ML18045A451

Forwards Rough Draft Rept Detailing NRC Safety Topic VII-2, Engineered Safety Feature Sys Control Logic & Design. Requests Comments & Recommendations

ML18045A451
Person / Time
Site:	Palisades
Issue date:	07/28/1980
From:	Mishimura M EG&G, INC.
To:	Scholl R Office of Nuclear Reactor Regulation
References
TASK-07-02, TASK-7-2, TASK-RR NUDOCS 8008060306
Download: ML18045A451 (13)

Text

n .

~'>EGc.G I'

I i'

Energy Measurements Group** San Aa~on Ope~atlons 2801 OLD CROW CANYON ROAD. SAN RAMON. CA* TEL. (415) 837-5381 *MAIL: BOX 204. SAN RAMON. CA 94583 28 July 1980 ESD# 6898 Mr. R. F. Scholl, Jr.

US Nuclear Regulatory Commission Division of Operating Reactors SEP Branch 7920 Norfolk Avenue Bethesda, MD 20014

SUBJECT:

PALISADES NUCLEAR POWER PLANT (DOCKET NO. 50-255)

Dear Ray:

Attached is a rough draft report on the Palisades plant detailing the NRC safety topic VII-2 (ESF System Control Logic and Design).

Please review the report and forward your comments and recommendations to me.

Sincerely, M. W. NISHIMURA GROUP LEADER MWN/ss. .*

cc: EG&G LLNL NRC D.

• Laudenbach M. Dittmore D. Allison*

B. Mayn G. St. Leger-Barter "8008080 30~

e* I I

I

"\

SYSTEMATIC EVALUATION PROGRAM REVIEW OF NRC SAFETY TOPIC VII-2 ASSOCIATED WITH THE ELECTRICAL, INSTRUMENTATION, AND CONTROL ~*

PORTIONS OF THE ESF SYSTEM CONTROL LOGIC AND DESIGN FOR THE PALISADES NUCLEAR POWER PLANT By. I j,

M. W. Nishimura* "(

July 1980 ROUGH DRAFT

• EG&G, Inc., Energy Measurements Group, San Ramon Operations

TABLE OF CONTENTS

... ~:

1 I

Page

. I

1. INTRODUCTION . ...

1 11

\:

2. CURRENT LICENSING CRITERIA. 2

3. REVIEW GUIDELINES. .. . .

' 4

4. SYSTEM DESCRIPTION . 5

5. EVALUATION AND CONCLUSIONS. 6

6.

SUMMARY

• 8 REFERENCES. 9 APPENDIX A NRC SAFETY TOPICS RELATED TO THIS REPORT . 10

SYSTEMATIC EVALUATION PROGRAM REVIEW OF NRG SAFETY TOPIC VII-2 ASSOCIATED WITH THE ELECTRICAL, INSTRUMENTATION, AND CONTROL PORTIONS OF THE ESF SYSTEM CONTROL LOGIC AND DESIGN FOR THE PALISADES NUCLEAR POWER PLANT M. W. Nishimura EG&G, Inc.i Energy Measurements Group San Ramon Operations

1. INTRODUCTION The Engineered Safety Features Actuation Systems (ESFAS) of both PWRs and BWRs may have design features that raise questions. about the electrical independence of redundant channels and isolation between re-dundant ESF channels or trains.

Non-safety systems generally receive control signals from the ESF sensor current loops. Th.e non-safety circuits are required to have i sol a-ti on devices to insure electrical independence from the ESF channels. The safety objective is to verify that operating reactors have ESF designs which provide effective and qualified isolation between ESFF channels, and between ESFs and non-safety systems~

This report will review the ESF EI&C design features at Palisades Nuclear Power Plant to insure that the non-safety systems electrically connected to the ESFs are properly isolated from the ESFs. This report will also review the plant's ESFs to insure that there is proper isolation between redundant ESF channels or trains and that the isolation devices or techniques meet the current licensing criteria detailed in Section 2 of this report. The qualification of safety-related equipment is not within the scope of this report and is discussed in NRG Safety Topic III-12 [Ref.

1] and NUREG-0458 [Ref. 2].

