ML18141A198
| ML18141A198 | |
| Person / Time | |
|---|---|
| Site: | Surry, North Anna, 05000000 |
| Issue date: | 11/04/1983 |
| From: | Stewart W VIRGINIA POWER (VIRGINIA ELECTRIC & POWER CO.) |
| To: | Harold Denton, Eisenhut D Office of Nuclear Reactor Regulation |
| Shared Package | |
| ML18141A199 | List: |
| References | |
| 617, GL-83-28, NUDOCS 8311100184 | |
| Download: ML18141A198 (66) | |
Text
.,
~
e VIRGINIA ELECTRIC AND POWER COMPANY RICHMOND, VIRGINIA 23261 W. L. STEWART VICE PRESIDENT NUCLEAR OPERATIONS November 4, 1983 Mr. Harold R. Denton, Director Office of Nuclear Reactor Regulation Attn:
Mr. Darrell G. Eisenhut, Director Division of Licensing U. S. Nuclear Regulatory Commission Washington, D. C. 20555 Gentlemen:
VIRGINIA ELECTRIC AND POWER COMPANY NORTH ANNA UNITS 1 AND 2 SURRY UNITS 1 AND 2 RESPONSE TO GENERIC LETTER 83-28 Serial No. 617 NO/JDH:acm Docket Nos. 50-280 50-281 50-338 50-339 License Nos. DPR-32 DPR-37 NPF-4 NPF-7 In response to your letter of July 8, 1983, we have prepared the enclosed report entitled Response to Generic Letter 83-28, Required Actions Based on Generic Implications of Salem ATWS Events.
We are forwarding six copies of the report and six copies of supporting drawings.
Additional copies are available upon request.
We have approached Generic Letter 83-28 as an opportunity to critically evaluate and to learn from the results of the Salem events.
Although much industry-wide work is proceeding on the Letter, we have taken the initiative to move forward with program improvements which will enhance our overall management control.
We intend to proceed aggressively with these plans and programs and to incorporate industry-wide contributions as they become available.
This response contains the status of current conformance with the positions stated in Generic Letter 83-28, and plans and schedules for any needed improvements for conformance with the positions.
We intend to update this report periodically to reflect revisions or additional information, and the status of implementation.
a:u i 1 oo 104 -s:h i 04--- -
~DR ADOCK 05000280 PDR Attachments cc:
Mr. J. P. O'Reilly (w/attachments)
Mr. M. B. Shymlock (w/attachments)
Mr. D. J. Burke (w/attachments)
VJ.if[;
W. L. Stewart
COMMONWEALTH OF VIRGINIA)
)
CITY OF RICHMOND
)
e The foregoing document was acknowledged before me, in and for the City and*
CollDllonwealth aforesaid, today by W.
L.
Stewart who is Vice President -
Nuclear Operations, of the Virginia Electric and Power Company.
He is duly authorized to execute and file the foregoing document in behalf of that Company, and the statements in the document are true to the best of his knowledge and belief.
Acknowledged before me this
-c:L t./
day of nc:n>-J'
£<<'
, 19 ----
My Commission expires:
~
- :;.. ~
, 19
~ s_.., *
---"==--a-"""----
Notary Public (SEAL)
S/001
RESPONSE TO GENERIC LETTER 83-28 REQUIRED ACTIONS BASED ON GENERIC IMPLICATIONS OF SALEM A TWS EVENTS VIRGINIA ELECTRIC AND POWER COMPANY
}?. '-:.~ *~., ;****: *:;..r 1" r:
.!'~ *:t** ~.~ -.** *:*~*.
~:..... (~\\.r:*~*~.. !.1-:.1... :-:._.. ::
VIRGINIA. ELECTRIC AND POWER COMPANY
', ;. ***** *.: :* *~. \\,'" '.;_ s~.. ;_/} *.:.*~-A
. * '*.. ~
RICHMOND, VIRGINIA 23261
- w. L. STBWART VlCB PKESJ:DBNT NuCLEAB 0PEBATJ:OWB November -4~ 1983 Mr. Harold R. Denton, Director Office of Nuclear Reactor Regulation Attn:
Mr. Darrell G. Eisenhut, Director Division of Licensing U.S. Nuclear Regulatory Connnission Washington, D. C. 20555 Gentlemen:
- ~ ~:'*'. {\\~.. /.:_*:*
- !~~-:--,,.
t,~ 1 7 x,.. S_e~i.i:!:;L_-.blo. 617
- .'f!Ipljn,ll,;~cnrr. **..
Pocket Nos~ *.. 5,Q~g80
\\i-:5:P_:;,:_281
- , _., -)};g~;_;~
Licen,se ~os:.. :-,:PP!l'.f-32 *
- .. ::\\;,;~;:~:i::7
- NPF-7
- VIRGINIA ELECTRIC AND POWER COMPANY NORTH ANNA UNITS 1 AND 2 SURRY UNITS 1 'AND 2 RESPONSE TO.GENERIC LETTER 83-28 In response to your letter of July 8, 1983.,,we hav~ *,:PI~;.~t;e,c:tJ;:he~-c.,~it~i~;ed
.. report entitled.* Response to.Generic Letter B3*+i8, R;equTrep>:AEfions -:1:fised:ron Generic
- Implications of Salem ATWS Events. *..We. ~:re f,g.~a..~dlng;* s;!.~; cop;i.e._!i'".:,Of the report and six copies of supporting drawings.
Additional
- copie~ are available upon request.
We have approached Generic Letter
- 83-28 as a?!,i *op.pprt;:µ.~ity
~o-,j-~c,ritical.ly evaluate and to learn from the results of the Salem. ev:.ents.
Althqµ-gh mtj.ch industry-wide *work is proceeding on the Letter, w~*;Jl~ve. ta.kl;!~. t:h~.- i~:i,.-tiative to move forward with program improvements which *. will-,:enh~nc~, ou,.i:: -,*Elv~.r~ll management control.
We intend to proceed aggressiyely:.:with th~!?~- :pl.an.a,, and programs and to incorporate industry-wide co~tributions* as they.. become available.
This response contains the status of* current conformance with the positions stated in Generic Letter 83-28, and plans and schedules. for any needed improvements. for conformance with the positions.
-~~ i-p.;.~pp,, !;P-*a;U.Pc\\e;~ t~his report periodical;Ly to ref.lee~ revisions or additional* informat:toI.1, ~nd the status*Qf implementation.
Attachments cc:
Mr. J. *P. *o*ieitiy '.(w/~:t:tachments)
Mr. M. B. Shymlock '(w/at,~,achments)
Mr. D. J. Burke (w/ at't~iclitiients)
/...
~..,
1.1 1.2 2.1.A 2.1.B 2.2.1 2.2.2 3.1 3.2 4.1 SCHEDULE
SUMMARY
ITEM/SUBJECT Post-Trip Review procedure implemented Data and Info. Capability Equipment Classification (RTS only)
Vendor Interface (RTS only)
Equipment Class.ification (All)
Augmented Equipment List In Place Vendor Interface (All)
- Administ.rative controls iri place
- Vendor identification completed Vendor Files established.
Post-Maintenance Testing (RTS only)
Post-Maintenance Testing (All)
RTS Reliability 4.2 RTS Reliabiilty 4.3 4.4 4.5
- 1.
Preventive Maintenance procedures revised
- 2.
Trending
- 3.
WOG Life Testing Program completed
- 4.
Periodic Testing Auto Shunt Trip Installation N/A System Functional Testing MILESTONE November 4, 1983 No action required July 1, 1984 No action required July 1, 1984 March 31, 1984 July 31, 1984 December 31, 1984 No action required December 31, 1984 No action required April 1, 1984 December 31, 1984 June 30, 1984 Linked to WOG Life Testing Program.
Surty-2 Fall 1984 Maintenance Outage Surry,-! Spring 1985 Maintenance Outage North Anna-2 Fall 1984 Refueling Outage North Anna-1 first out-ages of sufficient duration after Fall 1984*
Pending NRC Review of-WCAP-10271
i COMMONWEALTH OF VIRGINIA)
)
CITY OF RICHMOND
)
The f orego:lng document was acknowledged before me, in and for the City and
- Co11D11onwealth aforesaid, today by W.
L. Stewart who is Vice President -
Nuclear Operations, of the Virginia Electric and Power Company.
He is duly authorized to execute and file* the for~going document in behalf of th.at Company, and the statements in the document are true to the best of his knowledge and belief.
Acknowledged before me this My Counnission expires:
(SEAL)
S/001
-cL t./
day of na-v ft
.L,
, 19
~~
c?, - ;J.. G.
, 19
~ ~-
- Notary Public r
TABLE OF CONTENTS (Individual Tabs are provided for the major sections listed below.)
TRANSMITTAL AND REVISION LETTERS TABLE OF CONTENTS INTRODUCTION
RESPONSE
- e SCHEDULE 1.1 Post-Trip Review (Program Description and Procedure) 1.2 Post-Trip Review (Data and Information Capability) 2.1 Equipment Classification and Vendor Interface (Reactor Trip System Components) 2.2 Equipment Classification (All Safety-Related Equipment) 3.1 Post-Maintenance Testing (Reactor Trip System Components) 3.2 Post-Maintenance Testing (All Other Safety-Related Components) 4.1 Reactor Trip System Reliability (Vendor-Related Modifications) 4.2 Reactor Trip System Reliability (Preventive Maintenance and Surveillance Program for Reactor Trip Breakers) 4.3 Reactor Trip System Reliability (Automatic Actuation of Shunt Trip for Westinghouse and B&W Plants) 4.4 Reactor Trip System Reliability (Improvements in Maintenance and Test Procedures for B&W Plants 4.5 Reactor Trip System Reliability (System Functional Testing)
Drawings (attached)
e INTRODUCTION As part of the NRC's response to the Salem Anticipated Transient Without Scram events of February 22 and 25, 1983, the staff reviewed intermediate-term actions to be taken by licensees.
These actions were developed by the staff based on the information contained in NUREG-1000, Generic Implications of the ATWS Events at the Salem Nuclear Plant.
The actions addressed issues related to reactor trip system reliability and general management capability.
On July 8, 1983, the NRC issued Generic Letter 83-28, Required Actions Based on Generic Implications of Salem ATWS Events.
The letter required licensees to address NRC positions in four specific areas:
post-trip review, equipment classification and vendor interface, post-maintenance testing, and reactor trip system reliability improvements.
This_ response contains the status of current conformance with the positions stated in Generic Letter 83-28, and plans and schedules for any needed improvements for conformance with the positions.
This report will be updated periodically to reflect revisions or additional information, and the status of implementation.
Each section of this report contains a reprint of the NRC required action contained in the enclosure to Generic Letter 83-28, followed by the Vepco response.
For each item, the number assigned to the Vepco response paragraphs corresponds to the NRC positions.
Background information is provided where appropriate.
Several action plans and schedules have been developed to implement changes to meet the NRC positions.
A summary of the schedules for these changes is provided under a separate tab.
Vepco has made, and will continue to make, every effort to implement the programs, procedures, and schedules described in this report.
These programs are based on our analysis of the current status of the areas described and what will be necessary to fully comply with the NRC positions.
In some areas, conformance to a position will require development due to the complexity of.
the variables involved and will allow for modification of the developing program based on feedback of actual experience.
Vepco reserves the right to modify these programs and schedules as necessary to fully meet the intent of the criteria contained in the Generic Letter.
e*
REQUIRED ACTIONS BASED ON GENERIC IMPLICATIONS OF SALEM ATWS EVENTS 1.1 POST-TRIP REVIEW (PROGRAM DESCRIPTION AND PROCEDURE)
Position Licensees and applicants shall describe their program for ensuring that unscheduled reactor shutdowns are *analyzed and that a detennination is made that the plant can be restarted safely. A report describing the program for review and analysis of such unscheduled reactor shutdowns should include, as a minimum:
- 1. The criteria for detennining the acceptability of restart.
- 2. The responsibilities and authorities of personnel who will perform the review and analysis of these events.
