ML20072B876
| ML20072B876 | |
| Person / Time | |
|---|---|
| Site: | Shoreham File:Long Island Lighting Company icon.png |
| Issue date: | 05/17/1983 |
| From: | Pollock M LONG ISLAND LIGHTING CO. |
| To: | Starostecki R NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| Shared Package | |
| ML20072B875 | List: |
| References | |
| REF-SSINS-6820 IEB-80-06, IEB-80-6, SNRC-890, NUDOCS 8306140615 | |
| Download: ML20072B876 (15) | |
Text
,.
~
,.,e
-n, g-n
'Ahc{mut A 4e GHM-90I gg:g LONG ISLAND LIGHTING COM PANY r#aM W SHOREHAM NUCi EAR POWER STAT!ON P.O. DOK (44, NORTH COUNTRY ROAo e WADING RIVFa. N.Y.11792 May 17, 1983
\\
Mr. Richard W. Starostecki SNRC - 890 Director Division of Project and Resident Progra as U.S. Nucicar Regulatory Commission
~
631 Park Avende King of Prussia, Pennysivania 19405 NRC INSPECTION NO. 83-08 SilOREllA.'t El'C1.EXR PG'.;Ei! STATION - UNIT 1 DOCKET 1:0. 50-322
Dear Sir:
This letter is in response to your letter of April 15, 1983 which forwarded the referenced report of routinc inspection activitics authorized by NBC Licence No.
CPPR-95, conducted by Messrs. J.C. liiggins, C.D. Petrone and E.C. McCabe of your office on !! arch 1 - 31, 1983. Your letter stated that it appeared that one of our
)
activitics regarding certain Repair / Rework Rcquests were not conducted in full d
cocpliance with NRC requirements, and it was set forth in your Appendix A as a Notice of Violation.
In addition Appendix B addressed a Notice of Deviation regarding Bulletin 80-06, ESF reset. You requested that we respond within thirty (30) days of the date of that letter.
Our responses are provided as Attachments to this letter.
We believe that the inforcation contained herein should be sufficient to resolve the above cencerns.
If, however, ycu feel that cdditional information is required, please do not hesitate to advise us accordingly.
Very truly yours, h
&&b/ fd?ck
/
Millard S. Pollock Vice President - Nuclear WJH:jl cc:.MR. J. Iliggins
,J x All parties per the attached list.
{
Atto:h.
8306140615 830608
~
DR ADOCK 05000322 PDR
REhPONSE TO APPENDIX B
["'
Inspection Report 83-08
(-
Notice of Deviation Enginecred Safety Feature (ESP) Reset NRC Concern The Shoreham Final' Safety Analysis Report, Request and Response Nos. 223.88, 223.99 and 223.100, intended to identify all instances where the resetting of an Engineered Safety Feature (ESP) actuation signal will cause equipment to chango position.
Contrary to the above, the follouing ESP resets, not identified in the responses, cause equipment to change position,
( 1.) The Rcactor Building Standby Ventilation System (RBSVS) reset from a manual or low differential pressure actuation causes numerous RBSVS components to change position, and (2) The Nuc1 car Stcan supply Shutoff System reset from a containment isolation signal causes the Traversing Incore Probe (TIP) Nitrogen Purge Valve to open.
LILCO Response Bulletin 80-06 requires that LILCO " review the drawings for all j
systems serving safety-related functions at the schematic level to determine whether or not upon the reset of an ESF actuation signal, all associated safety-related equipment remains in its emergency mode".
In the development of the response to this issue (hiRCQuestion 223.88), the term " ESP actuation signal" was utilized in a narrow context by LILCO.
This context was subsequently maintained in our responses to follow-up NRC questions 223.99 and 223.100.
Follow-on discussions with the NRC Resident Inspector revealed that this complex issue needed to be further reviewed by LILCO.
(1) The corrective steps which have been taken and the results achieved.
In an effort to completely resolve the confusion
~
associated with this complex issue, LILCO has conducted an additional engineering review which included the following:
i.