2. CURRENT LICENSING CRITERIA

• ' 11 11 GDC 22 [Ref. 3], entitled Protection System Independence, states that:

The protection system shall be designed to assure that the effects of natural phenomena and of normal operating, main-tenance, testi~g, and postulated accident conditibns on redundant channels do not result in loss . of the protection function, or that they shall be demonstrated to be accept-able on some other defined basis. Design techniques, such as.functional diversity or diversity in component design and principles of operation, shall be used to the extent practi-cal to prevent loss of the protection function.

GDC 24 [Ref. 3], entitled "Separation of Protection and Control 11 Systems, states that:

The protection system shal 1 be separated from control systems to the extent that failure of any single control system component or channel, or failure or removal from service of any single protection system component or channel which is common to the control and protection system leave intact a system satisfying all reliability, redundancy, and independence requirements of the protection system. Inter-connection of the protection and control systems shall be limited so as to assure that safety is not si gni fi cantly impaired.

IEEE Std-279-1971 [Ref. 4 J, entitled 11 Cri teri a for Protection 11 Systems for Nuclear Power Generating Stations, states. in Section 4.7 .2 that:

The transmission of signals from protection system equipment for control system use shall be through isolation devices which shall be classified as part of the protection system and shall meet all the requirements of this document. No credible failure at the output of an isolati-0n device shall prevent the associated protection system channel from meet-ing the minimum performance requirements specified in the design bases. *

)

i, Examples of credible failures include short circuits, open circuits, grounds, and the appl i ca ti on of the maximum cred-ible a-c* or d-c potential: A failure in an isolation device \,

is evaluated in the same manner as a failure of other equip- '

ment in the protection system. [\'

3. REVIEW GUIDELINES The NRC guidelines used in this review are as* follows:

(1) Verify that the signals used for ESF functions are isolated .from redundant ESF trains or channels .

. Review the schematic diagrams to assure that the wiring satisfies the functional logic diagrams in the FSAR or its equivalent (GDC 22). *

(2) Verify that qualified electrical isolation devices are utilized when redundant ESF trains or channels share safety signals. Identify and describe the type of isolation device employed (GDC 22).

(3) Verify that the safety signals used for ESF functions are isolated from control or non-safety systems.

Identify and describe the type of isolation device employed (GDC 24, IEEE Std-279-1971, Seciton 4.7~2).

( 4) Verify that the 1ogi c does not contain sneak paths that could cause false opera ti on or prevent requfred action as the result of operation of plant controls.

(5) Identify the related NRC Safety Topics in an appendix to the re po rt.

4. SYSTEM DESCRIPTION The engineered safeguards controls, which are initiated by the safety injection signal' (SIS), consist of equipment that monitors and selects the available power sources, initiates operation of certain load groups, and wi 11 i ni ti ate containment i so 1a ti on when re qui red. The sys tern i,s designed on a two-indepe.ndent-channels basis with each channel capable of initiating the load groups for safeguards eq~ip~ent. This design meets the minimum requirements for safe shut down of the reactor a~d provides all the necessary functions for operating the systems that are associated with the plant's capability to cope with an abnormal event.

The system has redundant circuitry and physical isolation which is necessary so that a single failure within the system wi 11 not prevent proper system action when it is required. The system also has test facilities and alarms that alert the operator when certain components trip, malfunction, or are not available or operable. The controls are inter-locked to automatically provide the sequence of operations required to i ni ti ate engineered safeguards system opera ti on with or without standby power.

Each of the safety injection system* s generating parameters (pressurizer pressure low-low or containment pressure high) has four sensors which utilize a two-out-of-four logic to provide reliable operation with a minimum of nuisance tripping. The four sensors are physically isolated, and operation of any two out of four will initiate the appro-priate engineered safeguards action. This action is provided by combining the four sensors into a relay matrix which provides a dual-channel initi-ation signal. Isolation is maintained in the control panels by locating devices in individual groups and by providing barriers between groups. The cables for the two groups are run in separate raceways.

5. EVALUATION AND CONCLUSIONS Since both the containment high pressure and the pressurizer pressure low trip circuits are basically* the same, only one circuit will be reviewed. The review guidelines listed in Section 3 of this report will be applied to the pressurizer pressure low circuit from the sensor through the output of the actuating logi~.