- 3. The necessary qualifications and training for the responsible personnel.
- 4. The sources of plant infonnation necessary to conduct the review and analysis. The sources of infonnation should include the measures and equipment that provide the necessary detail and type of infonnation to reconstruct the event accurately and in sufficient detail for proper understanding. (See Action 1.2)
- s. The methods and criteria for comparing the event information with known or expected plant behavior (e.g., that safety-related equip-ment operates as required by the Technical Specifications or other perfonnance specifications related to the safety function).
- 6. The criteria for detennining the need for independent assessment of an event (e.g., a case in which the cause of the event cannot be positively identified, a competent group such as the Plant Operations Review Conmittee, will be consulted prior to authorizing restart) and guidelines on the preservation of physical evidence (both hardware and software) to support independent analysis of the event.
- 7. Items 1 through 6 above are considered to be the basis for the establishment of a systematic method to assess unscheduled reactor shutdowns.
The systematic safety assessment procedures compiled from the above items, which ire to be used in conducting the
~
evalu1tion, should be 1n the report.
&p11cabi11ty This position applies to all licensees and OL applicants.
Type of Review For licensees, a post-implementation review of the program and procedures w111 be conducted or the staff will perform a pre-implementation review 1f desired by the licensee.
NRR will perform the review and issue Safety Evaluations.
For OL applicants, the NRR review will be performed consistent with the licensing schedule.
Documentation Required Licensees and applicants shall submit I report describing their program addressing all the items in the position.
Techncial Specification Changes Required No changes to Technical Specifications are required.
References Section 2.2 of NUREG-1000 Regulatory Guide 1.33 ANSI NlS.7-1976/ANS-3.2 Item 1.c.s of NUREG-0660 10 CFR 50 - 50.72
1.1-1 ITEM I.I - POST-TRIP REVIEW (PROGRAM DESCRIPTION AND PROCEDURE)
The post trip review program and procedures have been reviewed in light of the requirements of Item I.I, Post Trip Review (Program Description and Procedure), of Generic Letter 83-28.
Existing procedures at both stations required documentation of the cause and corrective action prior to restart for any reactor shutdown or trip.
The procedure review identified the need for more extensive documentation of the investigation and clarification of the
. review and restart approval requirements.
Accordingly, both stations' Post
- Trip Review procedures have been revised to improve these areas and address all requirements of Generic Letter 83-28.
The revised procedure is included as Attachment I.
The revised procedure has been implemented at both Surry and North Anna Power Stations.
In-addition, with the advent of the Safety Parameter Display System (SPDS) and other NUREG 0737 improvements, the capability to gather and analyze the post trip data will be further enhanced.
The schedule for the 0737 Supplement I modifications was submitted as our response to Generic Letter 82-33.
I.
- 2.
Acceptance Criteria Restart is acceptable provided:
- a.
the cause of the trip is known and corrected.
- b.
major safety related and other important equipment functioned properly during the transient or corrective maintenance has been completed and satisfactory testing has been performed or will be completed when plant conditions permit.
- c.
the plant response during the transient has been analyzed and the plant responded as anticipated or all abnormalties have been resolved.
If the cause of the trip has not been positively identified, the Station Manager (or Assistant Station Manager) and the Station Nuclear Safety and Operating Committee (SNSOC) shall review the event prior to the restart.
The review will confirm that the event investigation has been thorough and accurate and that adequate measures are taken to prevent repetitively challenging safety systems during future power operations.
Responsible Person The station organization and the qualifications and responsibilities of individuals participating in the post trip review process are explained in Section 6.0 of each station's Technical Specifications.
The specific duties of key individuals in the post trip review process are defined in Section 3. 0 of the attached station's post trip review procedure.
1.1-2
- 3.
Qualifications The qualifications of the individuals participating in the post trip review process are defined in Technical Specification 6. 3.1 for North Anna and Technical Specification 6.1 for Surry.
All individuals involved in the post trip review meet or exceed the minimum qualifications of ANSI Nl8.1 -
1971 for comparable positions and the supplemental requirements specified in the March 28, 1980 NRC letter to all licensees, except for the Shift Technical Advisor who shall have a bachelor's degree or equivalent in.a scientific or engineering discipline with specific training in plant design, and response and analysis of the plant for transients and accidents.
All individuals involved have received training in the post trip review procedure and their specific responsibilities.
- 4.
Source Information Our response to section 1.2 of generic letter 83-28 provides a listing of computer based event and sequence recorders, control room strip charts and other hardware based sources available for post trip review.
This equipment provides a broad range of parameter trend data, specific time sequence of events such as logic functions and equipment actuations are recorded and printed automatically or on request.
The information provided is more than adequate to evaluate the cause of the trip and the proper functioning of equipment.
In addition to the hardware based data sources identified in response to section 1.2, the following sauces of information will be utilized in the post trip review.
- a.
Procedures Emergency Procedures which will be utilized in response to a reactor trip or other transient require detailed confirmation by the operator of proper functioning of safety related and important equipment.
Completion of these procedural verifications by the control room operator will identify any failure or degradation of this equipment.
Any abnormality will be recorded in the procedure and/or in the operator's log.
- b.
Control Room Logs The Control Room Operator and Senior Reactor Operator logs will provide a
narrative of significant events related to the transient.
- c.
Control Room References Station
- drawings, plant
- manuals, protection system logic diagrams, equipment descriptions, setpoint references and the FSAR are available in the control room.
These form the basis for confirming that equipment and systems functioned as designed.
Additional information is available from Station
1.1-3 Records as required.
Comparison of the transient under review with previous transients will be accomplished with data from the FSAR or from records of previous reactor trip events.
- d.
Station Simulator A station specific simulator is available for modeling of transients.
This may be used to reproduce transients to provide a better understanding of the event.
The simulator will also be used when necessary to train operators in the unit response to the specific event.
- e.
Personal Interviews Operating personnel and other persons involved in the trip event are responsible for providing the Shift Supervisors and the Shift Technical Advisor with an accurate and thorough summary of their observations and actions during the event.
- 5.
Performance Criteria The post trip review procedure requires that the Shift Technical Advisor compare the trip and transient with similar transients described in the FSAR or with previous similar trips for which data is available.
The purpose of this review will be to identify any abnormal response indicative of a degraded condition.
Attachment B of the post trip review procedure requires a detailed review to determine that all safeguard functions required have actuated and that all control systems functioned normally.
The station emergency proce-dures include detailed checkoffs to confirm individual component and function actuations in the event of reactor trip, safety injection, main steam and main feedwater isolation, or containment spray actuations.
Any failure or degration of safety related or important equipment will be identified and must be resolved prior to restart.
- 6.
Review Criteria For purposes of defining the levels of review required prior to restart, reactor trip events will be categorized into one of two categories as follows:
Class I Reactor Trip -
The trip is clearly understood and -corrected and no significant malfunctions of safety-related or important equipment occurred.
Class II Reactor Trip - The cause of the trip is not clearly or complete-ly known or safety related and/or other important equipment functioned in an abnormal or degraded manner during or following the trip.
e 1.1-4 Following any unplanned manual or automatic reactor trip a full post trip evaluation will be completed.
For a Class I reactor trip the restart may be authorized by the Superintendent of Operations.
For a Class II reactor trip the event must be reviewed by the Station Nuclear Safety and Operating Committee prior to restart and the restart must be authorized by the Station Manager or Assistant Station Manager.
The Post Trip Review Procedure specifies that package be developed documenting each trip review.
be retained for the life of the facility.
- 7.
Procedures a
comprehensive data The data package will Post Trip Review procedures for Surry and North Anna are included for information as Attachment I.
1.0 PURPOSE 1.1-5 VIRGINIA ELECTRIC AND POWER COMPANY POST TRIP REVIEW PROCEDURE Attachment I to Item 1.1 To provide a systematic method for diagnosing the causes of reactor trips, evaluating the proper functioning of safety-related and other important equipment, and making the determination that the plant can be restarted safely.
The post trip review process provides a consistent, comprehensive, and systematic method to determine the causes, conditions and circumstances associated with a reactor trip.
The review results will provide the basis for the determination of the readiness of the plant to safely return to operation.
2.0 DEFINITIONS 2.1 Reactor Trip -
a manual or automatic opening of the reactor trip breaker(s).
For purposes of defining review and approval levels within this procedure, reactor trips will be divided into two classifications.
Class I Reactor Trip - The trip is clearly understood and corrected and no significant malfunctions of safety-related or important equipment occurred.
Class II Reactor Trip -
The cause of the trip is not clearly or completely known or safety-related and/or other important equipment functioned in an abnormal or degraded manner during or following the trip.
3.0 RESPONSIBILITIES 3.1 Shift Supervisor The Shift Supervisor is responsible for determining the cause of any reactor trip.
The Shift Supervisor will document his findings by completing form l/889.92A "Reactor Shutdown and Trip Report Form" (attachment A).
3.2 Shift Technical Advisor (STA)
The STA is responsible for conducting an independent evaluation of.the reactor trip event.
His activities will be documented by the completion of Attachment B, "Post Trip Review Report".
3.3 Plant Personnel Plant personnel that were involved in the reactor trip event will cooperate fully with the Shift Supervisor and with the STA and will provide accurate, objective summaries of their observations of the event sequence and plant response.
1.1-6 3.4 Superintendent of Operations (or SRO on call)
The. Superintendent of Operations or SRO on call is responsible for making the decision to restart the reactor in those cases where the trip is clearly understood and corrected and where no significant malfunctions of safety-related or important equipment occurred (Class I trip).
3.5 Station Manager The Station Manager is responsible for making the decision to restart the reactor for a "Class II" trip where:
- a.
The cause of the trip is not clearly known.
- b.
Safety related and/or other important equipment functioned in an abnormal or degraded manner during or following the trip.
3.6 Station Nuclear Safety and Operating Committee (SNSOC)
The Station Nuclear Safety and Operating Committee (SNSOC) is responsible for reviewing all reactor trips.
For Class I reactor trips this review can take place following the restart.
For Class II reactor trips a preliminary SNSOC review must be completed prior to the restart.
3.7 Supervisor, Safety Engineering The Supervisor Safety Engineering will ensure that a final.
comprehensive trip report is formally submitted to. the SNSOC within 30 days of the reactor trip event.
3.8 Director-Safety Evaluation and Control The Director-Safety Evaluation and Control is responsible for providing a separate and independent review of the reactor trip event.
This independent review will assess the adequacy of the evaluation and the corrective actions.
Any concerns or recommendations resulting from this review will b.e directed to the Station Manager for resolution.
4.0 INSTRUCTIONS 4.1 General The post-trip review process is a five phase process.
The five phases are as follows:
(1)
Data collection (2)
Trip investigation (3)
Trip investigation review (4)
Restart decision (5)
Identification of lessons learned-followup actions
1.1-7 4.2 Initiation For any shutdown or reactor trip, scheduled or unscheduled, form
/1889. 92A "Reactor Shutdown and Trip-Report Form" (Attachment A) shall be completed by the Shift Supervisor.
Any unplanned manual or automatic reactor trip will require a full post trip review including the completion of Attachment B and the assembly of the associated data package.
The STA will be notified immediately following the reactor trip by the Shift Supervisor or his designee.
The post trip review shall be initiated after plant conditions have stabilized.
The post trip review shall not distract the Shift Supervisor or STA from their primary responsibility of monitoring plant parameters and maintaining the plant in a safe condition.
4.3 Data Collection
- 4. 3. 1 Purpose The purpose of the data collection phase of the trip review is to gather sufficient data to reconstruct the sequence of events from the appropriate time prior to the trip until plant parameters have stablized following the event.
4.3.2. Hard Copy Information The STA is responsible for collecting the required hard copy information.
Attachment B, "Post Trip Review Report" lists the information that should be collected.
Strip charts must accurately reflect real time.
Where this is not the case, the Chart shall be carefully marked on the paper to reflect
- date, time, parameter, instrument
- number, chart speed and time scale.
