ML17254A518
| ML17254A518 | |
| Person / Time | |
|---|---|
| Site: | Ginna  |
| Issue date: | 08/19/1985 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML17254A517 | List: |
| References | |
| GL-83-28, NUDOCS 8508200391 | |
| Download: ML17254A518 (15) | |
Text
E OSURE I SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION DOCKET NO. 50-244 R.E.
GINNA UNIT I GENERIC LETTER 83-28, ITEM 4.3 REACTOR TRIP BREAKER AUTOMATIC SHUNT TRIP INTRODUCTION AND
SUMMARY
In Generic Letter 83-28 dated July 8, 1983, the, staff identified actions required by all reactor licensees and applicants based on generic implications of the Salem ATWS events.
Item 4.3 of the generic letter established the re-quirement that Westinghouse plants be modified to provide reactor trip system actuation of the breaker shunt trip attachments.
By letter dated June 14, 1983 the Westinghouse Owners Group (WOG) provided a generic design for this modifi-cation consisting of an additional relay and two pushbutton switches (used for testing) in each reactor trip breaker.
By letters dated November 4,
- 1983, and March 19, 1985, Rochester Gas and Electric Corporation (RGSE) submitted the proposed modification which deviates from the approved generic design in four areas.
The first is the use of spare contacts of existing reactor protection system relays in lieu of an additional relay for automatic actuation of shunt trip of reactor trip breakers.
We find this to be acceptable.
The second is the absence of a pushbutton switch that would be used during testing to inde-pendentlv confirm the operability of the UV trip.
We find this change to the approved generic design to be unacceptable.
The third is that the design does not include remote breaker position indication on the main control board and the existing remote bypass breaker position indication on the protection sys-tem racks is not interlocked through a breaker cell switch.
We find this devi-.
ation to the approved generic design to be unacceptable.
The fourth is the absence of periodic on-line testing of the operability of the UV and shunt trip devices.
We find this to be unacceptable.
This modification was installed during the 1985 refueling outage.
DESCRIPTION OF MODIFICATION A logic matrix, which is the energize-to-trip equivalent to the ladder matrix used on the undervoltage trip, is developed using spare contacts on the reactor protection relays.
The shunt trip auxiliary relay and two test pushhuttons included in the WOG generic design are not used for this modification.
EVALUATION The shunt trip attachment on the Reactor Trip (RT) circuit breaker initiates a reactor trip from the same automatic protection system signals that cause the undervoltage trip attachment of the RT circuit breaker to initiate a
850820039i 8508i9 PDR ADOCK OS000244 PDR
0 I'
w'
The one exception is the undervoltage trip which is actuated below 8X power when the primary coolant temperature is less than 350"F.
Based on discussions with the licensee per telecon on April 24, 1985, it was noted that this trip feature is provided as a backup to administrative controls to ensure that the control rod drives are fully inserted under these conditions.
Therefore, based on this explanation for this trip feature, the staff concludes that it need not also be included in the autopatic actuation of the shunt trip attachments of the reactor trip breakers./
Redundant Class 1F. power sources are used for the shunt trip actuation of the reactor trip breakers and the circuitry used to implement the automatic shunt trip function is Class 1E.
Non-Class IE loads are isolated from Class 1E loads usino fuse and breaker coordination, therefore, a credible non-1E fault will not degrade the shunt trip function.
This is in accordance with IEEE 384 and is, therefore, acceptable.
The procurement, installation, operation, testing and maintenance of this circuitry will be in accordance with the plant specific quality assurance program which is consistent with the criteria set forth in Appendix B to 10 CFR Part 50 and is, therefore, acceptable.
Indications on the main control board for the reactor trip breaker operation are the red and green position lights.
The breaker position status lights are used to supervise the availability of power to the shunt trip circuits.
The red light which is connected in series with the shunt coil and the "a" auxil-iary contact indicates that the breaker is closed and also indicates that the power is available to the shunt trip device and, therefore provides detectabil-ity of power failure to the shunt trip coil.
- Also, a normally open auxiliary contact of each breaker provides breaker status information to the plant com-puter.
