ML20039C648

Draft Override & Reset of Control Circuitry in Ventilation/ Purge Isolation & Other ESF Sys

ML20039C648
Person / Time
Site:	Trojan File:Portland General Electric icon.png
Issue date:	12/02/1981
From:	Sargent I FRANKLIN INSTITUTE
To:	Beard J NRC
Shared Package
ML20039C649	List: ML20039C648
References
TAC-08291, TAC-42594, TAC-8291, TER-C5257-183, TER-C5257-183-DRFT, NUDOCS 8112290569
Download: ML20039C648 (28)

Text

.,.

. ~.. -

==

ENCLOSURE 4' o

i. "

~

(D R A F 'f)

TECHNICAL EVALUATION REPO'RT OVERRIDE AND RESET OF CONTROL CIRCUITRY IN THE VENTILATION / PURGE ISOLATION AND OTHER ENGINEERED SAFETY FEATURE SYSTEMS PORTLAND GENERAL ELECTRIC COMPANY TROJAN NUCLEAR PLANT

~

NRCDOCKETNO. 50-344 FRC PR ECT C5257 NRCTACNO. 08291 FRC ASSIGNMENT 7 NRC CONTRACT NO. NRC-03-73-118 FRCTASK 183

' Preparedby Franklin Research Center Author:

I. H. Sargent The Parkway atTwentieth Street

~.

Philadelphia, PA 19103 FRCGroupleaderNJ. Store Preparedfor Nuclear Regulatory Commission Washington, D.C. 20555 Lead NRC Engineer: J. T. 3eard Dece=ber 2, 1981 l

This report was prepared as an acenunt of work sponscied by an l

agency of the United States Government. Ne.ither the United States Government nor any agency thereof, or any of their employees, makes any warranty, expressed or implied, or assumes any legal liability or responsibility for any third party's use, or the results of such use, of any information, apparatus, product or process disclosed in this report, or represents that its use by such third..

party would not infringe privately owned rights.

00 Franklin Research Center I aoe, 8lI22.9o 5(og A Division of The. Franklin Institute m s. - n...

.,.m ra m m m o iwo

^ ' '

' - ~ '

-+

--*bvoo-

{._J a

m

.u 1.~

- '. a m.

.a

.:. ~..

TER-C5257-183

.a e

~

ABSTRACT 3

~ ~ '

2. '

i This report documents the technical' evaluation of the design of electri-cal, instrumentation, and control systems provided in the Trojan Nuclear Plant to initiate automatic closure of valves to isolate the containment.

The evaluation was conducted in accordance with NRC criteria, based on IEEE'Std 279-1971, for assuring that containment isolation and other engineered ~ safety features will not be compromised by manual ove' riding e

and resetting of the safety actuation signals.,It was concluded that the electrical, instrumentation, and control systems in the Trojan Nuclear Plant do not satisfy the NRC criteria.

f 1

4 iii A

t00u rronwiin a...rch conter.

Ac>

n.tn.r e w

_. -. _=. w -

. w ; 3 --.:.-- p ".s, w ;.. a n w..,.

~ ~ C :,,..

• :~.

l

<~

..ua.._..._..

d' ThR-CS257-183 s

FOREWORD i

k.

This report is supplied as part of the program for Review and,

Evaluation of Licensing Actions.for Operating Reactors being conducted by Franklin Research Center (FRC) for the.U.S. Nuclear Regulatory Comnission (NRC), Office of Nuclear Reactor Regulation, Division of Licensing..

The

• work was performed by FRC, Philadelphia, PA, under'NRC Contract No. NRC-03-79-118.

e, e

Y $

9 e

e e

nklin Resear.ch. Center.

~.

~

[

• Q'M[M *g g,',

-- w

-.--r.h-y 9%,.

[,,,',_,.[..h.

y r.--,------ -.~ --

y.,m.,

s 4-y

i.~L " ~~ '.w.

n.

_ :a,.

TER-C5257-183 6

CONTENTS t

h Section_

Title 1

1 INTRODUCTION.

3 2

REVIEW CRITERIA.

5

.3 TECHNICAL EVALUATION Containment. Ventilation Isolation System Design 5

I.1 Description 5

3.1.1 General System Design.

5 3.1.2 Iogic Circuits for. Trip, Seal-in, and Reset

. -9.

6-Individual Valve Control-Circuits.

3.1.3 Containment Ventilation Isolation System 7

3.2 Design Evaluation.

8 Other Enginee:ed Safety Feature System Circuits 3.3 bescription of Other Engineered Safety Feature-9 3.3.1 System Circuits 9

3.3.1.1 General System Design 3.3.1.2 Logic Circuit for Trip, Seal-in,

~

9 and Reset-I 10 3.3.1.3 Individual valve Control Circuits.

L Evaluation of Other Engineered Safety Feature 12 3.3.2 System Designs.

i 16

~

CONCLUSIONS 18 4

5 REFERENCIS.

I V

On

!!!!U Franklin Research Center A Oma.en of The Frerwen heenme

- ".. - ~,-waw,,m.,

{ =s.,

' ~ ~ - - - -

~

~....

.m.._.,.

. s

-.: a..

..a.,__._

r

~

TER-CS257-183

..e g

?

