ML17297A579
| ML17297A579 | |
| Person / Time | |
|---|---|
| Site: | Palo Verde  |
| Issue date: | 07/15/1981 |
| From: | Van Brunt E ARIZONA PUBLIC SERVICE CO. (FORMERLY ARIZONA NUCLEAR |
| To: | Harold Denton Office of Nuclear Reactor Regulation |
| Shared Package | |
| ML17297A580 | List: |
| References | |
| ANPP-18412-JMA, NUDOCS 8107230124 | |
| Download: ML17297A579 (448) | |
Text
r RKGULATO INFORMATION DISTRIBUTION TEM (BIDS)
I ACCESSION NBR 8107230124 DOC ~ DATE '1/07/15 NOTARIZED -
YES OOC FACILCSTN 50-528 Palo Verde Nuclear Stationr Unit it Arizona Publ) 050 STN 50"529 Palo Verde Nuclear Stationr Unit 2P Arizona Publi 05000529 STN 50-530 Palo Verde Nuclear StationP Unit 3r Arizona Publ-i 05000530 AUTH.,NAME AUTHOR AFFILIATION VAN BRUNTiE',K ~ Arizona Public Service- Co.
RECIP ~ NAME" RECIPIENT AFF IL'IATION DENTONiH.Rs Office of Nuclear Reactor Regulationi Director
SUBJECT:
Forwards Vols 1 8 2= of transcript of 810617-18 independent design review of facility instrumentation 8 control sys before Instrumentation L Control Sys ReView Board inI Phoenixi42,
~
DISTRIBUTION CODE'. SODIS COPIES RECEIVED:LTR J ENCI. ~
PSAR/FSAR AMDTS and Related Correspondence SIZE".gg'ITLE".
NOTES:Standardized Plant F 1 cy'.C Grimes 05000528 Standardized Plant,i cy:C Grimes 05000529 Standardized Plant.i cy!C Grimes 05000530 RECIPIENT COPIES RECIPIENT COPIES IO CODE/NAMEI LTTR ENCL ID CODE/NAME LTTR'NCL ACTION ~ A/D, LICENSNG 1 0 LIC BR ¹3 BC 1 0 LIC BR ¹3 LA 1= 0 KERRIGANg J ~ 04 1 1 INTERNAL: ACCIO EVAL BR26 1 AUX SYS BR 27 1 1 CHEM ENG BR 11 1 1 CONT SYS BR 09 1 1 CORE PERF BR 10 1 1 EFF TR SYS BR12 1 1 EMRG PRP DEV 35 1 1 KMRG PRP LIC 36 3 EQUIP QUAL BR13 3 3 FEMA~REP DIV 39 1 GEOSCIENCES 28 ~2 2 HUM FACT ENG 40 1 1=
HYD/GEO BR 30. 2 2 IKC SYS BR 16 1 1 ISED 06 3 L'IC GUIO BR 33 1 1 LIC QUAL BR 1 1 MATL 'ENG BR 17 1 1 18 MPA 0 32'ECH ENG BR 1 1 1 NRC PDR 02" 1 1 OELO 1
'1 OP LIC BR 34 1 1 POWER SYS BR 19 1 1 PROC/TST REV 20, 1 1 QA BR 21 1 1 R BR22; 1 1 REAC SYS BR 23. 1 1 EG FI 1 1 SIT ANAL BR 24 1 1-ENG BR25, 1 EXTERNALS ACRS 16 16 LPDR 03 NSIC 05~ 1 1 NTIS 198~.
JUL g8 TOTAL NURSER OF COPIES REQUIRED:'TTR '. ENCL
~ ~
F M
eaaaaeaaL lÃuHI Ilo P. O. BOX
~aa ooeaaauae 2I666 'HOENIXa ARIZONA 85036 July 15, 1981 ANPP-18412 - JMA/TFg Mr. H. R. Denton Director or Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission
'. 'ggXI 'Q~I,~ -ro Washington, D.C. 20555
Subject:
Palo Verde Nuclear Generating Station Units 1, 2 and 3 (PVNGS)
Nos. STN-50-528/529/530
'ocket
~oa
Dear Mr. Denton:
Attached are two copies of Volumes I and II of the transcript of the Independent Design Review conducted on June 17 and 18, 1981 for the PVNGS Balance-of-Plant Instrumentation and Controls. This transcript is submitted for your use and as a record of the'eview.
Volume III of the transcript, compilation of the exhibits presented at the Review, is not presently available. Modifications to the exhibits have been requested by the board members. Volume III will be submitted to you when we submit the resolutions to the open items.
A list of open items is provided on Pages 347 through 349. These items consist of unanswered questions and requests for information made by our review board members and the NRC representatives. Resolution of'he open items will be provided to the NRC in order to close the record of this Independent Design Review.
Very truly y urs E. E. Van Brunt, Jr.
Cl ~
APS Vice President, Nuclear Projects ANPP Project Director EEVB Jr/TFg/av yp0 Attachment 5 cc: J. Kerrigan (w/attach.)
J. Rosenthal (w/attach.)
B. Myerson (w/attach.)
P. Hourihan A. C. Gehr 8107230124 810715, PDR ADOCY 05000528
.T PDR
l I
1
Mr. H. R. Denton July 15, 1981 ANPP-18412 - JMA/TF0 Page 2 STATE OF ARIZONA )
) ss.
COUNTY OF MARICOPA )
I, Edwin E. Van Brunt, Jr., represent that I am Vice President Nuclear Projects of Arizona Public Service Company, that the foregoing document has been signed by me on behalf of Arizona Public Service Company with full authority so to do, that I have read such document and know its contents, and that to the best of my knowledge and belief, the statements made therein are true.
E wean . an runt, r.
Sworn to before me this~day of Jta i'981.
Notar u 1c I';;;.My Commission expires:
QNR~NllllsstQQ &giles Jap, gy, ~sy
V
~ 4 II la
~l
'l A ( V % % ~
~ lg e~
4
~)
~
OPPI IHIP
INDEPENDENT DESIGN REVIEW of the PALO VERDE NUCLEAR GENERATING STATION INSTRUMENTATION AND CONTROL SYSTEMS Before the INSTRUMENTATION 6 CONTROL SYSTEMS REVIEW BOARD VOLUME I of XXX Pages 1 215 Phoenix, Arizona June 17-18, 1981 GRUMLEY REPORTERS PlfOENlX, ARIZONA
~II +Kfo7Z.K/o(~
~~~~ ofoocomoob I
~ i VOLUME I I N'D E X 3
Participants Introduction NSSS Interfaces 15 System Overview Engineered Safety Feature Systems 41 Balance of Plant ESFAS Design Criteria 42 10 System Description 54
'ESF Actuated Device Logic Typicals 88 12 ESF Load Sequencer 13 Design Criteria 96 14 System Description 97 15 Systems Required for Safe Shutdown 114 Remote Shutdown Panel and Cold Shutdown 16 Capability Design Criteria 115 System Description and Layout 116 18 Safety-Related Display Instrumentation 140 19 Process Instrumentation 20 Design Criteria 140 21 SystemI Description 143 22 Safety Equipment Status System (SESS)
Design'riteria, 145 23 System Description and Layout 148 24 Post-Accident Monitoring 25 Design Criteria 167 System Description 169 GRUMLEY REPORTERS Phoenix, Arizona
0 VOLUME I INDEX Continued 3
System Overview Continued All Other Instrumentation Systems Required for Safety 193 Class IE Alarm System Design Criteria 194 System Description 194 Safety Parameter Display System (SPDS)
Design Criteria 196 10 System Descript'on 198 Control Systems Not Required for Safety 12 Design Criteria 209 13 System Description 210 14 15 16 17 18 19 20 21 22 23 24 25 GRUMLEY REPORTERS Phoenix, Arizona
'K
)I 1
BOARD MEMBERS JOHN M. ALLEN Nuclear Engineering Manager Arizona Public Service Company A. CARTER ROGERS Nuclear Engineering Manager Arizona'ublic Service Company EDWARD C. STERLING Supervising ISC Engineer Ariozna Public Service Company NORM HELMAN'enior IGC Specialist Arizona Public Service Company 10 WXLLIAN M. SIMKO PVNGS Operations Senior Mechanical Engineer Arizona Public Service Company 12 JIM MULLIGAN 13 Control Systems Engineer Arizona Public Service Company FRED MARSH 15 Chief Control Systems Engineer Los Angeles Power Division 16 Bechtel Power Corporation 17 LARRY JOHNSON Control Systems Engineering Specialist 18 Bechtel Power Corporation 19 JAMES F. MINNXCKS PVNGS Instrumentation and Controls Supervisor 20 Arizona Public Service Company 21 MIKE BARNOSKX Assistant Project Manager for the Arizona Project 22 Combustion Engineering, Xnc.
23 BERNARD BESSETTE Technical Supervisor, System 80/Nuplex 80 Projects 24 I&E Project Engineering Section Combustion Engineering, Inc.
25 GRUMLEY REPORTERS Phoenix, Arizona
RALPH PHELPS Project Group Leader of Nuclear Engineering on Son Onofre Units 2 and 3 Southern California Edison PARTXCXPANTS:
WILLIAM C. BINGHAM PVNGS Project En'gineering Manager Bechtel Power Corporation DENNIS KEXTH PVNGS Assistant Project Engineer Bechtel Power Corporation MARY MORETON Control Systems Group Leader 10 Bechtel Power Corporation GERALD KOPCHXNSKI PVNGS Nuclear Group Supervisor 12 Bechtel Power Corporation KONSTANTINOS SOTEROPOULOUS Controls Systems Group Supervisor Bechtel Power Corporation 15 STEPHEN SHEPHERD Nuclear Engineer 16 Bechtel Power Corporation 17 DAN JENSEN Nuclear Engineer 18 , Bechtel Power Corporation 19 JANIS D. KERRIGAN PVNGS Project Manager 20 Licensing Branch N3 Division of Licensing 21 Nuclear Regulatory Commission 22 J.'E. ROSENTHAL Principal Reviewer 23 Instrumentation and Control Systems Branch Nuclear Regulatory Commission 24 JOE MECH 25 Argonne National Laboratory Consulting Engineer Nuclear Regulatory Commission GRUMLEY REPORTERS Phoenix, Arizona
1$
NED KONDXC Reviewer, Instrumentation and Control Systems Branch Nuclear Regulatory Commission HEEQKN LaGOW Systems Consultant.
Nuclear Regulatory Commission ARTHUR C. GEHR Attorney at Law Snell 6 Wilmer OBSERVERS:
BILL QUXNN Supervising Licensing Engineer Arizona Public Service Company 10 TERRY F. QUAN Licensing Engineer Arizona Public Service Company 12 KENT JONES Licensing Engineer 13 Arizona Public Service Company NORA MEADOR Arizona Public Service Company 15 RON SXEDL 16 Units 3/5 Lead Instrumentation and Control Engineer Washington Public Power Supply System 17 KARL W. GROSS 18 Arizona Public Service Company 19 JIM ROWLAND Arizona Public Service Company 20 BOB KERSHAW 21 Arizona Public Service Company 22 JOSEPH SLAMAN 23
'rizona Public Service Company TED ROBB 24 Ari.zona Public Service Company 25 RXCHARD BADSGARD Arizona Public Service Company GRUMLEY REPORTERS Phoenix, Arizona
0
~,
CV e
iv STEVE FROST Arizona Public Service Company JOHN VOREES Arizona Public Service Company BILL HURST Arizona Public Service Company CHUCK LEWIS Arizona Public Service Company NAOMI JONES Arizona Public Service Company MARYELLE WHITAKER Arizona Public Service Company 10 CAROLYN SUTTER Arizona Public Service Company CINDY MILLER 12 Arizona Public Service Company 13 NORMA HAESLOOP Arizona Public Service Company 14 LAURIE MOORE 15 Arizona Public Service Company 16 LEON ICARD Arizona Public Service Company 17 MARK HXPSE 18 Arizona Public Service Company 19 SONYA SCOTT Arizona Public Service Company 20 DAN SMYERS 21 Arizona Public Service Company 22 MARY FAVELA Arizona Public Service Company 23 DON ANDERSON 24 Arizona Public Service Company 25 GRUMLEY REPORTERS Phoenix, Arizona
0 0,
The Instrumentation and Control Systems Review Board of the Palo Verde Nuclear Generating Station convened at the Holiday Inn Metrocenter, Phoenix, Arizona, on the l7th day of June, 1981, Mr. John Allen, Nucl'ear Engineering Manager, 5 Arizona Public Service Company, presiding.
MR. ALLEN: Welcome 5
to Phoenix and the Instrumentation 8 and Control Systems IDR. My name is John Allen., I am one of two Nuclear Engineering Managers reporting to the Vice-President of Nuclear Projects management for Arizona Public Service Company who usually chairs these Independent Design Reviews. Due to a previous commitment, Mr. Van Brunt cannot attend to chair this session. I am responsible for th 14 areas of Electrical Engineering, Instrumentation.'.and'Control, Licensing, Health Physics and Records Management for the design and engineering of the Palo Verde Nuclear Generating Station. Today I will act as chairman for this IDR.
18 The purpose of today's meeting is to perform an 19 Independent Design Review of the Palo Verde Nuclear Generatin Station's Balance of Plant Instrumentation and Control 21 Systems. An IDR for the instrumentation and control for, the 22 NSSS scope of supply was held two weeks ago in Windsor, Connecticut, which is where Combustion Engineering, the PVNGS 4 NSSS supplier, is located. The NRC reviewers here .today also attended the IDR in Windsor. This IDR is intended to GRUMLEY REPORTERS Phoenix, Arizona
complement what was reviewed earlier, thus giving the IGC for the total plant a thorough review.
For those of 'you who have not attended a previous 4 IDR, basically what, we do is take the design of a specific plant system, structure, or a specific program,and review it 6 for adequacy of design and compliance with regulations. This presentation is made by Bechtel personnel involved in that system, structure, or program. This formal presentation to a review board with NRC participants by the Bechtel project staff aids in the understanding of the design basis, construction, and operation of those systems, structures, or programs under review. This, in turn, minimizes,'f not 13 eliminates, the time required for the NRC to review that portion of the FSAR.
15 Upon completion of this IDR, Bechtel or other organizations will prepare formal responses to any open issue defined by the Review Board during this review. These responses will be reviewed by the Review Board for concurrenc When final satisfactory resolution of these items is accomplished, they will be provided to the NRC in writing.
21 For today's review, we have assembled a review 22 board with a varied background. Since the actual responsi 23 bility for an adequate review lies with the applicant, that 24 is, Arizona Public Service, the Board's basic formation 25 starts with APS personnel, complemented with personnel from GRUMLEY REPORTERS Phoenix, Arizona
~,
~ '
other groups who have expertise and experience on the system or program being reviewed not necessarily available within APS. Board members were provided with appropriate sections of several documents to familiarize'hem with the PVNGS Instrumentation and Control Systems; This included sections from PVNGS FSAR, the appropriate Standard Review Plans, and other materials.
At this time, I would like to introduce the members of the Board and then I will have Bill Bingham, Project Engineering Manager for Bechtel, introduce the Bechtel project representatives. Carter Rogers is the other APS Nuclear Engineering .Manager who reports to the Vice-President of Nuclear Projects Management and has responsibilities for mechanical engineering, chemical engineering, civil engineering, nuclear fuels,.and other nuclear-related items.
16 Ed Sterling is an APS Nuclear Engineering Departmen Supervising Instrumentation and Controls Engineer and reports to me.. Ed is responsible for the review of the instrumenta-tion and control portions of Palo Verde and the day-to-day interface with Bechtel and Combustion Engineering personnel in those areas. He is also a member of the NSSS IGC Review Board that was held in Windsor.
23 Norm Helman is an APS Nuclear Engineering Depart-4 ment Instrumentation and Controls Specialist. He reports to Ed Sterling. Norm is responsible for various technical GRUMLEY REPORTERS Phoenix, Arizona
aspects of the electrical and IaC portions of Palo Verde and also the day-to-day interface with Bechtel and Combustion Bill Simko is a Palo Verde Senior Mechanical Engineer in the Operations Engineering Section. Bill reports to the Operations Engineering Supervisor. His responsibiliti include review of plant systems for operability and balance of plant performance calculations.
Jim Minnicks is the PVNGS Instrumentation and Controls Supervisor and reports to the Maintenance Superin-10 tendent. Jim is responsible for calibiation and maintenance of instrumentation and controls.
12 We have also asked Jim Mulligan, Control Systems Engineer with Arizona Public Service .Company Generation 4 Engineering, to participate in this review. Jim is responsib for instrumentation and controls for APS fossil power plants 16 and currently is working on the Ocotillo and Four Corners 17 Power Plants design.
18 Two Board members are from the Bechtel Power 19 Corporation and have not'een directly involved in the 20 detailed design and engineering of Palo Verde. However, they have been used from time to time with the project team on various specific issues. These representatives are 23 Fred Marsh, Chief Control System Engineer, from the Los Angel 24 Power Division, and Larry Johnson, Control Systems-Engineerin Specialist, San Francisco Power Division. Mr. Marsh is GRUMLEY REPORTERS Phoenix, Arizona
responsible for review and approval of project control systems design and development of design standards. Larry is a cognizant engineer for Bechtel staff direction on control system design requirements 'and industry standards.
He is also a member of the NSSS IGC.Review Board and attended the meeting in Windsor.
Representing Combustion Engineering, who, as I said earlier, is the PVNGS Nuclear Steam Supply System supplier, are Mike Barnoski, Mike is the Palo Verde Assistant 10 Project Manager, and Bernie Bessette, who is Technical Supervisor of IGC Project Engineering. Mike reports 12 directly to the CE Project. Manager and is responsible for 13 PVNGS licensing support, including integxation of.CESSAR-. FSAR 14 which is CE's standard plant safety analysis report. Bernie 15 is Technical Supervisor on ',the CE System 80 design.
16 From Southern California Edison, which is one of 17 our participants in the Palo Verde Project,, we have Ralph 18 Phelps. Ralph is Project Group Leader of Nuclear Engineering 19 on Son Onofre Units 2 and 3 and supervises engineers in 20 establishing design criteria and guidelines for safety-21 related work.
22 I would like to ask Janis Kerrigan, the Palo Verde 23 Project Manager from the NRC, to introduce the NRC staff.
24 MISS. KERRIGAN: This is Jack Rosenthal. He is from the Instrumentation and Control Systems Branch. He is GRUMLEY REPORTERS Phoenix, Arizona
the primary reviewer in this area.
Joe Mech is from Argonne National Laboratory, a consultant on IGC.
Ned Kondic is with the ICSB Branch. He is a backup reviewer for the project.
We have Herman LaGow, who is an NRC consultant on the IDR process itself.
I would like to make a couple of comments about what we are hoping to see today. Because the IGC area 10 interfaces with'o many branches in NRC, we would like to get as complete a record a possible, so we will probably be asking a lot of questions that deal with what, is your basis for making that, statement. We understand that there is a 14 lot of material to go through and probably a lot of our questions can be addressed in the second meeting, but we would like to get them on the record in this meeting.
17 The second area that we would like to concentrate on very heavily is the CE interfaces, and perhaps Ed Sterling 19 and Mike Barnoski can help us out there. The transcript P
20 from the CE meeting is not yet available at this time, and we will bring up those areas during this meeting.
22 MR. ALLEN: We will provide a transcript of this maet-23 ing to the NRC as soon as we have received .it and proofed .it 24 from our court reporter. I would like to ask Terry Quan and Gerry Kopchinski to review the transcript and develop a QRUMLEY REPORTERS Phoenix, Arizona
joint list of the open items for the court reporter to append to the transcript of the meeting.
The Board is instructed to review the open items to ensure they reflect the issues that were raised upon receipt of the transcript. For the benefit of-the court reporter, T. would like to ask that the Review Board members or anyone else who makes a statement to please clearly identify himself. This holds true if someone from the audience happens to ask a question. At the completion of the review, Bechtel or other responsible organizations will be designated to prepare responses to the open items.
These responses will be sent to members of the Board for their review, comment, and ultimate concurrence. Upon 14 complete Board concurrence, these responses will be formally sent-to the NRC for their review.
16 To assure that these independent design reviews are completed in a timely manner that will not impact the PVNGS licensing review, we have prepared, in conjunction with Bechtel, a schedule that calls for completion of this 20 review in approximately eleven weeks. This (indicating) is 21 the time schedule that we intend to meet. As you can see, 4
22 this is a very ambitious schedule, and for us to adhere to cooperation from everyone .will be necessary
'I 23 the schedule, 24 and it will require very quick turn around on review of the open items. Please note that reconvening may be accomplished GRUMLEY REPORTERS Phoenix, Arizona
with a conference call. It does not necessarily mean that we will physically reconvene the Board. Also, the NRC reviewers have requested a follow-up meeting during the week of July 27, l981. The Review Board will not reconvene for this meeting, but will be informed of. any substantial outcomes.,
If there are no questions from any of the Board members, I would like to ask Bill Bingham to introduce his staff.
10 MR. BINGHAM: Thank you, John. My name is Bill Bingham. I am Project=Engineering Manager for Bechtel Power 12 Corporation assigned to the Palo Verde Project. As John 13 Allen indicated, we are here today to present a review of 14 the BOP Instrumentation and Control Systems at the Palo Verde 15 Nuclear Generating Station facility. This is the eighth in a series of Independent Design Reviews for the Palo Verde 17 Project. I have the following people with me today to assist 18 in the presentation: Dennis Keith, Assistant Project 19 Engineer; Gerry Kopchinski, Nuclear Group Supervisor; Mary 20 Moreton, Controls. Systems 'Group Leader; and Dan Jensen, 21 Nuclear Engineer. Also arriving later this morning to assist 22 in the presentation are Konstantinos Soteropoulous, Controls 23 Systems Group Supervisor, and Stephen Shepherd, Nuclear 24 Engineer.
25 The Instrumentation and Control Systems includes GRUMLEY REPORTERS Phoenix, Arizona
the Reactor Trip System, discussed in Standard Review Plan 7.2; Engineered Safety Features, discussed in Standard Review Plan 7.3; Systems Required for Safe Shutdown, discussed in Standard Review Plan 7.4; Safety-Related Display Instrumenta-tion, discussed in Standard Review Plan 7.5; All Other Instrumentation Required, for Safety, discussed in Standard Review Plan 7.6; and Control Systems Not Required for Safety, discussed in Standard Review Plan 7.7. The Reactor Trip System was discussed in detail by CE at an earlier Independen 10 Design Review presented during the first, week of June. Our discussion today will address the remaining instrumentation 12 and control systems..
13 In previous system Review Board meetings, we have discussed how the Design Criteria which are approved by 15 APS and are the basis of the plant design are dealt with.
16 In particular, we discussed how the final design was achieved using the Design Criteria as the starting point, and, as 18 part. of these discussions, we reviewed the various project 19 procedures which guide the design process and the documenta-20 tion of the design process. In addition, we have discussed 21 our procedures for assuring interface data are properly 22 included in the design and'rocurement for the various 23 components. Since this material has been discussed at 24 previous system Review Boards, we propose to refer. the Board 25 to Section V of the handout package for a more detailed GRUMLEY REPORTERS Phoenix, Arizona
r
10 presentation of the design method, and I would ask, John, at this time if that is an acceptable way to cover these issues.
MR. ALLEN: Yes.
MR. BINGHAM: Fine. Our presentation today and tomorrow will follow the agenda that is shown. There will be a substantial amount of material that we will be covering.
There will be an overview of each system followed by a summary of conformance with 'regulatory requirements and additional items of'concern. As with past reviews, I plan to accept questions at the end of the General Introduction 12 section; Section 2.A.1.A, BOP ESFAS Design Criteria; Section 2.A.1.B, BOP ESFAS System Description; Section 2.A.3, ESF 14 Load Sequencer; Section 2.B, Systems Required for Safe 15 Shutdown; Section 2.C.l, Process Instrumentation; Section 16 2.C.2, Safety Equipment Status System; Section 2.C.3, Post-17 Accident Monitoring; Section 2.D., All Other Xnstrumentation 18 Systems Required for Safety; Section 2.E , Control Systems Not Required for Safety; Section 3.A., SRP Acceptance Criteri 20 Section 3.B., General Design Criteria; Section 3.C.,
Regulatory Guides; Section 3.D., XEEE Standards, Section 22 3.E., Branch Technical Positions; Section 3;G., NUREG-0737; and Section 4., Additional Items of Concern. I would ask, John, that if there are minor clarifications that are 25 essential to the Board for continuity of that section that GRUMLEY REPORTERS Phoenix, Arizona
~
that, would be appropriate to ask. However, I would ask that the questions be held until the end of the presentation of that section.
Dennis, would you start? "
MR. ALLEN: I would like to say a couple of things first, Dennis-, before you start the presentation. I would like to reemphasize what. Bill said. Because of the huge volume of material we'e got, please hold your questions until the sections as Bill indicated.
10 .Also, Bill, I would like to ask you if someone asks a question that you know you are going to cover later 12 on down the, line, if you would so note so we are not answerin 13 questions two and three times in a row.
MR. BINGHAM: We will do that,. John.
15 MR. KEXTH: Figure l-l shows the scope of what we 16 are going to be covering in the next two days. The figure 17 actually shows the total scope of the instrumentation and 18 controls as covered in the Palo Verde FSAR: The Reactor 19 Trip System, ESFAS, Safe Shutdown '.Systems, Safety-Related 20 Display Xnstrumentation, All Other Safety-Related Xnstrumenta 21 tion, and Nonsafety-Related Control Systems. With each one 22 of these, there is a balance of plant section and an NSSS 23 section. The dotted line shows the scope of what we are going to be covering in the next two days, and that is all 25 the balance of plant portions of these subjects plus NSSS GRUMLEY REPORTERS Phoenix, Arizona
e' 0
12 interface requirements as applicable to all subjects.
Figure 1-2 shows the Palo Verde general plant arr'angement. Palo Verde consists of three identical units'.
Each unit has Combustion Engineerin'g as the NSSS, develops 3,800 megawatts thermal of power and about, 1,300 megawatts electric.. Each of the three units is identical, so that this Figure 1-2 shows all three units consisting of the containment building, fuel building, turbine building, auxiliary building, radwaste building, control building, and diesel generator building. Also shown but not labeled is the main steam support"structure where we house our main 12 steam and main feedwater isolation valves and the auxiliary feedwater pumps. The Seismic Category 'I structures where 14 we house our safety-related equipment consist of the 15 containment, main steam support structure, auxiliary building 16 control building, diesel generator building, and fuel buildin 17 and it is those buildings which house the instrumentation 18 we will be discussing in the next couple of days.
19 Figure 1-3. We have one common control room for 20 controlling the plant. That is located in the contxol..':,;;."
21 building at 40 feet above grade. I guess we don't show 22 elevations, but in case we do later in the presentation, at 23 all three units, we use a common grade of l00 feet .so that we 24 have one set of drawings for all three units, so this is at 25 140 feet or 40 feet above grade. Xt shows the main horseshoe GRUMLEY REPORTERS Phoenix, Arizona
13 areawithin which the operator is located and controls the plant. Outside the horsesho'e area, we have a number of cabinets, the computer room, and then various offices.
Exhibit l-l shows 'the. Palo Verde classifications.
These will be mentioned in the presentation when we talk 6 about. the classification of some of the instruments. We ~
wanted to provide a background for that here.. All of our safety-related components are qualified as Quality Class Q.
This includes all Class IE instruments. It also includes 10 all ASME Section III, which won'. really be covered in this presentation. Anything classified as Quality Class Q means 12 that it will have a .full quality assurance program, a 13 quality assurance program which meets all the requirements 14 of 10CFR50, Appendix B.
15 For equipment which is required for power generatio or is required for personnel safety which is not classified 17 as Q, we developed another quality classification, Quality 18 Class R. The quality assurance program 'for these components 19 is similar to 'Q, but. not as detailed as far as .the'mount of 20 documentation required, particuarly in the traceability area.
21 All of our other equipment,'hich would consist.. of industry 22 standard equipment, we classify as Quality Class S.
23 Then for seismic categories, all of our safety-24 related equipment is qualified as Seismic Category.I, which
\
25 means that it will remain functional for a safe shutdown GRUMLEY REPORTERS Phoenix, Arizona
earthquake and an operating basis earthquake. In the P
instrumentation area, we have split off the Seismic Category I qualification into two different ones, Qfl for all equipmen r
which remains functional before, during,,and after an SSE, and Qf2 for that equipment which is .functional before and after the SSE, but not necessarily during. That, latter classification Qf2 applies primarily to recorders where you have the needle bouncing around during an SSE so you don' really get adequate readings.
10 Then corresponding to the .equipment which is classified as Quality Class R, this equipment will be designe 12 to meet Seismic Category II requirements, and Seismic 13 Catetory II implies that the equipment will not malfunction for an equivalent static load of .13G horizontal and .09G 15 vertical.
Then all the other equipment, the Quality Class.S 17 equipment, will be designed'o Seismic Category IXI, which 18 means designed for an equivalent static load of .05G or for
)9 uniform building code Seismic Zone 2.
20 Por equipment classified as Quality Class R or S
- 2) which is located in the 'vicinity of the Sei'smic Category I equipment and'could in the event of an earthquake fall and 23 damage Seismic Category I equipment, we ha've designed that 24 equipment to meet Seismic Category IX requirements, which 25 means that it will remain intact or remain supported during GRUMLEY REPORTERS Phoenix, Arizona
r
-15 an SSE.
Exhibit lA-1. We will now cover the CESSAR interface requirements. The CESSAR, as John Allen mentioned, stands for the Combustion Engineeri'ng Standard Safety r
Analysis Report. This is a standard safety analysis report which has been submitted to the NRC by Combustion 'Engineering and it, is referenced in the Palo Verde Final Safety Analysis Report. CESSAR contains many interface requirements which we are required to meet and we will be discussing the 10 interface requirements for the Instrumentation and Control Systems in the next few slides. These requirements from 12 CESSAR are rather general. We will go through them rather hurridly now and, if there are any detailed questions, we 14 will respond to them.
CESSAR gives the power requirements in Section 16 8.3.1,'nd we are in compliance with that. The Palo Verde 17 equipment is protected from the effects of natural phenomena.
18 The Palo Verde safety-related instrumentation and control 19 components are protected from pipe failure.
20 Exhibit lA-2, continuing the CESSAR interface requirements. The safety-related equipment at Palo Verde is 22 protected from the effects of missiles. The safety-related 23 equipment is separated to meet the 'requirements of Reg. Guide 24 1.,75.
Exhibit 1A-3. The cabling associated with our GRUMLEY REPORTERS Phoenix, Arizona
I equipment is separated so that a single credible event will not cause multiple channel malfunctions or interactions between channels.
Exhibit 1A-4. Our equipment is located and qualified such that we meet thermal limitations as presented in CESSAR Section 3.11. Our equipment will give an indicatio if it is not available. Xt is monitored, to meet the CESSAR interface requirement presented.
Exhibit 1A-5. All of our Reactor:Protection System 10 and Engineered Safety Features Actuation System devices are capable of being manually actuated in the control room and 12 those required for safe shutdown are also manually operable 13 at the remote shutdown panel, which will be discussed later.
14 All of our instrumentation is capable of being inspected and 15 tested, and our equipment. is located so that we do not exceed any environmental requirements as related to chemistry.
.17 Exhibit. 1A-6. The CESSAR requirement on materials 18 is not applicable for instrumentation and. controls equipment.
19 Components are arranged to provide, access for maintenance, 20 testing, and operation, and we meet the requirement fox 21 analog and digital signals as far as sharing the same multi-22 conductor cable. Ne locate our radwaste lines such 'that they 23 are not next to components which are not qualified due to 24 the concern about electronic components exceeding any 25 radiation limits.
GRUMLEY REPORTERS Phoenix, Arizona
17 Exhibit 1A-7. Our components are located not to exceed the pressure limits specified in CESSAR Section 3.11, once again getting back to the environmental requirement.
We are providing fire protection as required to meet, the requirements of '.,Geiieral Design Criterion No. 3.
Exhibit '1A-S, physical identification. We do provide physical identification for all our safety-related cabling. All of our associated cabling is treated as Class IE cable so that it has the, same coloring as our Class IE cable.
Exhibit 1A-9. We provide environmental support systems such that our safety-related equipment, will not be subjected to environments exceeding the requirements of
~4 CESSAR Section 3.11, and our instrumentation meets the seismic design requirements as specified in CESSAR Section 17 Exhibit lA-10. Our inputs to the Reactor PrOtection System and the Engineered Safety Features Actuatio System can be sent to the Plant. Monitoring System for trendin 20 data logging, and anything else we need to do with it at the computer.
22 Figure lA-l. As you saw from the earlier figure, we are not discussing the Reactor Protection Syst'm, since 24 that is completely within CESSAR's scope. Howevex; there are some interface requirements"from the'eactor Protecti'on GRUMLEY REPORTERS Phoenix, Arizona
l8 System, and we will go through those. Figure lA-1 shows the electrical and mechanical devices and circuitry required 3 to 'initiate a reactor shutdown starting with the process systems variables, which are input 'to the Reactor Protection System and the Supplementary'rotection, System, which gives 6 signals to in this case the reactor trip breakers, which .can be controlled manually, and these, of course, send signals to the control element drive mechanisms to drop the control rods if the variables indicate that is needed.
10 Figure lA-2 shows the various locations at one of the levels inside the auxiliary building, which is, of course 12 this area around here (indicating), and then inside the 13 containment. It gives you an idea of where the various 14 components are located, various transmitters for those proces 15 variables which we use in the Reactor Protection System and Engineered Safety Features Actuation System.
17 Exhibit 1A-ll shows the CESSAR interface 18 requirements for the Reactor Trip System. The first
)9 requirement is that .the preamplifiers for the fission 20 chambers be located outside the secondary shield but ~nside
- 2) the containment building and that thecabling be provided 22 with physical and electrical separation. We 'do meet. that 23 interface requirement. The second requireme'nt-is that 24 administrative procedures or othe'i mea'ns be 'used to control 25 changes to any of the constants in the core protection GRUMLEY REPORTERS Phoenix, Arizona
~ '
calculators. We are in compliance with that, using the suitable administrative procedures.
That concludes the introduction.
MR. BINGHAM: Questions from the Board, John?
MR. STERLXNG: I had a question on Exhibit lA-2, Item 5), Separation. In the'E XDR, there was a question asked concerning the commonality of the sensors between the various protection systems, in one case the SPS and the RPS.
Are you going to be discussing the routing of the lines to 10 show separation?
