ML13330A391

Forwards Contractor Draft Technical Evaluation & NRC Safety Evaluation of SEP Topic VI-10.A Re Testing of Reactor Trip Sys & Esf.Proposes Mods to Tech Specs & Equipment to Implement Response Testing Program

ML13330A391
Person / Time
Site:	San Onofre
Issue date:	08/28/1981
From:	Crutchfield D Office of Nuclear Reactor Regulation
To:	Dietch R Southern California Edison Co
References
TAC-62079, TASK-06-10.A, TASK-6-10.A, TASK-RR LSO5-81-08-085, LSO5-81-8-85, NUDOCS 8109040111
Download: ML13330A391 (19)

Text

August 28, 1981 Docket No. 50-206 LSO5 08-085 Mr. R.

Dietch, Vice President

/

Nuclear Engineering and Operations g

Southern California Edison Company 2244 Walnut Grove Avenue Post Office Box 800 Rosemead, California 91770

SUBJECT:

SEP TOPIC VI-10.A, TESTING OF REACTOR TRIP SYSTEM AND ENGINEERED SAFETY FEATURES, INCLUDING RESPONSE TIME TESTING, DRAFT SAFETY EVALUATION FOR SAN ONOFRE is our contractor's draft Technical Evaluation of this topic. is a draft staff safety evaluation based on Enclosure 1. supports the findings of Enclosure 1 and proposes modifications to the Technical Specifications and some equipment to implement a response time testing program.

The need to actually Implement these changes will be determined during the integrated safety assessment. This topic assessment may be re9Ised in the future if your facility design is changed or if NRC criteria relating to this topic are modified before the integrated assessment is completed.

Sincerely, Dennis M. Crutchfield, Chief Operating Reactors Branch No. 5 Division of Licensing

Enclosures:

As stated cc w/enclosures:

4uq See next page 8109040111 810828 IPDR ADOCK 050002 6 O g S

DL SEPB:DL

/

SEPB:DL RB#

PM 0

CD L

OFFICE

.i#

1:k RHerman Ru 4

tssel1 SNo i

DC cfield GL inas SURNAME Ow.

. c i,

in..

................ 1.

. 8 Y 1I.

DATE R.M 0O ILR DP.

1 1..............

NRC FORM 318 (10-80) NRCM 0240 OFF IC IAL RE CORD COPY USGPO: 1981-335-960

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D. C. 20555 August 28, 1981 Docket No.

50-206 LS05-81-08-085 Mr. R. Dietch, Vice President Nuclear Engineering and Operations Southern California Edison Company 2244 Walnut Grove Avenue Post Office Box 800 Rosemead, California 91770

SUBJECT:

SEP TOPIC VI-10.A, TESTING OF REACTOR TRIP SYSTEM AND ENGINEERED SAFETY FEATURES, INCLUDING RESPONSE TIME TESTING, DRAFT SAFETY EVALUATION FOR SAN ONOFRE is our contractor's draft Technical Evaluation of this topic. is a draft staff safety evaluation based on Enclosure 1. supports the findings of Enclosure 1 and proposes modifications to the Technical Specifications and some equipment to implement a response time testing program.

The need to actually implement these changes will be determined during the integrated safety assessment. This topic assessment may be revised in the future if your facility design is changed or if NRC criteria relating to this topic are modified before the integrated assessment is completed.

Sincerely, Dennis M. Crutchfield, ief Operating Reactors Bra ch No. 5 Division of Licensing

Enclosures:

As stated cc w/enclosures:

See next page

Mr. R. Dietch cc Charles R. Kocher, Assistant General Counsel James Beoletto, Esquire Southern California Edison Company Post Office Box 800 Rosemead, California 91770 David R. Pigott Chickering & Gregory Three Embarcadero Center Twenty-Third Floor San Francisco, California 94111 Harry B. Stoehr San Diego Gas & Electric Company P. 0. Box 1831 San Diego, California 92112 Resident Inspector/San Onofre NPS c/o U. S. NRC P. 0. Box 4329 San Clemente, California 92672 Mission Viejo Branch Library 24851 Chrisanta Drive Mission Viejo, California 92676 Mayor City of San Clemente San Clemente, California 92672 Chairman Board of Supervisors County of San Diego San Diego, California 92101 California Department of Health ATTN:

Chief, Environmental Radiation Control Unit Radiological Health Section 714 P Street, Room 498 Sacramento, California 95814 U. S. Environmental Protection Agency Region IX Office ATTN: EIS COORDINATOR 215 Freemont Street San Francisco, California 94111 0487J SEP TECHNICAL EVALUATION TOPIC VI-10.A TESTING OF REACTOR TRIP SYSTEM AND ENGINEERED SAFETY FEATURES SAN ONOFRE NUCLEAR GENERATING STATION, UNIT NO. 1 Docket No. 50-206 July 1981 7-21-81

CONTENTS

1.0 INTRODUCTION

2.0 CRITERIA...........................................................

1 3.0 REACTOR TRIP SYSTEM................................................

