ML20031D816
| ML20031D816 | |
| Person / Time | |
|---|---|
| Site: | Millstone  |
| Issue date: | 09/30/1981 |
| From: | Udy A EG&G, INC. |
| To: | |
| Shared Package | |
| ML20031D812 | List: |
| References | |
| CON-FIN-A-6425, TASK-06-10.A, TASK-6-10.A, TASK-RR EGG-EA-5557, NUDOCS 8110140249 | |
| Download: ML20031D816 (19) | |
Text
bilb 4 UJ W 8 L I l
EGG-EA-5557
' SEPTEMBER 1981 SYSTEMATIC EVALUATION PROGRAM TOPIC VI-10.A, TESTING 0F REACTOR TP.IP SYSTEM AND ENGINEERED SAFETY FEATURES, MILLSTONE NUCLEAR POWER STATION, UNIT NO. 1 l
A. C. Udy U.S. Department of Energy ~
~
Idaho Operations Office
- Idaho National Engineering Laboratory
~
g:ifM
'";Qf
,/L
- ,
- /
~
~J p.
p;.
~ ~
I, L
r t.
g
~
- $yj%w L,. !'sl w?4T
,e,{
e
~'
r
-4e
(
a l
t \\.
4
~
% 44
- %g =~ = 5 % m ' a, m L
$<JJW;. 8Mr v ',.
t g.
f g
9g 1 Lh SE39.
aM N, % --,;- -,
e;.,s_F07 i,,,__,d.
- g. w%_;b.
- E.
O
.c.
_ i c a. G. W (g c
l L e% din 6 6'm; _.~ _ e r r e wr = s es w r a m a *d s.
gy.
4
[E d.
s s_
I:5 & TllbT5*AWQWdiO ij~ 2 0 5 T d k: v "'-- - -
g-o NS 1.
1.R$V w-q==: W%Q &** " W W-Tm...-. g.-- #
n _. ;_
s---
4 --
75
,, s
&:p.E}tc.:.-M.g r
s d
tp
.c
. -cr~ N.
'4 g.r
-py=*fgit.s.'
,g.
~ h ~ % e- -
r[R & g g g g g K %v e ~ y g
- .,ewei s
bl This is an Informal report intended for use as a preliminary or working document l
l l
Prepared for the U.S. Nuclear Regulatory Commission Under DOE Contract No. DE-AC07-761D01570 FIN No. A6423 0
EGnG,a,n.
g Shh !EfS!!%!!
Je P
Ib hEG1:G su,,,.. e topad EG4G 396
- e. n m INTERIM REPORT Accession No.
Report No. _EDS-EA-5557 a
~
Ccntract Program or Project
Title:
Electrical, Instrumentation, and Control Systems Support for the Systematic Evaluation Program (II)
Subject of this Document:
Systematic Evaluation Program Topic VI-10.A, Testing of Reactor Trip System and Engineered Safety Features, Millstone Nuclear Power Stati~on, Unit No. 1 Type of, Document:
Informal Report Auth:r(s):
A. C. Udy
~
~
Data cf Document:
September 1981 R;sp nsible NRC Individual and NRC Office or Division:
Ray F. Scholl, Jr., Division of Licensing This document was prepared primarily for preliminary orinternal use. it has not received full review and approval. Since there may be ribstantive changes,this document should not be considered final.
EG&G Idaho, Inc.
idaho Falls, Idaho 83415 Prepared for the U.S. Nuclear Regulatory Commission Washington, D.C.
Under DOE Contract No. DE AC07-76lD01570 NRC FIN No.
A6425 P
6 INTERIM REPORT t
.i i
1 0400J SYSTEMATIC EVALUATION PROGRAM TOPIC VI-10.A TESTING OF REACTOR, TRIP SYSTEM AND ENGINEERED SAFETY FEATURES MILLSTONE NUCLEAR P0r!ER STATION, UNIT N0.1
=.
~~ ~
~~
00cket Na. 50-245 5eptemoer 1981-A. C. Udy EGLG Ioano, Inc.
i I
9-1-81 1
,r-
- ' ~12-
... ABSTRACT,,,,_,.
ThisSEhfTeibbica)'Ivi]uation',[for$0nitSumb'e'el'.oftEe"~"
5
~
Millstone Nuclear Power Station, reviews the currently required comptnent.and dys_ tem tests.for_the reactor trip system and for a typical engineered safety feature system.
The currently required tests are then compared with current licensing criteria to determine if the required tests acc ~olish the same objectises as the licensing criteria.
