ML20031F480
| ML20031F480 | |
| Person / Time | |
|---|---|
| Site: | Millstone  |
| Issue date: | 09/30/1981 |
| From: | Udy A EG&G, INC. |
| To: | Scholl R Office of Nuclear Reactor Regulation |
| References | |
| CON-FIN-A-6425, TASK-06-10.A, TASK-6-10.A, TASK-RR EGG-EA-5557, NUDOCS 8110190941 | |
| Download: ML20031F480 (17) | |
Text
EGG-EA-5557 SEPTEMBER 1981 SYSTEMATIC EVALUATION PROGRAM TOPIC VI-10.A, TESTING 0F REACTOR TRIP SYSTEM AND ENGINEERED SAFETY FEATURES, grilth MILLSTONE NUCLEAP, POWER STATION, UNIT NO. 1
'k IbA ocr N'lC Research anGechnica,
'kg
^ ' ""'
Assistance lepor.
~ hr.
ANA Drts U.S. Department of Energy djf Idaho Operations Office
- Idaho National Engineering Laboratory
^
A s?R K ?s&
{L -
&?@
C'"
G- ~, :
f'S
,N sessuntumiEW -
w &'s:*
- a =,g~g yy_.q;s m
- _
~
I If \\,,
Th!s is an informal report intended for use as a prefiminary or working document Prepared for the U.S. Nuclear Regulatory Commission under DOE Contract No. DE-AC07-76ID01570 FIN No. A6425 g g g g,d,,,
]
gog941 e1093o O
r sh h EGsGa....-
FORM EGAG 398 (Rev 11 F9)
INTERIM REPORT' Accession No. _.
' Report No. EGG-EA-5557 Contract Program or Project
Title:
Electrical, Instrumentation, and Control Systems Support for the Systematic Evaluation Program (II) q
'm Subj:ct of this Document:
Systematic Evaluation Program Topic VI-10.A, Testing of Reactor Trip System and Eng'neered Saf ety Features, Millstone Nuclear Power Station, Unit No.1 s
Type of Document:
Informal Report
-e Author (s):
A. C. Udy
'2'
~ -4 NRC Researc1 an'c Tec" mica Dite of Document:
Ass,istance Report-September 1981
,t s
A R;sponsible NRC Individual and NRC Office or Division:
- c<\\
Ray F. Scholl, Jr., Division of Licensing
_t~
~
c This document was prepared primarily ror preliminary orinternM use. lt has not received O
full review and approval. Since there may be substantive changes, this document sho(Id not be considered final.
N
~
(-
EG&G Idahc, Inc.
Idaho Falls, Idaho 83415 Prepared for the
% m U.S. Nuclear Regulatory Commission h
Washington, D.C.
Under DOE Contract No. DE AC07 76lD01570 NRC FIN No.
A6425
,'"'s ?
- x N
INTERIM REPORT
(
s s -
x s.
.o s^
5 f
x 4
w-r
\\
1 c-
,N Lp-hx x
0400J M. U.
.s Am m.
\\
\\
- '\\
. N; g
's, s
t.,
\\, !
4 s
1 i.
,..y-g
. -.a w,
..s.
.M
't, s.
\\
x..
)
(
\\
s b)
I:
t.
1
-5YSTEMATIC EVALUATION PROGRAM TODIC VI-10.A x
A
'2 TOTJNG OF'hEACTOR TRIP SYSTEM AND aN
,,INGINEERED SAFETY FEATURES m
MILL 5TjWc Nlf tEfR' POWER STATION, UNIT NO.1 i
e t.
T y'
s 4..
. \\.
Dodet No. 50-245
,.4 s
S
.x
- 4. s sSeptemoer 1981 a
a s
'%w
,a$
'A.'C. Udy s
EG&G Idanc, Inc.
(
u w
i&
(-
g i ~;.. ~
,anica,,
bT iRC Researc'1 ant
.ec
~
1 Assistance Report
- v..
s s
'N 3...
q.
7 C-
^,l',
e Q
-ya w.
