ML20023A476
| ML20023A476 | |
| Person / Time | |
|---|---|
| Site: | North Anna  |
| Issue date: | 08/04/1982 |
| From: | Sargent I, Stone J FRANKLIN INSTITUTE |
| To: | Calvo J NRC |
| Shared Package | |
| ML20023A478 | List: |
| References | |
| CON-NRC-03-79-118, CON-NRC-3-79-118 TER-C5257-207-2, TER-C5257-207-208, NUDOCS 8208060249 | |
| Download: ML20023A476 (31) | |
Text
{{#Wiki_filter:. . _ - _ _ _m -
)
e.1 s G. t TECHNICAL EVALUATION REPORT 2 c a
.h OVERRIDE AND RESET OF CONTROL CIRCulTRY IN THE VENTILATION / PURGE ' % ISOLATION AND OTHER ENGINEERED SAFETY FEATURE SYSTEMS (B-20 A
VIRGINIA ELECTRIC AND POWER COMPANY M NORTH ANNA POWER STATION UNITS 1 AND 2 9 - D, NRC DOCKET NO. 50-338, 50-339 FRC PROJECT CS257 W NRC T AC NO.10161 FRC ASSIGNMENT 7 d NRC CONTRACT NO. NRC-03-79-118 FRC TASKS 207, 208
.D ild a
- Prepared by g Franklin Research Center Author: I. sargent it 20th and Race Street Philadelphia, PA 19103
.}~ FRC Group Leader: J. Stone -2 .
Prepared for - ^'
'Q .M Nuclear Regulatory CommiSSlon .(j Washington, D.C. 20555 Lead NRC Engineer: J. calvo a??
i August 4, 1982
- r"
- l. ;
l-11 This report was prepared as an account of work sponsored by an agency of the United States
- T Government. Neither the United States Government nor any agency thereof, or any of their ik employees, makes any warranty, expressed or impfled, or assumes any legal liability or Q
- ' +i responsibility for any third party's use, or the results of such use, of any information, appa-ratus, product or process disclosed in this report, or represents that its use by such third S party would not infringe privately owned rights.
%l M
9 Prepared by:
/ eviewed by:}/
Approved by: T' - $ /bl% '
"$L A JLby Principal Author: up Leader Departrnent Director (Acting)
Date: 4 L J n<e t. Date: k dg,/962-- Date: 4 Aug li etm m[ y j g. c peer G sM v I)(fp . ]_ Franklin Research Center 5 A Division of The Franklin Institute The Bengnmn Franhjin Parkway. Phila . Pa 19103(215)448.I000 @b XA Copy Has Been Sent to PDR .s. 5
pbi h 41 Mi d,? 4 TER-C5257-207/208
'N.
v,
%4 4
l'J 9
'*d b
9 m .
.'41 m
w .i G ABSTRACT 4 Q
%.. This report documents the technical evaluation of the design of "
9 ,ty electrical, instrumentation, and control systems provided at the North Anna Ih Power Station, Units 1 and 2, to initiate automatic closure of valves to oP lE ee isolate the containment. The evaluatfow was conducted in accordance with NRC
~$
criteria, based on IEEE Std 279-1971, for assuring that containment isolation 5:? and other engineered safety-features- 914.1 not be compromised by manual JC overriding and resettiMg of 'the safetf actuation signals. It was concluded
'3$
13 that the electrical, instrumentation, and control systems at North Anna Power 6.jg 3p Station, Units 1 and 2, partially conform to the NRC criteria. '_w .h.$
. f; k
22 ns N
=.%
l k
- e a '
f1.. v ,d e w
- s ki
.qn w
@ m
, ~ nklin
~.--.Research Cent er
7... .. . . _ . . . M
?1
, .y ia L:})
Di 5?
.;p TER-C5257-207/20 8 "M.,a 3 V,
k < P
=.'1e 9N n '#j FOREWORD d
k- This Technical Evaluation Report was prepared by Franklin Research Center
;M+. under a contract with the U.S. Nuclear Regulatory Connaission (Office of i
Nuclear Reactor Regulation, Division of Licensing) for technical assistance in support of NRC operating reactor licensing actions. The technical evaluation
$c yf was conducted in accordance with criteria established by the NRC. #3 % Mr. I. Sargent contributed to the tecnnical preparation of this report 4jy 75 through a subcontract with WESTEC Services, Inc. >$1 ?! .* +4. ;r ;
Ji iC' e:
^h1
~
- 9. ; -
N : s.
- x. .x.; -
ms W;g . ., 41 R
,e
*N p -
.h
~; :
; :n l-
,e'
.k
[W i.. 'Vf A:4'
. ..u
! 0;1 ' Xi1 i yr I- .U; ki k
'N w
\ .-@;% D 'Isi d lI, i iv l }' g 3- Jl dd Franklin Research Center
;. A %.n or n. rr non mana.
,Q
$e
-u
? .a Sk.
f.t q 1 L'b TER-CS257-207/208
'.3,f in.w hO .
?
?)$
Y
.p D
k CONTENTS
$m I %w. Section Title Page '
A M m 1 INTRODUCTION. . . . . . . . . . . . . . 1 Dd T 2 REVIEW CRITERIA . . . . . . . . . . . . . 3 y 3 TECHNICAL EVALUATION. . . . . . . . . . . . 5 Si ~ n - 3.1 Con'tainment Vencilation Isolation Systems . . . . ., 5
'O 3.2 Containment Isolation Systems . . . . . . . . 5 d
3.2.1 Containment Circuit Description .
. . . . . 5 3.2.2 Containment Isolation System j((y s Design Evaluation . . . . . . . . . 7 3.3 Other Engineer,ed Safet'yfFgature Systems. . . . . . 8 3.3.1 Circuit Descripti'on . . . 8 h.4 3.3.2 Other Engineered Safety Feature "g!
Ji; ^ System Design Evaluations . . . . . 9 W -
-e 6 4 m -
CONCLUSIONS AND RECOMMENDATIONS . . . . . . . . . 12
':f .
