ML20012D048

Responds to Generic Ltr 89-19 Re USI A-47, Safety Implications of Control Sys in Lwrs. Each Steam Generator Equipped w/three-element Feedwater Controller to Maintain Programmed Water Level as Function of Turbine Load

ML20012D048
Person / Time
Site:	Comanche Peak
Issue date:	03/19/1990
From:	Beck J TEXAS UTILITIES ELECTRIC CO. (TU ELECTRIC)
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
REF-GTECI-A-47, REF-GTECI-SY, TASK-A-47, TASK-OR GL-89-19, TXX-90106, NUDOCS 9003260389
Download: ML20012D048 (11)

Text

7- - x ,

u; .-

, c,, , , * ~-

Fq,. ._ c MM Log.=f TXX-90106-h d--

File # 10035 Ref. # 10CFR50.54(f) s 1UELECTRIC March 19, 1990 WHuem J. Cahut. Jr.

Execunvr Vke brMerit -

U. S. Nuclear Regulatory Commission

< Attn: Document Control Desk' Washington, D. C.' -20555

SUBJECT:

COMANCHE PEAK-STEAM ELECTRIC STATION (CPSES)

DOCKET NOS.,50-445 AND 50 446

-RESPONSE TO GENERIC LETTER 89-19 UNRESOLVED' SAFETY ISSUE A 47

" SAFETY IMPLICATION OF CONTROL SYSTEMS IN LWR NUCLEAR POWER PLANTS" Gentlemen:

As required by Generic Letter 89-19 of September 20, 1989, TU' Electric hereby.-

. reports that, as described in the attached evaluation, the applicable recommendations in enclosure 2 of .this generic letter have been implemented on Unit'I and are incorporated in the design criteria for Unit 2 which.is presently under construction.-

.In the course of the review TU Electric determined that the loss of safety related inverters 1~ ori2 would involve the coincidental' opening 'of the Main Feed Water. ,(MFW) control: valves in two loops-while the transient in section

'15.1.2 of. the FSAR is based on one MFW control valve in the fully open position. .. An analysis which indicates .that the conclusions of section,15.1.2 remain valid with two MFW control valves in the fully open position has been-y performed.

FSAR Section 15.1.2-and Question / Response 32.108 will be revised to reflect the new analysis by May- 31, 1990.

Sincerely, William J. Cahill, Jr. nl

-j By: r? -

D JoVn W. Beck 4 9003260389 DR 900319 Vice President.

p' ADOCK 05000445 JM PDC' U Nuclear Engineering

.JDR/grp

Attachments c - Mr. R. D. Martin, Region IV Resident Inspectors, CPSES (3) 400 North Olive Street LB. 81 Dallas, Texas 7520)

. . . . . . 1

n t. ,

AttachmentIl to TXX-90106-Page.1=of 1- '

UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION

'i o

'In the Matter of ) 'l

)-

, ' . Texas Utilities Electric Company ) Docket Nos. 50-445

) 50-446 (Comanche Peak, Steam Electric; )

Station, Units 1 & 2) )

i, AFFIDAVIT 1'

John W. Beck being duly sworn, hereby deposes and says that he'is ',

p Vice: President, Nuclear Engineering of TV Electric, the:1ead. Applicant herein: '

L that he is duly authorized to sign and file with the Nuclear Regulatory Commission this response to Generic ~ Letter 89-19: that-he is familiar with the ,

~ content thereof: and that-the matters' set forth therein are true-and correct L to the best of his knowledge. .information and belief.

l L

M  : :[ --

^

Jo(WW. Beck.

Vice President.

. Nuclear Engineering

, STATE OF TEXAS- ) -

l~ . )  !

l' COUNTY OF ) -

l Subscribed and sworn to before me, a Notary Public.. on this day of -'

1990.