The Ginna design of the bypass breaker does not follow the typical WOG design in that the design does not include remote breaker position indica-tion on the main control board for the bypass breakers.
Bypass breaker posi-tion indication is provided on the protection system racks, however, the posi-tion indicating lights are not interlocked with breaker cell switches.
Because the capability of the control room operator to readily determine this open-closed position statuq of the bypass breaker is safety significant as noted in the enclosed staff position on this matter, it is the staff's position that bypass breaker position status lights should he provided on the main control board including the cell switch interlock for all remote breaker position in-dication.
Based on our review of the plant specific aspects of the design, we conclude that the licensee should revise the design to include the provision n< status lights on the main control board for the bypass breakers including the interlock for all remote breaker position indication.
Each Class lE battery system has a dc monitoring system which is set to alarm at 1~5> of V5 volts.
The normal dc voltage system operates at 132 volts and a maximum sustained voltage equal to 140 volts occurs when a battery system is or an eoualization charge.
The STA and UVTA coils are rated for a maximum dc voltage of 115% of its 125 volt dc rating which is higher than the maximum expected voltage.
Since the coil ratings are higher than the maximum source
- voltage, ne additional overvoltage protection is required.
We find this to be acceptable.
Physical separation is maintained between the circuits used to manually initi-ate the shunt trip functions of the redundant reactor trip breakers.
The field cabling from the main control board and reactor protection logic to the redundant trains A and 8 are routed separately as train A and train B circuits.
Each of the two manual reactor trip switches actuates both UY and shunt trip coils or both trains of protection.
The wires associated with each switch are separated to the maximum extent possible in the main control board.
A fault on any one control circuit will not degrade both redundant trains.
This is in accordance with IEEE-384 and is, therefore, acceptable.
The proposed design does not add new components which would require a
new seismic qualification test program for the breakers.
The new STA's are being seismically qualified to IEEE 344 under the WOG program.
The staff finds this acceptable but will require the licensee to confirm that the shunt trip attach-ment is seismically qualified when the results of the WOG qualification program are completed.
The licensee noted that STA are being qualified to a
non harsh environment at an ambient temperature of 120"F.
During the staff's telecon with the licensee on April 24, 1985 it was noted that this ongoing environment-al qualification was in reference to the WOG program on reactor trip breakers.
The intermediate building, where the RT breakers are located, has a maximum ac-cident temperatur~
based on a postulated high energy line'reak of 215"F.
Based on documentation submitted to NPC in support of the qualification of the reactor trip breakers, the licensee concludes that they are qualified to per-form their safety function as required following a high energy line breal..
The staff has reviewed the basis for the licensee's conclusion on the environ-mental qualification of the shunt trip attachment as provided by the licensee's letter dated August 30, 1984 on the subject of environmental qualification of electrical equipment.
Enclosure I of the subject letter included the proposed resolution of environmental qualification issues noted in the Franklin Research.
Center Technical Evaluation Report FRC TER 'C5257-454, dated Nay 28, 1982 which was transmitted to the licensee with the NRC's Safety Evaluation Report by letter dated December 13, 1982.
Item 56 of enclosure.I addressed the re-actor trip breakers by noting that Westinghouse Topical Report MCAP-7706-L (p.3-22) provides a qualitative evaluation of the effects of adverse tempera-ture and humidity conditions on the reactor trip breakers.
Further, it is stated that since the postulated accident conditions are relatively mild (215"F, 0.8 psig, 100K relative humidity), the trip breakers perform their function within seconds, they are physically located two floors away from the postulated accident condition (pipe crack),
and suhseouent long-term failure could not cause the control rods to he withdrawn from the core, the licensee considers the trip breakers to be environmentally qualified.
The staff finds that the licensee's conclusions with regard tn the environmental qualification of the shunt trip attachments of the reactor trip breakers to be acceptable.
TESTABILITY The WOG generic proposed design which was previously reviewed and approved by the staff included the use of test switches to permit independent testing of the undervoltage and shunt trip attachments periodically.
Since the Ginna design does not include these test switches, on-line testing cannot be per-
formed to independently verify the operability of the undervoltage trip attach-ments.
