (IEEE Standard 279, Paragraph 4.14)
| |
| Access to means of bypassing any safety action or function for the ESF systems is under the administrative control of the control room operator. The operator is alerted to bypasses as described in <Section 7.1.2.4>, <Regulatory Guide 1.47>.
| |
| Control switches which allow system bypasses are keylocked.
| |
| All keylock switches in the control room are designed such that the key can only be removed when the switch is in the safe position. All keys will normally be removed from their respective switches during operation and maintained under the control of the Shift Manager.
| |
| : 15. Multiple Trip Settings (IEEE Standard 279, Paragraph 4.15)
| |
| There are no multiple set points within the ESF systems.
| |
| : 16. Completion of Protective Action Once Initiated (IEEE Standard 279, Paragraph 4.16)
| |
| Each of the automatically initiated ESF system control logics seal-in electrically and remain energized after initial conditions return to normal. Deliberate operator action is required to return (reset) an ESF system logic to normal.
| |
| : 17. Manual Initiation (IEEE Standard 279, Paragraph 4.17)
| |
| Refer to the discussion of <Regulatory Guide 1.62> in
| |
| <Section 7.3.2.1.3>.
| |
| : 18. Access to Setpoint Adjustments (IEEE Standard 279, Paragraph 4.18)
| |
| Revision 12 7.3-74 January, 2003
| |
| | |
| All access to ESF system set point adjustments, calibration controls and test points are under the administrative control of the control room operator. Setpoint adjustments for all safety-related trip units are located in the control room behind keylocked tamper guards.
| |
| : 19. Identification of Protective Actions (IEEE Standard 279, Paragraph 4.19)
| |
| ESF protective actions are directly indicated and identified by annunciators located in the control room and a typed record is available from the process computer.
| |
| : 20. Information Readout (IEEE Standard 279), Paragraph 4.20)
| |
| The ESF systems are designed to provide the operator with accurate and timely information pertinent to their status.
| |
| They do not introduce signals that could cause anomalous indications confusing to the operator.
| |
| : 21. System Repair (IEEE Standard 279, Paragraph 4.21)
| |
| The ESF systems are designed to permit repair or replacement of components.
| |
| Recognition and location of a failed component will be accomplished during periodic testing or by annunciation in the control room.
| |
| : 22. Identification of Protection Systems (IEEE Standard 279, Paragraph 4.22)
| |
| The identification scheme for the ESF system is discussed in
| |
| <Section 8.3.1>.
| |
| Revision 12 7.3-75 January, 2003
| |
| | |
| 7.3.2.1.3 Conformance to Regulatory Guides The following is a discussion of conformance to those regulatory guides which apply specifically to the ESF systems. Refer to <Section 7.1.2.4>
| |
| for a discussion of regulatory guides which apply equally to all safety-related systems.
| |
| : a. <Regulatory Guide 1.7>
| |
| For Control of Combustible Gas Concentrations in Containment following LOCA, refer to <Section 1.8>.
| |
| : b. <Regulatory Guide 1.22>
| |
| The ESF systems instrumentation and controls are capable of being tested during normal plant operation, unless that testing is detrimental to plant availability, to verify the operability of each system component. Testing of safety-related sensors is accomplished by valving out each sensor, one at a time, and applying a test pressure source. The main steam line radiation sensors may be removed and test sources applied. The combustible gas control system sensors are tested by introducing sample gases of known analysis. This verifies the operability of the sensor and the associated logic components in the control room. Functional operability of temperature sensors may be verified by readout comparisons, applying a heat source to the locally mounted temperature sensing elements or by continuity testing.
| |
| For the HPCS, LPCS and LPCI, testing for functional operability of the control logic relays can be accomplished by use of plug-in test jacks and switches in conjunction with single sensor tests.
| |
| Four test jacks are provided to allow ADS logic testing one for each logic channel. During testing, only one logic should be Revision 12 7.3-76 January, 2003
| |
| | |
| actuated at a time. However, when the test plug is plugged into one channel, the complement channel of that trip system is automatically rendered inoperative. Therefore, inadvertent ADS actuation cannot occur even if both channels are improperly placed in the test mode simultaneously. An alarm is provided if a test plug is inserted in either channel in a division. Operation of the test plug switch and the permissive contacts will close one of the two series relay contacts in the valve solenoid circuit. This will cause a panel light to come on indicating proper channel operation.
| |
| Annunciation is provided in the control room whenever a test plug is inserted in a jack to indicate to the operator that an ECCS is in a test status.
| |
| Operability of air operated, solenoid operated and motor-operated valves is verified by actuating the valve control switches and monitoring the position change by position indicating lights at the control switch.
| |
| The ESF systems are provided with indications, status displays, annunciation, and computer printouts which aid the control room operator during period system tests to verify component operability.
| |
| : c. <Regulatory Guide 1.53>
| |
| Refer to IEEE Standard 279 Paragraph 4.2, <Section 7.3.2.1.2>.
| |
| : d. <Regulatory Guide 1.62> - Manual Initiation of Protective Actions The HPCS, LPCS and the Division 2 LPCI system are manually initiated at the system level from the control room by actuation of a switch. The LPCS switch also initiates the Division 1 LPCI system.
| |
| Revision 12 7.3-77 January, 2003
| |
| | |
| The ADS and the CRVICS are manually initiated at the system (division) level by actuation of two switches (one for each logic channel).
| |
| The RHRS containment spray cooling mode is manually initiated at the system (division) level by actuation of the RHR pump start control switch and by opening the Containment Spray or Suppression Chamber Spray valves.
| |
| The RHRS suppression pool cooling mode is manually initiated from the main control room by actuation of system pump and valve controls.
| |
| All ESF and ESF supporting systems are provided with manual actuation at the system and or component level. These actuations are discussed in the system operation section for each system.
| |
| The actuation of the system level manual initiation switches simulate all the actions of automatic or manual (individual equipment initiation) system actuation.
| |
| : e. <Regulatory Guide 1.73> - Qualification Testing of Electric Motor Operators installed Inside the Containment of Nuclear Power Plants See <Section 3.10> and <Section 3.11> for discussion of compliance.
| |
| : f. <Regulatory Guide 1.95> - Protection of Nuclear Power Plant Control Room Operators Against an Accidental Chlorine Release See <Section 1.8> for discussion of compliance.
| |
| Revision 12 7.3-78 January, 2003
| |
| : g. <Regulatory Guide 1.96> - Design of Main Steam Isolation valve Leakage Control System for Boiling Water Reactor Nuclear Power Plants MSIV-LCS has been eliminated and is abandoned in place.
| |
| Revision 12 7.3-79 January, 2003
| |
| | |
| TABLE 7.3-1 ISOLATION SYSTEM INSTRUMENTATION RESPONSE TIME TABLE Trip Function Response Time (seconds) Notes MAIN STEAM LINE ISOLATION
| |
| : 1. Reactor Vessel Water Level (1)(2)(3)
| |
| - Low, Level 1 1.0 See Note (1)(2)(3)
| |
| : 2. Main Steam Line Pressure - Low 1.0 See Note (1)(2)(3)
| |
| : 3. Main Steam Line Flow - High 0.5 See Note NOTES:
| |
| (1)
| |
| Isolation system instrumentation response time specified for the Trip function actuating each containment isolation valve shall be added to the isolation time for each valve to obtain ISOLATION SYSTEM RESPONSE TIME for each valve.
| |
| (2)
| |
| Isolation system instrumentation response time for MSIVs only. No diesel generator delays assumed.
| |
| (3)
| |
| The sensor is not included in the response time testing for these circuits. Response time testing for the remaining channel including trip unit and relay logic is required.
| |
| Revision 12 7.3-80 January, 2003
| |
| | |
| 7.4 SYSTEMS REQUIRED FOR SAFE SHUTDOWN 7.
| |
| | |
| ==4.1 DESCRIPTION==
| |
| | |
| This section discusses the instrumentation and controls of the following systems required for safe plant shutdown:
| |
| : a. Reactor Core Isolation Cooling (RCIC) System
| |
| : b. Standby Liquid Control System (SLCS)
| |
| : c. RHRS Shutdown Cooling Mode (RSCM)
| |
| : d. Remote Shutdown System (RSS)
| |
| The sources which supply power to the safe shutdown systems originate from onsite ac and/or dc safety-related buses. Refer to <Chapter 8> for a complete discussion of the safety-related power sources.
| |
| 7.4.1.1 Reactor Core Isolation Cooling (RCIC) System
| |
| : a. RCIC System Function The reactor core isolation cooling system <Section 5.4.6>
| |
| instrumentation is designed to maintain or supplement reactor vessel water inventory during the following conditions:
| |
| : 1. When the reactor vessel is isolated from its primary heat sink (the main condenser) and maintained in the hot standby condition.
| |
| : 2. When the reactor vessel is isolated and accompanied by a loss of normal coolant flow from the reactor feedwater system.
| |
| 7.4-1 Revision 12 January, 2003
| |
| : 3. When the plant is being shutdown and normal coolant flow from the feedwater system is lost before the reactor is depressurized to a level where the reactor shutdown cooling mode of the RHR system can be placed into operation.
| |
| : b. RCIC System Operation Schematic arrangements of system mechanical equipment is shown in
| |
| <Figure 5.4-9>. RCIC system component control logic is shown in
| |
| <Figure 7.4-1>. Plant layout drawings are shown in <Section 1.2>
| |
| and elementary diagrams are listed in <Section 1.7.1>. Operator information displays are shown in <Figure 5.4-9> and
| |
| <Figure 7.4-1>.
| |
| The RCIC system can be initiated either manually or automatically.
| |
| The control room operator can initiate RCIC by operating the manual initiation switch which simulates an automatic initiation or by activating each piece of equipment sequentially as required.
| |
| RCIC is automatically initiated by four redundant differential pressure transmitters/trip relay contacts, arranged in a one-out-of-two-twice logic configuration, which sense reactor vessel low water trip (trip Level 2).
| |
| The RCIC steam line isolation motor-operated (MO) inboard valve, the RCIC steam line isolation MO outboard valve, and the turbine exhaust to the suppression pool MO valve are in the open position and they require no change of position for automatic system initiation.
| |
| 7.4-2 Revision 12 January, 2003
| |
| | |
| The RCIC system responds to an automatic initiation signal and reaches design flow rate within 30 seconds as follows (actions are simultaneous unless stated otherwise):
| |
| : 1. The pump suction from the condensate storage tanks valve E51F010 is signaled open.
| |
| : 2. To ensure that pump discharge flow is directed to the reactor vessel only, the test return line to the condensate storage tank valves E51F022 and E51F059 are signaled closed.
| |
| : 3. The turbine steam inlet valve 1E51F0045 is signaled to open.
| |
| : 4. When the turbine steam inlet valve E51F045 starts to open, the RCIC pump discharge to reactor vessel valve E51F013 is signaled open. Valve E51F013 is prohibited from opening or, if open, automatically closes when E51F045 or the turbine trip and throttle valve is closed.
| |
| : 5. The turbine gland seal compressor is signaled to start.
| |
| : 6. When valve E51F045 leaves the closed position, the RCIC turbine speed accelerates until the automatic flow controller set point is reached and the system discharge flow is controlled by the turbine electronic governor mechanism.
| |
| If water level in the condensate storage tanks becomes low, RCIC pump suction is automatically transferred from the condensate storage tank to the suppression pool by opening valve E51F031.
| |
| When the Control Room is notified of the issuance of a tornado warning for the vicinity of the plant, or if a tornado is sighted in the immediate vicinity of the plant, administrative controls 7.4-3 Revision 12 January, 2003
| |
| | |
| require the RCIC suction to be aligned to the tornado missile protected suppression pool. Once valve F031 is fully open, the condensate storage tank valve E51F010 is automatically closed.
| |
| The RCIC system includes design features which provide system equipment protection or accomplish containment isolation if certain types of abnormal events occur. The turbine is either manually trip actuated by the control room operator or automatically shut down by closing the turbine trip and throttle valve if any of the following conditions are detected:
| |
| : 1. Turbine overspeed
| |
| : 2. High turbine exhaust pressure
| |
| : 3. RCIC isolation signal
| |
| : 4. Low pump suction pressure To protect the RCIC pump from overheating during low flow conditions, the pump discharge flow and pressure are monitored. If the pump discharge pressure transmitter indicates that the pump is running and the pump discharge flow transmitter indicates low flow, the minimum flow return line valve E51F019 is automatically opened.
| |
| The minimum flow valve is automatically closed when flow is normal or when either the turbine trip and throttle valve or the steam inlet valve E51F045 is closed.
| |
| High water level in the reactor vessel indicates that the RCIC system has performed satisfactorily in providing make up water to the reactor vessel. Further increase in level could result in RCIC system turbine damage caused by gross carry-over of moisture. To prevent this, a high water level trip is used to initiate closure 7.4-4 Revision 12 January, 2003
| |
| | |
| of steam supply valve E51F045, to shut off the steam to the turbine and halt RCIC operation. The system will automatically reinstate if the water level decreases to the reactor water low level trip point.
| |
| Air operated (AO) valves E51F025, F026, and F054, and a condensate drain pot are provided in a drain pipeline arrangement just upstream of the turbine supply valve. The water level in the steam line drain condensate pot is controlled by a level switch and valve E51F054 which energizes to allow condensate to flow out of the drain pot by bypassing the steam trap. The drainage path is isolated by closing E51F025 and E51F026 upon receipt of an RCIC initiation signal.
| |
| RCIC steam turbine exhaust line vacuum breaker valves E51F077, E51F078 and turbine exhaust to suppression pool MO E51F068 are normally open but close automatically following system trip on low steam line pressure if drywell pressure exceeds the setpoint.
| |
| Detection of abnormal conditions by redundant leak detection portions of the RCIC system will cause system isolation as follows:
| |
| : 1. Division 1 circuitry will override the manual control switches and signal the outboard steamline isolation valve F064 and pump suction to suppression pool valve F031 to close.
| |
| : 2. Division 2 circuitry will override the manual control switches and signal the inboard steamline isolation valve F063 and steamline warmup valve F076 to close.
| |
| The conditions that will initiate the isolation are:
| |
| : 1. RCIC low steamline pressure.
| |
| 7.4-5 Revision 12 January, 2003
| |
| : 2. RCIC steam supply line high differential pressure.
| |
| : 3. Main steam tunnel high ambient or differential (inlet/outlet) ventilation air temperature.
| |
| : 4. RHR equipment area high ambient or differential (inlet/outlet) ventilation air temperature. Differential temperature instrumentation is required to provide the leak detection isolation signal only when the room coolers are running.
| |
| : 5. RCIC turbine exhaust diaphragm high pressure.
| |
| : 6. RCIC equipment area high ambient temperature.
| |
| For a complete description of the RCIC system leak detection isolation signals, see <Section 7.6.1>.
| |
| The RCIC system may be isolated after initiation by the control room operator by actuation of a switch which causes the outboard steamline isolation valve to close.
| |
| 7.4.1.2 Standby Liquid Control System (SLCS)
| |
| : a. SLCS Function The standby liquid control system <Section 9.3.5> instrumentation is designed to manually initiate injection of a liquid neutron absorber into the reactor. Other instrumentation is provided to maintain this liquid chemical solution well above saturation temperature in readiness for injection.
| |
| 7.4-6 Revision 12 January, 2003
| |
| | |
| The SLCS is a backup independent method of manually shutting down the reactor to cold shutdown conditions from normal operation or from anticipated transient conditions when control rod insertion capability is lost.
| |
| : b. SLCS Operation Schematic arrangements of system mechanical equipment is shown in
| |
| <Figure 9.3-19>. SLCS component control logic is shown in
| |
| <Figure 7.4-2>, with applicable drawings listed in <Section 1.7.1>.
| |
| Operator information displays are shown in <Figure 9.3-19> and
| |
| <Figure 7.4-2>.
| |
| The SLCS is initiated by the control room operator by turning a keylocked switch for system A, or a different keylocked switch for system B to the ON position. The key is removable in the OFF position. Should the selected pump fail to start, the other key switch may be used to select the alternate pump loop.
| |
| When the SLCS is initiated, the explosive-operated valve in the selected loop fires and the tank discharge valve starts to open immediately. The pump that has been selected for injection will not start until the tank discharge valve is fully open.
| |
| Pumps are interlocked so that either the storage tank discharge valve or the test tank discharge valve must be open for the pump to run unless the pumps are being tested using the momentary contact pump test switch. When SLCS system A is initiated the outboard RWCU isolation valve is automatically closed and when SLCS system B is initiated the inboard RWCU isolation valve is automatically closed.
| |
| 7.4-7 Revision 12 January, 2003
| |
| | |
| 7.4.1.3 RHRS/Reactor Shutdown Cooling Mode (RSCM)
| |
| : a. RSCM Function The Reactor Shutdown Cooling Mode <Section 5.4.7> of the RHR System is used during a normal reactor shutdown.
| |
| The RSCM consists of instrumentation designed to provide decay heat removal capability for the reactor core by accomplishing the following:
| |
| : 1. Reactor cooling during shutdown operation after the vessel pressure is reduced to approximately 130 psig.
| |
| : 2. Cooling the reactor water to a temperature at which reactor refueling and servicing can be accomplished.
| |
| : 3. Diverting part of the shutdown flow to the reactor vessel head to condense the steam generated from the hot walls of the vessel while it is being flooded.
| |
| : b. RSCM Operation The reactor shutdown cooling system contains two loops. Either loop is sufficient to satisfy the cooling requirements for shutdown cooling. However, both loops share a common suction line with two suction valves in series. In the event that one of the suction valves fails closed and normal shutdown cooling is not available, an alternate shutdown cooling loop may be established. The normal shutdown suction path may be bypassed by manually switching to take suction water from the suppression pool, returning through the LPCI line and manually opening the ADS valves to allow reactor water to flow back through the SRV discharge line to the suppression pool.
| |
| 7.4-8 Revision 12 January, 2003
| |
| | |
| The ADS valves may be actuated by either Division 1 or Division 2 power, thus providing redundancy in the event of a divisional power failure.
| |
| See <Section 5.4.7> for a complete description of the RSCM operation.
| |
| 7.4.1.4 Remote Shutdown System (RSS)
| |
| : a. RSS Function The RSS is designed to achieve a cold reactor shutdown from outside the control room following these postulated conditions:
| |
| : 1. The plant is at normal operating conditions and all plant personnel have been evacuated from the control room and it is inaccessible.
| |
| : 2. The initial event that causes the control room to become inaccessible is assumed to be such that the reactor operator can manually scram the reactor before leaving the control room. Two backup means of scramming the reactor from outside the control room are available. This can be accomplished by opening the output breakers at ATWS UPS distribution panels EVIA and EVIB or by opening the output breakers of the RPS MG sets.
| |
| : 3. Under normal conditions, the main turbine pressure regulators may be controlling reactor pressure via the bypass valves. It is assumed that this turbine generator control panel function is also lost. In the event of a pressure decrease to the MSIV isolation setpoint, the inboard MSIVs will be shut from the 7.4-9 Revision 12 January, 2003
| |
| | |
| Division 1 remote shutdown panel. Increases in reactor pressure will be relieved through the safety relief valves to the suppression pool.
| |
| : 4. The reactor feedwater system which is normally available is also assumed to be inoperable. Reactor vessel water inventory is provided by the RCIC system.
| |
| The RSS is required only during times of control room inaccessibility when normal plant operating conditions exist (i.e.,
| |
| no transients or accidents are occurring).
| |
| : b. Remote Shutdown System Operation Some of the existing systems used for normal reactor shutdown operation are also utilized in the remote shutdown capability to shut down the reactor from outside the control room. The Division 1 remote shutdown capability is designed to control the required shutdown systems from outside the control room irrespective of hot shorts, open circuits, or shorts to ground in the associated control room circuits that may have resulted from an event causing an evacuation (for example, a damaging fire in the control room). The functions needed for Division 1 remote shutdown control are provided with manual transfer switches at the remote shutdown panel which override controls from the control room, provide complete electrical isolation of the associated control room circuits, and transfer the controls to the Division 1 remote shutdown panel. Division 1 remote shutdown control is not possible without actuation of the transfer devices. All necessary power supplies and control logic are also transferred. Operation of the transfer devices used to transfer control of devices from the control room to the Division 1, remote shutdown panel, causes an alarm in the control room. Access to the Division 1 remote shutdown panel is administratively and procedurally controlled.
| |
| Revision 15 7.4-10 October, 2007
| |
| | |
| Most system equipment (i.e., valves and pumps) necessary for proper system lineup and complete system control are located on the Division 1 Revision 15 7.4-10a October, 2007
| |
| | |
| remote shutdown panel. Additional equipment required for remote shutdown capability are provided with combination transfer/control switches located on associated MCC doors (valves) and local panels (fans, chillers, pumps). Operation of these transfer/control switches causes an alarm in the control room by de-energizing voltage monitor relays. Equipment required for remote shutdown capability that has only voltage monitoring and/or indicating light circuits in the control room are provided with isolating fuses.
| |
| Redundant remote shutdown capability is provided using the Division 2 remote shutdown controls. These controls are designed to parallel the controls from the control room. All signals required for the Division 2 remote shutdown panel will be supplied from the ERIS data acquisition cabinet. An indicating panel for the Division 2 remote shutdown system is located in the Division 2 switchgear room. The Division 2 remote shutdown is controlled by pull-to-lock switches mounted on the switchgear and MCC panels.
| |
| The pull-to-lock switches are used to control pumps and valves of associated essential safe shutdown systems.
| |
| Manual activation of safety relief valves and the initiation of the reactor core isolation cooling (RCIC) system will maintain reactor water inventory and bring the reactor to a hot shutdown condition after scram. In the case of the Division 2 remote shutdown system, assume that automatic initiation of HPCS has occurred, thereby providing for RCIC system backup. During this phase of shutdown, the suppression pool will be cooled by operating the residual heat removal (RHR) system in the suppression pool cooling mode. Reactor pressure will be controlled and core decay and sensible heat rejected to the suppression pool by relieving steam pressure through the relief valves.
| |
| This procedure will cool the reactor and reduce its pressure at a controlled rate until reactor pressure becomes so low that the RCIC 7.4-11 Revision 12 January, 2003
| |
| | |
| system is unable to sustain operation. The RHR system will then be operated in the shutdown cooling mode using the RHR system heat exchanger to cool reactor water and bring the reactor to the cold low pressure condition.
| |
| : 1. Reactor Core Isolation Cooling (RCIC) System The following RCIC System equipment/functions have transfer and control switches located on the Division 1 remote shutdown control panel:
| |
| E51-F010: Motor-operated valve (pump suction from condensate storage)
| |
| E51-F013: Motor-operated valve (RCIC injection shutoff)
| |
| E51-F019: Motor-operated valve (minimum flow to suppression pool)
| |
| E51-F022: Motor-operated valve (test bypass to condensate storage)
| |
| E51-C004: Gland seal system air compressor E51-F031: Motor-operated valve (pump suction from suppression pool)
| |
| E51-F045: Motor-operated valve (steam to turbine)
| |
| E51-F059: Motor-operated valve (test bypass to condensate storage)
| |
| E51-F063: Motor-operated valve (steam supply line isolation inboard)
| |
| E51-F064: Motor-operated valve (steam supply line isolation, outboard)
| |
| E51-F068: Motor-operated valve (turbine exhaust to suppression pool)
| |
| E51-F076: Motor-operated valve (steam line warmup line isolation) 7.4-12 Revision 12 January, 2003
| |
| | |
| E51-F077: Motor-operated valve (vacuum breaker isolation outboard)
| |
| E51-F078: Motor-operated valve (vacuum breaker isolation inboard)
| |
| E51-F510: Motor-operated valve (turbine trip and throttle valve)
| |
| See <Figure 5.4-10>.
| |
| The following RCIC system instrumentation is provided on the Division 1 remote shutdown control panel:
| |
| C61-R001: RCIC flow controller and indicator C61-R003: RCIC turbine speed indicator Indicating lights are provided for conditions of turbine tripped, turbine bearing oil low pressure, turbine governor bearing oil temperature high, and turbine coupling end bearing oil temperature high.
| |
| Valve position and pump status indicators are also provided.
| |
| : 2. Residual Heat Removal (RHR) System The following RHR system loop A equipment/functions have transfer and control switches located at the Division 1 remote shutdown control panel:
| |
| E12-C002A: Residual heat removal pump E12-F003A: Motor-operated valve (heat exchanger shell side outlet)
| |
| E12-F004A: Motor-operated valve (RHR pump suction)
| |
| E12-F006A: Motor-operated valve (shutdown cooling)
| |
| E12-F006B: Motor-operated valve (shutdown cooling) 7.4-13 Revision 12 January, 2003
| |
| | |
| E12-F008: Motor-operated valve (outboard shutdown isolation)
| |
| E12-F009: Motor-operated valve (inboard suction isolation)
| |
| E12-F011A: Motor-operated valve (RHR heat exchanger flow to suppression pool)
| |
| E12-F023: Motor-operated valve (reactor head spray)
| |
| E12-F024A: Motor-operated valve (RHR test line)
| |
| E12-F027A: Motor-operated valve (injection shutoff)
| |
| E12-F028A: Motor-operated valve (containment spray)
| |
| E12-F037A: Motor-operated valve (shutoff upper pool cooling)
| |
| E12-F042A: Motor-operated valve (RHR injection)
| |
| E12-F047A: Motor-operated valve (heat exchanger shell side inlet)
| |
| E12-F048A: Motor-operated valve (heat exchanger shell side bypass)
| |
| E12-F040: Motor-operated valve (discharge to radwaste)
| |
| E12-F053A: Motor-operated valve (RHR injection)
| |
| E12-F064A: Motor-operated valve (RHR pump minimum flow)
| |
| E12-F609: Motor-operated valve (SPCU to RHR second outboard isolation)
| |
| The following RHR system loop B equipment/functions have control switches located at their respective motor control centers or switchgear panels:
| |
| E12-C002B: Residual heat removal pump E12-F003B: Motor-operated valve (heat exchanger shell side outlet)
| |
| E12-F004B: Motor-operated valve (RHR pump suction)
| |
| E12-F011B: Motor-operated valve (RHR heat exchanger flow to suppression pool)
| |
| E12-F024B: Motor-operated valve (RHR test line)
| |
| E12-F027B: Motor-operated valve (injection shutoff)
| |
| E12-F028B: Motor-operated valve (containment spray)
| |
| E12-F037B: Motor-operated valve (shutoff upper pool cooling) 7.4-14 Revision 12 January, 2003
| |
| | |
| E12-F042B: Motor-operated valve (RHR injection)
| |
| E12-F047B: Motor-operated valve (heat exchanger shell side inlet)
| |
| E12-F048B: Motor-operated valve (heat exchanger shell side bypass)
| |
| E12-F053B: Motor-operated valve (RHR injection)
| |
| E12-F064B: Motor-operated valve (RHR pump minimum flow)
| |
| See <Figure 5.4-13>.
| |
| The following RHR instrumentation is located on the Division 1 remote shutdown control panel:
| |
| C61-R005: RHR flow indicator for loop A The following RHR instrumentation is located on the Division 2 remote shutdown indicating panel:
| |
| C61-R025: RHR flow indicator for loop B.
