ML17251A406
| ML17251A406 | |
| Person / Time | |
|---|---|
| Site: | Ginna  |
| Issue date: | 03/16/1989 |
| From: | NRC |
| To: | |
| Shared Package | |
| ML17251A404 | List: |
| References | |
| NUDOCS 8903230436 | |
| Download: ML17251A406 (15) | |
Text
ENCLOSURE 1
SAFETY EVALUATION REPORT R. E.
GINNA NUCLEAR POWER PLANT COMPLIANCE MITH ATMS RULE 10 CFR 50.62 DOCKET NO: 50-244
1.0 INTRODUCTION
On July 26, 1984, the Code of Federal Regulations (CFR) was amended to include Section 10 CFR 50.62, "Requirements for Reduction of Risk from Anticipated Transients Mithout Scram (ATWS) Events for Light-Water-Cooled Nuclear Power Plants" (known as the ATWS Rulc).
The requirements of Section 10 CFR 50.62 apply to all cormercial light-water-cooled nuclear power plants.
An ATMS is an anticipated operational occurrence (such as loss of feedwater, loss of condenser vacuum, or loss of offsite power) that is accompanied by a failure of the Reactor Trip System (RTS) to shut down the reactor.
The ATWS Rule requires specific improvements in the design and operation of comnercial nuclear power facilities to reduce the probability of failure*to shut down the reactor following anticipated transients and to mitigate the consequences of an ATWS event.
Paragraph (c)(1) of 10 CFR 50.62 specifies the basic ATWS mitigation system requirements for Mestinghouse plants.
Equipment, diverse from the RTS, is required to initiate the auxiliary feedwater (AFM) system and a turbine trip for ATWS events.
In response to paragraph (c)(l), the Westinghouse Owners Group (WOG) developed a set of conceptual ATWS mitigating system actuation circuitry (AMSAC) designs generic to Mestirfghouse plants.
HOG issued Westinghouse Topical Report MCAP-10858, "AMSAC Generic Design Package,"
which provided information on the various Mestinghouse designs.
ppg3g3p436 8903i6-pP DR':.-: ADOCK.=05000244
"'P,'-
=
The staff reviewed MCAP-10858 and issued a safety evaluation of the subject topical report on July 7. 1986 (Ref. 1).
In this safety evaluation, the staff concluded that the generic designs presented in WCAP-10858 adequately meet the requirements of 10 CFR 50.62.
The approved version of the WCAP -is labeled MCAP-10858-P-A.
During the course of the staff's review of the proposed AMSAC design, the.
WOG issued Addendum 1 to WCAP-10858-P-A by letter dated February 26, 1987 (Ref. 2).
This Addendum changed the setpoint of the C-20 AMSAC permissive signal from 70K reactor power to 40% power.
On August 3, 1987, the WOG issued Revision 1 to WCAP-10858-P-A (Ref. 3), which incorporated Addendum 1 changes and provided details on changes associated with a new variable timer and the C-20 time delay.
For those plants selecting either the feedwater flow or the feedwater pump/valve status logic option, a variable delay timer is to be incorporated into the AMSAC actuation logics.
The variable time delay will be inverse to reactor power and will approximate the time that the steam generator takes to boil down to the low-low level setpoint upon a loss of main feedwater (MFW) from any given reactor power level between 40% and 100% power.
The time delay on the C-20 permissive signal for all logics will be lengthened to incorporate the maximum time that the steam generator takes to boil down to the low-low level setpoint upon a
loss of MFW with the reactor operating at 40~ power.
The staff considers the Revision 1 changes to be acceptable.
Paragraph (c)(6) of the ATWS Rule requires that detailed information to demonstrate compliance with the requirements be submitted to the Director, Office of Nuclear Reactor Regulation (NRR).
In accordance with paragraph (c)(6) of the ATWS Rule, Rochester Gas and Electric Corporation (RGSE) (licensee) provided information by letter dated August 31, 1987 (Ref. 4).
The letter forwarded the detailed design description of the ATWS mitigating system actuation circuitry proposed for installation at the R. E. Ginna Nuclear Power Plant.
The staff held a conference call with the licensee on November 23, 1987, to discuss their AMSAC design.
As a result of the conference call, the licensee responded to the staff concerns by letter dated April 29, 1988 (Ref. 5).
On June 15, 1988, another conference call was held with the licensee during which isolation devices and their compliance to the requirements of Appendix A to the generic safety evaluation (Ref.
