ML20027E281

Safety Evaluation Supporting Electrical,Instrumentation & Control Design Aspects of Override of Containment Purge Valve Isolation

ML20027E281
Person / Time
Site:	Crane
Issue date:	11/02/1982
From:	NRC
To:
Shared Package
ML20027E275	List: ML20027E274 ML20027E277 ML20027E281
References
TASK-2.E.4.2, TASK-TM NUDOCS 8211120508
Download: ML20027E281 (2)

Text

..

omw Enclesure 2 h

Io

,,[?,..-cg

~ UNITED STATES g

NUCLEAR REGULATORY COMMISSION

[

.-g

,jj WASHINGTON. D. C. 20G55 o, p j

c.

.....f m,

vo t,

m, SAFETY EVALUATION REPORT THREE MILE ISLAND UNIT 1 OVERRIDE OF CONTAINMENT PURGE ISOLATION Introduction

.1

~

Instances have be'en reported at. nuclear power plants where the in) ended __ ~

automatic closure of the containment purge / ventilation valves dur.1nga

- 6 2

signals were inadvertently overridden and/or blocked, due to desigri ~

~

l postulated accident w60Td'not-.have occurred because the safety actuation. . ~~

~

deficiencies.

These inst'a6cfd were determined to constitute an bnoriiIa1

'l h

f Occurren ce- ( #78e5-)J As a. follow-up a.ction..NRR issued a_ gen,eric_lptter

_g requesting each licensee to-fake certaTn actions.

,,,. o.-

.r

~.

Evaluation The enclosed report " Electrical, Instrumentation and Control Aspects of the Override of Containment Purge Valve Isolation," (EGG-EA-5167) was j

prepared for us by EG&G, Idaho as part of our technical assistance contract I

program.

The report provides their technical evaluation of the design compliance with NRC provided criteria.

Concl usion The contractor's report concludes that the unit meets the NRC guidelines j

except that non-safety grade radiation channels are used for automatic closure of the purge valves. We have determined that the resolution of TMI Action Plan Item II.E.4.2.7, Radiation Signal on Purge Valves, adequately addresses our concerns with respect to the radiation channels.

In a letter dated April 22,1981 (Reference 1) the staff determined that the licensee had met the requirements of II.E.4.2.7.

Therefore, the exception as noted by the contractor has been resolved.

Based on our review of the contractor's technical report, we conclude that the electrical, instrumentation and control design aspects of the l

override of containment purge valve isolation are acceptable.

This safety evaluation was prepared by T. Alexion and J. Calvo of the Operating Reactors Assessment Branch, Division of Licensing.

8211120508 821102 DR ADOCK 05000289 PDR

2-L References 1.

Letter from John F. Stolz to Henry D. Hukill dated Apri.122,1981, StBJECT: Safety Evaluation Reports for Items Contained in NUREG-0694 and Enclosure 1 to NUREG-0737 Outside of the Content of the Commission's Orders of August 9,1979 and March 6,1980 Required

~

by Restart.

y i

~

~

... _ ~.

.;.~.

s.

j...

-as

... :c_.

r.

e ;.

.~.

~

3 O

f e

I

(

1 l

l i

~ - -

l ~

EGG-EA-5167 n

June 1980 i

L.

ELECTRICAL, INSTRUMENTATION AND CONTROL ASPECTS OF'

-.e.i s

J THE OVERRIDE OF CONTAINMENT PURGE VALVE ISOLATION AND OTHER SAFETY FEATURE SIGNALS, THREE MILE ISLAND -

UNIT 1, DOCKET No. 50-289, TAC NO. 10205

.~~

A. C. Udy

.. a~.

r-

. u.

s

.r.

. e-t-.

. 4j

• *'.(. f

~..

s.

U.S. Department of En. er.m UJ Idaho Operations Office

• Idaho National Engineering Laboratory t \\

,===5 $N d

73.. h, $3[

?

Y

'I ?.T 5'l I

f m" W. Q~&W)v--=.m

.w,vm,--.

,?_ '.t

.1 l

W, wana owns, y.

-._i y; a.

2.G ? R, v_.6 d.__. 4...p p&.. & q m,5

.n.'

- ~ {,c -

W ;. :;,.-ge_ 2My-y _..y-,,-2,3 d[.E e-.....

oa : r en _. re re-w wr-== twur==www.

.h --

'r.

