ML19242B880
| ML19242B880 | |
| Person / Time | |
|---|---|
| Site: | NuScale |
| Issue date: | 08/30/2019 |
| From: | Getachew Tesfaye NRC/NRO/DLSE/LB1 |
| To: | |
| Tesfaye G / 415-8013 | |
| References | |
| Download: ML19242B880 (8) | |
Text
Discussion Topics for the July 24, 2019, Public Teleconference on Technical Specifications
- 1. The response time SRs. (Questions 16-50 and 16-65)
The proposed definitions do not explicitly require measurement of the response time from sensor to actuated component because they leave out the assumed (or allocated) time for MPS digital logic processing. This must be explicitly specified in the SRs somehow because the proposed definitions do not address entire response time. The Bases do not clearly explain how the entire response time is verified. But, just adding more explanation in the Bases is not sufficient, because the essential content of each STS response time definition is to verify the entire RT and ESF actuation response time --- from monitored variable value reaching the sensor Functions nominal setpoint until the end device completes repositioning to its actuated position.
- 2. The exception to meeting the safety-function-demonstration SRs for certain automatic valves, when the valve is in its actuated position. (Question 16-28) 2A. SR 3.1.9.2 Verify each automatic CVCS demineralized water isolation valve that is not locked, sealed, or otherwise secured in the isolated position, actuates to the isolated position on an actual or simulated actuation signal except for valves that are open under administrative controls.
SR 3.1.9.2 This Surveillance demonstrates that each automatic CVCS demineralized water isolation valve actuates to the isolated position on an actual or simulated actuation signal. This Surveillance is not required for automatic valves that are locked, sealed, or otherwise secured in the isolated position controlled under administrative controls. This means the Surveillance does not apply if the valve is open under administrative controls that assure they can be promptly closed. This exception is acceptable because of the slowly changing conditions and responses in the design basis events that the automatic isolation protects.
The automatic actuation logic is tested as part of Engineered Safety Features Actuation System Actuation and Logic testing, and valve performance is monitored as part of the INSERVICE TESTING PROGRAM.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Discuss which DWSI-mitigated design basis events have slowly changing conditions.
The case for the need for this exception is not clear. The staff concludes that the SR exception phrase is not needed because the Note to Required Action B.1 of Subsection 3.1.9 states that Flow path(s) may be unisolated intermittently under administrative controls. And the last sentence of SR 3.0.1 states that 1lPage
Discussion Topics for the July 24, 2019, Public Teleconference on Technical Specifications Surveillances do not have to be performed on inoperable equipment.
2B. SR 3.4.6.2 ---------------------------------NOTE------------------------------
Not required to be met for valves that are closed, or open intermittently under administrative controls.
Verify the isolation ACTUATION RESPONSE TIME of each automatic power operated CVCS valve is within limits.
SR 3.4.6.2 Verifying that the isolation ACTUATION RESPONSE TIME of each automatic power operated CVCS isolation valve is within limits is required to demonstrate OPERABILITY. The isolation time test ensures that the valve will isolate in a time period less than or equal to that assumed in the safety analysis (Ref. 1). Isolation time is measured from output of the mModule pProtection sSystem equipment interface module until the valves are isolated is fully closed in the isolated position.
A Note is provided that indicates that the SR is not required to be met when valves are closed, or open under administrative controls. This is acceptable because of the slowly occurring nature of the design basis events the CVCS isolation function mitigates. Frequency of this SR is in accordance with the INSERVICE TESTING PROGRAM.
(a) Discuss suggested edits.
(b) Discuss that the comma after closed is necessary.
(c) Discuss adding a statement describing what is meant by administrative controls in this context. Does it mean that the operator only has component-level manual control - either by intent or because the ESFAS automatic signal is inoperable, or the valve stroke shut time exceeds the required time?
(d) Discuss which CVCSI-mitigated design basis events have a slowly occurring nature.
The case for the need for this exception is not clear.
If manual action by the [dedicated?] operator under administrative controls to close the [degraded/inoperable] valve is good enough to satisfy the accident analysis isolation response time, then why is the automatic closure of the valve within an assumed time specified?
The ACTIONS provide the appropriate amount of flexibility for an inoperable (that is, slow) CVCS isolation valve.
And the last sentence of SR 3.0.1 states, Surveillances do not have to be performed on inoperable equipment or variables outside specified limits.
2lPage
Discussion Topics for the July 24, 2019, Public Teleconference on Technical Specifications The LCO is met when one of the covered valves is closed, provided the valves SRs are met. So, the LCO already allows this alternate configuration. The proposed SR Note would allow the SR for the affected valve(s) to be unmet whenever the unit is in this alternate configuration.
