ML19319C278
| ML19319C278 | |
| Person / Time | |
|---|---|
| Site: | Davis Besse  |
| Issue date: | 08/01/1969 |
| From: | TOLEDO EDISON CO. |
| To: | |
| References | |
| NUDOCS 8002110762 | |
| Download: ML19319C278 (65) | |
Text
{{#Wiki_filter:- - - - - ' - - - __ _ e d
- W o
eI
~
hi
.fi
+ r;a
= ,;gg. w.
- a ^2
*g%'3* .
.* .., Ih. E. '
't '
ijg[-f 9:%)th 9 c, w Shly l *
- Q;$$ -
-et: ; .
, A l[4 '
. . . . e*,
;W4 h
~
NIW6 *
..,4 u .'s
.24 b
e 0, s h- . S f y i s 0137 t 7 l 8002110fhM J..j
D-B I TABLE OF CONTENTS Section Page T INSTRUMENTATION AND CONTROL T-1 71 REACTOR PROTECTION SYSTEM T-1 T.1.1 DESIGN BASES T-1 T.1.1.1 Vital Functions 7-1 7 1.1.2 Principles of Design 7-1 T.1.1.2.1 Single Failure T-2 T.1.1.2.2 Redundancy T-2 T.1.1.2.3 Independence 7-2 T.1.1.2.h Loss of Power T-2 7.1.1.2.5 Manual Trip T-2 7 1.1.2.6 Equipment Removal T-3 7.1.1.2 7 Testin8 T-3 7.1.1.3 Functional Requirements T-3 7.1.1.4 Environmental Considerations T-3 7 1.2 SYSTEM DESCRIPTION 7h 7 1.2.1 System Description-Reactor Protection System 'Th T.1.2.2 Design Features 7-5 T.1.2.2.1 Redundancy T-5 T.1.2.2.2 Independence T-5 7.1.2.2.3 Loss of Power T-5 T.1.2.2.h Manual System Trip T-6 T.1.2.2.5 Equipment Removal T-6 T.1.2.2.6 Testing T-6 j T.1.2.2.7 Physical Isolation 7-6 C
^
0138 T-1
D-B TABLE OF CONTENTS (contd) Section Pace T.1.2.2.8 Primary Power Source T-T T.1.2.2.9 Reliability T-7 T.1.2.3 Summary of Protective Actions 7-8 T.1.2.h Relationship to Safety Limits T-8 T.1.3 SYSTEMS EVALUATION T-9 T.1 3.1 Functional Capability - Reactor Protection System T-9 T.l.3.2 Preoperational Tests 7-10 7.1.3.3 Comnonent Failure Censiderations 7-10 7 1.3.h Operational Tests 7-11 7.1.3.5 Separation of Control and Protection Systems 7-12 7.2 SAFETY FEATURES ACTUATION SYSTEMS T-13 7.2.1 DESIGN BASES T-13 7 2.2 EMERGENCY INJECTION ACTUATION 7-lh 7 2.2.1 Emergency Injection Actuation Signal T-lh T.2.2.2 Su=p Recirculation Actuation Signal T-15 T.2.2.3 Emergency Injection Actuation System Channel Bynass 7-16 T.2.3 CONTAINMENT SPRAY ACTUATION 7-16 1 7 2.h CONTAINMENT EMERGENCY HEAT REMOVAL ACTUATION SIGNAL T-17
's.2.5 CONTAINMENT ISOLATION ACTUATION SIGNALS T-17 8 T.2.6 EMERGENCY VENTILATION ACTUATION SIGNAL T-19 T.2.7 SYSTEM EVALUATION 7-19 e
73 REGULATING SYSTEMS T-22 T.3.1 DESIGN BASES T-22 T.3.1.1 Compensation Considerations T-22 0139
~
Amendment No.i 8 T-it
D-B TABLE OF CONTENTS (contd) (, Section , Page 7.3.1.2 Safety Considerations 7-23 T 3.1.2.1 Shutdown Margin T-23 7 3.1.2.2 Reactivity Rate Limits T-23 7 3.1.2.3 Power Peaking Limits 7-23 7 3.1.2.4 Power Level Limits 7-23 7.3.1.3 Start-Up Considerations T-23 7 3.2 SYSTEM DESIGN 7-24 7 3.2.1 Description of Reactivity Control 7-24 7.3.2.1.1 General Description T-2k 7.3.2.1.2 Reactivity Control 7-25 T.3.2.1.3 Reactivity Worth T-25 7.3.2.1.4 Reactor Control 7-26 T.3.2.2 Integrated Control System T-27 7.3.2.2.1 Turbine Control 7-28 7 3.2.2.2 Steam Generator Control 7-28 7 3.3 SYSTEM EVALUATION 7-30 7 3.3.1 System Failure Considerations T-30 T.3.3.2 Interlocking 7-30 7.3.3.3 Emergency Considerat$ons T-30 7.3.3.h Loss-of-Load Considerations- T-30 T.4 NUCLEAR UNIT INSTRUMENTATION T-32 7.4.1 NUCLEAR INSTRUMENTATION 7-32 7.4.1.1 Design T-32 7.h.1.1.1 Test and Calibration T-33 T.4.1.1.2 Power Range Detectors 7-33 0140
.- T-lii
D-B TABLE OF CONTENTS (contd) Section M T.k.l.1 3 Detector Locations T-33 7.k.l.1.h Interlock Functions T-33 7.k.l.2 Evaluation T-33 7.h.1.2.1 Loss of Power T-3h T.4.1.2.2 Reliability and Component Failure T-3h T.4.2 NONNUCLEAR PROCESS INSTRUMENTATION T-3h T.h.2.1 System Desi.rn T-34 7.h.2.2 System Evaluation T-35 7.k.3 IN-CORE MONITORING SYSTEM T-35 7.h.3.1 Design Basis T-35 7.h.3.2 System Design T-36 7.k.3.2.1 Syste= Description T-36 7.4.3.2.2 Calibration Techniques T-36 T.h.3.3 Detection and Control of Xenon oscillations T-37 T.h.3.h i stem Evaluation T-37 7.4.3.h.1 Operating Experience T-37 7.h.3.h.2 B&W Experience T-38 T.5 TURBINE CONTROL SYSTEMS T-39 T.5.1 DESIGN BASES T-39 T.5 2 DESCRIPTION AND OPERATION T-39 l T.6 OPERATING CONTROL STATIONS T h0 j T.6.1 GENERAL LAYOUT T h0 4 7.6.2 INFORMATION DISPLAY AND CCNTROL FUNCTION T k1 7.6.3
SUMMARY
O'! ALAEMS T k2 7.6.h COMMUNICATION 7 k2 j 7_1, 0141
D-B
~
[ , TABLE OF CONTENTS (contd) Section Page 7.6.5 OCCUPANCY 7-h2 7.6.6 AUXILIARY CONTROL STATIONS 7-43 7.6.7 SAFETY FEATURES 7-kh 7.6.8 SYSTEM EVALUATION 7-44 7.6.8.1 Information Available Post-Accident 7 kh 7.6.8.2 Control Room Availability 7 kh e
% y
.. g
~ 0142 7-v
D-B LIST OF FIGURES .N
%)
Figure No. Title 7-1 Reactor Protection System Block Diagram
'7-2 Reactor Protection System 4 ~
g i 7-3 Typical control Circuits for Engineered Safety Features Equipment 7h Reactor and Steam Temperatures Versus Reactor Power 7-5 Reactor Control Diagram - I.itegrated Control System 7-6 utomatic Control Rod Groups . Typical Worth Curve Versus Distance Withdrawn , 7-7 Steam Generator and Turbine Control Diagram Integrated Control System 7-8 Nuclear Instrumentation System 7-9 Nuclear Instrumentation Flux Ranges 7-10 Nuclear Instrumentation Detector Locations 7-11 Non-Nuclear Instrumentation Schematic -~) 7-12 Incore Detector Locations 7-13 Typical Arrangement - Incore Instrumentation Channel s
' ~
Amendmeht'No.8pl-
'~~ 0143 s.
7-vi
D-B [ 7 INSTRUMENTATION AND CONTROL 7.1 REACTOR PROTECTION SYSTD4 The reactor protection system performs important safot/ and interlock functions. The protection system extends from the sensing instruments to the final actua-ting devices. 7.1.1 DESIGN BASES The reactor protection system monitors parameters related to safe operation and trips the reactor to protect the reactor core against fuel rod cladding damage caused by departure from nucleate boiling (DNB), and to protect against reactor coolant system damage caused by high system pressure. 7.1.1.1 Vital Functions The reactor protection system automatically trips the reactor to protect the reactor core under these conditions:
- a. When the reactor power, as measured by neutron flux, exceeds a given limit,
- b. When the reactor power, as measured by neutron flux, exceeds the limit set by the reactor coolant flow.
- c. Loss of two reactor coolant pumps.
- d. The reactor out;et temperature reaches an established maximum limit.
- e. The reactor pressure reaches an established minimum limit.
- f. The reactor pressure reaches a mininami limit set as a function of the reactor outlet temperature.
The reactor protection system automatically trips the reactor to protect the reactor coolant system when the reactor pressure reaches an established maxi-mum limit. 7.1.1.2 Principles of Design o The reactor protection system is designed to meet the require =ents of the IEEE proposed " Criteria for Nuclear Power Plant Protection Systems" (IEEE 279) dated August 1968. Prototype and final equipment vill be subject to qualification tests as required by the subject standard. The tests will establish the ade-quacy of equipment perfor=ance in both normal and accident environments. The major design criteria are summarized in the following paragraphs: \
. ,o 0144 7-1
D-B 7.1.1.2.1 Single Failure
- a. No single component failure shall prevent the reactor protection system from fulfilling its protective functions when action is required.
- b. No single co=ponent failure shall initiate unnecessary protection system . action, provided implementation.does not conflict with the criterion ab' re.
7.1.1.2.2 Redundancy All protection system functions shall be implemented by redundant sensors, instrument strings, logic, and action devices that combine to form the pro-tection channels. , 7.1.1.2.3 Independence Redundant protection channels and their associated ele =ents are electrically independent and packaged to provide physical separation. Separate detectors and instrument strings are not, in general, employed for protection system functions and regulation or control. Sharing instrumenta-tion for protection and control functions is accomplished within the framework of the separation criteria of IEEE 279 by the employment of isolation ampli-fiers in each of the multiple outputs of the analog protection system instru- -
- ment strings.
l The isolation a=plifiers are precision operat 'onal amplifiers having a closed I loop unity gain and a lov dynamic output impedance. The effectiveness of the
- isolation a=plifier has been tested for all types of failures including open circuits , ground fa,.'.ts , and hot shorts up to 410 volts de and peak ac.
This may be stated as a corollary to the design criteria: "A direct short, open circuit, ground fault, faulting to a power source of less than h10 volts, or bridging of any two points at the output terminals of a protection system analog instrument string having multiple outputs shall not result in a sig-nificant disturbance within more than one output." Testing has demonstrated that the protection system design vill meet the above criteria. 7.1.1.2.4 Loss of Power A loss of power in a reactor protection system channel shall cau: 4:fected channel to trip. C 7.1.1.2 5 Manual Trip The reactor protection system shall have a manual actuating switch or switches in the control room which shall be independent of the autcmatic trip instru-mentation.- The manual switch and circuitry shall be simple, direct-acting, ~' and electrically connected close to the final actuating device. .. p..g . Q145 7-2
D-B 7.1.1.2.6 Equipment Removal - The reactor protection system shall initiate a trip of the channel involved when modules , equipment, or subassemblies are removed. 7.1.1.2.7 Testing Manual testing fact. ties shall be built into the protection system to provide for:
- a. Preoperational testing to give assurance that the protection systems can fulfill their required functions.
- b. On-line testing to prove operability and to demonstrate reliability.
7.1.1.3 Functional Recuirements The functional requirements of the protection system are those specified under vital functions. The functional requirements of the reactor protection system are to trip the reactor under the following conditions:
- a. The reactor power, as measured by neutron flux, reaches a preset maximum limit.
- b. The reactor power, as measured by neutron flux, reaches an allowable limit set by the number of operating reactor coolant pumps.
- c. The reactor power, as measured by neutron flux, reaches an allovable limit set by the measured reactor coolant flow.
- d. Two reactor coolant pu=ps are lost. (This also covers loss of three pumps and loss of all pu=ps.)
- e. The reactor outlet temperature reaches a preset maximum limit.
- f. The reactor coolant pressure reaches a preset maximum limit.
- g. The reactor coolant pressure reaches a preset minimum limit.
- h. The reactor coolant pressure falls or the reactor outlet temperature rises to a value dete uined by a preset relatienship between pressure and te=perature.
7.1.1.h Environ = ental Considerations < l The operating environment for equipment within the containment vessel vill nor-mally be controlled to less than approximately 120 F. The reactor protection system instrumentation within the containment vessel is designed for continuous if G i .: 0146 7-3 ~
D-B 0 3 operation in an environment of 120 F and 90 per cent relative humidity, but is also capable of performing reluired safety functions under accident conditions (1.4.23). ] / Protective equipment outside of the containment vessel, control re.:m, and cable room is designed for continuous operation in an ambient of 120 F and 90 per cent relative humidity. The control room and cable room ambients will be maintained at the personnel comfort level; however, protective equipment in the control 8l room and cable room vill operate within design tolerance up to an ambient temperature of 110 F. 7.1.2 SYSTEM DESCRIPTION 7.1.2.1 System Description-Reactor Protection System The system as shown in Figure 7-1 consists of four identical protective channels. Each channel controls one RS relay in four identical 2-out-of b logics. Each channel forms an AND gate to energize its respective RS relays. Should any one or more inputs to a given channel initiate a trip the RS relays associated with - that channel vill de-energize. Thus, from a trip standpoint, each channel is an OR gate. Should any two of the four protection channels de-energize their respective RS relays all four of the 2-out-of h logics will open, tripping the
' sntrol rod drive system circuit breakers which in turn removes power frcm the drives permitting the rods to move into the core shutting down the reactor.
The contrsi rod drive circuit breakers form a logic which is just short of a full 2-out-of h coincidence. The specified breaker combinations whit:h initiate a reactor trip can best be stated in logic notation as: AB + ADF + BCE + CDEF.
- This is a 1-out-of-2 logic used twice and is referred to as a 1-out-of-2 x 2 logic. It should be noted that when any 2-cut-of 4 protective cha.anels trip, all 2-out-of k logics trip, co=manding all control rod drive breakers to trip.
