ML14190A858
| ML14190A858 | |
| Person / Time | |
|---|---|
| Site: | Robinson  |
| Issue date: | 04/01/1985 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML14190A857 | List: |
| References | |
| GL-83-028 NUDOCS 8504220427 | |
| Download: ML14190A858 (19) | |
Text
.CLOSURE SAFETY EVALUATION REPORT H. B. ROBINSON 2 GENERIC LETTER 83-28, ITEM 4.3 REACTOR TRIP BREAKER AUTOMATIC SHUNT TRIP INTRODUCTION AND
SUMMARY
Generic Letter 83-28 was issued by NRC on July 8, 1983, indicating actions to be taken by licensees based on the generic implication of the Salem ATWS events.
Item 4.3 of the generic letter requires that modifications be made to improve the reliability of the Reactor Trip System by implementation of an automatic actuation of the shunt attachment on the reactor trip breakers. By letters dated December 27, 1984, and February 18, 1985, the licensee, Carolina Power and Light Company (CP&L), provided responses to the plant-specific questions identified by the staff in its August 10, 1983, Safety Evaluation Report of the generic Westinghouse design. The staff has reviewed the licensee's pro posed design for the automatic actuation of the reactor trip breaker shunt trip attachments and finds it acceptable, except as noted in the SER.
The licensee has already implemented the shunt trip modifications during Steam Generator replacement outage.
EVALUATION The following required plant-specific information items were identified based on the staff's review of the WOG proposed generic design for this modification:
850 4220427 850401 PDR ADOCK 05000261 P
-2
- 1. Provide the electrical schematic/elementary diagrams for the reactor trip and bypass breakers showing the undervoltage and shunt coil actuation circuits as well as the breaker control (e.g., closing) circuits, and circuits providing breaker status information/alarms to the control room.
The licensee provided the electrical schematic diagrams for the reactor trip and bypass breakers showing the undervoltage and the shunt trip circuits.
The design of the electrical circuits for the automatic actuation of the shunt trip attachment have been reviewed and found to be consistent with the WOG generic proposed design which was previously reviewed and approved by the staff. However, the licensee's design deviates from the generic design in two areas. The first is the use of key operated test switches in lieu of push button switches to test and to block the auto shunt trip circuits. We find this to be acceptable. The second is that the design does not include remote breaker position indication on the main control board for the bypass breakers.
Bypass breaker position indication is provided on the protection system racks, however, the position indicating lights are not interlocked with breaker cell switches. The staff finds this is inconsistent with the typical schematics provided with WOG generic design which included bypass breaker status indication including the cell switch interlock for all remote bypass breaker position indication. In response to staff's concern, the licensee in its submittal of February 18, 1985, indicated that it is not necessary to provide indication of the bypass breaker on the main control board as it is not used as a first indication of a successful reactor trip. Information on the exact breaker position is recorded on the computer (sequence of events) which is available in the control room. Because the capability of the control room
3, operator to readily determine this open-closed position status of the bypass breaker is safety significant as noted in the enclosed staff position on this matter, it is the staff's position that bypass breaker position status lights should be provided on the main control board including the cell switch interlock for all remote breaker position indication.
Based on our review of the plant specific aspects of the design, we conclude that the licensee should revise the design to include the provision of status lights on the main control board for the bypass breakers including the interlock for all remote breaker position indication.
- 2. Identify the power sources for the shunt trip coils. Verify that they are Class 1E and that all components providing power to the shunt trip circuitry are Class 1E and that any faults within non class 1E circuitry will not degrade the shunt trip function.
Describe the annunciation/indication provided in the control room upon loss of power to the shunt trip circuits. Also describe the overvoltage protection and/or alarms provided to prevent or alert the operator(s) to an overvoltage condition that could affect both the UV coil and the parallel shunt trip actuation relay.
Redundant Class 1E power sources are used to actuate the shunt trip of the reactor trip breakers and the shunt trip of the bypass breakers. The exist ing components in the shunt trip circuits are either Class 1E or will not affect the operation of the shunt trip mechanism should they fail.