~
MR. KEITH: We are not in this presentation showing 12 routing of lines. Pressurizer'ressure is the input to the 13 Supplementary Protection System and, of course, it .is also 14 an input to the Reactor Protection System. There are four 15 channels for both the SPS and the RPS and the lines for Channel A comes off a single tap and then, it branches off
)7 and there are two isolation valves," a separate one for RPS 18 and a separate one for SPS. Then they are separated from 19 that point. to the transmitters.
20 MR. STERLXNG: Are the lines then from the isolation
- 2) valves, since they are supposed to be separate redundant..
22 systems even though they are bo'th Channel A, are 'they routed 23 together or separately or are they physically separated to 24 meet the rest af the criteria?
25 MR. KEITH: Starting from a common point, obviouslyr GRUMLEY REPORTERS Phoenix, Arizona
20 and since it is right by the pressurizer, there are probably some line breaks which would take out both lines. I think the important thing to remember about the Supplementary Protection System is that the only reason that is there is to mitigate ATWS, which is not an event which would include a pipe break. So for those particular lines, I don't think'0 the requirements as far as separation to meet the effects of a pipe break would be applicable.
MR. STERLING: Would it. be fair to state that you wouldn'0 necessarily have separated those lines, that they could be running in the same area other than where the tap is 12 MR. KEITH: Yes, they could be running in the same 13 area.
14 MR. ALLEN: Ed, do you want. it as an,.open item to have a drawing showing those routings? Are you satisfied?
16 MR. STERLING: Maybe if you could provide a drawing that would show how those are routed, a simplified drawing showing the areas where they are together,.
19 MR. ALLEN: Anyone else have a question?
20 MR. BARNOSKI: I have a couple. On the interface requirements, the CESSAR IDR identified documents other than the interface requirements listed in CESSAR.
23 MR. BINGHAM: I'm sorry, we can't hear you, Mike.
24 MR. BARNOSKI: This is 'a general ques'tion. The 'CESSAR IDR identified other documents, specifically wha't CE calls GRUMLEY REPORTERS Phoenix, Arizona
21 interface requirement documents, that put forth more detailed interface requirements on the applicant. You have demon-strated, I think, that you meet the interface requirements that are in CESSAR. Do you also comply with the CE interface requirement documents for the Instrumentation and Control Systems?
MR. BXNGHAM: John, I just wanted to make one point.
clear about, the question. I will give you the answer first.
The answer is yes, we do include them, but we have for 10 purposes'f the licensing effort referenced CESSAR and then we presume that, those documents that CESSAR uses or 12 'eferences as backup that are given to us are the appropriate 13 documents.
MR. BARNOSKX: Since you are not going to talk about 15 the trip system, there was one other item I recall being 16 identified, and that dealt with the 27 items of concern on Arkansas relative to the CPC's. Are you going to address 18 those? Not all 27 were applicable to the BOP, but a few 19 were. Are you going to address them not necessarily here, 20 but in some manner?
21 MR. BXNGHAM: John, why don't you let us confer at 22 break time. We believe we are 'addressing the'ssues, but we I
23 would like to check and then'e will res'pond back.
24 MR. BARNOSKI: That's all- I have.
25 MR. ROSENTHAL: We audited a set of interface GAUMLEY REPORTERS Phoenix, Arizona
~,
0
22 documents labeled SYS80-ICE and then a four numerical designator and, although those documents are not in the SAR, they form a part of the basis of our review. Do you take 4 exception to any of the standard System 80 interface requirements in those documents? Let me further explain.
4 MR. BINGHAM: Just a moment, please.
We'e with you. 'Go ahead and clarify it, please.
MR. ROSENTHAL: The NRC is performing a review of the System 80 standard plant offering and we will issue an SER 10 on the System 80 standard plant offering and we wish to L
assure ourselves that Palo Verde may appropriately reference the standard System 80 NSSS design,,and that .is the motivatio for- this question. You need not comply with all aspects of 14 the standard System 80 interface requirements, but should you not comply, then 'we would like to know what alternate paths you have chosen.
17 MR. BINGHAM: You are asking a general question. Let 18 me give a general response and then perhaps we can look at 19 some specifics later ia the day or two to clarify it for the 20 Board. We are required to mee't all interfaces'.that are 21 given to us by Combustion Engineering whether they are in 22 the documents you mentioned or in other documents. Combustia 23 is obligated to review our interpretation of the req'uirements 24 to assure that we have incorporated their nee'ds in the proper manner. Now, this would be for Palo Verde. If there GAUMLEY REPOATERS Phoenix, Arizona
23 are some differences in the standard System 80 that are not applicable to Palo Verde, we would expect that Combustion Engineering would so notify us with the proper documentation 4 and give us the interfaces that we need to meet for balance of plant. I am sure that we have done that and we do have documentation in the files that shows that CE has reviewed our interpretation of the information through drawings and 8 documents.
I think, John, I, would have to ask the Board to 10 assure that Combustion Engineering has'sent Bechtel all the proper. documentation and that tha't which is being sent,to NRC 12 for review is compatible with what they have 'sent us for 13 the interfaces. I believe the answer is correct that, we'4 have, but we have not taken those particular documents and gone line by line by line necessarily.
MR. KEITH: Combustion Engineering, when they send us 17 documents such as the one you are referring to, they send 18 us the standard System 80 document plus a document whi'ch is 19 unique to Palo Verde, so that what we meet is really the theie will be
'0 combination of those 'two documents.. Because 21 some things in System 80 which 'for one 'reason or other may 22 not be applicable to Palo Verde, they issue 'th'is supplementar 23 document which is unique to the project.
24 MR. BINGHAN: I don't know how well that hei'ps with 25 your question, but there is a base document System 80 and ORUMLEY REPORTERS Phoenix, Arizona
~ i 24 there is a project document. As Dennis said, the two documents are put together and those are the documents that we use to meet the interface requirements.
MR. STERLING: As a clarification there, if there is a project-related document versus a System 80-related document, maybe it might be appropriate to say what grind of things cause you to have a F
project-related document, since we are referencing a System 80 plant.
MR. BINGHAM: I can give you an example, not in this 10 particular area, but we do have a desert site and that requires a different capacity heat exchanger to cool the 12 water, for example, .and that would not he.standard. That 13 would be unique to Palo Verde.
MR. KEITH: In this area, we may have unique hardware 15 and the power requirements for tha't hardware would be different than the general ones given for the standard 17 System 80, so that due to the hardware which Combustion Engineering had purchased for Palo Verde,,there would be 19 'different power requirements.
20 MR. STERLING: Such requirements that are 'more critica 21 such as thermal requirements, those types of things, would 22 not, this project-'related'ocument be different .than the 23 System 80 document, or would it be 'a fair statement that the project-related document is stricter than the 'System 80 document?
GRUMLEY REPORTERS Phoenix, Arizona
0 I ll J ~
25 MR. BINGHAM: Well, it is certainly site specific and' would guess that,,in general, the overall requirements 3 that you 'talked about would be the same as the standard System 80.
MR. ALLEN: Jack, getting back to your question, .you don', look like you are satisfied or you didn't get what you wanted. Maybe you can clarify a little bit more what you are looking for.
MISS KERRIGAN: I think I will clarify a little bit.
10 When you say you are in compliance with an'nterface requirement, you really may not be. It may just be that 12 you are in compliance with some requirement .of the project 13 as defined specifically for the Palo Verde project.
MR. KEITH: When we "talk about being in compliance 15 with interface requirements here,,we 'are in compliance.
16 MISS KERRIGAN: But in response to Mike's question, 17 when you say you are in compliance, I understand that these interface documents are much 'more. det'ailed and you may be 19 taking exceptions for the Palo Verde project,. and those show 20 up only in the project-related. document, is that right7 21 MR. KEITH: We are in compliance with the Combustion 22 Engineering requirements, but .Combustion Engineering sends 23 us two documents related to the requirements. One is the 24 standard System 80.'hat 'is what we 'may not be in complete 25 compliance with. The othe'r is the Palo Verde. That is 'from GRUMLEY REPORTERS Phoenix, Arizona
I II r
- 1')
I I
I 1
f 1 t K
1 I
1
)
)
I I 1 4
1 r
26 Combustion Engineering, so we are in compliance with the Combustion Engineering requirements.
MXSS KERRXGAN: At the second meeting with NRC, could you provide us with 'some sort of detailed list of the differences between the project documents and the CESSAR 80 document? Is that possible? Someone in the audience is nodding the'ir head.
MR. ALLEN: Does that satisfy you?
MR. BINGHAM: Sure..
MR. ROSENTHAL: You may need time to prepare a summary list and I may choose to read some of tho'se plant specific interface documents., I did spend a day reading the standard System 80 ones. What I am interested in is not, a question 14 of does Combustion typically supply 23 relays and 6 conta'cts and now you need a twenty-fourth relay in the same, actuation circuit in, let's say, the ESP auxiliary relay cabinet,,but, 17 rather, things like are the system qualifications for the 18 System 80, or the environmental qualifications, heat load, different for Palo Verde.
20 MR. BINGHAM: We can respondr to that.
21 MR. ROSENTHAL: Substantive rathei than nit-picking.
22 MR. BXNGHAM: They are 'not, and usually the qualifica-tions are handled in separate topicals by Combustion 24 Engineering, and I think their environmental qualification 25 is CENPD 255 and I believe their seismic is 1.83, if I GRUMLEY REPORTERS Phoenix, Arizona
t t I 'I ' *1 LI ttj) )'$ I j t))t" ))I "l,.tl , " * ))I -
Iht,( h)hh) ll 4
l'g I I I
+,I'lap
- ,j j I,'I,::'".Fr<h ),',, ' ~ r 1 h;
I g tr' )~h'gt j t jel h)jl Ikjj,IHI."K.t )2'1 I'h" .P,I,) )t< "
I,'5 I I 1) .1 fh I I'I.- t i fj II j,)y r) j I
1
't I 1 jj ))
I I " J I
~ 't I l,
t I
) )
)( 1
)l 1~
I'R J,I't l." I th 0
27 remember correctly. Those documents will form the basis for the qualifications, and I would expect that for Palo Verde, we would be in compliance for the qualifications. In other words, what we are saying. is that there are specific unique things at Palo Verde that require some clarification or modification of their basic criteria. They tell us what it is. We implement it. So for a particular project, if you add the documents that were specific to Palo Verde, that would give you the complete picture.
10 MR. ALLEN: Also, you could identify how we designate a difference between CESSAR and our FSAR, a colored page.
12 MR. BINGHAM: Yes.
. If there are major exceptions, they will be noted in the SAR. I don'0 know if there are 14 any.
15 MR. KEITH: Not in this area.
16 MR. BINGHAM: There are none in this area that we know of, John.
18 MR. KEXTH: That, o'f course,",is referring once again to CESSAR, deviations to. CESSAR interface, requirements. Bill 1
answered =-your question, Jack, that, the big things are. the same for Palo Verde and CESSAR. It is the'se 'things like your example of the number of relays where 'there are differ-ences, and that 'is where this spec'ific document 'c'omes in.
24 We will provide that summary or we will provide the 'actual 25 document for you.
GRUMLEY REPORTERS Phoenix, Arizona
28 MR. BARNOSKI: May I make a clarification? Maybe it is more procedural than anything else, but the process CE uses to go from a general System 80 to a project need I think is a CESSAR issue and probably needs to be pursued, if anyone wants to pursue it, on the 'CESSAR docket., I understand what. you are saying is that, whatever process he goes through to, give you those interface documents, that you feel you are in compliance with the ones that are in CESSAR and the more detailed ones that we send you.
10 MR. BINGHAM:'hat's right.
~
MR. ALLEN: Joe, did you have a question?
12 MR. MECH:, Might I just introduce an example to show 13 the kind of confusion that we get into or might get into?
14 It is subject to a lot of qualification and possibly defini-15 tion. CESSAR states very definitively that all the ESF are supported by two-out-of-four logic. Palo Verde states that' 17 good many of their ESF features are supported by one-out-of 18 two logic. Without looking at the'ndividual cases, you 19 from the surface, at. least, reach 'a contradiction.
20 MR. KEITH: We will be .'going into that difference.
21 think there is ample justification for our design.
22 MR. MECH: That is one 'of thethings.=
23 MR. KEITH: We will go into that in detail. For all 24 of the CESSAR, the things we need to protect, CESSAR equipmen 25 that is all Combustion Engineering logic and it is all GRUMLEY REPORTERS Phoenix, Arizona
29 two-out-of-four, so it is other qualification of plant items 2 where we get, into the one-out-of-two.
3 MR. ROSENTHAL: I have some more questions. On the insulation of impulse lines from root to transmitter, what are the insulation and separation criteria?
MR, BINGHAM: John, we talk about separation at just about every IDR we have in some particular form, and rather than just give a general review here, say in the afternoon, we will come back and specifically tailor it to this particul r 10 IDR.
MR. ALLEN:
'I Then you are going to cover it during 12 the IDR?
13 MR. BINGHAM: We will cover it.
14 MR. ROSENTHAL: One of your interface requirements 15 is on thermal limitations. Have you a monitor to assure 16 compliance with the thermal limits?
17 MR. BINGHAM: Which figure are you looking at, please?
18 MR. ROSENTHAL: lA-'4, .Item 7).
19 MR. KEXTH In meeting thi.s, the're is a question 20 which has -been around rel'ating to enviro'nmental qualification 21 and the failure 'of the ventilati'on system and we have 22 responded to tha't in 3;ll. I will 'try, and remember's much.
23 of the details as I can of that. Basically, we .get an 24 alarm upon the failure of any safety-related ventilation 25 equipment, and in the event, of that failure, we would monitor GRUMLEY REPORTERS Phoenix, Arizona
30 the temperature in that room by means of portable monitors so that we have a record if we exceeded the environmental qualification temperature in a given room.
MR. ALLEN: Do you hive addi'tional questions, Jack?
MR. ROSENTHAL: Yes. Then from a. strictly electrical
'I standpoint, I take it that you define HVAC as a supporting system for an instrumentation control device and that you
'I monitor with temperature switches.
MR. KEITH: I believe i;t is a failure of power to that equipment.
~
MR. ROSENTHAL: And you alarm it via bells, whistles, 12 plant computers 13 MR. KEITH: The plant annunciator. Jack, for these 14 supporting.,systems, they are also included in our safety 15 equipment status system, which 'will be discussed later as far'as the loss of power or anything like that.
17 MR. ROSENTHAL: A real quick question on Figure lA-2.
Are the transmitters in rack panels or in cabinets?
19 MR. KEITH: They are open racks or they could be wall mounted.
21 MR. ROSENTHAL: On .Page.'lA-8, you identify the. color 22 coding of protection associated circuits. Ho'w do you treat cables and ultimate equipment downstream of a qualified 24 buffer which interfaces between safety, and nonsafety systems and would it be formally classified as an associated circuit?
GRUMLEY REPORTERS Phoenix, Arizona
, ~
3l MR. KEITH: That is treated as non-IE cable downstream of an isolation device.
MR. ROSENTHAL: If I have a piece of safety equipment and I have a buffer that, is qualified for 480 volts on the output, not affecting the input, then the cable downstream of that buffer is 'non-IE cabling, but I should not. submit that cabling or circuitry to a credible fault which would result in imposing a voltage greater than the 480 volts, the buffer qualification.
10 MR. KEITH: We do take care of that concern in our cable routing program by assuring that cable downstream of the buffer is routed only in a tray which has cabling of a comparable voltage level', that qualified for the, buffer'4 l25 DC or whatever.
15 MR. ROSENTHAL: You have label'ed these cables A, B, C, D, J, K, L, M and A, B. I believe we saw some cables with X and Y designators on them, also, in the CE .scope of supply. Do you have any special way of treating them other tha'n as you stated earlier?
20 MR. STERLING: Just a clarification. I .think:those 21 wex'e instx'uments that wer'e indicated as bei'ng an X pnd p Y 22 and they wex'en't channel'ized pex'e.' bel'ieve it was the pressurizer level.
24 MR. KEITH: Tho'se 'particular cables whi;ch;you saw we treat as A and B.
GRUMLEY REPORTERS Phoenix, Arizona
32 MR. ROSENTHAL: That particular circuit then you properly address and we are all aware of that one. I am concerned that there may be othe'rs and I am hoping that maybe the answer is programmatic by virtue of the cable routing.
MR. KEITH: Well, let me try and see if this addresses your concern. .If there is any cabling which we provide to Combustion Engineering equipment which has been identified as safety-related, it would be treated by us as 10 A, B, C, or D, the Class IE cabling.
MR. ROSENTHAL: I'm sorry, I am being slow.
12 MRS. MORETON:. Maybe I can clarify. Our instrument 13 tag numbers contain additional information above and beyond 14 what Combustion gives us. They contain a digit in there that 15 identifies the safety channel. On the particular two you saw, which were pressurizer level instrument .tags, those 17 are A and B because the CE measurement channel block diagram 18 identified the cable as A and B. Downstream of that where 19 there is nonsafety-related instrumentation that also carries 20 a suffix of X and 7, the balance of plant tag number would 21 not contain a safety designator and that is treated as 22 downstream of the isolation. The' and the Y as 'on-IE 23 suffixes on the tag numbers 'are not really factored into the 24 design other tha'n they exist'n our tag number's suffixes, 25 but the key in our tag number is anothe'r designator which.
GRUMLEY REPORTERS Phoenix, Arizona
33 comes off of the hexagons you saw in the block diagram.
MR. STERLING: Would it be a fair statement that all cabling that is IE is in one of the four channels? There are no separate channel cables outside those four?
MRS. MORETON: The four safety channels and non-IE 6 channels.
MR. STERLING: There is no fifth or sixth channel?
There are no separate routings throughout the plant that are separate from those four channels in the Class IE?
10 MRS. MORETON: Unless CE specifically required special separations, as I think they do in the Plant, Protec-tion System and the, auxiliary relay cabinet, that is a true statement, and those are routed in special conduits separate 14 from all other cable.
15 MR. STERLING: Is -there a special color designation for'those particular ones?
17 MRS. MORETON: Not that I am aware of.
18 MR. STERLING: Do they carry the'our-channel red, green, yellow, blue? Are the'y all black?
20 MR. BINGHAM: We'belieVe .they carry the'olors."
21 Excuse me, John, we are getting down into qui,te a 22 bit of detail on the color coding. Would it be appropriate.
to spend a few minutes sometime during the two days to outlin 24 what is happening? I would have 'thought that at the CESSANT IDR, although I wasn't there, that the interfaces would match GRUMLEY REPORTERS Phoenix, Arizona
8 g 34 what is being done in the balance of plant, and I sense some 2 confusion or some uncertainty. Would it, help if we sat down with Jack during a recess and just indicated to him how the two mesh?
MR. ALLEN: Well, I will leave that up to you, Jack.
Are you getting what you need from this discussion or would you rather do it separate?
MR. ROSENTHAL: I am not a good note taker,'o I would prefer that it became part of the transcript. It was 10 an issue that was raised at a related IDR and I think it can be put to bed somewhere over the two days and I would like 12 to finish it formally.
13 MISS KERRIGAN: Either during this meeting or during 14 the NRC follow-up meeting during the week of July 27th.
15 MR. ALLEN: Why don't we go through the presentation?
I know they are going to get into it a little more. Then if you have any additional concerns, we could do it at the 18 follow-up meeting.
19 . MR. KEXTH: Can we clarify maybe right'ow, if you 20 could, Jack, just what, your concern is still?
21 MR. RQSENTHAL: Let me make a programmatic statement.
22 When it appears and we have a transcript going that an 23 issue is being raised, I think it would be best to finish. it 24 rather than leave it dangling. I think that is in every-25 body's interest,. Now for the technica,l concern. I believe GRUMLEY REPORTERS Phoenix, Arizona
35 that you answered my concern by virtue of your statement about your cable routing, and that is that wherever you have a non-IE cable that goes to a buffer which, in turn, attaches to a piece of safety-related equipment, you know what is in that cable, you know the quali'fication of the buffer, and that on a programmatic basis, you ensure that you don' violate the design criteria for the buffer. The other part, and we will use the example of a pressurizer level control, is that we have two circuits with 'information of some 10 importance which are independent, are downstream of buffers, and it sounds as if you would then conceivably intermingle 12 those as you went on in routing cable in the. plant because 13 they are non-IE and there really aren't good criteria.
MR. BINGHAM: Let me see if I can find a way to 15 respond to this thing. As I understand it, there axe some 16 concerns about how we interpret the CE requirements, and it 17 sounds to me like there is some confusion about the fact.
18 that has CE that. the A/E, in this pax'ticular case Palo 7erde, 19 has interpreted their criteria properly and ha's xouted the 20 cables properly. Perhaps ther'e was a response from CE to 21 that question at the IDR, but if there was, not,: then I think, 22 JOhn, today We can perha'ps chit,with 'CE 'and see Wha't .they 23 have done in order to assure. the'msel'ves'ha't we have.
24 interpreted their criteria properly. Once'he'y'ave done 25 that, we can spell out clea'xly the criteria which, we can GRUMLEY REPORTERS Phoenix, Arizona
36 give to you for your review. I think then that will tie together the CE criteria, how it was interpreted by the A/E in the routing, and you would have the whole picture.
4 Am I getting into the right. concern?
MR. ROSENTHAL: Fine. Mr. Sterling and Mr. Johnson are on the Board here and were 'on the Board at the Combustion meeting. We don't have a transcript, unfortunately, from that meeting. The two of them might be able to help me.
I remember that they also had questions.
10 MR. JOHNSON: Perhaps I can clarify the concern.
Once the cable has passed by the isolator, it, is now non-Class IE. What quality assurance procedures are in effect to ensure that that. non-IE cable stays in a voltage level 14 tray that that cable is designated fox? I understand that you would have a rigorous quality control procedure for the IE cables, but once you have a non-IE cable, what prevents that 480 volt cable from getting into a 4,kV volt'able tray?
18 MR. BXNGHAM: That we 'can answer. Xs that the only 19 3.ssue?
20 MR. ROSENTHAL: That and what are your criteria for separation of, let's say, these.'X and X designated channels downstream of the buffers, which 'would normally be considered non-XE and could in principle be intermingled.
24 MR. BINGHAM: All right. Hex'e I was focusing on assuring we understood the Combustion Engineering criteria QRUMLEY REPORTERS Phoenix, Arizona
0
37 that pass on to us for those particular circuits, and we will search that out and then we will demonstrate that we do meet those criteria.
MR. KEXTH: The routing of the non-IE cable downstream of the'uffer, that is the'uestion, which I addressed earlier. That is covered in our cable routing program, and that cable routing program applies to non-XE cable as well as the IE cable. It is 'all one program, so it is basically all under the same quality. assurance program. That program 10 assures us that we do not route 125 volt cable in with',160 volt cable or whatever. So we take care of that. Now, 12 using the pressurizer level" as an example where we have these 13 two transmitters whi;ch have been designated as X and Y by 14 Combustion and which we route as A and B, we route that as 15 Class IE cable and the indication which is required for post-accident. monitoring comes off of that as Class XE, and then 17 after that point, we come to an isolator and the'n .we have 18 some black cable, non-IE cable, whi'ch goes to the level 19 control system, which is nonsafety. That black cable from 20 both, the A and the B may be intermingled. There. are no 21 xequirements from Combustion Enginee'ring and we do not 22 impose "any xequixements to keep'hat 'cable 'separate from 23 each other.
24 MR. STERLING: But you do have, requirements that 25 indicate what voltage level that cable can be'outed in?
ORUMLEY REPORTERS Phoenix, Arizona
38 MR. KEITH: Yes. That is the other concern which we addressed. We do assure ourselves that that voltage cable stays within the qualification of the buffer.
MR. STERLING: The'nterface requirements for the X and the Y type instrument, .Combustion tells you outside the hexagon,. the little A's and the B's, what channel it should get power from, what channel it should be routed in and associated with upstream of the isolator?
MRS. MORETON: Correct.
10 MR. BINGHAM:'oes that 'satisfy the Board, John?
MR. ALLEN: I don't see any more hands. Why don' 12 we proceed?
13 MR. BINGHAM: There were some particular things we were going to respond to. I think Dennis tried to respond 15 to those questions and I wanted to hear whether we have 16 satisfied the Board in those areas or not.
17 MR. STERLING: It is a different:topic than this.
18 MR. ALLEN: Well, let's wait. I want to find out if 19 that is satisfactory with everybody or if somebody wants an 20 open item on it and additi'onal info'rmation.
21 Okay, Ed, did you have an additional question?.
/
22 MR. STERLING: Yes. The 'mounting of= the instruments 23 you say is on open racks.
24 MR. BINGHAM: That's correct.
25 MR. STERLING: You also on Exhibit lA-5, Item ll},
ORUMLEY REPORTERS Phoenix, Arizona
39 indicate that you are in compliance with not exceeding chemistry limits. Are there any instruments that are provide in the balance of plant that are in the spray environment?
MR. BINGHAM: What do you mean by spray?
MR. STERLING: Chemical spray .inside 'the containment.
6 MR. KEITH: None 'that have to survive the environment.
I mean, obviously, there are instrumen'ts inside containment.
which we provide in addition to those which Combustion provides, but none which are required post.-accident.
10 MR. STERLING: Are there any. of 'those that could be affected by the sprays that would adversely affect the operation of the plant if they fail?
13 MR. BINGHAM: Well, John, if you have the'. spray 14 actuated, I would expect. the oper'ators would be quite alarmed and perhaps you could discuss tha't with;the operating department,'7 MR. ALLEN: I don't thi'nk that .is what Zd is getting 18 at.
MR. STERLING: No. I mean are the instrumen'ts that are in the containment,.that 'are not protec'ted from the'pray, 21 are they designed such 'that the'hemical impact of the spray 22 is not going to adversely affect downstream of the instrument any of the safety systems or safe shutdown of the plant?
24 MR. KEITH: Ed, the equipment which, we 'ha've whi:ch is not designed for these. chemistry limits is all nonsafety GRUMLEY REPORTERS Phoenix, Arizona
~,
40 grade equipment and it could be adversely affected. Does that respond to your question?
MR. STERLING: Do those feed back into the safety systems?
MR. KEITH: No, none of that equipment feeds into. the safety channels.
MR. STERLING: Then your answer is that it couldn' affect the safe shutdown or the safe operation of the safety channels?
10 MR. KEITH: That's correct.
MR. ALLEN: Any further questions?
12 MR. BESSETTE: Exhibit lA-6, Item 12), on materials.
Do you have any instruments within your scope on the reactor coolant pressure boundary that might. have., to meet 15 the ASME code requirements for mater'ials?
MR. KEITH: Not as part of the reactor coolant 17 pressure boundary.
18 MR. BESSETTE: Expanding that a little bit, possibly 19 i,n the engineering safeguards systems whex'e the systems 20 went operational and became part of the 'reactor coolant 21 pressure boundary.
22 MR. KEITH: Staying within systems whi'ch 'are cOnnected 23 to the primary system, all Chat .instrumentation is provided 24 by Combustion Engineering.
25 MR. ALLEN: Are 'ther'e additional questions? Anyone GRUMLEY REPORTERS Phoenix, Arizona
4l else? I guess we are ready to go on to the next section.
We plan to take a break about 10:00.
MR. BINGHAM: The next section is our system overview, Engineered Safety Features System. 'e will cover the BOP ESFAS design criteria, John, and would suggest, after the questions, we will have a break, and then we will carry on with the system description.
MRS. MORETON: Referring to Figure 2A-l, which shows the Engineered Safety Feature System, which consists 10 of those electrical and mechanical devices,and circuitry, including the sensors that sense the process variables, 12 through the actuation devices required to initiate protective 13 action, we show here the NSSS Engineered Safety Features 14 Systems, which was discussed at CESSAR, the Balance of Plant 15 Engineered Safety Features System, including our ESF load sequencers. Both the systems do actuate the NSSS ESF system, 17 the BOP. systems, and the BOP support systems. Some examples 18 of those systems include containment isolation, main steam 19 isolation, auxiliary. feedwater, fuel building essential 20 ventilation, our BOP ESF systems, fuel .building essential 21 ventilation, containment purge isolation, control room 22 essential ventilation, and containment combustible gas control system, which is a manual system. BOP support systems include the diesel generators, the DG fuel oil 25 storage and transfer, Class IE DC power, Class IE AC power, GRUMLEY REPORTERS Phoenix, Arizona
42 1 essential cooling water, essential spray ponds, and chilled water system. For today, we will be discussing our BOP 3 ESFAS. We will cover typical actuated device logics, which 4 will address logics for all the ESF and ESFAS support systems Exhibit 2Al-l, .Balance of Plant Engineered Safety 6 Features Actuation System Design Criteria. The Balance of 7 Plant Engineered Safety Features Actuation System, the 8 BOP ESFAS, shall provide initiating signals for Balance of 9 Plant Engineering Safety Feature System components which 10 require automatic initiation following a design basis event.
11 The BOP ESFAS actuation signals are the fuel building 12 essential ventilation actuation signal, containment purge 13 isolation actuation signal, control room ventilation 14 isolation actuation signal, and control room essential 15 filtration actuation signal. These automatically actuated 16 BOP ESF systems are the fuel building essential ventilation, 17 containment purge isolation, control room essential 18 ventilation,,and their support systems. There is one manuall 19 actuated BOP ESF system, which is the containment combustible 20 gas control system.
21 Exhibit 2A1-2. Specific design criteria for the 22 BOP ESFAS as detailed in IEEE 279-1971 "Criteria for 23 Protection Systems for Nuclear Power Generating Stations,"
24 Section 3, are as follows, and will be covered over here, which include the design basis events, monitored variables, GRUMLEY REPORTERS Phoenix, Arizona
number and location of sensors, normal operation nominal variable values, normal operation variable limits, actuation setpoints, margin to actuation, qualification, redundancy, and failure modes, and minimum performance requirements.
Design basis events requiring BOP ESF action are shown on Exhibit 2Al-3. An example of a typical design basis event would be a fuel handling accident in the containment building, which is mitigated using the contain-ment purge isolation system and protection by the control 10 room operators through the essential ventilation system.
Basis (2), shown on Exhibit 2A1-4, covers monitored 12 variables initiating protective signals and the initiating 13 protective actions. An example here would be the fuel building airborne activity, which actuates our fuel building 15 events ventilation actuation signal. This signal actuates the fuel building filtration portion of the fuel building essential ventilation system and causes pressurized filtered 18 recirculation of the control room essential ventilation 19 system.
20 Basis (3) on Exhibit 2A1-5 covers the number and 21 location of sensors required to monitor. the variables.
22 Another example her'e is the fuel building exhaust duct 23 radiation level. It is monitored by Beta-scintillation 24 detector. There is one detector located at the fuel building 25 exhaust. The redundant parameter is monitored by a GRUMLEY REPORTERS Phoenix, Acizona
44 Geiger-blueller counter overlooking the fuel pool.
Bases (4), (5), (6) and (7) are covered on Exhibit 2A1-6. They cover the normal operation limits for each variable, the actuation setpoints, and the margin between the operation limits and actuation setpoints. An example shown here for the fuel b'uilding exhaust duct high activity. At full power,.the nominal is at less than
-6 microcuries sensitivity, which is less than 10 per cubic centimeter. The normal operation limit is the same. The 10 actuation .setpoint is 2 to the 10 -6 microcuries per cubic
-6 centimeter, and the margin to actuation is therefore 1 x 10 12 microcuries per cubic centimeter. Basis ',(8)-, shown on 13 Exhibit 2A1-7, covers the qualification, .redundancy, and failure mode requirements of the BOP ESFAS. BOP ESFAS 15 components shall be qualified to withstand and remain operable during the environmental conditions maintained at 17 the equipment locations be'fore, during, and after the design 18 basis events. The BOP ESFAS components shall withstand and 19 remain operabl'e during and after an SSE. A single failure 20 within the BOP ESFAS shall not prevent proper protective 21 action at the system -level. A loss of power to the BOP ESFAS 22 channels or to the logic system causes. system actuation.
Finally, Basis (9), covered on Exhibit 2A1-8, 24 covers the minimum performance requirements of the BOP ESFAS.
25 This includes response time, which is the sum of the GAUMLEY REPORTERS Phoenix, Arizona
measurement. channel response time and the BOP ESFAS logic response time, and includes the measurement channel accuracy.
An example here for the fuel pool area radiation, measurement.
channel response time is one-half second, BOP ESFAS logic response time is 1.278 seconds, with the measurement channel accuracy of plus or minus 20%.
Continuing on with the design criteria, Exhibit 2A1-9, only those ESF systems that, when actuated, do not cause a plant condition requiring protective action or 10 disturb .reactor operations shall be controlled by the BOP ESFAS. The automatically actuated BOP ESF systems shall- use 12 one-out-of-two input. signal logic. The BOP ESFAS logic 13 shall be contained in separate enclosures isolated from the NSSS two-out,-of-, four ESFAS and reactor protective system 15 logic. The actuation system consists of the sensors, 16 bistables, initiation logic, and actuation logic that monitor 17 selected plant parameters and provide an actuation signal to 18 each individual actuated component in the ESF system if the 19 plant parameters reach preselected points., The BOP ESFAS 20 shall provide the logic to automatically start and 21 sequentially load the diesel generators and to shed all 22 4.16 kV Class IE loads on a loss of power.
the standards used in I
23 'xhibit 2Al-10 addresses 24 the design of the BOP ESFAS, which include the IEEE standards essentially 10CFR50, Appendix A.
QRUMLEY REPORTERS Phoenix, Arizona
~
Exhibit 2Al-ll. The initiating circuits shall continuously monitor key process variables indicating accident. conditions and transmitting digital, or on/off, signals to the BOP ESFAS initiating logic. The BOP ESFAS initiating logic provides two ESFAS initiation signals for the actuation logic. The system shall monitor the under-voltage relays on the 4.16 kV Class IE bus and initiate a logic signal on a two-out-of-four coincidence of bus under-voltage. This logic signal will be used to shed all Class IE 10 4.16 kV loads except. the load center transformers, shed certain 480 volt, loads; start the diesel generator, start 12 equipment required after a loss of offsite power, and trip 13 the 4.16 kV Class IE bus preferred power supply breakers.
14 Exhibit 2A1-12. The system shall provide sequencin 15 logic for sequential loading of ESF and forced shutdown 16 loads onto the ESF bus upon closing of the diesel generator 17 breaker,, a safety injection actuation signal, or an 18 auxiliary feedwater actuation signal. The BOP ESFAS shall 19 be designed to'he requirements for nuclear safety-related 20 systems such that the devices must maintain their safety-21 related functional capability under all normal and abnormal 22 plant operating conditions. The two redundant initiating logic systems and the two redundant, actuation logic systems 24 shall be separated and identified by appropriate colored 25 nameplate and wiring separation identification. Power for GRUMLEY REPORTERS Phoenix, Arizona
V I
o o
~
47 each independent and redundant logic subsystem shall be supplied from a separate Class IE 120 volt-AC vital 3 instrument and Class IE 125 volt-DC distribution bus. The system shall accept power input line variations and transient
,without producing false protective actuations or preventing required response to accident conditions.