| |
| Valve position status indication and pump status indication.
| |
| : 3. Nuclear Boiler System The following functions have transfer and control switches located at the Division 1 remote shutdown control panel and control switches at the Division 2 remote shutdown control panel:
| |
| B21-F051C: Air operated safety relief valve B21-F051G: Air operated safety relief valve B21-F051D: Air operated safety relief valve 7.4-15 Revision 12 January, 2003
| |
| | |
| The following functions have transfer and control switches located at the Division 1 remote shutdown control panel:
| |
| B21-F022A: Inboard main steam line A isolation valve.
| |
| B21-F022B: Inboard main steam line B isolation valve.
| |
| B21-F022C: Inboard main steam line C isolation valve.
| |
| B21-F022D: Inboard main steam line D isolation valve.
| |
| The following function has transfer/control switches located on the associated MCC compartment door:
| |
| B21-F019: Motor-operated valve (main steam line drain isolation)
| |
| The following nuclear boiler instrumentation is provided on the Division 1 remote shutdown control panel:
| |
| C61-R012: Reactor pressure/level recorder C61-R010: Reactor level indicator C61-R011: Reactor pressure indicator The following nuclear boiler instrumentation is provided on the Division 2 remote shutdown control panel:
| |
| C61-R030: Reactor level indicator C61-R031: Reactor pressure indicator Valve position status indicators.
| |
| See <Figure 5.1-3>
| |
| 7.4-16 Revision 12 January, 2003
| |
| : 4. Reactor Water Cleanup System The following function has transfer/control switches located on the associated MCC compartment door:
| |
| G33-F004: Motor-operated valve (reactor water cleanup discharge isolation).
| |
| : 5. Emergency Service Water System The following loop A emergency service water system equipment/functions have transfer and control switches located at the remote shutdown control panel:
| |
| P45-F014A: Motor-operated valve (RHR heat exchanger isolation)
| |
| P45-F068A: Motor-operated valve (RHR heat exchanger isolation)
| |
| P45-F130A: Motor-operated valve (pump discharge shutoff)
| |
| P45-C001A: Emergency service water pump The following loop B emergency service water system equipment/functions have control switches located on the associated motor control centers and switchgear panels:
| |
| P45-F014B: Motor-operated valve (RHR heat exchanger isolation)
| |
| P45-F068B: Motor-operated valve (RHR heat exchanger isolation)
| |
| P45-F130B: Motor-operated valve (pump discharge shutoff)
| |
| P45-C001B: Emergency service water pump See <Figure 9.2-1>.
| |
| 7.4-17 Revision 12 January, 2003
| |
| | |
| The following emergency service water system instrumentation is provided on the Division 1 remote shutdown control panel:
| |
| P45-R033A: Flow indicator (RHR heat exchanger A)
| |
| P45-R055A: Flow indicator (ECC system heat exchanger A)
| |
| The following emergency service water system instrumentation is provided on the Division 2 remote shutdown control panel:
| |
| P45-R033B: Flow indicator (RHR heat exchanger B)
| |
| P45-R055B: Flow indicator (ECC system heat exchanger B)
| |
| Valve position and pump status indicators.
| |
| : 6. Emergency Closed Cooling System The following loop A emergency closed cooling system equipment has transfer and control switches located at the Division 1 remote shutdown control panel:
| |
| P42-C001A: Emergency closed cooling pump A The following loop B emergency closed cooling system has control switches located on the associated switchgear panel in the Division 2 switchgear room:
| |
| P42-C001B: Emergency closed cooling pump B Pump status indicators. See <Figure 9.2-3>.
| |
| The following emergency closed cooling system instrumentation is provided on the Division 1 remote shutdown control panel:
| |
| P42-R045A: Flow indicator (ECC system heat exchanger A) 7.4-18 Revision 12 January, 2003
| |
| | |
| The following emergency closed cooling system instrumentation is provided on the Division 2 remote shutdown control panel:
| |
| P42-R045B: Flow indicator (ECC system heat exchanger B)
| |
| : 7. Instrument Power The following instrument 120 Vac power systems have a transfer switch located at the Division 1 remote shutdown panel:
| |
| R41-K050: 120 Vac instrument power
| |
| : 8. Containment Atmosphere Monitoring System The following containment atmosphere monitoring system instrumentation is provided on the Division 1 remote shutdown control panel:
| |
| D23-R230: Recorder (drywell pressure/temperature)
| |
| D23-R240: Recorder (suppression pool level/temperature)
| |
| The following containment atmosphere monitoring system instrumentation is provided on the Division 2 remote shutdown panel:
| |
| D23-R260: Drywell temperature indicator D23-R270: Suppression pool temperature indicator D23-R280: Drywell pressure indicator G43-R102: Suppression pool level indicator
| |
| : 9. MCC, Switchgear and Miscellaneous Electrical Equipment Area HVAC Systems/Battery Room Exhaust System 7.4-19 Revision 12 January, 2003
| |
| | |
| The following loop A MCC, switchgear, and miscellaneous electrical equipment area HVAC Systems, and battery room exhaust system equipment have a common transfer/control switch located on the 480V switchgear panel EF1AO1 M23-C001A: MCC, switchgear and miscellaneous electrical equipment area HVAC supply fan A M23-C002A: MCC, switchgear and miscellaneous electrical equipment area HVAC return fan A M24-C001A: Battery room exhaust fan A P47-F045A: MCC, SWGR and miscellaneous electrical equipment area train A chilled water temperature control MOV
| |
| : 10. Emergency Closed Cooling Pump Area Cooling System The following loop A emergency closed cooling pump area cooling system equipment has fuse isolation provided for control room indication, voltage monitoring and annunciation circuits:
| |
| M28-B001A: Emergency closed cooling pump area cooling system ventilation fan A.
| |
| : 11. Emergency Service Water Pumphouse Ventilation System The following loop A emergency service water pumphouse ventilation system equipment have a common transfer/control switch and manual control units (for dampers) located in the emergency service water pumphouse ventilation system remote shutdown panel:
| |
| M32-C001A: Emergency service water pumphouse system ventilation Unit A 7.4-20 Revision 12 January, 2003
| |
| | |
| M32-F070A: Emergency service water pumphouse system pump house wall louver A M32-F040A: Emergency service water pumphouse system fan inlet air damper A M32-F050A: Emergency service water pumphouse system mixing air damper A
| |
| : 12. Emergency Core Cooling System Pump Room Cooling System The following emergency core cooling system pump room cooling system equipment have fuse isolation provided for control room indication and voltage monitoring circuits:
| |
| M39-B001A: Emergency core cooling system pump room cooling system RHR pump A and heat exchanger cooler.
| |
| M39-B004: Emergency core cooling system pump room cooling system RCIC pump room cooler.
| |
| : 13. Diesel Generator Building Ventilation System The following loop A diesel generator building ventilation system equipment is isolated from the control room by diesel generator A control transfer switch, located on the diesel generator A control panel, and actuated by an engine running interlock located in the diesel generator A engine control panel. The dampers are controlled by a setpoint station located on the Division 1 remote shutdown control panel which receives an input from a separate temperature transmitter used only for remote shutdown:
| |
| M43-C001A: Diesel generator building ventilation system ventilation fan A M43-F020A: Diesel generator building ventilation system outside air damper 7.4-21 Revision 18 October, 2013
| |
| | |
| M43-F030A: Diesel generator building ventilation system return (recirculation) air damper M43-F031A: Diesel generator building ventilation system return (recirculation) air damper M43-F070A: Diesel generator building ventilation system exhaust damper M43-F071A: Diesel generator building ventilation system exhaust damper
| |
| : 14. Control Complex Chilled Water System The following loop A control complex chilled water system equipment have individual transfer/control switches located on the associated switchgear panels in the Division 1 switchgear room and local control panel at the chiller.
| |
| P47-B001A: Control complex chilled water system control complex chiller A P47-C001A: Control complex chilled water system chilled water pump A
| |
| : 15. Emergency Service Water Screen Wash System The following emergency service water screen wash system equipment has fuse isolation provide for control room auto start and voltage monitoring circuits:
| |
| P49-D001A: Emergency service water screen wash system screen control 7.4-22 Revision 12 January, 2003
| |
| : 16. Safety-related Instrument Air System The following loop A safety-related instrument air system equipment have transfer/control switches located on the associated MCC compartment doors:
| |
| P57-F015A: Motor-operated valve (containment isolation)
| |
| P57-F020A: Motor-operated valve (drywell isolation)
| |
| : 17. Standby Diesel Generator System The following Division 1 standby diesel generator (R43-S001A) components are provided with fuse and transfer switch isolation from the control room:
| |
| Voltage regulator control and indicating light Generator field metering
| |
| : 18. Diesel Generator Fuel Oil System The following diesel generator fuel oil system equipment is provided with fuse isolation for control room voltage monitoring circuit:
| |
| R45-C001A: Diesel generator fuel oil system fuel oil transfer pump A 7.4.1.5 Design Basis The safe shutdown systems are designed to provide timely protection against the onset and consequences of conditions that threaten the integrity of the fuel barrier and the reactor coolant pressure boundary.
| |
| <Chapter 15> identifies and evaluates events that jeopardize the fuel barrier and reactor coolant pressure boundary. The methods of assessing 7.4-23 Revision 12 January, 2003
| |
| | |
| barrier damage and radioactive material releases, along with the methods by which abnormal events are identified, are also presented in
| |
| <Chapter 15>.
| |
| : a. Variables monitored to provide protective actions RCIC - Reactor vessel low water level (trip Level 2) is monitored in order to provide protective actions to the safe shutdown systems. All other safe shutdown systems are initiated by operator actions.
| |
| The plant conditions which require protective action involving safe shutdown are described in <Chapter 15> and <Appendix 15A>.
| |
| : b. Location and Minimum Number of Sensors Technical Specifications will discuss the minimum number of sensors required to monitor safety-related variables. There are no sensors in the safe shutdown systems which have a spatial dependence.
| |
| : c. Prudent Operational Limits Prudent operational limits for each safety-related variable trip setting are selected with sufficient margin so that a spurious safe shutdown system initiation is avoided. It is then verified by analysis that the release of radioactive materials, following postulated gross failures of the fuel or the nuclear system process barrier, is kept within acceptable bounds.
| |
| : d. Margin The margin between operational limits and the limiting conditions of operation of safe shutdown systems are accounted for in Technical Specifications.
| |
| 7.4-24 Revision 12 January, 2003
| |
| : e. Levels Levels requiring protective action are established in Technical Specifications.
| |
| : f. Range of Transient, Steady-State and Environmental Conditions Refer to <Section 3.11> for environmental conditions. Refer to
| |
| <Section 8.2.1> and <Section 8.3.1> for the maximum and minimum range of energy supply to the safe shutdown systems instrumentation and controls. All safety-related instrumentation and controls are specified and purchased to withstand the effects of these energy supply ranges.
| |
| : g. Malfunctions, Accidents and Other Unusual Events Which Could Cause Damage to Safety System
| |
| <Chapter 15> describes the following credible accidents and events:
| |
| floods, storms, tornadoes, earthquakes, fires, LOCA, pipe break outside containment, and feedwater line break. Each of these events is discussed below for the safe shutdown systems.
| |
| : 1. Floods The buildings containing safe shutdown system components have been designed to meet the PMF (Probable Maximum Flood) at the site location. This ensures that the buildings will remain water-tight under PMF conditions including wind generated wave action and wave runup. For a discussion of internal flooding protection, refer to <Section 3.4.1> and <Section 3.6>.
| |
| 7.4-25 Revision 12 January, 2003
| |
| : 2. Storms and Tornadoes The buildings containing safe shutdown system components have been designed to withstand meteorological events described in
| |
| <Section 3.3>.
| |
| : 3. Earthquakes The structures containing safe shutdown system components have been seismically qualified as described in <Section 3.7> and
| |
| <Section 3.8>, and will remain functional during and following a safe shutdown earthquake (SSE). Seismic qualification of instrumentation and electrical equipment is discussed in
| |
| <Section 3.10>.
| |
| : 4. Fires To protect the safe shutdown systems in the event of a postulated fire, the redundant portions of the systems are separated by fire barriers or physical distance. The use of separation and fire barriers ensures that even though some portion of the systems may be affected, the safe shutdown systems will continue to provide the required protective action. See <Section 9.5.1> for a discussion of fire protection.
| |
| : 5. LOCA The safe shutdown systems components located inside the drywell and containment which are functionally required following a LOCA have been environmentally qualified to remain functional as discussed in <Section 3.11>.
| |
| 7.4-26 Revision 12 January, 2003
| |
| : 6. Pipe Break Outside Containment This condition will not affect the safe shutdown systems.
| |
| Refer to <Section 3.6>.
| |
| : 7. Missiles Protection for safe shutdown systems is described in
| |
| <Section 3.5>.
| |
| : h. Minimum Performance Requirements Minimum performance requirements for safe shutdown systems instrumentation and controls are provided in Technical Specifications.
| |
| 7.4.1.6 Final System Drawings The final system drawings, including piping and instrumentation diagrams (P&ID) and functional control diagrams (FCD), have been provided or referenced for the safe shutdown systems.
| |
| 7.4.2 ANALYSIS The safe shutdown systems are designed such that loss of instrument air, a plant load rejection or a turbine trip will not prevent the completion of the safety function.
| |
| 7.4.2.1 Conformance To <10 CFR 50, Appendix A> - General Design Criteria The following is a discussion of conformance to those general design criteria which apply specifically to the safe shutdown systems. Refer 7.4-27 Revision 12 January, 2003
| |
| | |
| to <Section 7.1.2.2> for a discussion of General Design Criteria which apply as indicated in <Table 7.1-3>.
| |
| : a. General Design Criterion 19 - Control Room The remote shutdown system consists of equipment located outside the control room which is sufficient to provide and assure prompt hot shutdown of the reactor and to maintain safe conditions during hot shutdown. The equipment also provides capability for subsequent cold shutdown of the reactor.
| |
| : b. General Design Criterion 34 - Residual Heat Removal The reactor shutdown cooling mode of the residual heat removal system removes residual heat from the reactor when it is shutdown and the main steamlines are isolated, to maintain the fuel and reactor coolant pressure boundary within design limits. Redundant cooling routes are provided to meet the single failure criteria.
| |
| 7.4.2.2 Conformance To IEEE Standards The following is a discussion of conformance to those IEEE Standards which apply specifically to the safe shutdown systems. Refer to
| |
| <Section 7.1.2.3> for a discussion of IEEE Standards which apply equally to all safety-related systems.
| |
| : a. IEEE Standard 279 The reactor shutdown cooling mode of the residual heat removal system uses the same equipment used by the LPCI mode. Therefore, refer to <Section 7.3.2> for the RSCM standards and regulatory compliance.
| |
| 7.4-28 Revision 12 January, 2003
| |
| | |
| Conformance of the remote shutdown system to IEEE Standards is provided in the analysis section for each system whose instrumentation and controls interface with and become part of the remote shutdown system after transfer of controls <Section 7.3>,
| |
| <Section 7.4>, <Section 7.5>, and <Section 7.6>.
| |
| : 1. General Functional Requirement (IEEE Standard 279, Paragraph 4.1)
| |
| RCIC is automatically initiated when reactor vessel water level is determined to be below a predetermined limit.
| |
| SLCS is initiated by the control room operator. Display instrumentation in the control room provides the operator with information on reactor vessel water level, pressure, neutron flux level, control rod position, and scram valve status allowing assessment of the need for initiation of the SLCS.
| |
| : 2. Single-Failure Criterion (IEEE Standard 279, Paragraph 4.2)
| |
| The RCIC system is not required to meet the single-failure criterion, since the HPCS system is capable of fulfilling the objectives of the RCIC system if it fails thus, the two meet single failure on a network basis. The RCIC initiation sensors and associated logic do, however, meet the single-failure criterion for automatic system initiation. The single failure criteria is met through physical and electrical separation of equipment as described in <Section 8.3.1.4>.
| |
| SLCS serves as backup to the control rod drive (CRD) system for controlling reactivity if the CRD fails. It is not necessary for SLCS to meet the single failure criterion.
| |
| 7.4-29 Revision 12 January, 2003
| |
| | |
| The explosive values are redundant so that no single failure in these components will prevent initiation of SLCS.
| |
| : 3. Quality of Components and Modules (IEEE Standard 279, Paragraph 4.3).
| |
| Refer to <Section 3.11> for RCIC and SLCS conformance.
| |
| : 4. Equipment Qualification (IEEE Standard 279, Paragraph 4.4).
| |
| For a complete discussion of RCIC and SLCS equipment qualification refer to <Section 3.5>, <Section 3.6>,
| |
| <Section 3.10>, and <Section 3.11>.
| |
| : 5. Channel Integrity (IEEE Standard 279, Paragraph 4.5).
| |
| For a discussion of RCIC and SLCS Channel Integrity under all extremes of conditions described in <Section 7.4.1.5>, refer to <Section 3.11>.
| |
| : 6. Channel Independence (IEEE Standard 279, Paragraph 4.6).
| |
| Channel independence is maintained through application of the PNPP separation criteria as described in <Section 8.3.1>.
| |
| : 7. Control and Protection Interaction (IEEE Standard 279, Paragraph 4.7).
| |
| The RCIC and SLCS systems have no interaction with plant control systems.
| |
| : 8. Derivation of System Inputs (IEEE Standard 279, Paragraph 4.8).
| |
| 7.4-30 Revision 12 January, 2003
| |
| | |
| All inputs to the RCIC system that are essential to its operation are direct measures of appropriate variables.
| |
| Display instrumentation in the control room provides the operator with directly measured information on reactor vessel water level, pressure, neutron flux level, and control rod position. Based on this information the operator can assess the need for SLCS.
| |
| : 9. Capability for Sensor Checks (IEEE Standard 279, Paragraph 4.9).
| |
| Refer to <Section 7.4.2.3>, <Regulatory Guide 1.22>.
| |
| : 10. Capability for Test and Calibration (IEEE Standard 279, Paragraph 4.10).
| |
| Refer to <Section 7.4.2.3>, <Regulatory Guide 1.22>.
| |
| : 11. Channel Bypass or Removal from Operation (IEEE Standard 279-1971, Paragraph 4.11).
| |
| Calibration of a sensor which introduces a single instrument channel trip will not cause a protective action without the coincident trip of a second channel. Removal of a sensor from operation during calibration does not prevent the redundant instrument channel from functioning.
| |
| The SLC system is redundant to the CRD system, therefore, one pump may be removed from service during normal plant operation within the guidelines of the Technical Specifications.
| |
| 7.4-31 Revision 12 January, 2003
| |
| : 12. Operating Bypasses (IEEE Standard 279, Paragraph 4.12).
| |
| There are no operating bypasses within the RCIC system or the SLCS.
| |
| : 13. Indication of Bypasses (IEEE Standard 279, Paragraph 4.13).
| |
| For a discussion of bypass and inoperability indication refer to <Section 7.1>, <Regulatory Guide 1.47>.
| |
| : 14. Access to Means for Bypassing (IEEE Standard 279, Paragraph 4.14).
| |
| Access to means of bypassing any safety action or function for RCIC and SLCS is under the administrative control of the control room operator. The operator is alerted to bypasses as described in <Section 7.1>, <Regulatory Guide 1.47>.
| |
| Control switches which allow system bypasses are keylocked.
| |
| All keylock switches in the control room are designed such that their key can only be removed when the switch is in the safe position. All keys will normally be removed from their respective switches during operation and maintained under the control of the Shift Manager. Should a key be required to change a switch position, it will be obtained from the unit supervisor by approved key control procedures.
| |
| : 15. Multiple Setpoints (IEEE Standard 279, Paragraph 4.15).
| |
| There are no multiple setpoints within the RCIC or SLCS systems.
| |
| 7.4-32 Revision 12 January, 2003
| |
| : 16. Completion of Protective Action Once it is Initiated (IEEE Standard 279-1971, Paragraph 4.16).
| |
| Once RCIC is initiated by reactor vessel low water level, the logic seals-in and system operation may be terminated by the operator when the water level returns to normal. The system is automatically stopped on high vessel water level, system malfunction trip signals or if steam supply pressure drops below that necessary to sustain turbine operation.
| |
| The SLCS explosive valves remain open once fired. The injection valves will not close and discharge pump motors will continue to run unless terminated by operator action or by storage tank low level.
| |
| : 17. Manual Initiation (IEEE Standard 279, Paragraph 4.17).
| |
| Refer to <Section 7.4.2>, <Regulatory Guide 1.62>, for a discussion of the manual initiation of RCIC and SLCS.
| |
| : 18. Access to Setpoint Adjustment (IEEE Standard 279, Paragraph 4.18).
| |
| All access to setpoint adjustments for RCIC are under administrative control.
| |
| The operation of SLCS is not dependent on or affected by any setpoint adjustment or calibration except SLC storage tank low level.
| |
| : 19. Identification of Protective Actions (IEEE Standard 279, Paragraph 4.19).
| |
| 7.4-33 Revision 12 January, 2003
| |
| | |
| Initiation of the RCIC system is indicated in the control room.
| |
| The explosive valve status of SLCS, once fired, is indicated in the control room.
| |
| : 20. Information Readout (IEEE Standard 279, Paragraph 4.20).
| |
| The RCIC system is designed to provide the operator with accurate and timely information pertinent to its status. It does not give anomalous indications confusing to the operator.
| |
| The SLCS discharge pressure of boron solution pumps and storage tank level for the SLCS is indicated in the control room.
| |
| : 21. System Repair (IEEE Standard 279, Paragraph 4.21).
| |
| The RCIC and SLCS systems are designed to permit repair or replacement of components during normal plant operation.
| |
| Recognition and location of a failed component will be accomplished during periodic testing or by annunciation in the control room.
| |
| : 22. Identification (IEEE Standard 279, Paragraph 4.22).
| |
| All controls and instruments for RCIC and SLCS are located in separate sections of the control room panel and clearly identified by nameplates. Relays are located in separate panels for RCIC and SLCS use only. Relays and panels are identified by nameplates. All wiring and cabling is labeled to indicate its divisional assignment as well as its system assignments <Section 8.3.1.3>.
| |
| 7.4-34 Revision 12 January, 2003
| |
| | |
| 7.4.2.3 NRC Regulatory Guide Conformance Regulatory guide conformance for remote shutdown control and instrumentation is provided in the analysis sections of Chapter 7 for each system whose instrumentation and controls interface with and become part of the remote shutdown system after transfer of control.
| |
| Conformance to regulatory guides for the RHR shutdown cooling mode is discussed in <Section 7.3.2>.
| |
| The following is a discussion of conformance to those regulatory guides which apply specifically to the RCIC system and/or the SLCS. Refer to
| |
| <Section 7.1.2.4> for a discussion of regulatory guides which apply equally to all safety-related systems.
| |
| : a. <Regulatory Guide 1.22> - Periodic Testing of Protection System Actuation Functions The RCIC system is capable of being completely tested, except for the discharge valve to the head cooling spray nozzle, during normal plant operation to verify that each element of the system, is capable of performing its intended safety function.
| |
| All sensors for RCIC are installed with calibration taps and instrument valves to permit testing during normal plant operation by valving out the sensors and supplying a test pressure source.
| |
| The SLCS explosive valves may be tested during plant shutdown. The explosive valve control circuits are continuously monitored and annunciated in the control room. The remainder of the SLCS may be tested during normal plant operation to verify that each element is capable of performing its intended function.
| |
| 7.4-35 Revision 12 January, 2003
| |
| | |
| Testing of RCIC system and SLCS sensors during normal plant operation is accomplished by taking each sensor from its process line and applying a test pressure source. This verifies the operability of the sensor, its calibration range and the operability of associated control room logic components.
| |
| : b. <Regulatory Guide 1.53> - Application of the Single-Failure Criterion to Nuclear Power Plant Protection Systems See IEEE Standard 279, Paragraph 4.2, located in <Section 7.4.2> of the USAR for RCIC and SLCS.
| |
| : c. <Regulatory Guide 1.62> - Manual Initiation of Protective Actions The RCIC system is initiated at the system level manually from the control room by actuation of an armed pushbutton which simulates an automatic initiation.
| |
| The SLCS is initiated manually at the system level from the control room by actuation of the system pump start switch which starts the pump and fires the associated squib valve.
| |
| <Regulatory Guide 1.73> - Qualification Testing of Electric Motor Operators Installed Inside the Containment of Nuclear Power Plants.
| |
| See <Section 3.10> and <Section 3.11> for discussions of compliance.
| |
| 7.4-36 Revision 12 January, 2003
| |
| | |
| 7.5 SAFETY-RELATED DISPLAY INSTRUMENTATION 7.
| |
| | |
| ==5.1 DESCRIPTION==
| |
| | |
| 7.5.1.1 General This section describes the instrumentation which provides information to the operator to enable him to perform required safety functions.
| |
| The safety-related display instrumentation (SRDI) is listed in
| |
| <Table 7.5-1>. It tabulates equipment illustrated on the various system P&IDs, IEDs and FCDs located and described in <Section 7.2>,
| |
| <Section 7.3>, <Section 7.4>, and <Section 7.6>.
| |
| The elementary diagrams illustrate separation of redundant display instrumentation and electrical isolation of redundant sensors and channels. The P&IDs, IEDs, FCDs, and elementary diagrams adequately illustrate the redundancy of monitored variables and component sensors and channels.
| |
| The specific regulatory requirements applicable to SRDI are cited in
| |
| <Table 7.1-3>.
| |
| 7.5.1.2 Normal Operation The instrumentation and ranges were selected on the basis of giving the reactor operator the necessary information to perform all the normal plant startup, steady-state maneuvers and to be able to track all the process variables pertinent to safety during expected operational perturbations.
| |
| Revision 12 7.5-1 January, 2003
| |
| | |
| 7.5.1.2.1 Safe Shutdown Instrumentation is available to provide the operator with adequate information to maintain the plant safely in a shutdown condition during all design basis events.
| |
| 7.5.1.3 Abnormal Transient Occurrences The ranges of indicators and recorders provided are capable of covering the extremes of process variables and provide adequate information for all abnormal transient events.
| |
| 7.5.1.4 Accident Conditions Information readouts are designed to accommodate all credible accidents from the standpoint of operator action, information and event tracking requirements, providing assurance that all other credible events or incidents requirements will be covered.
| |
| 7.5.1.4.1 Initial Accident Event The design basis of all engineered safety features to mitigate the accident event condition takes into consideration that no operator action or assistance is assumed for the first ten minutes of the event.
| |
| This requirement, therefore, makes it mandatory that all protective action necessary in the first ten minutes be automatic. Thus, although continuous tracking of process variables is available, no operator action based on them is required.
| |
| 7.5.1.4.2 Postaccident Tracking No operator action (and therefore, postaccident information) is required for at least ten minutes following an accident, although the various Revision 12 7.5-2 January, 2003
| |
| | |
| monitoring devices are continuously tracking and indicating important parameter information and displaying it to the operator as well as recording appropriate data.