- 1) were discussed.
The licensee responded to the isolation device concerns by letter dated July 19, 1988 (Ref. 6).
2.0.
REVIEW CRITERIA The systems and equipment required by 10 CFR 50.62 do not have to meet all of the stringent requirements normally applied to safety-related equipment.
- However, the equipment required by the ATWS Rule should be of sufficient quality and reliability to perform its intended function while minimizing the potential for transients that may challenge the safety systems. e.g., inadvertent scrams.
The following review criteria were used to evaluate the licensee's submittals:
1.
The ATWS Rule, 10 CFR 50.62.
2.
"Considerations Regarding Systems and Equipment Criteria,"
published in the Federal
- Register, Volume 49, No 124, dated June 26, 1984.
3.
Generic Letter 85-06, "guality Assurance Guidance for ATWS Equipment That Is Not Safety Related."
4.
Safety Evaluation of WCAP-10858 (Ref. 1).
5.
WCAP-10858-P-A, Revision 1 (Ref. 3).
I I
5*'
ll 1
~,
k
't
3.0 DISCUSSION AND EVALUATION To determine that conditions indicative of an ATWS event are present, the licensee has elected to implement the WCAP-10858-P-A AMSAC design associated with. monitoring the main feedwater (MFW) flow and activating the AMSAC when the MFW flow is below the low flow setpoint.
Also the licensee will implement the new time delays (as described in the introduction section) associated with the C-20 permissive timer and the variable timer consistent with the requirements of Revision I to the WCAP.
Many details and interfaces associated with the implementation of the final AMSAC design are of a plant-specific nature.
In its safety evaluation WCAP-10858, the staff identified 14 key elements that require resolution for each plant design.
The following paragraphs provide a discussion on the licensee's compliance with respect to each of the plant-specific elements.
l.
~Dlvereft The plant design should include adequate diversity between the AMSAC equipment and the existing Reactor Protection System (RPS) equipment.
Reasonable equipment diversity, to the extent practicable, is required to minimize the potential for common-cause failures.
The licensee has provided information to confirm that the microprocessor-based AMSAC logic circuits will be diverse from the discrete logic circuits of the RPS in the areas of design, equipment, and manufacturing.
Where similar types of components are used, such as output relays, the AMSAC will utilize equipment of a different make and manufacturer.
2.
Lo ic Power Su lies Logic power supplies need not be Class 1E, but must be capable of performing the required design functions upon a loss of offsite power:.
The logic power must come from a power source that is independent from the RPS power supplies.
The licensee has provided information verifying that the logic power supplies selected for the Ginna AMSAC logic circuits will provide the maximum available independence from the RPS power supplies.
The AMSAC will be powered from nonsafety-related power supplies capable of operating upon a loss of offsite power.
3.
Safet -Related Interface The implementation of the ATWS Rule shall be such that the existing RPS continues to meet all applicable safety criteria.
The proposed Ginna AMSAC design interfaces at its input with the existing Class 1E circuits of the reactor protection system (RPS) main feedwater flow instrumentation and turbine first-stage impulse pressure instrumentation.
At its output, the AMSAC will interface with the Class lE circuits of the AFW pumps.
Connections to 'these Class 1E circuits will be made through the use of approved Class 1E isolation devices.
The licensee has confirmed to the staff that the existing safety-related criteria that are in effect at the R. E. Ginna plant and described in the FSAR Update Section 7.2 will continue to be met after the implementation of AMSAC (i.e., the RPS will perform its safety functions without interference from AMSAC).
Refer to Item 9 for further discussion on this issue.
4.
ualit Assurance The licensee is required to provide information regarding compliance with Generic Letter (GL) 85-06, "guality Assurance for ATWS Equipment That Is Not Safety Related."
I
~
~
I The criteria of the NRC quality assurance guidance (GL 85-06) were reviewed by the licensee.
The licensee stated that the quality assurance practices at the R. E. Ginna Plant, as applicable to nonsafety-related AMSAC equipment, 1
meets or exceeds the guidance provided by GL 85-06.
5.
Maintenance 8
asses Information showing how maintenance at power is accomplished should be provided.
In addition, maintenance bypass indications should be incorporated into the continuous indication of bypass status in the control room.
The licensee provided information showing how maintenance will be accomplished at power.
The staff was informed that maintenance at power will be accomplished by inhibiting (through a permanently installed switch) the operation of AMSAC's output relays, which will block the output signal and, thus, prevent it from reaching the final actuation devices.