The undervoltage coils of the control rod drive breakers receive their power from the protective channel associated with each breaker. The manual reactor trip swith is interposed in series with each 2-out-of h logic and the assigned breakers undervoltage coil.. A more detailed illustration of the control rod drive power system is shown in Figure 3-53. The trip circuits and devices are redundant and independent. Each breaker is independent of each other breaker, so a single failure within one trip circuit does not affect any other trip circuit or prevent trip. By this arrangement, , each breaker may be tested independently by the manual test switch. One seg- ! ment of the manual reactor trip switch is included in each of the circuit ' breaker trip circuits to implement the ". direct action in the final device" criterion. N The flux / flow monitor logic details are shown on Figure 7-2 There are four identical sets of flux / flow monitor logic, one associated with each protection 'I channel. Each set of logic receives an independent total reactor coolant flov t signal (EF), a " number of pump moY, ors in operation" signal (P ), and two ) isolated reactor power level signals (4) . J
}l 1
- QLG j Amendment No. 8 I
D-B
<. The flux / flow conitor continuously compares the ratio of the reactor neutron power to the reactor coolant flov. Should the reactor power as =easured by the linear power range channels exceed 1.10 times the total reactor coolant flow, a reactor trip is initiated. All measure =ents are in tezer of per cent full flow or full (rated) power.
The flux /pu=p.comparator co= pares the reactor neutron power against the num-ber of operating pumps. When the reactor is operating above X per cent FP, a reactor trip is initiated im=ediately upon loss of a single pu=p. Below this power level, a reactor trip is initiated when the reactor power to reactor coolant flow ratio rixceeds 1.10. Thus, below a predetermined reactor power, there is opportunity for the control system to reduce the reactor power to an acceptable level without a reactor trip. With the loss of two pumps the comparator initiates a reactor trip. The pressure-temperature comparator compares the reactor coolant system pres- ~ sure and outlet temperature. When the relationship 13 26T - 5,933 A P is satis-fled, a reactor trip is initiated. (T is temperature in F and P is pressure in psig.) 7.1.2.2 Design Features 7.1.2.2.1 Redundancy The reactor protection system is redundant for all vital inputs and functions. Redundancy begins with the sensor. Each input variable is measured by four in-dependent and identical instrument strings. Only one of the four is associated with any one protection channel. The total and complete removal of one protec-tion channel and its associated vital instrument strings vould not impair the function of any other instrument or protection channel. 7.1.2.2.2 Independence The redundancy, as described above, is extended to provide independence in the reactor protection system. Each instrument string feeding into one protection channel is operationally and electrically independent of every other instrument string. Each protection channel is likewise functionally and electrically in-dependent of every other channel. Only in the coincicence output are the channels brought into any kind of com-mon relationship. Independence is preserved in the coincidence circuits through insulation resistance and physical separation of the coincidence networks and their switching elements. 7.1.2.2.3 Loss of Power The reactor protection system initiates trip action upon loss of power. All bistables operate in a normally energized state and go to a de-energized state to initiate action. Loss of power thus automatically . forces the bistables into the tripped state. Figure T-2 shows the system in a de-energized state. ( m . .s. , 0148 T-5
a D-B 7 1.2.2.h Manual System Trip The manual actuating devices in the protection system are independent of the automatic trip circuitry and are not subject to failures that make the auto-matic circuitry inoperable. The manual trip devices are independent control switches for each power controller. The independent control switches are ac-tuated through a common manual trip switch or push button. 7.1.2.2.5 Equipment Re= oval The removal of modules or subasse=blies from vital sections of the reactor pro-tection system vill initiate the trip normally associated with that portion of the system. The removal criterion is implemented in two ways: (1) advantage is taken of the inherent characteristics of a deenergi::e to trip system, and (2) interlocks are provided. An inherent characteristic is illustrated by considering the power supply for one of the reactor protection channels. Re= oval of this power supply auto-matically results in trip action by virtue of the resulting loss of power. No interlock is required in such cases. Other instances require a system of inter-locks built into the equipment to insure trip act on upon removal of a portion of the equipment. 7.1.2.2.6 Testing The protection systems meet the testing criterion and its objectives. The test 3 circuits take advantage of the syste=s ' redundance, independence, and coinci- ,) dence features which make it possible to initiate trip signals manually in any part of one protection channel without affecting the other channels. This test feature allows the operator to interrogate the systems from the in-put of any trip element up to the fina' actuating device at any time during reactor operation without disconnecting permanently installed equipment. The test of a trip element consists of inserting an analog input and varying the input until the trip point is reached. The value of the inserted test sig-nal represents the true value of the trip point. Thus, the test verifies not only that the trip element functions but that the trip point is correctly set. Prestart-up testing follows the same procedure as the en-line testing except that calibration of the analog instrument stringa may be checked with less restraint than during reactor operation. As shown in Figure 7-2, the power breakers in the reactor trip circuit may also be manually tested during operation The only limitation is that not more than one power supply may be inteyru ted at a time without causing a reactor , trip. 7.1.2.2.7 Physical Isolation The physical arrange =ent of all elero .its associated with the protection systems . . reduces the probability of a single physical event impairing the vital functions of the' system. For example, pressure measurements of reactor coolant pressure V m .
< 0149 7-6
D-B
,_s are divided between four redundant pressure taps so as to reduce the probability of collective damage to all sensors by a single accident.
System equipment is physically separated to reduce the probability of damage to the total system by some single event. Wiring between vital elements of the syste= outside of equipment housing is routed and protected within the unit so as to maintain redundancy of the cys-tems with respect to physical hazards. 7.1.2.2.8 Primary Power Source The primary sources of control power for the reactor protection system are the vital a-c buses described in 8.2.2.6. 7.1.2.2.9 Reliability Design criteria for the reactor protection system have been formulated to pro-duce a reliable system. System design practices , such as redundant equipment , redundant channels, and coincidence arrangements permitting in-service testing, have been employed to implement reliability of protective action. The best grades of con =ercially available ec=ponents are used in fabrication. A system fault analysis will be made considering the modes of failure and determining their effect on the system vital functions. Acceptance testing and periodic g testing vill be performed to insure the quality and reliability of the completed system. ( The flux / flow and flux / pump comparators are basically " variable" trip bistables as described in 7.1.2.1. The protection system bistables may be considered voltage comparators in which the measured variable signal voltage is compared against a trip point voltage originating within the bistable. When the measured variable signal equals or exceeds the trip point voltage, the bistable trips. Because of the comparator action, the bistable trip point can be controlled from an external source such as the output of the pump contact monitor logic. Loss of the trip point con-trol voltage results in a trip. The variable trip bistables meet the requirements of IEEE 279 by being part of the redundant and independent logic and meeting the single failure criteria. Testing Protection system equipment specifications require type testing in accordance with IEEE 279 and assurance that the quality of the delivered product meets the standards and performance requirements specified. J The equipment =anufacturer is required to provide qualification test- data to verify the performance requirements of the equipment. Adherence to the equip-ment specifications and qualification test data is assured through monitoring and inspection of the manufacturer's work.
+
7,7 Amend ent No. 8
D-B Instrumentation and control items that must service part or all of the LOCA environment ara subject to these qualification test verification prtmedures and requirements. '] 7.1.2.3 Summary of Protective Actions Tha abnormal conditions that .31tiate a reactor trip are as follows: Steady-State Trip Value or Trip Variable No. of Sensors g rmal Range Condition for Trip hutron Flux k Flux 0-100". 105.5", of full (rated) power. Psutron Flux / Reactor k Flux 2 to k Pumps (1) Loss of one op-Coolant Flow Reactor Coolant erating coolant pump Pu=p Monitors motor and reactor . (16 Monitor neutron power ex-Contacts) ceeds predetermined . level. 6 (2) Loss of two op-erating reactor cool-ant pumps. 2 Flow Tubes (3) Ratio of reactor (8 AP Transmitters) neutron power to total reactor coolant flow exceeds 1.10. s Reactor Coolant k Pressure 2,120-2,250 2,350 psig Pressure psig 1,759 psig 2l Rcactor Outlet h Te=perature 520-608 F 617 F Tcmperature Pressure / Temperature k Pressure 2,120-2,250 P 5 13.26T - 5,933 h psig
- gl h Temperature 520-608 F T P + 5,933 h
13.26 7.1.2.h Relationship to Safety Limits Trip set points tabulated in 71.2.3 are consistent with the safety limits that have been tstablished from the analyses described in Section lb. The set point for each input, which 8 must initiate a trip of the reactor protection system, has been established at a level that will insure that control rods are inserted in sufficient time to protect the reactor core Factors such as the rate at which the sensed variable can change, instrumentation and calibration inaccuracies, trip element trip times, circuit breaker trip times, and control rod travel times, have been considered in establishing the margin between the trip set < points and the safety limits that have been derived. 0 Op; ration on two reactor coolant pumps will be provided for in the design of the reactor protection system. After reactor shutdown manual ad-justment of trip setpoints vill be 6 mad] in accordance with Tech. Spec. requirements to permit operation at reduced power. Th2 permissible power level and trip setpoints will be established during the detailed d rign of the' f system.
' o :_ 01.51 Ame ndment No. 8 7_g
l D-B i l h_ 8 7 1.3 SYSTFXd EVALUATION 7.1.3.1 Functional Capability - Reactor Protection System The reactor protection system has been designed to limit the reactor power to a level within the design capability of the reactor core. In all accident evaluations, the time response of the sensors and the protective channels is considered. Maximum trip times of the protection channels are listed below:
- a. Temperature - 5 s
- b. Pressure - 0 5 s
- c. Flux - 0.3 s .i
- d. Pump Monitor - 0 5 s Since all uncertainties are considered ac cumulative in deriving these times, the actual times may be only one-half as long in most cases. Even these maxi-mum times, when added to control rod drop times, provide conservative protec-tive action.
The reactor otection system vill limit the power that might result from an (. unexpected .eactivity change. Any change of this nature vill be detected and arrested by high reactor coolant temperature, high reactor coolant pressure, or high neutron flux protective action. An uncontrolled rod withdrawal from start-up will be detected by high neutron flux in the power range channels. A rod withdrawal accident at power will immediately result in a high neutron flux trip. Reduced reactor coolant flow results in a reduced allowable reactor power. The reactor coolant pump monitor operates to set the appropriate reactor power limit by adjusting the power level trip point. (f y 0152 1'
.x d.N + % l '
7-9 Amendment No. 8
'D-B Two major measurements feed the flux /flov monitor: (a) reactor coolant flow, e and (b) neutron power level. The flow tubes which provide the reactor coolant ~
flow measurement vill exhibit no change during the reactor life. A periodic calibration of the flow transmitters will be made. The neutron power level 8l signal vill be recalibrated by comparison with a routine heat balance. The power range channels use detectors arranged to effectively average the measure.- ment over the length of the core as described in 7.h.1.1.2. Therefore, their output is expected to be within h per cent of the calibrated value during nor-mal regulating rod group position changes, and the need for additional calibra-tion is thereby eliminated. A loss of reactor coolant will result in a reduction of reactor coolant pres-sure. The low-pressure trip serves to trip the reactor for such an occurrence. A significant turbine-side steam line rupture is reflected in a drop of reactor coolant pressure. The low reactor pressure trip shuts down the unit for such an occurrence. 7.1.3.2 Preoperational Tests Valid testing of analog sensing elements associated with the protection system vill be accomplished through the actual manipulation of the measured variable and comparison of the results against a standard. Routine preoperstional tests vill be performed by the substitution of a calibra-ting signal for the sensor. Simulated neutron signals may be substituted in , each of the power range channels to check the operation of each channel. Sim-ulated pressure, temperature, and level signals may be used in a similar fashion. This type of testing is valid for all elements of the system except the sensors. The sensors vill be calibrated during shutdowns for refueling, or whenever the true status of any measured variable cannot be assessed because of lack of agree-ment among the redundant measurements. The final defense against sensor failure during operation vill be the unit op-erator. The redundancy of measurements provides more than adequate opportunity for comparative readings. In addition, the redundancy of the system reduces the consequences of a single sensor failure. 7.1.3.3 Component Failure Considerations The effects of failure can be understood through Figure 7-2. In the reactor protection system, the failuye of any single input in the " tripped" direction places the system in a 1-out-of-3 mode of operation for all variables. Fail-ure of any single input in the "cannot trip" direction places the system in a 2-out-of-3 mode of operation for the variable involved, but leaves all other variables in the normal 2-out-of-b coincidence mode. With a " tripped" open 8 l circuit fault in' one channel, the system would be able to tolerate a maxi =um of two "cannot trip" short circuit failures within the same measured vari-able before minimum safety protection of the variable is reached. With one 8 "trinped" open circuit fault, a second identical fault within the same vari-able would trip the reactor. C ~, [b Amendment No. 8 . 0153 7-10 e
D-B A similar fault relationship exists between channels as a result of the 2-out-f' of h coincidence output. One " trip" faulted channel places the system in a 1-out-of-3 or single channel mode. A "cannot trip" faulted channel places the system in a 2-out-cf-3 mode. At the final device, a " trip" faulted power breaker does not affect the pro-tection :hannel mode of operation, reactor trip being dependent upon one of two breakers in the unaffected primary power supply to the control rod drives. A breaker faulted in the "cannot trip" mode leaves the system dependent upon the second breaker in the affected primary power supply. Primary power input to the protection system has been arranged to minimize the possibility of loss of power. Each channel of the protection system vill be supplied from one of the four vital a-c buses described in 8.2.2.6. The op-perator can initiate a reactor trip independent of the automatic protection action. 7 1.3.h operational Tests The protection system is designed and has the racilities for routine manual operational testing. Most inputs to the protection system originate from an analog measurement of a particular variable. Every input of this type is equipped with a continuous readout device. A routine check by the operator of each reading as compared to the other redundant readings available for ear variable vill uncover =ea-surement faults. These elements plus the bistable and relay trip elements of the protection systems require a periodic dynamic test. Each system provides for routine testing. Each trip element may be manually tripped, and the re-sults of that trip traced through the system logic and visually indicated to the operstor. The trip point setting of each t'ip r element may be verified by the application of an analog signal proportional to the measured variable, and that signal may be varied until the element trips. The test signal is manually injected into the instrument channel at the input of the first active channel element in the protection system cabinets. For the nuclear instru=ents, the test signal is injected in the neutron detector input while test signals for pressure and temperature are injected at the lin-ear input of their associated trip elements. Test signals for the pump =oni-tor are injected at the input from the pump monitors. l Testing an analog channel consists of varying the test signal over the dynamic I range of the channel and observing that the channel responds properly and that the associated trip element not only trips, but trips at the correct set point. , The on-line test is designed to detect set point and zero drift or a change in l the channel response. Calibration and corrective adjustments may be made dur-
. ing the on-line test. l l
Since the on-line test actually results in the instrument channel tripping its associated protection channel, placing more than one. channel on test at a time v.ll trip the plant. Therefore the coincident logic networks where the protec-i ti,n channels lose their identity are tested by parts. Eac'h log 49.plement is
; n i .. .. M 0154 T-11
D-B tripped, observed, and reset. The test scheme depends upon the coincidence A action of the logic to prevent a complete protection system trip during test- ' f/ ing. The test scheme includes an interlock within each p itection channel. The pur-pose of this interlock is to trip the protection channel before any associated instrument can be tested. Thus, any attempt to test elements of two protec-tion channels at the same time vill result in a protection system trip. Part of the test scheme includes providing readouts of the redundant analog inputs to the protection channels. These readouts will permit the operator to compare the performance of like instruments and observe their response to changes in the unit. 7.1.3.5 Separation of centrol and Protection Systems The reactor control system receives inputs from channels Vhich feed the reactor protection system in the following areas:
- a. Reactor coolant pressure.