3 4.1 Containment Ventilation Isolation System . . . . . 12 d:.e 4.2 Other Engineered Safety Feature Systems. . . . . . 12 [iif ' l@ . 4.2.1 Criterion 1 . . . . . . . . . . . 12 4.2.2 Criterion 2 . . . . . . . . . . . 13 4.2.3 Criterion 3 . . . . . . . . . . . 14 L-
~
4.2.4 Criterion 4 . . . . . . . . . . . 15 -t$ lg - 4.2.5 Criterion 5 . . . . . . . . . . . 15 N 2. 4 4.2.6 Criterion 6 . . . . . . . . . . 15 i$ d . M,+ 5 REFERENCES . . . . . . . . . . . . . . 18 , ?d , 't}g APPL 21 DIX A - RESOLUTION OF DRAWING DISCREPANCIES . . . . . . 25 A, y l~?h
,4 'r2 v
J 97}: 000u Frank!:n Research Center A m er n. r,waan m f.. l
_ __ ~ _ ,
- n. '
g ~: t@
- e A
TER-C5257-207/208 Y,
-, ,?..
c_.
*c.pe , , r. :
Y, N. [h' @*544 FIGURES
- 54
~: ;
Number Titie Page
.e ?%
au -Au 1 Containment Isolation Phase A/B .
. . . . . . . . 20
$b 2 Typ'ical Motor-operated valve Control Circuit. T . . . . . 21 R)
.q -,
3 Typical Solenoid-operated valve Control Circuits. . . .. . 22 9~ 4 Feedwater Control Logic . . . . . . . . . . . 23
.1; 5 Feedwater Solenoid-operated valve Control Circuits
. rip ^
. . . . 24
. ;. . +
n,
.c dl e,:c, f.:<
q
' 'r.:j k
s ' D8 n 4' $Q
=. .
,a-
.st w%, ??-
- lxl
.-f n
p '.N 3
,t . :
Vi n ' '.:)a:
- l ie d U Franklin Research Center A Duman of The Fransen ansomme
'M
.W M
ik TER-C5257-207/208 02
?4' @k C.d
- 1. INTRODUCTION W .
!] }5
- 2 Several instances have been reported at nuclear power plants where t.4 y automatic closure of the containment ventilation / purge valves would not have
@r, . occurred because the safety actuation signals were either overriden or blocked d@q during normal plant operations. These events resulted from procedural tjy inadequacies, design deficiencies, and lack of proper management controls.
wa ,g These events also brought into question the mechanical operability of the yd containment isolation valves themselves. These events were determined by the v M U.S. Nuclear Regulatory Commission '(NRC) to be Abnormal Occurrences (978-5) and were, sccordingly, reported to the U.S. Congress. x - N As a followup to these Abnormal Occurrences, the NRC staff is reviewi'g n j&' the electrical override aspects and the mechanical operability aspects of containment purging for all operating power reactors. On December 11, 1978, a fi$ ~ y the NRC issued a letter encitled " Con}ainment Purging During Normal Plant M g s Operation" (1]
- to boiling water reactor- (BWR) and pressurized water reactor
* (PWR) licensees. In a letter dated' January 17, 1979 (2), the Virginia e$1 - .; u 1% Electric and Power Company (VEPCO), L(censeeforNorthAnnaPowerStation lfD y (NAPS), replied to the" NRC generic letter.
":f In a letter dated October 30, 1979 (3], the NRC stated that their review i.N
'] of Reference 2 indicated that a commitment to meet cartain interim require- ,.h
' .q ments related to minimizing containment purge and vent operations, including keeping the purge and vent isolation valves closed whenever the plant was not a
'd in a cold shutdown condition, was required. On December 20, 1979 (4 ] , VEPCO
' y; reported that they had determined that they operate in conformance with the j NRC's Interim Position, noting that NAPS Technical Specifications require ,f containment pressure to be subatmospheric when the reactor coolant system A d I fs", temperature is above 200'F and that this requirement precludes opening the l 'g s containment purge and vent valves during plant conditions after the cold l ;Q shutdown. \ . :-
=
~
- Numbers in brackets refer to citations in the list of references, Section 5.
r i
- j. $
J ._ Y nklin Research Center
.1,,
A OMoon of The Frarman insonde [$
__ -- ,A.- w. _um e e -- e , _.__ - N,w1gy 7 ,_ - - - _ - - - - - , Y4*
'9
..Z
.a 3 TER-CS257-207/208
, ..] On July 25, 1980 (51, the NRC requested that additional information be m
provided concerning the electrical bypass and reset of engineered safety x} q feature (ESF) signals at NAPS. Their request for information provided six
$ evaluation criteria which were to be applied to all ESF systems and thus, %Q while related to prior investigations of containment venting and purging, was o!J q of substantially gre ter scope than the prior review and interim position.
TV t Q Further, tais letter requested that VEPCO provide certain detailed circuit 3 information sufficient to support an independent, schematic level, circuit design review. In a' letter dated July 1, 1981 (6], VEPCO responded to this (( request for information indicating compliance with criteria 1, 2, 3, and 5, Dx noting that criterion 4 had been discussed in prior correspondence (7, 8], and f indicating that a previous review of the resetting of ESF signals had resulted in certain control circuit modifications. No control circuit schematic 4 4 diagrams were provided. A site visit, arranged and monitored by the NBC, was
-( .
^
conducted on September 30-Octcber 2,1981. Observations from this site visit
,.'3G were incorporated into a draft Technical Evaluation Report (TER) and provided di.: for NRC and VEPCO staff review. On December 22, 1981 (9], VEPCO provided a 4; preliminary response which indicated that certain circuit modifications were under consideration periding the review of the equipment supplies. On February .f:
gg]j 19, 1982 (10], VEPCO indicated that they had completed their review with the
] equipment supplier and provided a revised response addressing each issue M
cim raised in the draft TER. On June 8, 1982 (11], VEPCO provided additional M V. .1 information pertaining to the availability of indication for the status of 'N certain ESP output devices. This report is based on information obtained l9 M during the site visit as well as that provided by the Licensee in the i Ff.1 !9 submittals identified.
.)9 This document addresses only the electrical, instrumentation, and control 4 design aspects of ESF systems at NAPS.
Yk nJ
'7dj y -
A
.ih hb .J "t.i M A (M.jg dd Franklin Research Center 4 oem.on om. n.nen maan.
3.d uW
Ife M c. N t.uj TER-C5257-207/208 d.,
,7
.]1 2. REVIDi CRITERIA ,
MA d:4 The primary intent of this evaluation is to determine if the following ~ NRC staff criteria are met for the sifety signals to all 3SF equipment: i@$
$ o Criterion 1. In keepin9 with the requirements of General Design Criteria (GDC) 55 and !!6, the overriding
- of one type of safety s actuation signal le.g., radiation) should not cause the blocking of
H 3 any other type of safety actuation signal (e.g., pressure) for those valves that have no function besides containment isolation.
