Text

Proposed Tech Spec Change Request 47,revising Surveillance Frequency from Quarterly to Refueling for Slave Relays Which Satisfy Screening Criteria in Table 4.3-2 of Surveillance Requirement 4.3.2.1.1
	ML20073D431
Person / Time
Site:	Beaver Valley
Issue date:	04/12/1991
From:	; DUQUESNE LIGHT CO.
To:	;
Shared Package
ML20073D407	List: ML20073D404; ML20073D408; ML20073D431;
References
	NUDOCS 9104290062
	Download: ML20073D431 (109)
	v • d • e

{{#Wiki_filter:_ _ _ _ - - _ _. _ _ _ _ _ _. - _ _ _ ATTACHMENT A i Revise the Beaver Valley Power Station, Unit No.2 Proposed technical Specification Change No. 47 ) Revise the Technical Specifications as follows: Remove PacEE Insert Pacen 3/4 3-15 3/4 3-15 j 3/4 3-33 3/4 3-33 1 3/4 3-34 3/4 3-34 3/4 3-35 3/4 3-35 3/4 3-36 3/4 3-36 3/4 3-37 3/4 3-37 3/4 3-38 3/4 3 38 1 i l 1 l l 9104290062 910412, ADOCK0500g4)/ DR

1 INSTRLMENTATION 3/4.3.2 ENGINEERED SAFETY FEATURE ACTUATION SYSTEM INSTRUMENTATION $URVEILLANCE RFnUIREMENTS U 4.3.2.1.1 Each engineered safety feature actuation system instrumentation i channel and interlock and the automatic actuation-logic with master and slave 1 relays shall be demonstrated OPERABLE by the erformance of the ESFAS Instru-mentationSurveillanceRequirements*duringt$eMODESandatthefrequencies shown in Table 4.3-2.. i 4.3.2.1.2 The logic for the interlocks shall be demonstrated OPERABLE during the at power CHANNEL FUNCTIONAL TEST of channels affected by interlock opera-tion. The total. interlock function shell be demonstrated OPERABLE at least-once per 18 months durin by interlock operation. g CHANNEL CALIBAATION testing of each channel affacted 4.3.2.1.3 The ENGINEERED SAFETY FEATURES RESPONSE TIME-of each ESF.func shall be demonstrated to be within the'11mit at least once per 18 months Each test shall include at 1 east one logic train such that both logic trains are tested at least once per 36 months and one channel per function such that all channels are tested at least once per N times 18 months where N is the total number of redundant channels in a specific ESF function as shown in the " Total No. of Channels" Column of Tabh 3.3-3. l OILETE-l l l l "For the automatic actuation logic -the surveillance: requirements shall-be the applicationofvarioussimulatedInputconditionsinconjunctionwitheach possible interlock logic state and verification of the required logic output-including as a sinimum, a continuity check of output devices. For the actuation, relays, the surveillance requirements:shall be the energization of-each master ~and slave relay and verification of OPERASILITY_of each relay.- The test of anster relays shall: include a enatinuitv chneit of ameh===ariated slave reltvr The tost of sinve relevil(to be perfomed a". least c,nce:per 921 Idays in ' ' au of at ' annt once ner 31 davs shall:1nclude, as a minimum, a l continuitv chac< of associated actuation vices that are not testable. K-(**The'specified13-monthsurve'11anceintervalduringthefirstfuelcyclemay7 ~ ( be extended to coincide with-completion of the first refueling outage. jW DELETE 1 BEAVER VALLEY - UNIT 2 3/4'3 hP*sh*

TABLE 4.3-2 I 3E ENGINEERED SAFETY FEATURE ACTUATION SYSTEM INSTRUMENTATION SURVEILLANCE REQUIREMENTS 9 CHANNEL MODES IN WHICH l CliANNEL CHANNEL FUNCTIONAL SURVEILLANCE / E CHECK CALIBRATION TEST REQUIRED { FUNCTIONAL UNIT E 1. SAFETY INJECTION AND FEEDWATER Q ISOLATION a. Manual Initiation N.A. N.A. N(1) 1, 2, 3, 4 ro-b. Automatic Actuation Logic and N.A. N.A. M(2) 1, 2, 3, 4 Actuation Relays c. Containment Pressure-High S R M 1,2,3 ? d. Pressurizer Pressure--Low 5 R M 1, 2, 3 l4w _ Steam'Line Pressure--Low-S R M 1, 2, 3 oy e.: r w c-O 1.1 SAFETY INJECTION-TRANSFER b FROM INJECTION TO THE 1 0 RECIRCULATION MODE l a. Automatic Actuation .N.A. ~M.A. M(2) 1, 2, 3, 4 c- ,d Logic, Coincident with .j Safety Injection Signal b. Refueling Water Storage' S R M 1, 2, 3, 4 L Tank Level-Extreme Low A I H i zs% in lL u, l-TU M

)> 5f j.