The shunt trip coils are currently being upgraded to Class 1E through the Westing house qualification program. We find this to be acceptable.
-4 The breaker position status lights are used to supervise the availability of power to the shunt trip circuits. The red light which is connected in series with the shunt coil and the "a" auxiliary contact indicates that the breaker is closed and also indicates that the power is available to the shunt trip device and, therefore provides detectability of power failure to the shunt trip coil.
Also, normally open auxiliary contacts of the breakers provide breaker status information to the plant computer. The shunt trip coils and associated circuitry in the reactor trip breakers are powered from 125 Vdc system. The maximum available voltage occurs during a battery equalizing charge at a maximum voltage of 115% of the nominal voltage. An overvoltage relay, set at 115% of 125 Vdc, is provided to shut down the battery charger if the voltage on the battery exceeds the 140 Vdc level used for equalizing.
The added shunt trip circuitry is powered from the reactor protection logic voltage supply (125 Vdc).
Components in the added shunt trip circuitry have been selected based on their ability to perform their intended function up to 115% of nominal voltage.
Based on our review, we conclude that appropriate consideration has been given to the aspects of the design described above and the design is, therefore, acceptable.
-5
- 3. Verify that the relays added for the automatic shunt trip function are within the capacity of their associated power supplies and that the relay contacts are adequately sized to accomplish the shunt trip function. If the added relays are other than the Potter & Brumfield MDR series relays (P/N 2383A38 or P/N 955655) recommended by Westing house, provide a description of the relays and their design specifica tions.
The added relays specified by Westinghouse for the automatic shunt trip func tion are the Potter and Brumfield MDR series relays (P/N 2383A38 for 125 Vdc).
The design includes the Potter and Brumfield MDR series relays as specified in the WOG generic design for the automatic shunt trip function. The relay con tacts are adequately sized to accomplish the shunt trip function. We find that this aspect of the design is acceptable.
- 4. State whether the test procedure/sequence used to independently verify operability of the undervoltage and shunt trip devices in response to an automatic reactor trip signal is identical to the test procedure proposed by the Westinghouse Owners Group (WOG).
a Identify any differences between the WOG test procedures and the test procedures to be used and provide the rationale/justification for these differences.
-6 The licensee notes that the generic test procedure proposed by WOG was used as a basis to develop test procedures to independently confirm the operability of the undervoltage and shunt trip devices in response to an automatic shunt trip signal.
We find this to be acceptable.
- 5. Verify that the circuitry used to implement the automatic shunt trip function is Class 1E (safety related), and that the procurement, in stallation, operation, testing and maintenance of this circuitry will be in accordance with the quality assurance criteria set forth in Appendix B to 10 CFR Part 50.
The licensee states that the circuitry used to implement the automatic shunt trip function will be Class 1E, (safety related) and the procurement, installation, operation, testing and maintenance of this circuitry will be in accordance with the quality assurance criteria set forth in Appendix B to 10 CFR Part 50. We find this to be acceptable.
- 6. Verify that the shunt trip attachments and associated circuitry are/
will be seismically qualified (i.e., be demonstrated to be operable during and after a seismic event) in accordance with the provisions of Regulatory Guide 1.100, Revision 1 which endorses IEEE Standard 344, and that all non-safety related circuitry/components, in physical proximity to or associated with the automatic shunt trip function, will not degrade this function during or after a seismic event.
-7 The licensee has seismically qualified the MDR series automatic shunt trip relays and the test switches. The WOG is working with Westinghouse to obtain seismic qualification of the shunt trip attachments. Upon completion of the WOG qualification program, CP&L will review the results and will take appropri ate action. There will not be any nonsafety-related circuitry/components in the physical proximity to, or associated with, the automatic shunt trip function to degrade this function during or after a seismic event. We find this to be acceptable.
- 7. Verify that the components used to accomplish the automatic shunt trip function are designed for the environment where they are located.
The licensee has verified that the plant specific environmental conditions defined in the WOG generic design package Table 1 envelope H. B. Robinson requirements. We find this is acceptable.
