ML18026A914
| ML18026A914 | |
| Person / Time | |
|---|---|
| Site: | Browns Ferry  |
| Issue date: | 03/15/1984 |
| From: | Mills L TENNESSEE VALLEY AUTHORITY |
| To: | Harold Denton Office of Nuclear Reactor Regulation |
| References | |
| GL-83-28, NUDOCS 8403200170 | |
| Download: ML18026A914 (11) | |
Text
Pq
~
REGULATORY li FORMATION DISTRIBUTION SYST M (RIOS)
ACCESSION NBR:8403200170 DOC ~ DATE: 84/03/15 NOTARIZED:
NO DOCKET FACIL:50 259 Browns Ferry Nuclear Power Stations Unit ii Tennessee 05000.
54'0-260 Browns Ferry Nuclea'r Power Stationi Unit 2> Tennessee 0
OALCL 50-296 Browns Ferry Nuclear Power Stationi Unit 3~
Tennessee OS000296 AUTH SNARE AUTHOR Al-'FILIATION HILLSrL ~ M ~
Tennessee Valley Authority REC IP ~ NAt<E HECIP IE~ I AFFILIATION DENTONgH ~ HE Office of Nuclear Reactor Regulationi Director
SUBJECT:
Forwards response to Item 4,5 of Generic Ltr 83-28i" "Required Actions Based on Generic Implications of Salem ATNS Events<"
re reactor trip sys reliability.Control rod tests check rod insertion times F hydraulic scram valves'ISTRIBUTION CODE:
AOSbS COPIES RECEIYED:LTH ENCL Q SIZE:
/0 TITLE: OR/Licensing Submittal:
Salem ATNS Events GL 83 28 NOTES:NMSS/FCAF
- 1cy, 1cy NrlSS/FCAF/PM.
NESS/FCAF icy'cy NMSS/FCAF/PM'MSS/FCAF 1cy ~
1cy N!ISS/FCAF/PH,'5000259 05000260 05000296 RECIPIENT IO CODE/NAME
!~RR OR82 BC 01 COPIES I.TTR ENCL 3
RECIPIENT IO CODE/NAYiE COPIES LTTR ENCL INTERNAL: ELO/HOS4 NRR/OE/EQB NRH/DHFS/HFEB NRH/OHFS/PSRB NRR/OL/ORAB NRH/OS 1/ASB NRH J)SI/PSB EXTERNAL: ACHS NRC PDR NTIS NOTES:
04 02 1
0 1
1 1
1 1
1 1
1 1
1 1
1 1
6 1,
1 1
1 IE/DGASIP NRR/OE/HEB NRR/OHFS/LQB NRR/DL OIR NRR/OL/SSPB NRR/DSI/ICSB NRR/DSI/RSB RGN2 LPDR NSIC.
03 05 1
1 1
1 1
1 1
1 1
1 1
1' 1
TOTAL NUMBER OF COPIES HEQUIRED:
LTTR 32 ENCL 31
TENNESSEE VALLEYAUTHORlTY CHATTANOOGA. TENNESSEE 3740l 400 Chestnut Street Tower II March 15, 1984 Mr. Harold R. Denton, Director Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, D.C.
20555
Dear Mr. Denton:
In the Matter of the
)
Tennessee Valley Authority
)
Docket Nos. 50-259 50-260 50-296 By letter to you dated November 7,
- 1983, we submitted our response to G'eneric 'Letter 83-28,'"Required Actions Based on Gener'ic Implications of Salem ATWS Events," for the Browns Ferry Nuclear Plant.
In that
- response, we stated that we were evaluating item 4.5, Reactor Trip System Reliability, and committed to provide the results later.
Enclosed is our response to item 4.5.
The November 7, 1983 letter stated that our response to item 4.5 would be submitted by February 29, 1984.
The need for additional time was discussed with R. J. Clark by telephone on Februar y 29, 1984.
Very truly yours, TENNESSEE VALLEY AUTHORITY Nuclear Licensing Enclosure cc (Enclosure):
U.S. Nuclear Regulatory Commission Region II Attn:
Mr. James P. O'Reilly, Regional Administrator 101 Marietta Street, NW, Suite 2900 Atlanta, Georgia 30303 Mr. R. J. Clark Browns Ferry Project Manager U.S. Nuclear Regulatory Commission 7920 Norfolk Avenue
PDR An Equal Opportunity Employer
ENCLOSURE RE~SE TO GENERIC LETTER 83-28 ITEN NO. 4.5 Browns Ferr Nuclear Plant 4.5 Reactor Trip System Reliability (System Functional Testing)
Position Online functional testing of the reactor trip system, including independent testing of the diverse trip features, shall be performed on all plants.
Action 1.