FOREWORD This report is supplied as part of the " Electrical, Instrumentation, and Control Systems Support for~the Systematic Evaluation Program (II) being conducted for the U.S. Nuclear Regulatory Commission, Office of Nuclear Reactor Regulation, Division of Licensing by EG&G Idaho, Inc., Reliability & Statistics Branch.
The U.S. Nuclear Regulatory Commission funded the work under i
the authorization B&R 20-10-02-05 FIN A6425-1.
G l
ii i
CONTENTS 1.0 INTRUDUCTION....................................................
I 2.0 CRITERIA........................................................
1 3.0 REACTOR TRIP SYSTEM.............................................
4 r
3.1 Description...............................................
4 3.2 Evaluation................................................
5 4.0 STANDBY LIQUID CONTROL SYS1_M...................................
9 4.1 Description...............................................
9 r
4.2 Evaluation................................................
11 5.0
SUMMARY
11
6.0 REFERENCES
11 TABLES i.
I
[
1.
Comparisons of Millstone Unit 1 RPS instrument surveillance requirements with BWR Standard Technical Specification requirements....................................................
6 l.
2.
Standby liquid control system and associated system surveillance l'
requirements....................................................
10 1
l 1
lc1 l
l i'
i*
I*
t l
i iii 5
9 1 1
SYSTEMATIC EVALUATION PROGRAM 4
i TOPIC VI-10.A 2
TESTING OF REACTOR TRIP SYSTEM AND ENGINEERED SAFETY FEATURES MILLSTONE NUCLEAR rdWER STATION, UNIT NO. 1 f
C
1.0 INTRODUCTION
The objective of this review is to determine if all Reactor Trip System (RTS) components, including pumps and valves, are included in component and system tests, if tne scope and frequency of periodic testing is adequate, and if the test program. meets current licensing criteria.
Tne review will also address these same matters with respect to the Standby Liquid Control System (SLCS) as a typical exa'r.ple of all Engineered Safety Feature (ESF) systems.
i i
- (
2.0 CRITERIA r
General Design Criterion 21 (GDC 21), " Protection System Reliability
'{
l and Testability," states, in part, that:
,{
Tne protection system shall be cesigned to permit periodic testing of i
its functioning wnen the reactor is in operation, including a i
capability to test channels independently to determine failure and losses of redundancy that may have occurred.I Regulatory Guide 1.22, " Periodic Testing of the Protection System Actuation Functions," states, in Section D.l.a, that:
6 The periodic tests should duplicate, as closely as practicaDie, the
\\
performance that is required of the actuation devices in the event of l
an accident; i
and further, in Section 0.4, states that:
k Wnen actuated equipment is not tested during reactor operation, it should be shown that:
1
a.
There is no practicable system design that would permit operation of the actuated equipment without adversely affecting the safety 1
or operability of the plant, o.
The probability that the protection system will fail to initiate tne operation of the actuated equipment is, and can be maintained, acceptably low without testing the actuated equipment during reactor operation, and c.
The actuated equipment can be routinely tested wnen tne reactor is shut down.2
' IEEE Standard 338-1977, " Periodic Testing of Nuclear Power Generating Station Class lE Power and Protection Systems," states, in part, in Sec-tion 3:
Overlap testing consists of channel, train, or load-group verification by performing individual tests on the various components and subsystems of the channel, train, or load group.
The individual component and suosystem tests shall cneck parts of adjacent subsys,tems, such that the entire cnannel, train or load group will be verified by testing of individual components or subsystems.3 and in part in Section 6.3.4:
Response time testing shall De required only on safety systems or suu-systems to verify that tne response times are within the limits of the overall response times given in the Safety Analysis Report.
Sufficient overlap shall be provided to verify overall system response.
The response-time test shall include as much of each safety system, from sensor input to actuated equipment, as is practicable in a single test. Where the entire set of equipment from sensor to actuated equip-ment cannot De tested at once, verification of system response time shall be accomplished by measuring the response times of discrete 2
i
Ni:t portions of the system and showing that the sum of the response times p
of all is within the limits of the overall system requirement.
M In addition, the following criteria are applicable to the ESF:
General f
Design Criterion 40 (GDC 40), " Testing of Containment Heat Removal System,"
4 states that:
g'l i
tc N
The containment neat removal system shall De designed to permit appro-f priate periodic pressure and functional testing to assure:
N k
( .
a.
Tne structural and leaktight integr
, of'its components.
j i
t b.
Tne operability and performance of the active components of the i
system.
