ML15264A590
| ML15264A590 | |
| Person / Time | |
|---|---|
| Site: | Oconee  |
| Issue date: | 03/22/1989 |
| From: | Hood D Office of Nuclear Reactor Regulation |
| To: | Tucker H DUKE POWER CO. |
| References | |
| NUDOCS 8903290366 | |
| Download: ML15264A590 (14) | |
Text
March 22, 1989 Docket Nos.: 50-269, 50-270
-and 50-287 Mr. H. B. Tucker, Vice President Nuclear Production Department Duke Power Company 422 South Church Street Charlotte, North Carolina 28242
Dear Mr. Tucker:
SUBJECT:
REQUEST FOR ADDITIONAL INFORMATION REGARDING ATWS - OCONEE NUCLEAR STATION, UNITS 1,.2, AND 3 The NRC staff is reviewing your proposed plant modification to meet the ATWS rule, 10 CFR 50.62. We find that additional information, identified in the enclosure, is needed to substantiate our understanding of the conceptual design and to resolve open issues.
We request that you respond to the enclosed request for information within 45 days of receipt of this letter.
In view of the significance of this issue, and its longstanding history, we also find, that your proposed dates of September 1991, January 1992, and May 1991 for implementing the ATWS modifications at Oconee, Units 1, 2, and 3, respectively, are untimely and should be accelerated. I recommend discussions between our staffs regarding the basis for your proposed schedule and your plans in this regard. Contact me at (301) 492-1442 to arrange for these discussions.
The reporting and/or recordkeeping requirements contained in this letter affect fewer than ten respondents, therefore, OMB clearance is not required under P. L.96-511.
Sincerely, Original Signed By:
Darl S. Hood, Project Manager Project Directorate 11-3 Division of Reactor Projects-I/II Office of Nuclear Reactor Regulation 0oo
Enclosure:
L N0 As stated cc w/encl:
See next page DISTRIBUTION Docket-FiT&
NRC PDR Local PDR Oct PDII-3 Reading G. Lainas 14-E-4 E. Adensam 14-H-3 c
D. Matthews 14-H-25 M. Rood 14-H-25 OGC 15-B-18 E. Jordan MNBB-3302 B. Grimes 9-A-2 ACRS (10)
P-315 OCONEE FILE TR 3 PRDI5-II-D3 o
DHood:sw Matthews 391/89 3/Z/89 J //8
Mr. H. B. Tucker Oconee Nuclear Station Duke Power Company Units Nos. 1, 2 and 3 cc:
Mr. A. V. Carr, Esq.
Mr. Paul Guill Duke Power Company Duke Power Company P. 0. Box 33189 Post Office Box 33189 422 South Church Street 422 South Church Street Charlotte, North Carolina 28242 Charlotte, North Carolina 28242 J. Michael McGarry, III, Esq.
Bishop, Liberman, Cook, Purcell & Reynolds 1200 Seventeenth Street, N.W.
Washington, D.C. 20036 Mr. Robert B. Borsum Babcock & Wilcox Nuclear Power Generation Division Suite 525 1700 Rockville Pike Rockville, Maryland 20852 Manager, LIS NUS Corporation 2536 Countryside Boulevard Clearwater, Florida 33515 Senior Resident Inspector U.S. Nuclear Regulatory Commission Route 2, Box 610 Seneca, South Carolina 29678 Regional Administrator, Region II U.S. Nuclear Regulatory Commission 101 Marietta Street, N.W., Suite 2900 Atlanta, Georgia 30323 Mr. Heyward G. Shealy, Chief Bureau of Radiological Health South Carolina Department of Health and Environmental Control 2600 Bull Street Columbia, South Carolina 29201 Office of Intergovernmental Relations 116 West Jones Street Raleigh, North Carolina 27603 Honorable James M. Phinney County Supervisor of Oconee County Walhalla, South Carolina 29621
ENCLOSURE OCONEE NUCLEAR STATION 10 CFR 50.62 (ATWS RULE)
REQUEST FOR ADDITIONAL INFORMATION Introduction and Discussion On July 26, 1984, the Code cf Federal Regulations (CFR) was amended to include the ATWS Rule (Section 10 CFR 50.62, "Requirements for Reduction of Risk from Anticipated Transients Without Scram [ATWS] Events for Light-Water-Cooled Nuclear Power Plants"). An ATWS is an expected operational transient (such as loss of feedwater, loss of condenser vacuum, or loss of offsite power), which is accompanied by a failure of the reactor trip system to shut down the reactor.
