ML17251A178
| ML17251A178 | |
| Person / Time | |
|---|---|
| Site: | Ginna  |
| Issue date: | 07/19/1988 |
| From: | Snow B ROCHESTER GAS & ELECTRIC CORP. |
| To: | Stahle C NRC |
| References | |
| NUDOCS 8807270248 | |
| Download: ML17251A178 (16) | |
Text
SUBJECT:
Forwards mods to Responses 3,9,11
& 12,per 880615 telcon.SER requested for installation of equipment during 1989 outage.
DISTRIBUTION CODE:
A048D COPIES RECEIVED:LTR l ENCL I
SIZE:
TITLE: OR/Licensing Submittal:
Equipment Qualification D
05000244 8
NOTES:License Exp date in accordance with 10CFR2,2.109(9/19/72).
ACCELEBRATED Dl BUTTON DEMONSTR TION SYF?'EM REGULAT INFORMATION DISTRIBUTION<
STEM (RIDS) j ACCESSION NBR:8807270248 DOC.DATE: 88/07/19 NOTARIZED:
NO DOCKET FACIL:50-244 Robert Emmet Ginna Nuclear Plant, Unit 1, Rochester G
05000244 AUTH. NAME AUTHOR,AFFILIATION SNOW,B.A.
Rochester Gas
& Electric Corp.
RECIP.NAME RECIPIENT AFFILIATION Document Control Branch (Document Control Desk)
RECIPIENT ID CODE/NAME PDl-3 LA STAHLE,C INTERNAL: ARM/DAF/LFMB NRR/DEST/MEB 9H NUDO BSTRACT
~ILE 01 EXTERNAL: LPDR NSIC COPIES LTTR ENCL 1
0 1
1 1
0 1
1 1
1 1
1 1
1 1
1 RECIPIENT ID CODE/NAME PD1-3 PD NRR/DEST/ADE 8H NRR/DEST/SGB 8D OGC 15-B-18 RES/DSIR/EIB NRC PDR COPIES LTTR ENCL 1
0 1
0 1
1 1
1 1
1 h
h TOTAL NUMBER OF COPIES REQUIRED:
LTTR 14 ENCL 10
xxutzzzzz zzzztzz yaw< y~rsa z&
~z iruzzsu
~
r ROCHESTER GAS AND ELECTRIC CORPORATION o 89 EAST AVENUE, ROCHESTER, N.Y. 14649-0001 July 19, 1988 TCLCRNOHC ARCA CODE 710 546-2700 U.S. Nuclear Regulatory Commission Document Control Desk Attn:
Mr. Carl Stahle PWR Project Directorate No.
1 Washington, D.C.
20555
Subject:
Clarification of April 29, 1988 AMSAC Submittal R.E.
Ginna Nuclear Power Plant Docket No. 50-244
Dear Mr. Stahle:
Based on a
June 15, 1988 telecon between RG&E and NRC personnel, we wish to make several clarifications to our April 29, 1988 AMSAC submittal.
Modifications to our responses 3,
9, 11 and 12, as requested in the telecon, are included in the enclosure.
The changes are marked with a change bar for clarity.
Based.
on these responses, RG&E requests that an SER be
- issued, so that this equipment can be installed during the Spring 1989 refueling outage.
Very truly yours, Bruce A. Snow Superintendent Nuclear Production Enclosure Ssp7p pp48 8850ppp PDR ADOCK 0 PNV
ENCLOSURE MODIFICATIONS TO RG&E RESPONSES OF APRIL 29 1988 ON AMSAC The plant-specific submittal.should indicate the degree of diversity that exists between the AMSAC equipment and the existing Reactor Protection System.
Equipment diversity to the extent reasonable and practicable to minimize the potential for common cause failures is required from the sensors output to, but not including, the final actuation
- device, e.g.,
existing circuit breakers may be used for the auxiliary feedwater initiation.
