ML17223A583

Forwards Response to Generic Ltr 89-19, Request for Action Re Resolution of USI A-47, 'Safety Implications of Control Sys in LWR Nuclear Power Plants,' Per 10CFR50.54(f)

ML17223A583
Person / Time
Site:	Saint Lucie
Issue date:	03/19/1990
From:	Goldberg J FLORIDA POWER & LIGHT CO.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
REF-GTECI-A-47, REF-GTECI-SY, TASK-A-47, TASK-OR GL-89-19, L-90-106, NUDOCS 9003260394
Download: ML17223A583 (12)

Text

ACCELERATED DIRIBUTION DEMON~TION SYSIEM j 'e y

REGULATORY INFORMATION DISTRIBUTION SYSTEM (RIDS)

ACCESSION NBR:9003260394 DOC.DATE: 90/03/19 NOTARIZED: YES DOCKET FACIL:50-335 St. Lucie Plant, Unit 1, Florida Power 6 Light Co. 05000335 50-389 St. Lucie Plant, Unit 2, Florida Power 6 Light Co. 05000389 AUTH. NAME AUTHOR AFFILIATION GOLDBERG,J.H. Florida Power 6 Light Co.

RECIP.NAME RECIPIENT AFFILIATION Document Control Branch (Document Control Desk)

SUBJECT:

Responds to Generic Ltr 89-19, "Request for Action re Resolution of USI A;47."

CODE: AOOID k'ISTRIBUTION COPIES RECEIVED:LTR Q ENCL ( SIZE:

TITLE: OR Submittal: General Distribution NOTES:

RECIPIENT COPIES RECIPIENT COPIES ID CODE/NAME LTTR ENCL ID CODE/NAME LTTR ENCL PD2-2 LA 1 1 PD2-2 PD 1 1 NORRIS,J 5 5 INTERNAL: ACRS 6 6 NRR/DET/ECMB 9H 1 1 NRR/DOEA/OTSB11 1 1 NRR/DST 8E2 1 1 NRR/DST/SELB 8D 1 1 NRR/DST/SICB 7E 1 1 NRR/DST/SRXB 8E 1 1 NUDOCS-ABSTRACT 1 1 OC 1 0 OGC/HDS2 1 0 R FILE 1 1 RES/DSIR/EIB 1 1 EXTERNAL: LPDR 1 1 NRC PDR NSIC 1 1 NOTE TO ALL "RIDS" RECIPIENTS:

PLEASE HELP, US TO REDUCE WASTEI CONTACT THE.DOCUMENT CONTROL DESK, ROOM Pl-37 (EXT. 20079) TO ELIMINATEYOUR NAME FROM DISTRIBUTION LISIS FOR DOCUMENTS YOU DON'T NEEDt TOTAL NUMBER OF COPIES REQUIRED: LTTR 27 ENCL 25

0 P.O. Box14000, Juno Beach, FL 33408-0420 MARCH 4 9 ~99O L-90-106 10 CFR 50.54(f)

U. S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, D. C. 20555 Gentlemen:

Re: St. Lucie Units 1 and 2 Docket Nos. 50-335 and 50-389 Generic Letter 89-19 Request. for Action Related to Resolution of Unresolved Safety Issue A-47 "Safety Implications of Control Systems in LWR Nuclear Power Plants" Pursuant to 10 CFR 50.54 f As a result of the technical resolution of USI A-47, "Safety Implications of Control Systems in LWR Nuclear Power Plants," the

'NRC concluded that protection should be provided for certain control system failures, and, for certain plants, that selected emergency procedures should be modified to assure that plant transients resulting from control system failures do not compromise public safety.

Generic Letter 89-19, issued September 20, 1989, provided recommendations for control system design and procedural modifications for resolution of USI A-47. Specifically, Generic Letter 89-19 recommended that all Combustion Engineering plant designs provide automatic steam generator overfill protection to mitigate main feedwater (MFW) overfeed events, and that plant procedures and technical specifications include provisions to periodically verify the operability of the MFW overfill protection and ensure that the automatic overfill protection is operable during reactor power operation. Additionally, it that all utilities that have plants designed with high pressure was recommended injection pump discharge pressures less than or equal to 1275 psi reassess their emergency procedures and operator training programs and modify them, as needed, to ensure that the operators can handle the full spectrum of possible small-break loss of coolant accident scenarios.

