ML20023A476

Override & Reset of Control Circuitry in Ventilation/Purge Isolation & Other ESF Sys (B-24), Technical Evaluation Rept

ML20023A476
Person / Time
Site:	North Anna
Issue date:	08/04/1982
From:	Sargent I, Stone J FRANKLIN INSTITUTE
To:	Calvo J NRC
Shared Package
ML20023A478	List: ML20023A476
References
CON-NRC-03-79-118, CON-NRC-3-79-118 TER-C5257-207-2, TER-C5257-207-208, NUDOCS 8208060249
Download: ML20023A476 (31)

Text

{{#Wiki_filter:.. _ - _ _ _m ) e.1 %s G. t TECHNICAL EVALUATION REPORT 2 c a .h OVERRIDE AND RESET OF CONTROL CIRCulTRY IN THE VENTILATION / PURGE ' ISOLATION AND OTHER ENGINEERED SAFETY FEATURE SYSTEMS (B-20 A VIRGINIA ELECTRIC AND POWER COMPANY M NORTH ANNA POWER STATION UNITS 1 AND 2 9 -D, NRC DOCKET NO. 50-338, 50-339 FRC PROJECT CS257 W NRC T AC NO.10161 FRC ASSIGNMENT 7 d NRC CONTRACT NO. NRC-03-79-118 FRC TASKS 207, 208 .D@ ild a Prepared by g Franklin Research Center .}~ Author: I. sargent it 20th and Race Street Philadelphia, PA 19103 FRC Group Leader: J. Stone -2 'Q Prepared for ^' .M Nuclear Regulatory CommiSSlon .(j Washington, D.C. 20555 Lead NRC Engineer: J. calvo a?? i August 4, 1982

r"

l. ;

l-11 This report was prepared as an account of work sponsored by an agency of the United States

T Government. Neither the United States Government nor any agency thereof, or any of their ik employees, makes any warranty, expressed or impfled, or assumes any legal liability or Q

responsibility for any third party's use, or the results of such use, of any information, appa-

' +i ratus, product or process disclosed in this report, or represents that its use by such third S

party would not infringe privately owned rights. %l M9 Prepared by: eviewed by:}/ Approved by: T' / /bl% "$L A JLby Principal Author: up Leader Departrnent Director (Acting) k dg,/962-- Date: 4 Aug li etm m[ Date: 4 L J n<e t. Date: y j

g. c peer G sM v I)(fp

. ]_ Franklin Research Center 5 A Division of The Franklin Institute The Bengnmn Franhjin Parkway. Phila. Pa 19103(215)448.I000 @b XA Copy Has Been Sent to PDR .s 5

pbih 41 Mi d,?4 TER-C5257-207/208 'N. v, %4 4$l'J 9 '*d b 9 m .'41m w .i G ABSTRACT Q 4 This report documents the technical evaluation of the design of 9 ,ty electrical, instrumentation, and control systems provided at the North Anna Ih Power Station, Units 1 and 2, to initiate automatic closure of valves to oPlE isolate the containment. The evaluatfow was conducted in accordance with NRC ee ~$ criteria, based on IEEE Std 279-1971, for assuring that containment isolation 5:? and other engineered safety-features-914.1 not be compromised by manual JC overriding and resettiMg of 'the safetf actuation signals. It was concluded '3$ 13 that the electrical, instrumentation, and control systems at North Anna Power 6.jg '_w Station, Units 1 and 2, partially conform to the NRC criteria. 3p .h.$ . f;k 22 ns N =.% l k e a f1 .. v ,d e

• w ki

s

.qn w m nklin Research Cent ~ ~.--. er

7... M ?1 ,.y ia L:}) Di 5? .;p TER-C5257-207/20 8 "M .,a 3 V, k =.' P 1e 9N n '#j FOREWORD d k-This Technical Evaluation Report was prepared by Franklin Research Center

M+.

under a contract with the U.S. Nuclear Regulatory Connaission (Office of i Nuclear Reactor Regulation, Division of Licensing) for technical assistance in $c support of NRC operating reactor licensing actions. The technical evaluation yf was conducted in accordance with criteria established by the NRC.

1. 3%

4jy Mr. I. Sargent contributed to the tecnnical preparation of this report 75 through a subcontract with WESTEC Services, Inc. >$1 ?! +4. ;

r Ji iC' e

^h 1 ~

9. ;

N .x.; s. x.ms W

g 41 R

,e

• N p

.h ~; :

n l-,e'

.k [W i.. 'Vf A:4 ...u ! 0;1 ' Xi1 i yr '.U; I-' kik 'N w l @;% \\.- D 'Isid lI, i iv l }' g l dd Franklin Research Center J 3-A %.n or n. rr non mana. ,Q

e -u ?.a Sk. f.t q L'b 1 TER-CS257-207/208 '.3,f in .w hO ? ?)$ Y.p D k CONTENTS m %w. I Section Title Page AMm 1 INTRODUCTION. 1 DdT 2 REVIEW CRITERIA. 3 y 3 TECHNICAL EVALUATION. 5 Si ~ n Con'tainment Vencilation Isolation Systems 'O 3.1 5 3.2 Containment Isolation Systems 5 d 3.2.1 Containment Circuit Description. 5 j((y 3.2.2 Containment Isolation System s Design Evaluation 7 3.3 Other Engineer,ed Safet'yfFgature Systems. 8 h.4 3.3.1 Circuit Descripti'on. 8 "g! ^ System Design Evaluations 9 3.3.2 Other Engineered Safety Feature Ji; W -e 6 4 CONCLUSIONS AND RECOMMENDATIONS. 12 m ':f 3 4.1 Containment Ventilation Isolation System 12 d:.e 4.2 Other Engineered Safety Feature Systems. 12 [iif l@ 4.2.1 Criterion 1. 12 4.2.2 Criterion 2. 13 4.2.3 Criterion 3. 14 L-4.2.4 Criterion 4. 15 ~ -t$ lg 4.2.5 Criterion 5. 15 N

2. 4 4.2.6 Criterion 6.