H rn Y

H> As'TER hAVE' TABLE 4.3-2 RELAY 6 ELAN a r 4 -' I E ENGINEERED SAFETY FEATURE ACTUATION SYSTEM INSTRUMENTATIONTeT W m y SURVEILLANCE REQUIREMENTS x

-4 CHANNEL MODES IN WHICH FUNCTIONAL 'f SURVEILLANCE M

CHANNEL CHANNEL CHECK CALIBRATION TEST REQUIRED m ~4 f FUNCTIONAL UNIT E E 1. SAFETY INJECTION AND FEEDWATER 2

1 ISOLATION

.c a. Manual Initiation N.A. N.A. M llT N.h. N. st 1, 2, 3, 4 -f, m b. Automatic Actuation Logic and N.A. N.A. M (9) Mt2) G(37 1, 2, 3, 4 -Actuation Relays l Containment Pressure-High 5 R M tJ. A. fJ. A. 1, 2, 3 c. q-1 d. Pressurizer Pressure--Low 5 R M N.A. f4. A< 1, 2, 3 2 e. Steam Line Pressure--Low S R M N. h. td. A. 1, 2, 3 w E-I - 1.1 SAFETY INJECTION-TRANSFER S FROM INJECTION TO THE RECIRCULATION MODE 4.i Automatic Actuation N.A. N.A. M (M N. A N. A 1, 2, 3, 4 a. Logic, Coincident with V Safety Injection Signal 4\\l.h N.b 1, 2, 3, 4

b. ' Refueling Water Storage S-R M

Tank Level-Extreme Low e e f-

~ n TABLE 4.3-2 (Continued) 3E ENGINEERED SAFETY FEATURE ACTUATION SYSTEM INSTRUMENTATION SURVEILLANCE REQUIREMENTS 9 CHANNEL MODES IN WHICH h CHANNEL CHANNEL FUNCTIONAL SURVEILLANCE E CHECK CALIBRATION TEST REQUIRED FUNCTIONAL UNIT E, 2. CONTAINMENT SPRAY G! a. Nanual Initiation N.A. N.A. M(1) 1, 2, 3, 4 m b. Automatic Actuation and N.A. N. A. M(2) 1, 2, 3, 4 Logic Actuation Relays c. Containment Pressure--High-S R M 1, 2, 3 High' m ~t5 w f 3. CONTAlfMENT-ISOLATION 2 ~ "t- 'a. Phase "A" Isolation w L, 4 1. Manual Initiation .N.A. N.A. M(1) 1, 2, 3, 4 ' s-M ?) 1, 2, 3, 4

2. -Automatic Actuation Logic N.A.

N.A. t g e.' and Actuation Relays See Functional Unit 1. above for all Safety Injection Surveillance m 3. ' Safety Injection m- ,G Requirements. ? u -- { . b. Phase "B" Isolation 7 h. 1. Manual Initation N.A. N.A. M(1) 1, 2, 3, 4 i 2. Automatic Actuation N.A. N.A. M(2) 1, 2, 3, 4 b Logic and Actuation Relays q r-3. Containment Pressure-- S R M 1, 2, 3, 4 N High-High h m 2 -4 CP .m-- ~

H 3-z y w y. M o~ TABLE 4.3-2 (Continued) tM, ] j MarTER [RELM] R' RELA'T I g) 3E ENGINEERED SAFETY FEATURE ACTUATION SYSTEM INSTRUMENTATION T.__ES_7 TgET g z 9 SURVEILLANCE REQUIREMENTS CHANNEL MODES IN WHICH --{ O CHANNEL CHANNEL FUNCTIONAL se# SURVEILLANCE E CHECK CALIBRATION TEST REQUIRED -4 7 FUNCTIONAL UNIT Po-r- E '2. CONTAINMENT SPRAY m U m a. Manual Initiation N.A. N.A. M (O N A N A-1,2,3,4 b. Automatic Actuation and N.A. N.A. M (Q) MO N, 2, 3, 4 h 1 Logic Actuation Relays p c. Containment Pressure--High-S R M N.k. N b 1, 2, 3 High ~p 3. CONTAIMENT ISOLATION 8, Phase "A" Isolation a. 1. Manual Initiation N.A. N.A. K {l) N.h.NA 1,2,3,4 .c g S 2. Automatic Actuation Logic N.A. N.A. M (2) MIM Qd ,2,3,4 1 'I and Actuation Relays W See Functional Unit.1. above for all Safety Injection Surveillance v - 3. Safety Injection Requirements. "b. Phase "B" Isolation 1. Manual Initation N.A. N.A. M[O N.ll N b* 1,2,3,4 2. Automatic Actuation 4-N.A. N.A. MQ,) MfM M 1 ,2, 3, 4 Logic and Actuation Relays

3. -Containment Pressure--

S. R M N.A. N A. 1, 2, 3, 4 i High-High 4esty of ClB oducked 5)aue reTq ) asso tsM wAh CoArol Rec % h.p hbidie's y W hC It4 des ~ _ _ _ _ _ _ -

TABLE 4.3-2 (Continued) E E ENGINEERED SAFETY FEATURE ACTUATION SYSTEM INSTRUMENTATION E SURVEILLANCE REQUIREMENTS h CHANNEL MODES IN WHICH G CHANNEL CHANNEL FUNCTIONAL SURVElttANCE FUNCTIONAL UNIT. CHECK CALIBRATION TEST REQUIRED E 4. STEAM LINE ISOLATION ~ a. Manual Initiation 1. Individual N.A. N.A. M(1) 1, 2, 3 2. System N.A. N.A. M(1) 1, 2, 3 ' b. Automatic Actuation Logic and N.A. N.A. M(2) 1, 2, 3 1 Actuation Relays m O$ Containment' Pressure-- S R M 1,2,3 c. Intermediate-High-High a

j d.

