ML17201M219

Safety Evaluation Re Compliance W/Atws Rule 10CFR50.62 on Alternate Rod Injection & Recirculation Pump Trip Sys

ML17201M219
Person / Time
Site:	Dresden, Quad Cities, 05000000
Issue date:	11/08/1988
From:	Office of Nuclear Reactor Regulation
To:
Shared Package
ML17201M218	List: ML17201M217 ML17201M219
References
GL-85-06, GL-85-6, NUDOCS 8811150062
Download: ML17201M219 (7)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D. C. 20555 SAFETY EVALUATION BY THE OFFICE.OF NUCLEAR REACTOR REGULATION DRESDEN STATION UNITS 2 & 3 QUAD CITIES STATION UNITS 1 & 2 COMPLIANCE WITH ATWS RULE 10 CFR 50.62 RELATING TO ALTERNATE ROD INJECTION (ARI) AND RECIRCULATION PUMP TRIP (RPT) SYSTEMS DOCKET NOS. 50-237/249 AND 50-254/265

1.0 INTRODUCTION

On July 26, 1984, the Code of Federal Regulations (CFR) was amended to include Section 10 CFR 50.62, "Requirements for Reduction of Risk from Anticipated Transients Without Scram (ATWS) Events for Light-Water-Cooled Nuclear Power Plants" (known as the "ATWS Rule").

An ATWS 1s an expected operational transient (such as loss of feedwater, loss of condenser vacuum, or loss of offsite power) which is accompdnied by a failure of the reactor protection system (RPS) to shut down the reactor. The ATWS rule requires specific improvements in the design and operation of connnercial nuclear power facilities to reduce the likelihood of failure to shut down the reactor following anticipated transients, and to mitigate the consequences of an ATWS event.

For each boiling water reactor (BWR), three systems are required to mitigate the consequences of an ATWS event.

1.

It must have an alternate rod injection (ARI) system that 1s diverse (from the RPS) from sensor output to the final actuation device. The ARI system must have redundant scram air header exhaust valves. The ARI system must be designed to perform its function in a reliable manner and be independent (from the existing RPS) from sensor output to the final actuation device.

2.

It must have a standby liquid control system (SLCS) with a minimum flow capacity and boron content equivalent in control capacity to 86 gallons per minute of 13 percent by weight of sodium pentaborate solution. The SLCS and its injection location must be designed to perform its function in a reliable manner.

I

3.

It must have equipment to trip the reactor coolant recirculating pumps automatically under conditions indicative of an ATWS.

This equipment must be designed to perform its function in a reliable manner.

(~*~~80.~~0

~1i1~1u5~c)~C~l6~2:;-::8~E~:t~1~0~9:---~~,h PPDR

• ADOC}< 050002:37 1

1 I!

PDC Lii 7

• This safety evaluation report addresses the ARI system (Item 1) and the ATWS/RPT system (Item 3) for both Dresden and Quad Cities, unless otherwise noted. The SLCS (Item 2) was addressed in separate documents.

2.0 REVIEW CRITERIA The systems and equipment required by 10 CFR 50.62 do not have to meet all of the stringent requirements normally applied to safety-related equipment.

However, this equipment is part of the broader class of structures, systems, and components important to safety defined in the introduction to 10 CFR Part 50, Appendix A General Design Criteria (GDC).

GDC-1 requires that "structures, systems and components important to safety shall be designed, fabricated, erected and tested to quality standards co11111ensurate with the importance of the safety functions to be performed." Generic Letter 85-06 11Qual1ty Assurance Guidance for ATWS Equipment that 1s not Safety Related" details the quality assurance that must be applied to th1s equipment.

In general, the equipment to be installed in accordance with the ATWS Rule is required to be diverse from the existing RPS, and must be testable at power.

Th1s equipment is intended to provide needed diversity (where only minimal diversity currently exists fn the RPS) to reduce the potential for corrunon mode failures, that could result fn an ATWS, leading to unacceptable plant conditions. The criteria used in evaluating the licensee's submittal include 10 CFR 50.62 "Rule Considerations Regarding Systems and Equipment Criteria" published in Federal Register Volume 49, No. 124 dated June 26, 1984 and Generic Letter 85-06 "Quality Assurance Guidance for ATWS Equipment that fs not Safety Related."

3.0 ARI AND RPT SYSTEM DESCRIPTION Convnonwealth Edison, by letters dated September 30, 1987 and May 9, 1988 has pro"vfded infonnation to identify conformance with the ATWS Rule.

