ML19329B413
| ML19329B413 | |
| Person / Time | |
|---|---|
| Site: | Davis Besse  |
| Issue date: | 06/17/1976 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML19329B412 | List: |
| References | |
| NUDOCS 8002050621 | |
| Download: ML19329B413 (17) | |
Text
g e
[~'
^
linc l er;t a re
'lhe following changes shall be made to the Da vi:> lle ;se fini t ; !!!GI)
Safety livaluation Report dated. lune 23, l 'J 7 7, Snction 7.I P" 9.e !
Replace Paragraph l with the fo llow i ng :
The drawings of the RPS, ESF and Class IE support sy. items that are provided in the FSAR are incomplete in part or are not. presented in sufficient detail to verify t'at the a
design has been adequately implemented. The applicant was requested to submit a final design package for all safety related equipment after an audit is performed assuring that the inforration presented (a) represents the as built design. (b) contains the necessary cross references and (c) will permit a point by point identification from an initiating device through to the actuated devices and equipment.
We will review these drawings when submitted and report the results.
in a supplement to this report.
Section 7.1 Page 1 Replace Paragraph 5 with the following: A site review for the purpose of evaluating the physical arrangements and installations of electrical equipment was conducted in October 1975.
Ilecause of construction restraints and incomplete status of equipment insta11ation it was not possible to complete our review. The applicant was informed that an additional site visit would be necessary and should be scheduled as soon as this installat ion is 80 complete. The results of the site visit 8 0 0 2 0 50@l
r will be includcd in a suppinment to thi: repo rt.
7.3.3 Decay lleat itemoval (1)llR) I.ow Pre.w;are to !!igh Pro..ure Isolati:,n Valcan Replace Ja.it paragraph in Sei t ion 7. 3.3 sa:b the Ds t i v.w i n :,
'ihe original duaign of the liik low pressure tu a i;; i pre.m r.;. s o l.t t. l..
valve control system was found unacceptabic.
't he applicant :,di fied the design to conform with the above requirements. The modified design utilizes independent and diverse interlocks, one fcr each valce, which automatically actuate valve closure and prevent the alves from opening whenever the reactor coolant pressure e.xceeds 230 psig.
In addition, during our review the applicant v;as requested to (a) verify that the consequences of inadvertant closure of these valves during Dilt mode of operation would not degrade the core cooling system below an acceptable icyc1 or (b) modify the design to make the consequences of such a failure acceptabic (Section 5.5.7 contains additional info rmation regarding the evaluationof this design).
Our review of the Di!R low pressure to high pressur isolation sy..:cm included review of the logic diagrams and selected schematics presently included in the FSAR. We conclude that the design meets the Commissions requirements stated in Section 7.1 of this report and the requirements stated above and is therefore acceptable, conditioned only 1-the satisfactory resolution of the items discussed in Section 7.1 and resolution of the staffs concern regarding inadvertant valve closure identified above.
ae
7.3.I Core Floodin: Tank Isolation V Iv, (CFTIV) iteplace Meet ion 7.. 4 en page 4 with the following Each of the two Core Flooding Tanks are pro;ided '.i ti a mtor operated isolation valve. The cont rol circui ts for these val. 4 a re m. ;a ad LO
Itu%d t 1 Ge l l y opf:0 M ud p;";? ' t
=.105
_>C
,+
~
reactor coolant pressure is above 800 psig. The interlock functions are derived from two independent and redundant in s t rur,ien t channela located in separate engineered safety features cabinates.
Each channel operates one of the two isolation valves.
Valve position indicacion, electrically independent of the valve power supply, is provided in the control room to monitor the status of these valves at all times. Also, two independent computer alarms, ona for each valve, derived from contacts on the motor operator indicate t. hen the valve is not fully open and uhen the wide range reactor ecolant pressure senscrs (on a 2 out of 4 basis) sense a pressure in excess of 725 psig.
A third valve position indication systen is provided using stem mounted valve position contacts and redundants and independent reactor pressure
..citches to indicate when the valve is not fully open when pressure is g. cater than 725 psig.
In addition the applicant has documented that the Technical Specifications will require that the icolation valve motor control circuit breakers will be locked open and padlocked to assure that the valves will remain open during reacter operation. The circuit breaker status is indicated in the control reom.
t
-A.