4.3.3 Post Trip Review Report Data The STA shall complete Part 1 and Part 2 of Attachment B, "Post-Trip Review Report", documenting the initial plant conditions and the plant response.
Information for the "Post Trip Review Report" shall come from a compilation of all available data.
4.3.4 The STA shall combine the hard copy information, his notes and the "Post Trip Review Report" in one folder.
1.1-8 5.0 POST TRIP INVESTIGATION 5.1 Purpose and Discussion The Shift Supervisor and the STA will both investigate and evaluate the reactor trip and associated transient.
The purpose of this investigation is to identify the cause of the trip and to assess the plants readiness to return to operation.
5.2 Event Reconstruction The STA will reconstruct the transient using the collected data.
A chronological description of the event will be developed by the STA using the sequence of events printout as a base.
Pertinent alarms, trips, actuations, and isolations will be listed.
Plant parameters, taken from the post trip log and strip charts, will be compared with the chronological list of events in the reconstruction.
If the sequence of events printout is out of service, the event shall be reconstructed using available data.
5.3 Comparison When possible, the similar transients Analysis Report or This will assist indications.
reconstruction shall be compared with described in the Updated Final Safety previous data packages for similar trips.
in identifying abnormal or degraded 5.4 Analysis and Evaluation The SRO and the STA shall analyze and evaluate the event reconstruction and event comparison to determine the following:
(1) the cause of the trip (2) If all major safety-related and other important equipment involved in the trip operated as anticipated or expected (3) if the trip/transient caused any detrimental effects on plant equipment (4) if it is acceptable to restart the reactor The SRO and STA shall look beyond the obvious indications to diagnose the cause of the trip and evaluate the plant response.
They shall thoroughly review the available information looking for abnormal or degraded trends in equipment performance,
- events occurring out of the normal or anticipated sequence, failed or degraded response of equipment to control signals, and unanticipated alarm conditions.
The actual or suspected cause of the trip* and any abnormal or degraded indication identified during the transient shall be documented in parts 5 through 7 of Attachment B.
1.1-9 5.5 Event Classification Based on his evaluation of the event and on his review of the STAs evaluation and assessment of the
- event, the Shift Supervisor will classify the event as either a Class I or Class II trip.
If the Shift Supervisor and the STA can not agree on the proper classification, the trip wilJ. be categorized as Class II and will be handled accordingly.
5.6 Notifications and Confirmation of Classification The Superintendent of Operations or SRO-on-call shall be notified of all reactor trips.
The Shift Supervisor and the STA will present their findings to the Superintendent of Operations.
The Superintendent of Operations will confirm that the classification of the event was correct.
6.0 INVESTIGATION REVIEW 6.1 Class I Reactor Trips Events classified as Class I reactor trips must be reviewed by the Superintendent of Operations or SRO on call prior to restart.
The review may be conducted by telephone.
Based on a thorough discussion of the findings with both the SRO and the STA the Superintendent of Operations shall determine if the evaluation if thorough and technically accurate.
He may request additional data or evaluations if necessary.
Once the Superintendent of Operations is satisfied that the *evaluation results represent a firm basis from which to make a restart decision, he is authorized to do so for Class I trips.
Class I trip events will be reviewed by the SNSOC within 30 days of the event.
6.2 Class II Reactor Trips Events classified as Class II reactor trips shall be reviewed by the Superintendent of Operations, and the Station Manager or Assistant Manager, and shall* receive a preliminary review by the Station Nuclear Safety and *operating Committee prior to restart.
For a Class II trip, the responsibilities of the Superintendent of Operations are the same as for a Class I event with the exception that he is not authorized to make the restart decision for a Class II event.
The review by the Manager or Assistant Manager and the preliminary review by SNSOC may be performed by telephone conference.
1.1-10 The Manager or Assistant Manager and the SNSOC will review the event and the findings.
This review will address the following areas:
- 1.
Is the trip data and evaluation adequate?
- 2.
What was the actual or most pro~able cause of the trip?
- 3.
What maintenance or testing is required prior to restart?
- 4.
Is additional monitoring or trending required during or after restart?
- 5.
Is additional expertise such as NSSS evaluation required?
- 6.
Are any specific briefings to operations and/or mainte-nance personnel necessary?
- 7.
The conditions necessary for restart.
7.0 RESTART DECISION 7.1 Basis The decision to restart the reactor shall be based on the following considerations.
(1) the cause of the trip is known and corrected (2) major safety related and other important equipment functioned properly during the transient or corrective maintenance and satisfactory testing have been performed or will be completed when plant conditions permit (3) the plant response during the transient has been analyzed and the plant responded as anticipated or all abnormalities have been resolved 7.2 Responsibilities For Class I trip events, the Superintendent of Operations is authorized to make the restart decision.
For Class II trip events, the Station Manager or Assistant Manager, with concurrence of the SNSOC and the Superintendent of Operations, is authorized to make the restart decision.
8.0 FINAL REVIEW BY SNSOC The station Safety Engineering Staff will make a formal report on the trip to the SNSOC within 30 days of the event.
This report will be made for all events including those for which a preliminary SNSOC review was completed prior to restart.
The purpose of the formal report is to confirm and elaborate on preliminary findings summarize corrective actions, identify the need for any additional corrective measures and to make recommendations.
The SNSOC will assess whether the review of the trip has been adequate and whether adequate measures have been taken *to prevent repetitive challenges to safety systems during future power operations.
1.1-11 8.1 Review by Safety Evaluation and Control (SEC)
The post-trip review data package (or a copy) shall be sent to the Director, Safety Evaluation and Control within 7 days for review by the SEC staff.
The post trip review data package will be screened to determine its significance to plant safety and reliability.
The event will be evaluated to determine the cause and lessons learned for operator and plant staff training and for dissemination to the industry.
The SEC staff will provide an independent review of the adequacy of the trip review and of corrective actions.
Any questions, concerns or recommendation will be directed to the Station Manager for action.
8.2 Data Retention The post trip review data package shall be retained for the life of the plant.
e e
e 1.1-12 REACTOR SHUTDOWN AND TRIP REPORT FORM UNIT Shutdown Information
- 1.
Shutdown No.:
Start of Ramp:
Steps C/D:
- 2.
Type of Shutdown:
I Date:
End of Ramp/Trip:
T avg:
CB -----
Normal Emergency Trip Attachment A
- 3.
Reason for Shutdown/Trip ----------------------------
- 4. Assistant Shift Supervisor: -------- Shift Supervisor:
Forward Second Copy to Station Manager via Superintendent of Operations within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following the shutdown with the above section complete.
Start-Up Information
- 5.
Cause of Emergency Shutdown/Trip Corrected:
Yes No
- 6.
State Corrective Action in Detail:
- 7.
PT-1.1 or 1.4 Date:
- 8. Jumper Log Review
- 9. Tagout Review
- 10. OP-IA Completed
- 11. ECP Complete:
- 13. Start-up No.:
Steps C/D:
T ave:
Date/Time:
I CB Loops:
Pzr:
- 12. Shift Supervisor: __
I
- 14.
Superintendent of Operations/Designeee Permission for Reactor Start-up and Power Increase above 2%.
Superintendent of Operations:
Put Original In Book In The Control Room After Completion.
Send 1st Copy to Station Records After Complete Via Superintendent of Operations.
Attachment B 1.1-13 NOTE: This is a general procedure, applicable to both Surry and North Anna.
Editorial differences may exist between the two stations.
POST TRIP REVIEW REPORT UNIT DATE OF OCCURRENCE TIME OF OCCURRENCE -----------
STA:
Signature Date Time Part 1 Initial Conditions (a)
Reactor Power (b)
Generator Output MWe (c)
Reactor Coolant Pumps Operating A
B C
(Circle ones operating)
(d)
Main Feed Pumps Operating A
B C
(e)
Condensate Pumps Operating A
B C
(f)
Status of Control Stations (Manual or Auto)
MAN/AUTO
- 1.
Rod Control
- 2.
Turbine Control
- 3.
Loop A Feedwater Control (MAIN)
- 4.
Loop B Feedwater Control (MAIN)
- 5.
Loop C Feedwater Control (MAIN)
- 6.
Loop A Feedwater Control (Bypass)
- 7.
Loop B Feedwater Control (Bypass)
- 8.
Loop C Feedwater Control (Bypass)
- 9.
Steam Dump Control (List Mode)
- 10.
Pressurizer Level Control
- 11. Pressurizer Pressure Control (g)
Off-normal status of any safety-related or important equipment.
- 1.
- 2.
Safety Injection
- 3.
Containment Sprays (QS, IRS, ORS, Casing Cooling)
- 4.
- 5. Electrical Distribution
- 6.
Other List by number and give details:
1.1-14 (h)
Testing or surveillance in progress:
Give test number and title and status at time of event Part 2 Plant Response (a)
Obtain a copy of the following parameter strip charts.
Mark these charts accurately and completely with time and parameter identifica-tion.
(All of these charts must be reviewed as part of the post trip review.
Obtaining and marking of all copies for inclusion in the data package should be completed as soon as practical after the trip but is not Fequired prior to the restart decision)
- 1.
Reactor power
- 2.
Pressurizer level
- 3.
RCS pressure
- 4.
Tave
- 5.
Main Steam Pressure
- 6.
Steam Generator Levels
- 7.
Any other chart displaying a parameter significant to the event (b)
Obtain a print out from:
- 1.
Sequence of events recorder
- 2.
P-250 alarm typewriter
- 3.
Post Trip Review printout (c)
Safety System Actuation and Performance Protective Action Reactor Trip - Train A Reactor Trip - Train B Turbine/Generator Trip Safety Injection Containment Intermediate High High Containment High High Feedwater Isolation Main Steam Isolation Auxiliary Feedwater Overpressure Protection System Pressurizer PORV's Pressurizer Safeties Demand Initiation Completion
1.1-15 Explain any discrepancies ------------------------
Causes ----------------------------------
Corrective Actions ---------------------------
(d)
Control System response:
- 1.
RCS pressure control.
- a.
Was pressure response normal?
- b.
Did PORV's or safeties lieft?
- 2.
Pressurizer level control
- 3.
Steam Generator level control
- 4.
Steam Dumps
- 5.
Other Decrepancies:
List by number and describe any control system abnormalities observed during the. transient--------------
Cause ----------------------------------
Corrective Actions --------'---------------------
(e)
Radiological Consequences "Did the event result in the release or spread of radioactivity? If so, give details -----~------------------------
Additional comments regarding Initial Conditions or Plant Response
1.1-16 Part 3 Sequence of Events (a)
Completion of this section is not required if the sequence of events recorder is fully operational throughout the event and the printout is included in the data package.
Time Event Description
L Part 4 Analysis and Evaluations Probable cause of transient 1.1-17 Part 5 Unexpected Aspects of Transient Behavior (if event was compared with a previous similar event, note the transient or reference used for comparison)
Transient Used for Comparison ------------------------
Part 6 Identification of specific component(s) which performed in an unusual or degraded mode.
Component Description of problem (1)
(2)
(3)
Corrective Actions (1)
(2)
(3)
e 1.1-18 Part 7 Event Classification Classify reactor trip event as either Class I or Class II based on the guidelines in the procedure (Sections 2.1 and 5.6)
The reactor trip event which occurred on at
___ d_a_t_e____
t_i_m_e __ _
is a Class event.
I or II Signatures indicates agreement with classification
____ / ___ _
Shift Supervisor Date Time
____ / ___ _
STA Date Time
____ / ___ _
Superintendent Operations Date Time Part 8 Permission to Start Up Class I Event
____ / ___ _
Superintendent Operations Date Time Class II Event
____ / ___ _
Station Manager Date Time Note:
Review by and concurrence of SNSOC is required prior to restart for a Class II event.
e 1.2 POST-TRIP REVIEW - DATA AND INFORMATION CAPABILITY Position Licensees and applicants shall have or have planned a capability to record, recall and display data and infonnation to pennit diagnosing the causes of unscheduled reactor shutdowns prior to restart and for ascertaining the proper functioning of safety-related equipment
- Adequate data and tnfonnation shall be provided to correctly diagnose the cause of unscheduled reactor shutdowns and the proper functioning of safety-related equipment during these events using systematic safety assessment procedures (Action 1.1). The data and infonnation shall be displayed in a fonn that pennits ease of assimilation and analysis by persons trained in the use of systematic safety assessment procedures.