O vfs
. 9 q t.,
we g..
'i, K,,'
s, s
,e s s
s, 9-1-81 s
scs ~x
,v m
L y
\\
- w g
a 4
I' gf,
\\
vi.
4 k
-%g'*\\~--,--,.-,,,,.....__L_..,___.,,,;,,,.,
7 c
l T,
as
'y*
f.,
,.g*~
1 8
A v
?,.
1 ABSTRACT 1
This SEP Technical Evaluation, for Unit Number 1 of the 1
Millstone Nuclear Power Station, reviews the currently required component and system tests for the reactor trip 1
system and for a typical engineered safety feature system.
The currently required tests are then compared with current licensing criteria to determine if the required tests accomplish the same objectives as the licensing criteria.
l
't '
ta FOREWORD 4
1 This report is supplied as part of the "Elt:trical, Instrumentation, and Control Systems Support for the j
Systematic Evaluation Program (II) being conducted for the s
-U.S. Nuclear Regulatory Commissior, Office of Nuclear Reactor Regulation, Division of Lioensing by EG8G Id6ho, Inc., Reliability & Statistics Branch.
4 The U.S. Nuclear Regulatory Commission funded the work under
~~
the authorization B&R 20-10-02-05 FIN A6425-1.
{, f f * * *; f
?,i G
'i ' r
- _-j ' J:lls ]n.
u..,
9-
' O b
Sp/ $
4 4
. e
-4
- r } 9 ii
~
a,
'y y
a' k.-
- e- -
4,.,
r CONTENTS 1.0 I N T R U Q UC T I O N....................................................
I 2.0 CRITERIA........................................................
I 3.0 REACTOR TRIP SYSTEM.............................................
4 3.1 Description............................................
4 3.2 Evaluation...............................................
5 4.0 STANDBY L I QUI D CON TROL SYSTEM...................................
9 4.1 Description..-............................................
9 4.2 Evaluation................................................
11 5.0
SUMMARY
11
6.0 REFERENCES
11 TABLES 1.
Comparisons of Millstone Unit 1 RPS instrument surveillance requirements with BWR Standard Technical Specification requirements....................................................
i 2.
Standoy liquid control system and associated system surveillance requirements....................................................
10 iii he-m a
r
\\
SYSTEMATIC EVALUATION PROGRAM TOPIC VI-10.A TESTING OF REACTOR TRIP SYSTEM AND ENGINEERED SAFETY FEATURES MILLSTONE NUCLEAR POWER STATION, UNIT NO. 1
1.0 INTRODUCTION
The objective of this review is to determine if all Reactor Trip System (RTS) components, including pumps and valves, are included in component and system tests, if tne scope and frequency of periodic testing is adequate, and if the test program meets cuirent licensiag criteria.
The review will also address these same matters with respect to the Standby Liquid Control System (SLCS) as a typical example of all Engineered Safety Feature (EST) systems.
~
2.0 CRITERIA General Design Criterion 21 (GDC 21), " Protection System Reliability and Testability," states, in part, that:
The protection system shall be designed to permit periodic testing of its functioning wnen the reactor is in operation, including a capability to test channels independently to determine failure and losses of redundency that may have occurred.l Regulatory Guide 1.22, " Periodic Testing of the Protection System Actuation Functions," states, in Section D.l.a, that:
The periodic tests should duplicate, as closely as practicaole, the performance that is required of the actuation devices in the event of an accident; and further, in Section D.4, states that:
l When actuated equipment is not tested during reactor operation, it should be shown that:
1
a.
There is no practicable system design that would permit operation of the actuated equipment without adversely affecting the safety or operability of the plant, o.
fhe probability that the protection system will fail to initiate l
tne operation of the actuated equipment is, and can be maintained, acceptably low without testing the actuated equipment during reactor operation, and c.
