ML20072Q362
| ML20072Q362 | |
| Person / Time | |
|---|---|
| Site: | Comanche Peak  |
| Issue date: | 12/14/1990 |
| From: | William Cahill, Walker R TEXAS UTILITIES ELECTRIC CO. (TU ELECTRIC) |
| To: | NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM) |
| References | |
| CP-88-30, TXX-901049, NUDOCS 9012210170 | |
| Download: ML20072Q362 (12) | |
Text
-
e.,
~
FE log # TXX-901049 File # 907.6 r
10110 Ref.
- 10CFR50.55(e) 7UELECTRlt:
)
% lilism J. Cahill, Jr.
i.mvu-rue nd""
December 14, 1990 U. S. Nuclear Regulatory Commission Attn Document Control Desk Washington, D.C.
20555
SUBJECT:
COMANCHE PEAK STEAH ELECTRIC STATION (CPSES)
DOCKER NO. 50 445 AND 50 446 COMS ACTUATION DURING ACCIDENT EVENTS SDAR:
CP 88 30 (SUPPLEMENTAL REPORT)
REF:
1)
NRC Letter from J. C. Linville to W. J. Cahill, Jr. dated October 9, 1990.
- 2) TV Electric Letter, TXX 88688, from W. G. Counsil, to the NRC dated October 5, 1988.
Gentlemen:
Reference 2 presented the basis for concluding that the failure to consider the postulated scenario described in reference 2 is not reportable under the provisions of 10CFR50.55(e),
in the FSAR Chapter 15 analyses of tho HSLB and SGTR events, single failures were considered in the systems required for accident mitigation in accordance l
with the requirements of 10CFR50, Appendix A.
The analyses satisfy the general design criteria for these systems.
The random, simultaneous, independent failure of the wide range temperature channel during a HSLB or SGTR event is not considered a credible failure.
Therefore, this postulated failure need not be considered in the design of the COMS.
Subsequently, the NRC staff requested additional information in reference 1.
The response to the requested information is attached.
- /
l 9012210270 901214 f
PDR ADOCK 0500044c i
S PDR I
/
400 Nonh Olive Street L B, 81 Dallas, Texas 75201
TXX 901049 Page 2 of 2 Should there be any questions concerning this submittel please contact A. Harvray at (214) 812 8296.
Sincerely, i(kbhn:;q,) Clk;$' ))
t William J. Cahill, Jr.
/
gygin, ry, ht'.'i h,,
0, Roger D. Walker Manager of Nuclear Licensing HAH /gj Attachment c - Mr. R. D. Hartin Region IV Resident Inspectors, CPSES (3)
Mr. J. W. Clifford. NRR i
f I
Attachment to TXX 903049 Page 1 of 10 (INTRODUCTION FROM NRC LETTER DATED OCTOBER 9, 1990)
The October 5, 1988 letter (TXX 886B8) provides the rationale for why the actuation of the Cold Overpressure Hitigation System (COMS) during a Main Steam Line Break (MSLB) or Steam Generator Tube Ruptere (SGTR) is not considered to be a credible event.
The key to the staff's acceptance of this argument is assurance that the control room operators would be immediately aware of the existence of a f ailure in the COMS circuitry that would result in its actuation during a HSLB or SGTR event.
To assist the staff in this regard, please provide the following information:
NRC OVESTION:
1.
Provide a detailed failure analysis of the COHS that lists each component whose failure would result in the actuation of the COMS during a HSLB or SGTR, all possible failure modes of these components, and why each of these f ailures would be immediately noticed by the control room operators.
TV ELECTRIC RESPONSE:
1A. [ Allures Required for COMS Actuation durino a MSLB or SGTR During a SGTR recovery, the reactor operators are intentionally using a PORV to depressurize the RCS: hence, the response to an unnecessary COMS actuation would be beneficial, und the increased attentiveness by the reactor operators lends additional assurance that an unnecessary COMS P.ctuation would receive immediate consideration.
Assuming that a design basis, double ended guilletine HSLB event occurred, the conservative analytical results indicate that the cold leg temperature in the affected loop would approach or fall below the 350F COMS arming temperature.
However, due to mixing in the lower and upper plena of the reactor vessel, the hot leg temperature would not fall below the COMS arming temperature, Thus COMS activation would not occur.
With the assumption that the postulated HSLB occurred on Loop 4 the bold boxes in Figures 1A, 1B, and 10 indicate those functions which would be in the proper state to allow a COMS actuation.
