ML19354C417
| ML19354C417 | |
| Person / Time | |
|---|---|
| Site: | Davis Besse  |
| Issue date: | 01/24/1981 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML19345E768 | List: |
| References | |
| NUDOCS 8102060074 | |
| Download: ML19354C417 (7) | |
Text
l 0
&poemjo,,
UNITED STATES NUCLEAR REGULATORY COMMISSION
.?
a wAsmuoTow. o. c.2 ossa j
S
,/
SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION SUPPORTING AMEN 0 MENT NO. 36 TO FACILITY OPERATING LICENSE NO. NPF -3 THE TOLEDO EDISON COMPANY AND THE CLEVELAND ELECTRIC ILLUMINATING COMPANY DAVIS-BESSE NUCLEAR POWER STATION. UNIT NO. 1 DOCKET NO. 50-346 1.0 Introduction By letter dated January 5,1981, the Toledo Edison Company (TECo or the licensee) proposed an amendment to the Davis-Besse. Unit No.1 operating license that would permit the plant to use a manual switchover of the Emergency Core Cooling System (ECCS) pumps from the Borated Water StorageiTank (BWST) to the erergency sump during a loss of coolant accident (LOCA) after the BWST reaches a low level.
The plant was previously licensed to require an automatic switchover feature. The low level in the BWST that initiated the switchover was referred to as a Safety Features Actuation System (SFAS) Incident Level 5.
The preposed amendment arose out of an event at the Davis-Besse plant on December 5,1980, in which inadvertent actuation of the SFAS occurred with an automatic alignment of the ECCS pumps to a dry sump.
(The Containment Spray pumps ' suction also lined up to the sump, but the SFAS actuation was not complete and these puras did not start).
The potential result of the inadvertent transfer of the suction to the sump is damage to the pumos and the loss of their safety function.
Several discussions were held with TECo in which the circumstances surrounding the event were discussed. Our primary concern was that the Davis-Besse SFAS design appeared prone to premature transfer of the pump suction during a LOCA. During the discussions, we also informed TECo that we were reviewing the current staff position that requires the transfer to be accomplished automatically. In response to our discussions, TECo proposed in iJts January 5,1981, submittal that the plant be allowed to rely on manual operator action to effect
- the transfer. This submittal was supplemented and revised in letters dated January 9,115,19, and 22,1981. He have reviewed the proposed amendment as an interim solution to our concern that premature switchover can occur during a LOCA pending our review of the staf f position regarding automatic transfer. Our evaluation of this amendment follows.
g 02060 C
. 2.0 Electrical Systems
2.1 Background
At the time of the December 5,1980 event, the design of the Engineered Safety Feature Actuation System included a fully automatic transfer to the Recirculation Mode for the ECCS and containment spray systems on low-low level in the BWST. The design includes four safety-related water level instrument channels for the Borated Water Storage Tank. Each of these four in.strument sensing channels provides input to each of four logic channels.
If logic Channels #1 AND #3 c
are tripped, Train A of the safety systems is actuated (i.e., transferred to the Recirculation Mode). Similarly, when logic Channels #2 AND
- 4 are tripped, Train B is automatically transferred. During the December 5 event, instrument sensing Channels #1 and 3 tripped and therefore caused both trains of ECCS and containment spray to be spuriously transferred to the Recirculation Mode.
2.2 Evaluation The licensee's reytsed proposal ist to preclude spurious automatic transfer by changing the actuation (by the BWST level instruments) to a semi-automatic function (i.e., a "pennissive" followed by a manual transfer to the Recirculation Mode). The electrical changes are associated primarily with control circuits for the BWST outlet yalves and Containment Emergency Sump valves.
The present BWST and Sump valve control circuits are basically relatively standard MOV (motor-operated-valve) control schemes with three special features. The three special features are: first, when Incident Level
- 2 (ECCS-high pressure injection), #3 (ECCS-low pressure injection),
I or #4 (Containment Spray) is actuated, various contacts are actuated
~
to assure that the BWST valves are open and the sump valves are closed.
Second, when Incident Level #5 (Automatic Transfer to Recirculation Mode) is actuated (by BWST low-low level), various contacts are actuated to open the sump valve and to simultaneously close the BWST valve.
Third, for operational (i.e., non-safety) considerations, three sets of valve position limit switches are used as interlocks to prevent draining the BWST to the sump by inadvertent use of the manual control switches. This set of interlocks functions by not allowing the BWST valve to be opened (except when the sump valve is fully closed), by forcing the BWST vilve closed (except when the sump valve is fully closed) and by not allowing the sump vilve to be opened (except when the BWST valve is fully closed).
