ML17334B011

Responds to 860924 Ltr Requesting Plant Schedules for Addressing plant-specific Design Features of ATWS Mitigation Sys Actuation Circuitry (Amsac).Request for Addl Info Re SER App a, Amsac Isolation Device Encl

ML17334B011
Person / Time
Site:	Cook
Issue date:	11/07/1986
From:	Alexich M INDIANA MICHIGAN POWER CO. (FORMERLY INDIANA & MICHIG
To:	Harold Denton Office of Nuclear Reactor Regulation
References
AEP:NRC:0838V, AEP:NRC:838V, GL-83-28, NUDOCS 8611120355
Download: ML17334B011 (22)

Text

~

~ p

+~e REGULATORY I'RNATI ON DISTR I BUT I QN SYS I- ( R IDS >

ACCESSION NBR 861 1 120355 DOC. DATE: 86/1 1/07 NOTARIZED: NO DOCKET FAC IL: 50-315 Donald C. Cook Nuclear Power Planti Unit 1> Ind iana a 05000315 50-316 Donald C. Cook Nuclear Power Planti Unit 25 Indiana 0 05000316 AUTH. NAl 1E AUTHOR AFFILIATION ALEXICH H, P. Indiana 8c Nichigan Electric Co.

RECIP. NANE RECIPIENT AFFILIATION DENTQNp H. R. Office of Nuclear Reactor Regulationi Director (post 851125

SUBJECT:

Responds to 860924 ltr requesting plant schedules f or addressing plant-specific design features of ATNB mitigation sos actuation circuitrg (Ai1SAC). Request for addi info re SER App Ai "Al'fBAC Isolation Device" encl.

DISTRIBUTION CODE: AO55D TITLE: QR/Licensing. Submittal: Salem COPIES RECEIVED: LTR ATWS l ENCL Events QL-83-28

j. SIZE:

NOTES:

RECIPIENT COP IES RECIP I ENT COP IES ID CODE/NANE LTTR ENCL ID CODE/NANE LTTR ENCL PNR-A ADTS PWR-A EB 1 1 PNR-A EICSB 2 2 PWR-A FOB 1 PNR-A PD4 LA 0 PWR-A PD4 PD 01 3 3 NIQQINQTON D 1 PWR-A PSB 1 1 PNR-* RSB 1 1 INTERNAL: ADN/LFNB 1 0 ELD/HDS3 0 IE/DI 1 1 IE/DGAVT 1 1 NRR LASHER, D 1 NRR PWR-A ADTS 1 1 NRR PWR-B ADTS 1 1 RD/RSIB 1 NRR/TANB 1 EQ FIL 04 1 1 RCN3 1 1 EXTERNAL: LPDR 03 2 2 NRC PDR 02 NBIC 05 1 TOTAL NU}')BER OF COPIES REQUIRED: LTTR 27 ENCL 24

~ g l(5 h~ ~ 'd 1k fhl I

f'I(h - Ilail/ 4 'I 1 I

~ ~

"t ~

l~ ' I

~C(LI( 9 7'- lt ('I f "~ ", 'IIL(f t. I P.' M h i'il lh f"

k

']

1 ('> '

h~(l

,>-,. kil3 ,l I

tf h

(  !"

'( I I

~If 'I

INDIANA 8 MICHIGAN ELECTRIC COMPANY P.O. BOX 16631 COLUMBUS, OHIO 43216 November 7, 1986 AEP:NRC:0838V Donald C. Cook Nuclear Plant Unit Nos 1 and 2 Docket Nos. 50-315 and 50-316 License Nos. DPR-58 and DPR-74 GENERIC LETTER 83-28; 10 CFR 50.62, AHSAC Mr. Harold R. Denton, Director Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, D.C. 20555

Dear Mr. Denton:

This letter responds to your September 24, 1986 letter requesting the D. C. Cook schedules for addressing the plant specific design features of the Anticipated Transients Without Scram (ATWS) Mitigation Systems Actuation Circuitry (AHSAC). Attachment 1 to this letter provides our background understanding of the AMSAC evolution. The purpose of this attachment is to ensure that there is no misunderstanding between ourselves and your staff regarding this issue. Attachment 2 contains responses to the SER and Appendix A of the SER. As we discussed with your staff, we have not responded fully to all SER items in Attachment 2 because we have not received all the required information from the Westinghouse Owners Group. As noted below, we anticipate receiving the necessary information in December 1986.