The plant has installed equipment to mitigate the potential consequences of an anticipated transient without scram event. The ATWS protection system consists of reactor pressure and reactor water level sensors, logic, power supplies, and instrumentation to f nitf ate the protective actions to mitigate an ATWS event.

The protective actions are to include:

a.

Al te.rnate Rod Injection (ARI), and

b. Recirculation Pump Trip (RPT)

This system is independent from the RPS, and is capable of initiating protective actions when both input channels indicating low water level or high pressure are tripped. System output will energize the devices to start the protective actions. The system can also be manually initiated.

ARI logic will cause the i11111ediate energization of the alternate rod insertion valves.'when either the ATWS/ARI reactor vessel hf gh pressure trip setpoint or the low water level trf p setpoint is reached, or the manual switches are actuated. The ARI valves and bleed paths are sized to allow insertion of all control rods to be completed in 30 seconds.

• The function of the RPT is to reduce the severity of thennal transients on fuel elements by tripping the recirculation pumps early in the transient events such as turbine trip, or load rejections. The rapid core flow reduction increases void content and thereby introduces negative reactivity in the reactor to reduce thennal power.

The RPT system automatically initiates a trip of all recirculation pumps on high reactor pressure or low-low reactor water level with a 9 second time delay. Each pump is tripped by the RPT system via the field breaker to the drive motor from the motor generator. The field breaker has two independent trip coils, one connected to each channel.

The ARl/RPT system can be tested while the plant is operating. This manually actuated test checks the system operation from the sensor outputs thru the logic to the actuating devices. The ARI/RPT instrumentation, logic, actuated devices and the circuits are separate from the RPS, and environmentally qualif1ed to the anticipated operational occurrence conditions.

The ARI function can be reset by the ARI reset switches or system internal logic after a time delay to ensure that the ARI scram goes to completion.

The other RPT funct19ns can be reset by the reset sw1tches.

4.0 EVALUATION OF ARI SYSTEM 4.1 ARI SYSTEM FUNCTION TIME General Electric Topical Report NEDE-31096-P, "Anticipated Transient Without Scram - Response to NRC ATWS Rule 10 CFR 50.62," dated December 1985, detailed conceptual designs which satisfy the ATWS rule requirements. This was accepted by the NRC on October 21, 1986, by letter from G. Lainas {NRC) to T. A. Pickens (BWR Owners' Group).

The licensee stated that the ARI system design satisfies the topical report's criteria with one exception. This one exception is the system function time criterion which states that rod injection motion will begin within 15 seconds and be completed within 25 seconds from ARI initiation. This assures that all rods will be fully inserted by the time the scram discharge volume (SDV) is full and was based on a generic analysis which envelopes all plant SDV designs.

Longer ARI initiation times may be justified provided that plant specific evaluations are performed. Therefore, an analysis was performed using plant specific data to reassess the requirements for the control rod start-of-motion time and the control rod full-insertion time for the ARI of the control rod drive (CRD) system.

The results of this analysis, which reevaluated the SDV fill time, shows that 34.6 seconds to control rod start-of-motion and 38.6 seconds to control rod full insertion are adequate requirements for the ARI function. The staff has reviewed the major assumptions of this analysis and finds them acceptable. However, the bounding leak rate of 5 gpm assumed for each CRD after the rod starts to insert and the 4 second period assumed for the time ft takes for the CRD to fully insert from the opening of the scram valves are based on Quad Cities data. Although these values are expected to also be applicable to the Dresden units, the staff reconunends that this be confinned for Dresden by measurement at the appropriate time. This confirmation will be verified during the staff inspection (temporary instruction 2500/20, Feb. 9, 1987) of ATWS implementation.

• 4.2 SAFETY RELATED REQUIREMENTS (IEEE STANDARD-279)

The ATWS Rule does not require the ARI system to be safety grade, but the implementation must be such that the existing protection system continues to meet all applicable safety related criteria.

The licensee stated that the ARI system is safety-related and segregated into two electrical divisions. All RPS channels are routed 1n separate conduits and never routed with divisional segregated circuits. The implementation of the ARI system will not prevent any existing protection system to perfonn its function.

The staff finds this acceptable.

4.3 REDUNDANCY The ATWS Rule requires that the ARI system must have redundant scram air header exhaust valves, but the ARI system itself does not need to be redundant.