The actuated equipment can be routinely tested wnen tne reactor is snut down.2 IEEE Standard 338-1977, "/eriodic Testing of Nuclear Power Generating Station Class lE Power and Protection Systems," states, in part, in Sec-tion 3:
Overlap testing consists of channel, train, or load-group verification by performing individual tests un the various compone'its and subsystems of the channel, train, or load group.
The individual component and subsystem tests shall check parts or adjacent subsystems, such that the entire cnannel, train or load group will De verified by testing of individual components or subsystems.3 and in part in Section 6.3.4:
Response time testing shall be required only on safety systems or sub-systems to verify that the response times are within the limits of the overall response times given in the Safety Analysis Report.
Sufficient overlap shall be provided to verify overall system response.
The response-time test shall include as much of each safety system, from sensor input to actuated equipment, as is practicable in a single test. Where the entire set of equipment from sensor to actuated equip-ment cannot De tested at once, verification of system response time shail be accomplished by measuring the response times of discrete 2
]
r portions of the system and showing that the sum of the response times of all is within the limits of the overall system requirement.
In addition, the following criteria are applicable to the ESF:
General Design Criterion 40 (GDC 40), " Testing of Containment Heat Removal System,"
states that:
The containment heat removal system shall oe designed to permit appro-priate periodic pressure and functional testing to assure:
a.
Tne structural and leaktight integrity of its components, b.
Tne operability and performance of the active components of tne system.
c.
The operability of the system as a whole and under conditions as close to tne design as practical, the performance of the full operational sequence that brings the system into operation, including operation of applicable portions of the prot :ction systems, the transfer between normal and emergency pc er sources, and tne operation of tne associated cooling water s); tem.4 GDC 38, " Testing of Emergency Core Cooling System," GDC 43, " Testing of Containment Ataiosphere Cleanup Systems and GDC 46, " Testing of Cooling Water Systua," are similar.
Standard Review Plan, Section 7.3, Appendix A. "Use of IEEE Stan-dard 279 in the Review of the ESFAS and Instrumentation and Controls of Essential Auxiliary Supporting Systems," states, in Section ll.b, that:
Perindic testing should duplicate, as closely as practical, the inte-grated performance required frota the ESFAS, ESF systems, and their essential auxiliary supporting systems.
If sucn a " system level" test can be performed only during shutdown, the testing done during power operation must be reviewed in detail. Check that " overlapping" tests do, in fact, overlap from cne test segment to another. For example, 4
3
closing a circuit breaker with the manual ureaker control switch may not be adequate to test the ability of the ESFAS to close the breaker.0 3.0 REACTOR TRIP SYSTEM (RTS) 3.1 Description. The system is made up of two independent logic channels, each having subcnonnels of tripping devices. Eacn subchannel nas an input from at least one independent sensor, monitoring each of the crit-ical parameters.
Tne output of each pair of subchannels is comoined in a one-out-of-two logic:
that is, an iaput in either one or both of the independent subchan-nels will produce a logic channel trip.
Both of the other two subchannels are likewise combined in a one-out-of-two logic, independent of the first logic channel.
The outputs of the two logic channels are combined in two-out-of-two arrangement so that they must be in agreement to initiate a scram. An off-limit signal in one of the two subchannels in one of the logic channels must be confirmed by any other off-limit signal in one of the two succhannels of the remaining logic channel to provide a reactor scram.
During normal operation, all vital sensor and trip contacts are closed, and all sensor relays are operated energized.
The control rod pilot scram valve solenoids are energized, and instrument air pressure is applied to all scram valves.
Wnen a trip point is reacned in any of tne monitored parameters, a contact opens, de-energizing a relay which controls i
a contact in one of tne two subcnannels.
Tne opening of a stbchannel con-tact de-energizes a scram relay which opens a contact in the power supply to tne pilot scram valve solenoids supplied oy its logic channel.
To this point, only one-half the events required to produce a reactor scram have occurred. Unless the pilot scram solenoids supplied by the other logic channel are de-energized, instrument air pressure will continue to act on i
the scram valves and operation can continue. Once a single channel trip is initiated, contacts in that sc am relay circuit open and keep that circuit ds-energized until tne initiating parameter has returned within operating c
l 4
l
-.~
r limits and the reset switcn is actuated manually.