A report shall be prepared which describes and justifies the adequacy of equipment for diagnosing an unscheduled reactor shutdown.
The report shall describe as a minimum:
- 1. Capability for assessing sequence of events (on-off indications)
- 1. Brief description of equipment (e.g., plant computer, dedicated computer, strip chart)
- 2. Parameters monitored
- 3. Time ~iscrimination between events
- 4. Fonnat for displaying data and infonnation
- s. Capability for retention of data and 1nfonnation
- 2. Capability for assessing the time history of analog variables needed to determine the cause of unscheduled reactor shutdowns, and the functioning of safety-related equipment.
- 1. Brief description of equipment (e~g., plant computer, dedicated computer, strip charts)
- 2. Parameters lftOnitored, sampling rate, ind basis for selecting parameters 1nd sampling rate 3 *.
- Duration of ttme history (minutes befo!l"e trip and minutes after trip)
- 4. Fonnat for d;splaying data including scale (readab;lity) of time histories
- 5. Capability for retention of data, information, and physical evidence (both. hardware and software)
- 3. Other data and infonnation provided to assess the cause of unscheduled reactor shutdowns.
- 4. Schedule for any planned changes to existing data and infonnation capab;lity.
Appl icabiHty.
This position applies to all licensees and OL applicants.
Type of Review Data and infonnation capability will be reviewed by NRR to detennine whether adequate data and information will be available to support the systematic safety assessment of unscheduled reactor shutdowns.
NRR wil 1 perfonn the reviews and issue a Safety Evaluation.
For licensees, a post-implementation review of the program and procedures will be conducted by NRR or the staff will perfonn a pre-implementation review if desired by the licensee.
For OL applicants, the NRR review will be performed consistent with the licensing schedule.
Documentation Required Licensees and applicants shall submit I report describing their data and information capability for unscheduled reactor shutdowns.
Technical Specification Changes Required To be determined based on evaluation of f1!qufred documentation.
References Section 2.2 of ttURE&-1000.
1.2-1 Item 1.2 - Post-Trip Review - Data and Information Capability North Anna Response
- 1.
Capability for Assessing Sequence of Events (On-Off Indications)
- 1. Description of Equipment Each unit of North Anna has a plant process and alarm computer, Westinghouse P250, which contains a sequence of events program.
The sequence of events program monitors the status of selected reactor trip signals.
A change in the status of the monitored parameters will initiate the recording and print subroutines, The change in state (sequence of events) is chronologically printed out on the utility typewriter located in the control room.
In addition, each unit has an independent sequential events recorder (SER).
The recorder is a Hathaway sequential events recorder.
The SER monitors selected reactor trip, turbine trip, ESF, generator and miscellaneous control system alarms.
A change in the status of the monitored parameters is recorded and is available for operator review.
- 2.
Parameters Monitored P-250 - The sequence of events program monitors reactor trip signals, including manual reactor trip initiation.
The program also monitors the status of the reactor trip breakers.
SER - The sequence of events recorder monitors the status of various annunciator alarms.
~he alarms monitored include reactor trip initiation signals, turbine trip signals, main generator alarms, main station service,* *startup transformer alarms, ESF initiation signals, and control system alarms.
- 3.
Time Discrimination Between *Events P-250 The scan time is every 16.7 milliseconds with time discrimination of 7 milliseconds.
SER - The time discrimination between events is 1 millisecond.
- 4.
Format for Displaying Data and Information P-250 - The sequence of events information is automatically displayed on the utility typewriter following a reactor trip.
Each event is identified by a computer point, verbal description of the parameter, and status of the parameter.
The time in hours, minutes and seconds is identified for the first event and the time for the subsequent events is printed in chronological order in the number of cycles (1/60 of a second per*cycle) after the first event.
SER - The sequence of events information is automatically printed on a paper tape by*a teletype printer.
Each event is identified by a verbal description and status of the alarm.
In addition, the time of each event is *recorded in hours, minutes, seconds and milliseconds.
- 2.
1.2-2
- 5.
Capability for Retention of Data and Information Both the P~250 and SER print a hard copy of the seque~ce of events information, which is retained in accordance with station administrative procedures.
- 6.
Power Sources P-250 - The power source for the plant computer is an inverter which is fed from one of the station's Class IE batteries or a transformer from a 4160 VAC.
SER - The power source for the SER is from one of the station's Class IE vital busses.
Capability of Assessing Time History of Analog Variables
- 1. Description of Equipment Each unit at North Anna has two means of assessing the time history of analog variables.
First is the post trip review program of the plant computer, which is automatically printed following a reactor trip.
The second is the numerous strip chart recorders located on the control panels in the control room.
- 2.
Parameters Monitored, Sampling Rate, and the Basis P-250 -
The post trip review program monitors numerous primary and secondary system parameters.
The parameters include pressure, temperature, level, flow and power levels.
Redundant channels are monitored to allow comparison and analysis of individual channel performance.
Parameters are sampled every 32 seconds.
The parameters were seledted such that the analog parameters that initiate a reactor trip, turbine trip or safety injection are monitored.
Strip Charts - Strip charts located in the control room monitor the principle primary and secondary system parameters.
These include primary system pressure, pressurizer level, temperature,
- power, secondary system level, flow and power.
In addition, selected auxiliary system parameters are monitored, e.g. tank levels.
The parameters were selected based upon te need to monitor the trend of the parameter. All parameters are monitored continuously.
- 3. Duration of Time History P-250 -
The time history of parameters is 8 minutes before the trip and 12 minutes after the trip.
Strip Charts -
The parameters are monitored continuously before and after the trip.
1.2-3
- 4.
Format for Displaying Data P-250 -
Each parameter is identified by a computer point and the numerical value of each parameter is printed at 32 second intervals.
Strip Charts - The format for the strip charts is a continuous plot of the value of the parameter versus the time.
The scale corresponds to the scale used on the associated panel mounted meter.
- 5.
Capability for Retention of Data P-250 - The post trip review program prints the data collected by the program on the log typewriter.
The hard copy is retained in accordance with station administrative procedures.
Strip Charts -
The strip charts are retained in accordance with station administrative procedures.
- 6.
Power Sources P-250 - The power source for the plant computer is an inverter which is fed from one of the station's Class lE batteries or a transformer from a 4160 VAC emergency bus.
Strip Charts - The strip chart recorders are powered from either the vital or semi-vital instrument busses.
Both the vital and semi-vital instrument bus are powered from a Class lE power source.
- 3.
Other Data and Information
- 4.
The P-250 plant computer has additional monitoring programs such as the alarm scan, post accident analysis log (following a safety injection),
and analog trend program.
The alarm scan identifies changes in position of selected breakers and parameters when they exceed preset alarm values or return to normal values.
Planned Changes The current data and information collection system is adequate for the evaluation of unplanned reactor trips.
However, with the installation of the data collection and processing system associated with the upgrading of the Emergency Response Facility pursuant to NUREG-0737, an enhancement to the data collection capabilities will be realized.
1.2-4 Item 1.2 - Post Trip Review -Data and Information Capability Surry Response
- 1. Capability for assessing sequence of events (on-off indicatio~s)
- 1.
Description of equipment Each unit of Surry has a plant process and alarm computer, Westinghouse P250, contains a sequence of event program.
The sequence of events program monitors the status of selected Reactor Trip, Turbine Trip and Engineered Safeguard Features (ESF) signals.
A change in the status of the monitored parameters will initate the recording and print subroutines.
The change in state, (sequence of events) is printed out on the Trend typewriter located in the control room.
In addition, each unit has an independent sequential events recorder (SER).
The recorder is a RIS compact RA-80DN numeric printout sequential events recorder.
The SER monitors selected Reactor Trip, Turbine Trip, ESF, Generator and misc control system alarms.
A change in the status of the monitored parameters is recorded and is available for operator review.
- 2.
Parameters monitored P-250 -
The sequence of events program monitors reactor trip signals, turbine trip signal, ESF initiation signals, main generator output breaker position.
The program also monitors the status of the reactor trip breakers.
SER - The sequence of events recorder monitors the status of RIS alarms.
The alarms monitored include reactor trip initiation signals, turbine trip signals, main generator alarms, main, station service, startup transformer alarms, ESF initiation signals, turbine runback signals and control system alarms.
- 3.
Time discrimination between events
- 4.
P-250 - The time discrimination between events is 4 msec.
SER - The time discrimination betwe.en events is 1 msec.
Format for displaying data and information P-250 -
The sequence of events information is automatically displayed on the Trend typewriter.
Each event is identified by a computer point, word description of the parameter, and status of the parameter.
The time in hours, minutes and seconds is identified for the first event and the time for the subsequent events are indicated in the number of cycles after the first event.
- 5.
1.2-5 SER -
The sequence of events information is automatically printed on a_paper tape by a high speed printer.
Each event is identified by an alarm point number and status of the alarm.
In addition, the time of each event is recorded in hours, minutes, seconds and msec.
The operator has available to him a.listing of the alarm points and the corresponding noun description of the alarm.
Capability for retention of data and information Both the P-250 and SER print a hard copy of the sequence of events information which is retained in accordance with station Administrative procedures.
- 6.
Power sources P-250 - The power source for the plant computer is a three phase static inverter which is fed from one of the station's Class lE batteries.
SER -
The power source for the SER is 125 VDC from one of the station's Class lE batteries.
- 2. Capability of assessing time history of analog variables
- 1. Description of equipment Each unit at Surry has two means of assessing the time history of analog variables. First is the Post Trip Review program of the plant computer.
The second is the numerous strip chart recorders located on the control panels in the control room.
- 2.
Parameters monitored, sampling rate, and the basis P-250 -
The post trip review program monitors 46 primary and secondary system parameters.
The parameters include pressure, temperature, level, flow and power levels.
Redundant channels are monitored to allow comparison and analysis of individual channel performance.
Parameters are sampled every 10 seconds.
In addition, selected primary and secondary parameters are sampled every 2 seconds.
The parameters were selected such that the analog parameter that initiate* a reactor trip, turbine trip or safety injection are monitored.
Strip Charts - Strip charts located in the control room monitor the principle primary and secondary system parameters.
These include primary system pressure, pressurizer level, temperature,
- power, secondary system level, flow and power.
In addition, selected auxiliary system parameters are monitored, e.g. tank levels.
The parameters were selected based upon the need to monitor the trend of the parameter. All parameters are monitored continuously.
e 1.2-6 3*.
Duration of time history P-250 - The time history of parameters is 2 minutes before the trip and 3 minutes after the trip.
Strip Charts - The parameters are monitored continuously before and after the trip.
- 4.
Forinat for displaying data
- 5.
P-250 -
Each parameter is identified by a computer point and the numerical value of each parameter is printed at 10 second intervals.
Selected parameters are printed at 2 second intervals.
Strip Charts - The format for the strip charts is a X-4 plot of the value of the parameter versus the time.
The scale corresponds to the scale used on the associated panel mounted meter.
Capability for retention of data P-2SO - The post trip review program prints the data collected by the program on the trend typewriter.
Once all the collected data is printed, the program resets itself to allow the collection of data for any subsequent reactor trip.
The hard copy is retained in accordance with station administrative procedures.
Strip Charts -
The strip charts are retained in accordance with station administrative procedures.
- 6.
Power sources P250 -
The power source for. the plant computer is a three phase static inverter which is fed from one of the station's Class IE batteries.
Strip Charts - The strip chart recorders are powered from either the vital or semi-vital instrument bus.
Both the vital and semi-vital instrument bus are powered from a Class lE power source.
- 3.
Other data and information
- 4.
The P-250 plant computer has additional monitoring programs such as the alarm scan and analog trend programs.
The fire detection system has a dedicated computer to monitor the heat and smoke detectors located throughout the plant.
