ML20062K573

Forwards GE Review of Lawrence Livermore Natl Lab Draft Rept Defense-in-Depth & Diversity Assessment of GE Sbwr Protection Sys Task 12

ML20062K573
Person / Time
Site:	05200004
Issue date:	12/13/1993
From:	Leatherman J GENERAL ELECTRIC CO.
To:	Borchardt R NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM), Office of Nuclear Reactor Regulation
References
MFN-227-93, NUDOCS 9312230002
Download: ML20062K573 (7)

Text

j e

GENuclear Energy L

Genera'Eeectnc Company 176 Cunner Avenue. Saa hse. CA 95125 l

December 13,1993 l

MFN No. 227-93 Docket STN 52-004 Document C(mtrol Desk U.S. Nuclear Regulatory Commission Washington DC 20555 Attention: Richard W. Borchardt, Director Standardization Project Directorate

Subject:

GE Nuclear Energy Comments on the Reference 1 LLNL Report as Requested by the Reference 2 NRC/GE Letter

References:

1. Lawrence Livermore National Laboratory (LLNL) Draft Report entitled "A Defense-in-Depth and Diversity Assessment of the General Electric SBWR Protection System, Task 12"

2. Letter, Markisohn (NRC) to Marriott (GE), dated September 27,1993, requesting GE comments on the Reference 1 report The attachment to this letter entitled GE Review of Lawrence Livermore National Imboratorv Draft Reaort provides GE Nuclear Energy comments on the Reference 1 Report as requested )y the Reference 2 letter.

Sincerely, Jl / pu~~ g J. E. Leatherman SBWR Certification Manager MC-781, (408)925-2023

Attachment:

GE Review of Lawrence Livermore National Laboratory Draft Report ec: M. Malloy, Project Manager (NRC) (2 attachments)

F. W. Hasselberg, Project Manager (NRC) (1 attachment) 210055 11RBK 93fJ iA n ie n aih86804 FI 3 +0 PDR h1 ' Il F

MFN No. 227-93 GE Review of Lawrence LivefiebNational Laboratory Draft Report

&py REF: G.C. Preckshot, A Defense-in-Depth and Diversity Assessment of the General Electric SBWR Protection System, Lawrence Livermore National Laboratory (LLNL), Version 1.0, June 30,1993 GE has completed an awessment of the subject draft report. While the report finds that the SBWR digital protection system is not vulnerable to system-wide common-mode failure (CMF) and has suflicient sensor diversity to preclude CMF of the sets of quadruple redundant sensors, the report also asserts severalinstances of purported material contradictions and discrepancies within the GE design documents. These instances will be addressed in the following commentag. In addition, the ongoing evolution of the design since the initial documentation was provided to LLNL will be presented and shown to further support the diversity and defense-in-depth inherent in the system.

General Comments Although the conclusions of the study are favorable, GE still has concems about this type of analysis, as it did with the similar study performed by LLNL for the ABWR.

Our major concerns are: (1) that the occurrence of each postulated common-mode failure concurrent with an accident or transient is assumed to be equally probable, (2) that the failure will occur or will have occurred, without having been detected, when the plant accident or transient event occurs, and (3) that it is assumed the event cannot, in most cases, be mitigated by human action. For example, the probability that all trip logic units (TLUs) lock up in the permanently untripped state and remain in this state undetected until a large break LOCA occurs is vey low since a manual test of the TLU trip logic in each division will be required monthly and self-diagnostic software runs continuously in each microprocessor-based controller. However, under the worst case assumptions of this study, it is necessary to assume that the self-diagnostics are also defective.

Similarly, a daily cross-channel check by the operator of each set of redundant sensors that uses the essential multiplexing system will be required. This check establishes operability of the sensors, multiplexers, digital trip modules (DTMs), and display control system. Four redundant sensor channels stuck at the same unchanging value so as to prevent a trip on demand should be readily detected by the operator, especially when this value is compared to similar non-safety-related instruments. In addition, the essential multiplexing system, which also has self-diagnostics, will be tested monthly for correct operation.

Note that the protection system design analyzed is supported by the SBWR probabilistic risk assessment (PRA), which resulted in the implementation of most of the diverse features of the protection system. The PRA did take into account mean time to detect a failure and also human response to the failures, given the availability of the necessag information.

Specific Comments on Sections of the Report The following comments address various discrepancies alluded to in the referenced

. MFN No. 227-93 sections or factual errors discovered during GE's assessment. GE othenvise accepts the report's findings.

Section 1.4 Increased system reliability due to the lack of control signal multiplexing to the actuators should he stated as an opinion of the author and not as an intention of the GE design. The use of direct hardwiring of control signals to the output actuators is not a result of a need to improve system reliability, since the use ofindependent,4-division, dual-redundant multiplexing in the ABWR design has been shown to be reliable. In the SBWR design, the location of the signal processing electronics for the safety systems within the reactor building safety envelope in four separated areas brings the control signals close to the actuators. In addition, many of the safety-related actuators are explosively-initiated squib valves and do not require the many control and interlock signal wires that motor control centers use. Thus, there was simply no need for multiplexing in these areas.