It snould be noted that each control rod has individual pilot scram solenoids for each channel and an individual air-operated scram valve. A normally-closed switch is pro-vided in each logic channel pilot scram solenoid circuit.
This allows each rod to bu manually scrammed (tested) by opening noth logic channel switches and de-energizing the pilot scram solenoids.
This type of test would pro-vide the required overlapping test of the RTS.
The parameters (sensors) which are required to initiate reactor scram are listed in Table 1.
However, tne only instruments included in this table are tnose required to prevent exceeding the fuel cladding integrity limits during normal operation or operational transients.
These are described in Table VII-l of the plant FSAR and listed in Tables 4.1.1 and 4.1.2 of the Millstone Nuclear Power Statied Technical Specifications for Unit 1.
For example, the condenser low-vacuum sensors are connected to the RPS trip system and can initiate a scram.
3.2 Evaluation.
The Millstone 1 RTS is designed to allow overlap-ping tests from actuating device througn the control rods.
Tne design allows individual cnannel tests from sensors though pilot scram valves while the reactor is in operation and the overlapping rod scram tests I
during refueling. Altnough one or more rod scram valves may fail during reactor ope.:. ion, tne cnannel tests will verify that no common mode fail-ure will occur and sufficient pilot valves will operate to shut down the reactor.
Table 1 shows the present Millstone 1 RTS instrument surveillance requirements, including frequency. The table also shows tne current licen-sing requirements for General Electric boiling water reactors as listed in the Standard Technical Specifications.
Tne tests shown only involve single channel testing (half-scram).
It should be noted that Technical Specification Table 4.1.2 does not require cnannel calibration for main steam-line isolation valve closure or turbine stop valve closure parameters, although the Millstone Technical Specification requirement for Unit 1 in Section 2.1.2.8 requires that a 10%
TABLE 1.
COMPARISONS OF MILLSTONE UNIT 1 RPS INSTRUMENT SURVEILLANCE WITH BWR STANDARD TECHNICAL SPECIFICATION REQUIREMENTS (STS)6 Channel Channel Functiogal Channel Checka Test Calibrationc Millstone Millstone Millstone Instrument Channel Unit 1 STS Unit 1 STS Unit 1 STS Hign reactor pressure NA NA Q*
M Q
R Hign drywell pressure NA NA Q*
M Q
Q Low reactor water D
D Q*
M Q
R level High water level in NA NA Q*
M Q
R scram discnarge Condenser low vacuum NA NA Q*d NA R
NA Main steam-line iso-NA NA Q*
M NA R
lation valve closure Turoiae stop valves NA NA Q*
M M8 R
closure Manual scram NA NA Q*
M NA NA Turbine control valve NA NA Q*
M Me Q
fast closure Average power range NA S
Q*
SUI W
W/SA monitor (APRM) flow oiased hign flux APRM-reduced high flux NA 5
SUf SUf Q
W/SA Intermediate range De 5
SUf Suf R
R monitor (IRM)
High steam line S
W Q*
W Q
R radiation Reactor mode switch NA NA R
R NA NA in shutdown po.ition 6
r TABLE 1.
(continued)
FREQUENCY NOTATION Notation Frequency Notation Frequency S
At least once per R
At least once per refueling 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> outage (18 months)
D At least once per NA Not applicable 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> SA At least once per 184 days W
At least once per SU Prior to start up 7 days M
At least once per SD Prior to shutdown 31 days Q
At least once per Q*
Not less than one-month or 3 months greater tnan three months.
Presently performed monthly.10 a.
A qualitative determination of acceptable operability by observation of channel oenavior during operation.
Inis determination snall include, wnere possible, comparison of the channel with other independent channels measuring the same variable.
b.
Injection of a simulated signal into the channel to verify its proper response including, where epplicable, alarm and/or trip initiating action, Adjustment of channel output such that it responds, with acceptable c.
range and accuracy, to known values of the parameter which the channel measures. Calibration shall encompass the entire channel, including equip-ment actuation, alarm, or trip.
d.