Steam Line Pressure--Low S R M 1,2,3 q-- T. 3 e. Steam 11ne Pressure Rate-High 5 R M 1, 2, 3 tr1 E. Negative r-oh 5. TURBINE TRIP AND FEEDWATER ISOLATION [ a. Automatic Actuation Logic and N.A. N.A. M(2) 1, 2, 3 Actuation Relays g b. Steam Generator Water S R M 1,2,3 5 I Level--High-High, P-14

c.. Safety Injection.

See Functional Unit 1 above for all Safety Injection Surveillance Requirements. TI). ]. z--- --w'u ,-s,. to +-a=_%,i .m. -+------.,---,.r i%.

W z d - H TABLE 4.3-2 (Continued) E b-MASTER A RELAT 4 g j E ENGINEERED SAFETY FEATURE ACTUATION SYSTEM INiTRUMENTATION AEt.A3 SURVEILLANCE REQUIREMENTS g 'g s m CHANNEL NODES IN WHICH T: E. CHANNEL CHANNEL FUNCTIONAL / SURVEILLANCE .53 l

FUNCTIONAL UNIT CHECK CALIBR.ATION TEST REQUIRED o;

E 4. STEAM.LINE ISOLATION ~ Y es --e ~ a. Manual Initiation {: 1. Individual N.A. M.A. M(1) NA N b'1,2,3 ~ C'

2.. System N. A.'

N.A. M [1] N A-1, 2, 3 b. Automatic Actuation' Logic and M. A.' N.A. . MQ) M m M 3D , 2, 3 1 4-Actuation Relays N. A - N A 1, 2, 3 >I c. Containment Pressure-- 5' R M ' Intermediate-High-High.. N 4 N* b' 1, 2, 3 p d. Steam Line Pressure--Low S' R M E e. Steamline Pressure Rate-High 5' R M N. A. N' b 1, 2, 3 f Ih Negative- .-!D-i" 5. TURBINE TRIP AND FEEDWATER ISOLATION MS N3 1,2,3 a. Automatic Actuation Logic and .N.A. M.A. MR) . Actuation Relays b. Steam Generator Water S-R M N b N b

1, 2, 3 I'

Level--High-High, P-14' c. Safety Injection See Functional Unit 1 above for all Safety Injection Surveillance Requirements. 9 ~ 4 ...n. ,,-o

TABLE 4.3-2 (Continued) m E ENGINEERED SAFETY FEATURE ACTUATION SYSTEM INSTRUMENTATION 9 SURVEILLANCE REQUIREMENis h. CHANNEL MODES IN WHICH CHANNEL CHANNEL FUNCTIONAL SURVEILLANCE m CHECK CALIBRATION TEST REQUIRED [FUNCTIONALUNIT E 6. LOSS OF POWER a. 4.16kv Emergency. Bus M.A. R M 1, 2, 3, 4 m l 1. Undervoltage.(Trip Feed) 2. Undervoltage (Start Diesel) N.A. R M 1, 2, 3, 4 b. 4.16kv Emergency N.A. R M 1, 2, 3, 4 Bus (Degraded Voltage). Q - w 2 .c. -480 Volt Emergency Bus N.A. R M 1, 2, 3, 4 (Degraded Voltage) o w u e r db. AUXILIARY FEEDWATER* 7 -h

a.. Automatic Actuation Logic and N.A.

N.A. M(2) 1, 2, 3 Actuation Relays. 3 .g-4- rn 'g b. Steam Generator Water { a Level--Low-Low n 1. Start Turbine Driven S R M 1, 2, 3 r71 I cu I .2. Start. Motor Driven - S R M 1,2,3 Q .r Pumps d c. Undervoltage - RCP (Start-S R M 1, 2 [ Turbine Driven Pump) F1

d

--4

Manual initiation is included in Specification 4.7.1.2.

D : ..... ~ _...... _.. _...........

Mk 2 4 e p! TABLE 4.3-2 (Continued) E MASTER StME Ill 8tLAY ? E ENGINEERED SAFETY FEATURE ACTUATION SYSTEM INSTRUNENTATION i RELAY 9 SURVEILLANCE REQUIREMENTS rest -jTE [ 0- Z' si CHANNEL MODES IN WHICH ' q E CHANNEL CHANNEL FUNCTIONAL SURVEILLANCE r-

TUNCTIONAL UNIT CHECK CALIBRATION TEST REQUIRED h,l

-4 E 6. LOSS OF POWER N.A N b-1,2,3,4 ro - a. 4.16kv Emergency Bus M.A. R M rp - 1. Undervoltage (Trip Feed) 2. Undervoltage (Start Diesel) N.A. R M N.S-N h _1, 2, 3, 4 I>' b. 4.16kv Emergency N.A. R M N.A. N.h-1,2,3,4 7) Bus-(Degraded Voltage) c. '480 Volt Emergency Bus N.A. R M N.h. N' b-1,2,3,4 o )G (Degraded Voltage) o"- 7. AUXILIARY FEEDWATER* E M(1)-8 N G.h 1,2,3 Automatic Actuation Logic and. N.A. N.A. o a.