The ATWS Rule requires specific improvements in the design and operation of commercial nuclear power facilities to reduce the likelihood of failure to shut down the reactor following anticipated transients and to mitigate the consequences of an ATWS event.
Paragraph (c)(6) of the Rule requires that information sufficient to demonstrate compliance with the requirements of the Rule be submitted to the Director, Office of Nuclear Reactor Regulation. The ATWS Rule requirements for Babcock and Wilcox (B&W) plants, such as the Oconee Nuclear Station (Oconee), are to provide a diverse scram system (DSS) and diverse (from the existing reactor trip system) ATWS mitigation system actuation circuitry (AMSAC).
Based on review of the information provided with the Duke Power Company (Duke) letters dated October 9, 1985 and December 20, 1988 and in subsequent clarifying discussions, this request for additional information is needed to allow the staff to determine fully whether the Oconee design complies with the ATWS Rule requirements of hardware diversity, electrical independence, and reliability and testability at power. This information should include block diagrams showing DSS and AMSAC circuit components with a description of manufacturer, model, principle of operation (electro-mechanical, solid-state, etc.), mode of
-2 operation (e.g., energize or de-energize to trip, etc.), power supplies (e.Q.,
AC or DC, operating voltages, etc.), and identification and location of all Class 1E/non-Class 1E system interfaces.
The principal function of the DSS at Oconee is to prevent an ATWS by tripping the reactor if, for any reason, the rods fail to drop in response to a reactor protection system (RPS) trip. The DSS must function to provide a reactor trip, diverse from the existing Reactor Trip System (RTS), for all ATWS transients that require a reactor trip (in addition to AMSAC actions) to prevent the potential for damage to, or over-pressurization of, the Reactor Coolant System (RCS).
The AISAC must function to actuate the emergency feedwater (EFDW) system and trip the turbine on ATWS transients, where required, to prevent serious RCS over pressurization, to maintain fuel integrity, and to meet 10 CFR release requirements. Considerations for avoidance of inadvertent actuation dictate that there be at least two channels, powered from separate sources and coupled with appropriate coincidence capability. The ATWS transients of concern for the B&W Owners Group (BWOG) plants have been shown to be a loss of main feedwater (LMFW) and the loss of offsite power (LOOP) leading to an LMFW.
The following discussion and associated questions are applicable to the Duke "conceptual design" for the DSS and AMSAC at Oconee.
Diversity from the Existing RPS In accordance with B&W Document 47-1159091-00, the generic design requirements for DSS and AMSAC diversity are such that the "primary input signals will be diverse from existing protection systems from the sensor output." Also, the logic "system shall be diverse from existing protection systems," except that "certain plant-specific configurations may require enabling signals and power supply interconnections with existing protection systems."
The output of the
W a
-3 DSS "will degate SCRs [silicon-controlled rectifiers] using relays different from RPS SCR degate relays."
The AMSAC "actuation devices will be shared with existing systems."
For the DSS, equipment diversity to the extent reasonable and practicable to minimize the potential for common cause (mode) failures is required from the sensors to, and including, the components used to interrupt control rod power.
For the AMSAC, equipment diversity to the extent reasonable and practicable to minimize the potential for common cause (mode) failures is required from the sensors to, but not including, the final actuation device.
It is the staff's understanding that Duke's "conceptual design" for the DSS it Oconee will use the RG 1.97, ITT/Barton Model 753 pressure transmitters with Westinghouse Monitor-86 digital equipment for the signal conditioning, while the RPS uses Rosemount pressure transmitters with Bailey Model 880 analog signal conditioning equipment. Diversity of sensors is not required, and the use of Westinghouse signal conditioning equipment for the DSS and Bailey signal conditioning for the RPS appears to provide adequate diversity. Duke's "conceptual design" does not indicate how diversity of the OSS logic and final actuation devices for interrupting power to the SCRs will be accomplished.
Therefore, Duke must further describe how diversity is to be achieved between the DSS and RPS equipment.