LIST OF FIGURES i

Nu: ber Title j!Je 1

CVI Actuation / Reset.

.' 19 "I

Motor-operated Valve Control, Circuitry.

20 i

21 3

Solenoid Operator - Scheme.1 I 22 4

Feedwater Isolatic'n Actuation / Reset.

g 23-S Solenoid Operator - Scheme 2.

r l

l l

l l

l l

A

.' vi 0000 Franklin Resea.rch Center A w or n rr. sa %

• <-,.+or

- I e hh..

._x y

,C 7 * * ** T j MW*

A

%p,9*S.I.'S h

,-P r-

2.2:r ? ~ n:

w.

w..a>..

. ~.

TER-CS257-183 1.

INTRODUCTION

! t Several-instances have been r'eported at nuclear power plants : here au o ld not have matic closure of.the containment ventilatiion/purg'e valves wou d

occurred because the safety actuation signals werc either over' rid en or These events resulted -from procedural

~

-blocked during normal plant operations.

~

l inadequacies, design deficiencies, and lack of proper man,agement rentro t.

ility of the These events also brought into question the mechanical operab These events were dete'rmined by the containment isolation valves themselves. to be Abnormal Occurren l

U.S. Nuclear Regulatory Commission (NRC) i and were, accordingly, reported to the U.S. Congress.

i i the As a followup to this Abnormal Occurrence, the.NRC staff is rev ew ng ts'of contain-electrical override aspects and the mechanical operability aspec On November 28,' 1978, the NRC ment purging for all operating power reactors.

tion" issued.a letter entitled " Containment Purging During Normal Plant Ope

~

and pressurized water reactor (PWR)

(1)* to all boiling water reactor (BWR)

Trojan Portland General Electric Company (PGE), Licensee for the (2, 3, 4) which,

licensees.

Nuclear Plan, responded to this letter in several sub ittals i

t the Trojan advised the NRC staff of PGE's review of purging cperat ons a in general, with the pliysical aspects,of These responses dealt, iles or debris and the plant.

purging, such as system susceptibility to internal miss l

f the emergency core effects of cpen purgo valves en the potential cperat en o On ' November 19, 1979'(5), the NRC staff provided an cooling ' system- (ECCS).

ration pending interim position concerning containment purge and vent valve ope ility. PGE resolution of' issues associated with isolation valve operabIn this respo 14, 1980. (6).

responded' to this position on January isolated to the indicated that the. containment at the Trojan plant remained l

hen required for extent'possible with purging and venting conducted on y w d vent isolation personnel or equipment protectilon, that the 54-in purge an d that the hydrogen valve would be maintained closed during plant operation, an h r than 50 vent system 8-in motor-operated valves would be opened no fort e list of references, Section 5.

• Numbers in brackets refer to citations in th

. A 0003 Franklin Research Center-A Dnassen af The Freas6a W*ende M

e whp%

ll

• Y "

a w.

i,r TER-CS257-183 degrees to ensure that critical valve parts would not be damacjed by a design Ir. addition, PG4 reported the'results of the, review of all basis accident..

engineered safety feature (ESP) actuation signal circuits incorporatir.g"a

~

manual override including the conclusion that there were no instances where the overriding of one ESF actuation signal would bypass any other ESF actuation signal.

t

t..

theNRCrequestedadditiona$tinf,o'rdationreiatedto On March 18, 1980 [7],

the electrical, instrumentation, and control aspects of containment purge and PGE responded to this r.equest by, letter other ESF systems at the Trojan plant.

16, 1980 [8], which was received by FRC on October 20,.1980.

This dated June information was insuff'icient for an independent schematic level r.eview by FRC and was supplemented, in response to FRC's verbal reque'st for additional 13, 1981 [9] and March 11, 1981 information, by two transmittals dated January

[10] covering valve centrol. circuitry.and solid state p:otection system circuitry, respectively.

h-This document addresses only the electrical, instrumentation, and control and other engineer'ed design aspects of centair. ment ventilation isolation (CVI) safety features.

4 2-Ohbd Franklin Resear.ch Center Ao-.awr m

~

- - ~ -..,__.

Mq M

g r

u

i w _ w.. u.

g 1

TER-CS257-183 2.

REVIEW CRITERIA The primary intent of this evaluation is to determine if.the following NRC staff criteria are met for the safety' signa'is to all ESF equipments criterion 1. ' In keepina with the requirements.of General Design,

55 andiS6, the overriding

• of one type of safety o

Criteria (GDC) should not cause the.. blocking of actuation signal. (e.g.Ir radiation) any other type of safety. actuation ' signal (e.g., pressure) for 'those -

velves that have no function besides containment isolation.

Sufficient physical features (e.g., key lock switches) criterion 2.

are to be provided to facilitate adequate administrative controls.

o A' system level annunciation of the overridden status should be provided for every safety system impacted when any override o. criterion 3.

is active.

(See NRC Regulatory Guide 1.47.)

Incidental to this review,'the 'following" addition'al NRC staff design criteria were used in the evaluations Diverse signals should be provided to initiate isolation o. Criterion 4.