2 Actuation Relays b.

Steam Generator Water Level--Low-tow 1. Start Turbine Driven S R M N h-N b 1, 2,.3 Pump 2. Start. Motor Driven S R M N !\\. N. k. 1, 2, 3 ' Pumps c. Undervoltage - RCP (Start S R M N.A. N.b 1, 2 Turbine Driven Pump)

Manual initiation is included in Specification 4.7.1.2.

=.

TABLE 4.3-2 (Continued) 9

gi ENGINEERED SAFETY FEATURE ACTUATION SYSTEN INSTRUMENTATION

= 5URVLILUWE.t REQUIREMENIS <YE CHANNEL MODES IN WilCH CHANNEL CHANNEL FUNCTIONAL SURVEILLANCE 7 FUNCTIONAL UNIT CHECK CALIBRATION TEST REQUIRED E 7. AUXILIARY FEEDlWLTER (continued) m d. Safety Injection (Stari..% tor-See 1 above (all SI surveillance requirements) Driven Pumps) e. Trip of Main N.A. M.A. R 1,2,3 I Feedwater Pum)s (Start Motor ) riven Pumps) 8.. ENGINEERED SAFETY FEATURE INTERLOCKS o ] 3 a. Reactor Trip, P-4 N.A. N.A. R(3) 1, 2, 3 m m L b. Pressurizer Pressure, P-11 N.A. R M 1, 2, 3 E c. Low-Low T,,,, P-12 N.A. R M 1, 2, 3 + 4 ,t a Nrr) H b r"7 uN b 2 --I e6 F1 5 ~

gp m a A

Q P TABLE 4.3-2 (Continued) F ,1 ENGINEERED SAFETY FEATURE ACTUATION SYSTEM INSTRUNENTATION W m = SURVEILLAnu RtQUIRtMtMI5 [ SURVEILLANCE E CH4felEL PRIDES IN WICH FUNCTIDW L WIT CHAfsIEL CHANNEL FUNCTIONAL 4# CHECK CALIBRATION TEST REQUIRED -4 5 7. AUXILIARY FEEDETER (continued) {1 r-

d.

Safety Injection (Start Motor-See 1 above (all SI surveillance requirements) m; m Driven Ptmps) g bl A N b 1, 2, 3 h e. Trip of Main-- N.A. N.A. R Feeduster Pun n 'p: I (Start Motor-Priven Pumps). P' 8. ENGINEERED SAFETY FEATURE INTERLOCKS 7_ g -a. Reactor Trip, P-4' N.A. N.A. R' N. A. N. A. 1, 2, 3 b. Pressurizer Pressure, P-11 N.A. R M N.h W A 1, 2, 3-o c. Low-Low Tave, P-12 N.A. R M N A N A 1, 2, 3 .:c .. N - i v

l l l TABLE 4.3-2 (Continued) DU.ETE TABLE NOTATION (1) Manual actuation switches shall be tested at least once per 18 months durino shutdown.JThis 18-month surveillance interval during the f rst /TUel cycle may be extended to coincide with completion of tie first [ refueling outage for Containment Spray, Safety Injection and Feedwater L Isolation and Phase B Isolation manual actuation switches. J All other circuitrv associated with manual safeguards actuation shall receive a CHANNEL FUNCTIONAL TEST at least once per 31 days. (2) Each train or logic channel shall be tested at least every other 31 days. (3) Th: :;::ified :tteve411:n;: interv:1 during the fir:t feel eye 4

r. y be 4 extended t: +kcide with complet4 r Of the first-Pefueling eet:ge.

re b s A b k s \\is-(sj o \\ l eusk ow e. oC he A\\ievaing Slove y ccderm c r c. ne p ced h be. k nchienall 4=tked on a re6h y 3 4rysm) bsi.s eni) ; oil dbr slove. re b a w i\\\\ b e 4es h J y guacher\\).fre usw sj. ow u A single failure in the Safeguards Test Cabinet circuitry would cause 4. an inadvertent RPS or ESF actuation, b. The test will adversely affect two or more components in one ESF system or two or more ESF systems. C. The test will create a transient (reactivity, thermal, or hydraulic) condition on the RCS. BEAVER VALLEY - UNIT 2 3/4 3-38 (fbposed Wo '^

ATTACHMENT B Beaver Valley Power Station, Unit No. 2 Proposed Technical Specification Change No. 47 REVISION OF TECHNICAL SPECIFICATION 4. 3. 2.

1.1 DESCRIPTION

OF AMENDMENT REQUEST e proposed amendment would allow slave relay testing to be nducted on a refueling frequency for those slave relays which tisfy certain screening criteria. The slave relays which do not tisfy the screening criteria will continue to be tested on a arterly test frequency. A Master Relay column and a Slave Relay lumn would be added to Table 4.3-2 to denote required test equencies and applicable notes. A new Table Notation (3) would be ded which specifies the previously mentioned screening criteria for arterly testing of slave relays. A note would be added to Table 3-2 Item 3.b.2 to denote that this item includes testing of CIB tuated slave relay (s) associated with control room emergency ntilation. Part of Table Notation (1) and the entire Table tation (3) would be deleted since they were only applicable for the est fuel cycle. BACKGROUND following information describes slave relay testing as applicable e Beaver Valley Power Station (BVPS) Unit 2 solid state protection stem (SSPS). Slave relays are tested to comply with Technical ecification 3.3.2.1, Surveillance Requirements 4.3.2.1.1, Table 3-2 for actuation relays. A note at the bottom of Technical ocification page 3/4 3-15 states in part: "The test of -slave relays (to be performed at least once per 92 days in lieu of at least once per 31 days) shall include, as a