The periodic testing is currently being performed on an annual or refueling outage frequency.
The purpose of the procedure for on-line testing is to provide a method for independently verifying the ability of the shunt trip and undervoltage trip mechanisms to trip the reactor trip breakers.
The operability of the shunt trip attachment could be verified by the operation of the shunt trip switch at the protection system racks.
However, similar features are not provided to independently verify the operability of the undervoltage trip attachment.
Therefore, it is the staff's position that provisions be provided for on-line testing to independently verify the oper-ability of the UV trip attachments of the reactor trip breakers.
Based on our review of this aspect of the design, we conclude that the licensee should re-vise the test procedure to include on-line testing of the reactor trip break-ers including independent testing of the undervoltage and shunt trip attach-ments.
Further, the test procedures should include verification of the proper operation of the associated control room indication.
The operability of the normally-closed contacts of the reactor manual trip switches is verified by tripping both the reactor trip breakers and the by-pass breakers ky de-energizing the UVTA devices through two sets of auxiliary relays.
The operability of the normally-open contacts of the reactor manual trip switches is verified by energizing the shunt trip circuit for both the reactor trip breakers and bypass breakers and monitoring the voltage across the combination of the shunt trip coil and the series connected breaker auxil-iary switch contact.
A voltmeter is connected across this combination of the reactor trip breaker components and will not involve installing iumpers or lifting leads.
We find this to be acceptable.
RG&E is participating in and supporting the WOG testing of the shunt trip attachment, including life cycle testing.
Nore frequent periodic on-line test-ing of breaker response time would be considered if life cycle testing shows that breaker response time degrades with operation.
We find this to be acceptable.
In previous reviews of the Westinahouse design the staff has required that the shunt trip attachments of bypass breakers be tested with the breaker in the test position prior to racking in and closing of a bypass breaker for reactor trip breaker testinq.
The basis for this requirement was that it provided a
readily available means to confirm the operability of the shunt trip attachment of the bypass breakers.
Also it was recognized that in general the Westing-house design for bypass breakers does not include features which would readily permit testing of the undervoltage trip attachment ts.
Therefore, although the shunt trip attachments for bypass breakers are not actuated on an automatic reactor trip, verification of its operability prior to the on-line testing of reactnr trip breakers provides assurance that bypass breakers could be tripped via the manual reactor trip switches in the control room.
The licensee notes that the test procedures will include a functional test of the bypass
- breaker, on an annual
- basis, during the RPS logic test.
The PPS logic test procedure will be modified to include a bypass breaker UVTA test.
The staff finds that confirmation of the operability of the bypass breaker undervoltage trip attachment on an annual basis is acceptable.
However, the staff will require that the shunt trip attachment of bypass breakers be tested prior to on-line testing of the reactor trip breakers either with the breaker in the test position usino the local pushbutton or with the breaker in the operate position using the pushbutton on the protection system rack.
In response to Item 4.5 of Generic Letter 83-28, the licensee's letter of November 4, 1983 noted that functional testino of the reactor trip breakers has been performed on a yearly basis throughout the life of the plant and that more extensive testing including response time testing began during the 1983 refueling outage.
Therefore, based on this data, the licensee noted that the functional testing will continue to be performed on an annual or refueling basis.
The staff finds that the licensee's response to the position noted in Item 4.5 of Generic Letter 83-28 is unacceptable.
That position set forth the requirement that on-line functional testing of the reactor trip system,. in-cluding independent testing of diverse trip feature, shall be performed on all plants.
Further, it was explicitly noted that:
The diverse trip features to be tested include the reactor under-voltage and shunt trip attachments on Westinghouse plants.
2.
3.
Finally on-line Changes tervals Plants currently not designed to permit periodic on-line test-ing shall justify not making modifications to permit such testing.
It should be noted that the Ginna plant includes the provision of bypass breakers that permit on-line testing of both the reactor trip system logic and breakers, and Existing intervals for on-line testing required by Technical Specifications shall be reviewed tn determine that the intervals are consistent with achievina high reactor trip system availability when accounting for considerations such as:
I) uncertainties in component failure rates.