We have scheduled AHSAC installation and implementation/operation following the refueling outage in 1988 for D. C. Cook Unit 2 and the refueling outage in 1989 for Unir. 1.

Consistent with this plan, we have assumed an August 30, 1987 date for receiving the final AMSAC SER from the NRC to enable us to complete the required design and engineering planning for installation. The key event dates listed below must be achieved in order to support our schedule. This schedule would be impacted and would require revision, should external delays be incurred or major modifications imposed on the design of AMSAC as it currently exists.

a. Westinghouse Owners Group Draft Technical Specifications (T/Ss) are to be completed and submitted to the NRC by approximately December 1986.

b. The completion of a. above will enable the American Electric Power Service Corporation (AEPSC) to submit finalized response to the SER by'ebruary 28, 1987.

Sbi1120355 Sb1107 P,'

PDR .',ADOCK

-'"',s l',

-'05000315 PDR

f J 1 j

~ J" 6 I

~ I P

P E

Ci P

Mr. Harold R. Denton AEP:NRC:0838V

c. We anticipate approval of these Technical Specifications from the NRC by April 30, 1987.

d. Receipt of c. above will enable AEPSC to submit our plant-specific design to the NRC by May 30, 1987.

e. Receipt of the D. C. Cook Plant-specific AMSAC SER from the NRC by August 30, 1987 will enable us to finalize the design work.

This document has been prepared following Corporate procedures which incorporate a reasonable set of controls to insure its accuracy and completeness prior to signature by the undersigned.

Very truly yours, Vice President 0 (qQ Attachments MPA/cm cc: John E. Dolan W. G. Smith, Jr. - Bridgman R. C. Callen G. Bruchmann G. Charnoff NRC Resident Inspector - Bridgman

ATTACHHENT 1 TO AEP:NRC:0838V BACKGROUND OF AHSAC DESIGN

Attachment 1 to AEP: RC: 0838V Page 1 Back round The Westinghouse Owners Group (WOG) provided the analysis and design concept to the NRC for using an Anticipated Transients Without Scram Mitiga'tion System Actuation Circuitry (AMSAC) design. This design incorporates a 25-30 second delay on initiation of AHSAC based on 50% or less feedwater flow to 3 out of 0 steam generators with the reactor power greater than 70%. At this point AMSAC trips the turbine, initiates the motor-driven and turbine-driven auxiliary feedwater pumps, and conserves auxiliary feedwater. It should be noted that AMSAC does not provide a direct input to trip the reactor and does not input in any way into the Reactor Trip System (RTS) or SSPS logic.

Our understanding of the design basis of AMSAC is that a common-mode failure in the Reactor Protection System (RPS) should not result in the primary coolant pressure exceeding 3200 psig (Level C limit). (The term Reactor Protection System is interpreted as the Solid State Protection System (SSPS].) In other words, we are not postulating a failure in the Engineered Safeguard System Actuation System or any of the Engineered Safeguard Systems such as Auxiliary Feedwater. It is for this reason that we are able to utilize the cables from the SSPS outputs to the turbine trip devices, the auxiliary feedwater pump motor breakers, and auxiliary feedwater conservation devices.

The AMSAC system will provide an independent means of tripping the turbine and initiating auxiliary feedwater in the unlikely event of a common mode failure within the Reactor Protection System. The RPS failures that are considered are logic and power supply failures in the SSPS and/or automatic RTS initiation. The Engineered Safeguard Systems are functional and available for mitigating action; e.g., auxiliary feedwater can be used.