15 i$ d M, 5 REFERENCES 18 + , ?d , 't}g APPL 21 DIX A - RESOLUTION OF DRAWING DISCREPANCIES 25 A, y l~?h ,4 'r2 v 97}: 000u Frank!:n Research Center J f.. ;.,; A m er n. r,waan m l

_ __ ~ n. g ~: t@

e TER-C5257-207/208 A

Y, -,,?.. c_. c.p,

• e

, r. : Y N., [h' @*544 FIGURES 54 ~: ; Number Titie .e Page ?% au -Au 1 Containment Isolation Phase A/B. 20 $b 2 Typ'ical Motor-operated valve Control Circuit. R) 21 T .q 3 Typical Solenoid-operated valve Control Circuits. 22 9 4 Feedwater Control Logic. 23 ~% .1; 5 Feedwater Solenoid-operated valve Control Circuits 24 . rip ^ + n, .c dl e,:c, f.:-( conducted on September 30-Octcber 2,1981. Observations from this site visit ^ ,.'3 were incorporated into a draft Technical Evaluation Report (TER) and provided G di.: for NRC and VEPCO staff review. On December 22, 1981 (9], VEPCO provided a 4; preliminary response which indicated that certain circuit modifications were under consideration periding the review of the equipment supplies. On February .f: gg]j 19, 1982 (10], VEPCO indicated that they had completed their review with the ] equipment supplier and provided a revised response addressing each issue M raised in the draft TER. On June 8, 1982 (11], VEPCO provided additional cim M information pertaining to the availability of indication for the status of V..1 'N certain ESP output devices. This report is based on information obtained l9 M during the site visit as well as that provided by the Licensee in the i Ff.1 !9 submittals identified. .)9 This document addresses only the electrical, instrumentation, and control 4 design aspects of ESF systems at NAPS. Yk nJ '7dj y A .ih hb .J "t.i M A dd Franklin Research Center (M.jg 4 oem.on om. n.nen maan. 3.duW

Ife M c. N t.uj TER-C5257-207/208 d., ,7 .]1 2. REVIDi CRITERIA M Ad The primary intent of this evaluation is to determine if the following ~

4 i@$

NRC staff criteria are met for the sifety signals to all 3SF equipment: o Criterion 1. In keepin9 with the requirements of General Design Criteria (GDC) 55 and !!6, the overriding

• of one type of safety actuation signal le.g., radiation) should not cause the blocking of s

3 any other type of safety actuation signal (e.g., pressure) for those H valves that have no function besides containment isolation. } o Criterion 2. Sufficient physical features (e.g., key lock switches) y are to be providwd to facilitate adequate administrative controls. w:4 o criterion 3. A system-level annunciation of the overridden status

g should be provided for every safety system impacted when any override h;e is active.

(See NRC Regulatory Guide 1.47.) 9 Incidental to this review, the following additional NRC staff design h criteria were used in the evaluationi- -

Oh

] o criterion 4. Diverse signals should be provided to initiate isolation 6f of the containment ventilation system. Specifically, containment high ( radiation, safety injection act.uation, and containment high pressure ]f, (where containment high pressure is not a portion of safety injection p actuation) should automaticall'y initiate CVI.

p 3

o criterion 5. The instrumentation and control systems provided to l@ initiate the ESF should be designed and qualified as safety-grade ,4 equipment. y o criterion 6. The overriding or resetting + of the ESF actuation ] signal should not cause any valve or damper to change position. h criterion 6 in this review applies primarily to other related ESF systems lpp because implementation of this criterion for containment isolation has been m f' reviewed by the Lessons Learned Task Force, based on the recommendations in 1j NUREG-0578, Section 2.1.4. Automatic valve repositioning upon reset may be iWw

-Q L

M

• Overrides the signal is still present, and it is blocked in order to h

perform a function contrary to the signal. W + Reset: the signal has come and gone, and the circuit is being cleared in D.* order to return it to the normal condition. F$ E . nklin Research Ce 3 ~ ~ ~ nter \\n

.m. _ s _- _. m / '. ; :l AW t.S TER-C5257-207/208 s.='d ? ;, .a,.,, 7.m.1 acceptable when containteent isolation is not involved; consideration will be Pi given on a case-by-case basis. Acceptability will be dependent upon system 'M y,) function, design intent, and suitable operating procedures. O' k. MN ?

4

?Id x r '. 0$ ~g 1 .4,. i*,

• 1

.1 4

j in

i. l

.ta .y 1 s.b .e -n,

• • .A

\\: D lR, ' l '.. _ g2 W-Y< ..M

2.',

idi 23 14 2 -$ "? Qk '1. A 000 ranklin Research Center x.9 4%awr ~. g a

1 _. .e f*% w 3d v 7,.3., TER-C5257-207/208 @~ e., e ;1 3. TECHNICAL EVALUATION 2.e .w;, b Qi 3.1 CONTAI) MENT VENTIIATION ISOLATION SYSTDiS $j ]f The North Anna Power Station (NAPS) is designed and operated with a sub-Ig atmospheric containment. Plant technical specifications require the mainte- {!9 nance of subatmospheric co,nditions &c all times when the average reactor cool-ant temperature is equal to or greater than 200*F, thus precluding containment 1ef venting or purging during plant conditions other than cold shutdown. The a . l? containment vacuum pump suction isolation valves, which may be open during g@ operation, are isolated by containment isolation Phase A. Consequently, the criteria of Section 2 are not applicable to CVI systems at NAPS. < cry y;, M

g..

