2CAN028906, Forwards Supplemental Response to Request for Addl Info Re Atws.Info Covers QA Program for ATWS Per Generic Ltr 85-06 & Maint Bypass Breakers in Diverse Scram Sys one-line Diagram
| ML20235N558 | |
| Person / Time | |
|---|---|
| Site: | Arkansas Nuclear  |
| Issue date: | 02/21/1989 |
| From: | Howard D ARKANSAS POWER & LIGHT CO. |
| To: | Calvo J NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM), Office of Nuclear Reactor Regulation |
| References | |
| 2CAN028906, 2CAN28906, GL-85-06, GL-85-6, TAC-59069, NUDOCS 8903010282 | |
| Download: ML20235N558 (9) | |
Text
.. _ _. _ _ _ _. - - -. _ _ _
a e
A j
ARKANSAS POWER & LIGHT COMPANY
]
POST OFFICE BOX 551 UTTLE ROCK. ARKANSAS 72203 (501) 377-4000 February 21, 1989 2CAN028906 Document Control Desk Mail Station P1-137 Washington, DC 20555 ATTN:
Mr. Jose A. Calvo, Director Project Director, Region IV Division of Reactor Projects III, IV, V and Special Projects
SUBJECT:
Arkansas Nuclear One - Unit 2 Docket No. 50-368 License No. NPF-6 AN0-2 ATWS Request for Additional Information, Supplemental Response
Dear Mr. Calvo:
The Arkansas Power and Light Company (AP&L), in correspondence dated February 2, 1989 (2CAN028904), submitted responses to a request for additional information regarding the Diverse Scram System (DSS) and Diverse Turbine Trip (DTT) design for Arkansas Nuclear One, Unit 2 (ANO-2).
Following a review by the NRC Staff of that submittal, a conference call was conducted between the Staff and AP&L to clarify portions of the information previously provided.
Pursuant to above referenced conference call, AP&L agreed to provide a statement that the quality assurance (QA) program associated with the ATWS project would be in accordance with the requirements of Generic Letter 85-06.
AP&L further agreed to provide a discussion of the administrative controls to be implemented to ensure that the maintenance by pass breakers included in the DSS one-line diagram are maintained in the appropriate state for proper DSS function.
This information is provided in the enclosed amended response to the Request for Additional Information.
Very truly yours, NN an R.
o ard Manage, Licensing DRH:MWT:de Attachment 0
99030102B2 890221 g
PDR ADOCK 05000368 p
PNU MEMBEA MCOLE SOUTH UTILITIES SYSTEM
v s
AP&L Response to NRC Request For. Additional Information 10CFR50.62 (ATWS Rule) Review
~
l l
Arkansas Nuclear One Unit 2 (ANO-2)
(TAC No. 59069) of December 28, 1988 1'
L L
..The following is the response to the Request for Additional Information dated December 28, 1988 (2CNA128802). The six items are in reference to the system description for the Diverse Scram System and Diverse' Turbine Trip circuitry provided in AP&L's Partial Request for Exemption from 10CFR50.62 dated November 3, 1988 (2CAN118801).
The terminology and abbreviations contained in this response are consistent with that provided in the Partial Request for Exemption.
In keeping with the above, the system denoted as the " Auxiliary Feedwater
. System" (AFWS) in enclosure 1 to the Request for Additional Information is referred to as the " Emergency Feedwater System" by Arkansas Nuclear One, Unit 2.
1.
LOGIC DIAGRAMS-DIVERSE SCRAM SYSTEM (DSS) & DIVERSE TURBINE TRIP (DTT) a)
Provide logic diagrams for the DSS and DTT designs that clearly show all instrument channels (including bistables), logic, actuation circuits, test points, interlocks, bypasses, alarms and indications.
Also, provide electrical one-line diagrams showing the CEDM MG sets, DSS actuated output contactors, and power distribution to the RPS, DSS, and DTT circuits, including vital buses, inverters, batteries and chargers.
Identify the safety related/non-safety related interfaces.
I
RESPONSE
SK-1 and SK-2 provide the logic block diagram and a typical logic for one of the 4 channels of the proposed DSS.
SK-3 provides the logic diagram for the DTT circuitry.
SK-4 provides the electrical one-line diagram for the portion of the CEDM system applicable to the ATWS modification.