It is also the staff's understanding that Duke's "conceptual design" for the AMSAC at Oconee will use pressure switches for monitoring the main feedwater pump turbine stop valve hydraulic control oil pressure and the main feedwater pump discharge pressure to detect a complete loss of main feedwater flow and that the AMSAC will not have any interfaces with the RPS. Duke must further describe their basis for determining the adequacy of these sensors for sufficiently detecting all loss of feedwater events. The "conceptual design" indicates that the electrical control equipment for the AMSAC will be diverse from the RPS, but gives no details about what this electrical equipment is or
-4 how it will be diverse. Therefore, the Duke final design submittal must provide details of how the diversity of the AMSAC signal conditioning and logic equipment will be achieved.
Adequate diversity between the DSS/AMSAC and the RPS is best achieved by the use of components from different manufacturers/manufacturing processes, the use of mechanical versus electronic devices, AC versus DC equipment, or the use of equipment employing different principles of operation. Therefore, Duke should consider these methods of determining diversity when addressing the DSS logic and final actuation devices and the signal conditioning and logic for the AMSAC design. This information should be included in the Duke final plant-specific Oconee submittal in order for the staff to make a determination of compliance with ATWS Rule.
Electrical Independence from the Existing RPS In accordance with B&W Document 47-1159091-00, the generic design requirements for DSS and AMSAC electrical independence are such that "the system will be electrically independent from existing protection systems, except for power supplies and certain enabling signals, which will be appropriately isolated."
Electrical independence of the DSS from the existing RTS should be provided from the sensor output up to, and including, the final actuation device.
Electrical independence of the AMSAC systems from the existing RTS should be provided from the sensor output up to, but not including, the final actuation device.
It is the staff's understanding that Duke's "conceptual design" for the DSS at Oconee provides for power to the DSS transmitters and signal conditioning equipment from the same vital buses that provide power to the RPS, with Class 1E circuit breakers for isolation. It is also the staff's understanding that Duke's "conceptual design" includes a dedicated DSS/AMSAC Uninterruptible Power Supply (UPS), connected to an offsite power source and consisting of a battery, rectifier, and charger providing 120 VAC to the DSS logic and final actuation device relays.
-5 It is the staff's understanding that Duke's "conceptual design" for the AMSAC at Oconee provides for power to be supplied to the main feedwater pumps turbine control oil pressure switch circuits from a battery-backed, non-vital source and for power to be provided to the main feedwater pumps discharge header pressure switch circuits from the vital batteries. It is also the staff's understanding that the dedicated DSS/AMSAC UPS will provide power to the AMSAC logic and final actuation device relays.
The Duke "conceptual design" for electrical independence of the DSS/AMSAC at Oconee appears to be consistent with the acceptable criteria defined as Option 1 in the September 7, 1988, letter from G. Holohan (NRC) to L. Stalter (BWOG). However, since the "conceptual design" includes connections between the RPS/vital busses and the ATWS equipment, additional information should be provided which describes the details of these connections.
In addition, even though the Class 1E to non-Class 1E isolators and isolation methods used in the DSS and AMSAC at Oconee have been previously reviewed and accepted by the staff, Duke must make a determination that the new DSS/AMSAC applications are bounded by the previously documented testing and so state in the final Oconee plant-specific submittal.
Physical Separation from Existing RPS In accordance with B&W Document 47-1159091-00, the generic design requirements for OSS ana AMSAC are such that "channel separation shall be provided in accordance with plant-specific requirements for routing non-safety signals."
To allow the staff to-determine fully if this part of the Oconee design complies with the current approved plant design requirements, specific details on component location and physical separation should be supplied in the final plant-specific submittal.
-6 Environmental Qualification (EQ), and Quality Assurance (QA) for Testing, Maintenance, and Surveillance In accordance with B&W Document 47-1159091-00, the generic design requirements for DSS and AMSAC are such that "equipment shall be qualified for a normal environment in accordance with plant-specific EQ program requirements; quality assurance measures are to be provided on a plant-specific basis equal to or better than the requirements promulgatEd by NRC's Generic QA guidance letter, GL 85-06."
It is the staff's understanding from the Oconee "conceptual design" that all ATWS equipment will be designed for, and located in, a mild environment and that the equipment will be operational for the anticipated operational environment in its location. It is also the staff's understanding that the ATWS system will be controlled in accordance with the general requirements of the existing Duke quality programs. The controls applied to the ATWS system will be in accordance with the "Quality Assurance Guidance For ATWS Equipment That Is Not Safety-Related," as set forth in Generic Letter 85-06.
