ML19340E835
| ML19340E835 | |
| Person / Time | |
|---|---|
| Site: | Beaver Valley |
| Issue date: | 12/12/1980 |
| From: | Dunn C DUQUESNE LIGHT CO. |
| To: | Grier B NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| References | |
| IEB-79-01B, IEB-79-1B, TAC-42459, NUDOCS 8101150933 | |
| Download: ML19340E835 (14) | |
Text
-
Ik s-b des
'Af (412) 456-6000 C",7'"*
December 12, 1980
~1 United States Nuclear Regulator / Commission u
Office of Inspection and Enforcement g
e Attn: Boyce H. Grier, Regional Director Region I 631 Park Avenue King of Prussia, Pennsylvania 19406
~1 f
Lf
Reference:
Beaver Valley Power Station, Unit No. 1 y
Docket No. 50-334 0~
o*
Supplemental Response to IE Bulletin 79-01B Gentlemen:
On December 2, 19>':, a meeting was held in Bethesda, Maryland to discuss the Duquesne Light Company Beaver Valley Unit I responses to IE Bulletin 79-013 dated September 30, 1980 and October 30, 1980. As a result of that meeting,.Duquesne Light Company agreed to submit an updated and expanded response to the Bulletin by January 6, 1981.
In addition, we agreed to submit this interim response which will, (1) identify procedures which were prepared or changed to provide additional guidance or instruction to the operator to cope with environmentally unqualified electrical equip-ment and, (2) provide expanded justification for interim operation for certain items that were highlighted in the December 2, 1980 meeting as being of special concern.
Procedures As committed at the meeting, procedural changes were made on December 3, 1980 to address the possibility of a failed limit switch resulting in a violation of containment integrity upon reset of an ESF function.
Change Notices to Operating Manual, Chapter 53, " Emergency Procedures," Sections 3 and 4 were issued to add instructions for the operator to check for a possible failed valve and for actions to be taken prior to resetting an ESF function following a LOCA or HELB.
Previously, two changes had been made to Operating Manual, Chapter 44B, " Safeguards Ventilation Systems." These two changes were made to reduce the severity of two of the HELB's outside containment which could cause class IE equipment to be exposed to a harsh environment for which it is not qualified.
One provides instructions to the operator to secure the inside and outside sample system containment isolation valves and the steam generator blowdown lines upon receiving a pipe tunnel area temperature alarm. The other change provides the operator with action to be taken upon receipt of an Auxiliary Feedwater and Quench Spray Pump Compartment 8101150$h T
Beaver Valley Power Station, Unit No. 1 Docket No. 50-334 l
Supplemental Response to IE Bulletin 79-OlB Page 2 temperature alarm.
This includes instructions to close the turbine-driven auxiliary feedwater pump isolation valve MOV-MS-105 and to notify a dedi-cated operator, stationed outside the main steam valve room, to check that MOV-MS-105 is shut or to shut it manually.
We have re-reviewed the responses to the Bulletin previously submitted to determine if any further changes to procedures.or new procedures should be prepared to deal with potential qualification deficiencies. As a result of this review, additional instructions have been added to Section 2,
" Precautions and Limitations" of Operating Manual Chapter 53, " Emergency Operations". These instructions alert the operator that 1) in extreme cases of instrument malfunction, parameters can be infered from related instrumen-tation (i.e., using pump ammeters or level instruments to infer flow) and
- 2) in cases of containment flooding, limit switches on submerged motor operated valves may give an erroneous valve position indication.
Special Concerns Items having incomplete qualification data and requiring an expanded justification for continued operation that were highlighted in the mecting as being of special concern include:
1.
NAMCO 700-series limit switches insid"e containment.
2.
Fischer-Porter steam flow transmitters.
3.
Barton pressurizer level transmitter.
4.
Submergence of motor-operated valve MOV-CH310.
Discussions of these items and expanded justifications for continued operation are included as an attachment to this letter.