By examining these figures, one may observe that to obtain a COMS actuation, one of the following functional blocks must fail 1)
TE 413B OR TE 423B OR TE 433A OR TE 443A Fails low OR -
l l
Attachsent to TXX 901049 i
Page 2 of 10 2)
Auctioneering Unit Fails Low OR -
3)
Function Generator fails low OR -
4)
Pressure Comparator Fails High OR -
5)
Temperature Comparator Fails Low OR -
6)
PT 403 Pressure Transmitter Fails High OR -
7)
The "AND" function fails.
- 10. Available Alarm functions To demonstrate how the reactor operators would become aware of these instrument failures, a discussion of the available alarms is provided.
1)
ALARH 1 ALB 58, Window 2.4 "AT L0 TEMP RCS PRESS HI" This window is in ALARM when Reference pressure generated based on
< PT-403 auctioneered low value of TE-413A, TE 423A, TE 4330, and TE-443B:
AND auctioneered low value of TE 413A.
< 350F TE 423A, TE 433B, and TE-443B OR Reference pressure generated based on
< PT-405 auctioneered ' sow value of TE 413B, TE 4238. TE-433A, and TE-443A AND auctioneered low value of TE-413B,
< 350F TE-423B TE 433A, and TE 443A, i
Attachment to TXX 901049 Page 3 of 10 4
e 2)
ALARM 1 ALB SC, Window 1.4 "PORY 455A/456 NOT CLOSE" 4
This window is in ALARM when either PORY 455A or PORY 456 is not closed.
4 3)
ALARM 1 ALB 60, Window 1.11 "AT LO TEMP PORY 455A APPROACHING LHT PRESS" This window is in ALARM when:
The actual pressure from PT 405 (Loop 1 Hot Leg wide range i
pressure) is greater than 20 psi less than the reference pressure generated based on the auctioneered low value of TE 413A, TE 423A, TE 433B, and TE 4438.
4)
ALARM 1-ALB 6D Window 2.11 "AT LO TEMP PORY 456 APPROACHING -
LHT PRESS" This window is in ALARM whent The actual pressure from PT-403 (Loop 4 Hot Leg wide range pressure) is greater than 20 psi less than the reference pressure generated based on the auctioneered low value of TE 4138 TE 423B, TE 433A, and TE 443A.-
- 10. Failure vs. Alarm A discussion of the alarm features available to the operator to-detect the failure of a component when the s), tem is operating at power is provided below.
Although the following discussion is based on the-presumptionoof a MSLD cn loop 4, only the tag numbers would change if the postulated MSLB were to occur on a different loop.
1)
TE 413B OR TE 423B OR TE-433A OR i
TE 443A Fails Low Because the auctioneered low temperature indication is used'to=
generate a reference pressure, any of these failures would cause the following. window to alarms ALARM 1 ALB 6D Window 2.11 "AT LO TEMP PORV 456.
APPROACHING LHT PRESS" t
(-
-r
~ry, c
m--
.-,.y.
,,--,,,,-,_,,.h-~--,,_,--,.-v,y..v,
-m-,-,,-.,,
,......-,,,,,,,,-,_,,,,,,,,,,w
,_,,,,,,.-,,,,.-w,,.,
- -,,y
.,.n.
Attachoent to TXX 901049 Page 4 of 10 I
2)
Auctioneering Unit Fails Low Note that two separate auctioneering units are used for each train of the COMS: one unit provides the auctioneered low temperature indication for use in the generation of the reference pressure and a separate unit is used for the COMS ARMING function on low temperature.
if the auctioneering unit used to generate the reference pressure f ails low, the following window would alarm.
ALARM 1 ALB 6D, Wirdow 2.11 "AT LO TEMP PORV 466 APPROACHING LHT PRESS" If the temperature auctioneering unit used to arm the COMS fails low (generic f ailure rate ~10 6/hr), no alarm would be annunciated until PORY 455A received an OPEN signal.
However, a monthly (31 day) verification will be performed which confirms the correct position of the auxiliary relays (see Item 7).
This _
verification, while not detecting the failure of this specific component, would detect any failure in the CONS which satisfied s
either the ARHING or ACTUATION logic.