Specifically, contalnment high of. the containment ventilation system.

safety injection actuation, and containment high pressure (where containment high pressure is not a portion of safety injection radiation, should autcmatically initiate CVI.

actuacion)

The instrumentation and control shstems prov'ided to initiate the ESF should be designed and qualified as safety-grade Criterion 5.

o equipment.-

Criterion 6. The' overriding or resetting + of the ESF acturtion signal should not cause any valve or damper to change post. tion.

o In this review, Criterion 6 applies primaEily to other related ESF l i systems, because implementatien of 'this criterion for co'ntainment iso at o has been reviewed by the Lesson's Learned Task Force, based on the rec Automatic v'alve repositioning upon reset tions in.NUREG-0578,'Section 2.1.4.

the signal is still present, and it is blocked in order to Z

• 0verrides perform a function contrary to the signal.

d in the signal has come and gone, and the circuit is being c1eare

+ Reset:

order to' return it to the normal condition.

t00u rrenxiin a....rch cent.,

A Dw of The Frenamninseems

• • • .9

"*-s>

-7%

m qq q g

~

~

. -.. - - ~,

. - -- J.

' TW:' ' --

.. _.. - - -. ~. _ _ _-,.

.,s.

_e,

,,4g, TER-C5257-183 may be acceptable when containment isolation is not involved., The accept-ability of repo'sitioning upon reset will be deter:nined on a case-by-case basis. Acceptability will be dependent upon system function, design intent, and suitable operating procedures.

1

... ~

?.

~

[

~.

.-g-l e

I i

l

~

nkJin Research Center A Censson af The Fr.rehn W

-.-+.-.,e M --

Y,

[. "*7 ;

+

~

~

TER-C5257-183 3.

TECHNICAL EVALUATION CCNTAINMENT VENTE.ATION ISCLAT' ION SYSTEM DESIGN DESCRIPTION 3.1 3.1.1 General Svstem Desian The cotitainment ventilati,on isolation (CVI) s'ystem is a portion of the

~

solid state protection system consisting of a printed citeuit board, desi,g-nated a SAF-CUT device, which processes inputs from either'th'e safety injection output device or the containment radiation monitor and produces an output (SI) to" shut the 54-in to actuate master and slave relays (and associated contacts) containment purge and exhaust is'olation valves (MO 10002, MO 10003, CV 10001',

and CV 15004). 'PGE has indicated that all instrumentation and control systems Containment purge and to initiate ESF are, safety related (i.e., safety grade).

exha6st isolation valves are currently inaintained closed during plant operation at the Trojan plant.

i Je 3.1.2 Loeic Circuits for Trio; Seal-in, and Reset Containnent ventilation isolation at the Trojan plant is ' initiated through Each train censists of autc=atic and two separare electrical trains, A and 3.

l manual inputs processed through solid state protection system logic ~ circuitry The outboard, motor-to actuate a relay logic co=ponent actuation system.

cperated, valves in the purce supply and exhaust lines are actuated by Train A.

The inboard, solenoid-operated, valves are actuated by Train B.

Initiation signals for each electrical train are arranged to provide an isolation signal based on the following inputs:

Automatic isolation o

SI actuation Containm'nt high radiation e

o Manual isolation Manual SI initiation Manual CVI initiation

~

nklin Research Center ADensen af The Feenten trummane

-- i

_.__.P-

-.7

g"--*--.==.

~~... _,....._ _ %

.,,.+ -

ir y

T'ER-C5257-183 The automatic SI signal is derived from any of the following:

o Low pressurizer pressure (2 of 3)

'o High containment pressure' (2 of 3)'

~

~

High steam line differential pressure.(2 of 3,- any loop) ~

o s

High steam line aflow' (2 of 4 loops) coincident with jlither low-low o

Tavg or low steam line pressure.

As shown in Figure 1, S'I actuation (automatic and manual) and high radiation CVI initiation signals are combined to provide a singl'e input t'o a logic device (SAF-OUT board) in'each ele *ctrical train. These output devices consist of a "resettable" solid state latching ~ circuit with a power condition-ing output circuit and are each used to drive a master relay coil. The.

contacts of the master relay control.the. latching-type. slave relays,. which have contacts in the individual control circuits for the' solenoid and. motor

~

operators used to position ESF' valves and dampers.

.hr A manually operated " RESET" pushbutton actuates the unlatch coils of the.

slave relays and p cvides a " reset" signal to the solid state logic circuit.

f A " reset" signal causes the SAF-OUT logic circuit to remove the actuation signal from the master relay and to go to 'a signal-blocking mode until all initiating signals have been removed (e.g., measured isolation parameter value returns to normal). Thus, the " reset" feature of the solid state protection system" SAF-OUT logic unit behaves as an everride which defeats all automatic The manual SI signals if initiated with an actuation signal present.

actuation signal automatically ac.tuates the CVI

• system and thus is affected by this override. The manual CVI signal', however, is downst' eam of the CVI r

SAF-OUT board and thus is not af fected by an override of the CVI logic.

3.1.3 Individual valve control circuits Control circuits for motor-operated (full voltage reverring motor control-1ers) purge supply and exhaust valves, shown in Figure 2, are designed to be Valve control opened only by actuation of an individua1 valve control switch.

nklin Research Center A C> m en af The Fransen wusase y --

. c.-

. w _, 4,

7-c

u. :..

,,,m.

=

a.