It follows then that other design bases accidents such as LOCA, HELB, and plant fires do not enter into AHSAC design bases.

As per the NRC Safety Evaluation Report (SER) 50-315/316, dated September 29, 1986, AMSAC is not required to be safety related; hence, we are not required to meet IEEE-279 (single-failure criterion, de-energize to actuate etc.). Also it is permissible to use existing sensors (including pressure and flow) (ref. above SER, p. 9, para. 3) and final actuation devices, e.g., auxiliary feedwater pump motor circuit breakers and the circuit breaker logic power supplies which are powered from station batteries. AMSAC hardware will be isolated from the RPS flow sensors by qualified, Class 1E, analog isolators at the input, and by relay coil/

contact isolation at the output. Care will be taken to ensure that in case of a seismic event, AHSAC hardware will not adversely interact with the RPS or Engineered Safety Features (ESF) system. AMSAC is a balance-of-plant, non-redundant system.

All AHSAC equipment will be located in a controlled environment in the control room area with major controls/indication integrated into the control room. For these reasons, AMSAC has no EQ or Appendix R requirements.

~ Attachment 1 to AEP:NR 838V Page 2 Attached are two figures: Figure 1 shows the generic Mestinghouse Owners Group option chosen by the American Electric Power Service Corporation (AEPSC) for its AMSAC design Figure igure 2 zs a conceptual1 block diagram of ANSAC that shows its major featur u es. . Ve are in th e process of eveloping deve o 'll design modifications separate from AHSAC th at wi 1 imit steam ump to  % or less during power operation. Therefore, the AHSAC system shown here does not contain provisions for limiting steam dump.

A.I.O. E.C.P. 2j 07107$

l OW PFEbWATER. FI oW Ql&H ~psi~E Ladle 1-(nO SCCoads I ~INC DCIa y 5o-l7-0 5CCo45 on gKQil ss4)

Time Bcl4 I W Qe:=@~Ca Iti~

>nova,'l (Q- ao Q RVPA MVF ~AW)

! 0 oolt10+o Ofl Hrta'IM&C 8c'J!cor.. ore i<<idatk54td llho.

l I I planetal Reset I I

I I

Tnrk'ate puallart Fr.a4patcv pgow I

+vip TUY "i4P AMERICAN ELECTIIIC POWER SERVICE CORPORATION PLANT INSTRUMENTATION C CONTROL E.C.P. SKETCH 0 C. Cuok /nit I 4 Unit LO ENG OR DATE 44'H.

QY~>cv 0<t. >I 88Ir CO CI R

NST.C CONTROLS SECTION TITLE ooo ~ WHShC. l oov.

OAK. btbhah~

0 sorer I or I

0 II

I Control Room Ind&ationt 1 I

IE SSPS Input Local l

~

I

~

i CH I,II,III,IV ndicatio a

AMSAC Log(c/

Test I Circuits R N

E To Auxiliary Feedwater P

L Devices 'ctuation U I A I T S I I Y

S To Feedwater Conservation Devices l S II ~

I A I I/I I 0 To Turbine Trip Actuation.Deuices N

l I/I I

~ I I 250VDC 120YAC I

• Existing AHSAC ESF pgguation Train A, 8 Flow Logic ANSAC

,, e I

Xmitters PS Control Inverter Power i,l I

I I

I I

pS I/I om Turbine Exi ting 1st Stage N-T ain Pressure Batter I

Independent t IE I I i Supply l

ATTACHMENT 2 TO AEP:NRC:0838V D. C. COOK PLANT-SPECIFIC RESPONSES

a N

Attachment 2 to AEP: C:0838V Page 1 Diversitv "The plant specific submittal should indicate the degree of diversity that exists between the AHSAC equipment and the existing Reactor Protection System. Equipment diversity to the extent reasonable and practicable to minimize the potential for common cause failures is required from the sensors output to, but not including, the final actuation device, e.g., existing circuit breakers may be used for the auxiliary feedwater initiation. The sensors need not be of a diverse design or manufacture. Existing protection system instrument sensing lines, sensors, and sensor power supplies may be used. Sensor and instrument sensing lines should be selected such that adverse, interactions with existing control systems are avoided."