| |
| The DBA-LOCA serves as the envelope accident sequence event to provide and demonstrate the plants postaccident tracking capabilities. All other accidents have less severe and limiting tracking requirements.
| |
| The following process instrumentation provides information to the operator after a DBA-LOCA to monitor reactor conditions.
| |
| The plant protection/ESF system electronic trip system <Section 7.1.3>
| |
| provides continuous control room indication of each variable monitored by the RPS, ECCS, CRVICS, and RCIC. Each variable is sensed by an analog transmitter that continuously transmits a signal proportional to the variable range, to a trip unit located in the control room. A millimeter located on each trip unit displays the transmitted signal.
| |
| The ammeter allows visual cross-checking between instrument channels to verify operability and variable level.
| |
| 7.5.1.4.2.1 Reactor Water Level Three wide range water level signals are transmitted from three independent differential pressure transmitters and are recorded on three, two-pen recorders. For two of the recorders, one pen records the wide range level and the other pen records the reactor pressure as stated in <Section 7.5.1.4.2.2>. For the third recorder, again one pen records the wide range level and the other pen records the fuel zone level as stated in <Table 7.1-4>. The range of the recorded level is from the top of the feedwater control range (above the high level turbine trip point) down to a point near the top of the active fuel.
| |
| Revision 12 7.5-3 January, 2003
| |
| | |
| 7.5.1.4.2.2 Reactor Pressure Two reactor pressure signals are transmitted from two independent differential pressure transmitters and are recorded on two, two-pen recorders which are operable before and after a safe shutdown earthquake (SSE). One pen records pressure and the other pen records the wide range level. The range of recorded pressure is from 0 to 1,500 psig.
| |
| 7.5.1.4.2.3 Reactor Shutdown, Isolation and Core Cooling Indication 7.5.1.4.2.3.1 Reactor Operator Information and Observations The information furnished to the control room operator permits him to assess reactor shutdown, isolation and availability of emergency core cooling following the postulated accident.
| |
| : a. Operator verification that reactor shutdown has occurred may be made by observing one or more of the following indications:
| |
| : 1. Control rod status lamps indicating each rod fully inserted.
| |
| : 2. Control rod scram pilot valve status lamps (power available) indicating open valves.
| |
| : 3. Neutron monitoring power range channels and recorders downscale and SRM recorders downscale.
| |
| There is no requirement for the power range channels and recorders downscale indication to remain available to the operator following a loss of offsite power. However, APRM downscale may be used as an indication of reactor power level Revision 12 7.5-4 January, 2003
| |
| | |
| following a loss of offsite electrical power. A loss of offsite power would result in all scram valve solenoids de-energized and scramed.
| |
| : 4. Annunciators for reactor protection system variables and trip logic in the tripped state.
| |
| The function of the annunciators is to supply information to the operator. They are not protective systems in that they do not provide any trip signals.
| |
| Annunciators are only one means by which the operator can assess the status of a system. It should be recognized that no operator action is required for the first ten minutes following an incident. This gives the operator adequate time to review system status from operating lights, indicators and relay positions.
| |
| : 5. Process computer logging of trips and control rod position log. The power source is the computer power supply from the plant uninterruptable auxiliary ac bus.
| |
| The plant process computer provides no trip signals. It provides thermal hydraulic information to the operator which he uses to keep the plant operating within Technical Specification limits. If the computer is not working, there are backup procedures to provide the same information. The process computer has no specific regulatory requirements.
| |
| : b. The reactor operator may verify reactor isolation by observing one or more of the following indications:
| |
| : 1. Isolation valve position lamps indicating valve closure.
| |
| Revision 12 7.5-5 January, 2003
| |
| : 2. Main steam line flow indication downscale.
| |
| : 3. Annunciators for the containment and reactor vessel isolation system variables and trip logic in the tripped state.
| |
| : 4. Process computer logging of trips.
| |
| : c. Operation of the emergency core cooling and the RCIC system following the accident may be verified by observing the following indications:
| |
| : 1. Annunciators for high pressure core spray, low pressure core spray, residual heat removal, automatic depressurization system, and reactor core isolation cooling system sensor initiation logic trips.
| |
| : 2. Flow and/or pressure indications for each emergency core cooling system are provided and are operable before and after a SSE.
| |
| : 3. RCIC isolation valve position indicating open valves.
| |
| : 4. Injection valve position lights indicating either open or closed valves.
| |
| : 5. Relief valve initiation circuit status by open or closed indicator lamps.
| |
| : 6. Process computer logging of trips in the emergency core cooling network.
| |
| : 7. Relief valve discharge pipe temperature monitors.
| |
| Revision 12 7.5-6 January, 2003
| |
| | |
| 7.5.1.4.2.4 Drywell and Containment Indications Drywell and containment conditions are indicated and/or recorded by the instrumentation described below.
| |
| : a. Drywell and Containment Pressure Monitoring Drywell/containment differential pressure is measured and indicated in the control room. Separate annunciation is provided in the control room on high positive differential and high negative differential pressure. Drywell pressure narrow range and wide range measurements are recorded in the control room and the narrow range measurement is indicated and annunciated in the control room.
| |
| Containment pressure is also measured with redundant channels, with each channel being indicated, recorded and annunciated in the control room. Additional redundant channels of instruments are used for extended range measurement of containment pressure with the signals recorded in the control room.
| |
| : b. Drywell and Containment Temperature Monitoring Temperature signals from sensors located in the drywell and the containment are recorded in the control room. An alarm for high average drywell temperature per division and a common alarm for high containment temperature for each channel are annunciated in the control room. One temperature sensor from each channel in the drywell and the containment has its signal indicated in the control room.
| |
| : c. Suppression Pool Temperature Monitoring Each channel of the suppression pool temperature sensors transmits the sensors signals to temperature switches and then to two and Revision 12 7.5-7 January, 2003
| |
| | |
| four position selector switches located on the postaccident monitoring panel. A suppression pool temperature is selected and indicated on a single indicator located on the ECCS benchboard. A common alarm for each channel on high suppression pool temperature is annunciated in the control room. Each channel is recorded in the control room.
| |
| : d. Suppression Pool Water Level There are nine suppression pool level transmitters. Four of the transmitters sense narrow-range (16-19 ft) and provide signals for annunciation, recording and automatic makeup to the suppression pool. A fifth narrow range (16-19ft) transmitter is provided for remote shutdown panel indication and recording. Two accident monitoring suppression pool level transmitters sense and record wide range suppression pool level (2-24ft) in the control room.
| |
| The remaining two suppression pool level transmitters are containment flood level transmitters and sense and record suppression pool level over the range of 16 to 96 feet.
| |
| The nine suppression pool level transmitters are arranged in two divisions, A and B. There are five instruments in division A because the remote shutdown transmitter is in that division. There are two narrow range instruments, one in each division, that provide narrow range control room indication and recording.
| |
| Additionally, all narrow range instruments are used to control automatic makeup to the suppression pool <Section 7.3.1.1.12>.
| |
| There are two wide range instruments, one in each division, that provide accident monitoring over the range of 2 to 24 feet. The accident monitoring instruments are recorded in the control room and are used to satisfy the Accident Monitoring Instrumentation requirements of the Technical Specifications.
| |
| Revision 12 7.5-8 January, 2003
| |
| | |
| There are two containment flood level instruments, one in each division, that provide control room recording and annunciation.
| |
| They are used to monitor containment water level between the top of active fuel and the 641 foot elevation when containment flooding is necessary.
| |
| In addition to the nine suppression pool level transmitters, there are two upper pool level transmitters, one per division. Each channel is recorded and indicated in the control room. High and low upper pool level is also annunciated in the control room.
| |
| 7.5.1.4.2.5 Control Room HVAC The SRDI which provides the operators with the necessary information to ascertain system operation is listed in <Table 7.5-1> and shown on
| |
| <Figure 6.4-1>.
| |
| 7.5.1.4.2.6 Emergency Water Systems The emergency water systems, emergency closed cooling and emergency service water operation can be verified by the SRDI indicating loop flow, pressure and temperature as well as flow and temperature indicators for each heat exchanger. These indicators are listed in
| |
| <Table 7.5-1> and shown on <Figure 9.2-1> and <Figure 9.2-3>.
| |
| 7.5.1.4.2.7 Annulus Exhaust Gas Treatment System The SRDI that provides the operators with the necessary information to ascertain system operation is listed in <Table 7.5-1> and shown on
| |
| <Figure 6.5-1>.
| |
| Revision 12 7.5-9 January, 2003
| |
| | |
| 7.5.1.4.2.8 Combustible Gas Control System The three subsystems of the combustible gas control system (CGCS) are provided with SRDI as shown on <Figure 6.2-62> and listed on
| |
| <Table 7.5-1>. These indicators and recorders provide sufficient information to determine the effectiveness of the CGCS following any DBA.
| |
| 7.5.1.4.2.9 Standby Power Systems The SRDI, which provides the operators with the necessary information to ascertain system operation, is listed in <Table 7.5-1>.
| |
| 7.5.1.4.2.10 Emergency Diesel Support Systems These support systems have SRDI as indicated in <Table 7.5-1>, shown on
| |
| <Figure 9.4-14> and discussed in <Section 9.5>.
| |
| 7.5.1.4.2.11 ESF Building and Area HVAC Systems These safety-related systems have status and position lights for motors and dampers that provide sufficient information to monitor system operation. These lights are powered from the same source as the device they monitor and are shown on <Figure 6.4-1>, <Figure 9.4-1>,
| |
| <Figure 9.4-4>, <Figure 9.4-10>, <Figure 9.4-11>, <Figure 9.4-12>, and
| |
| <Figure 9.4-13>.
| |
| 7.5.1.4.3 Safety Parameter Display System (SPDS)
| |
| The purpose of SPDS is to provide a concise display of critical plant variables to control room operators to help them rapidly and reliably determine the safety status of the plant. The parameters selected for Revision 12 7.5-10 January, 2003
| |
| | |
| SPDS are sufficient to assess the safety status of each identified function for a wide range of events, which include symptoms of severe accidents.
| |
| The Perry SPDS is a subsystem of the Emergency Response Information System (ERIS). ERIS was originally an independent computer system, but has now been integrated into the Integrated Computer System (ICS). The original SPDS was developed and supplied by General Electric (GE), and was identical, in most respects, to the general GESSAR II SPDS (Refer
| |
| <NUREG-0979> Supplement 4 and NEDE-30284-P). The design of the modified system, although implementing new hardware and software and updated display/MMI technology, has been carefully controlled to ensure that all prior commitments have been retained.
| |
| 7.5.2 ANALYSIS 7.5.2.1 General The SRDI provides adequate information to allow the reactor operator to perform the necessary manual safety functions.
| |
| All protective actions required under accident conditions for the NSSS equipment are automatic, redundant and decisive such that reactor operator intervention is unnecessary for the first ten minutes.
| |
| Information for postaccident protective actions is provided by safety classified instrumentation.
| |
| Information for other instrumentation systems will be assessed by the reactor operator on the basis of its reliability, verification by comparative means and by need for non-standard control actions.
| |
| Revision 12 7.5-11 January, 2003
| |
| | |
| 7.5.2.2 Normal Operation
| |
| <Section 7.5.1.2> describes the basis for selecting ranges for instrumentation and since abnormal, transient or accident conditions monitoring requirements exceed those for normal operation, the normal ranges are covered adequately.
| |
| 7.5.2.3 Abnormal Transient Occurrences These occurrences are not limiting from the point of view of instrument ranges and functional capability <Section 7.5.2.4.>.
| |
| The variety of indications, which may be used to verify that shutdown and isolation safety actions have been accomplished as required
| |
| <Section 7.5.1.4.2.3>, meets the requirements of IEEE Standard 279.
| |
| 7.5.2.4 Accident Conditions The DBA-LOCA is the most extreme operational event. Information readouts are designed to accommodate this event from the standpoint of operator actions, information and event tracking requirements, and therefore, will cover all other design basis events or incident requirements.
| |
| 7.5.2.4.1 Initial Accident Event The design basis of all engineered safety features used to mitigate accident event condition takes into consideration that no operator action or assistance is required or recommended for the first ten minutes of the event. This requirement therefore, makes it mandatory that all protective action necessary in the first ten minutes be automatic. Therefore, although continuous tracking of variables is available, no operator action based on them is intended.
| |
| Revision 12 7.5-12 January, 2003
| |
| | |
| 7.5.2.4.2 Postaccident Tracking The SRDI listed below is in compliance with safety-related system requirements <Section 7.1.2>. Process instrumentation provides information to the operator after a DBA-LOCA for his use in monitoring:
| |
| : a. Reactor Water Level and Pressure Vessel water level and pressure sensor instrumentation described in
| |
| <Section 7.5.2.1> is redundant, electrically independent and is qualified to be operable during and after a LOCA in conjunction with a SSE. Power is from independent instrument buses supplied from the two divisional ac buses. This instrumentation complies with the independence and redundancy requirements of IEEE Standard 279 and provides recorded outputs.
| |
| The sensors and recorders are designed to operate during normal operation and/or postaccident environmental conditions. The design criteria that the instruments must meet are discussed in
| |
| <Section 7.1.2>. There are two complete and independent channels of wide range reactor water level and reactor vessel pressure with a channel of each parameter having its readout on a separate two-pen recorder in the control room. A third independent channel of wide range reactor water level is provided with indication on a two-pen recorder in the control room shared with a fuel zone reactor water level channel.
| |
| The design, considering the accuracy, range and quality of the instrumentation, is adequate to provide the operator with accurate reactor water level and reactor pressure information during normal operation, abnormal, transient, and accident conditions.
| |
| Revision 12 7.5-13 January, 2003
| |
| : b. Suppression Pool Water Level and Temperature This instrumentation complies with the requirements of IEEE Standard 279 and provides recorded outputs. All equipment, except the recorders and indicators, will perform its required function during and after the seismic event. Recorders and instrumentation perform their required function after the seismic event; however, pen or pointer flutter is expected to occur during the event.
| |
| : c. Drywell and Containment Pressure and Temperature This instrumentation is redundant, electrically independent and is qualified to be operable during and after a LOCA. Power is from independent buses and the instrumentation complies with the requirements of IEEE Standard 279 and provides recorded outputs.
| |
| All equipment except the recorders and indicators will perform their required function during and after a seismic event.
| |
| Recorders and instrumentation perform their required function after the seismic event; however, pen or pointer flutter is expected to occur during the event.
| |
| : d. Emergency Core Cooling Systems Performance of emergency core cooling systems (ECCS) following an accident may be verified by observing redundant and independent indications as described in <Section 7.5.1.4.2.3.1.c> and fully satisfies the need for operator verification of operation of the system.
| |
| Redundancy of instrumentation within the individual systems is not provided. However, redundancy is provided within the combination of ECCS network. Each system is provided with system flow measuring indication and/or valve status indication allowing the operator to assess the operating conditions.
| |
| Revision 12 7.5-14 January, 2003
| |
| : e. Continued Shutdown Tracking The various indications described in <Section 7.5.1.4.2> provide adequate information regarding status of the reactor vessel level and pressure to allow reactor operators to make proper decisions regarding core and containment cooling operations, and fully satisfies the need for postaccident surveillance of these variables.
| |
| : f. Non-NSSS Engineered Safety Features and Auxiliary Supporting Systems Performance of engineered safety features and auxiliary supporting systems may be verified by observing the various indications described in <Section 7.5.1.2>. Displays showing the status of all ESF equipment and pertinent analog parameters are located on control room benchboards, in the same area as the associated ESF system controls, so that the operator can immediately assess the status of ESF systems and take whatever actions necessary under all plant conditions. This instrumentation is redundant, electrically independent between ESF divisions and is qualified to be operable during and after a LOCA and before and after a seismic event.
| |
| Power is from independent buses and the instrumentation complies with the requirements of IEEE Standard 279.
| |
| 7.5.2.4.3 Safe Shutdown Display The safe shutdown display instrumentation in <Section 7.5.1> consists of control rod status lamps, scram pilot valve status lamps (power available) and neutron monitoring instrumentation. These displays are expected to remain operable following an accident to indicate the occurrence of safe and orderly shutdown.
| |
| Revision 12 7.5-15 January, 2003
| |
| | |
| The displays provide redundancy by being in three separate systems and the rod position and neutron monitoring outputs are recorded (the former by the process computer).
| |
| 7.5.2.4.4 Engineered Safety Feature Operation Display The other operating instruments provide indication of operation of various safety systems but, except for the isolation valve status, do not constitute postaccident surveillance or safe shutdown display.
| |
| Isolation valve status indication is designed to perform as stated in
| |
| <Section 7.5.2.4>.
| |
| 7.5.2.5 System Drawings The applicable safety-related display instrumentation system schematics, electrical distribution drawings, functional control diagrams, instrument location drawings, and control room layout drawings have been provided and are listed in <Section 1.7>. P&IDs are located in
| |
| <Chapter 5>, <Chapter 6>, and <Chapter 9>.
| |
| 7.5.2.6 Isolation Devices The GESSAR II SPDS SER (Section III.G) addressed electrical and electronic isolation and concluded that the fiberoptics are acceptable for interfacing the original ERIS/SPDS with safety systems. The fiberoptic cable system supplies the necessary electrical isolation to meet all requirements of maximum credible faults and electrical interference considerations. The isolation equipment has been environmentally and seismically qualified in accordance with IEEE-323-1974 and IEEE-344-1975.
| |
| Revision 12 7.5-16 January, 2003
| |
| | |
| TABLE 7.5-1 SAFETY-RELATED DISPLAY INSTRUMENTATION (DISPLAY INSTRUMENTATION FOR SAFETY-RELATED SYSTEMS)
| |
| Number Type of of Readout System Parameter Readout Channels Range Location Rod Control Control Rod Position Lights 2 per rod N/A CR and Information Control Rod Scram Lights 1 per valve N/A CR Valves Neutron Power Range Neutron Recorder 8 (2 per recorder) 0 to 125% CR Monitoring Flux Oscillation Power Lights 4 N/A CR Range Monitors Source Range Count Rate Recorder 4 (2 per recorder) 10-1 to 106 cps CR Nuclear Reactor Vessel Pressure Recorder 2 0 to 1,500 psig CR Boiler Reactor Vessel Water Level: Wide Range Recorder 3 5 to 230 CR Fuel Zone One recorder, 3 -150 to 50 CR two meters Relief Valve Lights 2 N/A CR Initiation Circuit Relief Valve Discharge Recorder 1 0 to 600F CR Pipe Temperature RCIC RCIC Flow Meter 1 0 to 800 gpm CR RCIC Isolation Valve Lights 2 N/A CR RCIC Discharge Pressure Meter 1 0 to 1,500 psig CR Emergency HPCS Flow Meter 1 0 to 10,000 gpm CR Core Cooling HPCS Discharge Pressure Meter 1 0 to 1,500 psig CR LPCS Flow Meter 1 0 to 10,000 gpm CR RHR Flow (LPCI and Meter 1 per loop 0 to 10,000 gpm CR Shutdown Cooling)
| |
| Revision 12 7.5-17 January, 2003
| |
| | |
| TABLE 7.5-1 (Continued)
| |
| Number Type of of Readout System Parameter Readout Channels Range Location Emergency Core Cooling (Continued)
| |
| RHR Service Water Flow Meter 1 per loop 0 to 10,000 gpm CR ECCS Pumps Status 1 set per pump N/A CR Lights ECCS Valves Position 1 set per valve N/A CR Lights Containment Drywell Pressure Recorder 2 30 Hg to 35 psig CR Drywell (Wide)
| |
| Monitoring Drywell Pressure Recorder/Meter 2 10 Hg to +5 psig CR (Narrow)
| |
| Containment Pressure Recorder 2 10 Hg to 60 psig CR (Wide)
| |
| Containment Pressure Recorder/Meter 2 10 Hg to 20 psig CR (Normal)
| |
| Containment/Drywell Meter 2 -2.5 to +2.5 psig CR Differential Pressure Drywell Temperature Recorder 2/(3 locations 40 to 440F CR each)
| |
| Drywell Temperature Meter 2 40 to 440F CR Revision 12 7.5-18 January, 2003
| |
| | |
| TABLE 7.5-1 (Continued)
| |
| Number Type of of Readout System Parameter Readout Channels Range Location Containment Drywell Montoring (Continued)
| |
| Containment Temperature Recorder 2/(4 locations 50 to 300F CR each)
| |
| Containment Temperature Meter 2 50 to 300F CR Suppression Pool Level Recorder/Meter 2 16 to 19 feet CR (Narrow)
| |
| Suppression Pool Level Recorder 2 2 to 24 feet CR (Wide)
| |
| Containment Water Recorder 2 16 to 96 feet CR Level Suppression Pool Recorder/ 2/(8 locations 30 to 230F CR NOTE: Single meter Temperature Meter each) selectable on one of 8 locations Isolation Valves Position 1 set per valve N/A CR Lights Emergency Water ESW Loop Inlet Meter 1 each loop 0 to 100F CR (Emergency Temperature Service Water, (ESW); Emergency ESW Loop Pressure Meter 1 each loop 0 to 160 psig CR Closed Cooling Water ESW Flow to HPCS Meter 1 each loop 0 to 1,000 gpm CR (ECCW)) Diesel Hex ESW Flow to Stby Meter 1 each loop 0 to 1,200 gpm CR Diesel Hex Revision 12 7.5-19 January, 2003
| |
| | |
| TABLE 7.5-1 (Continued)
| |
| Number Type of of Readout System Parameter Readout Channels Range Location Emergency Water ESW Flow to ECCW Hex Meter 1 each loop 0 to 3,000 gpm CR (Emergency Service Water, ESW Flow to RHR Hex Meter 1 each loop 0 to 10,000 gpm CR (ESW); Emergency Closed Cooling, (ECCW)) ECCW Loop Pressure Meter 1 each loop 0 to 160 psig CR (Continued)
| |
| ECCW Loop Flow Meter 1 each loop 0 to 2,500 gpm CR ECCW Loop Temperature Meter 1 each loop 50 to 150F CR ESW Pumps Status 1 set per pump N/A CR Lights ESW Valves Position 1 set per valve N/A CR Lights ECCW Pumps Status 1 set per pump N/A CR Lights ECCW Valves Position 1 set per valve N/A CR Lights Standby Diesel Generator Field Current Meter 1 each generator 0-300 Amps CR Generator Generator Field Voltage Meter 1 each generator 0-300 Volts CR Generator Reactive Power Meter 1 each generator 0-6,000 kVAR CR Generator Power Meter 1 each generator 0-8,000 kW CR Generator Current Meter 1 each generator 0-1,200 Amps CR Generator Voltage Meter 1 each generator 0-5,250 Volts CR Revision 12 7.5-20 January, 2003
| |
| | |
| TABLE 7.5-1 (Continued)
| |
| Number Type of of Readout System Parameter Readout Channels Range Location Standby Diesel Generator (Continued)
| |
| Diesel Generator Meter 1 each generator 0-600 rpm CR Engine Speed Generator Synchroscope Meter 1 each generator Slow-Fast CR Standby Power Sources Meter/ 1 per source Various and N/A CR (Voltage/Current/Circuit Status Breaker Position) Lights Emergency and Diesel Fuel Storage Meter 1 each generator 0 to 100% level CR Standby Diesel Tank Level Generator Support Systems Diesel Fuel Day Meter 1 each generator 0 to 555 gal. CR Tank Level (HPCS gen.)
| |
| 0 to 550 gal.
| |
| (Standby gen.)
| |
| Ventilation Fan Status 1 set per fan N/A CR Lights Ventilation Outside Position 1 set per damper N/A CR Air Damper Lights Combustible Hydrogen Concentration Recorder 2/(4 locations 0-10% H2 CR Gas Control each)
| |
| Drywell Purge Status 1 set per N/A CR Compressor Lights compressor Drywell Purge Valves Position 1 set per valve N/A CR Lights Hydrogen Recombiner Meter 2 0-2,000F Local Temperature Revision 12 7.5-21 January, 2003
| |
| | |
| TABLE 7.5-1 (Continued)
| |
| Number Type of of Readout System Parameter Readout Channels Range Location Combustible Gas Control (Continued)
| |
| Hydrogen Recombiner Meter 2 0-100 kW Local Power Hydrogen Recombiner Status 1 set per N/A CR Lights recombiner Backup Purge Valve Position 1 set per valve N/A CR Lights Annulus Exhaust Annulus/Outside Recorder 2/(2 locations 0 to 5 H2O Vacuum CR Gas Treatment Atmosphere Differential each)
| |
| Pressure AEGTS Fans Status 1 set per fan N/A CR Lights AEGTS Dampers Position 1 set per damper N/A CR Lights Control Room Control Room Fan Status 1 set per fan N/A CR HVAC Lights Control Complex Chiller Status 1 set per chiller N/A CR Lights Control Room Dampers Position 1 set per damper N/A CR Lights ESF Ventilation ESF Ventilation Fan Status 1 set per fan N/A CR Lights ESF Ventilation Dampers Position 1 set per damper N/A CR Lights Revision 12 7.5-22 January, 2003
| |
| | |
| 7.6 ALL OTHER INSTRUMENTATION SYSTEMS REQUIRED FOR SAFETY 7.
| |
| | |
| ==6.1 DESCRIPTION==
| |
| | |
| <Section 7.6> describes the instrumentation and control systems required for safety not discussed in other sections. The systems include:
| |
| : a. Process Radiation Monitoring System
| |
| : b. High Pressure/Low Pressure Systems Interlocks
| |
| : c. Leak Detection System (LDS)
| |
| : d. Neutron Monitoring System (NMS)-(IRM, LPRM, APRM, OPRM)
| |
| : e. Rod Pattern Control System (RPCS)
| |
| : f. Recirculation Pump Trip System (RPT)
| |
| : g. Fuel Pool Cooling System
| |
| : h. Containment Atmosphere Monitoring System
| |
| : i. Hydrogen Control System
| |
| : j. Offgas Building Exhaust System
| |
| : k. Safety/Relief Valve-Relief Function
| |
| : l. Redundant Reactivity Control System (RRCS)
| |
| The sources which supply power to the safety-related systems described in this section originate from onsite ac and/or dc safety-related buses or, as in the case of the fail-safe logic NMS and portions of the LDS, Revision 12 7.6-1 January, 2003
| |
| | |
| from the nonsafety-related RPS MG sets. Refer to <Chapter 8> for a complete description of the safety-related systems power sources.
| |
| 7.6.1.1 Process Radiation Monitoring System - Instrumentation and Controls The safety-related portions of the process radiation monitoring system are described in <Section 7.2.1> and <Section 7.3.1>. The main steam line and containment ventilation exhaust radiation monitoring systems and all other systems are discussed in <Section 11.5>.
| |
| 7.6.1.2 High Pressure/Low Pressure Interlocks
| |
| : a. Function Instrumentation and controls are provided to prevent overpressurization of certain low pressure equipment.
| |
| : b. System Operation Schematic arrangement of mechanical equipment involved is shown in
| |
| <Figure 5.4-13>. Component control logic for the equipment involved is shown in <Figure 7.3-5>. Elementary diagrams are listed in <Section 1.7.1>.