C h
c.
The operability of the system as a whole and under conditions as close to tne design as practical, the performance of the full
}
. operational sequence that brings.the system into operation, E
including operation of applicable portions of the protection j[
systems, the transfer between normal and emergency power sources, l1 and the operation of tne assc:iated cuoling water system.4 GDC 38, " Testing of Emergency Core Cooling System," GDC 43, " Testing of Containment Atmospnere Cleanup Systems and GDC 46, " Testing of Cooling
~
Water System," are similar.
Standard Review Plan, Section 7.3, Appendix A, "Use of IEEE Stan-dard 279 in the Review of the ESFAS and Instrumentation and Controls of Essential Aailiary Supporting Systems," states, in Section ll.b, that:
Periodic testing should duplicate, as closely as practical, the inte-grated performance required from the ESFAS, ESF systems, and their essential auxiliary supporting systems.
If such a " system level" test can be performed only during shutdown, the testing done during power operation must be reviewed in detail. Check that " overlapping" tests do, in fact, overlap from one test segment to another.
For example, 3
~
closing a circuit breaker with the manual ureaker control switch.may not be adequate to test the ability of the ESFAS to close the breaker.6 3.0 REACTOR TRIP SYSTEM (RTS) 3.1 Description.
The sys' tem is made up of two independent. logic channels, each having subcnannels of tripping devices.
Eacn subchannel has an input from at least one independent sensor, monitoring each of the crit-ical parameters.
The output of each pair of subchannels is combined in a one-out-of-two logic:
that is, an input in either one c,r both of the independent subchan-nels will produce a logic channel trip.
Both of the other two subchannels are likewise combined in a one-out-of-two logic, independent of the first logic channel.
The outputs of the two logic channels are combined in two-out-of-two arrangement so that they must be in agreement to initiate a scram. An off-limit signal in one of the two subchannels in one of the logic channels must be confirmed by any other off-limit signal in one of.
the two succhannels of the remaining logic channel to' provide a reactor scram.
During normal operation, all vital sensor and trip contacts are closed, and all sensor relays are operated energized.
The control rod oilot scram valve solenoids are energized, and instrument air pressure is applied to all scram valves.
Wnen a trip point is reacned in any of tne monitored parameters, a contact opens, de-energizing a relay which controls
'a contact in one of tne two succnannels.
Tne opening of a subcnannel con-tact de-energizes a scram relay which opens a contact in the power supply to tne pilot scram valve solenoids supplied oy its logic channel.
To this point, only one-half the events required to produce a reactor scram have occurred.
Unless the pilot scram solenoids supplied by the other logic channel are de-energized, instrument air pressure will continue to act on the scram valves and operation can continue. Once a single channel trip is initiated, contacts in that scram relay circuit open and keep that circuit de-energized until tne initiating parameter has returned within operating 4
A
WI cm pa limits and the reset switch is actuated manually.
It snould be noted that g-each control rod has individual pilot scram solenoids for each channel and g
an individual air-operated scram valve. A normally-closed switen is pro-
%)
- e vided in each logic channel pilot scram solenoid circuit.
This allows each gb rod to be manually scrammed (tested) by opening both logic channel switches NIE p
and de-energizing the pilot scram solenoids.
This type of test would pro-g vide the required overlapping test of the RTS.
EW w:
The parameters (sensors) which are required to initiate reactor scram pgi are listed in Table 1.
However, the only ir.struments included in this
~
table are those required to prevant exceeding the fuel cladding integrity
- +
limits during normal operation or operational transients.
These are
't d'escribed in Table VII-1 of the plant FSAR and listed in Tables 4.1.1 and g
a 4.1.2 of the Millstone Nuclear Power Station Technical Specifications for EE!g Unit 1.
For example, the condenser low-vacuum sensors are connected to the RPS trip system and can initiate a scram, h)
M GC, e.
3.2 Evaluation. 'The Millstone 1 RTS is designed to allow overlap-g ping tests from actuating device ti1 rough the control rods. Tne design
- k allows individual cnannel tests from sensors though pilot scram valves lk while the reactor is in operation and the overlapping rod scram tests I'[
during refueling.
Altnough one or more rod scram valves mdy fail during reactor operation, tne cnannel tests will verify that no common mode fail-L.7.'
ure will occur and sufficient pilot valves will operate to shut down the T
1 rea; tor.
Table I shows the present Millstone 1 RTS instrument surveillance requirements, including frequency.
Tne table a no shows tne current licen-g sing requirements for General Electr:ic boiling water reactors as listed in g
the Standard Technical Specifications.