~Res onse The Cook Plant has two feedwater flow measurement loops for each steam generator. Each loop consists of a transmitter, instrument sensing lines, and a transmitter power supply. These two feedwater flow measurement loops share a common flow nozzle. By using a selector switch, either loop can be selected to provide the signal used for steam generator level control. Both of the loops provide a signal for feedwater flow/steam flow mismatch to the Reactor Protection System (RPS). We plan to use one of the two existing feedwater flow measurement loops (transmitter, instrument sensing lines and transmitter power supply) for AHSAC along with the existing final actuation devices associated with auxiliary feedwater initiation, auxiliary feedwater conservation, and turbine trip. Since an existing loop of transmitter and instrument sensing lines will be used, adverse interactions with existing control systems due to the addition of transmitters and instrument sensing lines will be avoided.

We will be using logic equipment and bistables for the AHSAC system that are diverse from the RPS. These devices will be arranged such that adverse interactions with RPS logic and RPS output relays will be prevented.

2. Lo ic ower su lies "The plant specific submittal should discuss the logic power supply design. According to the rule, the AHSAC logic power supply is not required to be safety-related (Class 1E). However, logic power should be from an instrument power supply that is independent from the reactor protection system (RPS) power supplies. Our review of additional information submitted by WOG indicated that power to the logic circuits will utilize RPS batteries and inverters. The staff finds this portion of the design unacceptable, therefore, independent power supplies should be provided."

~Res onse We will use the existing N-train battery and use an AHSAC inverter which will not be used to power any RPS loads. The N-train battery is to AEP: C:0838V e Page 2 independent of the station batteries which power the RPS inverters.

The logic power supply will be direct current from the N-train battery and the bistables will be powered from the AMSAC inverters.

3. Safet -related interface "The plant specific submittal should show that the implementation is such that the existing protection system continues to meet all applicable safety criteria."

R~es onse The AMSAC system inputs will" be isolated by analog isolators such that a failure in the AMSAC system will not result in a failure of the RPS.

Based upon the results of further study, one of the following two approaches will be used for the isolators:

1) We will qualify and use the presently installed analog isolators which isolate the steam generator level control circuits from the feedwater flow signals to the RPS (feedwater flow/steam flow mismatch) circuits. The AHSAC bistables for sensing less than 50% feedwater flow will be connected into the steam generator level control circuits.

2) We will add another analog isolator to four of the feedwater flow analog loops, one for each steam generator. These devices will connect to the AHSAC bistable for sensing less than 50% feedwater flow. This isolator will be powered from the AHSAC 120 V a.c.

inverter.

Relay coil/contact isolation at the AMSAC output will prevent failures within AMSAC from being propagated into the safeguards actuation circuits and the RPS.

ualit assurance "The plant specific submittal should provide information regarding compliance with Generic Letter 85-06, 'Quality Assurance Guidance for ATWS Equipment that is not Safety-Related.'"

~Res ense The applicable portions of the Quality Assurance Program as set forth in the "Updated Quality Assurance Program Description for the Donald C. Cook Nuclear Plant" (FSAR Chapter 1.7) will be applicable to those items of AMSAC equipment designated Class IE. Further details on the other equipment will be included in our submittal following the Westinghouse Owners Group submittal of Technical Specifications.

Maintenance b asses "The plant specific submittal should discuss how maintenance at power is accomplished and how good human factors engineering practice is incorporated into the co'ntinuous indication of bypass status in the control room."

