ML20028G070

Forwards Response to 821227 Request for Info Re Plant Computer Sys & non-nuclear instrumentation-X Power Failure

ML20028G070
Person / Time
Site:	Davis Besse
Issue date:	02/02/1983
From:	Crouse R TOLEDO EDISON CO.
To:	Stolz J Office of Nuclear Reactor Regulation
References
899, NUDOCS 8302070369
Download: ML20028G070 (10)

Text

.- ..

l l

l TC'.EDO i EDISON Rowto P. Cmw License No. NPF-3 v. . n .,,,,

una Docket No. 50-346 "8'""

Serial No. 899 February 2, 1983 Mr. John F. Stolz, Chief Operating Reactors Branch No. 4 Division of Licensing U. S. Nuclear Regulatory Commission Washington, D. C. 20555

Dear Mr. Stolz:

This is in response to your Ictter dated December 27, 1982 (log No. 1165) relating to plant computer system and NNI-X power failure. Your letter requested information on operability of plant ccmputer system in the event of unavailability of YAU or YBU and the implications of a loss of NNI-X power supply transient. Attachment 1 provides Toledo Edison's response to -

your letter as relating to th; Davis-Besse Nuclear Power Station Unit 1.

Very truly yours.

[fh :- '

RPC:SCJ:llA cc:

DB-1 NRC Resident Inspector 8302070369 930202 PDR ADOCK 05000346 P PDR THE TOLEDO EDIGON COMPANY EDISDN PLAZA 300 MADISON AVENUE TOLEDO, OHIO 43G52 l

l

Licance No. NpF-3 Docket No. 50-346 Serial No. 899 February 2,.1983 '

Attachment I to Toledo Edison Letter to the NRC on plant Computer System and Loss of NNI-X Item 1: Toledo Edison Company letter dated July 8, 1981 committed to providing automatic transfer to a redundant power source for the control room annunciator system. We understand that this commitment is fully implemented. Toledo Edison Company also committed to a similar provision for the plant computer system which was to be implemented when the new plant computer was installed. We understand that the new computer was installed during the last refueling outage.

Toledo Edison Company is requested to describe how the commitment for the plant computer system has been impic-mented. Specifically, does the computer system remain functionally operable (cpu, I/O units, etc.) from the control room in the event either power supply (YAU or YBU) is unavailable? If the commitment la not yet fully imple-mented, describe the extent to which the present system operability is independent of a single power source, the nature of your intended actions to complete impicmentation, your schedule for completion; and thc compensatory measures in force in the interim.

Response: The overall replacement of the plant computer system has several phases, phase one was completed during 1982, when the central processor and all peripherals except the multiplexers were replaced.

In 1982 Toledo Edison installed two separate processors, each powered from an independent uninterruptible power supply (YAU or YBU) source. power for the operator displays and peripherals has been divided equally between YAU and YBU. Both processors are normally running in a master / slave mode with a direct communication link between them.

During loss of YAU or YBU, af ter a 5 second period, the powered processor becomes the master and transfers all operator peripherals to its I/O buss. The computer multi-plexers have not been upgraded to meet the singic power failure criteria. Toledo Edison intends to provide this protection when the multiplexers are replaced.

The additional modifications providing the single failure protection for the plant computer system will be implemented in accordance with an integrated schedule approach that will maximize resources. The compensatory measure in force in the interim consists of reliance on manual comput-ation in the event of loss of a single power source.

+

Licensa-No. NPF-3 Docket No. 50-346 Serial No. 899 February 2, 1983 I

No direct or indirect reactor protection or process control i

action is taken by the computer system. The primary function of the system is to provide information to assist the operator in efficient operation of the plant. Should the computer be completely out of service for any reason, the capability of plant operation or safe shutdown under automatic or manual control is not impaired.