.h m r :;-g. ' - It r4

.=c v -T.'a--

%s.$p,..s

^

p

~' ~ Q

-9

_fR A

h

&T

'EklU*N

1. ~

~ l ~ ['~

. [. [ :

j,3 K - ",...'

_ _. _, _ _ -.. 7

_ _ _ m.

. ' "p i

.h e==' -a-y s, e, c.

\\

. ?t & Y

• 5 ~.

% _' * -~ ~ Y *M W-4 b

h.

'Nb N

7'f 3 _ i=:22:

w-

• .i--:rg'YWr$, Z$m.

aWWh;&g%

- ? % f..r 4

s

~

. 'M.g 5

k Ois k 4.

This is an informal report intended for use as a preliminary or working document Prepared for the U.S. Nuclear Regulatory Cot =nission Under DOE Contract No. DE-AC07-76ID01.5.70 0

b b E b Idano FIN No. A6256 pg

-O E G c G,.....

p rew mc 3.

. #ev 19J91 INTERIM REPORT

~

~

+

y

_ kcce.ssion No.

~

Re7 ort No.

ECC-EA-5167 C ntrtet Program or Project

Title:

_ Elsctrical, Instrumentation ar.d Control System Support 5.,

Subject of this Document: -

Elsctrical, Instrum&ntation"and Control Aspects.of the Override-of Con.taitiment. Purge b

Valve Isolation and Other Safety Fehture Signals, Three Mile Island - Unit 1,~

..,,'J-

'1~

Docket No. 50-289,' TAC No. 10'205

'. Type ef Document:

~

',,7,

.T-

.W Infor=al. Report ;

. j_,

., t

.,,a

... -, Z,

'Authtr(s):

A. C. Udy Ott] cf Document:

Jhne 1980 Risptnsible NRC Individual and NRC Office or Division:

Paul C. Shemanski, Division of Operating Reactors This document was prepared p'rimarily for preliminary or internal use. it has not received full review and approval. Since there may be substantive changes, this document should not be considered final.

EG&G Idaho, Inc.

Idaho Falls. Idaho 83415 i

l l

a Prepared for the U.S. Nuclear Regulatory Commission Washington, D.C.

Under DOE Contract No. DE-AC07 761001570 NRC FIN No.

A6256 INTERIM REPORT l

1227F 1

--.e..

O

~~

?

TECHNICAL EVALUATION REPORT 4

.. ~.

.~

• ;1 ELECTRfCAL, INETRUMENTATION', AND CONTROL ASPECTS OF..-

THE OiEi(RIDE [QF CONTAINMENT PURGE VALVE ISOLATION AND @ R. SAFETY FEATURE SIGNALS

.2

~

~.,9

~..:

p.

~

^

' l-

~

THREE MILE ISLAND ' NUCLEAR STATION, UNIT NO. 12 s Docket No. 50-289 TAC No. 10205 June 1980

)

A. C. Udy Reliability and Statistics Branch Engindef ng Analysis Division i

,.G&G Idaho, Inc.

E d

I' 9

. ~.

T s.

ABSTRACT Several instances have been reported where the automatic diosure bfC

~

~

'~

the containment vent'ilation.or-purge isola. tion valves would nof..have occur-red because..the safgty. actu[ tion signals,were manually overridden.[or inloc7e[, -

~

~

.s during. normal plant operations. This report addresses el.ectrig,al,3-instru,-

~

~

ment.ation, and. cont @l.desi}h aspects. for these valves, and the ability of....

.,g

.o

.~

- the unit containment venti'la, tion system to isolate on'several divgrse param.

u.

i eters. Other related. systems we.re audited to the,same guidelines..,

i l

i s

!.g

..I.,

(

,1 1

i

,b FIN No. A6256 EICS Support ii I

CONTEMES.

~.

i

1.0 INTRODUCTION

1

..s t.

2.0 EVALU'ATION OF THREE MILE ISLAND' NUCLEAR,STATIO_N,i, UNIT 1 2

2.1 Review Guidelines 2

2.2 Containment Ventilation Isolation Circuits Desi'gn Description 3

2.3 Containment Ventilation Isolation System Design Evaluation 5-

~

2.4 Other Related Engineered Safeguards Actuation System ~ ~

4 3.,.,.

Circuits 6_.,

3.0

SUMMARY

7

.- ~ ;.

7 ".'.. ~.

