ML20054C030
| ML20054C030 | |
| Person / Time | |
|---|---|
| Site: | Millstone  |
| Issue date: | 03/31/1982 |
| From: | Clark R Office of Nuclear Reactor Regulation |
| To: | Counsil W NORTHEAST NUCLEAR ENERGY CO. |
| References | |
| TAC-7089, NUDOCS 8204190403 | |
| Download: ML20054C030 (3) | |
Text
i f
MAR 311932 O!
DISTRIBUTION:
Mocket File NRC PDR L PDR NSIC Docket No. 50-336 ORB #3 Rdg DEisenhut a \\t Rf JHeltemes D
OELD
.,y ACRS-10 M N.r F No@og i
Mr. W. G. Counsil Vice President I&E gf B
q Nuclear Engineering & Operations Gray File S
Northeast Nuclear Energy Company PMKreutzer
)
P. O. Box 270 RAClark c;
o Hartford, Connecticut 06101 EConner
Dear Mr. Counsil:
A I 9 By letter dated October 23, 1981, you provided additional information with regard to the independence of the four channel Reactor Protection System (RPS) and the Engineered Safety Features Actuation System (ESAS) measurement logic in response to our April 16, 1981 letter.
Since issuance of the April 1981 letter, we have modified our position slightly. Two options are provided for licensees to follow. Option 1 would allow the bypass of an inoperable channel for a period not to exceed 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> et which time the inoperable channel must be placed in the trip mode. Option 2 would allow the bypass of an inoperable channel in accordance with the requirements delineated in the Techni-cal Specifications (TS) Enclosure 1 Action Statement 2.
Option 2 is less restrictive than Option 1.
Option 1 The original TS proposed by the staff for plants requesting to operate as a two-out-of-three system was to require that the inoperable channel be placed in the tripped condition within one (1) hour. Subsequent to this requirement, 48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> bypass was approved by the staff on various j'
operating plants (Calvert Cliffs. St. Lucie 1, and Arkansas Nuclear One Unit 2) based on the staff's review of the RPS and ESFAS sensor channels for the adequacy of physical and electrical independence.
Based on all reviews of Combustion Engineering (CE) designed plants completed to date, we now conclude that there is no technical or safety basis for limiting the bypass of a channel to one hour rather than 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />. Permitting 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> rather than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> prior to placing an inoperable channel in trip may, in fact, be a benefit to j
plant safety by reducing the probability of inadvertent protection system actuations and by providing greater flexibility in performing maintenance and/or testing on an inoperable channel. SeTect: ion of this option should result in application for TS in the form of Enclosure 3 to our letter of April 16, 1981.
8204190403 820331 PDR ADOCK 05000336 4
P PDR omc.,
sunnauct DATE) anc reau m 00-8m Nncu em OFFlClAL RECORD COPY usceo. is,i-33>,co
i j
_?
. Option 2 If it can be verified that three protection system channels in two-out-of-three logic are sufficient to satisfy all protection system criteria, then one channel of a four channel system may be bypassed for a lengthy period of time with no degradation to safety. Action Statement 2 of the Enclosure 1 TS pages (San Onofre - Unit 2) may be proposed in place of Action 2 of Enclosure 3 of our April 16, 1981 letter. Enclosure 2 delineates the criteria which must be satisfied to ensure that three channels are sufficient for plant protection. However, we believe that it is prudent that an inoperable channel be repaired and returned to service as quickly as practicable. Action Statement 2 of & closure 1 would allow the flexibility of continued plant operation with an inoper-able channel in bypass where it is not feasible to repair the channel (for example, if the failure is inside the containment in a location inaccessible during plant operation). The model TS, however, do place responsibility on the licensee to repair the channel as quickly as possible and in any event during the first cold shutdown after the failure has occurred.
Option 1 may be implemented by a request from you without any further analyses or review of the protection system by either the staff or yoursel f.
Option 2 should be implemented only after you have requested this option and have verified to the staff that you have reviewed the plant design and determined that it complies in all respects to the y
criteria delineated in Enclosure 2.