} o Criterion 2. Sufficient physical features (e.g. , key lock switches) y are to be providwd to facilitate adequate administrative controls.
w
- 4
;g o criterion 3. A system-level annunciation of the overridden status should be provided for every safety system impacted when any override h;e is active. (See NRC Regulatory Guide 1.47.)
- 9 Incidental to this review, the following additional NRC staff design h criteria were used in the evaluationi- -
- Oh 6f
] o criterion 4. Diverse signals should be provided to initiate isolation of the containment ventilation system. Specifically, containment high
]f,( radiation, safety injection act.uation, and containment high pressure (where containment high pressure is not a portion of safety injection p:p actuation) should automaticall'y initiate CVI. ' 3 o criterion 5. The instrumentation and control systems provided to l@ initiate the ESF should be designed and qualified as safety-grade
,4 equipment.
y o criterion 6. The overriding or resetting + of the ESF actuation
] signal should not cause any valve or damper to change position.
h criterion 6 in this review applies primarily to other related ESF systems lpp because implementation of this criterion for containment isolation has been m f' reviewed by the Lessons Learned Task Force, based on the recommendations in j 1 NUREG-0578, Section 2.1.4. Automatic valve repositioning upon reset may be i W w
- -Q L
- M
- Overrides the signal is still present, and it is blocked in order to hW perform a function contrary to the signal.
,$ + Reset: the signal has come and gone, and the circuit is being cleared in D.* order to return it to the normal condition.
F$ E . 3 ~ nklin
~ Research
~ nter Ce
\n . _ , ___ . - - _ . - _ _
. _ _ . , . .m. _ s _- _. m
/
', . ; :l AW t.S s .='d TER-C5257-207/208
? ;,
.a,.,,
acceptable when containteent isolation is not involved; consideration will be 7.m.1 Pi given on a case-by-case basis. Acceptability will be dependent upon system
'M y,) function, design intent, and suitable operating procedures.
O' k. MN ?
- 4
?Id x --
r
' . 0$ ~g ..
1
.4, .
i* ,
*1
- .14 .
in j
- i. l
.ta .y 1 s.b .e -n , **.A
\: D lR, ' l '. . _ g2 W-Y< . .M
- 2.',
idi 1 23 42
-$ "?
Qk '1-, . A
$; 000 ranklin Research Center gx.9 4%awr ~ .
a
1 _.
.e f*%
w 3d v 7,.3., TER-C5257-207/208
@~ e.,
e ;1
- 3. TECHNICAL EVALUATION .
2.e
.w;, .
b Qi 3.1 CONTAI) MENT VENTIIATION ISOLATION SYSTDiS
$j The North Anna Power Station (NAPS) is designed and operated with a sub- ]fIg atmospheric containment. Plant technical specifications require the mainte-
{!9 nance of subatmospheric co,nditions &c all times when the average reactor cool-ant temperature is equal to or greater than 200*F, thus precluding containment 1e fa venting or purging during plant conditions other than cold shutdown. The
. l? containment vacuum pump suction isolation valves, which may be open during g@ operation, are isolated by containment isolation Phase A. Consequently, the < cry criteria of Section 2 are not applicable to CVI systems at NAPS.
y;, ..
- g. .
M 3.2 CONTAI} MENT ISOLATION SYSTEMS JJ79
;b 3.2.1 Circuit Description -
id } ^ 3.2.1.1 Iogic Circuits for Trip, Seal-in, and-aeset Containment isolation systems Phasy A (CIA) and Phase B (CIB) are I ?.} 'W provided on each of two electrical trains, A and B. Safeguards actuation is ( initiated either by signals processed through the solid state protection f system (SSPS) circuitry or by manual push buttons to operate a relay logic h component actuation system as shown in Figure 1.*
.O The following initiation signals are provided for each train:
'm i 7 Containment Isolation Phase A 1 ?:i) l$ Automatic Safety Injection Actuation Signal (automatic)
- $ Manual Safaty Injection (automatic) f.; Containment Isolation Phase A (manual)
M M Containment Isolation Phase B %j i High-High Containment Pressure (automatic)
@ 3 Containment Isolation Phase B (manual).
8 d '.i ~.g _ The automatic safety injection actuation signal is derived from any of the E.h following: w M M os
*All figures may be found after Section 5, References. .b. ,
M !.L 1:2 @ d 0 Franklin Research Center y A m anor n . vem u n m C _ __
. , , m. _
. ., .x.
sj
+
D kN W TER-C5257-207/208 m t1 l 9:i j
,/ o High containment pressure '
f) o Iow pressurizer pressure 4 o High steamline flow coincident with either low steamline pressure or
.- low-low T average f o High steamline differential pressure.
EN w Automatic containment isolation actuation signals are processed in a SAF-OUT N board, consisting of a "resettable" solid-state la;.ching circuit with a power Ll
$Y conditioning output circuit, to energize a master relay coil. CIA and CIB W
34 manual actuation directly energizes the master relay coil. Master relay M. contacts control current flow to the latch coils of the associated latching-f type (MG6) slave relays. Slave relay contacts,are~ connected in the control h.y circuits for the solenoid operators and motor operators used to position ESF D+' valves and dampers. A manually operated " reset" switch (simple unprotected pushbutton) isprovidedwithmultiplecontactstooperatetheunlatc$coilsof
.h the slave relay system and to provide a reset signal to the SAF-OUT board,
'y
!Qs This " reset" signal will de-energite the master relay and cause the SAF-OUT j.g board to remain in a signal blocking (i.e., output signal removed and will not
<w
.o be reinstituted by a new actuation signal) mode until the initiating signal has been removed. Thus', this "resitt" feature performs as an override for i,-{.] processed input signals but will not preclude manual actuation of the master W relay.
f
*+
.;y ;g , 3.2.1.2 Individual Valve Control Circuits q .g Valve control circuitry provided for both motor-operated and solenoid-h2 ,1 operated valves in the CIA and CIB system is designed so that, in general,
% valves and dampers, once closed, can be reopened only by actuation of a local .w *$ control switch. A typical arrangement for motor-operated valves is illustrated gd g in Figure 2. Iccal control is accomplished by a normally open (momentarily closed) switch contact in series with the valve-opening coil. An auxiliary M
sp contact in the valve opening coil in parallel with the switch contact provides 4 a current path while the valve opening coil is energized. Any ESF signal, w energizing appropriate slave relays, causes contacts in the valve closing gs., e circuitry to close, thus supplying power to the motor operator closing coil,
.N w
Eh W
'% :gr
.tf d,b. Franklin Research Center Q ^ h or m r= = n m aa. $3
Y i.. (.y .