- b. Reactor coolant flow.
- c. Reactor coolant pump monitors,
- d. Reactor power level.
3 e resctor coolant pressure and reactor coolant flow measurements have four protection channels of which only one channel is connected to control at any given time. If failure in the control system were to somehow reflect back in-to the connected single channel of protection, the three remaining channels would meet the single failure criteria. To insure that failures in control do not carry over into the single protection channel, the output to the con-4 trol system from the shared sensor and amplifier is isolated by means of an isolation amplifier. The pu=p monitor circuits use separate contacts for protection and control in-put signals essentially creating four channels for protection and one channel for control. The circuitry for the measurement of power level for reactor control uses an averaging circuit which combines the inputs from all four reactor power level measurements . To insure thet failures in the control system cannot produce a failure in the protection system, each signal which goes to control from shared sensors,and a=plifiers is isolated by means of isolation amplifiers. The resulting systems meet the requirements for separation of. protection and control and for single failure specified in IEEE 279, and the AEC General Design Criteria 20, 21, and 22. 0155 -
, ~I. '
>+
(, '
- l. -
D-B 7.2 SAFETY FEATURES ACTUATION SYSTEMS 7.2.1 DESIGN BASES The quality of instrumentation used to initiate action of the engineered [,1 safety features is the same as that used for the reactor protection system. Control equipment used to start the pumps and actuate the valves is backed up, rated, and protected to achieve a redundance and r'eliability consistent with that of the protection system instrumentation as described in Section 7.1. The controls are interlocked to automatically provide the sequence of operations required to initiate safety features operations. The instrumentation and controls which actuate and control the engineered snfety features are designed on the following bases:
- a. Redundant instruments are provided for initiating safety features action.
- b. Four sensors are used for each of the critical parameters. l8
- c. An actuation signal from any two out of four sensors will initiate the ap'ropriate engineered safety features action l1 (see Figures 7-3),
l8
- d. Circuits are run in separate viring raceways and power supplies are taken from separate vital instrument buses, consistent with the principle of maintaining independence of channels. l8
( e. A loss of instrument power to two or more measurement channels or logic systems will initiate engineered safety features l1 actuation signals. gg
- f. All equipment including-panels, components e2.d cables associated with the engineered safety features will be marked in order to facilitate their identification.
l8
- g. Electrical circuit separation by means of isolation amplifiers or equal vill be provided between engineered safety features and annunciators, data loggers, and computers.
- h. Where more than one channel is used to transmit the same signal, each channel vill be povered from a separate safety features control power panel isolated to ensure reliability. .
The Safety Features Actuation Logic System generates actuation signals for the various safety features systems in the-station. The safety features 1 actuated by the logic system are: J
- a. Emergency Injection System comprising the high pressure and lov pressure injection systems.
; ,g *. .. 4~ . b. Containment Spray System.
v, ' t. ..c. 0156
> u Amendment No. 8 7-13 i
D-B
- c. Containment Emergency Heat Removal System. 3 i
- d. Containment Isolation.
- e. Shield Building and Penetration Room Ventilation and Filtration System.
Reliability of system operation is assured by duplication of vital compon-ents, control circuits, and power supplies in conjunction with emphasis placed on design and periodic performance testing. The Safety Features Actuation Logic System is shown in Figure T-3 T.2.2 E!ERCMCY INJECTION ACTUATION SYSTEM 7.2.2.1 p.ergency Injection Actuation Signal The Emergency Injection Actuation System obtains its actuation signal from . the Safety Features Actuation Logic System as shown in Figure T-3 There are four independent reactor coolant system pressure transmitters and four independent containment pressure detectors to provide individual signal inputs. There are two low reactor coolant pressure setpoints associated with each of the four independent reactor coolant pressure channels to the logic system. One setpoint is at 1500 psig and the other is at 200 psig. A h psig setpoint is associated with each of the four high containment pressure channels. A _ 1 high pressure emergency injection signal occurs when the 1500 psig setpoint is reached on two out of four low reactor coolant system pressure channels or when the 4 psig setpoint is reached on two out of four high containment pressure channels. With the loss of all auxiliary power and one diesel generator operating, a high pressure injection signal vill initiate the following action:
- a. Send an actuating signal to make sure the ncreally open supply line valve from the borated water storage tank is open.
O b. (DELETED)
- c. Start one high pressur injection pump.
- d. Open two high pressure ' solation valves in injection line from this pump. d
- e. Close isolation valves in the letdevn line and seal return lines.
With station auxiliary power available or two diesels operating, a second train of items, a through e, vill also operate. This is described in Section 6.1 and is shown on_ Figure 6-1. h 0157 7~ Amendment No. 6
D-B A low pressure emergency injection signal occurs when the 200 psig setpoint is reached on two out of four low reactor coolant system pressure channels or when the h psig setpoint is reached on two out of four high containment pressure channels. With the loss of all auxiliary power and one diesel generator operating, a low pressure injection signal will initiate the following actions:
- a. Send an actuating signal to make sure the normally open supply line valve from the borated water storage tank is open to pro-vide suction to one decay heat pump.
- b. Open the low pressure injection line isolation valve from this decay heat pump. l8
- c. Start one decay heat pump (low pressure injection pump). 1 8 If station auxiliary power is available or if two diesels are operating, a -
second train of items, a through c, will also be actuated by the low pres- l8 sure injection actuation signal. Automatic actuation of the pumps and valves associated with both high and low pressure injection syste=s is accomplished by relays controlled by the Safety Features Actuation Logic System. The pumps and valves are also equipped with manual control devices located on the control board in the control room. \ The high pressure injection system will be tested during shutdown and the low pressure injection system vill be tested during station operation for reliability and so as not to endanger station operation. 7.2.2.2 Sume Recirculation Actuation Signal The coincidence of two low level signals from any of four independent level sensing devices on the borated water storage tank initiates the sump recir-culation actuation signal (SRAS). This automatically transfers the emergency injectionandspraypumpsuctiontothecontainmentvesselemergencysumpbyl 6 opening the two sump outlet valves, closing the borated water storage tank outlet valves and closing the pump minimum flow recirculation valves to the borated water storage tank. Transfer to the recirculation mode can also be initiated manually. The borated water storage tank outlet valves are normally open and designed to fail open to ensure the availability of pump suction water at the start of emergency injection and containment spray. Valve fail-ure in the open position during the recirculation mode of operation does not affect pump suction since check valves are provided to maintain centainment integrity and prevent reverse flow during the recirculation operation. The sump outlet valves are normally closed and designed to fail as is. The valves are controlled to open on the recirculation actuation signal or by operator control. ,j The sump recirculation actuation signal is independent of the. Safety Features g ( Actuation Logic System and is not actuated by it. 0158 7-15 Amendment No. 8 u
D-B 7.2.2.3 Emergency Injection Actuation System Channel Bypass k~' The low reactor coolant pressure actuation setpoints will be bypansed for reactor start-up and cooldown. This includes the 1,500 psig high pressure 8 injection setpoint and the 200 psig low pressure injection sc+. point. Each of the pressure setpoint bypass functions is identical in its imple-mentation and differs only at the operating point. ' In the low pressure state at start-up, the operator manually initiates each 8 f the low pressure setpoint bypasses separately. The low pressure injec-tion actuation setpoint becomes active automatically at h00 psig and the high pressure injection at 1,600 psig. During cooldown and depressurization, the low pressure bypasses may be manu-ally initiated only within the dead band of the bypass equipment. Initiation 0 of the high pressure injection bypass can occur only between 1600 psig and 1500 psig and for low pressure injection between h00 psig and 200 psig. - The high containment pressure setpoint bypass logic is shown in Figure 7-3. The pressure actuation setpoint of h psig may be bypassed only within the dead band of the 200 psig low coolant pressure bypass equipment. This arrangement prevents bypassing the high containment pressure actuation above 8 l1 400 psig pressure in the primary coolant loop. 8l Each low pressure actuation signal element has an independent bypass circuit associated with it; therefore, all elements of the bypass function are a part of the protection system and are designed to meet the IEEE Standard 279 7.2.3 CONTAINMENT SPRAY ACTUATION SIONAL Containment air cooling is accomplished during emergency conditions partly by the Containment Spray System. Two containment spray headers are located in the dome of the containment building for this purpose. Each header has an associated pump and spray nozzles. There are four independent high pressure detectors of the containment at-mosphere combined in a two out of four logic. Each of the four pressure detector channels has an associated pressure setpoint of 20 psig. An actuating signal from this logic system in combination with the signal that actuates the high pressure emergency injection system initiates the Contain-ment Spray System as shown in Figure T-3. There are two independent signal channels for actuating the spray system, either of which actuates the two containment spray pumps with their associated valves. The isolation valves are designed to fail open to ensure a flow path for the < spray in the event of component failure in the control circuit. Manual actuation of'each jump ahd.if9 associated valves may bei i~n'itiated from separate control switches located in the control room. This will permit periodic operability testing of components and circuitry without inadvertent spray into the containment structure. This system is described in Section s 8l 6.2 and flow diagram is shown in Figure 6-5 Amendment No. 8 0159 7-16 -
D-B ( Blocking of the Containment Spray Actuation Signal during startup and shut-down of the station is accomplished when the logic signal that actuates the high pressure emergency injection system is blocked. This block (bypass) is described in Section 7 2.2.3 7.2.h CONTAINMENT EMERGENCY HEAT REMOVAL ACTUATION SIGNAL Containment air cooling is provided partly by the three ventilation air coolers described in Section 6.2. The containment air recirculation fans, coolers and their associated valves are actuated by the same logic signal that initiates the high pressure emergency injection system. The logic is shown in Figure T-3. The same four independent reactor coolant pressure channels and four independent containment pressure channels provide actua-tion signals for the containment cooling system. There are two independent signal channels in the Safety Features Actuation Logic System, either of which sends actuating signals to three containment air recirculation fans, 1 coolers and their associated valves when a high pressure emergency injection signal occurs. The service cooling water supply bypass valves to the containment coolers are normally open. The cooling water main discharge valves are opened by the same signal which actuates the containment coolers and are designed to fail open to ensure a flow path for the cooling water required for emergency ' cooling. This is shown in Figure 6-6. Manual actuation of the system may be initiated from individual fan and ( valve control switches located in the control room. Blocking of the Containment Emergency Heat Removal Actuation Signal is accomplished when the high pressure emergency injection signal is blocked (bypassed) as described in Section 7.2.2.3 Each fan and isola' ion valve has test features to permit periodic opera-bility testing of individual components and circuitry without causing interruptions of the containment air recirculation system. 7.2.5 CONTAINMENT ISOLATION ACTUATION SIGNALS Containment isolation is initiated by three logic systems as follows: 1
- a. Non-critical isolation valves are closed by the same logic actuation signal that initiates high pressure emergency in-jection. These valves are those whose closing vill not endanger any station equipment.
Air operated engineered safety features valves automatically go to their engineered safety features nos_ tion uten loss of j 2 control air. Each of the two valves used in a line is control-led from a single engineered safety features channel. Single valves used in lines are controlled from two engineered safety features channels in an "0R" configuration. The valves with
- their actuators, positioners, etc. are listed in T ble 5-2 and
. . Figure 5-8. ' 1
- f. ,
0160 7-17 Amendment No. 3
D-B Manual actuation may be initiated from individual valve control switches located in the control room. Blocking of the logic signal that actuate the non-critical isolation valves may be accomplished when the high pressure emergency injection signal is blocked (bypassed) cs described in Section 7.2.2.3
- b. Critical isolation valves are closed by the same actuation signal that initiates the Contain=ent Spray System. These valves are those whose closing could endanger station equipment.
These valves are therefore delayed in operation by having to wait for the Containment Spray Actuation Signal which occurs in a time period after emergency injection is initiated. Air operated engineered safety features valves automatically go to their engineered safety features position upon loss of con- : trol air. Each of the two valves used in a line is controlled from a single engineered safety features channel. Single valves used in lines are controlled from two engineered safety features chanLels in an "0R" configuration. The valves with their actuators, positioners, etc. are listed in Table 5-2 and Figure 5-8.
- Manual actuation may be initiated from individual valve control 1
switches located in the control room. Blocking of the logic cignal that actuates the critical isola-tion valves may be accomplished in the same manner as the logic signal block (bypass) to the non-critical valves.
- c. The containment purge system isolation valves are closed auto-matically by the same logic signal from the Safety Features Actuation Logic System that initiates the high pressure in-jection system or by a high radiation signal. The high radia-tion signal occurs when two out of four high radiation sensors reach a prescribed setpoint. The radiation sensors consist of two stack monitors (one gas and one particulate) and two containment monitors (also one gas and one particulate).
There are two independent logic channels, either of which will actuate the purge system isolation valves. The valves auto-matically go to their closed position upon a loss of control air. Manual actuation may be initiated from individual switches located in the control room. Blocking of the logic signals that actuate the containment purge isolation valves may be accomplished when the high pressure emergency injection signal is blocked (bypassed) as described in Section 7.2.2.3. The high radiation actuation signal cannot be blocked.
