ML18022A632

Submits Addl Info to Suppl 880111 Ltr Re plant-specific ATWS Mitigating Sys Actuation Circuitry Per 10CFR50.62, Including Sys Test Frequencies,Simplified Logic Diagram & Ser,App a Info

ML18022A632
Person / Time
Site:	Harris
Issue date:	04/12/1988
From:	Loflin L CAROLINA POWER & LIGHT CO.
To:	NRC OFFICE OF ADMINISTRATION & RESOURCES MANAGEMENT (ARM)
References
NLS-88-084, NLS-88-84, NUDOCS 8804210144
Download: ML18022A632 (20)

Text

ACCEIZRLTED DI&iIBUTION DEMONSTRATION SYSTEM REGULATORY INFORMATION DISTRXBUTION SYSTEM (RIDS)

ACCESSION NBR:8804210144 DOC.DATE: 88/04/12 NOTARIZED: NO DOCKET FACIL:50-400 Shearon Harris Nuclear Power Plant, Unit 1, Carolina 05000400 AUTH. NAME AUTHOR AFFILIATION LOFLIN,L.'I. Carolina Power & Light Co.

RECIP.NAME RECIPIENT AFFILIATION Document Control Branch (Document Control Desk)

SUBJECT:

Submits addi info to suppl 880111 ltr re plant-specific ATWS mitigating sys acutuation circuitry.

DISTRIBUTXON CODE: A001D COPIES RECEIVED:LTR ENCL SIZE:

TITLE: OR Submittal: General Distribution NOTES:Application for permit renewal filed. o5ooo4oo S

RECIPIENT COPIES RECXPIENT COPIES ID CODE/NAME LTTR ENCL ID CODE/NAME LTTR ENCL PD2-1 LA 1 0 PD2-1 PD 5 5 BUCKLEY,B 1 1' A INTERNAL: ACRS 6 ARM/DAF/LFMB 1 0 NRR/DEST/ADS 7E 1 1 NRR/DEST/CEB 8H 1 1 NRR/DEST/ESB 8D 1 1 NRR/DEST/MTB 9H 1 1 NRR/DEST/RSB 8E 1 1 NRR/DOEA/TSB 1 1 1 1

~RR+1B~~~B 12 1 1 OGC 15-B-18 1 0 1 1 RES/DE/EIB 1 1 EXTERNAL: LPDR 1 1 NRC PDR 1 1 NSIC 1 1

'A TOTAL NUMBER OF COPIES REQUIRED: LTTR 27 ENCL 24

ggQ1, Carolina Power & Light Company APR 2 2 f988 SERIAL: NLS-88-084 United States Nuclear Regulatory Commission ATTENTION: Document Control Desk Washington, DC 20555 SHEARON HARRIS NUCLEAR POWER PLANT DOCKET NO. 50-400/LICENSE NO. NPF-63 SUPPLEHENTAL PLANT-SPECIFIC AHSAC SUBMITTAL

REFERENCE:

CP&L letter to NRC dated January 11, 1988 NLS-87-258 Gentlemen:

Carolina Power & Light hereby submits additional information to supplement the reference letter dealing with the Shearon Harris Nuclear Power Plant (SHNPP) plant-specific AMSAC. This information is required by 10CFR50.62 and delineated in the staff's SER on WCAP 10858. This supplemental information includes: system test frequencies; a simplified logic diagram; and the SER Appendix A information for the output isolation relays. These items are provided in the attachment to this letter.

At that time of the January submittal, the SHNPP AMSAC design was not yet finalized. As a result, some of the testing methodology described in the reference submittal has changed due to subsequent evolutions and refinements of the system design. To aid in your review, CP&L has provided in Section 12 of the attachment a comprehensive, revised discussion of the system's testing capabilities which supercedes Section 12 of the previous submittal.

Carolina Power & Light has proceeded with design and procurement of nonsafety related AHSAC equipment in accordance with Section 19 of the Corporate Quality Assurance Program (Radwaste Q). The activities to date have been primarily performed at the Corporate General Office.

