ML17194A082
| ML17194A082 | |
| Person / Time | |
|---|---|
| Site: | Dresden  |
| Issue date: | 08/05/1981 |
| From: | Crutchfield D Office of Nuclear Reactor Regulation |
| To: | Delgeorge L COMMONWEALTH EDISON CO. |
| References | |
| TASK-07-01.A, TASK-7-1.A, TASK-RR LSO5-81-08-014, LSO5-81-8-14, NUDOCS 8108140414 | |
| Download: ML17194A082 (13) | |
Text
- ..* !
{
\\.
Docket No. 50-237 LSOS08-014 Mr. L. DelGeorge Director of Nuclear Licensing Conunonwealth Edison Company Post Office !Box 767 Chicago, Illinois 6069d
Dear Mr. Abel:
August 5, 1981
SUBJECT:
SEP TOPIC VII-1.A, ISOLATION OF REACTOR PROTECTION SYSTEM FROM NON-SAFETY SYSTEMS, INCLUDING QUALIFICATION OF ISOLATION
.DEVICES, DRAFT SAFETY EVALUATION FOR DRESDEN UNIT 2 Encl6sure l is our contractor's draft technical evaluation of the subject for your plant. is the staff's draft safety evaluation and it is based on Enclosure 1.
Both documents reconunend that suitable isolation devices be provide-d be-,.
tween the nuclear instrumentation system and the process recorders and 1,-ttle plant process computer.
<ti>--
':_ \\ :. '
I'
- ,; \\,:: '
- ~..
l.
\\
I
- l..
\\ \\-\\
The need to *actually implement these changes will be deternlined during the.
integrated safety assessment. This topic assessment may be revised in the future if your fac11 ity design is changed or if NRC criteria relat,1ng to this-.
topic are modified befor¢ the integrated. assessment* is completed.
\\~
!<\\'-
{ \\_,.
- ~.
-~!
Enclosures:
As stated cc w/enclosures:
-See next ~age
~ AHa £40414 - a 10005-,
p ADDCK 05000237.
PDR I Sincerely, Dennis M. Crutchfield,.Chief
.Operating Reactors Branch No. 5 Division of Licensi.ng
\\
\\
',_\\.
~:
Mr. L. DelGeorge cc Isham, Lincoln & Beale Counselors at Law One First National Plaza, 42nd Floor Ch~cago, Illinois 60603 Mr *. Doug *Scott Plant Superintendent Dresden Nuclear Power Station Rural Route #l Morris, Illinois 60450
~atural Resources Defense Council 917 15th Street, N. W.
~ashington, D. C.
20005 U. S. Nuclear Regulatory Commission Resident Inspectors Office Dresden Station RR- #1 Morris, Illinois 60450.
Mary Jo Murray Assistant Attorney General Environmental Control Division 188 W. Randolph Street Suite 2315 Chicago, Illinois 60601 Morris Public Library 604 Liberty. Street.
Morris, Illinois 60451 Chairman Board of Supervisors of Grundy County Grundy County Courthouse Morris, Illinois '60450 John F. Wolfe, Esquire 3409 Shepherd Street
- Chevy Chase, Maryland 20015 Dr. Linda w. Little 500 Hermitage Drive R~leigh, North Carolina 27612 I 11 i noi s Department of Nuclear Safety 1035 Outer Park Drive, 5th Floor Springfield, Illinois 62704 U.S. Environmental Protection*Agency
- Federal Activities Branch Region V Office
'ATTN:
EIS COORDINATOR 230.South Dearborn Street Chicago, Illinois 60604
.Dr. Forrest J. Remick 305 East Hamilton Avenue
- State College~ Pennsylvania 16801
SEP TECHNICAL EVALUATION TOP IC VI I - 1. A ISOLATION OF REACTOR PROTECTION SYSTEM FROM NON-SAFETY SYSTEMS DRESDEN UNiT NO.. 2 Docket N6~ 50-237 July 1981 Enclosure 'I' 04.73J 7-13-81.
1.0 2.0 3.0 4.0 5.0 6.0
- CONTENTS INTRODUCTION CRITERIA DISCUSSION AND EVALUATION.
- 3. 1 3.2 Discussion Evaluation....................................................
SUMMARY
REFERENCES.
APPENDIX A i i 2
2 5
- 5.