Oitr review of the design of the core fl<>oding tank isolation valves included review of the lo;;i.c diagra:as and selected scheaatic dia;;rans presnetly included in the FSAR. he have concluded that the d'nign neets tiie Conais: ion's requi re:aents u stated in Section 7.1 n; inis i
r-port and i s acceptable coadi ti one.1 e n ! :.
t, tau ti rac
,e resolution of the items discussed in Section 7.1 of thi s report.
Delete Sections 7.4.2 and 7.4.3 These sections are now covered under Section 7.4.1 because of the applicant's modified design.
7.4.1 Steam and Feedwater Line Rupture Control System (SFNCS1 Replace Section 7.4.1 with the following:
The function of the SFPCS is to 1) automatically start the auxiliary feedwater system in the event of a main feedwater line rupture or a main steam line rupture and, 2) automatically isolate the main steam and feedwater system in the event of a rupture and autoamtically align the auxiliary feedwater system with the uneffected steam generator.
The SFRCS is comprised of two redundant and independent subsystems.
liach subsystem consists of an AC powered logie channel and a !)C powered logic channel. The loss of power to the logie channel will trip the a ffected channel.
7
p Iach lo; tic tis;itumi rece i veo-the 0,1 1 o c. i n ;; input;
!!ain stea:a line pressure a.
b.
!&iin feedwater/ steam generator di fferential preraire c.
Steara gentrator level d.
Poactor coolant pump. t :> N t ;
Ltin feed < ater 13 ump trip status and loss of all four reactor c.
coolant pumps.
(Input from the non-safety control system)
Each logie channel actuates on a one out of two basis. Ope rat ion o f each subsystem requires actuation of both the AC and the DC logic channel in the subsystem to initiate a safety action.
During our review the applicant was requested to address concerns regarding loss of all AC power to this system. The details of this review and the resolution of the staffs concerns are addressed in Section 9.2.7 of this SER.
Based on the review of the logic drawings and selected final design schematics various design features of this system have been identified as areas of nonconformance with the requirements established for safet;.
systems and therefore, unacceptable to the staff.
The applicant was requested to modify the design to conform fully with the Commissions requirements and the requirements of IEEE Std. 279-1971 and amend the FSAR accordingly.
i
p
. t.
n Ou r re v i ew conc l ude. that the de ;i;'n o f the SI HCS vm Lt-aadu acceptable subject only to the sati s facto ry resol ut ion o f th<: i to:.r; identified below.
L.
.\\u t i c ipatte r; trip 2nput.. to rht reactor prot xtion, i v :a a re a F r. c.,
- y N.s m -
4 2.,
..a Integrated Control System) and as such do not satisfy the requirenents of IEEE Std. 279-1971 Section 4.7.1.
The applicant cas requested to design these inputs to the requirements of IEEE Std. 279-1971 if they are to remain as SFRCS inputs, or remove them if they are not required for safety. The applicant agreed to these requiremer.ts and committed to submit a modified design.
lie will review the modified design when submitted and will report resolution of this item in the supplement to this report.
2.
The SFRCS portion of the design that is used to isolate the main feedwater and steam flow in the event of an accodent in not designed in full conformance with the requirements of Sections 4.2 and 4.16 of IEEi: Std. 279-1971 and is, therefore, unacceptable. Our review identified areas in the main and startup feedwater valve control system and in the main steam isolation valve control system where a single failure could negate the required isolation of the intact steam generator.
in addition, we identified areas in the circuitry associated with solenoid actuated valves where the protection system once initiated could be automatically reset and prevent protective i
r 7
- !c t i on t o n<
t <> comp l e t ion. The applicant a;:reni t e, r.td i fy t h <
de:- ign and rc"i';c the schematic d r:. i n g.s to d mant: ne full c n Tcrmane.
- -h 9ecti<o
? 'nd i l'
of
-b.
f< rer o n
~%,'
We will reeiew H ec dif'ied design when suisa t ted a:
report resolution of these iteras in the supplen-nt. to th is rep;.rt.
3.
