ML20055A436

Electrical,Instrumentation & Control Sys Support, Interim Rept

ML20055A436
Person / Time
Site:	Hatch
Issue date:	02/28/1980
From:	Udy A EG&G, INC.
To:	Shemanski P Office of Nuclear Reactor Regulation
Shared Package
ML20055A435	List: ML20055A436
References
CON-FIN-A-6256 EGG-EA-5110, TAC-42603, TAC-42604, TAC-51984, TAC-51985, NUDOCS 8207160401
Download: ML20055A436 (15)

Text

.

ATTACHMENT TO ENCLOSURE 3 I1 .

$4 E G s G w.~. x FORM (G&G 390 (Rev.11.@

INTERIM REPORT Accession No.

Report No. ECC-EA-5110 Contract Program or Project

Title:

Electrical, Instrumentation and Control System Support Subject of this Document El.actrical, Instrumentation and Control Aspects of the Override of Containment Purge Valve Isolation and Other Safety Feature Signals, Edwin I. Hatch Nuclear Plant, Unit Nos. 1 and 2, Docket Nos, 50-321 and 50-266, TAC Nos. 10178 and 10177 Type of Document:

Informal Report Author (s): ,

A. C. Udy D:le of Document:

February 1980 .

Responsible NRC Individual and NRC Office or Division:

Paul Shemanski, Division of Operating Reactors This document was prepared primarily for preliminary or internal use. it has not received full review and approval. Since there may be substantive changes, this document should not be considered final.

EG&G ldaho, Inc.

Idaho Falls, Idaho 83415 Prepared for the ,

U.S. Nuclear Regulatory Commission Washington, D.C.

Under DOE Contract No. DE-AC07-761D01570 NRC FIN No. A6256 INTERIM REPORT 8207160401 820707 PDR ADOCK 05000321 P PDR

1141F I

TECHNICAL EVALUATION REPORT ELECTRICAL, INSTRUMENTATION, AND CONTROL ASPECTS OF THE OVERRIDE OF CONTAINMENT PURGE VALVE ISOLATION AND OTHER SAFETf FEATURE SIGNALS EDWIN I. HATCH NUCLEAR PLANT UNIT NOS. 1 AND 2 Docket llos. 50-321 and 50-366 TAC Nos. 10178/10177 February 1980 A. C. Udy EC&G Idaho, Inc.

. _ - . . _ _ ~ . . - , , , - , - , a. ,_,v.-, - -

r-- .,y -,- -- - - , -- - - --, , , - -

i-

ABSTRACT Several instances have been reported where the automatic closure of the containment ventilation or purge isolation valves would not have ,

occurred because the safety actuation signals were manually overridden or blocked during normal plant operations. This report addresses elec-trical, instrumentation, and control design aspects for these valves, and the ability of the unit containment ventilation system to isolate on several diverse parameters. Other related systems were audited to the same guidelines.

r I

i FIN No. A6256 EICS Support ii

1 CONTINTS

1.0 INTRODUCTION

. . .. . . . . ...... .. . .. . . .. .. . 1 2.0 EVALUATION OF HATCH NUCLEAR PLANT UNITS 1 AND 2 . . .. . .. . 2 2.1 Review Guidelines . . . ....'.. .. . ... . . . . .. 2 2.2 Containment Ventilation Isolation Circuits Design Description . . . . . . ...... .. . ... . . . ... 3 2.3 Containment Ventilation Isolation System Design Evaluation . . . . . . . .... . .. . . .. .... .. 4 2.4 Other Related Engineered Safety Feature, System Circuits .. 6 3.0

SUMMARY

. . . . . . . .. . ... .. ..... .. ... . .. 6

4.0 REFERENCES

. . . . . . . . . .. ... ... . ... ... ... 7 ,

1 l

l l

TECHNICAL EVALUATION REPORT ELECTRICAL, INSTRUMENTATION, AND CONTROL ASPECTS OF THE OVERRRIDE OF CONTAINMENT PURGE VALVE ISOLATION AND OTHER SAFETY FEATURE SIGNALS EDWIN I. HATCH NUCLEAR PLANT UNIT NOS. 1 AND 2

1.0 INTRODUCTION

Based on the information supplied by Georgia Power Company (GPC),

this report addresses the electrical, instrumentation, and control systems design aspects of the Containment Ventilation Isolation (CVI) subsystem of the Primary Containment Isolation (PCI) system and other related Engineered Safety Feature (ESF) system functions for the Hatch 1 and Hatch 2 units. The Final Safety Analysis Reports verify that these systems are identical in both units.