The continuous indication of bypass status will be provided in the main control room through the use of status lights and annunciation.
This indication will be installed consistent with the human-factors guidelines in effect at the plant.
6.
0 eratina 8
asses The operating bypasses should be indicated continuously in the control room.
The independence of the C-20 permissive signal should be addressed.
The licensee has provided information stating that an AMSAC operating bypass (C-20) will be used to enable the operators to bring the plant up in power during startup and to avoid spurious AMSAC actuations at power levels below 40Ã reactor power (the C-20 setpoint).
Above 40K reactor power, the C-20 will automatically arm the AMSAC logic.
Upon the loss of the C-20 input (turbine impulse pressure signal), the C-20 permissive signal will be maintained for 30 seconds longer than the value of the variable timer at 40K reactor power.
This is consistent with Revision I to WCAP-10858-P-A.
The licensee has determined that the time delay is sufficient to ensure that
\\
l s
AMSAC will perform its function in the event of a turbine trip (loss of load ATMS).
The C-20 permissive signal will originate from existing first-stage turbine impulse chamber pressure sensors.
This signal will be taken downstream from qualified isolators and will not interfere with the RPS.
The operating bypass will be indicated continuously in the control room via annunciation and status lights whenever it arms or enables the AMSAC.
This indication will be consistent with the accepted human-factors guidelines in effect at the plant.
7.
Means for B
asses The means for bypassing shall be accomplished by using a permanently installed, human-factored, bypass switch or similar device.
Disallowed methods for bypassing mentioned in the guidance should not be utilized.
The licensee's response stated that a permanently installed control switch will be used for the bypass function.
The disallowed methods for bypassing, such as lifting leads, pulling fuses, blocking relays, tripping breakers, will not be used.
The bypass switch is located on the main control board.
The licensee will conduct a human-factors review of the AMSAC maintenance and test bypass controls and indications consistent with the plant's detailed control room design process including taking into account the applicable human factors considerations described in NUREG-0700.
8.
Manual Initiation Manual initiation capability of the AMSAC function must be provided.
In the plant-specific submittal, the licensee discussed how manual turbine trip and auxiliary feedwater actuation are accomplished by the operator.
In summary, the operator can use existing manual controls to perform a turbine trip and to start auxiliary feedwater flow should it be necessary.
- Thus, no additional manual initiation capability is required as a result of installing the AMSAC eqgipment.
9.
Electrical Inde endence From Existin Reactor Protection S stem Independence is required from the sensor output to the final actuation device, at which point nonsafety-related circuits must be isolated from safety-related circuits by qualified Class lE isolators.
The licensee discussed how electrical independence is to be achieved.
The proposed design requires isolation between the non-Class 1E ANSAC and the Class 1E circuits associated with the RPS main feedwater flow instrumentation, the turbine first stage impulse chamber pressure
- signals, and the AFM pumps.
The licensee has informed the staff that the required isolation will be achieved using electrical isolation devices that have been qualified and tested to Class 1E electrical equipment requirements.
In addition, the
'solators were tested as described in Appendix A to the safety evaluation (Ref. I) and, thus, are acceptable for use at Ginna as qualified isolators for this application.
10.
Ph sical Se aration From Existin Reactor Protection S stem The implementation of the ATMS mitigating system must be such that the separation criteria applied to the existing RPS are not violated.
The licensee stated that the NSAC circuitry will be physically separated from the RPS circuitry.
The licensee has further stated that the cable routing will be independent of protection system cable routing and that the ATMS equipment cabinets will be located so that there will be no interaction with the protection system cabinets.
The licensee also stated that the RPS design will continue to meet the separation criteria originally established for the R. E. Ginna plant during initial plant licensing, and that the RPS wilI not be compromised as a result of the NSAC installation and implementation.
11.
Environmental ual ification The plant-specific submittal should address the environmental qualification of ATMS equipment for anticipated operational occurrences.
The licensee stated that NSAC mitigation equipment will be located in areas of the plant that are considered to be a mild environment.
The licensee also stated that the equipment will be environmentally qualified for anticipated operational occurrences that might occur associated with the respective equipment locations.
12.
Testabilit at Power Measures to test the ATMS mitigating system before initial operation, as, well as periodically, are to be established.
Testing may be performed with the system in the bypass mode.
The testing from the input sensor through to the final actuation device should be performed with the plant shut down.