TER-CS257-183 switches have contacts in both the opening and closing ' relay circuits, which are cpen whenever the switch is in its neutral / normal position. 'Since,these switches are spring returned to neutral," with the closing contact bypassed by

~

the appropriate slave relay contact when an isolation signal is present, manual switch motion is necessary to energize the opening coil following the clearing er, a normally closed slave relay ** contact in f

" of the isolation signal.

F,u the "open relay circuit prevents momentaryialve motion'.shgul'5' the loical f

control switch be placed in the open position with a CVI signal present.

In contrast, as shown in the control switch development of Figure 3, control circuits for solenoid-operated purge supply and exhaust valves are not designe'd to require follow-up manual actuation in order to reopen these valves following the " reset" of an' isolation signal. Valve control switches provide a set of alternate action contacts in series with the. solenoid.that remain in the state required for the last valve operation (i.e., closed following a Conse-valve opening operation, open' following a valve closing operation)...-c quently, if the mest recent valve action has been.to open, the removal of the isolation signal, which' deenergizes the appropriate slave relay causing the

~

slave relay contact -in series with the solenoid to reclose, will reenergire the valve control solenoid. Thus, the valve will automatically reopen upon

" reset" of the safety a'etuation signal.

3.1 ~ CONTAINMENT VENTILATIO3 ISOLATION SYSTEM DESIGN EVALUATION The CVI system at the Trojan plant does not satisfy Criterion 1.

Actuation.of the system " RESET" provided for the CVI SAF-OUT device, with an input, signal present, will deenergize the master re' lay 'and unlatch the slave.

relays for the purge isolation valves, allowing the valves to be reopened or Further, " RESET" actuation will prevent a second causing,them to reopen.

from isolation signal (e.g., safety injection after containnent high radiation) initiating CVI until the first signal has cleared.

No The CVI system at' the Trojan plant does not satisfy Criterion 2.

physical features have been provided to facilitate administrative controls to prevent the inadvertent actuation of the CVI " RESET."

- s-l A

Uh00 Franklin Research Center 4 o

.a n.r,= 6.

.u.

~ "Y"

' ~

~~

~~ -

w _. ~ ~ ~

. av u -

~

.~

=-

4"

'TER-C5257-183 The CVI system at the Trojan plant does not satisfy Criterion 13. No annunciation of' the overridden status of the CVI actuation system is prov_ided.

The CVI system at the Trojan plant partially satisfies Criterion 4.

' Containment-purge supply and exhaust are isolated on safety injection actuation (high containment pressure, high steam line diffe'rential pressure,

" ~

t low pressurizer pressure, or high' steam line flow) or a containme.nt-high_,

radiation signal. Other containment ventilation isolation ' valves such as. the b containment hydrogen vent va'1ves, however, are isolated by actuation of the containment isolation master relay. Thisisolationsignalisinktiatedby safety injection actuation only and is not initiated by a containment high radiation signal.

The CVI system at the Trojan plant partially satisfies Criterion'5.' PGE

' has stated th'at all instrumentation and edntrol systems provided 't'o initiate l

ESF are safety related (i.e.,' safety gra'de) and referenced the Trojan FSAR i

Sections 7.1. and 7.3 for further information concerning compliance.'.'2he Trojan FSAR provides a detailed description of system design features with respect to safety design criterion (e.g., IEEE Std 279) indicating that, in general, these systems do eet acceptable safety requirements fer design, f

qualification, and testing. There is no in'dication, however, that containment high radiation detectors and associated circuitry have been considered to be ESF-related equipment. The Licensee should confirm that radiatien monitoring

. instruments used to initiate CVI do satisfy safety grade requirements (i.e.,

~

j f

IEEE Std 279) for design, qualification, and testing.

':he CVI system at the Trojan' plant does.not satisfy criterien 6.

the solenoid-operated purge supply and exhaust valves '(CV Following CVI reset, in001, CV 10004) will reopen unless the operator positions individual valve control switches to "c' lose" prior to the " reset" action.

3.3 OTHER ENGINEERED SAFETY FEATURE SY. STEM CIRCUITS

~

i In addition to the review of valves and dampers associated with the CVI

~

~

system (i.e., ' purge supply and exhaust valves) pre,viously described, FRC

(

4 M8-i 00hu Franklin Research Center A Dummen of The Fransen buenas

_. g

.,.j ?'^

'" C a-

• C" A

.. _ _ ;3 e

- = * * -

+.

~.

o TER-C5257-183

~

s audited the design of other ESF systems with manual override features by perfo'rming a detailed circuit analysis of spray a'etuation, contai'nment isolation, and feedwater isolation'.

Descriction of Other Encineered Safety Feature System Cltcuits 3.3.1

~3.3.1.1 General System Desigh, Initiation signals for ESF sy tems and components are combined in' solid.

state logic circuits. For other than a simple "OR" gate, logic circuits are provided in printed circuit boards designated UNIVERSAL BOARD. 'The logic of these boards can be selected by external connections to produce output signals based ori AND,.OR, 2-out-of-3, or 2-out-c'f-4 combinations of input signals.

The output of the universai logic. circuits is used to drive SAF-OUT boards as

~

previously desciibed. SAF-CUT signals, control power 'to master relays which, Slave, elay contacts operate in the control in turn, control slave relays..

r circuit for individual valves," dampers, and other ESF equipment. Manual-ESF.