- 8. Describe the physical separation provided between the circuits used to manually initiate the shunt trip attachments of the redundant reactor trip breakers. If physical separation is not maintained between these circuits, demonstrate that faults within these circuits cannot degrade both redundant trains.
-8 The licensee states that there is physical separation between the Train 'A' and 'B' circuits used to manually initiate a shunt trip. At the main control board the train 'A' and train 'B' signals are in separate metal braid enclosed cables. The cables are then routed in separate train 'A' or 'B' cable trays.
At the switchgear, the relay compartment has a metal barrier between the train
'A' side and the train 'B' side. We find this meets the requirements of Regulatory Guide 1.75 and is, therefore, acceptable.
- 9. Verify that the operability of the control room manual reactor trip switch contacts and wiring will be adequately tested prior to startup after each refueling outage. Verify that the test procedure used will not involve installing jumpers, lifting leads, or pulling fuses and identify any deviations from the WOG procedure. Permanently installed test connections (i.e., to allow connection of a voltmeter) are acceptable.
The licensee states that the control room manual reactor trip switch contacts used to open the UV coils circuit for both the reactor trip breakers and bypass breakers are tested by monitoring the voltage across the UV coil.
The mon itoring of the voltage across the shunt trip coils is not performed. The current test procedure uses jumpers between the terminals to block the reactor trip condition and to keep the UV trip device energized during the test. Since this testing could be performed in a manner which would not require the use of
-9 jumpers, we found that the existing procedure was unacceptable. In response to the staff's concern, the licensee in its February 18, 1985, submittal noted that in addition to the independent check on jumper removal, a functional test will be performed to verify that the jumpers have been removed. Since a functional test will be performed to confirm the removal of the jumpers and will be incorporated into the existing procedure prior to its use during the next refueling outage, we find this to be acceptable.
- 10. Verify that each bypass breaker will be tested to demonstrate its operability prior to placing it into service for reactor trip breaker testing.
The licensee in its February 18, 1985, submittal indicated that it has incorporated appropriate changes to the existing procedure to provide an under voltage trip of the bypass breakers prior to placing them in service. We find this to be acceptable.
- 11.
Verify that the test procedure used to determine reactor trip breaker operability will also demonstrate proper operation of the associated control room indication/annunciation.
01 10 The licensee states that the test procedure used to determine reactor trip breaker operability also demonstrates proper operation of the associated con trom room indication/annunciation. The red light indicates that the breaker is closed and the green light indicates that the breaker is open. The licensee should confirm that the test used to determine the bypass breaker operability will also demonstrate proper operation of the main control board position indication.
- 12.
Verify that the response time of the automatic shunt trip feature will be tested periodically and shown to be less than or equal to that assumed in the FSAR analyses or that specified in the technical speci fications.
The licensee states that the response time of the breakers tripped by the UVTAs is measured to verify that the response time is not greater than 167 milliseconds. Theesionse time of the breakers tripped by the STAs is not periodically being tested as part of the maintenance program. Upon final completion of the WOG life cycle testing of the STAs and UVTAs, CP&L will evaluate the results and determine, as appropriate, necessary revisions to the maintenance program. We find this commitment to be acceptable.
- 13.
Propose technical specification changes to require periodic testing of the undervoltage shunt trip functions and the manual reactor trip switch contacts and wiring.
The licensee states that monthly on-line testing of automatic shunt trip and undervoltage trip is performed as addressed in the technical specifications.
However, the technical specifications do not explicitly state that the periodic testing of the undervoltage and shunt trip functions will be done independently.
Additional guidance on these changes will be provided to the licensees. Since, the shunt trip modifications have already been implemented, the staff will require proposed technical specification appropriate for this change to the trip system design.
CONCLUSION Based on the review of the licensee's response to the plant specific questions identified in the staff's evaluation of the proposed design modifications, we find that the proposed modifications are acceptable however the staff's reso lution of this matter is conditioned on the following:
(a) Submission of revised information including revised electrical schematics showing:
(i) provision of bypass breaker position status lights on the main control board.
12 (ii) inclusion of cell switch interlock for bypass breaker position indication as detailed in item 1.
This item remains open pending the staff's review.