The sensors need not be of a diverse design or manufacture.
Existing protection system instrument-sensing lines,
- sensors, and sensor power supplies may be used.
Sensor and instrument sensing lines should be selected such that adverse interactions with existing control systems are avoided.
R~es onse The RGGE AMSAC design utilizes
- Feedwater Low Flow to sense and respond to an ATWS event.
Figure 1 illustrates how the AMSAC system inputs are to be obtained from the existing feedwater flow instrumentation.
Existing Ginna Station reactor protection hardware consists of Foxboro H
Line (Consotrol) signal processing and Westinghouse BF output relays.
For diversity, the new AMSAC hardware will consist of Foxboro Spec 200 and.Spec 200 Micro signal processing, and Magnecraft output relays to minimize the potential for common cause failures.
2.
Lo ic Power Su lies The plant-specific submittal should discuss the logic power supply design.
According to the rule, the AMSAC logic power supply is not required to be safety-related (Class 1E).
- However, logic power should be from an instrument power supply that is independent from the Reactor Protection System (RPS) power supplies.
Our review of additional.
information submitted by WOG indicated that power to the logic circuits will utilize RPS batteries and.
inverters.
The staff finds this portion of the design unacceptable, therefore, independent power supplies should be provided.
~Res onse The power to the AMSAC logic circuitry will be provided by the existing Technical Support Center (TSC) battery which is independent of the RPS and will not fail upon loss of offsite power.
3.
Safet -Related Interface The plant-specific submittal should show that the implementation is such that the existing protection system continues to meet all applicable safety criteria.
~Res onse The existing RPS will be isolated from the AMSAC logic by
.means of existing Foxboro M/66BR-OH current repeaters and new Magnecraft output relays.
Therefore, the existing RPS will continue to meet all applicable safety criteria, as provided in Section 7.2 of the Ginna Station UFSAR.
4.
alit Assurance The plant-specific submittal should provide information regarding compliance with Generic Letter 85-06, "Quality Assurance Guidance for ATWS Equipment that is not Safety-.
Related".
~Res onse RG&E will implement an existing Quality Assurance Program developed for "Non-Seismic Category I - Safety-Related Items" for the
- design, fabrication, installation, inspection, test and operation of AMSAC equipment.
This program meets or exceeds the guidance provided in Generic Letter 85-06.
The program is defined. in Section 2.2 of Appendix A to the Ginna Station Quality Assurance Manual.
A copy of Appendix A has been previously provided to the NRC.
5.
Maintenance B
asses The plant-specific submittal should discuss how maintenance at power is accomplished and how good human factors engineering practice is incorporated into the continuous indication of bypass status in the Control Room.
R~es onse Maintenance at power will require placing the AMSAC system in a
bypass mode which will isolate the AMSAC output relays from the turbine trip and the auxiliary feedwater pump start logic.
The continuous indication of.
bypass status in the Control Room, as well as all Control Room modifications, will require a
human factors engineering review.
The conceptual design is reviewed by
the RGGE Nuclear Engineering group to ensure that the modification meets the principles of human factors engineering as established by the guidelines of NUREG-0700.
Modification design cannot be finalized until approval of the human factors engineering considerations is obtained.
6.
eratin B
asses The plant-specific submittal should state that operating bypasses are continuously indicated in the Control Room; provide the basis for the 70% or plant-specific operating bypass level; discuss the human factors design aspects of the continuous indication; and discuss the diversity and independence of the C-20 permissive signal (defeats the block of AMSAC).
~Res ense The AMSAC operating bypass will be continuously indicated in the Control Room.
The AMSAC system actuation signals are blocked below a
level of 40 percent
- power, as determined by one of two turbine load signals being below predetermined.
setpoints.
Both of the turbine load signals exceeding their setpoint (corresponding to 40 percent power) will arm the AMSAC logic, and permit actuation of the turbine trip and auxiliary feedwater start circuits.