.. ~.,.

<- 6 s.

.]'..

4.0 REFEREN'CES.

~

t ~

=

. a 1,j

.-f

' 7,

~

w.

.I'*

_.f 2

.3

~/ '$

^

,0.

-.a

3..

d

)

-tt I't I

t l

l I

iii l

s

TECHNICAL EUALUATION REPOR"I ELECTRICAL, INSTRUMENTATION, AND CONTROL. ASPECTS OF

~

THE OVERRRIDE OF CONTAINMENT PURGE'VALV$ ISDLATION

• AND OTHER SAFETY FEATURE. SIGNALS s.

THREE MILE ISLAND NUCLEAR STATION, UNIT'NO. 1

~

1.0 INTRODUCTION

Based on the information supplied by General Public Utiliti'es (GPU),2 this report' addresset the' efectrical,"insYrsmentation, and ciinthol lystems.

~~

design aspects of the Containment Ventila~ ion Isolation (CVI) spstem and '-.c~.

t otherrelated'Enginekred.Salf'eguardsActua'tionSys' tem (ESAS) functio ~nsfor*

ihree Mi,le Island--Unit 1.;e-

.f4 i..

i._

.4.-

_:f ys 1

7' Several ins'tances have been' reported where the automatic c~l'osur.e bf 7

the contain=ent ventilation or purge isolation valves wo~uld not have' occur-red becausd the safety actuation signals were manually overridden or blocked during normal plant operations. These events resulted from a lack.of proper management controls, procedural inadequacies, and circuit design deficien-cies. These events also brought into quest, ion the mechanical operability i

of the valves themselves. These events were determined by the Nuclear i

g Regulatory Cocsission (NRC) to be an Abnormal Occurrence (#78-05) and accordingly, were reported to Congress.

~

I i.

As a follow-up of this Abnor=al Occurrence, the NRC is reviewing the electrical overridt aspects and the mechanical operability aspects' of con-tainment purging for all operating reactors. On Nove=ber 28, 1978, the NRC issued a letter, " Containment Purging During Normal Plant Operation"I to all Boiling Water Reactor and Pressurized Water Reactor licensees. GPU 2

responded to the letter by a letter of January 4, 1979.

After discus-sions between GPU and the NRC, GPU issued another letter on this subj5ct on April 3, 1980.3 Additional information is taken from the Three Mile Section 2.1.1.5, and the Final Safety Island--Unit 1 restart report 5

Analysis Report (FSAR). A telephone conference call on May 7, 1980, discussed the April 3, 1980 letter.