SK-5 provides an electrical one-line diagram which indicates tne power sources for RPS, DSS and DTT.
It thould be noted that at I
AND-2 the Reactor Protection Syste:a is part of a larger Fysted called the Plant Protection System (PPS).
PPS is essentially a combination of RPS and Engineered Safety Features Actuation System (ESFAS).
i J
i
\\-
l-b)
Provide information necessary to ' explain how the DSS and DTT will l
remain operable to perform the intended functions given a loss of l
.offsite power.
How does this coordinate with the 15 minutes of inh rnal battery back up.
RESPONSE
L The power supply of DSS consists of two 120 VAC diesel backed power l
circuits supplying two small battery chargers whir.h maintain two 24 VDC l
batteries.
Internally, the two 24 VDC power sources will be distributed on an odd even DSS channel basis.
The system sensors, logic, actuation relays and indicators operate on the 24 VDC from the battery.
Upon the loss of offsite power, the 120 volt instrument AC circuit becomes deenergized for the time required to start and line up the Emergency Diesel Generator (approximately 15 seconds); at this time the 120 volt circuit becomes re-energized and supplies the system power requirements.
Upon failure of a diesel generator or other component l
which precludes this re-energization, the DSS internal batteries will meet DSS electrical load requirements for a minimum of 15 minutes.
It is not conceivable to operate the reactor above a power level of 25 t
percent where an ATWS would be significant without offsite power for'a period of time approaching 15 minutes.
Failure of a 24 VDC internal supply will be alarmed.
Under this condition the associated channels l
(odd or even) would become inoperable; however, the DSS function would remain operable with a 2 out of 2 logic from the remaining (even or odd) channels.
The diverse turbine trip circuitry receives actuation power from the turbine Electro Hydraulic Control System (EHC).
The undervoltage I
relays essentially use CEDM power to hold the contacts open.
The UV-1 through UV-4 auxiliary relays are supplied power from instrument AC buses 2Y1 and 2Y2.
These relays have contacts grouped such that loss of 2Y1 or 2Y2 will not produce a turbine trip signal (see SK-3).
Upon the loss of voltage to these relays, the contacts close utilizing springs.
The loss of voltage to both CEDM buses will, by design, produce a reactor trip.
The EHC system receives power from the 125 volt on non-safety related distribution panel 2D-22 and from 120 VAC instrumentation (2Y1), which is converted to 2a VDC through internal power supplies.
The 125 VDC L
provides monitoring power for tripping relays while the 24 VDC provides actuation power for the master trip relay and trip solenoid valves.
2.
ISOLATION DEVICES j
Provide information to demonstrate the adequacy of all isolation i
devices used to protect the integrity of safety-related circuits from non-safety related ATWS DSS and DTT circuits.
The required information is identified in Attachment 1.
2 of 8 i
I i
RESPONSE
i The design as proposed does not need and does not contain isolation devices of the type implied in attachment 1 to enclosure 1 of the RAI.
Therefore, the information requested is not necessary to approve the design and has not been included.
l 3.
SOFTWARE PROTECTION 1
1 The ANO-2 DSS design uses a Foxboro Spec. 200 Micro Control Module, which is a computer based control device.
Please describe the procedure to maintain the software protection of this component to assure that the DSS will perform its function in a reliable manner.
RE.m PONSE AP&L will use existing computer software control procedures currently used for safety-related operations programs, such as SPDS, CAPS and
{
CPC.
This software will be validated as part of the post implementation testing.
Future changes will be accomplished under the existing safety-related software control procedures.
4.
MAINTAINABILITY, TESTABILITY, RELIABILITY a)
Describe the At-Power test frequency.
RESPONSE
"At power testing", or " channel functional test", as it is known at ANO, will be performed on the same schedule currently used on the RPS system.
The established frequency is monthly.
This testing is done on one channel each week on a rotating basis designed to test all 4 channels every month while in modes 1 and 2.
All four channels will be tested prior to each return to criticality af ter a forced or scheduled
{
outage of greater than 7 days in length.
Refer to Technical Specification 4.3.1 for RPS logic testing requirements (Item 12 of Table 4.3-1).
Arkansas Power & Light does not intend to modify the above section of the Tech. Spec. to include the DSS testing.