<M M .h TER-C5257-207/208 M
y a h Removal of the ESF signal, while de-energizing the slave relay, and unlatching G it if the removal is accomplished through " reset," cannot cause the valve to . h V change position.
@m Solenoid valve control circuitry behaves similarly, as shown in Figure Q ;) 3a. When the solenoid is energized (valve open), an auxiliary contact $$ provides a circuit path aqound the open contact of the manual control switch.
f This network is connected in series with the contact from the slave relay. When a slave relay is energized, its contact in the valve control circuit ]11 T opens to de-energize the solenoid. Upon " reset," the slave relay contacts M;;
~
reclose, but the solenoid remains de-energized since both the manual switch M contact and the solenoid auxiliary contact remain open. N
.g.] The single instance observed during the audit of Licensee-supplied .. ;Q -
circuit diagrams associated with CIA and CIB where a valve will change
.f position upon reset was the air ejector vent to atmosphere. As shown in
[N Figure 3b, the slave relay contacts are;,in a simple series arrangement with
# the solenoid (i.e., without any auxiliary hold in. contact) .
M m - s-4 lkl 3.2.2 containment Isolation System Design Evaluation \?C l ~[ef " Reset" switches provide for SAF-OUT devices employed in CIA and CIB are l$ actually overrides which will block an output signal with an input signal
- .y a present and will not allow reactuation by a second input signal unless the n
} first signal has cleared. SAF-OUT devices for these systems are, however, actuated by a single parameter signal (safety injection actuation for CIA, E high-high containment pressure for CIB).
y No special physical features have been provided to facilitate administra-l :< tive controls over the use of these overrides. The overriden status of these y systems is not annunciated.
- h
N The Licensee has stated [6] that all instrumentation and control systems 1 ".!S. l , associated with ESF systems were defined as safety-grade equipment and met 16% l.xT applicable safety standards at the time of purchase and installation. n l a.1 ,vf 'i1 1% Bi - lL 'N :.
>> branklin Research Center Acmmonornevm un m
- !]l4 lC u - __ _ _ _ _ _ _ _ _ _ _
. :. x - . _ . .
- g. a M
s ij TER-C5257-207/208 SW
- 6
.aC
% An audit of valves actuated by CIA and CIB has revealed one valve (air
~g ejector vent to atmosphere) which will reposition upon ESF " reset" (i.e.,
override). This valve is not a containment isolation valve in the accepted Yl sense of the term (e.g.,10CFR50 Appendix J) . It isolates the noncondensable
'h gas discharge frosa the air ejector after condenser. The auxiliary steam T supply to the air ejector is tripped shut by CIA and will not change position upon CIA reset. Further, the air ejector vent isolation valve is normally (i.e. , unless tripped by CIA) controlled by a high radiation signal and can be
'Nj open only when a high radiation signal is not present. This feature shuts the s isolation valve when required by plant conditions (i.e., high radioactivity in
,3 the condenser) .
3.3 OTHER ENGINEERED SAFETY FEATURE SYSTEMS 3.3.1 Circuit Description f.h
.m .
5 3.3.1.1 Iagic Circuits for Trip, Seal-in, and Reset g Feedwater isolation and containment spray circuitry were reviewed. Containment spray t' rip, seal-in, and reset is essentially identical to that ! . ..g previously described (Section 3.2.1.1) for CIB, except that two simultaneous, [h @ independent actions are required to manually initiate spray.
? The feedwater isolation system, shown in Figure 4, is formed from a 8 complex of subsystems operating on three groups of components (i.e., turbine v$ .g and main feed pumps, bypass control valves, and feedwater control valves) .
The main feedwater isolation valves are part of the first group. Each of l' these groups will be actuated by either high steam generator water level Ej ! .;g (control system trip) or safety injection. In addition, the feedwater control ly valves will be closed by low T avg coincident with reactor trip. \4 A pushbutton " reset" is provided for the bypass valves only. The SAF-OUT f i] devices for the feed pump / turbine trip and feedwater control valves act as [, non-inverting. drivers (although they may be reset through the multiposition lh; test circuitry). Latching-type slave relays are not used in these two 3 M l3 .
"?[q M
_g_ lq -& I$ b ranklin Research Center
-{ A DMoon of The Frannhn m *
. ... --. ; . . . :. - . , . : :.- -...-2-- -
-r=
.x y
i .. '
.2 i TER-C5257-207/208 3.
u;., circuits and, consequently, slave relays will de-energize and their contacts '3 will return to their normal (i.e., non-ESF) condition upon input signal - T clearance. In the case of the feedwater control valves, a reactor trip input
.N will seal in the output signal from the universal board until all initiating M"
Es1 trip signals have cleared and the reactor trip breakers have been manually M reset. ,% i G U- 3.3.1.2 Individual Valve Control Circuits
.ke e.;(
. In general, motor- and solenoid-operated valve control circuits in the y containment spray and feedwater isolation systems are designed to preclude Vt.4 g valve repositioning upon reset or signal clearance. These systems use control I circuitry fundamentally equivalent to that described in Section 3.2.1.2 and
.s .
/t w
shown in Figures 2 and 3a. Two exceptions were noted. Circuits for the q . . r. feedwater bypass control valves, illustrated in Figure Sa, and feedwater flow y control valves, shown in Figure 5b, are. designed so that these valves will be 3 -
~q c... .
restored to their modulate position (i.e., position called for by the
,@ feedwater control system) when the aspropriate slave relay is de-energized.
9,.o 3.3.2 Other Engineered Safety Feature System Design Evaluations ' si , '..m.k SAF-OUT devices used in the containment spray and feedwater isolation ' 2i[ systems are identical to those used in the CIA and CIB systems. They are 3 7 capable of being overriden to block a safeguards output with an input signal
#.Y Q present and will not allow reactuation by a second signal unless the first h signal has cleared.
dl
@w.