During preparation of the plant modification package that control of quality assurance for site activities related to AMSAC it was determined would be more appropriately implemented via existing site procedures for nonsafety related equipment. Accordingly, CP&L's response regarding nonsafety related equipment in Section 4.0, Quality Assurance, has been revised 'and is included in the attachment. This does not represent a reduction in CP&L's implelnentation of the guidance presented in Generic Letter 85-06, only a change in how CP&L is implementing that guidance.

It remains CP&L's intent to maintain the schedule of installing AHSAC during the first refueling outage (i.e.,July 1988) if final NRC 8804210144 880412 PDR ADOCK 05000400 P DCD 411 Fayettevilte Street > P. 0. Box 1551 o Raleigh. N. C. 27602

,0I

))t

~ ~

l I

~t!",. ~'

.I >A

Document Control Desk NLS-88-084 / Page 2 acceptance of the SHNPP AMSAC package is received by June 1,1988.

Approval of the SHNPP AMSAC modification is required by June 1,1988 to provide sufficient time to finalize modification packages to be implemented during the first RFO. If final NRC approval of the SHNPP AMSAC package cannot be provided by June 1,1988 CP&L again requests NRC concurrence with delaying the implementation of AMSAC at SHNPP until the second RFO.

Given the schedule restrictions necessary to ensure that the system can be installed during the first RFO, CP&L requests that the NRC review the SHNPP plant-specific application and provide preliminary feedback by April 29, 1988 to minimize any potential impact upon the implementation schedule.

Please refer any questions regarding this submittal to Mr. Steven Chaplin at (919) 836-6623.

Yours very truly, Leonard I'oflin Manager Nuclear Licensing Section LIL/SDC Enclosure cc: Mr. B. C. Buckley W/A Dr. J. Nelson Grace W/A Mr. G. F. Maxwell W/A

Attachment to NLS-88-080

)

SHNPP RESPONSE TO PLANT-SPECIFIC REQUIREMENTS OF ATWS/AMSAC SAFETY EVALUATIONREPORT ADDENDUM (540 l SDC/ess )

t t Attachment to NLS-88-080 Page 1 of 12 SUPPLEMENTAL RESPONSE TO PLANT-SPECIFIC REQUIREMENTS OF ATWS SAFETY EVALUATIONREPORT GENERAL The CPRL AMSAC system utilizes the capabilities of a pair of redundant microprocessors in a moderately sophisticated scheme in order to enhance system operability and reliability. As a result, the system does not lend itself to the type of simplified logic diagrams typically depicted in the AMSAC WCAPs. However, in order to facilitate the staff's review, a simplified Functional Diagram (Figure 1) has been attached to provide an overall view of the AMSAC system from its interface with the existing plant input signal to its interface with the output actuation circuitry. To maintain the simplicity of the diagram, the more relevant functions of the microprocessors have been depicted as subprograms, the outputs of which feed the overall program logic. The detailed operations of these subprograms have been provided on separate figures (Figures 2 and 3). Although all of the functions and capabilities of the system are not depicted by the diagram, CPRL believes that the attached figures provide the level of detail required for the NRC to perform its review. The information concerning testing capabilities (Section 12) provides a discussion of the system capabilities which will help explain the Functional Diagram.

PLANT-SPECIFIC INFORMATIONSPECIFIED BY SER 0.0 QUALITYASSURANCE The plant-specific submittal should provide information regarding compliance with Generic Letter 85-06, "Quality. Assurance Guidance for ATWS Equipment that is not Safety Related."

RESPONSE

A. Nonsafet Related QA guidance for nonsafety-related AMSAC equipment has been provided by the NRC through Generic Letter 85-06. Carolina Power R Light Company has reviewed the Generic Letter and has determined that the requirements for radioactive waste management systems provided in Section 19 of the CPRL Corporate Quality Assurance Program (CQAP) meet or exceed the guidance provided in Generic Letter 85-06 with the exception of Sections IX and XVIII. Therefore, CPRL's corporate design and procurement activities for nonsafety-related AMSAC equipment will be controlled in accordance with Section 19 of the CQAP.

Carolina Power R Light Company's plant site activities will be controlled by plant procedural requirements for nonsafety-related equipment. These site procedures meet or exceed the guidance for quality assurance pr ovided in Generic Letter 85-06 with the exception of Section XVIII.