Tne tests shown only involve single yc9 channel testing (half-scram).
A.-
it y
It should De noted that Technical Specification Table 4.1.2 does not y
require cnannel calibration for main steam-line isolation valve closure or g
turbine stop valve closure parameters, although the Millstone Technical Specification requirer. ant for Unit 1 in Section 2.1.2.B requires that a 10%
T.-
[*.
i S
e l
y.
TABLE 1.
COMPARISONS OF' MILLSTONE UNIT 1 RPS INSTRUMENT SURVEILLANCE WITH BWR STANDARD TECHNICAL SPECIFICATION REQUIREMENTS (STS)6 Channel Channe}
Functiogal Channel Check Test Calibration _
c Milistor.e Milistone Millstone Instrument Channel Unit 1 STS Unit i STS Unit 1 STS High reactor pressure NA NA Q*
M Q
R High drywell pressure NA NA Q*
M Q
Q Low reactor water D
D Q*
M Q
R level High water level in NA NA Q*
M Q
R scram discnarge Condenser low vacuum NA NA Q*d NA R
NA Main steam-line iso-NA NA Q*
M NA R
lation valve closure Turoine stop valves NA NA Q*
M Me R
closure Manual scram NA NA Q*
M NA NA Turoine control valve NA NA Q*
d Me Q
fast closure Average power range NA S
Q*
Suf W
W/SA monitor (APRM) flow ciased nign flux APRM-reduced high flux NA S
SUf SUf Q
W/SA Intennediate range De 5
SUf SUf R
R monitor (IRM)
High steam line S
W Q*
W Q
R radiation Reactor mode switch NA NA R
R NA NA in shutdown positian 6
TABLE 1.
(continued)
FREQUENCY NOTATION l
Notation Frequency ____
Notation Frequency S
At least once per R
At least once per refueling outage (18 months) 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> 1
0 At least once per NA Not applicacle i
24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> SA At least once per 184 days W
At least once per SU Prior to start up 7 days M
At least once per SD Prior to shutdown 31 days Q
At least once per Q*
Not less than one-month or greater tnan three months.
3 months Presently performed monthly.10 A qualitative determination of acceptable operability-by observation of a.
channel oenavior during operation.
This determination shall include, wnere possible, comparison of the channel with other independent channels measuring the same variaole.
Injection of a simulated signal into the channel to verify its proper b.response including, where applicable, alarm and/or trip initiating action.
Adjustment of cnannel outout such that it responds, with acceptable c.
range and accuracy, to known s-lues of tne parameter which tne channel Calibration shall encompass the entire channel, including equip-measures.
ment actuation, alarm, or trip.
Consists of injecting a simulated electrical signal into the d.
i measurement channel, Tnis not required by technical specification, nowever, test are e.
performed.10 f.
Maximum test frequency is once per week.
7
~
I valve closure initiate scram.
These, and the time delay of 260 msec for the Turbine Control Valve Fast Closure are verified by surveillance procedures SP 408E, SP 408F and SP 408G resepctively, on a monthly basis.10 The Standard Technical Specifications for General Electric boiling water reactors (page 3/4 3-1, paragraph 4.3.1.2) require the logic system function test and simulated automatic operation at least every 18,mor.ths.
This is done at Unit No. 1 of tne Millstone Station by overlapping tests consisting of the half scram test and the scram insertion time test.
As can be seen in Taole 1 the following channels are nct subjected to a channel cneck as frequently as required for present-day licensing:
APRM--flow biased high flux APRM--reduced high flux IRM The following channel is not subjected to a cnannel functional test as frequently as required for present-day licensing:
High steam line radiatior.
The following channels are presently given a channel functional test as frequently as required for present-day lice.asing; however, the technical specifications allow the present frequency to Decome quarterly, without notice to tne NRC.
Hign reactor pressure High drywell pressure Low reactor water level High water level in scram distnarge Main steam line isolation valve closure Turoine stop valves closure Manual scram Turbine control valves fast closure APRM--flow biased high flux 8
A
l S-E IM L?d The following channel is not calibrated at least as frequently as e?j i
required for present-day licensing:
M
$.n APRM--reduced high flux
- 5
}
This shoulo be a weekly calibration against heat balance calculations.