2) uncertainties in common mode failure rates.
3) reduced redundancy during testing.
4) operator errors dur ing testing.
5) component "wear-out" caused by the testing.
the position stated that "licensees currently not performing periodic testing shall determine appropriate test intervals as described above.
to existing required intervals for on-line testing as well as the in-to be determined by licensees currently not performing on-line testing
shall be justified by information on the sensitivity of the reactor trip sys-tem availability to parameters such as the test intervals, component failure
- rates, and common mode failure rates."
The licensee's conclusion stated in the November 4, 1983 letter that testing on a refueling basis is adequate based on the Ginna operating experience and one response time test nf the reactor trip breakers during the 1983 refueling out-age is an unjustified qualitative judgement.
Further, it is non-responsive to the position stated in Item 4.5 of Generic Letter 83-28 which specifically noted that nn-line test intervals were to be based on quantitative assessments of reactor trip system availability.
Further, the licensee states in his March 19, 1985 letter that a review of existing testing intervals identified no requirements for technical specifica-tions changes.
Further, the licensee notes that results of the Westinghouse Technical Specification Optimization Program being performed by the WOG may be used to justify changes in the future.
As a member of the WOG, the licensee should be cognizant of the WOG recommendations on reactor trip system logic and breaker surveillance intervals documented in Topical Report WCAP-10271 wherein the WOG proposed an extension of the current Westinghouse Standard Technical Specifica-tion requirements for bimonthly testing on a staggered test basis.
- Further, that the risk kased unavailability analysis led to a WOG recommendation for semi-annual on-line testing on a staggered test basis for the reactor trip system logic and breakers.
Thus, in view of the WOG analysis, the staff finds that the licensee's position, that testing at a refueling outage interval is acceptable based on qualitative judgements derived from limited experience at the Ginna plant, is not justified.
Finally, as a member of the WOG the licensee should have been cognizant that the WOG requested that NRC focus its review on the changes involving analog channels because of the complication'f the Salem ATWS events that were superimposed on the WCAP review.
As a
consequence the NRC deferred its review of proposed changes for actuation logic.
and reactor trip breaker surveillance intervals.
Therefore, it is the staff's conclusion that the reactor trip system logic and breakers should be tempted on line on a bimonthly staggered test basis con-sistent with the guidance provided in the Westinghouse Standard Technical Specifications.
Further, the staff concludes that this is fully consistent with the requirement of Item 4.5 of Generic Letter 83-28 and that the licensee response thereto has not set forth an acceptable basis for an exemption from these requirements.
Proposed technical specifications should reflect the requirement for independent testing of the undervoltage and shunt trip functions du~ing on-line testing.
The staff will issue additional guidance on additional appropriate technical specifications for this modification.
This matter will be subiect to further staff review following the submittal of pro-posed technical specification changes.
Finally, the staff has noted that the desiqn of the bypass breaker trip cir-cuits do not include an interlock which precluded the possibility that both bypass breakers could be closed at the same time.
This is a standard Westing-house design feature which the staff has noted that exists on every other West-inghouse plant which includes bypass breakers.
In response to staff's questions on the absence to such an interlock, the licensee nnted in the tele-
con of April 24, 1985 that only one breaker trip mechanism is used, for the by-pass
- breakers, and therefore this removes the potential that two bypass breakers could he closed at one time.
However, in view of the staff's position for on-line reactor trip breaker testing, the licensee may conclude that breaker trip mechanisms should be maintained in each of the bypass breaker compartments to preclude shifting the presently maintained, single mechanism, between bypass breaker compartments.
Should such action be taken, it is the staff's position that an interlock to preclude both bypass breakers being closed at,one time should be installed during the next refueling outage.
CONCLUSION Based on the review of the licensee's proposed
- design, we find that the proposed modifications are acceptable conditioned on the following:
(a)
Revision of the breaker test procedure to include on-line testing of the reactor trip system logic and breakers including independent testing of the shunt trip attachments of the reactor trip breakers.
The procedures shall include a test of the bypass breaker shunt trip prior to reactor trip breaker testing.