The status of the fire detection system is provided in graphic and printed form.
Planned changes The current data and information collection system is adequate for the evaluation of unplanned reactor trips. However, with the installation of the data collection and processing system associated with the upgrading of the Emergency Response Facility pursuant to NUREG-0737 an enhancement of the data collection capabilities will be realized.
e 2.1 EQUIPMENT CLASSIFICATION AND VENDOR INTERFACE (REACTOR TRIP SYSTEM COMPONENTS)
Licensees and applicants shall confirm that all components whose function-ing is required to trip the reactor are identified as safety-related on documents, procedures, and information handling systems used in the plant to control safety-related activities, including maintenance, work orders, and parts replacement. In addition, for these components, licensees and applicants shall establish, implement and maintain a continuing program to ensure that vendor information is complete, current and controlled throughout the life of the plant, and appropriately referenced or incorporated in plant instructions and procedures.
Vendors of these components should be contacted and an inter-face established.
Where vendors can not be identified, have gone out of business, or will not supply the information, the licensee or applicant shall assure that sufficient attention is paid to equipment maintenance, replacement, and repair, to compensate for the lack of vendor backup, to assure reactor trip system reliability. The vendor interface program shall include periodic colTVTlunication with vendors to assure that all applicable information has been received.
The program should use a system of positive feedback with vendors for mailings containing technical information. This could *be accomplished by licensee acknowledgement for receipt of technical mailings. The program shall also define the interface and division of responsibilities among the licensees and the nuclear and nonnuclear divisions of their vendors that provide service on reactor trip system components to assure that requisite control of and applicable instructions for maintenance work are provided.
Applicability This action applies to all licensees and OL applicants.
Type of Review For licensees, a post-implementation review will be conducted.
NR~ will perform these licensing reviews and issue a Safety Evaluation.
For OL applicants, the NRR review will be performed consistent with the licensing schedule.
Documentation Required Licensees and applicants should submit*a statement confirming that they have reviewed the Reactor Trip System components and conform to the position regard;ng equipment classification. In addition, a sunnary report des~ribing the ~endor interface program shall be submitted for staff review.
Vendor lists of technical information, and the techncial information itself, shall be available for inspection at each reactor site.
Technical Specification Changes Required No changes to Technical Specifications are required.
Reference Section 2.3.1 of NUREG-1000.
Section 2.3.2 of NUREG-1000.
2.1-1 ITEM 2.1.A EQUIPMENT CLASSIFICATION AND VENDOR INTERFACE (REACTOR TRIP SYSTEM COMPONENTS)
The controlling documents for equipment classification are Station Administra-tive Procedures (i.e., ADM-73, Surry; ADM-2.1, North Anna.)
These procedures contain listings of structures, systems, and components classified as Category I.
Category I
is Vepco' s terminology for "Safety-related."
These administrative procedures do not provide a detailed listing of each component of the Reactor Protection System.
Subcomponents of safety-related systems are generally treated as safety related.
The administrative procedures at both North Anna and Surry classify the following as safety-related:
- 1.
Reactor Protection
- 2. All components that input to the reactor protection system and the racks
- 3.
Electrical penetrations and terminal boxes Maintenance on the Reactor Protection System is performed using approved written procedures referenced in the controlling Maintenance Report.
Maintenance Reports issued for the Reactor Protection System are visibly stamped as "Safety-related."
Replacement parts are documented on the Maintenance Report by part number/stock number and on the part by the use of an identification tag or sticker as required by the NPSQAM.
The Vepco Purchasing Requisition and stock card reflect the classification of the item, storage level, specifications, documentation required, and other Quality Assurance requirements.
For a more detailed description of the Equipment Classification Program, see response to Section 2.2.
While maintenance actions in the Reactor Protection System are treated as safety-related at both stations, the controlling administrative procedures are too broad in content to provide adequate assurance that all components in the Reactor Protection System are identified as safety-'related.
As the actions identified in 2.2.1 are implemented, the administrative procedures will be updated to include identification of safety-related components in all safety-related systems.
ITEM 2.1.B VENDOR INTERFACE (REACTOR TRIP SYSTEM COMPONENTS)
The proposed Vendor Interface Program described in our response to Item 2.2.2, Vendor Interface (All Safety-Related System), includes Reactor Trip System components, Collection, review, and appropriate corrective actions regarding Reactor Trip System information will be given *highest priority.
An interim vendor interface with the Reactor Trip System vendor has been established and is controlled by approved procedures.
This includes a positive feedback
~
system for information pertinent to RTS components.
e e
2.2 EQUIPMENT CLASSIFICATION AND VENDOR INTERFACE (PROGRAMS FOR ALL SAFETY-RELATED COMPONENTS)
Position Licensees and applicants shall submit, for staff review, a description of their programs for safety-related* equipment classification and vendor interface as described below:
- 1. For equipme,t classification, licensees and applicants shall describe their program for ensuring that all components of safety-related systems necessary for accomplishing required safety functions are identified as ~afety-related on documents, procedures, and information handling systems used in the plant to control safety-related activities, including maintenance, work orders and replacement parts. This description shall include:
- 1. The criteria for identifying components as safety-related within systems currently classified as safety-related.
This shall not be interpreted to require changes in safety classl'Tication at the systems level.
- 2. A description of the information handling system used to identify safety-related components (e.g., computerized equipment list) and the methods used for its development and validation.
- 3. A description of the process by which station personnel use this information handling system to determine that an activity is safety-related and what procedures for main-tenance, surveillance, parts replacement and other activities defined in the introduction to 10 CFR 50, Appendix B, apply to safety-related components.
- 4. A description of the management controls utilized to verify that the procedures for preparatfon, v_alidation and routine utilization of the information handling system have been followed.
- 5. A demonstration that appropriate design verification and qualification testing is specified for procurement of safety-related compon~nts. The specifications shall include quali-fication testing for expected safety service conditions and provide support for the licensees' receipt of testing documen-tation to support the limits of life rec~rmended by the supplier.
- sifety-retated structures, systems, and components are those that are relied upon to remain functional during and following design basis events to ensure:
(1) the integrity of the reactor coolant boundary. (2) the capabil;ty to shut down the reactor and maintain it in a safe shutdown condition, and (3) the capability to prevent or mitigate the consequences of accidents that could result in potential offs1te exposures comparable to the guidelines of 10 CFR Part 100.
- 6. Licensees and applicants need only to submit for staff review the equipnent classification program for safety-related components. Although not required to be submitted for staff review, your equipnent classification program should also include the broader class of structures, systems,** and components important to safety required by GDC-1 (defined 1n 10 CFR Part 50, Appendix A, *&eneral Design Criteria, Introduction").
- 2. For vendor interface, licensees and applicants shall establish, implement and maintain a continuing program to ensure that vendor 1nfonnation for safety-related components is complete, current and controlled throughout the life of their plants, and appropriately referenced or incorporated in plant instructions and procedures.
Vendors of safety-related equipnent should be contacted and an interface established. Where vendors cannot be identified, have gone out of bus;ness, or will not supply infonnation, the licensee or applicant shall assure that sufficient attention is paid to equipnent maintenance, replacement, and repair, to compensate for the lack of vendor backup, to assure reliability commensurate with its safety function (GDC-1).
The program shall be closely coupled with action 2.2.1 above (equ;pnent
- qualification). The program shall include periodic tonlllunication with vendors to assure that all applicable infonnation has been received.
The program should use a system of positive feedback with vendors for mailings containing technical infonnation. This could be accomplished by licensee acknowledgment for receipt of technical mailings. It shall also define the interface and division of responsibilities among the licensee and the nuclear and nonnuclear divisions of their vendors that provide service on safety-related equipnent to assure that requisite control of and applicable instructions for maintenance work on safety-related equipnent are provided.
Applicability This action applies to all licensees and OL applicants.
Type of Review For licensees, 1 post-implementation review will be conducted.
NRR will perfonn the review and fssue a Safety Evaluation.
For OL applicants, the NRR review will be perfonned consistent with the licensing schedule.
Docunentation Required Licensees a~d app1icants should submit a report that describes the equipnent classification 1nd vendor interface programs outlined the position above.
e e
Technical Specification Changes Kequ1red No changes to the Technical Specifications are required.
References Section 2.3.1 of NUREG-1000.
Sect;on 2.3.2 of NUREG-1000.
- 1.
2.2-1 ITEM 2.2.1 -
EQUIPMENT CLASSIFICATION (ALL SAFETY-RELATED EQUIPMENT)
The existing program and procedures associated with equipment classifica-tion have been reviewed in accordance with the referenced requirements in
- 2. 2.1 of Generic Letter 83-28.
As a result of this review certain improvements have been noted as necessary.
Consequently, procedure modifications or clarifications have been implemented to ensure written instructions exist for classifying equipment and verifying classification of equipment when required.
As with any document of this type it is expected that ongoing changes and refinements will be made to provide a more useful tool to the users.
The recent improvements include:
a.) Clarification of definition of "safety-related' b.) Provision of review process for determing classifications c.) Provision of review process required to remove items from a safety-related classification d.) Clarification of "frequently used" terms related to classification i.e. RCS Boundary, safe-shutdown, design basis events, etc.
Improvements to the governing procedures have already been made.
Other improvements will be beneficial in providing more useful information to the user.
Emphasis will be placed on developing a more detailed breakdown,of the existing safety related structures,
- systems, and components listing.
The criteria stated in the improved procedures will be used to provide the more detailed breakdown of equipment.
Reviews will be conducted to ensure that the criteria have been applied consistently to structures, systems, and components.
This expanded listing will also provide the basis for vendor interfaces are referenced in GL 83-28 section 2. 2. 2, and maintenance, design, and procurement activities. It is planned that the refinement of the existing equipment list will be accomplished by July 1, 1984.
Safety Related Criteria The criteria utilized for classification of safety-related systems are consistent with the definition and requirements stated in 10CFRlOO, Appendix A, paragraph III.E. et.al. as referenced in the NRC position statement for item 2.2.
The criteria are defined as follows:
"Safety-related structures, systems, and components are those that are relied upon to remain functional during and following design basis events to ensure:
(1) the integrity of the reactor coolant boundary, (2) the capability to shut down the reactor and maintain it in a safe shutdown condition, and (3)
'the capability to prevent or mitigate the consequences of accidents that could result in potential offsite exposures comparable to the guide lines of 10 CFR Part 100."
These requirements stem primarily from criteria associated with seismic structures, systems, and components.
Initially, these criteria were used by the architect/engineer to determine various design requirements to be applied to different structures,
- systems, and components.
This ultimately resulted in a listing of Class 1 structures, systems, and
- 2.
2.2-2 components in each station's FSAR (Section 15.2-Surry, Section 3.2-North Anna).
It should be noted that FSAR terminology in these sections equates "Class l"
and "safety-related" and the terms were used interchangeably.
Future reference will be to "safety-related".
Having established the safety-related structures, systems, and components listing, later requirements dictated the segregation of all plant structures,
- systems, and components into general categories.
This occurred during the development of the Nuclear Power Station Quality Assurance Manual (NPSQAM).
This segregation into quality categories included safety-related structures,
- systems, and components.
This information is contained in the NPSQAM Appendix A.
This information is used primarily to determine governing general design requirements and is used in various procurement activities.
The implementing document developed from the requirements above and used by each station to classify structures, systems, and components is a station administrative procedure (ADM-73, Surry; ADM-2.1, North Anna).
Contained in this procedure is a listing of structures, systems, and components which are classified as safety-related (Category I-Vepco terminology).
The listing also contains structures,
- systems, and components that are handled as safety-related due to recent regulatory, code or utility imposed requirements for example, Electrical Equipment Qualification, Appendix R-Fire Protection, and Inservice Inspection.
Information Handling System As stated above, the information handling system consists of a station administrative procedure which contains a listing of safety-related structures,
- systems, and components.
This procedure is used when determination of component or system classification is required when performing modifications or maintenance.
The listing contained in the procedure does not provide a detailed listing of every component of safety-related systems but provides a general breakdown by system and major component parts.