Item 2: It is our understanding that a large fraction of the non-nuclear instrumentation is powered from the NN1-X supply and the remainder from tne NNI-Y supply. Therefore, if the NNI-Y supply fails, a minor plant transient would occur and that a plant trip might be avoidable. Accordingly, control room reedout devices are switched to NNI-X powered transmitters to provide sufficient information to the reactor operator. However, if NNI-X supply fails, the plant transient is more significant and a plant trip is

-unavoidable.

Toledo Edison Cempany is requested to describe the transient that occurs (in terms of RCS pressure, temperatures and flows, etc.) if NNI-X is lost. Identify the control room indicators rematting to permit identification of the l transient, track the course of the event. Identify those l plant systems necessary to mitigate the transient. Identify any systems that are expected to be unavailble during the event. Provide your basis for acceptability of this event in lieu of plant modifications or other compensatory actions to lessen the effects of the disproportionate NNI loading on the NNI-X power supply.

Response: The NNI cabinets are provided with automatic transfer switches that select a redundant source of AC power if the normal source is lost. This feature, plus redundant DC power supplies, makes a loss of power unlikely.

A loss of NNI-X AC/DC power supply causes main feed water flows in both loops to be BTU limited to apprcximately zero feed water flow. The reactor coclant system average c temperature (Tave) input to the Integrated Control System i (ICS) falls mid-ncale to 570*F resulting in continuous withdrawal of control rods. The above actions culminate in a hip,h pressure condition in the reactor coolant system causing a reactor trip. The main and startup feed water flow control will be lost and the secondary side inventory will begin to rapidly boil off. Manual or automatic initiation of the Steam and Feedwater Rupture Control System (SFRCS) will restore secondary side cooling, and safety grade secondary side level control.

1 i

. - . - - - , . -- -. .. - --- -- - - . - - - - . - - , ~ , - . - . . . , ,

1.icenze No. NPF-3 Docket No. 50-346 Serial No. 899 -

February 2, 1983 Davi's-Besse Unit i experienced a loss of NNi-X AC power on January 18, 1983. This trannient van very similar to the onn dencribed abovo. Further detailed evaluation of this trannient in continuing.

The loss of NNI-X AC/DC results in the failure of a algnifi-cant number of controlling signals which results in a ynir trip and possible SFRCS actuation. The following are the pertinent controlling nignal ..nd the resul. ting effects na a result of loss of NNI-X AC and NNI-X DC:

A. loss of NNI-X AC

1. Tave Integrated Control System input falls to 570*F causing control rods to continuounty withdraw nince normal Tave is maintained at 582*F.

2. Selected turbine header pressure signal fails to 900 psig causing turbine load increano as normal turbine header ,ressura is maintained at 870 poig.

3. l.oop and selected Tg nignals f all to 570*F causing both loop main feed water flown to be BTtl limited to approximately zero feed water flow (lons of main feed water flow to both steam generators). To compensate for thin, the loop and selected Tg nignaln are proce-durally transferred to NNI-Y.

4. Reactor trip on high pressure.

5. Pont trip tenponse is off-normal due to failure of steam generator low level limits and fallere of makeup flow control valve MU32 "an is" (approximately 25%

open normally).

6. Possible SFRCS actuation on low steam generator level due to failure of steam generator low level limit control by the Integrated Control System. (Start up range level signal to the ICS is f ailed at cent::r ncale and will not actuate steam generator low level limit control unless action in taken by the operator).

The SFRCS actuation will ret. tore adequate secondary side cooling and level control.

7. Ponnible initiation of Safety Featuren Actuation System (SFAS).

i

License No. NPF-3 Docket No. 50-346 Serial No. 899 -

February 2, 1983 The following automatic functions will become inoperable j following loss of NNI-X AC:

1. Automatic pressurizer level control is inoperable duc to makeup flow control valve MU32 failing "as is" and inaccurate pressurizer level control signal to MU3?.

To alleviate this situation, operator is procedurally L directed to use the MU32 bypass valve (MU211) utilizing the control room pressurizer level indication. The  !

control room pressurizer level indicators will indicate the existing uncompensated pressurizer level.