3.2 CONTAI} MENT ISOLATION SYSTEMS JJ 79

b 3.2.1 Circuit Description id}

3.2.1.1 Iogic Circuits for Trip, Seal-in, and-aeset ^ Containment isolation systems Phasy A (CIA) and Phase B (CIB) are I ?.} 'W provided on each of two electrical trains, A and B. Safeguards actuation is ( initiated either by signals processed through the solid state protection f system (SSPS) circuitry or by manual push buttons to operate a relay logic h component actuation system as shown in Figure 1.* .O The following initiation signals are provided for each train: 'm 7 Containment Isolation Phase A i 1 ?:i) l$ Automatic Safety Injection Actuation Signal (automatic) Manual Safaty Injection (automatic) f.; Containment Isolation Phase A (manual) MM Containment Isolation Phase B %j i High-High Containment Pressure (automatic) Containment Isolation Phase B (manual). 3 d '.i 8 ~.g The automatic safety injection actuation signal is derived from any of the E.h following: wM M

• All figures may be found after Section 5, References.

os .b., M !.L 1:2 d 0 Franklin Research Center y A m anor n. vem u n m C

m. .x. sj + D kN W TER-C5257-207/208 mt1 9:i j ,/ o High containment pressure f) o Iow pressurizer pressure 4 o High steamline flow coincident with either low steamline pressure or low-low T average .-f o High steamline differential pressure. EN Automatic containment isolation actuation signals are processed in a SAF-OUT wN board, consisting of a "resettable" solid-state la;.ching circuit with a power $Y Ll conditioning output circuit, to energize a master relay coil. CIA and CIB W 34 manual actuation directly energizes the master relay coil. Master relay M. contacts control current flow to the latch coils of the associated latching-

f type (MG6) slave relays. Slave relay contacts,are~ connected in the control h.y circuits for the solenoid operators and motor operators used to position ESF D

valves and dampers. A manually operated " reset" switch (simple unprotected +' pushbutton) isprovidedwithmultiplecontactstooperatetheunlatc$coilsof .h the slave relay system and to provide a reset signal to the SAF-OUT board, 'y !Qs This " reset" signal will de-energite the master relay and cause the SAF-OUT j.g board to remain in a signal blocking (i.e., output signal removed and will not be reinstituted by a new actuation signal) mode until the initiating signal <w .o has been removed. Thus', this "resitt" feature performs as an override for i,-{.] processed input signals but will not preclude manual actuation of the master Wf relay.

• +

.;y 3.2.1.2 Individual Valve Control Circuits

g,

q.g Valve control circuitry provided for both motor-operated and solenoid-h2 operated valves in the CIA and CIB system is designed so that, in general, ,1 valves and dampers, once closed, can be reopened only by actuation of a local .w*$ control switch. A typical arrangement for motor-operated valves is illustrated gd g in Figure 2. Iccal control is accomplished by a normally open (momentarily closed) switch contact in series with the valve-opening coil. An auxiliary M contact in the valve opening coil in parallel with the switch contact provides sp 4 a current path while the valve opening coil is energized. Any ESF signal, energizing appropriate slave relays, causes contacts in the valve closing wg circuitry to close, thus supplying power to the motor operator closing coil, s., e .Nw Eh W '% :gr .tf d,b. Franklin Research Center Q ^ h or m r= = n m aa. $3

Y i.. (.y <MM .h TER-C5257-207/208 My h Removal of the ESF signal, while de-energizing the slave relay, and unlatching aG it if the removal is accomplished through " reset," cannot cause the valve to h V change position. @mQ Solenoid valve control circuitry behaves similarly, as shown in Figure

)

3a. When the solenoid is energized (valve open), an auxiliary contact provides a circuit path aqound the open contact of the manual control switch. f This network is connected in series with the contact from the slave relay. ]11 When a slave relay is energized, its contact in the valve control circuit T opens to de-energize the solenoid. Upon " reset," the slave relay contacts M;; reclose, but the solenoid remains de-energized since both the manual switch ~ %M contact and the solenoid auxiliary contact remain open. N .g.] The single instance observed during the audit of Licensee-supplied

Q circuit diagrams associated with CIA and CIB where a valve will change

-.f position upon reset was the air ejector vent to atmosphere. As shown in [ Figure 3b, the slave relay contacts are;,in a simple series arrangement with N the solenoid (i.e., without any auxiliary hold in. contact). Mm s-4 lkl 3.2.2 containment Isolation System Design Evaluation \\?C l ~[ef " Reset" switches provide for SAF-OUT devices employed in CIA and CIB are l$ actually overrides which will block an output signal with an input signal

.y a

present and will not allow reactuation by a second input signal unless the n} first signal has cleared. SAF-OUT devices for these systems are, however, actuated by a single parameter signal (safety injection actuation for CIA, E high-high containment pressure for CIB). y No special physical features have been provided to facilitate administra-l :< tive controls over the use of these overrides. The overriden status of these y systems is not annunciated. - hN The Licensee has stated [6] that all instrumentation and control systems ".!S. associated with ESF systems were defined as safety-grade equipment and met 1 l 16% l.x applicable safety standards at the time of purchase and installation. T .n l a.1 ,vf 'i1 1% Bi lL 'N :. branklin Research Center

