ML17319A508
| ML17319A508 | |
| Person / Time | |
|---|---|
| Site: | Cook  |
| Issue date: | 06/20/1980 |
| From: | Hunter R INDIANA MICHIGAN POWER CO. (FORMERLY INDIANA & MICHIG |
| To: | James Keppler NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III) |
| References | |
| AEP:NRC:00387, IEB-80-06, IEB-80-6, NUDOCS 8007180324 | |
| Download: ML17319A508 (8) | |
Text
INDIANA L MICHIGAN ELECTRIC COMPANY P. O.
BOX 18 BO WLIN G G R E EN ST ATION NEW YORK, N. Y. 10004 Donald C.. Cook Nuclear Plant Units 1 and 2
Docket Nos.
50-315 and 50-316 License Nos.
IE Bulletin 80-06 June 20, 1980 AEP:NRC:00387 Mr. James G. Keppler, Director Office of Inspection and Enforcement U.S. Nuclear Regulatory Commission Region III 799 Roosevelt Road Glen Ellyn, Illinois 60137
Dear fir. Keppler:
This letter responds to your letter of March 13, 1980 which we received on March 18, 1980 and which transmitted to us IE Bul'letin No. 80-06 entitled "Engineered Safety Feature (ESF)
Reset Controls".
As required by Action Item 1 of the Bulletin, we have completed the review of drawings for the systems serving safety-related functions to determine the mode of operation following reset of an ESF actuation signal.
The results of our findings, the type and schedule of proposed modifications are described in the Attachment to this letter.
In response to Action Item 2, to verify that the actual installed instrumentation and controls at the Donald C.
Cook Nuclear Plant are consistent with the results of the drawing review described
- above, testing to demonstrate that all equipment remains in its emergency mode following ESF resets will be performed during the Units'efueling outages to take place in the Spring of 1981 (Unit 2) and in the Summer of 1981 (Unit 1).
Very tr ly yours, R.
S.
Hu ter RSH:dfs Vice President CC:
NRC Office of Inspection and Enforcement Division of Reactor Operations Inspection, Washington, D.C.
20555 R.
C. Callen G. Charnoff John E. Dolan R.
W. Jurgensen D. V. Shaller - Bridgman JUN 23 1980 soovxsoSA
I...E, Bul 1 e,ti:n; 80-.0.<
AEP;NgC;00387 STATE OF NEW YORK COUNTY OF NEW YORK R.
S. Hunter, being duly sworn, deposes and says that he is a Vice President of the licensee Indiana 8 Michigan Electric Company, that he has read the foregoing response to IE Bulletin 80-06 and knows the contents thereof; and that said contents are true to the best of his knowledge and belief.
Vice President Sworn and subscribed to before me this zo'+day of June, 1980.
Notary Publi'c KAa IILIC~I IiAI~RY YOTARY IubLIC, 5'Glc cl Hcw Jolg No. 41-iuof)793 Quchiiod '<<i 4uccns County
o ATTACHMENT TO AEP:NRC:00387
( I.E.
BULLETIN) NO. 80-06
)
Action Item 1
The safety-related systems listed below have been reviewed to determine whether or not upon the reset of an ESF actuation signal at the system level, all associated safety-related equipment remains in its emergency mode:
1.
Reactor Trip Function 2.
Safety Injection 3.
Steamline Isolation 4.
Feedwater Isolation 5.
Motor Driven Auxiliary Feed Pumps start from Lo-Lo Steam Generator Water Level 6.
Turbine Driven Auxiliary Feed Pump Automatic Start 7.
Emergency Diesel Generators Start 8.
Containment Isolation Phase "A"
9.
Containment Isolation Phase "B"
10, Containment Yentilation Isolation ll.
Control Room Intake Duct Isolation 12, 'ontai'nment Spray Actuation The results of our review are as follows:
Reactor Tri Function:
Upon occur ence of a reactor trip signal the reactor trip breakers are actuated (tripped).
Resetting of these signals will not succeed in reclosing the breakers since energization of the breaker's closing coils is strictly manual operation.
Thus, this equipment does not change its emergency mode of operation because of reactor trip signal reset.
2.
Safet In'ection:
Safety Injection signal resetting is automatically blocked for two minutes after S. I. signal actuation occurrence by a S. I.
"Reset Blocked" timer.
After two minutes delay the operator can manually reset the S. I. signal; with one exception, no equipment will change its mode of operation because of the S. I. signal reset.
The one exception is the motor driven auxiliary feedwater pumps (MDAFWP) test valve.