}1 d
in Section 3.1 of tne Millstone 1 Technical Specifications, 100 milli-
{
seconds is stated as the required limit to the response time between any channel ti-ip and tne de-energizaticn of the scram solenoid relay. Response h
l time testing to verify that the channel response time does not exceed this reqairement is not in the technical specifications.
u 3
4.0 STANDSY LIQUID CONTROL SY" FEM d
a d
4.1 Description.
_ standby liquid control system is designed to insert a sodium pentabor ate (or equivalent poison) solution to render and maintainthe reactor suberitical even when the control rods are all fully
(
withdrawn. The equipment consists of an unpressurized solution storage L
tank, a pair of positive displacement pumps, either of which has full capacity to perform the system function, two explosive actuated shear plug valves, a poison sparger ring and associated valves, piping and instrumen-tation.
A complete description is in Section VI-7.2 of tne plant FSAR.
Tne storage tank is heated to prevent particulate formation. Tne discharge of each pump is protected by a pressure relief valve that discharges back to the storage tank.
Pilot light indication of circuit continuity for the explosiv,. valves is provided. A single key controlled switch will start a pump and open: associated valves.
Both sets of valves i
and pumps are not operated simultaneously; nowever, the valves for both pumps may be open.
A test tank and a supply of demineralized water are provided for testing.
The FSAR indicates that testing is done in two parts.
One part deter-mines the ability of the pump to develop flow and suction from thE storage tank. The system is afterwards flushed to prevent Doron precipitation.
Another test uses demineralized water to snow that water can ce delivered 9
TABLE 2.
STANDBY LIQUID. CONTROL SYSTEM SURVEILLANCE REQUIREMENTS Fr,equency Millstone Surveillance Requirements Unit 1 STS
~ Solution temperature within limits.
Da D
b Solution volume is greater than specified.
D D
Heat treced pump suction piping is greater than or equal Da D
to 700F.
Start Soth pumps and recirculate demineralized water to Mc g
the test tank.
d Verify the continuity of the explosive charges.
D M
Solution chemical analysis.
M/M M/M 1
Verifying that each valve (manu d, power-operated or auto-Md g
matic) in tne flow path that is not locked, sealed or otnerwise secured in position, is in its correct position.
Initiating one loop using demineralized water and replace-R R
ment of tne. explosive cnarge.
Verify minimum flow requirement against reactor vessel M
R head pressure.
Demonstrate relief valve setpoint and that it does not Re R
operate during recirculation test to the test tank.
d Verify piping from tne storage tank to the reactor vessel R/M R/M is not olocked.
Demonstrate tnat the storage tank heaters are operable.
a R
Minimum tempersture is 75' per surveillance procedure SP 641.2. This a.
'provides an indirect test of the operability of the storage tank heaters, b.
Minimum volume is specified oy technical specification Figures 3.4.1 and 3.4.2.
c.
Flow rate required to be 32 gpm wnile the FSAR design requires 40 gpm.
The technical specifications do not require testing of both pump loops; surveillance procedure SP 661.4 does. Pressure is not specified. Technical specification, 4.4.A.2b recirculates solution from and to the storage tank at least once in 18 months for ooth systems.
Not in technical specifications, required by surveillar,ce procedure.10 d.
e.
Non-operation during recirculation test is not requireo.
Surveillance procedure SP 662.1 verifies that the relief valves do not operate under normal system operating pressure.
10
+w
... - ~,
hh.'
At 100 into tne reactor vessel.
This test requires replacement of the explosive (f,1
%,~
charges in the shear plug valves.
WC v i, 4.2 Evaluation. Table 2 snows the current testing requirements for W
p&
The surveillance tne standby liquid control system and associated systems.
m required by technical specifications and surveillance procedures is done at g
least as frequently as required for present day licensing.
?_ ?
3:
The t4ilistone 1 tecnnical specifications ao not agree with tne design C
presented in i FSAR, in that the minimum test flow rate is 80% of tne
- 4-y design flow rate,
- .L
?.'b Further, it is apparent that Millstone 1 has only one three-pnase
.1 neater in the solution stordge tank, whereas present requirements are for g
two redundant heaters.
ni
- M Gg 5.0
SUMMARY
i@
il Tne Technical Specifications for Millstone Unit I were compared with llp toe Standard Technical Specifications for current Boiling Water Reactor r
It was found that, for the reactor trip system, three signals li' censing.
are not suajectea to a channel cneck, one signal is riot subjected to a channel functional test and one cnannel is not calibrated as frequently as required in the standard tecnnical specifications.
(See Section 3.2.)
AJoitionally, tne cnannel response time oetween cnannel trip and tne de-energization of tue scram relay is not requireo to be tested.