!]l4 Acmmonornevm un m lC u

. :. x g. a M s% ij TER-C5257-207/208 SW

6

.aC An audit of valves actuated by CIA and CIB has revealed one valve (air ~ g ejector vent to atmosphere) which will reposition upon ESF " reset" (i.e., override). This valve is not a containment isolation valve in the accepted Yl sense of the term (e.g.,10CFR50 Appendix J). It isolates the noncondensable 'h gas discharge frosa the air ejector after condenser. The auxiliary steam T supply to the air ejector is tripped shut by CIA and will not change position upon CIA reset. Further, the air ejector vent isolation valve is normally (i.e., unless tripped by CIA) controlled by a high radiation signal and can be 'Nj open only when a high radiation signal is not present. This feature shuts the s isolation valve when required by plant conditions (i.e., high radioactivity in ,3 the condenser). 3.3 OTHER ENGINEERED SAFETY FEATURE SYSTEMS 3.3.1 Circuit Description f.h .m 5 3.3.1.1 Iagic Circuits for Trip, Seal-in, and Reset -g Feedwater isolation and containment spray circuitry were reviewed. Containment spray t' rip, seal-in, and reset is essentially identical to that !...g previously described (Section 3.2.1.1) for CIB, except that two simultaneous, [h independent actions are required to manually initiate spray. @? The feedwater isolation system, shown in Figure 4, is formed from a v$ complex of subsystems operating on three groups of components (i.e., turbine 8 .g and main feed pumps, bypass control valves, and feedwater control valves). The main feedwater isolation valves are part of the first group. Each of l' these groups will be actuated by either high steam generator water level Ej !.;g (control system trip) or safety injection. In addition, the feedwater control ly valves will be closed by low T avg coincident with reactor trip. \\4 f A pushbutton " reset" is provided for the bypass valves only. The SAF-OUT i] devices for the feed pump / turbine trip and feedwater control valves act as [, non-inverting. drivers (although they may be reset through the multiposition lh; test circuitry). Latching-type slave relays are not used in these two 3M l3 "?[q M _g_ lq I$ b ranklin Research Center -{ A DMoon of The Frannhn m *

-...-2-- -r= .x y i.. .2 i TER-C5257-207/208 3.:. u;., circuits and, consequently, slave relays will de-energize and their contacts '3 will return to their normal (i.e., non-ESF) condition upon input signal T clearance. In the case of the feedwater control valves, a reactor trip input .N will seal in the output signal from the universal board until all initiating M" trip signals have cleared and the reactor trip breakers have been manually Es1 M reset. i G U-3.3.1.2 Individual Valve Control Circuits .ke e.;( In general, motor-and solenoid-operated valve control circuits in the y containment spray and feedwater isolation systems are designed to preclude Vt.4g valve repositioning upon reset or signal clearance. These systems use control I circuitry fundamentally equivalent to that described in Section 3.2.1.2 and .s ./t shown in Figures 2 and 3a. Two exceptions were noted. Circuits for the wq feedwater bypass control valves, illustrated in Figure Sa, and feedwater flow . r. .y control valves, shown in Figure 5b, are. designed so that these valves will be 3 ~q restored to their modulate position (i.e., position called for by the c... feedwater control system) when the aspropriate slave relay is de-energized. 9 3.3.2 Other Engineered Safety Feature System Design Evaluations ,.o ' si , '..k SAF-OUT devices used in the containment spray and feedwater isolation .m ' 2i[ systems are identical to those used in the CIA and CIB systems. They are 3 7 capable of being overriden to block a safeguards output with an input signal

1. .YQ present and will not allow reactuation by a second signal unless the first h

signal has cleared. dl Pushbutton-type switches are provided for the SAF-OUT devices employed in w.N the containment spray system and feedwater bypass valve subsystem of the @n feedwater isolation system. The containment spray SAF-OUT device is actuated

. R.y by a single parameter signal (i.e., high-high containment pressure) and thus M

jf poses no violation of Criterion 1. The feedwater bypass valve SAF-OUT device, 'W jf however, is actuated by either of two parameters (i.e., safety injection

r actuation or high-high steam generator water level) and, since the overriding I.{fj of one signal will block the other, constitutes a violation of Criterion 1.

p~s

6 9

'd W 000 Franklin Research Center w

j#;d A cma n at m rranen %

~,n u fj Mg TER-C5257-207/208 !.T

.n Na gh Pushbutton-type reset switches are not provided for the feed pump / turbine trip or feedwater control valve subsystems of the feedwater isolation system.

$5 No special physical features have been provided to facilitate administra-Ys T tive controls for the " resets" (overrides) associated with the containment b spray system or feedwater bypass valre portion of the feedwater isolation -4 system. The overridden status of these systems is not annunciated. The Licensee has stated (6] that all instrumentation and control systems associated with ESF systems were defined as safety 1rade equipment and met 15 applicable safety standards at the time of purchase and installation. 1 4 An audit of valves actuated by containment spray and feedwater isolation 7 systems has revealed two groups of valves which will reposition upon ESF j " reset." Both the feedwater flow control valves and the feedwater bhass h valves will return to their modulate (i.e., that dictated by the controller) [ position when associated slave relays de-energize. 4, N In the case of the feedwater flow control valves, no manual (i.e., push-r,- a button) reset is provid,ed. The SAF-OUT device for these valves is a non-inverting driver which will de-energize its master relay when its input %) signal, from an upstream logic device, clears. This logic device incorporates .:4 .y a signal seal-in based on the status of the reactor trip breaker to prevent 2,${1 automatic clearing when the isolation signal is accompanied by a reactor /;w qJ trip. A review of the feed and condensate system has determined that the reopening of the feedwater control valves following a feedwater isolation Ed M signal will not reduce below two the number of isolation barriers between the ,:9 1,5X steam generator (or auxiliary feed pump discharge connection) and the low l e,n pressure portion of the feed and condensate system for either isolation signal y that might not be accompanied by a reactor trip (i.e., manual safety injection ,w $.a actuation or high steam generator water level). In either case, the y iy initiating signal will shut the main feedwater isolation valves and trip the