Pushbutton-type switches are provided for the SAF-OUT devices employed in N the containment spray system and feedwater bypass valve subsystem of the
@n feedwater isolation system. The containment spray SAF-OUT device is actuated
- . R.
y by a single parameter signal (i.e. , high-high containment pressure) and thus M jf poses no violation of Criterion 1. The feedwater bypass valve SAF-OUT device,
'W jf however, is actuated by either of two parameters (i.e., safety injection
- r actuation or high-high steam generator water level) and, since the overriding I.{fj of one signal will block the other, constitutes a violation of Criterion 1.
p~s
;6 9 'd W w 000 Franklin Research Center A cma n at m rranen %
- j#;d
~,n u
fj Mg TER-C5257-207/208
!.T
- .n Na gh Pushbutton-type reset switches are not provided for the feed pump / turbine trip or feedwater control valve subsystems of the feedwater isolation system.
$5 No special physical features have been provided to facilitate administra-Ys T tive controls for the " resets" (overrides) associated with the containment b - spray system or feedwater bypass valre portion of the feedwater isolation 4 system. The overridden status of these systems is not annunciated.
The Licensee has stated (6] that all instrumentation and control systems associated with ESF systems were defined as safety 1rade equipment and met 15 applicable safety standards at the time of purchase and installation. 1 4 An audit of valves actuated by containment spray and feedwater isolation 7 systems has revealed two groups of valves which will reposition upon ESF j " reset." Both the feedwater flow control valves and the feedwater bhass h valves will return to their modulate (i.e., that dictated by the controller) [ position when associated slave relays de-energize. 4, - Nr,- a In the case of the feedwater flow control valves, no manual (i.e., push-button) reset is provid,ed. The SAF-OUT device for these valves is a non-inverting driver which will de-energize its master relay when its input
%) signal, from an upstream logic device, clears. This logic device incorporates
.:4.
y a signal seal-in based on the status of the reactor trip breaker to prevent 2,${1
/; automatic clearing when the isolation signal is accompanied by a reactor w
qJ trip. A review of the feed and condensate system has determined that the Ed reopening of the feedwater control valves following a feedwater isolation M ,:9 signal will not reduce below two the number of isolation barriers between the 1,5X l e,n steam generator (or auxiliary feed pump discharge connection) and the low % pressure portion of the feed and condensate system for either isolation signal y ,w that might not be accompanied by a reactor trip (i.e., manual safety injection actuation or high steam generator water level). In either case, the $.a y iy initiating signal will shut the main feedwater isolation valves and trip the ,~ LA. 4 < main feed pumps. The main feed pump trip will cause the feed pump discharge $C valves to shut. Neither valve will automatically reopen upon the clearing of 4 y the isolation signal. y:; %a n
.H Y O
$y b Franklin Research Center
- g A com.on et The Franmun in iuc.
M- :
i
.~
' h-t l TER-C5257-207/208 In the case of the feedwater bypass valves, repositioning will follow a
?;; .
single operator action (depressing the feedwater bypass valves blocked " reset"
~
f. g.P [ pushbu'. ton) , regardless of the status of isolation signals. Further, the
? reopening of these valves, since they bypass the feedline isolation valves, r
'3,e results in there being only two valves (the feed pump discharge valve and the
.f$j feedline check valve) between the feed pump and the steam generator. In the q i d unlikely situation of the failure of the feed pump to trip in response to the c%
- Sy
. isolation signal, only the check valve will remain, and steam generator feed
,y C will occur should the bypass valves be open.
2 . %n d Ih'! n .. b 0 74 w 5C _yrj '- - dl . m A -b
~
c' - - .
.a$:s 3.2 's d.l
- ?
- !t
.9 1.7. ,%
l Yr
.'2 n:]
e'. 5
'i//
w c1 .
'YJ g ._ : ,. E,.
..m lls ?N d'E s
~O
$ 'NE y l1
- D
.n:i
- c. _11_ % -
%y A Rese
@.3a ' 00h% ranklin w % arch Center M I
- _.-- .- - , , . n ,_. -_
,y
.N M
.h TER-C5257-207/208 4.,%
M
- 4. CONCLUSIONS AND RECOMMENDATIONS b
gM The electrical, instrumentation, and control aspects of the engineered
-[l safety feature (ESP) systems at NAPS were reviewed and found to be in substantial compliance with the NRC design criteria. The following section t
f identifies (1) the extent c" compliance with each criterion, (2) the d
.m Licensee's msition concerning these criteria, (3) conclusionn and Nq recommendations, and (4) proposed modifications based on existing conditions, where appropriate.
6 D 4.1 CONTAINMENT VENTILATION ISOLATION SYSTEM 2 Staff criteria do not apply to the CVI system at NAPS as discuss,ed in M Section 3.1. o 4.2 OTHER ENGINEERED SAFETY FEA'57RE SYSTEMS w.r -
+v . 'N 4.2.1 Criterion 1 3" .
J 4.2.1.1 Existing Condihion
'} Circuitry provided for the control of the feedwater bypass valves does y not satisfy Criterion 1. The " reset" provided at the SSPS SAF-OUT board for
- y:; this subsystem is'actually an override. The override will terminate an output h signal and block system actuation by a second input signal until the first is R
g; cleared. k.:~ !? 4.2.1.2 Licensee Position y y 9 "A two position, " Normal - S/G Wet Layup" keylock switch located in eacn 41 Train A and B system protection rack will be added to the EW bypass valve h circuitry such that when the switch is in the " Normal" position (station M % in any operating mode except cold shutdown or refueling) the FW bypass valve reset switch will not permit opening the valves until the trip 7; signal is cleared. When the station is preparing to place the steam fg generators in wet layup, the above mentioned keylock switch will be placed in the "S/G Wet Layup" position which will allow the FW bypass y reset switch to perform its reset function. In this case, the signal Qj being blocked (Hi-Hi SG level) is not considered to be a safety signal. > lC Keylock switch operation will be administrative 1y controlled in the ll% Station's Operating Procedures." w i:' 1-0000 Franklin Research Center
, A cw==n om. Franan m n,.
. . . - . . . ~ . . . . . . . . . . - . . . . - . . . . . . _ . . _ . . _ _ . .. . . . . -
T.;.ff M '
.?