Specifying a Note that would allow closing an isolation valve in lieu of demonstrating that the SR acceptance criteria are satisfied within the specified Frequency seems logical but is probably not practical for normal unit operation. And this would create a need for an associated allowance to place administrative control over the valve with a dedicated operator standing by to manually close the valve if a need for CVCSI (or CIS) arises (and the CVCSI or CIS automatic actuation function fails to initiate valve closure). Acceptable limits on the duration of unit operation when this valve with an unmet SR is in the normal open position can be specified by use of the adverb intermittently; imposing a time limit is appropriate because even though the valve is likely available for CVCS/CNV isolation, it is technically inoperable because its SR was not performed successfully within the specified Frequency.
In contrast, the approach in the STS is to enter the ACTIONS for a valve, which is declared inoperable only because one or more of its SR(s) are not met. Rev. 2 of the NuScale generic TS Subsection 3.4.6 adequately addresses this situation with Condition A (One or more CVCS flow paths with one CVCS valve inoperable.); Required Action A.1 says Isolate the affected CVCS flow path by use of at least one closed and de-activated automatic valve, closed manual valve, or blind flange within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, and Required Action A.2 says Verify the affected CVCS flow path is isolated once per 31 days. Finally, ACTIONS table Note 1 says CVCS flow path(s) may be unisolated intermittently under administrative controls.
2C. SR 3.4.6.3 Verify each automatic CVCS isolation valve that is not locked, sealed, or otherwise secured in the isolation position, actuates to the isolation position on an actual or simulated actuation signal except for secured valves that are opened intermittently under administrative controls.
SR 3.4.6.3 This Surveillance demonstrates that each automatic CVCS isolation valve actuates to the isolated position on an actual or simulated actuation signal. This Surveillance is not required for valves that are locked sealed, or otherwise secured in the isolated position, or while such valves are intermittently opened under administrative controls. The actuation logic is tested as part of Engineered Safety Features Actuation System Actuation and Logic testing. An exception to the SR is provided for valves that are opened under administrative controls. This is acceptable because of the 3lPage
Discussion Topics for the July 24, 2019, Public Teleconference on Technical Specifications slowly occurring nature of the design basis events the CVCS isolation function mitigates. The actuation logic is tested as part of Engineered Safety Features Actuation System Actuation and Logic testing.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(a) Discuss suggested edits.
(b) Discuss adding a statement describing what is meant by administrative controls in BOTH cases. In the exception case, does it mean that the operator only has component-level manual control - either by intent or because the ESFAS automatic signal is inoperable?
(c) Discuss which design basis events are slowly occurring in nature.
(d) Discuss which valves the exception is for.
The case for the need for this exception is not clear.
If manual action by the operator under administrative control to close the valve is good enough, then why is the automatic closure of the valve specified?
2D. SR 3.6.2.2 Verify each containment isolation manual valve and blind flange that is located outside containment and not locked, sealed, or otherwise secured and is required to be closed during accident conditions is closed, except for containment isolation manual valves and blind flanges that are open under administrative controls.
LCO The normally closed isolation valves are considered OPERABLE when manual valves are closed, automatic valves are de-activated and secured in the closed position or blind flanges are in place, and closed systems are intact.
ACTIONS The ACTIONS are modified by four notes. Note 1 allows isolated penetration flow paths to be unisolated intermittently under administrative controls. These administrative controls consist of stationing a dedicated operator at the device controls, who is in continuous communication with the control room. In this way, the penetration can be rapidly isolated when a need for containment isolation is indicated.
SURVEILLANCE REQUIREMENTS (continued)
SR 3.6.2.2 This SR requires verification that each manual containment isolation valve and blind flange located outside containment, and not locked, sealed, or otherwise secured in position, and required to be closed during accident conditions, is closed. The SR helps to ensure that post accident leakage of fission products outside the containment boundary is within design limits. This SR does not require any testing or device 4lPage
Discussion Topics for the July 24, 2019, Public Teleconference on Technical Specifications manipulation. Rather, it involves verification that those containment isolation devices outside containment and capable of being mispositioned are in the correct position.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR specifies that containment isolation valves that are open under administrative controls are not required to meet the SR during the time the valves are open.
The case for the need for this exception is not clear.
What are the non-automatically actuated power operated containment isolation manual valves to which this surveillance applies?
Because LCO 3.6.2 states Each containment isolation valve shall be OPERABLE it appears that for a containment isolation manual valve or a blind flange [taking a valves place?], which must meet this SR, to be operable, the manual valve or blind flange must be in the closed position.
2E. SR 3.6.2.3 ---------------------------------NOTE------------------------------
Not required to be met for automatic containment isolation valves that are closed to comply with ACTIONS, that are when open under administrative controls.
Verify the isolation time ACTUATION RESPONSE TIME of each automatic containment isolation valve is within limits.
This Note is acceptable (with suggested edits) because it complements ACTIONS table Note 1 Penetration flow path(s) may be unisolated intermittently under administrative controls. But it is not needed because the last sentence of SR 3.0.1 states, Surveillances do not have to be performed on inoperable equipment or variables outside specified limits.