Florida Power 6-Light Company's response to the recommendations in Generic Letter 89-19 for St. Lucie Units 1 and 2 is attached.

9003260394 9003i9 PDR ADOCK 05000335 P PD.C ,oI an FPL Group company

0 t

~ t

~\

i

U. S. Nuclear Regulatory Commission L-90-106 Page two Should there be any questions regarding the attached information, please contact us.

V ry truly yours, J. H. Goldberg Executive Vice President JHG/MSD/gp Attachment cc: Stewart D. Ebneter, Regional Administrator, Region Senior Resident Inspector, USNRC, St. Lucie Plant II, USNRC

STATE OF FLORIDA )

) ss.

COUNTY OF PALM BEACH )

J. H. Goldber being first duly sworn, deposes and says:

That he is Executive Vice President, of Florida Power & Light Company, the Licensee herein; That he has executed the foregoing document; that the statements made in this document are true and correct to the best of his knowledge, information and belief, and that he is authorized to execute the document on behalf of said Licensee.

J. H. Goldbe Subscribed and sworn to before me this

~7day of

'NOTARY PUBL C, in and for th ounty of

<,. Palm Peach, State of Florida Not%, pobrir, State of HorMa on Exp res lone 1 1993 Ny t:omm~ s Iasaraaca Inc.

Soadad rheo Troy Fain

.My,Commission expires

/

4t~

<</~

~l /j l

ATTACHMENT Response to Generic Letter 89-19, Unresolved Safety Issue Im lementation of Control S stems in LWR Power Plants~~ A-47'~Safet Back round The purpose of Generic Letter 89-19 is to ensure that all power plants have reactor vessel or steam generator overfill protection.

Additionally, it was recommended that all utilities that have plants designed with high pressure injection pump discharge pressures less than or equal to 1275 psi reassess their emergency procedures and operator training programs and modify them, as needed, to ensure that the operators can handle the full spectrum of possible small-break loss of coolant accident scenarios. to Generic Letter 89-19 discusses the recommendations for Combustion Engineering (CE) Nuclear Steam Supply System pressurized water reactors like St. Lucie. The recommendations are:

(1) All CE plants provide automatic steam generator overfill protection.

(2) All CE plants provide plant procedures and technical specifications for periodic surveillance of the overfill protection.

(3) CE plants with high pressure injection pump discharge pressures less than 1275 psi reassess their emergency procedures and operator training to ensure safe shutdown during any postulated small break loss of coolant accident.

In Enclosure 2 the NRC concludes, "CE-designed plants do not provide automatic steam generator overfill protection that terminates MFW flow." FPL is of the position that, with respect to St. Lucie Units 1 and 2, this is incorrect and both units have steam generator overfill protection systems to satisfactorily resolve USI A-47. The recommendations outlined in Section 4 of are discussed below for St. Lucie Units 1 and 2.

Recommendation 4a It is recommended automatic, steam that all Combustion Engineering plants provide generator overfill protection to mitigate main feedwater (MFW) overfeed events. The design for the overfill-protection system should be sufficiently separate from the MFW control system to ensure that the MFW pump will trip on a steam generator high-water-level signal when required, even if a loss of power, a loss of ventilation, or a fire in the control portion of the MFW control system should occur. Common failure modes that could disable overfill protection and the feedwater control system, but, would still result in a feedwater pump trip, are considered acceptable failure modes.

FPL Res onse:

Steam Generator Overfill S stem Descri tion St. Lucie Units 1 and 2 use a 2-of-4 coincidence logic for steam generator overfill protection from four Reactor Protective System (RPS) level loops per steam generator. The loops provide high and high-,high level isolation signals. These signals result in feedwater regulating valve closu're on high steam generator level and feedwater pump trip and main turbine trip on high-high steam generator level. The initiating signals are used in non-safety related overfill protection circuits. The level loops which initiate steam generator isolation (feedwater regulating valve closure, feedwater pump trip and main turbine trip) are different from the level channels used for normal feedwater regulating valve control.