No review would be required by
/
the staff unless a significant question arises related to your review.
l V
Application for the Option 1 or Option 2 TS should be submitted any time within the next 6 months. The issue should be resolved before startup from the subsequent scheduled refueling outage.
x Sincerely, Original signed by Robert A. Clark Robert A. Clark, Chief Operating Reactors Branch #3 Division of 1.icensing
Enclosures:
As stated cc: See next page QW4$.
..o
... 0R B f.3.;.01...k.
omce>
PMKreutzer n
Rg....grA..... m....
mR_ >
3!Zll.82....
3.L*fL82
,gM).L82 om>
NRC FORM 318 00% NRCM ONJ OFFICIAL RECORD COPY usamai-am
Northeast Nuclear Energy Company cc:
William H. Cuddy, Esquire Mr. John Shedlosky Day, Berry & Howard Resident Inspector / Millstone Counselors at Law c/o U.S.N.R.C.
One Constitution Plaza P. O. Drawer KK Hartford, Connecticut 06103 Niantic, CT. 06357 Mr. Charles Brinkman Regional Administrator Manager - Washington Nuclear Nuclear Regulatory Commission, Region I Operations Office of Executive Director for Operatiot C-E Power Systems 631. Park Avenue Combustion Engineering, Inc.
King of Prussia, Pennsylvania 19406 4853 Cordell Aven., Sui te A-1 Bethesda, MD 20014 Mr. Lawrence Bettencourt, First Selectman Town of Waterford Hall of Records - 200 Boston Post Road Waterford, Connecticut 06385 Northeast Nuclear Energy Company ATTN:
Superintendent Millstone Plant Office of Policy & Management Post Office Box 128 ATTN:
Under Secretary Energy Waterford, Connecticut 06385 Division 80 Washington Street Waterford Public Library Hartford, Connecticut' 06115 Rope Ferry Road, Route 156 Waterford, Connecticut 06385 U. S. Environmental Protection Agnecy Region I Office ATTN:
Regional Radiation Representative John F. Kennedy Federal Building Boston, Massachusetts 02203 Northeast Utilities Service Company
~
ATTN:
Mr. Richard T. Laudenat, Manager Generation Facilities Licensing P. O. Box 270 Hartford, Connecticut 06101 A
e.
ENCLOSURE i TABLE 3.3-1 (Continued) 7 TABLE NOTATION With the protective system trip breakers in the closed position, the CEA s
drive s9 stem capable of CEA withdrawal, and. fuel in the reactor vessel.
- The provisions of Specification 3.0.4 are not applicable.
~4%ofRATEDTHEPP.ALPONER; bypass (a) Trip may be manually bypassed above 13 shall'_'be automatically removed when THEPyAL POWER is.less.than or. equal
.~
to 10 '% of RATED THERMAL POWER.
(b) Trip may be manually bypassed below 400 psia; bypass shall 'be automatically removed whenever pressurizer pre sure is greater than.or equal to 400 psia.
(c) Trip may be manually bypassed below 10 % of PATED THERMAL POWER; bypass, shall be au_tematica11y removed when THERMAL POWER is greater than.or equal to 10 '% of RATED THERMAL POWER.
During testing pursuant to Special Test Exception 3.10.3, trip r,ay be manually bypassed below 1% of RATED THERMAL POWER; bypass shall be automati,cally' removed.wben THEPyAL POWER is greater than or equal to 2,% of RATED THERMAL' POWER.
(d) Tri;i may be bypassed during testing pursuant.to Special Test
. Exception 3.10.3.
(e)
See Speciai Test Exception 3.10.2.
Each channel shall' be comprised of two trip breakers,; actual trip logic (f) shall. be. one-out-of-two taken twice.
(g)', Trip.may be bypassed below 55% RATED THERMAL POWER.
~~
- /
ACTION STATEMENTS With the number of channels OPERABLE one less than required by ACTION 1 the Minimum Channels OPERABLE requirement, restore the
~(
inoperable channel to OPERABLE status within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and/or open the protective system trip-breakers.