The interlock is provided consistent with WCAP-11436, since it has been demonstrated that the Reactor Coolant System pressure does not approach the ASME stress level C limit of 3200 psig when an ATWS event occurs below 40 percent power.
This will be provided to insure that spurious AMSAC actuations do not occur at low power operations and during startup.
The block will automatically be removed as power increases above the 40t level and. reinstated as power decreases below the 40%
level.
A human factors review of the bypass continuous indication will be performed as discussed in Item 5.
Diversity and independence of the C-20 permissive will be achieved in the same manner as for the feedwater flow analog inputs described. in Items 1 and 3.
Refer to Figure 2 for a, functional block diagram of the Low Feedwater Flow AMSAC logic for Ginna Station.
Actuation of AMSAC will occur on low main feedwater flow as measured by existing main feedwater flow sensor/transmitters.
The setpoint to actuate AMSAC will be 25% of nominal main feedwater flow., Although 25% flow is more than ample to protect against overpressure in the event of an
- ATWS, instrumentation error would become unacceptably large if a substantially lower setpoint were
used.
A variable time delay unit is required on the low main feedwater flow channels to adjust the AMSAC actuation response time.
This allows the Reactor Protection System to g'enerate a protective signal before AMSAC actuation trips the turbine and starts the auxiliary feedwater flow.
The delay unit will be designed such that the delay time is dependent on turbine load (i.e., turbine impulse chamber pressure).
The input signal to the variable time delay unit will be derived from two turbine impulse pressure chamber
- signals, each with a
lag placed, on'he circuit.
The two lagged signals will then be auctionee'red high and the resulting signal is the turbine power input to the variable time delay.
If one of the channels of the turbine impulse chamber pressure signals is unavailable, the signal from the remaining channel will be used as an input to the variable time delay unit.
The time delay is a function of compensated turbine power and will be within the acceptable range shown in Figure 2-4 of WCAP-10858P-A, Rev.
1.
Removal of the C-20 permissive signal will be delayed for at least 30 seconds longer than the value of the variable timer at 409. nominal full turbine load. to avoid blocking AMSAC before it can perform its function in the event a
turbine trip occurs.
7.
Means of B assin The plant-specific submittal should state that the means for bypassing is accomplished with a
permanently installed, human
- factored, bypass switch or similar
- device, and verify that disallowed methods mentioned in the guidance are not utilized.
~Res ense The means for bypassing the AMSAC actuation logic will be.
a permanently installed, human. factored, manual bypass switch located on the main control board.
The manual bypass will not involve lifting leads, pulling fuses, manually tripping relays, or physically blocking relays.
8.
Manual Initiation The plant-specific submittal should discuss how a manual turbine trip and auxiliary feedwater actuation are accomplished.
by the operator.
Jl
~Res ense A manual turbine trip is accomplished by actuating the single Manual Turbine Trip pushbutton on the main control board.
Auxiliary feedwater flow is manually initiated by moving both motor driven auxiliary feedwater pump breaker control switches on the main control board from auto to the close position.
The turbine driven pump is started by moving the control switch for either of the two redundant turbine driven pump steam admission valves to the open'osition.
9.
Electrical Inde endence from Existin Reactor Protection
~Sstem The plant.-specific submittal should show that electrical independence is achieved.
This is required from the sensor output to the final actuation device at which point non-safety-related circuits must be isolated from safety-related circuits by qualified Class 1E isolators.
Use of existing isolators is acceptable.
- However, each plant-specific submittal should. provide an analysis and tests which demonstrate that the existing isolator will function under the maximum worst case fault conditions.
The required method for qualifying either the existing or diverse isolators is presented in Appendix A.
~Res ense Electrical independence from existing Reactor Protection System instrumentation is achieved with existing Fozboro M/66BR-OH current repeaters (isolators).