~
~)
01G1. Amendment No. 1 7-18
D-B (
~
The containment isolation valves have the capability to be tested individ-ually by manual actuation. 1 7.2.6 DIERGENCY VENTILATION ACTUATION SIGNAL 1 8 The Emergency Ventilation System consists of two independent and redundant ventilating systems and is described in Section 6. 3 The ventilation fans 8 and their associated dampers are actuated automatically upon receiving the same signal that actuates the containment purge isolation valves. A high pressure emergency injection signal or two out of four high radiation signalk 1 vill actuate the system. There are two independent signal channels, either of which vill actuate two ventilation fans and their associated dampers. The fans and associated da=pers are designed to fail safe criteria in the control circuits. Manual actuation of eaca fan and associated dampers may be initiated from separate switches in tne control room which permit periodic operability testing. Blocking of the Energency Ventilation Actuation Signal is accomplished during l8 station start-up and shutdown when the high pressure emergency injection actuation signal is blocked (bypassed) as described in Section 7.2.2.3 1 The logic actuation signal from the high radiation monitoring system cannot be blocked. The logic system for this signal is shown in Figure T-3 7.2.7 SYSTEM EVALUATION The engineered safety features initiation, control and power supply systems are designed in accordance with the Proposed IEEE Criteria No. 279, dated August, 1968, so that no single fault in components, units, channels or sensors will prevent engineered safety features operation. The timing of initiation and start-up of the engineered safety features system is such as to provide conservative protection. The viring vill be installed so that no single fault or failure, including either an open or shorted circuit, vill negate minimum engineered safety features operation. Wiring for redundant circuits is protected and routed independently so that damage to any one path will not prevent minimum engineered safety features action. Sensors are piped so that bicekage or failure of any one connection does not prevent engineered safety features operation. _ After a loss of auxiliary power the diesels vill each pick up the safety features power loads essential for the safe control of the station. Assum-ing safety features actuation signals call for all the equipment to be started the ,following is a list of equipment started by each diesel and a , tentative starting sequence: [}jjg,3 A=endment No. 8 7-19
D-B 1 Component Cooling Water Pump
/,.
8 1 High Pressure Injection Pump ,, 8 l 1 Decay Heat Pu=p (Low Pressure Injection) 1 1 Service Water Pump 1 Containment Spray Pump 1 Containment Cooler Fan 8 1 Emergency Ventilation System Fan The first five items will be started in thirty seconds and the other two , started in the first forty seconds. Control room ventilation fans vill be started from the diesel by operator control after forty seconds. The detailed design vill incorporate the following characteristics in order to counteract faults resulting in loss of power: 8 a. All redundant components are powered from separate buses.
- b. The reliability of the 125 volt de and 120 volt ac vital power buses used, as discussed in detail in Sections 8.2.2.5, 8.2.2.6 )
8 and as shown on Figure 8 h. '
- c. The reliability of the h160 volt and h80 volt systems as 8 l discussed in Section 8.
- d. The starting and loading of diesel generators as described in Section 8.2.3.3.
0163 b Amendment No. 8 T-20
D-B
- e. Whenever practical, components of the engineered safety features system assume on loss of power the position called for under emergency conditions.
Testing of the safety features systems will be performed during shutdown. The individual components like pumps, heat exchangers, etc., may be tested periodically during normal station operation. Visual inspection of all 1 equipment will be dene periodically. All safety features system testing will oe performed in accordance with administrative controls. m
'.4( I ' w 0164 T-21
D-B 73 REGULATING SYSTEMS T.3.1 DESIGN BASES 7.3.1.1 Cemeensation Considerations Reactor regulation is based on the use of movable control rod assemblies and chemical neutron absorber (boric acid) dissolved in the reactor coolant. Relatively fast reactivity effects including Doppler, xenoa, and moderator tem-rerature are controlled by the control rods, which are capable of rapid com-pensation. Relatively slow reactivity effects, such as fuel burnup, fission product buildup, samarium buildup, and hot-to-cold moderator deficit, are con-trolled by soluble boron.
- Control rods are used throughout approximately 90 per cent of core life for .
xenon transients associated with normal power changes. Chemical shim is used in conjunction with control rods to compensate for equilibrium xenon conditions. The reactor controls are designed to maintain a constant average reactor cool-ant temperature over the load range from 15 to 100 per cent of rated power. The steam system operates on constant pressure at all loads. The average reac-tor coolant temperature decreases over the range from 15 per cent load to zero ' load. Figure 7 h shows the reactor coolant and steam temperatures over the entire load range.
~$
Input signals to the reactor controls include reactor coolant average tempera- ~' ture, unit load demand, and reactor power as indicated by out-of-core neutron detectors. Soluble boron dilution is initiated manually and terminated auto-matica11y or manually. Manual rod control is .used below 15 per cent of rated power. Automatic or manual rod control may be used above 15 per cent of rated power. Increasing power transients between 20 and 90 per cent power are limited to ramp changes of 5 per cent / min and step increases of 10 per cent. Power increases from 15-20 per cent and above 90 per cent are limited to 5 per cent / min, subject to xenon limitntions. Decreasing power transients between 100 and 20 per cent power are limited to ramp changes of 5 per cent / min and step decreases of 10 per cent. min. Power decreases between 20-15 per cent are limited to 5 per cent / The turbine bypass system and atmosphere safety valves permit a 100 per cent load drop without reactor trip. s
.s Control rod, rod, and control rod assembly (CRA) are used interchangeably , in this section and elsewhere in this report.
s . 0165 7-22
D-B 7 3.1.2 Safety Considerations 7 3.1 2.1
. Shutdown Margin -
The control rods are provided in sufficient number to allow a hot shutdown that is greater than 1 per cent suberitical with rod assembly of greatest worth fully withdrawn and a typical level of soluble boron (Figure 3-1). 7 3.1.2.2 Reactivity Rate Limits The maximum rate of change of reactivity that can be inserted by any group of control rods does not exceed 1.09 x 10 4 (ak/k)/second. (The accidental withdrawal of the rod group of greatest worth is discussed in 14.1.2.2 and Ih.l.2.3. The maximum normal rate (70 gpm)(through one letdown cooler) of, pure water ad- , dition does not change reactivity worth more than 1.6 x 10-6 (ak/k)/second. Reactivity control may be exchanged between rods and soluble boron consistent ~ with the design bases listed above. Refer also to 7.3.2.1.3. 7 3.1.2.3 Power Peaking Limits The nominal reactivity available to a power regulating control rod group is limited so that established radial and axial flux-peaking liinits are not ex-ceeded with the rod group in any position at power levels up to 100 per cent power. 7 3.1.2.4 Power Level Limits The reactor automatic controls incorporate a high limit and a lov limit of power level demand to the reactor. Additional limits are imposed on reactor power demand by reduced feed-water flow capability and reactor coolant system flow capability. 7 3.1.3 Start-up considerations Over the life of the nuclear unit, start-up vill occur at various temperature levels and after varying periods of downtime. Examples of regulating system design requirements as related to start-up are:
- a. Control rod and/or control rod group " withdraw inhibit" on high start-up rate (short period) in the source range and intermediate range.
- b. Start-up control mode. This mode prevents automatic rod withdrawal below 15 per cent power. ,
- c. In start-up control mode, the controls are arranged so that the steam system follows reactor power rather than turbine demand. The con-trols vill limit steam dump to the condenser when condenser vacuum is inadequate.
- d. Sufficient control rod worth is provided to override traqsgeht xenon following a 50 per cent reduction in power during mcst of core life.
'> 0166
'7-23
- m. d*
D-B During cold shutdown, it will be necessary to increase boron concen- ' tration to maintain shutdown margin. Folleving a cold shutdown, ) bo ;n concentration changes will be made during start-up. A number of rod assemblies (or groups), sufficient to provide 1 per cent shut-down margin during start-up, are required to be withdrawn before a dilution cycle.
- e. Minimum pressurizer water level conditions must be met before and during' start-up.
T.3.2 SYSTEM DESIGN T.3.2.1 Descrintion of Reactivity Control T.3.2.1.1 General Description The reactor controls move control rods to regulate the power output of the re- - actor and =aintain constant reactor coolant average temperature above 15 per
- cent rated power. As shown in Figure 7-5, the unit load demand signal is added to the reactor coolant average temperature error to form a reactor power level demand signal. The reactor power level demand signal is compared to the re-actor power level measured by the power range detectors in the nuclear instru-mentation. When the resulting reactor power level error signal exceeds the dead band, the output signal is a control rod drive " withdraw" or " insert" command to the controlling rod group. For reactirity control limits, see 3.1.2.2. x
)
7.3.." 1.2 Reactivity Control ~s Reactivity control is maintained by movable control rod assemblies and by sol-uble boron dissolved in the reactor coolant. The moderator temperature coef-ficient (cold to hot critical), as well as long-term reactivity changes caused by fuel burnup and fission product poisoning, are controlled by adjusting sol-uble boron concentration. Short-term reactivity changes caused by power change, xenon poisoning, and moderator temperature change from 0 to 15 per cent pover are controlled by control rods. Values for the reactivity components and control distribution are listed in
. ables 3-h and 3-5.
Twenty-four of the 57 control rod assemblies are assigned to automatic control of reactor power level during the first core cycle. These control rod assem-blies are arranged in three symmetrical groups which operate in sequence. The position of one automatic group is used as an index to soluble boron dilution. Soluble boron adjustment is initiated manually and terminated automatically or manually. The position of this group acts as a " permissive" to restrict the start of dilution to a " safe" rod position pattern. The pos' ; ion of the same group terminates dilution automatically. One bank of axial purer shaping rods consisting of eight rods may be used for control of the axial power shape. Withdrawal of these rods is by operator action. s
; OtG7 7-24
5 D-B During reactor start-up, control rods are withdrawn in a predetermined sequence in symmetrical groups of four or more rod assemblies. The group size is pre-set, and individual control red assembly assign =ents to a group are made at a control rod grouping panel. However, the operator can manually control any individual control rod assembly and any rod group for motion as required. A typical control rod group withdrawal scheme is as follows: Group 1 12 CRA Group 2 5 CRA Group 3 h CRA Group 4 h CRA Gr up 5 8 CRA Regulating Group 6 8 CRA Group 7 roups 8 CRA Group 8 8 CRA Axial Power Shaping Group - An automatic sequence logic unit is used for reactor control with three regulat-ing rod groups in the power range. This unit allows operation of no more than one control rod group simultaneously except over the last 25 per cent travel of one group and the first 25 per cent travel of the next group when overlapping motion of two groups is permitted. This tends to linearize tne reactivity in-sertion frc= group to group as shown in Figure 7-6. As fuel burnup progresses, dilution of the soluble boren is controlled as follows: When the partially withdrawn active control rod group reaches the fully withdrawn point, interlock circuitry permits setting up a flow path from a deborated water tank, in lieu of the normal flow path of borated make-up, to the reactor coolant system. Deborated makeup water is fed to the reactor coolant system, and borated reactor coolant is removed. The reactor controls insert the active regulating rod group to compensate for the reduction in boron concentration. When the control rod group has been inserted to the 75 per cent withdrawn position, the dilution flow is automatically blocked. The dilution cycle is also terminated automati-cally by a preset makeup volume measuring device, which is independent of rod position. Normally, a dilution cycle is required every several days. 7 3.2.1.3 Reactivity Worth The maximum worth of any group of the three automatic control groups is approxi- ' mately 1.5 per cent ok/k. At design speed, a group requires approximately 5 minutes to travel full stroke. This rate inamaximumreactivityrateof1.09x10gfcontrolrodgrouptravelresults (ak/k)/second.
" ,! The maximum rate of reactivity addition with the soluble boron system, i.e.,
( injecting unborated water from the makeup system at 140 gpm maximum, is 3.2 x
~
10-6 g ggydecond. 0168 T-25
r-D-B Table 3-5 shows a shutdown reactivity analysis. The rod vorth provided gives a i hot shutdown margin of 4.7 per cent ak/k or more under normal conditions, and a margin in excess of 1 per cent ak/k with the CRA of greatest worth stuck in the withdrawn position. Under conditions where cooldown to containment vessel ambient conditions s re- . quired, concentrated soluble boron will be added to the reactor coolant to pro-duce a shutdown margin of at least 1 per cent ak/k. The reactivite changes from hot zero power to a cold condition, and the corresponding increases in boric acid concentration, are listed in Table 3-6. 7.3.2.1.4 Reactor control The reactor control is made up of analog computing equipment with inputs of unit load demand, core power, and reactor ~ coolant average temperature. .The output
- of the controller is an e ror signal that causes the control rod drive to be positioned until the error signal is within a dead band. A block diagram of -
the reactor control is shown in Figure 7-5 First, reactor power level demand (Nd ) is computed as a function of the unit load demand (UL d ) and the reactor coolant system average temperature deviation (AT) from the set point, according to the following equation: Nd
- K1 ULd+ 2(E+ / d dt)
Unit load demand is introduced as a part of the demand signal through a pro-b' portional unit having an adjustable gain factor ('t) . The temperature devia-tion is introduced as a part of the demand signal Lfter proportional plus reset (integral) action is applied. For the temperature deviation, K2 is the adjust-able gain and T is the adjustable integration factor. The reactor power level demand (N d ) is then compared with the average reactor powerlevelsignal(5),whichisderivedfromthenuclearinstrumentation. The resultant error signal (Nd - Ni ) is the reactor power level error signal (Ep ). When the reactor power level error signal (E p) exceeds the dead band settings, the control rod drive receives a co==and that withdraws or incerts rods depend-ing upon the polarity -of the power error signal. The following additional features are provided with the reactor power controller:
- a. An adjustable low limit on the unit } cad demand signal (UL d ) to cut out the automatic reactor controi .cet3cn.
- b. A high limit on reactor pov'" <>< .denand (N d ) to minimize reactor power overshoot under aut T!di . t; trol ac, ion.
- c. An adjustable lov limit on reactor poww avel demand (Nd ) to minimize reactor power undershoot under automatic C Lt..ml action.