Several instances have been reported where the automatic closure of the containment ventilation or purge isolation valves would not have occurred because the safety actuation signals were manually overridden or blocked during normal plant operations. These events resulted from procedural inadequacies, design deficiencies, and a lack of proper management controls. These events also brought into question the mech-anical operability of the valves themselves. These events were deter-mined by the Nuclear Regulatory Commission (NRC) to be an Abnormal Occurrence (#78-05) and accordingly, were reported to Congr ss.

As a follow-up of this Abnormal Occurrence, the NRC is reviewing the electrical override aspects and the mechanical operability aspects 1

of containment purging for all operating reactors. On November 28, 1978, the NRC issued a letter, " Containment Purging During Normal Plant )

Operation" to all Boiling Water Reactor and Pressurized Water Reactor licensees to initiate a review of these systems. GPC responded in letters dated January 9, 1979 2and August 29, 1979 3. Information 4

in a GPC letter of August 10, 1979 is also applicable.

1

A meating ecs h2ld on Octob2r 3, 19795with tha CPC cnd tha NRC to clarify the design characteristics of the Hatch CVI and ESF systems.

GPC letters of January 9, 1980 0and January 14, 1980 answered 7

the questions that remained af ter t' <c meeting.

2.0 EVALUATION OF HATCH NUCLEAR PLANT UNITS 1 AND 2 2.1 Review Guidelines .

The intent of this evaluation is to determine if the following NRC requirements are met for the safety signals to all ESF equipment:

1. Guideline No. 1--In keeping with the requirements of General Design Criteria 55 and 56, the over-ridinga of one type of safety actuation signal (e.g., radiation) should not cause the blocking of any other type of safety actuation signal (e.g.,

pressure) for those valves that have no function besides containment isolation.

s

2. Guideline No. 2--Sufficient physical features (e.g., ,

key lock switches) are to be provided to facilitate adequate administrative controls.

3. Guideline No. 3--A system level annunciation of the ovarridden status should be provided for every safety system impacted when any override is active.

(See R.G. 1.47.)

Incidental to this review, the following additional NRC design guidelines were used in the evaluation:

1. Guideline No. 4--Diverse signals should be provided to initiate isolation of the containment ventilation system. Specifically, containment high radiation, safety injection actuation, and containment high

a. The following definition is given for clarity of use in this '

evaluation:

Override: the signal is still present, and it is blocked in order to -

perform a function contrary to the signal.

2

pressure (where containment high pressure is not a portion of safety injection actuation) should auto-matica11y initiate CVI.

2. Guideline No. 5--The instrumentation and control systems provided to initiate the ESF should be designed and qualified as safety grade equipment.

3. Guideline No. 6--the overriding or resetting a of the ESF actuation signal should not cause any valve or damper to change position.

Guideline 6 in this review applies primarily to other related ESF systems because implementation of this guideline for containment isola-tion will be reviewed by the Lessons Learned Task Force, based on the recommendations in NUREG-0578, Section 2.1.4. When containment isola-tion is not involved, consideration on a case-by-case basis of automatic valve repositioning upon reset may be considered acceptable. Accept-ability would be dependent upon system function, design intent, and suitable operating procedures.

2.2 Containment Ventilation Isolation Circuits Design Description Each of the Hatch units has two ESF trains which close indepen-dently and separately the inboard and outboard PCI valves. The valves are opened only by manual control. Each valve has a two position con-trol switch. The automatic initiating signals which override any opening signal, resulting in valve closure, are listed below:

1. Either reactor building or refueling area ventila-tion radiation levels exceeding high trip setpoint

2. A one-out-of-two-taken-twice logic using two dry-well pressure high signals (2 psig) and two reactor vessel water level low signals (12.5 inch reference).