minimum, a

continuity check of associated actuation devices that are not testable." tuation devices are considered to be equipment (i.e. pumps, valves, nors, etc.) that function upon slave relay actuation. 3 solid state protection system output slave relays were designed r contact multiplication from the master relays to actuate various Jineered safety features (ESP) components directly or through <iliary relays. The system was provided with a test cabinet for sting the slave relays. The test circuitry will actuate the slave lays and either allow equipment to operate (go testing), or block 3 operation (blocked testing) if it will result in an adverse 3act on the unit. The original design of this test circuitry did consider all operational factors which may lead to reduced level safety while performing-slave relay testing during plant 3 ration. Attachment B-2 titled " Test Circuit Operation" contains a

hnical description of the three basic types of test circuits used the safeguards test cabinet.

Attachment B-3 titled " Safeguards iting Cabinet Blocking Circuit Failure Analysis" contains an 11ysis of the types of failures that can occur in blocking type it circuits.

TTACHMENT B, continued roposed Technical Specification Change No. 47 age 2 ertain equipment cannot be re-positioned by slave actuation at power ithout resulting in a reactor trip. Therefore, these slave relays are blocking schemes incorporated in the test circuit design. Other SPS slaves if actuated individually cause partial ESF actuations and quipment operation. In anticipation of such undesirable resalts, bny systems must be manipulated extensively to prepare for a slave [alay test and re-aligned after testing to restore plant conditions "a normal syst em arrangement. In many

cason, equipment is

.eliberately disabled by closing a valve or opening a component Iroaker to acconmodate continuity testing. In several instances, freakers are racked to the test position, control power fuses pulled }nd jumpers installed to allow use of a MCC TEST SET to verify santactor actuation. Once a component's status is altered to prepare lor a relay

test, it is no longer available to perform its design afety function if called upon.

Without local operator action to eset the relay in test and/or restore system mechanical and lectrical alignments, the ESP equipment would not perform as

pected, n

the interest of prompt restoration in the event of an actual ESF

ignal, each slave relay test includes a precaution to return all 2st switches to normal.

The reset switch in the test cabinet is mmon and would result in at least momentary reset of ALL SLAVE CLAYS in that Train. The consequences of such action are 1 predictable due to time dependence (whether valves have reached the ill stroke

limit, etc.),

which relay was under test, and what ESF ignal was received. >erations personnel have always been concerned about performing SSPS lave relay testing outside the design of the Solid State Protection / stem. Deliberately disabling ESF equipment or closing a normally >e n valve to demonstrate that it will open on slave actuation, or opping a pump, re-aligning a flow system, then re-starting the pump ith slave actuatie= seems to be an unnecessary cycle of equipment id potentially dangerous. The potential for undesirable system ansients is very high. en blockable ttsting of slave relays involves some risk. This was ident when one MG-6 relay failed to block during undervoltage ! sting of a normal 4160 volt bus. A reactor trip occurred due to e trip of a reactor coolant pump. (See IR2-8r-35 and LER 2-88-07 1 4-4-88). A blocking relay failure during SSPS slave relay testing Juld occur with similar undesirable results. Tother area of concern is human error. Due to the number of people ivolved and the complex nature of the testing, significant potential ir human error exists, one possible scenario might be actuation of e incorrect relay. This could be very significant since test nditions are established to expect certain equipment to actuate or ns t continuity in a disabled state. Actuation of the incorrect >1ay would start equipment whose associated system valves may be -energized in the non-ESF position. This is the case because

ATTACHMENT B, continued Proposed Technical Specification Change No. 47 Page 3 several relays are used for each ESF

function, (i.e.- sic

CIA, CIB/ Containment Spray Actuation) and components actuated by a single relay are not always consistent with system needs.

By design, unless all relays for a train of SSPS actuate at the-same time a safety system will not function as expected. Since November 1987, BVPS Unit:2 has-been performing SSPS slave relay testing on a quarterly basis to comply with technical specification-requirements. To

date, there have been no SSPS relay. failures to actuate upon demand.

In

contrast,

~ documenting-inadvertent >ESF several incident and-licensee event reports have been written actuations and other undesirable conditions during such testing. The licensee event and incident reports are as follows: LER 88-016 Auto start of B chemical-injection. pump IR 2-89-83 - Incorrect test method-trip startup feed pump-on'SSPS relay actuation LER 90-004 Charging valve-closure when breaker was closed before SI reset. LER 90-009 Letdown isolation on loss of containment air-pressure Since the onset of testing, surveillance test procedures have been revised numerous times to reduce the potential for causing a plant upset while still complying' with technical specification requirements. C. JUSTIFICATION The proposed change would; allow slave relay testing to be conducted a-: refueling-frequency for those slave relays which satisfy any of on the following criteria: 1) A single failure - in the. safeguards' test 1cabinetfcircuitry ~ would cause an inadvertent reactor 1 protection system-(RPS)- or engineered safetyLfeature (ESP) actuation. 2) The test-will adversely affect'two or more components 'in one ESF system or two or more ESF: systems. 3). The test ~ will create a-transient (reactivity, thermal, or 'I hydraulic) condition on the-reactor coolant system (RCS)'. These criteria are the same that were approved under' Amendments 123 and 107,- (TAC;NOS, 73236 and 73237), for Virginia _ElectrionandoPower-Company North 7 Anna Units 1 and 2. In accordance -with the. Safety Guide-22, actuation-devices and actuated-equipment' are to be' designed:to permit: testing during power-operation.' If this operation could damage plant equipment or disrupt-reactorL operation, alternative methods for testingLare provided in the Safety' Guide. -These methods include testing relays in judiciously selected groups, preventing the operation of certain