The case for the need for this exception is not clear.
2E. SR 3.6.2.4 ---------------------------------NOTE------------------------------
Not required to be met for automatic containment isolation valves that are closed to comply with ACTIONS, that are when open under administrative controls.
Verify each automatic containment isolation valve that is not locked, sealed, or otherwise secured in position, actuates to the isolation position on an actual or simulated actuation signal.
5lPage
Discussion Topics for the July 24, 2019, Public Teleconference on Technical Specifications This Note is acceptable (with suggested edits) because it complements ACTIONS table Note 1 Penetration flow path(s) may be unisolated intermittently under administrative controls. But it is not needed because the last sentence of SR 3.0.1 states, Surveillances do not have to be performed on inoperable equipment or variables outside specified limits.
The case for the need for this exception is not clear.
- 3. The exception to meeting the safety-function-demonstration SRs for certain breakers when the breaker is in its actuated position. (Question 16-28) 3A. SR 3.3.2.1 ------------------------------NOTE------------------------------
Not required to be met for reactor trip breakers that are open.
Perform ACTUATION LOGIC TEST. l In accordance with the Surveillance Frequency Control Program 3B. SR 3.3.2.2 ------------------------------NOTE------------------------------
Not required to be met for reactor trip breakers that are open.
Verify ACTUATION RESPONSE TIME is within limits. l In accordance with the Surveillance Frequency Control Program 3C. SR 3.3.2.4 ------------------------------NOTE------------------------------
Not required to be met for reactor trip breakers that are open.
Verify each RTB actuates to the open position on an actual or simulated actuation signal. l In accordance with the Surveillance Frequency Control Program This exception is not needed because the last sentence of SR 3.0.1 states, Surveillances do not have to be performed on inoperable equipment or variables outside specified limits.
Discuss why opening a RTB that is not inoperable would ever be necessarry.
The case for the need for this exception is not clear.
6lPage
Discussion Topics for the July 24, 2019, Public Teleconference on Technical Specifications
- 4. The exception to meeting the safety-function-demonstration SRs for certain breakers when the breaker is in its actuated position. (Question 16-28) 4A. SR 3.3.3.2 ---------------------------------NOTE-------------------------------
Not required to be met for pressurizer heater breakers that are open, or closed under administrative controls.
Verify pressurizer heater trip breaker ACTUATION RESPONSE TIME is within limits. l In accordance with the Surveillance Frequency Control Program 4B. SR 3.3.3.4 ---------------------------------NOTE-------------------------------
Not required to be met for pressurizer heater breakers that are open, or breakers closed under administrative controls.
Verify each pressurizer heater breaker actuates to the open position on an actual or simulated actuation signal. l In accordance with the Surveillance Frequency Control Program G.1 ----------------NOTE--------------
Pressurizer heater breakers may be closed intermittently under administrative controls.
The case for the need for this exception is not clear.
Because these SRs are anticipated to usually be performed before the units RCS heatup in MODE 3 at the beginning of each fuel/operating cycle, discuss when performing these SRs would be necessary in MODE 1, 2, or 3, during the operating cycle.
Because of the Action G.1 NOTE, the SR exceptions are redundant.
7lPage
Discussion Topics for the July 24, 2019, Public Teleconference on Technical Specifications
- 5. The exception to meeting the safety-function-demonstration SRs for certain Class 1E electrical isolation devices when the device is in its actuated open position. (Question 16-28) 5A. SR 3.3.1.5 ---------------------------------NOTE------------------------------
Not required to be met for Class 1E isolation devices that have isolated 1E circuits from non-1E power.
Perform CHANNEL CALIBRATION on each Class 1E isolation device. l In accordance with the Surveillance Frequency Control Program 5B. SR 3.3.2.3 ---------------------------------NOTE------------------------------
Not required to be met for Class 1E isolation devices that have isolated 1E circuits from non-1E power.
Perform CHANNEL CALIBRATION on each Class 1E isolation device. l In accordance with the Surveillance Frequency Control Program 5C. SR 3.3.3.3 ---------------------------------NOTE------------------------------
Not required to be met for Class 1E isolation devices that have isolated 1E circuits from non-1E power.
Perform CHANNEL CALIBRATION on each Class 1E isolation device. l In accordance with the Surveillance Frequency Control Program The case for the need for this exception is not clear.
(a) Because opening a Class 1E isolation device causes the supported safety circuit to lose power, would the supported actuated device be expected to move to its actuated position?
Discuss the redundancy within each MPS channel with respect to power supplies and processors.
(b) Because the CHANNEL CALIBRATION is anticipated to usually be performed before the units RCS heatup in MODE 3 at the beginning of each fuel/operating cycle, discuss when performing this calibration would be necessary in MODE 1, 2, or 3, during the operating cycle.
8lPage