When the pump is being tested, i.e.
the valve is open, and an ESF actuation signal occurs, the test valve will close.
The valve will remain closed if the steam generator level is below Lo-Lo,even though the ESF reset would permit automatic reopening.
When the steam generator level is above Lo-Lo level and the ESF signal is reset the test valve would reopen automatically.
Since the steam generator level is then in the normal range AFW is not required.
3.
Steaml ine Isolati on:
Upon receiving a steamline isolation signal the steam generator stop valves close.
The isolation signal is reset automatically when the conditions causing it disappear, but thi's automatic reset will not cause the stop valves to re-open.
Operator actuation of the hydraulic exerciser is necessary to reopen the stop valves.
Feedwater Isolation:
" 'A feedwater isolation signal causes the feed pump discharge valves (motor operated and air operated in series) to close.
Resetting of the initiating signal will cause the air operated valves to open.
The motor operated
- valves, however, will stay close until the operator manually opens them by actuation of the co'ntrol switch.
Motor Driven Auxiliary Feedwater Pump Start From a Lo-Lo Steam Generator Hater Level:
6, All devices actuated by this signal will remain in its emergency operating mode after system reset except for the test valve mentioned in 2 above.
If the pump was being tested and a Lo-Lo S.G. level signal'occurred, the test valve will be closed; upon resetting of the signal the test valve will re-open.
Resetting of the Lo-Lo level signal is auto-mati'c after the steam generator level is above the Lo-Lo level.
Reopening of the test valve at this time will present no operational or safety problems.
Turbine Driven Auxiliar Feedwater Pum Automatic Start:
'The initiating signals (steam generator Lo-Lo level or RCP bus undervoltage signals) reset automatically.
With one exception, the reset has no effect on the mode of operation of the devices actuated by the initiating signals.
The one exception to this situation is the TDAFHP test valve.
If the valve was open during testing, a steam generator Lo-Lo level signal or a black;out signal will cause the valve to close; resetting of the Lo-Lo signal is, as said, automatic and will cause the valve to reopen.
The discussion given above for the SI and the MDAFHP systems also applies in this case.
7.a.
Emer enc Diesel Generator Start:
Upon receiving a safety injection or a loss of voltage
- signal, the diesel generators will start and continue running after the initiating signal is reset.
The loss of voltage reset is automatic; and, safety injection, can be manually re-set after the 2-minute time delay described before.
Manual actuation of the diesel generator stop switch is necessary for the diesel generators to stop running.
7.a Emer enc Diesel Generator Start:
Cont'd 7.b.
If a loss of voltage signal caused the diesel generator to start, the load shedding relays will be energized, loads will be shed, the diesel generators will be started and the blackout sequential loading begins.
A loss of voltage signal will be automatically reset after the diesel generator has restored power to the buses but this will not cause any component to change its emergency mode of operation.
If the initiating signal was a loss 'of voltage coincident with a safety injection signal, the load conser-vation control circuit will also be activated.
The automatic resetting of the loss of voltage signal will have no effect on the operation of the load conservation control circuit.
The load conservation control circuit resets itself in 75 seconds (shorter than the 2 minutes that have to elapse before. safety injection can be reset) and, with one exception, no change in the emergency mode of operation of any device occurs because of this resetting.
The one exception is the component cooling water pump fans (12-HV-ACCP-l, 12-HV-ACCP-2, and 12-HV-ACCP-3).
Mhen in "Auto"
- mode, a load conservation signal will start the fan.
Resetting of the load conservation signal will cause the fan to trip.
Our actions concerning this circuit are described under our re-sponse to Action Items 3 and 4 of the Bulletin.
8.
Containment Isolation Phase "A"
CI-A 9.
All containment isolation valves affected by a CI-A will close and remain closed after the CI-A signal is reset.
The containment sump pumps (containment pipe tunnel
- sump, reactor cavity sump, lower containment sump) will trip on CI-A and will remain tripped after the CI-A initiating signal is reset.
Containment Isolation Phase "B"
CI-B :
Resetting of the containment isolation phase B signal will cause no change in the mode of operation of the devices affected except for the dampers and containment air recirculation fans listed below.
The dampers for the Auxiliary Building charcoal filters will be closed on initiation of a CI-B signal.
However they will reopen automatically upon resetting of the CI-B signal.
Our actions con-cerning the control circuit for these dampers are described in our response to Action Items 3 and 4 of the bulletin.
The containment recirculation fans are set to start 10 minutes (Unit 1) and 9.5 minutes (Unit 2) after the occurrence of
.a CI-B signal (when in "Auto" mode).