~i . . . c.
g <. , * $ *, F 0169 Jt T-26' e __z
D-B ( Separate from, but related to, the automatic reactor control system is the re-actor coolant flow signal. The reactor coolant flow is measured and limits the unit load demand and respective steam generator feed-water demand to within the capability of the available reactor coolant flow. In additicn to measuring the reactor coolant flow, digital logic units contin-ually monitor the number of energized reactor coolant pumps and establish a maximum limit on the unit load demand. 7.3.2.2 Integrated Control System The integrated control system maintains constant average reactor coolant tem-perature and constant steam pressure in the nuclear unit during steady-state and transient operation between 15 and 100 per cent rated power. Figures 7-5 and 7-7 show the overall system. The system is based on the integrated boiler-turbine concept videly used in fossil-fuel-fired utility plants. It combines the stability of a turbine-following system with the fast response of a boiler-following system. Optimum overall unit performance is maintained by limiting steam pressure variations; by limiting the unbalance that can exist between the steam generators, turbine, process steam, and the reactor; and by limiting the total unit load demand upon loss of capability of the steam generator feed sys-tem, the reactor, or the turbine generator. Figure 7-5 shows the reactor control portion of the integrated control system (ICS) described in 7.3.2.1.h. Figure 7-7 shcws the steam generator control, and turbine control portions of the integrated control system. This control receives inputs of unit load demand, system frequency, and steam pressure, and supplies output signals to the turbine bypass valve, turbine EH controls, and steam generator feed-water flow controls with changing operating conditions. The turbine and steam generator are capable of automatic control from zero power to rated power with optional manual control. The reactor controls are designed for manual operation below 15 per cent rated power and for automatic or manual operation above 15 per cent rated power. The turbine is operated as a turbine-following unit with the turbine header pressure set point varied in proportion to megawatt error. The steam generator is operated as a boiler-following system in which the feed-water flow demand to the steam generator is a su=mation of the unit leal demand and the steam pressure error. The ICS obtains a load demand signal from the system dispatch center or from the operator. A frequency loop is added to the megawatt demand to match the speed droop of the turbine speed controls. The load demand is restrained by a maximum load limiter, a minimum load limiter, a rate limiter, and a runback limiter. In norms 1 operation, the unit load demand (UL d ) limits would be set q as follows: Maximm: Load Limit Minimum Load Limit 100 Per Cent 15 Per Cent llll( Rate Limit 5 Per Csnt/ Min 0170 cv .
.a.:. . a:
1 I l 7-27 i l
D-B The runbacks act to run back and/or limit the unit load demand on any of the following conditions: O '
- a. One or more reactor coolant pumps are inoperative.
- b. Total feed-water flow and reactor power unbalance by more than 5 per cent,
- c. One feed-water pump is inoperative,
- d. Asymmetric rod withdrawal patterns exist.
- e. The generator separates from the 345 kV bus.
- f. Loss of stator coolant.
- g. Reduction in reactor coolant flow.
The output of the limiters is a unit load demand signal which is applied to the steam generator control and reactor control in parallel. The reactor control responds to the unit load demand signal as described in 7.3.2.1.h. 7.3.2.2.1 Turbine control The megawatt demand is compared with the generator megawatt output, and the resulting megawatt error signal is used to change the turbine header pressure y set point. The turbine valves then change position to change load and steam ) pressure. As the megawatt error reduces to zero, the steam pressure set point is returned to the steady-state value. By limiting the effect of megevatt error on the steam pressure set point, the system can be adjusted to parmit controlled variations in steam pressure to achieve any desired rate of turbine response to megawatt demand. 7.3.2.2.2 Steam Generator Control Control of the steam generator is based on matching feed-water flow to unit , load demand with bias provided by the error between steam pressure set point and steam pressure. The pressure error increases the feed-water flow demand if the pressure is lov. It decreases the feed-water flow demand if the pres- ' sure is high. The basic control actions for parallel steam generator operation are:
- a. Unit load demand converted to feed-water demand.
- b. Steam pressure compared to set pressure, and the pressure error y converted to feed-water demand. '
- c. Total feed-water demand computed from sum of a and b. .
hP i
- d. Total feed-water flow demand split into feed-water flow demand for each steam generator. T'
\ G1>
~
j i 0.h.$,$ 1 T-28 l
D-B
- e. Feed-water demand compared to feed-water flow for each steam gen-erator. The nesalting error signals position the feed-water flow controls to match feed-water flow to feed-water demand for each steam generator.
For operation below 15 per cent load, the steam generator control acts to main-in a preset minimum downcomer water level in the steam generator. The con-arsion to level control is automatic and is introduced into the feed-water centrol train through an auctioneer. At low loads below 15 per cent, the tur-- bine bypass valves will operate to limit steam pressure rise due to removing load from turbine. The steam generator control also provides ratio, limit, and runback actions as shown in Figure T-7, which include:
- a. Steam Generator Load Ratio Control Under normal conditions, the steam generators vi31 each produce one-half of the total load. Steam generator load ratio control is pro-vided to balance reactor inlet coolant temperatures during operation with more reactor coolant pumps in one loop than in the other.
- b. Water Level Limits A maximu= vater level limit prevents gross overpu= ping of feedwater and insures superheated steam under all operating conditions.
A minimum water level limit is provided for lov load control and insures a minimum water inventory under all operating conditions.
- c. Reactor Coolant Flow Limiters These limiters restrict feed-water demand to match reactor coolant pumping capability. For exa=ple, if one reactor coolant pump is not operating, the maximum feed-water demand to the steam generator in the loop with the inoperative pump is limited to approximately one-half normal.
- d. Steam Generator Pressure Limits The limiters reduce feed-water demand when the pressure in the steam generator becomes high.
- e. Reactor Outlet and Feed-Water Low Temnerature Limits J
These limiters reduce feed-water demand when the reactor outlet tem-perature or the feed-water temperature is low.
. - c3 ~ o.1;;::
T-29
f- / ~~ D-B (P7 s 7.3.3 SYSTEM EVALUATION 7.3.3.1 System Failure Considerations Redundant sensors are available to the integrated control system, for those parameters with sensors that cannot be readily maintained or replaced. The operator can select any of the redundant sensors frem the control room. Manual reactivity control is available at all power levels. Loss of electrical power to the automatic controller reverts reactor control to the manual mode. 7.3.3.2 Interlocking Control rod withdrawal is prevented on the occurrence of a high startup rate below 10 per cent power. The automatic sequence logic sets a predetermined insertion and withdrawal pat-tern of the three regulating rod groups and the axial power shaping rods. Control circuitry allows manually selected operation of any single control rod assembly or control rod group throughout the power range. An interlock will prevent actuation of both withdrawal and insertion of control rod simultaneously with the insertion signal overriding the withdrawal. "s Control rod drive switching circuits allow withdrawal of no more than a single ' control rod group in the manual mode. The automatic sequence logic limits regulating rod motion to one group except at the upper and lower 25 per cent of stroke where operation of two groups is permitted to linearize reactivity versus stroke. Maximum and minimum limits on the reactor power level demand signal (N d ) pre-vent the reactor controls from initiating undesired power excursions. Maximum and minimum levels on the unit load demand signal (UL d ) prevent the reactor controls from initiating undesired power excursions. 7 3.3.3 Emergency Considerations Loss of power to the control rod drives initiates a react.r trip. When conditions arise due to malfunctioning of the control system, the operator
~
can revert to the manual control mode, c 7.3.3.h Loss-of-Load Considerations The system is, designed to accept 10 per cent step load rejection without . safety valve action or turbine bypass valve action. The combined actions of the control system and the turbine bypass valve are expected to permit a h0 ' per cent load reductic s or a turbine trip from h0 per cent load without safety -
?!.t?3 7-30
D-B l' valve action. The controls will limit steam dump to the condenser when conden-ser vacuum is inadequate, in which case the atmosphere dump or safety valves may operate. The combined actions of the control system, the turbine bypass valve, and the dump valves permit a 100 per cent load rejection without reac-tor trip. The feature that permits continued operation under load rejection conditions includes:
- a. Integrated Control System During normal operation, the ICS (see Figure 7-7) controls the unit
.oad in response to load demand from the system dispatch center, or from the operator. During normal load changes and small frequency changes, turbine control is through the EH control system to maintain constant steam header pressure and meet the demand load.
- During large load and frequency upsets, the turbine governor takes control to regulate frequency. For these upsets, frequency droop signal into the integrated control system becomes more important in providing load matching between the ICS and the turbine EH control.
- b. 100 Per Cent Relief Capanity in the Steam System This provision acts to reduce the effect of large load drops on the reactor system.
Consider, for example, a sudden lead rejection greater than 10 per cent. When the turbine generator starts accelerating, the governor valves begin to close to maintain set frequency. At the same time, the megawatt demand signal is reduced, thus reducing the unit lead demand which decreases the demand to the turbine EH control, feed-water flow demand, and reactor power level demand. As the governor valves close, the steam pressure rises and acts through the control system to reinforce the feed-water flow deme.nd reduction already initiated by the reduced megawatt demand signal. In addition, when the load rejection is of sufficient magnitude to cause an excess pressure condition, the turbine bypass valves open to reject excess steam to the condenser. For continuing higher pressure, the safety valves open to exhaust steam to the atmosphere. The rise in steam pressure and the reduction in feed-water flow cause the average re-actor coolant temperature to rise which reinforces the reactor power level demand reduction, already established by reduced unit load de-mand, to restore reactor coolant temperature to set value. As a result, the reactor, the reactor coolant system, and the steam sys-
, . tem run back rapidly and smoothly'to the new load level.
As the turbine generator returns to set frequency, the turbine con-trols revert to load and steam pressure control rather than frequency l control. This feature holds steam pressure within relatively narrow ! limits and prevents further large steam pressure 'chan j 0174
.r> x +>
7-31
L D-B ' l 7.h NUCLEAR UNIT INSTRUMENTATION T.h.1 NUCLEAR INSTRUMENTATION The nuclear instrumentation system is shown in Figure 7-8. Emphasis in the design is placed upon accuracy, stability, and reliability. Instruments are redundant at every level. The design criteria stated in 7 1.1.2 have been applied to the. design of this instrumentation. 7.h.1.1 Design The nuclear instrumentation has eight channels of neutron information divided into three ranges of sensitivity: source range, intermediate range, and power t range. The three ranges combine to give a continuous measurement of reactor power from source level to approximately 125 per cent of rated power or ten decades of information. A minimum of one decade of overlapping information is provided between successive higher ranges of instru=entation. The relationship - between instrument ranges is shown in Figure 7-9 The source range instrumentation has two redundant count rate channels origi-i nating in two high sensitivity proportional counters. These channels are used l over a counting range of 0.1 to 100 counts /s as displayed on the operator's control console-in terms of log counting rate. The channels also measure the rate of change of the neutron level as displayed for the operator in terms of start-up rate from -1 to +10 decades / min. A control rod withdraw hold and
~
alarm will initiate on high start-up rate in either channel. l The intermediate range instrumentation has two log N channels originating in two identical electrically gamma-compensated ion chambers. Each channel pro-vides eight decades of flux level information in terms of log ion chamber cur-rent and start-up rate. The ion chamber output range is from 10-11 to 10-3 amperes. The start-up rate range is from -1 to +10 decades per minute. high ! start-up rate in either channel will initiate a control rod withdraw hold inter-lock and alarm. The power range channels have four linear level channels originating in 12 un-compensated ion chambers. The channel output is directly proportional to re-l actor power and covers the' range from 0 to 125 per cent of rated power. The ( system is a precision analog system which employs a digital monitoring technique to provide highly accurate signals for instrument calibration and reactor trip set point calibration. The gain of each channel is adjustable, providing a l means for calibrating the output against a reactor heat balance. Protective action on high flux level consists of reactor trip initiation by the power range _ channels at preset flux levels. Additional features pertinent to the nuclear instrumentation system are as < follows:
- a. Independent power supplies are included in each channel. Primary power originates from the vital a-c buses described in 8.2.2.6.
d*.,,f.'34 Where applicable, isolation transformers are provided to insure a stable, high-quality power supply, n - ons T-32
D-B /-
- b. The proportional counters used in the source range are designed to be electrically secured when the flux level is greater than their useful operating range. This is necessary to obtain prolonged operating life.
- c. The intermediate range channels are supplied with an adjustable source of ga=ma-compensating voltage.
T.h.1.1.1 Test and Calibration Test and calibration facilities are built into the system. The test facilities will meet the requirements outlined in the discussion of protection systems testing. Facilities for calibration of the various chan .el amplifiers and measuring equipment will also be a part of the system. T.h.1.1.2 Power Range Detectors . Twelve uncompensated ionization chambers are used in the power range channels. Three chambers are associated with each channel, i.e., one near the bottom of the core, a second at the midplane, and a third toward the top of the core. The outputs of the three chambers are combined in their respective linear am-plifiers. A means is provided for reading the individual chamber outputs as a manual calibration and test function during normal operation. T.h.l.l.3 Detector Locations The physical locations of the neutron detectors are shown in Figure 7-10. The power range detectors are located in four primary positions, 90 degrees apart around the reactor core. The two source range proportional counters a e located en opposite sides of the core adjacent to two of the power range detectors. Tue two intermediate range compensated ion chambers are also located on oppo-site sides of the core, but rotated 90 degrees from the source range detectors. T.h.l.1.h Interlock Functions Interlocking functions of the nuele'ar instrumentation system are to:
- a. Inhibit control rod withdrawal on the occurrence of a predetermined start-up rate.
- b. Bypass the start-up rate control rod withdrawal inhibit when the re-actor power reaches a preset,value. c
;/.,
7 h.1.2 Evaluation The nuclear instrumentation will monitor the reactor over the 10-decade range from source to 125 per cent of rated power. The full power neutron flux level at the power range detectors will be approximately 109 nv. The detectors em-ployed will provide a linear response up to approximately h x 1010 nv before they are saturated. (( ,y . T-33
D-3 ne The intermediate range channels overlap the source range and the power range channels in an adequate manner, providing the continuity of information needed during start-up. The axial and radial flux distribution within the reactor core will be measured by the in-core neutron detectors (7.h.3). The out-of-core detectors are pri-marily for reactor safety, control, and operation information. 7.h.1.2.1 Loss of Power The nuclear instrumentation draws its primary power from redundant battery-backed vital a-c buses described in 8.2.2.6. 7.h l.2.2 Reliability and Component Failure The requirements established for the reactor protection system apply to the nuclear instrumentation. All channel functions are independent of every other ~ channel, and where signals are used for safety and control, electrical isola-tion is employed to meet the criteria of 7.1.1.2. 7.h.2 NONNUCLEAR PROCESS INSTRUMENTATICN 7.h.2.1 System Design The nonnuclear instrumentation measures temperatures, pressures , flows, and ,_ levels in the reactor coolant system, steam system, and reactor auxiliary sys- .) tems. Process variables required on a continuous basis for the start-up, op- ./ ! eration, and shutdown of the nuclear unit are indicated, recorded, and con-l trolled from the control room. The quantity and types of process instrumen-l tation provided will insure safe and orderly operation of all systems and j- processes over the full operating range of the unit. The amounts and types of various instruments and controllers shown are intended to be typical exam-ples of those that will be included in the various systems when final design details have been completed. The nonnuclear process instrumentation for the reactor coolant and steam systems is shown in Figure 7-11 and on the reactor i auxiliary system drawings in Sections 5, 6,9, and 11. Process variables are I monitored as shown on the nonnuclear instrumentation and reactor auxiliary system drawings and are as follows:
- a. In general, resistance elements are used for temperature measurements.
l Fast-response resistance elements monitor the reactor outlet tempera-l ture. The outputs of these fast-response elements supply signals to i the protection system. i l b. Pressures are measured in the reactor coolant system, the, steam sys-tem, and the reactor auxiliary systems. ' Pressure signals for high and low reactor coolant pressures and high reactor building pressure are provided to the protection systems.
