Reactor Trip Function

The nuclear system protection system initiates the rapid insertion of the control rods to shut down the reactor. The system is of the fail-safe design where it will trip on loss of electrical power but will not trip and cause a scram on the loss of a single power source. The four trip channels are physically separated from each other and from other equipment precluding the possibility of interactions that could cause possible false scrams or failure to scram. The logic requires a manual reset by the operator, which is automatically inhibited for 10 s. One reset switch is used for each trip channel. Failure of a single trip channel, division logic, or a system component will not prevent the normal protective action of the nuclear system protection system. 

---

The Safety Protection Subsystem of the Plant Protection and Instrumentation System (PPIS) is that portion of the PPIS which performs lOCFRlOO-related functions. It includes the reactor trip Instrumentation hardware and associated system sensors which are used to detect abnormalities in the plant... 

The reactor trip and main loop shutdown instrumentation hardware and sensors are designed to withstand the forces imposed by the QBE and SSE so as to remain functional during and after either earthquake. System failures which could result in loss of function are identified as follows ... 

The ex-vessel neutron detectors are involved in AOOs. The ex-vessel detectors are unaffected by the transient imposed on the vessel internals by the rod withdrawal event (AOO-3) because they are located outside the vessel. Their function is carried out when they detect a high power level and send the signal to the Safety Protection Subsystem which combines it with a flow signal resulting in a reactor trip command. 

Ihe three chambers will be located near each other so as to provide the same relative Information. At B, D, DR, F, and H Reactors they should be installed in the top of the reactor. Holes should be bored to place the chambers on the centerlines of the VSR pattern as shown in Figure 6. By installing these chambers on top of the reactor, the level trip function of this instrument can be used to monitor the top-hedf of the reactor in the same manner as the present Beckmans now monitor... 

Following the reactor trip the operators monitor the progress of the RSSE from a display panel in the Central Control Room. They may intervene if any particular item of auxiliary plant fails to respond in its correct time sequence. Flowever, sufficient redundancy of essential plant is provided, making such intervention unnecessary on safety grounds. Finally, all discrepancies are noted and defects rectified and functionally tested before reactor startup. 

Which system is to be chosen can only be decided in view of the type of reaction and reactor, just because not every system is effective in any case even if the trip function is successful. 

The RPS is a very important system for NPP safety. So that, current regulation requires a very high reliability of the system in performing its vital and required safety function, i.e. reactor trip. The fault tree shown in Fig. 3 can be used to estimate the reliability of the RPS before and after the STl change under study. Table 1 shows there are no significant reduction of the RPS reliability after the change, since it remains very high. 

One of the most important safety related systems is reactor trip system (RTS). RTS malfunction probability assessment is based on knowledge of malfimction its components and on reliability analysis of its functions. Solution of this task is described in (Fuchs et al. 2007). Input parameters of this task are component failures data (see table 1) and output parameters are malfunction probabilities of RTS functions, see Table 2. 

The next band corresponds to accidents that directly impact the three safety functions and are not arrested or mitigated by the built-in safety systems, such as reactor trip. Proper application of Defence In Depth may still prevent releases to the environment. However, a trained nuclear accident response team would be dispatched from the central monitoring station. 

The plant control system provides for non safety plant control functions. The Diverse Actuation System provides for an alternative means for initiating the reactor trip and the emergency safety features by integrating a complete diverse actuation system within the plant control system. 

A Turbine Bypass System (TBS) is provided which passes steam directly to the main condenser under the control of the pressure regulator. The TBS has the capability to shed 40% of the turbine generator rated load without reactor trip or operation of a SRV. The TBS does not serve or support any safety-related function and has no safety design. 

ERGs may not be entered into and used until a manual or automatic reactor trip or safety injection has been initiated, or conditions exist that should have resulted in either actuation. Regardless of the trip-initiating event, the first ERG entered is the reactor trip or safety injection (E-0) procedure. This procedure serves four basic functions ... 

After completion of the standard post-trip actions, diagnostic aids will be consulted to assist in quickly identifying the optimal procedural guidance. If all safety function criteria are satisfied the operator will be directed to a recovery procedure for an uncomplicated reactor trip recovery. If one or more of the safety function criteria are not satisfied by means of the diagnostic guidance, the operator will be directed to an optimal recovery procedure or the functional recovery procedure. 

Heat removal from PWR plants following reactor trip and a loss of off-site power is accomplished by the operation of several systems, including the secondary system via the steam relief to the atmosphere. The auxiliary (emergency) feedwater system (AFW) functions as a safety system because it is the only source of makeup water to the steam generators for decay heat removal when the main feedwater systems becomes inoperable. 

The negative reactivity insertion following a reactor trip is a function of the acceleration of the RCCAs as a function of time and the variation in rod worth as a function of rod position. For accident analyses, the critical parameter is the time of insertion up to the dashpot entry, or approximately 85 percent of the rod cluster travel. In analyses where all of the reactor coolant pumps are coasting down prior to, or simultaneously with, RCCA insertion occurring, a time of 2.09 seconds is used for insertion time to dashpot entry. In analyses where some or all of the reactor coolant pumps are running, the RCCA insertion time to dashpot is conservatively taken as 2.47 seconds. 

A reactor trip signal acts to open two trip breaker sets connected in series, feeding power to the control rod drive mechanisms (CRDMs). The loss of power to the mechanism coils causes the mechanisms to release the RCCAs, which then fall by gravity into the core. There are various instrumentation delays associated with each trip function including delays in signal actuation, in opening the trip breakers, and in the release of the rods by the mechanisms. The total delay to trip is defined as the time delay from the time that trip conditions are reached to the time the rods are free and begin to fall. 

The consolidated categories for initiating events reflect their potential to affect delivery of the Key Safety Functions spurious reactor trip, increase in heat from the primary systems, decrease in heat removal by the secondary system, decrease in reactor coolant flow rate, reactivity and power distribution anomalies, increase in reactor coolant inventory, decrease in reactor coolant inventory and anticipated transients without scram. 

The DAS provides an alternate means of initiating a reactor trip and actuating specific engineered safety features in the event of a common mode iailine within the Protection and Safety Monitoring System that is, it provides diverse backup to the main protection system. The DAS has three functions diverse automatic actuation, diverse manual actuation and diverse indication of the plant information needed by the operator for a manual actuation of critical safety measures. 

A. 1609. The settings of all protection system functions that are used in the safety analysis shall be listed. Typical protection system functions are reactor trip, isolation valve closures and backup cooling. 

Each pressurized water reactor manufactured by Combustion Engineering or by Babcock and Wilcox must have a diverse scram system from the sensor output to interruption of power to the control rods. This scram system must be designed to perform its function in a reliable manner and be independent from the existing reactor trip system (from sensor output to interruption of power to the control rods). 

---