Exhibit 2A1-,13. Provisions for testing shall be in accordance with Reg. Guide 1.22 and IEEE 338-1971.
shall prevent the operator from bypassing more 10 than one sensor channel at a time for any one type of trip.
This interlock shall not compromise the redundance and 12 independence of the, channels.
22'nterlocks Should another accident 13 condition occur after the load sequencer has started, the sequencer shall reset to zero. Equipment in operation at I
14 15 this time shall remain in operation. If a,loss of o'ffsite 16 power signal is initiated after the load sequencer has t
17 started, all loads will be shed and resequenced on the 18 diesel generator breaker closure.
19 This concludes the BOP ESFAS presentation.
20 MR. BINGHAM: John, are there any questions from the 21 Board, on the design criteria?
MR. ALLEN: I am sur'e'here are.
23 Ed, go 'ahead.
24 MR. STERLING: Do you have thermal design criteria 25 for the design limits?
GRUMLEY REPORTERS Phoenix, Arizona
'I l'
MR. BINGHAM: Which figure are you looking at, Ed?
2, MR. STERLING: Well, there isn't one listed.
MR. BINGHAM: What is the question, please?
MR. STERLING: A thermal requirement for where these logics and actuation circuits should be located.f MR. BINGHAM: You are talking about equipment qualifications?
MR. STERLING: Well, there is a thermal requirement in the CESSAR interfaces. Do we have a design criterion for 10 our electronics as to'hat thermal MR. BINGHAM: Yes, and at the IDR, I don't recall 12 you were on .the Board or not, we did go through the 'hether 13 zones and the location of all the equipment and the sequencin we go through to qualify it. I believe that information is 15 covered in detail in that particular transcript.
16 MR. STERLING: That would be helpful. You were V
17 referring to that transcript, then?
18 MR. BINGHAM: Yes.
19 MR. STERLING:. On the load sequencer, Exhibit. 2A1-13, 20 do you intend to go through the complete description of what 21 you are doing at that time? 0 22 MRS. MORETON: Yes, it will be covered under the 23 ESF load sequencer. The design criteria will be repeated 24 at that time and the system description will be covered.
25 MR. STERLING: I think I will hold my questions, GRUMLEY REPORTERS Phoenix, Arizona
N 0
49 because I want to get into more detail on that.
MR. ALLEN: Further questions?
MR. KONDIC: Exhibit 2A1-5, the control room air intake chlorine level, is it done continuously or periodicall or how often, because it is difficult to visualize that that is continuous.
MRS. MORETON: Continuously.
MR. KONDIC: Really? I'm glad.
A MR. MECH: In a couple of places, you refer to the 10 Reading the FSAR, apparently you do not. use chlorine.'hlorine on site.
12 MR. BINGHAM: . We do not=-use chlorine gas.
f 13 MR. MECH: You do use it?
14 MR. BINGHAM: Do not.
15 MR. MECH: Then what is the reason or what is the I
logic behind the chlorine detector? I have looked through 17 it to see what the necessity was.
18 MR, BINGHAM: What we use is sodium hydrochloride at 19 the site. We 'did in the early days have a chlorine gas as 20 part of our use, particularly in the water reclamation 21 facility. The detectors are still there in case, there is an 22 inadvertent railroad car or truck or something nearby that 23 might, spill chlorine content.
24 MR. MECH: But you don't really need them.
25 MR. BINGHAM: No.
GRUMLEY REPORTERS Phoenix, Arizona
I MR. ALLEN: Any Board member? Jack'.
MR. ROSENTHAL: Do you have a containment vacuum relief system?
MR. KEITH: No.
MR. ROSENTHAL: On Exhibit 2A1-5, is the containment 6 hydrogen analyzer, which works on the basis of thermal conductivity, the same hydrogen analyzer which will be used to satisfy the NUREG-0737 requirements?
MRS. MORETON: Yes..
10 MR. ROSENTHAL: Later on in the presentation, I would like a little bit more information on the sensor j.tself, the 12 thermal conductivity. device rather than--
13 MRS. MORETON: We can either cover it here or we can cover it under post-accident monitoring.
15 MR. ROSENTHAL: Later. This, is related to Exhibit 16 2A1-10. You call out IEEE 338-7l. I believe the later 17 versions of IEEE 338 require response time testing, and on 18 Exhibits 2Al-6 and 8, talking about response times, can you 19 describe the degree to which the systems in fact differ from 20 338-75 or 77? I recognize that the licensing basis for 21 the plant is the 338-71 version.
22 MR. BINGHAM: Would it be adequate to just address 23 how we handle response time testing? Is that your concern?
24 . MR. ROSENTHAL: There are two areas. One is the 25 specific response time testing, and there is another area, QRUMlEY REPORTERS Phoanix, Arizona
rh 8
51 which is the licensing basis of the plant, because the docket date is 338-1971. I am under instructions, one, that you need not conform with later versions of the IEEE standards, but, two, we are supposed to understand where differences between conformance to the later versions exist and be able to draw the conclusions that the plant is safe.
MR. BINGHAM: We understand. Give me just one second.
MISS KERRIGAN: We would defer that, question until the second meeting. It is probably a more detailed question, but let' .leave it on the record and address it in the second meeting.
12 MR. BINGHAM: . Janis, I am not sure that we need to do 13 necessarily. We wanted to try to take care of the I'hat 14 needs, and we do appreciate the problem that Jack has. I was exploring whether we were going to'over it when we talking about Reg. Guide 1.18 or whether me are going to 17 cover it, in reviewing the SRP's, and maybe at that time we 18 can address that particular issue. Would that be satisfactor 19 MR. ROSENTHAL: Sure. You will pick up the response 20 time testing at. that time, also?
21, MR. BINGHAM: We will pick that up at that same time.
22 MR. ROSENTHAL: Fine. I have one last one in this 23 section, and I am asking it because this is a design review 24 meeting xather than a licensing type meeting. That is, havin 25 gone to all the pains on the undexvoltage trip and loss of ORUMLEY REPORTERS Phoenix, Arizona
52 offsite power relationship to the sequencer, why don't you trip the reactor, also, on loss of offsite power directly U
rather than indirectly?
MR. BINGHAM: John, would you like APS to address that issue? It is our criterion from APS to have a plant that will stay 'on line with loss of offsite power. Perhaps a member of APS might want to discuss the rationale with the Board.
MR. ALLEN: 'It wa's a design criteria I remember for 10 APS when we got, the NSSS system to try to prevent tripping of the reactor and keep the reactor on line as long as you 12 can. Since there is no firm requirement from the regulators, 13 that has been our design basis from the start. That and 14 other cases also. What was the basis for 'your question?
15 MR. ROSENTHAL: I concur with you that there is no 16 regulatory requirement and I only bring it up because it is a 17 design review meeting and I am trying to understand the 18 system. Post TMI, there was a fair amount of discussion of 19 what would be called anticipatory trips and there seemed to, 1 20 be varying design philosophies, and I just thought I would 21 like to understand why you don't do it, because if you lose 22 offsite power, you are going to lose the plant'. You can'.
23 run your primary'umps,.for instance.
24 MR. ALLEN: If you look back, if you can take the 25 reactor system down in a normal mode rather than tripping it, GRUMLEY REPORTERS Phoenix, Arizona
k f'k, f;aC. 3" >>W f,,k: K
'..Vf"--',
~ ~f 'I ".>>>>. >> 3,.'>> " .. <
I'ktka',)'f~4dQ9-'-,k3
..'PV."K>>tf.,' ~ ".PHC ',. ') 889 l 0'>> k'* 'I> lf V'SI t 4'.>> "K L JJkr " k:.3k",'.1 LFik>>>> Ji I
' * pj:>'>>
II,, III'P ',J '
>> 2 ') ~ t>>IKVP k>> .I>>~>>, '",g,'L . 'I I" 'if I f .l w ( l VI:,I 'dt,, l I
v" tf I> 0 <<+ "I t $ c '
fD '0$ ltf$+gtk Vs '
f/~!P'I KV Y.kiOt'
~
= =, ~
~
> " '. 49 tP k K )KkF'G>>f kw B>>Y.4 -. o YW>>f.kkt 8K:'"i
.>>K:,'.>V>>ff.:O') k 'v>>'X0 0>> "Pi9~ PV = K:::. '-.k>>. '-V~n, ' I t" Jf>>',7$
fi,-'"-:!
'=>> lt '. ftt>> XC'!Vh~~.k'.. 3'>> I~':")~~'", k!""' fC ~ '
kk'v V '
53 you are preventing some kind of a transient. Every time you trip the reactor, you get some kind of a transient on the system, so if you can minimize the number of trips, then you minimize the number of transients.
MR. KEXTH: X think we need to clarify one thing Jack said on. the pumps. The reactor coolant pumps are 7 transferred to the turbine generator so that what we are designed for is to take the loss of the grid and keep the plant -- you know, without tripping the reactor, we keep 10 the plant. on line. The turbine generator will continue to run.
12 MR. ROSENTHAL: I didn'4 realize that the pumps were 13 on the diesels.
14 MR. KEITH: On the, turbines.
15 MR. ROSENTHAL: On the turbines.
16 MR. BINGHAM: Any other questions, John, from the 17 Board?
18 MR. ALLEN: Anybody over here?
19 MR. BINGHAM: This might be an appropriate time to 20 break.
21 MR. ALLEN: Why don't we have about a 15-minute break.
22 Try to be back here about ten after.
23 (Thereupon a brief recess was taken, after which 24 proceedings were resumed as follows: )
25 MR. ALLEN: Bill, why don't you proceed with the next GRUMLEY REPORTERS Phoenix, Arizona
lk tt IJ I
54
'ection.
MR. BINGHAM: We will now proceed with the System Description, Section 2.A.l.B.
MRS. MORETON: Before we get into the system description, -we have prepared Figure .2A1-1 to show our signal from manual input, alarm, lights, OR gate, AND gate, not, on delay, off. delay, which is the timed memory, high bistable showing the setpoint, memory set/reset, some abbreviations that you will see on the logic diagrams, safety equipment, 10 actuated status, which is part of our safety equipment status system, safety equipment inoperable status, and 12 HS, which simply means handswitch.
13 Exhibit 2A1-14, the BOP ESFAS System Description.
14 The BOP ESFAS measurement channels, process measurement 15 channels are used to perform the following functions:
Continuously monitor each selected generating station variabl 17 provide indication of operational availability of each sensor 18 to the operator, and transmit these signals to bistables
\
19 within the ESFAS initiating logic. Protective parameters are measured with two independent process measurement channel 21 We will be referring to Figure 2Al-2 as we go through this.
23 Exhibit 2Al-15 on the measurement channels. A 24 measurement channel consists of instrument sensing. lines, 25 sensor, transmitter, power supply, isolation device, if that GRUMLEY REPORTERS Phoenix, Arizona
7'IV*.,
~ ~V I Ip x.ig
'jiv z., ( L 4 F i'" gKVL.">k,i~g," C$ ([ r-
'jp~P .J
~;.'.Ql3Q"~g,
~ 'Jism D~',
a" " fi ~ g g'X<>Hl&fL
<<g
~
~
'Jfi s- -) ~
'"fL,'.A(g~ '3:.",d J'Q SMGEL::
)v .,Cq(yJ.k! ppIGMg3f> jkg 6 x g~Vg OffJ rial r,h>P LXXKV f>4>g tf
~ G~3figf.' >'~ J. '. mB 'XOD ZG .tMXi<'f c-'.-, Pi~d;"44~'i' '-,'U~ Gfc.: ~=. ~U>'E~ Gl T
~)fag pcs ~ fc'r afGc f1[ II I'
9,:>.3 f.'lgC,E43r>J~ <5, Nt',g <)fj),~~ l
>+@ < g'>~ ~
<<(
4 J A II I I. ~
I
'l S
C (
l 3
is required to go to the plant annunciator or plant computer, and indicator to the operator. Each redundant measurement channel -- this (indicating) is our measurement Channel A, this (indicating) is measurement Channel B is powered by a separate and independent'20 volt AG vital distribution bus.
The BOP ESFAS bistable and initiating logic is shown here on Figure 2Al-2. Initiating logics compare signals received from the sensor with a predetermined initiation setpoint in this bistable here (indicating), provide channel and signal 10 status information to= the operator in. the form of lights on the front of BOP ESFAS cabinet, and annunciation to the, plant control room operator, and they provide two ESFAS initiation signals for the actuating logic, one in this line here.
14 The cross-channel logic is redundant and they are electricall isolated and physically separated.
16 Exhibit 2Al-16. The initiating logic does consist of the bistables, bistable output relays, trip output 18 signals, indicating lights, and interconnecting wiring.
Signals from the protective measurement channels are sent to 20 comparator circuits where the input signals. are compared to 21 predetermined setpoints. Whenever a channel parameter reache 22 the predetermined setpoint, the channel'istable de-energizes 23 an output relay. Each redundant channel bistable relay is 24 suppli,ed from a separate 120 volt vital AC bus. This wpuld be, for example, from Channel A (indicating), from Channel"B GRUMLEY REPORTERS Phoenix, Arizona
I 1
e
'V
'I
(indicating). The bistable setpoints are adjustable from the front of the cabinet. Access is limited by means of a key-operated switch. Bistable setpoints are capable of being read out on a display located on the cabinet. The ESFAS initiation signals are generated in two channels designated A and B. A signal from the bistable output relay in either or both protective measurement channels generates ESFAS initiating signals to both actuation channels Exhibit 2A1-17, actuating logic. Referring back to Figure 2A1-2, the actuating logic performs a one-out,-of-two incidence of the two channels, generates an output to the 12 operator, provides a means for manual initiation, as shown 13 here, in the control room. It provides annunciation out to 14 the operator. The actuating logic is located in two ESFAS cabinets. The top portion of the slide would be in ESFAS Cabinet A; the bottom portion of the slide would be ESFAS Cabinet B. Each cabinet contains the logic for the ESF load 18 group equipment. One / cabinet contains the logic for Load 19 Group 1 equipment and the other for Load Group 2 equipment.
20 Exhibit 2A1-18. The two initiating signals are 21 arranged in a one-out-of-two logic in each actuation channel.
22 Actuation of either signal de-energizes the group relay associated with that, channel and results in an actuation signal. Each channel is supplied from a separate 125 volt AC distribution bus and a separate 125 volt DC distribution GRUMLEY REPORTERS Phoenix, Arizona
~,
1
57 bus.
"2 ESF System Actuation. Components in each BOP ESF system are actuated by group relays. The group relay contact.
are in the power control circuit for the actuated components of each. ESF system. The initiating and actuating logic causes de-energization of the actuation relay whenever the bistable output, relay is de-energized. De-energization of the group relay actuates the ESF system components.
Exhibit 2A1-19, Channel Bypasses. Initiating logic 10 bypasses are provided in the BOP ESFAS and are employed to remove the initiating logic from service for maintenance.
12 The actuating logic .is converted to a single active channel 13 for the ESFAS-monitored variable bypass.'he bypass time 14 interval for maintenance is a very short interval such that 15 the probability of failure of the remaining measurement 16 channel and initiating logic is acceptably low during 17 maintenance bypass periods. Other ESFAS-monitored variable 18 initiating logics:that have not been bypassed in either of their two channels remain in a one-out-of-two actuating 20 logic. The bypass is manually initiated, as shown on 21 Fj.gure 2A1-2. It does cause a block at the channel level of 22 the initiating logic. An electrical inter'lock, shown here 23 (indicating), is also electrically isolated and physically 24 separated. The electrical interlock does prevent bypass of more than one channel at any one time. Bypasses are GRUMLEY REPORTERS Phoenix, Arizona
58 annunciated visually and audibly to the operator. This is on the front of the BOP ESFAS cabinet, annunciation to the control room operator via the plant annunciator.
4 Exhibit 2A1-20, Operating Bypasses. The BOP ESFAS does not have any operating bypass system. Electrical interlocks in the BOP ESFAS prevent .the operator from bypassing more than one channel at, any one time.
Exhibit,2Al-21, Redundancy. Redundant features of the BOP ESFAS include two independent channels from proces 10 sensor/transmitter through the actuation output relays. Two initiating logic paths-are present for each actuation signal.
Each actuation signal actuates two output trains so that redundant 'system components may be actuated from separate 14 trains. Power for the system is provided from two separate buses. Channel A is powered from the Load Group l bus and Channel B is powered from the Load Group 2 bus. The result of these redundant features is that, the system does meet 18 the single failure criterion.
19 Exhibit, 2Al-22, Diversity. The BOP ESFAS is design 20 to eliminate credible dual channel failures originating from a common cause. The failure 'modes of redundant channels and the conditions of operation that are common to them are 23 analyzed to assure that the monitored variables provide 24 adequate information during the accidents, the equipment can perform as required, and the interactions of protective GRUMLEY REPORTERS Phoenix, Arizona
1 IE L
~ i
59 actions, control actions, and the environmental changes that cause, or are caused by, the design basis events do not prevent the mitigation of the consequences of the event.
Exhibit 2A1-23, continuing on diversity, the system cannot be made inoperable by the inadvertent actions of operating and maintenance personnel. In addition, the design is not encumbered with additional components or channels without reasonable assurance that such additions are beneficial.
10 We will now discuss a little bit about testing.
Provisions are made to permit periodic testing of the BOP ESFAS. The tests will cover the trip actions from sensor input through the protection system and the actuation devices 14 The system test does not interfere with the protective function of the system, and such testing does meet the 16 requirements of IEEE Standard 338-1971 and Reg. Guide 1.22.
17 Exhibit 2A1-24, continuing with testing. Testing is performed on the BOP ESFAS by complete actuation such that the BOP ESFAS does.not disturb normal plant operating 20 conditions. Sensor checks are performed during reactor 21 operation by cross-checking outputs of similar channels and cross-checking with related measurements, During extended shutdown periods or refueling, these measurement channels 24 are checked and calibrated against known standards. The bistable trip test is accomplishe'd by manually varying the ORUMLEY REPORTERS Phoenix, Arizona
0'9
60 "input signal to the trip setpoint level on one bistable at a time and observing the trip action, and it is done at this poi;nt (indicating) entering the bistable.
Exhibit 2A1-25. When the'istable of a protective channel is in a tripped condition, the following conditions should exist: The bistable output relay is de-energized, the group relay in each actuation channel is de-energized, the ESF components are in the ESFAS actuation position, and
'actuation is annunciated in the control room, so there will be two separate places for trip annunciation and actuation annunciation.
12 Exhibit 2A1-26. Proper operation may be verified 13 by the following: Checking the position of each ESF componen checking the actuation annunciation, and checking the ESF 15 component status indication. What is'one here is repeated I
for the other bistable.
17 Continuing on with Exhibit 2A1-26, response time testing. Response time testing will be performed at refuelin 19 interyals. These tests include the sensors for each ESFAS 20 channel and are based on the previously defined system 21 response time criteria. \
22 Exhibit 2Al-27. We will now go into some of the 23 BOP ESFAS acutated systems and explain their function in the 1
24 ESFAS specific logic. Fuel Building Essential Ventilation Xn the event of fuel handling accident in the spent o
25 System.
GRUMLEY REPORTERS Phoenix, Arizona
fuel area, sensors in the fuel building will detect the fission products released from the fuel. The fuel building II essential ventilation actuation signal, called FBEVAS, is initiated by one-out-of-two high airborne activity signals from x'adiation monitors. One of these is a gaseous monitor, 6, it is in the fuel building normally, and the other is an area radiation monitor on a wall overlooking the fuel pool.
These two signals combine in the fuel building essential ventilation system to provide the FBEVAS actuation. On 10 Figure 2Al-3, the FBEVAS also sends a signal to the CREFAS logic that we will discuss in a few minutes. The fuel 12 building essential ventilation system is automatically 13 actuated by an FBEVAS from the BOP ESFAS to reduce the release of fission products into the environment.
15 If we refer to our simplified diagram of the fuel building essential ventilation system, Figure 2A1-4, -we 17 see radiation monitoring overlooking the spent fuel pool, 18 another radiation monitor on the exhaust duct. On high 19 x'adiation, these generate the FBEVAS signal which performs 20 to terminate normal air handling units intake and exhaust I
21 by closing the dampers and stopping the *'fans and will 22 actuate intake through the'ssential air filtration units 23 out to the atmosphex'e. It 'causes a slight depres'surization 24 of the fuel building to prevent out lea'kage other than 25 through the essential air filtration units.
GRUMLEY REPORTERS Phoenix, Arizona
t P'
62 Exhibit 2Al-28. The system is designed such that a loss of electric power to one-out-of-two like channels will cause a fuel building essential ventilation actuation signal and actuate the system. Manual initiation of the fuel building essential ventilation system is provided in the control room. The fuel building essential ventilation system is composed of components in redundant load groups.
You can see here (indicating) there are two essential air filtration units, two sets of dampers. Independence is 10 adequate to retain the redundancy required to maintain.
equipment functional capabilities following those design basis events that require fuel building ventilation isolation 13 Exhibit 2A1-29. The fuel building essential ventilation actuation system is combined with the safety injection actuation system in the NSSS ESFAS in the device control circuits so that any one of the signals activate the required devices. During SIAS, the fuel building/auxiliary building essential ventilation system is aligned to exhaust 19 from the auxil'iary building. The SIAS takes precedence over 20 FBEVAS should both signals be present at the same time.
21 Figure 2Al-5. As you can see, thi.'s is a typical actuated device logic for one of our fuel building essentia,al'entilation fan.. The SIAS is combined in thi:s OR circuit, 24 with the FBEVAS to start 'the fan.
25 Back to Figure 2Al-4. On the SXAS mode, intake GRUMLEY REPORTERS Phoenix, Arizona
63 is taken from the auxiliary building ESF pump rooms. The dampers are aligned. These dampers (indicating) would be 3 closed taking air .from the fuel building such that the auxiliary building pump rooms are exhausted through the essential air filtration units.
e 6 Continuing on with another ESF system, Exhibit 2A1-30, the containment purge isolation system. In the event of a fuel handling accident inside the containment, sensors will detect the fission products released from the fuel.
10 Containment purge isolation actuation signal is initiated by one-out-of-two high airboxne activity signals'rom 12 redundant radiation monitors located in close proximity with 13 the power access purge exhaust duct and the refueling purge 14 exhaust duct. These two Imonitors are shown on Figure 2A1-6.
15 The containment purge isolation system is automatically, 16 actuated by the CPIAS from the BOP ESFAS to prohibit release 17 of radioactive material into the environment. The Cp?A'S '
18 also sends a signal to the CREFAS logic, which we will get 19 into in a few minutes.
20 Exhibit 2Al-31. The system, is designed sO that 21 loss of electric power causes actuation. Manual initiation 22 is provided in the control 'room. The'ontainment purge 23 . isolation system is composed of components in redundant load 24 groups such that independence and redundancy is maintained 25 to retain the functional capability following design basis GRUMLEY REPORTERS Phoenix, Arizona
't II I'
i 0'
64 events; The CPIAS is combined with the contain-ent isolation actuation signal in;,the control circuits of the isolation valves, such that either signal as shown on Figure 2Al-7 can actuate the containment purge isolation valves.
Exhibit 2Al-32, our control. room essential ventilation systems. The control room essential ventilation systems are the control room isolation system and the control room essential filtration system. The control room ventilation isolation actuation signal, CRVIAS, is initiated 10 by one-out-of-two control room outside air intake high chlorine signals. That is shown on Figure 2Al-8. The 12 control room ventilation isolation system is automatically 13 actuated by a CRVIAS from the BOP ESFAS to activate the 14 control room essential air handling units and isolate the 15 control room from outside air. The control room essential 16 filtration actuation signal, or CREFAS, is initiated by 17 one-out-of-two control room outside air intake hi;gh airborne 18 activity signals. It is also actuated, as we were pointing 19 out earlier, by a fuel building essential ventilation 20 actuation signal or a containment purge isolation actuation 21 signal.
22 Exhibit 2Al-33. The control room essential filtration system is automatically actuated by a CREFAS 24 from the BOP ESFAS to activate the control room essential 25 air handling units and to route the 'air thr'ough the 'essential GRUMLEY REPORTERS Phoenix, Arizona
t J
65
'iltration units to pressurize the control room and prevent infiltration of untreated air. We have a simplified diagram on Figure 2Al-l0. You will. notice the outside air intake.
Radiation is monitored. On high radiation, a CREFAS j.s actuated. Chlorine detectors will actuate a BOP ESFAS signal CRVIAS. There are two modes of operation. Both of them do start the essential air handling units and isolate the normal 8 air intake to the control room. On the CREVAS mode,'the 9 circulation is performed as well as intake from outside air 10 to slightly pressurize the control room and prevent in-leakag On the CRVIAS mode,,essential intake is eliminated and air 12 is just recirculated through the essential air handling 13 units. The system is designed so that loss of electric power 14 to one of the two like channels does perform actuation.
15 Manual initiation of both signals is provided in the control 16 room.
17 Exhibit, 2A1-34. Both of the systems are composed 18 of components in redundant load groups and CREFAS is combined 19 with. the SIAS in the device control circuits so that any one 20 of the signals does actuate the required components. Figure 21 2Al-ll shows a typical actuating device logic. This is for 22 one of the dampers that closes on the'RVIAS and will open 23 on an SIAS or a CREFAS, the'ogic being combined at the 24 device level. The CRVIAS is combined with, the signals that 25 actuate the control room essential filtration system in the, GRUML.EY REPORTERS Phoenix, Arizona
h i
66 device control circuits so that any of these signals combined in a logical OR can actuate the isolation valve common to both of the control room essential ventilation systems. The CRVIAS takes precedence over CREFAS to isolate the control room should both signals be- present at the same time.
Exhibit 2Al-35. In. addition to the automatic initiating signals, two independent smoke detectors are provided in the outside air intake plenum. Upon detection of smoke, an audible and visible alarm will alert the 10 operator to manually initiate the control room ventilation E
isolation system.
12 Exhibit 2Al-36, containment combustible gas control system. The containment hydrogen gas concentration 14 may increase to a combustible concentration following a LOCA.
15 In the unlikely event that a LOCA does occur, the containment hydrogen gas concentration is maintained less than the lower 17 combustible limit by operation of the containment combustible 18 gas control system. The principal parameter monitored 'for 19 determining. when the containment .combustible gas control 20 system is to be placed in service is hydrogen concentration.
21 The containment hydrogen analyzer is normally on standby.
22 Following a desi'gn basis event, the hydrogen analyzer is 23 placed in service with controls mounted on the main control 24 board. The containment combustible gas control system 25 components are controlled manually from control switches ORUMLEY REPORTERS Phoenix, Arizona
~I h
t
67 located at local panels. The local panel will be accessible after a design basis event.
3 Exhibit. 2Al-37. A control switch with an override feature is provided for each of the containment combustible gas control system isolation valves. Figure 2A1-12 shows the 6 control switch performing the override. This control switch override feature is functional only after receipt'f a containment isolation actuation signal'hown here (indicating Xf the containment isolation actuation signal is not present, the override will not be enabled. The open and closed positions of these valves, in addition to the override 12 status, are indicated in the control room. We will be going 13 into a lot more detail on overrides and how they aie implemented in a few minutes. The containment combustible gas control system is composed of components in redundant load groups. The containment combustible gas control system test pressure is greater than the peak containment design pressure. This precludes system overpressurization by the 19 inadvertent opening of the isolation valves.
20 That concludes the BOP ESFAS presentation.
21 MR. BINGHAM: Any questions.
22 MR. MARSH: On Exhibit 2Al-24 with 'regard to bistable 23 trip testing, you state manually varying the'nput signal to 24 the trip setpoint level on one bistable at a time is-25 accomplished to check the trip action. Could,you explain in GRUMLEY REPORTERS Phoenix, Arizona
E 11
68 a little more detail how that is accomplished? Particularly I am concerned about what means is provided to assure that 3 the'ystem is returned to normal following the test.
MRS. MORETON: On the radiation monitor, the bistable is actually part of the radiation monitoring system. There is a local unit that is plugged into the radiation monitor where the signals can be varied and they axe displayed through that unit back to the operator. Xt is accessible only by key lock control. Because he has that display, the 10 technician would then have to verify. that he .resets his setpoint back to where it should have been.
12 MR. MARSH: That is done at the field device?
13 MRS. MORETON: It is done at the radiation monitori,ng 14 cabinet in the control room. If testing is performed at the 15 field device, it would automatically reset when you go back 16 into normal operation.
17 MR. ROSENTHAL: I would like a, little bit more I
18 explanation on the bistable test,' bistable i.s'ssenti,ally I
19 a summer. Either you put in a test si,gnal to that leg which 20 would receive the monitoring device 'or alternately you can 21 change the other leg of the'ummer referen'ce 'or'thesetpqj,nt 22 signal. In which cases are you injecting a signal in, li:eu of the normal sensing device and looking at wher'e the bi,stabl 24 changes stage and in which cases pre you changing the
'25 referencing, which I would call the bistable 'setpoint GRUMLEY REPORTERS Phoenix, Arizona
I 69 typically operated by a part with a screwdriver, and in the latter case, how do you accomplish the reset?
3 MR. BINGHAM: 'et's have Steve Shepherd answer that question, since it is part. of the radiation monitoring system we are'ealing with right now.
MR. SHEPHERD: There are two ways to check. The first way is as we mentioned a minute ago, which is to physically move the setpoint down and bring it back up again. The other way is to adjust the setpoint such that when the unit 10 goes into automatic check source, it physically perturbs the measured variable by exposing the radiation so it is coming 12 back, so it automatically goes through the system. You can 13 do it from the sensor level and you can do A
it from the setpoint level.
15 MR. ROSENTHAL: When do you do which to what?
16 MR. SHEPHERD: You would do this as part of the 17 response time testing at refueling. There is automatic 18 check source activation normally once a day, but that is 19 not checking s'etpoint, that is checking response to monitor, 20 but you can move the setpoint down to check it at. any time 21 you want to, since actuation of the device doesn'0 'cause 22 any problems. It normally would be at a refueling period.
23 MR.'OSENTHAL: That is the sensor half. On the 24 screwdriver to a part half, the setpoint, how do you reset 25 the setpoint?
QRUMLEY REPORTERS Phoenix, Arizona
1 I'I 0
70 MR. SHEPHERD: Physically, assuming that we are making the change at the field unit, you administratively 3 tur'n the control panel to local. That issues the alarm to the system so it is aware you are in a test. mode. You use a key path, physically key in, since it is a digital computer system, a new setpoint. You evaluate the results and,then you can return it. However, if you do not return it, when you turn the key back to normal, the system will automatically reset. Now, in the control room master console 10 if you make that same change, whatever'you now select becomes the permanent setpoint. until you administratively 12 change it back.
13 MR. ALLEN: One thing you want to remember here, Jack, 14 he is talking just about the radiation monitoring and not 15 necessarily bistables and some of the other stuff, because 16 that's different.
17 MR. ROSENTHAL: What do you do at the bistables?
18 MR. BXNGHAM: Excuse me, what, is the next question, 19 John? What about, the bistable, is that the question, Jack?
20 MR. ROSENTHAL: Mr. Allen, can you. clarify your 21 clarification?
22 MR. ALLEN: What I indicated was what he is talking 23 about in this digital key in is strictly for radiation 24 monitoring systems. He is not indicating it is done the 25 same way on all the rest of the ESFAS.
GAUMLEY AEPOATEAS Phoenix, Arizona
~ o 0
71 MR. KONDIC: Exhibit 2A1-36, the second paragraph, the containment hydrogen analyzer. 'How and when do you check its operability, and, second, what kind of alarm annunciation it gives when there is hydrogen?
MR. SOTEROPOULOUS: The hydrogen analyzer as. it is presently mechanized to test, we could put the device into a calibrated mode where we could inject into the system a
.~
4% concentration of hydrogen and the system would go into alarm.
10 MR. KONDIC: What, kind of alarm? Annunciator or sound alarm?'R.
12 SOTEROPOULOUS: It would be an annunciator, alarm.
13 MR. KONDIC: Thank you.
rl MR. ROGERS: I want to go back to Figure 2A-l and 15 also Exhibit 2Al-24 and ask for a clarification. On Figure 2A-l, on the right-hand side, there is a list of 17 balance of plant systems which seems to indicate that it.
18 includes such things as the containment isolation, main steam 19 isolation, and auxiliary feedwater. The page right after 20 that doesn't list those as systems that you are going to 21 discuss. Clearly, Exhibit 2A1-24 says that you test balance 22 of plant systems on line, and I am 'wondering if you can do 23 a test of a main steam isolation on line without disturbing 24 the plant. Are you going to address these main steam isolati n, 25 auxiliary feedwater, and containment isolation as a part of GRUMLEY REPORTERS Phoenix, Arizona
o 72 this presentation, Bill?
MRS. MORETON: They will be addressed only from a I
typical actuated device logic level. The reason they are on there is because they are BOP ESF systems, but they are not actuated by the BOP ESFAS, which is the system descrip-tion we just went through. They are BOP ESF systems, but they are actuated by the NSSS ESFAS.
MR. ROGERS: So the testing and design criteria are really not covered in this particular system review; they 10 would have been covered at the Combustion. Engineering system review?
12 MRS. MORETON:. The testing of the ESFAS would have been covered at, the Combustion Engineering review. The 14 testing of the components would be covered at those various 15 system reviews.
16 MR. ROGERS: Well, let me ask that again. Whatever 17 actuates main steam isolation and how'that is tested and how 18 the logic is set up and design criteria for main steam 19 isolation woul'd have been covered at the Combustion F
20 Engineering system review, is that correct?
21 MR. BESSETTE: That's correct.
22 MR. JOHNSON: May I 'clarify that? Just the testing of an MSIS itself. The,MSIV test was not covered.
24 MR. ROGERS: I understand. We are .talking about the 25 instrumentation and controls, not the hardware of the valves.
GRUMLEY REPORTERS Phoenix, Arizona
73 MR. JOHNSON: Not the controls of the valve, either, just the MSIS signal itself. It did not get into the actuation device logic circuitry. That is downstream of the NSSS ESFAS. That was not discussed in the CESSAR review.
MR. ROGERS: Will that be discussed here?
MRS. MORETON: The typical actuated device logic will be discussed. The specific testing of the 'MSXV, no.