. a. The following definition is given for clarity of use in this evaluation:

Reset: the signal has come and gone, and the circuit is being cleared in order to return it to the normal condition.

3

The actuation signal resulting from the automatic initiation signal can be' reset (but not blocked), once the initiating signal is cleared, at the ESF panel; this allows manual opening of the CVI valves.

The automatic closure signals will close'the valves even with the control switch in the "open" position. Loss of power to the control system or loss of air to the solenoid valve also closes the isolation valves. Valve position lights, open and closed, are provided on the control console.

2.3 Containment Ventilation Isolation System Design Evaluation Guideline 1 allows no signal override to prevent another safety actuation signal from functioning. The Torus two-inch vent relief valve, the Drywell two-inch vent relief valve, and the two-inch normal operator bypass line valve (Unit 2 only) are the only CVI valves capable of being opened when the PCI system isolation signal is present. Use of a keylocked bypass, switch bypasses the composite (of all initiating signals) signal only when the steamline pressure is less than 850 psig.

Any initiating signal after use of the bypass switch is ineffective; this condition is annunciated in conformance with guideline 3. Since this is not in conformance with NRC guideline 1, GPC has initiated a design change to remove the bypass capability.3'O Guideline 2 requires reset and override switches to have physical provisions to aid in administrative control ot' the switches. The momentary contact valve group reset switches have no such provisions, and do not comply with this guideline. All other switches are in con-formance with guideline 2.

Guideline 3 requires that system level annunciation for wherever an override affects the performance of a safety system. The Hatch units conform to this guideline, as mentioned above. .

O 4

l Guideline 4 requires that isolation of the CVI system be actuated by several diverse signals. The Hatch units meet this requirement in i that (a) the same signals that initiate safety injection also initiate the PCI system, (b) the reactor building pressure ir a portion of this signal, and (c) radiation trips in either the reactor building or in the refueling floor areas will cause isolation.

Guideline 5 requires isolation actuation signals to be derived from safety grade equipment. The Hatch units conform to this guideline.5 Guideline 6 requires that resetting of isolation logic will not, of itself, automatically open the isolation valves. The Hatch units do not conform to this guideline. The valves are controlled by rotary, maintained contact switches. Should the valve control switch be in the open position when the valve group reset switch is actuated (with no signals calling for closure), the valves would automatically reopen.

The opening of the isolation valves is annunciated. GPC, recognizing this problem, instituted administrative controls requiring that the valve control switches be in the closed position prior to resetting the 4

valve group logic . A briefly described design change has been made in this logic requiring that all valve control switches be in the closed position before the logic can be reset. This modification satisfies this guideline. CPC will later install momentary contact, spring return to neutral switches to control valve position. This will relieve the operator from checking each valve control switch prior to resetting the actuation logic. These are to be installed when parts are available, snd after installation, guideline 6 will still be satisfied. GPC has i

not yet documented these design changes or when they were (or will be) made. The NRC should require the GPC to document these modifications with as-built drawings and descriptions to comply with the information requirements of Section 7.3 of Regulatory Guide 1.70, Revision 2.

CPC noted in their review 3 that the 2-in. post LOCA purge valves of Unit 1 vould not close as a result of an isolation signal. GPC has initiated a design change that will cause these valves to close on the 5

i j .

] same valva grcup icoletion signal that classe the ether containment

{

! ventilation valves. CPC indicated that Unit 2 does not have this design  !