6 7
1.0 INTRODUCTION
SEP TEGHNICAL EVALUATION TOP IC VI I.- LA ISOLATION.OF REACTOR PROTECTION SYSTEM FROM NON-SAFETY SYSTEMS DRESDEN 2 The objective -0f this review is to ~etermine if non-safety sy~tems
. *which are el ectri.ca l ly connected* to. the Reactor Protection System (RPS) are properly isolated from the RPS and if ~he isolation devices or techniques used meet. current licensing criteria. The qualification of safety-related equipment is' not.within the scope of 'this review.
Non-safety systems generally-receive control si9~als from RPS sensor*
turrent loops.
The non~safety circuits are required to have isolation devices to ensure ~lectrical independence of the RPS channels.
Operating experience has shown that* some of the earlier isolation devices or arrange-ments at operating plants may not meet current licensing criteria.
2.0 CRITERIA General Design Criterion 24 (GDC 24), entitled, "Separation of Protec-tion and Control S,Ystems-,
11 requires that:
- The protection system shall be sepa-ffied from control sys-tems to the extent that failure of any single control system component or channel, or fail~re or.removal from service of any single protection system compon~nt or channel ~hich is common to the contra 1 and protect ion systems,. 1 eaves intact a system that satisfi~i ~11 reliability, redundancy, and independence requirements of the protection system.
I.nter-connection of *the protection and control.systems shall be 1 imited so as to assure:that.safety is not significantly impaired. 1 IEEE-Standard 279-1971, entitled, "Criteria for Protection.Systems for Nuc 1 ear Power Generating Stations, 11 Sect i.on 4. 7. 2, states:
The transmission of sig~als from protection system equipment for control system use shall pe through isolation devices which shall be classified as part o~ the protection system and sha 11 meet a 11 the requirements of this document.
- No credible failure at the output of an isolation device shall prevent the associated protection system channel from meet-ing the minimum performance requirements specified in the design bases.
Examples of credible failures include short circuits, open circuits, grounds, and.the application of the maximum cred-ible AC or DC potential. A failure in an isolation device is evaluated in the same manner as a failure of other equip-ment in the protection system.2
- 3. 0 DISCUSSION AND EVALUATION 3.1 General.
The Reactor Ptotection System (RPS) includes the sen-sors, amplifiers, logic, power sources. and oth~r equipment essential to the monito~ing of selected nuclear power conditions. It must reliably effect a rapid reactor shutdown if any one or a combination of parameters deviate beyond preselected setpoints to mitigate the consequences of a po~tulated de~ign basis event.
The RPS parameters as identified in the Dresden 2 Technical Specifi-cations3 are as follows:
- 1.
Mode Switch
- 2.
- 3.
High IRM Neutron Flux
- 4.
High APRM Neutron Flux
- 5.
High Reactor Pressure
- 6.
High Drywell Pressure
- 7.
Low Reactor Water Level
- 8.
High Scram Discharge Volume Level
- 9.
Low Turbine Condenser Vacuum
- 10. Main.Steam Line Radiation 2
e l l.
- Mai n Ste am Li n e I sol at itJ n Va l.v e Cl o sure
- 12.
Generator Load Reject
- 13.
Turbine Stop Valve Closure
- 14.
Turbine Control, Loss of Control Oil Pressure 3.1.l
.~PS Logic*.* The RPS logic is composed of two independent
~nd separate 16gic channels:
Each of the logic channels has two indepen-dent subchannel~. The output of the two subchannels in each channel are combined in a one-out-of-two trip logic. A trip of both logic channels is required to initiate reactor scram.
Sensors for each subchanriel are dedi-cated *to the RPS and separaie from the reactor in~trumentation systems. 4 Each parameter, with the exception of the IRM, the LPRM and the APRM, is monitored by four or m6re bistable sensors.
The bistable contacts*
~ctuate individual. relays wi.th the contacts of these relays incorporated into the scram logic circuits actuating the eight scram relays.
Contacts from the scram relays control the solenoid scram valves for the four scram rod groups.
RPS annunciation, indicator lights,' and event inputs to the co~puter are by auxiliary contacts f~om the RPS relays. -Circuit bypasses and interlocks are generated by bistab'le sen.sors, relays and manua_l switches including the mode switch. Circuit testing is by manually actuated switch*
or relay ~ontacts in.the logic circuits whic~ interrupt (trip) the logic when actuated. 5 The four position reactor mode swit-cn* actuates various scram functions as well as selected bypasses and interlocks.