The approach to the EQ and QA requirements identified above appears to be acceptable. It should be noted that the EQ and QA programs will be audited periodically during NRC regional inspections to assure continued compliance.
During the life of commercial light-water-cooled nuclear power plants, many components reach their end of life and must be replaced, including components installed in the RTS, DSS, and AMSAC. In its plant-specific submittal, Duke should provide a description of the measures/programs implemented for Oconee to assure that the equipment diversity provided in accordance with the ATWS Rule will be maintained during component repair, replacement, and modifications and/or design changes, etc. throughout the life of the plant.
Safety-Related (1E) Power Supplies In accordance with B&W Document 47-1159091-00, the generic design requirements for DSS and AMSAC are such that a "safety-related power supply is not required."
However, "operability during Loss of Offsite Power is required."
W
-7
-7 Although the use of safety-related (lE) power supplies is not required for the DSS and AMSAC systems, the logic and actuation device power for the DSS and logic power for the AMSAC designs must be from an instrument power supply independent from the power supplies for the existing RPS. In this regard, it is the staff's understanding that the Oconee "conceptual design" for DSS and AMSAC provides for power to be supplied by offsite power with a battery, inverter, and charger to provide 120 VAC power to the ATWS logic circuitry.
This dedicated UPS will also be backed-up by the onsite emergency sources.
Duke, in its final submittal, should indicate what these emergency sources are, the voltages supplied from these sources, and how the UPS will be isolated from these sources.
Testability at Power In accordance with B&W Document 47-1159091-00, the generic design requirements for DSS and AMSAC testability at power are such that "the system shall be testable at power." At.power tests shall be performed at 6-month intervals with the complete system test being performed every refueling. The following exceptions exist. The DSS input sensors and the AMSAC input sensors and final actuation devices will be tested only at refueling outages.
To ensure that the DSS circuits perform their safety functions in a reliable manner, the circuits must be maintained and periodically tested at-power in accordance with technical specification operability and surveillance requirements or equivalent means.
It is the staff's understanding that the portion of the Oconee "conceptual design" that will allow testability at power is provided by the design of the DSS and AMSAC systems. These systems are designed so that both are two out of two logic-actuated systems, and provisions are incorporated which disable the system output when a channel is placed in the test condition.
u8 This approach appears to be in accordance with the design requirements discussed above. However, the plant-specific submittal should also address the time limits associated with channel testing, disabling of channels, actions to be taken if one channel failed, etc.
Inadvertent Actuation In accordance with B&W Document 47-1159091-00, the generic design requirements for DSS and AMSAC to prevent inadvertent actuation are such that "the system shall be designed to minimize challenges to safety systems" by using at least two channels with appropriate coincidence logic; the use of two channels concurrent with the energize-to-trip design should minimize the number of inadvertent actuations.
To avoid the potential for inadvertent actuations of this nonsafety system, the system shall be designed so as not to revert to a one-out-of-one status during channel test. For systems designed using the minimum two-channel logic, this dictates that the system shall become inoperable during channel test.
It is the staff's understanding that the Oconee "conceptual design" is in accordance with the above mentioned design requirements.
Maintenance Bypasses, Operating Bypasses, Indication of Bypasses, and Means for Bypassing In accordance with B&W Document 47-1159091-00, the generic design requirements for OSS and AMSAC bypassing are such that "the system shall incorporate a channel test capability; the test function should simultaneously test an input ar output channel together from sensor to final actuation device."
-9 System status during testing shall be annunciated in the control room. The system should be designed to provide output to the control room mounted alarms for input channel trip conditions, output channel trip conditions, system trip, and test status. The system status will also be annunciated when the system is in the Startup Bypass mode/condition and reactor power is less than 25% of rated full power.
It is the staff's understanding that the Oconee "conceptual design" conceriung bypassing provides for disabling of a channel for maintenance, testing, repair or calibration by placing the specific channel in Test. Administrative controls will be provided to require placing a DSS or AMSAC channel in Test in order to provide control room annunciation any time work is to be performed which would disable operation of the other channel.
These administrative controls will also prohibit personnel from working on more than one DSS or AMSAC channel simultaneously.