'de ficiency .

l l 4 i

2.4 Other Related Engineered safety Feature gye am Circuits The design of the containment spray system requires that the system j lines through containment be open when the spray is operating.3 To achieve this, the Match units have a keylocked switch for each contain- j ment spray injection valve and separate override keylock switches to

• i

the PCI actuation signals (one-out-of-two-taken-twice logic, composed

)'1 of low reactor water level and high drywell pressure) to the containment l 4

spray valves. Using these switches allows, as long as the reactor j vessel water level is above the low-low setpoint, the containment spray to be manually initiated. The bypass is removed and valves closed i automatically should the reactor vessel water level drop below the low-low setpoint. The bypass can also be manually removed by use of

, the keylocked switch.,

i

~

This design satisfies guideline 1 because this is an engineered '

! safety feature system, and its use has functions other than' containment isolation. The design satisfies the other app'licabid ' guidelines. -

J t

]

No other manual override capability has been identified in the

! review of the material submitted by GPC for this audit. '

~ ~ M  !

l ,

s ,

j 3.0 SUle(ARY -'

e

-Q ~ , . w ,,^m The electrical, instrumentation, and control design aspects of_the containment ventilation isolation valv'e's and other related ESF sig"'als n for the Hatch units were evaluated un'ing the design guidelines' stated

in Section 2.1 of this report. After either modification proposed by

.; GPC (interlocking the valve control switches with the actuation logic ,

reset as presently constituted or using three-position, spring return '

to neutral valve control switches which GPC classifies as the optimum ~., .

fix), the CVI system complies with the NRC guidelines except for the l 4 s

.6 J' l -.

, s

).  % - - ,

i I s

~

w

. _ _ - - . _ , . - - . - - . ..__.,-.._,.__-,_______m.,. _ , , , - ,,,,,_...,c,_,_,_..m . _ _ . - - . - _ . -,..___,__-yw_,,,.*y

unprotected valve group reset switches. GPC should cover or provide

, , other physical features to aid in the administrative control of these switches at both Hatch units. The NRC should also require the CPC to document the modifications made to the valve control switch and isola-tion reset logic.

4.0 REFERENCES

1. NRC/ DOR letter, A. Schwencer, to all BWR and PWR licensees, " Con-tainment Purging During Normal Plant Operation," dated November 28, 1978.

2. GPC letter, Chas. F. Whitmer, to Director of Nuclear Regulatory Commission, " Containment Purging During Normal Plant Operation",

Edwin I. Hatch Nuclear Plant, Units 1 and 2, NRC Dockets 50-331 and 50-366, January 9, 1979.

3. GPC letter, R. J. Kelly, to Director of Nuclear Regulatory Com-mission, "Cor.tainment Purging During Normal Plant Operation",

Edwin I. Hatch Nuclear Plant, Units 1 and 2, NRC Dockets 50-331

, and 50-366, August 29, 1979.

4. GPC letter, K. J. Kelly, to Director of Nuclear Regulatory Commission, "I & E Bulliten 79-08--Additional Information",

Edwin I. Hatch Nuclear Plant, Units 1 and 2, NRC Dockets 50-331 and 50-366, August 10, 1979.

5. Meeting, NRC, GPC at MNBB in Bethesda, MD, October 4, 1979.

6. GPC letter, R. J. Kelly, to U.S. Nuclear Regulatory Commission,

" Containment Purging and Venting During Normal Operation,"

Edwin I. Hatch Nuclear Plant Units 1, and 2, NRC Dockets 50-321 and 50-366, January 9, 1980.

7. GPC letter, R. J. Kelly, to Director of Nuclear Regulatory Commission, " Response to Show Cause Order of January 2, 1980,"

Edwin I. Hatch Nuclear Plant Unit 2, NRC Docket No. 50-366, January 14, 1980.

I

=

S o

7

. Enclosure 4 CONTAINMENT SYSTEMS LIMITING CONDITION FOR OPERATION 3.6.1.7 The containment purge supply and exhaust isolation valvesThemay be open for safety-related reasons (or shall be locked closed).

containment vent line isolation valves may be open for safety-related reasons [or shall be locked closed).

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTION:

(For plants with valves closed by technical spe,cification)

With one containment purge supply and/or one exhaust isolation valve open, close the open valve (s) within one hour or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

(For plants with valves that may be opened by technical specifications)

1. With one containment purge supply and/or o.ne exhaust isolation or vent valve inoperable, close the associated OPERABLE valve and either restore the inoperable valve to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or lock the OPERABLE valve closed.

2. Operation may then continue until performance of the next required valve test provided that the OPERABLE valve is verified to be locked closed at least once per 31 days.