1

~~~ ~

EVALUATION OF ThREE MILE ISLAND NUCLEAR STATION, UhlT 1 2.0 2.1 Review Guidelines t

s.

The intent of this evaluation is to determine if the.following NRC requirements are met for the safety signals to all ESAS equipment:

Guideline No. 1--In keeping with the requirements of

~

e-1.

a G.eneral De, sign, Criteria 55 and 56,. the overriding og on.e type of safety actuatio~5 sign'al (e.g., radiation)"

' ~ ~ ~~ ~

-~

should not cause the' blocking of any other type of 4.

/J.'-

safety actuation.gignal (e.g.,, pressure) for those

'f5[

~

-4

~~!

valves tha.t have~nj function besides containment g

Isolation. -

~

S.Q i.

.22

- ~

.-M 2'.

~ Guidliine 'No.~2;_ Sufficient physfcal. features (e.g.,

,1

i-key lock switches) are to be provided to facilitate --

s~.,

adequate administritive controls.

3.

Guideline No. 3--A system level._annunci_a. tion of the overridden status should be provided for every' safety system impacted when any override is active.,

/

Incidental to this review, the following additional NRC design guide-lines were used in the evaluation:

,y l's GuidelineNo.4--Diversesignalsshouldbeprkvidedto 1.

initiate isolation of the containment ventilation Specifically, containment high radidtdon, system.

safety injection actuation, and' containment hi~gh pres (where containment high pressure is not a portion sure of safety injection actuation) should automatically l

initiate CVI.

l 2.

Guideline No. 5--The instrumentation and control systems provided to initiate the ESAS should be designed and qualified as safety grade equipment.

a 3.

Guideline No. 6--the overriding or resetting of the l

ESF actuation signal should not cause any valve or da=per to change position, following definition is given for clarity of use in this evaluation:

a.

The t

Override: The signal is still present, and it is blocked in order to l

perform a function contrary to the signal.

2 l

l 1

t

' ~ -

Guidalina 6 in this revicw applies pri-tr.ily.to otber related ESAS

~

circuits because implementation of this guidelin:. for containment isolation will be reviewed by the Lessons Learned Task Force, based on the recot=nend-y.

~.

ations in NUREG-0578, Section 2.1.4.

When containment isolation is not

-.e.;

}

involved, consideration'on a case-by-case basis of automatic valve reposi-tioning upon reset may be considered acceptable. Acceptability would be dependent upon system function, design intent, and suitable operating

~

procedures.

- C 2.2 Containment Venti,lation Isolation Circuits Design Dercription ~

'~

i s~

"2 Three Mile Island--Unit' I has two ESAS trains which close','indepin~'

~

3-dently,an,d sep;arately.,,thefi+nboard and outboard isolation valves.

Each '

-D

...L

.~

.,4

,.~

- valve can only be ' opened by,a ~ manual control switch if a key-operated per a z,

missive switch has been. operated.3 The key is removed'once the valve.is

'l opened.5

~~

The control system is such that the automatic closure signals will close the valves-even if the control switch is held in the "open" position.

The resetting of the isolation signal does not cause the opening or repo-sitioning of any CVI valve.4 Loss of power to the control system or loss of air to the solenoid valve closes the solenoid-operated isolation valves.

Motor-operated valves remain in their last position. Valve position lights,.

"open" and " closed", are provided on the control console.

The initiating signals which will close the valves are listed belew and in Table 2.1-1 :

1.

Containment pressure high (4 psig) a.

The following definition is given for clarity of use in this evaluation:

Reset:

The signal has come and gone, and the circuit is being cleared in order to retu n it to the nor=al condition.

3

~~

Reactor building eichaust monitors of E dioactijvity 2.

level as called out in the unit FSAR:

~-

L-a.

Air particle monitor b.

mine monitor c.

Radioactive gas monitor -

~

a 3.

Reactor trip.

, ~ -,..

~

n

~

...;.~-

s~

3 T-[

The actuation signal Tesulting from the automatic initiation signal..

[g.,

can be, reset, once tihe.iniWEtion signal is - gone, at the ESAS panel or at' a

~

_ g.g

^ ~

.y

~ benchboard to allow manual'-opening of the CVI valves. The permisgive, key 1.._._ g

~

switch will still need to be operated before the valves can be openede,

Individual initiation signals can be overridden. An override condition

=-

can only be established when an accident signal exists, and is automatically removed When the accident signal is gone. An audible signal informs the

-j operator that his action has established an override condition.

/

~

r

.g The inboard and the outboard CVI valves are controlled by separate

!g ESAS trains, with the three radiation monitoring channels also able to

• I f close both the inboard and the outboard valves. Once a closure signal has been received, the valves cannot be opened until the initiating signal is l

either overridden or gone (and the logic then reset by a manual pushbutton switch). There is provision to override an actuation signal from the radi-ation channels; this override is annunciated. A reactor trip actuation signal can also be overridden, as can the containment pressure signal, to l

permit valve opening. These override conditions cause an audible signal when established, and are automatically removed when the initiating condi-tion is gone.

The reactor trip signal, defined in iiecticn 2.1.1.5.34 as "antici-a.