Combustion Engineering drawing 2966-D-3106 [Ref. 5 J and Bechtel drawing E-84 [Ref. 6] show that sensor PTD102A receives d-c power from the P-0102A power supply .(safety circuit 11 A11 ) . The power supply, in turn, receives a-c power from the preferred pane 1 YlO ( Y20, Y30 and Y40 supp 1y power to safety circuits B, C and D, respectively). The output from the sensor is fed to high pressure trip unit PA-0102AH, thermal margin low pressure trip unit PA-0102AL, and to pressurizer pressure low-low trip unit 11 PIA-0102ALL. The trip units are all within safety circuit 11 A therefore, they do not require isolation. The drawings do not show interconnections with: any additional circuits.

The pressurizer pressure low-low trip unit processes the signal from sensor PT-0102A and converts it to relay logic (two-contact closures).

The output of the relay logic is designated as PIA-0102ALL. Bechtel draw-ing E-206 [Ref .. 7] shows that one contact feeds into relays XPAl and XPA2; the other contact feeds into relays XPA3 and XPA4. Bechtel drawing E-209

[Ref. 8] shows that these four relays make up the two-out-of-four 1ogi c circuit which actuates the nine safety i nj ecti on relays ( SIS-1 through SIS-8 and SIS-10). Actuation train 11 A has all even-numbered SIS relays, 11 train 11 B11 has all odd-numbered relays. Tr~in 11 A11 receives its power from 11 preferred panel Y20; train B11 from panel Y30.

6 -

SIS relays 1 through 8 have 6 contacts (outputs) each, and SIS relay 10 has 12 contacts. There are a total of 60 outputs, all of which are isolated from each other and all of which provide actuation signals to all ESF and other equipment*requiring an SIS signal for operation.

Based on the review of the Palisades FSAR [Ref. 9] and the draw-ings specifieq, we conclude tht the plant complies to the current licensing criteria detailed in Section 2 of this report.

I.

I I

6.

SUMMARY

Palisades Nuclear Power Plant complies to current licensing criteria for the ESF system control logic and design, as defined in Section 2 of this report. ~

-. 8 -

I REFERENCES

1. Nu cl ear Regulatory Commission, Safety Topic II I-12, En vi ronmenta l Qualifications of Safety Related Equipment.

2. U.S. Nuclear Regulatory Commission, Short-Term Safety Assessment on the Environmental Qualification of Safety-Related Electrical Equipment of

. SEP Operating Reactors, NUREG-0458, May 1978.

3. U.S. Nuclear Regulatory Commission, Code of Federal Regulations, Title 10, Part 50 (10 CFR 50), Appendix A (General Design Criteria), 1979.

4. Institute of Electrical and Elettronics Engineer~,. IEEE Std-279-1971. 'I*

5. Combustion Engineering drawing 2966-D-3106, 11 Interconnection Diagram Channel P-0102.

6. Bechtel drawing E-84, "Schematic Diagram-Pressurizer Pressure Control and Measurement Channel Instrumentation. 11

7. Bechtel drawing E-206, 11 Schematic Diagram-Safety Injection Signal Auxi l'i a*ry Circuits. u *

8. Bechtel drawing E-209, 11 Schematic Diagram-Safety.Injection and Sequence Loading Circuit. 11

9. Consumer Power Company, Palisades Final Safety Analysis Report, filmed

• in June 1978.

• • • • • *~"

. APPENDIX A NRC SAFETY TOPICS RELATED TO THIS REPORT

1. Safety Topic VII-1, "Reactor Trip Systems (IEEE-279). 11 A. Isolation of reactor protectionsystem from non-safety systems, including qualification of isolation devices B. Trip uncertainty and setpoint analysis review of operating data base.

11

2. Safety Topic VI I-3, Systems Re qui red for Safe Shutdown. 11

3. Safety Topic VII-4,  !!Effects of Failure in Non-Safety Related Systems on Selected Engineered* Safety Features. 11

4. Safety Topic VII-5, "Instruments for Monitoring Radiation and Process

, Variables During Accidents. 11

5. Safety Topic VI I-6, "Frequency Decay. 11

6. Safety Topic VII-7, "Acceptability of Swing Bus Design on BWR-4 Plants. 11

• Cathy #4/#11/CEB/amr