ESP systems actuated by bSP actuation signals and affected by reset of.those signals, ii.
ESF syrtoms actuated by non-ESF actuation signals and affected by subsequent reset of these signals, and iii.
Non-ESP systems affected by resets of ESF actuation signal.m.
~
1 e
S 9
W
(.
The results of this review were presented to the NRC Resident Inspector on April 12,1983.
These results revealed that four systems or system moden contain equipment that would change position if th7 actuation signals were reset.
These systems are described below.
.A.
Steam Condensing Mode of Rl!R - This mode is used af ter the primary heat sink is isolated.
It takes steam from the reactor, reduces the pressure, directs it to the R!!R heat exchangers where it is condensed.
The condensato is then returned to either the reactor pressure vesse1~via the RCIC system or the Suppression Pool.
Upon an ESP actuation signal, steam inlet valve lE11*MOV-049, condensate return valves 1 Ell *MOV-043A, B,
and pressure control valves (PCV's) lEll*PCV-003A, B,
007A, B all close.
When the ESF actuation signal is reset, the PCV's will reopen.
This is acceptable because:
a) the steata inlet valves and the condensate return valves remain closed after the reset and b) the above only happens if the steam condensing mode was in service at the
- j time of the ESF actuation.
i B.
Traversing In-Core Probe (TIP) System - Although it has been determined that the TIP Nitrogen Purgo Containment Isolation Valve (IC51*SOV-028) does not reopen after a reset of the Nuclear Steam Supply Shutoff System, the TIP system does contain components which may change position upon reset of the ESF actuation signal.
The TIP system is used to map the i
core.
It consists of four movable detectors, four drive i
mechanisms cach with ball and shear valves for containment isolation, readout equipment, and indexing equipment.
If the probes arc inserted in the core at the time of an ESF actuation signal they will be automatically retracted and the 1
ball valves vill close.
Upon reset of the ESP actuation signal, the probes will be reinserted.
This is considered acceptable since this condition will occur only if the TIP system was in use at the time of ESF actuation.
!!owever, LILCO is currently pursuing a generic design change to the Shorcham TIP-RESET logic through General Electric.
Any proposed generic design modification will be evaluated upon roccipt and an appropriate Shorcham-specific modification will be implemented.
In addition, the solchoid valv5 for the TIP nitrogen purge line (upstream of isolation valve 1C 51
- SOV-0 28 ) will re-open upon reset of the ESP actuation signal.
This is also acceptable because the isolation valve renains closed after ESP Roset.
~
C.
The Reactor Building Standhv Ventilation System (RBSVS)
.BBSVS initiation er'! reset design is sir'.lar to the Control Ecom Air Cenditioning System (CEAC) cs der rilef. in t7c response to URC queatier 223.99.
They automatically start on the following signals:
2
1.
Reactor Vessel water level low, 2.
Drywell pressure high, area exhau't duct radiation 3.
Reactor building refueling s
- high, 4.
Bus under voltage _(RBSVS ONLY),
5.
Reactor building differential pressure low.
If RBSVS or CRAC system ucre automatically or manually actuated from logics of signals 1, 2, or 3, then the system components will not change position unless a) those signals are c1 cared, b) the initiating logic is reset, and c) RBSVS l
or CRAC system logic is roset.
If RBSVS or CRAC system were started by signals 4 (RBSVS only) or 5, or manually initiated via the RBSVS or CRAC system switch, then the system components will chango position to normal upon a RBSVS or CRAC reset signal.
This design is acceptable because these three system initiations are operational and not accident related.
D.
Automatic Dooressurization System Safety / Relief Valves -
Resetting of the ESF actuation signals will cause the Automatic Depressurization System Safety Relief Valves to close if they have not already closed.
This is consistent with the system design.
(2) Corrective stens which will be taken to avoid further deviation.
LILCO will revise the responses to NRC questions 223.88, 223.99 and 223.100 in the FSAR to denote the exceptions *and justifications described above relative to ESF reset.