| |
| The following high pressure/low pressure interlock equipment is provided:
| |
| Interlocked Parameter Process Line Type Valve Sensed Purpose RHR Shutdown MO E12-F009 Reactor Prevents valve opening Cooling MO E12-F008 Pressure until reactor pressure Suction is below system design Isolation pressure Revision 12 7.6-2 January, 2003
| |
| | |
| Interlocked Parameter Process Line Type Valve Sensed Purpose RHRS Shutdown MO E12-F053A,B Reactor Prevents valve opening Cooling Pressure until reactor pressure Injection is below system design pressure RHRS Head MO E12-F023 Reactor Prevents valve opening Spray Pressure until reactor pressure is below system design pressure The shutdown cooling suction isolation valves, head spray valve, and shutdown cooling injection valve have redundant interlocks to prevent the valves from being opened when the primary system pressure is above the subsystem design pressure.
| |
| 7.6.1.3 Leak Detection System - Instrumentation and Controls The safety-related portions of the leak detection system are main steam line leak detection, RCIC system leak detection, RHR system leak detection, and reactor water cleanup system leak detection.
| |
| : a. Leak Detection System Function The main portion of the leak detection system instrumentation and controls is designed to monitor leakage from the reactor coolant pressure boundary and initiate alarms and/or isolation when predetermined limits are exceeded <Section 5.2.5>.
| |
| Revision 12 7.6-3 January, 2003
| |
| : b. Leak Detection System Operation Schematic arrangements of system mechanical equipment and operator information displays are shown in <Figure 7.6-1>. LDS component control logic is shown in <Figure 7.3-5>, <Figure 7.4-1>, and
| |
| <Figure 7.3-3>. Plant layout drawings are shown in <Section 1.2>
| |
| and elementary diagrams are listed in <Section 1.7.1>.
| |
| Systems or parts of systems which contain water or steam and which are in direct communication with the reactor vessel, are provided with leakage detection systems.
| |
| Each of the required leakage detection systems inside the drywell is designed with a capability to detect leakage less than established leakage rate limits. Refer to Technical Specifications.
| |
| Major components within the drywell that by nature of their design are sources of leakage (e.g., pump seals, valve stem packing, equipment drains), are collected ultimately in an equipment drain sump.
| |
| Equipment associated with systems within the drywell (e.g.,
| |
| vessels, piping, fittings) share a common volume. Steam or water leaks from such equipment are collected ultimately in the floor drain sumps.
| |
| Each sump is protected against overflowing to prevent leaks of an identified source from masking those from unidentified sources.
| |
| Outside the containment, the piping within each system monitored for leakage is in compartments or rooms separate from other systems, wherever feasible, so that leakage may be detected by sump level, ambient or differential area temperature or high process flow.
| |
| Revision 12 7.6-4 January, 2003
| |
| | |
| Sensors, wiring, and associated equipment of the leak detection system which are associated with the isolation valve logic are designed to withstand the conditions that follow a design basis loss-of-coolant accident <Section 3.11>.
| |
| The operator is kept aware of the status of the leak detection system variables through meters, digital displays and recorders which indicate the measured variables in the control room. If a trip occurs, the condition is annunciated in the control room.
| |
| Discussions of the specific portions of the Leak Detection System are as follows:
| |
| : 1. The MSL leak detection
| |
| : 2. RCIC system leak detection
| |
| : 3. RHR system leak detection
| |
| : 4. Reactor water cleanup system leak detection 7.6.1.3.1 MSL Leak Detection The MSL Leak Detection system is described in <Section 7.3.1>.
| |
| 7.6.1.3.2 RCIC System Leak Detection The steam lines of the RCIC system are monitored for leaks by the leak detection system. Leaks from the RCIC will cause a change in at least one of the following monitored parameters: sensed equipment area temperatures, steam flow rate, or steam pressure. If the monitored variables indicate that a leak may exist, the detection system initiates an RCIC isolation signal.
| |
| Revision 12 7.6-5 January, 2003
| |
| | |
| The following is a description of each RCIC leak detection method:
| |
| : a. RCIC System Isolation - RCIC Equipment Area Temperature Monitoring (see item e. for the RHR Area description.)
| |
| High temperature in the RCIC equipment area could indicate a breach in the RCIC steam line reactor coolant pressure boundary.
| |
| Two redundant ambient area and differential temperature monitoring channels are provided. The redundant ambient area instrument provides input to one of two logic channels (ESF Division 1 or Division 2).
| |
| Using 1 out of 2 logic for a division, an RCIC equipment area high area ambient temperature initiates an isolation of either the RCIC system inboard or outboard isolation valves. The differential temperature is required to operate only when the RCIC room cooler is running and provides alarm only.
| |
| A bypass/test switch is provided in each logic channel for the purpose of testing the temperature monitor without initiating RCIC system isolation.
| |
| Diversity is provided by RCIC steam line flow and pressure monitoring.
| |
| : b. RCIC Flow Rate Monitoring The steam line flow rate from the reactor vessel leading to the RCIC turbine is monitored by four differential pressure transmitters. During high flow conditions, the flow rate trip unit initiates the auto-isolation signal. A time delay in each logic division prevents inadvertent system isolations due to pressure spikes <Section 7.4.1>.
| |
| Revision 14 7.6-6 October, 2005
| |
| | |
| High flow in the steam line initiates isolation of the RCIC system.
| |
| Diversity is provided by ambient temperature, differential temperature and RCIC steam line pressure monitoring.
| |
| : c. RCIC Pressure Monitoring The steam line pressure from the reactor vessel leading to the RCIC turbine is monitored by two pressure transmitters. In the presence of a leak, resulting in low line pressure, the RCIC pressure trip unit initiates the auto-isolation signal <Section 7.4.1>.
| |
| Diversity is provided by ambient temperature, differential temperature and RCIC steam line flow monitoring.
| |
| Outputs from the two monitoring circuits are used to generate the RCIC auto-isolation signals (one for each division) to isolate the inboard and outboard isolation valves.
| |
| : d. Main Steam Line Tunnel Area Temperature Monitoring High temperature in the MSL tunnel could indicate a breach in the reactor coolant pressure boundary.
| |
| Two redundant MSL ambient temperature and temperature monitoring channels are provided. Each redundant instrument provides input to one of two logic channels (Division 1 or Division 2).
| |
| Using 1 out of 1 logic for a division, a MSL tunnel high area ambient temperature initiates an isolation of either the RCIC inboard or outboard isolation valves.
| |
| Revision 15 7.6-7 October, 2007
| |
| : e. RCIC System Isolation - RHR Equipment Area Temperature Monitoring High Temperature in the RHR Equipment Areas could indicate a breach in the RCIC steam line reactor coolant pressure boundary, because some RCIC steam piping remains in the RHR equipment areas even after elimination of the Steam Condensing Mode of RHR, as shown on USAR Figure 3.6-70a.
| |
| Revision 14 7.6-7a October, 2005
| |
| | |
| Two redundant ambient temperature and temperature monitoring channels are provided for each of two RHR equipment areas. Each redundant instrument provides input to one of two logic channels (Division 1 or Division 2). Any high RHR equipment area ambient temperature for a division will initiate isolation of either the inboard or outboard RCIC isolation valves.
| |
| The differential temperature is required to operate only when the RHR room coolers are running.
| |
| 7.6.1.3.3 RHR System Leak Detection The RCIC steam supply line in the RHR heat exchanger rooms is monitored for leaks by the leak detection system as described above in Section 7.6.1.3.2.e. Also, leaks from the RHR reactor coolant pressure boundary are detected by equipment area ambient temperature monitoring, and by low water level in the reactor vessel. If the monitored parameters indicate that a leak exists, the LDS (ambient) initiates an RHR isolation signal.
| |
| Outputs from both circuits are used to generate the RHR auto-isolation signal (one for each division) to isolate the inboard and outboard isolation valves.
| |
| The following is a description of each RHR leak detection method:
| |
| : a. RHR System Isolation - RHR Equipment Area Temperature Monitoring High temperature in the equipment room areas of the RHR system could indicate a breach in the reactor coolant pressure boundary in the RHR system.
| |
| Revision 15 7.6-8 October, 2007
| |
| | |
| The RHR area temperature monitoring circuit is identical to the one described for the RCIC leak detection method <Section 7.6.1.3.2.e>.
| |
| Two redundant ambient and differential temperature monitoring channels are provided for each of two RHR equipment areas. Each Revision 14 7.6-8a October, 2005
| |
| | |
| redundant instrument provides input to one of two logic channels (Division 1 or Division 2).
| |
| Any high RHR equipment area ambient temperature for a division will initiate an isolation signal closing either the RHR inboard or outboard isolation valves.
| |
| The differential temperature is required to operate only when the RHR room coolers are running and provides an alarm function only.
| |
| A bypass/test switch is provided in each logic channel for the purpose of testing the temperature monitor without initiating RHR system isolation.
| |
| Diversity is provided by Reactor Vessel Water Level - Low, Level 3 monitoring.
| |
| : b. RHR Flow Rate Monitoring Flow rate monitoring is provided on the RCIC steam supply line to the RHR heat exchanger rooms by redundant differential pressure transmitters, which can initiate an isolation of the RCIC isolation valves, as described above in Section 7.6.1.3.2.b.
| |
| Revision 15 7.6-9 October, 2007
| |
| | |
| 7.6.1.3.4 Reactor Water Cleanup System Leak Detection The RWCU leak detection system monitors equipment area ambient and differential temperature and inlet and outlet differential flow.
| |
| Automatic isolation of the RWCU system isolation valves is initiated when monitored parameters indicate that leakage exists.
| |
| The following is a description of each RWCU leak detection method:
| |
| : a. RWCU Differential Flow Monitoring Refer to <Section 7.3.1>.
| |
| : b. RWCU Area Temperature Monitoring Refer to <Section 7.3.1>.
| |
| 7.6.1.4 Neutron Monitoring System (NMS) - Instrumentation and Controls The safety-related portions of the neutron monitoring system are the Intermediate Range Monitor (IRM), Local Power Range Monitor (LPRM),
| |
| Average Power Range Monitor (APRM) and Oscillation Power Range Monitor (OPRM).
| |
| : a. Neutron Monitoring System Function The neutron monitoring system instrumentation and controls are designed to monitor reactor power (neutron flux) from startup through full power operation.
| |
| Revision 14 7.6-10 October, 2005
| |
| : b. Neutron Monitoring System Operation The neutron monitoring system uses incore detectors, either fixed (LPRM) or retractable (IRM), to determine neutron flux levels.
| |
| NMS will initiate a scram when predetermined limits are exceeded and provide operator information during and after accident conditions.
| |
| The NMS component control logic is shown in <Figure 7.6-2>.
| |
| 7.6.1.4.1 Intermediate Range Monitor (IRM)
| |
| : a. IRM Function The IRM monitors neutron flux from the upper portion of the SRM range to the lower portion of the power range (APRM) as shown in
| |
| <Figure 7.6-3>.
| |
| : b. IRM Operation The IRM has eight channels, each of which includes one detector that can be positioned in the core by remote control. Refer to
| |
| <Figure 7.6-4>. The detectors are inserted into the core for a reactor startup and are withdrawn after the reactor mode selector switch is placed in the RUN position.
| |
| Each detector assembly consists of a fission chamber attached to a low-loss, quartz-fiber-insulated transmission cable. The detector cable is connected underneath the reactor vessel to a triple-shielded cable that is connected to the preamplifier.
| |
| The preamplifier converts current pulses to voltage pulses, modifies the voltage signal, and provides impedance matching. The Revision 12 7.6-11 January, 2003
| |
| | |
| preamplifier output signal is then sent to the IRM signal conditioning electronics.
| |
| Each IRM channel input signal from the preamplifier can be amplified and attenuated. IRM preamplification is selected by a remote range switch that provides 10 ranges of increasing attenuation (the first six are called low range, the last four are called high range). As the neutron flux of the reactor core increases, the signal from the fission chamber is attenuated to keep the input signal to the inverter in the same range. The output signal, which is proportional to neutron flux at the detector, is amplified and supplied to a locally mounted meter, a remote meter and recorder.
| |
| The IRM scram trip functions are discussed in <Section 7.2.1.1.b>.
| |
| The IRM trips are shown in <Table 7.6-1>.
| |
| The IRM range switches must be upranged or downranged to follow increases and decreases in power within the range of the IRM to prevent either a scram or a rod block. The IRM detectors should be inserted into the core whenever these channels are needed, and withdrawn from the core, when permitted, to prevent unnecessary burnup.
| |
| 7.6.1.4.2 Local Power Range Monitor (LPRM)
| |
| : a. LPRM Function The LPRMs provide localized neutron flux detection over the full power range for input to the APRM.
| |
| Revision 12 7.6-12 January, 2003
| |
| : b. LPRM Operation The LPRM includes 164 detectors located at 41 locations at different axial heights in the core; each detector location contains four fission chambers. <Figure 7.6-5> shows the LPRM detector radial layout scheme.
| |
| The LPRM assembly consists of four neutron detectors installed in a housing <Figure 7.6-6>.
| |
| The chambers are vertically spaced in a way that gives adequate axial coverage of the core, complementing the radial coverage given by the horizontal arrangement of the LPRM detector assemblies.
| |
| Each chamber consists of two concentric cylinders, which act as electrodes. The inner cylinder (the collector) is mounted on insulators and is separated from the outer cylinder by a small gap.
| |
| The gas between the electrodes is ionized by the charged particles produced as a result of neutron fissioning of the uranium-coated outer electrode. The chamber is operated at a polarizing potential of approximately 100 Vdc. The negative ions produced in the gas are accelerated to the collector by the potential difference maintained between the electrodes. In a given neutron flux, all the ions produced in the ion chamber can be collected if the polarizing voltage is high enough. When this situation exists, the ion chamber is considered to be saturated; output current is then independent of operating voltage.
| |
| Each location contains a calibration tube for a traversing incore probe. The enclosing tube around the entire assembly contains holes that allow circulation of the reactor coolant water to cool the tubes containing the ion chambers.
| |
| Revision 12 7.6-13 January, 2003
| |
| | |
| The current signals from the LPRM detectors are transmitted to the LPRM amplifiers in the control room through coaxial cable. The amplifier is a linear current amplifier whose voltage output is proportional to the current input and therefore proportional to the magnitude of the neutron flux. Low level output signals are provided that are suitable as an input to the computer, APRMs etc.
| |
| The output of each LPRM amplifier is isolated to prevent interference of the signal by inadvertent grounding or application of stray voltage at the signal terminal point.
| |
| When a central control rod is selected for movement, the output signals from the amplifiers associated with the nearest LPRM assembly are displayed on reactor control panel digital meters.
| |
| The four LPRM detector signals from the LPRM assembly are displayed on 4 separate digital meters. The operator can readily obtain readings on any individual LPRM assembly by selecting an adjacent control rod.
| |
| The trip circuits for the LPRM provide trip signals to activate lights, instrument inoperative signals, and annunciators. These trip circuits use the 24 Vdc power supply and are set to trip on loss of power. They also trip when power is not available for the LPRM amplifiers. <Table 7.6-2> indicates the trips.
| |
| Each LPRM channel may be individually bypassed. When the maximum number of bypassed LPRMs associated with any APRM channel has been exceeded, an inoperative trip is generated by that APRM.
| |
| Each individual chamber of the assembly is a moisture-proof, pressure-sealed unit. The chambers are designed to operate at 575F and 1,250 psig.
| |
| The detectors, cables and connectors are designed to remain accurately functional for drywell temperatures up to 330F and 100 percent relative humidity.
| |
| Revision 12 7.6-14 January, 2003
| |
| | |
| Power for the LPRM is supplied by the two 120 Vac ATWS/UPS buses.
| |
| Approximately half of the LPRMs are supplied from each bus. Each LPRM amplifier has a separate power supply (ICPS) in the control room, which furnishes the detector polarizing potential. This power supply is adjustable from 75 to 200 Vdc. The maximum current output is three milliamps. This ensures that the chambers can be operated in the saturated region at the maximum specified neutron fluxes. For maximum variation in the input voltage or line frequency, and over extended ranges of temperature and humidity, the output voltage varies no more than two volts. Each page of amplifiers is supplied operating voltages from a separate low voltage power supply.
| |
| 7.6.1.4.3 Average Power Range Monitor (APRM)
| |
| : a. APRM Function The function of the APRM is to average signals from the LPRMs and provide a flow reference reactor scram when neutron flux exceeds predetermined flux.
| |
| APRM signal levels are sent to the redundant reactivity control system logic if additional reactivity control is necessary following an ATWS event. The use of this signal is discussed in
| |
| <Section 7.6.1.12>.
| |
| : b. APRM Operation The APRM has eight redundant channels. Each channel uses input signals from a number of LPRM channels. Four APRM channels are associated with each trip system of the RPS.
| |
| The APRM channel uses electronic equipment that averages the output signals from a selected set of LPRMs, trip units that actuate Revision 12 7.6-15 January, 2003
| |
| | |
| automatic devices and signal readout equipment. Each APRM channel can average the output signals from as many as 24 LPRMs.
| |
| Assignment of LPRMs to an APRM follows the pattern shown in
| |
| <Figure 7.6-6>. Position A is the bottom position, Positions B and C are above Position A and Position D is the topmost LPRM detector position. The pattern provides LPRM signals from all four core axial LPRM detector positions.
| |
| The APRM amplifier gain can be adjusted by combining fixed resistors and potentiometers to allow calibration. The averaging circuit automatically corrects for the number of unbypassed LPRM amplifiers providing inputs to the APRM.
| |
| Refer to <Section 7.2.1> for a further description of the APRM inputs to the RPS.
| |
| The APRM channels receive power from the 120 Vac ATWS/UPS System.
| |
| 7.6.1.4.4 Oscillation Power Range Monitor (OPRM)
| |
| : a. OPRM Function The function of the OPRM is to detect and suppress evidence of reactor thermal-hydraulic instability in the core by providing a scram when regional (neutron flux) oscillations in the core exceed predetermined levels.
| |
| : b. OPRM Operation The OPRM system has four (4) redundant and independent trip channels and each channel contains two (2) OPRM modules. Each OPRM channel receives signals from existing LPRM signals. The assignment of the LPRM signals to each OPRM channel is grouped Revision 12 7.6-16 January, 2003
| |
| | |
| together such that the resulting OPRM response provides adequate coverage for monitoring regional oscillations.
| |
| The OPRM system is provided with a built-in self-test diagnostic program that is continuously performed on-line, which checks system operability. In addition, the self-test is performed when the system is returned to service.
| |
| Configuration and setpoint changes to the OPRM system are made using a maintenance terminal which is key-switch and password protected.
| |
| The OPRM trip circuits provide signals to the Reactor Protection System (RPS), activate local indication, and provide annunciator alarms. The trip signals to the RPS utilize relay modules to provide electrical isolation and compatibility. Local indicating lights are available on the OPRM modules. Annunciator alarms are provided in the control room for the OPRM Trip, OPRM Alarm, OPRM Bypass, OPRM Trip Enable and OPRM Inop. The OPRM Inop signal does not cause a scram nor does it affect the OPRM logic that interfaces with the RPS.
| |
| The OPRM system does not affect the other existing neutron monitoring (NMS) subsystems.
| |
| 7.6.1.5 Rod Pattern Control System (RPCS) - Instrumentation and Controls
| |
| : a. System Function The Rod Pattern Control System (RPCS) is a subsystem of the RC&IS
| |
| <Section 4.3.2.5>. When the thermal power is less than or equal to the Low Power Setpoint (LPSP), the RPCS functions as the Rod Revision 12 7.6-17 January, 2003
| |
| | |
| Pattern Controller (RPC); when the thermal power is above the LPSP, the RPCS functions as the Rod Withdrawal Limiter (RWL).
| |
| The purpose of the RPC is to minimize the consequences of the postulated Control Rod Drop Accident (CRDA) by restricting control rod patterns to those which have been analyzed to result in acceptable increases in fuel enthalpy during the CRDA
| |
| <Section 15.4.9>. The RPC also reduces the potential for a fast period scram by restricting control rod withdrawal to single notches for certain groups of control rods.
| |
| For changes in licensed operating power level, the LPSP is rescaled such that the absolute value remains the same.
| |
| The purpose of the RWL is to mitigate the consequences of the Rod Withdrawal Error (RWE) by restricting the maximum control rod withdrawal increments to those which have been analyzed to ensure that neither the safety limit minimum critical power ratio (MCPR) nor the fuel licensing basis linear heat generation rate (LHGR) are exceeded during control rod withdrawal <Appendix 15B>.
| |
| : b. System Operation Rods may be moved in either gang or single rod mode and in either single notch or continuous mode.
| |
| The RPCS is designed as a safety-related system with dual channels that are redundant and divisionally separate. Each channel consists of:
| |
| : 1. A set of rod position information reed switches contained in a dual rod position probe in each rod drive.
| |
| Revision 12 7.6-18 January, 2003
| |
| : 2. Separate cables to independent rod position multiplexers which are arranged one cabinet for each division.
| |
| : 3. Separate rod action control cabinets which are arranged one cabinet for each division and which have the electronic circuits which contain the RPCS control logic.
| |
| Each channel of RPCS receives the following inputs:
| |
| : 1. Position word which includes information on the following:
| |
| (a) Core coordinate (b) Full in (c) Full out (d) Drifting (e) Overtravel (f) Axial rod position (g) Data fault (h) Position bypass
| |
| : 2. Request word which includes information on the following:
| |
| (a) Core coordinate (b) Insert (c) Withdraw Revision 12 7.6-19 January, 2003
| |
| | |
| (d) Continuously Withdrawn (e) Continuously Insert (f) Reset rod drift (g) Test rod drift (h) Gang mode (i) Enter substitute position (j) Raw position data (k) RPC sequence selection
| |
| : 3. Alternate rod word which includes information of the following:
| |
| (a) Core coordinate (b) Selected (c) Full in (d) Full out (e) Drifting (f) Overtravel (g) Axial rod position (h) Data fault Revision 12 7.6-20 January, 2003
| |
| | |
| (i) Position bypass (j) Substitute position data (k) RPC withdraw permit (l) RPC insert permit (m) Selected gang (n) Selected group (o) Selected half
| |
| : 4. High power setpoint indication (HPSP),
| |
| : 5. Low power setpoint indication (LPSP),
| |
| : 6. Low power alarm point indication (LPAP),
| |
| : 7. Selected and driving.
| |
| First stage turbine pressure is the measured parameter which is used to determine how the thermal power relates to the HPSP, LPSP and LPAP. These trip function are input to the proper rod activity control cabinet. Each channel enforces the control rod movement restriction that is appropriate for the thermal power sensed by the instruments in that channel. The instruments that sense thermal power are continuously monitored with any out-of-service or gross failure being alarmed and indicated in the control room.
| |
| A means of comparing the outputs of the RPCS logic devices is provided as a way of monitoring the performance of the two Revision 12 7.6-21 January, 2003
| |
| | |
| channels. Both channels must be operable and have identical outputs before rod motion is permitted. Comparison failures and circuit failures or inoperative conditions are indicated in the control room. RPCS outputs are transmitted to the two activity control sections of the RC&IS in the form of rod select and drive permissive interlocks. The two RPCS channels provide inputs separately to the two separate activity controls. These two inputs are then treated as other rod block interlocks and further compared in the non-divisional rod drive portion of the RC&IS.
| |
| In addition to the periodic self-test mode of system operation, the RC&IS can be routinely checked for correct operation by manipulating control rods using the various methods of control.
| |
| Detailed testing and calibration can be performed by using standard test and calibration procedures for the various components of the reactor manual control circuitry.
| |
| Because of the possibility of failed rod position indication, provisions are made to substitute rod positions from one channel to the other. Substitute rod positions may be entered into the RPCS according to the following restrictions:
| |
| : 1. Substitute data shall not replace good data.
| |
| : 2. Not more than one rod per gang may have substitute data at one time.
| |
| : 3. Data from the other channel may not be used if it is substitute data.
| |
| Revision 12 7.6-22 January, 2003
| |
| : 4. Good data received will replace substitute data.
| |
| Because of the possibility of failed drives or stuck rods, the capability is provided for drive bypassing one rod. A drive bypassed rod will not move when selected in individual drive mode.
| |
| During shutdown, an approach alarm, called the low power alarm point (LPAP), is provided so that the operator may position the rods into a valid pattern for proper shutdown below the LPSP. A control room annunciator is also provided to alert the operator that power is at or below the LPSP.
| |
| A keylocked switch and alarm is provided in the control room to override the LPSP interlock. The override switch will only be used when:
| |
| : 1. Reactor power is below the LPSP and the control rods are out of sequence as specified by the appropriate step in the Emergency Operating Procedures (EOPs). The operator will rapidly insert control rods using the In Timer Skip.
| |
| : 2. During a reactor shutdown utilizing the Improved BPWS Control Rod Insertion Process as described in USAR,
| |
| <Section 4.3.2.5.2>.
| |
| All bypass switches are under keylock control. All bypass conditions including unknown and substitute rod positions are indicated in the control room and are logged by the process computer (if available).
| |
| Revision 16 7.6-23 October, 2009
| |
| : c. RPCS Logic The control logic and rod group identification information are in electronic Read Only Memory (ROM) circuits contained in the rod action control cabinets. These ROMs are not site programmable except through engineering design change requiring new electronic circuit cards. These circuit cards may be changed to reflect cycle-dependent physics analysis.
| |
| The rod group identification is presented in <Figure 4.3-27>,
| |
| <Figure 4.3-28>, <Figure 4.3-29>, and <Figure 4.3-30>.
| |
| Revision 16 7.6-23a October, 2009
| |
| | |
| The capability is provided for position bypassing up to 8 rods, with the bypass capacity of the system expandable up to a maximum of 20 rods. Position bypassed rods are not be checked by either the RPC logic or the RWL logic; therefore, neither insert nor withdraw inhibits are generated for position bypassed control rods.
| |
| The RPCS does not generate insert inhibits for control rods that are Full In; nor does it generate withdraw inhibits for control rods that are Full Out.
| |
| The RWL logic does not generate any insert inhibits. The RWL generates withdrawal inhibits when the position of the control rod or gang reaches a predetermined increment relative to the position at the time of selection. Between the LPSP and the high power setpoint (HPSP), this increment is four notches; above the HPSP, this increment is two notches. Also, while in continuous drive mode, the increment is one notch less than it would be otherwise.
| |
| This one notch reduction prevents overshoot of the original incremental withdrawal limit.
| |
| The RPC mitigates the consequences of the postulated control rod drop accident (CRDA) by enforcing the following bank position withdrawal sequence restrictions on the control rod movement:
| |
| NOTE: For the sake of brevity, the restrictions on the converse groups are shown in parentheses.
| |
| : 1. Groups 5, 6, 7, 8, 9, and 10 must be fully inserted before Group 1, 2, 3, or 4 can be moved.
| |
| : 2. Groups 1 and 2 (3 and 4) must be fully inserted or fully withdrawn before Group 3 or 4 (1 or 2) can be moved.