The switch is mechanically divided into two separate switch ~anks each serving one of the RPS channels.
Isolation of the RPS functions from control and non-safety function is by switch and/or relay contacts.
The neutron flux monitor systems which can scram the reactor consist of intermediate range monitbrs (IRM) and average power range monitors (APRM).6 The APRM deri.ves its input from local power range monitors (LPRM) to provide an output signal proportional to reactor average power.
3
The IRM subsystem consists of a*channels of miniature fission chambers and associated signal conditioning* equipment. which monitor reactor power with four.. channe 1 s incorporated in each RPS channe 1.
- A reactor scram is initiated by a single IRM trip in each RPS ~hannel or by an !RM.channel inoperative.
Any one of the IRM channels will initiate a rod block from high flux.. lev_el, IRM inoperative, IRM down_scale or detectors.not fully iQserted: The IRM analog ~i~nal provides relay actu~tion for RPS trips as well as analog signals to indicating instruments and process record~rs.
Manual bypass of one IRM channel in each RPS channel is permitted during*
reactor operation.
The APRMs average the output of selected LPRM amplifiers. Six APRM
- channels, each averaging the input from 20 to 21 LPRMs provide the trip functions for the two RPS logic chan~els~ Any one of the'three APRM high neutron flux.monitors tripped in each channel wil 1 *initiate a reactor scram.
Switches on the reactor console permi*t bypassing one APRM channel in each RPS channel during Reactor uperation.
Interface between the APRM and the scram logic is by relay actuatiOn from the APRM analog output
- signal.
An~log signals from both the LPRMs and the APRMs are also fed to control room indicating meters and recorders.
Digital outputs from relay _action of t~~ 1RM and LPRM channels provide input to the process tomputer.
Analog signals from the APRM chan~els als6 input. directly to the process computer.
3.1.2 RPS Power. *Power to th-eKP~ is supplied from two 120VAC sources.
The prim~ry source is from the RPS motor-generator ~ets 2-A ~nd 2-B.
The alternate source -0f power is from the instrument bus fed from M~C 25-2.
Output of each motor-generator is isolated from its di s*tri but ion panel bus by a thermal magnetic circuit breaker with undervoltage trip and 7
thermal overloads.
Each RPS 1 og i c channe 1 is i so 1.ated from* other safety funct i ens on their respective MG power panels by thermal circuit breakers.
Individual 4
subch~nnel sensor logic trains, scram logic and control rod solenoid valve circuits are isolated from each other by fuses.
The backup scram auxiliary relays are initiated by manual scram or from the automatic scram logic from each RPS channel and are fed from separate 125V DC buses.
3.2 Evaluation.
Based on the review of the* referenced documents, that portion of the RPS comprised of sensors, relay logic, bypasses and mode switch is adequately isolated from control and non-safety functions.
There are no devices which isolate the !RM, LPRM and APRM analog signals from the control room process recorders and indicating meters.
The APRM scram function is derived from relay actuation.resulting from amplified analog signals sensed by these relays.
The amplified analog signals are also input directly to the process computer with 1/32 amp fuses as the isolation devices.
Fuses do not meet the intent of the IEEE Standard 279 pat. 4~7.2, Isolation Devices~
The two motor-generator sets supplying power to the RPS channels do 8
not qualify as class lE power systems.
Undetected failures nf the motor-generator contra 1 system ( abnorma 1 voltage or frequency) would be transmitted to the RPS relays and ~olen6ids posing potential damage ~r fa'ilure of an RPS channel to *perform up.on demand.
However, reference 9 indicates this condition will be correctea'in accordance with NRC approved modifications during the 1983 spring refueling.,
4.0.
SUMMARY
Based on current licehsing criteri~ and review guidelines, the plant reactor protection system complies with all current licensing criteria listed in Section 2.0 of this report except for the following.
- 1.
IEEE Standard 279, Section 4.7.2, requires isolation devices between RPS and control systems.
There are no isolation devices 5
between the nuclear flux monitoring system analog signals and the process recorders ~nd indicating instruments.
- 2.
Qu~lified isolation.devices are not provided to isolate the APRM system fro~ the process c6mputer. *
- 3.
The power suppli~i for the RPS channels do not *qualify as l E
- equipment.
Isolation between each -RPS channel and its respective power supply is inadequate.
5.0 REFERENCES
- l.