4 3.1 Description.................................................

4 3.2 Evaluation.................................................... 4 4.0 CONTAINMENT SPRAY SYSTEM...........................................

8 4.1 Description...............................................

8 4.2 Evaluation................................................. 8 5.0

SUMMARY

........................................................... 11

6.0 REFERENCES

......................................................... 11 TABLES

1. Comparisons of San Onofre Unit 1 RTS instrument surveillance requirements with PWR Standard Technical Specification requirements...................................................... 5

2. Containment spray system and associated system surveillance requirements................................................ 9 11

SEP TECHNICAL EVALUATION TOPIC VI-10.A TESTING OF REACTOR TRIP SYSTEM AND ENGINEERED SAFETY FEATURES SAN ONOFRE NUCLEAR GENERATING STATION, UNIT NO. 1

1.0 INTRODUCTION

The objective of this review is to determine if all reactor trip system (RTS) components, including pumps and valves, are included in component and system tests, if the scope and frequency of periodic testing is adequate, and if the test program meets current licensing criteria. The review will also address thTse same matters with respect to the containment spray (CS) system as a typical example of all engineered safety feature (ESF) systems.

2.0 CRITERIA General Design Criterion 21 (GDC 21), "Protection System Reliability and Testability," states, in part, that:

The protection system shall be designed to permit periodic testing of its functioning when the reactor is in operation, including a capab.ility to test channels independently todetermine failure and losses of redundancy that may have occurred.

Regulatory Guide 1.22, "Periodic Testing of the Protection System Actuation Functions," states, in Section D.l.a, that:

The periodic tests should duplicate, as closely as practicable, the performance that is required of the actuation devices in the event of an accident; and further, in Section D.4, it states that:

When actuated equipment is not tested during reactor operation, it should be shown that:

a. There is no practicable system design that would permit.operation of the actuated equipment without adversely affecting the safety or operability of the plant,

b. The probability that the protection system will fail to initiate the operation of the actuated equipment is, and can be maintained, acceptably low without testing the actuated equipment during reactor operation, and

c. The actuated equipment can be routinely tested when the reactor 2

is shut down.

IEEE Standard 338-1977, "Periodic Testing of Nuclear Power Generating Station Class 1E Power and Protection Systems," states, in part, in Section 3:

Overlap testing consists of channel, train, or load-group verification by performing individual tests on the various components and subsystems of the channel, train, or load group. The individual component and subsystem tests shall check parts of adjacent subsystems, such that the entire channel, train or load group will be verified by testing of 3

individual components or subsystems.

and, in part, in Section 6.3.4:

Response time testing shall be required only on safety systems or sub systems to verify that the response times are within the limits of the overall response times given in the Safety Analysis Report.

Sufficient overlap shall be provided to verify overall system response.

The response-time test shall include as much of each safety system, from sensor input to actuated equipment, as is practicable in a single test. Where the entire set of equipment from sensor to actuated equip ment cannot be tested at once, verification of system response time shall be accomplished by measuring the response times of discrete 2

portions of the system and showing that the sum of the response times of all is within the limits of the overall system requirement.

In addition, the following criteria are applicable to the ESF:

General Design Criterion 40 (GDC 40), "Testing of Containment Heat Removal System," states that:

The containment heat removal system shall be designed to permit appro priate periodic pressure and functional testing to assure:

a. The structural and leaktight integrity of its components.

b. The operability and performance of the active components of the system.

c. The operability of the system as a whole and under conditions as close to the design as practical, the performance of the full operational sequence that brings the system into operation, including operation of applicable portions of the protection systems, the transfer between normal and emergency power sources,

4 and the operation of the associated cooling water system.

GOC 38, "Testing of Emergency Core Cooling System," GOC 43, "Testing of Containment Atmosphere Cleanup Systems and GDC.46, "Testing of Cooling Water System," are similar.