O l 3 TER-C5257-207/208 M
?.t . If A
4.2.1.3 Conclusions and Recommendations ;
.]
h The proposed keylock switch, a two-position switch to be located between - Q( the pushbutten contact and the R input to the bypass control valves SAF-OUT . k
.M'S device, will prevent an override of the SAF-OUT device when open. With this switch open, depressing the reset pushbutton will unlatch the bypass control valve subsystem slave relay (K636), allowing the slave relay to change 4h position if the master relay (K520) is de-energized. With a continuous open y) at the R input, the SAF-OUT device acts as a non-inverting driver, q
jg de-energizing the master relay only when all input signals are cleared. This T .
% $ modification, combined with the Licensee's provisions to ensure that the y proposed keylock switch will be closed only during cold shutdown or refueling, ld meets the intent of Criterion 1.
~
j.h .* 2 3 4.2.2 Criterion 2
$)w.
M 4.2.2.1 Existing Condition - $b N Systems employing pushbutton-actuat d " resets'! (i.e. , containment h din isolation Phase A and Phase B, containlIbent spray, and feedwater bypass valve 3 isolation) do not comply with Criterio& 2. These " resets" actually function 'D as overrides and require appropriate physical features to ensure that they f cannot be operated, inadvertently and are operated only with proper supervisory M control. @tw h 4.2.2.2 Licensee Position
@y $ " Based on NBC interpretation of Criterion 2, Vepco will initiate a Q modification that involves the addition of covers to the pushbutton reset 45 switches for Containment Isolation - Phase A and Phase B, Containment N Spray, and Feedwater Bypass Valve Isolation. Because of the modification h that will be made to address Criterion 1, it will not be necessary to include the Feedwater Bypass Valve Isolation under this criterion."
e&
$ 4.2.2.3 Conclusions and Recommendations N
[d The modification described should prevent inadvertent operation of the k% reset pushbuttons. If the covers are supplemented my suitable instruction y( (e.g. , warning criteria) to the operator concerning the effect of these b , n. nklin Research Center k
d
&g i,N a
M ih n TER-C5257-207/208
".i3 w
M q pushbuttons or the authority necessary to operate them, Criterion 2 will be 7 satisfied. kic
% 4.2.3 Criterion 3 Y
4.2.3.1 Existing Conditions e A Systems employing'pushbutton-actuated resets which are operable during M N. Plant conditions other than cold shutdown or refueling partially comply with lj Criterion 3. These systems are provided with an annunciator window that 6 indicates the status of the associated master relay. Rose annuciators are
- M g illuminated upon receipt of ESF actuation signal and will clear on system "P.ESBT. "
g M3 4.2.3.2 Licensee Position M It is the Licensee's contentfod that existing indication supplemented by , _ ~ . 'y appropriate operating and annunicatos response procedures is sufficient to QN satisfy Criterion 3. Since a safeguards actuations signal will illuminate the
. 4 m
d appropriate annunciator window,. the operator will know that such a signal exists. Likewise, since the only way to extinguish this annunciation is to operate the appropriate reset pushbutton, the operator will be able "to verify 8 4 that a signal has been reset (overridden) ."
- e jp 2 e Licensee has further stated that provision for additional annuncia-
,.s g3 ,- tion is, in their opinion, redundant and would require extensive changes to
, @g the SSPS, including alterations to the safeguards driver printed circuit board. h mt [ 4.2.3.3 Conclusions and Recommendations k ce The existing system is judged to partially satisfy criterion 3 in that it 7,' can indeed indicate to the operators when a system has been overridden (i.e. ,
- c W
the RESET pushbutton depressed with a signal present) since the indicating
@ light will be extinguished when the master relay is deenergized. This arrangement will not, however, in itself unequivocally identify the plant h,p,
{ status since the same indication will be provided when the system is reset u
-g (i.e., the RESET pushbutton depressed af ter the initiating signal clears) .
9 nklin Research Center 4:, a ca an or m n.n n m. l~ _ ___-._m<,-
, m , m- , __ . _ _ _ _ _ _ , _ _ - - _ - .
4 TER-C5257-207/20 8 9 The Licensee has agreed to update operating and annunciation response
.e j procedures to indicate that the containment isolation and containment spray '
G .
'] annunciators " provide information as to the reset status of the associated ESF n ;,}.; signal." While such a simple statement would not appear to adequately address the staff's concern, it is likely that the existing annunciation in y$' ?.e conjunction with appropriate procedural warni.gs and supported by additional q a W
information available to the operator (e.g., plant parameter values and memory yg board indication of universal board status) could be used to ensure that the M operator is aware of the fact that a safety signal has been overridden (rather
-;-:1 than just RESET). The NBC staff should require 'that the Lice'nsee provide a
- c f' comprehensive approach to determining system status using installed
- d[
y .:p annunciation.
$.b 9 4.2.4 Criterion 4 k.r. .~ ~ ]$ Criterion 4 is not applicable at NAPS.
W . .c, - W N 4.2.5 Criterion 5 ;' ij w 4,. 1 j ESF instrumentatidn and control sylstems at NAPS comply with Criterion 5. j:)
- j Criterion 6, 4.2.6 d 4.2.6.1 Existing Conditions f Three instances were found where the resetting of an FSF signal will y cause valves to change position:
JS yJ o air ejection vent to atmosphere isolation valves g c o feedwater flow control valves u $ o feedwater bypass control valves. eq' 'n ni T 4.2.6.2 Licensee Position b !fg o Air Eiector Vent to Atmosphere Isolation Valves - m 34 "Vepco does not intend to make any changes under Criterion 6 concerning the circuitry for the air ejector vent to atmosphere d isolation valves, since the present circuitry receives a high ] radiation signal and a containment isolation Phase A signal even
.Q 4 83 ,.
00hd Franklin Research Center A cam.on or n. rr.non m "Nb - . . , - . - - - _ - _ _ _ _ - -
~
..:s b
h
%$ TER-CS257-207/208 h
h,gi though this valve is not a containment isolation valve. For this circuit, if containment isolation were reset and there was a high
'9 radiation condition, the air ejector vent to atmosphere isolatica valves would remain closed. If no high radiation condition were p present, no detrimental situation would be encountered if the valve j opened after resetting containment isolation."