The applicant's response to our position concerning the single failure criterion as it relates to electrical 1; -cperated active and passive cer.penents identified two norr. ally epen valves on the discharge side of the auxiliary feed pumps (one in each 1 cop) which if failed closed would prec1nde adequate systen function. These valves are required te remain open to assure a heat sink to the.stean generators during the course of an necident.
The applicant subnitted a design that provides adequ:tte assurance that the valves will remain open when required. Two indepandent relays isolate the centrol power to the valves whieb prevents valve rovement and satisfies the single failure criterion during nar-21 cI erat ion.
Restoration c'f the centrol power to these valves requires actuition of two sci arate and independent pushbuttons located in the contral room.
Our revica of the circuitry associated with these valve < in.!icated that although the design satisfied the staffs requirements regarding removal of poner to tne valves, the ;'osition indication of these valves were inadequate and, t h e re fo re, unacceptable.
The ap; licant was reque <ted and ar, reed to inodify the de: inn and provide r, dundant p.'s i t i e:
indication in the main control rear to 'teni t o" the status of t he -e vnives
e n-a' all t i res, and that the design of th<< position indication i * :.el f satis fy the s ingle failur-c ri terior,
i e mi n e d. ' re.a t a,
i
., t c c c d i # i - 'd>
ah~n resolution in the supplement to this etport.
4.
Testability of SFRCS was reviewed.
Provisions in the system ',110w periodic on-line testing of the system logic channels. The sys en design incorporates " blind sensor" inputs. These sensors are 1ccated noth inside and outside ccntain.ent. The applicant verified that for all sensors located outside containment provisions,ill be avai'able te periodically verify sensor operability.
!!cwever, ro apparent provisiens were availabic to periodically verify sensor operability of these sensors located inside containment. The applicant was requested to include provisions that would allew periodic verif cation of all sensors required for safety and satisfy the requirements of IEEE Std. 2 9-19 1. Section 4.0 The applicant has been informed that the staff requirce the Technical Specification to include periedic testing of systers require ' fe" safety to verify their functioral operability.
(This includes the systems as a whole, i.e., sensors, logies and actuated devices.1 The channel testing period defined, is not to e.xceed once a men 1.
Fo r "' lind senser" channels this monthly test will include actuatio : of the output device of the sensor itself.
In addition, the Tee'" ic.t! Speci ficat ien
-9 will require pcrio<ii c ett libt :t ion 0 " thru. "I,lind <:ensors" once every th rne muoth' We will review t!'e er;thod uced to veri fy operabilitf of the 9 en':o rs requi r ed fo r euf* ty during nur n i' c tiJit.'nd p rond t ne resul *:; in L s t ;,p] er s n t o ?Fe
% mrt 5.
Our review of the SI-i>CS actuated equipment identi f med valves HV106,
'llV106A, !!Y107, and liv 107A (stean inlet valve to the auxiliary feedwater pump turbines) which incorporate on override interlock te shut these valves or inhibit the valves frc= opening whenever the conte.inment pressure exceeds preselected setpoint of 35 3 psia It is the staff's cencern that this inter 1cck can inhibit the operation of the atixiliary feedwater, both automatically and narually, and negate this systen during accident condi*. ions.
The applicant was requested to demonstrate that when conditiens inside containment reach 38.5 psia the operation of the auxilia cy feedwater system would not be required to mitigate the consequences of an accident and that adequate nargin is provided in these set points that allo'es proper operation of tais system when required, or modify the design to satis factorily resolve the sta t'f's concern.
In a recent meeting, the applicant agreed to delete these inter!c ts and e
submit a modified design. We will review the nodified design when submitted and report resolution of this item i1 the supplement to this report.
i j
.lo-Sec t ion 7. 4..' for the Auxiliar. 9hutdown ';yst u dw l d : v., ' s ident i fi ed n ';ection '.1. 2.
n na 0, e ?. a.,t n:.:ecr n 3.i
- r. -
,.n-Replace Section 7.5.1 with the fo!!owing.
The staff's requirements with regard to accident ar! pc:t-accident monitoring instrumentation is that the instrurentation "hould t 1.
Qualified fer the accident environment (post-accidert it<tr nents only),
2.
Redundant with at least one channel recorded (the recordine, system, recorders and associated circuitry and components, are required to be seismically qualified to de onstrate operability following, not necessarily during a scismic event, and 3.