As agreed to in the December 2, 1980 meeting, the expanded justifi-cations for the remaining 79-OlB items will be provided in the updated t
submittal.
Very truly yours, m~
C. N. Dunn Vice President Operations Attachment
.m.---
~. * *, '.
Besvar Vclicy Powar Station, Unit No. 1 Docket No. 50-334 Supplemental Response to IE Bulletin 79-01B Page 3 cc:
Mr. D. A. Beck =an U.S. Nuclear Regulatory Commission Beaver Valley Power Station Shippingport, PA 15077 U.S. Nuclear Regulatory Commission c/o Document Management Branch Washington, DC 20555 U.S. Nuclear Regulatory Commission Office of Inspection and Enforcement Division of Reactor Inspections Operation Washington, DC 20555 Director of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Aten:
Mr. Steven A. Varga, Chief Operating Reactors Branch No. 1 Division of Licensing Washington, DC 20555 a
ATTACHMENT 1 NAMC0 EA700 LIMIT SWITCHES 1.
LOCATION AND SAFETY FUNCTION NAMC0 limit switches located in-containment and shown on the master list are used in air-operated valve de solenoid control circuits.
Under normal operating conditions, the valve solenoids are energized and their associated air-operated containment isolation valves are open.
The solenoids are kept in the energized state or " sealed-in" by means of NAMC0 limit switches.
Figure 1 shows a typical control circuit for an air-operated valve using a limit switch for " seal-in".
2.
QUALIFICATION DEFICIENCY A Beaver Valley No. 1 deficiency concerning certain NAMCO limit switches was identified to the NRC in a Duquesne Light letter dated November 21, 1980.
Specifically, three NAMC0 EA700 switches which are used on con-tainment isolation valves TV-CC-107Dl, 107E1, and'110E3 do not have complete documentation to show environmental qualification.
3.
FAILURE MODE ANALYSIS The switches can fail open, grounded,'or closed.
A failure mode and effects analysis shows that for each failure mode two initial conditions for the associated solenoid must be considered:
Solenoid initially energized e.nd solenoid initially de-energized.
With the solenoid initially energized, limit switch failures will affect l
the solenoid and air-operated valve as follows.
If the switch fails open, it will de-energize the solenoid and cause the associated air-operated valve to go to its fail safe position (closed) and need not be considered any further. A failure resulting in a single ground would have no effect on the battery power supply which is ungrounded.
Multi-ple grounds could result in a trip of the circuit breaker that feeds tne solenoid.
This failure would cause de-energization of the solenoid resulting in the associated air-operated valve going to its fail safe position (closed) (Refer to Figure 1).
If the solenoid is initially de-energized it will be due to any of three l
possible conditions, not including the limit switch failure itself.
These conditions are (1) loss of power, (2) control switch failed open or held continuously in CLOSE position, and (3) containment isolation l
signal.
For the first two conditions, limit switch failure has no l
effect on the solenoid.
For the third condition (containment isolation l
signal present), should the limit switch fail open, there would be no immediate effect.
Subsequent to the failure, it would not be possiole to re-open the air-operated valve unless the control switch were held continuously in the OPEN position. However, this condition has no effect on the ability of the valve to perform its safety function, i.e.
to close.
l 7665A
fn the event that containment isolation is called for and the limit switch f ails closed, the isolation function will be performed as required.
However, when the isolation signal is subsequently reset, the f ailed limit switch would cause its associated solenoid to be re-ener-gized resulting in a re-opening of the air-operated isolation velve (Refer to Figure 1).
4.
JUSTIFICATION FOR INTERIM OPERATION Protection against a loss of isolation is provided by a redundant air-operated valve (TV-CC-10702, 107E2, or 110E2) located outside of containment.
Because these valves and their control elements are located outside containment they are not subject to the adverse environment resulting from the postulated initiating event.
However, to protect against the unlikely event that this valve experiences a random f ailure and does not isolate, Operating Manual change notices to Chapter 53, " Emergency Procedures", Sections 3 and 4 were instituted on December 3,1980 to provide guidance to the control room operator to check for successful operation of these valves and for actions to be taken prior to resetting any emergency safety ' features or containment isolation function.