patory of SFAS and occurs prior to SFAS initiation," occurs at 1900 psig i

reactor coolant system (RCS) pressure, while the SFAS initiation occurs at 1600 psig RCS pressure.

4 l

l-l

To raopsn the purge valves when cn isolation condition is present,

~

three actions are necessary for each redundant valve, The operator must actuate the override _ switch, operate, the permissive Rey switch, and operate b

the valve control switch.

e 2.3 Containment Ventilation Isolation System Design Evaluation Guideline 1 requires that no signal override can prevent another safety actuation signal from functioning. The signals can be individpally over-a ridden witheno affect on the o.ther actuat. ion sig,, alt; this conforms with -

n I" }"

f(( '

};.%

this guideli_ne.

M

'. _ c

.s.

. Guid_eline.2 rejuires-ppat any reset or override switches have' physical i..

. [-

provisions to aid'in the adm.i5istrative c[n' trol of the's' witched. With

~ ' '..

~d

~

~

..s.

~

I '.

'l.

key-locked permissive switches installed in the CVI val've opening-log'ic,

'this guideline is satisfied. The override switches do not meet the literal intent of this guideline; however, an override can only 'be established and ~

maintained when an accident condition exists. Once the override is estab-lished, the purge valves cannot be opened without using a key permissive switch.

This is deemed sufficient to facilitate administrative control.

Guideline 3 requires system level annunciation whenever an' override affects the performance of 4 safety system. Annunciation is provided when a radiation channel is overridden. Overrides of ESAS signals cause an audible signal when the override is established. While not in full compli-ance with the guideline, in all cases, the operator is informed by the control system that an override has been established. The override itself does not allow the purge valves to be opened. A key-locked permissive switch still needs to be operated. Additionally, the override is automati-cally removed when the actuating condition is gone. Annunciation, in addi-tion to these design features, is not deemed necessary.

Guideline 4 requires that isolation of the CVI system be actuated by l

l several diverse signals. Three Mile Island--Unit 1 uses a reactor trip i

l signal as anticipatory of a safety injection. This is acceptable. With I

5 l

~

high radiation signals and high,containm:nt. pressure sighals in tddition to the reactor trip sigq.als, this guideline is sati,sfied,.

L Guideline 5 requires that the isolation *'actuaeron si;gnals be derived from safety grade instruments. Three Mile Ialand--Unit 1 actuates closure of the purge valves by use of signals derived from safety grade equipment, except for non-safety grade radiation channels 4,5 The NRC should require.

~

the use of safety grade radiation channels to initiate isolation _of_the ]*

1.

purge. valve.s at Three Mile., Island--Unit Guideline 6 requires thht no resetting of isolation logic 'wilf, ;cf.Y][

itself, automatically, ope,n{the isolation valves. The CVI. valves have beep

'.'w:a modified as Sec. tion I.l..l.Si5 states: " deliberate operator action shall '

~._,4

_. ~.

v.

~ be required to reopen selebted individual val.ves."

Gdideline 6;is,

~

satisfied.

2.4 Other Related Engineered Safeguard Actuation System Circuits Other ESAS circuits have manual override capabilities. Table 2.1-l' shows these overrides. Applicable guidelines are complied with for.these circuits.

No other manual overrides have been identified in the review of the material submitted for this audit.

3.0

SUMMARY

The NRC issued a letter, " Containment Purging During Normal Plant Operation," which requested GPU to review purging requirements, controls, and procedures for purging at the Three Mile Island station.

The electrical, instrumentation, and control design aspects of the containment ventilation isolation valves and other related ESAS signals for Three Mile Island--Unit I were evaluated using the design guidelines stated in Section 2.1 of this report. The unit design meets the NRC guidelines 6

except that non-safety grade radiation channelsf.are used' for automatic closure of the purge, valves.

L The NRC should require GPU to submit pl'ans to-sup21y Three Mile Island--Unit I with safety grade radiation channels that will initiate closure of the CVI valves.

The.Three Mile Island--Unit 1 CVI syPCem is not in Compliagee.with t[he

~

literal requirements of gui_delines 2 and 3, which require pr_otective covirs_,

or other features for the override switches and annunciation wh'en an over-g...

ride ~ is established.. The NRC should accept the present design as adequate ~..-

e.,.

,~

T-j{

as pointed out in Section 12-3 of this report.

~ -

W-

- 582

4.0 REFERENCES

~, ' - '

.y

-z

.f j

...., 7, 1.

NRC/ DOR letter (A. Schwencer) to all BWR and PWR licensees, " Con-tainshnt Pu'rging-~ During Nor=al Plant' Operation," ' dated November 28, l'978.

2.

Met Ed letter (J. G. Herbein) to Director of Nuclear Reactor Regu-lation, "Three Mile Island Nuclear Station, Unit 1 Containment Purging," January 4, 1979, GQL 0007.

3.

Met Ed letter (J. G. Herbein) to Director of Nuclear Reactor Regu-lation, " Purge valves," April 3, 1980, TLL 157.

4'.

Three Mile Island Nucle'ar Station, Unit 1 Restart Report, Sec-tion 2.1.1.5 and response to NRC question 26.

5.

Telecon, A. C. Udy, EG&G Idaho, Inc., Dominic Dilanni, NRC, l

G. Sen, J. Korea, and D. Chisholm, GPU, May 7, 1980.

l I

l i

l i

7 I