Consiste r/ injecting a simulated electrical signal into the measurement channel.
e.
This not required by technical specification, however, test are performed.10 f.
Maximum test frequency is once per week.
e 7
valve closure initiate scram.
Tnese, and the time delay of 260 msec for the Turbine Control Valve Fast Closure are verified by surveillance procedures SP 408E, SP 408F and SP 403G resepctively, on a monthly basis.10 The Standard Technical Specifications for General Electric boiling water reactors (page 3/4 3-1, paragraph 4.3.1.2) require the logic system function test and simulated automatic operation at least every 18 months.
This is done at Unit No. 1 of tne Millstone Station by overlapping tests consisting of the nalf scram test and the scram insertion time test.
As can be seen in Table 1 the following channels are not subjected to a channel cneck as frequently as required for present-day licensing:
APRM--flow biased nign flux APRM--reduced hign flux IRM The following channel is not subjected to a cnannel functional test as frequently as required for present-day licensing:
High steam line radiation l
l l
The following channels are presently given a channel functional test l
as frequently as required for present-day licensing; however, the technical specifications allow the present frequency to oecome quarterly, without notice to the NRC.
Hign reactor pressure High drywell pressure l
Low reactor water level High water level in scram discnarge Main steam line isolation valve closure Turoine stop valves closure l
Manual scram Turbine control valves fast closure APRM--flow biased high flux l
8 1
I
r The following cuanN 1 is not calibrated at least as frequen 'y as required f or present-day licensing:
APRM--reduced high flux This snould be a weekly calibration against heat balance calculations.
In Section 3.1 of tne Millstone 1 Technical Specifications, 100 milli-seconds is stated as the required limit to the response time between any channel trip and tue de-energization of the scram solenoid relay. Response time testing to verify that the channel response time does not exceed this requirement is not in the technical specifications.
4.0 STANDBY LIQUID CONTROL SYSTEM 4.1 Description. The standby liquid control system is designed to insert a sodium pentaborate (or equivalent poison) solution to render and maintain tne reactor subcritical even wnen the control rods are all fully withdrawn. The equipment consists of an unpressurized solution storage tank, a pair of positive displacement pumps, either of which has full capacity to perform the system function, two explosive actuated shear plug valves, a poison sparger ring and associated valves, piping and instrumen-tation. A comp?cte description is in Section VI-7.2 of tne plant FSAR.
The storage tank is heated to prevent particulate formation. Tne discharge of each pump is protected by a pressure
. lief valve that discharges nack to the storage tank.
Pilot lignt indication of circuit continuity for the explosive valves is provided. A single key controlled switch will start a pump and open associated valves. Both sets of valves and pumps are not operated simultaneously; nowever, the valves for both pumps may be open. A test tank and a supply of demineralized water are provided for testing.
The FSAR indicates that testing is done in two parts.
One part deter-mines the ability of tne pump to develop flow and suction from the storage tank.
The system is afterwards flushed to prevent Doron precipitation.
Anot'er test uses demineralized water to snow that water can oe delivered 9
TABLE 2.
STANDBY LIQUID CONT:20L SYSTEM SURVEILLANCE REQUIREMENTS Frequency Millstone Surveillance Requirements Unit 1 STS Solution temperature within limits.
Dd D
b Solution volume is greater than specified.
D D
3 Heat traced pump suction piping is greater than or equal D
0 to 700F.
Start
-" oumps and recirculate demineralized water to Mc g
the t:st tank.
d Verify the continuity of the explosive charges.
D M
Solution chemical analysis.
M/M M/M Verifying that each valve (manual, poder-operated or auto-Md M
matic) in tne flow pato that is not locked, sealed or otherwise secured in position, is in its correct position.
Initiating one loop using demineralized water and replace-R R
ment of tne explosive cnarge.
Verify minimum flow requirement against reactor vessel M
R head pressure.