Although it was not included as part of the deviation, the inspector has noted, per Inspection Report 83-08 page 18, that the preoperational test progran did not fully test to verify that components did not change position i
after the actuation signal clears and then after a system l
reset from both automatic and manual initiations.
With regard to preoperational testing, Shoreham's preoperational test program will conduct tests to verify that ESF system components do not change position after the ESF actuation signal is cleared and again when the ESF logic is reset, except for components for which exceptions have been taken in t
the system design as described above or in the FSAR.
Where not clearly demonstrated in tests performed to date, the ESF reset concern expressed in Bulletin 80-06 will be verified via the Integrated Electrical Test (PT.307.002-1) and/or
-~
[
additi onal te. sting.
LILCe Startur is currently evaluatine
\\
existing preoperational test procedures to determine the need m
e.,
(.
fo'r an additional test procedure to fulfill the above.
The results of this evaluation will be reviewed with the NRC Resident Inspector.
The additional engineering review combined with Startup testing verification will avoid further i
deviation in this area.
\\
j (3) The date when full comoliance will be achieved.
The FSAR revision is currently scheduled for the end of June, 1983.
The revised Integrated Electrical Test procedure is scheduled to be issued in mid-June 1983.
Revisions to existing preoperational test procedures and preparation of additional procedures (if necessary) will be completed by July 1, 1983.
I 4
i I
8 4
1-i
}
i t
e 4
e 4
p.
(
\\.
~.
...n.-
-- r,
i
SNPS-1 FSAR Request 223.88:
Several instances have been reported where automatic closure or the containment ventilation / purge valves would not have occurred Decause the safety actuation signals were eitner manually overriden or bypassed (blocked) during normal plant operations.
In
- addition, a
related design deficiency with regard to the resetting of engineered safety feature actuation signals has been found at several operating tacilities where, upon the reset of an ESF signal, certain safety related equipment would return to its non-safety mode.
Specifically, on June 25, 1978, Northeast Nuclear Energy Company discovered that intermittent containment purge operations had been conducted at Millstone Unit No. 2 with the saiety actuation signals to redundant containrent purge isolation valves (48 inch butterfly valves) manually overriden and inoperable.
The isolation signals which are required to automatically close the purge valves to assure containment integrity were manually overriden to allow purging of containment with a high radiation signal present.
The manual override circuitry designed ny the plant's architect / engineer defeated not only the high radiation signal but also all other isolation signals to these valves.
To manually override a safety actuation signal, the operator cycles tne valve control switch to the closed position and then to the open position.
This action energized a relay which blocked the safety signal and allowed manual operation independent or any safety actuation signal.
This circuitry was designed to permit the opening of certain valves after an accident to allow manual operation of required safety equipment.
On September 8, 1978, the staff was advised that, as a matter of routine, Salem Unit No. 1 had been venting the containment through the containment ventilation system valves to reduce pressure.
In certain anstances this venting has occurred with the containnent high particulate radiation monitor isolation signal to the purge and pressure-vacuum relief valves overridden.
The override of this containment isolation signal was accomplished by resetting the train A and B reset buttons.
Under these circumstances, six valves in the containment vent and purge systens could be opened with the radiation isolation signal present.
This override was performed after verifying that the actual containment particulate levels were acceptable for venting.
The
- licensee, atter further investigation of this practice, determined that the reset of the particulate raciation monitor alarm also overrides the containment isolation signal to the purge valves such that the purge valves would not nave automatically closed on an emergency core cooling system (ECCS) safety injection signal.
A related design deficiency was discovered curing a review of syste.a opcration f ollowing a recent unit trip and subsequent 223-88
SNPS-1 FSAR safe'ty injection a't North Anna No.
1.
Specifically, it was found that certain equipment important to safety (for example, control room habitability system dampers) would return to its non-safety mode following the reset of an ESP signal.
in
- addition, many utilities do not have saf'ety grade radiation monitors to initiate containment isolation.