Energi:ed from the ensite power s 7 plies and designed in accordance with the requirements of IEEE Std 279-1971.
During our review we found the design to be unaccept.:Sie. Tne applicent nodified the design to conform with the above position and identified in Table 7.9 of the FSAR the parameters that are used for accident and post-accident monitoring.
We have reviewed the crite ia and the design for the accident and post-r accident nonitoring system and conclude that the design meets the abore requirements and is acceptable conditioned enly en the satistactory resolution of the items diseu< sed in Sectier
.! ef thi< repert.
,e
. i j..
't he adequacy of the pic armt e r::, dee:ned essent ia l fin a < c i d <:n t ani and poet accident nor i t o ri ng is discuc.ed ir. See?it.n 6 o'~ th< SfS.
nep nee '.cer'an
'.c with t!c t'<: l i r.w i n g :
j 12 1 d.**
f...... s * *1
'. I.
- i :' C 1, 2 c.P. ;
f i. ' _.
We have reviewed the appliennt's criteria ar.d prece.! urns for taintainin:;
the integrity, physical independence, and identification of safety-rei ted equipraent and circuits.
During our review we have identified arris where adequate separation was not prnvided or the infurmation was too general to corplete our evaluation. The applicant hee atended the infernation in the FSAR describing his criteria for separation cf redurdant Class IE circuits, documented his criteria for fire stops.,nd seals and has sub-mitted prelininary test results demonstrating the degree of flare retardancy of his cable.
The following sections identify the staff's cancerns and the resolutions:
We conclude that conditioned on the satisfactory resciutions discussed in Section
.1, Section 7.9.2, and Section ".9.3. the separatie-criteria for the l' avis Besse Unit i design procide
- e.,ui'ca l e n t ar irpr.,ved degree of separation as compared te dc<igns of recently licens.'d plants and are acceptable.
I.'
TE and ?, n JI;i:- I !- P a<:.. c. in i
7.9.1 T:1)a rat on l'et::cen 1:edun< tant Cin.
-4 Dible Sprealiny.1:co.x. nd Ccr. ora' r. r. :
r e.u W app 1;carr '. ri ver i a fcr ron-c le.', T r-raceuys d^ fines *Lr
'. rac.
Im c:3.. rce :,
.c i..
J: :inet
.1 o u r. -: ( i.. e.
dt. aignats;d "act wa;/a (i..
,A, 5, D.id i ).
Ini J G.g cables is precluded by administrative proced.:re s, but r.3ch non-class IE group may be run in close proxinity to another nor.-c!asr IE :.;rcup. ! th no minimum separation requirements. The criter;a fcr electrical separatio: between redundant class IE raceways are defined as 1 feet vertical, 18" hori: ental.
When these distances are not maintained barriers will be prorided to assure that fire propagati:n.;cul ! not degrade redundant trains.
In addition, the applicant's criteria for power cables (i.e., above 13 W';
require that these cables be routed in rigid steel cerduits er be embedded in duct banks.
During cur review the staff identified areas where nen-class IF raccways were interposed between redundant class IE raceways in such close proximit.
that a fire in a ncn-class IE tray could prepa; ate, ria other non-class 1E trays stacked ene above the other, te redundant class IE trays and degrade safety. Although the applicant criteria permit specific non-class IE greups to be run in close proxicity to specific class IE ;.;rcups with no tinimum sel'aratien requi re: ents (i.e., non-ela th.' re'c im of the rodified criteria, alecte ! dr"w1. p ' hat i tal l enent these criteria, the review of the construction of the raceways, tqe d u.? ;. r.:e *. i 1 ron ui+r fo r r.c.ec t cafsi -.rl
- fl- ; * : ;* :
'.~'2R
..r t',
f L;,
.t q'"
ry g
the design is acceptable.
7.9.2 Separation Criteria Cetween Redundant Class IE Circuits in 'bral Ccmiuits The applicant utilizes meta! corduits for various CIsss IE c ese-'tini circuits routings. During our revic.' the staff ider.tified creas where redundant channel. iring reuted in separate and independent retal conduits, were routed in c1csc proximity (i.e. I 1/2 inch apart) to ca.h other without previsions for br.riers other tha.n the cerduit itself.