Resetting of the CI-B signal after the fans have started will cause the fans to stop.
Resetting of the CI-8 signal before the delay time will prevent the fans from starting.
Our actions concerninn this circuit are given under our response to Action Items 3 and 4 of the Bulletin.
4 10.
Containment Venti 1 ati on Isol ati on:
Upon a containment ventilation isolation signal, all con-tainment ventilation isolation valves close and remain closed after the system has been reset.
Operation of each valve con-trol switch is necessary to reopen the valve.
11.
Control Room Intake Duct Isolation:
A safety injection signal actuation will cause the control room intake duct isolation dampers to close and the recirculation damper to open.
Resetting of the safety injection signal will have no effect on damper position.
Operation of the individual dampers control switches is necessary for the dampers to revert to the pre-accident signal position.
I'2.
Containment S ra Actuation:
Resetting of the Containment spray actuation signal results in no change in the mode of operation of the devices affected by the initiating signal.
Operator action on the individual devices is necessary.
Action Items 3 and 4
Device
.....,.. Summarized below are *the safety-related devices.that chanqe their mode of operation upon an ESF actuation signal reset and the planned control circuit modifications.
The notes give the reasons for not taking interim actions until the modifications are completed.
The notes also give the reasons for not implementing other circuit ondifications.
The schedule to complete the planned
.....modifications has been given in the cover letter.
Modifications Planned
~ESFN 1S Yes "'
'o 'otes Safety Injection Feedwater Isolation MDAFHP TDAFl!P Emergency Diesel Generator Start Containment Isolation Phase B
-MDAFMP Test Valve
-Air-operated iso-lation valves
-Test Valve
-Test Valve
-Component Cooling water fans
-Auxiliary Building charcoal filter dampers
-Containment Re-circulation fans (2)
(1)
(1)
(3)
(4)
NOTES:
(1)
See response under Action Item 1, Items 2., 5.
and 6.
Ltalve reopening, in the rather infrequent test mode, occurs only if the Steam Generator level is above Lo-Lo, in which case, there is no consequence to its reopening.
(2)
See response under Action'tem 1, Item 4.
Since the motor operated valves stay closed and require operator action to reopen following signal reset, no corrective action is required because the required isolation is achieved without the use of the air-operated isolation valve.
In addition, these valves can be manually re-closed if required.
Further, turbine trip and feedwater isolation occur upon a Steam Generator Hi-Hi Signal in 2 out of 3 channels.
(3)
. The component cooling water fans control 'circuit will be modified to allow the fans to continue running after load conservation signal reset prior to the performance of the general test required by the bulletin.
The planned schedule for the ESF circuitry test has been discussed elsewhere in our response.
No interim actions are being taken since there is sufficient time for the operator to restart the fans after signal reset, if necessary, because temperatures in the auxiliary building will stabilize below equip-ment design limits.
(4)
The control circuit controlling the Auxiliary Building Charcoal Filter Dampers will be modified to prevent their reopening upon the reset of the CI-B signal.
The proposed schedule for the modifications is similar to those given in Note (3) above.
(5)
The control circuit for the containment recirculation fans will be modified to prevent the fans either from not starting. or from tripping when resetting the CI-B signal.
The proposed schedule to implement the modifications is similar to those discussed in Note (3) above.'ith regard to Notes (4) and (5) above, sufficient actions have already been taken to prevent the inadvertent or erroneous use of the CI-B signal reset switches in response to the NRC's generic review of containment purging and venting during normal plant operations and over-riding of safety actuation signals setforth in Hr. A. Schwencer's letter of November 28, 1978.
Our responses to t1r. Schwencer's letter submitted on January 4, 1979 (AEP:NRC:00114) and June 8, 1979 (AEP:NRC:00114A) describe the changes made to the Cook Plant which permanently address the matter of overriding of safety actuation signals.
Basically we provided:
a) sealed protective covers over the reset switches,
b) a "reset-blocked" alarm which annunciates to alert the operator anytime the 'reset pushbutton is used, whether or not a safety actuation signal is blocked (conservative measure),
c)- strict administrative controls governing the use of the reset switches and de-energizing the "reset-blocked" alarm requiring a Senior Reactor Operator to review the need to use the reset feature, place and remove the seals and de-energize the alarm, d) the installation of a warning notice beneath each reset switch which reads "Do Hot Reset Until the Cause for the Initiating Signal has been Evaluated",
and e) a procedural and training review which assures that adequate precautions are included to evaluate and review multiple plant parameters before determining the need to reset and that operators are not instructed to reset safety actuation signals.