The diverse trip features to be tested include the breaker undervoltage and shunt trip features on Westinghouse, B&W (see action 4.3 above),
and CE plants; the circuitry used for power interruption with the silicon controlled rectifiers on B&W plants (see action 4.4 above);
and the scram pilot valve and backup scram valves (including all initiating circuitry) on GE plants.-
, 2.
Plants not currently, designed.to permit periodic online testing shall justify not making modifications to permit such testing.
Alternatives to online testing proposed by licensees will be considered where special circumstances exist and where the objective of high reliability can be met in another way.
3.
Existing intervals for online functional testing required by Technical Specifications shall be reviewed to determine that the intervals are consistent with achieving high reactor trip system availability when accounting for considerations such as:
1.
Uncertainties in component failure rates 2.
Uncertainty in common mode failure rates 3.
Reduced redundancy during testing 4.
Operator errors during testing 5.
Component "wear-out" caused by the testing Licensees currently not 'performing periodic online testing shall determine appropriate test intervals as described above.
Changes to existing required intervals for online testing as well as the intervals to.be determined by licensees currently not performing online testing shall be justified by information on the sensitiv-ity of reactor trip system availability to parameters such as the test intervals, component failure rates, and common failure rates.
~
~
Response
to Action Items 1
2 and 3
Browns Ferry does not have a system defined as "reactor trip system."
Plant equipment required to perform these functions is contained in the reactor protection system (RPS) and the inputs to RPS that monitor parameters that are important to safety.
The RPS is comprised of the following.
1.
Relay logic 2.
Electrical solenoid valves that operate the scram inlet and outlet valves 4.
Electrically-operated backup scram valves Browns Ferry's RPS and associated systems comply with all applicable regulatory requirements.
A review of the Browns Ferry RPS online.functional testing and testing intervals was performed and Sound to be consistent with achieving a high scram system reliability.
Online channel functional testing of multiple and diverse reactor transient trip sensor s is performed a minimum of one time a month.
Average power range monitor trip signals are channel functionally tested before reactor startup and weekly thereafter.
Main steamline radiation monitors are functionally tested weekly.
Based on the required trip sensor channel tests, each scram contactor which actuates a scram solenoid valve is tested at least 11 times eacn month.
The simple operation'f the scram contactors minimizes concerns of wear, and frequent testing ensures that any failures are detected early.
Operation of all the scram solenoid valves is verified after core alternations, and 10 percent are tested on a rotating basis every 16 weeks.
The surveillance testing requirements related to the scram solenoid valves ensure that the probability of undetected failures of the independently acting solenoid valves is small.'n
- summary, the curi ent RPS online surveillance testing requirement, in conjunction with multiple and diverse scram sensors, ensure that the probability of failure of enough control rods to prevent reac'tor shutdown is negligible.
In addition to what is required by current regulatory requirements, additional protection is provided by redundant backup scram valves located on the common scram air header.
The backup scram valve solenoid electrical circuits are designed so that operation of the scram contactor contacts which energize the backup scram valve solenoids can be confirmed during routine surveillance testing.
The electr ical continuity of the backup scram valve solenoid coils is continuously monitored by indicator lights in the main control room.
This level of testing and monitoring is adequate to ensure proper operation of the backup scram valves, The following evaluation discusses in detail the functional testing and reliability of Browns Ferry's RPS.
BRO>lNS FERRY NUCLEAR PLANT RPS FUNCTIONAL TESTING AND RELIABILITYEVALUATION Xntroduction RPS and control rod"drive (CRD) system test intervals have been developed in the Browns Ferry technical specifications to provide early identification of component failures during operation and to ensure that any indication of systematic problems will be identified and corrective action initiated on a timely basis.
By identifying component failures and any systematic problems early, corrective actions can be taken to ensure that systems achieve and maintain high scram system reliability.
The purpose of this evaluation is to review the current Browns Ferry online functional testing for the RPS and CRD systems required by technical specifications to verify that testing intervals are consistent with achieving high scram system reliability.
Channel Functional Tests Channel functional tests are performed monthly for the following sensor trips.
1.
Reactor vessel dome high pressure 2.
Reactor vessel low water level 3-Main steamline isolation valves closure Drywell high pressure 5.
Turbine control valve fast closure or turbine trip 6.
Turbine stop valve closure 7.
High water in the scram discharge volume 8.
Turbine condenser low vacuum Channel functional tests are performed for the average power range monitors weekly, as well as before startup.
The intermediate range
- monitors, when they are required to be operable, are functionally tested weekly and before startup.
The main steamline radiation monitors are functionally tested weekly.
4 Xn reference 1
, (see attachment 3), it is shown that each of the plant variables used to initiate a protective function is backed up by a completely different plant variable.
ln fact, it can be seen from table 1
(see attachment
- 2) that for the most frequent transients scram is initiated by three diverse sensors in all but one case (regulator failure primary pressure increase which is initiated by two diverse sensors).