MR. STERLING: On that..same list, do you intend to talk about. the atmospheric dump valve? That is not on that 10 list.
MRS. MORETON: The atmospheric dump valves are part 12 of the safe shutdown system and they will be discussed when 13 we discuss the safe shutdown system.
MISS KERRIGAN: I am still kind of unclear about 15 Carter's question. Who is going to address it? It sounds 16 like CE isn't and it sounds like balance of plant isn'. Who 17 is going to address it?
18 MR. BINGHAM: Let me see if I can try. What Mary 19 said was we are not going to specifically deal with the 20 particular one he had in question. We are going to talk 21 typical. If there is a need from the Board to explore a 22 particular one, we will explore it.
23 MISS KERRIGAN: I think that was Carter's question.
MR. ROGERS: Well, my question is really one that 25 comes from Exhibit 2Al-24. Xt talks about the testing on ORUMLEY REPORTERS Phoenix, Arizona
74 line, and going from that and back to the list in Figure 2A-l it shows this main steam isolation as being part of the balance of plant. I started asking for clarification. It doesn', seem that you could test th'e actuation logic of main steam isolation under what you .state right here on Exhibit 2A1-24, and if that is not correct, where is the testing covered? Are you going to discuss it here or was it discussed at Combustion Engineering, or was the logic for that circuitry, and how are tests performed in operation?
MR. BINGHAM: I think that is probably some Chapter l0 W
10 things, but, Carter, we will take a look at the break and 12 see if we can put it in perspective for the Board. If it would help for this discussion, we'l talk about it. This 14 chart was trying to really give you the scope of where things 15 fell, where the interfaces were, how'e categorized them 16 with the SRP's as general 'overall information of how to tie 17 the interfaces together rather than to give you an outline of 18 what will be covered in the presentation.
lh 19 MR. ROGERS: Bill, I understand that, but I was confused.
21 MR. BINGHAM: John, are there any other questions?
22 MR. ALLEN: I'e got a couple,'ill. Those detectors for smoke, are those IE sensors?
24 MRS. MORETON: No.
25 MR. ALLEN: Also, I noticed on one slide up there GRUMLEY AEPORTERS Phoenix, Arizona
1 0
i
75 where you had your various sensors in the intake plenum for the control room ventilation. What type of separation protection do you have in that plenum so you can't get a tornado missile in there? Is that steel louvers?
MR. BINGHAM: I think we will have to check the details. It is a concrete shield for some missiles, I can ~
tell you that much. If you would like the details, John,'e can provide those.
MR. ALLEN: What I was getting at is, bearing in on 10 tornado missiles, I thought in the back of my head I had read somewhere where it was steel louvers so you can't get 12 a missile in there to knock it out.
-13 MR. BINGHAM: I am not sure. Let me just find out.
14 We have the louvers.. Whether they are steel are not, there 15 is protection.
16 MR. ALLEN: Are there additional questions?
17 MR. BESSETTE: Could I expand on your question?
18 Are your radiation monitoring units and your chlorine 19 monitoring units Class I?
20 MRS. MORETON: Yes.
21 MR. MECH: In reference to Figure 2Al-ll and possibly 22 12, this is a logic diagram and it shows indicating lamps 23 for'alve position. The first part of the question, dqes 24 Palo Uerde use a standard system for valve 1'amp indication 25 or valve wiring such as to provide the indication?
GRUMLEY REPORTERS Phoenix, Arizona
o 76 MR. BINGHAM: Could you please repeat that?
MR. MECH: All right, let's put it, in a different way.
3 Is there a uniform method for indicating valve position used throughout the plant?
MRS. MORETON: Yes.
MR. MECH: The second part of the question, you show lamps at the motor control center, so this makes me wonder if the lamps are a direct measure of the valve position.
MRS. MORETON: They are a direct measurement of 10 valve position.
=MR. MECH: Do you wire the valve at the motor control 12 center or is the motor control center indication simply an 13 indication that the contactor is opening and closing to 14 move the valve?
15 MRS. MORETON: It is wired back to the motor control 16 center. Limit switches on the valves are actually use'd to 17 stop the motor during travel, so they are wired back from 18 the valve to the motor control center to complete the valve 19 logic, and they are also used for indication at the motor 20 control center, and then they are wired into the control 21 room to provide that indication from the valve limit switches 22 MR. MECH: Thank you.
MR. STERLING: On Exhibit 2A1-37, the first bullet, 24 if you have overridd'en and you receive 'another safet'y signal,
25 the override is removed, but does the actuated device change GAUiltiLEYREPORTERS Phoenix, Arizona
77 state?
MRS. MORETON: If the containment isolation signal 3 is present, the valves will go closed. If the 'operator performs the override of the containment isolation signal, he then has to position the valve into the open position.
The containment isolation signal is then removed, the overrid will be disenabled, the valve will not change state.
8 MR. STERLING: If you reset the CIAS, that would be the same as removing it, it still will not. change state?
10 MRS. MORETON: Correct.
MR. STERLING: So it. is an operator action then to 12 do anything with that valve once that safety signal is 13 MRS. MORETON: Yes.
14 MR. STERLING: If the safety signal reappears, that i
15 valve will drive to whatever the actuated condition is?
MRS. MORETON: Yes.
17 MR. ALLEN: Questions?
18 MR. ROSENTHAL: Yes, please. First, on 2A1-37, I take 19 it that. the containment combustible gas control system is 20 installed for the- purpose of showing it conforms with 21 10CFR50.44.
22 MR. BINGHAM: Yes.
23 MR. ROSENTHAL: And is designed for the limits 24 specified in 50.44?
25 MR. BINGHAM: That's correct.
QRUMLEY REPORTERS Phoenix. Arizona
0 0
0'
78 MR. ROSENTHAL: Fine. On the override, the reset of 2 the CPIAS, can you state the sequence that the operator goes through in order to reopen the valve?
I MRS. MORETON: Jack, we are 'going to cover that in a lot of detail under our ESF actuated logic typicals.
MR. ROSENTHAL: 2A1-19. You bypass one of two channels. That is permitted in IEEE 279 where you can show that the bypass time is small relative to its need. You have an assertion as Xtem B on that page that that bypass 10 time is small. What is the basis for the assertion?
MRS. MORETON: The primary basis for the assertion is 12 that, we only implement the bypass for maintenance. It is not 13 implemented for. testing, for calibration, or anything else, 14 only for maintenance.
V 15 MR. ROSENTHAL: If I have two systems both with an 16 unreliability of the order of 10 -2 to 10 -3 and I ta'ke one 17 of them out for maintenance and checking, that is a major 18 contributor to reducing the total system reliability. Do you 19 have other numerical goals for each channel of the two-channe 20 systems that back your assertion or limits in Tech. Specs.
21 on the time that one channel can be taken out of bypass or 22 something? Can I take it out for three weeks?
23 MR. BINGHAM: Let us confer here a minute.
24 John, I think what we would like to do is to study the response and we will come back after lunch with the QRUMLEY REPORTERS Phoenix, Arizona
0
79 criterion that was used.
MR. ROSENTHAL: 2Al-30. Can you show me the location of the rad mountings relative to the valves?
MR. SHEPHERD: There are two sets for each duct.
There is a small mini-purge valve and there is a large refueling purge valve. They are about eight feet apart.
Directly between them there is a support post and the radiation monitors are put. on the posts between the two ducts.
MR. ROSENTHAL: If I have a V
fuel handling accident 4
and I initiate the system, I close the purge valves, does 12 my signal then cease to appear at my rad monitors?
13 MR. SHEPHERD: It would depend on whether you had 14 activity still existing in the duct.
15 MR. ROSENTHAL: But they are downstream of the large 16 butterflies?
17 MR. SHEPHERD: That's correct. The butterflies are 18 right next to the containment.
19 MISS KERRIGAN: What is the mini-purge?
20 MR. SHEPHERD: The mini-purge is what we call a 21 power access purge which is used during power operation.,
22 MISS KERRIGAN: That a.s your 10-inch or something, 23 little one?
24 MR. SHEPHERD: Eight, inch, I believe.
25 MR. ALLEN: Do you have some additional questions, GRUMLEY REPORTERS Phoenix, Arizona
~ h 80 Jack?
MR. ROSENTHAL: Figure 2Al-4. Again, because FBEVAS 3 is a one-out-of-two, you can be operating some time with that, system actuated. Are there any time limits that you have on the time that you are exhausting through the essential AFU?
MR. KEITH:, What is your concern, Jack? We can operate it continuously.
MR. ROSENTHAL: I have a one-out-of-two system.
10 Should that system fail, the operator would have the option of tripping that system and continuing to keep the plant in 12 power until we got, around to fixing it. In that mode, which 13 could last for some period of time, you would be pumping 'air 14 through the charcoal filters and the HEPA filters and 15 continual use of those filters may diminish the effectiveness of the charcoal, so it would be prudent for one not to 17 operate. in that mode for extended periods of time. Is there 18 some Tech; Spec. or procedure or something which limits 19 that mode of operation?
20 MR. KEITH: There is -not a Tech. Spec. as such.. There 21 will be a requirement,, and I believe ther'e 'is -- it is 1
.22 probably covered in Reg. Guide '1.52,. although 'I canrt recall 23 right now that the chaxcoal in the HEPA filters be tested 24 periodically to assure that. they do have the required 25 efficiency.
GRUMLEY REPORTERS Phoenix, Arizona
tt 81 MR. ROSENTHAL: The filters are normally handled by other engineering'roups within the NRC, and let me relate".
t the concern back to what would be a more conventional instrumentation and contxol branch concern, and that is that if one is worried about 'the reliability of an FBEVAS 6 in'the bypass mode when you are down to one channel, one would be tempted to require that if you don', have both channels available to trip FBEVAS. Now, the problem with requiring such an operating mode because one is concerned 10 over the reliability of FBEVAS is that 'one may be degrading the charcoal filters should you have a real event where you 12 need them, so I believe that there is an interrelationship 13 between the prudent amount of time that you should be 14 running on essential AFU versus the thoughts about the 15 availability of FBEVAS, and X am seeking your advice on what would be a prudent way of monitoring these relationships.
17 MR. KEXTH: Jack, one thing to keep in mind about 18 this system as far as the FBEVAS logic is the only time'we 19 would be concerned about that logic actuating the system is 20 during the refueling mode of oper'ption when you are actually 21 handling fuel inside the fuel building. That .is the only 22 time you have a possibility of a problem inside the fuel 23 building. As far as the othe'x'ode when we use the'ssential 24 air handling units in the fuel building, that during normal 25 power operation is actuated by an SlAS, which," of course, is GRUMLEY REPORTERS Phoenix, Arizona
ki 82 the two-out-of-four logic. So we are talking about a relatively limited period of time just during fuel handling operations inside the fuel building when you are worried about this one-out-of-two logic.
MR. ROSENTHAL: I do try to oheck what I am doing with other functional groups and I was tempted to require because it is a one-out-of-two system that if one channel is down, you trip the system, and my Accident Analysis Branch people said gee, that may not be prudent, because you are unduly taxing the charcoal filters. Can you make an argument that, because of the limited time that you need "
12 FBEVAS that no Technical Specifications are needed relating 13 the availability of these two systems?
MR. KEITH: I think we can. Another thought comes 15 to mind, on the fuel handling accident. As I recall, you 16 can 'make the assumptions for that accident and not use this system at all and still be inside the guidelines of 10CFR100.
18 MR. RQSENTHAL: The Accident Evaluation Branch has assumed, those 'filters would work -and the Palo Verde SAR 20 showed small fractions of CFR100, so effec'tively you have 21 taken credit for the system to show the small fraction.
HR. KEITH: We and they I believe have both dpne 1
22 23 analyses assuming it is not there. You still, obviously, 24 have higher doses than you do if it 'is xunning, but, i,t is 25 still acceptable for the 10CFR100 'guide, So I think that QRUMLEY REPOATEAS Phoenix, Arizona
1 0
I, I
a I
1'
83 and the small amount of time when you are actually handling fuel would argue for not having a Tech. Spec. requirement
'hat you activate this system in the event that one channel be down.
MR. ROSENTHAL: Would it not .be prudent to either demonstrate that either one of the two channels of FBEVAS has a high reliability, a high numerical reliability, or alternately to restrict the time that any one channel can be in bypass. I 10 MR.,BINGHAN:'- Isn't there also, Jack, another demonstration where you put them all together and demonstrate 12 the system is adequate? I think that is the approach that 13 we have taken.
14 MR. ALLEN: Bill, are you going to take that as an 15 open item?
16 MR. BINGHAM: Well, I am not exactly sure what,to 17 take as an open item, John, and perhaps you could get a 18 clarification on what we might provide. I believe what we 19 have said is that we. only need it during refueling and that
~
20 is a short time.
21 MR. ROSENTHAL: Excuse me, you can be shuffling fuel 22 in the spent fuel pool lots of times', not only during 23 refueling.
MR. KEITH: 7ou can be, thatrs correct., but.that 25 doesn't happen a lot.
GRUMLEY REPORTERS Phoenix, Arizona
P 84 MR. BINGHAM: We are assuming there 4
is not a lot of activity during operations, 'and I believe that was one thing that we said. We also, I think, indicated, didn't we, Dennis, or we have thought in the past that degradation of those filtering systems would be checked in accordance with what, 1.52, to make sure that we had sufficient capability.
MR. KEITH: I believe that covers it.
MR. BINGHAM: We do have .redundancy in the systems, and then we said that even in our analysis when we assumed 10 they didn't exist, that the doses were still within the requirements or limits of 10CFR100. Would the Board like 12 a followup, John, on that rationale? As I understand from 13 Jack ' question, it r, is demonstrated that you don ' need to put a Tech. Spec. limit on the time that that system 15 MR. ALLEN: Or trip the channel.
MR. BINGHAM: Or trip, yes.
17 MR. ALLEN: Xs that what you meant?
18 MXSS KERRIGAN: You have stated your position.
19 MR. ALL'EN: X. thi'nk we can take that as an open item.
20 MISS KERRIGAN: To us, it does not need to be an 21 open item. I think the position has been stated and NRC .will 22 go home and either agree or disagree 'with that position.
~
If we disagree with that position, you will be hearing from 24 us again.
25 MR. ALLEN: Any further questions?
GRUMLEY REPORTERS
,, Phoenix, Arizona
I
MR. BESSETTE: I have another question regarding the control room air intake activity in the radiation monitor 3 ing system. You indicated that was IE. You also indicated previously that the bistable action was a computer based action or microprocessor based action. Did I understand, that correctly?
MR. SHEPHERD: Yes.
MR. BESSETTE: Could you explain the scope of that system as to what portions are IE?
10 MR. BINGHAM: How much detail would you like?
MR. BESSETTE: The actual setpoint determination and 12 the monitoring of the parameters, whether or not,you exceed 13 the setpoint, all that is done in the computer. Therefore, 14 is that computer a IE system or is the microprocessor a IE 15 device? t 16 MR. SHEPHERD: The field unit, that is, the sensor, 17 its; microprocessor'. and..the, microprocessor,and the.=safety-18 related monitoring system cabinet in the control room are 19 all IE.
20 MR. ALLEN: To follow up on that, .I think what he is 21 asking is where is the setpoint calculated and the'etermina-22 tion made whether to trip the'ha'nnel.. Is that done by 23 software or is that hardware?
MR. SHEPHERD: It is done by software.
25 MR. ALLEN: Is that your question?
GRUMLEY REPORTERS Phoenix, Arizona
0
11 k
I 7'
86 MR. BESSETTE: That, is the question. Thank you.
MR. STERLING: Is that software changeable by a tec'hnician or is it'an always in there type of program that is nonadjustable? Could somebody get into the software and inadvertently change that?
MR. SHEPHERD: Pirst of all, the safety-related monitoring system cabinet is where they would have to'go, which is in the control room, so I presume that any changes to that system are under normal administrative control for 10 control room access. Secondly, to change setpoints and to
=
change .physical values such as calibration constants, you do 12 have to use a key switch under administrative control. You 13 could, however, physically pull out the boards, at which 14 point the system would go into alarm. You could start 15 pulling EPROMs and change that type of level of software, but 'I don't think that is what you are asking for.
17 MR. STERLING: Is the only activity the technician 18 would be doing in that cabinet enter'ing a new set, of setpoint 19 to that software? Is there any other activity in that 20 software other than the setpoints that he 'could be 'performing 21 MR. SHEPHERD: Yes. As an example, the'ystem is.
h 22 not automatically put into test, on the safety-related monitor it has to be manually initiated to go into test, so he could go up and say go into a test mode of checking a test routine.
25 MR. STERLING: Well, tha't is "alarmed, but to do that, GRUMLEY REPORTERS Phoenix, Arizona
0 87 he doesn'0 have to turn his key to the programmable position.
MR. SHEPHERD: That's correct.
MR. STERLING: So at, that point, the physical key position will not allow him to change software?
MR. SHEPHERD. He has not changed the response of the system under those conditions. You must, turn %he key to change any of the privileged data.
MR. STERLING: I guess basically what. my question is can he be doing something else besides changing his 10 setpoints in there and inadvertently have the setpoint change and is unaware of it?
12 MR. SHEPHERD:. No.
13 MR. ROSENTHAL: Can you describe the use of read only 14 memory versus EPROM versus EPRAM?
15 MR. SHEPHERD: I would rather not get into a technical 16 discussion. Let me take that as an open item to get into the details and simply state there is a batt'ery backed up 18 memory that, contains various setpoints and the like. The 19 function to determine whether the computer is operating correctly is in EPSOM and would not require that backup, but 21 the data, the counts, have been received'n channel's on 22 erasable memory.
23 MR. ROSENTHAL: But the program is on E-. P~ 0;g?
24 MR. SHEPHERD: That is correct.
MR. ALLEN: Did you have a question?
ORUMLEY REPORTERS Phoenix, Arizona
HI 88 MR. BINGHAM: Excuse me just a minute, John. We
.talked about an open item. Do we need to carry an open item on this issue? Do we need more detail?
MR. ALLEN: I don'5 see any need.
MR. MARSH:'ust one more thing.
6 MR. BXNGHAM: No I heard?
MR. ALLEN: No.
MR. MARSH: A followup on that concern about the possibility of accidentally changing setpoints. Can you "I
10 conclude whether that would be more or less likely with this digital monitor than it, would be with the older style analog electronic system?
13 MR. SHEPHERD: Yes, it is less likely with the digital 14 because you can protect certain functions. Normally in an 15 analog monitoring system, your only protection is a cover 16 shield which you key lock and remove out of the way and then you have control of any action you want to.
18 MR. BXNGHAM: Any other quts'tions on thi's.system?
19 MR. ALL'EN: X guess you can proceed, Bill.
20 MR. BINGHAM: Let's move. on to'A'2, ESF Actuated 21 Device Logic - Typicals.'RS.
22 MORETON: I am referring to Exhibit .2A2-l and Figure 2A2-1, which we will go thr'ough in detail. For a 24 typical logic of an actuated dev'ice,'his would be. an NSSS device or a BOP device, this is the 'steps through our GRUMLEY REPORTERS Phoenix, Arizona
89 device level components, level logic. Each ESF system actuated device receives an ESFAS signal or combination of ESFAS signals to automatically actuate the device to its safe position, as shown on Figure 2A2-1. The safe position for 'the purposes of this typical device logic discussion will be defined as that position required to perform the ESF system function. The ESFAS signals block inadvertent operator action with this block, here (indicating) to prevent the operator from inadvertently changing the device to its 10 normal position or that opposite from the safe position.
By normal, you don't necessarily mean the operating position, 12 but the opposite of,the safe position. The reset of the 13 ESFAS signal does not cause the device to change status.
The device remains in 'its safe mode of operation on reset of 15 an ESFAS signal. Resets of an ESFAS signal, as we, have 16 ,di'scussed earlier and as was discussed i.n the CE IDR, can 17 occur only after the initiating conditions have cleared and 18 the operator has manually reset the ESFAS signal logic.
19 Each ESFAS actuated device is provided with manual control 20 and the control switch is located on the main control board 21 to enable the operator to actuate the devices as necessary I
22 for system operation and for testing. Feedback to the operator is provided in the form of red and green lights in h
24 the control room. They are located either in the switch or 25 above the switch. Electrical protection circuits are GRUMLEY REPORTERS Phoenix, Arizona
1 1) 0
90, provided as shown here to preclude physical damage under overloaded conditions. In the case of motor operated valves, the thermal overload protection is bypassed by the ESFAS signal. Annunciation of electrical protection is provided to the control room operator.
Exhibit 2A2-2. An ESF system actuated device is provided with the. capability to override the ESFAS signal to allow manual control of the ESF system. In general, there are a few exceptions, but. the override of the ESFAS is 10 performed as follows: With the ESFAS signal present, the operator will turn his control switch to the safe position, 12 which is the same as that actuated by the ESFAS signal.
13 If a pump is to start, the operator will turn the switch to the start position. This will arm the override and provide 15 feedback to the operator in the form of a white light on the main control board. The override mode is automatically 17 reset. If the ESFAS signal. does clear, it is automatically 18 reset,'so the operator cannot, enable the override mode if an 19 ESFAS signal is not present, and if the ESFAS signal clears 20 or resets, the override is automatically removed. The 21 override functions to block the ESFAS signal shown here and 22 to enable manual control of the actuated device. The over-23 ride itself does not change the state of the device. The 24 actuated device can then be returned to normal when the 25 operator positions the switch into the normal position. This QRUMLEY REPORTERS Phoenix, ArIzona
I requires two operations by the operator, one to arm the override by turning the switch to the safe position; when he gets feedback by the white light, the second action required by the operator to turn the switch to the normal position to actuate change of the device state.
Exhibit 2A2-3. Each ESF s stem actu ated device is monitored by the safety equipment status system. We provide two alarms. One is the safety equipment inoperable status alarm, which is an. indication that the device is not 10 available, has been bypassed or rendered inoperable, it is not available, loss of power or breakers racked out, if 12 the ESFAS signal should occur. The other alarm we provide 13 is the SEAS, the actuated status alarm to annunciate that 14 the ESFAS signal has been received and the device has not 15 traveled to its safe state. Interfacing signals are also provided as required .to interface with supporting equipment 17 or devices.
7 18 That concludes the presentation on the typical 19 device logic. We'e got some slides here. (Slide l) This 20 is a slide of the PVNGS simulator, which is a duplicate of 21 the main control room on all three units. 'This (indicating) 22 is the horseshoe area shown on the slide. This (indicating) 23 is what we call BOl or the electrical mimic board, the ESF 24 panel here with our safety equipment status system compon'ents 25 in a system level annunciation, chemical and volt control GRUMLEY REPORTERS Phoenix, Arizona
0 0'
systems panel, reactor regulating panel, plant protection system panel where the plant protection system initiating parameters are displayed and where the manual actuation switches are available, the steam generator, turbine generato feedwater control panel, and B07, which is our,,auxiliary panel.
Slide 2. The purpose of this slide is to try and show what the manual actuation switches look like :in the control room. These are the manual actuation switches for 10 all the ESFAS signals. This is listed here as it, will be provided. These are the BOP ESFAS manual switches for 12 Train A, and on the second slide, we show the actuation 13 switches for Train B.
14 This is a mock-up of the core protection calculator 15 display. Annunciation for the BOP ESFAS is provided. Also on that same panel, our BPS panel B05, signal actuations 17 are alarmed, CPIAS, FBEVAS CRVIAS, CREFAS. Then also in 18 this same annunciator are the reactor protection system 19 alarms.
20 If we go to the next slide, Slide 5, we will see 21 an enlargement of this left-hand area showing the BOP ESFAS 22 alarms, the channel trip alarms, trouble alarms, test alarms, channel bypass alarms.
24 In the next four slides, we will try to demonstrate 25 what the operator does and what he sees when he performs an GRUMLEY REPORTERS Phoenix, Arizona
r IR
93 override function. This particular. valve (indicating) on the left-hand side of the screen has been driven closed by the containment purge isolation actuation signal. It is shown by the green light indicating closed to the operator.
lit It is not,very well here, but that light is light. You will see the contrast in a few minutes. This switch (indicating) =has been positioned by the operator. The switch has been turned to the closed position, which has 9 armed the override and provided feedback to the operator in 10 the form of these two white lights illuminating.
The next slide shows that the operator has now 12 positioned this switch to the open position and the valve I
13 is in mid-travel. Both these lights (indicating) are on.
14 Nothing has changed on this switch (indicating).
15 The operator has now performed the same two actions 16 on the second switch causing this valve (indicating) to.
17 travel. The first valve is now 'fully open., The green light 18 has extinguished.
19 On this slide, both green lights are now extinguish d.
20 Both red lights are now on showing that the valves are open 21 and that the operator has them in the override mode.
22 I think we can take questions now.
23 MR. STERLING On Figure 2A2-1, at the top of that 24 figure underneath the z'ed light on the far right, you have 25 the safety equipment annunciator. Is that. driven by the GRUMLEY REPORTERS Phoenix, Arizona
94 logic or is it driven by the actual. device position?
MRS. MORETON: It is driven in the case of valves by limiter position switches and on breakers by the breaker auxiliary contacts.
MR. ALLEN: While we are on that, slide, Mary, when you go into override., what is the effect of the interaction of the support systems or devices? Anything?
MRS. MORETON: It is specific to the specific logic.
MR. ALLEN: What I am trying to get at, when it goes 10 into override, does it override another system?
MRS. MORETON: The example would be the air handling 12 units for the containment supply pump room, which are .
13 started by an auxiliary contact, which is what we are trying 14 to demonstrate here, off of the pump breaker. If the pump 15 is in fact stopped, the air handling unit does stop, but 16 if the pump is put in the override mode, since the pump 17 would not change state, the air handling unit 'would not 18 change state.
19 MR. STERLING: Just, to follow up on that, when you 20 put the primary device in override, is there an override 21 indication on the secondary device?
22 MRS. MORETON: No.
23 MR. STERLING: So if the operator were to look at 24 the secondary device and it hadn't changed state, then just 25 by looking at the secondary device,. he would not know whether GRUMLEY REPORTERS Phoenix, Arizona
~ '
95 J
it had failed or that the primary device had moved other 2 than if he had moved it himself.
MRS. MORETON: If the failure were one that would be alarmed because of an electrical protection or because of process failure, he would know from his annunciation that it had failed. If it had stopped because he stopped the primary device, no, he would not know. Typically, the kind of support devices we are talking about aren'0 directly controlled from a control'oard light in the air handling 10 units.
ll .MR. STERLING: One more question. The white light 12 remains on as long as you are in override. If the ESPAS 13 signal is removed, the white light will also be removed.
14 MRS. MORETON: Yes.
15 MR. STERLING: Or will it stay on until the operator 16 moves the thing back to the normal position?
17 MRS. MORETON: The override is disenabl'ed when the 18 ESPAS signal is removed and the white light is extinguished.
19 The device does not change state.
20 MR. ALLEN: Any further questions?
21 MR. BINGHAM: Shall we proceed? Might I ask, when 22 are you scheduled for lunch?'R.
23 ALLEN: We are going to break'bout noon for 24 lunch. How does that fit in with the next 'section?
25 MR. BINGHAM: I believe we can get through the next GRUMLEY REPORTERS Phoenix, Arizona
~ I 1
0'
96 1 section, so we will do 2A3, ESF Load Sequencer Design Criteria and System Description.
MRS. MORETON: Exhibit 2A3-1, ESF Load Sequencer System Design Criteria. We repeat here the design criteria specific to the load sequencer system. These design criteria were presented this morning as part of the BOP ESFAS. The BOP ESFAS shall provide the logic to automatically start andsequentially load the diesel generators and to shed all 9 4.3.6 kV Class IE loads on a loss of power. The system shall monitor the'ndervoltage relays on the 4.16 kV Class IE bus and initiate a logic signal on a two-out-of-four coincidence of bus undervoltage. This logic signal will be used to shed all Class IE 4.16 kV loads except the load center transformers, shed certain 480 volt loads, start the 15 diesel generator, start equipment, required after a loss of offsite power, and trip the 4.16 kV Class IE bus preferred power supply breakers.'he system shall provi'de sequencing logic for sequential loading of ESF and forced shutdown loads 19 onto the ESF bus upon closing of the diesel generator breaker, a safety injection actuation signal, or. an auxiliary feedwater actuation signal.
Exhibit 2A3-2. Should another accident condition occur after the load sequencer has started, the sequencer shall reset to zero. Equipment in operation at this time shall remain in oper'ation. If a loss of offsite power signal GRUiILEY REPORTERS phoenix, Arizona
'0 ES 4r
- I 0
97 is initiated after the load sequencer has started, all loads will be shed and resec{uenced on the diesel generator breaker, closure.
That concludes the design criteria other than the General Design Criteria that apply to the entire'BOP ESFAS.
We will now go into .the ESF load sequencer system description Exhibit 2A3-3. Each redundant ESF load seguencer system performs logic functions to generate a loss of offsite power signal or load shed signal, a. diesel generator 10 start signal, load seguencer start and permissive signals.
Each ESF load sequencer is supplied from a separate 120 volt 12 vital AC distribution bus and a separate Class IE 125 volt 13 DC distribution bus. ESF .load sequencer system signals are 14 generated from two load groups designated Load Group 1 and 15 Load Group 2.'he logic is physically located in the two 16 BOP ESFAS cabinets. One cabinet contains the logic for 17 ESF, Load Group 1, the other\ cabinet. contains the logic for 18 ESF Load Group 2.
19 Exhibit 2A3-4, Redundancy. Redundant features 20 of the ESF load sequencer system include two independent 21 logic paths from input signals through and including output 22 relays, and power for the system is provided from two separat 23 buses. Power for control and operation of redundant actuated 24 components comes from separate buses. Load Group 1 component 25 and systems are energized only by the Load Group 1 bus and
'RUMLEY REPORTERS Phoenix, Arizona
0 V,
98 Load Group 2 components and systems are energized only by the Load Group 2 bus.
3 Testing.'rovisions are made to permit periodic testing of the ESF load seguencer system. Tests cover the trip actions from .input signals through the system and the actuation devices. .System tests'o not. interfere with the 7 protective function. of the system.
Continuing on with the Testing on Exhibit 2A3-5, actuation of the components controlled by the ESF load 10 seguencer system does not disturb normal plant operating conditions. Therefore, the ESF load seguencer system is.
12 tested by complete actuation. Proper operation may be 13 verified by checking the position of each ESF component, 14 checking the actuation annunciation, checking the ESF 15 component status indication. Response time testing will be performed at refueling intervals.
17 Exhibit 2A3-6, ESF load seguencer sy'tem signal 18 logic. The loss of offsite powex signal/load shed signal 19 logic is shown on Figure 2A3-l. *Each LOP signal/load shed 20 signal logic continuously monitors the Class IE 4..16 kV 21 buses fox'ndervoltage, provide indication and annunciation 22 of an, undervoltage relay trip to the operator, indication 23 on the BOP ESFAS cabinet, provides a logic output on a two-24 out-of-four coincidence of undervoltage relay trip or manual actuation located at the BOP ESFAS cabinet. This logic GRUMLEY REPORTERS Phoenix, Arizona
I' 0
~,
99 generates an LOP signal to the diesel generator to initiate a diesel generator start signal, it initiates an LOP signal through a 60-second off delay to the forced shutdown system loads, also initiates a load shed, which is a one-second pulse, to trip preferred power supply. breakers and to trip the selected loads for load'hed, and provides indication
'nd annunciation to the operator. It also provides a signal to the load sequencer for load information.
Exhibit 2A3-7, the diesel generator start signal logic. It is shown on Figure 2A3-2. Each DGSS logic perform the following: It combines the LOP signal, AFAS-l, AFAS-2, and SIAS with manual actuation from the BOP ESFAS cabinet 13 to generate a combined DGSS signal'to actuate the diesel 14 generator.
15 The load sequencer start and permissive signal logic is shown on Figure 2A3-3. Each load seguencer start 17 and. permissive signal logic performs the following functions:
'I 18 It monitors input, determines the appropriate mode of opera-tion, and generate sequentially timed start and permissive signals to ESF and forced shutdown loads as required to prevent instability of the Class IE buses. Start signals actuate devices by de-energizing actuation relays. Permissiv signals allow loading of devices by energizing actuation 24 relays.
Exhibit 2A3-8. The load seguencer controls only GRUMLEY REPORTERS Phoenix, Arizona
100 pumps, fans, and chillers and as such does not cause complete ESF system actuation. The ESF load sequencer does not 3 control any valves or dampers. The load sequen'cer is designed to respond to a loss of coolant accident with offsite power available, to a LOCA without offsite power.
6 available, to an accident other than LOCA with offsite power available, to an accident other than LOCA without offsite power available, to a loss of offsite power with or without an accident other'han a LOCA followed at a later 10 time by a,LOCA, and a loss of coolant 'accident followed at a later time by a loss of offsite power.
12 Exhibit 2A3-9. The load sequencer has a normal 13 mode, which we call Mode 0, and four operating modes.
Operating Mode l is initiated by an SXAS/CSAS with a loss 15 l of offsite power signal not present. Mode actuates the 16 loss of coolant accident loads with offsite power available.
17 Mode 2 is actuated by a safety injection actuation signal, 18 containment spray actuation signal and a loss of offsite 19 power. Sequencing is initiated when the diesel generator 20 breaker closes. This mode actuates the local loads without 21 offsite power available. Mode 3 is loss of offsite power 22 signal without the containment spray/safety injection 23 actuation signal. Sequencing for the shutdown loads is 24 initiated when the diesel generator breaker closes. Mode 4 25 is other signals without a safety injection or containment GRUMLEY REPORTERS Phoenix, Arizona
~,
v
spray signal and without loss of offsite power. These signals are the CRVIAS and CREFAS combined in a logical "OR," FBEVAS, AFAS-1 and AFAS-2 combined in a logical "OR,"
or a signal if the diesel generator is running.
Exhibit 2A3-10. .Receipt of subsequent input signals requiring a .change of operating mode causes the load sequencer to reset, transfer to the required mode, and initiate sequencing of the required loads. The devices
,sequentially actuated through the load sequencer receive I'
10 load shed signal on bus undervoltage to trip the device load and a load sequencer start signal to start the device 12 at the appropriate time. Reset of the load sequencer and 13 its actuation relays does not. stop or shed actuated devices.
14 Devices are shed only on the load shed signal.
15 If we go back to our typical logic for an ESF 3 system device, Figure 2A3-4 modifies that logic we discussed 17 previously to show the sequencer signals repla'cing the ESFAS 18 signals in the device logic to actuate the device, and it 19 is overridden and.'is treated as another ESFAS signal in 20 addition to the load shed signal which is required to shed F 21 the'oad on a loss of offsite power.