Subcomponents of safety-related systems are considered to be safety-related.
The list has *evolved over a period of time incorporating original FSAR requirements and later requirements as deemed necessary and appropriate.
Contained in the procedure are the established criteria that are used in determining the safety classifica-tion of a structure, system, or component.
The development of the list was primarily a joint effort between engineer-ing and quality assurance personnel.
The procedure containing the list is a controlled station document requiring review and approval by the Station Nuclear Safety and Operating Committee (SNSOC).
Also contained in the procedure are instructions for review of classifications where specific structures, systems, or components are not listed.
These requests are forwarded to the station engineering staff for resolution.
Instructions are also provided regarding appropriate reviews. to be conducted to remove or add items to the list.
2.2-3
- 3.
Classification Decision Station administrative procedures provide general guidelines and requirements for conduct of business at the plant site.
Departmental procedures provide specific instructions on conduct of operations and work activities.
The administrative procedures referenced previously (ADM-73, and ADM-2.1) deal strictly with classification of structures, systems and components and do not specifically deal with the conduct of work related to these structures, systems, and components.
Other work or task related station procedures reference directly to ADM-73 and ADM-2.1 as appropriate.
There are various work activities that will require classification of a system or component.
Examples of major activities are as follows:
- a.
Maintenance Work which is initiated and implemented by Maintenance Request (MR).
Personnel would refer to equipment classification procedure as required to determine if certain maintenance activities are safety-related.
Additional procedures may be written or existing procedures may be utilized as necessary to perform maintenance activities.
Instructions are provided as required to designate any additional special controls necessary for safety-related activities.
- b.
Design Changes -
Modifications to the station are implemented utilizing Design Change Packages (DCP).
During the initial
- review process in the development of a DCP, classification of the affected systems or components are required.
This is necessary to determine the level of control to be applied during the design and implementation phases of the DCP.
The referenced administrative procedures provide the basis for ~etermining these classifications.
- c.
Engineering Work Requests -
Requests for support to the station engineering staff are used for evaluation of possible Design Changes, Setpoint Changes, drawing changes,* special maintenance work, or other evaluation or study work which may require station engineering support.
These activities are governed by procedures which dictate the disposition of these requests.
Review processes require
- the determination of the classifica-tion of the evaluation work and any possible ensuing maintenance or other work activity.
- d.
Setpoint Changes -
The mechanism for initiating changes to setpoints in nuclear plant instrumention and other setpoints listed in various setpoint documents is the Setpoint Change Request.
Various setpoint changes are safety-related.
Again the system classification listing would be used as a reference tool in determining the classification of the change.
2.2-4
- e.
Special Tests -
These tests are normally performed to obtain data to evaluate possible modifications, perform "one-time" tests to provide baseline data for evaluation purposes or fulfill special testing requirements to meet regulatory require-ments.
Other routine testing (i.e.
Periodic Testing for surveillance requirements, Design Change Testing, Inservice Testing, et.al.)
are carried out using other established procedures.
- Normally, a written special test procedure is prepared for all special testing.
The classification of the procedure (i.e.
safety-related, non-safety-related) is not specifically required although reference may be made to the classification procedure to determine if special controls may be required in conduct of the test.
- 4.
Classification Verification As stated previously, the controlling document for determining structures systems, and component classification is a station administrative proce-dure.
This procedure is prepared and reviewed by station engineering personnel and approved by the Station Nuclear Safety and Operating Committee (SNSOC).
During routine use of the classification procedure during maintenance, plant design changes, testing and other processes or activities verification of proper classification is normally made at the supervisor level.
Interpretations in classifications may be referred higher or to station engineering as required.
Changes in the approved classification listing must be approved by the SNSOC.
Periodic Quality Assurance audits and _reviews of maintenance and work activities are conducted.
A key element in the audit process is verify-ing appropriate controls etc. have been established and followed for safety-related work.
Verification of proper equipment classification is an important part in determining whether proper controls have been applied.
- 5.
Procurement The guideline and policy for procurement of equipment for use at each station is contained in Section 4 and Section 7 of the Nuclear Power Station Quality Assurance Manual (NPSQAM) and related station administra-tive procedures.
Direction is provided regarding review of purchase documents, requirements for standard tests or inspections and supporting Quality Assurance documentation, requirements for review when "commercial grade" materials or components or substitute materials or components are used in lieu of those originally specified.
General guidanc~ is also provided regarding the use of "Engineering Specifications" for new materials or components added during plant design changes.
Normal replacement parts and maintenance items are procured through purchase requisitions which contain the required information referenced in the NPSQAM and station administrative procedures.
The information and detail is included in the purchase document and are normally standard nuclear industry requirements.
Special items may be procured using formal specification documents and the specifications include unique requirements as necessary.
Specification guidelines include such considerations as environmental and testing conditions.
2.2-5 Material and equipment for plant modifications are procured through methods similar to those described above.
The same governing documents apply to this procurement cycle.
The difference is primarily in the area of approval for monetary committments and expenditures.
In the area of plant modifications the use o*f formal specifications is more abundant than for normal maintenance and replacement activity since new systems and components are usually installed.
ITEM 2.2.2 -
VENDOR INTERFACE (ALL SAFETY RELATED EQUIPMENT)
We have reviewed our existing administrative program procedures and have revised or are developing, as necessary, procedures to be fully responsive to the topics addressed in Item 2.2.2.
A comprehensive program will be developed and implemented for vendor interface to ensure that vendor information for safety-related components is complete, current, and controlled throughout the life of our operating facilities.
The program currently being developed includes two phases.
Phase A Control and maintenance of vendors manuals/files, vendor drawings, and a tracking system with positive feedback of corrective actions.
This is predominately an in-house activity and includes:
(1)
Vendors that have supplied equipment or components that are specifically identified as Safety Related as of the date of this letter will be identified by reference in a Safety Related components listin:g.
Vendor identification will be completed by July 31, 198.4.
(2)
Where Safety Related components have been identified but not currently described in a
published vendor
- manual, a
vendor file will be established.
This file will include available drawings, parts lists or other technical information.
This will be completed by December 31, 1984.
(3)
A controlled distribution and tracking system will be expanded to include information currently obtained from vendors and the information that will be received as a result of the activities of Phase B.
The Administrative Procedures presently in place will be revised by March, 1984 to govern
.these activities.
Phase B Participation in a coordinated industry approach to the Vendor Interface program through the efforts of INPO.
The concept of the NUTAC is to ensure the adequate resolution of required actions while attempting to minimize the effect of these additional programs on vendors of equipment who have furnished materials to a nuclear facility.
Vepco will take actions necessary to develop and implement the controls necessary to maintain an effective communication program for vendor interface.
Vepco will continue to participate in the *NUTAC, and based on our continuing review of the NUTAC effort, will revise its program to incorporate those NUTAC items which would result in the optimal Vendor Interface Program.
e 3.1 POST-MAINTENANCE TESTING (REACTOR TRIP SYSTEM COMPONENTS)
Position The following actions are applicable to post-maintenance testing:
- 1. Licensees and applicants shall submit the results of their review of test and maintenance procedures and Technical Specifications to assure that post-maintenance operability testing of safety-related components 1n the reactor trip system 1s required to be conducted and that the testing demonstrates that the equipnent is capable of perfonning its safety functions before being returned to service.
- 2.
Licensees and applicants shall submit the results of their check of vendor and engineering reconrnendations to ensure that any appropriate test guidance is included in the test and maintenance procedures or the Technical Specifications, where required.
- 3. Licensees and applicants shall identify, if applicable, any post-maintenance test requirements in existing Technical Specifications which can be demonstrated to degrade rather than enhance safety.
Appropriate changes to these test requirements, with supporting justification, shall be submitted for staff approval. (Note that action 4.5 discusses on-line system functional testing.)
Applicability This action applies to all licensees and OL applicants.
Type of Review For licensees, a post-implementation review will be conducted for actions 3.1.1 and 3.1.2 above.
The Regions will perform these licensing reviews and issue Safety Evaluations. Proposed Technical Specification changes resulting from action 3.1.3 above will receive a pre-implementation review by NRR.
For OL applicants, the review will be perfonned consistent with the licensing schedule.
Ooc1111entation Required Licensees and applicants should submit a statement confirming that actions 3.1.1 and 3.1.Z of the above position have been implemented.
Technical Specification Changes Required Changes to Technical Specifications 0 as a result of act\\on 3.1.3. are to be detenn1ned by the licensee or applicant 1nd submitted for staff approval.
as necessary.
Reference Section 2.3.4 of NUREG-1000.
3.1-1 3.1 POST-MAINTENANCE TESTING (REACTOR TRIP SYSTEM COMPONENTS)
- 1.
Post-maintenance operability testing of safety-related components in the reactor trip system is required to be performed by various station administrative procedures and/or are included in the controlling maintenance procedure.
This testing ensures that the equipment is operational prior to being returned to service.
Although the Technical Specifications do not specifically require post-maintenance testing of any system, preventive and corrective maintenance procedures do require post-maintenance operability testing.
Additional-ly, maintenance procedures contain acceptance criteria to ensure the task has been completed correctly.
- 2.
Station administrative procedures at both North Anna and Surry require procedures to be reviewed periodically to ensure that the procedures are technically adequate using the current available information.
Cognizant supervisors are required to review new or revised vendor correspondence to determine if changes to station procedures are required.
There is no formal interface program to assure vendor information is included in applicable procedures.
Maintenance and testing procedures for the Reactor Protection System contain the latest vendor information received by the stations.
These procedures will be updated periodically to include the latest vendor information as the actions in 2.2.2 (Vendor Interface) are implemented.
- 3.
The maintenance program for Reactor Trip System components has been reviewed to assure that appropriate test guidance and recommendations are included in maintenance testing.
As a result of the Salem events, we are evaluating the need to expand both the scope and depth of our maintenance procedures to include additional aspects of breaker maintenance which would further augment our existing maintenance program.
Although we cannot currently identify specific test requirements which we can demonstrate to degrade rather than enhance safety, we are concerned that the overall RTS component test frequency is excessive.
This is based on several factors.
Our.maintenance program provides adequate assurance that RTS components are capable of performing their safety function before returning them to service.
Testing beyond that necessary to assure this reliability can adversely contribute to reliability by providing additional opportunities for error, excessive wear, and unnecessary challenges to protection systems.
In addition, human factors concerns arise in that maintenance personnel may perceive the intent of to*o frequent maintenance testing to be "pass the test",
rather than an opportunity to exercise their skills in a thorough and workmanlike manner.
Excessive testing can lead to focusing on only checklist or procedural items (even though the procedures are thorough and detailed), and gives insufficient credit for personnel qualifications, experience, and training.
3.1-2 However, we believe that RTS component maintenance test frequency repre-sents only one aspect of a broader concern in the area of reliability.
This concern is further addressed in our response to Item 4.5
e 3.2 POST-MAINTENANCE TESTING (ALL OTHER SAFETY-RELATED COMPONENTS)
Position lhe following actions are applicable to post-maintenance testing:
1 *. Licensees and applicants shall submit I report doc1111enting the extending of test and maintenance procedures and Technical Specifications review to assure that post-maintenance operability testing of 111 safety-related equipnent is required to be conducted and that the testing demonstrates that the equipment is capable of perfonning its safety functions before being returned to service.
- 2. Licensees and applicants shall submit the results of their check of vendor and engineering recorrrnendations to ensure that any appropriate test guidance is included in the test and maintenance procedures or the Technical Specifications where required.
- 3. Licensees and applicants shall identify, 1f applicable, any post-maintenance test requirements in existing Technical Specifications which are perceived to degrade rather than enhance safety. Appropriate changes to these test requirements. with supporting justification.
shall be submitted for staff approval.
Applicability This action appli~s to all licensees and OL applicants.
Type of Review For licens*ees, a post-implementation review will be conducted for actions 3.2.1 and 3.2.2 above.