,~

LA. < main feed pumps. The main feed pump trip will cause the feed pump discharge 4 $C valves to shut. Neither valve will automatically reopen upon the clearing of 4y the isolation signal. y:; %an .H Y O $y b Franklin Research Center

g A com.on et The Franmun in iuc.

M-

i .~ ' h-tl TER-C5257-207/208 In the case of the feedwater bypass valves, repositioning will follow a ?;; single operator action (depressing the feedwater bypass valves blocked " reset" ~ f.[ pushbu'. ton), regardless of the status of isolation signals. Further, the g.P ? reopening of these valves, since they bypass the feedline isolation valves, r'3 results in there being only two valves (the feed pump discharge valve and the ,e .f$j feedline check valve) between the feed pump and the steam generator. In the q i d unlikely situation of the failure of the feed pump to trip in response to the c%

Sy isolation signal, only the check valve will remain, and steam generator feed

,y C will occur should the bypass valves be open. 2 %n d Ih'! n b 0 74 w 5C _yrj dl m A -b c' ~ .a$:s 3.2 's d.l

?:!t

.9 1.7.,% l Yr.'2 n:] e'. 5 'i// !.w c1 'YJ g._ : ,. E,. .-..m lls ?N d'E s ~O$ 'NE y l1:D .n:i c. _11_ %y A 00h ranklin w arch Center @.3a ' Rese M I

. n,_. -_ ,y .N M.h TER-C5257-207/208 4 M 4. CONCLUSIONS AND RECOMMENDATIONS b Mg The electrical, instrumentation, and control aspects of the engineered -[l safety feature (ESP) systems at NAPS were reviewed and found to be in substantial compliance with the NRC design criteria. The following section t f identifies (1) the extent c" compliance with each criterion, (2) the d .m Licensee's msition concerning these criteria, (3) conclusionn and Nq recommendations, and (4) proposed modifications based on existing conditions, where appropriate. 6 D 4.1 CONTAINMENT VENTILATION ISOLATION SYSTEM 2 Staff criteria do not apply to the CVI system at NAPS as discuss,ed in M Section 3.1. o 4.2 OTHER ENGINEERED SAFETY FEA'57RE SYSTEMS w.r +v 'N 4.2.1 Criterion 1 3" J 4.2.1.1 Existing Condihion '} Circuitry provided for the control of the feedwater bypass valves does y not satisfy Criterion 1. The " reset" provided at the SSPS SAF-OUT board for

y:;

this subsystem is'actually an override. The override will terminate an output h signal and block system actuation by a second input signal until the first is Rg; cleared. k.:~ !? 4.2.1.2 Licensee Position y y 9 "A two position, " Normal - S/G Wet Layup" keylock switch located in eacn 41 Train A and B system protection rack will be added to the EW bypass valve h circuitry such that when the switch is in the " Normal" position (station M in any operating mode except cold shutdown or refueling) the FW bypass valve reset switch will not permit opening the valves until the trip 7; signal is cleared. When the station is preparing to place the steam f generators in wet layup, the above mentioned keylock switch will be g placed in the "S/G Wet Layup" position which will allow the FW bypass y reset switch to perform its reset function. In this case, the signal Qj being blocked (Hi-Hi SG level) is not considered to be a safety signal. lC Keylock switch operation will be administrative 1y controlled in the ll% Station's Operating Procedures." w i:' 1 - 0000 Franklin Research Center A cw==n om. Franan m n,.

... ~........ T..ff M .?O l 3 TER-C5257-207/208 M ?.t . If 4.2.1.3 Conclusions and Recommendations .] A h The proposed keylock switch, a two-position switch to be located between Q( the pushbutten contact and the R input to the bypass control valves SAF-OUT k device, will prevent an override of the SAF-OUT device when open. With this .M'S switch open, depressing the reset pushbutton will unlatch the bypass control valve subsystem slave relay (K636), allowing the slave relay to change 4 position if the master relay (K520) is de-energized. With a continuous open y)h at the R input, the SAF-OUT device acts as a non-inverting driver, q jg de-energizing the master relay only when all input signals are cleared. This T$ modification, combined with the Licensee's provisions to ensure that the %y proposed keylock switch will be closed only during cold shutdown or refueling, ld meets the intent of Criterion 1. ~ j.h 2 3 4.2.2 Criterion 2 $) w.M 4.2.2.1 Existing Condition $b N Systems employing pushbutton-actuat d " resets'! (i.e., containment hd isolation Phase A and Phase B, containlIbent spray, and feedwater bypass valve in3 isolation) do not comply with Criterio& 2. These " resets" actually function 'D as overrides and require appropriate physical features to ensure that they f cannot be operated, inadvertently and are operated only with proper supervisory M control. @t w h 4.2.2.2 Licensee Position @y " Based on NBC interpretation of Criterion 2, Vepco will initiate a Q modification that involves the addition of covers to the pushbutton reset 45 switches for Containment Isolation - Phase A and Phase B, Containment N Spray, and Feedwater Bypass Valve Isolation. Because of the modification h that will be made to address Criterion 1, it will not be necessary to include the Feedwater Bypass Valve Isolation under this criterion." e& 4.2.2.3 Conclusions and Recommendations N [d The modification described should prevent inadvertent operation of the k reset pushbuttons. If the covers are supplemented my suitable instruction y( (e.g., warning criteria) to the operator concerning the effect of these b , n. nklin Research Center k%