Notary Public t

..' .= : . Attachment 2 to-TXX-90106' Page 1 of 9 -i 4 0 t

3 e

APPLICABILITY OF NRC GENERIC LETTER GL 89-19 RECOMMENDATIONS TO THE CPSES DESIGN I

s v

..9 t

l I6

.t l

4

'. . : LAttach2cnt 2 to-TXX 90106'

..- Page 2;of 9. ,-

TABLE OF-CONTENT

-APPLICABLE NRC GL 89-19 RECOMMENDATIONS CPSES PLANT SPECIFIC EVALUATION

1. Steam Generator Overfill Protection-

2. Steam Generator Level Control

3. Control and Protection System Interaction

4. - Loss of-Ventilation

, 5. Fire Effects

6. Technical Specification and-Plant Procedures-CONCLUSIONS TABLE 1 - LOSS OF POWER EFFECTS ON SG OVERFILL PROTECTION-

AND MFW CONTROL-SYSTEM TABLE 2 - PLANT TEST PROCEDURES FOR MFW ISOLATION CHANNELS SURVEILLANCES 6

I i

i

'~. Attach ent 2 to TXX 90106 .

Page 3 of 9- .

APPLICABLE NRC GL 89-19 RECOMMENDATIONS The NRC GL 89-19 addresses automatic steam generator-(SG) overfill protection provided to mitigate main feedwater (MFW) overfeed events resulting from main  ;

feedwater control system malfunctions due to common mode failures. The steam generator overfill protection system must isolate the MFW by closing the MFW isolation valves and tripping the MFW pumps. For Group I Westinghouse designed PWR plants, the overfill protection system is initiated on a steam generator high-high water level signal based on the 2-out-of-3 initiating logic. The steam generator high-high level signal, is safety grade, uses one-out-of three channels for both control and protection, and is acceptable provided that:

A. The overfill protection is sufficiently separated from the MFW control portion if:

it is not powered from the same power source it is not located in the same cabinet fire is not likely to affect both, the overfill protection and MFW l control loss of ventilation will not affect both systems.

B. Plant Technical Specification and surveillance procedures include:

provisions to periodically verify the operability of the overfill L

protection system l

channel check, calibration, and operational test, and set point verification j' -

appropriate LCO's.

CPSES PLANT SPECIFIC EVALUATION

1. Steam Generator Overf111 Protection The SG overfill protection initiates the closure of the MFW control and isolation valves, and trips the MFW pump turbines based on a 2-out-of-3 logic of high-high water level in any steam generator. This logic, processed by the Solid State Protection System (SSPS), provides two trains for actuation of MFW equipment. The MFW isolation and control valves have redundant Class 1E actuation, each controlled by one train of SSPS. which ensures MFW isolation when postulating a single failure. In addition, the non-Class IE MFW pump turbine hydraulic fluid trip solenoids are actuated by either train of the SSPS through appropriate electrical isolation.

This design meets the recommendation of GL 89-19. Enclosure 2. Item (2),

for Group I design for overfill protection.

. Attachosnt 2 to TXX-90106

'Page'4 of_9 .

2. Steam Generator Level Control Each SG is equipped with a three-element feedwater flow controller, which maintains a programmed water level as a function of turbine load.

The three-element feedwater controller regulates $he feedwater valve by continously comparing the feedwater flow signal, the water-level signal, the. programmed level signal, and the pressure-compensated steam flow signal. In addition, the main feedwater pump turbine speed is varied to-maintain a programmed pressure differential between the steam header and the-feed pump discharge header. Manual override of the feedwater control system is available at all times.

Some of the MFW control signals are derived from sensors which are part of the protection system. Where process parameter measurements for protection and control systems overlap, the CPSES design uses a common sensor.- This ensures that the system is controlled from the same measurement with which it is protected, and precludes any effects of sensor drift between control and protection functions. Electrical isolation and physical separation between _the control and protection is addressed in Item 3 below. The listing below shows the elements of the feedwater control system and identifies whether their-inputs are derived from control or~ protection channels:

a. Steam flow control channels compensated by steam pressure.