3)
Function Generator fails Low This postulated failure would cause a low reference pressure to be generated, thereby-causing the following window to alarms ALARM 1 ALB 60 Window 2.11 "AT LO TEMP PORV 456 APPROACHING LHT PRESS" 4)
Pressure Comparator Fails The pressure comparator card consists.of two separate comparators; one for the ALARM function cnd one for the ACTUATION function, if the ACTVATION function comparator failed high (generic failure rate ~10 6/hr), resulting in an indication that the actual pressure is greater than the reference pressure.:no alarm would be annunciated until-the PORY 456-received on-open permissive signal.
However, a monthly (31 day) verification will.be performed which confirms the correct position of the auxiliary relays (see Item 7).
This verification, while not detecting the failure of this specific component, would detect any failure in the C0HS which satisfied either the ARMING or ACTUATIO;i logic.
l
Attachment to TXX 901049 Page 5 of 10 t
5)
Temperature Comparator Faile Low The temperature comparator card consists of two separate comparators: one for the ALARM function and one for the ARMING function.
If the ARHING function comparator failed low (generic failure rate ~10 6/hr), resulting in the generation of a CONS ARHING signal for PORY 455A, no annunciator would alarm until an ACTUATION signal for PORV 455A was also received.- However, a monthly (31 day) verification will be performed which confirms the correct position of the auxiliary relays (see item 7).
This verification, while not detecting the failure of this specific.
component, would detect any failure in the CONS which satisfied either the ARMING or ACTUATION. logic.
6)
PT 403 Pressure Transmitter Fails High This postulated failure would cause the indicated pressure to be greater than the reference pressure, thereby causing-the following windows to alarm:
ALARM 1 ALB 6D. Window 2.11 "AT LO TEMP PORY 456 APPROACHING LHT PRESS" 7) the "AND" function fails The AND function consists of two auxiliary relay contacts in series in each of-the PORV's-control circuitry.
These auxiliary relays are driven by the analog rack driver cards associated with the COMS ARHING signal and the C0HS ACTUATION signal bistables.
The ARHING driver card and its associated auxiliary relay are normally energized (de energize to arm).. The ACTUATION driver card and its associated auxiliary relay are normally de energized (energize to actuate).
Since one PORV is-assumed to be ARMED and the other PORY is assumed to have an ACTUATION signal present due to the HSLB, then either of the following "AND" function failures could occur and induce a simultaneous COMS actuation, a)
ACTUATION portion of "AND" function:
the ACTUATION driver card's output fails high
-(generic failure rate ~10-6/hr) the ACTUATION relay's normally open contacts become shorted (generic failure rate ~10*7/hr)
_ _. _. _. - _ _ _. _ _ _ _.. _ -. _. _ _ _. _ _. _.. _. ~ _ _
i AttachGent to TXX 901049 Page 6 of 10 i
b)
ARMING portion of "AND" function 4
the ARHING relay driver card fails low (generic failure rate ~10*6/hr) 1 the normally energized ARMING relay coil fails (generic failure rate ~10*6/hr) the ARHING relay contacts become shorted (generic failure rate ~10*7/hr) i i
None of these failures are immediately annunciated to the operators during normal operations.
However. a monthly (31 day) verification will-be performed which confirms the correct position of the auxiliary relays.
This verification, while not detecting the failure of any specific component, would detect any failure in the COMS which satisfied either the ARMING or ACYUATION logic (except for relay contact shorting).
Given the high_ reliability of the COMS components, the 31 day verification schedule is adequate to detect failures in the CONS.. In addition. TV Electric has opted to enhance the failure detection capability by modifying the logic-for the annunciator SB, window 2.4.
The modification would allow the operators to immediately detect any failure in the COMS by alarming if any of the four ACTUATION or ARMING relays changed position. This modification will be implemented by the end of the first refueling outage for Unit 1 and prior to initial criticality for Unit 2.
NRC QUESTION:
2.
Human errors such as calibratinn mistakes must be considered in the failure analysis.
Show why there cannot be any human errors-that will go undetected by the control room operators during normal operating-condition that would result in COMS actuation during MSLBlor SGTR events.
TV Electric RESPONSE:
i 2.
Site instructions require "AS FOUND" and 'AS LEFT" Analog Channel Operational Tests (ACOTs) to be conducted prior to and following each calibration of theso COMS control 1 cops.
Consequently, any error. induced-during the course of the calibration would be identified through the performance of these ACOTs.
l 1
Attac,;. dent to TXX 901049 Pago 7 of 10 NRC 00EST10N:
3.