5.
RESOLUTION OF QUALIFICATION CONCERN
~
Replacement switches have been ordered and are scheduled to be delivered 12/19/80. They will be installed at the first outage following their delivery in which the plant conditions are such that it is permissible to remove the equipment from service to make the replacement.
t l
l
(
l I
7665A
TVPfCAL LIMlT SWlTCH " SEAL-IN" CIRCUlT FOR CONTAINMENT ISOLATION VALVE r
2 CONTROL SWITCH
/ 1 (CLOSED IN "0 PEN" AND "AUT0" POSITIONS)
(CLOSED IN CONTACTS "0 PEN" (SPRING RETURN ~/
POSITION)
TO "AUT0" POSITION)
LIMIT SWITCH CONTACT (CLOSED WHEN AIR-OPERATED VALVE LEAVES CLOSED POSITION)
/
CONTAINMENT ISOLATION CONTACT (CLOSED EXCEPT ON 7
CONTAINMENT ISOLATION SIGNAL)
~
I S0V l
FIGURE 1
~
ATTACHMENT 2 STEAM FLOW TRANSMITTERS (FT-MS-474, 475, 484, 485, 494, 495) 1.
LOCATION AND SAFETY FUNCTION Steam flow is used as a protective function in the inside containment feedline break analysis and as input to the steam generator level con-trol system prior to receipt of. trip.
2.
QUALIFICATION DEFICIENCY The Fischer Porter steam flow transmitters were qualified to perform their short-term trip function as documented in WCAP-9157 (Proprietary) and 9122 (Non-Proprietary). However, the qualification does not meet the one hour margin requirements of tha D0R guidelines.
3.
FAILURE MODE ANALYSIS AND JUSTIFICATION FOR INTERIM OPERATION The effects of steam flow transmitter failure on these systems and tne justification of their acceptability in the interim are:
Protection Function The protective trip function assumed in the BVPS Unit 1 FSAR Chapter 14 to mitigate a feedline rupture is a low steam genera-tor level coincident with steam-feed mismaten in the nonfaulted stean generator and low-low steam generator level in the faalted steam generator.
The current transmitter qualification is ;on-sidered adequate to perform the trip, the only NRC concern is cne of margin.
Nevertheless, even if we assume failure of these l
'Jnits the trip function will be provided by low-low steam generator water level in the faulted steam generator (qualified Barton Lot 2, LT-FW-474 to 476, 484 to 486, 494 to 496).
No credit is taken in the accident analysis following a main feedline rupture for main feedwater flow being injected into tne steam generators, therefore, failures in the steam flow transmitters post trip will not compromise this safety function.
Control Function a)
Failere of the steam flow transmitter in the high direction i
improves system transient results due to increased feed for all accidents, except steam line break.
The steam line break analysis assumes feedwater flow which conservatively envelopes conditions caused by the postulated failure.
b)
Failure of the steam flow transmitter in tne low direction results in low feedwater flow which results in lower steam l
generator level.
When level decreases to the low-low steam l
generator level trip setpoint the Auxiliary Feed Pump is automatically started to maintain steam generator level.
7665A
The auxiliary fe:dwater system will maintain a sufficient secondary heat removal source.
Monitoring Function The steam flow transmitters are used by the operator for monitoring steam generator performance during steady-state plant conditions.
Specifically, they are used in conjunc-tion with feed ficw and steam generator level on a three pen recorder to provide a visual indication of secondary system operation. The steam flow transmitter information is not used during transients such as step changes, heat-up, and Cooldown.
The steam flow transmitters are not identified for post-accident monitoring. The operator will use steam pressure and steam generator level information to diagnose a secon-dary HELB.
4.
RESOLUTION OF QUALIFICATION CONCERN These transmitters will be replaced with transmitters having margin with respect to the 00R guideines.
A purchase order will be issued by 12/31/80 for these replacements.