Two channels are provided with a selector switch on the control board,

b. Feedwater flow - control channels. Two channels are provided with a .

selector switch on the contro1' board.

c. SG level - protection channels. Two channels are provided with a selector switch on the control board. The source of one channel is a sensor used for SG overfill protection. The source of the other channel is a sensor used for SG low-low level protection which is based on a 2-out-of-4 logic in any SG. This second channel is always selected except when it is being tested or inoperable. In such a case, when the channel for overfill protection is selected for control, it's bistable is placed in the trip condition within one hour (FSAR Q/R 032.108 and operating procedure ABN 710A, Rev. 5),

d. Level program - protection channels, derived from the turbine impulse stage pressure,

e. Steam header pressure - control channel,

f. Feedwater header pressure - control channel.

g. MFW flow controller - control channel,

h. MFW pump turbine speed controller - control channel.

/

'I

'. Attachment 2 to TXX-90106-Page 5 of 9 .,-

3. Control and Protection System Interaction The protection and control systems use Westinghouse 7300 series hardware.~

The 7300 series design provides electrical independence between control and protection systems'in cases where the common sensor is used for both the protection and the control function by transmitting the sensor output

~

to the control system through an isolation device. The isolation device

~

is classified as.part'of the protection system and is located in the protection. system cabinet. The control system input is the output of the isolation device.- Due to this feature, no components are shared between control.and protection systems. They are either part of the protection system and located in the protection cabinets, or they are part of the control system and located in the control cabinets. The signals obtained through the isolation device for control or other non-safety functions are never returned to the protection racks.

The. physical separation and electrical independence between redundant' channels of the protection system, and between protection channels and control channels, meet the guidance of RG 1.75. Rev.1, and IEEE 384-1974.

The physical separation of redundant protection channels originates at the sensors and continues through the field wiring and containment penetrations to the four analog protection racks. The same separation is maintained between protection and control cables.

The power supply for the four protection and four control channels is provided from four safety-related instrument distribution panels receiving power from four safety related inverters. -In addition al1~ four- control channels have an automatic back-up power supply-from a non-safety related instrument distribution panel. Inherent in the 7300 series design is that the power supply of the protection' channel is part of the-protection.

. system. Thus, if the protection channel provides input to the control channel .a power supply failure in the protection system would affect the function of the control channel. The most limiting failure is the failure of a single safety-related inverter. Loss of power to'the control set due to a circuit breaker trip would not affect MFW control system because of the automatic backup from the non-safety power supply.

Table 1 shows the effects of failure of any one of the four inverters and the effects on the:SG overfill protection and MFW control. The table illustrates that the SG overfill protection continues to perform it's protective function following a single inverter failure, and that the effects on the MFW controls will not adversely affect safe plant operation.

The excessive MFW transient addressed in the FSAR analysis in Section 15.1.2 is based on the malfunction of one MFW control valve in the fully open position. However, the transient described herein is a result of coincidental opening of MFW control valves in two loops following the failure of inverter No.1 or 2, as shown in Table 1. An analysis to evaluate this excessive MFW event has been performed and has shown that all applicable acceptance criteria are satisfied. To reflect this transient, FSAR Section 15.1.2 and Question / Response 32.108 will be revised accordingly.

I

.Attachaent'2'to TXX-90106 Page 6 of 9-l 4. floss of Ventilation The protection system cabinets containing SG overfill protection equipment are located in the control room. The control system cabinets containing MFW control equipment are located elsewhere in the control building, one elevation above the control room.

. The control room is provided with a redundant safety-related HVAC system.

.The redundant standby train of the system will automatically start on loss of the operating train. The room housing the control system cabinets is also supplied by the control room HVAC systems supplemental cooling is provided by non-safety cooling units.. The room temperature will increase to 900F on loss of supplemental cooling, well below the design temperature of 1200F for the control system cabinets (WNES Shop Order 320. E Specification 953109. Rev. 0). Thus, total loss of ventilation in the control room is not considered a credible event, and the loss of supplemental cooling in the control system cabinet room will have no adverse effect on. the _ control system due to a sufficient margin between the hardware design temperature and ambient temperature.