d &g i,N aM ih TER-C5257-207/208 n ".i3wM pushbuttons or the authority necessary to operate them, Criterion 2 will be q 7 satisfied. k ic% 4.2.3 Criterion 3 Y 4.2.3.1 Existing Conditions eA M Systems employing'pushbutton-actuated resets which are operable during N. Plant conditions other than cold shutdown or refueling partially comply with lj Criterion 3. These systems are provided with an annunciator window that 6 indicates the status of the associated master relay. Rose annuciators are

Mg illuminated upon receipt of ESF actuation signal and will clear on system "P.ESBT. "

%g M 4.2.3.2 Licensee Position 3M It is the Licensee's contentfod that existing indication supplemented by , _ ~ 'y appropriate operating and annunicatos response procedures is sufficient to Q satisfy Criterion 3. Since a safeguards actuations signal will illuminate the N 4 d appropriate annunciator window,. the operator will know that such a signal m exists. Likewise, since the only way to extinguish this annunciation is to operate the appropriate reset pushbutton, the operator will be able "to verify 4 that a signal has been reset (overridden)." 8e

jp 2 e Licensee has further stated that provision for additional annuncia-

,.s g3 tion is, in their opinion, redundant and would require extensive changes to , @g the SSPS, including alterations to the safeguards driver printed circuit board. _h mt[ 4.2.3.3 Conclusions and Recommendations k The existing system is judged to partially satisfy criterion 3 in that it ce 7,' can indeed indicate to the operators when a system has been overridden (i.e.,

c the RESET pushbutton depressed with a signal present) since the indicating W

light will be extinguished when the master relay is deenergized. This h,p, arrangement will not, however, in itself unequivocally identify the plant { status since the same indication will be provided when the system is reset u-g (i.e., the RESET pushbutton depressed af ter the initiating signal clears). 9 nklin Research Center 4:, a ca an or m n.n n m. l~ m, m- ___-._m<,-

4 TER-C5257-207/20 8 9 The Licensee has agreed to update operating and annunciation response .ej procedures to indicate that the containment isolation and containment spray G '] annunciators " provide information as to the reset status of the associated ESF n

,}.;

signal." While such a simple statement would not appear to adequately address y$' the staff's concern, it is likely that the existing annunciation in ?.e conjunction with appropriate procedural warni.gs and supported by additional q a W information available to the operator (e.g., plant parameter values and memory .,y board indication of universal board status) could be used to ensure that the gM operator is aware of the fact that a safety signal has been overridden (rather -:1 than just RESET). The NBC staff should require 'that the Lice'nsee provide a

c

d[

comprehensive approach to determining system status using installed f' y annunciation. .:p $.b 9 4.2.4 Criterion 4 k. .~ ~ r. ]$ Criterion 4 is not applicable at NAPS. W ..c, N W 4.2.5 Criterion 5 ij w 1 4,.j ESF instrumentatidn and control sylstems at NAPS comply with Criterion 5. j:):j 4.2.6 Criterion 6, d 4.2.6.1 Existing Conditions

f Three instances were found where the resetting of an FSF signal will y

cause valves to change position: JS o air ejection vent to atmosphere isolation valves yJ g c o feedwater flow control valves u o feedwater bypass control valves. eq' 'n ni T 4.2.6.2 Licensee Position b !fg o Air Eiector Vent to Atmosphere Isolation Valves - m3 "Vepco does not intend to make any changes under Criterion 6 4 concerning the circuitry for the air ejector vent to atmosphere d isolation valves, since the present circuitry receives a high ] radiation signal and a containment isolation Phase A signal even .Q 4 83 00hd Franklin Research Center A cam.on or n. rr.non m "Nb -

~ ..:s bh TER-CS257-207/208 h h though this valve is not a containment isolation valve. For this ,gi circuit, if containment isolation were reset and there was a high '9 radiation condition, the air ejector vent to atmosphere isolatica valves would remain closed. If no high radiation condition were p present, no detrimental situation would be encountered if the valve j opened after resetting containment isolation." JQ o Feedwater Flow Control Valves - "In the case of the feedwater flow control valves no manual (i.e., Ml pushbutton) reset is provided. The SAF-OUT device for these valves is a non-inverting driver which will de-energize its master relay when f its input signal, from an upstream logic device, clears. This logic m device incorporates a signal seal-in based on the status of the yi reactor trip breaker to prevent automatic clearing when the isolation l signal is accompanied by a reactor trip. Review of the feed and condensate system indicates that the reopening of the feedwater control valves following a feedwater isolation signal will not reduce below two the number of isolation barriers between the steam tjenerator 3 (or auxiliary feed pump discharge connection) and the low pressure uY portion of the feed and condensate system for either isolation signal that might not be accompanied by. a reactor trip (i.e., manual safety M injection actuation or hi'gh steam generator water level). In either Yi of these cases the initiatit!g signal will shut the main feed line 2 isolation valves and trip the main feed pumps. The main feed pump 3% trip will cause the feed pump discharge valves to shut. Neither valve D will automatically reopen upon the clearing of the isolation signal. h Based on the foregoing Vepco does not intend to make any circuit l'i modification with report to the valves." ?4 o _Feedwater Bypass Control Valves - l @d c Q.. "Upon completion of the modification as described under Criterion 1 1 i g;g above, during normal operations it will take two (2) operator actions to reset the FW bypass valves following the initiation of a SI signal: (1) reset of SI and (2) reset of EW bypass valves. The resetting of the bypass valves following a steam generator Hi-Hi level signal will W be possible only after the signal has cleared and is really not an issue under Criterion 6 since the Hi-Hi level signal is not an ESP M signal. It was added to the design to provide equipment protection (prevents moisture carryover to the turbine)." 5g 4.2.6.3 Conclusions and Recommendations f.D o Air Eiector Vent to Atmosphere Isolation Valves - The present circuitry is considered to be an acceptable deviation from Criterion 6. M 4* : \\ M NU Franklin Research Center g a >=oaorn.Fr=wn m 4' -he=6 -ee-6 e -eme -ee e m ee.-.e