Delivery is scheduled for October 1981.
Installation will be made at the first outage following delivery in which plant condition permits replacement, but no later than June 30, 1982.
7665A
ATTACHMENT 3 PRESSURIZER LEVEL TRANSMITTER (LT-RC-459) 1.
LOCATION AND SAFETY FUNCTION Since pressurizer level coincident with pressurizer pressure has Deen removed as a safety injection initiation requirement following TMI, the pressurizer level function no longer performs a protective trip function for any event causing an adverse environment inside containment. Thus.
the transmitters are only used for post-accident monitoring purposes with respect to these accidents.
2.
QUALIFICATION DEFICIENCY At present, there are two new Barton Lot 2 transmitters and one originai transmitter (Barton qualified in WCAP-7410L) that provide this func-tion.
The original transmitter is not qualified for post-accident moni-toring.
It was re-installed as a temporary replacement for a new trans-mitter that developed a calibration problem.
3.
FAILURE MODE ANALYSIS No deleterious control action will result should the original trans-mitter fail when the pressurizer level control is in AUTO, oecause during SI, CIA or CIB the pressurizer level control system is defeated by closure of the charging system flow control valve which isolates the normal charging header from the reactor coolant system.
Furthermore, to minimize any control system interaction by pressurizer level channel LT-RC-459 prior to safety injection its pressurizer level control input will be administrative 1y limited to minimum time periods required for maintenance and surveillance testing.
4.
JUSTIFICATION FOR INTERIM OPERATION Justification for interim operation with one original transmitter and two new (Barton Lot 2) transmitters performing the pressurizer level function is as follows.
First, the two qualified transmitters, LT-RC-460 and 461 provide the identical functions of the original transmitter and are powered from different power supply trains.
Second, should the original transmitter fail, the operator is instructed to refer to redun-dant instrumentation by the following note in Section 2, " Precautions and Limitations" of Operating Manual, Chapter 53, " Emergency Operations".
l "The process variables referred to in these instructions are typ-ically monitored by more than one instrumentation channel.
Tne redundant or related channels should be checked for consistency while performing the steps of these instructions.
Consideration must be given to the possibility of instrument errors caused oy tne transmitters being located in a hostile atmosphere created by the accident."
l 7665A
5.
RESOLUTION OF QUALIFICATION CONCERN The new qualified Barton Lot 2 transmitter wnien developed a calioration problem, is Deing sent to tne vencor for repair. The. repair process is being expedited.
Installation will ce made at tne first outage fol-lowing celivery in wnicn plant conditions permit replacement, out no later than June 30, 1982.
e 7665A
f ATTACHMENT 4 SUBMERGENCE OF MOV-CH-310 1.
LOCATION, SAFETY FUNCTION AND DEFICIENCY The motor-operator for MOV-CH-310 is located below flood level but is not qualified for submergence.
MOV-CH-310 is required to close immediately on receipt of a safety injection signal and to stay closed thereafter.
It is located midway between the containment floor and the maximum containment flood level.
For a LOCA, the water level in containment will not rise above tne operator prior to completion of valve closure. This is documenteo in calculation 11700-EF-181-0 dated November.3,1978.
No furtner action is required of MOV-CH-310 after it closes.
2.
FAILURE MODE ANALYSIS The failure modes to be analyzed are those in which suomergence could possibly worsen the course of the accident. Tney are failures whicn (1) cause a cascading failure to the valve motor's 480 Vac power supply or which (2) cause the valve to inadvertently open.
The circuit to be analyzed is shown on Figure 2 and operates as fol-lows.
The valve motor is operated by the application of 480 Vac power to its terminals by a standard reversing contactors.
The contactors are controlled by a remote switch.
Switch closure applies control power to the contactor coil causing it to energize the valve notor and seal itself in until the valve has completed its travel.
At this point, limit or torque switches located at the valve interrupt the seal-in, de-energize the contactor coil, and thereby remove power from the valve motor.
Control circuits are transformer isolated and ungrounded.