For tne Standay Liquid Control System, selected as typical of ESF systems, surveillance requirements:were as frequent as required in the
.I standard tecnnical specifications.
6.0 REFERENCES
General Design Criterion 21, " Protection System Reliability and Test-1.
ability," of Aopendix A, " General Design Criteria of Nuclear Power Plants," 10 C; d Part 50, " Domestic' Licensing of Production and Utili-zation Facilities."
11
gy 1,0g 2.
Regulatory Guide 1.22- " Periodic Testing of the Protection System Actuation Functions."
3.
IEEE Standard 338-1975, " Periodic Testing of Nuclear Power Generating Station Class lE Power and Protection Systems."
4.
General Design Criterion 40, " Testing of Containment Heat i;emoval Systems," of Appendix A, " General Design Criteria of Nuclear Power Plants," 10 CFR Part 50, " Domestic Licensing of Production and Utili-zation Facilities."
5.
Nuclear Regulatory Commission Standard Review Plan, Section 7.3, Appendix A, "Use of IEEE Standard 279 in the Review of the ESFAS and Instrumentation and Controls of Essential Auxiliary Supporting Systems."
6.
Standard Technical Specifications for General Electric Boiling Water Reactors (BWRs), NUREG-0123, Resision 2, Fall 1980.
7.
Millstone Point Nuclear Power Station-Unit No.1, " Final Safety A1alysis Report," Amendment 5, dated March 14, 1968.
8.
Technical Specifications 5sd Bases for Millstor,a Nuclear Power Plant Unit 1, Appendix A, to Provisional Operating License DPR-21, Amendments I tnrougn 45, dated December 1977.
9.
Northeast Utilities letter, W. G. Counsil to Director of Nuclear Reactor Regulation, NRC, "SEP Topic VI-10.A, Testing of Reactor Trip System and Engineered Safety Features," August 4, 1981, A01766.
e B
e 12
SYSTEMATIC EVALUATION PROGRAM TOPIC VI-10.A MILLSTONE 1 i
TOPIC: VI-10.A TESTING 0F REACTOR TRIP SYSTEM AND ENGINEERED SAFETY FEATURES, INCLUDING RESPONSE TIME TESTING I.
INTRODUCTION The purpose of this Topic is to review the reactor trip system (RTS) and engineered safety features (ESF) test program for verification of RTS and ESF operability on a periodic basis and to verify RTS and ESF response time in order to assure the operability of the RTS and ESF.
Response times should not exceed those assumed in the plant accident ar.alys es. Accordingly, the test program of the RTS and ESF was reviewed in accordance with the Standard Review Plan, including applicable Branch Technical Positions.
II.
REi.".! CRITERI A The r.eview criteria are presented in Section 2 of EG&G Report EGG-EA-5557,
" Testing of Reactor Trip System and Engineered Safety Features."
III. RELATEC SAFETY TOPICS AND INTERFACES Top'c VI-7.A.3 discusses the questiot of testing protection systems urder conditions as close to design condition as practical. There
- re no topics that are dependent on the prelent topic information for their completion.
IV.
REVIEW GUIDELINES Review guidelines are presented in Section 2 of Report EGG-EA-5557 V.
EVALUATION Millstone 1 does not comply with the current licensing criteria.
because the systems required to protect the public health and safety l
are not tested as frequently as operating experience has indicated to be desirable and because response time testing is not conducted.
VI.
CONCLUSION 2
l It is the staff's position that the design of systems which are required for safety shall include provisions for periodic verification that the minimum performance of instruments and control is not less than that which was assumed in the safety analyses. The bases for this position are Gen-eral Design Criterion 21, Section 3.9 of IEEE Std 279-1971, and IEEE Std 338-1977. Therefore, the licensee should implement a program for response time testing of all reactor protection system (including engineered safe-ty features systems such as containnent isolation).
Furthermore, the
. present Technical Specifications should be revised to reflect the higher test fr-ci 3ncy of the current Standard Technical Specifications. We note that you have already developed : cost of the procedures and circuit modifica-tions necessary to conduct response time. tests to verify the 50 m sec.
specified in the Te::hnical Specifications.
I i
l 1
'l i
e e
I l
1 e
w-w=
w- +, -
py--yn
~pw,e4-w,.---,w--,,me-ws,ye-,-
e vn, e m - p
,s-m-- -ew w m..g
,w-,m, se e
-,vw w.y,+ rm e,e e-s-g
-,v~pp~~mw w,
,._,-e-,.ws-
,s,r..s-
,so,-,-
-,wv.w