The qualification and effectiveness of these isolators'bility to provide electrical isolation of maximum credible faults has been evaluated under SEP Topic VII-1.A and, on July 30,
- 1981, the NRC formally concluded that the Foxboro M/66BR-OH isolators in use at Ginna Station are suitably qualified for providing Class 1E isolation and satisfy all current licensing criteria.
Electrical independence from existing auxiliary feedwater and turbine trip hardware will be provided by Class 1E Magnecraft Class 199 NW199ABX-14 electromechanical contact
,output relays.
Documentation of 'Class 1E qualification is, contained. in Farwell and Hendricks, Inc.
Test Report No.
60142 dated September 28,
- 1987, on file at RGGE.
An evaluation documenting the compliance of the output relay to the Appendix A requirements follows:
~
~
1'
- a. For the type of device used. to accomplish electrical isolation, describe the specific testing performed, to demonstrate that the device is acceptable for its application(s).
This description should include elementary diagrams when necessary to indicate the test configuration and. how the maximum, credible faults were applied 'to the devices.
R~es onse Refer to Attachment I for the AMSAC output relay test elementary and, test procedure.
- b. Data to verify that the mwmaum credible faults applied during the test were the maximum voltage/current to which the device could be exposed, and define how the mmdmun voltage/current was determined..
~Res ense The AMSAC output relays will be located in the AMSAC instrument cabinet.
The maximum available voltage and current in the AMSAC cabinet is a 120VAC/15 amp power feed to the cabinet.
The test voltage documented in the qualification report was 600 volts.
The power supply was capable of delivering 2000 amps at this voltage.
These values clearly envelope this maximum credible fault.
- c. Data to verify that the maximum credible fault was applied to the output of the device in the transverse mode (between signal and return) and other faults were considered. (i.e., open and. short circuits).
~Res onse Attachment I illustrates that the test fault was applied to the coil (non-Class lE) side of the relay and the'esponse measured at the contact output (Class 1E) side of the relay, satisfying the intent-of this requirement.
This type of destructive test also effectively demonstrates the response of the device to open and short circuits at the input terminals.
- d. Define the pass/fail acceptance criteria for each type of device.
~Res onse As indicated in Attachment l, the test acceptance criteria is zero current flow at the relay contact output terminals.
- e. Provide a commitment that the isolation devices comply with the, environmental qualifications (10CFR50.49) and.
with the seismic qualifications which were the -basis for plant licensing.
~Res nse The AMSAC output relays comply with the environmental and seismic qualifications required for the location in which they are intended to function.
These devices are not in a harsh environment subject to 10CFR50.49.
- f. Provide a description of the measures taken to protect the safety systems from electrical interference (i.e.,
Electrostatic
R~es onse The electromechanical AMSAC output relays are not considered to be affected by electrical, interference that may be generated by the AMSAC
- circuits, therefore, no,special measures for EMX protection are required.
- g. Provide information to verify that the Class 1E isolator is powered. from a Class 1E'source.
~Res onse As illustrated in Attachment I, the coil side of the AMSAC output relay is connected to the non-Class 1E 120VAC AMSAC power source, and the contact output side is connected to the Class 1E 125VDC Auxiliary
'Feedwater Pump and Turbine Trip logic.
No additional power sources are required for,the operation of this electromechanical relay.
- 10. Physical Separation from 'Existing Reactor Protection S stem Physical separation from existing Reactor Protection System is not required, unless redundant divisions and channels in the existing reactor trip.system are not physically separated.
The implementation must be such that separation criteria applied to the existing protection system are not violated.
The plant-specific submittal should respond to this concern.
c
~Res onse To ensure physical separation from the existing
AMSAC system instrumentation and relays will be installed in a cabinet physically separate from RPS cabinets.
- 11. Environmental uglification The plant-specific submittal should address environmental qualification of ATWS equipment anticipated operational occurrences
- only, not accidents.
the for for R~es onse The AMSAC system hardware will be suitable for the environment in which it is intended to operate during anticipated operational occurrences.