SAFETY SIGNIFICANCE The overriding of certain containment ventilation isolation signals could also bypass other safety actuation signals and thus prevent valve closure when the other isolation signals are present.
Although such designs may be acceptable, and even necessary, to accomplish certain reactor functions, they are generally unacceptable where' they result in the unnecessary bypassing of safety actuation signals.
Where such bypassing is also inadvertent, a more serious situation is created especially where there is no bypass indication system to alert the operator.
Where the resetting of ESF actuation signals, such as safety injection, directly causes equipment important to safety to return to its non-safety mode, protective actions of the affected systems could be prematurely negated when the associated actuation signal is reset.
Prompt operator action woulo be required to assure that the necessary equipment is returned to its emergency mode.
The use. of non-safety grade monitor to initiate containment isolation could seriously degrade the reliability of tne isolation system.
STAFF POSITION It is our position
- that, in addition to other applicable criteria, the following should be satisfied for all operating license applications currently under review:
. 1)
The overriding of one type of safety actuation signal (e.g.,
particulate radiation) should not cause the blocking of any other type of safety actuation signal (e.g., iodine radiation, reactor pressure) for those valves that have no function other than containment isolation.
2)
Physical features (e.g.,
key lock switches) should be proviced to ensure adequate administrative controls.
3)
A system level annunciation of the overridden status should be provided for every safety system impacted when any override is active.
(See R. G.
- 1. 4 7).
223-88a O
r-m.
m
,-.e
.m
l SNPS-1 FSAR 4)
The following diverse signals should be provided to initiate isolation of the containment purge / ventilation system:
containment high radiation, safety injection actuation, and containment high pressure (wnere containment high pressure is not a portion of satety injection actuation).
5)
The instrumentation systems provided to initiate containment purge ventilation isolation should be designed and qualified to Class 1E criteria.
l 6)
The overriding er resetting of the ESF actuation signal l
should not cause any equipment to change position.
l i
Accordingly, you are requested to review your protection system design to determine its degree of conformance to these criteria.
You should report the results of your review to us describing any departures from the criteria and the corrective actions to be implemented.
Design departures for which no corrective action is planned should be justified.
The following definitions are given for clarity.
(a). Override:
The signal is still present, and it is blocked in order to perform a function contrary to the signal.
(b) Reset:
The signal has come and gone, and the circuit is being cleared in order to return it to the j
normal condition.
(
Response
Following are the responses to the Staff Positions aDove:
1.
Within the NSSS design scope, there are no overrides of one type of signal which would result in the blocking of I
another safety actuation signal for valves that have no other function than containment isolation.
It should be noted that within the AE's design scope, one exception exists to the above design approach whereny SRV all supply inboard isolation and SRV normal air supply isolation valves are closed upon a
safety in3cction signal, placing the SRV's on their emergency bottled air l
system.
After approximately 10
- minutes, the oper6 tor I
ha's the option, if the normal air system is present, to
(
override isolation and revert back to the normal air l
supply.
This will save the emergency air supply for further needs.
t l
{
223-88b e
w w
g e
SNPS-1 FSAR 2.
Automatic action of engineered safety features (ESP) can be. overridden in two ways:
(a)
Lockout functions The lockout function is accomplished with pull-to-lock control switches.-
The lockout function is used for maintenance of a system or component, i.e., pump breaker.
Once in
" Lock-Out" the auto and remote manual controls are overridden.
l (b)
Manual Override of an automatic action of an ESF System -
The f ollowing systems have overrides:.
Nuclear boiler, residual heat removal, core spray, reactor core isolation cooling
- radwaste, reactor building standby ventilation, con trol room A-C chilled water, compressed air, and control room air conditioning systems.
The manual override' allows the operator to secure equipment that is no longer needed or for reasons indicated on Table 223.88.
The capability t'o manually override satety system initiation signals after completion of accident or transient mitigation, is necessary to allow other modes I
of system operation.
These overrides place system control in the hands of the control room operators, utilizing normal equipment controls.
Keylocking et these controls would greatly reduce operator capaoility to respond to abnormal events.