| |
| Revision 12 7.6-24 January, 2003
| |
| : 3. If Groups 1 and 2 (3 and 4) are fully inserted, Groups 3 and 4 (1 and 2) can be moved without banking at axial positions.
| |
| : 4. If Groups 1 and 2 (3 and 4) are fully withdrawn, all rods in Groups 3 and 4 (1 and 2) must be banked at axial positions.
| |
| : 5. For a group to be banked at axial positions, all control rods in a group must be between the same group axial bank limits, inclusive.
| |
| : 6. After moving any Group 1, 2, 3, or 4 control rod, all control rods in that group must be either fully withdrawn or fully inserted before moving any control rod in any other group.
| |
| : 7. The order of control rod movement within a group is arbitrary.
| |
| : 8. Groups 1, 2, 3 and 4 must be fully withdrawn before Group 5, 6, 7, 8, 9, or 10 can be moved.
| |
| : 9. For any rod in a banked group to be moved past an axial bank position, all rods in that group must be at the same axial bank limit.
| |
| : 10. If Group 9 or 10 (7 or 8) is not full in, Groups 5 and 6 and either Group 9 or 10 (7 or 8) must be at or beyond axial bank Position 12 in order for Group 7 or 8 (9 or 10) to be moved.
| |
| See General Electric NEDO-21231, January 1977, for additional information of the banked position withdrawal sequence. Exception to General Electric NEDO-21231, January 1977, may be taken for Alternate control rod scram time testing provided that the exception does not result in exceeding the bounding analysis Revision 12 7.6-25 January, 2003
| |
| | |
| criteria used in General Electric NEDO-21231, January 1977. The supporting analysis is documented in the following letters from General Electric: TCL-88039, TCL-8905, TCL-8910, and TCL-9022.
| |
| The RPC reduces the potential for a fast period scram by enforcing the following reduced notch worth procedure restrictions on control rod movement:
| |
| NOTE: For the sake of brevity, the restrictions on the converse groups are shown in parentheses.
| |
| : 1. If Groups 1 and 2 (3 and 4) are fully withdrawn, Groups 5, 6,7, 8, 9, 10, and 3 and 4 (1 and 2) must be withdrawn in single notch mode below axial bank Position 12.
| |
| See General Electric Service Information Letter No. 316, November 1979, for additional information on reduced notch worth procedure.
| |
| 7.6.1.6 Recirculation Pump Trip (RPT) System - Instrumentation and Controls
| |
| : a. System Function The recirculation trip system is designed to aid the RPS in protecting the integrity of the fuel barrier. Turbine stop valve closure or turbine control valve fast closure will initiate a scram and concurrent recirculation trip in order to keep the core within the thermal hydraulic safety limits during operational transients.
| |
| : b. System Operation Initiating circuitry is shown on <Figure 7.2-1>. RPS inputs sense turbine stop valve closure (turbine trip) or turbine control valve Revision 12 7.6-26 January, 2003
| |
| | |
| fast closure (load rejection). These inputs utilize four-division RPS logic and are combined into the two-divisional two-out-of-two systems utilized for RPT function. The devices used to sense turbine trip and full load rejection are discussed in
| |
| <Section 7.2.1>.
| |
| The basic logic arrangement is a two-divisional two-out-of-two design for the turbine control valve and the turbine stop valve.
| |
| It receives signals from each of four RPS divisions. Initiation requires confirmation by sensors located in two or more RPS divisions. Failure to initiate requires failure in more than two RPS divisions. Inputs per division are combined in two-out-of-two configurations. The Technical Specifications require that the RPT Instrumentation channels meet response time criteria.
| |
| <Table 7.6-3> provides the acceptable response times for these channels along with any clarifying information.
| |
| Each RPT division causes both recirculation pumps to trip off the main power supply.
| |
| 7.6.1.7 Fuel Pool Cooling System (FPC) - Instrumentation and Controls
| |
| : a. FPCS Function The function of the FPC system is to remove decay heat from the spent fuel storage pool to ensure adequate cooling of irradiated stored fuel assemblies. The FPC system also purifies the storage pool water, maintains water clarity for fuel handling operations, and fills and drains the fuel transfer canal <Section 9.1.3>.
| |
| Revision 12 7.6-27 January, 2003
| |
| : b. FPC System Operation The FPC system consists of two redundant cooling loops.
| |
| Instrumentation is provided to monitor the pool temperature, pump suction and discharge pressures, and water conductivity to allow the control room operator to assess system operation.
| |
| The fuel pool cooling and cleanup system also provides cooling and cleanup of the pool located inside the containment.
| |
| During accident conditions, the containment pool cooling and cleanup operation is automatically isolated from the fuel pool cooling and cleanup system.
| |
| The circulating pumps are controlled manually from the control room. The operating pump will be tripped by low-low level in the surge tank. Flow instrumentation monitors the flow rates through the system loops and remote-manual adjustment of flow control valves is made to establish the required flow patterns. Surge tank level is also indicated and annunciated in the control room for high and low level conditions. Low circulating pump discharge pressure is also annunciated in the control room.
| |
| Fuel storage and preparation pool and spent fuel storage pool water level is monitored with both high and low water level conditions being annunciated in the control room. Temperature for these pools is also monitored with indication and high temperature annunciation in the control room.
| |
| Cask pit drain pump high suction pressure is monitored and used as a permissive to start the pump. Pump discharge flow is monitored with a flow switch to provide a pump trip interlock during low discharge flow conditions.
| |
| Revision 12 7.6-28 January, 2003
| |
| | |
| The fuel transfer tube drain pumps for the fuel transfer tube drain tank are controlled by high and low level switches on the fuel transfer tube drain tank. Controls are supplied so that either one or both pumps may be actuated or deactuated by the level signals.
| |
| A high level signal will automatically start one or both pumps, depending on the operating position of the control switches. The pump(s) are tripped by a signal from a low level switch on the tank. Low and high level conditions are annunciated in the control room.
| |
| Redundant level and temperature instrumentation is provided to alarm in the control room for conditions of high or low water level and high water temperature in the containment pools.
| |
| The filter demineralizer flow controller senses flow out of the filter demineralizer and modulates the control valves to maintain the desired flow. On low flow from the main system, the filter demineralizer is taken off stream by automatically closing the discharge valves, and the holding pump is automatically started to maintain the filter medium on the filter elements. Filter precoating and backwashing are manually initiated automatic operations. The valves which are required to ensure proper alignment of the system for each operating mode are provided with position indication on the local control panel.
| |
| The areas under the containment pools and fuel handling area pools are monitored for leaks with high leakage being alarmed in the control room.
| |
| Cooling water conductivity is monitored for water chemistry.
| |
| Surge tank level is interlocked with the circulating pumps to trip the operating pump on a low-low level condition.
| |
| Revision 12 7.6-29 January, 2003
| |
| | |
| The containment pool cooling portion of the system is automatically isolated by a motor control valve upon receipt of an isolation signal for reactor vessel low-low level or high drywell pressure.
| |
| During a LOCA, the fuel pool filter demineralizer system is automatically isolated from the cooling portion of the system. The fuel pool filter/demineralizer system can be bypassed by means of a motor control valve controlled from the control room. A hand operated bypass valve is also provided in parallel with a motor control bypass valve.
| |
| 7.6.1.8 Containment Atmosphere Monitoring System - Instrumentation and Controls
| |
| : a. System Function The containment atmosphere monitoring system instrumentation and controls <Figure 7.6-7> are intended to detect and aid in the prediction of the progression of abnormal occurrences inside the containment and to monitor the containment after postulated accidents.
| |
| : b. System Operation All safety-related pressure and temperature channels are recorded with the recorder appearing on the postaccident monitoring panel in the control room.
| |
| Redundant temperature sensors are located in the drywell, containment and suppression pool. Each channel of suppression pool temperature sensors transmits the sensors signals to temperature switches and then to two and four position selector switches located on the postaccident monitoring panel for providing Revision 12 7.6-30 January, 2003
| |
| | |
| selection of suppression pool temperature indication on a single indicator located on the ECCS benchboard. A common alarm for each channel for indication of high suppression pool temperature is annunciated in the control room.
| |
| Temperature signals from sensors located in the drywell and the containment are recorded in the control room. An alarm for high average drywell temperature per division and a common alarm for high containment temperature for each channel are annunciated in the control room. Average drywell temperature associated with each division is indicated in the Control Room.
| |
| One temperature sensor from each redundant channel in the containment has its signal indicated in the control room.
| |
| Drywell/containment differential pressure is measured and indicated in the control room for each channel. Each channel also has separate annunciators in the control room for high positive differential and high negative differential pressure. Drywell pressure narrow range and wide range measurements are recorded in the control room with the narrow range measurement also indicated and annunciated in the control room.
| |
| Containment pressure normal and wide range are also measured with redundant channels, with each normal range channel being indicated, recorded, and annunciated for high containment pressure in the control room, and each wide range channel being recorded in the control room.
| |
| All pressure sensing lines which penetrate the containment have an isolation valve inline which is controlled from the control room with valve position status lights indicated in the control room.
| |
| Revision 12 7.6-31 January, 2003
| |
| | |
| Redundant safety-related channels exist for monitoring drywell temperature, drywell pressure, suppression pool temperature, and level for recording on the Division 1 and Division 2 remote shutdown panels.
| |
| Three suppression pool level sensing lines form part of the suppression pool makeup system. However, the isolation valves for these lines are part of the containment atmosphere monitoring system. Two redundant lines receive Division 1 and Division 2 power. The third line senses suppression pool level for high pressure core spray system instrumentation and receives Division 3 power. Containment humidity is determined by the plant computer system which receives electrical inputs from a nonsafety-related temperature and a moisture sensor, each of which are located so as to detect general containment conditions.
| |
| Indicators, annunciators and recorders are located in the control room. Temperature sensors are located inside the containment and drywell. All controls, instrumentations and sensors have been selected to meet the normal, accident and postaccident worst case environmental conditions of temperature, pressure, humidity, radiation, and vibrations expected at their respective locations.
| |
| Refer to <Section 3.11> for equipment qualification.
| |
| 7.6.1.9 Hydrogen Control System
| |
| : a. System Function The hydrogen control system (HCS) consists of 102 igniter assemblies mounted throughout the containment and drywell. Each igniter assembly is capable of igniting low volumetric concentrations of hydrogen present during a hydrogen generation event. This postulated event creates large quantities of hydrogen Revision 12 7.6-32 January, 2003
| |
| | |
| which are controlled by burning before the hydrogen is allowed to pocket or increase to high concentrations which could threaten containment integrity or equipment survivability. The igniters are located throughout the containment and drywell areas to avoid buildup of hydrogen in local areas.
| |
| : b. System Operation The hydrogen control system is operated in accordance with the Emergency Operating Procedures (EOPs). Prior to the hydrogen concentration reaching a predetermined hydrogen concentration (minimum detectable level) in the drywell or containment, or the reactor vessel water level reaching above top of active fuel, the hydrogen igniters are placed in service. The igniters are energized by two OFF-NORM-ON handswitches located in the control room on panel H13-P800. Red-green indication lights for each handswitch are provided. There are no interlocks associated with the hydrogen control system.
| |
| After manual initiation, the igniters are capable of providing their functions for up to seven days. The system is manually de-energized by the operator turning both handswitches to OFF when the hydrogen generation event has passed. The hydrogen igniters are secured automatically if power to the igniters is lost and manually if the hydrogen concentrations inside drywell or containment cannot be determined to be below predetermined hydrogen concentration limits.
| |
| 7.6.1.10 Offgas Building Exhaust System
| |
| : a. System Function The function of this system is to exhaust air from potentially contaminated areas through a charcoal filter train prior to discharging it to the atmosphere.
| |
| Revision 15 7.6-33 October, 2007
| |
| : b. System Operation Schematic arrangement of mechanical equipment and instrumentation is shown on <Figure 9.4-10>.
| |
| The main components of this system consist of two-100 percent capacity charcoal filter trains and two-100 percent capacity exhaust fans.
| |
| Instrumentation is provided for indication in the control room of the following:
| |
| : 1. Indication of which fan is operating (status light).
| |
| : 2. Low air flow with fan operating for each fan (alarm).
| |
| : 3. High and high-high temperature in the charcoal filter beds (alarm and readout).
| |
| : 4. High radioactivity in the exhaust air before and after the filters (alarm).
| |
| : 5. Smoke in each exhaust fan discharge duct (alarm).
| |
| : 6. Motor overload or power loss for each fan (alarm).
| |
| The offgas exhaust system is manually initiated from the control room.
| |
| The standby fan is automatically started when differential pressure switches across the operating fan detect low flow.
| |
| Revision 12 7.6-34 January, 2003
| |
| | |
| 7.6.1.11 Safety/Relief Valves (SRV) - Relief Function 7.6.1.11.1 SRV Function The relief function of the SRVs is to relieve high pressure conditions in the nuclear system that could lead to the failure of the reactor coolant pressure boundary. The system activates the safety/relief valves to vent steam to the suppression pool and reduce reactor pressure. A low-low set feature is also provided to enable the relief function of the SRVs to meet the containment design basis. The containment design basis requires that during the initial surge of an overpressure event, enough steam is vented so that subsequent surges during the same event shall require not more than one SRV to reopen.
| |
| See <Section 5.2.2> for further details. Also, see
| |
| <Section 7.3.1.1.1.2> for the ADS function of selected SRVs.
| |
| 7.6.1.11.2 SRV Operation Schematic arrangement of system mechanical equipment is shown in
| |
| <Figure 5.1-3>. The SRV component control logic is shown in
| |
| <Figure 7.3-5>. Instrument location drawings and elementary diagrams are identified in <Section 1.7>.
| |
| The relief function of the SRVs is provided by two redundant and independent trip systems A and B. Relief trip system A actuates the A solenoid air pilot valve on each SRV. Similarly, relief trip system B actuates the B solenoid pilot valve on each SRV. Either or both solenoid actuations allow pneumatic pressure from the accumulator to act on the air cylinder operator, and open the valve.
| |
| Operation of the SRVs is initiated by high reactor vessel pressure.
| |
| Redundant reactor vessel pressure channels are provided in each trip Revision 12 7.6-35 January, 2003
| |
| | |
| system which operate in a two-out-of-two configuration in order to prevent inadvertent SRV actuation. Each trip system provides the following capabilities:
| |
| : a. Over Pressure Relief Feature Initiate operation of three groups (Low, Middle, High) of SRVs, at three respective pressure setpoints. This feature automatically adjusts the relief capacity to the size of the overpressure condition. The reclose pressure setpoint (reset) for any group is separately adjusted, and adequate deadband is provided to eliminate rapid open/close operation and minimize system stresses.
| |
| : b. Low-Low Set Point Relief Logic In order to assure that no more than one relief valve reopens following a reactor isolation event, six SRV valves are provided with lower opening and closing setpoints. These setpoints override the normal setpoints following the initial opening of the relief valves and act to hold these valves open longer, thus preventing more than a single valve from reopening subsequently. This system logic is referred to as the low-low setpoint relief logic and functions to ensure that the containment design basis of one safety/relief valve operating on subsequent actuations is met.
| |
| This logic is armed when two or more valves are signaled to open from their normal relief pressure switches. At this time, the low-low set logic automatically seals itself into control of the six selected valves. This logic remains sealed in until manually reset by the operator.
| |
| Since the valves will already have opened from their original pressure relief signals, the low-low set logic acts to hold them open past their normal reclose point until the pressure decreases Revision 12 7.6-36 January, 2003
| |
| | |
| to a predetermined low-low setpoint. Thus, these valves remain open longer than the other safety/relief valves. This extended relief capacity assures that no more than one valve will reopen a second time. Also, the sealed-in logic provides the low-low set valves with new reopening setpoints which are lower than their original S/R setpoints. The medium low-low set valve acts as a backup for the low low-low set valve, should it mechanically fail. See <Section 5.2.2> for further system description.
| |
| The low-low set logic is designed with redundancy and single failure criteria, i.e., no single electrical failure will: (1) prevent any low-low set valve from opening, (2) cause inadvertent seal-in of low-low set logic.
| |
| The six valves associated with low-low set are arranged in three independent secondary setpoint groups or ranges (low, medium, high). The low and medium pressure ranges consist of one valve each, having both reopen and reclose setpoints independently and uniquely adjustable. These are set considerably lower than their normal SRV setpoints. The remaining valves are individually controlled by new pressure switches which have an independently adjustable reclose setpoint. The SRV opening setpoints are unchanged for this valve group though reclose is extended in the low-low set operating mode.
| |
| The pressure switches are arranged in two divisions for each low-low set valve. The single-failure criterion is thus met for this function.
| |
| The SRV system has two low-low setpoint logics, one in Division 1 and one in Division 2. Either one can perform the low-low set function. A key-locked switch, which has an Off, Auto and an Open position is provided for each valve. The key is removable only in the Auto position. When the key is inserted and switched Revision 12 7.6-37 January, 2003
| |
| | |
| to Off an annunciator will alert the operator of the status. A valve with its control switch in the Off position will not respond to the high reactor pressure signals should they occur.
| |
| Indicator lights are switched in series with the solenoid coils on the low-low set valve to facilitate logic testing without actually actuating the valves. The annunciator will not clear until the key is returned to the Auto or Open positions.
| |
| Manual system level initiation capability is included in each trip system. Remote-manual switches are installed in the control room.
| |
| Lights in the main control room indicate when the solenoid-operated pilot valves are energized to open a safety/relief valve.
| |
| 7.6.1.12 Anticipated Transient Without Scram (ATWS) -
| |
| Instrumentation & Controls 7.6.1.12.1 Redundant Reactivity Control System (RRCS)
| |
| The redundant reactivity control system is a system designed to mitigate the potential consequences of an anticipated transient without scram (ATWS) event. The system consists of control panels, their associated ATWS detection sensors and actuation logic and the necessary interface logic for those systems required to perform specific functions in response to an ATWS event.
| |
| 7.6.1.12.2 RRCS Operation The RRCS consists of reactor pressure and reactor water level sensors, solid state logic, control room cabinets and indications, and interfaces with several systems actuated to mitigate an ATWS event <Figure 7.6-8>.
| |
| The solid state logic is divided into Division 1 and Division 2 each of which is subdivided into Channels A and B. The logic is energized to trip and both Channels A and B of either division must be tripped in order to initiate the RRCS protective actions. The system can be Revision 12 7.6-38 January, 2003
| |
| | |
| manually initiated by depressing two pushbuttons (tripping both Channels A and B) in the same division. This manual initiation function is designed so that no single operator action can result in an inadvertent initiation. The pushbuttons collar must be rotated to arm the switch before depressing will trip the logic. The manual initiation pushbuttons are located in the control room near the RPS manual scram pushbuttons. There are four RRCS manual initiation pushbuttons. The RRCS is initiated either by manual initiation or when the RRCS detection sensors reach the reactor high dome pressure setpoint or the reactor low water Level 2 setpoint. It is the initiation of the RRCS that causes the alternate rod insertion (ARI) to initiate a scram and the recirculation pump trip (RPT).
| |
| 7.6.1.12.3 Alternate Rod Insertion (ARI)
| |
| The ARI group of valves provides an alternate means of accomplishing the scram (see <Figure 7.6-9> for ARI valves). The ARI trip logic performs the following functions: (1) cutoff of instrument air supply to the scram pilot air header; (2) vent the scram pilot air header; and (3) isolate the scram discharge volume. These ARI valves are controlled by the RRCS signals and therefore independent from the RPS signals which control the normal scram logic and the normal scram related valves.
| |
| Furthermore, the main scram valves are activated by de-energization of the solenoids while the ARI valves are activated by the energization of its solenoids. The ARI and RRCS are designed to allow insertion of all control rods to begin within 15 seconds.
| |
| 7.6.1.12.4 Recirculation Pump Trip (RPT)
| |
| The RRCS sensors and logic are also designed to automatically initiate the RPT logic whenever the reactor pressure or the reactor water level Revision 12 7.6-39 January, 2003
| |
| | |
| reaches the RCCS sensor settings. The low reactor water Level 2 signal will completely trip the recirculation pumps by tripping the 13.8 kV supply breakers and the low frequency motor generator (LFMG) supply breakers. The high vessel pressure signal will trip the 13.8 kV supply breakers and transfer the recirculation pumps to the LFMG sets. The LFMG supply breakers will then be tripped and feedwater runback will be initiated if the APRM upscale remains for 25 seconds. The RPT is a Class 1E system. Manual RRCS initiation does not initiate RPT or feedwater runback.
| |
| 7.6.1.12.5 Other RRCS Features The RRCS is continually checked by a solid state microprocessor based self-test system. This self-test system checks the RRCS sensors, logic, protective devices, and itself.
| |
| Nuclear boiler system instrumentation is provided to monitor reactor vessel high dome pressure and low vessel water level. The sensors, transducers and trip units are Class 1E, independent from the RPS, and environmentally qualified to perform their protective function during ATWS events.
| |
| The APRMs provide a downscale trip signal to the RRCS permissive logic.
| |
| This signal is Class 1E and contains all available channels of input.
| |
| APRM signals from NMS Division 1 and Division 2 are routed to RRCS Division 1 through isolators, and APRM signals from NMS Division 3 and Division 4 are sent to RRCS Division 2 through isolators
| |
| <Figure 7.6-10>. Loss of power to an APRM channel or an APRM INOP condition will result in an RRCS permissive signal. Bypassing an APRM channel will prevent the bypassed APRMs not downscale or INOP trip from supplying a permissive.
| |
| Each RRCS channel can be manually reset by depressing the RRCS reset pushbuttons (four, one for each tripped channel) provided that ARPM Revision 12 7.6-40 January, 2003
| |
| | |
| power is downscale and seal-in period has elapsed. When the RRCS is reset the following seal-in signals are broken:
| |
| : a. Low water Level 2 recirculation trips
| |
| : b. Manual initiation
| |
| : c. High reactor pressure recirculation trips and feedwater runback signal.
| |
| The RRCS ARI function is reset by the RRCS ARI reset pushbuttons. This second set of four pushbuttons (one for each channel) will enable the reset of the ARI logic 30 seconds after initiation of ARI provided that initiating signals have cleared. This 30-second time delay before the ARI reset permissive appears is designed to assure that the RRCS ARI scram goes to completion.
| |
| The RRCS is a two-divisional system <Figure 7.6-10>. Separation is maintained between the redundant portions of the system to assure compliance with the separation and single failure criteria. Two channels in a given division are kept separate until they terminate on a common device. This separation is done to satisfy the single failure criterion. The two divisions of RRCS logic are designed so that either can cause LFMG trip and feedwater runback when a sufficient power reduction has not occurred. There is no RRCS bypass or operating bypass. The RRCS meets IEEE 279-1971 and <Regulatory Guide 1.75>,
| |
| Revision 1.
| |
| 7.6.1.13 Design Basis The safety-related systems described in <Section 7.5> are designed to provide timely protective action inputs to other safety systems to protect against the onset and consequences of conditions that threaten Revision 12 7.6-41 January, 2003
| |
| | |
| the integrity of the fuel barrier and the reactor coolant pressure boundary. <Chapter 15> and <Appendix 15A> identify and evaluate events that jeopardize the fuel barrier and reactor coolant pressure boundary.
| |
| The methods of assessing barrier damage and radioactive material releases, along with the methods by which abnormal events are identified, are also presented in <Chapter 15>.
| |
| The station conditions which require protective actions are described in
| |
| <Chapter 15> and <Appendix 15A>.
| |
| : a. Variables Monitored to Provide Protective Actions The following variables are monitored in order to provide protective action inputs:
| |
| : 1. High Pressure/Low Pressure Interlocks (a) Reactor pressure
| |
| : 2. Leak Detection System (a) RCIC area temperatures - ambient (b) RCIC steam line flow rate (c) RCIC steam line pressure (d) RHR area temperatures - differential and ambient (e) RWCU area temperatures - differential and ambient (f) RWCU differential flow Revision 12 7.6-42 January, 2003
| |
| | |
| (g) RHR/RCIC steam line flow rate (h) MSL tunnel temperatures - differential and ambient (i) MSL temperatures, turbine building (j) MSL flow
| |
| : 3. Neutron Monitoring System (a) IRM neutron flux (b) APRM neutron flux (c) OPRM neutron flux oscillations
| |
| : 4. Rod Pattern Control System (a) Reactor Power Level (b) Control Rod Selection
| |
| : 5. Recirculation Pump Trip System (a) Turbine Stop Valve Closure (b) Turbine Control Valve Fast Closure
| |
| : 6. Fuel Pool Cooling System (a) Fuel Transfer Tube Drain Tank Level (b) High Drywell Pressure Revision 12 7.6-43 January, 2003
| |
| | |
| (c) Reactor Vessel Low Water Level (Level 1 & 2)
| |
| (d) Low Demineralizer Flow (e) Fuel Pool High/Low Level (Alarm Only)
| |
| (f) Fuel Pool High Temperature (Alarm Only)
| |
| : 7. Containment Atmosphere Monitoring System This system has no automatic protective actions. Its function is to monitor conditions and provide information.
| |
| : 8. Offgas Building Exhaust System This system has no automatic protective actions.
| |
| : 9. Safety/Relief Valves - Relief Function (a) Reactor Vessel Pressure
| |
| : 10. Redundant Reactivity Control System (a) Reactor Pressure (b) Reactor Vessel Water Level (c) Reactor Power The plant conditions which require protective action involving the safety-related systems discussed in <Section 7.6> are described in
| |
| <Chapter 15> and <Appendix 15A>.
| |
| Revision 12 7.6-44 January, 2003
| |
| : b. Location and Minimum Number of Sensors See Technical Specifications for the minimum number of sensors required to monitor safety-related variables. The IRM and LPRM detectors are the only sensors which have spatial dependence.
| |
| : c. Prudent Operational Limits Operational limits for each safety-related variable trip setting are selected with sufficient operating levels so that a spurious safety system initiation is avoided. It is then verified by analysis that the release of radioactive materials, following postulated gross failures of the fuel or nuclear system process barrier, is kept within acceptable bounds.
| |
| : d. Margin The margin between operational limits and the limiting conditions of operation of the safety-related systems are accounted for in Technical Specifications.
| |
| : e. Levels Levels requiring protective action are established in Technical Specifications.
| |
| : f. Range of Transient, Steady-State and Environmental Conditions Environmental conditions for proper operation of components of instrumentation systems required for safety are discussed in
| |
| <Section 3.11>.
| |
| Revision 12 7.6-45 January, 2003
| |
| | |
| Environmental conditions for proper operation of the systems described in <Section 7.6> are discussed in <Section 3.10> and
| |
| <Section 3.11>.
| |
| : g. Malfunctions, Accidents and Other Unusual Events Which Could Cause Damage to Safety Systems
| |
| <Chapter 15> and <Appendix 15A> describe the following credible accidents and events; floods, storms, tornadoes, earthquakes, fires, LOCA, pipe break outside containment, and missiles.
| |
| : 1. Floods The buildings containing safety-related components have been designed to meet the PMF (probable maximum flood) at the site location. This ensures that the buildings will remain water tight under PMF including wind generated wave action and wave runup. Therefore, none of the functions are affected by flooding. For a discussion of internal flooding protection refer to <Section 3.4.1> and <Section 3.6>.