The high level isolation signal from the RPS level indicating controllers provides a feedwater control override signal, which results in closure of the feedwater regulating valve for the respective train. Although the initiating signal is generated from the RPS level loops, the main feedwater regulating valve isolation function is integral to the feedwater control system. The high-high level isolation function is accomplished independently of the feedwater system via a separate circuit. Upon receipt of a high-high level isolation signal, with a 2-of-4 coincidence from either steam generator, a trip relay is energized. This relay trips both feedwater pumps and energizes a second trip relay and an .auto stop solenoid. The second trip relay provides annunciation. The auto stop solenoid provides for a main turbine trip by closing the turbine stop/control valves.

The initiating logic for steam generator overfill protection is from either of two sets of four safety-grade, independent RPS transmitter loops. The signals initiate from level indicators which are mounted on the Reactor Turbine Generator Board. The St.

Lucie Unit 2 signals pass through isolation cabinets; the Unit 1 signals do not. The signals then pass through common (separate circuits) "normal/bypass" control switches. The high level signal then ties into the feedwater regulating system modules. The high-high level signal ties into the two trip relays and turbine stop solenoid.

Review of the power supplies for the feedwater control system and the steam generator overfill protection circuit shows they are from different sources. The normal power supplies for a single feedwater control train and the overfill protection system are ultimately fed from a common 480 volt switchgear (Unit 1) or 4160 volt bus (Unit 2); however, the feedwater control system is supplied 120 volt AC power and the steam generator overfill protection system is provided 125 volt DC. The steam generator overfill protection circuit is provided back-up emergency power from the 2B(1A) station battery in the event normal power is lost.

Each train of the feedwater control system is also provided with an automatic transfer to a back-up power source from the 120 volt vital AC cabinets, to ensure further reliability. This source is

V

~ t ultimately powered from the 2AB(lAB) swing bus, which can be manually aligned to either train "A" or "B" 480 volt AC switchgear.

Emergency back-up power is also provided via the 2D(1D) station battery and associated inverter.

Common Failure Modes Discussion Various potential common mode failures between the feedwater control system and the steam generator overfill protection circuits were evaluated. The limiting common mode failures evaluated were for a loss of power, a common fire, and failure of the shared override/manual control switch.

Power Loss The normal power supplies for the feedwater control and steam generator overfill protection circuits are not totally independent (as discussed above); however, the back-up supplies are sufficiently independent to ensure operability of one or both systems in the event a common normal bus is lost. The steam generator overfill protection circuitry is provided back-up 125 volt DC power from safety-related station battery 2B(1A), such that the feedwater pump trip should still occur if a high-high steam generator level condition occurs coincident with a loss of normal power. Similarly, the feedwater control system is provided with an automatic transfer to the 120 volt AC vital bus (fed off the "AB" 480 volt Motor Control Center) in the event normal power is lost. This feedwater control power source is further backed-up by the 2D(1D) battery. Furthermore, the design of the feedwater control system requires the feedwater regulating valve to fail closed on a loss of power, such that even in the remote event (multiple failure) the common bus and the back-up power supplies are lost, feedwater flow will still be isolated for the affected train.

Fire In the event of a fire in the control room, the feedwater control and overfill protection systems are not sufficiently separate to ensure the operability of at least one system. The two systems have circuitry, which share common "Norm/bypass" handswitches in the control room, common cable tray routing and are located within adjacent control room panels. Given a fire of a large magnitude, which renders the control room uninhabitable, a manual reactor/turbine trip would be initiated prior to leaving the control room and safe shutdown would be accomplished from the remote shutdown panel. Main feedwater flow would be isolated per operating procedures and steam generator level is controlled via auxiliary feedwater.

Shared Control Switch The final common mode failure postulated was the failure of a common "normal/bypass" handswitch due to inadvertent mispositioning, contact failure "open," or short to ground.

Inadvertent mispositioning of the handswitches is not credible, as annunciation is provided to warn mispositioned. Furthermore, if if any of the four switches is a single handswitch is mispositioned or its contacts fail open, the high and high-high overfill protection are still operable. A 2-of-3 coincidence will now be required to initiate a high/high-high steam generator isolation signal. In the event a single switch shorts to ground, both the feedwater control and steam generator overfill protection circuits lose power and the feedwater regulating valves fail close.