22 MR. BINGHAM: Are there questions from the Board?
23 MR. STERLING: Exhibit 2A3-4. Your last statement 24 on Chat page was system test does not interfere with the protective function of the system. Would you describe what GRUMLEY REPORTERS Phoenix, Arizona
~,
0
102 happens if you are in test and you do get a safety actuation, what does the sequencer do?
MRS. MORETON: Testing is performed by actuating the load sequencer. If a safety signal did come in, the load sequencer would change modes during testing.
MR. STERLING:. So to the seguencer, it doesn't know the difference between a design input and a regular input, it just would respond?
MRS. MORETON: Correct.
10 MR. ALLEN: Isn't this an auto test seguencer?
MRS. MORETON: The seguencer does have an automatic 12 tester that. will periodically scan through the entire BOP 13 ESFAS to check logic. If you are in automatic test and a safety signal comes in, the seguencer when it changes out, of 15 Mode 0 terminates auto test.
MR. STERLING: Continuing on that, if we might have 17 Figure 2A3-3, to help me understand thi's, where is your test?
18 It would test through Modes l through 4?
19 MRS. MORETON: Manual test?
20 For manual test, you would actuate these signals 21 individually in their combinations until you achieved the 22 'desired mode output to verify their operation.
23 MR. STERLING: Then you are 'testing all the way 24 ., through your actuated devices?
25 MR. MORETON: Yes.
GRUMLEY REPORTERS Phoenix, Arizona
I I
103 MR. STERLING: So your diesel, would start and you would go through your load sheds'?
MRS. MORETON: Yes.
MR. ALLEN: Any other questions?
MR. MECH: The diesel supply breaker is interlocked to not. close on a faulted bus or into an energized bus. At some point, one of these signals will open the breaker that energizes the bus so the diesel breaker can close. Can you describe that in more detail?
10 MRS. MORETON: Can we go back to Figure 2A3-1? On reset of an undervoltage, the load sh0d signal does trip 12 the supply breaker.
13 MR. MECH: It will trip it even though there may be 14 voltage on that bus?
15 MRS. MORETON: There is no voltage, because the 16 undervoltage relays have dropped out.
17 MR. MECH: Well, whatever the condition'f the under-18 voltage says.
19 MRS. MORETON: What are the setpoints for undervoltage 20 MR. MECH: Setpoints, yes.
21 MR. BINGHAM: The question was what are the'ndervolta e 22 setpoints? That was probably covered in the AC review. We 23 can go back, John, if you would like and pull tho'se out for
,24 information.
25 MR. ALLEN: Maybe over lunch we could look in the FSAR GRUMLEY REPORTERS Phoenix, 5r)zoria
ll 104 I
or something just, to get those numbers.
MR. BINGHAM: We just don't have them.
MR. ALLEN: Or we can call over to our office and get them.
MR. MECH: That's okay. It is not zero .at that point, though. I mean it is something like 70%.
MR. ALLEN: It is 70, 80%, somewhere in that order.
MR. BINGHAM: Is that. satisfactory?
MR. MECH: That's all I need to know; 10 MR. PHELPS: - On Exhibit, 2A3-8, there is a statement made at the top that the load sequencer controls only 12 pumps, fans, and chillers and does not control any valves.
13 What controls the valves?
14 MRS. MORETON: The valves are not sequenced. They 15 are controlled directly by the ESFAS signals. If there is 16 no power on the bus, the signals will still be present when 17 the bus is re-energized and the valves will go'o their proper position.
19 MR. PHELPS: What if you receive a safety injection 20 actuation signal and there is no loss of offsite.power?
21 Does the sequencer then load all the'IAS components on 22 simultaneously?
23 MRS. MORETON: No.
24 MR. PHELPS: But all the valves actuate?
25 MRS. MORETON: Yes.
GRUMLEY REPORTERS Phoenix, Arizona
105 MR. PHELPS: And you have insured that there are no interaction problems?
MRS. MORETON: Yes.
MR. ALLEN: A followup, Mary, on that. Doesn't the sequencer give permissives to some of,the valves?
, MRS. MORETON:. The permissive signals generated by the sequencer are to allow the operator to manually load on those loads that, may be required later on like the charging pumps. They are not signals to the valves."
10 MR. ALLEN: Further questions? Mike.
MR. BARNOSKI: I have a question on Figure 2A3-1 in 12 regard to the 60-second delay. My concern is on loss of 13 offsite power establishing feed flow to the generator. I 14 assume that with that 60-second delay, that effectively 15 eliminates the starting of the motor driven aux feed pump 16 if it is just loss of offsite power for 60 seconds and you 17 would rely on the aux feed actuation signals to initiate 18 the load sequencer. I guess that meet's the minimum.
19 MRS. MORETON: Yes 20 MR. BARNOSKI: My question was for a loss of offsite 21 power event, what logic led you to include that 60-second 22 delay specifically for actuation of aux fee'd to the generator?
24 MRS. MORETON: The loss of offsite, powe'r signal does 25 not actuate the auxiliary feedwater pumps. The loss of GRUMLEY REPORTERS Phoenix, Arizona
offsite power signal actuates selective groups of forced shutdown loads to minimize equipment damage like the CEDM coolers or the continual normal coolers and their associated dampers as an example. The auxiliary feedwater pumps are actuated by the sequencer, not by the LOP.load check logic on an ASS signal.
MR. BARNOSKI: I am not, sure I got the answer I was looking for. What you are telling me is that for a real loss of offsite power, I am going to get that aux feed 10 actuation signal coming on pretty quickly and that even if the operator had power available, the time is so short that 12 he would get the aux feed actuation signal before he would 13 have a chance to manually go put those aux feed pumps on.
14 MR. BINGHAM: Just a minute. What answer were you 15 expecting?
16 MR. BARNOSKI: I'm just trying to rationalize why 17 for loss of offsite power when you clearly have to get aux 18 feed going as soon as you can, .why the 60-second delay?
19 MRS. MORETON: There is no 60-second delay in the 20 initiation of E
aux feed. The 60-second delay is in the LOP 21 logics I 22 MR. BARNOSKI': Yes, I understand that.
23 MRS. MORETON: The signal that goes to the load 24 sequencer, this is an aux delay, whi'ch is a timed memory. It 25 is not g delay. It is not an "on" delay, it is an "off" GAUMLEY AEPORTERS Phoenix, Arizona
H
lo delay, which means that when this signal goes away, this remains for 60 seconds. It does not delay the signal. It.
maintains the signal fox 60 seconds after the interval has cleared to keep the se'quencer in its undervoltage mode.
MR. BARNOSKI: Fine.
MR. ALLEN: Any. further questions?
MR. PHELPS: I would just like to make one general observation, and that is when you defined the interfaces with Combustion Engineering for performing the accident analyses that you make sure that you have the most adverse time delays for the actuating components associated with all the modes in the sequencer's operation and the valve 13 operations.
14 MR. ALLEN: Jack, did you have a question?
15 MR. ROSENTHAL: Yes, please. Exhibit 2A3-9, Xtem 4.
What was the rationale for not including MSXS on that list?
17 MRS. MORETON: The MSIS does not actuat'e any pumps, 18 fans, or chillers required to meet sequence onto the Class IE 19 bus.
20 MR. ROSENTHAL: Apparently I don't understand the system, which is my failing. MSXS would surely be a precursor of emexgency feedwater demand signals, .and I don' 23 see why it wouldn't be a good idea to get a head start on 24 getting those diesels running.
25 MR. KEITH: Well, the logic, as we say, for the MSXS GRUMLEY REPORTERS Phoenix, Arizona
l08 and AFAS comes from Combustion Engineering and it was needed by them to support their accident analyses. On an MSXS, we are only shutting some valves, the main steam isolation valves, main feedwater isolation valves. I am sure that the Combustion Engineering analysis supports that, that in the N
event of an accident, requiring an MSIS that the AFAS logic will support the feedwater needs of the generator. So that.
is why we have the logic the way it is.
MR. ROSENTHAL: Surely the Chapter 15 analysis 10 involving. the aux feedwatex indicates that there is plenty of time for aux feedwater to the steam generator, but the 12 time delay until you get down to low steam generator water 13 level, at which point you will generate an AFAS, can be 14 some period of time, especially if you had an . MSIS which 15 bottled up the system. With a loss of offsite power, 16 wouldn't it be prudent to get those=diesels running?
17 Let me rephrase the question. I understand your 18 statement that the Chapter 15 analysis .in CESSAR supports the 19 design as indicated on this exhibit. My question is would 20 it not be prudent to start the diesel generators. on an,.
21 MSXS g 22 MR. BINGHAM: Were you asking that for CE to consider 23 or would you like just our view?
24 MR. ROSENTHAL: Your view. I assume that their 25 position is that they don't need it to support their GRUMLEY REPORTERS Phoenix, Arizona
109 Chapter 15 analysis.
MR. BXNGHAM: Yes. They are one of many designers of this plant, but as I indicated earlier, Jack, it is our obligation to design a matching system.
MR..ROSENTHAL: You can do more.
MR. BXNGHAM: . We generally have APS that encourages us not to do that.
MR.. ROSENTHAL: Okay. Well, the answer to my, prudent.
question.
10 MR. 'BINGHAM:. Let. us talk for a minute and see if we can answer that question.
12 John, we haven't had, obviously, an opportunity 13 to talk to the APS counterparts, but X think. Dennis can give 14 our overview response now, and if the Board would like that followed up in some detail, we can do that.
16 MR. KEITH: Jack, we don', think it would adversely affect .the system at all. It would provide some benefits.
We don'0 feel offhand that the benefits which could be provided would offset the increased complexity of the 20 circuits=-which you get involved with to do it. We don't see 21 that much benefit at .thi's point in time,'
other questions?
23'R.
22 MR. BINGHAM:
JOHNSON:
Any As your sequen'cing valves on the bus after the <<;
25 MR. KEITH: We don't sequence f
valves.'RUMLEY REPORTERS, Phoenix, Arizona
~,
,4
~ '
l
ll0 MR. JOHNSON: They do not sequence, but the signals that substitute them come in at varying times in accident scenarios. Correct?
MR. KEITH: Depending on .the accident.
MR. JOHNSON: Yes, depending on the accident. It takes various stroke, times depending on the size and the type of valve. Have you taken into account. the degraded bus voltage caused by large equipment loadings into the sizing of the valve actuators? Your bus will swing high and 10 low as each heavy load comes on.
MR. KEITH: Yes, that wa's covered in some detail in 12 the AC systems review, the degraded bus voltage. question, 13 and all the equipment is sized to meet those requirements.
14 MR. JOHNSON: Thank you.
15 MR. STERLING: Is the answer to his question that 16 we are adequately designed?
17 MR. KEITH: Yes. IJ thought I said that.
18 MR. ALLEN: Further questions?
19 MR. BESSETTE: We were discussing previously the 20 interface basically that we'e got in our Chapter 15 analysis 21 which brings another question to my mind, which is the 22 criteria or administrative controls that the operator would 23 use in overriding ESF components where the systems are 24 assumed operational. In .the Safety Analysis, we went 25 through the circuitry and procedure that. he would use to GRUMLEY REPORTERS Phoenix, Arizona
h 0
override a component, but what control do you apply to him that he does not do that indiscriminately?
3 MR. BINGHAM: Excuse me, when you are talking about "we," you are talking about Combustion Engineering?
t MR. BESSETTE: I am talking about the operator manuall overriding a" safeguard component; MR. BINGHAM: I understand that part, but before you said some criteria was discussed.
MR. BESSETTE: Yes.'hat relates to assumptions that 10 we may have made in our Chapter 15 analysis regarding availability of these safeguard systems or your ESF systems.
It 12 MR. BINGHAM: And there.was information passed on 13 to. the utility for particular requirements by Combustion,,
14 is that correct?
15 MR. BESSETTE I guess it would have come down as 16 an interface. I cannot identify a specific one, 'I am saying 1
17 we make, assumptions as to the cooling systems.be'ing available 18 and that the support systems to'ur safeguard systems are 19 available. The operator, once the system is initiated, 20 has the capability to override and to reverse the'irection 21 of some of these 'components'. What .controls or administrative 22 procedures do you apply that he'oes not. do that?
23 MR. BXNGHAM: John, I think, I would have to xefer tq 24 the operating group on this particular ques'tion.
MR. ALLEN: Do one of you guys want to address it GRUMLEY REPORTERS Phoenix, Arizona
. ~
0'
from Operations or do you want to carry it as an open item and then respond as an open item?
MR. SIMKO: I can't speak for Operations in particular but we do have the CE guidelines that we are using and they have all the accident analysis and transients, and we are putting those into the operating procedures so our operators do not inadvertently override these.
MR. BARNOSKI: Can I get, a clarification on that?
Then you are saying you are going to be using the emergency guidelines that are currently being prepared and going to i
the CE Owners Group. You are going to adopt those and use 12 13 MR. SIMKO: I don'0
\
know if it is the CE Owners Group.
14 MR. STERLING: I think we will clarify this a little.
There are two sets of procedures, one out of the Owners Group, which is the emergency guidelines that, are a part, of the 1.C.1 Task item. There are administrative operating 18 procedures which are being gener'ated by the project office of Combustion. In either case, those form the basis of the procedures that will be used to operate the plant.. I ass~e 21 that Combustion Engineering has used those or has based 22 those guidelines on their Chapter 15 analysi's, I will" say, 23 too, that we do receive for our input, the assumptions that were used by Combustion to: per'form their Chapter 15 analysis, so we are aware of what needs to be available.
GRUMLEY REPORTERS Phoenix, Arizona
a
~
MR. BESSETTE: I guess the answer that I hear is the operator is restricted by the procedures as to when he can use these for that function.
MR. STERLING: Yes, that's correct.
MR. BESSETTE: l have two other questions, much more general. One is has. any consideration been given to the functional grouping. of indicators and controls to layout and design of the control board?
MR. STERLING: I w'ill respond to that. As was
'I 10 pointed out on the slide that we saw of the control board with the missing indicator, our thorough human factors review 12 of the control board is identifying those areas so that 13 the control board will be able to support whatever procedures 14 are required to adequately control the plant. So that 15 function is under the l.D Task of 0737. Also, I might point 16 out that Combustion Engineering is reviewing those procedures 17 that are being prepared to the guidelines, 18 MR. BESSETTE: Then my last question is does the 19 operator rely 'on the CRT indication for any safety action?
20 MR. BINGHAM: No.
21 MR. ALLEN: It is well p ast noon. I think we had 22 better shut it down right now and go have 'lunch.'f anyone 23 has any additional questions .on thi's section of the presenta-tion, just hold them until after'unch 'and we will address 25 them to Bechtel.
GRUMLEY REPORTERS .
Phoenix, Arizona
e (Thereupon the meeting was at recess.)
June 17, 1981 1:20 p.m.
MR. ALLEN: Were there, any questions left over before lunch before we proceed to the next section?
Seeing none, go ahead, Bill.
8 MR. BINGHAM: We will continue the presentation with 2.B, Systems Required for Safe Shutdown.
10 MRS. MORETON.: Figure 2B-1 identifies those systems required for safe shutdown. It includes the electrical and 12 mechanical devices and circuitry required to achieve and 13 maintain a safe shutdown condition'of the plant. There are 14 sensors, device logic, control room displays, remote 15 shutdown displays for the NSSS and the BOP safe shutdown systems. The NSSS systems include the boron addition 17 port'ion of the chemical and volume control system and the 18 shutdown cooling system. The BOP systems that we will be 19 discussing on 'a general basis as it relates to the remote 20 shutdown panel and typical information for sensors and 21 manually activated device logic include the diesel generators 22 including the ESF load sequencer, diesel generator fuel 23 oil storage and transfer system, Class IE DC and AC powex F
24 systems, auxiliary feedwater, "'atmosphex'ic steam dump, 25 essential cooling water, essential spray ponds, and the GRUMLEY REPORTERS Phoenix, Arizona
115 essential chilled water systems. Most. of the discussion will concentrate on the remote shutdown panel and the ability to go to cold shutdown outside the control room.
Starting on Exhibit 2Bl-l, the design criteria, I design for maintaining=the plant in a safe shutdown condition when the main control room is inaccessible shall be in accordance with 10CFR50, Appendix A, GDC l9, "Control Room."
Safe shutdown requirements comprise the capability for prompt hot shutdown when the reactor is subcritical at 10 normal operating pressure and temperature, including the necessary instrumentation and controls to maintain the unit in a safe condition during hot shutdown, and the potential capability for subsequent cold shutdown of the reactor through the use of suitable procedures and controls and instrumentation outside the control room. Access back into the main control room will generally be achieved prior to the initiation of cold shutdown. However, the capability 18 for bringing the reactor to cold shutdown conditions exists outside the control room through the use of suitable procedures and secondary controls. Control room evacuation 21 is initiated from an "undefined" cause; for example,
-22 control room environment not"habitable.
23 Exhibit 2B1-2, continuing with design criteria.
24 Design basis accidents are assumed not to occur simultaneousl with control room evacuation. LOP and seismic events shall GRUMLEY REPORTERS Phoenix, Arizona
f
~ i
~,
0'
not jeopardize the safe shutdown function. Systems, controls and indications essential to the residual heat removal 3' function during hot shutdown shall be designed with suitable redundancy in accordance with 10CFR50, Appendix A, GDC 34, "Residual Heat Removal." Loss of safe shutdown system redundancy does not .occur as a result of the event, excluding a control room fire, requiring control 'room evacuation.
All seismically qualified automatic functions perform as 9 required. Design of the remote shutdown panel, system controls, and surveillance instrumentation shall not degrade the primary shutdown controls located in the main control 12 room and shall be designed in accordance with the applicable 13 sections of IEEE 279-.1971.
14 Exhibit 2B1-3. We are now going to the Remote Shutdown Panel and Cold Shutdown Capability System Description. The following systems 'are required for safe=.
17 shutdown: auxiliary feedwater, atmospheric steam pump, 18 diesel generators including ESF load seguencer, the diesel generator fuel oil storage and transfer system, essential 20 cooling water, essential spray ponds, essential chilled water class IE AC power, Class IE DC power, the boron addition 22 portion of the chemical and volume control system, and the 23 shutdown cooling system.-
24 Exhibit 2B1-4, continuing on with our system description, should the control room, become inacce'ssible,,the GRUMLEY REPORTERS Phoenix, Arizona
l q 0,
117 reactor may be manually tripped from the control room as it is being evacuated or from the reactor trip switchgear 3 system, which is located in the auxiliary building, elevation 120. Hot shutdown conditions can be maintained from outside the control room by control of pressurizer pressure and level,. auxiliary, feedwater flow, and atmospheric steam dump.
Instrumentation and controls are available at the remote shutdown. panel and ESF switchgear, both located in the control building, elevation 100, for these systems and components. The remote shutdown panel, which is shown on Figure 2Bl-1 down at the lower section, is located in the 12 control room building. This is all at elevation 100, which 13 is at grade. The remote shutdown panel consists of three 14 physically separate cabinets. Instrumentation and controls 15 for Channel A and Train A systems and components are provided 16 in one cabinet, shown up here (indicating} . Instrumentation 17 and controls for Channel B and Train B systems'nd components 18 are provided in a second cabinet. A nonsafety-related 19 cabinet is provided for instrumentation. That is this 20 third cabinet (indicating). Controls for Channel C are 21 provided in a sep'arate subsection of the Train A cabinet and 22 controls for Channel' are provided in a separate subsection 23 of the Train B cabinet. Controls for large 'horsepower 24 components, 480 volt and 4.16 kV, are provided at the ESP switchgear, switchgear located here (indicating) for Train A GRUMLEY REPORTERS Phoenix, Arizona
It q
- I r
118 and here (indicating) for Train B. The Train A remote
.2 shutdown panel is physically separated from the Train B remote shutdown panel by a fire wall separating the two panels. There is an access door providing access to the
- 5. panels. 'h t
Exhibit 2Bl-5. In the event of a loss of offsite I
power, the diesel generators will automatically be started and sequentially loaded by the ESF load sequencer system and the dies'el generator control systems. Control outside of 10 the control room is provided at local panels in the diesel generator building. Cold shutdown can be achieved from 12 outside the control room through the use of suitable 13 procedures and local controls. Parallel control between the 14 control room and the remote shutdown panel, ESF switchgear 15 or local control is utilized. Transfer of control is used 16 only for analog control, an example being the auxiliary 17 feedwater turbine speed control. Redundant features include 18 two independent instrumentation and control channels for 19 safe shutdown systems and components and power provided from 20 two separate buses.
21 Exhibit 2Bl-6 identifies instrumentation provided 22 on the remote shutdown panel. As shown on that exhibit, 23 you can see there is redundant instrumentation provided for 24 Train A or Channel A and Channel B,
'25 Exhibit 2Bl-7 identifies, the controls at the GRUMLEY REPORTERS Phoenix, Arizona
0 4!
o
19 remote shutdown panel. Again, 'redundancy is provided in Channel A and Channel B. There is a point, of clarification.
The auxiliary feedwater Channel A system is a DC system and, therefore, has controls associated with the pump, because it is turbine driven, but you do riot see it duplicate in Channel B. The Train B pump is started at the ESF switchgear, which will show up on Exhibit 2B1-8, which shows the components controlled. from the switchgear.
Exhibit 2Bl-9 identifies local controls provided to enable the operator to bring the plant to cold shutdown from outside the control room.
12 We have a typical device logic for a safe shutdown system on Figure 2Bl-2. This drvice happens to be started 14 by the load seguencer. Some of the devices are also started up by high safety features actuation systems. The only 16 difference between this logic;and the logic we have discussed 17 previously is the parallel control at the'emote shutdown 18 panel 'and the main control room with parallel indication.
I A typical control scheme for the atmospheric .
20 dump valve is shown on Figure 2Bl-3; which sho'ws the atmospheric dump valves. Typical for each atmospheric dump valve; there is one dump valve,per steam line, two 23 steam lines per steam generator., This identifies .the 24 parallel controls provided at the 'remote shutdown panel and at the control room and feedback to the operator for valve GRUMLEY REPORTERS Phoenix, Arizona
0, 120 position information. There are two solenoid valves blocking air to the atmospheric dump valve system which prevent inadvertent opening of the atmospheric dump valves. One is powered from one, instrument channel, the other is powered from the other instrument channel. Backup instrument air is provided from a nitrogen actuator which is automatically transferred over on lack of normal instrument air. These atmospheric dump valves also provide control throughout the hot shutdown sequence.
10 .That concludes the discussion on safe shutdown.
MR. ALLEN: Any questions? Jack.
12 MR. ROSENTHAL: Do you believe that you meet RSB 13 Branch Technical Position 5.1 with".respect to achievement 14 of cold shutdown from the control room?
15 MR. BINGHAM: Yes.
MR. KEITH: Yes, we do have She capability to achieve 17 cold shutdown from the control room.
18 MISS KERRIGAN: With no local operation required?
19 MR. KEXTH: Correct.
20 MR.'ROSENTHAL: Wha't about the SIT isolation valVes?
21 MR. BINGHAN: What about it? Excuse'e."
22 MR. RQSENTHAL: I will be clearer. I am concerned about the ability to go 'to cold shutdown conditions from inside the control room, whi'ch is one of the '.goals of RSP BTP 5.1. Qne of She specific systems of concern is the
'RUMLEY REPORTERS Phoerilx, Arizona
ll safety injection tanks. For normal operation, the block valves are open, and in some of this documentation, I think it i.s in the SAR, it says that power is removed from the motor operator to the block valves. Can you reinstate power from the control room, and, if so, then do you -- I'.m sorry, I will wait for the .answer.
MR. KEITH: Jack, we can depressurize:; the safety injection tanks from the control room. I was concerned about a possible conflict between this answer and my last 10 answer, but, we achieve cold shutdown leaving those isolation valves open'.
12 MR. ROSENTHAL: Do I take it that you have the ability 13 to reduce nitrogen overpressure in the SIT tanks?
14 MR. KEITH: From the control room.
15 MR. ROSENTHAL: Is there an analysis to confirm that 16 that is a suitable means of operation such that you don' 17 dump nitrogen into the primary, or an excess amount, and is 18 there also suitable analysis to show that that mode of 19 operation is consistent,.with concerns related to low 20 temperature of the pressurization of the primary?
21 MR. KEITH: I think it is handled procedurally. As 22 you are coming from hot shutdown to'old shu'tdown, you are 23 'meeting various pressure/temprature relationships in the 24 RCS. You must vent the safety injec'tion tanks at certai,n 25 times, so as long, as you are meet'ing the procedures and GRUMLEY REPORTERS Phoenix, Arizona
I 122 staying within those limits, you won't have a problem.
MXSS KERRIGAN: You are talking about a procedure.
This is in your normal operating procedures that that is how you normally do it? You normally would not do what is in the PSAR. =I mean this would be your normal way of going to cold shutdown and it, would be in the normal operating proce-dures, is that right?
MR. KEITH: I am just trying to get a clarification h
of do you consider that method of going to cold shutdown 10 the normal method as opposed to shutting the safety injection tank isolation valves?
12 MXSS KERRIGAN: Yes.
13 MR. KEXTH: I am going to have to check. I don' 14 know what -- Mike, can you help 'us? Or you are not sure.
15 MR. BARNOSKI: No. Clearly, the normal way would be .
16 to close the valves.
17 MISS KERRIGAN: Right.
18 MR. KEITH: So this would be some kind of abnormal 19 operating procedure in order to. do it completely from the 20 control room.
21 MXSS KERRIGAN: Right. That is the 'Branch Technical 1
22 Position, and I guess we would like to kind of leave that .
23 as a thought for you, to assure yourselves'hat you can go 24 to cold shutdown from the control room in the 'normal--
MR. ROSENTHAL: No, in emergency.
GRUMLEY REPORTERS Phoenix, Arizona
E 0
e
l2 MISS KERRIGAN: Yes.,
MR. ROSENTHAL: Using emergency procedures.
MXSS KERRIGAN: Right.
MR. KEITH: That, we have an emergency proceduxe to MISS KERRIGAN: That covers that mode of going to cold shutdown totally within the control room.
MR. ALLEN: We will take that as an open item and confirm it with operations.
MR. KONDIC: May I rephrase a porti'on of Jack's 10 question? Are we sure tha't during the noxmal operation of the plant there will not, occur a depressurization via the 12 system we are discussing now that we shall not lose the gas?
13 MR. ROSENTHAL: Yes, that, is equivalent, or, t
14 alternately, do you meet XCSB/Power Systems Branch Branch 15 Technical Position 18?
16 MR. KEITH: We meet .CE requirements on the system.
17 We have two valves in series as far as the ven't on the 18 safety injection tanks which are powered from different
)9 -power sources.'R.
20 KONDXC: Thank you.
- 2) MR. ALLEN: Any othex'uesti,ons?-.
22 MISS KERRIGAN: That was kind of a funny way, tO phr'use 23 the answer, that you meet, CE requirements. Do CE requirement 24 meet the ICSB position?
25 MR. BINGHAM: Well, we have the interface problem.
GRUMLEY REPORTERS Phoenix, Arizona
4 lt
124 In.'the presentation, I am sure that. they have presented what they mean.
MISS KERRIGAN: So you would leave that as a CE open item' MR. BINGHAM: We would leave that as CE.
MR. BESSETTE:, That. was addressed at our last presentation two weeks ago as far as our position on this Branch Technical Position.
MR. ROSENTHAL: Our position with respect to 5.1 is 10 the valve, and I would request that if we are leaving this as a general open item, the achievement of cold shutdown from the control room, that in the course of preparing to respond, you look at several related Branch Technical 14 Positions as an involvement and do your homework. I just point out that if you don't want the nitrogen to get out, you put two valves in series, if you do want it to.get out, 17 you put two in parallel, and now you have conflicting goals.
l r 18 I am sure you will do your homework thoroughly and you should 19 consider .not only that specific system, but all the 'systems 20 involved in achieving cold shutdown.
21 MISS KERRIGAN: That would be 'an item that we would r
22 want t'o go'into in our second meeting probably in quite more 23 detail.
24 MR. BINGHAM: So the 'issue 'is how do we go to cold shutdown from the control room GRUMLEY REPORTERS Phoenix, Arizona
0 125 MISS KERRIGAN: And still meet all the requirements.
MR. BINGHAM: -- and still meet all requirements of the Branch Technical Positions.
MISS KERRIGAN: Yes.
MR. ALLEN: Bill, axe you going to answer that?
MR. BINGHAM:, Well, I think,,John, since it involves both CE and Bechtel and APS on the interfaces and the Operating Department. as well that we probably ought to coordinate the response so that we have gone through the 10 spectrum of concern.
MR. SIMKO: Did we ever get a valid question out of 12 this? I am not. sure what they are asking.
13 MISS KERRIGAN: I guess the question is how do you 14 meet RSB BTP .5.1.
15 MR. BINGHAM: Just for my own understanding, is this 16 basically a Chapter 5 question or position? Is Chat where 17 it would come up normally?
18 MR. ROSENTHAL: Five/six.
19 MR. BINGHAM: Th'e reason that. we are concerned is 20 because we try very hard in these presentations to address 21 all the Branch Technical Positions and the SRP's, and for 22 7,'f course, it will be absent from this presentation. If 23 it is in 5,'e would expect that .that would be a CESS'AR 24 directed question, and that is why I want to get that 25 clarification so that you understand you won', see it today.
GRUMLEY REPORTERS Phoenix, Arizona
1 0
e H
'I E
0
126 MR. ROSENTHAL: Pine. We have~done some coordination at the NRC side, and when you do make your presentation, I will ensure that we have systems people and ICSB type people present so we can properly respond to you.
MR. ALLEN: 'Additional questions? Go ahead, Jack.
MR. ROSENTHAL: You have a list of equipment, on the remote shutdown panel. Ideally, that would come in part based on reviewing procedures. I take it the plant doesn' have procedures yet. How do you know that this list is complete? The corollary--
MR. BINGHAM: Is there more to the question?
12 MR. ROSENTHAL: The corollary of that, is alternately, r
13 given that this is all the'quipment that will be provided, 14 'ow are we assux'ed that the plant emergency procedures or plant procedures when they are wxitten don't use more equipment than is physically present?
17 'R. KEITH: Jack, the basis of the'quipment that 18 we have'.included comes from Combustion Engineering, which, 19 as you know, has designed many NSSS's and have operating 20 procedures. Although the detailed operating procedures are 21 not developed for Palo Verde, we are relying on what has 22 been done on other plants, and then to that basic equipment 23 which Combustion requires which. is directly nec'essary to 24 keep the reactor cool, we added oux'upporting systems which were necessary to keep that equpment running such as HVAC GRUMLEY REPORTERS Phoenix, Arizona
~ '
~ o
-0 4
127 and things like that and the cooling water systems that are P
part of the balance of plant. So, obviously, as we get W
into the detailed operating procedures, it is highly unlikely that we are going to find anything that we need that is not already on hexe. If we do, then we will have to make a design change.
MISS KERRXGAN: So that is a commitment on your part.
I take it that is a commitment.
IJ MR. KEITH: Ne intend to meet the requirements.
10 MISS KERRIGAN: You will make a design change. If you find that the operating procedures require more equipment 12 you commit to make that design change to get that equipment 13 on the remote shutdown panel.
14 .MR. KEITH: If it is equipment required for hot 15 shutdown. Hot shutdown we are doing at the xemote shutdown 16 panel. For all other equipment, we can control it. outside 17 the control room, but not at the remote shutdown panel.
18 MISS KERRIGAN: Through manual procedures?
19 MR. KEXTH: Yes.
20 MR. STERfING: Dennis, would it. be a fair. statement 21 then that in the design of the plant utilizing Combustion's 22 interface requirements for remote shutdown that you have 23 designed the plant to be shut down using the functions laid E
24 out on this panel?
25 MR. KEITH: That's correct.
GRUMLEY REPORTERS Phoenix, Arizona
II' l28'R.
STERLING: And by design, you don'0 need any more functions for hot shutdown than what'are'n the panel?
MR. KEITH: That's correct.
MR. STERLING: And. for cold shutdown, what is on the panel plus your additional local instruments.
MR. KEITH: Yes.
MR. STERLXNG: Xt would be up to APS then to implement those pieces of equipment to shut down.
MR. KEITH: I didn't understand the last statement 10 you made there.
MR. STERLING: In procedures, then it, would be up to 12 APS.to implement that equipment according to the design to 13 shut down the plant.
14 MR. KEXTH: Yes, APS will develop the operating 15 procedures to shut down the plant.
MR. STERLXNG: Utilizing that equipment.
17 MR. KEITH: Utilizing that equipment, y'es.
18 MR. ALLEN: Carter, did you have a question?
19 MR. ROGERS: Yes. Dennis, I believe that there are 20 procedures for shutting down the plant which are being, used 21 or have been used on our simulator which is in operation at 22 the present time. Has anybody taken this list of equipment 23 on the remote shutdown panel and compared it against those 24 procedures which have been developed for the simulator?
25 MR. BINGHAM: The procedures that we have been using GRUMLEY REPORTERS Phoenix, Arizona
o d
l29 to develop the simulator have not been plant specific, procedures. 'I think they fall in the same category, Carter, as the procedures or the input that Dennis was talking about.
The development of =the simulator was based also on inputs from the Combustion Engineering equipment we required for the Palo Verde System 80 plant. I think what I heard asked or I thought I heard Janis say was that if for some unlikely reason when you finally get all the specific operating procedures wiitten and you are not able to take the plant to 10 hot shutdown, then would there be a modification to correct the deficiency, and I think we said of course.
12 MR. ALLEN: Go ahead.
13 MR. MECH: How do you plan 'to limit the access to 14 the remote shutdown area? It has doors I noticed on Figure 15 '2Bl-4 where it shows the doors.
16 MR. BINGHAM: Why 'don'0 we put that figure up so we Figure 2Bl-l, these are the 'fire doors 4
17 can see? On this 18 we are talking about. here (indicating) . ~
19 MISS KERRIGAN: We are talking about an interface, 20 really, between your security procedures and not.being in 21 conflict with the need for quick access to the remote II 22 shutdown panel.
23 MR. BINGHAM: I am not, 'sure that we have exactly how they are controlled or will be controlled. I know they J
25 'ould be tied in with the security system and part of the GRUMLEY REPORTERS Phoenix, Arizona
'1 iI 0
130 fire protection requirements.
MISS KERRIGAN: It might be more appropriate to direct the question to APS.
MR. ALLEN: Norm, do you want to answer it? Before 5 you do, -though, use your own judgment on divulging any
'security information.