Section 2.1

a. ATWS does not trip any ESF functions.

b. ADS is initiated only on low water level.

Section 3.1.1

a. ATWS does not start some ESF functions.

b. ATWS does not provide an alternative method of starting the isolation condenser system (ICS). This is apparently a misunderstanding of the SSLC IED. The level 2 signal is routed through the ATWS discrete logic card only to provide a diverse actuating signal for the isolation condenser. The signal is from a sensor ,

independent and diverse from the multiplexed signal path where a different sensor is used. The diverse sensor is also used for ATWS mitigation, but the ATWS logic itselfis not used for ICS initiation.

Section 3.1.8 in the section covering ESF/ATWS, a clarification is required regarding ESF, since it is apparently assumed in the report that ICS is part of ESF. This is not the case; the ESF functions of ADS, PCCS, and GDCS are backups to ICS. ICS is designed to prevent initiation of ESF after sudden reactor shutdown or isolation from full power and is the primary means of removing decay heat after these conditions occur. The ICS is categorized as one of the Safe Shutdown Systems.

Section 3.3 l

._ In Figure 1, add Turbine Control Valve Fast Close to the reactor parameter table Section 3.3.2 In Figure 2, System Diagram, change the Turbine Stop Switch inputs from the MSLIV TLU to the RPS DTM (hardwired) and add Hydraulic Trip System Oil Pressure (Turbine Control Valve Fast Closure) inputs into the RPS DTM (hardwired) [See the attached markup of Figure 2]. These are later revisions to the protection system analyzed in the report.

MFN No. 227-93  ;

In the text for this section, delete the reference to turbine switches in the list of parameters that affect ESF actuation.

NOTE: Please change all references to "MSLIV" to the GE convention of "MSIV" both in the figures and text throughout the report in order to have consistent references between the LLNL report and GE  !*

documentation.

Section 3.6.2.1 The low water level (L2) signal routed through ATWS/ARI discrete logic starts ICS -

r (opens the condensate return bypass valve) and is shown on SAR Figure 7.3-2b and Figure 2 of the subject report. The L2 signal from the multiplexed sensor channel is  ;

not used for ICS because it is the signal used to close the MSIVs. MSIV closure also opens the condensate return valve. Thus, the condensate return valve plus the condensate return bypass valve open on L2. l Section 3.6.2.2 The lower dqwell temperature trip has been deleted from RPS and is not shown in  ;

revision B of the RPS IED.

Section 3.6.5.1 Figure 2, System Diagram, does not show the PRMS inputs into SSLC correctly. PRMS is a standalone radiation monitoring system, but the binag trip outputs are multiplexed into the LD&IS DTM or ICS DTM, depending on the source of the trip signal. The DTM does not perform setpoint comparison, as it does for sensor signals, 3 but instead distributes the trip signals among the four divisions of TLUs for the 2-out-of-4 coincidence trip decision. There is no PRMS input into the LD&IS discrete logic unit (DLU): this DLU is only used for RPV water level 1 backup.

[See the attached markup of Figure 2.]

Section 3.6.5.3 SAR Figure 7.3-2b shows the signal correctly as "APRM not downscale." ,

Section 3.6.5.4 The design has changed since the SAR revision that LLNL used and the documents  ;

are now consistent. These changes are described in the comments to Section 3.3.2 l above. Turbine Stop Valve closure causes reactor uip, but does not cause MSIV closure.

Section 3.6.5.5 ICS valve F006 is the condensate return bypass valve, which is normally closed and fails open on loss of electrical power. If valve F005, the condensate return valve, fails to ,

open on MSIV closure (perhaps because the MSIV L2 initiator failed), the backup L2 trip from the ATWS DLU (and independent sensor) will open F006, which also starts ICS. Normally, as described in the comment to Section 3.6.2.1 above, both will open.

Section 3.6.6.3 '

Change the sentence "The ATWS subsystem, except for the ARI valves and the FMCRD, is implemented as a safety-grade system..." to "The ATWS subsystem,

i

- MFN No. 227-93 cxcept for the ARI valves, the FMCRD and Feedwater Runback, is implemented as a safety-grade system. .".

1 Section 5.2 The revised SSLC design has relocated the GDCS manual switches to completely bypass SSLC including the load drivers. Also, the same arrangement has been added j for manual DPV actuation. [See the attached markup of Figure 2.]

Section 5.5.1 Design discrepancies and inconsistencies referred to in this section have been addressed in the previous comments.

i Appendix A, Event 15.2.3 Turbine Trip As described in the comment to Section 3.6.5.4 above, Turbine Stop Valve switches and Turbine Control Valve fast closure pressure sensors are now inputs to the reactor trip function, but do not have inputs to MSIV closure. These should be added to the analysis chart, but their presence does not materially affect the outcome of the analysis, since these parameters fail along with water level and dome pressure when the DTMs or TLUs fail common-mode. Thus, the diverse backup operates in the same  !

manner as in the existing analysis.

Appendix A, Event 15.2.5 loss of Condenser Vacuum Reference to Figure 3 should instead be to Figure 2.