The licensee stated that, based on engineering recommendations, the ATWS mitigative system will be tested periodically during the life of the plant.
The periodic test will consist of an end-to-end test.
The end-to-end test of the ANSAC system, including the AMSAC outputs through to the actuation devices, will be performed during each refueling outage.
The licensee further stated that the NSAC design is capable of being tested while at power.
The at-power tests will be performed for maintenance or troubleshooting purposes.
The bypass of the NSAC output actuation devices will be accomplished through the use of q permanently installed bypass switch, which will negate the need to lift leads, pull fuses, trip breakers, or physically block relays.
Status outputs to the main control board, indicating that a
general warning condition exists with NSAC will be initiated when the system's outputs are bypassed.
Plant administrative procedures will be used to test the NSAC circuitry and associated outputs.
These procedures will ensure that NSAC is returned to service when testing is complete.
13.
Com letion of Miti ative Action The licensee is required to verify that (1) the protective action, once initiated, goes to completion and (2) the subsequent return" to operation requires deliberate operator action.
The licensee responded that the system will be designed so that the final AMSAC actuation signal will be sealed in.
Once initiated, the design will ensure that protective action goes to completion.
Deliberate operator action will then be required to override the actuation signals and return the final actuation devices to normal operation.
14.
Technical S ecifications The plant specific submittal should address technical specification requirements for AMSAC.
The licensee responded stating that no technical specification action is proposed with respect to the AMSAC and that normal administrative controls are sufficient to ensure AMSAC operability.
The equipment required by the ATWS Rule to reduce the risk associated with an ATWS event must be designed to perform its functions in a re)iable manner.
A method acceptable to the staff for demonstrating that the equipment satisfies the reliability requirements of the ATWS Rule is to provide limiting conditions for operation and surveillance requirements in the technical specifications.
In its Interim ConmSsion Policy Statement of Technical Specification Improvements for Nuclear Power Plants
[52 Federa!
Re<easter
- 3788, February 6, 1987j, the Comaission established a specific set of objective criteria for determining which regulatory requirements and operating restrictions should be included in technical specifications.
The staff is presently reviewing ATWS requirements to criteria in this Policy Statement to determine whether
and to what extent technical specifications are appropriate.
Accordingly, this aspect of the staff review remains open pending completion of, and subject to the results of, the staff's further review.
The staff will provide guidance regarding the technical specification requirements for AMSAC at a later date.
4.0 CONCLUSION
The staff concludes, based on the above discussion and subject to final resolution of the technical specification issue, that the AMSAC design proposed by Rochester Gas and Electric Corporation for the R. E. Ginna Power Plant is acceptable and is in compliance with the ATWS Rule, 10 CFR 50.62.
paragraph (c)(l).
The staff's conclusion is further subject to the satisfactory completion of certain noted human-factors engineering reviews to which the the licensee has cemitted.
Information'o support each plant-specific item discussed in Section 3.0 above should be compiled by the licensee and available for review during a
subsequent site audit in accordance with Temporary Instruction 2500/20 (Ref. 7).
Until staff review is completed regarding the use of technical specifications for ATWS requirements, the licensee should continue with the scheduled installation and implementation (planned operation) of the ATWS design and provide testing utilizino administratively controlled procedures.
5.0 REFERENCES
l..
- Letter, C E. Rossi (NRC) to L. D. Butterfield (WOG), "Acceptance for Referencing of Licensing Topical Report," July 7, 1986.
2.
- Letter, R. A. Newton (WOG) to J.
Lyons (NRC), "Westinghouse Owners Group Addendum 1 to WCAP-10858-P-A and WCAP-11233-A:
ANSAC Generic Design Package,"
February 26, 1987.
3.
- Letter, R. A. Newton (WOG) to J.
Lyons (NRC), "Westinghouse Owners Group Transmittal of Topical Report, WCAP-10858-P-A, Revision 1, ANSAC Generic Design Package,"
August 3, 1987.
4.
Letter, R.
W. Kober (RGSE) to U.S.
NRC, "Anticipated Transients Without Scram, R. E. Ginna Nuclear Power Plant," August 31, 1987.
5.
Letter, B. A. Snow (RG&E) to U.S.
NRC, "Anticipated Transients Without Scram, R. E. Ginna Nuclear Power Plant," April 29, 1988.
6.
Letter, B. A. Snow (RGIIE) to U.S.
NRC, "Clarification of April 29, 1988, ANSAC Submittal," July 19, 1988.