ML15216A411

TSTF-505: August 4, 2015 Public Meeting

ML15216A411
Person / Time
Site:	Diablo Canyon
Issue date:	08/04/2015
From:	Carte N N NRC/NRR/DE/EICB
To:
References
TSTF-505
Download: ML15216A411 (9)

Text

TSTF-505 TSTF-505 Norbert Carte (NRC/NRR)August42015 August 4 , 2015 Concerns Concerns*MethodologytodeterminewhenalossoffunctionMethodology to determine when a loss of function has occurred is not described.

• OperatorswillneedtomakethisdeterminationOperators will need to make this determination within one hour after the components are declared inoperable.

• Some regulatory requirements may not be explicitly modeled or addressed in the PRA.

• Reductions in redundancy and/or coincidence may introduce new events to be protected against.

2 When can a RICT be used?

• NEI 06-09 does not allow a RICT for a total loss of function, but does not have detailed guidance on what constitutes a total loss of g function*TSTF-505 allows two or more channels to be inoperable

• When Components are shared between protection and control systems, how many need to be PRA Functional or Operable in order fortherenottobeatotallossoffunction?for there not to be a total loss of function?*Two Types of FunctionsIdentifiedinTSTablesforRTS&ESFAS

-Identified in TS Tables for RTS & ESFAS-Specific functions identified in regulatory requirements

• IEEE 279-1971 3

Functional Requirements (StifPttidCtl)(Separa tion o f P ro t ec tion an d C on t ro l)*GDCs 21 & 24

• Effectively increases redundancy requirementsIEEE279 1971*IEEE 279-1971-Explicit Requirement to protect against

• Single Failures of shared equipment (extra redundancy)

• Events (alternate channels) -Not discussed below

• IEEE 603-1991SiiltIEEE279 1971-Si m il ar t o IEEE 279-1971 4 GDC 21-Protectionsystemreliability

-GDC 21Protection system reliability

-"The protection system shall be designed for high functionalreliabilityRedundancyandindependence functional reliability

-Redundancy and independencedesigned into the protection system shall be sufficient to assure that (1) no sin gle failure results in loss of the ()gprotection function -"Typical Configurations:

• 1 out of 2

• 2 out of 3

• 2 out of 4

• 1 out of 2 taken twice 5

GDC 24 -Se paration of protection and control p p"The protection system shall be separated from control systemstotheextentthatfailureofanysinglecontrolsystemsystems to the extent that failure of any single control system component or channel, or failure or removal from service of any single protection system component or channel which is commontothecontrolandprotectionsystemsleavesintactacommon to the control and protection systems leaves intact a system satisfying all reliability, redundancy, and independence requirements of the protection system

."Typical Configurations:

• 1outof2 1 out of 2*2 out of 3 vs 1 out of 3

• 2 out of 4

• 1 out of 2 taken twice 6

IEEE 279-19714.7, "Control and Protection System Interaction "Clause 4.7.3, "Single Random Failure," states:"Where a single random failure can cause a control system action thatresultsinageneratingstationconditionrequiringprotectivethat results in a generating station condition requiring protective action and can also prevent proper action of a protection system channel designed to protect against the condition, the remaining redundantprotectionchannelsshallbecapableofprovidingtheredundant protection channels shall be capable of providing the protective action even when degraded by a second random failure

.Provisions shall be included so that this requirement can still be met ifachannelisbypassedorremovedfromservicefortestor if a channel is bypassed or removed from service for test or maintenance purposes.Acceptable provisions include reducing the required coincidence, defeating the control signals taken from the redundant channels

, or initiatin g a protective action from the ,gpbypassed channel."

7 IEEE 279-1971Clause 4.11, "Channel Bypass or Removal from Operation,"states:"The s ystem shall be desi gned to p ermit an y one channel to be ygpymaintained, and when required, tested or calibrated during power operation without initiating a protective action at the systems level.

During such operation the active parts of the system shall of themselves continue to meet the single failure criterion

.Exception: "One-out-of-two" systems are permitted to violate the single failure criteria during channel bypass provided that acceptable reliability of operation can be otherwise demonstrated.

For example, the bypass time interval required for a test, calibration, or maintenance operation could be shown to be short thtthbbilitffilfthtihlldb th a t the pro b a bilit y o f f a ilure o f th e ac tive c h anne l wou ld b e commensurate with the probability of failure of the "one-out-of-two" system during its normal interval between tests."

8 IEEE279to603Mapping IEEE 279 to 603 MappingIEEE279-1971IEEE603-1991 IEEE 279 1971 IEEE 603 1991Clause 3Clause 4 ClCl0 Clause 4.1 Clause 5.0Clause 4.2Clause 5.1Clause 4.7.1Clause 5.6.3.1(1)Clause472Clause5631(2)

Clause 4.7.2 Clause 5.6.3.1(2)Clause 4.7.3Clause 5.6.3.3Cl474Cl63 Cl ause 4.7.4 Cl ause 6.3 9