ATTACHMENT B, continued Proposed Technical Specification Change No. 47 Page 4 actuated equipment, or designing the system so that it requires more than one actuation device to operate the equipment. In any case, actuation devices and equipment should be tested. As stated in Section D, part 4 of Safety Guide 22, where actuated equipment can not be

operated, it should be shown that there is no practicable design to permit operation of the actuated equipment, there is a low probability of

failure, and the equipment can be tested during shutdown.

Safety Guide 22 provides guidance when the design Will not allow s6fe k testing of plant equipment. The slave relays which meet at least one of the three proposed screening criteria that were previously stated would satisfy Section D, part 4a of Safety Guide 22. A summary of specific relays which meet this criteria is shown in Attachment B-1. A summary of failures that can occur in a blocking circuit are provided in Attachment B-3 and are supported by proposed screening criteria No. 1. A fourth criteria is also stated in Attachment B-1, which is for slave relays which can be tested during plant operation. Safety Guide 22 Section D, part 4b and 4c states, "The probability that the protection system will fail to initiate the operation of the actuated equipment is, and can be maintained, acceptably low without testing the actuated equipment during reactor operation, and the actuated equipment can be routinely tested when the reactor is shut down". A high level of confidence that the relay will perform its safety function will be maintained by the system design and testing. The slave relays are designed to be normally de-energized there-by reducing their susceptibility to failure modes common to energized components. Master relay tests will still be conducted on a quarterly frequency. Master relay tests include a coil-continuity of the slave relays. A limited number of-slave relays will continue to be tested during plant operation (see Attachment B-1, Criteria (4)). By testing a portion of the slave relays eaca quarter, there is a reasonable time limit in which common-modo failure could be detected. A total ESF functional test every refueling outage will ensure that all slave relays and auxiliary contacts function properly. To date, there have been no SSPS relay failures to actuate upon demand. Considering the reliability of the SSPS relays, coupled with the fact that there are two-safety trains, the probability of a slave relay failing to actuate is extremely low and the_ probability for its redundant relay failing concurrently-is even lower. Therefore, the proposed change to the SSPS relays test frequencies is consistent with Section D, part 4-of Safety Guide 22. The reduction in the scope of slave relay testing is also consistent with the NRC Policy issued October 26, 1988 (Secy 88-304) regarding " Staff Actions to Reduce Testing. at Power" wherein the stated ultimate objective is to climinate testing at power.for-equipment where acceptable reliability can be achieved without such testing. Based on the

above, there is reasonable assurance that the relays will function as required with the proposed testing schedule.

A reduction in the number of slave relays which are required to be tested on a quarterly basis would save approximately 180 man-hours of operator time each quarter and remove eight surveillance tests

HMENT B, continued > sed Technical Specification Change No. 47 5 ,ving sixty-eight different SSPS slave relays and reduce human f potential. Each relay test, whether Blockable or Go testing, ! the potential to cause a plant upset, reactor trip or forced lown should test circuit failure or operator error occur. On the

ige, Go testing involves four to eight operators, Blockable

. rug takes three to four operators, and SIS Go testing involves to twelve operators. Blockable testing normally is performed in

to two hours where Go testing takes the entire shift.

Due to the .ex nature of testing and system alteration /re-alignments, only slave relay test (5-6 relays per test) is scheduled each week a 10 week period. i relay testing results in undue hardship and unusual

imstances without a compensating increase in the level of quality Lafety.

It provides increased opportunity for human error (as in previously noted LER's) as complex controls - involving incing jumpers and lifted leads, special test equipment, special

rical and mechanical alignments in multiple locations under

.!d plant specific conditions challenge both operator and edures. It also results in many hours of plant operation with ided safeguards status. 'i be added to Table 4.3-2 Item 3.b.2, which would state >te e this item includes testing of CIB actuated slave relay (s)

iated with control room emergency ventilation.

This change will .f y that in addition to the Surveillance Requirement 4.7.7.1.e.6, i requires that the control room bottled air pressurization om is initiated from a CIB signal on an 18 month frequency, the tbility of CIB actuated slave relays associated with the control emergency ventilation system is required to be demonstrated iBLE in accordance with surveillance requirement 4.3.2.1.1. 2/3 chlorine detectors / control room isolation actuation relays l A/ K6308) are included in Attachment B-1. These relays were tted to be tested as part of SSPS on a quarterly frequency as d in a DLC letter to the NRC (2NRC-7-128) dated May 22, 1987. ng of the K630A/K630B relayn, which isolates both trains of the ol room emergency pressurization

system, on a

quarterly ency creates that same operational impact and degrades overall safety as does many of the other relays included in Attachment Therefore, these relays are included to justify changing their frequency from quarterly to refueling. AFETY ANALYSIS additional assurance of equipment operability provided by testing slave relays on line is negated by the adverse consequences such the overall margin of safety is reduced. The testing of certain y relays on line requires significant plant manipulations, mal configurations, and the removal from service of various

ACHMENT B, continued posed Technical Specification Change No. 47 1pment for the duration of the slave relay test. (See Attachment

).