JQ - . o Feedwater Flow Control Valves -
, "In the case of the feedwater flow control valves no manual (i.e.,
pushbutton) reset is provided. The SAF-OUT device for these valves is Ml a non-inverting driver which will de-energize its master relay when f its input signal, from an upstream logic device, clears. This logic m device incorporates a signal seal-in based on the status of the yi reactor trip breaker to prevent automatic clearing when the isolation
-* l signal is accompanied by a reactor trip. Review of the feed and condensate system indicates that the reopening of the feedwater control valves following a feedwater isolation signal will not reduce
, below two the number of isolation barriers between the steam tjenerator u 3 (or auxiliary feed pump discharge connection) and the low pressure Y$
portion of the feed and condensate system for either isolation signal that might not be accompanied by. a reactor trip (i.e., manual safety M injection actuation or hi'gh steam generator water level) . In either Yi of these cases the initiatit!g signal will shut the main feed line 2 isolation valves and trip the main feed pumps. The main feed pump ' 3% trip will cause the feed pump discharge valves to shut. Neither valve l D will automatically reopen upon the clearing of the isolation signal. hl'i Based on the foregoing Vepco does not intend to make any circuit modification with report to the valves." l l
? l 4 o _Feedwater Bypass Control Valves - l c !
@d "Upon completion of the modification as described under Criterion 1 i Q.. 1 g;g -- above, during normal operations it will take two (2) operator actions to reset the FW bypass valves following the initiation of a SI signal: (1) reset of SI and (2) reset of EW bypass valves. The resetting of
@ the bypass valves following a steam generator Hi-Hi level signal will W be possible only after the signal has cleared and is really not an issue under Criterion 6 since the Hi-Hi level signal is not an ESP M signal. It was added to the design to provide equipment protection $$ (prevents moisture carryover to the turbine) ."
5 g 4.2.6.3 Conclusions and Recommendations f.D o Air Eiector Vent to Atmosphere Isolation Valves - The present circuitry is considered to be an acceptable deviation from Criterion 6. M 4* : M NU Franklin Research Center
\
l g a >=oaorn.Fr=wn m 4' -he=6 -ee-6 . e -eme -ee e m ee.-.e
- . . . . ~ ... ......s. .. - ~ ... . ..- n -. . .. - . . ~ . .?--. . .: . . . - - -
) .
EE
, TER-C5257-207/208 sg 4
o Feedwater Flow Control valves - The present circuitry is considered to
;A be an acceptable deviation from Criterion 6. .
I:/* o Feedwater Bypass Control Valves - The circuit modification proposed by
.9 the Licensee is such that, in the more important case of feedwater .g?; bypass control valve isolation consequent to an SI signal, two Q,$ operator actions are required to reset the slave relay for these i2 y valves. While not altering the fact that the individual valve control x1 g circuitry remains in violation of Criterion 6 (i.e., the bypass -3 control valves may change position upon reset notwithstanding the % number of operator actions required to cause the reset), this &g modification provides additional assurance that this repositioning 3 will be undertaken deliberately and under stable plant conditions.
5 W This result is similar to the situation which would exist if the
$sj individual valve control circuits were modified to require a separate H
l$
~.
operator action to reposition [th'e valve following reset (in g< conformance with Criterion 6) . ihe difference between the two situations is that in the former case, proposed by the Licensee, the s, . ,. c repositioning action takes place at a pushbutton labeled " reset," 99l
- G . ~-
.7 whereas in the latter case the repositioning action takes place at a
,- switch suitably labeled, presumably, to identify the device controlled.
y Consequently, the arrangement at NAPS should be found in compliance w" l- with Criterion 6 if the feedwater bypass control valve reset rushbutton ) .:y ". 1 is relabeled or provided with an appropriate warning sign to identify IX3 Its the consequences of depressing the button. lOM l$ W LIY lC T dE l4 }f41 i
- 1. -
l@ l% l$5 ' l# lt.~ _17-1.x A Nd 0000 Franklin Research Center I,( A Chaman et The Frannien usease
m - - - h
.1 E.1 N$
7f: TER-CS257-207/208
.y w
M 5. REFERENCES li2)
- 1. O. D. Parr (NRC) h Intter to C. M. Stallings (VEPCO) j-3 Suoject: Containment Purging During Normal Operation 45 11 Dec 1978 1
- 2. C. M. Stallings (VEPCO)
Letter to O. D. Parr (NRC)
Subject:
Containment Purging During Normal Operation 17 Jan 1979 'M.
'S 3. A. Schwencer (NRC) h Letter to W. L. Proffitt (VEPCO)
)
Subject:
Request for Commitment on Containment Purging jJ 30 Oct 1979
?d si
q 4. C. M. Stallings (VEPCO) yg Letter to H. R. Denton (NRC) pg
Subject:
Request to Interim Position on Purging Operations
?,g 20 Dec 1979 '
x 39 5. H. R. Denton (NRC) c... Letter to R. H. Leasburg (VEPCO) .fM
Subject:
Request for Addition &l Information - Bypass and Reset of ESF {;g's 25 July 1980 . m ,
'7 6. R. H. Leasburg (VEPCO)
M Letter to H. R. Denton (NRC)
Subject:
Information on Bypass and Reset of ESF y; 1 July 1981 E'd di 7. C. M. Stallings (VEPCO) %j Letter to H. R. Denton (NRC) M Subjects Information on Bypass and Reset of ESF M 26 Nov 1979 Jpg 8. E. R. Sylvia (VEPCO) 'Q Letter to H. R. Denton (NRC) h gg
Subject:
Information 7 July 1980 on Bypass and Reset of ESF 2. 3 9. R. H. Leasburg (VEPCC) iB Letter to H. R. Denton (NRC) J[Zj$
Subject:
Information on Bypass and Reset of ESF 22 December 1981 Tj he
'M '0h k
u o s _ nklin Research Center g A DMoon of The Franen insonae M*
. .. m. .s __ .. . . . . . . . . . . _ _ _ _ . _ _ . . _ . . . . . _ . . _ _ . . ._.___. -
5 y ,
.,p ' f.s TER-C5257-207/208
- m
.1%
yin 4M g 10. R. H. Leasburg (VEPCO) s.'d
% In tter to H. R. Denton (NRC) .gj
Subject:
Additional Information on Bypass and Reset of ESP , if 19 Feb 1982 g 11. R. H. Imasburg (VEPCO) N Intter to H. R. Denton (NRC)
Subject:
Additional Information on Response to NRC Technical Evaluation,
'{ Bypass and Reset of Engineering Safety Features, North Anna Unit Nos.1 and 2 8 June 1982
-Q k
+
b 2?-
;h G
069 - - r,:. n ~ en n 5.%
- bN e .