(b) Confirmation that shunt trip components have been seismically qualified as committed to in item 6.
(c) Confirmation that bypass breaker testing will demonstrate proper operation of control board bypass breaker position indication as identified in item 11.
(d) Submission of proposed technical specifications noted in item 13, following implementation of this modification.
With regard to the staff's position on bypass breaker status indication noted in item (a) above, these modifications should be implemented during the next refueling outage.
ENCLUftX ICSB SALP INPUT A
PLANT:
H. B. Robinson 2
SUBJECT:
REVIEW OF DESIGN FOR AUTOMATIC SHUNT TRIP FOR REACTOR TRIP BREAKERS ION PERFORMIANCE BASIS EVALUATIO CATEGORY CRITERIA CA TEGOR Direct communication was established with the licensee which permitted
- 1. Management 2
prompt action to resolve some of the concern.
Involvement S
- 2. Approach to 2
An understanding of the issue was demonstrated.
Resolution of Technical Issues
- 3.
Responsiveness 2
The licensee did not submit the revised submittal in response to NRC initiatives which precluded a timely resolution of this matter.
- 4. Enforcement N/A No basis for assessment.
History 2
The reporting of the design modifications for automatic shunt trip Rfor reactor trip breakers was complete, however, the licensee failed to
- eresuhmit its desiwn.
- 6.
Staffing N/A No basis for assessment.
- 7. Training N/A No basis for assessment.
STAFF POSITION ON REACTOR TRIP BYPASS BREAKER POSITION INDICATION BACKGROUND:
The design of the Reactor Trip System (RTS) for Westinghouse plants includes two reactor trip breakers located in series with the holding power for the control rod drive units. On a reactor trip, power is removed from the control rods by the opening of either reactor trip breaker. The majority of Westinghouse plants include bypass breakers to permit on-line testing of the reactor trip breakers. During testing, the bypass breaker maintains power to the control rod drives when a reactor trip breaker is opened to confirm its operability.
When a reactor trip breaker is bypassed by the closure of the bypass breaker, a reactor trip is dependent on the operability of the remaining reactor trip breaker and its associated protection system logic. The reliability of the reactor trip system during testing is enhanced by the fact that the bypass breaker which is closed, would also be tripped by an automatic trip signal to the inservice reactor trip breaker. Thus, the trip of the bypass breaker provides further assurance for the removal of power from the control rod drives during testing.
In addition to the removal of power from the control rod drives to effect control rod insertion on a reactor trip, th eositibn of the reactor trip and bypass breakers is monitored to provide signals to the P-4 interlock. The P-4 interlock is used as a permissive to reset or block a safety injection signal, to initiate a turbine trip on a reactor trip, and as an interlock for feedwater isolation on low Tavg. The P-4 interlock is also used as an interlock in the steam dump control system for some plants. The use of breaker position
I 2
-2 switches for these safety functions provides greater assurance that they are initiated regardless of the event that initiated a reactor trip, e.g., auto matic, manual, or component or RTS power system failure. The logic for the P-4 interlock is such that the P-4 interlock condition only exists when both the reactor trip breaker and its bypass breaker are in the open position.
Further the P-4 interlock signal for Train A (B) of the protection system logic is only derived.from the train A (B) reactor trip and bypass breakers.
Thus, the automatic trip of bypass breakers during testing also enhances the reliability of the P-4 interlock functions.
DISCUSSION:
In response to Generic Letter 83-28 the Westinghouse Owners Group submitted a proposed generic design modification to include automatic actuation of the shunt trip attachments for the reactor trip breakers. In the generic design package, the argument was set forth that the addition of the automatic shunt trip to the bypass breakers is not necessary since there is little benefit and a high expense for adding the automatic shunt trip to the bypass breakers.
In its evaluation of the generic design, the staff accepted the Owners Group basis for exclusion of an automatic shunt trip of the bypass breakers. How ever, the staff noted that the operability of each bypass breaker would be required prior to it being placed in service. Since the outline of the test procedures included in the WOG submittal did not address testing of bypass breakers, this is a matter which was addressed in plant specific reviews of the plant design modifications.