3. Otherwise, be in at least HOT STANDBY within the next six hours and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

4. The provisions of Specification 3.0.4 are not applicable.

i

! SURVEILLANCE REQUIREMENTS J.6.1.7.1 The -inch containment purge supply and exhaust isolation valves and the -

-inch vent line isolation valves shall be determined locked. closed at least once per 31 days.

4.6.1.7.2 The valve seals of the purge supply and exhaust isolation valves and the vent line isolation valves shall be replaced at least one per __, years.

3/4 6-10

CONTAINMENT SYSTEMS 3/4 4.6.3 CONTAINMENT ISOLATION VALVES LIMITING CONDITION FOR OPERATION 3.6.3 The containment isolation valves specified in Table 3.6-1 shall be OPERABLE with isolation times as shown in Table 3.6-1.

APPLICABILITY: MODES 1, 2, 3 and 4.

ACTION:

With one or more of the isolation valves (s) specified in Table 3.6-1 inoperable, maintain at least one isolation valve OPERABLE in each affected penetration that is open and either:

a. Restore the inoperable valve (s) to OPERABLE status within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> or

b. Isolate each affected penetration within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> by use of at least one deactivated automatic valve secured in the isolation position, or

c. Isolate each affected penetration within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> by use of at least one closed manual valve or blind flange; or

d. Be in at least HOT STANDBY within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

SURVEILLANCE REQUIREMENTS 4.6.3.1 The isolation valves specified in Table 3.6-1 shall be demonstated OPERABLE prior to returning the valve to service af ter maintenance, repair or replacement work is performed on the valve or its associated actuator, control or power circuit by performance of a cycling test, and verification of isola-tion time.

3/4 6-14 l

l l

i

r ..

CONTAINMENT SYSTEMS SURVEILLANCE REQUIREMENTS (Continued) 4.6.3.2 Each isolation valve specified in Table 3.6-1 shall be demonstrated OPERABLE during the COLD SHUTDOWN or REFUELING MODE at least onca per 18 months by:

a. Verifying that on a Phase A containment isolation test signal, each Phase A isolation valve actuates to its isolation position.

b. Verifying that on a Phase B containment isolation test signal, each Phase B isolation valve actuates to its isolation position.

4.6.3.3 The isolation time of each power operated or automatic valve of Table 3.6-1 shall be determined to be within its limit when tested pursuant to Specification 4.0.5.

4.6.3.4 The containment purge and vent isolation valves shall be demonstated OPERABLE at intervals not to exceed mon ths. Velve OPERABILITY shall be determined by verifying that when the measuued leakage rate is added to the leakage rates determined pursuant to Specification 4.6.1.2.d for all other Type B and C penetration, the combined leakage rate is less than or equal to 0.60La.

However, the leakage rate for the containment purge and vent isolation valves shall be compared to the previously measured leakage rate to detect excessive valve degradation.

3/4 6-15

v 9 ,

g .

Enclosure 5 BTP CSB 6.4 Pesition G.4 Amolification

1. Purging / venting should be minimi:ed during reactor operation because the plac; is inherently.safir with c1csed purg-/ vent valves (containment) than with Open lines which require valve acticn to pr:vida contair. ment. (Saricus consideration is being given to .

ultimately requiring that future plants be designed such that purging / venting is not required during operation).

~

'. ~

2. Some purging / venting on current plants will be permitted provided that:

a) purging is needed and justified for safety purposes, and b) valves are judged by the staff to be both operable and i

reliable, and c) the estimated amount of radioactivity released during the time required to close the valve (s) fo'llowing a LOCA either

1. does not cause the total dose to exceed 10 CFR Part 100 Guidelines; then a goal should be established which represents a limit on the annual hours of purging expected through each particular valve, or ii. causes the total dose to exceed the guideline values; then purging / venting shall be limited to 90 hours0.00104 days <br />0.025 hours <br />1.488095e-4 weeks <br />3.4245e-5 months <br /> / year.

3. Purging / venting should not be permitted when valves are being

~

used that are known to be not operable or reliable under transient or accident conditions.

e e