.-g-initiation, where provided, directly~ energizes the appre,>riate master relay regardless of the' status; of the associated SAF-GUT device. Manual system

" RESET," where provided, cperates (as previcusly described). to unlatch associated slave relays and block the output of associa,ted SAF-CUT. devices.

PGE has indicatcd that a'll instrumentation and control systems provided to i

initiate ESF are safety related.

3.3.1.2 Logic Circuit for T' rip,' Seal-in, and Reset In general, other ESF systems are actuated' automatically by signals associ,ated.with appropriate plant parameters and may be ' initiated manually Manual initiation is accoinplished through momentary contact push' buttons.

regardless of the state of the associated SAF-OUT ' device, by directly energizing the appropriate master relay which energizes the associated slave

' relays. Release of the manual initiation push button deenergizes the master A momentary contact push hutton relays but does not unlatch the slave relays.

(" RESET") is provided to unlatch the sla've relays and b ock the output of the l

The " RESET

• associated ' SAT-CUT device until the initiating signal has cleared.

nk!!n Research Center A C>mmen of The Frenten insamme

-G-

~-

3

.n.

I l'

TER-C5257-183 The win not block output if no input signal continues to be prese'nt.

d in applicability "of these features to individual ESF circuits is identifie -

Table 1.

~

As discussed in Section 3.1.2, concerning the operation of the SIJ-0UT device, the "R3 SET" feature performs as an override which.will override auto-l

'This matic signals b'ut will not preclude manual actuation of the master re ay.

3

~

feature is of significance when more than one input sign'ai i,s'cdsbined-in a l

In such a case, the " RESET" of gate immediately prior to the SAF-OUT board.

i i i tion of a the SAF-OUT device with one signal present win prevent t e re n t a before SAF-ouT output signal should a second input signal appear at the OR gate This situation does not occur in Trojan ESF circuits, the 'first signal clears.

other than CVI as previous'ly discussed, since single pa'rameter initi'ation

' isolation signals are used to, initiate the containment spray and containment actuation systems and, in the case of.the feedwater isolation systems, as tion shown in Figure 4, a single parameter signal is used to initiate that por of the system having a pushbutton " reset."

~

Individual Valve Centrol Circuits i

l 3.3.1.3 Valve control circuitry provided for motor-operated valves in ESF systems utral at the Trojan plant is,'in general, designed with spring return to ne I

~

Switch contacts are located in series vita-individual valve control switches.

itch is in the i

each motor cen roller reversing relay and are open when the sw normal or neutral position." Each switch contact is paralleled by an "a i

til contact frem its associated reversing relay to provide signal seal-ns un td ESF valve. travel is complete or the corresponding torque switch is actua e.

'it shunt slave relay contacts in the appropriate closing (motor-reversing).circu h

sing relay when the associated ",close" switch contacts to energize t e rever Some controllers have push buttons which an,ow l

the slave relay is energized.

Figure 2 provides a simplified schematic representation local valve cycling.

i Valves which of the egntrol circuitry for a valve closed on ESF initiat on.

header isolation are opened on ESF initiation (e.g., c'entainment spray ring l with the are wired similarly with the slave relay contacts in tarane l

valves) control switch contacts in the opening circuit..

nklin Research Center.

.

• A D=usen af The Fenreen > sense

'#A E

-h...

~ ' ~Z -.. ::.: -

. _ - - ~.

. -... - ~.

TER-C5257-183 a

Table 1

~

Manual ESF Initiation Auto Initiation Sicnal

" RESET"

~

Containment Spray Yes High-High Containment Yes Pressure 12 of 4)~

~

Containment Isolation' Yes '

Safety Injecticn(a)* s Yes Feedwater Isolation No Safety Injection (a)

Yes (b)

~

High-High Steam Generator Level (2 of 3) from Any Steam Generator Low Tavg (2 of 4) Coincident

~

with Reactor Trip

~

.h a.

Either manual or autematic.

• b.

":ISIT" push button provided fc: Icw Tavg trip.

Steam generator water level trip 'RESIT" in test mode only.

Safety injection trip " RESET" in test node or at SI output device.

9 A.

b0 Frank!!n Research Center.

~

A D=usen of The Franten buence

-~~~ w w w

.s. w n.w..- -

cm. -

- - --. -. ;y s a +se.--

,~

e a _.. a y

s' TER-C5257-183 Control circuits for solenoid-operated valves in Trojan ESF ' systems are.

Provided in two basic schemes. Se basic series' arrangement is depicted'in Figure'3. In this arrangement, the ESF slave relay ' contacts are installed in

_ series with contacts from the manual control switch. Be manual switch is provided with a spring return to neutral / normal with valve

• control contacks aligned (when in neutral / norma () in the position required by the last manual nlve position selected preceding the switch return. A second arrangement is depicted in Figure f.

In this arrangement, a solenoid position switch contact is provided in a hold-in loop in series with the' ESF slave relay

• contact i.nd control switch contact which, upon spring return to normal, remains'in the i

state required by the last manuar operation. This circuit is paralleled by a switch contact which is closed only when the control switch is bald in the open position.