3.
All manual overrides which render a
safety system l
inoperable during maintenance and testing are l
annunciated at the system level as required by l
R.G. 1.47.
I Operator override of safety system 2nitiation signals following accident mitigation is indicated by a
light only with no annunciation since the saf ety function is not out-of-service.
4.
Shoreham's containment purge / ventilation system is isolated upon: a) reactor vessel low water level; b) drywell high pressure; c) refueling platform level high radiation; d) reactor building low differential pressure; e) bus undervoltage.
At present there is not l
a containment high radiation signal.
5.
The instrumentation system provided to initiate containment purge / ventilation isolation is designed and qualified to Class lE criteria, IEEE-323 (1971) and IEEE-279 (1971).
223-88c wi y,
yy y7-r mm.
--m ew.
m.
SNPS-1 FSAR b.
Within the BOP
- design, for those components with override circuits that utilize their own control switches to initiate an override, the component will return to its non-satety position or function upon overriding.
Resetting - Review of ESF circuits indicated that in two instances (both in tne RBCLCW ' System), a reset of "LOCA" signal will return ADV's to their apre-accidenta positions f or example, during normal plant cperation valves JP42*TCV0001X and W,
modulate to control flow through the RECLCW beat.exchangers on system demand.
This provision is made in order to protect components from too low or too high cooling water temperatures.
These components being noncritical loads are isolated daring an accident; also, valve TCV001X is closed and TCV001d is opened to direct full cooling water flow through the heat exchanger which is the system tail /satu pos2 tion for the valves.
If the "LOCA" signal is reset, the valves revert to the modulating mode.
However, this will not degrade RDCLCN capability during the accident, because it still meets system demand and design requirements.
- Also, 1P42*Auv282,
- 293, 294 are testable check valves with spring assist in close direction during test.
"LOCA" signal deenergizes the solenoid valve to apply spring tension on valve in close direction.
Resetting of "LOCA" signal-will remove spring tension, allowing valve to operate as a simple check valvo.
The spring assist Ieature is provided to minimize leakage cut or the closed system if level in the surge tans drops below a
predetermined
- level, tnen a " low level surge tank" signal deenergizes the solenoid valve to apply spring tension on the valve in the closed direction.
This signal cannot ce overridden; thereforc, the RbCLCH capability will not be degraded.
In addition, the Reactor Building Standby Ventilation System (RBSVS) and the. Control Room Air Conditioning (CRAC) System contain equipment that would change position if the actuation signals were reset.
The reset features of these systems are further described in the responses to NRC requests 223.99 and 223.100.
Within the NSSS design, manual override or ESF cctuation
~
~
~
signals rollowing mitigation of the event will result in equipment reverting to another position which is sate for the new mode of system operdtlon that is entered.
223-88d Oy ww--w WW j
+
s'
!5 bW
?A 0v "L$We h % %
4 1
.J Uf A '
Resetting of ESP actuation signals will cause the RHR Heat Exchanger sample line valves to reopen.
Resetting of the ESF actuation signals will also cause the Automatic Depressurization System (ADS) Safety / Relief Valves to close if not already closed.
This is consistcnt eith the system desinn and, therefore, acceptaLle.
~
There are two non-ESF systems or systen m' odes which contain eauipment that coul(. chen~c Forition if the ESF nctur. tion signals were recot.
Ohose crc as follcus:
S+ cam Condensinc lbde of FFR - This modo is used af ter the pr2 nary.. eat s' ins is isolated.
It takes steam from the reactor, reduces the pressure, directs it to the RHR heat exchangers where it in condensed.
The ccndensate is then returned to either the reactor pressure vescel'via the RCIC system or the Suppression Pcol.
Cpon an ESP actuatien signal, steam inlet valve 1E11*MOV-049, condensate return valves 1E11*MOV-043A, B,
and pressure control valves (PCV's) 1E11*PCV-003A, B,
007A, B all close.
When the ESP actuation cignal is reset, the PCV's will reopen.