The possibility of wide range temperature instrument drift great enough to cause actuation of the COMS during a MSLB or SGTR event (but not great enough to arm the COMS during normal operating conditions: thereby alerting the operators) was discounted by the licensee as not being a credible failure mechanism.
Provide a detailed justification for this position, including test data, if available. that demonstrates that these types of instruments will not drif t appreciably between calibration intervals.
Describe the calibration techniques used on these instruments and specify the time interval between calibration checks.
TV Electric RESPONSE:
3.
The wide range RTDs used to supply the input to the COMS circuits are calibrated each refueling using the cross calibration methodology.
This cross calibration utilizes the 16 installed RCS RTDs and verifies each is within acceptable agreement.
If not, re characterization of the affected RTDs to the cross calibration results is implemented.
Because only one of these cross calibrations has been performed with the existing RTDs. no test data exists to document observed drift over an operating cycle.
However, these wide range RTDs are subjected to periodic channel checks (every 31 days, temperature indications are verified to agree within required tolerance). This surveillance provides adequate assurance that excessive drift is not occurring: therefore, an inadvertent COHS actuation due to undetected RTD drift is not considered to be credible.
I I
I 1
l I
J
1
'l Attachcent to TXX 901049 Page 7 of 10 NRC OVESTION:
i 3.
The possibility of wide range temperature instrument drift great enough to cause actuation of the COMS during a HSLB or SGTR event (but not great i
enough to arm the COMS during normal operating conditions: thereby alerting the operators) was discounted by the licensee as not being a i
credible failure mechanism.
Provide a detailed justification for this I
position, including test data, if available, that demonstrates that these types of instruments will-not drift appreciably between calibration intervals.
Describe the calibration techniques used on these instruments j
and specify the time interval between calibration checks.
'l TV Electric RESPONSE:
i 3
The wide range RTDs used to supply the input to the COMS circuits are calibrated each refueling using the cross calibration. methodology.
This cross calibration utilizes the 16 installed RCS RTDs and verifies each is within acceptable agreement.
If not, re characterization of the affected RTDs to the cross calibration.results is implemented.
Because only one of i
these cross calibrations has been performed with the existing RTDs. no test data exists to document observed drift over an operating cycle.
However, these wide range RTDs are subjected to periodic channel checks (every 31 days, temperature indications are verified to agree within required tolerance).
This surveillance provides adequate assurance that excessive drift is not occurring therefore, an inadvertent COMS actuation due to undetected RTD drift is not considered to be credible.
l 1
i l
t i
'I I
I
)
Attachment Page 8 of HOT LEG 1 1 hot T hot T cold T cold PRESSURE th0P 1 th0P 2 th0E 3 loop 4 PT 405 TE 413A TE 423A TE 433B TE 443B s
E E
EM AUCTIONEERED AUCTIONEERED IDW IhW FUNCTION ENEP.ATO COMPARATOR COMPARATOR COMPARATOR COMPARATOR PRESSURE PRESSURE)
(TEMPERATURE)
(TEMPERATURE)
OPEN OPEN 455A PORV PORV 456 OPEN AIARM S5A AIARM 5B, PORV 456 6D.1.11 4.2 INPUT PERMISSTVE MSLB INDUCED FIGURE 1A l
~
Attachment to TXX 901049 Pago 9 of 10 HOT LEG 1 T hot T hot.
T cold T cold PRESSURE 140P 3 LOOP 4 LOOP 1 loop 2 PT 403 TE 433A TE 443A TE 413B TE 423B A
AUCTIONEERED AUCTIONEERED LOW LOW FUNCTION GENERATOR I
COMPARATOR COMPARATOR COMPARATOR COMPARATOR (PRESSURE)
(PRESSURE)
(TEMPERATURE)
(TEMPERATURE)
OPEN OPEN 456 PORV A1 ARM 456 PORV 455A OPEN 6D,2.11 AIARM SB, PORV 455A 4.2 INPUT PERMISSIVE MSLB INDUCED FIGURE IB
Attachment to TXX-901049 Page 10 of 10 1
OPEN PORV OPEN PORV 455A OPEN PORV OPEN PORV 456 455A PERMISSIVE 456 PERMISSIVE A
A N
N D
D I
I l
l ALARM ALARM 5B,2.4 5B,2.4 OPEN PORV 455A OPEN PORV 456 i
s 3
MSLB INDUCED FIGURE 1C