With respect to reactor trip breaker position indication, the staff requested confirmation on a plant specific bases that the surveillance procedures
-3 include verification of the reactor trip breaker status position indication lights during testing of the reactor trip breakers.
During the review of plant specific design modifications, two basis schemes were noted to exist for the majority of the Westinghouse plants with regards to the control and operation of bypass breakers.
For the older Westinghouse plants which generally have the relay protection system logic design, the con trol scheme for the bypass breakers include push button control switches and breaker status indicating lights at the reactor protection system racks. One push button switch is used to close the bypass breaker and the other is wired in series with the undervoltage trip coil to trip the bypass breaker. For some plants, the rack push button switch is wired to the shunt trip coil to trip the bypass breaker. Due to a breaker cell switch interlock, power is generally only available to the indicating lights and closing circuit when the breaker is in the operate position. Two push button control switches are also provided locally at the breaker. One push button is wired to the closing cir cuit and the other is wired to the shunt trip coil.
Due to a cell switch interlock, power is only available to the local control circuits when the breaker is in the test position.
For the newer Westinghouse plants which generally have the solid state pro tection system logic, the control scheme for the bypass breakers includes only the local push button closing and shunt trip functions, however, power is available to these control circuits when the breaker is in either the operate or test position. Further, the control circuit differs from that of older
I--4
-4 plants in that the shunt trip attachment of the bypass breakers is actuated via the manual reactor trip switches on the main control room control board.
With respect to bypass breaker position indication, the majority of the Westinghouse plants have bypass breaker status lights on the main control board in addition to reactor trip breaker position indication. In those cases where position indication has not been provided on the main control board, the staff has taken the position that it should be provided as a part of the upgrade for the automatic actuation of the shunt trip attachments of the reactor trip breakers.
The bases for the staff position are the following:
- 1. During normal plant operation the bypass breakers are racked out. In this situation the absence of breaker position indication, both red and green position lights extinguished, confirms that the breaker is in the racked out position. This reduces the potential for inadvertent operation of a bypass breaker.
- 2. During reactor trip breaker testing, the plant operator has direct status indication that a bypass breaker is closed and therefore one train of the RTS is in a bypassed condition. If a reactor trip should occur or be initiated during testing, the operator can directly deter mine that each reactor trip and bypass breaker is in the open position.
Breaker position status is safety significant not only with regards to
-5 control rod insertion, but also due to safety actions initiated by the.
P-4 interlock derived from reactor trip and bypass breaker position status switches.
- 3. In the absence of direct position indication for bypass breakers, the position of the bypass breakers can only be inferred by the absence alarms or breaker change status obtained from computer outputs.
- 4. Direct indication of safety actions including reactor trip and bypass breakers is consistent with operators actions to confirm protection system operations and in the event of any anomolous indication to initiate appropriate follow up actions consistent with plant emergency operating procedures. As noted in the Westinghouse Owners Group Emer gency Response Guidelines, step 1 of the procedure for reactor trip or safety injection includes verification of reactor trip by confirming "Reactor trip and bypass breakers - OPEN."
Also, it should be noted that for the newer Westinghouse design, the operability of the undervoltage trip attachments for the bypass breakers is only testable during a plant shutdown. In contrast the operability of the undervoltage trip attachment for bypass breakers for the older design would be confirmed when the bypass breakers are closed for reactor trip breaker testing.
As a consequence, there is a higher potential that a bypass breaker may not be
-6 tripped, for the newer design, if an automatic trip occurred during reactor trip breaker.testing. This difference further supports the staff position for bypass breaker position indicating being available to the plant operator for the newer Westinghouse plants.
Finally, the staff does not concur that the typical two hour interval for testing breakers or protection system logic should be reason to negate the staff position on bypass breaker position indication since a number of inadvertent reactor trips occur during this time. Nor does the staff concur that alarms initiated on closure of bypass breakers provide an equivalent degree of direct bypass breaker position status indication. Therefore, it is the staff's conclusion that bypass breaker position indication is safety significant and should be provided as currently exist in all but a few Westinghouse plants.