By imposing off-normal plant manipulations and configurations,

re is an increased probability of human error or component lfunction which may lead to more significant events.

In the event actual demand was required during this time, some equipment would be available to perform its intended safety function. The safety lications of this are significant when considering that a single dure on the opposite train could result in a total loss of an ESF pty function. This could also lead to a more safety significant ht and could cause the BVPS Unit 2 design basis and accident $1ysis to be exceeded, any ESP component fails to actuate due to a malfunction or failure a slave relay or its

contacts, adequate testing, design, and t

<inistrative controls exist to ensure that the mitigative function ESF equipment can be relied upon to perform the required safety sted function. The majority of all ESF equipment (i.e., pumps and /es) is tested at least quarterly by the BVPS Unit 2 Inservice 2 (IST) Program These tests verify equipment operability as L as the operability of the manual actuation circuitry. The lal actuation circuitry was designed such that a failure of the

re relay will not prevent the equipment from being manually nted.

Therefore, if a slave relay fails, manual actuation is

Li available.

Immediate actions described in the emergency ?; ting procedures ensure that all equipment actuates by requiring manual actuation for equipment which may not automatically rate. Major equipment is verified immediately while verification e all equipment takes approximately five minutes to perform.

krofore, the reliability of ESP equipment to perform its safety

tion remains

high, and any additional assurance provided by

.ing all of the relays on line does not outweigh the possible

equences incurred as a result of current slave relay testing, reliability of the slave relays has been effectively demonstrated recognizing that no slave relay has ever failed to actuate upon ind.

Testing some of the relays, but not all, provides adequate

rance of equipment operability and relay reliability without ecting the unit to compromising conditions.

Such testing has the 'all effect of increasing the margin of safety.

efore, this change is considered safe based on the reduction in associated with testing all the slave relays on line.

Current ing is not justified by the circuit failure analysis, operational et. and safety significance when there presently exists adequate gn

features, sufficient, safe and proven testing methods, and nistrative controls to assure proper equipment operation.

_ NO SIGNIFICANT HAZARDS EVALUATION The no significant hazard considerations involved with the proposed amendment have been evaluated, focusing on the three standards set forth in 10 CFR 50.92(c) as quoted below:

L ATTACHMENT B, continued Proposed Technical Specification Change No. 47 Page 7 i t The Commission may make a final determination, pursuant to the procedures in paragraph 50.91, that a proposed amendment to an operating license for a facility licensed under paragraph 50.21(b) or paragraph 50.22 or for a testing facility involves no significant hazards consideration, if operation of the facility in accordance with the proposed amendment would not: \\ (1) Involve a significant. increase in the probability or l consequencen of an accident previously evaluated; or i (2) Create the possibility of a new or_different kind of accident from any accident previously evaluated; or-(3) Involve a significant reduction in a margin of~ safety. 1 The following evaluation is provided for the no significant hazards consideration standards. g 1. Does the change involve a significant increase in' the probability or consequences of an accident previously evaluated? The design and safety . function. of the ESF system. and associated equipment have not changed. The availability of ESF components (i.e. pumps and valves) has increased by not placing them in off. normal configurations. This has the q effect of decreasing the'-probability and consequences of previously evaluated accidents. The reduced surveillance J frequency for slave: relays will not cause a.significant increase in the probability-or consequences of.an accident previously evaluated due to the demonstrated very low failure [ rate of the slave -relays. Therefore, the-proposed change 1 does not involve a significant increase in the probability or consequences of an accident previously~ evaluated. j 2. Does the change create the possibility-of a-new-or different kind of accident from-any accident previously evaluated? The design and safety ~ function of any; component or-system has not been changed. Loverall system availability is_ increased by not testing certain' slave relays-during plant operation and the probability of. challenging single. failure accident analysis is-reduced. Therefore, the proposed changes do not. create the' possibility of a new or different kind of accident .] previously evaluated. ~ 3. Does the change involve a significant reduction in a margin of safety? The proposed change will; continue to ensure that the ESF protection system' maintains-an overall system functional capability. comparable to the original design standards. The 1 .i

ATTACHMENT B, continued Proposed Technical Specification Change No. 47 Page 8 documented SSPS relay failure rates show a high level of reliability. By continuing to test a portion of the slave relays each quarter, there will not be a significant reduction in the margin of safety due to an undetected common mode failure. Any perceived decrease in the margin of safety through reduced frequency testing will be offset through fewer abnormal plant configurations, including significant plant manipulation, and removal from service of various plant equipment. Therefore, the proposed change does not involve a significant reduction in a margin of safety. F. NO SIGNIFICANT HAZARDS CONSIDERATION DETERMINATION Based on the considerations expressed above, it is concluded that the activities associated with this license amendment request satisfies the no significant hazards consideration standards of 10 CPR 50.92(c)

and, accordingly, a

no significant hazards consideration finding is justified. G. ENVIRONMENTAL EVALUATION The proposed changes have been evaluated and it has been determined that the changes do not involve (1) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amount of any effluents that may be released off site, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed changes meet the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22 (c) (9). Therefore, pursuant to 10 CFR 51.22 (b), an environmental assessment of the proposed changes is not required. H. UFSAR CHANGES Attachment D provides changes to the UFSAR to accommodate the proposed revisions to the slave relay testing requirements. The UFSAR changes are provided for information only -and will be incorporated following approval of the proposed rechnical Specification changes.

