Text

Safety Evaluation Accepting Util Actions to Comply W/Atws Rule (10CFR50.62).Licensee Should Continue W/Scheduled Installation & Implementation of ATWS Design Utilizing Administratively Controlled Procedures
	ML17326B598
Person / Time
Site:	Cook
Issue date:	04/14/1989
From:	; NRC
To:	;
Shared Package
ML17326B597	List: ML17326B596; ML17326B598;
References
	NUDOCS 8904210299
	Download: ML17326B598 (14)
	v • d • e

'%OR RECu

~c.

+

0 Cy

0 C

O I

t+/p %p*y4 UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D. C. 20555 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO COMPLIANCE WITH ATWS RULE 10 CFR 50.62 INDIANA MICHIGAN POMER COMPANY DONALD C.

COOK NUCLEAR PLANT UNITS NOS.

1 AND 2 DOCKETS NOS.

50-315 AND 50-316

1. 0 INTRODUCTION On July 26, 1984, the Code of Federal Regulations (CFR) was amended to include Section 10 CFR 50.62, "Requirements for Reduction of Risk from Anticipated Transients Without Scram (ATMS) Events for Light-Mater-Cooled Nuclear Power Plants" (known as the ATWS Rule).

The requirements of Section 10 CFR 50.62 apply to all commercial light-water-cooled nuclear power plants.

An ATWS is an anticipated operational occurrence (such as loss of feedwater, loss of condenser vacuum, or loss of offsite power) that is accompanied by a failure of the reactor trip system (RTS) to shut down the reactor.

The ATWS Rule requires specific improvements in the design and operation of commercial nuclear power facilities to reduce the probability of failure to shut down the reactor following anticipated transients and to mitigate the consequences of an ATWS event.

Paragraph (c)(1) of 10 CFR 50.62 specifies the basic ATWS mitigation system requirements for Westinghouse plants.

Equipment, diverse from the RTS, is required to initiate the auxiliary feedwater (AFW) system and a turbine trip for ATMS events.

In response to paragraph (c)(1), the Westinghouse Owners Group (WOG) developed a set of conceptual ATMS mitigating system actuation circuitry (AMSAC) designs generic to Westinghouse plants.

MOG issued Westinghouse Topical Report MCAP-10858, "AMSAC Generic Design Package,"

which provided information on the various Mestinghouse designs.

3904210299 390414 PDR ADOCK 05000315 P

PDC

The staff reviewed WCAP-10858 and issued a safety evaluation of the subject topical report on July 7, 1986 (Ref. 1).

In this safety evaluation, the staff concluded that the generic designs presented in WCAP-10858 adequately meet the requirements of 10 CFR 50.62.

The approved version of the WCAP is labeled WCAP-10858-P-A.

During the course of the staff's review of the proposed AMSAC design, the WOG issued Addendum 1 to WCAP-10858-P-A by letter dated February 26, 1987 (Ref. 2).

This Addendum changed the setpoint of the C-20 AMSAC permissive signal from 70K reactor power to 40% power.

On August 3, 1987, the WOG issued Revision 1 to WCAP-10858-P-A (Ref. 3), which incorporated Addendum 1 changes and provided details on changes associated with a new variable timer and the C-20 time delay.

For those plants selecting either the feedwater flow or the feedwater pump/valve status logic options, a variable delay timer is to be incorporated into the AMSAC actuation logics.

The time del'ay on the C-20 permissive signal for all logics will be lengthened to incorporate the maximum time that the steam g'enerator takes to boil down to the low-low setpoint upon a loss of MFW with the reactor operating at 40K power.

The staff considers the Revision 1 changes to be acceptable.

Paragraph (c)(6) of the ATWS Rule requires that detailed information to demonstrate compliance with the requirements be submitted to the Director, Office of Nuclear Reactor Regulation (NRR).

In accordance with paragraph (c) (6) of the ATWS Rule, Indiana Michigan Power Company (IMPCo) provided information by letter dated November 7, 1986 (Ref. 4).

The letter forwarded preliminary information on the detailed design of the ATWS Mitigating System Actuation Circuitry (AMSAC) proposed for installation at the Donald C.