-.... ~ ......s. ~......- n -.... - .. ~. .?--. ) EE TER-C5257-207/208 sg 4 o Feedwater Flow Control valves - The present circuitry is considered to

A be an acceptable deviation from Criterion 6.

I

/*

o Feedwater Bypass Control Valves - The circuit modification proposed by .9 the Licensee is such that, in the more important case of feedwater .g?; bypass control valve isolation consequent to an SI signal, two Q,$ operator actions are required to reset the slave relay for these i2 y valves. While not altering the fact that the individual valve control x1g circuitry remains in violation of Criterion 6 (i.e., the bypass control valves may change position upon reset notwithstanding the -3 number of operator actions required to cause the reset), this &g modification provides additional assurance that this repositioning 3 will be undertaken deliberately and under stable plant conditions. 5 W This result is similar to the situation which would exist if the $sj individual valve control circuits were modified to require a separate l$ operator action to reposition [th'e valve following reset (in H g< conformance with Criterion 6). ihe difference between the two ~. situations is that in the former case, proposed by the Licensee, the c s, 99l repositioning action takes place at a pushbutton labeled " reset,"

G

~- .7 whereas in the latter case the repositioning action takes place at a switch suitably labeled, presumably, to identify the device controlled. y Consequently, the arrangement at NAPS should be found in compliance w" l-with Criterion 6 if the feedwater bypass control valve reset rushbutton ).:y ". 1 is relabeled or provided with an appropriate warning sign to identify IX3 Its the consequences of depressing the button. lOM l$ W LIY lCTd E l4% }f41 i

1. -l@

l% l$5 l# lt.~ _17-1.x A Nd 0000 Franklin Research Center I,( A Chaman et The Frannien usease

m - h .1 E.1 N$ 7f: TER-CS257-207/208 .y w M 5. REFERENCES li2) 1. O. D. Parr (NRC) h Intter to C. M. Stallings (VEPCO) j-3 Suoject: Containment Purging During Normal Operation 45 11 Dec 1978 1 2. C. M. Stallings (VEPCO) Letter to O. D. Parr (NRC)

Subject:

Containment Purging During Normal Operation 17 Jan 1979 'M. 'S 3. A. Schwencer (NRC) h Letter to W. L. Proffitt (VEPCO) )

Subject:

Request for Commitment on Containment Purging jJ 30 Oct 1979 ?d si q 4. C. M. Stallings (VEPCO) yg Letter to H. R. Denton (NRC) pg

Subject:

Request to Interim Position on Purging Operations ?,g 20 Dec 1979

.x 39 5.

H. R. Denton (NRC) Letter to R. H. Leasburg (VEPCO) c... .fM

Subject:

Request for Addition &l Information - Bypass and Reset of ESF {;g's 25 July 1980 m '7 6. R. H. Leasburg (VEPCO) M Letter to H. R. Denton (NRC)

Subject:

Information on Bypass and Reset of ESF y; 1 July 1981 E'd %j di 7. C. M. Stallings (VEPCO) Letter to H. R. Denton (NRC) M Subjects Information on Bypass and Reset of ESF M 26 Nov 1979 Jpg 8. E. R. Sylvia (VEPCO) 'Q Letter to H. R. Denton (NRC) h

Subject:

Information on Bypass and Reset of ESF

• gg 7 July 1980 2.3 9.

R. H. Leasburg (VEPCC) iB Letter to H. R. Denton (NRC) J[Zj$

Subject:

Information on Bypass and Reset of ESF 22 December 1981 Tj he 'M '0h ku s _ o nklin Research Center g A DMoon of The Franen insonae M*

m..s __..........

5y .,p '.s f TER-C5257-207/208

m

.1% yin 4Mg

10. R. H. Leasburg (VEPCO) s.'d In tter to H. R. Denton (NRC)

%.gj

Subject:

Additional Information on Bypass and Reset of ESP if 19 Feb 1982

1. g

11. R. H. Imasburg (VEPCO)

N Intter to H. R. Denton (NRC)

Subject:

Additional Information on Response to NRC Technical Evaluation, '{ Bypass and Reset of Engineering Safety Features, North Anna Unit Nos.1 and 2 8 June 1982 -Q

%k

+ b 2?-

hG 069 r,

.

n ~ en n 5.% bN e W2 f6 'p

~,;.