The ARI system has redundant scram air header exhaust valves.

The initiation and control circuits are redundant. The ARI performs a function redundant to the RPS scram system. This 1s in conformance with the ATWS rule guidance, ana therefore is acceptable.

4.4 DIVERSITY FROM EXISTING RPS The ATWS Rule requires that the ARI system should be diverse.from the existing reactor protection trip system.

Four reactor high pressure sensors and four reactor vessel low water level sensors are used to detect the ATWS events. The ARI/RPT system uses the Rosemount analog transmitters and trip units (ATTUs) for both pressure and level channels.

The RPS also uses the Rosemount ATTUs.

Although the trip unit has a different module number (ARI uses model 510DU while the RPS uses model 710DU), the staff f1nds that the difference between these two modules is insufficient to satisfy the diversity requirements of the ATWS rule.

Diversity was the most important factor regarding the implementation of the ATWS mftfgation equipment because common mode failures were detennined to be a larger safety risk than random failures. Based on the *relative importance of this diversity requirement, the staff has concluded that the type of signal processing equipment provided for the ARI system is not acceptable in that it is not diverse from RPS signal conditioning equipment.

Having considered the need for additional time to change out the existing trip units to provide compliance with 10 CFR 50.62, the Conmission agrees wfth an extension of time to fully comply with 10 CFR 50.62 until no later than the end of the next refueling outage. Another alternative, pennitted by the provisions of 10 CFR 50.12, would be to request an exemption from the diversity requirement of 10 CFR 50.62. However, we do not reconunend this option.

4.5 E(ECTRICAL INDEPENDENCE FROM THE EXISTING RPS The ATWS Rule guidance states that the ARI system is required to be electrically independent from the existing RTS from sensor output to the final actuation device at which point non-safety related c1rcu1ts must be isolated from safety related cf rcufts.

• The ARI system is identified as a safety related system and has two electrical divisions. Division I and Division II are maintained separate. The RTS has four channels.

Each channel is routed in individual conduit. The RTS cable is never routed with the ARI system c1rcuits. The ARI logic and valve control power is separated from the RTS control power. This is in confonnance with the ATWS Rule guidance and therefore is acceptable.

4.6 PHYSICAL SEPARATION FROM EXISTING RPS The ATWS Rule guidance states that the implementation of the ARI system must be such that separation criteria applied to the existing protection system are not violated.

Except for the use of conunon instrument sensing lines, the ARI system from the sensor outputs is separated and independent from the RPS.

It has redundant circuits from sensors to the ARI valves. Either circuit tratn can perfonn the protective action. The separation between the RPS and the ARI system satisfies the guidance provided in the ATWS Rule.

The staff finds this acceptable.

4.7 ENVIRONMENTAL QUALIFICATION The ATWS Rule guidance states that the qualification of the ARI system ts for anticipated operational occurrences only, not for accidents.

Since the 11censee has stated ARI system is qualified for anticipated operational occurrence condition, the staff finds this acceptable.

4.8 QUALITY ASSURANCE NRC Generic Letter 85-06 dated April 16, 1985 provides quality assurance guidance for the ARI system.

Since the 11censee has committed to follow this guidance the staff finds this acceptable.

4.9 SAFETY RELATED POWER SUPPLY The ATWS Rule guidance states that the ARI system must be capable of perfonning its safety function with loss of offsite power, and that the power source should be independent from the existing RPS.

The ARI system will operate from noninterruptible de power sources (i.e., 125 Vdc buses backed up by station batteries) which are independent from the RPS power sources. The ARI system is capable of perfonning its safety functions during a loss of offsite power event.

The staff finds this acceptable.*

4.10 TESTABILITY AT POWER The AT\\tlS Rule guidance states that the ARI system should be testable at power.

The ARI system uses a two-out-of-two actuation logic for each division. Each individual level or pressure instrument channel can be tested during plant operation without initiating the ARI system. Test pushbuttons and indicating lights are provided for testing the ARI control logic and instrumentation up to but not including the final ARI solenoid valves. Either division can initiate

• the ARI function. Therefore, the test arrangement w111 not prevent true ARI initiation. Since this is in conformance with the ATWS rule guidance, the staff finds this acceptable.

4.11 INADVERTENT ACTUATION The ATWS Rule guidance states that inadvertent ARI actuation which challenges other safety systems should be minimized.