~

3.3.2 Evaluation of other Encineered Safety Feature System Desions O

.-t Control' circuitry in ESF systems at the Trojan plant, other than the CVI system, meets the intent of Criterion 1.

In cases, where 1.he ESF signal can be everrieden in the solid stata protection system circuitry (i.e.

through the j

use of a push butten " RESET" operating on the TAF-CUT devi el, this. override affects only a sirigle trip'p'arameter (e.g., high-high containment pressure for centainment spray in'itiatien, safety injection for contai. ment isolation, and' icw Tavs for a portien of the feedwater isolction, system). The "ESET" of the

'SI SAF-OUT board does block multiple signals ' input to the SI SAF-OUT board is provided by either high containment pressure, high steam time differential pressure, icw pressuri:er pressure, or high s' eam line' flo[), but this output t

performs functions other than containment isolation (e.g., pump starts) and has been identified by the NRC staff to be beyond the scope of this review.

In several instances, hand switch overrides are proIrided in individual valve control circuitry which can override an ESF signal. Such arrangements occur in motor operator controllers not provided with ESF slave relay contacts in both reversing coil circuits. Similarly', one solenoid operator control scheme provides a manual switch contact which will typass ESF slave-relay O@J Franklin Research Center

-lh -

4 o,

.r n. r=*a =

., w

. a w.

a.

+

TER-CS257-183 se

=

contact. All such arrangements found in the FBC review, however, employ either moment'ary contact push buttons or spring return-to normal switches which result -

in an override situation only when 'the push button is deprecsed or the hand

~

switch is held in th'e override position. 'Upon release of thesw pust. buttons or hand switches, the, associated valve will return to the gosition' required by '

t the.ESF signal.. Further, as discussed with respect to the SAF-CDT " RESET,"

the e local switches do not,'with the exception of devices. actunded by safety -

~

injection actuation, override multiple pr.rameter input signals (i.e., the switch contacts bypass only a sing'le set of slave relay contacts).

System level (i.e., '" RESET") and ' local overrides at',the Trojan plant do n

t not' satisfy Criterion 2.

No physical features have been provided to facilitate the administrative control of switches or push buttons which could continuously-(e.g.y " RESET

• push' button) or momentarily override ' an ESF signal.,

System level overrides at the Trojan plant do.not satisfy Criterion 3.

I

.There is no indication that the use.of a system level override (e.g., " RESET" of containment spray initiation, feedwater isolation, or containment.

~

isolation; will be annunciated to indicate the overridden status of that f

i system.

A discussion of.

Criterion 4 does not, apply to other ESP systems.

co=pliance with the criterion.in the case of centainn.ent, ventilation systems j

is p:ovided in Sectica 3.2.

This-bF systems other than CVI' at the Trojan pl' ant satisfy Criterion 5.

conclusion is based en the Licensee's statement.that "all instrumentation and control systems provided to initiate ESF.are safety related (i.e.,.ssfety grade)" and on' FBC's review of the Trojan FSAR.

ESF instrumentation and control systems at the Trojan plant do not fully satisfy Cr'iterien 6.

Several instances were found iri yhich solenoid control circuitry was arranged as depicted in Figure 3 or, in the case of.feedwater control and bypass valves, where ESF slave, relay contacts were in series with

.a solenoid operator (i.e., no control switch provided). In such an arrange-the reset cf an ESF signal will cause the as'sociated valve to change

ment, i.

A NOU Franklin Research Center A Dunason of The Fen # Wen bueeune

-~

L---~-

... ~

.L_~;~7 1~b TN.~

E ~'Tl

..a

~

s'

'TER-C5257-183 a

automatically to its pre-ESF position. A listing,of valve operators that have been identified' in the review as changing position upon ESF reset is provided-in Table 2.

PGE's response [8] to requests for information on this subject indicated that modifications have be6n made to the control circuits for 23 containment isolation. valves to prevent repositioning upon ESF reset; however, these valves have not been* identified and no indication ~of such sodification

.~

appeared on the drawin's provide'd for this review.

~~.

- T

~~

g l

-c.

l

~

l l

l i

i

~

~

l A ~

00b!! Franklin Research Center A p.m.en of The re beenne

' ~ ' ' ' * ' * ~

~:

s..s 9'"

• ~

• a.:

.y

.s TER-C5257-183 Table 2'

' sn Valve Number Name Initials Remarks SV 5661 RCDT Sample Isolation Valve

'CIS SV 5652 Sample Isolati'on Valve - Accum comon CIS

)

SV 5655 t.

- RCS Hot

• Legs

.CJS-SV 5657

- PIR Liquid Space CIS SV 5659

- PZR Vapor Space CIS SV 4470

. Service Air to Containment Building CIS' SV 4471' Service Air to Contaifunent Building CIS SV 4006 RCDT N 'and Outlet Valve '

CIS 2

SV 4000 RCDT N and Outlet Valve CIS 2

SV 43.01 Gas Collection Header. Valve CIS-SV 4181 Containment Sump Pump Discharge Isolation Valve-CIS

~

HQ 4180 Containment Sump Pump Discharge Isolation valve CIS Note 1

~2. x ~

SV 10014 CW Return Line Isolation Valve

'CIS

.SV 10015 CW Supply Line Iselation Valve CIS SV 2993A1,A2 Feedwater Bypass Control Valve Loop 1 WI -

SV 2993B1,B2 Loop.2

.FWI SV 2993C1,C2 Loop 3 WI SV 2993Dl,D2 Loop 4 WI l

SV 510A,B Feedwater Flow Control Valve SG A FWI Note 2, 3 SV 5 9A,B'

'SG B WI Note 2, 3 SV 530A,B SG C WI Note 2, 3 SV 540A,'B SG D FWI Note 2, 3 SV 2971A,B,C,D Feed.iater Isolation Valves FWI Note 3 SV 2973A,B,'C,D Feedwater Bypass Isolation valves FWI

~

I Note 1.