This is acceptable because:
a) the steam inlet valves and the condensate returr valves remain closed after the reset and b) the above only happens if the steam condencing mcde was in service at the time of the ESP actuation.
4
.Traversino In-Core Proba (TIP) Svetem - The TIP system is used't'O'nep the core.
It consi sts of four movable detectors, four drive mechanisms each with ball and shear valves for containment isolation, readout equipment, and indexing equipment.
If the probes are inserted in the core at the time of an ESF actuation signal they will be automatically retracted and the ball valves will close.
Upon reset of the ESF actuation signal, the probes will be reinserted.
This is considered acceptable since this condition will occur only if the TIP system was in use at the time of ESP actuation.
However, LILCO is currently pursuing a generic design change to the Shoreham TIP-RESET logic through General Electric.
Any" proposed generic design modification will be evaluated upon receipt and an appropriate Shoreham-specific modification will be implemented.
In addition, the solenoid valve for the TIP nitrogen purge line (upstream of isolation valve 1C51*SOV-028) will re-open upon reset of the ESF actuation signal.
This is also acceptable because the isolation valve remains closed after ESP Reset.
~
Preoperational startup cescuig will be performed tr.st will confirm proper runctioning or equtement (in accordance witn design requirements) when control systems are reset.
223-88e,
[
[ g ';r m ;
7p p y y;'MT: ~ QWTL n g" AT-3,
-f m
SNPS-1 FSAR Request 223.99:
As a
result of the review of the Shoreham SER by tne Region 1, six additional instances regarding Engineered Safety Features LESF) reset (ISE Bulletin 80-06) were discovered.
These instances are discussed in inspection report 50-322/81-06 dated June 5, 1981.
Because of these discrepancies, the staff is questioning the applicants original ESF reset review and the basis for the studies conclusions.
The staff has concluded, that this item needs further review by the applicant and requests that an updated submittal concerning ESF reset be provided.
4 i
Response
Inspection Report 50-322/8_1-06:
Bulletin 80-06, Engineering Safety Feature (ESF) Roset Controls, describes a situation where certain safety equipment changed its mode or position to the normal or non-safety state, af ter actuation, as a result of ESF reset button operation only. The issue was also addressed in an FSAR question, which the licensee answered in letter SNRC-546 dated 3/18/81.
The letter stated that there were only two examples in the balance of plant design and two in the nuclear steam supply system design where equipment changed position on reset of ESF actuation.
The letter detailed these instances.
Based on a
brief systems
- review, the inspector noted an additional instance of the type in question;
- namely, in the control room air conditioning (CRAC) System (X61), MOV-031A, AOV-039A, MOV-032A and FN-026 all change position or operating mode on a reset of CRAC initiation.
Additionally the battery room and diesel generator room ventilation systems automatically restart on a
fire protection reset.
The inspector questioned the basis for the statements in letter SNRC-546.
The Bulletin remains open.
LILCO Position In response to the above, refer to Exhibit 223.99-1: 1X61*MOV-031A opens on receipt of CRAC initiation signal 86A1-1X61A07.
Upon reset of CRAC initiation the contact 86A1-1X61A07 will open.
l However, there is no corresponding automatic signal to close the motor operated valve.
Therefore the valve will not change state.
Same is true of 1X61*MOV032A (Exhibit 223.99-2).
Refer to Exh'ioit 223.99-3: 1X61*AOV-039A closes upon receipt of CRAC initiation signal 86A1-1X6107.
Ref er to Ex'hibit 223.99-4:
if the CRAC was manually initiated through switch 1A1, the valve reverts to normal position upon reset by switch 1A2.
- However, during an accident
- scenario, the automatic initiation is via contact 3B-1T46A19, which is truly the ESF initiation signal l
(Exhibit 223.99-5) and unless that (the originating) accident I
signal is recet, it is not porsibic to renet the "CRAC initiation signal" even if the recct button qA2 is turned to " RESET.a This is an accaptable design.
