ORNL-4191 - the Molten Salt Energy Technologies Web Site

trouble proved to be a failure in a glass seal that
allowed water to enter the magnesia insulation in
the cable, which is an integral part of the chamber.
Safety System
A period safety amplifier failed when lightning
struck the power line to the reactor site, and a
replacement amplifier failed as it was being in-
stalled. The field-effect transistor in this type of
amplifier is susceptible to damage by transient
voltages, and it was found that under some condi-
tions, damaging transients could be produced when
the amplifier is removed from or inserted into the
system. A protective circuit was designed, tested,
and installed 011 the spare unit; in the interim, a
different and more stable field-effect transistor was
installed. The module replacement procedure has
been modified to reduce the possibility of damage
incurred on installation of the module.
Experience at other sites with the type of flux
safety amplifiers used in the MSKE had shown that
the input transistor could be damaged, causing
erroneous readings, if the input signal became too
large too rapidly. Therefore, a protective network
of a resistor and two diodes was added to the input
circuit nf each of these amplifiers.
Two relays in the safety relay matrices failed,
both with open coil circuits. A chattering contact
on the fuel pump motor current relay caused safety
channel 2 to trip several times before the problem
was overcome by paralleling two contacts on the
same relay. A defective switch on the core outlet
temperature also caused several channel trips and
one reactor scram before the trouble was identified
and the switch was replaced
Four rod scrams, all spurious, occurred during
operation in the report period. Two were caused
by general power failures during electrical storms.
Ancther occurred during a routine test of the safety
system when an operator accidentally failed to reset
a tripped channel before tripping a second channel.
:?
1 he other scram, also during a routine test, came
when a spurious signal from the switch on the core
outlet temperature tripped a channel while another
channel was tripped by the test.
TWBL SYSTEM DES3GN
P. G. Herndon
As experience showed the need or desirability of
more information for the operators, improved per-
48
formance, or increased protection, the instrumentation
and controls systems were modified or added to.
During the report period there were 25 design
change requests directly involving instruments or
controls. Six of these required only changes in
process switch operating set points. Fourteeri
requests resulted in changes in instruments or
controls, one was canceled, and the remaining four
were not completed. The more important changes
are described below.
The single T32-v dc power supply formerly sewing
the nuclear safety and controls instrumentation
was replaced with three independent power supplies,
one for each safety channel. Each obtains +32-v dc
from 110-v ac, but the ac power sources arc different.
One is the normal building ac system.
Another is 110-v ac from a 50-kw static inverter
powered by the 250-v dc system. The third comes
from a 1-kw inverter operating on the 48-v dc system.
Thus continuity of control circuit operation is
ensured in the event of a single power supply or
power source failure. It also increased the reliability
of the protection afforded by the safety
system by ruling out the possibility that malfunction
of a single voltage-regulating circuit could
compromise more than one channel. (Before the
change, on one occasion, a failure in part of the
regulating circuit caused its voltage output to increase
from 32 to SO v, and only a second regulator
in series prevented this increase from being imposed
on all the safety circuits.)
To prevent the reactor from dropping out of the
“Run” control mode when a single nuclear safety
channel is de-energized, the “nuclear sag bypass”
interlocks were changed from three series-connected
contacts to a two-of-three matrix.
Circuits were installed to annunciate loss of
power to the control rod drive circuits. This reminds
the operator that he cannot imrnediately return
to power simply by manually withdrawing the
rods after the controls have dropped out of the
“Run” inode.
A wiring error in a safety circuit was discovered
and corrected. Interlocks had recently been added
in the “load scram” channels to drop the load wheri
the control rods scram. A wiring design error resulted
in these interlocks being bypassed by a
safety jumper. Although the circuits were wired
this way for a the before being discovered, the
scram interlocks were always operative during
power operation, since the reactor cannot go into
the “Operate” mode when any safety jumper is
inserted.