Althou;;h the staff recognizes t at the e et'1 cond :its cay be i
n valid barrier for certain types of events, the staff does not consider that conduits alone are adec,uate barriers for all types of The applicant was requested to review their installatioi, and events.
where events such as heat or nirsiles Tay effect the redunbr.: circuits ist these conduits, the appliennt vas requested to provide ".trriers te assure the integrity of these circeits, or justify their den:r on sc. e T
other defined basis.
Incidents such ac a fire in ar open tray eressirg
p
,. under redund uit conduits wt:; ;ited as cr c:.anpl : ' hat m'.
_ # f e. 2 t!.
" T.? l s: i I.i ; 4.. e t il -* co:1d u [L :ni[.;gr3ue t,
,'J>^
~scuitJ ' _lO'.
acceptable level.
The applicant committed to evaluate their design and will advise the staff as to the resolution of this concern.
.:e. rill review the applicants response when submitted and report our ecaluation in the supplement to this report.
- 7. 9. 3 Senaration Criteria lletween Redundant Class IE and ':en Class 1::
Circuits Within Enclosures During the review, the staff identified areas in enclosures (i.e.,
control boards and instrument cabinets) where acn-Class lE cablas are bundled together with essential cables (i.e., non class lE train A cables routed together with Class lE channel 1 and non class lE train 3 cables are routed together with Class lE channel 2 cables).
Although minimum separation of 12 " is provided between essential redundant cables in these enclosures, the two non class 1E groups identi fi=d above enter the enclosures via a common routing path and are then diverted toward their designated locations in a wye (Y) configuration and bundled together with the associated class lE cables.
The applicant was advised that this design violates the independence of redundant essential trains and is unacceptable unless it can be demonstrated by test simulating the actual as built cond L t i.ons that a fire inside these enclosure. could not propagate to beth redundant C l.m s 11. channels aad
- I f, de:'rach i l.e m Intl o't
.iccept ab le 1 ". 21.
Tiv-rip,1 ! < ro t crc - ted %
sut o
provide these t es t.s ani! <!cnonst r.ite the ath: ; ua r.;; of t.<Ir
- b., U:n.
2 Prelininary test re -:ul t - have be.n cubnitt<:! to the taff for reni e...
11 h r.T. nc ie:- b! :n t '
J L
..ur.
se r -
.i.
.a t v.-
,3 final test results as part of the FSAR docket.
We will review the final test results when submitted and repre resolution of this item in the supplement to this report.
7.10 Electrical Penetrations Replace the 2nd paragraph of section 7.10 with the followinp:
Since these tests are predicted on the satisfactory operation of the interrupt devices provided i.e., breakers, fuses, etc. the applicant was requested to describe in detail the degree of protectica provided by these devices to assure functional integrity of the penetration, for both safety and non safety circuits associated with the electrical penetrations. Where back-up protection is used the applicant was requested to describe the type of devices used and justify their design accordingly, thereby demonstrating their conformance to ';2C General Design Criteria 50, " Containment Design Bases."
The applicant was requested to document these tests and t'aeir results in the FSAR.
r
- j
.S_ection u.:.I Prm.
I?
Replace P.iragra;;h 7 9:m 13 wit.h the T.llox: >.
On.; i t; imei o i l >:t,nr-co.i r t irer' !r
- . r,000 ; a l i on t i- -
.>r
,c
'o r r "
th, 9
r <-
t
.it.
T;, e y,tr 5,
o diesel at fuel load.
iiw oti~aite fuel storcc2 c.tyc::
is m ficieit for 7 day operation for each diesel generator unit.
The revie, o f th =
fuel oil system concludes that the design reets the r->quirenents of IEEE Std. 308-1971 with regard to seisnic qualificati. ani erergency storage capacity and is acceptable.
Re fe r t ; Section 9.5.1 of the Safety Evaluation Report for the detailed s: sten description.
Section 8.3.1 Pace 13 Replace last paragraph with the following:
1.'e have reviewed selected detailed schenatics and elenentary schenatics and conclude that the design of the energency a-c pouer systen ncets the requirenents of GDC 17 and 18 and Regulatory Guide 1.6 and is acceptable conditioned only on the satisfactory resolution of the itens identified in.Sectior 7.1 of this report.