2. Automatic seal injection flow control is inoperable due to seal injection valve (MU19) failing "as is".  !

3. The seal injection flow interlock will not function to prevent the start of a reactor coolant pump without >

seal injection flow, houever, the reactor coolant  ;

pumps will not trip resulting from this loss of .

function. i

^ i

4. Pressurizer low level heater cutoff will not function.

However, manual control of the safety grade heaters f rom the control room will not be impaired. l S. Steam Generator low level limit control will not t l function due to steam generator startup range level j signals to the Integrated Control System failing to 125 inches. However, the control room and auxiliary  ;

shutdown panel steam generator start up range level I indicators will be available and will display the existing steam generator water levels. t

6. All automatic feed water flow control (both main and startup) will be inoperable due to failed signals ,

and/or faulty temperature compensation. However, ,

essential auxiliary feed water controls in the control

) room and controls at the auxiliary shutdown parel will be available.

B. Loss of NNI-X DC j

1. Tave Integrated Control System input fails to 570*F causing control rods to continuously withdraw since  ;

normal Tave is maintained at 582*F.  ;

t I

i i

l i

4

% . . ~ ~.-- ,.--y . , , _.m. . , - . . - . ww,. , n-,. w - ,,-,,,,w.. .--w-,---,, , . -- , . , ,y - - , , , ,-7, -,,,%, ~ ,,.--e . - , - - , --

Licenze No. NPF-3 Docket No. 50-346 Serial No. 899 February 2, 1983

2. Selected turbine header pressure signal fails to 900 psig causing the turbine to continuously pick up load.

3. Loop and selected T signals fail to 570*F causing H

both loop main feed water flows to be BTU limited to approximately zero feed water flow (loss of main feed water flow to both steam generators).

4. If open, the pressurizer spray valve (RC2) and the PORV (RC2A) will close. The POEV can, however, be manually opened if required.

5. If energized, pressurizer heaters will turn off.

Manual control of the safety grade heaters from the control room will not be impaired.

6. Reactor trip on high pressure.

/. Makeup flow control valve MU32 will fail to 50% open.

8. Possible SFRCS r.ctuation on low steam generator IcVel due to failure of steam generator low level limit contrel by the Integrated Control System (start up range level signal to the Integrated Control System is failed at center scale will not actuate low level limit control, and cannot be regained without NN1-X DC power). This will restore adequate secondary side cooling and level control.

9. Possible initiation of Safety Features Actuation System.

The following automatic functions will become inoperable following loss of NNI-X DC:

1. Automatic pressurizer level control is inoperable due to makeup flow control valve MU32 failing to 50% open and inaccurate pressurizer level control signal to MU32. To alleviate this situation, operator is procedurally directed to use the MU32 bypass valve (MU211) utilizing the control room pressurizer level indication. The control room pressurizer level indicators will indicate the existing uncompensated pressurizer level.

2. Automatic seal injection flow control is incperable due to seal injection valve MU19 failing to 50% open (approximately the normal position for this valve).

Licanes No. NPF-3 Docket No. 50-346 Serial No. 899 February 2, 1983

3. The seal injection flow interlock will not function to prevent the start of a reactor coolant pump with out seal injection flow, however, the reactor coolant pumps will not trip resulting from this loss of function.

4. Pressurizer low level heater cutoff will not function.

However, no damage will be impar:cd to the heaters since they will be de-energized. In addition, manual control of the safety grade heaters from the control room will not be impaired.

5. Pressurizer heaters will not function in the automatic mode, however, manual control of the safety grade heater banks can be regained in the control room.

6. Neither the pressurizer spray valve (RC2) nor the PORV (RC2A) will open automatically. The PORV can, however, be manually opened if required.

7. Steam generator low level limit control will not function due to steam generator etartup range level signals to the Integrated Control System failing to 125 inches. The safety grade control room and auxiliary shutdown panel startup level indicators will display existing steam generator levels.

