Class 1E circuits must be independent from circuits of other categories. Understanding IEEE 384-1992 is vital to understanding the NRC’s circuit separation and isolation requirements. . . .
The purpose of the standard is to determine how to achieve circuit independence. Independence is achieved when a combination of physical separation and electrical isolation are applied to redundant systems.
Why do we care about circuit “independence,” you may ask? Simple: IEEE 603-1991 explains that circuit independence is a component of the overall design strategy for building a nuclear plant safety system, and the NRC made it a law in 10 CFR 50.55a(h) that nuclear plants must adhere to IEEE 603-1991: “Protection systems of nuclear power reactors of all types must meet the requirements specified in this paragraph.”
[Generally speaking. There are other options available for plants whose construction permits were issued before May 13, 1999.]
IEEE 603-1991 (sections 5.6.3.2 and 5.6.4) points to IEEE 384 to locate the detailed separation requirements for Class 1E equipment and circuits. The NRC, in Revision 3 of Regulatory Guide 1.75, endorsed IEEE 384-1992 as an acceptable way to implement circuit independence.
IEEE 384-1992 defines independence as “The state in which there is no mechanism by which any single design basis event, such as a flood, can cause redundant equipment to be inoperable.”
Several of the General Design Criteria in Appendix A of 10 CFR 50 specify “independence.” GDC 17, for example, requires that “The onsite electric power supplies, including the batteries, and the onsite electric distribution system, shall have sufficient independence, redundancy, and testability to perform their safety functions assuming a single failure.”
GDC 24 states that “The protection system shall be separated from control systems to the extent that failure of any single control system component or channel, or failure or removal from service of any single protection system component or channel which is common to the control and protection systems leaves intact a system satisfying all reliability, redundancy, and independence requirements of the protection system.”
The NRC has endorsed IEEE 603-1991 as an acceptable method to achieve “independence.” In section 5.1 of IEEE 384-1992, it is explained that Class 1E circuits and equipment will achieve independence if they are physically separated and electrically isolated.
THREE KINDS OF CIRCUITS
Physical separation is attained by employing safety-class structures, separation distance, barriers, or any combination of these things to separate Class 1E equipment.
Electrical isolation is attained by employing separation distance, isolation devices, shielding and wiring techniquess, or any combination of these things.
The standard draws distinctions between three kinds of circuits:
- Class 1E circuits are those that comprise safety-related equipment and systems.
- Non-Class 1E circuits are those that are both physically separated in accordance with the minimumm separation distances and electrically isolated from Class 1E circuits.
- Associated circuits are non-Class 1E circuits that are not sufficiently physically separated or are not electrically isolated from Class 1E circuits.
While the function of associated circuits is non-Class 1E, the NRC requires that they be treated as if they are part of the Class 1E division they are associated with:
The staff position is that (1) non-safety-related circuits that are not separated from safety-related circuits through the minimum separation or barriers, must be treated as “associated circuits,” and (2) the cables that are associated because they are powered from a safetyrelated source serving non-safety-related loads or share the safety signal must also be treated as associated circuits. Both of these groups of associated circuits should not ever become associated with a redundant division through its proximity or shared signal to preserve the independence.
The standard effectively requires that mechanical equipment (like HVAC) of one safety division cannot receive power from a separate safety division. That’s because the failure of one could jeopardize the independence of another. It also requires that Class 1E independence and redundance be maintained even as non-safety-related structures and equipment fail during design basis events.
The standard also requires that electrical fires in one Class 1E division not disable the safety-related functions of another division.
SPECIFIC SEPARATION CRITERIA
In Secion 6, the standard moves to a discussion about physical separation specifics. First, there are three enclosure categories:
- Open to Open, which includes open tray to open tray, and free-air cable to free-air cable.
- Enclosed to enclosed, which includes conduit to conduit, and enclosed tray to conduit.
- Enclosed to open, which includes conduit to free-air cable, and enclosed tray to open tray.
The standard also defines three different areas. The separation distances for each of the three enclosure categories above varies depending on the environment:
- Nonhazard areas (also known as the cable spreading room) – an area that contains no high-energy equipment like switchgear or motors. Any power supply circuits in the area must be limited to those required to serve the area (like lights or power panels), and they must be installed in enclosed raceways (tray or conduit).
- Limited-hazard areas (also known as general plant areas) – areas similar to nonhazard areas but without equipment restrictions. In these areas, the main sources of damage are from high-energy electrical faults. Specifically, there is no risk of missiles, pipe failures, or non-electrical fires.
- Hazard areas – these are further divided into three sub-categories: pipe failure hazard areas, missile hazard areas, and fire hazard areas:
- Pipe failure areas are those with pipes carrying high or moderate energy fluids.
- Missile hazard areas are those that may produce high-energy missiles during a design basis event and possibly damage Class 1E circuits separated in accordance with the distances required of limited-hazard areas.