| |
| : 2. Storms and Tornadoes The buildings containing safety-related components have been designed to withstand all credible meteorological events and tornadoes as described in <Section 3.3>.
| |
| : 3. Earthquakes The structures containing safety-related system components have been seismically qualified as described in <Section 3.7>
| |
| and <Section 3.8>, and will remain functional during and following a safe shutdown earthquake (SSE).
| |
| Revision 12 7.6-46 January, 2003
| |
| : 4. Fires To protect the safety systems in the event of a postulated fire, the components have been separated by distance or fire barriers. The use of separation and fire barriers ensures that, even though some portion of the system may be affected, the safety function will not be prevented <Section 9.5.1>.
| |
| : 5. LOCA The safety-related systems components described in
| |
| <Section 7.6> located inside the drywell and functionally required during and/or following a LOCA have been environmentally qualified to remain functional as discussed in
| |
| <Section 3.11>.
| |
| : 6. Pipe Break Outside Containment Protection for these components is described in <Section 3.6>.
| |
| : 7. Missiles Protection for safety-related components is described in
| |
| <Section 3.5>.
| |
| : h. Minimum Performance Requirements Minimum performance requirements for safety-related systems instrumentation and controls are provided in the Technical Specifications.
| |
| Revision 12 7.6-47 January, 2003
| |
| | |
| 7.6.1.14 Final System Drawings The final system drawings including piping and instrumentation diagrams (P&ID), functional control diagrams (FCD)/control logic diagrams and instrument and electrical drawings (IED), have been provided or referenced for the safety-related systems in this section.
| |
| Electrical interconnection and elementary diagrams are listed in
| |
| <Section 1.7.1>.
| |
| 7.6.2 ANALYSIS 7.6.2.1 Safety-Related Systems - Instrumentation and Controls
| |
| <Chapter 15> evaluates the individual and combined capabilities of the safety-related systems described in <Section 7.6>.
| |
| The safety-related systems described in <Section 7.6> are designed such that a loss of instrument air, a plant load rejection or a turbine trip will not prevent the completion of the safety function.
| |
| Analysis for Safety/Relief valves is covered in ADS analysis in
| |
| <Section 5.2.2>.
| |
| 7.6.2.2 Conformance to <10 CFR 50, Appendix A> - General Design Criteria (GDC)
| |
| The following is a discussion of conformance to those General Design Criteria which apply specifically to the safety-related systems described in <Section 7.6>. Refer to <Section 7.1.2.2> for a discussion of General Design Criteria which apply equally to all safety-related systems.
| |
| Revision 12 7.6-48 January, 2003
| |
| | |
| GDCs for the NMS and process radiation monitoring system are discussed in <Section 7.2.2.1> and <Section 7.3.2.1.1>, respectively.
| |
| : a. Criterion 12 - Suppression of Reactor Power Oscillations The NMS provides protective actions to the RPS to assure that fuel design limits are not exceeded.
| |
| : b. Criterion 21 The RRCS is designed for high functional reliability and its logic can be tested for the safety functions to be performed. No single failure in this two divisional, four channel protection system will result in the loss of the protective functions.
| |
| : c. Criterion 24 The RRCS protection system interfaces with control systems through isolation devices. Specifically, the RRCS signals to the recirculation system pump and LFMG breakers and the signal to the feedwater system to initiate runback both pass through isolators.
| |
| This assures that electrical failures in the control systems cannot propagate back into the RRCS system and therefore cannot prevent other channels in the RRCS divisions from performing their protective functions.
| |
| : d. Criteria 30, 34, 35 The leak detection system provides means for detecting the source of reactor coolant leakage.
| |
| : e. Criterion 41 See <Section 7.6.1.9> (Hydrogen Control System)
| |
| Revision 12 7.6-49 January, 2003
| |
| | |
| 7.6.2.3 Conformance to IEEE Standards The following is a discussion of conformance to those IEEE standards which apply specifically to the safety-related systems described in
| |
| <Section 7.6>. Refer to <Section 7.1.2.3> for a discussion of IEEE standards which apply equally to all safety-related systems.
| |
| : a. IEEE Standard 279 - Criteria for Protection Systems for Nuclear Power Generating Stations
| |
| : 1. General Functional Requirement (IEEE Standard 279, Paragraph 4.1)
| |
| The safety-related systems described in <Section 7.6>
| |
| automatically initiate protective actions when a condition monitored reaches a preset level for all conditions described in the design bases <Section 7.6.1>. For example, the leak detection system initiates containment isolation by closure of containment isolation valves when area temperatures exceed preset limits.
| |
| : 2. Single Failure Criterion (IEEE Standard 279, Paragraph 4.2)
| |
| The safety-related systems described in <Section 7.6> are not required to meet single failure criteria on an individual system basis. However, on a network basis, the single failure criteria does apply to assure the completion of a protective function. Redundant sensors, wiring, logic, and actuated devices are physically and electrically separated such that a single failure will not prevent the protective function.
| |
| Refer to <Section 8.3.1.4> for a complete description of the PNPP separation criteria.
| |
| Revision 12 7.6-50 January, 2003
| |
| : 3. Quality of Components and Modules (IEEE Standard 279, Paragraph 4.3)
| |
| Refer to <Section 3.11> for a discussion of safety system component quality.
| |
| : 4. Equipment Qualification (IEEE Standard 279, Paragraph 4.4)
| |
| All safety-related equipment as defined in <Section 3.10> and
| |
| <Section 3.11> is designed to meet its performance requirements under the postulated range of operational and environmental constraints. Detailed discussion of qualification is contained in <Section 3.10> and
| |
| <Section 3.11>.
| |
| : 5. Channel Integrity (IEEE Standard 279, Paragraph 4.5)
| |
| For a discussion of channel integrity for the safety-related systems described in <Section 7.6> under all extremes of conditions described in <Section 7.6.1>, refer to
| |
| <Section 3.10>, <Section 3.11>, <Section 8.2.1>, and
| |
| <Section 8.3.1>.
| |
| : 6. Channel Independence (IEEE Standard 279, Paragraph 4.6)
| |
| System channel independence is maintained by application of the PNPP separation criteria as described in
| |
| <Section 8.3.1.4>.
| |
| Revision 12 7.6-51 January, 2003
| |
| : 7. Control and Protection System Interaction (IEEE Standard 279, Paragraph 4.7)
| |
| There are no control and protection system interactions for the systems described in <Section 7.6> except for the redundant reactivity control system.
| |
| The transmission of signals from RRCS protection system equipment for control system use is accomplished through isolation devices which are classified as part of the protection system and meet all the requirements of this standard. No credible failure at these isolators will prevent the associated protection system channel from meeting its design requirements.
| |
| : 8. Derivation of System Inputs (IEEE Standard 279, Paragraph 4.8)
| |
| The variables discussed in <Section 7.6> are direct measures of the desired variables indicating the need for protective action.
| |
| : 9. Capability for Sensor Checks (IEEE Standard 279, Paragraph 4.9)
| |
| For a discussion of sensor checks for the safety-related systems described in <Section 7.6>, refer to <Regulatory Guide 1.22> in <Section 7.6.2.4>.
| |
| : 10. Capability for Test and Calibration (IEEE Standard 279, Paragraph 4.10)
| |
| For a discussion of the test and calibration capability of the safety-related systems described in <Section 7.6>, refer to
| |
| <Regulatory Guide 1.22> in <Section 7.6.2.4>.
| |
| Revision 12 7.6-52 January, 2003
| |
| : 11. Channel Bypass or Removal from Operation (IEEE Standard 279, Paragraph 4.11)
| |
| See <Section 7.2.2.2> for NMS compliance with IEEE Standard 279.
| |
| The leak detection system logic is provided with a bypass/test switch for the purpose of testing temperature sensors without initiating associated system isolation. Operation of one switch at a time will not prevent the remaining redundant isolation logic from providing system isolation if required.
| |
| : 12. Operating Bypasses (IEEE Standard 279, Paragraph 4.12)
| |
| There are no operating bypasses for any of the safety-related systems described in <Section 7.6>.
| |
| : 13. Indication of Bypasses (IEEE Standard 279, Paragraph 4.13)
| |
| For a discussion of automatic bypass indication for the safety-related systems described in <Section 7.6>, refer to
| |
| <Section 7.1.2.4> <Regulatory Guide 1.47>.
| |
| : 14. Access to Means for Bypassing (IEEE Standard 279, Paragraph 4.14)
| |
| Access to bypassing any safety action or function is under administrative control. The operator is alerted to bypasses as described in <Section 7.1.2.4> <Regulatory Guide 1.47>.
| |
| The Redundant Reactivity Control System cannot be manually bypassed.
| |
| Revision 12 7.6-53 January, 2003
| |
| : 15. Multiple Setpoints (IEEE Standard 279, Paragraph 4.15)
| |
| The neutron monitoring system has the APRM setdown function wherein the system auto-selects a more restrictive scram trip setpoint when the reactor mode switch is not in the run mode.
| |
| Also, the IRM range switch establishes a more restrictive scram setpoint whenever it is ranged downward, in order to compensate for decreasing neutron flux in the core and to keep the scram trip setpoint within one decade of the actual flux level. The devices used to prevent improper use of less restrictive setpoints are designed in accordance with criteria regarding performance and reliability of protection system equipment.
| |
| There are no other multiple setpoints within the safety-related systems described in <Section 7.6>.
| |
| : 16. Completion of Protective Action Once it is Initiated (IEEE Standard 279, Paragraph 4.16)
| |
| Except as indicated below, each control logic for the safety-related systems described in <Section 7.6> seals-in electrically and remains energized or de-energized. After initial conditions return to normal, deliberate operator action is required to return (reset) the safety system logic to normal.
| |
| Only the annunciators and local lights of IRM, APRM and OPRM are seal-in type. All other NMS, IRM and APRM, trips and alarms are of the non seal-in type due to the nature of multiple setpoints and various upscales and downscales.
| |
| The fuel pool cooling system is initiated manually for continuous pool cooling when the pool contains spent fuel.
| |
| Revision 12 7.6-54 January, 2003
| |
| : 17. Manual Initiation (IEEE Standard 279, Paragraph 4.17)
| |
| For a discussion of the manual initiation capability for the safety-related systems described in <Section 7.6>, refer to
| |
| <Regulatory Guide 1.62> in <Section 7.6.2.4>.
| |
| : 18. Access to Setpoint Adjustments, Calibration and Test Points (IEEE Standard 279, Paragraph 4.18)
| |
| During reactor operation access to setpoint adjustments, calibration controls and test points for the safety-related systems variables described in <Section 7.6> is under administrative control.
| |
| : 19. Identification of Protective Actions (IEEE Standard 279, Paragraph 4.19)
| |
| When any sensor of the safety-related systems described in
| |
| <Section 7.6> exceeds its predetermined setpoint, a control room annunciator is initiated to identify that variable.
| |
| : 20. Information Readout (IEEE Standard 279, Paragraph 4.20)
| |
| The safety-related systems described in <Section 7.6> are designed to provide the operator with accurate and timely information pertinent to their status. This information does not give anomalous indications confusing to the operator.
| |
| : 21. System Repair (IEEE Standard 279, Paragraph 4.21)
| |
| During periodic testing of the safety-related systems described in <Section 7.6> (except as noted) the operator can determine any defective component and replace it during plant operation.
| |
| Revision 12 7.6-55 January, 2003
| |
| | |
| Replacement of IRM and LPRM detectors must be accomplished during plant shutdown. Repair of the remaining portions of the neutron monitoring channels may be accomplished during plant operation by appropriate bypassing of the defective instrument channel. The design of the system facilitates rapid diagnosis and repair.
| |
| : 22. Identification of Protection Systems (IEEE Standard 279, Paragraph 4.22)
| |
| The identifications scheme for the safety systems is discussed in <Section 8.3.1>.
| |
| 7.6.2.4 Conformance to NRC Regulatory Guides The following is a discussion of conformance to those Regulatory Guides which apply specifically to the safety-related systems discussed in
| |
| <Section 7.6>. Refer to <Section 7.1.2.4> for a discussion of Regulatory Guides which apply equally to all safety-related systems.
| |
| : a. <Regulatory Guide 1.21> - Measuring, Evaluating and Reporting Radioactivity in Solid Wastes and Releases of Radioactive Materials in Liquid and Gaseous Effluents from Light-Water Cooled Nuclear Power Plants The process radiation monitoring system is in compliance with the applicable requirements of this regulatory guide.
| |
| : b. <Regulatory Guide 1.22> - Periodic Testing of Protection System Actuation Functions See <Section 7.2.2.3> for NMS conformance.
| |
| Revision 12 7.6-56 January, 2003
| |
| | |
| The IRMs are calibrated by comparison with the APRMs.
| |
| The proper operation of the sensors and the logics associated with the leak detection systems is verified during the leak detection system preoperational test and during inspection tests that are provided for the various components during plant operation. Each temperature switch, both ambient and differential types which provide isolation signals, is connected to one element of a dual thermocouple element.
| |
| Each temperature switch contains a trip light which illuminates when the temperature exceeds the setpoint. To verify the thermocouple (sensor) input, a comparison of the redundant sensor readings, one from each trip channel, and the recorded channel is made. The recorded channel monitors the second of the dual thermocouples. The first element is part of the division one trip channel. To test the temperature trips a simulated trip level signal is input to the device from an external source. In addition, keylock test switches are provided so that instrument and logic channels can be tested without sending an isolation signal to the system involved. Thus, a complete system check can be confirmed by checking actuation of the trip logic relay associated with each temperature switch.
| |
| The NUMAC Leak Detection Instrumentation has a self-test capability and alerts the operator via an annunciator when a problem is detected. The self-test feature includes continuous monitoring of thermocouple input signals, power supplies and assuring that the monitor is not left in an inoperable condition. NUMAC surveillance tests provide an overlapping set of tests to thoroughly test each channel without the need to disconnect inputs and outputs.
| |
| Revision 12 7.6-57 January, 2003
| |
| | |
| RWCU differential flow leak detection alarm units can be tested by inputting an electrical signal to simulate a high differential flow. Alarm and indicator lights monitor the status of the trip circuit.
| |
| All other system instrumentation is tested and calibrated during normal reactor operation by valving out the instrumentation and supplying a test pressure source or by comparison of redundant analog channels and introducing a trip signal at the trip unit.
| |
| : c. <Regulatory Guide 1.45> - Reactor Coolant Pressure Boundary Leakage Detection System Provisions are made to monitor systems connected to the RCPB for signs of intersystem leakage, including radioactivity monitoring of process fluids (process radiation monitoring system) and reactor vessel water level monitoring (NSSS).
| |
| The leakage detection system is qualified for operation following an OBE.
| |
| Indicators and alarms for each leakage detection subsystem are provided in the control room.
| |
| : d. <Regulatory Guide 1.53> - Application of the Single Failure Criterion to Nuclear Power Plant Protection Systems See IEEE 279-1971, Paragraph 4.2, <Section 7.6.2.3>.
| |
| : e. <Regulatory Guide 1.62> - Manual Initiation of Protective Actions The FPC system is manually initiated from the control room by actuation of system pump and valve controls.
| |
| Revision 12 7.6-58 January, 2003
| |
| | |
| Means are provided for manual initiation of the redundant reactivity control system protective actions. The alternate rod insertion function is initiated upon depression of the RRCS manual initiation pushbutton. The RRCS LFMG transfer, recirculation pump trip and feedwater runback are not initiated by manual initiation of the RRCS. These may be manually initiated at the respective system control panels using system breaker control switches.
| |
| Revision 12 7.6-59 January, 2003
| |
| | |
| TABLE 7.6-1 IRM SYSTEM TRIPS(1)
| |
| Trip Function Trip Action IRM upscale Scram, annunciator, red light display IRM inoperative Scram and rod block, annunciator, red light display IRM upscale Rod block, annunciator, white light display IRM downscale Rod block (exception on most sensitive scale),
| |
| annunciator, amber light display IRM bypassed White light display NOTE:
| |
| (1)
| |
| IRM is inoperative if module interlock chain is broken, operate-calibrate switch is not in operate position, or detector polarizing voltage is below 80 volts.
| |
| Revision 12 7.6-60 January, 2003
| |
| | |
| TABLE 7.6-2 LPRM SYSTEM TRIPS Trip Function Trip Range Trip Action LPRM downscale 2% to full scale White light and annunciator LPRM upscale 2% to full scale Amber light and annunciator LPRM bypass Manual switch White light and APRM averaging compensation Revision 12 7.6-61 January, 2003
| |
| | |
| TABLE 7.6-3 END-OF-CYCLE RECIRCULATION PUMP TRIP SYSTEM RESPONSE TIME TABLE Trip Function Response Time (Milliseconds)
| |
| : 1. Turbine Stop Valve - Closure 140
| |
| : 2. Turbine Control Valve -
| |
| Fast Closure 140 Revision 12 7.6-62 January, 2003
| |
| | |
| 7.7 CONTROL SYSTEMS NOT REQUIRED FOR SAFETY 7.
| |
| | |
| ==7.1 DESCRIPTION==
| |
| | |
| <Section 7.7> describes instrumentation and controls of major plant control systems whose functions are not essential for the safety of the plant. The systems include:
| |
| : a. Leak Detection System
| |
| : b. Rod Control and Information (RC&IS)
| |
| : c. Recirculation Flow Control System
| |
| : d. Feedwater Control System
| |
| : e. Steam Bypass and Pressure Regulating System
| |
| : f. Refueling Interlocks
| |
| : g. Reactor Water Cleanup System
| |
| : h. Process Sampling System
| |
| : i. Gaseous Radwaste System
| |
| : j. NSSS Process Computer
| |
| : k. Drywell Vacuum Relief (DVR) System Refer to <Table 7.7-1> and <Table 7.7-2> for system design and supply responsibility and similarity to licensed reactors, respectively.
| |
| Revision 12 7.7-1 January, 2003
| |
| | |
| 7.7.1.1 Reactor Vessel Head Seal Leak Detection Pressure between the inner and outer reactor vessel head seal ring is sensed by a pressure transmitter. If the inner seal fails, the pressure at the pressure transmitter is the vessel pressure and the associated trip unit will trip and actuate an alarm. The plant will continue to operate with the outer seal as a backup, and the inner seal can be repaired at the next outage when the head is removed. If both the inner and outer head seals fail, the leak will be detected by an increase in drywell temperature and pressure.
| |
| 7.7.1.1.1 Safety/Relief Valve Seal Leak Detection Thermocouples are located in the discharge exhaust pipe of the safety/relief valve. The temperature signal goes to a multipoint recorder with an alarm and will be activated by any temperature in excess of a set temperature signaling that one of the safety/relief valve seats has started to leak.
| |
| 7.7.1.2 Rod Control and Information System (RC&IS) -
| |
| Instrumentation and Controls
| |
| : a. RC&IS Function The RC&IS provides the operator with the means to make changes in nuclear reactivity by the operator manipulating control rods so that the reactor power level and power distribution can be controlled.
| |
| This system includes the interlocks that inhibit rod movement (rod block) under certain conditions. The RC&IS does not include any of the circuitry or devices used to automatically or manually scram the reactor; these devices are discussed in <Section 7.2>. In addition, the mechanical devices of the control rod drives and the Revision 12 7.7-2 January, 2003
| |
| | |
| control rod hydraulic system are not included in the RC&IS. The latter mechanical components are described in <Section 4.6.1>.
| |
| : b. RC&IS Operation The RC&IS includes the following:
| |
| : 1. Control Rod Drive - Control System
| |
| : 2. Rod Block Interlocks
| |
| : 3. Rod Position Probes
| |
| : 4. Position Indication Electronics The rod pattern control system, a subsystem of RC&IS, is safety-related and discussed in <Section 7.6.1>.
| |
| <Figure 4.6-5> and <Figure 4.6-6> show the layout of the control rod drive-hydraulic system. <Figure 7.7-1> shows the functional arrangement of devices for the control of components in the control rod drive hydraulic system. Although the figures also show the arrangement of scram devices, these devices are not part of the RC&IS. Control rods are moved by water pressure, from a control rod drive pump, on the appropriate end of the control rod drive cylinder. The pressurized water moves a piston, attached by a connecting rod to the control rod. Three modes of control rod operation are used: insert, withdraw and settle. Four solenoid-operated valves are associated with each control rod to accomplish these actions.
| |
| When the operator selects a control rod for motion <Figure 7.7-2>
| |
| and operates the rod insertion pushbutton, independent messages are formulated in the Channel 1 and 2 portions of the rod interface Revision 12 7.7-3 January, 2003
| |
| | |
| system (RIS), a subsystem of RC&IS. These independent messages (or words) consist of a serial transmission of electrical pulses which carry information from one part of RC&IS to another. These messages are compared, bit by bit, and if identical, one is stored in a memory and the other is transmitted to all hydraulic control units (HCUs). The digital word to the HCUs contains, (1) the identity or address of the HCU which corresponds to the rod selected by the operator, and (2) data communicating the action to be executed by the rod. Only the HCU with an identical address to that contained in the transmitted digital word executes the rod movement command.
| |
| An operator request for withdrawal instead of insertion of a rod would be processed in a similar manner, except that the outgoing command word to the HCUs would have the proper sequence of electrical pulses (bits) to instruct the rod to withdraw (HCU directional control valves are shown in <Figure 4.6-6>.
| |
| Upon receipt of the command word, the selected HCU transponder transmits a digital acknowledge word back to the control room.
| |
| This acknowledgment contains (1) the identity (address) of the acknowledging HCU, (2) the actions currently being executed, and (3) status information of valve positioners, accumulator conditions and test switch positions. Parts of this returning word are compared with the original command word stored in memory as a check to see that the selected rod is performing the designated action.
| |
| When a predetermined number of disagreements between the Channel 1 and Channel 2 formulated words or the returning acknowledge word is reached, further rod motion is terminated and the operator is notified that a problem exists (this rod motion block in no way prevents the reactor protection system from initiating and completing a SCRAM).
| |
| Revision 12 7.7-4 January, 2003
| |
| | |
| Continued rod motion depends on the HCU receiving a train of sequential words because the HCU insert, withdraw and settle valve control circuits are AC coupled; i.e., the system must operate in a dynamic manner to effect rod motion. Thus, system failure (which generally results in static conditions) will terminate further rod motion.
| |
| In <Figure 7.7-3>, three action loops of the solid state RC&IS are depicted:
| |
| : 1. Loop A The high speed loop (duration = 200 sec) alternately:
| |
| (a) Commands the selected rod and (b) Either scans a rod for status information or directs a portion of a single HCU self-test.
| |
| : 2. Loop B The medium speed loop (duration = 205 to 1,270 msec) alternately:
| |
| (a) Monitors the status of all rods in order to update the RIS display and (b) Completes two seven step self checks of one HCU unit.
| |
| : 3. Loop C The low speed loop (duration = 36 to 234 sec) self-tests all HCUs one at a time to ensure correct execution of actions commanded. These tests are of such short duration that the valves do not move.
| |
| If an HCU fails a test or the return digital word is altered by electrical noise, Loop B automatically performs additional self-test checks. If these tests obtain good results, the loops Revision 19 7.7-5 October, 2015
| |
| | |
| proceed as usual, but if a preset number of errors are detected the system stops all rod motion by removing the AC power supplied to the drive control valves. Operator action is then necessary to restore the system to normal operation.
| |
| The rod selection circuitry is arranged so that a rod selection is sustained until either another rod is selected or separate action is taken to revert the selection circuitry to a no-rod-selection condition. Initiating movement of the selected rod prevents the selection of any other rod until the movement cycle of the selected rod has been completed. Reversion to the no-rod-selected condition is not possible (except for loss of control circuit power) until any moving rod has completed the movement cycle.
| |
| The direction in which the selected rod moves is determined by the position of four switches located on the reactor control panel.
| |
| These four switches, insert, withdraw, continuous insert, and continuous withdraw are pushbuttons which return by spring action to an off position.
| |
| A description of the operation of the reactor manual control system during an insert cycle follows. The cycle is described in terms of the insert, withdraw and settle commands from the RC&IS.
| |
| With a control rod selected for movement, depressing the insert switch and then releasing the switch energizes the insert command for a limited time. Just before the insert command is removed, the settle command is automatically energized and remains energized for a limited time. The insert command time setting and the rate of drive water flow provided by the control rod drive hydraulic system determine the distance traveled by a rod. The time setting results in a one-notch (6-in.) insertion of the selected rod for each momentary application of a rod-in signal from the rod movement Revision 12 7.7-6 January, 2003
| |
| | |
| switch. Continuous insertion of a selected control rod is possible by holding the insert switch.
| |
| A second switch can be used to affect insertion of a selected control rod. This switch is the continuous insert switch. By holding this switch in, the unit maintains the insert command in a continuous, energized state to cause continuous insertion of the selected control rod. When released, the timers are no longer bypassed and normal insert and settle cycles are initiated to stop the drive.
| |
| A description of the operation of the RC&IS during a withdraw cycle follows. The cycle is described in terms of the insert, withdraw and settle commands.
| |
| With a control rod selected for movement, depressing the withdrawal switch energizes the insert valves at the beginning of the withdrawal cycle to allow the collet fingers to disengage the index tube. When the insert valves are de-energized, the withdraw and settle valves are energized for a controlled period of time.
| |
| The withdraw valve is de-energized, before motion is complete; the drive then settles until the collet fingers engage. The settle valve is then de-energized, completing the withdraw cycle. This withdraw cycle is the same whether the withdraw switch is held continuously or momentarily depressed. The timers that control the withdraw cycle provide a fixed timing cycle. Flow control elements at each HCU DCV manifold are set so that the rod travels one notch (6-in.) per cycle. Provisions are included to prevent further control rod motion in the event of timer failure.
| |
| A selected control rod can be continuously withdrawn if the withdraw switch is held in the depressed position at the same time that the continuous withdraw switch is held in the depressed Revision 12 7.7-7 January, 2003
| |
| | |
| position. With both switches held in these positions, the withdraw and settle commands are continuously energized.
| |
| The following is a description of the operation of the RC&IS during the ganged rod mode.
| |
| In the ganged rod mode of operation, more than one rod may be moved at a time. This mode of operation facilitates plant startup and load following. Ganged rod movement can be used for either insert or withdrawal and the operation of the HCUs is the same as described for the withdraw and insert cycle. Ganged rod movement can be initiated at any power level and is subject to the constraints of the rod pattern control system.
| |
| To initiate ganged rod movement, the operator places the RC&IS in the gang drive mode by pushing the drive mode selector pushbutton on the operator control module. To select a gang of rods for motion, the operator can select any rod in that gang and the other rods in the gang are automatically selected. There are up to four rods in a gang. The selected gang may be inserted or withdrawn in either the notch mode or the continuous mode. Movement of the selected gang of rods is accomplished by operating the insert or withdraw pushbutton for single notch gang movement; and the simultaneous operation of the continuous pushbutton if continuous gang movement is desired.
