ML18033A527
| ML18033A527 | |
| Person / Time | |
|---|---|
| Site: | Browns Ferry  |
| Issue date: | 01/22/1989 |
| From: | NRC |
| To: | |
| Shared Package | |
| ML18033A526 | List: |
| References | |
| NUDOCS 8902010010 | |
| Download: ML18033A527 (8) | |
Text
~S IlEOgpi
~ +
Cy nOg O
<r
~O
+**4+
t UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D. C. 20555 ENCLOSURE SAFETY EVALUATION BY THE OFFICE OF SPECIAL PROJECTS CONCERNING COMPLIANCE llITH ATWS RULE 10 CFR 50.62 RELATING TO ALTERNATE ROD INJECTION ARI) AND RECIRCULATION PUMIP TRIP RPT SYSTEMS TENNESSEE VALLEY AUTHORITY BROMNS FERRY NUCLEAR PLANT, UNITS I, 2, AND 3 DOCKET NOS. 50-259, 50-260 AND 50-296
- 1. 0 INTRODUCTION On July 26, 1984, the Code of Federal Regulations (CFR) was amended to include Section 10 CFR 50.62, "Requirements for Reduction of Risk from Anticipated Transients Mithout Scram (ATHS) Events for Light-Mater-Cooled Nuclear Power Plants" (known as the "ATWS Rule" ).
An ATMS is an expected operational transient (such as loss of feedwater, loss of condenser vacuum, or loss of offsite power) which is accompanied by a failure of the reactor trip system (RTS) to shutdown the reactor.
The ATMS rule requires specific improvements in the design and operation of comercial nuclear power facilities to reduce the likelihood of failure to shutdown the reactor following anticipated transients, and to mitigate the consequences of an ATMS event.
For each boiling water reactor unit at Browns Ferry, the following three systems are required to mitigate the consequences of an ATWS event.
a.
It must have an alternate rod injection (ARI) system that is diverse (from the reactor trip system) from sensor output at the final actuation device.
The ARI system must have redundant scram air header exhaust valves.
The ARI system must be designed to perform its function in a reliable manner and be independent (from the existing reactor trip system) from sensor output to the final actuation device.
b.
It must have a standby liquid control system (SLCS) with a minimum flow capacity and boron content equivalent in control capacity to 86 gallons per minute (gpm) of 13 percent by weight of sodium pentaborate solution.
The SLCS and fts injection location must be designed to perform its function in a reliable manner.
c.
It must have equipment to trip the reactor coolant recirculating pumps automatical'ty under conditions indicative of an ATWS.
This equipment must be designed to perform its function in a reliable manner.
8902010010 S90122 PDR ADOCK 05000259 P
PDC This safety evaluation report addresses the ARI system (Item a) and the ATMS/RTP system (Item c).
The SLCS (Item b) was addressed and approved in a separate HRC document dated September 2, 1988.
2.0 REVIEW"CRITERIA The system and equipment required by 10 CFR 50.62 do not have to meet all of the stringent requirements normally applied to safety-related equipment.
- However, this equipment is part of the broader class of structures,
- systems, and components important to safety defined in the introduction to 10 CFR 50 Appendix A, General Design Criteria (GDC).
GDC-1 requires that "structures, systems and components important to safety shall be designed, fabricated, erected and tested to quality standards commensurate with the importance of the safety functions to be performed."
Generic Letter 85-06, "guality Assurance Guidance for ATWS Equipment that is not Safety Related" detailed on April 16, 1985 the quality assurance that must be applied to this equipment.
In general, the equipment to be installed in accordance with the ATMS Rule is required to be diverse from the existing
- RTS, and must be testable at power.
This equipment is intended to provide needed diversity (where only minimal diversity currently exists in the RTS) to reduce the potential for common mode failures. that could result in an ATWS leading to unacceptable plant conditions.
The criteria used in evaluating the licensee's submittal include 10 CFR 50.62 "Rule Considerations Regarding Systems and Equipment Criteria" published in Federal
~Re later, Volume 49, No.