W2 - f6
'p
;~,;.
' q.
.e g
'St .
I-l1
.ay e
at yt M; k; 4 R&c Oh
.y .'y:1 i&
t 'b 'N
~n i1
\3 j .* - j 4MU Franklin Research Center . 'ff l 3,c m on or n. Fr.non insou. i.H
[ fbi Ib d $h,N['L$/[N hiM hk b .S .d h b E N 6 ['f[$hh ' h khMkOYhb b d Th{jI M k.M d M d k y/.Q g K y .], i l I f t I, i t a g e=> 2 s E-a :i' N
+
d! 120 VAC 120 VAC g3* 48 VDC / o SLAVE i gh g
- o (LATCH) j
*{ .
t o O----__lrOo SLAVE o (UNLATCH) l i MASTER ;o_ _ _ _ _ 4 i O w Y-AUTOMATIC a w ACTUATION SIGNAL (S) S o 1 g
? 1 Cl SAF OUT MANUAL o o o C1 Cl
" ACTUATION
RESET R 1 V V 2 M um 4 i 1 w o Figure 1 w Containment Isolation Phase A/B N N O CD l
$$dfhh.NNINys JIkb[($2b IhkSI' bI b b E Y' ' ' ' ' ^
^
i i i I. l
<= !
c=>
- 7: ,
5 a E ' > a 5' [_4 LS _~ LS 2.9 r, M
- t
;$LS }d TS .'1 LS
_ TS ( *?. a t4 u (OPEN) ,
$g = ,,p_. ________. l (CLOSE) o SSPS I 120 VAC ~~~~------ -
- 52C ESF
- s' " 8 '. ~
~ SL4VE
~
- y. 52C f 52 7 O 5
0 52C
- 1 e
' t I 49 (OVERLOAD)' @ '
t ' ui M
' ui I 4
.i N i o ;
4 . Figure 2. Typical Motor-operated Valve Contsol Circuit \ P as i i. i i l af
b Y hYb??$b1l $kYb ?: -iY$4 khYL$tf NNYh$?Yk( M b h ${f':{nt'likh?YYkk E k k?- -:!$Y _Y E _ YY?$$5ffh0lh$tk'[Q h;3 i
}
EL
" l >m A
o 2E , EL 3
- a O
4 CLOSE , TEST n . OPEN ON ~ ] E@R f
- HilHI R=ATiON SOv. = = u pOPeu
_ 4 SSPS _e SSPS 7~ SLAVE 7 SLAVE ;e 4 u 4
' _ /_ CONTROL INTERLOCK [
/- PERMISSIVE y
, I i
SOV SOV l i 1 A 8 t
- % F n.
4 l i
. l -
Figure 3. Typical Solenoid-operated valve control circuits a s 2 N O CD 1 J
,$ll5..YlNh h y-Yfyfh ,_, * '$lhg'{kE5Q.?h?$;'1'? lp( ' }l: sl{.'1: y r_ {i;.ll% ,iif&;*7)-h'fQj ::,QqQQf h5)kQ] $$,h Ykf-?h l ' f?$$g;)l:{f+.;Q,{Qhjfq,y:,h':j;R>}g f ,_ Ie 8 I (TURBINEfFEED PUMP TRIP MAIN FEEDWATER ISOLATlON VALVES) 7 f$i SGHWL K508 5f gm S8 UNIV O A313 8 ggp O y + 48V OUT l -
. to Si t12 f ASIF l8 gi; S R ' W 120 VAC TEST CKT K621 ' t.r kO Hi - = !.
K520 (FW BYPASS CONTROL VALVES)
- S SAF O Wg
+ 48V OUT- I K636
--* A51,7 la f R
'i'
' 'HP 120 VAC -
s e i t LATCH t r I \f * \ N W {' E (RESET) l [
- c K638 (UNLATCH)
'HP 120VAC
~ O UNIV SAF LOW TAVE A213 OUT A517 REACTOR _ TEST CMT R K50F (FW CONTROL VALVES)
TRIP
, , y + 48V ,
I 84 450 y iI -320VAC o K620
- g m
-J I
N o e 4
. N
- N Figure 4. Feedwater Control Logic '
o
d$kkO L$bk $ Ab .'t b N 0Y : ' $5 bt'* !5 Y! Y$ # ' " ' ' ' bI l5
= $7 a
n E en
$N $ SSPS SLAVE
- SSPS SLAVE (FWI)
~ 4 In:r ._ K601 (SIAS) 7 %a K636 . ~
i 7 ~ (FROM FIG. 4)
*h
- SSPS SLAVE
~ d K620 (FWI) 7 (SEE FIG. 4)
. , e
.g i a i u -
Y , SOV SOV A: FW BYPASS CONTROL VALVES B: MFW CONTROL VALVES N w
, A u
u m - l 4 l Figure 5. Feedwater Solenoid-operated Valve . Control Circuits 1 y i -4 N u
' O CD
\
3 1
,s,
.Y. , TER-C5257-207/208
- a. APPENDIX A - RESOLUTION OF DRAWING DISCREPANCIES -
.Gi
-;w *
) A.1 UNIVERSAL BOARD INTERNAL WIRING
,h The circuit diagram provided for the Universal Board (Ref. Dwg.
'dj 1046F57-A) showed a connection between the output of the logic gates and the
.a 9u output of the multiplex systems used to provide monitoring information to the
}!/ computer. This connection was questioned, and a check was made against the I.7$ generic Westinghouse drawing Universal Board Schematic Diagram 1046F57. The connection in question does not exist on the generic drawing. This ,
discrepancy has been noted in a prior review and was determined, in that case, u:.f jg to be an error on the plant-specific drawing. . r 9... w.
.:d -
..q Y
,f.? '
u . ms -
.;q
_m .jp M .: s-
, -n M2;v ,
- ,3
.A df l Mj
;e p.1 s
>es lRGh 1 l x.i l TJ 9:
+
4m 4 18
.1.,<C 4.hI ,_
=
$ , f,b tI.7, d 0 Franklin Research Center r 'g"[ < A QMoon of The Frannan insonae
'+.
f:}}