In order to ensure that the guidance concerning Audits (Section XVIII)is met, plant modifications that involve AMSAC will be included in the population of modifications from which QA audit samples are selected. This measure will be taken in addition to the normal reviews by line management provided for in procedures for engineering plant modifications.

(5401SOC/I ah )

Attachment to NLS-33-030 Page 2 of 12 Existing engineering and plant modification control procedures provide for controls over Special Processes (Section IX).

Record keeping for design control and modification of existing plant systems will comply with the requirements of 10CFR50.59.

9.0 ELECTRICAL INDEPENDENCE FROM EXISTING REACTOR PROTECTION SYSTEM The plant-specific submittal should show that electrical independence is achieved.

This is r'equired from the sensor output to the final actuation device at which point nonsafety-related circuits must be isolated from safety-related circuits by qualified Class 1E isolators. Use of existing isolators is acceptable. However, each plant-specific submittal should provide an analysis and tests which demonstrate that the existing isolator will function under the maximum worst-case fault conditions. The required method for qualifying either the existing or diverse isolators is presented in Appendix A.

RESPONSE

Isolation relays will be used for the nonsafety to safety-related interface on AMSAC outputs. Nonsafety AMSAC outputs will energize the coils of the isolation relays with the relay contacts initiating ATWS mitigation in safety-related circuits. Safety and nonsafety relay panel wiring will be physically separated.

Carolina Power dc Light will use the Struthers and Dunn Model 219XBX230 relay for output isolation. These relays are existing spares which are seismically and environmentally qualified Class IE devices installed in Class 1E isolation cabinets at SHNPP. It is CPRL's understanding that this relay module had been accepted by the NRC for this application at other facilities and that selection of this module would resolve the NRC concerns that a qualified isolation device would be used. It is not used in the reactor protection system, thereby ensuring the required diversity for protection against common mode failures in both AMSAC and RPS. To the extent applicable, the Appendix A information for this unit is provided below to show'that this unit is used in a configuration enveloped by its testing.

Specific responses to the Appendix A information requests are provided below for the signal output isolation devices. The Appendix A information requests are restated followed by the response pertaining to these output isolation devices.

RESPONSE TO APPENDIX A: OUTPUT ISOLATION DEVICES Information Re uest A For the type of device used to accomplish electrical isolation, describe the specific testing performed to demonstrate that the device is acceptable for its application(s). This description should include elementary diagrams when necessary to indicate the test configuration and how the maximum credible faults were applied to the devices.

(540ISDC/lych )

Attachment to NLS-88-084 Page 3 of 12

~Res onse New and thermally aged,Struthers-Dunn test relays were subjected to a hypot test between the coil and contacts of 0000 VRMS for one minute. A hypot test between coil and frame of 0000 VRMS for one minute was also conducted. The results of this testing concluded the relays performed their required isolation function and withstood the specification for the 0000 VRMS isolation test.

Information Re uest B Data to verify that the maximum credible faults applied during the test were the maximum voltage/current to which the device could be exposed, and define how the maximum voltage/current was determined.

~Res onse The power supplies used for the Struthers-Dunn isolation relays will be nominal 120 VAC. In view of the 0000 VRMS isolation design (0000 VRMS Test), the isolation relays are adequate for this application.

Information Re uest C Data to verify that the maximum credible fault was applied to the output of the device in the transverse mode (between signal and return) and other faults were considered (i.e., open and short circuits).

~Res onse While this request seems to be for an electronic signal isolator, a 0000 VRMS isolation test between relay coil, contacts, and frame should satisfy any transverse concerns for a relay.

Information Re uest D Define the pass/fail acceptance criteria for each type of device.

~Res onse Isolation relays type tested for SHNPP must withstand 0000 VRMS hypot testing for one minute without a loss of electrical isolation.

Information Re uest E Provide a commitment that the isolation devices comply with the environmental qualifications (IOCFR50.09) and with the seismic qualifications which were the basis for plant licensing.

~Res onse The Struthers-Dunn isolation relays will be installed in a mild environment. The relays were thermally aged and seismically tested to meet the environmental and seismic qualification for the plant licensing basis at SHNPP.