ESF reset will restore control to an automatic controller. Valve repositioning will be dependent on ' controller. signal.

Note 2.

This " RESET" restores control air to the valve operator. Valve l

position will be determined by the pneumatic signal provided by the l

feedwater control sy:trm.

l Note 3.

Pushbutton " RESET" is available, for low Tavg trip only.

4 UNU FranWin Research Center A Dansen of The honen buenas

_ =~. _3 y:-

u.pr.

l a r_.

~.a

.. w TER-C5257-183 s

~

4.

CONCLUSIONS The electrical,, instrumentation, and control design aspects of ESF -

systems at'the Trojan plant were evaluated against NRC design criteria.

Several areas of noncompliance with these criteria were identified on the basis of schematic drawings,ppided by the Licensee. The following summarizes these areas of noncompliance and FRC's recommesdations.

Criterion 1.

In the case of the CVI system, the " RESET" feature of the SSPS SAF-CCT device will cause the overriding '(i.e., '" RESET") of one type of actuation signal (e.g., safety Injecticri) to block a different type of actuation signal (e.g., containment high radiation). The fact that PGE is currently maintaining containment purge supply and exhaust valves shut during

/

plant operation tends to reduce, but not eliminate, the potential' for. an operator error causing these valves to be opened when an isolation signal is present and subsequently failing to close when a second isolation sisplYs received.

. Other ESF systems with this feature are acceptable only because a single actuatien parameter is involved.

Criterion 2.

None of the ESF systems at the Troian olant satisfy Criterion 2.

As previously discussed, SSPS " RESET" push buttons act as

~

overrides since their actuation will eliminate an output signal from their l

' associated SAF-CUT device when an ESF initiating signal is present.

Criterien 3.

ISF syste=s at the Trojan plant do not satisi'y Criterion 3.

The " RESET" of a SAF-CUT device with an input signal present performs as an.

override of one or more actuating parameters which shoul'd be annunciated at l

the system level in order to satisfy Criterion 3.

Note: In the event that the Licensee decides to install system modifica.

tions to ensure that SSPS " RESETS" perform as true resets and will not override

]

I an ESF signa,1, Criteria 2 and 3 are not applicable.

i 9

i l

Criterion 4.

ESF systems at the Trojan plant partially satisfy Criterion j

4.

Containment purge and exhaust valves (54 in) are. isolated by the CVI

~

D nklin Research Center A De of The Frans6n buuue

-,.w-

~ _.

.~ ~ ~. :

~p

• *[ ^

[.

y c..

..c__. _ _ _ ~ _ _ _ _ _ ._2._...___ s i TER-C5257-183, subsystem which is actuated by diverse signals (safety injection actuation and high radiation). Other ventilation. valves, however, are not isolated byIthe ~ CVI subsystem. Those valves (e.g.,. 8-in inydrogen vent valve) ire, isolated by the containment isolation subsystem. This subsystem is activated automatically by safety injection actuation which, while provi. ding signaf diversity, does not satisfy the' requirement that. isolation be initiated by containment high i radiation. Criterion 5'. ESF system's at the Trojan plant partially satisfy Criterion E No informaticn has been provided concerning the design and qualification of containment high radiation det'ectors and associated circuitry. Criterion 6. ESF systems at the Trojan plant do not' satisfy Critierion 6. Several instance's were found where a. solenoid operator control scheme is used that will result in valve repositioning upon ESF actuation signal override or re se t. valves observed during'this review'which must be so categorized hay.e been identiified in Table 2. The Licensee has indicated [8] that modi 6 cations ~ have been comp 1.eted for 23 containment isolation valve control circuits at the Trojan plant to preclude valve repositiening uper'ESF reset. No such modifications we're apparent en the drawings previded by'PGE for FRC review to indicate that some or all of the valves identified by FRC'may have been'so modified. Tne Licensee should ' review all solenoid valve operator control systers actuated by ESF slave relay contacts, including these identified in Table 2, and. provide appropriate. circuit modifica't:lons. nklin Research Center A Deusen of The Fransen basene

73 37%

w y?y3ernr. - w ~.