Standard Review Plan, Section 7.3, Appendix A, "Use of IEEE Standard 279 in the-Review of the ESFAS and Instrumentation and Controls of Essential Auxiliary Supporting Systems," states, in Section ll.b, that:

Periodic testing should duplicate, as closely as practical, the inte grated performance required from the ESFAS, ESF systems, and their essential auxiliary supporting systems. If such a "system level" test can be performed only during shutdown, the testing done during power operation must be reviewed in detail.

Check that "overlapping" tests do, in fact, overlap from one test segment to another... For example, 3

closing a circuit breaker with the manual breaker control switch may not be adequate to test the ability of the ESFAS to close the 6

breaker.

3.0 REACTOR TRIP SYSTEM (RTS) 3.1 Description. The system contains two logic channels, each having subchannels of tripping devices.

Each subchannel has an input from at least one independentsensor, monitoring each of the critical parameters.

The channel output signal operates the reactor trip breakers by both the undervoltage and the trip coils.

The subchannel parameter and degree of redundant logic are:

a) High flux level (1 of 4),

b)

Safety injection (1 of 4),

c) Manual reactor trip (1 of 2),

d)

High pressurizer pressure (2 of 3),

e) High pressurizer level (2 of 3),

f)

Steam feedwater flow mismatch (2 of 3),

g) Loss of reactor coolant flow permissive with reactor coolant pump breaker open (2 of 3) (above 50% reactor power),

h) Loss of reactor coolant flow permissive with reactor coolant pump breaker open (2 of 3) (above 10% reactor power),

i) Turbine trip (2 of 3),

j) Low pressurizer pressure (2 of 3) (calculated from the average coolant temperature), and k) Start up rate excessive (1 of 2)

Should any of the above conditions occur,.the gravity driven control and shutdown rods insert when the reactor trip breaker opens.

3.2 Evaluation. Table 1 shows the present San Onofre Unit No. 1 RTS instrument surveillance requirements, incluoing frequency. The table also 4

TABLE 1. COMPARISONS OF SAN ONOFRE UNIT 1 RTS INSTRUMENT SURVEILLANCE REQUIREMENTS1 WITH PWR STANDARD TECHNICAL SPECIFICATION REQUIREMENTS (STS)6 (page one of three)

Channel Channe FunctioS al Channel c Check Test Calibration San Onofre San Onofre San Onofre Instrument Channel Unit 1 STS Unit 1 STS Unit 1 STS Manual NA SU NA Power range neutron S

NA M

d D

flux (heat balance)

Power range neutron NA M

R flux rate Intermediate range Sd S

SU SU R

neutron flux Source range neutron Sd S

SU M&SU R

flux Overtemperature AT S

M R

(reactor coolant (S)

(BW)

(R) temperature).

Overpower.AT S

M R

(variable low pressure (S)

(NA)

(R) calculator)

Pressurizer pressure S

S BW M

R R

low Pressurizer pressure S

S BW M

R R

high Pressurizer water S

S BW M

R R

level high Loss of flow-1 loop S

S Q

M R

R

-2 loop S

S NA NA R

R Steam generator S

M R

water level low low 5

TABLE 1. (continued) (page two of three)

Channel Channe Functioal Channel Check Test Calibration San Onofre San Onofre San Onofre Instrument Channel Unit 1 STS Unit 1 STS Unit 1 STS Steam/feedwater NA S

BW/SU M

R R

flow mismatch and low steam generator water level Undervoltage-reactor NA NA NA M

NA R

coolant pumps Under frequency-reactor NA NA NA M

NA R

coolant pumps Turbine.trip-low fluid NA SU NA oil pressure Turbine trip-Turbine NA SU NA stop valve closure Safety injection NA M (automatic) --

NA R (manual)

Reactor coolant pump e

NA e

R e

NA breaker open Reactor trip breaker NA AM&SU NA Automatic trip logic NA AM NA FREQUENCY NOTATION Notation Frequency Notation Frequency S

At least once per R

At least once per refueling 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> outage (18 months)

D At least once per NA Not applicable 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> SA At least once per 184 days BW At least once per SU Prior to start up 14 days 6

TABLE 1. (continued) (page three of three)

FREQUENCY NOTATION Notation Frequency Notation Frequency M

At least once per AM Alternate channels 31 days tested on a stag ged basis at least Q

At least once per once per 62 days.