5. Fire Effects

' Physical separation and electrical independence, as described in Item 3 .

ensure that internally generated fires will not simultaneously affect redundant protection channels, and that a fault due to fire in a control channel will not propagate to a protection channel. Based on this separation and electrical independence, a fire is not likely to affect both systems. In addition, the CPSES Fire Protection Report provides analyses of fire hazards, safe shutdown'in case of fire and fire detection and protection. This report shows that adequate. protection is provided' for the equipment required to safely shutdown the plant per the CPSES licensing bases. Fires that render the control room uninhabitable were evaluated and it was demonstrated that the plant can be safely shut down ,

from.the Hot Shutdown Panel and from local control stations.

6. Technical Soecification and Plant Procedures The SG overfill protection channel check, calibration, and operational test are performed in accordance with CPSES Technical Specification 3/4.3.2. Table 4.3-2, Channel Functional Unit, Item 5. Table 3.3-2 Functional Unit 5.b specifies appropriate LCO. The plant test procedures which presently implement the Technical Specification surveillance requirements are shown in Table 2.

l l

~ *

. Attach:ent 2'to TXX-90106 Page 7 of 9

. y: . .

$0NCLUSIONS:

The evaluation of the NRC Generic Letter 89-19 recommendations, as related to-the CPSES design,-demonstrates that:

o the 2-out-of-3 safety grade logic for SG overfill protection is physically separated and electrically isolated from the MFW control system, and located in separate cabinets, thus precluding common mode failures.due to internally generated fires.

o the SG overfill protection system isolates the MFW by closing the MFW [

control and isolation valves and' tripping the MFW pumps. '

o the f ailure of the power supply for the SG overfill protection and for MFW control does not compromise the proper operation of the SG.

overfill protection system, o the total loss of ventilation is not considered a credible event due to the redundant automatic safety-related control room HVAC system.

o the Technical Specification for the SG overfill protection system and plant procedures include surveillance requirements for periodic channel check, calibration, and operational test.

+

Based on this evaluation, TV Electric concludes that the SG overfill protection recommendations presented by NRC Generic Letter 89-19 are implemented in the CPSES design. FSAR Section 15 1.2 and Question / Response ,

32.108 will be revised to reflect the analysis described in Item 3.  !

l' L -

L

e y

4

-==.-e--.--.--..---.---.-----

6 e G t G s e e e e- . E o

• E3 e e e i I M ew e M e-e o e e e e e W o e  % Lal oA 9 e e-e e > .E e W> E6 e s B s e E .J m o E .J .m e e e a e <Wo3 e <Wog a e e e eM>Em6 e M>Em6 e e e e eW M E eW w E e e 8 0 M E e ** a M E m e+ e e e gWW eooEWW e

e e

e o

.J o.ep

> E> e .J F.

U w ;:3 E >

e s

e e

e e

e e U H H e=e e=e e e e=e w e e s

.e -e < m to e < mM e e j t H e J .J Ch. E M e .J J A E M e e e e ae W o E :n W e Wog3W e e -e a W e >MmHu e mHu e .e e e > e W *=e A M e > Lae W *i Ch. M e e e 8 W e .J EW s .J - EW e a e e e e6 3 e-* -

e e e e e G e W ts. < M . e c e5 IL. E .M e: La e e  :

8. E e M .J E E D.e e M .J E E >.e e e e e

>-e e o e o e o a e o e e-a 2 to M H a *

• E M to H e e e a E E F cL. ch. E 3 a E F ch. ch. E e -e e a 3 e e E e.e m.e W Q s e E >.e e-e W e e e e oe p.e o E E > .J e e-e o gs: g > e e a e En e Eub