The Regions will perform these licensing reviews and issue Safety Evaluations. Proposed Technical Specification changes resulting from action 3.2.3 above will receive a pre-implementation review by N~R.
For OL applicants, the review will be perfonned consistent with the licensing schedule.
Documentation Required Licensees and applicants should submit a statement confirming that actions 3.2.1 and 3.2.2 of the above position have been implemented.
Technical Specification Changes Required Changes to Technical Specifications, as a result of action 3.2.3, are to be determined by the licensee or applicant for staff approval, as necessary.
Reference Section 2.3.4 of NUREG-1000.
3.2-1 3.2 POST-MAINTENANCE TESTING (ALL OTHER SAFETY-RELATED COMPONENTS)
- 1. and 2.
The response to this position is the same as the response to 3.1, but applies to all other safety-related components in addition to reactor trip system components.
- 3.
Although we cannot currently specify test requirements which we can demonstrate to degrade rather than enhance safety, we are concerned that overall test frequency (of which post-maintenance testing contributes a significant fraction) is excessive.
Our specific concerns pertaining to RTS components has already been addressed in our response to Item 3.1.3.
Other concerns regarding excessive test frequencies of all safety-related components involve: turbine valve freedom testing, LHSI, and diesel generators.
We are continuing to pursue these and other matters both individually and in conjunction with the W Owners Group activities which are described in our response to Items 4.5.3.
e 4.1 REACTOR TRIP SYSTEM RELIABILITY (VENDOR-RELATED MODIFICATIONS)
Posftfon All vendor-recommended reactor trip breaker 1110difications shall be reviewed to verify that either: (1) each modification has, in fact, been implemented; or (2) a written evaluation of the technical reasons for not implementing a modification exists.
For example, the modifications recommended by Westinghouse in NCD-Elec-18 for the DB-50 breakers and a March 31, 1983, letter for the DS-416 breakers shall be implemented or a justification for not implementing shall be made available. Modifications not previously aade shall be incorporated or a written evaluation shall be provided.
AppHcabflfty This action applies to a11 PWR licensees and OL applicants.
Type of Review For licensees, a post-implementation review will be conducted. The Regions wfll perfonn these licensing reviews and issue Safety Evaluations.
For OL applicants, the NRR review will be perfonned consistent with the licensing schedule.
Documentation Required Licensees and applicants should submit a statement confinning that this action has been implemented.
Technical Specifications Required No changes to Technical Specifications are required.
Reference Section 3 of NUREG-1000.
4.1-1 4.1 REACTOR TRIP SYSTEM RELIABILITY (VENDOR-RELATED MODIFICATIONS)
All reactor trip breaker modifications recommended by Westinghouse and received by each Nuclear Power facility have been implemented
- e e
4.2 REACTOR TRIP SYSTEM RELIABILITY (PREVENTATIVE MAINTENANCE AND SURVEILLANCE PROGRAM FOR REACTOR TRIP BREAKERS)
Position Licensees and applicantf shall describe their.preventative aaintenance and surveillance program to ensure reliable reactor trip breaker operation.
The progr~ shall include the following:
- 1. A planned progran of periodic maintenance, including lubrication, housekeeping, and other items recommended by the equipment supplier.
- 2. Trending of parameters affecting operation and measured during testing to forecast degradation of operability.
- 3. Life testing of the breakers (including the trip attachnents) on an acceptable sample size.
- 4. Periodic r,epl~cement of breakers or components consistent with demonstrated life cycleso Applicability This action applies to all PWR licensees and OL applicants.
Type of Review Actions 4.2.1 and 4.2.2 will receive a post~implementation review by NRR. A pre-implementation review will be perfonned by NRR for actions 4.2.3 and 4.2.4 (the circuit breaker life testing program and the com-ponent testing/replacement requirements based upon the life testing results). A Safety Evaluation will be issued
- For OL applicants, NRR will p.erform the reviews for actions 4.2.1 and 4.2.2 on a schedule consistent with the licensing schedule.
NRR will perfonn a pre-implementation review for actions 4.2.3 and 4.2.4 (the circuit breaker life testing program and the component testfog/replace-ment requirements based upon the life testing results). Safety Evaluations will be issued.
Doclltlentation Required Licensees and applicants should submit descriptions of their progr1111s to ensure compliance with thfs action.
Technical Specification Changes Required No changes to Technical Specifications are required.
Reference Section 3 of NUREG-1000.
4.2-1 ITEM 4.2 -
REACTOR TRIP SYSTEM RELIABILITY (PREVENTIVE MAINTENANCE AND SURVEILLANCE PROGRAM FOR REACTOR TRIP BREAKERS
- 1.
P.reventive Maintenance
- 2.
Preventive maintenance procedures for the reactor trip breakers are in place at both stations.
These procedures are presently performed during each refueling outage.
In addition, monthly testing of the reactor protection system exercises each breaker through a manual and an electric trip signal.
The Westinghouse Owners Group Reactor Trip SwitchGear draft improvement recommendations has been reviewed by Vepco.
A study was conducted to compare the draft guidelines to existing Vepco programs.
All but a few of the Draft recommendations were already incorporated in Vepco's existing procedures.
The Westinghouse Owners Group's final recommendation is expected to be distributed by the first of the year (1984).
At this time another review will be conducted by Vepco to consider additional recommendations for enhancement of our existing programs.
We expect to complete review of the Westinghouse Owners Group final recommendations by February 1984 and incorporate accepted recommendations into Vepco's existing procedures by April, 1984.
Trending A time response measuring device for the Westinghouse DB-50 Reactor Trip Breaker will be evaluated during 1984 for possible application.
The time response device will provide voltage time profiles of the trips coil circuits and a time graph of breaker mechanical condition for trend comparisons.
If this device proves to be acceptable, consideration will be given to incorporating its use into the PM program.
- 3.
Life Testing
- 4.
Life cycle testing of the shunt trip attachment and the undervoltage trip attachment of the reactor trip switchgear is being conducted by Westing-house for the Westinghouse Owners Group.
This program is aimed toward establishing the service life of these devices, and substantiating periodic test requirements with proper maintenance.
The results of this program will be factored into maintenance, replacement and qualification programs.
The test program is scheduled for completion by June 30, 1984.
Periodic Replacement Periodic replacement will depend on the testing being conducted by Westinghouse for the Westinghouse Owners Group.
This test program is scheduled for completion by June 30, 1984.
4.3 REACTOR TRIP SYSTEM RELIABILITY (AUTOMATIC ACTUATION OF SHUNT TRIP ATTACHMENT FOR WESTINGHOUSE AND B&W PLANTS)
Position Westinghouse and B&W reactors shall be 1110d1fied by providing automatic reactor trip system actuation of the breaker shunt trip attachments.
The shunt trip attachment shall be considered safety related (Class IE).
Applicability This action applies to all Westinghouse and B&W licensees and DL applicants.
Type of Review For licensees, a pre-implementation review shall be perfonned for the design modifications by NRR.
A Safety Evaluation will be issued.
For OL applicants, the NRR review will be perfonned consistent with the licensing schedule.
Technical Specification changes, 1f required, will be reviewed prior to implementation.
Documentation Required Licensees and applicants should submit a report describing the modifications.
Technical Specification Changes Required Licensees are to submit any needed Technical Specification change requests prior to declaring the modified system operable.
Reference Section 3 of NUREG-1000.
e 4.3.-1 4.3 PLANT SPECIFIC INFORMATION AS REQUIRED AND IDENTIFIED IN THE NRC SER ON WOG'S GENERIC DESIGN FOR THE AUTOMATIC SHUNT TRIP MODIFICATION NORTH ANNA AND SURRY Vepco plans to implement the Westinghouse Owners Group generic automatic actuation of shunt trip modification, which has been submitted to, and reviewed by, the NRC.
The generic design has been accepted by the NRC staff.
A conceptual design for this modification has been completed.
The preliminary schedule calls for the modification to be ready for installation in the fall of 1984.
If this schedule holds, Surry Unit 2 will be modified during the fall 1984 maintenance outage and Unit 1 will be modified during the spring 1985 maintenance outage.
For North Anna, it is expected that the modification can be installed during the Unit 2 refueling outage currently scheduled for the fall of 1984 and during the next outage of sufficient duration on Unit 1 after the fall of 1984.
The plant specific information, required by the NRC SER is provided below:
- 1.
- 2.
The electrical schematic showing the proposed automatic shunt trip modification for Surry Units 1 and 2 Reactor Trip Breakers as required by NRC, is enclosed (Sketch A).
The electrical schematics showing the proposed automatic shunt trip modifications for North Anna Units 1 and 2 Reactor Trip Breaker, as required by NRC, are enclosed (Elementary Drawing Nos. 11715-ESK-6X, 11715-ESK-6V, 12050-ESK-6X, and 12050-ESK-6V).
Electrical Schematics for Reactor Trip Bypass Breakers, as required by
- NRC, are also enclosed.
(Elementary Drawing Nos.
1 l 715-ESK-6W, 11715-ESK-6Y, 12050-ESK-6W, and 12050-ESK-6Y).
The power supplies for the shunt trip circuitry meet Class lE require-ments.
- The shunt trip coils for Surry Unit 1 Reactor Trip Breaker (52/RTA) and Bypass Breaker (52/BYB) are powered from a Class IE 125VDC Panel 1-1, circuit 13 (Train A).
The shunt trip coils for Reactor Trip Breaker (52/RTB) and Bypass Breaker (52/BYA) are powered from another Class lE 125VDC Panel 1-2, circuit 11 (Train B).
The Reactor Trip Breakers and Bypass Breakers for Surry Unit 2 are similarly powered from Class 1E 125VDC Panels 2-1, circuit 13 (Train A); and 2-2, circuit 11 (Train B).
Since the Class lE circuitry provided to the shunt trip is separated from non-Class lE circuitry per criteria in effect at the licensing time, and as further addressed
- in the FSAR, credible faults within non-Class lE circuitry will not degrade the shunt trip function.
The shunt trip coils for North Anna Unit 1 Reactor Trip Breaker (52/RTA) and Bypass Breaker (52/BYB) are powered from a Class IE 125VDC Panel IA, circuit 10 (Train A).
The shunt trip coils for Reactor Trip Breaker (52/RTB) and Bypass Breaker (52/BYA) are powered from another Class lE 125VDC Panel lB, circuit 10 (Train B).
The Reactor Trip Breakers and Bypass Breakers for North Anna Unit 2 are similarly powered from Class IE 125VDC Panels 2A, circuit 10 (Train A); and 2B, circuit 10 (Train B).
Since the Class IE circuitry provided to the shunt trip is separated from non-Class IE circuitry per criteria in effect at the licensing time, and as further addressed in the FSAR, credible faults within non-Class IE circuitry will not degrade the shunt trip function.
4.3-2 There are red and green status lights for breaker operation provided on the Main Control Board for North Anna (and at the test racks for Surry).
These lights are powered from the same fused 125\\TDC supply used for closing and shunt tripping the circuit breakers.
The green light being lit indicates that the breaker is open and power is available for closing and tripping the breaker.
The red light indicates that the breaker is closed.
Red light also indicates that power is available to the shunt trip device and that there is continuity in the shunt trip coil circuitry, since the red light is connected in series with the shunt trip coil and an "a" auxiliary breaker contact.
This provides an indication that the shunt trip coil has power available to it and is ready to perform its function when required.
The power supply for closing and shunt tripping the circuit breakers for Surry is 125V DC and is derived from the station batteries.
Battery low voltage condition is alarmed in the control room.
The added shunt trip circuitry will be powered from the reactor protection logic voltage supply.
Components in the added shunt trip circuitry have been selected based on their ability to perform their intended funtion up to a voltage as high as approximately 115 percent of nominal voltage.
At Surry the reactor protection logic voltage supply is 125VDC which is derived from the 125VDC station batteries.
Batteries are charged from Static Battery Chargers (2 per 125VDC bus).
Battery voltage is indicated to the operator on the main control board and continuously recorded on recorders located in the emergency switchgear room.
Loss of ac or low charging current is alarmed in the control room.