3 months

a. A qualitative determination of acceptable operability by observation of channel behavior during operation. This determination shall include, where possible, comparison of the channel with other independent channels measuring the same variable.

b. Injection of a simulated signal into the channel to verify its proper response including, where applicable, alarm and/or trip initiating action.

c. Adjustment of channel output such.that it responds, with acceptable range and accuracy, to known values of the parameter which the channel measures. Calibration shall encompass the entire channel, including equip ment actuation, alarm, or trip.

d. When channels are in operation.

e. Part of loss of flow surveillance.

shows the current licensing requirements for Westinghouse pressurized water reactors as listed in the standard technical specifications.

In comparing the instrument channels that can cause a reactor trip at San Onofre Unit No.. I with the surveillance-requirements that are in the unit technical specifications (Table 4.1.1), it appears that the following channels are not checked, tested or calibrated: manual, start up rate excessive, safety injection and turbine trip. Additionally, there are channels called out in the standard technical specifications that San Onofre Unit No.. 1 does not use for a reactor trip signal.

The San Onofre Unit No. '1 technical specifications require the channel functional test for loss of flow quarterly, while.the standard technical 7

specifications require this monthly. Additionally, the power range neutron flux channels do not have a channel functional test and the intermediate and source range neutron flux channels are not required to be calibrated by technical specifications.

The standard technical specifications for Westinghouse pressurized water reactors (page 3/4 3-1, paragraph 4.3.1.2) require the logic system response time testing at least every 18 months. Response time testing to verify that the channel response time does not exceed the required response time is not in the San Onofre Unit No. 1 technical specifications.

4.0 CONTAINMENT SPRAY SYSTEM 4.1 Description. The containment spray system is designed to spray a borated water solution into the containment atmosphere. This is done to reduce the pressure within the containment sphere and to reduce the fission product decay heat of.the containment atmosphere. Two refueling pumps also serve as containment spray pumps. The pumps have access to borated water in the refueling water storage tank and in the containment sump, via the recirculation heat exchanger. These water sources are the same as used for the safety injection and the recirculation systems. The recirculation heat exchanger is cooled by the component cooling water system, which in turn is cooled by the salt water cooling system.

4.2 Evaluation. Table 2 shows the current testing requirements for the containment spray system and associated systems. The following sur veillence is not done at least as frequently as required for present day licensing:

Refueling water storage tank volume and concentration.

Refueling water storage tank temperature (however, even at the lowest expected ambient temperature, precipitation is not expected).a

a. Since the tank is.

not heated, and the worst expected ambient temper ature will not cause precipitation, checking the tank temperature is not necessary.

8

TABLE 2. CONTAINMENT SPRAY SYSTEM SURVEILLANCE REQUIREMENTS Frequency San Onofre Surveillance Requirements Unit 1 STS Containment Spray

1. Verify correct valve position, not locked or M

M sealed.

2.. Test for discharge pressure.

M a

3. Verify correct automatic valve operation on a R

R test signal.

4. Verify automatic spray pump start on a test R.

R signal.

5. Air or smoke flow test to verify that each b

b spray is unobstructed.

Refueling Water Storage Tank

6. Volume and concentration.

c W

7. Temperature.

d Dd Component Cooling Water System

8. Verify correct valve position, not locked or M

sealed.

9. Verify correct automatic valve operation on a R

test signal.

Salt Water Cooling System

10. Verify correct valve position, not locked M

or sealed.

11.

Verify correct automatic valve operation.

R on a test signal.

Ultimate Heat Sink

12.

Level within limits.

D

13.

Temperature within limits.

D 9

TABLE 2.

(continued)

Frequency San Onofre Surveillance Requirements Unit 1 STS Containment Spray Actuation Signals

14.

High containment pressure high high.

DeMf

15.

Manual.

NA

a. Surveillence interval as specifiec in Section XI, AS1E Boiler and Pressure Vessel Code.

b. At least once per 5 years per standard technical specification; San Onofre Unit 1 technical specifications require this test every other refueling outage.

c. While the volume and concentration are specified in the San Onofre Unit 1 technical specification Section 3.3.3, the frequency of surveillance is not specified.

d. When ambient temperature is less than 35*F for standard technical speci fication; San Onofre Unit 1 technical specifications Section 3.3. 3, do not require testing as the sustained. ambient temperature does not go below 320F.

e. Channel calibration and response time testing.

f. Channel Functional Test.