- c. Reactor coolant pu=p motor operation is monitored as a measure of -
the number of pumps in operation. In addition, reactor coolant flow signalsareobtainedandindica,g*bymeansofreactorcoolantflow
. .' ? . .
i 1 >< 0177 T-34
D-3 (- meters. This information is fed to the reactor protection system. Reactor control also receives information of the number of pumps in operation.
- d. Flow in the steam system is inferred from feed-water flow. Flow in-formation is utilized for control and protective functions in the steam system. Steam generator level measurements are provided for control and alarm functions.
- e. Pressurizer level is measured by differential pressure transmitters calibrated to operating temperature and pressure. The pressurizer level is a function of the reactor coolant system makeup and letdown flow rate. The letdown flow rate is remote manually controlled to the required flow. Pressurizer level signals are processed in a level controller whose output positions the makeup control valve in .
the makeup line to maintain a constant level,
- f. Reactor coolant system pressure is maintained by a control system that energizes pressurizer electrical heaters in banks at preset pressure values below 2,175 psig or actuates spray control valves if the pressure increases to 2,230 psig.
9 7.h.2.2 System Evaluation Redundant instrumentation has been provided for all inputs to the protection systems and vital control circuits. Where vide process variable ranges are required and precise control is involved, both vide-range and narrow-range instrumentation are provided. Where possible, all instrumentation components are selected from standard com-mercially available products with proven operating reliability. All electrical and electronic instrumentation required for safe and reliable operation vill be supplied from redundant vital a-c buses. 7.h.3 IN-CORE MONITORING SYSTEM T.h.3.1 Design Basis The in-core monitoring system provides neutron flux detectors to monitor core performance. No protective action or direct control functions are performed by this system. All high-pressure system connections are terminated within the reactor building. In-core, self-powered neutron detectors measure the neutron < flux in the core to provide a history of power distributions and disturbances during power operating modes. The in-core monitoring system is not connected to the reactor protection system or the reactor control. The system is provided primarily to collect data for effective ad=inistration of the fuel management program and secondarily to pro-vide the operator with confirming information regarding power distribution in the reactor core. 0.178 6 e 7-35 m __
D-B i i During normal. operation, the in-core instru=entation is not needed to provide the operator with any information on which he must take corrective control action, because core power distribution should follow previously calculated values. The in-core instrumentatien, however, is expected to alert the reactor operator whenever xenon oscillations exist, because it is only during xenon oscillation that undesirable maximum-to-average power conditions can occur. Xenon oscillations, however, can only occur at higher power levels under pre-dictable circumstances, which lend themselves to analytical determination. The required analyses will be performed during the design of the reactor and a xenon oscillation threshold power versus core life curve vill be developed. However, there is some power level belov which significant xenon oscillations can never occur. T.h.3.2 System Design T.4.3.2.1 System Description The in-core monitoring system consists of assemblies of self-powered neutron detectors located at 57 preselected radial positions within the core. The in-core monitoring locations are shown on Figure T-12. In this arrangement, an in-core detector assembly, consisting of seven local flux detectors and one background detector, is installed in the instrumentation tube of each of 5T fuel assemblies (Figure 3-46). The local detectors are positioned at seven different axial elevations to provide the axial flux gradient. The outputs
~
of the local flux d 'tectors are referenced to the background detector output - so that the differential signal is a true measure of neutron flux. As shcun in Figure T-12, seventeen detector assemblies are located to act as symmetry monitors. The remaining h0 detector assemblies, plus two of the eight symmetry monitors, provide monitoring of every type of fuel assembly in the core when quarter cere sy= metry exists. When the reactor is depressu2';ed, the in-core detector assemblies can be in-serted or withdrawn through guide tubes which originate at a shielded area in the reactor building as shown in Figure T-13. These guide tubes, after ccm-pleting two 90 degree turna, enter the bottom head of the reactor vessel where internal guides extend up to the instru=entation tubes of 57 selected fuel as-semblies. The instru=entation tube then serves as the guide for the in-core detector assembly. The in-core detector assemblies are fully withdrawn only for replacement. During refueling operations, the ih-core detector asse=blies are withdrawn approximately 13 feet to allow free transfer of the fuel assem-blies. After the fuel assemblies are placed in their new locations, the in-core detector assemblies are returned to their fully inserted positions in the core, and the high-pressure seals are secured. " 7.4.3.2.2 Calibration Techniques The nature of the detectors permits the manufacture of nearly identical detec-tors which will produce a high relative accuracy between individual detectors. The detector signals must be compensated for burnup of the neutron sensitive ) material and this will be done periodically. *~'
~ 0179 T-36
D-B Calibration of detectors will not be required. The in-core self-poce.ed detec-tors can be controlled to very precise levels of initial sensitivity by quality control during the manufacturing stage. The sensitivity of the detector changes over its lifetime due to such factors as detector burnup, control rod position, fuel burnup, etc. Experimental programs have been completed to determine the magnitude of these factors. The results of these experiments have been incor-porated into calculations which will be used to continuously compensate the output of the in-core detectors for these factors. Operation of detectors in both power and test reactors has demonstrated that this compensation program, when coupled with the precise levels of initial sensitivity, provides detector readout accuracies sufficient to eliminate the need for a calibration system. T.h.3.3 Detection and Control of Xenon Oscillations Under normal operating conditions, 57 strings of in-core detectors will be supplying information to the operator in the control room. The information will be in a form such that, if an oscillation is detected, the operator can refer to the operating procedures for this particular case and act accordingly to damp out the disturbance. The stability analysi of the core has shown that axial oscillations are possible, azimuthal oscillations are unlikely, and rsdial oscillations will not occur. The in-core monitoring system has been designed in this context. The system is not a part of the reactor protection system. Each individual detector will measure the neutron flux at its locality which will be used to determine the local power density. The individual power densi-ties will then be averaged permitting the peak-to-average power ratios to be calculated. The application of this system for de.ection of xenon oxcillation and its mini-mum sensitivity is being examined trrough the analysis of experimental data. A codal analysis has been submitted as ?opical Report BAW-10010. Further an-alyses will be filed as completed in Topical Report form. However, previous performance data are available. A series of Physics Verification Program Re-ports develcped under AEC Contract No. AT(30-1)-36h7 and 3&W Contract No. 41-2007 has previously been submitted to the Commission for review. Much of the data compiled was taken by self-powered detectors and shows the performance capabilities cf the detectors. Upon initial installation, the self-powered detector has the capability to measure the relative flux within 5 per cent of the true flux when used in conjunction with an adjacent background detector. The sensitivity of the detector will decrease with exposure to neutron flux due to transmutation of the emitter in the detector. However, by use of inte-grated current inventories, it is felt that the additional inaccuracies shall be no more than 1 per cent per year for the average flux conditions. 7.4.3.h System Evaluation C T.h.3.4.1 Operating Experience The AECL has been operating in-core, self-powered neutron detectors at Chalk River since 1962. They have been successfully applied to both the NRX and NRU reactors and have been operated at fluxes beyond those expect;d in not.'al pres-surized water reactor service. jggggg 0180 T-37
D-B
'm 7.L.3.4.2 B&W Experience Self-powered, in-core neutron detectors have been assembled and irradiated in the B&b Development Program that began in 196h. Results from this program have produced confidence that self-powered detectors used in an in-core instru-ment system for pressurized water reactors vill perform as well as, if not better than, any . system of in-core instrumentation currently in use.
The B&W Development Program included these tests:
- a. Parametric studies of the self-powered detector.
- b. Detector ability to withstand PWR environment.
- c. Multiple detector assembly irradiation tests. *
- d. Background effects.
- e. Readout system tests.
- f. Mechanical withdrawal-insertion tests.
- g. Mechanical high-pressure seal tests.
- h. Relationship of flux measurement to power distribution experiments.
J The in-core monitoring system development program results and conclusions, are presented'in B&W Topical Report BAW-10001; "In-Core Instrumentation Test Program." o , 0181 o 6 T-38
D-B 7.5 TURBINE CONTROL SYSTEMS 7.5.1 DESIGN BASES The turbine control system is designed to control the turbine gensrator to meet cterating conditions. 752 DESCRIPTION AND OPERATION The turbine generator control system (or electrohyd .111e control system) combines electronics and high-pressure hydraulics to control steam flow through the turbine. The control system c tsists of the following major parts:
- 1. Control cabinet containing the electrical control circuits.
- 2. Energency trip system. .
- 3. Hydraulic power supply system.
- h. Electric power supply system.
5 Control panel. The control circuits in the console include the speed control unit, the load , control unit, and the flow control units. The speed control unit uses speed signals produced by pickups that are placed over a toothed wheel on the tur-bine shaft. The pulses from these pickups are translated into d-c voltages proportional to speed and compared to a speed reference. The speed control unit is used to monitor and control the startup of the turbine. The load control unit combines the speed error signal derived from the speed control unit with the load reference and special biases used to achieve full-are admission operation during start .1p and initial loading, and partial-ara admission for normal opeJation. The desired terminal load is set on one knob, and the loading rate is set on a second knob. The turbine generator increases load at the selected rate, and transfers from full-are admission to partial-are admission, and vice versa, automatically, at a preselected load and transfer rate. The load control system includes provision for connection t*o an automatic load dispatching system. For normal operation under load as controlled by a dispatching system, pulse signals are accepted to control the load refer-ence. l The outputs of the load control unit are three flow signals, respectively, for j
' the main stop valves, the control valves and the intermediate valves. l l
The flow control units position the main stop valves, control valves and in- l termediitte valves. The flov signals from the load control unit are a=plified l \ in servo amplifiers suitable for the particular valves. The output of the servo amplifiers operates servo valves which addt high-pressure fluid to the respective rams that operate the corresponding valves. N 01.M l t? 7-29
D-B The valve positions are fed back to the flow control units .by means of suit-able feedback circuits. O ed The emergency trip system is entirely independent of the operating control system and operates the main stop and intermediate valves by means of a hydrau-lic relay system with high-pressure fluid. Malfunctions or faults which cause trips include turbine overspeed, loss of condenser vacuum, thrust bearing wear, and generator / electrical faults. The hydraulic power supply system is completely separate from the bearing oil system and uses fire-resistant fluid. Two full-size high-pressure pumps driven by a-c motors are located on the hydraulic fluid tank. Each of these pumps delivers enough flow for the operation of the system; the second pump serves as a standby. Accumulators located at the hydraulic power supply unit are used to provide 6 high flow capacity for transients, and as a brief flow reserve in case a-c . power to the pump is momentarily lost. ' The hydraulic power supply contains the necessary filters, heating and cool-ing provisions; the tank and piping are made of stainless steel. The electric power supply system contains electronic circuits that transform either 120 V a-c line power or h20 Hz a-c power from the permanent magnet gen-erator into the d-c voltages necessary to operate the control and logic cir-cuits. s 7.6 OPERATING CONTROL STATIONS All control panels, switches, controllers, and indicators necessary to start up, operate, and shut down the unit are located in the control room. Con-trol functions necessary to maintain safe conditions after a loss-of-coolant accident can be initiated from the centrally located control room although many of these are initiated automatically. In the unlikely event that it shotAd be necessary for operators to leave the control room they can main-tain the unit in a hot standby condition from other locations. Controls for certain other auxiliary systems are located at remote control stations when the system controlled does not directly involve power genera-tion control, such as radwaste and screen wash. 7.6.1 GENERAL LAYOUT The control room is designed so that one man can control operation of the plant during normal steady-state conditions. During other than normal operat-ing conditions, other operators are utilized to assist the control operator. Pertinent instrumentation and control devices for startup, shutdown and normal and emergency operation are located on the control console and the vertical control panel. Most of the essential instruments and controls for power opera-tion are on the control console. s The vertical control panel contains instrumentation less frequently used than that which normally requires the operator's attention during start-up, before the reactor is critical, and during shutdown. The instrumentation is arranged in functional groups on the panels. m'- -
. 0183 Amendment No. 6 ' T-40 l
D-B T.6.2 INFORMATION DISPLAY AND CONTROL FUNCTION The necessary information for routine monitoring of the nuclaar steam supply system and the balance of the station vill be displayed on the operator's con-sole and the various vertical boards located within the control room. Infor-mation display and control equipment frequently employed on a routine basis will be mounted on the console sections. Recorders and radiation monitoring equipment vill be mounted on the separate vertical panel sections located behind the' consoles. Infrequently used equipment, such as indicators and controllers used primarily during startup and shutdown, will be mounted on vertical boards.
~
There vill be alarm panels with numerous alarm lights above the back vertical board which the operator in front of the control console or at the computer console can see. A Digital Station Process On-Line Computer and Data Logging System vill be provided to function as an operational aid through continuous monitoring of selected parameters. The system shall collect aata from the NSSS, turbine generator and auxiliaries, and balance-of-station for print-out and alarm and selected performance calculations. The functions performed by the computer will not prevent station operation or in any way affect safety in the event of computer malfunction since tne cri-tical information displayed by the computer shall also be monitored by other instrumentation. The computer desk and console vill be rear of the operating console. There vill be computer printouts for the operator and the station record of data approaching the alarm point or in unusual data range. An operator at the console can perform all routine operating functions. Operator action at the vertical panels will only be necessary during startup, shutdown, and other non-routine operating conditions. Information in the control room vill include the information to start, con-trol and operate, and to shut down the station. Some of the principle infor-nation vill include:
- a. Typical information from inside containment on control boards.
e
- 1. Reactor coolant pressure.
- 2. Reactor coolant flow.
- 3. Reactor coolant temperature.
- h. Pressurizer level.
5 Levels - Steam generators.
- 6. Pressure.
7 Levels - Core Flooding Tanks.
- 8. Pressure - Core Flooding Tank.
9 Contain=ent vessel Emergency Sump level.
- 10. Containment Vessel Temperature.