Cook Nuclear Plant, Units 1 and 2.

The licensee provided additional information on the AMSAC design and also responded to the changes and revisions to the WCAP by letters dated June 25, 1987 (Ref. 5) and October 28, 1987 (Ref. 6).

The staff held conference calls with the licensee on November 11, 1987, January 17, 1988 and February 22, 1988 to discuss their AMSAC design and the information contained in Addendum 1 to the WCAP.

As a result of the conference calls, the licensee responded with additional information on December 18, 1987 (Ref. 7) and March 31, 1988 (Ref. 8).

The response raised additional questions with respect to the AMSAC output isolators, and the staff held a conference call with the licensee on April 26, 1988, during which isolation devices and their compliance to the requirements of Appendix A of the generic SER (Ref.

1) were discussed.

The licensee responded to the isolation device concerns by letter dated May 2, 1988 (Ref. 9).

2.0.

REVIEW CRITERIA The systems and equipment required by 10 CFR 50.62 do not have to meet all of the stringent requirements normally applied to safety-related equipment.

However, the equipment required by the ATWS Rule should be of sufficient quality and reliability to perform its intended function while minimizing the potential for transients that may challenge the safety systems, e.g.,

inadvertent scrams.

The following review criteria were used to evaluate the licensee's submittals:

l.

The ATWS Rule, 10 CFR 50.62.

2.

"Considerations Regarding Systems and Equipment Criteria,"

published in the Federal

Register, Volume 49, No. 124, dated June 26, 1984.

3.

Generic Letter 85-06, "guality Assurance Guidance for ATWS Equipment That Is Not Safety Related."

4.

Safety Evaluation of WCAP-10858 (Ref. 1).

5.

WCAP-10858-P-A, Revision 1 (Ref. 3).

3.0 DISCUSSION AND EVALUATION To determine that conditions indicative of an ATWS event are present, the licensee has elected to implement the WCAP-10858-P-A AMSAC design associated with monitoring the main feedwater (MFW) flow and activating the AMSAC when the MFW flow is below the low flow setpoint.

Also, the licensee will implement the new time delays (described in the introduction section) associated with the C-20 permissive timer and the variable actuation timer consistent with the requirements of Revision I to the WCAP.

Many details and interfaces associated with the implementation of the final AMSAC design are of a plant-specific nature.

In its safety evaluation of WCAP-10858, the staff identified 14 key elements that require resolution for each plant design.

The following paragraphs provide a discussion on the licensee's compliance with respect to each of the plant-specific elements.

l.

~Diversi t The plant design should include adequate diversity between the AMSAC equipment and the existing Reactor Protection System (RPS) equipment.

Reasonable equipment diversity, to the extent practicable, is required to minimize the potential for common-cause failures.

The licensee will utilize the existing Class lE MFW flow-sensing instru-mentation as input to AMSAC.

The AMSAC logic system equipment will be diverse from equipment used in the RPS in the areas of design and manufacturer.

The AMSAC output signals will interface with. existing auxiliary feedwater (AFW) pump and turbine trip circuitry.

This interface will use output relays that will be diverse (different make and manufacturer) from the relays used in the RPS.

2.

Lo ic Power Su lies Logic power supplies need not be Class 1E, but must be capable of performing the required design functions upon a loss of offsite power.

The logic power must come from a power sour ce that is independent from the RPS power

- -supplies.

The licensee has provided information verifying that the power supplies selected for the AMSAC logic circuits will be independent from the RPS power supplies and capable of operation upon a loss of offsite power.

3.

Safet -Related Interface The implementation of the ATWS Rule shall be such that the existing Reactor Protection System (RPS) continues to meet all applicable safety criteria.

The licensee has stated that the implementation of the AMSAC/RPS interface will be such that the existing RPS will continue to meet all applicable safety criteria (i.e., the RPS will continue to perform its safety function without interference from AMSAC).

Refer to Item 9 for further discussion on this issue.

4. ~li A

This element requires the licensee to provide information regarding compliance with Generic Letter (GL) 85-06, "guality Assurance for ATMS Equipment That Is Not Safety Related."