The San Onofre. Unit No. 1 technical specifications do not agree with the present standard technical specifications further in that:

1. The component cooling water system is not under surveillance,

2. The salt water cooling system is not under surveillance, and

3. The ultimate heat sink is not under surveillance.

10

5.0

SUMMARY

The Technical Specifications for San Onofre Unit No. 1 were compared with the standard technical specifications for current pressurized water reactor licensing. It was found.that, for the reactor trip system, one signal is not subjected to a channel functional test as frequently as required in the standard technical specifications (see Section.3.2.); seven channels are not checked, tested or calibrated as required in the standard technical specifications; and several channels that are part of the RTS for the standard technical specifications are not part of the San Onofre Unit No. 1 RTS. Additionally, the channel response time between channel trip and the operation of the reactor trip relay is not required to be tested.

For the Containment Spray System, selected as typical of ESF systems, surveillance requirements were non-existent for systems that are required to operate in support of the containment spray system. (See Section 4.2.)

6.0 REFERENCES

1..

General Design Criterion 21, "Protection System Reliability and Test ability," of Appendix A, "General Design Criteria of Nuclear Power Plants," 10 CFR Part 50, "Domestic Licensing of Production and Utili zation Facilities."

2. Regulatory Guide 1.22, "Periodic Testing of the Protection System Actuation Functions."

3.

IEEE Standard 338-1975, "Periodic Testing of Nuclear Power Generating Station Class 1E Power and Protection Systems."

4. General Design Criterion 40, "Testing of Containment Heat Removal Systems," of Appendix A, "General Design Criteria of..Nuclear Power Plants," 10 CFR Part 50, "Domestic Licensing of Production and Utili zation Facilities."

5. Nuclear Regulatory Commission Standard Review Plan, Section 7.3, Appendix A, "Use of IEEE Standard 279 in the Review of the ESFAS and Instrumentation and Controls of Essential Auxiliary Supporting Systems."

6. Standard Technical Specifications for Westi.nghouse Pressurized Water Reactors, NUREG-0452, Revision 3, September, 1980.

7. San Onofre Nuclear Generating Station-Unit No. 1, "Final Safety Analysis Report."

8.

Technical Specifications and Bases for San Onofre Nuclear Generating Station Unit 1, Appendix A, to. Provisional Operating License DPR-21, Amendments 1 through 56, Section 3.3, 4.1 and 4.2.

12 SYSTEMATIC EVALUATION PROGRAM TOPIC VI-10.A SAN ONOFRE TOPIC:

VI-10.A, TESTING OF REACTOR TRIP SYSTEM AND ENGINEERED SAFETY FEATURES, INCLUDING RESPONSE TIME TESTING I.

INTRODUCTION The purpose of this Topic is to review the reactor trip system (RTS) and engineered safety features (ESF) test program for verification of RTS and ESF operability on a periodic basis and to verify RTS and ESF response time in order to assure the operability of the RTS and ESF. Response times should not exceed those assumed in the plant accident analyses.

Accordingly, the test program of the RTS and ESF was reviewed in accord ance with the Standard Review Plan, including applicable Branch Technical Positions.

II. REVIEW CRITERIA The review criteria are presented in Section 2 of EG&G Report 0487J, "Testing of Reactor Trip System and Engineered Safety Features, Including Response Time Testing."

III.

RELATED SAFETY TOPICS AND INTERFACES Topic VI-7.A.3 discusses the question of' testing protection systems under conditions as close to design condition as practical.

There are no topics that are dependent on the present topic information for their completion.

IV. REVIEW GUIDELINES Review guidelines are presented in Sections 3 and 4 of Report 0487J.

V. EVALUATION The Technical Specifications for San Onofre Unit No. 1 were compared with the standard technical specifications for current pressurized water reactor licensing. It was found that, for the reactor trip system, one signal is not subjected to a channel functional test as frequently as required in the standard technical specifications; seven channels are not checked, tested or calibrated as required in the standard technical specifications; and several channels that are part of the RTS for the standard technical specifications are not part of the San Onofre Unit 1 RTS. Additionally, the channel response time between channel trip and the operation of the reactor trip relay is not required to be tested.

-2 For the Containment Spray System, selected as typical of ESF systems surveillance requirements were non-existent for systems that are required to operate in support of the containment spray system.

VI.

CONCLUSION It is the staff's position that the design of systems which are required for safety shall include provisions for periodic verification that the minimum performance of instruments and control is not less than that which was assumed in the safety analyses. The bases for this position are Gen eral Design Criterion 21, Section 3.9 of IEEE Std. 279-1971, and IEEE Std. 338-1977. Therefore, the licensee should implement a program for response time testing of all reactor protection systems (including engineered safe ty features systems such as containment isolation).

In addition, the licensee should amend the Technical Specifications to correct for the other omissions noted in our contractor's report.