~

~

Attachment 2 to AEP: C:0838V

~Res ense AMSAC will be disabled for repair and maintenance. This will be accomplished through a bypass switch or similar device whose status will be continuously monitored in the control room. The human factors aspect will be addressed in our submittal following Westinghouse Owners Group submittal of Technical Specifications. As noted in our cover letter, our submittal is tentatively scheduled for February 1987.

6. 0 eratin b asses "The plant specific submittal should state that operating bypasses are continuously indicated in the control room; provide the basis for the 70% or plant specific operating bypass level; discuss the human factors design aspects of the continuous indication; and discuss the diversity and independence of the C-20 permissive signal (Defeats the block of AMSAC)."

~Res ense We will have continuous indication in the control room when AMSAC is in the bypass mode. The Westinghouse Owners Group WCAP-10858 contains the basis for the 70% power operating bypass level and the diversity and independence of the C-20 permissive signal. The human factors design aspects of the continuous indication will be addressed in our submittal following Westinghouse Owners Group submittal of Technical Specifications. As noted in our cover letter, our submittal is tentatively scheduled for February 1987.

7. Means for b assin "The plant specific submittal should state that the means for bypassing is accomplished with a permanently installed, human factored, bypass switch or similar device, and verify that disallowed methods mentioned in the guidance are not utilized."

~Res onse We will utilize a permanently installed switch for bypassing AMSAC.

We will not be using any disallowed methods to place AMSAC in bypass.

The disallowed methods consist of pulling fuses, lifting leads, tripping breakers, or physically blocking relays. On-line testing of the logic portion of the circuits will be done by use of this bypass switch. Relay output testing will be done on an off-line basis.

8. Manual initiation "The plant specific submittal should discuss how a manual turbine trip and auxiliary feedwater actuation are accomplished by the operator."

to AEP: C:0838V e R~es onse At the component level, the operator can manually trip the turbine and manually actuate auxiliary feedwater from the control room.

Manual initiation of AMSAC at the system level will be accomplished through a control switch or pushbutton. The human factors aspect of the manual initiation will be addressed in our submittal following Westinghouse Owners Group submittal of Technical Specifications. As noted in our cover letter, our submittal is tentatively scheduled for February 1987.

Electrical inde endence from existin reactor rotection s stem "The plant specific submittal should show that electrical independence is achieved. This is required from the sensor output to the final actuation device at which point non-safety-related circuits must be isolated from safety related circuits by qualified Class 1E isolators. Use of existing isolators is acceptable. However, each plant specific submittal should provide an analysis and tests which demonstrates that the existing isolator will function under the maximum worst case fault conditions. The required method for qualifying either the existing or diverse isolators is presented in Appendix A."

R~es onse AMSAC logic and power supply are independent of the RPS logic and power supply. The AMSAC alarms will be annunicated on annunciators that are powered from the existing control room 125 Vac annunciator bus. The AMSAC analog inputs will be from existing sensors which are powered from existing RPS power supplies. Please refer to our response to Appendix A for information on the isolators.

10. Ph sical se aration from existin reactor rotection s stem "Physical separation from existing reactor protection system is not required, unless redundant divisions and channels in the existing reactor trip system are not physically separated. The implementation must be such that separation criteria applied to the existing protection system are not violated. The plant specific submittal should respond to this concern."

~Res onse We have separation between trains of the RPS; therefore, physical separation between AMSAC and the RPS is not required. The RPS separation criteria will remain unaffected by the installation of AMSAC.

11. Environmental uglification "The plant specific submittal should address the environmental qualification of ATWS equipment for anticipated operational occurrences only, not for accidents."

to AEP: C:0838V e

R~es ense We will be placing the new equipment for the AHSAC system in a controlled environment in the control room. There are no high-energy lines present in the area; therefore, special 10 CFR 50.49 environmental qualification will not be needed.

12. Testabilit at ower "Measures are to be established to test, as appropriate, non safety related ATWS equipment prior to installation and periodically.

Testing of AHSAC may be performed with AMSAC in bypass. Testing of AHSAC outputs through the final actuation devices will be performed with the plant shut down. The plant specific submittals should present the test program and state that the output signal is indicated in the control room in a manner consistent with plant practices including human factors."