The licensee stated that the AMSAC equipment will be treated under a

quality assurance (gA) program that is in full compliance with the guidelines presented in GL 85-06.

5.

Maintenance B

asses Information showing how maintenance at power is accomplished should be provided.

In addition, maintenance bypass indications should be incorporated into the continuous indication of bypass status in the control room.

The licensee has stated that, during maintenance or surveillance of the AMSAC system or sensor inputs, the AMSAC output signals will be bypassed using a permanently installed bypass switch located on an existing control room panel.

The continuous indication of the AMSAC bypass will be displayed by an AMSAC trouble alarm window that will be located in the main control room.

6.

0 eratin B

asses The operating bypasses should be indicated continuously in the control room.

Diversity and independence of the C-20 permissive signal should be provided.

The licensee has provided information stating that the AMSAC logic will be automatically armed above 40% reactor power as indicated by the turbine first-stage impulse pressure signals.

The armed condition will be continuously indicated by a control room annunciator.

The C-20 permissive signal will be derived from existing protection system instrumentation and will be processed by the AMSAC logic circuitry which will be diverse from the reactor protection system logic circuitry.

The time delay on de-energization (TDOD) timer associated with the C-20 permissive signal will be set for a time period that is longer than the actuation variable timer consistent with the require-ments of Revision 1 to WCAP-10858-P-A.

7.

Means for B asses The means for bypassing shall be accomplished by the use of a permanently installed, human-factored, bypass switch or similar device.

Disallowed methods for bypassing mentioned in the guidance should not be utilized.

The licensee stated that bypassing AMSAC during testing and maintenance will be accomplished by the use of a permanently installed bypass switch.

The disallowed methods for bypassing, such as lifting leads, pulling fuses, blocking relays, or tripping breakers, will not be used.

The licensee has

conducted a human-factors review of the AMSAC maintenance and test bypass controls and bypass indications consistent with the plant's detailed control room design process.

8.

Manual Initiation Manual initiation capability of the AMSAC mitigation function must be provided.

The licensee discussed how manual turbine 'trip and auxiliary feedwater actuation are accomplished by the operator.

The licensee stated that existing manual controls for turbine trip and AFW actuation are located in the main control room and may be used by the operator to manually perform the AMSAC function if necessary.

The licensee has also provided for the manual initiation of AMSAC at the system level.

9.

Electrical Inde endence From Existin Reactor Protection S stem Independence is required from the sensor output to the final actuation device, at which point nonsafety-related circuits must be isolated from safety-related circuits by qualified Class 1E isolators.

The licensee discussed how electrical independence is to be achieved.

The proposed design requires isolation between AMSAC and the Class lE circuits associated with the MFW flow, the turbine first stage impulse chamber pressure

signals, and the AFW pumps.

The licensee has informed the staff that the required isolation will be achieved using electrical isolation devices that have been qualified and tested to Class lE electrical equipment requirements.

In addition, the isolators will be tested as described in Appendix A to the Safety Evaluation (Ref. 1).

The data and information required by Appendix A is to be compiled by the licensee and should be available for review during a subsequent site audit in accordance with Temporary Instruction 2500/20 (Ref. 10).

e

10.

Ph sical Se aration From Existin Reactor Protection S stem The implementation of the ATWS mitigating system must be such that the separation criteria applied to the existing RPS are not violated.

The licensee stated that the AMSAC circuitry will be located in separate cabinets and will be physically separated from the RPS.

In addition, the AMSAC cable routing will be in accordance with the physical separation criteria originally established for the station at the time of initial plant licensing.

Thus, the existing separation criteria for the RPS will not be compromised as a result of installing the AMSAC equipment.

11.

Environmental uglification The plant-specific submittal sho'uld address the environmental qualification of ATWS equipment for anticipated operational occurrences.

The staff was informed that the AMSAC cabinet and equipment will be located in the control room area which is considered a mild environment.

Based on the information provided it is the staff's understanding that the equipment will be qualified for anticipated operational occurences associated with the respective equipment locations.