Appendix A, Event 15.6.4 Steam System Pipe Break Outside Containment ,

Note that even though the DPV/GDCS TLUs fail common-mode, manual actuation is now available for both DPV and GDCS independent of SSLC (see the comment to l Section 5.2 above). A diverse RPV water level indicator and level 1 alarm is also included as shown in Figure 2.

FIGoGE 1 M M4cvf sh I or u

. y rwten um n \ ' ~

MFN No. 227 93

• ~~ ma arreuw 4Tc v Faie c45 'it _

(cy_ et csson 1* "' e tws s w sm r.,+r -

I CMD ^

l EMS I *l***** N u we u

% om . _ -

,,,- Ru 1 Ess -

DTM Nh

-W- a ns Reecsor

• N *w*==*- M u, Trip

>>Rt tv pnerin v.eN j

m, h* ,  % J auw a--  % em. Ru O s%r/5 - - - >

U UIM -

)

l1urtene siao 5.sches . .y wp

^* Ia "I I

uuttips. .d s.n.o,.

nov nar me .,, u > -_[ DYYb[ ~

w w Rev .o eng wir u e WIu T** * $ Ru ~

& RPV tuoi mq mit M & "' ~ T '* ~

DTM -

miy.

M,. .Wijy-c.ocs %.i > -

c a- -i t

%.n eas.m.o., ,

%.n n,essun &

gy _ ==~ es 4Pv mme r*etsum & L y,,,,,,,,,,,, *==-

son, ow 1.w -

.,~ oTu DPv.cocs -

so, ow t...i + -

( y _ _._ ; '~* i can enweo mw.

..,~,..-.v..

e i ] ' '"" ~ , $* ,

M]

_ e V

,0 ,  ;

Tuatwn, miet Perssum & .r.

M51 f knur M * * * ' "

gg ois,, t o a is senu,,  := - * * ~ * -

• DTM --- -

its s -v., e g.

Coniamnt Ras Mon "

?

g wlo [ y'* * $ TLu

" ~

IPFMS}ICS 1- ... .r_ :,..'.' _ DTM -

Lo a s M '"'" M &nd Gibam  ;

b5D*W p 'iTh'**8 1

( pg  ;

~

PAmL 61598LE  : ut c->

'TP.I f 5  ; cm r.- -e

. , - n n nA . . - ., n . >

n . . < s/

1 ..

'"" "* h

. otu wp i nov . m.. v ' - wgl u l ATM

- usuve nov mm,n,,coe, -

l Q %g

/

g==~wa.m w at*

• t

,j - DLu  !

SRV8

--+=. w?1 o I ATM _ ,d' { o koun -1 y  :

.e  :

otu . t

..--I -o- w21 o " - LD & s

\f ._- 3 l ATM ,

t s

Y j.. ) ,

i bene l ,

PRMS w/x \-  :

a' ' . --. .

, - w-a tas da enam.

y ,. y ,

/

N a Bysmaa

~ ' ~

l * +*"" 6-=

' . .- 1 ATM 10 w *=* ,

hus

$RNM { pg, 5=

• Apsu $i. --  !

n--.-u L u

=

ATws. art otu * * " *a* < -

• w7lu i ATM p Q 2&.-,

Figure 2. Section Diagram C*  ;

10 DRAFT  !

t

' FIG ute 1 MMVvP M 1- 0F 2-

[* ,

'o

.- MFN No. 227-93 ,

. i

, . . ,.~ . . . . .

....c. ,

4 l .

olu - A. ...

~ ~.-

e- , _ _ , $_ Lo=*

Drrves , * = . .

• ~ .

t 6..

= m.. l

.la ssa g . . . .<9 . ..  ;

OLU ,

>=.a Lead way

.- * - ~ - ' D,,,,e _._ .. .

~ ~ ~ ~

g 7 _ ._

a..

OLU m F A I L. N EW e ao.

m. sw.. .,  % Load Davere _

e.  ;

AuvA 4, F gpp oo= e ce Land Da...

-- , ,s C  !

., g ,,.

DPV J t$cMW W D"*

t uouc \

U'.1 gray "

'iLoAP 2 v. t DLIdAS -E D

1

- p. a Load ' ***

' *- Dr.... , ,

..g '*** -

• m 4p aratu % -> GDc5 l T Drives __

s**

~

r 2Mcef 10- -O O ~

[h"[ -

ora usrs g, l

~ CRO Purv s ,

., r apv

(*** ' M Wae,r Leel e . .."s'.o

- -- - <u ,

1

a. . . Load _ .,

• - orrve. .

__ g3 i

,s. %

t

',...- g ~~. *c .. gS I1 PRNu Hv^c

)

olu t

-*- , .. ,, .,. 4

.. ,i.-*- Earos

• • / 7 FACS-

-- e. .

,I AcCWS

. .gg,:;u 6

" cAus ,

n... '

/ ~' -- -

0, s coes r -

FC5 ,

,s..... _

KICs ,

' ~

rw %,c..$

rucno. .

A RI Van es l Figure 2. System Diagram (cont.) o-- "

o -. -

MATws -

i 11 DRAFT 1 l

.