(5401SDc/mss )

I

'a W I

Attachment to NLS-88-080 Page 0 of 12 Information Re uest F Provide a description of the measures taken to protect the safety systems from electrical interference (Le., Electrostatic Coupling, EMI, Common Mode, and Cross Talk) that may be generated by the ATWS circuits.

~Res onse The subject Class lE isolation cabinets at SHNPP are dedicated for control circuits and are, therefore, segregated from signal circuitry which may be susceptible to electrical interference.

Information Re uest G Provide information to verify that the Class 1E isolator is powered from a Class 1E source.

~Res onse ATWS output isolation relays will be powered from a battery-backed nonsafety power source supplied in the existing relay isolation cabinets. Loss of power to the output isolation relay would disable the AMSAC output; however, it would not have any effect on isolation of AMSAC from existing safety-related circuitry. The output relays do not require power classification beyond the level of nonsafety battery back-up on the nonsafety side of the isolation equipment.

12.0 TESTABILITYAT POWER Measures are to be established to test, as appropriate, nonsafety-related ATWS equipment prior to installation and periodically. Testing of AMSAC may be performed with AMSAC in bypass. Testing of AMSAC outputs through the final actuation devices will be performed with the plant shut down. The plant-specific submittals should present the test program and state that the output signal is indicated in the Control Room in a manner consistent with plant practices including human factors.

~Res onse Some of the testing methodology described in the 3anuary 11, 1988 submittal have changed as a result of subsequent evolutions and refinements of the system design. To avoid any confusion as to the capabilities of the existing design, the following is a comprehensive, revised discussion of the system's testing capabilities which supersedes the description provided in the previous submittal. The attached AMSAC Functional Diagram will be used to help demonstrate which portions of the system are being tested by each manual test described below.

AMSAC will undergo testing/calibration on a refueling outage basis. It is anticipated that testing/calibration will be performed in three overlapping segments: sensor input loops, the AMSAC processors and output isolation relay, and the final actuation circuitry/device. Regardless of the number of segments, the testing of AMSAC will be conducted pursuant to plant procedures in a manner that provides effective end-to-end testing of the AMSAC capability.

(540lsDc/mss)

~ 'ttachment NLS-88-080 to Page 5 of 12 o INPUT INSTRUMENT LOOP VERIFICATIONAND CALIBRATION The existing steam generator level and turbine pressure input instrumentation loops are presently calibrated once a refueling outage as a part of the existing reactor protection system. The plant procedures governing those calibrations will be modified to test the additional isolator and current-to-voltage conversion in each loop that feeds the AMSAC system.

These procedures will test and calibrate the AMSAC input signals from the sensors through the isolators to the test terminal strips in the AMSAC cabinet.

o PROCESSOR TEST AND CALIBRATION The AMSAC cabinet is equipped with a special test/terminal strip which enables the technician to break the connection from any input signal to either processor by simply opening a knife blade type contact across the input and output lugs of the terminal strip. A simulated input signal can then be injected into either processor by plugging a 0-5 VDC signal generator into the signal injection port on the output lug of the terminal strip. The terminal strip is accessible from the front of the AMSAC cabinet so that the technician can readily view the information displayed on the local panel.

Using this capability to simulate inputs and the various information displayed on the AMSAC panel, a functional test and calibration of the AMSAC processor can be performed. The processor's comparators which identify the "tripped" condition'and perform the "spread checks" for each of the AMSAC signal inputs can be calibrated. The setpoints can be verified or adjusted by observing the input value which activates the corresponding lamps on the cabinet display. By injecting various combinations of signals into each "processor, the program logic can be verified and the capability of each processor to independently trip the final output isolation relay can be verified. During the course of this testing and calibration, proper functioning of the AMSAC panel and Control Room displays can be verified. At the conclusion of the tests, the continuity across the closed knife contacts on the terminal strip will be verified for each input to the processor under test/calibration.

The processor test and calibration will cover the AMSAC circuitry from the input test/terminal strip to its output interface with the existing turbine trip and Auxiliary Feedwater (AFW) actuation circuits, i.e., the output isolation relay. This testing will verify that AMSAC, at the output interface, is capable of initiating the required actuation functions.