With the number of channels OPiRABLE one less than the Total ACTION 2
(
Number of Channels, STARTUP and/or POWER OPERATION may continue provided the ineperable channel is placed-in the bypassed or tripped condition within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.
If the inoperable ' channel is bypassed, the desirability of ma#.taining this channel in the bypassed condition shall be reviewed in accordance with i
i Specification 6.5.1.6k.
The channel shall be returned to OPERASLE status no later than during the next COLD SHUTDOWN..
7 Ql - -
3_J 8>.ll-h' %{l4 k
SAN OMPRE-UNIi 2 3/4 3-4 i
e Pil00F & lH&n0PY
~
ADMINISTRATIVE CONTROLS MEETING FREOUENCY 6.5.1.4 The.0SRC shall meet at least once per calendar month and as ' convened by the OSRC Chairman or his designated alternate.,
OUORUM 6.5.1.5 The minimum quorum of the OSRC necessary for the performance of the OSRC responsibility and authority provisions of these Technical Specifications shall consist of the Chairman or his designated alternate and four meet.ers including alternates.
RESPONSIBILITIES 6.5.1.6 The Onsite Review Committee shall be responsible for:'
~
a.
Review of 1) all procedures required by Specification 6.8 and ~ changes thereto, 2) all programs rcquired by Specification 6.8 and changes
~
thereto, 3) any other proposed procedures or changes thereto as
. determined by the Station Manager to affect nuclear safety.
b.
Review of all proposed tests and experjpents that affect nuclear safety.
s
- c. ~ Review of all proposed changes.to Append.ix "A" Technical Specifications.
d.
Review of all proposed ' changes or modifications to Onit systems or equipment that affect nuclear safety.
. Investigation of all violations of the Technical Specifications-e.
including the preparation and forwarding of reports covering evaluation and r.ecommendations to prevent rec' rrence to the Nuclear u
Control Board (NCB).
)
l l
f.
Review of events requiring 24-hour written notification to the l
/,
Commission.
1
.\\
, Review of unit operations to detect poteni.ici nuclear safety hazards.
, g.
hl Performance of special reviews, investigations or analyses and reports thereon as requested by the S~tation Manager or the NCB.
t i.
Review of the Security Plan and implementing procedures and shall l
submit recoc= ended changes to the NCS.
f i
j.
Review of the Emergency Plan and implementing procedures and. shall submit recommended changes to the NCB.
' k.
Review and documentation of judgment con'cerning prolonged operation in l
bypass, channel trip, and/or repair of defective protection channels of process variables placed in bypass s,ince the last OSRC. meeting.
l SAN ONOFRE-UNIT 2 6-7 w
- ~
ENCLOSURE 2 '
' DES'IGN CRITERIA In present and various past Combustion Engineering (CE) applications,
~
applicants have proposed to operate four-channel protection systems (Reactor Protection System and specific Engineered Safety Feature Systems) with one of the four channels of a given process variab'le in bypass for an indefinite period of time.
Operating reactor licensees who. desire to use the ~ Technical Specifications of Enclosure 1 must verify that they have re-viewed the design and installation of their protection system and defermined that the system meets the. criteria below.
The licensees must also confirm.
that detail'ed information verifying compliance with the criteria is avail-able.at the licensee's facilities for staff audi.t.
Until the licensee's confirmation. that the p,rotection system meets the criteria below has been completed and submitted to the staff,' bypass of a protection system channc' should be limited to 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> at which time the channel shall b,e placed in the trip mode.
I 1.
High Energy Line Break The protection system should be reviewed for the effects of high energy line breaks.
Each licensee must analyze the protection system to verify that high energy line hazards in coinci,dence with the bypass of' a channel will not negate the minimum acceptable redundancy required by IEEE Std. 279-1971.
It should be noted that credit is not to be taken for the " fail-safe" mode of the channels affected by high energy line breaks.
9 4
l
~
~
6 2.