.\
; , /
93g4 7-41 t' ,
D-B
- b. Typical information from outside containment on control
~
boards. 1
- 1. Containment pressure
- 2. Feed-water flow.
3 Containment spray flev.
- h. High-pressure injection flow.
5 Low-pressure injection flow.
- 6. Borated water storage tank level.
7 Condensate and demineralized water tank levels.
- 8. Condenser pressure.
9 Circulating water flow.
- 10. Coolant temperatures throughout the station.
- 11. Equipment temperatures.
The operator is alerted to abnormal conditions by the panel alarms and the computer printouts. 7.6.3
SUMMARY
OF ALARMS Visible and audible alarm units will be incorporated into the control room to warn the operator if unsafe conditions are approached by selected data points. This will include radiation alarms and temperature and pressure alarms. Containment evacuation alarms are to be initiated from the radiation monitor- S ing system, or manually by the operator. Audible alarms vill be sounded in appropriate areas throughout the station if high radiation conditions are ') present. 7.6.h COMMUNICATION Station telephone and paging systems are provided with independent power supplies to provide the control room operator with constant coccunication with all areas of the station. An intercom =unications system co= mon to the control room, the fuel pool area and inside the containment vessel permits talking between these points as an aid in the fuel handling operation. Communications outside the station are through the local telephone company. 7.6.5 OCCUPANCY Safe occupancy of the control room during abnormal conditions is provided for in the design. Adequate shielding is used to maintain tolerable radiation levels in the control room for MHA conditions. Provisions are made for the centrol roam air to be recirculated with makeup air filtered through high-efficiency and charcoal filters. Emergency lighting is provided. j The potential magnitude of a fire in the control room is limited by the following factors:
. a. The control room construction is of noncombustible materials.
7 .
. D185 f
7 h2 _- 1
D-B
- b. Control cables and switchboard viring are used which
'/~ meet the flame test as described in Insulated Power Cable Engineers Association Publication S-61 402 and National Electrical Manufacturers. Association Publi-cation WC 5-1968.
- c. Furniture used in the control roce is of metal con-struction.
- d. Combustible supplies, such as records, logs, procedures, manuals, etc., are limited to the amounts required for station operation.
- e. All areas of the control room are readily accessible for fire extinguishing.
- f. Adequate fire extinguishers are provided.
- g. The control room is occupied at all times by a qualified person who has been trained in fire extinguishing techniques.
The only flammable materials inside the control room are:
- a. Paper in the form of records, logs, procedures, manuals, diagrams, etc.
- b. Svt11 amounts of combustible materials used in the manufact.ure of various electronic equipment.
The above list indicates that the flammable materials are distributed to the extent that a fire is unlikely to spread. Therefore, a fire, if started, will be of such a smil magnitude that it can be extinguished by the operator using s hand fire extinguisher. The resulting smoke and vapors vill be removed by the ventilation system. 7.6.6 AUXILIARY CONTROL STATIONS Centralized controls are located in the one control room. All controls and instrumentation essential for safe operation of the plant during normal and : abnormal conditions are located therein. If the control room should become ' uninhabitable operators can maintain the nuclear si,eam supply system in the hot standby condition from control points outside the control room. The auxiliary (turbine driven) feed pumps can be operated and steam generator levels monitored and controlled from one of the auxiliary control stations independent of the control room if necessary. Normal operation and control q is from the control room. '
.;? l Auxil'iary control stations are provided where their use simplifies control of certain auxilicry systems such as radvaste, screen wash, chemical additon, I etc. Sufficient indicators and alarms are provided so that the central con- l trol room operator is made aware of abnormal conditions involving remote con- !
trol stations. 1 T 43 0186 4 1
D-B 7.6.7 SAFETY FEATURES The primary objectives in the control room layout are to provide the necessary controls to start, operate, and shut down the nuclear unit with sufficient - information display and alarm monitoring to insure safe and reliable operation under normal and accident conditions. Special emphasis vill be given to maintaining control integrity during accident conditions. The layout of the engineered safety features section of the control board vill be designed to minimize the time required for the operator to evaluate the system performance under accident conditions. Deviations from predetermined conditions vill be alarmed so that the operator may take corrective action using the controls provided on the control panel. In case of MHA the engineered safety features will operate without operator action. See Section 7.6.6. 7.6.8 SYSTEM EVALUATION 7.6.8.1 Information Ava11able Post-Accident . The information available to the operator in the control room following a loss-of-coolant accident vill depend on its source and the extent of the post-accident damage. All infor=ation available from outside the containment vessel (7.6.2) vill be available post-accident. Information from within the containment vessel may be available following the accident. 7.6.8.2 Control Room Availability 3 Normal operation of the power station is from the control room. This room is j specifically designed to permit the operator to perform his duties under all credible accident conditions. The forced abandonment of the room is not deemed credible for the following reasons:
- a. The control room has been given a high pricrity for shielding from external radiation from any area in the station.
- b. Nonfla=mable construction is used in construction n'.terials and all interior components, i.e., control boards, furniture, etc.
- c. Adequate fire-fighting equipment is available in the control room and operators have received fire-fighting training.
- d. Self-contained air-breathing equipment is available in the control room for operator use.
- e. Cables and switchboard viring have passed flame tests as required by IPCEA Publication S-61-h02 and NEMA WC 5-1968. <
- f. Combustible materials in the control room are kept to the minimum required for normal operation reference and records.
Permanent station records and nonessential referer~ i*a stored elsewhere.
\
0187 7-4h
D-B f g. Accessibility to the control room is'from multiple points, thus insuring entry for emergency personnel.
- h. Fireproof or fire-resistant doors are installed on all rooms adjoining the control room vbere significant amounts of combustible materials are stored.
- i. The control room has its own independent recirculated ventilation system with provisions to supply makeup air throu6h high-efficiency and charcoal filters upon incidence of high airborne activity external to the control room.
Babcock & Wilcox Topical Reports BAW-10001 In-Core Instrumentation Test Program BAW-10010 Stability Margin for Xenon Oscillations-Modal Analysis 1 6 , 0188 T h5 ;
w b CHANNEL I CHANNEL CH AMM EL OH ANN EL I 2 3 4 HIGH NEUTRON FLUX I HI GH R EACTOR OUTLET TEMP. _
"0R" l "0R" "0R" "0R" HIGH REACTOR GATE I GATE GATE GATE COOLANT PRESSURE; FOR FOR FOR FOR g
OW REACTOR TRIP l TRIP TRIP TRIP COOLANT PRESSURE u I LOW P RESSURE l HIGH TEMP. l LOSS OF REACTOR l COOLANT FLOW l
~
LOSS OF REACTOR l COOLANT PUMPS
= l l
IMPUTS TYPICAL OF l ALL FOUR CHANNELS g TRIP l TRIP TRIP TRIP R EL AY S I RELAYS RELAYS RELAYS RSI ! RS2 RS3 RS4 I i I _____________.J l 2 OUT OF 4 2 OUT OF 4 2 OUT OF 4 2 OUT OF 4 CO I NCI DENC E Co l N C I DE N C E COINCIDENCE C0 lN C I DE N CE ROD ORIVE R00 DRIVE R0D ORIVE R00 DR I VE DC POWER AC POWER AC POWER DC POWER SOURCE N0.1 SOU RCE NO. I SOU RC E N0. 2 SOURCE NO.2 BR EAK ERS BREAKER BREAKER BRE AKE RS e 1 DAVIS-3 ESSE NUCLEAR POWER STATION f.i.N REACTOR PROTECTION SYSTEM BLOCK DIAGRAM FIGURE 7-1
I c . a.. , . c . a.. . . I ..a..,. I , ,
. . ... sse.t :: , :i _
- i
.C f,0 L 0o# #
L Ds P *t ssW.E [] I (( , .I f-- " 2". E-(t) --
- .., s s ,i- :: . :: , :- -
4I _ FLCe LOOP 2
.a T tiaP E . a f. et _e [' 2.
~_ 3
.t....,,, ,. .
.'-.4.,_
r ca.p a.s to.
*- Ca*T *C f sao.n so.
N*,' piF i n, g . , , - -- ' -,
-- 3 1
...,to. :: , :: . :: >
i anws4..s** __ __I I L D. P.e.8 ,,_B . __
.C 2 L0ss of ? Puu s no LOCP t ii ii
.s. .s, .o n.. ..
_ co ,s.no a. .
.C s9 - f L O.L0s P2 . ace at ..ov ac Pgesp .l . a f(sf
= ... a :: -
-.- co,, a.a ,.. A '
c f*,c, ,- ..., P[ n,- i .s. . . l
. . , . . ~~ n- ;w
( 1. i P P B T' -- :: ,,
=" a2 '
,,,,, i
.s,., .s , . ,
g y _ _(..g
- m. ..
.ss , . s. . ,
I
.C .u - , . s. . ,
~
ie P s i .a_.y g g i .ss.a . .s, ,
~----
,, r
~,-'- - a. ---(1) ,
= 1 Y, _ na i I i C ,,.x .oe :.i.e ,e. . a .. i s q) i co ,
i 1 1 _1_.1_1__1__J 1_ 1_ _1 _1_ 1_ q;c1_q1_f p, ;c it , 7 T T" T' T' "T "T "T "I "
.. -..s. .
~
Cr a.are. Co. i m.
*- " ' L- i i
i sti ..r aut assir .t.t mo.iio
'"" *> '8 h g i i a t o.
I I ff 5' l 2
" l C i O
G! E 1 i . I _ 1 1 .L n i - > .u - > l In. 2 In> > n. 3 I ni a I I n, . Ir
.n o. .
[
i T>>.. > - > T >'- > T T">'- P
- ," - -{s) 1 7 --
- f. _
#'N
... o.
.s.,.,._,
L__}.......".I Q 3,
)
1
. i1 at .
m ....... ass..... n.-- C(pe a.a TO. CC.f aC1
; :;'_r p-
...a..., C.,.m
,,,,,,,, Cut. To si t Co.T 00 Po.*.,-, ,g , 6 uti.11 Nt C&) .0t D PDat.10 CO. 0L .C D C. s .6 0&+ Gat i.f. Poes.1. Co.t.ot eDD cois i
g
- 0130 T r > P st a r t . a s , aa, , gcg , go, a
?
i %44 .
- 9
.t.C) D. Coot 6., l 7
,..ip i s.2 ..t 3'20ss,.a.
5i
;- l
. s,
=-
. . . . ., ...o sS e .w.c i .. <
e =
+ -
= ,= ,
i.,i.t ms .m . o. ,,2 -
._+
,E 5, I
]
ql ll
,.f 5Sv.E twt..,s.E ma es, a ,___ ,
a* a.a ro. Hl If e~ si , .s, . , : 3 css s es. . : g ,,,,, i .. i
--1 : 7 %. --- . s Hf5.F-2 K$3 2 3 7 I 1i .
s3 , 3. , _ . I HF lI ni r esi .: I
._________q ri, , ,
_/ .i u,..
...co. . ,
I > m'.",...... i _
- i.r %%l .u , , -
6 = - 1 i 2 e- ., 7 i i i i . . . _ . I ! , t S St l
, o i ru, ,
C/ I e.
....u..,<,.oi.
,o. . u . . ..
. . - . - - - =
, J > oss. > o v< . 'm ,. a
_ . . s, .- e .1, o. < l 1 _ i j ,,,.... Q . . . , __-.-
. =. .s ,, ,. . ?.,, .
1 1 i
. 7. . .. ..
7 .3; _ , . . . . . . ,
'"' " _ L _ _ _ J (q,, , ,,, , ._ . < . s
} _ . . . . ..n. . 1. . . .. . ,
c_.....,...u.,<,,,..... Ow.s.G DE , Lit ot sic.
.1,2
.., O _ . o. co.1, . .. . .. . .e.... DAVIS-BESSE NUCLEAR POWER STATION e _ _ . .. .. . . .. . . .. . .u c c . ' NUCLEAR INSTRUMENTATION AND C;'!'. Q u-'u'a ai- PROTECTION SYSTEM FlGURE 7-2
~ 4 ..,,.......o,. 01 AMENDMENT NO. I j
t
/
8 4
.e....... . ... ., ...
f IP II jf IP If if it are see se s.e
- a<e ao as 3. . a. sa se y __ _ . . _
. . . . . ii . ==. ==.
.a .a .a ima ..
.2 "?.,. .if'... Ja'. . J !... .2 !.7.
/ l l l et e- .tme
~ *9y stKs
~y .-
.tK.
v 9 e [ . e- l9- - a _ .o L _ . _
]I- eneg
==. .<u .,=. . ==.
t t I o t t 'r " b._"] l=I 9__ (=) v
.. si.e y y e.acris.
ma mete.it 65.f.e4 se.4,E8
. MIIEE j
-t wer l! 1 LM.eet
' istiam BSWE LN.PellSW.E
' as'im e .=mm aw.masu sWLAteen teateen (1399KR M41) (614 CAL EELEh 1I
, e u o am. . mame a-.e.-=
IMAYee ematse .e WCEE
.e3EURII mte. stem sidB Sf tsCEL SELIES) (Im mstet3L ERLES) {pfD g '. . . . .
/
) 019R
, , , ,;g,, , ,, ~;.y, o o o o , o ,, e
.='.
/
e _ r
- 7. ~
x
/... -
__Lt_ _f 't J L C=) W 5 1 I l l
, O E o
.y 7 t ,,. ....
.g. . y .
h DAVIS-BESSE NUCLEAR POWER STATION SAFETY FEATURES ACTUATION SYSTEM n LOGIC DIAGRAM FIGURE 7-3 AMENDMENT NO. 1 01f13 .
l ' (' l l l 820 i l I Reactor Outlet Temperature 600 g
# i 3
Steam
% Temp.