(5401SOC/mss )

~~

4V

Attachment to NLS-88-080 Page 6 of 12 o FINAL ACTUATIONCIRCUIT TEST The turbine trip and AFW actuation circuits are tested independently of AMSAC by the existing test program on at least a once per refueling basis.

The plant procedures governing these tests will be amended as appropriate to include the additional circuit from AMSAC. The combination of the input instrument loop calibration, the processor testing, and the final actuation circuit testing will provide effective end-to-end testing of the AMSAC capability.

In addition to the manual periodic test/calibration described above, the following sections describe the automatic checks performed by each processor.

CONTINUOUS SELF-DIAGNOSTICS (AUTOMATIC)

Each programmable controller will perform self-diagnostics to ensure proper operation. Immediately upon power-up, it will perform a cyclic redundancy check on the read only memory (EPROM) containing the microprogram which directs the programmable controller operation. The self-diagnostics will test the random access memory (RAM) to ensure it can be written to, and read from, and verify proper operation of the arithmetic and logic functions.

A parity check on the program memory is performed each time an instruction is executed. This involves encoding a specific "parity bit" tracer at predetermined locations in the program data in memory. The controller verifies the authenticity of the command by verifying the existence and location of the parity bit. A watchdog timer will check that each scan is executed normally. These checks will ensure that the hardware functions properly and the software is not corrupted. Processor failures identified will be indicated by activation of the "Trouble Lamp" in the control room and on the local AMSAC panel.

o SENSOR INPUT QUALITYCHECKS (AUTOMATIC)

The AMSAC controller program will perform a "spread check" on AMSAC input signals every scan cycle and light the "AMSAC Trouble" lamp in the Control Room and on the local AMSAC panel if a large difference exists among the signal inputs from the steam generators or the turbine. The plant personnel will then use the AMSAC panels diagnostic features to investigate the nature of the problem. The spread checks test each signal for most failure modes, however, slight instrument drift cannot be detected. Figure 0 shows the controls and displays currently planned for this local AMSAC panel.

The final design is subject to minor changes.

Status lights for the steam generator level and power level inputs to each controller unit will indicate which of the inputs was exhibiting the excessive "spread" which initiated the "AMSAC Trouble" lamp in the Control Room.

Diagnostic capabilities at the AMSAC panel, in conjunction with existing control room instrumentation, will enable plant personnel to establish the probable source of the problem that actuated the trouble light.

(5401SDC/ms s )

Attachment to NLS-88-080 Page 7 of l2 These status lamps will also indicate any inputs which are in a "tripped" status for having exceeded their setpoint values. A separate "variable

.tripped" lamp indication will allow plant personnel to distinguish indication of an input exceeding its setpoint from that of the input exhibiting an excessive spread from the other corresponding inputs.

o PROCESSOR VOTING RELAY TEST (AUTOMATIC)

To enhance reliability and testability, each AMSAC controller unit will drive three relays wired in a configuration shown in the attached Figure 5.

Continuity is required across these contacts in order to supply power to the isolation relays which initiate mitigating actions. One of the relays from each controller unit (labeled A3 and B3) we be normally closed during operation and opened only when the associated controller unit is isolated in a test mode. The other two relays from each unit are redundant modules which are normally open and close only upon an AMSAC actuation signal from the associated controller. This configuration of redundant output relays from independent controller units contributes significantly to the reliability of the system. These relays are automatically tested every IO days by the Output Relay Test Subprogram. Auxiliary circuits enable each processor to open or close its associated relays individually while maintaining a non-tripped configuration. The processor is then capable of testing relay operation by generating a test signal which is passed through the relay contracts. Proper contact position is verified by receipt of the signal at the contact output.

The test signal connections and relay sequencing logic are configured to ensure that each output relay (e.g., Al to A3 and Bl to B3) is unambiguously tested to open and close on the appropriate command.