Demonstrate relief valve setpoint and that it does not Re R
operate during recirculation test to the test tank.
d Verify piping from tne storage tank to the reactor vessel R/M R/M is not blocked.
Demonstrate that the storage tank heaters are operable.
a R
a.
Minimum temperature is 75 per surveillance procedure SP 641.2.
This provides an indirect test of the operability of the storage tank heaters.
l b.
Minimum volume is specified by technical specification Figures 3.4.1 and 3.4.2.
i c.
Flow rate required to be 32 gpm wnile the FSAR design requires 40 gpm.
Tne technical specifications do not require testing of Doth pump loops; surveillance psocedure SP 661.4 does.
Pressure is not specified.
Technical specification, 4.4.A.2c recirculates solution from and to the storage tank at least once in 18 montns for ooth systems.
d.
Not in technical specifications, required by surveillance procedure.10 e.
Non-operation during recirculation test is not required.
Surveillance procedure SP 662.1 verifies tnat the relief valves do not operate under normal system operating pressure.
10
[
r I
into tne reactor vessel.
This test requires replacement of the explosive charges in the shear plug valves.
4.2 Evaluatlion.
Tabie 2 snows the current testing requirements for a
tne standby liquid control system and associated systems.
The surveillance required by technical specifications and surveillance procedures is done at least as frequently as required for present day licensing.
4 The etillstone 1 tecnnical specifications do not agree with tne design presented in tne FSAR, in that the minimum test flow rate is 80% of the design flow rate.
i Further, it is apparent that Millstone I has only one three-pnase heater in the solution storage tank, whereas present requirements aie for two redundant heaters.
5.0
SUMMARY
Tne Technical Specifications for Millstone Unit 1 were compared with tne Standard Technical Specifications for current Boiling Water Reactor licensing.
It was found that, for the reactor trip system, three signals are not suDa Cted to a channei check, one signai is not subjected to a e
channel functional test and one channel is not calibrated as frequently as required in the standard tecnnical specifications.
(See Section 3.2.)
Additionally, tne cnannel response time Detween channel trip and tne de-energization of the scram relay is not required to be tested.
For the Standoy Liquid Control System, selected as typical of E5F systems, surveillance requirements were as frequent as required in the standard technical specifications.
6.0 REFERENCES
~
1.
General Design Criterion 21, " Protection System Reliability and Test-
~
ability," of Appendix A, " General Design Criteria of Nuclear Power Plants," 10 CFR Part 50, " Domestic Licensing of Production and Utili-zation Facilities."
11
2.
Regulatory Guide 1.22, " Periodic Testing of t'ie Protection System Actuation Functions."
3.
IEEE Standard 338-1975, " Periodic Testing of Nuclear Power Generating Station Class lE Power and Protection Systems."
4.
General Design Criterion 40, " Testing of Containment Heat Removal Systems," of Appendix A, " General Design Criteria of Nuclear Power Plants," 10 CFR Part 50, " Domestic Licensing of Production and Utili-zation Facil ties."
5.
Nuclear Regulatory Commission Standard Review Plan, Section 7.3, Appendix A, "Use of IEEE Standard 279 in the Review of the ESFAS and Instrumentation and Controls of Essential Auxiliary Supporting Systems."
b.
Standard Tecnnical Specifications for General Electric Boiling Water Reactors (BWRs), liuREG-0123, Revision 2, Fall 1980.
7.
Millstone Point Nuclear Power Station-Unit 110. 1, " Final Safety Analysis Report," Amendaient 5, dated i4 arch 14, 1908.
8.
Technical Specifications and Bases for Millstone Nuclear Power Plant Unit 1, Appendix A, to Provisicn?l Operating License DPR-21, Amendments i tnrougn 45, dated December 1977.
9.
Northeast utilities letter, W. G. Counsil to Director of Nuclear Reactor Regulation, NRC, "SEP Topic VI 10.A, Testing of Reactor Trip System and Engineered Safety Features," August 4, 1981, A01766.
12
-