MR. HELMAN: Those doors labeled (C) and (D) here and the interim door are controlled and require a high level of access. Does that ans'wer your question? ~
10 MR. MECH: For an instant, F
it looked like you might have to go through there to get to- the one switchgear room, for example. It might be easier to do that perhaps than 13 going around some other way. It looks like it might be a 14 passageway.
15 MR. HELMAN: That's true. There is another door over on the right-hand side of the picture that you see up ther'e 17 to access the Train B ESP switchgear room and that is the 18 normal access. This other is by higher level controlled 19 access, .shall Ve say.
t I 20 MR. ALLEN: People that have to get in, there will have
'21 the necessary clearance to get in there and nobody'lse will.
1 I
22 MR. MECH: Another question. On Exhibit 2B1-5, you 23 state on Item 7 that, there is parallel control between the 24 control room and the remote shutdown panel. Can you provide I
25 some -idea of the thinking behind that parallel .,control?
GRUMLEY REPORTERS Phoenix, Arizona
~i 131 This seems to depart from the usual. method, which is to lock out the control from the control room when the remote 3 shutdown area is being used.
MR. BXNGHAM:. We will have Dino give you a response.
MR. SOTEROPOULOUS: The rationale behind parallel control for all of our circuits and not using any lockouts is to keep the reliability of our control circuits up. Any time you add components to a control system, you degrade the reliability of those'circuits in question, so our circuits 10 are basically designed with continuous parallel control active at all times. With the controlled "access to the switchgear rooms and the remote shutdown panels, we preclude 13 the potential of people going in and operating components.
14 MR. MECH: Xs there communication between the remote shutdown panel and-the control room?
16 MR. SOTEROPOULOUS: Yes, sir.
17 MR. MECH: So if .you had an operator there, you could 18 talk to him?
19 MR. SOTEROPOULOUS: Yes.
20 MR. MECH: That would be under not emergency condition 21 "but under normal conditions?
22 MR. SOTEROPOULOUS: There is'communication with the 23 control room from that area, yes.
24 MR. ROSENTHAL: Prom an equipment rather than a human standpoint, I am concerned that equipment failures at the GRUMLEY REPORTERS Phoenix, Arizona
0 132 remote shutdown panel may put the reactor in an upset mode and deny appropriate mitigation capability from the control room'. Have you systematically postulated single failures of equipment in the remote shutdown panel for all the systems involved and found that you have adequate control from the-control room?
MR. BINGHAM: Jack, just for clarification, we designed the plant to take a single failure. Had you some other complication in mind that would go beyond the single 10 failure criterion?
MR. ROSENTHAL: No.
12 MR. MECH: One last question. On Figure 2Bl-l, I 13 observe that the remote shutdown panel is in the same buildin 14 as the control room. This is at elevation 100. The control 15 room is up 40 feet, but otherwise the remote shutdown panel 16 is substantially fairly close to the main control room.
17 Have you analyzed to see that some incident, which might 5 \
18 cause the evacuation of the control room will not necessitate 19 evacuation of .the remote shutdown panel? I postulate a fire 20 in the lower cable room.
21 MR. ROSENTHAL: Exclusive of fire.
22 MR.. MECH: Exclusive of fire.
MR. BINGHAM: Would you like to repeat the question?
24 MR. MECH: Have you made an analysis to see that the same condition which might cause the evacuation of the GRUMLEY REPORTERS Phoenix, Arizona
NA 133 control room will not necessitate evacuation of the remote shutdown area?
3 MR. BINGHAM: Dennis will answer the question. I guess the answer to the question is we don't have a formal analysis, but there is a reason. He will give you the 6 reason.
P MR. KEITH: The requirements for evacuation of the control room, there has never been any mechanism postulated P
for that other than a fire, which is under discussion, so 10 we haven't really done an analysis. Because there is no mechanism postulated, there is, therefore, nothing to
,12 analyze.
13 MR. MECH: All right.
/
Thank you.
,14 MR. ALLEN: Any other qu'estions? Jack.
15 MR. ROQSENTHAL: I'm sorry, I'm not sure I had my 16 question answered. Let me give an example. As you 17 systematically look down the list, if the pressurizer 18 backup heater Group l failed'n an "on" demand signal, which 19 is surely an anticipated operational occurrence, a minor 20 upset to the plant, do the procedures reflect should this 21 event happen the operator's attempt to defeat that'nadverten 22 I
"on" signal whether it comes from the control room or the 23 auxiliary shutdown panel?
24 . MR. BINGHAM: I think what we said is that regardless 25 of where you hypothesize it coming from, we have to be able GRUMLEY REPORTERS Phoenix, Arizona
,H t
IL h
I
l34 to deal with the issue, the single failure. In this particular case, I am not sure exactly how we have handled 3 that. Maybe I am getting off MR. ROSENTHAL: Yes. I was looking for a programmatic answer more than a specific answer for any one system. It would seem to me that if the operator realized that he had an inadvertent demand signal in the control room, he would obviously in the control room attempt to trip the actuated device on the component l'evel to savethe day. We also 10 can start. postulating failures on the remote shutdown panel, which is now an active and parallel system rather than 12 isolated by a transfer switch, and again is the operator's 13 training and procedures such that he would in a similar and 14 like fashion to faults in the control room mitigate a 15'6 failure due to faults from the remote shutdown panel?
MR. BINGHAM: Jack, let's see if we can answer this.
17 I will have Dino answer it again. I would indicate one 18 thing, that. in .the control room, I am not sure that. the 19 operator would know where the signal is coming from regardles 20 so I am not sure that is an issue, but let's go through 21 the rationale. I 22 MR. SOTEROPOULOUS: The question of parallel control 23 from the control room with the remote shutdown panel, the 24 only controls that are there that are in fact parallel and 25 active are digital on/off controls for pumps specifically.
GRUMLEY REPORTERS Phoenix, Arizona
135 The one control that is down there for analog is for the feed pump turbine, and that is in fact transferred, because we can't have an analog signal from more than one place at a given time. The on/off switches that are on that panel, 5 we don'0 feel as though l
it is credible to have a'fault 6 signal, from a manual "off" switch. There isn'0 a credible failure that. could give you a signal 'from the remote shutdown panel if nobody is there other than some event which is that subject we are not talking about which is addressed someplace 10 else.
MR. ROSENTHAL: I think we have traditionally 12 postulated a simple short of a toggle switch as an initiating 13 event. I am not saying that that event can'0 happen or that 14 you should design such that it won't happen, but, rather, 15 are the controls then in the control room through the 16 emergency procedures and the operator's training sufficient such that he, suitably copes with 'those events?
18 MR. KEITH: It seems to me the cpxestion you are 19 asking really doesn't have anything to do with the parallel 20 controls, but it is just a general one of, say, if we had 21 a switch in the control room that failed and turned the 22 pressurizer heaters on -and you couldn't turn them off from 23 the control room, then the operator would have to go and 24 E
pull fuses or whatever was necessary to de-energize them.
25 There is flexibility at the local switchgear and local motor GRUMLEY REPORTERS Phoenix, Arizona
I, control centers or whatever to do those kinds of things.
MR. ROSENTHAL: And his procedures and training are such that if the single random failure occurred't the remote shutdown panel, he would take perhaps the same actions or parallel actions as he would take if the. single random failure occurred in the control room?
MR. KEITH: The procedures would be the same for .the remote shutdown panel as they would be for the control room.
MR. ROSENTHAL: When they are written.
10 MR. BINGHAM: When they are written.
MR. ALLEN: I guess, Jack, I really don't know what 12 you are looking for right now. Are you looking for a, 13 commitment from APS that we will write procedures? I think 14 that is a foregone conclusion.
15 MISS KERRIGAN: No, I guess what we are saying is when you do write your procedures, you assure yourselves 17 that in event of failure at the remote shutdow'n panel, you 18 utilize those same procedures and the operator's training is 19 such that he would use those same procedures and would 20 recognize that it is da-da-da-da-da..
21 MR. ALLEN: Let's take that as an open item and assign it to APS.
H 22 23 MR. BINGHAM: All right.
24 MR. ALLEN: Any other questions?
25 MR. ROSENTHAL:
I I have one more question. Do the GRUMLEY REPORTERS Phoenix, Arizona
e
137 A and C channels of instruments come to the same panel?
Within the panels, do you follow Reg. Guide 1.75?
MR. KEITH: 'es.
MR. ALLEN:, Any further questions?
MR. STERLING: I have one. On Figure 2B1-2, your remote shutdown controls have no override feature nor are they tied to the sequencer. Is that because of the criterion that you are assuming no DBA at the time that you go to the remote shutdown panel?
10 MRS.. MORETON.: Yes.
MR. ALLEN: Any further questions from the Board?
12 MISS KERRIGAN: I would like to give a little bit 13 more clarification on the question'that was discussed before.
14 Since you do have a parallel system, then your procedures should reflect the fact that somebody down at the remote shutdown panel isn'0 in conflict with somebody in the control 17 room doing things at cross purposes.
18 MR. BINGHAM: Let me add a point here, because we 19 seem to be getting a little confused. At least, I am.
20 People can be at the switchgear. and do things that would be 21 equally as concerning to the operator, so whether it is the it k
22 remote'hutdown panel, the switchgear, or whatever, is still a problem that has to be dealt with and written into 24 the emergency procedures I would believe. Is that correct?
MR. ALLEN: Plus the security system will go in that GRUMLEY REPORTERS Phoenix, Arizona
A "I
'4
~ '
l38 room. You know darned well if something is in that room, the operator is going to be aware of it. So, actually, 3 I think the remote shutdown area would be safer than maybe the switchgear or something else as far as knowing someone is there.
, MR. BINGHAM: . I think one of your panel members had a question down there.
MR. MARSH: I would like to just ask a clarification type question along those lines. It would occur to me that 10 without having a transfer switch on that remote shutdown panel, the potential types of failure modes would be fewer, 12 in fact, and that the analysis that was done would be simplie 13 with this particular design for parallel control. In other 14 words, if'the transfer switches were provided, wouldn'0 all 15 of the same kinds of failures and perhaps some others as 16 well be possible from the transfer switch itself? 'Is that 17 a true statement?
18 MR. BINGHAN: That is a true statement.
19 MR. BESSETTE: I would also like to add what, I think 20 is clarification to this issue. In the event. that you .do 21 have'a hot short in the remote shutdown panel that energizes 22 your heaters, if you want to take this example, you will 23 still have indication in the control room that your heaters 24 are on, you will have indication tha't the pressure is 25 increasing, you probably will receive a high pressure alarm, GRUMLEY REPORTERS Phoenix, Arizona
0 0
139 you would get indication that your sprays are running more frequently, or backup. I think you have an auxiliary spray.
In any case, all these indications are available to the operator. I am not.sure that it is a factor in emergency
'rocedures .so much as it is the operator's normal training 1
to recognize that my heaters are on, I can'0 shut them off, my pressure conditions are increasing. Similarly, where a pump is .energized, should it be a pump or something as opposed to heaters that you turn on again, .he would have 10 indication that. this device is running. Again he would have positive indication he can't de-energize. It seems a rather 12 logical sequence that the operator would follow in diagnosing 13 that this fault has occurred and it is again a logical 14 process that he would go through in correcting the problem 15 as opposed to making that a factor in the emergency procedures.
17 MXSS KERRIGAN: He would just be using 'normal 18 emergency procedures.
19 MR. BESSETTE: I am comparing emergency procedures simple diagnostics of a'ault that the operator becomes f'o 20 21 aware that conditions are digressing- and he follows some 22 logical path because of this training to narrow the problem 23 out to its source and either himself or the fuel people take 24 other actions to de-energize and correct it if he does not 25 have control of it. What I am saying is it is just a part GRUMLEY REPORTERS Phoenix, Arizona
14O of the operator's logical process of training.
I MR. ALLEN: Anything else?
Go ahead, Bill.
MR. BINGHAM:. The next section we would like to cover is 2.C., Safety-Related Display Instrumentation.
MRS. MORETON:. Figure 2C-1 represents the safety-7 related display instrumentation which is available to the 8 operator to allow'im to monitor conditions so that he may perform manual actions important to plant safety. This 10 consists of sensors., monitoring process system variables, the NSSS ESF, ESF support, BOP ESF, and the reactor trip system to provide displays in the control room to the 13 operator. The NSSS system includes the safety-related 14 plant process display instrumentation, reactor trip system monitoring, ESF systems monitoring, CEA position indication, 16 and post-accident monitoring. What we will be covering today A
17 are the BOP systems, which include process monitoring 18 including the ESF systems monitoring,,post-accident monitorin 19 and our automatic bypass indication system called the I
'20 safety equipment status system.
21 I would like to go first to the 'process instrumenta 22 tion design criteria, Exhibit: 2Cl-1. Design Criteria for 23 process instruments come from the piping and instrument 24 diagrams, detailed design criteria for the process system, 25 and general codes and standards are provided to meet:the GRUMLEY REPORTERS Phoenix, Arizona,
~ i 0
0
141 i
IEEE and GDC. Additional design criteria're as follows:
Ct instruments shall be provided to operate at a nominal 115 volt-AC supplied to instrument. cabinets. Controls and 4 annunciators shall operate at 120 volt-AC or 125 volt-DC nominal. The maximum and minimum voltage limits for the 120 volt-AC and 125 volt-DC systems are given in the electrical systems design criteria.
Exhibit 2C1-2. Resistance temperature detectors, RTD's, shall utilize a three-wire circuit. The RTD sensors shall have a resistance of 100 ohms (preferred). Exceptions will be considered on a case-by-case basis. Thermocouple 12 materials shall be chromel-alumel, Type K. Electronic 13 transmitter loops shall utilize a current range of 4 to 20 14 milliamperes. Pneumatic loops shall utilize 3 to 15 psig instrument air. Critical data acquisition, alarming, and 16 protective controls are energized from a DC power source.
All control systems designs shall include shie1ding, groundin and physical separation provisions which will minimize the 19 effects of high voltage switching surges, inductive coupling, 20 and onsite radio transmission signals. Aluminum shall not be used in or around equipment containing or producing 22 ammonia. Aluminum and zinc shall be excluded wherever 23 possible from instrument and control device casing which are in the containment and could be exposed to the containment spray fluid. Exposed aluminum shall not be used for GRUMLEY REPORTERS Phoenix, Arizona
e, n
142 instruments installed in the circulating water system where contact with the circulating water is possible.
Exhibit 2Cl-3. Provisions shall be made such that the response time testing can be performed on safety-related channels. Nuclear instrumentation and .radiation monitoring indicators and records shall have log scales and charges. All. other indicating and recording devices with the exception of motor current. indicators shall be linear direct reading with a minimum scale length of four inches.
10 Wherever possible, alarms shall not be initiated from indicators or recorder contacts. In-line paddle type flow 12 switches shall not be used. Magnetic type flow meters 13 are perferred for sludge or slurry'service. Flow elements 14 shall be sized, wherever practicable, for 100 inch water 15 and design flow shall,. be 85% of range. Equipment control 16 circuit status shall be indicated on the control room 17 control panels along with the equipment. status'. All 18 overrides of Engineered Safety Features Equipment shall be 19 i,ndicated. In general, time delay rel'ays shall not be used 20 to bypass short, time nuisance alarms upon equipment startup.
21 Nuisance alarms shall be bypassed upon manual shutdown of 22 standby, or redundant components.
23 2Cl-4. Mercury shall not be used for any
'xhibit 24 application within the containment building, spent, fuel pool
- 25. area, boron recovery area, chemical and volume control areas, GRUMLEY REPORTERS Phoenix, Arizona
0 l43 or in the radwaste building. Switches using mercury, whether encapsulated or not, and mercury-wetted relays shall not be used in safety-related equipment.. Mercury shall not be used in instruments in direct or indirect contact with the primary coolant system, the feedwater and condensate systems, or systems which provide makeup to the primary, feedwater, and condensate systems. Instruments containing mercury for level, pressure differential pressure, temperature, or flow switches may be used outside of the 10 specific mercury exclusion areas and systems. Only hermetically-sealed mercury switch assemblies contained 12 within NEMA-4 housings shall be used. Care shall be taken 13 in selecting instruments for use such that a broken mercury 14 switch capsule shall not. result in mercury entering sumps.
15 Switches which will contain the mercury within the instrument 16 case may be used. An example is the Hagnetrol type switch.
17 Exhibit 2C1-5. Mercury manometers shall be 18 restricted from use in the plant operating process 19 instrumentation, but may be used in'instrumen't shops. All 19 20 systems shall include the required straight runs for flow 21 measurement nozzles. Flow metering runs shall be in 22 accordance with ASME Publication, "Fluid Meters, Their Theory 23 and Application," Supplement to ASME Power Test Code 19, 24 We will proceed now with 'the Process Instrumentatio 25 System Description, Exhibit 2C1-6. A typical process GRUMLEY REPORTERS Phoenix, Arizona
144 r
instrumentation loop consists of sensor, processing electronic and display. Various sensors include thermocouples and RTD's, pressure tr'ansmitters including differential pressure transmitters for level and flow monitoring, radiation monitors, example Beta scintillation, Geiger-Mueller,
'analyzers such as hydrogen, which is thermal conductivity, or chlorine, which is chemically impregnated paper tape, and float and displacer type level instruments. Processing electronics include signal converters such as I-to-E, E-to-E 10 isolators, square root extractors, and bistables.'2 Processing electronics are housed within control room
'abinets. Two separate Class IE cabinets are provided, 13 A and B, and separate non-IE cabinets are provided.
14 Exhibit. 2Cl-7. Types of displays include 15 indicators, recorders, indicating lights, and annunciator.
16 Figure 2C1-1 is a typical instrument loop diagram.
17 This one happens to be for the fuel building HVAC system.
C 18 It shows a transmitter with a 40 milliamp signal going to .,
19 the signal converter, .which is in the'ontrol ro'om processing 20 rack. It goes to '-a b'istable which causes annunciation via 21 the isolation cabi'net and display on the'ain control board.
22 Some of'ur process instrumentation for the II 23 Engineered Safety Features System i's provided in Exhibit,t 24 2C1-8. A typical example would be 'the fuel pool 'area 25 radiation mo'nitor located, in the control room with 'a range GAUMLEY REPOATERS Phoenix, Arizona
~ '
145
-1 and per hour, displayed accuracy of plus or E
4 of 10 10 .mR minus 20%. Additional examples follow on Exhibit 2Cl-9 through 2C1-10, ll, and 12. This covers our BOP ESF system.
We also cover in this table the auxiliary feedwater system, including the pump discharge pressure indicator in the control room.
Exhibit 2Cl-13 also indicates the rest of the auxiliary feedwater instrumentation, and the ESF status panel indicates system availability. This we will discuss
'10 as part of the SESS in the following presentation.
MR.'XNGHAM: I believe that we will go ahead and 12 present, 2.C.2, Safety Equipment Status System, John, and 13 then we can have questions at that time.
MRS. MORETON: Going on to 2C2-1, Design Criteria 15 for the Safety Equipment Status System, the safety equipment status system shall function to alert the operator by visual 17 and audible means insofar as practicable at, a 'system level 18 when any piece of automatically actuated ESF equipment has 19 been bypassed or rendered inoperable and',";not available for 20 use. The SESS shall also, in the event of, an ESFAS, monitor 21 all of the ESF components and alert .the operator by visual 22 and audible means when any piece of equipment has not 23 completed the transition to the safe operating position.
24 The safety equipment status system will be designed in
'25 compliance indicated on Exhibit 2C2-1 and continued on GRUMLEY REPORTERS Phoenix, Arizona
V,f l
f e
146 Exhibit 2C2-2. The system shall consist of two portions, one reporting the status of safety Train A'quipment, the 3 other reporting the status of Safety Train B equipment.
The system shall accept channelized Class IE associated inputs. The system inputs are Class IE associated;. therefore the system shall be powered from Class IE 125 volt-DC power supplies. Status contacts shall continuously monitor the availability of control power'nd the position of circuit breakers of all automatically actuated ESF devices. A loss 10 of control power or. deliberate racking out of a breaker shall automatically indicate at the component level the 12 device which has been rendered inoperable. Simultaneously, a system level indication with audible alarm, shall be 14 initiated. Proceeding with the design criteria, Exhibit 2C2-3. The capability for initiating a manual bypass indication and alarm is provided to indicate the bypass 17 condition to the operator for those manual valves and other I I 18 components which are not automatically monitored. The 19 initiation and removal of manual bypass indication will be 20 under administrative,,contxol.. A system of status contacts 21 shall monitor the safe operating position of all automaticall 22 actuated ESF devices during an ESFAS. These status contacts 23 shall automatically indicate at the component level the
'24 device which has failed to automatically complete the 25 transition to the safe operating position within a normal GAUMLEY REPORTERS Phoenix, Arizona
')
147 time period. Simultaneously, a system level indication with audible alarm shall be initiated.- All systems affected by the bypassing or inoperability of,a given component which is shared by multiple systems automatically generates a bypass/inoperable audible and visual alarm in each system affected. Indication and annunciation test capability is provided by simulating a trouble contact condition when the test button is depressed. The test feature is independent for each channel. A minimum of two lamps, connected in 10 parallel, shall be furnished for each annunciator window, indicator window, and indicator switch.
12 Exhibit 2C2-4. All components, including Solid-13 State devices, transformers, resistors, and relays, shall 14 be of a quality and shall be used in the system in a way 15 that will ensure high reliability, minimum maintenance 16 requirements, and low failure 'rates. Ease of maintenance 17 shall be a primary consideration in the equipment design of 18 all components operated below their electrical and thermal 19 rated values, taking into account all possible combinations e
20 of operating environments, power source ranges, and transient 21 conditions. The safety equipment .status system shall be 22 located in the control room and seismically qualified to 23 the following acceptance criteria: Structural failure which would .cause the system logic cabinets and/or window displays 25 to dislodge from, their mounting or cause any part of these GRUMLEY REPORTERS Phoenix, Arizona
0 148 subassemblies to detach and fall during an OBE and SSE shall not be permitted. The equipment, shall not cause short circuits or spurious signals that would adversely affect the Class IE equipment providing inputs 'to this system.
f We will now go into the Safety Equipment Status System Description starting with Exhibit 2C2-5 and referring to Figure 2C-1A on the system arrangement of the safety equipment status system. The safety equipment status system consists of two physically separate systems shown here (indicating). One of these systems provides monitoring and annunciation for safety Train A equipment. The other system'provides .monitoring and annunciation for safety Train B equipment. Each of the train-related systems consists of system level window cabinet, component level indicator light panel, system control panel', logic cabinet, audible alarm devices shown here (indicating), and inter-connecting cables.
Exhibit 2C2-6. Each of the train-related systems performs indication of safety equipment actuated status hand safety equipment inoperable status. Each of the train-related systems is powered from a separate 'Class IE 125 vol<-
DC distribution bus. The annunciation sequence of operation and testing -for SESS alarms 'is the same as that for the plant annunciator. The safety equipment actuated status GRUMLEY REPORTERS Phoenix, Arizona
,I Jl 0
149 logic is shown in Figure 2C2.
Exhibit 2C2-7. The SEAS logic continuously monitors the operating status of ESF and ESF support 5
system actuated devices, continuously monitors the status of ESFAS signals down here on the bottom of the figure (indicating), provides-"failure -to automatically actuate" I
annunciation if all actuated devices this would be all devices for a particular system do not transition to the "safe" position required to 'perform the ESF system function 10 after receipt of an. ESFAS signal and an allowable transition E time. This time is adjustable to meet the transition 12 requirements. This annunciation is audible and indicated 13 on the system level window cabinet, which is in the main 14 control zoom. It provides indication of components oz 15 group of components which failed to transition to the "safe" 16 position. This indication is on the component level 17 indicator light panel, and that is indicated b'y these blue 18 lamps (indicating). It provides "failure to automatically 19 actuate" annunciation if all the actuated dev'ices in a suppor F
20 system do not transition to the "safe" position required to 21 perform the ESF support system function. The support system 22 interface in the logic diagram is shown here {indicating).
23 If the support system is required to actuate and does not 24 transition, it will cause an alarm for that system, or if 25 this particular system is a support system to another ESF GRUMLEY REPORTERS Phoon(x, Arfzona
0 4
I 0
t 1
~,
0 t
l50-system, it will provide input logic to that system's logic.
Exhibit 2C2-8 and Figure 2C-3 will describe the 3 logic of the safety equipment status system inoperable status. The SEIS logic continuously monitors the "avail-ability" of. ESF and ESF support .system components, shown-here as the component "available" to respond to and perform rt ESF system functions when required.
b'he Availability consists of the following as appropriate: Availability of control power to actuate the device, circuit. breaker is 10 not racked out, or manually operated valve intended for use more than once a year is properly aligned. The SEIS logic 12 provides "inoperable status" annunciation if any monitored 13 component in a system is not available to perform its 14 required function. This is at the system level, the 15 annunciation. It provides a means to manually initiate 16 system "inoperable status" if a manual valve intended for 17 use less than once a year or other component i's removed 18 from service. This initiati'on is under administrative 19 control. It is provided here (.i.ndicating) with 'feedback 20 to the operator in the form of a white light. It provides 21 "inoperable status" annunciation if any support, system 22 monitored component is inoperable or has a manual "inoperable 23 sta'tus" initiation. The support system interfaces are tl 24 shown.
ll Figure 2C-4 is a figure that shows the SESS GRUMLEY REPORTERS Phoenix, Arizona
15 system level annunciator panel in the main control room.
This would be identical for Train A and a dublicate one for Train B.
Figure 2C-5 is the control panel where the operator
,5 may manually initiate "inoperable status" of a manual valve that is used less than-once a year is rendered inoperable.
Xt is under administrative control. This (indicating) is also the test pushbuttons to perform system tests.
Figure 2C-6 is a layout of the component status 10 panel.
Ne have some slides of these. This slide is a 12 photograph of the safety equipment status system BO2 or 13 the ESF panel on the simulator, which is identical to the one in the main control room. These two windows up at the 15 top of the slide, one for Train A, one for Train B, are the system level alarms. The panels right below them, one 17 for Train A and one for Train B, are the compo'nent- level 18 windows. Directly below that on the lower portion of the 19 control panel 'are the two control panel inserts for the 20 SESS.
21 Looking at a closeup of the system level annunciato 22 this slide shows you the windows and a closeup of the 23 indicator panels.
24 On the logic diagram, you noticed there were two lights, a blue light and a white 'light, for each system.
GRUMLEY AEPOATERS Phoenix, Arizona
/
152 On the annunciator panel and on the indicating light panel, the white light is in the upper half of the 'annunicator or in the component level, and this indicates inoperable status. There is a blue lamp, two sets actually, in the lower half of each component window in each annunciator panel which indicates a failure to automatically actuate.
This gives the operator component level feedback of either failure to auto actuate or inoperable status.
This is a photograph of the system control panel, and on the next slide, this shows the illumination of the upper white light., which indicates that. the operator has pressed his pushbutton indicating back to him that the system has been manually put into a bypass state because some manual valve was racked out.
15 This slide is just an example of our control room indicator. This happens to be the HVAC intake chlorine 17 indicated on. the main control panel.
18 This j.s our- mock-up model of what the indicators 19 look like on the control board. This little 'lower segment 20 here (indicating) is the'ndication that will light up to 21 i,ndicate the process variables.
22 The last slide we have shows an example of our 23 recorders. These are for post-accident monitoring recordexs.
24 The red nameplate indicates these are all in Channel A, 25 strip chart and indication on the recorder with 'the lights GRUMLEY REPORTERS Phoenix, Arizona
4' indicating power availability.
MR. BINGHAM: Any questions?
3 MR. STERLING: At'the Combustion IDR, there was some concern over what, indication the operator would receive from this instrumentation in the control room or the indicators upon, loss of power'. Could you briefly discuss. what happens to the indicators when the power goes out?
n MRS. MORETON: The PVNGS displays are Foxboro Model 10 270 indicators. On. a loss of power to the rack, the indicators will completely go out,. They do require l20 volts 12 to illuminate them, and it will just extinguish. On loss 13 of power, to the recorders, the small light you saw at the 14 bottom of the recorder will go out.
15 MR. STERLING: Are there not cases when the indicator 16 will either go full-scale high or low or will sit there and 17 fluctuate center? Are there failure modes in 'these indicator 18 either because of power failure or sensor failure 'or whatever 19 it is that would cause 'a false- reading on these types of 20 -neon discharge indicators?
21 MR. BINGHAM: I am not exactly sure whexe the.
22 question is heading.
23 MR. STERLING: Well, for example, on the simulator, 24 we di,d have the problem of chl;ps inside that caused these 25 things to go haywire either full-scale high or low..
GRUMLEY REPORTERS Phoenix, Arizona
154 MR. BXNGHAMz That's right, but that wasn't a production model simulator.
MR. STERLXNG: No, I understand that. That problem 4 has been fixed. What I am trying to get at is the operator going to be misled by some failure in, the'se Poxboros either in the power supplies to the indicators or to the loops that they sit. in that is going to mislead the operator?
MR. BINGHAM: Well, we would hope that that isn't the case, and to finish off, I suspect that you could postulate any individual case. where a particular instrument might give a false indication of some kind, but there are other backup instruments and procedures that the operator would use to 13 quickly assess what it was he was seeing, 14 MR. STERLXNG: Xs there a case where that thing could 15 it fail at a reading, reading something and could just fail 16 right there?
17 MR. BINGHAM: T. don't know if that has been the case with the failures that have been seen, and we will go back to Zoxboro experience. Usually the'y were flashing or they 20 weren't exhibiting any reading at all, but I don,'t. recall 21 offhand whether the're was a case or not where it stayed an at a misreading.
23 MR. STERLING: I had another'question on your process 24 instrumentation, I guess Exhibit 2Cl-4. That may not he the right. exhibit. I don't find the right.'exhibi:t, so I will GRUMLEY REPORTERS Phoenix, Arizona
4 155 just ask my question. The lines from the sensors to the transmitters, do you have a criterion there for proper sloping, and so forth, for air entrapment, fluid entrapment'?
That criterion doesn'0 appear in this list.
MR. BINGHAM: It is part of the design standards.
The documents do exist. We didn't list them in this particular presentation. We do have them.
MR. ALLEN: Any questions?
MR. MECH: On Exhibit 2C1-3, this is. your criteria, 10 and it talks about testing in It'em 10. Is it necessary when you do this'testing to remove wires or use jumpers or remove 12 components?
13 MRS. MORETON: Xt may be necessary.
14 MR. MECH: I believe it is a requirement of one of 15 the standards that your testing should be built into the 16 system, your test capability.
17 MR. ALLEN:, Could you identify the stan'dard you are 18 talking about?
19 MR. MECH: ,I don't recall the number offhand.
20 MXSS KERRIGAN: We have it here. We will look it up during the break 'and get back to you on that.
MR. MECH: I have one more little question.
MR. ROSENTHAL: Let me hit it right now. Reg. Guide 24 1;118, which was'issued after the date of your CP, speaks about periodic testing of electrical power and protection .
GRUMLEY REPORTERS Phoenix, Arizona
l56 "systems and Section C-6 discourages. the use of jumpers and pulling fuses, et cetera. Within the context that this 3 Reg. Guide is for protection systems and within the context that the Reg. Guide was published Rev. 02, June, '78, after the date of. your CP date, will you identify where your system is designed such that you have jumpers, fuses pulled, et cetera, and why you feel that's okay.
MR. BINGHAM: Jack, what Mary was thinking about when we were talking about some testing was the fact that an 10 RTD or a thermal weld may have to be disconnected or lab bench tested, and she wasn't focusing on the protection 12 system. Maybe with that clarification, or maybe we can add a
13 some more information, but that was the reason for her 14 response.
15 MR. ROSENTHAL: I called that out and emphasized that to tell you at. least our regulatory basis and how far I 17 thought in a regulatory sense we could push th'is issue. On r
18 RTD's, the response time testing; is deferred from CESSAR to 19 the applicant's SAR in todal with respect to Chapter 7. For 20 RTD's, are you using loop current testing procedures?
21 MR. BINGHAM: Let us take'that as an item to respond 22 to, John, because we do have to talk to APS, unless you have 23 the answer.
24 MR. MINNICKS: We do plan on using the loop current, 25 test response methodology.
GRUMLEY REPORTERS Phoenix, Arizona
- ~
1 0
157 MR.,ROSENTHAL: And that will be documented where?
MR. MINNICKS: There will be procedures developed to 3 that testing by that, procedure that uses that methodology.
4 MR. ALLEN: Any further c(uestions?
MR. MECH: One more quick one., On 2C-3, 4 and 5, if we could flash back quickly and compare them MR. KEITH: The figures or exhibits?
MR. MECH: I think those are figures. They were pictures of annunciator panels.
10 MR. ALLEN: Do you want the slides? Is that what you are talking about?
12 MR. MECH: Five shows a small panel at the bottom and 13 4 does not. Is Figure 4 supposed to have one, also, a 14 panel? 'imilar 15 MRS. MORETON: No. Figure 2C-4 is the system level annunciator windows. Figure 2C-5 is the control panel 17 where the operator will manually initiate a by'pass alarm for 18 a system. This insert here (indicating) is for system 19 testing.
20 MR. MECH: In the FSAR, there is a similar figure 21 for SESS Train A; which I think is the identical one for 22 I think you had two pictures that showed for Train A and 23 Train B with the small panel on the bottom.
24 MRS. MORETON: Those are on the slides, yes.
25 MR. MECH: So Train A will haVe its own panel and GRUMLEY REPORTERS Phoenix, Arizona
1 Train B will have its little panel?.
MRS. MORETON: Correct.
MR. MECH: Okay, that's what. I wanted to know.
MR. ALLEN: Mary, I'e got a question. On Figure 2C-3 you indicated the SESS input logic from support, systems.
Could you touch on it, just give me an example?
MR. MORETON: An example of where you will see this kind of feeding from system to system, you could take the safety injection system, which depends on the essential HVAC, 10 which depends on the essential cooling water system, which depends on the essential spray pond system. You will see an input, as an example, on the essential cooling water system, an input from the essential spray pond system to the essential cooling water system, and one from the essential 15 cooling water system to, as an example, the essential chilled water system.
17 MR. STERLING: Exhibit 2C2-2, Item 4. You say you will accept channelized Class IE associated inputs. Are those buffered inputs from the Class IE systems or are they connected directly to the Class IE circuits?
21 MRS. MORETON: Those inputs come from separate limit 22 switches or breaker'auxiliary contacts from the actuated 23 devices. They are not separated from the IE signals or l
~
cables and they are not isolated.
25 MR. STERLING: Since they are coming from limits which GRUMLEY REPORTERS Phoenix, Arizona
ll e
ll
l59 contact some switch contacts, and so forth, I guess there is no way they could get back to the Class IE function.