~Res onse The testing of AMSAC with the unit at power will be performed with the AHSAC system in bypass. The testing at power of the AMSAC non-safety related components will consist of checking system operation from the input of the bistables to the input of the AMSAC actuation output relays. Full testing of the AMSAC system will require the unit to be shut down." The specific details will be submitted in our submittal following Westinghouse Owners Group submittal of Technical Specifications. As noted in our cover letter, our submittal is tentatively scheduled for February 1987.

13. Com letion of miti ative action "AMSAC shall be designed so that, once actuated, the completion of mitigating action shall be consistent with the plant turbine trip and auxiliary feedwater circuitry. Plant specific submittals should verify that the protective action, once initiated, goes to completion, and that the subsequent return to operation requires deliberate operator action."

~Res onse The Westinghouse Owners Group low feed flow design delays the unlocking of AMSAC (C-20 signal) for 60 seconds to allow AHSAC initiation to follow through to completion. The WCAP-10858 provided the basis for this design. Its implementation will be consistent with existing plant turbine trip and existing auxiliary feedwater control circuit requirements.

Initial plant checkout testing will verify that once initiated, AHSAC wil'1 go to completion. Our design requires a deliberate action from the operator to reset the AMSAC system. AMSAC system will be continuously monitored in the control, room.

to AEP: C:0838V Page 6

14. Technical S ecifications "Technical specification requirements related to AMSAC will have to be addressed by plant specific submittals."

~Res ense The Westinghouse Owners Group is writing the generic Technical Specifications (T/Ss) and plans to submit them to the NRC for approval in approximately December 1986. We will submit Cook Plant Technical Specifications following Westinghouse Owners Group submittal of Technical Specifications. As noted in our cover letter, our submittal is tentatively scheduled for February 1987.

~ ~

~

Attachment 2 to AEP:NRC:0838V Page 7 SER APPENDIX A, AMSAC ISOLATION DEVICE, REQUEST FOR ADDITIONAL INFORMATION "For the type of device used to accomplish electrical isolation, describe the specific testing performed to demonstrate that the device is acceptable for its application(s). This description should include elementary diagrams when necessary to indicate the test configuration and how the maximum credible faults were applied to the devices.

b. "Data to verify that the maximum credible faults applied during the test were the maximum voltage/current to which the device could be exposed, and define how the maximum voltage/current was determined.

"Data to verify that the maximum credible fault was applied to the output of the device in the transverse mode (between signal and return) and other faults were considered (i.e., open and short circuits).

d. "Define the pass/fail acceptance criteria for each type of device."

Res onse to a. throu h d above:

The above information is being developed and will be submitted in our submittal following Westinghouse Owners Group submittal of Technical Specifications. As noted in our cover letter, our submittal is tentatively scheduled for February 1987.

e. "Provide a commitment that the isolation devices comply with the environment qualifications (10 CFR 50.49) and with the seismic qualifications which were the basis for plant licensing."

~Res ense:

The analog and logic isolation devices will be located in a mild environment (in the control room), so special 10 CFR 50.49 environmental qualification is not required. Our plan is to use analog isolators which are already seismically qualified or to add seismically qualified analog isolators to spare locations in existing seismically qualified Foxboro racks. New equipment will be seismically qualified to meet or exceed the original seismic bases for plant licensing.

f. "Provide a description of the measures taken to protect the safety systems from electrical interference (i.e., Electrostatic Coupling, EMI, Common Mode and Crosstalk) that may be generated by the ATWS circuits.

g. "Provide information to verify that the Class 1E isolator is powered from a Class 1E source."

,Attachment 2 to AEP: C:0838V Res onses to f and . above:

The above information is being developed and will be included in our submittal following Westinghouse Owners Group submittal of Technical Specifications. As noted in our cover letter, our submittal is tentatively scheduled for February 28, 1987.