AMSAC equipment is not subject to 10CFR50.49.
- 12. Testabilit at Power Measures are to be established to test, as appropriate, non-safety-related ATWS equipment prior to installation and periodically.
Testing of AMSAC may be performed. with AMSAC in bypass.
Testing of AMSAC outputs through the final actuation devices will be performed with the plant shutdown.
The plant-specific submittals should. present the test program and state that the output signal is indi'cated in the Control Room in a manner consistent with plant practices including human factors.
~Res onse Although the RG&E-installed AMSAC has the capability to be tested during power operation, RG&E has determined that the performance of such testing is not warranted.
As a
measure of good engineering
- practice, RG&E has requested our equipment supplier to provide us. with a recommendation for testing frequency, to ensure that the equipment would maintain high functional reliability.
Our vendor has recommended annual testing as the suitable frequency.
This correspondence is documented in our project engineering files.
RG&E agrees that annual testing is reasonable, particularly in light of the low probability of required equipment. operation.
- Thus, RG&E has agreed that the following periodic testing shall be performed:
0 K
I
~
~
I During each refueling shutdown, operability of the system will be tested in such a
way that the input of proper analog inputs will cause a trip of the turbine trip latch mechanism and the start of the auxiliary feedwater pumps.
The AMSAC system will not normally be testing during power operations, but if required. during maintenance or troubleshooting, operability of the AMSAC system will be testable from each analog input to the output actuation relay by placing the system in the bypass mode.
The output signal will be indicated in the Control Room in a manner consistent with plant practices including human factors.
13.
Com letion of Miti ative Action'MSAC shall be'esigned so
- that, once
- actuated, the completion of mitigating action shall be consistent with the plant turbine trip and auxiliary feedwater circuitry.
Plant-specific submittals should verify that the protective
- action, once initiated, goes to completion, and that the subsequent return to operation requires deliberate operator action.
R~es onse.
The AMSAC system will be designed so that the final actuation, signal will be sealed in until the initiating conditions are removed and a reset pushbutton on the main control board is depressed.
- 14. Technical S ecifications Technical Specification requirements related.
to AMSAC will have to be addressed by plant-specific submittals.
R~es onse The WOG has taken a
position that Technical Specifications for AMSAC are unnecessary and do not enhance the overall safety of nuclear power plants.
Normal nuclear plant administrative controls are sufficient to control AMSAC.
i
~ (+ ie II 1
ROCHESTER GAS AND ELECTRIC CORP ION I2 33 ENG.
DEPT.
STAT I ON:
N ( hJ tvg DATE:
g LtI( (gg PAGE OF MADE BY:
gI P P CK:
TEST 6~MC~AR /
FoR, 4M,~ C.
< SoLATL~Q QC.V<CE F00 q
VAC OOOO A.IAI CAPh C AT+
SovR.<S (olL I
I CO24ThC T I
1 '50YDc 5 p4NP Chi hC iTP 5oUQ~
~L0 SE 5'hl UQ III
<Oll
'57ggI QI EQ5
~Q, P'+IL$
OPC,W
3.
NE'ER, RG-C ~O(-,Cy (OOVI3 C.
ScVA.C.C.:
Ou6 LCAb OQ M,n'AL IhouNTiH C>
PLAT/
I QTi<E'R lAAib FiRQ T lo
- GNAT, Co < L TCRM-IUA,I-,l HCQ TO OTNCA.
Co< L. 't SWi uR I
'V.
>Gs EPIC cuRA.&AT 2~ nice~
o< ~cz9+
ACCCi3T i.l ag l4, VCR Ci C.VII.T46tJ'T FLOW Ihl Q i(+<&
QN I3 NVjhC-.<CgQ InJ EACH CA58 PA+vJ+t I f Q~DgaCLc.Q lVC
%ST RHORT - <<6<<'E< ]
9 hS /S7