223-99
r SNPS-1 FSAR
~
1X61-FM-26 (Exhibit 223.99-6) is a non-safety related component e.nd tnerefore, unrelated to the icsue.
Refer to Exhibit 223.99-7: the battery room ventilation restarts when relay. contact 28X-Tr143A05 is reset.
- However, refer to Exhibit 223.99-8, 28X cannot be reset by switch 1-1M43A05, until the CO fire protection initiation contacts RH1 or THR are first 2
- reset, and if this were to occur it would return the ventilation systen to its safety mode.
Trains B and C, and diesel generator room ventilation systems are similar to the aoove.
In addition, these initiations originate in the CO fire protection system 2
which is not an ESF system.
Bulletin 80-06 addresses ESF systems.
It should be noted that the above explanation on the CRAC initiation and reset clso applies to the Reactor Building Standby Ventilation System (RBSVS).
Refer to Exhibits 223.99-5,9,10 and 11.
The RBSVS and CRAC System are similar except that RBSVS also receives an initiation signal on bus undervoltage.
.. ~. -.....
223-99a
I
,/
Recuest 223.100i the Applicant's response to questi'on 223.99, it was indicated In
. ~
that valves in the Control Room Air Conditioning (CRAC)
System would revert to a normal position if switch 1A2 was reset.
It was also indicated that this reset would occur only if the CRAC System were ' manually initiated and not automatically initiated.
This indicates to the staff that the Applicant apparently has not
~
included a review of Engineered Safety Features (ESP) resets when the ESF Systems are manually initiated even though the review for IE Bulletin 80-06 (ESP Rosets) is intended to cover both autcmatic and manual initiations.
Therefore, the Staff has concluded that-the Applicant should include a review of manual initiation for the ESF Systems and provide an updated submittal concerning IE Bulletin 80-06.
Response
In response to NRC Request 223.88 and 223.99, reviews were done on the resets of Engineered Safety Features (ESP) system actuation signals which included automatic as well as manual initiation.
As indicated in our responses, there are no systems other than those identified in the above responses, where a system reset will return safety equipment to their normal (non-naferv) nnnitions.
'It should be noted that the reset design of the Control Room Air Conditioning (CRAC) system and the Reactor Building Standby Ventilation System (RBSVS) is unique in that, as noted in LILCO's response to NRC Request 223.99, a reset of the CRAC/RBSV systems may return certain CRAC/RBSVS components to the normal position.
This is acceptable as explained below.
I (IEEE Standard 279-1971 defines a protective function as follows:
~"A protective function is the sensing of one or more variables associated with a particular generating station condition, signal processing, and the initiation and completion of the protective action at values of the variables established in the design bases."
Additionally, paragraph.4.16 of the above standard states that, "The protection system shall be so designed that, once initiated, a protective action at the system level shall go to completion.
Return to operation shall require subsequent deliberate operator action."
In our design, once CRAC or RBSVS, as ESF syst' ems, are automatically.
initiated at the system level to perform their protective -functions they cannot be returned to their normal mode of operation unless distinct and deliberate operator actions are taken.
CRAC and RBSVS automatically start on the following signals:.
1.
Reactor Vessel water level low, 2.
Drywell pressure high,
-3.
Reactor building refuel-ing area exhaust duct radiation high, 4.
Bus undervoltage-(RBSVS ONLY).
5.
Reactor building differential pressure low.
223-100 4
a
+
If RBSVS or CRAC system were required to perform their protective function and actuated from logics of signals 1, 2, or 3, (including Nuclear Steam Supply Shutoff System manual initiation) then the system components will not change position unless a) these signals are cleared, b) the initiating logic is reset,.4nd c)
RBSVS or CRAC systeht logic is reset.
If RBSVS or CRAC system were started by signals 4 (RBSVS only) or 5, or manually initiated via the RBSVS or CRAC system switch, then the system components will change position to normal upon a RDSVS or CRAC reset signal.
This design is acceptable because these thyee methods of system initiation are operational and not accident related.
l l
l l
223-100a 1
a--.
.- -