Fur-thermore, when the contactor is de-energized, only one leg of the con-trol circuit is directly exposed to the containment. The other leg is isclated from f aults caused by the containment environment, by either the control switch or by position indication lights.
Two circuits need to be analyzed for f ailures:
the power circuit and the control circuit. The power feed to the motor is de-energized immediately after valve closure and remains de-energized throughout tne submergence. period. Therefore, suomergence has no direct impact on tne power circuit.
The control circuit is shown on Figure 2.
The hignlignted limit switches LSl-LS5 and the torque switches TS1 and TS2 are tne only valve operator components in the control circuit that could be exposed to submergence.
The condition.to be analyzed is whether the closed valve can be spuriously moved to the open position by submergence.
TS2 and LS4 need not be addressed because they are located in the CLOSE Circuit tneir status cannot cause opening of the valve.
Short circuits need not be addressed for LS1, LS2, LS3, and TS1 because these switches are already closed when the valve is closed.
7E65A
~
The effect of a short circuit on (S5 would be the lighting of the red position indication light.
This is the only result of a snort circuit caused by submergence.
A single ground caused by submergence to any of the nighlighted components on Figure 2 will have no effect on tne control or indication functions However, in the unlikely event that one ground show as G1 already existed between the control switch and the 42-0 coil, an additional ground at, for example, G2 due to submergence would provide a path through which the 42-0 coil could be energized.
It is improoable that the contactor would actually pick up, because such a patn would have a relatively high resistance.
Finally, if a ground existed at G3 and a second ground were caused by submergence at G2, a hign resistance would be placed across the secondary of the control transformer. This could cause a control transformer failure, but the only action that might result would be a trip of the circuit breaker, dedicated to protection of the MOV-CH-310 circuit and the loss of position indication for the valve.
From the foregoing analysis, three failures produce results requiring further examination.
These results are:
(1) The erroneous lighting of the red position indication light when the valve is closed, (2) improba-ble but possible opening of the valve, and (3) loss of both position indication lights.
3.
JUSTIFICATION FOR INTERIM OPERATION With the failure analysis conclusions indicated above it is judged that safe and reliable operation can be expected for the following reasons.
After a safety injection' actuation any erroneous indication of an ECCS flowpath alignment valve, or the flowpath redundant valve would be found and corrected during the emergency procedure check of safeguards automa-tic component actuations.
For example when an operator is making his check of safeguards equipment and finds ECCS alignment valve (M0V-CH-310) indicating open or with no indication he would take the following actions.
One, he would operate MOV-CH-310, control switch, to the closed position. Two, he would verify that the redundant ECCS alignment valve MOV-CH-289 is closed and third, that no flow exists in that header. Addressing the possibility that MOV-CH-310 would open, it l
is also judged that this problem would be identified in the same manner as dual or no indication. This would be a safe mode of operation because the redundant ECCS flowpath alignment valve M0V-CH-289 which is outside containment and not subject to submergence would be closed.
Procedures that would be used are in BVPS Operating Manual, Chapter.53, i
1 Section 4, Emergency Procedures. Chapter 53, Section 2, " Precautions and Limitations" have been changed to reflect that in cases of containment flooding M0V-CH-310 may become submerged and that the j
associated limit switches may give an erroneous valve position indication when submerged.
4.
RESOLUTION OF QUALIFICATION DEFICIENCY To prevent submergence from having any possibility of causing a spurious opening of the valve, a modification will be made at the motor control l
center. Relays will be installed to remove power from any control power 7665A
~
.\\
feeds to the limit and torque switches whenever the valve is closed.
Position indication will be retained.
i Design work has been started and the modification will be installed at the first outage following delivery in which plant condition permits replacement, but no later than June 30, 1982.
l E
t i
l l
l I
=
k t
a} (,
=
m
=
E S0E C
y J,
2 c
E R
UG I
F wl_
N E
P "6,
O J, a<
?
=
\\
A \\s
}E
- G
'x nn ;;
e 1lll