(b)
Submission of revised information including revised electrical schematics showing:
(i)
Provision of test features to confirm the operability of the UV trip attachments of the reactor trip breakers during on-line testing.
E(ii)
Revised test procedures for independent verification of the operability of the shunt and undervoltage trip attachments of the reactor trip breakers during on-line testing.
(iii) Provision of bypass breaker position status lights on the main control board.
(iv)
Inclusion of a cell switch interlock for remote bypass breaker position indication.
(v)
Inclusion of an interlock to preclude both bypass breakers being closed at one time if breaker mechanisms are to be maintained in each bypass breaker compartment for on-line testing.
These items remain open pending further staff's review.
(c)
Confirmation that shunt trip components have been seismically qualified.
(d)
Con irmation that bypass breaker testing will demonstrate proper opera-tion of control board bypass breaker position indication.
(e)
Submission of proposed technical specifications as noted.
It should be noted that this evaluation satisfies the preimplementation review requirements for Item 4.3 of Generic Letter 83-28.
With regard to the staff's position on reactor trip breaker undervoltage trip attachment test features, bypass breaker status indication, and bypass breaker irterlocks, noted above, these modifications should be implemented during the next refueling outage.
PRINCIPAL CONTRIBUTOR:
N. Trehan Dated:
ENCLOSURE 2 STAFF POSITION ON REACTOR TRIP BYPASS BREAKER BACKGROUND:
The design of the Reactor. Trip System (RTS) for Mestinghouse plants includes two reactor trip breakers located in series with the holding power for the control rod drive units.
On a reactor trip, power is removed from the control rods by the opening of either reactor trip breaker.
The majority of Mestinghouse plants include bypass breakers to permit on-line testing of the reactor trip breakers.
During testing, the bypass breaker maintains power to
'l the control rod drives when a reactor trip breaker is opened to confirm its operability.
Mhen a reactor trip breaker is bypassed by the closure of the bypass breaker, a reactor trip is dependent on the operability of the remaining reactor trip breaker and its associated protection system logic.
The reliability of the reactor trip system during testing is enhanced by the fact that the bypass breaker which is closed, would also be tripped by an automatic trip signal to the inservice reactor trip breaker.
Thus, the trip of the bypass breaker provides further assurance for the remo'val of power from the control rod drives during testing.
In addition to the removal of power from the control rod driv'es to effect control rod insertion on a reactor trip, the position of the reactor trip and bypass breakers is monitored to provide signa')s to the P-4 interlock.
The P-4 interlock is used as a permissive to reset or block a safety injection signal, to initiate a turbine trip on a reactor trip, and as an interlock for feedwater isolation on low Tavg.
The P-4 interlock is also used as an interlock in the steam dump control system for some plants.
The use of breaker position
switches for these safety functions provides greater assurance that they are initiated regardless of the event that initiated a reactor trip, e.g., auto-matic, manual, or component or RTS power system failure.
The logic for the P-4 interlock is such that the P-4 interlock condition only exists when both the reactor trip breaker and its bypass breaker are in the open position.
Further the P-4 interlock signal for Train A (B) of the protection system logic is only derived from the train A (B) reactor trip and bypass breakers.
Thus, the automatic trip of bypass breakers during testing also enhances the veliabi litv of the P-4 interlock functions; DISCUSSION:
In response to Generic Letter 83-28 the Westinghouse Owners Group submitted a proposed generic design modification to include automatic actuation of the shunt trip attachments for the reactor trip breakers.
In the generic design
- package, the argument was set forth that the addition of the automatic shunt trip to the bypass breakers is not necessary since there is little benefit and a high expense for adding the automatic shunt trip to the bypass breakers.
In its evaluation of the generic design, the staff accepted the Owners Group basis for exclusion of an automatic shunt trip of the bypass breakers.
How-ever, the staff noted that the operability of each bypass breaker would be required prior to it being placed in service.
Since the outline of the test procedures included in the WOG submittal did not address testing of bypass breakers. this is a matter which was addressed in plant specific reviews of the plant design modifications.