~.. ~ 3' TER-CS257-183 a 5. REFERENCES 1. A.' Schwencer (NBCl I4tter to all BWR and PWR licensees

Subject:

Containment Purging During Normal Plant Operation 28 Nov. 1978 2. PGE Letter to A. Schwencer (NBC) 3 Jan. 1979 3. D. J. Broehl (PGE) Letter to A. Schwencer (NBC) 30 March 1979 4. C. Goodwin, Jr. (PGE) Letter to A. Schwencer '(NRC) 31 May 1979 I 5. A. Schwencer (NBC) Letter to BWR and PWR Licensees 19 Nov. 1979 .i-6. W. J. Lindblad (PGE) Letter to A. Schwencer (NRC) 14 Jan. 1980 7. A. Schwencer (NRC) Letter to PGE 18 March 1980 8. C..Goodwin, Jr. (PGE) Later to R. A. Clark (NRC) 16 June 1980 9. J. W. Lentsch - (PGE) i Letter to J. Stone (FRC) 13 Jan'. 1981 10. J. W.14ti:sch (PGE) l I4tter to I. Sargent/J. Stene (FRC) 11 March 1981 i I ~ -if3- !!00J Franklin Research Center A Dmmen of The Fransen buemme 7 - - e ~ v* ~ +~4 4u. .,,, w.,

1 n s 120VAC 120VAC e, I i - :o 33 ' AU.l O STAS 4 Q w / S U) 7 a . / < > s(L) s (l 3 l. SAF OUT 7; = > 7s L. agy --o \\ (s ':r Q p a _L. _ MANUALSI M M ~ [__ _ - ^ 1 i H na CVI L. T 3 to a as 1 HIRAD (AUTC) I SAF OUT- = p (" RESET") ' MAN CVI ' 1 CVI l1 " RESET" I-r> Q g; Cvi"nasEr~ g M - M ASTER RELAY / S(L)- SLAVE RELAY (LATCH Colt) 7 S(U)- SLAVE RELAY (UNLATCH Colt) 1'. i \\- 3 1 3. m ( '3 u 4 Figure 1. CVI Actuation / Reset 8 e .f at D8 '{' (D W l o f I O [ 3 L

V. e at i TS LS " p> 33 \\ n tg d g ,gg 1 su ! 2f. ~

LS

LS

g..

,g}* t( 1,- w Cl. Control Switch Position In ( ~VbgI Normot Alter. e gs . g j Contact Open Open Close Close { CI;. :: CS2 1 X 2 l x

CSi.

.~ ,_,N /12 2 <%_L,d g t {~e e-+ e I" \\ g / P %/ %s T --Ra Fa T T s zRb , r Fb

1. ;

? 7* p. w t... d [! "-Torque Switch . TS

I.

F(open) R (closo) . LS ' - Limit Switch 5 CS -Control Switch Cl - Containment isolation Slave. Relay Contact .8 Fa.b-m.bContactonF(forward) Relay. 'a M Re.b-s b Coniect on R (reverse) Rel4y

• MOL-MolorOverloedRelayContact(p

b j

yot o

NOTE: I f ,g. 1 - Containment Purge Supply and Exhaust Only U 2* -Notincludedin AllSystems i 3 I-3 Motor-Operated Valve Control Circuitry Figure 2 i i

,l , f { i!l, t ' ji l:7 ,i .~ g .f' ?. a A E.MJ.gHs4 e8 a I L e tc .t a 3 t e* n o Cya l e e s lo R e C v n a ~ l r o So 1 il e nl le a r s or me o e lo ie t P l ap e C oO. h l l h A c s il l .hi e c a v ct l S w m ne l 8 r n i o e weV X Smd l o N p f nl O oio r r I en-o n t I l o e t nnl C n CCSooo. a I r n p X e - = - e k' e g p O e Sl V O L CCS d ( i one l o y S S l s C C {. '~ -} 3 ? erug i e F -w 5

wPI Ln gaEu:o 3,= R S n 3 4 E-l<

~ g (( t g, ,li.1 \\ f ),' l 3i I1

• i

,.I' .f,!. i l !. il1r 1> '- j ,I ,ai 4

j .' f. t: 1 i r. i 120V T. RIP 48V . i ] '="

[g; M508

. seas}V .,i

---

TURelHE t'

; yg MAIN FEED PUMP

! 4 p.:n . a A3 I,,Q Si SAF ~-F y.. gg, OUT . lff) e FWCOt4T VLV . * ?. - TEST 8620 ---g gy 4 t MSOT

1. ~

SAFE ~f l i 112 U SGWL. OUT-a l l

FWCONiVLV

- TEST S(L)636 - - - -- yw ggog,,yty i w }S(L)630.63T

• FWISOL BYP VLV

( S(L)63T )-- --- ~ FW EYP CONT VLV RT.'" 1 M520 - - -. - - - - - - - - - - - - - - SkF 212, .h TAVA OUI' ~- j N <i ..HESET" - r 1 L .t. - .g g 3 I ' OUTPUT (LOW) SEALED [g oi i gl IN WHEN REACTORTfMPPED y [ t l 4 I ,it ( - I i V se W Figure 4. Feedwater Isolation Actuation / Reset i ! t t I 1 . i, i t

e e? - r' .... ' " v TER-C5257-183 d o 0 s = - m =e .~ s e \\ z < s I,E B e 3 z

o. x 3

o N e cc g c e e x x a n m s.- u ee w -0 wo, ' e 1 Q. ~ c9 E <T w o w C e o e o W e e -L G ~ o -o o e u. m o m e e N' f m w i. 1 as a en s E m eo w o c. \\ o E &l l A, Nbhrank5n Research Center ~ A h of The Fmnamn kuumme --+9.mts.e u www.av u ~- -.- - +. ~ -., --}}