---.H W .w - e EUHHW i e a e- e - - - - - - - - - - - - e e e a e a e a e e e E I E e Q e Q e a e M LaJ e M LaJ eW eW e-e W Ch. I LaJ Ch. e HE e HE s e e >Q s >o e uo e uoe e e .J

<q e _J e Wm a W e. e e e e <M e 6p e wp e.

e e > e > e wu: e.mue e

e e

e .J e5 4 s J e6 e e

<< a-(<

e e

e a e o e.e e oN e M .,J e gp} .J e-

-e e glC e E e .J o a ao E e I HM e H LA e 4 cc e <E e e M a E Ch. E ch. e gH e EH e o.e

> e H eoo e oo e ga .t e HE e ue uo.

W e e uoJ e >o 'e >. oe c. E M U LaJ e .J e e MU g MU s HWH I L e 3 a 3 e e e UHM e 6 e e La E e oo e ooe W Q >- I W e 6E>E.e Ep e EE e EE e A cic M e---e-- -- --------- - -e k Ch. - e e a e e g e=0 Las .J e e  : e e e Jo e e i e s W E .J E e e e a e .e

.J W e-a b. e a e e- e e to 3 LA. E e e a e e e

<QEo F. Ch. W U e

e E e 3 oe o=J 3

o - 3

-e o e

e N

< se >e LLI >=e 8 .J e .J e E e E e LL. o 3 e .J E H e e e e e o La. e <moe e e GE e E .J LaJ e e e e a to M - 0 0 >.e Ctl e a e e M Q e e.e < m.* e e e e e oEE e MAoe e e e

.J Q < s- e ---- --- - - e e e a e s e 4 .e e I e e e 8 e e e e e- e E e M e e e e e Q y e e e e e e 3 p.e i eg i e e e e OHM es e e e i

.--50 e Q e J<a e N e a e o e MW e 6too c.e a e e e est t .J >= 0 Eo a e

• e e o e <ue EWJ Q .J e oJ e e  :

Ch e E LaJ B < CL. E LAJ e ZW eW eW s e 8 CL e tal E J > e > a Z e E e M GW e CW ow A e H Q .J e, o e o e e X e M< a MU< M .J e M3 E e E e H_ e - e- - - - .-e a e e a e O e e e N e n e 9 e.

W I e e1 s e e a e a e e . e , , . e N e e o e o e o e oe ci a e LE e LE e 1E i 1E s W e e o e o e o e o g ee Cs.o e e grl e Cr: e E e eo e W e LaJ W i WW e WW e WW e E e E e CI H e Cr* H C2: H ct: H e

.C CD e Emo ::s ca: e o C: e. :p cc e o cx: e V J LaJ mW e

e La.s J e 3w e p.e >

e e

.J W p.e p. e, ,,,.

.J. W>

e a, w ,

e ,, y e WG e O< e <Z e aC E e atC E e .uC E e M 9 8 A LL. I L n=e e LL. m.e e 1 e.e a La. e-o e

<A e e-.--..- - g l

s

J*b ~*.=< JAtthchment 2 to'TXX-90106' Il

~~.'~ Page 9 of 9L '.. ,

. ... t

,, i TABLE 2- ,

PLANT TEST: PROCEDURES- ^

FOR MFW' ISOLATION. CHANNEL SURVEILLANCES d

(

CHANNEL CHECK- OPT-102 3

CALIBRATION AND INC-7296A .-

-ANALOG CONTROL INC-7322A OiERABILITY TEST INC 7323A

'INC-7324A INC-7325A' -;

INC-7326A INC-7327A INC-7328A INC-7329A ,

INC-7331A -

INC-7332A '

INC-7333A LOGIC TEST' INC 7900A f INC-7901A

, SLAVE RELAY TEST OPT-406A FUNCTIONAL' CHECK EGT-778 -[

1 i

h t

[ '.

. j I

l-

?

_ - - _ _ . _ _ _ . _ - _ _ _ _ _ _ - - - - _ - - - . _ - _ _ - - - - _ _ _ _ - _ - _ - _ -