580 r' '
~~
N
\
Reactor Average ( ;
$ Tempe ratu re h
- " N 560 '
Reactor inlet Temperature 540 f L. Tsat at 925 psia 520 0 20 40 60 80 100 Rated Reactor Power ( 2650 nit), 5 DAYlS-BESSE NUCLEAR POWER STATION REACTOR STEAM TEMPERATURES VERSUS REACTOR POWER FIGURE 7-4 0194 l l
l l1
- TO 07 ROD @
AUTOMATIC SEQUENCE F----- LOGIC I I l I , I I STEAM l l GENERATOR l FEEcaATER + l I 1 I sc ,., sc ,.,, l I I
. l l l
l l . LX '
------- DEADBA;
( T( 1 a s M(
- - g
/}
0195 m< N
~ \
c
I
- ER CO N T ROL tlVE GROUPS CONT ROL ROD
~~~
DRlyE GROUP ST E AM in Th i (2 STEAM GENERATOR REACTOR - I
& FEEDhATER
+ +
l r <r 1r 'r AVERAGE AVERAGE LOOP NO. 1 Ih t ir it 7 AUCil0NEER UL, f~ i T C2 l Ep N
]
d T AVERAGE DEM AN D
-- - - COMPARE --- - - - --
AND D COMPUTER COMPARE T g LOOP NO. 2 h2 T T - AVERAGE h1 2 I ht .2 L EGEND y RE ACTOR COOL ANT SfSTEM STEAM SYSTEM CONT ROL SYSTEM
. RE ACTOR COOL ANT SYST EM COLD LEG TEMPERATL RE \ . REACTOR Q)0L ANT 3YSTEM HOT LEG TEMPER ATUF:E . AVER AGE REACTOR COOL ANT SYSTEM TEMPER ATUF E - DEVI ATION OF AVERAGE TENPERATURE FROM SE1 POINT . RE ACTOR POWER LEVEL ERROR,Nd-Nj - R00 vet 0CiTv oEMANo DAVIS-BESSE NUCLEAR POWER STATION
- e. unit LOAo oEMANo REACTOR CONTROL DIAGRAM-
! . AUCTIONEER AVEREAGE REACTOR POWER LEVEL
. . RE ACTOR P0wtR LEvEt oEM ANo INTEGRATED CONTROL SYSTEM
- e CHANNEL RE ACTOR P0hER LEVEL FIGURE 7-5 AMEN 0 MENT NO, 1 ()196 ,
4 - Eax. Differential q forth - 21.8 x 10-5 (Ak/k/ i n)
%, 3 ,. ,
/
d
~
/
/ .
l ' b . 2 }
~ '
- 1 7 ,-
/ /
0 l t i I t 1 l l l g 0 25 50 75 100 0 25 50 75 100 l GROUP 5 POSIT 10N GROUP 7 .'OSIT10N' t i i t 0 25 50 75 100 GROUP 6 POSITION l Distance Withdrawn, 5 I'
<l OAVIS BESSE NUCLEAR POWER STATION AUTOMATIC CONTROL R00 GROUPS-TYPICAL
, WORTH CURVE VERSUS OlSTANCE WITHORAWN FIGURE 7-6 1
0137 i i I
F 4 I
/
I ses l CO. - I ... . L , l use (Lt fLEC L0 LOS5 Of EL ECtelt LOAD gg l etaCToe COOLaat FL0e tau a
~
m G ~ e i-o @
- i. i i . . .. i ,,,,,
to d g g Tute t et Yve gie t SfP ASS SPEtt u urt , Jomtect
.E7 s RiaCTOR C00L&ef FLOW LIMIT I
g, _ RtaCTOR CCDL Alli TfesPittfUet L epit I i v., to. estu arie TfeePE tafsti Llulf I
,,......,0 P,
PR($$Ute LINil
@ .. I I
.. i L, $Tiene GlutatTOR LitEL Lluf f i i i .
g) sr arvP e rio..,t. p v o Fit 0 watyt rLOW Conf e0Ls LOOP I LOOP g s
9 l #eu 244, I _ b f Rioutst? Sif 70:e mii. l I L0a0 LCaf j i , L0a0 L IEit l 6 . . ave t ri, I e4 66 'Y1 DE < , T 4040 LOSS Of fitosafte Puw fie ama me staCY0A C00Laaf PuuPS Ortsat tes alpmET AIC SOCS meats Listn0: <- satt Leap Otmas10 ADS . automatic 015PaTCM ST3 flu a . Olf f EttaCl Pg . STtage Patssuat P . $Tlam 6tateaTOR Petssuet
#$ Sgt . $ttase Sti Paf 55uet RCF . RE actos ED0taaf FL0s bes? L0a0 stenene 70 station Costect . FEt0maf te f L0s u . Ma nuaL Sif P0 tut N a . MaGual/auT(peafit L = $1 tam statesTOs ttutt In e RE ACTOR CUTLif ItWts&Tutt E A 084as0 T a
- Rt ACTOR letti TfurtBafutt E T _
T, . FEEDuaff t TDePERAYget C'_ Iif at IE10 matte Otman0 I fut auM5tA SutSCRIPf3 atita 10 LOOP t as0 LOOP , if enf 0e
- e 3 Costa 0t t
E etaCTOR C00L asf dC7g , (TC FL0s L aus? I St ,0. C- a.T TEtePitaiset Liesef ,*2 L0s FtEDeatta y, itwikatual Laust i i Sitase 6tsttaTOR p Pet 15tet L emet 1 I CO.i.Ou . 's, I
.TI
_ t .E
.t.t.af.s L , . ,
tq , DAVIS-BESSE NUCLEAR POWER STATION I I STEAM GENERATOR AND TURBINE CONTROL St aafuP f enig an ,L.itewalte C O. '* ' INTEGRATED CONTROL SYSTEM Lo , , Loir , FIGURE 7-7 0139
1 I i - g x y. N(
.. 0s, ,0s
... ( ~t -- e
...t.
yyy/ Sup*L e ( 50ueCl c attl h [ Pe0Poef *0.*at
-et
. . . ,x N. . . . .. .
3 =, t e
..., (
P0s t 8 nt - y y p= . 7 ,/
% C0 map L DG-# -"(T E 85 I
g, , , // C8C l
,,,3 b aart et s t e -
Poet. OG
.ef t ast$s eTE N'
08 d CasestL S SUPPL T y
F // A cic j , , , 0, , , t e. ... e i .e - Poet S sgP PL1 ovitEE -
) -
es Ese i adCT:Catta UC I C
&Wf GEE
. . . . < ,- .....t b & / / (1 P0.t . .t,t.,
L_ h... !
..t c ~
i i e0ste enest taasetts % , p0 era etTEB5 Poste l Suset t l
....< ...t 1
W l P0wta l
'~
@ ' t. .t, ' <
l Syett e ] i ,,.t . -
/ l 80wt e aqf tel ll SvP P0st8 PL T l l
s, 0200 l V
9 2 1 f . s .g e g eg f e 'l .t il21 ,@ / / h-f..... . . r. U ,' e,/ y.
....f.
. f . .t , f , .. . t .t . t ., > Y $ h r + e-y Le w 4. . of f(SS O m LJ
, 4 ,
598 > 3 Dr e etit:1 m 4 . Y.
.a.
g .... 9 OtStaSLI 19e# reif
. tite 40Caff 0 os toeveeL (kssoit eitf( A LOCattD L0taLLv in (maear t ecovLt 500 CDeletvaf t08 Sit f itsRE 7-2 3,
-p
^
y , a s Post t it vt L 10 Rt aCT OS PR0t ttt 'Oe S. Situ o h4
.. ..S
. .tP . alb Q att
- [
Q Fonte LtetL TO Mattes L. J }u ] l e0T ECi tGB SIST Em e .......
;f ,
W ) L . 0 .u,....,E. t . ,l .t , 1. .t .. f' e los FP o 70mit tiett 19 elaCT04 > 6 4DitCt es 5,3tt.
- ,n:,,
;) .
g,_, . . . . . .. .L 9 _ DAVIS-BESSE NUCLE AR POWER STATION NUCLEAR INSTRUMENTATION SYSTEMS FIGURE 7-8
-- 10-3 1010 _ - g l
4 - 125 , 10g ~~ *. - - 100
- 10-5 j 108 -- ,
g- - 10
- a I - 10-6
=
107 -- =--1
; l E - 10-7 ,
106 _, u
$ 5 - - 10 8
, gs -- ,
=
f j --
- 106 - - 10 9 5 - - 105 - 10 g 103 --
t
=
=
- - 104 - 10-11 102 ,,
8 a - 103 10 -- - E
- 102
-- e
- 10 10 1 - -
- -1 5' 10-2 , , g
- - 0.1 .
5= 5
= -
~
2" 3 : na E 5. DAVIS-BESSE NUCLEAR POWER STATION NUCLEAR INSTRUMENTATION FLUX RANGES OM i FIGURE 7-9 l 1 L
\
NI-5 NI-3 UCIC CIC X NI-l - NI-6 PC gglg
.,..s.
4 4 6' o
,0 f ,.__
4
- I -
Y o, ., , y- g- -----
- y. ,.
N I -2
-* PC 4 .
NI-7 C UCIC NI.4 Z CIC
'EGEND PC - PRO PORTI ON A L COUNT ER - S OURCE R ANGE DETECTOR C IC - COM PE NS ATED 10N CHAMBER - INT ERMEDI ATE !
RANGE DETECTOR UCIC - UNCOMPENS ATED 10N CilAMBER - POWER RANGE DETECTOR 1 1 DAVIS-BESSE NUCLEAR POWER STATION l NUCLEAR INSTRUMENTATION DETECTOR LOCATIONS FIGURE 7-10 OZON AMENDMENT NO. 2
I l c. : m... ,
>= .
{ ' '
. i O
- Eg A1 (Q n
i='
== !, ( U. U. 't. [
i i : , p mm,m
; e i
- i a
;. . __e _ ._ _ _ _ a _ _ _ ,.!
;. y, ;
- i. -
si e : i
, ii. . ,
, ,e
- i. , ,
, o __
='ai
_ _ _ _ _ g_ _ _ _ _. ,, l l f--h-- 'll V j l l _. e _ . . .f ... l ( I
, s_.. A ___ ______) 4., !.
, A,
, a , . .
i i ,________, V, i. , I e . . , w e i
=== . i ,
8 0 6 pg,7,g,,, F -. ,l l ----
,r ---n, n. li. _ _mn. _ _ _ _ _ _,! l k
--i " "" l
, ; a ,
, naimi: ._2_. i
, ususin g
s s, e . . __ ; . _ _ _. _c,._ s e , e i i ! , , , i nin. . , ! , i e i ' MM
'--------8 4.ig.i s. . ,, ,, ,, ,, ,,,,,,
; go i, o ,, u - a a '"'l
l m s - s' l l -l ),, , , i 3 i
; . ... Ie_
l c ' l l 4., = 'j l' a V' 'j e V '.I l l l . ul l i
, e, i..-l__..l______l__.l e
i l t 8 l - ;- .;i ,_______ , ,
, . e ma. . i t
i _ .3_.l_ _ _ _ _ _.; -rui.= l ; e , , , .m. , i , . l '_ L _ _ g __ ) l
. A" l._ _ l , , .
i l i i , e J .i. e i e i i a _.Ai i e i i e e i e g i i I l 8 g 6 4 0 0 g a 8 8 l
'l p______13
; .j__u___-___+________= _ .
.l_ __________q ,.,,,,,,, ;
s , , , .. . , ,, e i , c. = .
,i ,----t
, mm. e i ,
~~~~~
s_________.._. . .*%________.e# l .O. I., i /_ _.A
,i i
W
,P _ - _ d s.uP :f.s l
i (. - l l l
,,i l
A, ' ' m
- , ..t. : .
'I ] .ii PP
,B : i s
,, l
----I ** =im l
h .
,I----0;,[,.
i 4 i i , 1 I l
. st.P
; g,q3 .t.g, s I. 4 ==
l i I 02, 4 - 4
/ **-__ ---__ _-- .. _ _____.*
I
t i b I L {u_ _._, _ _,,, ,
.i, i a i 1
i
, , I e.
% =
' i . ..
8, .L g;7 l l y,- - . e.., , A' _ _l! !
%A. l]
l l l
- m. l l
.._p... l l i
i i, i i ie i ,
- i ,
i ,. ,. ., i ll .L 8e 6 _ l i
.i
-- , , t t...t.
, g
.n . . .
.., c i i i
., .a n .n,
.a m.. . . i " _ _i='i'PL'e _ m _ i i l, ,
l %._A._ : l , . . . .. I W' ,, I f y,,,_______________'i,, _ srm , :
.. i i
;l 2
- ll l i,
liis a' I i i i
.! ,, .I"..' .#. i ,il i, .. ,,i
,. ii 3, . _ - _ _ _ , ,ii i
,i l
' t 1
i i (( I ,-___________y__________2__,, i
, , i , .,_ I i
i
, ,;ii __3.___ ___ __ ... _ _ _ ,. , ,i i
, ,i , i i , i .i I i .
, , i
. : i l
l i... iis i i l
, . l i . , isi i
.i ,
..,____i,_____.,___ ,
i i
.,_,__ ,i i.i,
," , ~
- , ii,ii i
ll l ll i. lll
%)
.. .,i. i.
., .i ...
. i : l' : . me e ""
1 l l ll l ; i l;: W m- 1 t
- l c _ _ u_t--s- __ , l i
l.l
,i i,
- ,-- --i .m.,.m, u___ i
,m .
, i r,'.i,
.i i
,,. __ -, , .i ___i
,, i -
,_ _ _. _ m _1; ; _______. .
..m...
,, , i, ., .,
L -)
, ),____.,_________
,i ___________.
,______________,.i, ,
A ii ik; it _ _-.e. _ _ _ _6... t j"
... u... ......u, i n . . . . .. .
M', l!T T ,. ,s l
, i.e.
i
. . . . . . l, ....
,i _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ .
.,m.
. 0205 a
p . . i,...., DAVIS-BESSE NUCLEAR POWER STATION l ana". I
.u.i NON-NUCLEAR INSTRUMENTATION SCHEMATIC '
l FIGURE 7-11
. AMENDMENT NO. 1
C .. - O O 90 @ , Totai core monitors O O based on 1/4 core O SGO 9 symmetry. GO G G @ O @ OO O e
@ 4 4 O Symmetry monitors.
90 ee O O O O O OO O 90 O O 9 9 $ $ g Combination tota' core e O GSO 9 and symmetry monitors. 9 9 l i O l ( " i I.s I i 1 AXIAL FLUX l [ SHAPE ACTIVE CORE
- LENGTH i =
E E E E
- e a o BACKCROUND DETECTOR LOCAL FLUX DETECTORS DAVIS-BESSE NUCl. EAR POWER STATION b INCORE DETECTOR LOCATIONS 0206 S FIGURE 7-12
I i C' ELECTRICAL CONNECTOR
- s noo Psi sut L - _a L
t_____. hl ~- --- g-y g-
'r 4 ,
ll T .. c cu iet rust
} ,
^
*j e e '.
j ,.
' .f .
.'.-f .
I 4
< i
/
i l DAVIS-BESSE NUCLEAR POWER STATION l l TYPICAL ARRANGEMENT-INCORE : INSTRUMENTATION CHANNEL 0207 Figure 7-ia [-- I}}