On the testing portion of the SESS, if we go to Exhibit 2C2-3, could you explain Item 9? What do you mean by simulating a trouble contact condition?
MRS. MORETON:, There are two test pushbuttons provided to allow testing on the logic. These are an inoperable test pushbutton which will test the SEIS logic and a status test pushbutton which will test the, SEAS logic. Those test pushbuttons -induce a signal into all cards in the SESS cabinet which will cause all lamps on the system level and 12 on the component level to alarm, to light and flash, and then the operator would go through the reset actions to 14 reset those lamps.
15 MR. STERLING: So that is at the input point to the SESS. It would be the same input point as the limit switch from the source device.
18 MRS. MORETON:'es.
19 HR. STERLING: The status test does the same?
20 MRS. MORETON: For the status inputs, inoperable, is 21 coming from'oss of power contacts,- breaker racked out 22 contacts. These are coming from limit switches and breaker e
auxiliary contacts.
24 MR. STERLING: In the action of the 'SESS, you get a 25 safety actuation. On your logic, I guess it is do you GRUMLEY REPORTERS Phoenix, Arizona
i 0
have the one with the blue lights on it? When you get an actuation, that panel will show all blue lights and they will go out as the items are activated?
MRS. MORETON: That's correct.
MR. STERLING: Then after. a suitable time delay, you will not get an audible until after that suitable time delay.
MRS. MORETON: ,That's correct.
MR. STERLING: If you take one of your actuated device l
and put it into bypass or override it but don't change anything, it is not. going to affect, his panel?
MRS. MORETON: That's correct.
12 MR. STERLING: If you take that device and then 13 turn it to the unsafe or to the normal or change it, then 14 you will get an actuation.
15 MRS. MORETON: We will get the blue light and the system -level light and the audible.
17 MR. STERLING: Would you also get a whi'te unavailable light if it goes into override?
19 MRS. MORETON: No.
20 MR. ALLEN. Any other questions.
21 MR. JOHNSON: Yes, on Exhibit 2C2-2, Item 5. Can you 22 explai.'n your rationale for not including a spring charge
'23 contact inavailability of the breaker?
24 MR. SOTEROPOULOUS: There is a limit switch in the spring charge for the breakers lwhich has not been wired into GRUMLEY REPORTERS Phoenfx, Arizona
this system. All of our switchgear. breakers monitor the spring charge with a white monitor light that is down at the switchgear and that is the place where that would be periodically monitored to verify that the motor has wound up the spring for the closing'of the switchgear. It has not been wired into this, system.
,.7 MR. STERLING: Is it not, the case that when those breakers are reset that that motor at that time rewinds the spring and it is latched?
10 MR. SOTEROPOULOUS: Every time you trip the breaker, the motor will wind up the spring for the next closure, t
12 at which time the limit switch will close and there will 13 be a white light that monitors that contact at the switchgear 14 panel.
15 MR. JOHNSON: Your rationale is then that the 16 electrical technician is responsible, not the operator for 17 knowing the status.
18 MR. SOTEROPOULOUS: Yes.
'19 MR. ALL'EN: other questions?
Any 20 MR. MULLIGAN: There are two panels sitting side by 21 side on the SESS and it seems to me like if you have a 22 failure in one train, say Train B, that then your indications 23 are going to be contradictory. Is that right? Which is he supposed to believe, the operator? What kind of action 25 should he take?
GRUMLEY REPORTERS Phoenix, Arizona
~ e l62 MRS. MORETON: The purpose 'of having two panels is to monitor the two separate systems. The Train A panel monitors the Train A components and the Train B panel monitor the Train B components, so the operator would know if he had annunciation in one train that that train was not available. The other train would be assumed to be available.
MR. MULLIGAN: There are also pushbuttons there like for containment isolation signals. You push the button and a whole bunch of valves are supposed to close?
10 MRS. MORETON: No, this is only an indication system.
When you push the pushbuttons, it is done because of an 12 administrative procedure. A manual valve, as an example, 13 is opened for some maintenance reason and would not be 14 monitored automatically, because it is not anticipated that 15 it would ever be open more than -- it would be open less often than once a year. The operator would then under 17 administrative p rocedures p ush the containment'solation 18 button to indicate to himself that the containment isolation system or containment isolation valves are not available.
1 19 20 Pushing that pushbutton causes no system action;- only 21 indication.
22 MR. MULLIGAN: On containment isolation signals, 23 I think there are some valves on both sides of the wall, so 24 there is a lot of lines. How does the logic work, that both valves have to be closed or )ust one to say that you GRUMLEY REPORTERS Phoenix, Arizona
1
~
163 have isolation on that line?
MRS. MORETON: The safety equipment actuated status logic would monitor the Train A valve and Train B would monitor the Train B valve. The operator would have to form the conclusion.
MR. MULLIGAN:. So in a situation like that where they are both inside containment and outside containment, one is on Train A'and one is on Train B?
MRS. MORETON: Right.
MISS KERRIGAN: I have a logistical question. A lot of the information that we are discussing like that on the control room panel display, will that, be reproduced in the control room design presentation that is coming up in a few weeks?
MR. STERLING: What. exact information are you looking I
for?
MISS KERRIGAN: Annunciatox status and blue lights, white lights, what lights on the panels, and things.
MR. STERLING: We will report on the adequacy of the presentation as far as the information being given to. the operator for him to do his job. We won't be providing a design document. on the SESS per se. The SESS part of the control board is being looked at to assure that its presenta,-
tion to the operator is MISS KERRIGAN: That's what' am asking. That will GRUMLEY REPORTERS Phoenix, Arizona
II III h
e Qo 1'
164 be almost readdressed then in the control room Design Review Board.
3 MR. ALLEN:'nything further? Jack.
MR. ROSENTHAL: Yes, please. Item 4 on Exhibit 2C2-2.
I would like to-explore the question of associated circuits a little bit. more. ,I recognize that in'evolving interpreta-tions of IEEE 384, people may or may not have considered a simple contact as an isolating device and now intend to provided there is physical separation. It's fine that it.
10 is treated as an associated circuit. That's proven. How much of the stuff really is associated as distinct from 12 being buffered circuits by virtue of having a switch contact 13 which is physically isolated from the actuated device?,.
14 MR. BINGHAM: We believe it is all associated and we would leave it that way.
4 15 16 MR. SOTEROPOULOUS: The system is associated in fact, 17 not only the cable to it, the circuits to it, 'but the whole 18 system is addressed as an associated system, if there were 19 such an animal. By virtue of the fact that it is physically 20 and electrically separated Train A, Train B, with 1.75 21 separation, we consider them associated systems.
22 MR. ROSENTHAL: Bearing in mind that our Reg. Guide 23 1.47 has no requirements on the quality. of the hardware, can you telL us if this is a computer'ased system or is 25 it a hard wired?
GRUMLEY REPORTERS Phoenix, Arizona
t V
1 u
165 MR. SOTEROPOULOUS: It is a hard wired logic system, hard wired logic.
MR. ROSENTHAL: Has it been designed? Is the design complete?
MR. SOTEROPOULOUS: Yes, the design is complete.and it has been fabricated and .delivered.
t MR. ROSENTHAL: I am concerned about completeness of indicating on the systems level the failure of support systems. Can you make some programmatic statement that you monitor all support. systems -- lube oil, component cooling, electrical, HVAC?
MR. SOTEROPOULOUS:, Yes, all support systems. .We have the capability to alter that. as necessary as our designs change by hard wire programming, jumper programming as you would an analog type of patch panel affair. We can alter the number of inputs, tie one support system to another support system as necessary as our designs evo'lve.
MR. ROSENTHAL: The last thing is the operator's V procedures and training, especially his training, does that include a description of this panel and the interrelation-ships that are being displayed by the panel?
MR. ALLEN: Yes.
MR. STERLING: Yes.
MR. BINGHAM: Yes, it does.
MR. SOTEROPOULOUS: The system sort of evolved GRUMLEY REPORTERS Phoenix, Arizona
166 addressing the regulatory requirements of 1.47, which really only impose as a requirement for monitoring the availability 3 of safety systems. It became evident with all of the wiring that was brought. into this panel that it would be a very simple addition to "monitor the position status .after an event as well, and that is why it,,sort of grew into the two halves. It was very convenient to do it that. way even though there was no requirement to do this at the time.
MR. BINGHAM: Any other questions?
10 MR. MECH: Are any of these annunciators that you showed the first-in type?
12 MR. SOTEROPOULOUS: Not this system. The normal 13 station annunciator does have first-out capability.
14 MR. ALLEN: Our schedule called for taking a. break k
15 at 3:00. It is now ten after. Why don't we take about a 16 15-minute break.
17 (Thereupon a brief recess was taken, after which 18 proceedings were resumed as follows: )
19 MR. BINGHAM: There was a question about the under-20 voltage setpoints. The drop out is at 68% and the pick up 21 is at 75%.'et's proceed then with 2C3, Post-Accident.
22 Monitoring-. John, I think in the interests of time, we won'.t P
23 go through the criteria -in as much. detail as we have, because 24 you can read i< from the exhibit. If there are some particul clarifications, we will come back and pick those up.
GRUMLEY REPORTERS Phoenix, Arizona
l 0
167 I
MR. ALLEN: Bill, could you j.ndicate what you would like to try to go through tonight?
3 .MR. BXNGHAM: Yes. We would like to get through 3.F.
MRS. MORETON: Exhibit 2C3-1, Post-Accident Monitoring Design Criteria. These are the design criteria and the entire post.-accident. monitoring sections not currently in 1
the PVNGS. FSAR. These are the design criteria the Project is adopting and this information will be provided in the FSAR when it is finalized.
10 Design criteria for post-accident monitoring come from Regulatory Guide 1.97, Revision 2. The design 12 and qualification criteria categories are unique definitions 13 to PVNGS to sort of put it in the design framework that we for the different categories. These are our interpreta-I'se 14 15 tions of the requirements out of Reg. Guide 1.97, Revision 2, for the various categories.
Category l. Xnstrumentation is qualified in 18 accordance with Reg. Guide 1.,89 and Reg. Guide 1.100.
19 Instrumentatio'n is designed to accommodate single failure.
20 Instrumentation is powered from Class IE. Instrumentatian is 21 available prior to the accident as required by the Tech..
22 Specs. or XEEE 279, Paragraph 4.11. Xnstrumentation is 23 Quality Class'.
l 24 Exhibit 2C3-2. Continuous indication is provided.
25 Recording shall be provided on one channel. Transmission of GRUMLEY REPORTERS Phoenix, Arizona
168 F
signals for use other than post-accident monitoring shall be through isolation devices. Types A, B, and C instruments 3 shall be specifically identified on the control panels.
Category -2. Sensors shall be qualified in accordance .with Reg. Guide l.89. Seismic qualifications will be provided when instrumentation is part of the safety-related system. Instrumentation's powered from a non-Class IE instrument bus which has,Class IE power as a backup, or they may be powered from Class IE power. The 10 out-of-service interval, is based on the Tech. Specs. The sensors shall be Quality Class Q. There are some cases 12 where Quality Class R sensors are used. Displays shall be 13 Quality Class R.
'Exhibit 2C3-3, continuing on Category 2. Display 15 shall be on an individual instrument or on demand on a CRT. Data recording is provided for effluen't radioactivity 17 monitors, area radiation monitors and meteorol'ogy monitors.
18 Transmission of signals for use other tha'n the post-accident 19 monitoring shall be through isolation devices. Again 20 Types A, B, and C instruments are 'specifically identified.
Category 3. Instrumentation shall be of high 22 quality commercial grade and shall be selected to withstand 23 the service environment. In Category 3, the 'display shall 24 be on. indiVidual instrument or on demand on a CRT.'xhibit 25 2C3-4. These are more General Design GRUMLEY REPORTERS Phoenix, Arizona
'i 0
l69 Criteria. Servicing, testing, and calibration programs shall be provided. Whenever means for removing channels from service are included in the design, the design shall facilitate administrative control. The design shall facilita e administrative control of access to all setpoint adjustments, module. calibration adjustments and test points. The monitoring instrumentation design shall minimize development of conditions which would cause meters, annunciators, recorders, or alarms to give anomalous indications potentiall 10 confusing to the operator. The instrumentation shall be desi,gned to facilitate recognition, location, replacement, 12 repair, or adjustment of malfunctioning components or, modules 13 To the extent practicable, monitoring instrumentation inputs 14 shall be from sensors that directly measure the, desired 15 variables.
4 16 Exhibit 2C3-5. The same instruments shall be used I
17 practicable for accident monitoring as are use'd for normal
/
18 operations of the plant. Periodic testing shall be in 19 accordance with the applicable portions of Reg. Guide l.l18.
20 Proceeding on with the Post-Accident Monitoring 21 System Description, Exhibit 2C3-6, Type A variables are those 22 variables to be moni,tored that provide the primary informatio 23 requixed to permit the control room operator tp take specific manually controlled actions for which no automatic 25 control is provided and whi.'ch are 'required for safety GRUMLEY REPORTERS Phoenix, Arizona
170 systems to accomplish their safety function for design basis accident events. For the Type A variables, Combustion Engineering is providing a review of emergency guidelines to identify if each event required manual action, instrument consulted, .required range and accuracy, and the qualification status. Completion .of this activity is expected in November, 1981. In, addition, a review of the emergency procedures after they are developed will be performed to ensure the required variables have been identified.
10 Exhibit 2C3-7 lists the Type B variables, which are variables required to provide information to indicate 12 whether the plant safety functions are being accomplished.
These functions include reactivity control, core cooling, maintaining re'actor coolant system integrity, and maintaining containment integrity. Category '1 variables in the balance of plant design include coolant level in the reactor. The 17 only part that is in the balance of plant design is the
'I 18 display, which will be two channels Class IE.'ontainment sump water .level, wide range. Requirement, tp monitor to 20 bottom pf containment to 600,000 gallon equivalent. We have 21 provided sensors in the ll-foot range. Display is two 22 channels, Class IE, .with recording on one channel.
,23 Exhibit 2C3-8, continuing on with:Ty'pe B Category 1 variables. For containment pressure, two'equirements exist, one to measure from zero to design pres'sure,'he other to GRUMLEY REPORTERS Phoenix, Arizona
I measure from 10 psia to design pressure. Sensors provided will be from minus 5 psig to 180 psig. Display is in 3 two channels, Class IE, with recording on one channel.
F Containment isolation valve position, excluding check valves.
Display is .provided for valve status for all automatic or remote manual containment isolation valves.
Category 2. Degrees of subcooling. Balance of plant on this is the display only, which will be two channels Class IE. Containment sump water level, narrow range. The requirement is to monitor the sump. Sensors are provided one per sump. Tha't measures the sump from 6 inches above 12 the bottom of the sump to 6 inches above the top of the sump to provide overlap with the wide-range detector. There is 14 one display per sump, since the sensor is qualified to the 15 post-LOCA environment.
16 Exhibit 2C3-9, continuing on with the Type B 17 Category 3 variables. Requirement, to measure'CS soluble 18 boron concentration from zero'o 6,000 ppm. This is 19 accomplished i'n the post-accident sampling system. The range 20 is from zero to 6,000 ppm, remote 'sample, in-line automatic 21 with a grab sample backup.
22 Core exit tempex'ature. 'he balance of plant 23 provisions here are for display only, which 'will be two 24 channels, Class IE.
25 Exhibit 2C3-10 covers Type C variables, which are GRUMLEY REPORTERS Phoenix, Arizona
172 variables which provide information to indicate the potential for being breached or the actual breach of the barriers to 3 fission product releases. The barriers are fuel cladding, primary coolant pressure boundary, and. containment.
Category l variables include the core exit temperature, which we have discussed previously. Radioactivi concentration or radiation level in circulating primary coolant,,the requirement is to monitor from one-half Tech.
9 Spec. limit to l00 times Tech. Spec. limit in R per hour.
Sensor range is provided to cover a range from 1R per hour to 10 5 R per hour. Display is .via a CRT, non-Class IE, and 12 two safety-related channel displays at the radiation monitor-13 ing cabinet, which are Class IE and recording on one channel.
14 Containment pressure. The design requirements 15 here for Type C variables include an additional requirement to measure from 10 psia to three times design pressure.
17 Sensor provided covers that range, as discusse'd before.
18 Exhibit 2C3-ll, continuing on with Type C Category 19 1. Containment sump water level, wide range, is provided 20 as discussed before.
21 Containment hydrogen concentration. The requiremen 22 is to measure from zero to l0%, capable of operating from 23 10 psia to maximum design pressure. Sensor'provided does measure from zero to l0%. It is available 30 minutes after 25 initiation of safety injection, which is in conformance with GRUMLEY REPORTERS Phoenix, Arizona
e e
e,
,5 0
0
173 NUREG-0737. It is capable of operating from minus 5 psig to 60 psig. Display is on two channels, Class IE, with recording on one channel.
Exhibit 2C3-12, continuing on with Type C variables 5 Category 2.. Containment sump water level, narrow range.
Display is provided,, as discussed before.
Containment effluent radioactivity noble gases from identified release points. The requirement is to monito
'rom -6 microcuries -2 10 per cc to 10 microcuries per cc.
10 Sensor 'provided at the plant vent responds to'0 to 10 microcuries per cc. Display in the control zoom is via CRT.
12 The sensor is qualified to post-accident environment.
13 Radiation exposure rate (inside buildings or areas 14 which are in direct c'ontact with primary containment where 15 penetrations and hatches are located.) The requirement is 16 to monitor from 10 -1 R per hour to 10 4 R per hour. PVNGS 17 design will incorporate 13 monitors with sensor range of
-1 4 18 10 R per hour to 10 R per hour. Display is in the control 19 room via CRT. 'ensors will be qualified to post-accident 20 environment.
21 Exhibit 2C3-13, continuing with Type C Category 2 variables. Effluent radioactivity noble gases from 23 buildings, as indicated above. The requirement is to monitor from 10 -6 microcuries per cubic centimeter to 10 3 microcuries 25 per cubic centimeter. It has a sensor off the fuel building GRUMLEY REPORTERS Phoenix, Arizona
a I
174
'6 vent with a range of 10 microcuries per cubic centimeter to 10 microcuries per cubic centimeter. It has a sensor off the fuel building vent with a range of lO -6 microcuries per cc to lO 5 . Display is via CRT. Sensor qualified to post-accident environment.
Type C Category 3 variables. Analysis of primary coolant (Gamma Spectrum). The requirement is to monitor 10 microcuries per gram to 10 curies per gram or TID-l4844 source term in coolant volume. The PVNGS design incorporates 10 a post-accident sampling system, which is a remote sample.
An in-line automatic isotopic sampling is done over a range 12 of 10 microcuries per cc to 10 curies per cc.
13 Containment area radiation. The requirement, is to 14 monitor from l R per hour to 10..:4 R per hour. Sensor provided 15 monitors over that range and display via CRT.
16 Exhibit 2C3-14, continuing with Type C Category 3 17 variables. Effluent radioactivity noble gas'ffluent 18 from condenser air removal system exhaust. The requirement
-6 <<2 19 is to monitor from 10 microcuries per cc to 10 microcurie
-6 20 per cc. Sensor provided monitors from lO microcuries per 21 cc to lO microcuries per cc. Display via CRT, with sensor 22 qualitied to post-accident environment.
23 We will now go to the Type' 'variables that provide 24 information to indicate the operation of individual safety 25 systems and other systems important to safety. These GRUMLEY REPORTERS Phoenix, Arizona
P 0;
175 variables are to help the operator make appropr'iate decisions in using the individual systems important to safety in mitigating the consequences of an accident. The Category 1 variable included here is the condensate .storage tank level.
PVNGS design has a 'sensor from zero to 50 feet with display on two channels, Class IE, recording on one channel.
Exhibit 2C3-15, Type D Category 2 variables. The primary system safety relief valve positions, closed not closed. PVNGS will comply with this requirement. This is 10 on the table in this form because the design is not far enough along to give any specific information.
12 Pressurizer heater status. The requirement, is to monitor electric current. PVNGS will comply.
14 The safety/relief valve positions or main steam 15 flow, closed not closed. PVNGS will comply.
Y Auxiliary feedwater flow. The requirement is from 17 zero to 110% design flow. Sensor provided from zero to 18 2,000 gpm. Display, two channels, Class IE.
19 Containment atmosphere temperature. The requiremen 20 is to monitor from 40 to,400 degrees F. PVNGS will comply.
21 Containment sump water temperature. The requiremen 22 is to monitor from 50 to 250 degrees F. This design 23 implementation is still under review.
24 Exhibit 2C3-16, continuing with Type D variables 25 Category 2. Essential cooling water system temperature.
GRUMLEY REPORTERS Phoenix, Arizona
1 l
4
176 The requirement. is to monitor from 32 to 200 degrees F.
Sensor provided is from zero to 200 degrees F, with display A
provided for each train.
Essential .cooling water system 'flow. The require-ment is to monitor from zero to 110% design flow. Sensor provided monitors from zero to 20,000 gpm, with the display on each train.
Emergency ventilation damper position. The requirment is to monitor open-closed status; Control room 10 display includes damper status for all automatic or remote manual emergency ventilation dampers.
12 Status of standby power and other energy sources.
The requirement is to monitor voltages, currents, and pressures." Display is provided in the control room of all ESF voltages and currents. The displays are Class IE.
Low pressure alarms are provided on the accumulators for the 17 MSIV, MFIV, and atmospheric dump valves.
18 Exhibit 2C3-17, Type D Category 3. Reactor coolant 19 pump status. 'The requirement is to display motor current.
20 This is provided.
21 High-level radioactive liquid tank level. The requirement is to monitor from top to bottom. Main control 23 room alarm is provided of the radwaste system trouble. The 24 radwaste systems are normally controlled from the radwaste control room in the main control room.
GRUMLEY REPORTERS Phoenix, Arizona
l e
A
177 Radioactive gas holdup tank pressure. The requirement is to monitor from zero to 150% design pressure.
3 Display is provided via control room alarm of radwaste 4 system trouble. Again, the radwaste systems are normally controll'ed from the radwaste control room.
Exhibit 2C3-18, Type E variables. Those variables are to be monitored as required for use in determining the magnitude of the release of radioactive materials assessing such releases. and'ontinually 10 Category 1 variable includes the containment area radiation-high range. The requirement is to monitor from 7
12 1 R per hour to 10 R per hour. The sensor is provided over 13 that range with a nonsafety-related CRT display and two 14 safety-related display channels at the radiation monitoring 15 cabinet, which are Class IE. Recording is provided on one channel.
I 17 Exhibit 2C3-19, Type E Category 2 va'riables.
18 Radiation exposure rat'e (inside buildings or areas where 19 access is required to service equipment. important to safety).
20 requirement is to monitor from 10 -1 R per hour to 10 4'he R
21 per hour. PVNGS design incorporates 10 monitors with a 22 sensor range over the required range. Display is via CRT.
23 Sensors are qualified to the post-accident environment, and 24 local display and annunciation at the monitors is provided.
25 Containment, or purge effluent, noble gases and GRUMLEY REPORTERS Phoenix, Arizona
0 f
I
178
-6 vent flow rate. The requirement is to monitor from 10 microcuries per cc to 10 5 microcuries per cc and from zero to ll0% vent design flow. These releases are through the plant vents. We will be discussing that on the next slide.
Common plant, vent noble gases and vent flow rate.
-6 microcuries The requirement is 10 per cc to 10 3 microcuries per cc and zero to 110% design flow. This again will be e
discussed on the next slide.
Exhibit 2C3-20. Auxiliary building noble gases and vent flow rate.. This is the plant vent. The requirement is from 10 -6 microcuries per cc to 10 3 microcuries per cc 12 and zero to ll0% vent design flow. The PVNGS design has
-9 microcuries per'cc to 10 5 13 a 'sensor monitoring from 10 14 microcuries per,cc at the plant vent. Display is via CRT.
is qualified, to post-accident environment, and flow 'ensor 16 measurement will be provided.
17 Condenser air removal system exhaust' noble gases is -6 microcuries 18 and,vent flow rate. The requirement -10 per cc to 10 5 microcuries per cc and zero to 110% vent design 20 flow. Sensor is provided over that range with a CRT display.
21 Flow measurement will 'be provided.
22 Vent from steam generators'afety relief valves 23 ox atmospheric dump valves noble gases and vent, flog rate.
-1 microcuries 3 The requirement is 10 per cc to 10 microcuries per cc. Duration of releases in seconds and mass of steam GRUMLEY REPORTERS Phoenix, Arizona
If I If
179 per unit. time. Flow monitor is provided per steam line over the range required. Display is CRT. Sensors qualified 3 to post-accident environment.
Exhibit 2C3-21, continuing with Type E Category 2 Fuel building vent noble gases and.vent flow.
4'ariables..
-6 microcuries The requirement is 10 per cc to 10 2 microcuries per cc, zero to 110% vent design flow. Sensor is provided over that range, with the display via CRT.
Exhibit 2C3-22,'ype 3 variables Category 3.
10 Particulates and halogens at all identified release points I (except steam generator safety relief valves or atmopsheric 12 steam dump valves and condenser air removal system exhaust) 13 sampling, with onsite analysis capability. The requirement 14 is over the range of 10 -3 microcuries per cc to 10 2 microcuri s 15 per cc, zero to 110% vent design flow. Monitors are provided over that range at the fuel building vent and at the main 17 air removal exhaust. Flow measurement will be 'ondenser 18 provided.
19 Exhibit 2C3-23, continuing with Type E Category 3 20 variables. Radiation exposure meters, continuous indication 21 at fixed locations per NUREG-0654. PVNGS will comply.
22 Airborne radio-halogens and particulates (portable 23 sampling with onsite analysis capability) over the range of
-3 24 10 microcuries per cc to 10 microcuries per cc. PVNGS will comply.
GRUMLEY REPORTERS Phoenix, Arizona
jl 1
180 Exhibit 2C3-24, continuing with Type E Category 3 variables. Plant and environs radiation via portable instrumentation. The requirement is to monitor 10 -3 R per
-3 hour to 10 4 R per hour, photons 10,. rads per hour to 10 4 5 rads per hour, Beta radiations and .low energy photons.
PVNGS will comply.
Plant and environs radioactivity (portable instrumentation). The requirement, is multichannel Gamma-Ray spectrometer. PVNGS will comply.
10 Exhibit 2C3-25, Type E Category 3 variables continues. Wind direction. The requirement is over a range of zero to 360 degrees, starting speed of one mile per hour, damping ratio between .4 and .6, distance consta'nt of 2 meter 14 PVNGS has sensors monitoring from zero to 540 degrees plus 15 or minus 5 degrees accuracy, a starting threshold of .75 mile per hour, damping ratio .4, distance constant, 3.3 fee't.
17 Wind speed. The requirement is zero to 30 meters 18 per second or minus .22 meters per second. Accuracy for wind speeds less than ll meters per second, with a starting threshold of 1ess than .45 meters per second,. PVNGS 21 design has a wind speed from zero to 50 miles per hour plus 22 or minus 1% or .15 miles per hour, whichever is greater, with 23 a starting threshold of .6 miles per hour.
24 Exhibit 2C3-26, continuing with Type E Category 3 25 variables. Estimation of atmospheric stability. The GRUMLEY REPORTERS Phoenix, Arizona
1 F
requirement is based on vertical temperature difference from primary system over a minus 5 degree C to 10 degree C or minus .15 degrees, the accuracy per 50 meter interval range for alternative stability estimates. PVNGS or'nalogous design provides based on a vertical difference of 160 feet plus or minus 6 degrees F analog and digital, plus 18 to minus 6 degrees F analog and .18 degrees F accuracy.
Exhibit. 2C3-27, continuing with Type E Category 3 A
9 variables. On the accident sampling capability, primary coolant and sump via a grab sample, the requirement is for gross activity 10 microcuries per milliliter to 10 curies
-3 microcuries 12 per milliliter. PVNGS monitors from 10 per cc 13 to 10 curies per cc.
'Gamma Spectrum via isotopic analysis is in 15 compliance.
Boron content from zero to 6,000 ppm, in compliance 17 Chloride content zero to 20 ppm, in 'compliance.
18 Dissolved hydrogen from zero to 2,000 cc STP per 19 kilogram, in compliance.
20 Dissolved oxygen from zero to 20 ppm, in compliance 21 pH from 1 to 13, in compliance.
22 Exhibit 2C3-28, continuing with the Type E 23 Category 3 variables for accident sampling capability of containment air. Hyrodgen content from zero to 10%, in 25 compliance.
GRUMLEY REPORTERS Phoenix, Arizona
~f 4
182 Oxygen content from zero to 30%, in compliance.
Gamma Spectrum via isotopic analysis. PVNGS
-7 microcuries design provides isotopic analysis from 10 per cc to 10 5 microcuries per cc.
MR..BINGHAM: Any questions?
MR. BARNOSKI:, I have a couple questions. After going through all that, I would like to try to summarize what you said, because my eyes weren't quick enough to compare all the numbers and make sure of everything. I gathe your intent is to comply with Reg. Guide l.9I, Rev. 2.
MR. BINGHAM: That's correct.
12 MR. BARNOSKI: On the Type A variables, you say the 13 expected completion date is November, '81. I believe there 14 is a considerable amount of work that needs to be done on a plant specific basis for the BOP to support a Type A analysis. I know the CESSAR schedule was November for the 17 NSSS portion. Is the BOP going to be done on 'that same 18 schedule, -also?
19 MR. BINGHAM: I believe we were led to believe that.
20 We can recheck that date i f you w0 u ld lake.
21 MR. STERLING: I believe we led. Bechtel to believe it 22 was November, '81.
23 MR. BARNOSKI: I just have one other question, and 'I 24 realize this is relatively new, but, on the Type B, C, D, and E, some of the variables which were addressed during the GRUMLEY REPORTERS Phoenix, Arizona
4
183 CESSAR review appear here. Others do not. Was that just because of time? Specifically, I'l take the first one.
3 Coolant level in the reactor was addressed. However, THot, T
Cold, and RCS pressure were not. Could you clarify what your intent is, if you have gotten'that far, 'as to what you would be referencing. CESSAR for?
MR. BINGHAM: I think you'e right. It was a matter of timing. Once those are included in CESSAR, we will pick them up.
10 MR. BARNOSKI: Fine. That's all.
MISS KERRIGAN: I have just some very general 12 questions. I can't really tell from this table what is 13 in now and what you are planning to put in and when you plan 14 to put it it'in. Xs only the places where you have called 15 out. PVNGS will comply? Are those the only instrumentation that, is not in now?
17 MR. ALLEN: canis, what do, you mean by not in?
18 MISS KERRXGAN: Installed or bought, purchased.
19 MR. BXNGHAM: When we have the ranges speci.fi;ed, 20 that means we have enough information to procure it. It may.no 21 yet be installed, but it will be installed; Where we say 22 we will comply, it generally means that we have not yet 23 developed enough information to give- all the particulars and that when we have it, we'will meet the requirements.
25 MISS KERRIGAN: So you still really can't tell whether'RUMLEY REPORTERS Phoenix, Arizona
~,
h P
~,
184 you would be running into procurement problems later down the road. There is still a potential for running into
.procurement problems with some of these instruments where Is it your'ntent I
you have specified the ranges and,things.
to have everything installed prior to .licensing or by June,
'83?
MR. BINGHAM: Was June, '83 the correct date? ,.I believe June, '83, but remember, Janis, we, are getting behind the line of all the other utilities that are buying the 10 same instruments in. front of us.
MISS KERRIGAN: That's right.
12 MR. BINGHAM: I would hope that the industry can 13 supply the equipment. in a timely manner, but we still have 14 one constraint.
will keep apprised of 1
15, MISS KERRIGAN: ~
But you the NRC any procurement problems and a separation of which of the 17 instrumentation will be installed by licensing and which will be deferred until the June, '83, required date.
MR. BINGHAM: We will apprise APS. APS I am sure will 20 keep you informed.
21 MISS KERRIGAN: The second question that I have is 22 'it looks like you are taking at least some exceptions to 23 Reg. Guide 1.97, Rev. 2, and will those exceptions be discussed in the LLIR update and a basis provided for any 25 deviation from the criteria?,
GRUMLEY REPORTERS Phoenix, Arizona
E MR. STERLING: I believe that thoser are already addressed in the LLXR.
MISS KERRXGAN: Okay, and a basis provided for the exceptions in the LLIR instead of .hashing that out in this meeting?
MR. STERLING:, I don't remember the exact words,
'll but I believe that's correct.
MX8S KERRXGAN: Maybe Bill can, help us out.
MR. QUINN: I don'0 really believe that we have discussed thoroughly any such exceptions. We have provided the infor'mation.
12 MISS KERRXGAN: 'e would need that, and rather than address it in a meeting of this type, because we would be here for the rest of our lives, it would be acceptable to put it in the next LLXR, which is due when, Bill?
16 MR. QUINN: Well, we would like to shoot for August 17 1st.
18 MR. ROSENTHAL: Mr. Allen, the needs of the NRC with 19 respect to this may be different than the needs of the 20 Review Board, so you should determine whether this is an appropriate forum for discussion.
22 MISS KERRIGAN: I think probably what we will do is defer NRC's questions on this whole area until the LLXR submittal.
MR. KOPCHXNSKI: Can I ask a procedural question?
GAUMLEY AEPORTERS Phoenix, Arizona
186 The LLIR just covers NUREG-0737. Are you asking that we include a response to 1.97 in there?
3 MISS KERRIGAN: No.
MR. ROSENTHAL: We are asking all of the industry to comply with Reg. Guide 1.97, Rev. 2, by June, '83, and we ask you to do .the same 1'ould thing. I. would like to see as strong a commitment as you can make that you intend to conform by the implementation date. Next, you want to get a license before the impl'ementation date of this plant, and if the Reg.'uide has never been published, we would still have to review in some depth the post-acci'dent monitoring 12 instrumentation. I think what I would like to do is go into 13 the SER or the SSER stage with a clear understanding of what equipment 'is in as of that time, and I would consider your interim post-accident monitoring system and look for 16 compliance by June, '83.
17 MR. KOPCHINSKI: Which document would y'ou like us to 18 provide?
MR. STERLING: Could I offer a suggestion? Maybe we
'could mark on these exhibits. the ones that are in procurement 21 the ones that are being installed now, and maybe as an open item to explain for those areas where we have, an exception the basis for it, because I know there are not that many 24 exceptions.
25 MISS KERRIGAN: Yes, that would be acceptable.
GRUMLEY REPORTERS Phoenix, Arizona
e l87 MR. BXNGHAM: All right. The intention of this whole section was to put everything out so that we could see where we are, and if that would help for us to do that, we will.