Based on the above, FPL concludes that the steam generator overfill protection system currently installed in St. Lucie Units 1 and 2 provides adequate assurance that a steam generator overfill event will be prevented.

Recommendation 4b It is recommended that plant specifications for all Combustion procedures and technical Engineering plants include provisions to verify periodically the operability of overfill protection and ensure that automatic main feedwater overfill protection is operable during reactor power operation. The instrumentation should be demonstrated to be operable by the performance of a channel check, channel functional testing, and channel calibration, including setpoint verification and by identifying the LCOs. These technical specifications should be commensurate with existing plant technical specification requirements for channels that initiate protection actions.

FPL Res onse:

St. Lucie Plant procedures include provisions to periodically verify. steam generator overfill protection and ensure that automatic main feedwater overfill protection is operable during reactor power operation. Testing of the steam generator high and high-high level circuitry is completed on an 18 month refueling basis by functionally testing the circuitry using the 2-of-4 logic to close the feedwater regulating valve, trip the feedwater pump and trip the turbine.

The NRC staff is currently reviewing the Nuclear Steam Supply System (NSSS) vendor specific revised standard technical specifications developed using the criteria of the NRC interim policy statement on technical specification improvements (Federal Register p. 3788/Vol. 52 No. 25/Friday, February 6, 1987).

Recommendations for specific Limiting Conditions for Operation (LCO) pertaining to steam generator overfill protection should be addressed as part of the review of the improved NSSS vendor technical specification submittals. In addition, FPL reviewed the criteria of the Commission's interim policy statement on technical specification improvements pertaining to the identification of LCOs to be included in the technical specifications. It was concluded through use of the criteria in the interim policy statement that additional LCOs for the steam generator overfill protection system

are not appropriate for inclusion in the St. Lucie Plant Technical Specifications. FPL believes that, the requirements for testing the steam generator overfill protection system can be controlled through the plant procedures.

Recommendation 4c Reassess emergency procedures and operator training programs and modify them, as needed, to ensure that the operators can handle the full spectrum of possible small-break loss-of-coolant-accident (SBLOCA) scenarios. This may include the need to depressurize the primary system via the atmospheric dump valves or the turbine bypass valves and cool down the plant during some SBLOCA. The reassessment should ensure that a single failure would not negate the operability of the valves needed to achieve safe shutdown. The procedures should clearly describe any actions the operator is required to perform in the event a loss of instrument air or electric power prevents remote operation of the valves. The use of the pressurizer PORVs to depressurize the plant during a SBLOCA, if needed, and the means to ensure that the RT>>, (reference temperature, nil ductility transition) limits are not compromised, should also be clearly described.

FPL Res onse:

St. Lucie Plant Emergency Operating Procedure, EOP-3, Loss of Coolant Accident (LOCA), provides operator instructions and contingency actions for the full spectrum of LOCA scenarios.

Guidance is provided within EOP-3 for cooldown and depressurization of the plant. This procedure addresses cooldown and depressurization by means of the Steam Bypass Control System (SBCS). When the SBCS is unavailable, guidance contained in the contingency actions of EOP-3 is given to use the Atmospheric Dump Valves (ADV) to cooldown and depressurize the plant. EOP-3 is written to allow cooldown and depressurization of the plant with either a Loss of Offsite Power (LOOP) or the loss of a single emergency electrical train. Loss of instrument air or an electrical casualty may require manual operation of the ADVs.

Manual operation of the ADVs is possible and is included in operator training classes. 'he inability to cooldown and depressurize the plant using the SBCS or the ADVs constitutes the loss of a Safety Function. Upon the loss of Safety Function, procedural guidance and training on the use of Emergency Operating Procedures directs the operator to EOP-15, Functional Recovery.

Cooldown and depressurization of the plant would then be affected through use of EOP-15, RCS and Core Heat Removal Success Path 4, once through cooling using the Pilot Operated Relief Valves (PORV).

The RT>>I criteria are met through compliance with Figure One (Pressure/Temperature Curves), which is provided in all Emergency Operating Procedures, and Pressurized Thermal Shock (PTS) Criteria which are provided in the appropriate Emergency Operating Procedures involving complicated reactor trips.

Additionally, FPL is participating in a Combustion Engineering Owner's Group task of conducting an assessment of the potential for inadequate core cooling during a small break LOCA.