With respect to reactor trip breaker position indication, the staff requested confirmation on a plant specific bases that the surveillance procedures
include verification of the reactor trip breaker status position indication lights during testing of the reactor trip breakers.
During the review of plant specific design modifications, two basis schemes were noted to exist for the majority of the Westinghouse plants with regards to the control and operation of bypass breakers.
For the older Westinghouse plants which generally have the relay protection system logic design, the con-trol scheme for the bypass breakers include push button control switches and breaker status indicating lights at the reactor protection system racks.
One push button swi.tch is used to close the bypass breaker and the other is wired in series with the undervoltage trip coil to trip the bypass breaker.
For some plants, the rack push button switch is wired to the shunt trip coil to trip the bypass breaker.
Due to a breaker cell switch interlock, power is generally only available to the indicating lights and closing circuit when the breaker is in the operate position.
Two push button control switches are also provided locally at the breaker..
One push button is wired to the closing cir-cuit and the other is wired to the shunt trip coil.
Due to a cell switch interlock, power is only available to the local control circuits when the breaker is in the test position.
For the newer Westinghouse plants which generally have the solid state pro-tection system logic, the control scheme for the bypass breakers includes only the local push button closing and shunt trip functions, however, power is available to these control circuits when the breaker is in either the operate or test position.
Further, the control circuit differs from that of older
~
N
~
~
4-plants in that the shunt trip attachment of the bypass breakers is actuated via the manual reactor trip switches on the main control room control board.
Mith respect to bypass breaker position indication, the majority of the Mestinghouse plants have bypass breaker status lights on the main control board in addition to reactor trip breaker position indication.
In those cases where position indication has not been provided on the main control board, the staff has taken the position that it should be provided as a part of the upgrade for the automatic actuation of the shunt trip attachments of the reactor trip breakers.
The bases for the staff position are the following:
In During normal plant operation the bypass breakers are racked out.
this situation the absence of breaker position indication, both red and green position lights extinguished, confirms that the breaker is in the racked out position.
This reduces-the potential for inadvertent operation of a bypass breaker.
2.
During reactor trip breaker testing, the plant operator has direct status indication that a bypass breaker is closed and therefore one train of the RTS is in a bypassed condition. If a reactor trip should occur or be initiated during testing. the operator can directly deter-mine that each reactor trip 'and bypass breaker is in the open position.
~Sreaker position status is safety significant not only with regards to
control rod insertion, but also due to safety actions initiated by the P-4 interlock derived from reactor trip and bypass breaker position status switches.
3.
In the absence of direct position indication for bypass
- breakers, the position of the bypass breakers can only be inferred by the absence alarms or breaker change status obtained from computer outputs.
4.
'Direct indication of safety actions including reactor trip and bypass breakers is consistent with operators actions to confirm protection system operations and in the event of any anomolous indication to initiate appropriate follow up actions consistent with plant emergency operating procedures.
As noted in the Westinghouse Owners Group Emer-gency Response Guidelines, step 1 of the procedure for reactor trip or safety injection includes verification of reactor trip by confirming "Reactor trip and bypass breakers - OPEN."
Also, it should be noted that for the newer Westinghouse
- design, the operability of the undervoltage trip attachments for the bypass breakers is only testable during a plant shutdown.
In contrast the operability of the I
undervoltage trip attachment for bypass breakers for the older design would be confirmed when the bypass breakers are closed for reactor trip breaker testing.
As a co'nsequence, there is a higher potential that a bypass breaker may not be tripped, for the newer design, if an automatic trip occurred during reactor trip breaker testing.
This difference further supports the staff position for bypass breaker position indicating being availab1e to the p1ant operator for the newer Westinghouse plants.
Finally, the staff does not concur that the typical two hour interval for testing breakers or protection system 1ogic shou1d be reason to negate the staff position on bypass breaker position indication since a number of inadvertent reactor trips occur during this time.
No~ does the staff concur that a1arms initiated on closure of bypass breakers provide an equivalent degree of direct bypass breaker position status indication.
Therefore, it is the staff's conclusion that bypass breaker position indication is safety significant and should be provided as currently exist in a11 but a few Westinghouse plants.