12.

Testabilit at Power Measures to test the ATWS mitigating system before installation, as well as periodically, are to be established.

Testing of the system may be performed with the system in the bypass mode.

Testing from the input sensor through to the final actuation device should be performed with the plant shut down.

The licensee has stated that the AMSAC equipment will be functionally tested before and after installation.

The ANSAC system will be testable at power in the bypass mode in accordance with procedures approved for the Donald C.

Cook Nuclear Power Plant.

Bypassing AMSAC for testing and returning the system to ser vice will be controlled by administrative procedures.

The bypassed condition will be continuously indicated in the control room.

The periodic at-power testing frequency will be based on manufacturer and engineering recommendations.

The end-to-end test (including the AMSAC outputs through to the final actuation devices) will be performed during each refueling outage.

13.

Com letion of Miti ative Action The licensee is required to verify that (1) the protective action, once initiated, goes to completion and (2) the subsequent return to operation reouires deliberate operator action.

The licensee responded that once the ANSAC is initiated, the circuits for starting the AFW pump and the turbine trip will go to completion in accordance with existing plant circuit design.

Deliberate manual action on the part of the operator is required to reset the turbine trip circuits, restore the AFW pumps to standby status, and to reset the ANSAC output circuitry.

14.

Technical S ecifications The plant-specific submittal should address Technical Specification requirements for ANSAC.

The licensee responded stating that no Technical Specification action is proposed with respect to the ANSAC.

The licensee stated that the system does not meet NRC criteria for inclusion in the Technical Specifications.

The surveillance interval and actions required to service the AMSAC will be administratively controlled using station procedures.

The equipment required by the ATWS Rule to reduce the risk associated with an ATWS event must be designed to perform its functions in a reliable manner.

A method acceptable to the staff for demonstrating that the equipment satisfies the reliability requirements of the ATMS Rule is to provide limiting conditions for operation and surveillance requirements in the Technical Specifications.

In its interim Commission Policy Statement of Technical Specification Improvements for Nuclear Power Plants (52 FR 3788, February 6, 1987), the Commission established a specific set of objective criteria for determining which regulatory requirements and operating restrictions should be included in Technical Specifications.

The staff is presently reviewing ATMS requirements to criteria in this Policy Statement to determine whether and to what extent Technical Specifications are appropriate.

The staff will provide guidance regarding the Technical Specifications requirements for AHSAC at a later date.

4. 0 CONCLUSION The staff concludes, based on the above discussion and pending resolution of the Technical Specification issue, that the AHSAC design proposed by Indiana Hichigan Power Company for the Donald C.

Cook Nuclear Plants is acceptable and is in compliance with the ATWS Rule, 10 CFR 50.62, paragraph (c)(1).

The staff's conclusion is further subject to the satisfactory completion of isolation device qualification testing to which the licensee has committed.

It is the staff's position, that the AHSAC should not be declared operational prior to successful qualification of the electrical isolation devices in accordance with Appendix A to the Safety Evaluation (Ref. 1).

Until the NRC provides additional guidance regarding the use of Technical Specifications for ATWS requirements, the licensee should continue with the scheduled installation and implementation (planned operation) of the ATWS design utilizing administratively controlled procedures.

5.0 REFERENCES

Letter, C.

E. Rossi (NRC) to L. D. Butterfield (WOG), "Acceptance for Referencing of Licensing Topical Report," July 7, 1986.

2.

Letter, R. A. Newton (WOG) to J.

Lyons (NRC), "Westinghouse Owners'roup Addendum 1 to WCAP-10858-P-A and WCAP-11233-A:

AMSAC Generic Design Package,"

February 26, 1987.

3.

Letter, R. A. Newton (WOG) to J.

Lyons (NRC), "Westinghouse Owners'roup Transmittal of Topical Report, WCAP-10858-P-A, Revision 1, AMSAC Generic Design Package,"

August 3, 1987.

4 ~

Letter, M. P. Alexich (INP) to H.

R. Denton (NRC), "Generic Letter 83-28, 10 CFR 50.62, AMSAC," November 7, 1986.

5.