The DTT circuitry will be tested consistent with the surveillance of the Turbine Electro Hydraulic Control System (EHC), which is currently tested on a weekly basis.
The four UV relays used as input to the DTT will be tested monthly.
b)
Provide the information to conduct an End-to-End test (from sensor input to actuation device output) once each refueling outage.
1 I
3 of 8
RESPONSE
L The End-to-End test, known as a system functional or operability surveillance, will be_ conducted on a refueling outage basis.
This surveillance will consist of recalibrating inputs, simulating the input and verifying DSS output, actuation, alarms, indicators and contactor operation, c)
. State the method (s) used to effect maintenance and/or test bypasses.
Indicate whether the bypasses involve undesirable practices such as installing jumpers, lifting leads, pulling
_ fuses, tripping breakers, blocking relays, or other circuit modifications.
RESPONSE
Maintenance and' test bypasses will be built-in, integral contral switches, on the Spec. 200 Micro Control Module instrument racks.
Jumpers or_ other " temporary modifications" for testing' will not be required.
The undervoltage relays (UV-1 through UV-4) used for DTT also have " test" switches which are used to simulate a loss of voltage on the CEDM bus, and test the circuit, d)
Describe in detail the indications and alarms used' to alert the control room operators to DSS and DTT inoperable conditions (e.g.,
when a channel / system or equipment is placed in a bypass or test status).
RESPONSE
The details requested have not been fully developed at this point in the design process.
It is AP&L's intention to provide as a minimum the following alarms:
DSS Reactor Trip Confirmed DSS Reactor Trip Demand DSS Channel Trip DSS Channel in Test / Bypass DSS System Trouble The system trouble alarm will include alarms such as loss of 24 VDC power from the internal charger, and contactor bypass breaker closed.
The control room alarm will also include other significant items which i
could potentially cause channel inoperability, require short-term corrective action, or otherwise degrade the system or render it inoperable. All of the above alarms will be consistent with AP&L annunciator policies derived from the Control Room Design Review process.
This policy sets criteria for the need, location, wording, etc. of the control room alarms per Human Engineering Practices.
Any additional alarms for the DTT circuitry would be a duplication of the EHC system.
No additional alarms over and above the existing EHC annunciation scheme are planned for the DTT circuitry.
4 of 8
d 4
'5 DIVERSE TURBINE TRIP
~
Tht: ATWS Rule requires a diverse system to initiate a turbine trip.
(DTT).
Please address your'conformance to the 11 areas (from safety-related to inadvertent actuation) published in Federal Register.
Volume 49, No. 124, dated June 26, 1984.
RESPONSE
The following is a discussion of the conformance to NRC guidance published as supplemental information to the ATWS Rule.
If the-guidance does not recommend other than normal design criteria, the point of discussion has not been included.
For example, the guidance does not recommend conformance to IEEE 279, therefore, a discussion of the level of compliance to IEEE 279 has not been included.
Points discussed include Diversity, Electrical Independence, Environmental Qualification, Qeality Assurance, Testability At-Power, and Inadvertent Actt:ation.
Diversity The DTT circuit is made up of undervoltage relays, turbine trip relays, master trip relays and trip solenoid valves.
Detailed information is provided in the following table:
Component Manufacturer Model UV Relay G. E.
ICR-548 Trip Relay G.E./Clare-G.I.C.
CR120HF/HGSMS Master Trip Relay G.E.
CR120HF Master Solenoid Vickers F3DG4S4 None of the above appear in the reactor tsip system (refer to CEN 315 dated September, 1985 by CEOG for RTS component data).
Electrical Independence The DTT circuitry is not connected to any RTS power source or component, is physically located in separate control cabinets and does not share any circuits with the RTS.
Environmental Qualification The DTT component ratings will be verified to be acceptable for the environment in which they are/or will be installed.
These components will not be included in the ANO EQ Program implemented to meet the requirements of 10CFR50.49 or the EQ Master List.
Quality Assurance See response to item 6d.
]
5 of 8
_ _____-______-___- _ ___ _ D
Testability At-Power The diverse turbine trip will be testable during power operations.
The undervoltage relays will be tested monthly by simulating a loss of voltage at the CEDM bus.
The master trip solenoid is currently tested through the EHC system test.
UV relay status is displayed in the main control room.