General Desigri Criterion 24j
~Separation of Protection and Control
- Systems, 11 of Appendix A, "General Design Criteria for Nuclear Power Plants,*
11 10 CFR Part 50, "Domestic Li.censing of Production and Utili-zation Facilities."
- 2.
IEEE Standard 279-1971, 11 Criteria for Protection Systems for Nuclear Power Generating Stat i_ons.
11
- 3.
Dresden Nuclear Power.Station Unit No. 2 Technical Specifications.
Appendix A to License No. DPR-19, Amendment 14, February 25,, 1976.
- 4.
Dresden Nuc.lear Power Station, Units No. *2 and 3, F_inal Safety Analysis Report, Volume 2, November 17, 1967.
5~
Sargent & Lundy drawings 12E2464 Rev. P, 12E2465 Rev. T, 12E2466 Rev. U, 12E2467 Rev. P, 12E2469 Rev. J.
- 6.
Sargent & Lundy drawirigs 12E2470 Rev. N; 12E2471 Rev. J and 12E2472 Rev. K.
- 7.
Sargent & Lundy drawings 12E2591 Relf'o H and.12E2592 Rev. D.
- 8.
IEEE Standard 11Criteria for* Class lE. Power Systerr.s for Nuclear Power Generating Station, 11 IEEE standard 308-1974.
- 9.
Letter Janecek to Ippolito, Dresden.Station, Unit~ No. 2 and 3, Reactor Proteciion System Power Supply Modifications, dated Decembet 11, 1980..
- /
- APPENDIX A NRC SAFETY TOPICS RELATED TO THIS REPORT
- 1.
II I-I Classification of Structures, Components and Systems.
- 2.
VI-10.A Testing of Reactor Trip Systems and Engineered Safety Fea-tures, Including Response Time Testing.
3..
VII-2 ESF System Control Logic and Design
- 4.
VII-3 Systems Required for Safe Sh~tdown 7
SAFETY EVALUATION REPORT DRESDEN 2 TOPIC:
VII~l.A, ISOLATION OF REACTOR PROTECTION SYSTEM FROM NON-SAFETY SYSTEMS, I NCLUD lllG QUALIFICATION OF ISOLATION DEV.ICES I.
INTRODUCTION Non-safety systems generally receive control* signals from the reactor protection system (RPS) sensor current loops.
The non-safety circuits are req~ired to have isolation devices to insure the independence of the RPS channels.
Requirements for the design and qualificaton of isolation
- device~ are quite specific.
Recent operating experience has shown that some of the earlier isolation devices or arrangements at operating plants may not be effective.
The objective of our review was to verify that operating reactors have RPS designs which provide effective and qualified isolation of non-safety systems from safety systems to assure that safety systems will function as required.'
II.
REVIEW CRITERIA The review criteria are presented in Section 2 of EG&G Report 0473J, "Isolation of Reactor Protection System from Non-Safety S~stems.
11 III.
RELATED SAFETY TOPICS AND INTERFACES The scope of review for this topic ~as limited to avoid duplication of effort since some aspects of the review were performed under related topics.
The related topics and the subject matter are jdentified below.
Each of the related topic reports contain the acceptance criteria and review guid-ance for its subject matter.
VI-7.C.l VIII-1.A IX-6 Independence of Onsite Sources Degraded Grid Fire Protection There are no safety topics dependent on the present topic information because proper i~olation has been assumed.
. IV.
REVIEW GUIDELINES The review guidelines are pres~nted in Section 3 of Report 0473J.
V.
EVALUATION Based on current licensing criteria and review guidelines, the plant reactor protection system complies with all curr~nt licensing criteria listed in Section 2.0 of this report except for the following:
- 1.
IEEE Standard 279, Section 4.7.2, requires isolation devices between RPS and control systems.
There are no. i~olation devices between the.
nuclear flux monitoring systems and the process recorders and indicating
.instruments.
.. '. '1
- 2.
Isolation devices are* not provided to *isolate the APRM system from the process computer.
. 3.
The power supplies for the RPS channels do not qualify as IE equip~
ment.
Isolatio~ between each RPS channel and it~ respective power supply is inade~uate.
VI. CONCLUSION The staff's position is that suitably qualified isolators should be provided for exceptions 1* and 2 noted above or that the acceptability of the present designs be justified by the licensee.
The staff has also concluded that fulfillment of the licensee's commitment (Reference 9 to Report 0473J) to provide an NRC approv~d modification is an acceptable resoluti6n of Ite~ 3 above.
j*
__ l
.-