124 dated June 26, 1984 and Generic Letter K:o~'y letters dated March 1. July 15 and August 14, 1988, Tennessee Valley Authority (the licensee) pr'ovided information regarding conformance with the ATMS Rule.
The licensee endorses the Boiling Water Reactor Owners Group (BWROG)
ATMS design recommendations.
The plant will install redundant trip systems.
Each system has the dedicated block and dump valves to perform the ARI function.
The ARI system will consist of one three-way valve per trip system which will act to block control air upstream of the control rod drive system hydraulic control units while dumping the downstream side to atmosphere when the ARI initiation signal is present for that system.
The ARI system is independent from the reactor trip system and is capable of initiating protective actions when either input channels indicating low water level and/or high pressure are tripped.
The system output will energize the devices to start the protective actions.
The systems can be manually initiated.
The ARI logic will cause the energization of the Alternate Rod Insertion valves when either the reactor vessel high pressure trip setpoint or the low water level trip setpoint fs reached, or the manual pushbutton fs actuated for each trip system.
The ARI valves and bleed paths are sized to allow insertion of all control rods to begin within 15 seconds and be completed within 25 seconds after an ATMS signal is detected.
The function of the RPT is to reduce the severity of thermal transients on fuel elements by tripping the recirculation pumps early in the transient events
(such as turbine trip, or load rejections).
The rapid core flow reduction increases void content and thereby introduces negative reactivity in the reactor to reduce the thermal power.
There are two separate and independent systems to trip the recirculation pumps.
One is the End of Cycle Recirculation Pump Trip (EOC-RPT), which detects turbine control valve fast closure and main steam stop valve closure.
The other is the Anticipated Transient Mithout Scram Recirculation Pump Trip (ATMS/RPT) which detects high reactor pressure or low reactor water level.
Each logic train trips both of the recirculation pumps at the same time.
The RPT and ARI systems can be tested while the plant is at power.
This actuated test checks the system operation from the sensor outputs through the logic to the actuation device.
- sensor, logic circuits and actuation devices are separate from the RTS, and environmentally qualified to the anticipated operational occurrence conditions.
The ARI function can be reset by the ARI reset switches after a 30 second time delay to ensure that the ARI scram goes to completion.
4.0 EVALUATION OF ARI SYSTEM 4.1 ARI Function Time The licensee has performed a scram air header depressurization study.
A computer program was developed to calculate the air venting time.
The result of the analysis indicates that the afr pressure in the Hydraulic Control Unit (HCU) scram diaphragm valves will depressurize from the initial pressure of 70-75 psig to 28 psig in 11 seconds.
The scram inlet and outlet valves will begin to open when pressure is reduced below 30 psig.
The licensee concludes that the control rod motion will begin less than 15 seconds after ARI initiation and will be completed within 25 seconds.
The licensee is required to perform a preoperational test to verify that the actual ARI function time will meet the design requirement.
The test results should be made available fot staff audit during the post-implementation inspection.
4.2 Safet -Related Re uirements IEEE Standard-279 The ATMS Rule does not require the ARI system to be safety grade, but the implementation must be such that the existing protection system continues to meet all applicable safety related criteria.
The licensee stated that Class 1E isolators are used to interface with safety-related
- systems, and Class lE isolators are powered from Class 1E source.
The implementation of the ARI system will not affect the existing protection systems.
This is in conformance with the ATWS Rule guidance and therefore is acceptable.
The ATMS Rule requires that the ARI system must have redundant scram air header exhaust valves, but the ARI system itself does not need to be redundant.
The Browns Ferry ARI system has redundant block and vent valves at Che scram air header.
The two-out-of-two logic for either trip system (1 or 2) will initiate the ARI. The ARI performs a function redundant to the backup scram system.
This is fn conformance with the ATMS rule guidance and therefore is acceptable.
4.4 Diversit From Existin RTS The ATMS Rule requires that the ARI system be diverse from the existing reactor trip system.