The ARI system has coincident logic circuits and two sensor channels must be tripped in order to initiate the protective actions. The ARI trip settings will not challenge the RPS scram.

As a result, inadvertent actuation ts minimized. Since this is in confonnance wfth the ATWS rule guidance, the staff finds this acceptable.

4.12 MANUAL INITIATION The ARI system has armed switches for manual initiation 1n the control room.

The operator must first arm then actuate the switches in both channels to initiate the protective action. The staff finds this acceptable.

4.13 INFORMATION READOUT The ARI system should provide a means for informing the operator that the ARI system has been initiated.

The ARI system has annunciator readouts on the main control board to indicate a channel trip, a trouble alarm, or the arming of the manual pushbuttons.

Additional ARI system trip and availability status information is provided in the auxiliary control room.

The staff finds thfs acceptable.

4.i4 COMPLETION OF PROTECTIVE ACTION ONCE' IT IS INITIATED The ARI logfc has a seal-in feature to ensure the completion of protective action once it is initiated. After initial conditions return to normal, the system will automatically return to normal after a 30 second delay. The staff finds that this ts not a prudent design. A preferable design should involve a deliberate operator action to reset the system.

At a mfnfmum, the licensee should provide procedures to assure that a proper verification that all related components are returned to normal status when the ARI system is reset. These procedures will be verfffed during the staff inspection (temporary instruction 2500/20, Feb. 9, 1987) of the ATWS equipment implementation.

4.15 CONCLUSION ON ARI SYSTEM The staff ffnds that one area of the ARI design (e.g., diversity) is not in compliance wfth the ATWS Rule 10 CFR 50.62, and as a result, the ARI system 1s not acceptable. This is discussed in more detail in Section 4.4. The licensee is also required to document the test result of the ARI system function time for the Dresden units as discussed in Section 4.1 and the procedures for the ARI system reset for both the Dresden and Quad Cities units as discussed in Section 4.14 of this evaluation. This documentation will be verified during the staff inspection of the ATWS equipment implementation.

Based on our review, the ARI design basts requirements 1dent1f1ed above are not in full

• compliance with ATWS Rule 10 CFR 50.62 paragraph (C)(3) and the guidance published in Federal Retister Volume 49 No. 124 dated June 26, 1984 and therefore are not accep able.

5.0 EVALUATION OF AHJS/RPT SYSTEM The RPT design is modeled after the NRC approved Monticello design.

An RPT on level will only occur after a nine second consecutive level drop.

In a letter from H. R. Denton (NRC) to C. Reed (CECo) dated January 9, 1979, the staff agreed that time delays on the order of 10 seconds were desirable for low level initiation pump trips in order to avoid making the consequences of a postulated Loss of Coolant Accident (LOCA) more severe. The staff also agreed that such delays have an insignificant effect on ATWS consequences (for low level initiated ATWS pump trips only). Therefore, the staff finds the 9 second delay for the low level initiated RPT to be acceptable.

The staff finds that one area of the RPT design (e.g., diversity) is not in compliance with the ATWS Rule 10 CFR 50.62, and as a result, the RPT system is not acceptable *. This is discussed in more detafl 1n Section 4.4 of this SER.

6.0 TECHNICAL SPECIFICATIONS The equipment required by the ATWS Rule to reduce the risk associated with an ATWS event must be designed to perfonn its function 1n a reliabfe manner.

A method acceptable to the staff for demonstrating that the equipment satisfies the reliability requirements of the ATWS Rule is to provide equipment technical specifications including operability and surveillance requirements. The staff will provide guidance on technical specification requirements for the ARI and the RPT systems in a separate document.

7.0 REFERENCES

1.

Conmonwealth Edison Company letter from I. M. Johnson to NRC dated September 30, 1987.

2.

Commonwedlth Edison Company letter from I. M. Johnson to NRC dated May 9, 1988.

3.

NRC letter from H. R. Denton to C. Reed of Cormionwealth Edison Company dated January 9, 1979.

4.

BWROG Topical Report NEDE-31096-P "Anticipated Transients Without Scram; Response to NRC ATWS Rule 10 CFR 50.62," dated December 1985.

5.

Stdff SER on BWROG Topical Report NEDE-31096-P letter from Gus Lainas (NRC) to Terry A. Pickens (BWR Owners' Group Chainnan) dated October 21, 1986.

Principal Contributor:

H. Li Dated: October 8, 1988