Добавил:
Upload Опубликованный материал нарушает ваши авторские права? Сообщите нам.
Вуз: Предмет: Файл:
I&C Safety Guide DRAFT 20110803.doc
Скачиваний:
13
Добавлен:
01.02.2015
Размер:
720.38 Кб
Скачать

8.17. Means should also be provided to manually initiate the mechanical safety systems and the individual components necessary to initiate and control performance of their safety functions.

8.18. Manual initiation of safety action provides a form of defence in depth for abnormal conditions and supports long-term post accident operation.

8.19. Mechanical safety systems are, for example, the individual divisions of reactor trip, emergency feed water, emergency core cooling, or containment isolation.

Information display

8.20. SSR 2/1 paragraph 6.33(3) states:

The design (of the protection system) shall … make relevant information available to the operator for monitoring the effects of automatic actions.

8.21. The protection system should make available to plant operators the value of each input parameter used in protection system functions, the status of each trip and actuation function in each division, and the status of each system initiation.

Protection system sensors and settings

8.22. The sensors that provide signals to the protection system should be classified as part of the protection system, and their signals should only feed other systems through appropriate buffering and isolation devices.

8.23. Design techniques, such as functional diversity, diversity in component design, and principles of operation, should be used to the extent practical to prevent loss of protection system functions.

8.24. Setpoints for protection may be either fixed or variable dependent upon some other plant parameter or condition.

8.25. Where it is necessary to provide multiple setpoints, the design should provide active means or administrative control to assure that the more restrictive trip setpoint is used when required.

8.26. It might sometimes be desirable to provide multiple setpoints to achieve adequate protection for a particular mode of operation or set of operating conditions.

8.27. When variable or multiple setpoints are needed the devices used to change the setpoint setting are part of the protection system and should meet its requirements.

8.28. The protection system should provide the operator with a means for determining the setpoint values for each protection system channel.

Operational bypasses

8.29. Operational bypasses or trip-conditioning logic might be necessary to inhibit the actuation of protection system functions during specific plant conditions. For example, the trips that limit reactor power during startup must be bypassed at some point to allow power increase past the low power trip setpoint.

8.30. Indication of the operational bypass states should be provided in control room.

8.31. During plant operation, the operator should be provided with suitable warnings or alarms when the plant is approaching a state where operation of a bypass is needed.

8.32. The protection system should prevent the activation of an operational bypass or initiate the appropriate safety actions when the applicable permissive conditions are not met.

8.33. If after activating an operational bypass, conditions change such that the bypass is no longer permissible, the protection system should automatically accomplish one of the following:

  1. Remove the activated operational bypass,

  2. Put the plant in a condition where the operational bypass is permissible, or

  3. Initiate appropriate protective actions.

Protection system ‘seal-in’

8.34. SSR 2/1 paragraph 6.35(2) states:

The design (of the protection system) shall prevent operator action that could compromise the effectiveness of the protection system in operational states and accident conditions, but not to counteract operator actions in accident conditions.

8.35. Actions initiated by the protection system should be latched or sealed-in so that once an action is started, it will continue although the initiating state might have ceased to be present.

8.36. Seal-in is normally implemented at the division level. Seal-in of individual channels is not required.

8.37. Once a protection system action is initiated, it should not be possible to terminate or cancel the action except by manual operator action taken after the safety action is complete.

8.38. The guidance of paragraph 8.37 is not meant to restrict the action of devices that are provided to protect safety equipment activated by the protection system. The electrical power safety guide, DS-430, Ref. [14], gives guidance on electrical protection of items important to safety.

8.39. Reset of protection system functions should require separate operator action for each system-level function.

Spurious initiation

8.40. The design of the protection system should, to the extent practicable, minimize the potential for spurious initiations or actions of the protection system.

8.41. Spurious initiation of protection system functions could lead to:

  • Unnecessary stress on equipment and reduction of plant life;

  • The need for other safety actions;

  • Erosion of the operator’s confidence in equipment, potentially leading to subsequent disregard of valid signals; and

  • Loss of capability for production at the plant.

8.42. Spurious initiation or actions of the protection system should not place the plant an unsafe condition.

8.43. If spurious initiation or actions of the protection system could result in a plant state in which the plant requires protection, then safe conditions should be maintained through actions that are initiated and carried out by the unaffected parts of the protection system.

Interaction between the protection system and other system

8.44. SSR 2/1 requirement 64 states:

Interference between the protection system and the control systems at the nuclear power plant shall be prevented by means of separation, avoiding interconnections or by suitable functional isolation.

If signals are used in common by both a protection system and any control system, separation (such as by adequate decoupling) shall be ensured and the signal system shall be classified as part of the protection system.

8.45. The protection system should satisfy all reliability, redundancy, and independence requirements in the presence of a failure of any component or signal used in common by the protection system and control system.

8.46. The reliability requirements that must be satisfied include compliance with the single failure criterion including any assumptions about pre-existing failures, cascading failures, and channels that may be temporarily out of service.

8.47. SSR 2/1 paragraph 6.32(1) states:

The protection system shall be designed to be capable of overriding unsafe actions of the control system.

8.48. If a PIE can cause a control system action that results in a plant condition requiring safety action, then the same PIE should not prevent proper action of the safety group that gives protection against that plant condition.

8.49. Effective measures to prevent interactions between control and protection systems include:

  • Additional equipment in the safety group to deal with the potential interaction;

  • Provision of barriers or alternative plant arrangements to limit the damage resulting from the PIE; or

  • A combination of these items so that the safety group and plant design is sufficient to maintain the plant conditions within acceptable limits.

8.50. When a device may be actuated by either the protection system or a system of lower safety classification, any protection system demand for actuation of a protection system function should have priority to actuate the device.

8.51. For example, actuation signals might be sent from the control system for normal operation or to allow the operators to control normal operation of all system elements from the same user interface, but any protection system demand for safety actuation must always override control system commands.

8.52. Paragraphs 8.110-8.111 give guidance on control of safety classified components from computer-based operator controls of a lower safety classification.

POWER SUPPLIES

8.53. The power supply for I&C systems should have classification, reliability provisions, qualification, isolation, testability, maintainability, and indication of removal from service, consistent with the design basis reliability requirements of the I&C systems they serve.

8.54. I&C systems that are required to be available for use at all times in operational states or design basis accident conditions should be connected to non-interruptible power supplies that provide the systems with power within the tolerances specified by the I&C design bases.

8.55. I&C systems may be transferred by the plant operators or by automatic switching action to a stand-by power supply instead of the normal supply when operating circumstances need it, provided that the functions of the I&C systems can tolerate the associated interruption in supply. Normally the transfer system will be treated as part of the power supply system and will be of the same safety category as the I&C system that it supports.

8.56. Modern I&C systems can be powered directly from DC power sources. This is advantageous for systems that need non-interruptible power because it eliminates the need for inverters, motor-generators, or power transfer devices in the electrical power system.

8.57. Power supplies can provide a transmission path for EMI which might originate outside the I&C systems or might arise from other I&C systems that are connected directly or indirectly to the same power supply. Such interference sources include electrical fault clearance associated with other equipment on the same supply.

8.58. DS-430, Ref. [14] provides detailed recommendations for power supplies and associated distribution systems.

Соседние файлы в предмете [НЕСОРТИРОВАННОЕ]