The Browns Ferry ARI system uses energize-to-function valves instead of de-energize-to-function valves.
It has dc-powered valve actuators and logic instead of ac-powered valve actuators and logic for the RTS.
The reactor high pressure
.sensors and reactor vessel low water level sensors in the ARI system employ Rosemount analog transmitters and trip units (ATU) and the RTS employs the same type of instruments.
The diversity of application is provided by setting two internal switches so that the ARI is energized to trip while the RTS is de-energized to trip.
The staff has concluded that this is not in conformance with the ATMS Rule diversiCy requirements and therefore fs not acceptable.
The staff has learned that compatible trip circuit boards manufactured by a different vendor, are available and are fully qualified as a
replacement for the Rosemount ATUs. If the alternate boards were used in the ARI system, sufficient diversity would exist between the ARI system and the RTS, then such a modffication appears reasonable and practicable.
The staff has concluded that this portion of the ATHS implementation design is not acceptable.
The licensee is required to modify the trip unit design such that ft meets the "ATMS Rule" diversity requirements.
The licensee is requested to provide a schedule for this modification including justification if this modification will not be made prior to Unit 2 startup.
4.5 Electrical Inde endence From The Existin RTS The ARI system sensors actuation logics, and power supplies are independent from the RTS.
The ARI instrument components are located in separate panels from the RTS.
The electrical independence from the existing RTS-is.in conformance with the ATWS rule guidance and therefore is acceptable.
4.6 Ph sfcal Se aration From Existin RTS The ATWS Rule Guidance states that the implementation of the ARI system must be such that separation criteria applied to the existing protection system are not violated.
The ARI system is physically separated and independent from the Reactor Trip System.
It has redundant circuits from sensors to the ARI valves.
The separation between the RTS and the ARI system satisfies the ATMS Rule guidance.
The staff finds this acceptable.
4.7 Environmental uglification The ATMS Rule guidance states that the qualification of the ARI system is for anticipated operational occurrences only, not for accidents.
The ARI system is qualified to the anticipated operational occurrence conditions during an ATMS event up to the time that the ARI function is completed.
The staff finds this acceptable.
The ARI system quality assurance program complies with the quality assurance requirements of NRC Generic Letter 85-06.
This is in conformance to the ATMS rule guidance on gA requirements and therefore is acceptable.
4.9 Safet -Related IE Power Su 1
The ATMS Rule guidance states that* the ARI system must be capable of performing its safety function with loss of offsite power, and that the power source should be independent from the existing reactor trip system.
The ARI systems are powered from the Class lE 250V dc batteries.
The ARI system is capable of performing its safety functions with loss of offsite power and the ARI power sources are independent from the existing RTS system logic and scram pilot solenoid valve actuation power source, and is in conformance with the ATMS rule guidance.
The staff finds this acceptable.
4.10 Testabilit At Power The ATMS Rule guidance states that the ARI system should be testable at power.
The Browns Ferry design allows the ARI system to be tested while the plant is in power operation.
The use of the two level transmitters and two pressure transmitters in a two-out-of-two logic. and the presence of two ARI/RPT initiation channels permit the testing of one channel while the other is still operable.
It also permits the testing of one trip unit without initiating ATMS (ARI/RPT) since two trip units must operate at once to initiate the ARI/RPT functions.
The ARI valve actuation can be bypassed by the test switch during surveillance testing to prevent spurious ARI actuation.
These bypasses are continuously alarmed in the main control room.
This is in conformance with the ATMS tule guidance and therefore is acceptable.
4.11 Inadvertent Actuation The ATWS Rule guidance states that inadvertent ARI actuation which challenges other safety systems should be minimized.
The ARI system has coincident logic circuits and two sensor channels must be tripped fn order to initiate the protective actions.
The reactor pressure vessel setting for ATWS is higher than the RTS scram setting and the ATMS reactor water level setting is lower than the RTS scram setting.
This is in conformance with the ATMS rule guidance and therefore is acceptable.
4.12 Manual Initiation Manual ARI initiation is provided in the main control room.
Manual initiation of ARI will not trip the recirculation pumps at the same time.