- Fire hazard areas are those that contain flammable or combustible liquids, flammable solids (like easily burnable woods), or flammable coatings (like various paints or varnishes).
The separation distances vary depending on which enclosure category and which area they are located in. The basic distances range from one inch of horizontal separation and three inches of vertical separation in the worst-case scenario in a nonhazard area, up to three feet of horizontal separation and five feet of vertical separation in a limited-hazard area.
The open-to-open category requires the greatest separation distance. In both areas, the minimum enclosed-to-enclosed separation (such as conduit to conduit) is one inch. This means that, in these two areas, two different Class 1E divisional cables can be routed side-by-side as long as they are routed in conduits and spaced one inch apart on all sides.
The routing criteria become more complex for hazard areas. Generally, either no Class 1E circuits are allowed at all, or only one Class 1E division is allowed to be routed in the hazard area. In other words, there is no minimum separation distance; the only acceptable physical separation is by barrier (usually a wall).
ADDITIONAL SEPARATION REQUIREMENTS FOR SPECIAL CASES
There are additional separation requirements given for different classes of equipment. Standby generators have to be separated from each other by physical safety structures (walls), and the same goes for Class 1E batteries.
Switchgear, motor control centers, distribution panels, and containment elelctrical penetrations must be separated in accordance with the separation requirements given above for the various separation classifications and areas.
Main control panels must be located in a non-hazard area (i.e. the control room).
Internal control panel wiring (divisional Class 1E, or Class 1E and non-Class 1E) must be separated by a minimum distance of one inch of horizontal spacing and six inches of vertical spacing (as long as the control panel materials are flame retardant). If this criteria cannot be met, then barriers can be installed. If the spacing or barrier requirements aren’t met for non-safety circuits, then they become associated circuits and effectively dedicated as the divisional, Class 1E circuit they are associated with (close to).
ELECTRICAL ISOLATION REQUIREMENTS
To achieve electricial isolation, isolation devices must be installed between Class 1E and non-Class 1E circuitis, and between associated circuits and non-Class 1E ciricuits.
Circuit breakers qualify as isolation devices if they are tripped by fault current and are coordinated so that they interrupt a downstream fault before tripping an upstream circuit breaker. They must also be included in a periodic testing program to ensure they have not degraded over time.
Finally, the bus must be able to supply enough fault current for a long enough time to trip the breaker. This isn’t usually a case on standard power buses, but it becomes critical when Class 1E 120-volt buses are powered by inverters; when shorted, the inverter usually is only capable of supplying a small amount of current for a very short period before it cuts off. If the breaker doesn’t trip before this occurs, then all of the circuits on that bus could lose power when the inverter voltage output collapses.
Fuses are considered isolation devices if they meet similar criteria as circuit breakers:
- They must not degrade over their lifespan.
- They must be properly coordinated so that they melt in time to interrupt a downstream fault before an upstream protective device trips.
- The power source must be able to supply adequate current for a long enough time to melt the fuse without impairing any Class 1E device functionality.
For instrumentation and control circuits, there are similar rules for isolation devices. A list of acceptable isolation devices is supplied, including amplifiers, current transformers, fiber-optic couplers, and relays.
For I&C circuits, one other requirement to consider is that downstream faults can’t disrupt upstream Class 1E functions. The standard puts it this way in Section 7.2.2.1: “shorts, grounds, or open circuits occurring in the non-Class 1E side will not degrade the circuit connected to the device Class 1E or associated side below an acceptable level.”
For example, consider using a signal isolator separate an indicator in a current loop from another indicator in the same loop. If the isolated side of the circuit is damaged by a fire, for example, and creates an open-circuit or short-circuit condition that interferes with the indicator reading on the other side of the loop, then the so-called isolator isn’t doing any good. It isn’t an adequate electrical isolation device for use in a Class 1E, I&C circuit because a fault on the isolated side degrades the Class 1E functionality of the unfaulted side.
CONCLUSION
This article doesn’t discuss all the details of the IEEE std. 384-1992, but it gives an overview.
To achieve circuit independence, circuits must contain both adequate physical separation and electrical isolation.
Class 1E circuits of one division must be independent from Class 1E circuits of another division. Class 1E circuits must also be independent from non-Class 1E circuits. Finally, associated circuits must be independent from non-Class 1E circuits.
Physical separation requirements vary depending on how hazardous a particular area is, and it varies depending on whether the cables are routed in closed or open raceways, or in free-air.
Circuit breakers and fuses are the primary electrical isolation devices. Circuit breakers, if credited as Class 1E isolation devices, must be properly coordinated with other protective elements upstream. They must also be included in a periodic testing program to ensure that their performance characteristics remain up to par.
Fuses don’t have to be tested, but they must not degrade in performance over their lifespan.
Thank you for an informative article.
Well written.