This indicates that adequate redundancy exists in the design to provide protection against multiple independent sensor failures.
Diversity among sensor types reduces the potential for common cause failures, failures because of human error, and increases in failure rate because of wear.
Each sensor channel functional test includes full actuation of the associated logic, the two output scram contactors in each channel, and the scram solenoid valves for the associated logic division (solenoids from both logic divisions A and B
are required for scram initiation).
A pictorial representation of the RPS logic configuration with the frequency of channel functional tests is provided in figure 1
(see attachment 1).
Based upon the required sensor channel.functional tests, each. individual channel output.
contactor is tested at least 11 times each month.
Each of the scram valve solenoids associated with a CRD is actuated at least 22 times each month.
The manual scram trip is tested quarterly and the reactor mode switch in the shutdown position is tested once each cycle.
The first trip involves online testing.
The mode switch test can only be conducted during reactor shutdown.
The most credible failures within the RPS logic will deenergize a set of scram valve solenoids which cause a half scram,'.e.,
one of the two scram valve solenoids required for scram initiation is deenergized at all the hydraulic control units.
These failures would be "SAFE" failures that would increase the probability of plant shutdown.
The less credible logic failures which prevent a channel from
'deenergizing will be detected during channel functional tests in compliance with technical specification requirements.
The frequency of tests ensures that an increase in failure rate because of a wear-out condition or, a common cause failure potential could be detected early and corrective action taken before the failure condition becomes systematic.
Scram Solenoid Valve and Control Rod Testing Although the scram solenoid valves are electrically cycled during the monthly channel functional tests, operability of each pair of these valves can be verified only by actual insertion of the appropriate
Browns Ferry's technical specifications require that the control rods be tested on the following schedule.
Percent of Control Rods Tested Frequency 100 10 After each refueling outage Every 16 weeks In addition to verifying operation of the scram solenoid valves, the control rod tests check rod insertion times and operation of the hydraulic control unit's (HCU)'cram inlet and outlet valves.
Backup Scram Logic In addition to the primary RPS scram logic, backup scram logic is provided in the RPS.
The backup scram function is accomplished by two solenoid valves which isolate the main air supply and vent the air supply header which connects to the individual HCUs.
The backup scram valves are redundant valves with redundant trip signals from both RPS logic trains A and B.
The logic is diverse from the primary RPS since the backup scram valve solenoids are energized to trip and dc oowered versus the primary scram pilot ac-powered valves which are deenergized to trip.
Although half of the backup scram logic is actuated for each valve during channel functional tests, the only time the backup scram solenoids are actuated is when a complete scram signal is initiated..
Indicator lights located in the main control room are wired in parallel with the backup scram valve solenoid logic in such a way that the indicator lights can verify operation of the appropriate RPS channel scram contactor during routine RPS channel surveillance testing and continuity through the backup scram valve solenoid coils during plant operation.
I The backup scram function has been designed to be highly reliable by use of redundant valves and actuating..logic.
Because of the lower testing frequency of the backup scram valves, the potential for a common cause or human error affecting the primary and backup RPS is reduced.
Conclusion The current Browns Ferry online testing program is adequate and the components tested and frequency of testing are consistent with achieving high scram system reliability.
Attachn>ent 2
Table 1
SENSOR DIVERSITY FOR MAJOR TRANSIENTS Scram Si naia Inputs From Pressure or Differential Pressure Transntitters and Trip Unitkl Inputs Frola Pressure oaition or Micro Suitch Con t ac t Open ing
)
n0 C4 Inputs Froa Neutron Flux
~ j<
re
')4 Transient MSIV Closure Turb Trip (uith bypass)
Generator Trip (uith bypass) rcs.
egu ator Fai ure (pr impar ressure decrease)
Pres.
Regulator Failure (prbiary presFture increase)
F.M. Flou Control, Failure (reactor uater inventory increase)
F.M. Flou Control, Failure (reactor uater inventory decrease)
Loss of Condenser Vacuuli o
Cl C4 H tit C4 U
1 0
~ O u
tr.
A'-(2) 0Uai U~
Cl Cr. V 0 U 0
C4 rC U0tll U
~
0 0 LP C4 A)
O A. W 0 M Utit t4 A H tt O 00 C4 t4
+ H H O CI.'s V I
C CJ'0 0
Loss of Nodal AC Pouer (3)
>'r l.
After completiot~f analog trip systenl, present sensors:lre mr chanical type witches.
2.
Numbers indicate order of occurrence.
3.
Loss of AC power deenergizes RPS and initiates scram.
~
pO
~
~
Attachment 3
Reference 1.
NED0-10189, "An Analysis of Functional Common-iMode Failures i'n GE B'klR Protection and Control Instrumentation,"
L. G. Frederick, et al., July 1970.