(5401SDc/mss )

~n I

Attachment to NLS-88-084 Page 8 of 12 SHNPP AMSAC FUNCTIONAL DIAGRAM LEGEND AMSAC jCABINET 7 I )ER AN) GATE INPUTS SUBPROGRAMS OUTPUT CR OAVE SIGNAL PROCESS I M IA)IICNAT I C/CO)IT I IA)KS)

PROCESSOR A TEST Io SPREAD FAluRE INI')PUT I~

CIECK TERMINAL O ALL PINER I ~S BYPASSED STRIP Q ALL LEVEL BYPASSED I LOCAL Q REFERENCE SIGNAL FAILLE SIGNAL lEST/CALI BRATI Ctl CABINET MAIN CONTROL ISOLATOR SIGNAL ItkECTICN L J DISPLAYS BOARD INPUTS RACKS PO PRCCtKSCA SELF-CtECW S IAUTCMATIC/CONTltA)CUS)

SIGNAL LEVEL I SOLATCR Ll I Q SELF~ FA IUD Ll BYPASS L J SWITCH ITYP ICAL)g LI BYPASS TD PROCESSOR 8" OUTPUT RELAY TEST IAUTONATIC/INTERMITTENT)

SIGNAL ITYP I CAL)

I SOLATCR IQRELAY TEST I'AILLRE I

Dl SARM DELAY S/8 C" SIGNAL T I)ER LEVEL LT ISOLA TCR ARMED" LEEE +2 TING It% SIGNAL Pl PRESSum PT ISOLATOR Pl PROCESSCR A TtSml ~ PT SIGNAL I BYPASS ACTUATE CELAY I

I TR IPPED L~

TR I PPEO TI TIMER APERTURE PB BYPASS PROCESSOR TEST MOOS IN FROM TR IPPEO ~ CARB 0 >VaBable OE I

PROCESSOR TEST SELECTOR AMSAC BYPASS SWITCH

~Pertuye ~T P SW I TCH SAFETY I NON SAFETY I Al BYPASS PROCESSOR B TEST TERMINAL ITO O)SPLAY OUTPUT I~

TYP I CAL)

STRIP PROCESSOR B ISOLATION SIGNAL TO PROCESSOR 8 RELAY IN PROCESSCP 8 TEST MCCE TR IPPEO LAMP SAME AS PR ESSOR "A" CR P2 I PROCESSOR 8 AMSAC ARMED LA@

Pl F IB TLR81NE TRIP AFW ACTUATI ON I

NON-SAFETY I SAFETY I

P5W /O/ -O/

p F I

I i

I 'I I t

I I ~

~ I 8

'I" P

aW/

I~

Attachment to NLS-88-084 Page 9 of 12 PROCESSOR UIOER TEST Pi LOI POIER I POIER I BTPASSEO OUTPUT TO P2 LOI Disarm POIER 2 Delay Timer POIER 2 STPASSEO LEGERO:

RO GATE OR GATE

>RVERTOR COLIPARATPR AMSAC FUNCTIONAL LOGIC DIAGRAMS AMSAC ARMED LOGIC FIGURE 2

~ I ~ ~

Attachment to NLS-88-084 Page 11 of 12 LEVEL 1 ~ AMSAC TRIPPED LEVEL 2 Q K (RED) 0 TROUBLE SYSTEM POWER 1 (ORANGE)

RESET POWER 2 SYSTEM BYPASSED TEST 'PP TEST (ORANGE)

DIGITAL TEST DIGITAL READOUT READOUT TIMER TRIGGERED Q Q VARIABLETRIPPED VARIABLE VARIABLE SELECT SELECT AMSAC LOCAL PANEL FIGURE 4

Attachment to NLS-88-084 Page 12 of 12 cowreocczz n POLLER L

I C.ON7 25 I

7~5T FE'LAP I

/E8 T'EZA 8 I I I I

I I

007 PCl T Ourpu7-PZLRY Z PzcAY 2 I

ourFur OOT Pu7 geCHI L z~~av s I

I I

L Pm)ea Td ZdeWcszE'cruArlou/lsocArIMI RzC AYD Notes: l) All contacts open when de-energized.

2) Contacts labeled A are driven by Processor A; those labeled B are driven by Processor B. Either processor is capable of independently generating the AMSAC initiating signal.

3) Contacts A3 and B3 are held closed when the AMSAC is running. A3 opens when Processor A is under test; Contact B3 opens when B is under test.

0) Contacts numbered l and 2 are from redundant output modules on each controller. Both close upon a signal from the controller to initiate AMSAC mitigating action.

ARRANGEMENT OF SIGNAL OUTPUT RELAYS FIGURE 5