It is to be noted that the present automatic Level 5 contacts prevail over the Level 2, 3, 4 contacts and prevail over the operational interlock.
e The licensee's revised proposal has three parts. First, in the BWST valve closing controls, the Level' 5 contacts (which bypass the Level 2, 3, 4 contacts and the manual close contacts) are to be removed. Second, in the sump valve opening controls, the Level 5 contacts (which bypass the Level 2, 3, 4 contacts, bypass the interlock-contacts-from the-BWST-velve-position-1-imit switch, and bypass the manual open contacts) will be rewired so as to bypass only the interlock contacts. Third, the input to the annunciator will be changed from being actuated when any one of the four BWST level channels (i.e., bistables) is tripped at low-low level to being actuated when any one of the four logic channels is tripped on BWST low-low level. Thus, the annunciator provides some indirect indication regarding the status of SFAS Incident Level #5 (i.e., when the "pemissive" for manual transfer is active).
Operationally, the revised scheme will function as follows: When the BWST instrumentation system generates an Incident Level 5 actuation, the " permissive" will bypass the interlock in the sump opening controls and the annunciator should alert the operator. The operator would manually bypass the Incident Level 2, 3, 4 signals to the BWST/ Sump valve controls. When the Level 5 pemissive is active, the operator can manually open the sump valves. As the sump valves leave the fully-closed position, another portion of the interlock causes the BWST valves to start closing and thereby complete the transfer.
In our review we confinned that the proposed design will 'in fact disable the automatic transfer to Recirculation Mode.
If tso BWST level sensing channels are tripped on low-low level, the proposed automatic action is only to generate the " permissive" (i.e., bypass an interlock) and to alert the operator. Manual action is then required to open either train's sump valve or to close either BWST valve. Therefore, the primary objective of preventing a spurious Level 5 actuation from causing the automatic transfer of either train to the Recirculation Mode is met.
j We reviewed the proposed design to determine if a single failure could cause unacceptable performance. We'found that single failures could prevent generating the " permissive" for one ECCS train, thus preventing manual transfer of that train to the Recirculation Mode. These single failures can be considered no worse than other single failures that can prevent one of the two redundant ECCS trains from functioning. We found no single failure that could incapacitate both trains; therefore performance of the safety functions is reasonably assured.
i i
We reviewed the annunciator scheme provided to alert the operator of the status of the permissive. Level 5 Actuation (i.e., the permissive),
for Train "A" is generated electrically when both logic #1 AND logic #3 are tripped; for Train "B", when logic #2 AND logic #4 are tripped. The licensee's proposal is that the a single annunciator is to be triggered when any of the four BWST level logic modules is tripped. A more direct (accurate) indication on a per-train basis of the permissive-status is desirable. However, the annunciator itself l
O
-%+
,w s.----
e m
,m
. ~,-,. -,,
r r,
,...,..,,,,,-,m,-
.,y
,.,-,~,.ry-,
r e
-9
-+- -
4 y
4-is not qualified as " safety-related" and thus vulnerable to single failures also. The procedures require the coerator to attempt the transfer to Recirculation based on the level indicators showing 8 feet or less and to repeat the attempt periodically until successful, independent of the status of the permissive. The annunciator is, therefore,, considered a non-essential extra feature of this design.
As such, the annunciator scheme regarding the pemissive is electrically acceptable.
We reviewed the design of the operational (i.e., non-safety related) interlock in the manual control circuits to determine if this interlock would cause an adverse interaction with the proposed manual safety actions. Previously this interlock would have been bypassed by the automatic safety contacts and the proposed design partially eliminates this bypass. In addition, this anti-drainage protection feature is very tightly interlocked, i.e., three different sets of contacts. We confinned that the interlock does not interfere with the manual transfer to the sump. We note that the proposed design now depends upon this interlock to automatically close the BWST valve when the sump valve is manually opened. For this consideration, this aspect of the interlock must be classiffed as " safety-related" (in' stead of its previous non-safety related description). The licensee has stated that the installed wiring for this interlock satisfies the separation criteria for safety-related equipment. The licensee has constitted to propose revised Technical Specifications to require periodic functional testing of this interlock.
The licensee has committed to testing the BWST and Sump valve actions prior to plant operations at power. We note also that not just two but all four BWST level instruments, indicators, logic channels, etc. will be retained as safety-related equipment under Operability requirements and periodic Surveillance requirements in the Technical Specifications.
2.3 Conclusion Based upon the information provided by the licensee as discussed above, we conclude that the proposed electrical design changes will prevent l
a spurious 1.evel 5 Safety Actuation from causing an6 automatic transfer of the ECCS and Containment Spray systems to the Recirculation Mode and will provide the means of allowing operator action to effect the transfer.
In this respect, this is one acceptable method of implementing this functional change. Our acceptance is subject to.the Office of Inspection and Enforcement review of the test procedures and acceptance of the test results. We note this modification does not alter the conformance of the t
SFAS_ system design.with respect.to_IEEE 279.197.1_.
l
~#
w-
l
\\
5-We find that the previously non-safety related interlock (provided to l
prevent inadvertently manually having the BWST and Sump valves open t
simultaneously) must be re-classified as a safety-related feature.
As such, this interlock must be covered by Technical Specifications that require peiiodic functional testing. The licensee has agreed to propose these Technical Specification changes within 30 days of our issuance of this amendment.
3.0 BWST Water Voltane Evaluation In submittals of January 15, 1981 and January 22, 1981 the licensee discussed the adequacy of the Borated Water Storage Tank (BWST)
In the discussion capacity at Davis-Besse to meet ECCS requirements.
the licensee has proposed to provide a Technical Specification for 482,728 gallons (448.3 inches) and will initiate a minimum volume of operator action to effect a nanual switchover from the injection mode of ECCS operation to the recirculation mode at an indicated BWST volume of 103,392 gallons (96 inches, alerted by an operator designated to monitor BWST level and backed up by a BWST level alarm).
Considering uncertainties associated with the BWST level instrument-ation, the above specifications assure that 345,000 gallons of water In the January 22, will be injected prior to initiation of switchover.
340,000 gallons of 1981 submittal the licensee has identified that injected water would provide greater than two feet of NPSH margin.
We conclude that adequate injection capacity is provided to meet NPSH requirements.
At the 96-inch level the operator is alerted to begin switchover to the recirculation mode. Accounting for level instrument un-certainty (15.65 inches; 16,680 gallons), and an unavailable volume at the bottom of the BWST (40,000 gallons), there are at least 46,532.' gallons of water available to be pianped while the operator Conservatively assuming a performs the switciiover procedures. valve stroke time of 90 seconds, and an av 0.7 during the time of valve repositioning, with the two ECCS trains switched sequentially, this volume is sufficient to provide the operator about 41/2 minutes to complete the switchover pro-The adequacy of cedures from the time he is alerted to consnence.
this tire period is discussed in Section 4.1.
s
l 4.0 procedures 4.1 Evaluation We reviewed this amendment to evaluate if the operator can be safely relied on to perfom the required manual function as an interin solution to the problem. We require that there be an assigned operator, knowledgeable of the required actions, and physically present to perfom the necessary tasks. The licensee has connitted to assign this responsibility to a dedicated operator already assigned to secure reactor coolant pump operation upon SFAS initiation. This assignment will ensure the operator is physically present before he is needed for ECCS pump suction switchover.
The licensee has also committed to training all control room personnel after system modifications are completed and prior to being ass 1gned the task.
Second, we require that the instrumentation and procedures clearly provide the necessary guidance for the operator to know when and what operator actions are required and that these actions can be carried out as described by the procedures. The level instruments used to evaluate when operator action is required are on the same panel as the operator controls and will
'ee marked to indicate the procedural setpoint. The revised procedures provide clear and measurable conditions that the operator can recognize as requiring action and clear instructions as to what action is requimd.
An indirect indication of the SFAS Incident Level 5 Pemissive status provides supplementary information to the operator.
Third, we require that there must be sufficient time allowed for operator action in the analyzed sequence of events. With the assignment of a i
dedicated operator, the proximity of indicators and controls, and the procedurally required operator actions, there has been enough time allowed for operator actions, specifically, greater than three minutes for two operator actions necessary to transfer one train of the ECCS system.
Finally, we require that operator errors of consission be considered and effects minimized. This will be accomplished by retaining the SFAS Incident Level 5 as a permissive. This pemissive will not allow the transfer of the ECCS and Containment Spray pumps' suction to the containment sump until the BWST is naarly empty. This will prevent early transfer by the operator.
4.2 Conclusion
~
Based on the Infomation provided by the licensee and the connitments made by the ifcensee, we conclude that the proposed reliance on the operator' to transfer the suction of the ECCS and Containment Spray pumps from the l
BWST to the containment sump is acceptable on an interim basis.
The staff is currently reviewing its position on the acceptability of manual versus automatic safety evstems. A long term solution must be proposed that is consistent with the revised staff policy.
l
5.O Envimnmental Considerations We have determined that the amendment does not authorize a change in effluent types or total amounts nor an increase in power level and will not result in any significant enviromental impact.
Having made this determination, we have further concluded that the amanhent involves an action which is insignificant from the stand-point of environmental impact and, pursuant to 10 CFR 551.5(d)(4).
that an environmental impact statement or negative declarption and environmental impact appraisal need not be prepared in connection with the issuance of this amendment.
6.0 Conclusions We have concluded, based on the considerations discussed above.
l (1) because the amendment does not involve a significant in-that:
(
crease in the probability or consequences of accidents previously considered and does not involve a significant decrease in a safety i
margin, the emendment does not involve a significant hazards consider-l ation, (2) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, and (3) such activities will be conduc*4 in compliance with the Commission's regulations and the issuance of this amendment will not be inimical to the comon defense and security or to the
~~
health and safety of the public.
Januarv 24,.1931 l
l l
l
,m.-.-a r
-