Sinale Fa'ilure In Combination With' Prolonced Byoass Th'ere may be cases where the prolonged bypass of a specific protection channel in combination with a single failure micht jeopardize plant protection (i.e., channels remaining will not sufficiently detect associated transients and accidents without causing unacceptable consequences such'as core damage, etc.) The licensee should review the accident analyses (i.e., rod drop accident, rod ejection, etc.) to
' verify'that the bypass of a specific protection channel iil coincidence with a single failure of a redundant channel will not prevent re-quired protection for any transient or accident.
1 3.
' Channel Independence
~
The four protection channels must be reviewed for physical in-dependence.
Each licensee should confirm,that the four protection channels as installed meet the physical independence criteria of Regulatory Guide 1.75.
4.
Indeoendence of the Vital Buses Each plant must be reviewed for independence of the vital buses.
The Combustion Engineering (CE) reactor protection system (RPS) is made up of foui- (4) protection channels for each trip parameter, Each parameter channel consists of bistable relays and associated contacts which are arranged into six logic NDs (AB, AC, AD, BC, BD, CD matricies) which represent all possible coinc.idences of two com-l binations (e.g., combinations of two-out-of-four logic).
l Each logic matrix is powered by two of four Class lE independent 120 Vac vital _ bu'ses as shown in Figure 1.
This arrangement may challenge the isolation and hence inde~pendence of the redundant ac vital po',eer
,,,,,.,,__-..._.m,.
~
L h:
buses.
It'is typical of licensees using the CE design to assure that the independence of these buses is maintained through th'e use of qualified isolators.
.c
.a t icensees desiring to use the Technical Specifications of Enclosure 1 should confirm that tests.and analyses have been performed to demonstrate independence of the redundant vita 1 buses.
The, tests.
~
and supporting information should include:
a) The use of a plant-specific mock-up representing one protection logic matrix system (i.e., two matrix power ~
sup' plies, each with its own simulated 120 Vac vital bus supply, matrix relays, bistable power supplies, bistable.
trip units, and isolation circuitry),.
~
b) The application of surges (internal and external transient voltages) and faults (including continuous phase-to-phase short-circuits, ph'ase-to-ground short-circuits and the appli. cation of continuous external high voltages) to t'he simulated 120 Vac vital bus supplying power to an associated matrix power supply, l
c) Application' of the surges ind. faults between each matrix power
~
supply input conductor and ground (common mode) and across (line-to-line) the matrix power supply input conductors (trans' verse mode),
t
~
d) Monitoring the redundant simulated 120 Vac vital bus supplying power to its matrix power supply 'to measure any effect as a re-sult of application of the faults or surges on the other bus, l*
-5.
,w
. =,
formed.
~
1.icensees desiring to use the Technical Specifications of Enclosure 1 should confirm that sufficient tests and analyses have been per-formed to assure that with a channel bypassed, a ' vital bus single failure will not negate the required protective function.
The tests and supporting information should include:
a) The use of a plant-specific mock-up representing one pro-tection logic matrix system (i..e., two matrix power supplies, each with its own simulated 120'Vac. vital bus supply, matrix -
relays, bistable power supplies, bistable trip units, and isolation circuitry),
b) The application of surges (internal and external transient voltages) and faults -(including continuous phase-to-phase short circuits, phase-to-ground short-circuits and the application.of continuous external high voltages) to the simulated 120 Vac vital bus supplying power to an associated matrix power supply, cl. The application of surges and faults between each matrix power supply input conductor and ground (comon mode) and across (line-to-line) the matrix power supply input con-ductors (transverse mode),
d) Moni.toring the auctioneered matrix. power supply output to measure any effect on the logic matrix circuitry as a result of application of the faults or. surges,
~.... :i.:.
~
6-e) Verification that during and after the application of the surges and faults, the protection circuits will perform their protective actions, f) Justification that the faults and surges used during the testing exceed the maximum worst-case failures which could occur within the protection systems circuits.
Any response addressing the degree to which the ANO-2 design meets these criteria may reference information previously submitted on the ANO-2 docket on these subjects.
The reference should be specific with respect to the location of the specific in-formation and should state the bases for the licensees conclusion that the infor-mation supports the conclusion that the ANO-2 design meets the subject criteria.
O t
t a