8. All automatic feed water flow control (both main and scartup) is inoperable due to failed signals and/or faulty temperature compensation. However, essential auxiliary feed water controls in the control room and controls at the auxiliary shutdown panel will be available.

9. Decay Heat / Low Pressure Injection pump 1-2 high and low flow alarts are inoperable.

10. High Pressure Injection pump 1-2 high and low flow alarms are inoperable.

11. Loop 2 high and low reactor. coolant pressure alarms '

are inopere'ile.

To avoid a severe plant transient caused by a loss of NNI-X, there are sufficient alarms to alert the operator about such failure which may permit operator action that could avoid a potential SFRCS actuation. This will result I in a reduced cooldown rate of the reactor coolant system which will slow the transient to a more controllable rate under the limiting circumstances. The alarms are:

P License No. NPF-3 Docket No. 50-346 Serial No. 899 February 2, 1983 A. NN1-X AC:

1. ICS/NNI 118 V AC PWR Trill. Annunicator Alarm

2. I.ons of X-AC NNI Power Indicating 1.ight on Control Room Panel

3. Computer point Q696-NNI X 118 V AC PWR Trill.

4. ICS S/C 1 and ICS S/C 2 on 11TU l.imit Annunicator alarma

5. Zero volta indicated on Uninterruptible Instrument hunnen YAU and YllU

6. On al1 X-NNI powered recordern, the penn fail "an in" and paper motion stopa

7. All X-powered ludicatorn falla toward, but not necennarily at, center scale.

11 . NNI-X DC:

1. l.oss of X-DC NNI Power Indicating 1.ight on Control Hoom Panel

2. NNI 24 VDC llun Trip Annunicator alarm

3. Computer Point Q715 - NNI-X DC llun Trip

4. RC I.oop 2 Ilot 1.cg l'!nw 1.ow Annunciator alarm

5. RC llot 1.cg Total Flow !.ow Annunicator alarm

6. ICS S/G 1 and ICS S/C 2 on llTU l.imit Annunciator alarm

7. ICS RC Flow Runback in Effect Annuneintor alarm

8. All indicators and recordern displaying X signals f ail toward, but not necennarily at, center scale, llaned on the above, we feel that there are sufficient alarms and luuications available to the operator to take appropriate immediate as well as supple-mentary actions as required to mitigate the trannient, in order to enhance the overall reliability of the NN1-X AC and DC power supplien, Toledo Edinon han undertaken several measuren. These include:

! 1. Providing automatic trannfer of the AC nource to an alternate unin-terruptible power source when the primary source has been lost.

2. Providing two NNI-X DC power supplien which are nupplied f rom separate uninterruptible AC sources. Each DC power supply can supply the full load of the system.

3. Another modification, in the design stage, in to provide independent funen (see attached figure) to the AC circults auch that failure in one portion of NNI-X will not cause a total NNI-X failure, and no l more than one critical component will be lont

License No. NPF-3 Docket No. 50-346 Serial No. 899 February 2, 1983 The system modifications completed heretofore, and those under evaluation provide sufficient compensatory measures to enable appropriate operator actions to ensure acceptable system respcnse in relation to the severity of overall transient, be d/9 l

I l

1 1

License No. NPF-3 Docket No. 50-346 Serini No. 899 February 2, 1983 "X" NNI CABINET PRIORI YAU VN >,TY,.,

MU 19 C

ALTERNATE FEED --N N -

> MU 30A g ASCO --m pyu3Og syn}' XFER MM U 3OC N- SW g .MMU 300 Y8U y .W U 32 R --<v--bRC 14 NORMAL FEED

-~ ,m & M C2 z m, e

u>

E o

4 Q~

e 5

s u>

'x L4J V v DC DC PWR. PWR.

SUP. SUR 66 AUCT.

_ v DC BUS _9_

_ . _