MXSS KERRIGAN: Maybe a little bit more detail as an open item.
MR. ROSENTHAL: .If you chose to discuss it for another ten minutes, it. is up to you. My branch is the one who will review this conformance and I am one of the co-authors.
MR. BINGHAM: Well, why don't we discuss it for 10 another ten minutes., and if there are some issues that. we need to get out, let's get, them out.
12 MR. ROSENTHAL: I saw under Category 2 variables 13 seismic qualification--
1a MR. BXNGHAM: What exhibit are you on'?
15 MR. ROSENTHAL: It is way up in the front.
17 MR. ROSENTHAL: Seismic qualification i'n accordance 18 with Regulatory Guide l.100 shall be provided when the 19 instrumentation, is part of N
a safety-related system. It was 20 clearly our intent that, all Category 2 instruments be 21 seismically qualified whether they were hung on seismic stuff h
22 or not.
23 MR. BINGHAM: Could you explain the rationale for doing, that?
25 MR. ROSENTHAL: One, we wanted to keep the operator GRUMLEY REPORTERS Phoenix, Arizona
r 188 informed of whether that system was functioning or not.
Two, there is a good probability that a nonseismically qualified system w'ill continue to function post a seismic event, and it seemed prudent that he had reliable indication of its status.
MR. BINGHAM: . The reason I asked is that, of course, we like to keep the power plant intact as well for seismic events, and there are certain things that we do. Dennis discussed a qualification program that we implement that gives us some good assurance, but yet we don't go with the Appendix B type program and the very long lead time in order to get some of this equipment to implement. So if we were 13 looking at early implementation, we would be much better off to specify only those parameters that give us the assurance that we will have some indication later on rather than specify quite a pedigree and wait a very long time to get it in the plant.
18 "MR. ROSENTHAL:-" I would find it. convenient if you 19 could just indicate which of the Category 2 variables will h ~
20 have full. seismic pedigree and which won'. This is a very prescriptive Reg. Guide, and we will treat. it as a Reg. Guide i
22 and.not as a regulation and we will permit exceptions, but I would like you to identify them.
24 Then ifL I go all the way up to 2C3-27, and just using this as an example, I look at gross activity, the GRUMLEY REPORTERS Phoenix, Arizona
A t
t I .
Ih, I
18 high range of your ability to analyze grab sample cross-sections is off by a factor of thousands. Is that a typo, 10 microcuries per milliliter versus 10 curies -- I'm sorry, same thing.
MR. KEITH: You 'are getting more than you asked for.
Right?
MR. ROSENTHAL: Yes, you'e right.
MISS KERRIGAN: I guess as an open item, though, I think the point that Jack was trying to make is any places 10 where you did take exceptions to requirements, please provide a basis. That would be the open item. The other open item 12 would be, as he had suggested, what is in now, what you 13 plan to put in, and what in the future is to be put in, a strong commitment to Reg. Guide 1.97 on the schedule specific in 1.97.
16 MR. BINGHAM: Fine. We will do that, Janis.
MR. ALLEN: Ned, did you have a question?
1 I 18 MR. KONDIC: ,I have two questions. One pertains to 19 the table again. We understand this is like a checklist,"
20 and for most of the properties or items, the requirements 21 do mesh with design features, but in some places, we have more verbal or qualitative explanation. Can we assume that 23 you imply that everything checks?
MISS KERRIGAN: They will document. any places where 25 they do not meet the requirements.
GRUMLEY REPORTERS Phoenix, Arizona
0 l90 MR. KONDIC: The second question, to come back to this morning where we decided to postpone that chemical spray effect and water effect. of the containment spray on the instrumentation, we decided to discuss this later this afternoon. Are there some instruments in the containment which may be adversely affected by water per se, in addition by chemicals in that water?
MR. BINGHAM: I thought we had discussed that in the morning, but, as I recall 10 MR. KEITH: First, we said there were no safety-related "12 MR. BINGHAM: Yes, no safety-related components.
13 MR. KONDIC: But then we discussed that maybe spray 14 on some of those instruments may be involved in the judgment 15 of the operator.
16 MR., ROSENTHAL: Let's take a specific example, a pressurizer pressure. Those transistors are not required to function to perform a safety function after some very short period of time, but those sensors also provide a long-term indication to the operator of what-the primary pressure is, so with respect to the post-accident monitoring function, which will continue for months and months and -months, you 23 would like to know that it hadn't deteriorated.
24 MR. BINGHAM: I understand, and in the qualification program that Combustion Engineering has, they do look at, GRUMLEY REPORTERS Phoenix, Arizona
x what I guess they call non-IE devices to make sure that they f5 are properly qualified. There is a category for that particular type instrument.
MR. KEITH: This particular one is IE, but the whole equipment qualification thing is being addressed.
MXSS KERRXGAN: Is that in the 255?
MR. KEITH: Yes, that particular one would be.
MR. KONDIC: Another example, we had the preamps.'in.
the containment. Are the preamps waterproof?
10 MR. BXNGHAM:. That example falls in the same category as the previous one.
12 MR. ALLEN: Any other questions? Ralph.
13 MR. PHELPS: You'e got a lot of your variables I 14 reading out on indication in the control room, and I think 15 in NUREG-0696 for emergency support facilities, they have 16 suggested that they want all the Reg. Guide 1.97 variables r
displayed in the technical support center and 'the EOF as 18 well. Are you making any provisions for that type of thing?
19 MR. BINGHAM: Yes.
20 MISS KERRIGAN: Are you going to do it or, not?
21 MR. BINGHAM: 'es, we are.
22 MISS KERRIGAN: So all the Reg. Guide 1.97 variables 23 would be displayed both in the TSC and the EOF?
24 MR. BINGHAM: That is our intent.
25 MR. ALLEN: Further questions?
GRUMLEY REPORTERS Phoonix, Arizona
I 192 MR. MARSH: It is perhaps a small point. I wanted to clarify 'on Exhibit, 2C3-17 regarding the radwaste liquid level. That annunciation is-provided in the control room and indicators are provided in the radwaste control room'. Do the indicators that are provided there meet, the requirements of 1.97? You didn't explicitly state that.
MR. BINGHAM: We may not have heard the question correctly. Would you repeat it, please?
MR. MARSH: As I understand the table, Reg. Guide 1.97 10 requires an indication, for example, on the liquid tank level in the .high level radioactive waste,'op to bottom 12 level indication. The design feature described there does C
13 not explicitly state whether the indicators or the radwaste t control room panel meet that, provide an indicator from top 15 to bottom or not. All it states is that there is an alarm 16 in the main control room, an indicator in the radwaste contro 17 panel.
18 MRS. MORETON: There are indicators in the radwaste 19 control room for high level radioactive liquid tank level 20 and for radioactive gas holdup tank pressure. At this time, 21 the pressure indicator does not meet the 150% design pressure 22 requirement and it is under review.
23 MR. MARSH: How about. the .level?
MRS. MORETON: That meets the level requirement.
25 MR. ALLEN: Carter, have you got a question?
GRUMLEY REPORTERS Phoenix, Arizona
h 193 MR. ROGERS: I have a similiar type of a question on Exhibit 2C3-16. On essential cooling water system flow, the requirement is zero to 110% of design flow. You do not tell us what the design flow is, but you say that the high range is 20.,000 gallons per minute. Does that .meet the requirement?
MR. KEITH: We will have to check.
MR. STERLING: In addition, you might check on 2C3-15 the auxiliary feedwater flow, also.
10 MR. BINGHAM:, I think we are going to be going through this and adding the columns. We will pick up those generic questions.
MR. ROGERS: That is satisfactory for me.
14 MR. ALLEN: Any additional questions before we move 15 on?
MR. BINGHAM: Let's go on with 2.D., All Other Instrumentation Systems Required for Safety.
18 MRS. MORETON: Figure 2D-1 identifies all other instrumentation systems that are required for safety, which 20 are those instrumentation systems designed to protect other 21 vital systems from potentially damaging transients. For the 22 purposes of this review, this does not include fire protectio The NSSS features are the shutdown cooling system 24 high injection valve interlocks and the safety injection tank isolation valve interlocks. In the balance of plant, GRUMLEY REPORTERS Phoenix, Arizona
V 194 1
we will be discussing the Class IE alarm system and the safety parameter display system.
Exhibit 2Dl-l are the Class XE Alarm System Design Criteria. The Class IE alarm system is provided for a limited number of operational occurrences for which no specific automatic acutation of a safety system is required.
The system alerts the operator to keep the plant operating within Technical Specification limits,and aids in precluding equipment damage. The .,Class XE alarm system shall be 10 designed in'ompliance with the standards listed on Exhibit, 2Dl-l and continued at the top of Exhibit 2Dl-2. Power for 12 each redundant Class XE annunciator shall be supplied from 13 a separate Class IE l25 volt-DC distribution bus. Each r
14 Class IE annunciator is an independent unit from the plant 15 annunciator. The annunciation sequence for operation and 16 testing for the Class IE annunciators shall be the same as 17 the plant annunciator with. the exceptions that'he Class XE 18 annunciator shall have a key locked alarm acknowledge 19 function and the Class IE annunciator does 3'
not have a 20 return-to-normaal audible. The Class XE alarm system shall 21 be designed to the requirements for nuclear safety-related 22 systems such that the devices must maintain their safety-23 related functional capability under all normal and abnormal 24 plant operating conditions.
25 Exhibit 2D1-3. This is our system description of GRUMLEY REPORTERS Phoenix, Arizona
195 the Class IE alarm system. Class XE alarms are provided to alert the operator in the event of a loss of nuclear cooling water to the reactor coolant pumps seal coolers, inadequate safety injection tank pressure, and high water level in an I
ECCS pump room. Silencing of the alarm audible is provided by a key locked alarm acknowledge switch. Four Class XE annunciators are provided, two in instrument'Channel A and two in instrument Channel B. The Channel A annunciators are physically separate and independent of the Channel B 10 annunciators. The annunciators are supplied from separate 125 volt-DC Class IE distribution buses.
12 Exhibit 2Dl-4 identifies the four Class XE 13 annunciators. An annunciator is provided for inadequate 14 safety injection tank pressure of Tanks 3 and 4, high water 15 level in ECCS Train A pump rooms, one annunciator window per'ump room. The same is provided on Channel B for safety 17 injection Tanks 1 and 2 and for the ECCS Train' pump rooms.
18 An additional annunciator is provided on loss of nuclear 19 cooling water to the reactor coolant pumps seal coolers, one 20 window per pump, and a redundant annunciator is provided on 21 Channel B.
22 Exhibit 2D1-5. Each, Class IE annunciator is a unit 23 with integral windows, horn, power supply, and annunciator 24 logic cards mounted in the annunciator section of the main 25 control boards. Separate switches exist for alarm acknowledg GRUMLEY REPORTERS Phoenix, Arizona
0 196 flasher reset, lamp reset, and test, Class IE alarm functions include the loss of nuclear cooling water to the reactor coolant pumps seal coolers. Redundant safety grade instrument channels are provided to continuously monitor nuclear cooling water flow to the seal coolers for each reactor coolant pump. Annuncia-tion is provided if, the nuclear cooling water flow rate is reduced below the minimum required, for pump operation.
Inadequate safety injection tank pressure alarm.
10 Safety grade instrument channels monitor the .pressure in each safety injection tank and the pressurizer. Annunciation is 12 provided if the pressure in a safety injection tank falls 13 below 600 psig while pressurizer pressure is .above 700 psig, 14 indicating the unavailability of the safety injection tank.
15 Exhibit 2Dl-6. A Class IE alarm is provided on 16 high water level in an ECCS pump room. Safety grade 17 instru'ment channels monitor level in the drain'asin in the 18 rooms for the low pressure safety injection pumps, high 19 pressure safety injection pumps, and the containment, spray 20 pumps. Annunciation is provided on a high level signal 21 indicating leakage in a pump room.
22 We will proceed now to the Safety Parameter Display 23 System Design-Criteria. This system is still in the design 24 implementation and procurement phases. These are the design 25 criteria that have been adopted by the project.
GRUMLEY REPORTERS Phoenix, Arizona
A
'0 1g I
V
~
'V
197 The safety parameter display system shall be provided to assist control room personnel in evaluating the safety status of the plant. The primary function of the SPDS is to aid the operator in rapid detection of abnormal operating conditions. The SPDS shall be designed to 10CFR50, Appendix A, General Design Criteria, XEEE 344 for seismic qualification, and NUREG-0696.
Exhibit 2D2-2, continuing with the safety parameter display system. The important plant functions related to 10 the primary SPDS display while the plant is generating power shall include but not be limited to the reactivity control, 12 reactor core cooling, heat removal from the primary system, 13 reactor coolant system integrity, radioactivity control,'nd 14 containment, integrity. The SPDS function in the control m
15 room shall be provided during and following all events 16 expected to occur during the life of the plant, including 17 SSE. The SPDS display shall take account of human factors 18 and the man-machine interface. The SPDS display shall be 19 incorporated into the main control room with a location that 20 will allow the displays to be easily observed by the operatio 21 staff. The SPDS display shall reflect and be capable of 22 suppor'ting all operating modes.
23 Exhibit 2D2-3. The SPDS display shall also be 24 availabe in the TSC, the satellite TSC, and EOF. The 25 SPDS shall be designed to an operational unavailability goal GRUMLE'Y REPORTERS Phoenix, Arizona
J, P
l98 as defined in NUREG-0696 of 0.0l for the data display function at each facility when the reactor is above'cold shutdown status. In addition, the SPDS display function in the control room shall be designed to an operational unavailability goal of 0.2 for cold shutdown status including the refueling mode..
The SPDS System Description is provided on Exhibit 2D2-4. It is very brief, because the, system has not yet been procurred. The SPDS consists'f two display systems located .
10 in the control room". a full-color CRT display driven from the technical support center computer system, and a seismical y 12 qualified display system driven from a separate control room 13 processor system. Plant functions included in the SPDS displays are those that were defined in the design critiera.
15 MR. BINGHAM: Any questions?
MR. ROSENTHAL: By when do you intend to install the 17 SPDS?
it 18 MR. BINGHAM: Our present schedule is to have installed prior to November of '82.
20 MR. HELMAN: I have a question on 2D2-3, Item 7). My I
21 question concerns the,EOF and post-EOF; Could you explain 22 a little further about the location of the current EOF and 23 its compliance with 0696?
24 MR. BXNGHAM: I'm sorry, when .you say the location and its compliance, what did you have in mind, Norm?
GRUMLEY REPORTERS Phoenix, Arizona
199 MR. HELMAN: The current requirement, correct me if if I am wrong, is we have a close-in EOF, which we do currently, we are also required to have an'alternate EOF at some further location with specific SPDS and TSC type displays in that location. I notice in here that you indicate that the SOS display will be available in the TSC, satellite TSC,'nd EOF. I am concerned about addressing the
'alternate EOF.
MR. BINGHAM: I think, John, I would prefer that APS respond to that particular issue. That, is the alternate 11 EOF.
12 MR. ALLEN: Run that by one more time, Norm. You are saying explain why we'e got a satellite TSC?
14 MR. HELMAN: No, I am asking about the possibility of an alternate EOF, because 0696 requires that if you have a close-in EOF, you must also have in addition an alternate EOF that is greater than ten miles.
18 MR. BINGHAM: There is a letter- that APS has sent to 19 NRC stating the position regarding the alternate EOF. I 20 don't recall there being a response.
21 MR. ALLEN: We had met with the NRC a few weeks back, and at that time, they had indicated to us that they felt that our EOF location was satisfactory. However, they 24 would verify that and let us know by letter.
25 MISS KERRIGAN: That's right.
GRUMLEY REPORTERS Phoenix, Arizona
200 MR. ALLEN: That is still in process, Janis?
MISS KERRIGAN: That's right. There has been a 3 Commission paper prepared to propose to the Commission your design along with a few other plants and we have not yet gotten feedback on that from the Commission.
MR. HELMAN: Is there a specific commitment dat'e for receipt of that letter?
MISS KERRIGAN:. No..-
MR. HELMAN I wanted to hear that.
10 MISS KERRIGAN: We hope to get it out shortly.
MR. ALLEN: Any other questions?
12 MR. PHELPS: I'e got a question regarding the 13 monitoring of the cooling water flow to the pump seals. Are 14 those transmitters placed in a portion of the line where 15 they also monitor the cooling water to the pump motors?
16 MRS. MORETON: The flow transmitters are located in I
17 the nuclear cooling water lines that service all the coolers 18 for the reactor coolant pump.
19 MR. PHELPS: Is that seismically designed for DBE?
20 MRS. MORETON: The nuclear cooling water lines?
21 MR. PHELPS: Yes."
22 MRS . MORETON: No.
p 23 MR. PHELPS: Then how do you meet your criteria for 24 that event?
25 MR. KEITH: The nuclear cooling water lines to the GRUMLEY REPORTERS Phoenix, Arizona
0 Cf
20l pumps are not Seismic Category I. The flow transmitters are Seismic Category I and seismically mounted. These trans-mitters'ere installed because of the concern that we had non-Seismic Category I cooling water going to the reactor 5 coolant, pumps. CE has done testing on these pumps showing that the pumps are fine for at least 30 minutes without, any cooling water. The 30 minutes plus the alarm that we would get if we lost cooling water. flow to the reactor coolant pumps, we would then have'0 minutes to shut down, the reactor in an orderly fashion and stop the reactor coolant pumps.
MR. PHELPS: What type of flow meters are they?
12 MRS. MORETON: They are differential pressure 13 transmitters.
14 MR. PHELPS: And you'e got the orifice plate portion 15 of that mounted seismically, so that even if a line breaks, 16 they will still receive a no-flow signal?
17 MRS. MORETON: The orifice plate is not seismically 18 mounted. Only the transmitters are seismically mounted.
19 If the line ruptured, the impulse lines or sensing lines 20 would also break, indicating no flow. The transmitter would 21 fail to its no-flow position and cause the alarm.
V 22 MR. KONDIC: Are those flow meters checked and 23 recalibrated because, of numerous possibilities with time to 24 give a different reading? You buy them and that's it, or 25 is there any way to find out whethe'r that orifice has, for GRUMLEY REPORTERS Phoenix, Arizona
~,
t 1'
I 0,
'K
202 example, accumulated dirt? A Delta. P is not a measure of 2 the flow rate any more. This is something new.
MR. ALLEN: Jim,'ould you like to say what you intend to do on those orifices, if. anything? Nothing.
Is that satisfactory?
MR. KONDIC: .The silence?
MR. ALLEN: No, there is no check of the orifices or anything after they are'nstalled.
MR. KONDIC: Thank you.
10 MR. MECH: I have a question which might throw some li'ght on that, perhaps. I am a little confused. On Exhibits 12 2D1, 5 and 6, you list the sensors used for the Class IE 13 alarm functions. Now, let me get this straight. There are 14 four annunciator panels.
15 MRS. MORETON: Yes.
MR. MECH: A, B, C, D.
17 MRS. MORETON: A, B, A, B, two A's and 'two B's.
18 MR. MECH: All right,. Then the sensors that are 19 involved with the safety injection tank, are they the same 20 sensors that are involved with the safety injection tank 21 interlocks?
22 MR. BINGHAM: We will have to look at the drawings to 23 answer that question.
24 MR. MECH: Well, let me ask another question then 25 that might help. From reading the FSAR, I find words like i
GRUMLEY REPORTERS Phoenix, Arizona
ll
203 on Exhibit 6, high water level in an ECCS pump room, I find words like one independent level sensor is used to monitor the level. What does that. mean? What is that one indepen-dent level sensor?
MRS. MORETON: The Train A pump room, as- an example, the containment spray pump room,,has a Channel A sensor that supplies monitoring or annunciation only to this annunciator, to nowhere else. The Train B pump room would have a Channel B sensor.
10 MR. MECH: And this is a second sensor that is put in in addition to the one that is there for other reasons'?
12 MRS. MORETON: Not in the same room. In a separate 13 room.
14 MR. ALLEN: Any further questioning on that section?
4 15 MR. MECH: I asked what an independent level sensor 16 was.
17 MR. ROSENTHAL: You "lose CCW to the RCP's on a 8
18 containment isolation actuation signal by design. The 19 containment isolation actuation signal comes from lower 20 pressurizer pressure as well as high containment, pressure, so 21 'one expects that simple anticipated operational occurrences J
22 will generate a containment isolation and, in turn, isolate 23 CCW to the RCT's, so with some frequency, you Will isolate 24 CCW to the CRP's, more than once a year. What is %he rationale for not modifying the system such that you don' GRUMLEY REPORTERS Phoenix, Arizona
204 CCW on a CIAS.
L MR. BINGHAM: Let me see if I understand. You are saying during normal operating transients that you would expect, containment isolation to occur at least once or more a year.
MR. ROSENTHAL: Yes. The containment isolation actuation signal some years past was on only high containment pressure and would happen hopefully very infrequently, while SIAS is induced by any overcooling event that drops the 10 pressurizer pressure below 1,600. Now that you have added diversity to CIAS such that you pick up lower pressurizer 12 pressure, any overcooling event,'nd we see even undercooling 13 events which ten minutes later become overcooling events, 14 wil'l cause SIAS and CIAS, they are logically one and the 15 same, and then by design, you isolate those lines in order 16 to fulfillthe classical containment function of buttoning 17 everything up at this time, so now we have a s'ituation in 18 which the pumps have been tested and can withstand, based 19 on limited testing, loss of CCW, and yet we expect a 20 relatively high frequency due, to simple plant transients 21 to be challenging those pump seals, and loss of those pump 22 seals, gives you a small break LOCA. Given that, why did you 23 decide to isolate CCW on containment isolation rathex than 24 choosing to take an exception to the normal containment 25 isolation?
GRUMLEY REPORTERS Phoenix, Arizona
205 MR. BINGHAM: Regardless of whether it is seismic or not, the issue is there. Let us confer for just a second.
3 MR. KEITH: First, I am not convinced that we are going to have'ow pressure transients that often. I don' know how good the data is on that, but, anyhow, it doesn'.
seem to me like we should have them more often than once a year. But, at any rate, because we felt, we could live with isolating these valves on a containment isolation actuation signal, we went ahead and did't that way. - I am not sure that, not doing it would be acceptable I to your Containment Systems Branch. If it were, I think there is some rationale I on not to shut them off on a CIAS. I would agree with your 13 observations.
14 MR. ROSENTHAL: I have had discussions with the Containment Systems Branch, Auxiliary Systems Branch, Reactor Safety Branch myself on this issue. The design as 17 you approach it seems to meet the requirements'f the regulations in the area of equipment unavailability, which is a commercial concern which we wouldn't involve ourselves 20 in, although this Board might. We weren't fully happy that 21 we were sure we were doing the prudent thing, so 'I would 22 appreciate an explanation of the rationale, and this is an 23 area in which we would surely be anxious to hear your 24 rationale one way or the other..-
25 MISS KERRIGAN: I guess what Jack is saying is we GRUMLEY REPORTERS Phoenix, Arizona
206 like to hear a rationale being used "because NRC told 3'on'5 us to." The responsibility of safety of the plant is yours, not NRC's.
MR. BINGHAM: I don'0 believe that was the impression Dennis was .trying to give you, Janis. This system has been the way it is since f976 and 7
it continues and remains to be that, way until there is other'evidence that there should be some'hange. What I guess I understand that Jack is saying is that there is some rethinking going on about the desir-.-
10 ability of isolating that particular system.
MISS KERRIGAN: All right. I think that was back 12 into one of'the TMI concerns, the old lessons-learned 13 concern about essential versus nonessential systems, and 14 that was part of the responsibility of the vendor's and 15 utilities to rethink that, so we assume you have done that.
16 And now have a very strong basis for defining that. CCW is 17 nonessential, and that is what we would like t'o hear.
18 MR. KEITH: I kind of alluded to that. Our evaluation 19 based on the work that CE has done and assuming for most 20 accidents, although it was beneficial at times at Three Mile 21 Island to run the reactor coolant pumps, generally the 22 reacto'r coolant pumps are not considered essential and needed F 23 so, based on that, we have classified this as a nonessential 24 system. Admittedly, it is borderline and I think we could 25 go back 'and take another look at it.
GRUMLEY REPORTERS Phoenix, Arizona
0 L
(
r\
'4 il e
207 MR. ROGERS: Let me ask a question before you get off into that. Is not the seal injection system which is connected with the charging system, which is not isolated in the case of a containment isolation signal, doesn't that provide secondary cooling to the seals on the reactor coolant pumpsP MR. KEITH:, That's correct. There is that for the seals.
MR. PHELPS: I just wanted to make one additional point. If your original concern was correcting the low pressure safety injection actuation signal terminating 12 recoolant water flow because of some of the TMI work while 13 waiting for the loss to/ come back, CE's operating guidelines 14 require the reactor coolant pumps to be tripped on the low 15 pressure safety injection setpoint,,so that concern goes away for the time being.
17 MR. ROSENTHAL: Excuse me, tripping of 'the pumps 18 doesn't totally protect the seals, which are quite Delta T 19 dependent. Yes, it would help, but I don'5 know if I am 20 bordexing on an equipment concern or a safety concer'n. That 21 helps.
22 MR. ROGERS: The same system is a backup for the seals 23 and will keep the seals intact if you lose cooling water.
24 It is redundant in that sense to the component cooling water system as I understand it.
GRUMLEY REPORTERS Phoenix Arizona
0 11 I
L
MR. BINGHAM: And that valve. we don't shut. We leave that one open, so there is that, Jack. You might want to look at that parti.cular feature.
MR. ROSENTHAL: Yes, we have.
I MISS KERRIGAN: Were you going to go back and look at it or not? It's up .to you.
7 MR. B1NGHAM: It is up to the Board, of course. If you like, I believe we will have to go to Combustion to get their review.
10 MR. ALLEN: I think from our standpoint we are fairly well satisfied. If you would like us to look into it--
12 purposes' MISS KERRIGAN: No, it is the Board's decision.
13 I th'ink we have the position on record and that served our 14 15 MR. ALLEN: That position was discussed at the last 16 IDR, also,. on the containment system. Unless someone else 17 on the Board has a desire to look at it, I would just as soon 18 close it. k 19 MR. BINGHAM: Any more questions?
20 MR. ALLEN: Any questions left?
21 MR. BINGHAM: Due to the lateness of the hour, we 22 will present 2.E., Control Systems Not Required for Safety, 23 and then end the day's work with that section. Then 24 tomorrow morning, as I recall, we are convening at 8:00.
25 I would like a few minutes to bxing the'pen items that we GRUMLEY REPORTERS Phoenix, Arizona
k 1' V
'i V
209 can from today and then we will move into Section 3, which is Compliance With Regulatory Requirements, if that is satisfactory to the Board.
MRS. MORETON: Figure 2E-l. Control systems not required for safety are those electrical and mechanical I
devices and circuitry required for plant operation but whose functions are not, essential for the safety of the plant.
Most of these systems are NSSS systems which were discussed, in CESSAR. There are two NSSS systems that are outside the CESSAR scope, including the steam bypass control system option with two valves to atmosphere and the extended range feedwater control system that provides control from zero to 13 15% power. The balance of plant system is the loose parts 14 monitoring system.
15 The design criteria for the control systems not required for safety are, on Exhibit 2E-l, the feedwater 17 control system extended range. For operatio'n between 18 zero and 15% power, the feedwater control system shall 19 automatically control the steam generator downcomer water 20 level. Steam generator level will'e controlled. during the 21 following condition, assuming tha't all other control systems are operating in automatic: steady state operations, 1% per minute turbine load ramps between 0 and 15% NSSS power, 24 loss of one of two operating feedwater pumps, and load 25 rejection of any magnitude.
GRUMLEY REPORTERS Phoenix, Arizona
II Ill e
l gi 0
210 Design criteria for the 'steam bypass control system option, Exhibit 2E-2. The CESSAR system is modified n
for PVNGS to dump'steam to atmosphere through two of the turbine bypass valves-. These valves shall be the last to open and first to close during steam bypass operation.
Design criteria for the loose parts monitoring system on Exhibit. 2E-3. A loose parts monitoring system shall be provided to detect, and record signals resulting from impacts occurring within the reactor coolant system.
10 I will now proceed with the system description.
Exhibit 2E-4, feedwater control system extended, range.
12 Below l5% NSSS power, referring to Figure 2E-2, the feedwater 13 control system performs dynamic compensation on the level 14 signal to generate an Alpha signal indicative of the required feedwater flow. The Alpha signal is used to generat the downcomer valve position demand" signals When in this control mode, the economizer valve will be clo'sed and the 18 pump speed setpoint will be at its minimum value. You see the signal coming to the downcomer program. When we are below 15% power, the economizer valve is closed and the 21 feedwater pump is set, to minimum.
22 Exhibit 2E-5, steam bypass control system descrip-tion. The CESSAR system is modified from four valve groups 24 to five valve groups. Valve Group 5 contains the seventh.
and eighth steam bypass valves which discharge to atmosphere.
GRUMLEY REPORTERS Phoenix, Arizona
k I'
2ll Valve Group 5 is the last group to sequence open and is not interlocked with a loss of condenser vacuum signal.
Figure 2E-3 is a simply block diagram of the steam bypass control system which is identical to the control system provided in CESSAR, still., eight valves. The only, change. is that six go to the condenser and two to the atmosphere. Those two that go to the atmosphere'do not receive condenser interlock signals.
Exhibit-2E-6, system description of the loose 10 parts monitoring system. Eight high temperature piezoelectri accelerometers (transducers) will be located in the areas where loose parts are most likely to become entrapped. Two 13 redundant transducers are clamp mounted on the in-core 14 instrument guide tubes on the reactor vessel lower head.
These are diametrically opposed. Two redundant transducers will be stud mounted on the reactor vessel upper head service structure flange, also diametrically opposed, 'and two redundant transducers on the lower head region of each steam generator. One transducer will be clamped to the primary inlet pipe and the other will be clamped to the primary outle 21 pape.
22 Exhibit 2E-7, continuing on with the loose parts system description. A data acquisition panel is located in 24 the control room area which contains alarm modules that continually monitor the incoming signals from the preamplifie GRUMLEY REPORTERS Phoenix, Arizona
C l
p
(
2l2 for the presence of impacting. The occurrence of a loose part impacting on the inside of the structure causes bursts of signals that exceed the alarm setpoint and trigger the e
alarm. The data acquisition panel includes tape recorders with playback and an audio monitor.
MR. BINGHAM: Questions?
MR. MECH: One little question. You don't list in the systems here the gross:failed fuel .monitor, which is generall considered desirable. In Chapter 9 of the FSAR, you have 10 what you call a process radiation monitor, which .appears to do the same function. Is this true?
12 MR. BINGHAM: That's true.
13 MR. MECH: Thank you.
14 MR. ALLEN: Jack, I think you had one.
15 MR. ROSENTHAL: Yes. Do you have a control grade 16 power cutback system? I assume that is part of the'eactor 17 standard System 80 scope of supply.
18 MR. BINGHAM: We have it. Is it part of the standard System 80?
20 MR. BARNOSKI: Yes.
21 MR. ROSENTHAL: That system in some sense is in lieu 22 of the'nticipatory trip of the reactox on a turbine trip, 23 which is a safety grade system and which we have required Would it be appropriate to I
24 on other than CE NSSS plants.
25 have some requirements with 'respect to availability of that GRUMLEY REPORTERS Phoenix, Arizona
jl
~ I
'I J
1
~
H
213 system? It is no great scheme and one does have turbine trip. I believe that the Chapter 15 analysis shows it lifts the safeties, which is an undesirable characteristic.
"MR. BINGHAM: I'm not sure that Bechtel is the one that that question should be directed to. Maybe, John, you could help us. If I understand, the question is, since that is a control grade system, should there be some other requirements on its availability to perform when required.
Is that correct.'?
10 MR. ROSENTHAL: Yes.
MR. ALLEN: That sounds like a question that would 12 have to be coordinated with Combustion. We can, take it as an 13 open item. r 14 MR. BARNOSKI: If I might make a suggestion, I guess 15 from our point, of view, that is a 'CESSAR question as opposed to a question for these folks. We have noted it and we will 17 be prepared to discuss that at'he upcoming me'eting in July.
18 MR. ROSENTHAL: Okay, fine.
19 MR. BINGHAM: Does that take care of it?
20 MR. ALLEN: A clarification on that. r Some System 80 21 plants don't have that like Yellow Creek.
Let me clarify. All System 80 plants 4'R.
22 BESSETTE:
23 do have reactor power cutback. Some 'of the'unctions of 24 the reactor power cutback on Yellow Creek, for example, 25 aren't included because theyhaVe a thi:rd feed pump. Therefor GRUMLEY REPORTERS Phoenix, Arizona
214 there is no reactor power cutback initiated on a loss of a feed pump, because they still have 100% feed pump capability, but the reactor power cutback itself doesn'0 exist.
MR. ROSENTHAL: Another control grade system that you have is called COLSS. That system was discussed at.
Combustion and the level of QA of that system to the point that the software leaves Combustion's doors was discussed.
That software now arrives at Palo Verde. Can you describe the quality assurance of it and protection of that COLSS software package?
MR. ALLEN: We will have to take that one as an'pen 1
12 item. We don', have the people here to do that.
13 MR. BINGHAM: Maybe I could add enough, John, to get 14 this before these folks.
15 MR. ALLEN: That is an Operations QA problem and I would like to see it addressed by Operations.
17 MR ..BINGHAM: Fine.
18 MR. ROSENTHAL: Similarly, the reactor power cutback 19 system, control grade system, does get some input from 20 information which is stored on the plant computer. There 21 should be some commensurate level of QA of the software 22 for this control grade system performed by Palo Verde, We would like to discuss that.
24 MR. ALLEN: We will take that as an open'tem, also.
25 MR. SIMKO: There were some questions from the NRC GRUMLEY REPORTERS Phoenix, Arizona
lP.
0
'u l
0 E C 'll
215 addressing these already. I can'5 remember where. A couple of months ago, they talked about this and I know our 3 Licensing Group is addressing this type of question.
MISS KERRIGAN: In other words, they could have spent W
time with that first set of Ql's under the QA set of question MR. SIMKO: You can leave it, an open item, but I know
, we have addxessed that.
MISS KERRIGAN: It could be that your response would 1
be referring us to your Ql response.
10 MR. ALLEN: Any further questions?
MR. BINGHAM: No more questions?
12 MR. ALLEN: I guess then we will adjourn for the day 13 and meet back at this room at 8:00 sharp tomorrow morning.
14 (Thereupon the meeting was at recess.)
15 16 17 18 19 20 21 22 23 24 25 GRUMLEY REPORTERS Phoenix, Arizona
il h
1 l,4 f c',
0-h