The staff finds this acceptable.
4.13 Information Readout The ARI system provides status indications and alarms in the control room for trip status, test status, inoperative, failure, and maintenance status.
Continuous readout of the level and pressure instruments is provided.
Annunciators are provided for the ARI trip and the channel under test.
The staff finds this acceptable.
- 4. 14 Com letion Of Protection Action Once It Is Initiated The ARI system has a seal-in feature (inhibited reset for up to 30 seconds) to ensure the completion of protective action once it is initiated.
After initial conditions return to normal, deliberate operator action is required to reset'he safety system logic to normal.
The staff finds this acceptable.
4e15 Conclusion On ARI S stem The staff finds that the Browns Ferry ARI design is in compliance with 10 CFR 50.62 paragraph (c)(3), except for the diversity concern as discussed in more detail in Section 4.4 of this SE.
The licensee is required to modify the trip unit design such that the "ATMS Rule" requirement of diversity is met.
The licensee is also required to document the preoperational test to verify the ARI function time.
This documentation will be verified during the staff inspection of the ATMS equipment implementation.
5.0 EVALUATION OF ATMS RPT SYSTEM The Browns Ferry's ATMS/RPT design will use the end-of-cycle RPT breakers to perform the ATMS RPT function.
A spare trip coil in each EOC-RPT breaker cubicle will be isolated and wired to one of the two ATMS trip systems.
An initiating signal from either trip system will open one of two breakers in series for each recirculation pump.
These spare trip coils will be mechanically and electricaliy isolated from the Reactor Trip System and powered from a power source other than that in the breaker cubicle.
The initiation signal for the ATMS/RPT system comes from the same logic which initiates the ARI system.
The staff finds that the Browns Ferry ATWS/RPT design has satisfied the criteria stated in the ATNS rule considerations published in Federal
~Re ister, Volume 49, No.
124 dated June 26,
- 984, with the exception of ttts Tversi ty requirement which has been discussed in Section 4.4 of this repor t.
Because
the same instrument channels are used for both the ARI and the RPT s modification required for the ARI system ill 1
b system.
s em w a so be applicable to the RPT
- 6. 0 TECHNICAL SPECIFICATIONS ATWS The equipment re uired b event must be designed to erform its q
by the ATMS Rule to reduce the risk associated with p
i s function in a reliable manner.
A e
w an the reliability requirements of the ATWS Rule a
e o
e staff for demonstratin that th specifications fncluding operabil 't d
a i y an surveillance and requirements.
By letter dated August 4, 1988 the 1
, the licensee requested an amendment to licens g
rowns Ferry Nuclear Plant Technical
, an DPR-68 to chan e the B
es s
proposed change adds limiting ATMS-RPT t
Th ATMS-RPT TS odifi corn let d before its fuel load for. the c modifications are to be. completed before
.comp e e efore their next fuel load from the current n
e a res art requirement and is currently 7.0 REFERENCE 1.
Letter from R. Gridley, Tennessee Valley Authority. to NRC Document ontrol Desk,
Subject:
Key Elements to Plant ATMS Designs per R 50.62, dated March 1, 1982.
2.
Letter from R. Gridley, Tennessee Valley Authority, to NRC Document Control Desk,
Subject:
Response
to NRC April 13 1988 le ATMSDtil dD i C it i, dtd 01 15 198 3.
Letter from H. R. Shell, Tennessee Valley Authority, to NRC Document Pump Trip, dated August 4. 1988.
Control Desk,
Subject:
Technical Specification Change No.
252 - ATM o.
S 4.
BMROG Topical Report NEDE-31096-P "Antic R
o to NRC ATMS R 1
u e 10 CFR 50.62," dated December 1985.
5.
Letter from G. Lafnas, NRC to Terr erry A. Pickens, Chairman BMR Owners'p on opical Report NEDE-31096-P, dated October 21, 1986.
Principal Contributor:
H. Lf Dated:
january 22, 1989