ML18081B048

Final Deficiency Rept Re Undetectable Failure in Engineered Safety Features Actuation Sys.Testing Procedures Revised to Include Testing of Permissive Circuitry P4 on Periodic Basis.Unit Will Be Tested Prior to Operation

ML18081B048
Person / Time
Site:	Salem
Issue date:	12/21/1979
From:	Public Service Enterprise Group
To:
Shared Package
ML18081B046	List: ML18081B047 ML18081B048
References
NUDOCS 8002150213
Download: ML18081B048 (5)

Text

SAL~M GENERATING .ATION NOS. 1 AND 2 UNITS e 7 90 733 EVALUATION OF POTENTIAL DEFICIENCY OF AN UNDETECTABLE FAILURE IN THE ENGINEERED SAFETY FEATURES ACTUATION SYSTEM

Potential Deficiency Identified by Westinghouse The reactor trip breakers provide position input to the Solid State Protection System * . This breaker position input cir-cuitry is used as a permissive to provide the operator, de-pending on plant conditions, the. capability to manually reset and block safety injection. The-protection system is re-quired to be periodically tested, however, the present test-ing provisions are not adequate to assure proper operation of the* reactor trip breaker position circuitry. The undetect-able fa.il ure of this circuit could prevent ini tia ti on of a protective function or alter operations described in emer-gency procedures.

• Analysis/Safety Implications The reactor trip switchgear design for Salem is shown .in Fig-ure 1 (attached). The protection system utilizes contacts from position switches on the reactor trip breakers to pro-vide the permissive (P4) for reset of safety injection. The breaker position permissive is generated as shown in Figure

2. The permissive is used in the reset logic shown in Figure 3.

Testing of the protection system at Salem did not include checking of the contacts for the P4 perm~ssive.

The P4 permissive is generated when the reactor trip breakers and bypass breakers are open causing the P4 contacts to close. The failure of the contacts to close for two position switches from either the trip or bypass breakers would pre-vent the operator from resetting the protection system fol-lowing a safety injection actuation. Failure to reset the protection system would affect operator response following an accident. However, there are manual actions that can be taken by ~he operator to permit him to perform recovery oper-ations. Such actions are not inconsistent with existing safety criteria {single failure criterion). Failure to reset could* be caused by an assumed failure in the logic or in the trip breaker position contacts.

The P4 permissive is removed when the reactor trip breakers and/or bypass breakers are closed causing the P4 contacts to open. The failure of the contacts to open for one position switch from both the trip and bypass breakers would result 213

~002150.

• -* in* a continued P4 permissive. If this condition occurs fol-lowing a previous initiation of safety injection and a manual

• reset/block, the block of safety injection would remain in effect following reclosure of the reactor trip breakers and return of the plant to normal power operation. A subsequent required automatic safety injection actuation could then not occur. However, the operator could still initiate safety in-jection manually at the system level. An indicating light is utilized to alert the.operator of this blocking function.

Once again, the corrective actions taken are not inconsistent with existing safety criteria ("single failure criterion).

The failure of automatic actuation could be caused by an as-sumed failure in the logic or in the trip breaker position contacts in conjunction with the specified set of operating circumstances

. . . described above.

• In each of the above failure modes, the consequences require the failure of a number of position switches and the occur-rence of certain operating conditions. In order to affect.

both protection system trains, the failures must occur in the 11 A 11 and "B" trip breakers. The conditions necessary to es-tablish these failure consequences are based ori the occur-rence of low probability events. The operator can still ini-tiate manual actions to perform the necessary protective functions. The deficiency exists due to the potential loss of the protective function from an undetectable failure of the protection system. The testing provisions for the pro-tection system must. include this circuitry.

Corrective Action Upon receipt of the deficiency notification from Westing-house, the P4 permissive Qircuitry (contacts/wiring) was tested on Salem Unit No. 1 to verify its proper operation.

The Westinghouse recommended testing procedure was utilized and no failures were discovered. The Salem testing proce-dures will be revised to include testing bf the P4 perrnissiye circuitry on a periodic basis. Salem Unit No. 2 will be tested prior to operation.

The above testing/procedure*revisions are satisfactory to re-solve the deficiency of an undetectable failure in the reactor trip P4 permissive circuitry.

BBOS/l *PD 18.1.002 - Solid State Protection System External Input Function Check Salem No. 1 and 2*units - 18 month frequency.

S#~H GEAJER#~~ Sr117;oJ)

• U1J17.S . I 11//b 2 W RE1tem.R 1R.i/J '9~E1t1<E~ ~£R,l)6.£JIE.c17 STRT10,.J low£~

'l;1sr~u~o1/oA.J $us RElleTO£.*. "JR;/) REllt!'l?J,R Zf1)'

11\*.

8RM~&

N 8* gyl'l/ss

'9RE.t/KE£ "8 "

ROl!7tJ~ /£11' .l<Elll7l>.t 1RJ;D .

• fi1~1tss

$~G.t1R£.R.

11 f'/ "

.t£MK.C;f If llott1!11. Alll~£ 0t?&£/IJ/a;J:

1R1/J fiREl!R&.R.s t9t..0SE1.> 1 fi/~/ISS .&t'.AKU~ C>.l'b.J,

~jl'A.s.s fiRbl~ l/T/llr£b IO~ 7&.n1JJ& ()/:"//!IP 8REllJ!E.2S l>EsM;pt;o;J ;AJ Fsl/R SE1!.7"10AJ t 2. F!GU£E 1

SttlEH GEAIERdliAJG Sr11T10JJ V1t11rs I l/IJD 2.

/J¥ /JERN1ss111E t.('ttJ1r~/

II/ h~N1.ss11J~ ,/)1 _/JE.(H/SSlllE ssP.s ~111AJ It *

• SSPS ~111"1. I!>

1:e1I BK~* II

'SwrrcH I

__..._ -/1#$K.t

_,..._ Swm11 I

-- ~l'fiK.tfi su1110112 Ay111ss. BK.t II b'yi'.J.s.s &R. /j Su)fTaN I SuJ/flJJI ~

.1 J

tll~ 7fllf7¥'!J,.

'10S.I ¥i/1Jll'fQ;ij 1 10~ ..QV.JN/Ylll.1/VOJ 4 1 - - - - - a IS 7Hflflll;I .

- - - (YOl.J.i){Vf1_7 ll0o7~

(//~

~().t.~Jl.7l c a - - - - c

.t.H917 ,;

~/Vl.1.JIJl<lfl/

.')/~07?/.QS:7Q' IS ?Jln~µl'I s11:1rv'01s rs

.VIJ./:IH0.1.fl/J f

?fJ07fl 3S.7Q' .IS ~O;I Wlfl'JJIJ'(/. ~1907

? <trv11 / S.J.ttvn (l'Ol.JHJ. <;:; 9{Vl.J.l/d':J('{] f) H31t:J s