Inadvertent Actuation The undervoltage relays, which provide the input into the EHC system, are configured in a selective 2 out of 4 logic, which is not prone to inadvertent actuation.
Simultaneous failures of a certain UV relay on each CEDM bus must occur to produce an inadvertent turbine trip.
(See SK-3).
6.
OTHER SYSTEM DESIGN CONSIDERATIONS a)
Explain the specific operator actions required to manually initiate a DSS and/or DTT protective action.
RESPONSE
The operator will be provided a manual push-button to directly trip the DSS contactors, as a backup to DSS system failure.
The manual trip buttons will be wired into the contactor control power circuit, which uses CEDM power through a control power transformer.
The DTT circuitry is configured such that a turbine trip signal will be generated upon a DSS automatic or manual reactor trip.
The turbine EHC system also contains manual turbine trip push-buttons located in the control room.
Both the turbine and reactor DSS manual trip circuits are electrically independent of the RTS.
b)
Following manual or automatic initiation, is the protective action sealed in at the system level to ensure completion of the ATWS prvention/ mitigation function?
i
RESPONSE
Manual and automatic DSS trip initiations will be sealed (latched) and will require manual reset.
The turbine EHC also requires manual reset of locking out relays.
(Reference paragraph 3.2.1) c)
Explain how deliberate manual operator action is required to reset the systems actuated by the DSS and/or the DTT.
)
6 of 8
<y l
RESPONSE
The operator will be required to go to the Spec. 200 Micro Control Module instrument rack (front) to reset the DSS trip; upon reset of the-DSS system, the operator will be able to close the contactor manually.
Reset of the DTT occurs upon reset of the turbine EHC system.
The UV l
relays automatically reset (pick up) upon closure of the DSS contactor.
l and appropriate reactor trip breakers.
Neither system can be reset if l
a trip condition exists.
1 d)
Provide information regarding compliance to Generic Letter 85-06.
RESPONSE
With an exception in the area of procurement document controls, AP&L will install, maintain, test and modify the ATWS equipment, systems and components in accordance with our Quality Assurance Manual-Operations.
The procurement exception being the supplier or vendor furnishing the ATWS equipment, system, or component need not be on AP&L's Qualified Vendors List.
It is our intent to procure ATWS components of the highest quality.
e)
Discuss how good human-factors engineering practices are incorporated into the design of ATWS prevention / mitigation system components located in the control room.
Specifically address the coordination of displays used to provide the status of ATWS systems / equipment to the' operator with existing displays.
RESPONSE
ATWS display indicators and controls will be designed, selected and installed in accordance with and consistent with existing control room displays and good human engineering practices currently in effect at AP&L.
Per the existing pJant modification process a human factors review is required on all design change packages which specify changes to the control room.
The ATWS modification will be carried out under this process, which is procedurally controlled.
The integration and coordination of displays with the existing control room is accomplished during the detailed design phase; at this point specific design details have not yet been developed.
l l
l 7 of 8
Provide comments to answers given in the telecon held on February 10, 1989.
The required information is as follows:
1.
Provide statement that the QA program as it pertains to ATWS is in accordance with the requirements of GL 85-06.
RESPONSE
The AP&L QA program as described in the Quality Assurance Manual-Operations exceeds the requirements of GL 85-06.
2.
Provide a discussion of the administrative controls that will be placed in effect regarding the opening and closing of the DSS contactor by pass circuit breakers:
address arming upon start-up, disabling for shutdown, maintenance, etc., in the administrative controls.
RESPONSE
DSS by pass circuit breaker administrative controls are as follows:
a)
The DSS system will be placed in service with the contactor by pass breakers open prior to entry into Mode 1 as defined in the Unit 2 Technical Specifications.
b)
The DSS by pass circuit breakers may be closed at any time after exiting Mode 1 to a lower mode, to support DSS testing or DSS corrective maintenance.
c)
When the DSS is armed and the plant is in Mode 1, closure of the by pass circuit breakers will result in a DSS system trouble alarm (breaker disagreement alarm) in the control room to alert the operator (s) of a "by pass" condition, d)
An operational and administrative controls warning label will be added to the DSS by pass breaker cubicles summarizing the above administrative controls.
The proposed administrative controls for the DSS by pass breakers will insure proper operational status of the DSS, while facilitating operations and maintenance.
l 8 of 8 i
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _.