ML20004F206
| ML20004F206 | |
| Person / Time | |
|---|---|
| Site: | Millstone  |
| Issue date: | 06/05/1981 |
| From: | Crutchfield D Office of Nuclear Reactor Regulation |
| To: | Counsil W NORTHEAST NUCLEAR ENERGY CO. |
| References | |
| TASK-06-10.A, TASK-6-10.A, TASK-RR LSO5-81-06-026, LSO5-81-6-26, NUDOCS 8106160612 | |
| Download: ML20004F206 (15) | |
Text
fE%
0 UNITED STATES
- 'y 4
{
g NUCLEAR REGULATORY COidMISSION
. j WASHINGTON, D. C. 20555 (v;
0, *.$
t June 5, 1981 Docket No. 50-245 o
c.
2... :
h 3,
JUN15 IS8Ih V Mr. W. G. Counsil, Vice President i
Nuclear Engineering and Operations
'~
8.a.
Northeast Nuclear Energy Company
- %%s 4 g/
P. O. Box 270 Hartford, Connecticut 06101 4,,,--.; y 6
Dear Mr. Counsil:
RE: SEP TOPIC VI-10.A TESTING 0F REACTOR TRIP SYSTEMS AND ENGINEERED SAFETY FEATURES (MILLSTONE NUCLEAR POWER STATION)
Enclosed is a copy of our contractor's draft evaluation of SEP Topic VI-10.A for the Millstone Nuclear Pov er Station. This assessment compares your facil-ity, at described in Docket No. 50-245, with the criteria currently used by the regulatory staff #or licensing new facilities. Please inform us within 30 days if your as-built facility differs from the licensing basis assumed in our assessment.
As a part of your response, please provide a technical description of how your plant satisfies the requirements of IEEE Std. 338-1975 and General Design Cri-terion 21 for each of the deviations noted on pages 5, 7, 8, 9 and 11 of the enclosed report.
This evaluation will be a basic input to the staff's safety evaluation report for this topic unless you identify changes needed to reflect the as-built con-ditions at your facility. This assessment may be revised in the future if your facility design is changed or if NRC criteria relating to this subject are modified before the integrated assessment is completed.
In future correspondence regarding this topic, please refer to the topic number in your cover letter.
Sincerely, M
s Dennis M. Crutchfield, ief Operating Reactors Branch No. 5 Division of Licensing Y
Enclosure:
As stated g
$[#f cc w/ enclosure: See next page
^
sift osa asE &c-(27) y 8196160612
Mr. W. G. Counsil CC William H. Cuddy, Esquire Connecticut Energy Agency Day, Berry & Howard ATTN: Assistant Director Counselors at Law Research and Policy One Constitution Plaza Development Hartford, Connecticut 06103 Department of Planning and Energy Policy Natural Resources Defense Council 20 Grand Street 91715th Street, N. W.
Hartford, Connecticut 06106 Washington, D. C.
20005 Director, Criteria and Standards Division Northeast Nuclear Energy Company Office of Radiation Programs ATTN: Superintendent (ANR-460)
Millstone Plant U. S. Environmental Protection P. O. Box 128 Agency Waterford, Connecticut 06385 Washington, D. C.
20460 Mr. James R. Hinnelwright U. S. Environmental Protection Northeast Utilities Service Company
. Agency P. O. Box 270 Region I Office Hartford, Connecticut 06101 ATTN: EIS C0ORDINATOR JFK Federal Building Resident Inspector Boston, Massachusetts 02203 c/o U. 5. NRC P. O. Box Drawer KK Niantic, Connecti' cut 06357 Waterford Public Library Rope Ferry Road, Route 156 Waterford, Connecticut 06385 First Selectman of the Town of Waterford i
l Hall of Records 200 Boston Post Road Waterford, Connecticut 06385 Jchn F. Opeka Systecs Superintender.t Northeast Utilities Strvice Conpany P. O. Box 270 Hartford, Connecticut 16101 O
v-,
w.
.rv-
w--.
e-
--i.-e em-
-e+--
e.--
--e-
0400J SEP TECHNICAL EVALUATION TOPIC VI-10.A TESTING OF REACTOR TRIP SYSTEM AND ENGINEERED SAFETY FEATURES MILLSTONE NUCLEAR POWER STATION, UNIT NO. I i
Docket No. 50-245 i
1 May 1981 h
I r
I Draft 5-11-81 l
i,
CONTENTS
1.0 INTRODUCTION
1 2.0 CRITERIA...........................................................
1 4
3.0 RE. ACTOR TRIP SYSTEM................................................
4 3.1 Descriptio.i...................................................
3.2 Evaluation.................................................... 5 4.0 STANDBY LIQUID CONTROL SYSTEM...................................... 8 ~
4.1 Description................................................... 8 4.2 Evaluation.................................................... 8 5.0
SUMMARY
12
6.0 REFERENCES
12 TABLES 1.
Comparisons of Millstone l' nit 1 RPS instrument surveillance requirements with BWR Standard Technical Specification requirements....................................................... 6 2.
Standby liquid control system and associated system surveillance re q u i r eme n t s.....................................................
10 11 9
, - - - - -.. ~ _ - -. - - -.
,..--,v
,.n--.n-...,
--.,,.-~e.-
,.. - -. ~
t SEP TECHNICAL EVALUATION l
TOPIC VI-10.A TESTING OF REACTOR TRIP SYSTEM AND ENGINEERED SAFETY FEATURES MILLSTONE NUCLEAR POWER STATION, UNIT NO. l
1.0 INTRODUCTION
The objective of this review is to determine if all Reactor Trip System (RTS) components, including pumps and valves, are included in component and system tests, if the scope and frequency of periodic testing is adequate, and if the test program meets current licensing criteria. The review will also address these same matters with respect to the Standby Liquid Control System (SLCS) as a typical example of all Engineered Safety Feature (ESF) systems.
2.0 CRITERIA General Design Criterion 21 (GDC 21), " Protection System Reliability and Testability," states, in part, that:
The protection system shall be designed to permit periodic testing of its functioning when the reactor is in operation, including a capability to te3t channels independently to determine failure and i
losses of redundancy that may have occurred.
1 I
l Regulatory Guide 1.22. " Periodic Testing of the Protection System Actuation Functions," states, in Section 0.1.s, that:
The periodic tests should duplicate, as closely as practicable, the performance that is required of the actuation devices in the event of.I an accident; and further, in Section 0.4, states that:
l When actuated equipment is not ~ tested during reactor operation, it l
should be shown that:
e 1
.-r- -, -. -
....y,,
_m__.y
a.
There is no practicable system design that would permit operation
~
of the actuated equipment without adversely affecting the safety or operability of the plant, b.
The probability that the protection system will fail to initiate the operation of the actuated equipment is, and can be maintained, acceptably low without testing the actuated equipment during reactor operation, and c.
The actuated equipment can be routinely tasted when the reactor
~
is shut down.2 Regulatory Guide 1.118, " Periodic Testing of Electric Power and Protection Systems," Section C-12, requires, in part, that:
Safety system response-time measurements shall be made periodically to verify the overall response time (assumed in the safety analysis of the plant) of all portions of the system from and including the sensor to operation of the actuator. The response-time test shall include as c
much of each saf.ety system, from sensor input to actuated equipment, as possible in a single test. Where the entire set of equipment from sensor to actuated equipment cannot be tested at once, verification of system response time may be accomplished by measuring the response times of discrete portions of the system and showing that the sum of i
the response times of all portions is equal to or less than the overall system requirement.3 l
IEEE Standard 338-1975, " Periodic Testing of Nuclear Power Generating l
Station Class lE Power and Protection Systems," states, in Section 3, that:
l Overlap testing consists of channel, train, or load-group verification l
by performing individual tests on the various components and subsystems of the. channel, train, or load group. The individual component and subsystem tests shall check. parts of adjacent subsystems, such that the entire channel, train or load group will be verified by testing of individual components or subsystems.4 2
~
r
_. ~ _
m In addition, the following criteria are applicable to the ESF: General Design Criterion 40 (GOC 40), " Testing of Containment Heat Removal System,"
states that:
. The containment heat removal system shall be designed to permit appro-priate periodic pressure and functional testing to assure:
a.
The structural and leaktight integrity of its components.
b.
The operability and performance of the active components of the
- system, c.
The operability of the system as a whole and under conditions as close to the design as practical, the performance of the full operational sequence that brings the system into operation, including operation of applicable portions of the protection systems, the transfer between normal and emergency power sources, and the operation of the associated cooling water system.
GDC 38, " Testing of Emergency Core Cooling System," GDC 43, " Testing of Containment Atmosphere Cleanup Systems and GDC 46, " Testing of Cooling
' Water System," are similar.
Standard Review Pla1, Section 7.3, Appendix A, "Use of IEEE f
Standard 279 in the Rev1t.v of the ESFAS and Instrumentation and Controls of Essential Auxiliary Supporting Systems," states, in Section ll.b, that:
~
[.
Periodic testing should duplicate, as closely as practical, the inte-grated performance required from the ESFAS, ESF systems, and their I
essential auxiliary supporting systems.
If such a " system level" test f
can be performed only during shutdown, the testing done during power
(
I operation must be reviewed in detail. Check that " overlapping" tests do, in fact, overlap from one test segment to another. For example, closing a circuit breaker with the manual breaker control switch may not be adequate to test the ability of the ESFAS to close the i-breaker.0 i
it a
3.0 REACTOR TRIP SYSTEM (RTS) 3.1 Description. The system is made up of two independent logic channels, each having subchannels of tripping devices. Each subchannel has an input from at least one independent sensor, monitoring each of the crit-ical pa'rameters.
The output of each pair of subchannels is combined in a one-out-of-two.
logic: that is, an input in either one or both of the independent subchan-nels will produce a logic channel trip.,8oth of the other two subchannels i
are likewise combined in a one-out-of-two logic, independent of the first logic channel. The outputs of the.two logic channels are combined in two-out-of-two arrangement so that they must be in agreement to initiate a scram. An off-limit signal in one of the two subchannels in one of the logic channels must be confirmed by any other off-limit signal in one of the two subchannels of the remaining logic channel to provide a reactor scram.
k During normal operation, all vital sensor and trip contracts are closed, and all sensor relays are operated energized. The control rod pilot scram valve solenoids are energized, and instrument air pressure is applied to all scram valves. When a trip point is reached in any of the monitored parameters, a contact opens, de-energizing a relay which controls a contact in one of the two subchannels. The opening of a subchannel con-
)
tact de-eneigizes a scram relay which opens a contact in the power supply to the pilot scram valve solenoids supplied by its logic channel. To this point, only oae-half the events required to produce a reactor scram have l
occurred. Unless the pilot scram solenoids supplied by..the other logic l
channel are de-energized, instrument air pressure will, continue to act on f
the scram valves and operation can continue. Once a single channel trip is l
initiated, contacts in that scram relay circuit open and keep that circuit i
de-energized until the initiating parameter has returned within operating I
limits and the reset switch is actuated manually.
It should be noted that
)
each control rod has individual pilot scram solenoids for each channel and an individual air-operated scram valve. A normally-closed swi?ch is pro-f vided in each logic channel pilot scram solenoid circuit. This allows each 4
1
.,..-.,,,.,,.-----...,--,_._.._,..-,.__.,....,,,,,,...,..--.._--..._..~-,.,..e
.._.___~-r__...-,,
rod to be manually scrammed (tested) by opening both logic channel switches and de-energizing the pilot scram solenoids. This type of test would pro-vide the required overlapping test of the RTS.
The parameters (sensors) which are required to initiate reactor scram are lis'ted in Table 1.
However, the only instruments included in this table are those required to prevent exceeding the fuel cladding integrity limits during normal operation or operational transients. These are described in Table VII-l of the plant FSAR and listed in Tables 4.1.1 and 4.1.2 of the Millstone Nuclear Power Station Technical Specifications for Unit 1.
For example, the condenser low-vacuum sensors are connected to the RPS trip system and can initiate a scram.
~
3.2 Evaluation. The Millstone 1 RTS is designed to allow overlap-ping tests from actuating device through the control rods. The design allows individual channel tests from sensors though pilot scram valves while the reactor is in operation and the overlapping rod scram tests during refueling. Although one or more rod scram valves may fail during reactor operation, the channel tests will verify that no common mcde fail-ure will occur and, sufficient pilot valves will operate to shut ocwn the reactor.
Table i shows the present Millstone 1 RTS instrument surveillance requirements, including frequency. The table also shows the current licen-sing requirements for General Electric boiling water reactors as listed in the Standard Technical Specifications. The tests shown only involve single channelstesting(half-scram).
It should be noted that Techriical Specification Table 4.1.2 does not require channel calibration for main steam-line isolation valve closure or j
turbine stop valve closure parameters, although the Millstone Technical Specification requirement for Unit 1 in Section 2.1.2.8 requires that a 10%
valve closure initiate scram. Additionally the time delay of 260 msec for the Turbine Control Valve Fast Closure is not verified.
l 5
TABLE 1.
COMPARISONSgFMILLSTONEUNIT1RPSINSTRUMENTSURVEILLANCE REQUIREMENTS WITH BWR STANDARD TECHNICAL SPECIFICATION REQUIREMENTS (STS)7 Channel Channe}
Functiogal Channel c
Check Test Calibration Millstone Millstone Millstone Instrument Channel Unit 1 STS Unit 1 STS Unit 1 STS _
High reactor pressure NA NA Q*
M Q
R, High drywell pressure NA NA Q*
M Q
Q Low reactor water D
D Q*
M Q
R level High water level in NA NA Q*
M Q
R scram discharge Condenser low vacuum NA NA Q*d NA R
NA Main steam-line iso-NA NA Q*
M NA R
lation valve closure Turbine stop valves NA NA Q*
M NA R
closure Manual scram NA NA Q*
M NA NA Turbine control valve NA NA Q*
M NA Q
fast closure Average power range NA S
Q sue Q
W/SA monitor (APRM) flow biased high flux APRM-reduced high flux NA S
SUE sue Q
W/SA Intermediate range NA S
Sue Sue R
R monitor (IRM)
High steam line S
W Q*
W Q
R radiation Reactor mode switch NA NA R
R NA NA in shutdown position 6
..=
- - -. : ^~~~T m zr' -..... _... - --
-.... g
TABLE 1.
(continued)
FREQUENCY NOTATION Notation Frequency Notation Frequency S
At least once per R
At least once per refueling 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> outage (18 months) 0 At least once per NA Not applicable 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> SA At least once per 184 days W
At least once per SU Prior to start up 7 days M
At least once per 50 Prior to shutdown 31 days Q
At least once per Q*
Based on unsafe failure rate 3 months data and reliability analysis.
Not less than one-month or greater than three months.
A qualitative determination of acceptable operability by observation of a.
channel behavior during operation. This determination shall include, where possible, comparison of the channel with other independent channels measuring the same variable.
b.
Injec+. ion 'of a simulated signal into the channel to verify its proper -
response including, where applicable, alarm ana/or trip initiating action.
c.
Adjustment of channel output such that it responds, with acceptable range and accuracy, to known values of the parameter which the channel measures. Calibration shall encompass the entire channel, including equip-ment actuation, alarm, or trip.
d.
Consists of injecting a simulated electrical signal into the measurement channel.
e.
Maximum test frequency is once per week.
The Standard Technical Specifications for General Electric boiling water reactors (page 3/4 3-1, paragraph 4.3.1.2) require the logic system function test and simulated automatic operation at least every 18 months.
Available information indicates that the overlapping system test is not performed at llillstone, Unit 1.
7 a
d As can be seen in Table I the following channels are not subjected to a channel check as frequenty as required for present-day licensing:
APRM--Flow biased high flux APRM--Reduced high Flux IRM The following channels are not subjected to a channel functional test as frequenty as required for present-day licensing:
High Reactor Pressure High Orywell Pressure Low Reactor Water Level High Water level in scram discharge Main Steam Line Isolation Valve Closure Turbine Stop Valves Closure y
Manual Scram Turbine Control Valves Fast Closure
~
APRM--Flow biased high flux High Steam Line Radiation The following channels are not calibrated at least as frequently as required for present-day licensing:
APRM--Flow biased high flux APRM--Reduced high flux Main Steam Line isolation valve closure Turbine Control Valve Fast Closure Turbine Stop Valves Closure i
I In Section 3.1 of the Millstone 1 Technical Specifications, 100 milliseconds is stated as the required limit to the response time between any channel trip and the de-energization of the scram solenoid relay. Response time testing to verify that the channel response time does not exceed this requirement is not in evidence in the Technical Specifications.
8 g,
,m,
=,--9
-w--w-m y
- ---+-
w r
4.0 STM.EY :.*CUID CONTROL SYSTEM 4.1
- escri:. tion. The standby liquid control sytem is designed to ir.scrt i s;;ic pentaborate (or equivalent poison) solution to render and 3in:2in tr.e reactor subcritical even when the control rods are all fully
'I
.ith;r:an. The equipment consists of an unpressurized solution storage a pair of positive displacement pumps, either of which has full
- tick,
- city to preform the system function, two explosive actuated shear plug
.21.cs, a poisen sparger ring and associated valves, piping and instrumen-
- ucn. A co plete description is in Section VI-7.2 of the plant FSAR.
E 1 y
Me storage tank is heated to prevent particulate formation. The etser.arge of each pump is protected by a pressure relief valve that H
Oistnarges back to the storage tank. Pilot light indication of circuit 4(
continiuty for the explosive valves is provided. A single key controlled 7
s.tten will start a pump and open associated valves. Both sets of valves
[
anc pu ps are not operated simultaneously, however, the valves for both
,it ps.:s may be open. A test tank and a supply of demineralized water are a3 provicec for testing.
gd, Eg The FSAR indicates that testing is done in two parts. One part determines the ability of the pump to develop flow and suction from the Q
storage tank. The system is afterwards flushed to prevent boron bh-pre:1pitation. Another test uses demineralized water to show that water
[]Yg can e,e celivered into the reactor vessel. This test requires replacement Of tee esplosive charges in the shear plug valves.
b,h E
4.2 Evaluation. Table 2 shows the current testing requirements for 4
t*e standby liquid control system and associated systems'. The following b
s.rietilence is not done at least as frequently as required for present day lite stng:
imy M
g verification of the continuity of the explosive charges.
Valve position and that they are not locked, sealed or otherwise i
se: area, d
! m1 l$g-y4 w
i Pc..
9 l 7f"
'wq 5
!7,*7~;F.
~
TABLE 2.
STANDBY I.IQUID CONTROL SYSTEM SURVEILLANCE REQUIREMENTS Frequency Millstone Surveillance Requirements Unit 1 STS 1..' Solution temperature within limits.
Da 0
2.
Solution Volu.ae is greater than specified.
Ob 0
3.
Heat traced pump suction piping is greater than N/A D
or equal to /00F.
4.
Start both pumps and recirculate demineralized Mc M
water to the test tank.
M 5.
Verify the continuity of the explosive charges.
6.
Solution chemical analysis.
M/M M/M M
7.
Verify valve position and that they are not locked, sealed or otherwise secured.
8.
Initiating one loop using demineralized water R
R and replacement of the explosive charge.
9.
Ver,1fy minimum flow requirement against reactor M
R
, vessel head pressure.
- 10. Demonstrate religf valve setpoint and that it Rd R
does not operate during recirculation test to the test tank.
R/M
- 11. Verify piping from the storage tank to the reactor vessel is not blocked.
R
- 12. Demonstrate that the storage tank heaters are operable.
a.
Minimum temperature is not specified.
b.
Minimum volume is not specified.
c.
Flow rate required to be 32 gpm while the FSAR design' requires 40 gpm.
The technical specifications do not require testing of both pump loops.
Pressure not specific. A second requirement 4.4.A.2b recirculates solution from and to the storage tank at least once in 18 months for both systems.
d.
Non-operation during recirculation test is not required.
h 10
,.m-
--v,-
y_--
e
y---
Verification that pump suction piping is not blocked.
Demonstration that the storage tank heaters are operable.
Millstone 1 does not have heat traced piping in the Standby Liquid Control System, therefore this requirement is not applicable.
The Millstone 1 technical Specifications do not agree with the present standard technical specifications further in ; hat:
1.
Theminimumvolumeofsolution(isnotspecified, 2.
The minimum solution temperature is not specified, 3.
The relief valves are not verified to not operate under normal system operating pressure, and 4.
Both pump loops are not specifically tested monthly (Item 4).
One loop could be tested all the time while the other loop is not tested.
Further, it is apparent that Millstone 1 has only one heater in the solution storage tank, where as present requirements are for two.
l l
l I
11
.-m._
--r_.-
5.0
SUMMARY
~
The Technical Specifications for Millstone Unit I were compared with l
the Standard Technical Specifications fo current Boiling Water Reactor
~~
-Licensin It was found that, for the reactor trip system, three signals v..---i..r..:.. &, bjected to a channel check, ten signals are not subjected to a are not su ghannel functional _ test. and five cnannels are not calibrated as frequently a's required in the standard technical specifications.
(See Section 3.2.)
Additionally, the channel response time between channel trip and the de-energization of the scram relay is not required to be tested.
For the Standby Liquid Control System, selected as typical of ESF systems, surveillance requirements were less frequent (or non-existent) than required in the standard technical specifications in four requirements.
Four additional requirements do not conform with the standard technical specification while the frequency of surveillance does.
(See Section 4.2.)
6.0 REFERENCES
I 4
1.
Generil Design Criterion 21, " Protection System Reliability and Test-ability," of Appendix A. " General Design Criteria of Nuclear Power Plants," 10 CFR Part 50, " Domestic Licensing of Production and Utili-zation Facilities."
2.
Regulatory Guide 1.22, " Periodic Testing of the Protection System Actuation Functions."
3.
Regulatory Guide 1.118, " Periodic Testing of Electric Power and Pro-j tection Systems."
4.
IEEE Standard 338-1975, " Periodic Testing of Nuclear Power Generating Station Class lE Power and Protection Systems."
5.
General Design Criterion 40, " Testing of Containment Heat Removal Systems," of Appendix A, " General Design Criteria of Nuclear Power Plants," 10 CFR Part 50, " Domestic Licensing of Production and Utili-f zation Facilities."
6.
Nuclear Regulatory Comission Standard Review Plan, Section 7.3, Appendix A, "Use of IEEE Standard 279 in the Review of the ESFAS %.
Instrumentation and Controls of Essential Auxiliary Supporting Systems."
\\
l 12 i
.er
- - - ~.
_,---,--..-.-----,...,n.
,--.,----..,n
7.
Standard Technical Specifications for General Electric Boiling Water Reactors (BWRs), NUREG-0123, Revision 2 Fall 1980.
8.
Millstone Point Nuclear Power' Station-Unit No.1,." Final Safety.
Analysis Report," Amendment 5, dated March 14, 1968.
9.
Technical Specifications and Basas for Millstone Nuclear Power Flant Unit 1, Appendix A, to Provisional Operating License DPR-21, Amendments 1 through 45, dated December 1977.
O e
I
)
?
2 13 y. __..
.-