| |
| The positions of all rods in a gang are continuously monitored by both channels of RC&IS and rod pattern control system. Violation of rod pattern constraints will result in insert and withdraw blocks on all rods. Correction of violation can be made by use of the single rod bypass function.
| |
| Revision 12 7.7-8 January, 2003
| |
| : 1. Control Rod Drive-Hydraulic System Control One motor-operated pressure control valve, two air-operated flow control valves, and four solenoid-operated stabilizer valve assemblies are included in the control rod drive hydraulic system to maintain smooth and regulated system operation. These devices are shown in <Figure 4.6-5> and
| |
| <Figure 4.6-6>. The motor-operated pressure control valve is positioned by manipulating a switch in the control room. The switch for this valve is located close to the pressure indicators that respond to the pressure changes caused by the movement of the valve. The air-operated flow control valve in service is automatically positioned in response to signals from an upstream flow measuring device. The stabilizer valves are automatically controlled by the energization of the insert and withdraw commands. The control scheme is shown in
| |
| <Figure 7.7-1>. There are two drive water pumps which are controlled by switches in the control room. Each pump automatically stops on indication of low suction pressure.
| |
| : 2. Rod Block Interlocks A portion of the RC&IS, upon receipt of input signals from other systems and subsystems, inhibits movement or selections of control rods.
| |
| (a) Grouping of Channels The same grouping of neutron monitoring equipment (SRM, IRM and APRM) that is used in the reactor protection system is also used in the rod block circuitry.
| |
| Half of the total monitors (SRM, IRM and APRM) provide inputs to one of the RC&IS rod block logic circuits and Revision 12 7.7-9 January, 2003
| |
| | |
| the remaining half provide inputs to the other RC&IS rod block logic circuit. Scram discharge volume high water level signals are provided as inputs into both of the two rod block logic circuits. Both rod block logic circuits sense when the high water level scram trip for the scram discharge volume is bypassed.
| |
| The APRM rod block settings are varied as a function of recirculation flow. Analyses show that the selected settings are sufficient to avoid both reactor protection system action and local fuel damage as a result of a single control rod withdrawal error. Mechanical switches in the SRM and IRM detector drive systems provide the position signals used to indicate that a detector is not fully inserted. The rod block from scram discharge volume high water level utilizes two differential transmitters installed on the scram discharge volume. A second trip unit on one transmitter provides a control room annunciation of increasing level below the level at which a rod block occurs.
| |
| (b) Rod Block Functions The following discussion describes the various rod block functions and explains the intent of each function. The instruments used to sense the conditions for which a rod block is provided are discussed in the following sections. <Figure 7.7-1> shows all the rod block functions on a logic diagram.
| |
| (1) With the mode switch in the REFUEL position, no control rod can be withdrawn except during the single rod test. This enforces compliance with the intent of the shutdown mode.
| |
| Revision 12 7.7-10 January, 2003
| |
| | |
| (2) The circuitry is arranged to initiate a rod block regardless of the position of the mode switch for the following conditions:
| |
| : i. Any APRM inoperative alarm. This assures that no control rod is withdrawn unless the average power range neutron monitoring channels are either in service or correctly bypassed.
| |
| ii. Scram discharge volume high water level. This assures that no control rod is withdrawn unless enough capacity is available in the scram discharge volume to accommodate a scram.
| |
| The setting is selected to initiate a rod block earlier than the scram that is initiated on scram discharge volume high water level.
| |
| iii. Scram discharge volume high water level scram trip bypassed. This assures that no control rod is withdrawn while the scram discharge volume high water level scram function is out-of-service.
| |
| iv. Rod pattern control system. The purpose of the rod pattern control system is to limit the worth of any control rod such that no undesirable effects will result from a rod drop accident or a rod withdrawal error. The rod pattern control system will enforce operational procedural controls by applying rod blocks before any rod motion can produce high worth rod patterns. See <Section 7.6.1>
| |
| for further discussion of this system.
| |
| Revision 12 7.7-11 January, 2003
| |
| : v. Rod position information system malfunction.
| |
| This assures that no control rod can be withdrawn unless the rod position information system is in service.
| |
| vi. Rod measurement timer malfunction during withdrawal. This assures that no control rod can be withdrawn unless the two independent timers agree and are in service.
| |
| (3) With the reactor mode switch in the RUN position, any of the following conditions initiates a rod block.
| |
| : i. Any APRM downscale alarm. This assures that no control rod will be withdrawn during power range operation unless the average power range neutron monitoring channels are operating correctly or are correctly bypassed.
| |
| ii. Scram discharge volume high water level. This assures that no control rod will be withdrawn unless enough capacity is available in the scram discharge volume to accommodate a scram.
| |
| The setting is selected to initiate a rod block earlier than the scram that is initiated on scram discharge volume high water level.
| |
| iii. Scram discharge volume high water level scram trip bypassed. This assures that no control rod is withdrawn while the scram discharge volume high water level scram function is out-of-service.
| |
| Revision 12 7.7-12 January, 2003
| |
| | |
| iv. Any average power range monitor (APRM) flow biased upscale rod block. The purpose of this rod block function is to avoid conditions that would require reactor protective system action if allowed to proceed. The APRM high flow biased rod block setting is selected to intitiate a rod block before the APRM flow biased upscale scram setting is reached.
| |
| (4) With the mode switch in the STARTUP or REFUEL position, any of the following condition initiates a rod block:
| |
| : i. Any IRM upscale alarm. This assures that no control rod is withdrawn unless the intermediate range neutron monitoring equipment is correctly upranged during a reactor startup. This rod block also provides a means to stop rod withdrawal in time to avoid conditions requiring reactor protection system action scram) in the event that a rod withdrawal error is made during low neutron flux level operations.
| |
| ii. Any average power range monitor (APRM) upscale rod block alarm. The purpose of rod block function is to avoid conditions that would require reactor protection system action if allowed to proceed. The APRM upscale rod block alarm setting is selected to initiate a rod block before the APRM high neutron flux scram setting is reached.
| |
| Revision 12 7.7-13 January, 2003
| |
| | |
| iii. Any IRM downscale alarm except when range switch is on the lowest range. This assures that no control rod is withdrawn during low neutron flux level operations unless the neutron flux is being correctly monitored.
| |
| This rod block prevents the continuation of a reactor startup if the operator upranges the IRM too far for the existing flux level.
| |
| Thus, the rod block ensures that the intermediate range monitor is on scale if control rods are to be withdrawn.
| |
| iv. Any IRM inoperative alarm. This assures that no control rod is withdrawn during low neutron flux level operations unless neutron monitoring capability is available in that all IRM channels are in service or are correctly bypassed.
| |
| : v. Any source range monitor (SRM) detector not fully inserted into the core when the SRM count level is below the retract permit level and associated IRM switches are on either of the two lowest ranges. This assures that no control rod is withdrawn unless all SRM detectors are correctly inserted when they must be relied on to provide the operator with neutron flux level information.
| |
| vi. Any SRM upscale level alarm and associated IRM range switches are below Range 8. This assures that no control rod is withdrawn unless the SRM detectors are correctly retracted during a reactor startup. The rod Revision 12 7.7-14 January, 2003
| |
| | |
| block setting is selected at the upper end of the range over which the SRM is designed to detect and measure neutron flux.
| |
| vii. Any SRM downscale alarm and associated IRM range switches are on either of the two lowest ranges. This assures that no control rod is withdrawn unless the SRM count rate is above the minimum prescribed for low neutron flux level monitoring.
| |
| viii. Any SRM inoperative alarm and associated IRM range switches are below Range 8. This assures that no control rod is withdrawn during low neutron flux level operations unless proper neutron monitoring capability is available.
| |
| ix. Any intermediate range monitor (IRM) detector not fully inserted into the core. This assures that no control rod is withdrawn during low neutron flux level operations unless proper neutron monitoring capability is available.
| |
| (c) Rod Block Bypasses To permit continued power operation during repair or calibration of equipment for selected functions that provide rod block interlocks, a limited number of manual bypasses are permitted as follows:
| |
| (1) 1 SRM channel (1 on RPS Bus A or Bus B)
| |
| Revision 12 7.7-15 January, 2003
| |
| | |
| (2) 2 IRM channels (1 on Bus A and Bus B)
| |
| (3) 2 APRM channels (1 on Bus A and Bus B)
| |
| The permissible IRM and APRM bypasses are arranged in the same way as in the reactor protection system
| |
| <Section 7.2.1>. The IRMs are arranged as two groups of equal numbers of channels. One manual bypass is allowed in each group. The groups are chosen so that adequate monitoring of the core is maintained with one channel bypassed in each group. The same type of grouping and bypass arrangement is used for the APRMs. The arrangement allows the bypassing of one IRM and one APRM in each rod block logic circuit.
| |
| These bypasses are affected by positioning switches in the control room. A light in the control room indicates the bypassed condition.
| |
| An automatic bypass of the SRM detector position rod block is effected as the neutron flux increases beyond a preset low level on the IRM instrumentation.
| |
| : 3. Rod Position Probes The position probe is a long cylindrical assembly that fits inside the control rod drive. Each control rod drive has two sets of reed switches for redundant indication of all information. These two sets of switches are electrically and mechanically separate within a common enclosure. The reed switches are located along the length of the probe and operated by a permanent magnet fixed to the moving part of the hydraulic drive mechanism. As the drive, and with it the control rod blade, moves along its length, the magnet causes Revision 12 7.7-16 January, 2003
| |
| | |
| reed switches to close as it passes over the switch locations.
| |
| The particular switch closed then indicates where the control rod drive, and hence the rod itself is positioned.
| |
| The switches are located as follows: one at each of twenty-five notch (even) positions; one at each of twenty-four mid-notch (odd) positions; two at the fully inserted position (approximately the same location as the 00 notch); one at the fully withdrawn position (approximately the same location as the 48 notch position); and, one at the overtravel or decoupled position.
| |
| All of the mid-notch or odd switches are wired in parallel and treated as one switch (for purposes of external connections),
| |
| and the two full-in switches are wired in parallel and treated as one switch. These and the remaining switches are wired in a 5 x 6 array (the switches short the intersections) and routed out in an 11-wire cable to the processing electronics (the probe also includes a thermocouple which is wired out separate from the 5 x 6 array).
| |
| : 4. Position Indication Electronics The electronics consists of a set of probe multiplexer cards (one per 4-rod group where the 4-rod group is the same as the display grouping described above), a set of file control cards (one per 20 multiplexer cards), and one set of master control and processing cards serving the whole system. All probe multiplexer cards are the same except that each has a pair of plug-in daughter cards containing the identity code of one 4-rod group (the probes for the corresponding 4 rods are connected to the probe multiplexer card). The system operates on a continuous scanning basis with a complete cycle in approximately 60 milliseconds.
| |
| Revision 12 7.7-17 January, 2003
| |
| | |
| The operation is as follows: The control logic generates the identity code of one rod in the set, and transmits it using time multiplexing to all of the file control cards. These in turn transmit the identity with timing signals to all of the probe multiplexer cards. The one multiplexer card with the matching rod identity will respond and transmit its identity (locally generated) plus the raw probe data for that rod back through the file control card to the master control and processing logic. The processing logic does several checks on the returning data. First, a check is made to verify that an answer was received. Next, the identity of the answering data is checked against that which was sent. Finally, the format of the data is checked for legitimacy. Only a single even position or, full-in plus position 00, or full-out plus position 48, or odd, or overtravel, or blank (no switch closed) are legitimate. Any other combination of switches is flagged as a fault.
| |
| If the data passes all of these tests, it is decoded and transmitted in multiplexed form to the displays in the main control panel, and loaded into a memory to be read by the computer as required.
| |
| As soon as one rods data is processed, the next rods identity is generated and processed and so on for all of the rods. When data for all rods has been gathered, the cycle repeats. The RC&IS is totally operable from the main control room. Manual operation of individual control rods is possible with a pushbutton to effect control rod insertion, withdrawal or settle. Rod position indicators, described below, provide the necessary information to ascertain the operating state and position of all control rods. Conditions which prohibit control rod insertion are alarmed with the rod block annunciator.
| |
| Revision 12 7.7-18 January, 2003
| |
| | |
| A rod information display on the reactor control panel is patterned after a top view of the reactor core. The display allows the operator to acquire information rapidly by scanning. Digital windows provide an overall indication of rod pattern and allow the operator to quickly identify an abnormal indication. The following information for each control rod is also presented in the display:
| |
| (a) Rod full inserted (green)
| |
| (b) Rod fully withdrawn (red)
| |
| (c) Selected rod identification (d) Rod scram (green)
| |
| (e) Rod position (numeric) of selected rods (f) Rod position (numeric) of all rods Also dispersed throughout the display, in locations representative of the physical location of LPRM strings in the core, are LPRM lights as follows:
| |
| (a) LPRM high flux (red)
| |
| (b) LPRM string selected (yellow)
| |
| (c) LPRM downscale (green)
| |
| A continuous core rod position display is provided from both of the rod position information system cabinets. The data for the display is automatically alternated between the two RC&IS Revision 14 7.7-19 October, 2005
| |
| | |
| outputs at a rate that is visible to the operator so that position data faults are easily detected.
| |
| A separate, smaller display below the full core status display will provide the LPRM reading adjacent to the selected rod.
| |
| The associated LPRM for each rod in a gang may be selected and displayed so that the operator can easily observe core power response to the motion of the gang rods. Proper gang motion can be further confirmed by observing rod position changes indicated by the full core display.
| |
| The position signals of selected control rods, together with a rod identification signal, are provided as inputs to the online performance monitoring system. The acquisition of the rod position signal does not interrupt the rod position indication signal in the control room. The performance monitoring system can, on demand, provide a full core printout of control rod positions.
| |
| The following control room lights are provided to allow the operator to know the conditions of the control rod drive hydraulic system and the control circuitry:
| |
| (a) Insert command energized (b) Withdraw command energized (c) Settle command energized (d) Insert not permissive (e) Withdrawal not permissive (f) Insert required Revision 12 7.7-20 January, 2003
| |
| | |
| (g) Continuous withdrawal (h) Pressure control valve position (i) Flow control valve position (j) Drive water pump low suction pressure (alarm and pump trip)
| |
| (k) Drive water filter high differential pressure (alarm only)
| |
| (l) Charging water (to accumulator) low pressure (alarm only)
| |
| (m) Control rod drive temperature (alarm only)
| |
| (n) Scram discharge volume not drained (alarm only)
| |
| (o) Scram valve pilot air header high/low pressure (alarm only) 7.7.1.3 Recirculation Flow Control System - Instrumentation and Controls
| |
| : a. System Function The recirculation flow control system controls reactor power level, over a limited range, by controlling the flow rate of the reactor recirculating water.
| |
| : b. System Operation Reactor recirculation flow is varied by throttling the recirculation pumps discharge with control valves. The Revision 12 7.7-21 January, 2003
| |
| | |
| recirculation pumps operate at constant speed, on either LFMG or normal 60-cycle power. By adjusting the position of the discharge throttling valves, the recirculation system can automatically change the reactor power level <Figure 7.7-4> and <Figure 7.7-5>.
| |
| An increase in recirculation flow temporarily reduces the void content of the moderator by increasing the flow of coolant through the core. The additional neutron moderation increases reactivity of the core, which causes reactor power level to increase. The increased steam generation rate increases the steam volume in the core with a consequent negative reactivity effect, and a new steady-state power level is established. When recirculation flow is reduced, the power level is reduced in the reverse manner.
| |
| Each recirculation system loop flow control valve has its individual manual control system as well as the capability of being controlled in unison by the master-flux controllers. The master controller output demands a certain neutron flux level in the reactor which is compared with a filtered measurement of neutron flux. The resultant error is fed into a flux controller which, in turn, demands a drive flow in each loop.
| |
| Each loop has an individual flow controller that causes adjustment of valve position to meet a demanded change in loop flow and hence core flow and core power. This process continues until the error existing at the input of the flux controller is driven to zero.
| |
| The flux controller can remain in automatic even though the master controller is in manual.
| |
| The reactor power change resulting from the change in recirculation flow causes the pressure regulator to reposition the turbine control valves. If the original demand signal was a turbine load/speed error signal, the turbine responds to the change in Revision 12 7.7-22 January, 2003
| |
| | |
| reactor power level by adjusting the control valves, and hence its power output, until the load/speed error signal is reduced to zero.
| |
| : 1. Pump Motor Control Each reactor water recirculating pump drive motor is a four pole ac induction motor that will operate from the normal plant electrical supply during normal plant power operation.
| |
| At plant low-power levels, the recirculation pump motor will operate from the electrical output of the low-frequency motor generator (LFMG) set. Since the LFMG set electrical output frequency is at approximately one-fourth the normal plant electrical frequency, the recirculation pump motor will be driven at approximately one-fourth of its rated speed.
| |
| The LFMG set is not intended to be capable of starting the recirculation pump motor with the motor initially at zero speed. At low reactor power levels, the motor start is initiated on the normal plant electrical power supply. As the motor speed approaches rated full load speed, it is automatically tripped. When the motor speed coastdown is about 25 percent of rated full load speed, the motor will be reenergized from the LFMG set and driven at about 25 percent rated full load speed. Preceding initiation of the recirculating pump motor, the plant operator may manually start the LFMG set. If the LFMG set is not operating when the motor start is initiated, the LFMG will be automatically started.
| |
| If the recirculating pump motor start is initiated at higher reactor power levels, the LFMG set will not start automatically, and the pump/motor will continue to operate at rated full load speed.
| |
| Revision 12 7.7-23 January, 2003
| |
| | |
| Certain trip functions, as shown in <Figure 7.7-4>, will trip the recirculating pump motor and automatically transfer it to the LFMG set. Other trip functions will trip the motor without transfer to the LFMG set.
| |
| In addition to the normal drive motor trips, a high vessel pressure or low vessel level signals from the redundant reactivity control system, <Section 7.6.1.12>, will initiate a recirculation pump motor trip. Each trip sensor and channel is separate and independent from the reactor protection system, and includes a testability feature that will allow testing of each trip sensor while the recirculation system is in operation. The abnormal position of the test switch is annunciated.
| |
| : 2. Low-Frequency Motor-Generator (LFMG) Set The LFMG set consists of a 16-pole ac induction motor driving a 4-pole ac synchronous generator. This arrangement provides one-fourth normal plant frequency at the output of the generator. The generator exciter is directly connected to generator to provide a brushless excitation system. The voltage regulator for the excitation system is located in the auxiliary relay panel which is separate from the LFMG set.
| |
| Several permissives, shown in <Figure 7.7-4>, must be satisfied before the recirculation pump/motor can be operated from either the normal plant electrical system or the LFMG set. These permissives prohibit pump start until conditions assure there will be no damage to the system. <Section 4.4.3>
| |
| describes the regions of the operational map where operation is not permitted.
| |
| Revision 12 7.7-24 January, 2003
| |
| : 3. Valve Position Control Components The main flow regulating valves can be controlled individually or jointly. The master controller, flux demand limiter, flux controller, and total drive flow limiter are common to the control of both valves. The signal from these components is fed to two separate sets of control systems components, one for each limiter, a flow controller, a high-low signal failure alarm, a loss of signal valve motion inhibit interlock, a drive flow feedback signal to each flow controller, a valve actuator, and a limiter. The limiter runs back the main flow regulating valve if one of the reactor feed pumps should trip, with a coincident or subsequent reactor vessel low water level. This run back was intended to reduce reactor power to within the capacity of the remaining feedwater pump. This limiter function may be bypassed during single recirculation loop operation, since reactor power is kept within the capacity of one feedwater pump.
| |
| : 4. Master Controller The manual/automatic master controller provides a signal to control reactor flux. The automatic mode is not used at Perry.
| |
| : 5. Flux Demand Limiter The flux demand limiter is adjustable. Its purpose is to limit the neutron flux demanded by the flux controller, keeping it sufficiently below the high flux scram point to prevent scrams during reactor power increases.
| |
| Revision 12 7.7-25 January, 2003
| |
| : 6. Flux Controller The flux controller supplies a total drive flow demand signal to a flow controller station, which in turn supplies each flow loop with a demand signal. Under automatic control, the flux controller output is compared to the sensed loop flow from the feedback proportional amplifiers in each loop. The error signal is fed via the flow controller amplifier to the valve position, resulting in a change of loop flow and therefore core power.
| |
| Neutron flux is sensitive to changes in core flow in the frequency range of approximately 0.015 to 0.31 Hertz. The flux controller is a lag/lead compensated proportional-integral (P-I) controller. The lag/lead compensation removes the flux overshoot and the P-I controller provides a high gain output for low frequency input signal from feedwater or pressure disturbance.
| |
| : 7. Drive Flow Limiter The drive flow demand limiters are adjustable. The high signal limiter establishes the maximum drive flow demand limit needed for the upper end of the automatic load-following range. The low signal limit is determined from a core stability criterion and defines the lower end of the automatic load-following range. There is no low flow limit and the valve can be closed to its minimum position when the flux controller is in manual mode operation.
| |
| : 8. Flux Feedback Isolation Amplifier The flux feedback isolation amplifier performs a dual function. It is a secondary amplifier that completely Revision 12 7.7-26 January, 2003
| |
| | |
| isolates the reactor flow control system from the particular APRM that supplies its input signal. It also filters process noise in the flux signal. A failure in the amplifier cannot interfere with the protection system function of the APRMs.
| |
| Each of the two APRM channels available for flux feedback is further isolated or buffered by an additional primary isolation amplifier, so that the system complies with the requirements of Paragraph 4.7 of IEEE Standard 279.
| |
| : 9. Manual/Automatic Transfer Stations Switching between manual and automatic operations is done on the master, flux and individual flow controllers, using a manually operated switch. To automatically control loop flow by the flux controller, the transfer switch on the flux and flow controllers must be in the automatic position.
| |
| Setting the master control transfer switch to the manual position provides ganged parallel manual operation of the flow control loops. Switching to manual control on the master controller sets the cascade input or setpoint of the flux controller and hence the signal to the valve. The individual flow controllers must be in automatic mode. During startup, the flux controller output signal is determined by the manual signal level setting on the flux controller with the controller in manual mode.
| |
| : 10. Flow Controller The individual flow controller (one for each valve) transmits the signal that adjusts the valve position. During automatic operation, the input signal is received from the flux controller. During manual operation, each flow regulating Revision 12 7.7-27 January, 2003
| |
| | |
| valve can be manually positioned with the manual output signal raise/lower controls provided on each flow controller.
| |
| : 11. Limiter A limiting function is required (as briefly outlined in foregoing paragraphs). Electronic limiting, with reasonable range adjustment, is provided in each main flow control loop.
| |
| This limiter is normally held bypassed by auxiliary devices such as relay contacts. When the limiting permissive condition is reached, the main regulating valve control signal is limited to close the valve to the desired position.
| |
| : 12. Valve Actuator The valve actuator (one on each valve) is the electro-hydraulic device that moves the flow control valve to the desired position and maintains it there. The valve control system is designed to maintain the valve in the last position demanded if control power is lost.
| |
| The valve actuator has an inherent rate limiting feature that will keep the resultant rate of change of core flow and power to within safe limits in the event of upscale or downscale failure of the valve position or velocity control system.
| |
| 7.7.1.4 Feedwater Control System - Instrumentation and Controls
| |
| : a. System Function The feedwater control system controls the flow of feedwater into the reactor vessel to maintain the vessel water level within predetermined limits during all normal plant operating modes. The range of water level is based on the requirements of the steam Revision 12 7.7-28 January, 2003
| |
| | |
| separators (this includes limiting carryover, which affects turbine performance, and carryunder, which affects recirculation pump operation). The feedwater control system uses vessel water level, steam flow and feedwater flow as a three-element control
| |
| <Figure 7.7-6>.
| |
| Single-element control is also available based on water level only.
| |
| Normally, the signal from the feedwater flow is equal to the steam flow signal; thus, if a change in the steam flow occurs, the feedwater flow follows. The steam flow signal provides anticipation of the change in water level that will result from change in load. The level signal provides a correction for any mismatch between the steam and feedwater flow which causes the level of the water in the reactor vessel to rise or fall accordingly.
| |
| : b. System Operation During normal plant operation, the feedwater control system automatically regulates feedwater flow into the reactor vessel.
| |
| The system can be manually operated.
| |
| The feedwater flow control instrumentation measures the water level in the reactor vessel, the feedwater flow rate into the reactor vessel and the steam flow rate from the reactor vessel. During automatic operation, these three measurements are used for controlling feedwater flow.
| |
| The optimum reactor vessel water level is determined by the requirements of the steam separators. The separators limit water carry-over in the steam going to the turbines and limit steam carry-under in water returning to the core. The water level in the reactor vessel is maintained within approximately 2 in. of the setpoint value during normal operation and within the high and low Revision 12 7.7-29 January, 2003
| |
| | |
| level trip setpoints during normal plant maneuvering transients.
| |
| This control capability is achieved during plant maneuvering transients. This control capability is achieved during plant load changes by balancing the mass flow rate of feedwater to the reactor vessel with the steam flow from the reactor vessel.
| |
| The redundant reactivity control system in its automatic mode can initiate a feedwater runback, reducing flow to 0 percent within 30 seconds. This runback is independent of the feedwater control operating mode, and overrides the loss-of-signal interlock which prohibits change of feedpump output under loss of control signal conditions. Control of the feedwater system can be regained by the operator 30 seconds after the runback begins. This runback is discussed in <Section 7.6.1.12>. ATWS alarm lights are provided on the front of the feedwater control panel.
| |
| The following is a discussion of the variables sensed for system operation:
| |
| : 1. Reactor Vessel Water Level Reactor vessel narrow range water level is measured by three identical, independent sensing systems. For each channel, a differential pressure transmitter senses the difference between the pressure caused by a constant reference column of water and the pressure caused by the variable height of water in the reactor vessel. The differential pressure transmitter is installed on lines that serve other systems.
| |
| The control system automatically selects the median reactor level from the three level signals and uses it for feedwater control.
| |
| Revision 14 7.7-30 October, 2005
| |
| | |
| Each narrow range level channel also functions to provide failure tolerant trips of the main turbine and feed pump prime movers. All three narrow range reactor level signals and reactor pressure are indicated in the control room. A fourth level sensing system (wide range) provides level information beyond the span of the narrow range devices. The median narrow range water level and wide range water level signals are continually recorded in the control room.
| |
| : 2. Main Steam Line Steam Flow Steam flow is sensed at each main steam line flow restrictor by a differential pressure transmitter. A signal proportional to the true mass steam flow rate is linearized and indicated in the main control room. The signals are summed to produce a total steam flow signal for indication and feedwater flow control. The total steam flow signal is recorded in the control room.
| |
| : 3. Feedwater Flow Feedwater flow is sensed at a flow element in each feedwater line by differential pressure transmitters. Each feedwater signal is linearized and then summed to provide a total mass flow signal which is recorded in the control room. In addition, feedwater flow through each pump is sensed. The flow control loop subtracts the total feedwater flow from the setpoint provided by the level control loop to generate an error for the controller to act on. Valve position control or turbine speed change are the flow adjustment techniques involved.
| |
| Revision 14 7.7-31 October, 2005
| |
| | |
| Three modes of feedwater flow control and thus level control are provided.