Battery ground indicators are located in the control room.
At North Anna the reactor protection logic voltage supply is 48VDC which is derived from Westinghouse Solid-State Protection System.
The Solid-State Protection System is provided with an overvoltage protection set at 115 percent of nominal voltage (48VDC).
Any circuit malfunctions resulting in an overvoltage condition will result in a fail-safe consequence of load removal, including the undervoltage (UV) coil and the parallel shunt trip actuation relay, which -will trip the breaker.
The shunt trip coils in the reactor trip breakers are powered from 125 VDC via the station batteries.
Normally the shunt trip coils are in a de-energized condition.
When the trip breakers are closed, the red lamp current (approximately 50 ma) flows through the trip coil to monitor the*
circuit continuity.
This current is not large enough to actuate the trip coil armature.
The reactor trip signal applies a nominal voltage of 125VDC to each shunt trip coil in the redundant trains.
As the breaker trips, its auxiliary switch opens to de-energize the shunt trip coil.
Since the 125VDC voltage is supplied from the battery system, it may temporarily rise to the battery equalizing voltage (not exceeding 115 percent of nominal voltage).
The shunt trip coil will cause the breaker to open, despite an overvoltage, since it is energized to operate.
- 3.
It has been verified that the relay contacts are adequately sized for the shunt trip function and relays are within the capacity of their associated power supplies.
The added relays for the automatic shunt trip function are the Potter and Brumfield MDR series relays (P/N 2383A38, 125VDC for Surry; and P/N 955655, 48VDC for North Anna).
4.3-3
- 4.
The details of the testing to independently confirm the operability of the undervoltage trip and shunt trip will be based on the procedure submitted by the WOG to the NRC in letter No. OG-101, dated June 14, 1983.
- 5.
It has been verified that the added circuitry used to implement the automatic shunt trip function is Class IE and that procurement, installa-tion, operation, testing, and maintenance of this circuitry will be in accordance with the Vepco Nuclear Power Station Quality Assurance Manual which satisfies the quality assurance requirements of Appendix B to 10 CFR Part 50.
- 6.
The shunt trip attachments and associated circuitry will be seismically qualified.
The WOG is working with Westinghouse to obtain seismic qualification of the shunt trip attachments.
If qualification tests show that any of the added components do not perform their intended function during or after a postulated seismic event, these components will be replaced at the next scheduled outage of sufficient duration, subsequent to receipt of the replacement components.
- 7.
It has been verified that the plant specific environmental conditions defined in the WOG Generic Design Package, Table 1 envelope Surry Units 1 and 2 and North Anna Units 1 and 2 environmental conditions in the area where components used to accomplish the automatic shunt trip function are located.
- 8.
At Surry, physical separation is provided between the circuits used to manually initiate the shunt trip attachments of the redundant reactor trip breakers by routing the field cabling from the Main Control Board and Reactor Protection logic to redundant Train A and Train B Reactor Trip Switchgear as Train A and Train B circuits.
Contact-to-contact isolation is provided within Reactor Trip Switchgear and the wiring meets the separation criteria in effect at the time of licensing.
At North Anna, physical separation is provided between the circuits used to manually initiate the shunt trip attachments of the redundant reactor trip breakers by routing the field cabling from the Main Control Board and Reactor Protection logic to redundant Train A and Train B Reactor Trip Switchgear as Train A and Train B circuits.
Main Control Board manual Reactor Trip switches are provided with dual section with fire barriers between redundant train switch decks.
Contact-to-contact isolation is provided within Reactor Trip Switchgear and the wiring meets the separation criteria in effect at the time of licensing.
- 9. All control room manual reactor trip switch contacts and wiring will be tested prior to startup after each refueling outage.
The test procedure used will not involve installing jumpers, lifting leads, or pulling fuses, and will be identical to the WOG procedure.
- 10.
Each bypass breaker is tested to demonstrate its operability during the refueling outage.
Since bypass breakers are closed only during testing of main trip breakers and it is only during this time that the bypass breaker could be called upon to provide a protective action, the
- 11.
- 4. 3-4 probability of complete failure of the reactor trip system due to failure of the bypass breaker during testing is remote and does not appear to warrant testing of the bypass breakers prior to placing them into service for reactor trip breakers testing.
The new test procedures being developed to support operability the undervoltage and shunt trip will include verification of operation of the associated control room or instrument indication.
testing of the proper test rack
- 12.
Westinghouse is in the process of performing the life cycle testing of the reactor trip breakers.
Should life cycle testing show that breaker trip response time degrades with operation, periodic on-line response time testing of the automatic shunt trip feature will be considered.
- 13.
Proposed technical specification changes to require periodic testing of the undervoltage and shunt trip functions and the manual reactor trip switch contacts and wiring will be provided at a later date.
It is to be noted that WOG is working with Westinghouse on this effort.
Section 4.5 of Generic letter 83-28 addresses the automatic shunt trip surveillance as well as undervoltage reactor trip surveillance.
4.4 REACTOR TRIP SYSTEM RELIABILITY (IMPROVEMENTS IN MAINTENANCE AND TEST PROCEDURES FOR B&W PLANTS)
Position licensees and applicants with B&W reactors shall apply safety-related aatntenance ind 'test procedures to the diverse reactor trip feature provided by interrupting power to control rods through the silicon controlled rectifiers.
This action shall not be interpreted to require hardware changes or additional environnental or seismic qualification of these components.
AppHcab11 tty This action applies to B&W licensees and DL applicants only.
Type of Review For licensees, a post-implementation review will be conducted. The Regions will conduct the licensing review and issue a Safety Evaluation.
For OL applicants, the review will be *perfonned consistent with the licensing schedule.
Documentation Required Licensees and applicants should submit a statement confinning that this action has been implemented *.
Technical Specification Changes Required Include the silicon controlled rectifers in the appropriate surveillance and test sections of the Technical Specifications.
Reference Section 3 of NUREG-1000.
4.4-1 Item 4.4 is not applicable to the North Anna or Surry units.
e 4.5 REACTOR TRIP SYSTEM RELIABILITY (SYSTEM FUNCTIONAL TESTING)
Position On-line functiona1 testing of the reactor trip system. including independent testing of the diverse trip features. sha11 be perfonned on 111 plants.
- 1. The diverse trip features to be tested include the breaker undervo1tage and shunt trip features on Westinghouse. B&W (see Action 4.3 above) and CE plants; the circuitry used for power interruption with the silicon controlled rectifiers on B&W plants (see Action 4.4 above); and the scram pilot valve and backup scram valves (including all initiating circuitry) on GE plants.
- 2. Plants not currently designed to pennit periodic on-line testing shall justify not making 1110difications to pennit such testing.
Alternatives to on-line testing proposed by licensees will be considered where special circumstances exist and where the objective of high reliability can be met fn* another ~ay.
- 3. Existing intervals for on-line functional testing required by Technical Specifications shall be reviewed to detennine.that the intervals are consistent with achieving high reactor trip system availability when accounting for considerations such as:
- 1. uncertainties in ccrnponent failure rates
- 2. uncertainty in comnx>n mode failure rates
- 3. reduced redundancy during testing
- 4. operator errors during testing S. component *wear-out* caused by the testing Licensees currently not perfonning periodic on-line testing sha11 detennine appropriate test intervals as described above. Changes to existing required intervals for on-line testing as-well as the 1nterva1s to be detennined.by licensees currently not perfonning on-line testing shall be justified by infonnation on the sensitivity of reactor trip system availability to parameters such as the test intervals. component failure rates. and common mode failure rates.
App1 i cab1 ity This action applies to all licensees and OL applicants.
Type of Review For licensees, 1 post-implementation review will be conducted for action 4.5.1. The Regions wfl 1 perfonn these licensing reviews and issue Safety Evaluations. A~tions 4.5.2 and 4.5.~ wfl 1 require a pre-implemen-tation review by NRR. Results will be tssued tn a Safe~ Evaluation.
- 1.
- 2.
- 3.
4.5-1 4.5 REACTOR TRIP SYSTEM RELIABILITY (SYSTEM FUNCTIONAL TESTING)
At Surry, the diverse trip features are tested independently as part of the Preventive Maintenance Program.
Additionally, response time testing of the reactor trip breakers is being conducted.
At North Anna, procedures are being revised to include independent testing of the diverse trip features.
Not Applicable The Westinghouse Owners Group has been pursuing a program to define a methodology capable of providing justification for establishing meaningful Technical Specification requirements.
This methodology has been applied to the Reactor Protection System and is documented in WCAP-10271, "Evaluation of Surveillance Frequencies and Out of Service Times for the Reactor Protection Instrumentation System".
The WCAP considers common mode failure, operator error, reduced redun-dancy during testing and equipment bypass.
WCAP-10271 also considers correlative effects on plant operation and safety including the manpower expenditure associated with surveillance, the number of inadvertent trips which occur during testing and the distraction from plant monitoring on the part of the control room operator and shift supervisor associated with testing.
Supplement 1 to WCAP-10271, submitted to the NRC in October 1983, is an extension of the evaluation to encompass all Westing-house facilities, and provides a discussion of component wearout caused by testing.
The NRC review of WCAP-10271 to date has resulted in a request for additional information the NRC felt necessary to complete the review.
Information submitted to the NRC in response to that request included an overall evaluation of the impact on plant* safety of RPS surveillance, a discussion of the uncertainty of failure rates and common mode failure and more detail concerning the impact of surveillance intervals on RPS unavailability.
The conclusion of WCAP-10271 and Supplement 1 is that, although RPS unavailab:i,.lity is increased, less frequent testing of RPS components is warranted and will result in an improvement in overall plant safety and equipment reliability.
In addition, representatives of the Westinghouse Owners Group recently met with members of a newly formed NRC Task Force chartered to outline a course of action to identify and rectify current Technical Specification requirements which may be inconsistent with overall plant safety.
In response to the staff's request, the WOG representatives initially identified to the Task Force, and later prioritized, those Technical Specification requirements which it considered to be problem areas, i.e.
contrary to, or not necessitated by safety considerations.
These areas included the surveillance frequency concerns previously discussed in our response to Items 3.1 and 3.2.
Vepco supports and is actively participating in both of the activities described above.
(~*--
l<EAC..TOR PRO"TEC"TION L0611:'.'.:.. (TRAIN A;
~
~LOSE REAC."TOR PROTEl:'.'.:..l"ION L06\\C.. (TR~\\ N A)
~
~-- ---- --
~-- ---
Tglp b,.
_:_ _________________ * --. -- ------*-- --t.,.,.Tl<IP
-BLOC..K AUTO SHUNT "TRIP 0
-[l_
\\J N
b LE6END
- - PJ;20POSED AUTO SHUNT Tg\\p MODS, 0 ""." l:::EAl.TO~ PROTEC.-
TION SY5. 12AC.K 6-MAIN CONTROL BOA...~D
~
~
\\. \\ \\.~~ \\~ ~
._ <::) \\
~~~~~~~~~~-52/~TA~~~~~~~~~~~~~,1,<-~~~52/B~B~~~~~------=----=--=--=--=--=--=--=---z..~~~~~~~~~~--.
(REAC.TOI< Tg1p B~EAKEI< A')
(BYPA:i5 Bl<EAKER B)
VlR.6\\NIA ELE<::.Tl2l_l. 9 *POWEl2 LO, N01E:
SIMPLIFIED Sc.HEMA1'1C. FOi< UNIT I) 'TRAIN A. l<EA~TOR l"RIP BREAKER A (52./RTA') AND BYPA55 BREAKER B (52./BYB') IS SHOWN,.S~HEMA"TIC. FO~ UNIT I I TgA\\N B AND UNIT 2 l"f2A\\N A-~ B 12EA(..ToR Tl<IP BgEA.KEl<S AND BYPASS Bl<EJ-.\\.KEfcS 15 SIMILA!<,
I 5U~r2."( POWE.IZ 5T"l"IOJ',..I SC...HEMA'TIL DIA6RAM EEAL TOI< T~IP BREAKERS SK.ETC.I-\\ A