' q. .e g 'S. t I-l1 .ay .e at yt M;k; 4 R&c Oh .y .'y:1 i& t 'b 'N ~n i1 \\3 j.* -j 4. 'ff MU Franklin Research Center l 3,c m on or n. Fr.non insou. i.H

[ fbi Ib d $h,N['L$/[N hiM hk b.S.d h b E N 6 ['f[$hh ' h khMkOYhb b d Th{jI M k.M d M d k y/.Q g K y.], i l I f t I, i t e=> g a 2 sE a :i' N +d! 120 VAC 120 VAC g3 48 VDC / SLAVE gh ' o g o (LATCH) i

• {

O----__lr o SLAVE t O j o o (UNLATCH) l i MASTER ;o_ _ _ _ _ 4 O i w Y-AUTOMATIC a ACTUATION SIGNAL (S) 1 w S o g ? 1 Cl SAF OUT MANUAL o o o Cl C1 RESET " ACTUATION R 1 V V 2 M um 4 i 1wow Figure 1 Containment Isolation Phase A/B NN O CD l

$$dfhh.NNINys JIkb[($2b IhkSI' bI b b E Y' ' ^ ^ i i i I. l <= c=>

• 7:

5aE a 5' [_4 LS _~ LS 2.9 r, M t

$LS

}d TS .'1 LS _ TS ( *?. a t4 u (OPEN) l $g = ,,p_. (CLOSE) o SSPS 8 '. - - 52C ESF I 120 VAC ~~~~------ ~ ~ SL4VE s'

y. 52C

- f 52 ~ 7 O 5 52C 0 1 e t I 49 (OVERLOAD)' t ui M ui I 4 .i N i o 4 Figure 2. Typical Motor-operated Valve Contsol Circuit \\ P i as i. i i l af

b Y hYb??$b1l $kYb ?: -iY$4 khYL$tf NNYh$?Yk( M b h ${f':{nt'likh?YYkk k k?- -:!$Y _Y E YY?$$5ffh0lh$tk'[Q h;3 E 0 i } EL l >m Ao 2E EL 3 a O 4 CLOSE TEST E@R n OPEN ON ~ ] f l

HilHI pOPeu R=ATiON SOv. = =

u 4 SSPS 7~ SLAVE _e SSPS 7 SLAVE

e 4

4 /_ CONTROL INTERLOCK [ u /- PERMISSIVE y I i SOV SOV l i 1 A 8 t F n. l 4 i l Figure 3. Typical Solenoid-operated valve control circuits as 2 N O CD 1 J

,$ll5..YlNh h y-Yfyfh,_, * '$lhg'{kE5Q.?h?$;'1'? lp( ' }l: sl{.'1: y r_ {i;.ll%,iif&;*7)-h'fQj ::,QqQQf h5)kQ] $$,h Ykf-?h ' f?$$g;)l:{f+.;Q,{Qhjfq,y:,h':j;R>}g f,_ l I e -%8 (TURBINEfFEED PUMP TRIP MAIN FEEDWATER ISOLATlON VALVES) I 7 f$i SGHWL K508 5f S8 UNIV O 8 O y + 48V ggp gm A313 OUT l . to Si t12 ASIF l f 8 W 120 VAC gi; S TEST CKT R K621 ' t.r kO Hi = K520 (FW BYPASS CONTROL VALVES) S O W + 48V SAF g OUT-I K636 f R A51,7 la 'HP 120 VAC 'i' e i t LATCH t s r \\ I \\f N {' E (RESET) W l [ K638 (UNLATCH)

c

'HP 120VAC ~ O UNIV SAF LOW TAVE A213 OUT A517 REACTOR _ TEST CMT R K50F (FW CONTROL VALVES) TRIP y + 48V I y 84 450 -320VAC o iI K620

• gm

-J I No e 4N N Figure 4. Feedwater Control Logic o

d$kkO L$bk $ Ab .'t b N 0Y : ' $5 bt'* !5 Y! Y$ bI l5 = $7 an E en $N SSPS SLAVE

• 4 SSPS SLAVE In:r (FWI)

._ K601 (SIAS) ~ 7 %a

• h K636

~ i 7 ~ (FROM FIG. 4) SSPS SLAVE ~ d K620 (FWI) 7 (SEE FIG. 4) J e .g i a i u Y SOV SOV A: FW BYPASS CONTROL VALVES B: MFW CONTROL VALVES Nw A uum l 4 J l Figure 5. Feedwater Solenoid-operated Valve. Control Circuits 1 y \\ i -4 Nu O CD \\

3 1 ,s, .Y., TER-C5257-207/208 APPENDIX A - RESOLUTION OF DRAWING DISCREPANCIES a. .Gi -;w ) A.1 UNIVERSAL BOARD INTERNAL WIRING ,h The circuit diagram provided for the Universal Board (Ref. Dwg. 'dj 1046F57-A) showed a connection between the output of the logic gates and the .a 9 output of the multiplex systems used to provide monitoring information to the u }!/ computer. This connection was questioned, and a check was made against the I.7$ generic Westinghouse drawing Universal Board Schematic Diagram 1046F57. The connection in question does not exist on the generic drawing. This u:.f discrepancy has been noted in a prior review and was determined, in that case, " jg to be an error on the plant-specific drawing. . r 9... .:d w. ..q Y,f.? u ms .;q _mM .jp -n s-M2;v

,3

.A df l Mj

e p.1 s

>es lRGh 1 l x.i l TJ 9:+ 4m 18 4 . <C 1., 4.hI =$, f,b tI.7, d 0 Franklin Research Center r 'g"[ < A QMoon of The Frannan insonae '+. f:}}