It is the staff's understanding that the Oconee "conceptual design" requires no cperational bypasses. Based on analyses performed by Duke in determining the input parameters for detecting a complete LMFW, no 25% low-power bypass is required. The status of the DSS/AMSAC will be indicated in the control rocm by inputs to the plant computer, which displays alarm status to the cperators. Bypass capabilities for maintenance and test of the DSS/AMSAC equipment will be provided by using installed tEst devices (switches, lights, etc.).
In order for the staff to make a determination of complete compliance, Duke should assure that all items of concern addressed in the testability section of this document and that are applicable to bypassing at Oconee are discussed in the plant-specific submittal.
W a 10 Completion of Protective Action In accordance with B&W Document 47-1159091-00, the generic design requirements for DSS (AMSAC is not addressed) to assure completion of the protective action once it has been initiated are such that "the DSS shall incorporate a trip lockup with manual reset capability in the output channels when activated by a true DSS trip."
It is the staff's understanding that the Duke 'conceptual design" for the DSS at Oconee provides lockup of the DSS trip function such that reset of the DSS trip function requires manual operator action from the control room. It is also the staff's understanding that the AMSAC does not use a lockup trip function but will utilize the normal reset features of the main feedwater pump turbine control scheme. However, Duke should provide specific information which confirms that both the DSS and AMSAC at Oconee are designed such that, upon receipt of a trip signal, the protective action goes to completion and deliberate operator action is required to reset the systems. In addition to the specific information on the system's design, Duke should include a discussion of any required operator actions.
Information Readout Although this item is not specifically addressed in B&W Document 47-1159091-00, it is the staff's understanding that Duke's "conceptual design" for Oconee provides for indication of DSS and AMSAC system status both remotely (by means of the plant computer) and locally on the DSS and AMSAC logic cabinets (by means of indicating lights). This type of design appears to be acceptable. However, in the final Duke plant-specific submittal for Oconee, more detailed information relating to how the operator is provided with accurate, complete, and timely information (i.e., what actuates or deactuates alarms, annunciators, lights, and what functions are performed by specific switches, etc.) pertinent to system status should be provided. In addition, Duke should provide a discussion of how good human factors
0 L
p 11 engineering practices are incorporated into the design of ATWS prevention/
mitigation system components located in the control room. The coordination of displays used to provide the status of ATWS systems/equipment to the operator with existing displays should be addressed specifically.
Safety-Related Interfaces In accordance with B&W Document 47-1159091-00, the generic design requirements for safety-related components/interfaces are such that "the DSS and AMSAC are not required to be safety related nor designed to meet IEEE 279, however must be designed and engineered for high reliability to preclude unnecessary challenges to existing safety systems."
It is the staff's understanding that the Duke "conceptual design" for the Oconee OSS and AMSAC does not include interfaces with the existing reactor protection systems, except for sensor instrument power supplies. It is the staff's understanding that the only other Class 1E to non-Class 1E interfaces are the control interfaces between the AMSAC and the EFDW system. The Oconee "conceptual design" indicates that the methods of isolation for the power supplies and the EFDW interfaces will be consistent with present practices and the licensing basis for the plant. However, the adequacy of the isolation, devices used in these systems should be addressed in the plant-specific submittal in order for the the staff to evaluate the applicability of the devices for the use in the DSS/ANSAC systems.
Technical Specifications The staff, in its Technical Specification Improvement Program, is presently evaluating the need for technical specification operability and surveillance requirements. This evaluation includes those actions considered to be appropriate to ensure that equipment installed per the ATWS Rule will be maintained in an operable condition when operability requirements cannot be met (i.e.,.limiting conditions for operation).
In its Interim Commission Policy Statement on Technical Specification Improvements for Nuclear Power
12 Plants [52 Federal Register 3778, February 6, 1987], the Commission established a specific set of objective criteria for determining which regulatory requirements and operating restrictions should be included in Technical Specifications. The staff will provide guidance regarding the Technical Specification requirements for DSS arid AMSAC at a later date.
Installation of ATWS prevention/mitigation system equipment should not be delayed pending the development or staff approval of operability and surveillance requirements for ATWS equipment.
Conclusion In order for the staff to make a determination on the Oconee compliance with the ATWS Rule and issue a Safety Evaluation Report,.the additional information requested in the body of this document will be required. This additional information, as well as pertinent information supplied previously, should be submitted to the staff in a single ATWS system final design package. This will assure that only the most complete and up to date information is reviewed.