| |
| (a) Startup automatic level control (1 Element Control)
| |
| (b) Run mode automatic flow control (3 Element Control)
| |
| (c) Manual control Separate level controllers are provided for each automatic mode. Each level control mode provides output indication as well as level setpoint and measured level. In the 1 Element control mode, measured level is compared to level setpoint within the controller to develop a controller output signal.
| |
| In this mode, it is possible to have two feed pumps in automatic control. A feed pump may be manually controlled by using the pumps manual/auto station faceplate.
| |
| During normal operation three element automatic control is provided. The total steam flow signal, modified by the conditioned level error signal, provides a flow demand signal to the feedwater flow control loop. The demanded flow is compared to actual total feed flow from running pumps. The resultant flow error signal, after conditioning by the proportional plus integral flow control loop changes the MFP valve position, and/or changes the turbine speed, zeroing the error signal.
| |
| Manual control is available by using the manual/auto station faceplates via the touch screen displays to accomplish the desired flow change. Automatic inventory control is available with any single pump or any combination of two pumps.
| |
| Revision 14 7.7-32 October, 2005
| |
| | |
| The level control system also provides interlocks and control functions to other systems. When one of the reactor feed pumps is lost and coincident or subsequent low water level exists, recirculation flow is reduced to within the power capabilities of the remaining reactor feed pumps. This reduction aids in avoiding a low level scram by reducing the steaming rate. Reactor recirculation flow is also reduced on sustained low feedwater flow coincident with low recirculation flow control valve position to ensure that adequate NPSH will be provided for the recirculation system.
| |
| Alarms are provided for high and low water level and reactor high pressure. Interlocks will trip the plant turbine and feedwater pumps in the event of reactor high water level.
| |
| Feedwater is delivered to the reactor vessel through a parallel arranged combination of two turbine-driven and one electric motor-driven feedwater pumps. The turbines are driven by steam from the reactor vessel. The electric motor-driven pump operates at constant speed and flow is controlled by a flow control valve. During planned operation, the feedwater control signal from the level control system is fed to the turbine speed control systems, which adjust the speed of their associated turbines so that feedwater flow is proportional to the feedwater demand signal. Each turbine can be controlled by its manual/automatic transfer station faceplates via the touch-screen displays. The Revision 15 7.7-33 October, 2007
| |
| | |
| feedwater controller, and the manual/auto transfer stations associated with each turbine speed controller, are the bumpless transfer types.
| |
| 7.7.1.5 Steam Bypass and Pressure Regulating System -
| |
| Instrumentation and Controls
| |
| : a. System Function As a direct cycle boiling water reactor, the turbine is slaved to the reactor in that all (except steam to the moisture separator reheaters) steam generated by the reactor is normally accepted by the turbine. The operation of the reactor requires pressure regulation be employed to maintain a constant (within the range of the regulator controller proportional band setting) turbine inlet pressure with load following ability accomplished by variation of the reactor recirculation flow.
| |
| The turbine pressure regulator normally controls the turbine control valves to maintain constant (within the range of the regulator controller proportional band setting) turbine inlet pressure at a particular valve. In addition, the pressure regulator also operates the steam bypass valves such that a portion of nuclear boiler rated flow can be bypassed when operating at steam flow loads above that which can be accepted by the turbine as well as during the startup and shutdown phase.
| |
| The overall turbine generator and pressure control system accomplishes the following:
| |
| : 1. Control turbine speed and turbine acceleration.
| |
| : 2. Control the steam bypass system to keep reactor pressure within limits and avoid large power transients.
| |
| Revision 12 7.7-34 January, 2003
| |
| : 3. Control main turbine inlet pressure within the proportional band setting of the pressure regulator.
| |
| : b. System Operation Pressure control is accomplished by controlling main steam pressure immediately upstream of the main turbine stop and control valves through modulation of the turbine-control or steam-bypass valves.
| |
| Command signals to these valves are generated by redundant control elements using the sensed turbine inlet pressure signals as the feedback. For normal operation, the turbine control valves regulate steam pressure; however, when the total steamflow demand from the pressure regulator exceeds the capacity of the turbine control valves, the pressure control system sends the excess steam flow directly to the main condenser, through the steam bypass valves. The plant ability to follow grid-system load demands is enabled by adjusting reactor power level, by varying reactor recirculation flow (manually) or by manually moving control rods.
| |
| In response to the resulting steam production changes, the pressure control system adjusts the turbine control valve to accept the steam output change, thereby regulating steam pressure.
| |
| : 1. Steam Pressure Control During normal plant operation, steam pressure is controlled by the main turbine control valves, positioned in response to the pressure regulation demand signal. The steam bypass valves are normally closed.
| |
| The output of one of the regulators is used to provide combined flow demand, and bypass demand signals and is continuously compared to the output of the other regulator.
| |
| If the difference between any two comparable signals exceeds Revision 12 7.7-35 January, 2003
| |
| | |
| the permissible value, the signal which has changed the least in the previous few seconds assumes control.
| |
| To minimize pressure regulator disturbance during main steam isolation valve testing or main turbine stop valve testing, a pressure tap is taken from each main steam line ahead of the turbine stop valves and routed into an instrument header pressure equalization manifold. The pressure transmitters are connected to this manifold.
| |
| The turbine control valve (steam flow) demand signal is limited, after passage through the low value gate, to that required for full opening of the turbine control valves.
| |
| Thus, if the pressure control system requests additional steam flow from the reactor when the control valves reach wide open, the control signal error to the bypass valves will increase and cause bypass actuation.
| |
| Control for the turbine control valve is designed so that the valves will close upon loss of control system electric power or loss of hydraulic system pressure.
| |
| : 2. Steam Bypass System The steam bypass equipment is designed to control steam pressure when reactor steam generation exceeds turbine requirements such as during startup (pressure, speed ramping and synchronizing), sudden load reduction and cooldown.
| |
| The bypass capacity of the system is 35 percent (nominal) of the pre-power uprate NSSS rated steam flow; sudden load reductions of up to the capacity of the steam bypass can be accommodated without reactor scram.
| |
| Revision 18 7.7-36 October, 2013
| |
| | |
| Normally, the bypass valves are held closed and the pressure regulator controls the turbine control valves, directing all steam flow to the turbine. If the speed governor or the load limiter restricts steam flow to the turbine, the regulator controls system pressure by opening the bypass valves. If the capacity of the bypass valves is exceeded while the turbine cannot accept an increase in steam flow, the system pressure will rise and reactor protection system action will cause shutdown of the reactor.
| |
| The bypass valves are an automatically-operated, regulating type which are proportionally controlled by the turbine pressure regulator and control system.
| |
| The turbine control system provides a signal to the bypass valves corresponding to the error between the turbine control valve opening required by the controlling pressure regulator and the turbine control valve position demanded by the output of the low value gate circuit. An adjustable bias signal is provided to maintain the bypass valves closed for momentary differences during normal operational transients.
| |
| : 3. Turbine Speed/Load Control System The control signals supplied by the pressure regulator to the turbine control system and the signals which the pressure regulator requires from the turbine control system are shown in <Figure 7.7-7>. The turbine control system is designed to receive and supply the following signals:
| |
| (a) Signal 1 - The load demand signal varies from no load to rated load.
| |
| Revision 12 7.7-37 January, 2003
| |
| | |
| (b) Signal 2 - The pressure control demand signal varies from no load to rated load and is limited by the turbine flow limiter to place an upper bound on the total turbine and bypass flow demand.
| |
| (c) Signal 3 - The control valve position (flow) demand signal varies to close or open the valve. The turbine flow limiter limits the pressure control demand signal so that it does not exceed the value corresponding to valves fully open. Signal 3 is used by the pressure regulator as a turbine flow reference signal to operate the bypass valves when high steam pressure causes the pressure control signal, Signal 2, to be higher than Signal 3.
| |
| : 4. Turbine Speed-Load Control Interfaces (a) Normal Operation During base-load plant operation, the turbine load reference is held above the desired load, such that the pressure regulation demand governs the turbine control valves.
| |
| (b) Behavior of Turbine Outside of Normal Operation (1) Turbine Startup.
| |
| Prior to turbine startup, sufficient reactor steam flow is generated to permit the steam bypass valves to maintain reactor pressure control while the turbine is brought up to speed and synchronized under its speed-load control.
| |
| Revision 12 7.7-38 January, 2003
| |
| | |
| (2) Partial Load Rejection.
| |
| During partial load rejection transients, which are apparent to the reactor as a reduction in turbine load demand resulting from an increase in generator (or grid) frequency above rated, the turbine-pressure control scheme allows the reduced turbine speed-load demand to bias the pressure regulation demand and thereby directly regulate the turbine control valves.
| |
| (3) Turbine Shutdown or Turbine Generator Trip.
| |
| During turbine shutdown or turbine generator trip conditions, the main turbine stop valves and control valves are, or will be, closed. Reactor steamflow will then be passed through the steam bypass valves under steam pressure control, and through the reactor safety/relief valves, as needed.
| |
| (4) Steam Bypass Operation.
| |
| Fast opening of the steam bypass valves during turbine trips or generator load rejections requires coordinated action with the turbine control system.
| |
| When the turbine control valves are under pressure control, no bypass steamflow is demanded; conversely, when the turbine speed-load demand falls below the pressure regulation demand, a net bypass flow demand is computed. During turbine or generator trip events resulting in fast closure of the turbine stop or control valves, the turbine control valve demand is immediately tripped to zero Revision 12 7.7-39 January, 2003
| |
| | |
| as an anticipatory response, causing the bypass steamflow demand to equal the initial pressure regulation demand.
| |
| (5) Loss of Turbine Control System Power.
| |
| Turbine controls and valves are designed so that the turbine stop and control valves will close upon loss of control system power or hydraulic pressure.
| |
| 7.7.1.6 Refueling Interlocks - Instrumentation and Controls
| |
| : a. Refueling Interlocks Function The purpose of the refueling interlocks is to restrict the movement of control rods and the operation of refueling equipment. This reinforces operational procedures that prevent the reactor from becoming critical during refueling operations.
| |
| : b. Refueling Interlocks Operation The refueling interlocks circuitry senses the condition of the refueling equipment and the control rods to prevent the movement of the refueling equipment or withdrawal of control rods (rod block).
| |
| Redundant circuitry is provided to sense the following conditions:
| |
| : 1. All rods inserted
| |
| : 2. Refueling platform positioned near or over the core
| |
| : 3. Refueling platform main hoist fuel-loaded
| |
| : 4. Reactor mode switch in Refuel position and not more than one rod withdrawn Revision 12 7.7-40 January, 2003
| |
| | |
| The indicated conditions are combined in logic circuits to satisfy various restrictions on refueling equipment operations and control rod movement <Table 7.7-3>. A two-channel circuit indicates that all rods are in. For one channel, the rod-in condition for each rod is established by the closure of a magnetically operated reed switch in the rod position indicator probe. The rod-in switch must be closed for each rod before the all-rods-in signal is generated.
| |
| RC&IS control circuitry must indicate all-rods-in to allow refueling equipment to be used.
| |
| During refueling operations, no more than one control rod is permitted to be withdrawn; this is enforced by a logic circuit that uses the all-rods-in signal and a rod selection signal from the RC&IS to prevent the selection of a second rod for movement with any other rod not fully inserted. Control rod withdrawal is prevented by comparison between the A and B portions of the RC&IS for rod position with a subsequent rod withdrawal block if necessary. The simultaneous selection of two control rods is prevented by the multiplexing action of the rod select circuitry and by feedback from the rod motion timer which latches the selected rods identity in a holding register. With the mode switch in the REFUEL position, the circuitry prevents the withdrawal of more than one control rod and the movement of the loaded refueling platform over the core with any control rod withdrawn.
| |
| Operation of refueling equipment is prevented by interrupting the power supply to the equipment. The refueling platform is provided with two mechanical switches attached to the platform, which are tripped open by a long, stationary rail, mounted adjacent to the platform rail. The switches open before the platform or any of its hoists are physically located over the reactor vessel to indicate the approach of the platform toward its position over the core.
| |
| Revision 14 7.7-41 October, 2005
| |
| | |
| Load cell readout is provided for all hoists. Indicators display given hoist loads directly to the operator. Load sensing is done by a solid-state type load sensing system.
| |
| Associated interlock and load functions are performed by a load cell monitor that senses the strain generated by the load.
| |
| The three hoists on the refueling platform are provided with solid state load sensing systems with contacts that open at their required settings. The relay contacts for two of the hoists (monorail and frame) are set to open at a load weight that is lighter than that of a single fuel assembly. Fuel can only be handled with the main fuel hoist of the refueling platform.
| |
| De-energizing the fuel hoist load cell power supply opens the grapple load cell relay contact and gives a false indication that the grapple is loaded. This interlock prevents control rod withdrawal with the mode switch in the STARTUP or REFUEL positions.
| |
| The rod block interlocks and refueling platform interlocks provide two independent levels of interlock action. The interlocks which restrict operation of the main fuel hoist provide a third level of interlock action since they would be required only after a failure of a rod block and refueling platform interlock.
| |
| In the refueling mode, the control room operator has an indicator light for Refueling Mode Select Permissive whenever all control rods are fully inserted. He can compare this indication with control rod position data from the computer as well as control rod in-out status on the full core status display. Whenever a control rod withdrawal block situation occurs, the operator receives annunciation and computer logs of the rod block. The operator can compare these outputs with the status of the variable providing the rod block condition. Both channels of the control rod withdrawal Revision 14 7.7-42 October, 2005
| |
| | |
| interlocks must agree that permissive conditions exist in order to move control rods; otherwise, a control rod withdrawal block occurs. Failure of one channel may initiate a rod withdrawal block, and will not prevent application of a valid control rod withdrawal block from the remaining operable channel <Table 7.7-3>.
| |
| In terms of refueling platform interlocks, the platform operator has a digital display for the platform x-y position relative to the reactor core.
| |
| The position of each hoist is shown on locally mounted indicators or digital display. Load cell indications of hoist loads are given for each hoist by locally mounted indicators or digital display.
| |
| Individual push button and joystick control switches are provided for local control of the platform and its hoists. The platform operator can immediately determine whether the platform and hoists are responding to his local instructions, and can, in conjunction with the control room operator, verify proper operation of each of the three categories of interlocks listed previously.
| |
| 7.7.1.7 Design Differences Refer to <Table 7.7-2> for a list of instrumentation and control system designs and their similarity to designs of other nuclear power plants.
| |
| 7.7.1.8 Process Computer System - Instrumentation
| |
| : a. System Function The function of the plant process computers is to provide a quick and accurate determination of core thermal performance; to improve Revision 14 7.7-43 October, 2005
| |
| | |
| data reduction, accounting and logging functions; and to supplement procedural requirements for control rod manipulation during reactor startup and shutdown.
| |
| : b. System Operation The Plant Process Computer is composed of two (2) CPUs (Central Processing Units). One CPU will be the primary and the second will be in standby. The standby CPU will take over all scan/log/alarm functions should the primary CPU experience any kind of failure.
| |
| The system uses at least one of each of the following peripheral devices: analog/digital I/O, operators display console, graphics workstation, alarm typer, log typer, line printer, magnetic tape unit, digital display, and trend pen recorder.
| |
| The analog/digital data acquisition hardware consists of an analog and digital inputs as well as digital outputs, corresponding I/O terminations, and signal conditioners. The data acquisition hardware accepts analog signals from plant instrumentation and converts them to digital representation for use in the computer.
| |
| The digital signals sense plant contact actuations and are used to read status information from plant instrumentation, including alarms and binary coded signals. Intermittent signals and pulse type inputs are sensed by sequence of event change detect hardware and allow immediate processing of information that might otherwise be lost if normal digital scanning were used.
| |
| During routine operation, the operator uses a keyboard and display located in the main control room and various other plant locations to enter information into the computer and to request various special functions from it. Information from the computer can be Revision 20 7.7-44 October, 2017
| |
| | |
| directed by the operator to video terminal displays, digital displays and trend recorders located on 1H13-P680, or hard copy terminals.
| |
| The process computer system has self-checking provisions. It performs diagnostic checks to determine the operability of certain portions of the system hardware and performs internal programming checks to verify that input signals and selected program computations are either within specific limits or within reasonable bounds.
| |
| The computer equipment, except peripherals, is designed for continuous duty from 59F to 82F, and 20% to 80% relative humidity. The peripherals are designed to operate under less restrictive environmental conditions. All CPUs are installed in air-conditioned rooms.
| |
| The processor is capable of checking each analog input variable against two types of limits for alarm purposes:
| |
| : 1. Process alarm limits are either variable limits determined by the computer during computation or preprogrammed limits determined by the operator, and
| |
| : 2. A reasonableness limit of the analog input signal level programmed.
| |
| The alarming sequence consists of an alarm typer and video monitor message for the variables that exceed process alarm limits. A variable that is returning to normal is signified by a return to normal message.
| |
| The process computer provides to the operator a means of monitoring, displaying and recording both NSS and BOP events.
| |
| Revision 12 7.7-45 January, 2003
| |
| | |
| These functions are performed by the following software 1) status alarm monitor, 2) sequence of events log, 3) digital trend,
| |
| : 4) archive data, 5) core performance calculations, and 6) balance of plant calculations.
| |
| The sequence of events log monitors up to 128 primary NSS variables and records to a resolution of 4 milliseconds in chronological order any change of state. These events are logged on a line printer whenever 64 contact changes have been sensed or 30 seconds have elapsed since the first detected change. Status designates the nature of the input event, description of the signal and time to the nearest millisecond.
| |
| The Free Format log allows the operator to define and print any additional logs that do not conveniently fall into any other log categories. Logs can be created or modified that will gather plant data by point groups. Print period and data gathering period are user selectable. An immediate printout of any active free format log and the ability to stop data gathering and printing of a Free Format log is available on demand.
| |
| The Process Computer system supports data archiving. Any point in the system can be set to archive its value and status upon a predetermined change in value from one reading to the next, and/or upon a change of status. All points are archived once each hour.
| |
| The core performance calculation is the total core thermal power calculated from a reactor heat balance. Total power is then distributed to every six-inch segment of each fuel assembly by calculation. Using plant inputs of pressure, temperature, flow LPRM levels, control rod positions, and the calculated fuel exposure. Interactive computational methods are used to establish a compatible relationship between the core coolant flow and core Revision 12 7.7-46 January, 2003
| |
| | |
| power distribution. The results subsequently are interpreted as local power at specified axial segments for each fuel bundle in the core.
| |
| The core power distribution calculation sequence is completed periodically and on demand. The sequence requires one to two minutes to execute. After executing the program, the computer prints a periodic log for record purposes.
| |
| Flux level and position data from the traversing in-core probe (TIP) equipment is read into the computer. The computer evaluates the data and determines gain adjustment factors by which the LPRM amplifier gains can be altered to compensate for exposure-induced sensitivity loss. The LPRM amplifier gains are not to be physically altered except immediately prior to processing TIP data using 3DMONICORE. This TIP data may be obtained just prior to physically altering the LPRM gains, such that an LPRM calibration requires only one set of TIP traverses. With up to ten TIP measurement locations inaccessible, data may be replaced by data as described in 1 or 2 below.
| |
| : 1. Option 1 is no longer used at Perry.
| |
| : 2. TIP data for inaccessible measurement locations may be replaced by data obtained from the on-line core monitoring system (process computer), normalized with available operating measurements.
| |
| Revision 21 7.7-47 October, 2019
| |
| | |
| The gain adjustment factor computations help to indicate to the operator when such a calibration procedure is necessary.
| |
| Using the power distribution data, a distribution of fuel exposure increments from the time of previous power distribution calculation is determined and is used to update the distribution of cumulative fuel exposure. Each fuel bundle is identified by batch and location, and its exposure is store for each of the axial segments used in the power distribution calculation. These data are printed out on operator demand.
| |
| Exposure increments are determined periodically for each quarter length section of each control rod. The corresponding cumulative exposure totals are periodically updated and printed out on operator demand.
| |
| The exposure increment of each local power range monitor is determined periodically and is used to update both the cumulative ion chamber exposures and the correction factors for exposure-dependent LPRM sensitivity loss. These data are printed out on operator demand.
| |
| The computer provides online capability to determine monthly and on-demand isotopic composition for each one-quarter-length section of each fuel bundle in the core. This evaluation consists of computing the weight of one neptunium, three uranium and five plutonium isotopes as well as the total uranium and total plutonium content. The isotopic composition is calculated for each one-quarter length of each fuel bundle and summed accordingly by bundles and batches. The method of analysis consists of relating the computed fuel exposure and average void fraction for the fuel to computer stored isotopic characteristics applicable to the specific fuel type.
| |
| Revision 12 7.7-48 January, 2003
| |
| | |
| Balance of plant calculations provide a means of implementing calculations which give meaningful indications of various conditions/parameters, for example, nuclear steam supply, turbine, condenser, feedwater heater. moisture separator, and overall plant performance. The program also will provide unit operating factor daily and monthly summaries. Such summaries include plant capacity factor, average power level, gross electrical energy generated, and unit load factor. All calculations will be executed and the results presented or stored every 10 minutes, provided the plant is online and power levels are high enough to ensure meaningful results.
| |
| 7.7.1.9 Reactor Water Cleanup System Refer to <Section 5.4.8>
| |
| 7.7.1.10 Process Sampling System Refer to <Section 9.3.2.>
| |
| 7.7.1.11 Gaseous Radwaste System Refer to <Section 11.3.>
| |
| 7.7.1.12 Drywell Vacuum Relief (DVR) System
| |
| : a. System Function The DVR system equalizes pressure between the drywell and outer containment volume (portion of containment volume outside drywell).
| |
| The only safety function of the system is to provide drywell to containment isolation.
| |
| Revision 12 7.7-49 January, 2003
| |
| : b. System Operation Both the check valves and the motor-operated isolation valves are normally closed when the differential pressure between the containment and drywell is zero or positive. When the differential pressure between the containment and drywell is negative, the motor-operated isolation valves are opened electrically. The check valves open in response to the differential pressure and thus provide vacuum relief. The motor-operated isolation valves also close automatically on a containment isolation signal which consists of reactor low-low level or drywell high pressure. The containment isolation signal is overridden and the motor-operated isolation valves are automatically opened by a negative differential pressure signal. The system diagram and control logic for the motor-operated isolation valves are shown in
| |
| <Figure 7.3-10> and <Figure 7.7-8>, respectively.
| |
| Isolation valve position indicating lights and system bypassed, inoperative alarms in the control room provide the operator sufficient information to monitor the status of the system and its devices.
| |
| 7.7.2 ANALYSIS 7.7.2.1 Safety Function Refer to the safety evaluations in <Chapter 15> and <Appendix 15A>.
| |
| <Chapter 15> shows that the systems described in <Section 7.7> are not used to provide any design basis accident safety function. Safety functions are provided by other systems.
| |
| Revision 12 7.7-50 January, 2003
| |
| | |
| 7.7.2.2 Failure Modes and Malfunctions
| |
| <Chapter 15> also evaluates all credible control system failure modes, the effects of those failures on plant functions, and the response of various safety-related systems to those failures.
| |
| The PNPP electrical system used for achieving safe shutdown is a Class 1E redundant system. Each redundant division contains its own power sources and separate controls and instrumentation. The trains are both electrically independent, and physically separated. Additionally, the PNPP is designed to <Regulatory Guide 1.75>, therefore, a failure of a non-Class 1E electrical component or system cannot adversely impact the operation of the Class 1E electrical control system.
| |
| Instrumentation and controls required for operation of the safety-related fluid systems are Class 1E, therefore, the only possible means of interaction between safety and nonsafety systems would be through the fluid process system. The major plant control systems described above have no direct interface with any safety-related systems and, thus, control system failures, other than those described in
| |
| <Chapter 15>, have no effect on the safety-related systems. Analysis for additional control system interactions is discussed in
| |
| <Appendix 15G>.
| |
| Revision 12 7.7-51 January, 2003
| |
| | |
| TABLE 7.7-1 DESIGN AND SUPPLY RESPONSIBILITY FOR NONSAFETY-RELATED SYSTEMS GE GE Design Supply Others
| |
| : 1. Rod Control & Information System X X
| |
| : 2. Recirculation Flow Control System X X
| |
| : 3. Feedwater Control System X X X
| |
| : 4. Steam Bypass and Pressure X X X Regulating System
| |
| : 5. Refueling Interlocks X X X
| |
| : 6. Reactor Water Cleanup System X X
| |
| : 7. Process Sampling X X
| |
| : 8. Gaseous Radwaste X X
| |
| : 9. NSSS Process Computer X X X Revision 14 7.7-52 October, 2005
| |
| | |
| TABLE 7.7-2 SIMILARITY TO LICENSED REACTORS FOR NONSAFETY-RELATED SYSTEMS Plants Applying for or Having Construction Instrumentation and Controls Permit or Opera- Similarity
| |
| __________(System)__________ ting License____ of Design
| |
| : 1. Rod Control and Information Grand Gulf Size diff-System erence
| |
| : 2. Recirculation Flow-Control Grand Gulf Capacity System differences to accommo-date vessel size difference
| |
| : 3. Feedwater Control System Grand Gulf Capacity differences
| |
| : 4. Steam Bypass and Pressure River Bend Capacity Regulating System differences
| |
| : 5. Refueling Interlocks Grand Gulf Same for PNPP
| |
| : 6. Reactor Water Cleanup Grand Gulf
| |
| : 7. Process Sampling
| |
| : 8. Gaseous Radwaste Grand Gulf
| |
| : 9. NSSS Process Computer Grand Gulf NSSS base function similar Revision 12 7.7-53 Janaury, 2003
| |
| | |
| TABLE 7.7-3 REFUELING INTERLOCK EFFECTIVENESS(1)
| |
| Refueling Refueling Platform Hoists Platform Mode Situation Position TMH FMH FG Control Rods Switch Attempt Result
| |
| : 1. Not near core UL UL UL All rods in Refuel Move refueling No restrictions platform over core
| |
| : 2. Not near core UL UL UL All rods in Refuel Withdraw rods Cannot withdraw more than one rod
| |
| : 3. Not near core UL UL UL One rod Refuel Move refueling No restrictions withdrawn platform over core
| |
| : 4. Not near core L One rod Refuel Move refueling Platform stopped withdrawn platform over before over core core
| |
| : 5. Over core UL UL UL All rods in Refuel Withdraw rods Cannot withdraw more than one rod
| |
| : 6. Over core L All rods in Refuel Withdraw rods Rod block
| |
| : 7. Not near core UL UL UL All rods in Startup Move refueling Platform stopped platform over before over core core
| |
| : 8. Not near core UL UL UL All rods in Startup Withdraw rods No restrictions
| |
| : 9. Over core UL UL UL All rods in Startup Withdraw rods Rod Block NOTE:
| |
| (1)
| |
| Table terminology is as follows:
| |
| TMH - trolley mounted hoist (Monorail Hoist)
| |
| FMH - frame mounted hoist (Frame Hoist)
| |
| FG - fuel hoist UL - unloaded L - loaded Revision 14 7.7-54 October, 2005}}
| |