ATTACHMENT B-1 Beaver Valley Power Station, Unit No. 2 Propoced Technical Specification Change No. 47 Equipment Testing Requirements Evaluation The attached evaluation provides the basis for which SSPS output relays should not be tested during plant operation.

Attachment B-1, continued Propoced Technical Specification Change 2A-47 Page 2 of 54 EOUIPMENT TESTING REOUIREMENTS EVALUATION The attached data sheets identify the SSPS output relays for one train which perform an ESP function. The other train is similar; any differences will be noted. The data sheets describe the signal which actuates the relay and lists the major equipment tested by the relay and the type of test performed (Block or Go). The data sheets also describe the design

function, operational impact of testing, and safety significance of testing each relay.

The relays are grouped by actuation signal. The first relay in each group describes the function of the actuation signal. The remaining relays in the group do not repeat the function of the actuation signal to eliminate redundancy. Details on why specific equipment is actuated by each relay is located in each design function description. Based on operational impact and safety significance of testing, the relays have been categorized according to the following: Category 1: A single failure in the safeguards test cabinet circuitry would cause an inadvertent RPS or ESF actuation. Category 2: The test will adversely affect two or more components in one ESP system or two or more ESF systems. Category 3: The test will create a transient (reactivity, thermal, or hydraulic) condition on the RCS, Category 4: Testable during plant operation. A summary of specific items such as test category and actuation signal are contained in Tables 1 and 2. The results below show how many relays fall into each category: Category 1: 13 Relays Category 2: 48 Relays Category 3: 7 Relays Category 4: 6 Relays i

w.,... At+m ;._,L B-1, contirned Fwycsed Technical Specification Change 2A-47 Page 3. 'of 54 TABLE 1 Train "A" Relay Test Cateaory Actuation Sianal M Test Plan Pane # K602A 4. Safety Injecticm (SI)- Go Quarterly / Refueling '7 f K603A/K603XA 2 SI Go Refuelirg 8 K604A/K604XA 2. SI Go Refuelirg 10 -K609A' -2 SI Go Refueling 12 K610A/K610XA 3 SI ~Go Refueling 14 .- K611A/K611XA 2 SI Go Reibeling 16 K605A 3 Containment Isolation -Go Refueling 18 Ihase AL(CIA) K606A 2 CIA .Go Refuelirg '22 b ' !?'97A - 1 CIA Blocked Refieliog 24 1K612A:- .'4_ CIA - Go Quarterly / Refueling 25 K613A/K613XA: 2. CIA-Go Refuelirg 26 K614A/K614XA~ 2 ^ -CIA Go Defuelirg 28 .K618A/K618XA. '2 (bntairmnent Isolation - Go-Refueling 30-Ihase B (CIB) - ~K619A 1: CIB: Blocked Refueling 32 K626A/K626XA.' 2

CIB Go Refuelirg 33

[__ ~

i Attad==d. B-1, continticd - 3F1.vrxsed Technical Specification Change 2A-47 Page 4 of 54~ TABIE 1; Continued Train "A" Relav Test Cateaory Actuation Sianal Type Test Plan Paae # K643A' 2 ' CIB/ Spray Actuation Go Refueling 35 - K644A 2 CIB/ Spray Actuation Go Befueling 37

K645A 2

CIB/ Spray Actuation Go Refueling 39 K621A-1 Feedwater Isolation Blocked /Go' Refueling 42 ' K622A 1-Feedwater Isolation Blocked Refueling 43 K616A 4 Steam Line Isolation Go Quarterly / Refueling 45- ~ K623AI -1. Steam Line Isolation Blocked Refueling 46-K632A-Reactor trip Go Refbeling 47 - K633A J2 ' 2/3 S/G Isvel Iow-Iow .Go Refueling '47 K634A 2' 2/3 S/G level low-Iow .Go Refueling 49 K635A .~ 1 ' Ttirbine trip Blocked Refbeling 50 K625A 2L CIB/Cbntrol Room Isolation Go Refueling 51 K630A.- 2 ' Chlorine /Cbntrol Rocan Go Refueliry 53 Isolation d >

'M

'^"# -~"' ~ ~' ' ' ~ ~ " " - - ' - ~ ~ ~ - " ' ' " * ~ ' ~ '#~

Attachment B-1, continued Pwpusei Technical Specification Change 2A-47 Page 5 of 54 TABIE 2 l Train "B" Relay Test Catenog Actuation Sicnal Tvoe Test Plan Pace # K602B 4 Safety Injection (SI) Go Quarterly /Refuelirg 7 K603B/K603XB 2 SI Go Refueliry 8 K604B/K604XS 2 SI Go Refuelirg 10 i K609B 2 SI Go Refuelirg 12 K610B/K610XB 3 SI Go Refuelirg 14 K611B/K611XB 2 SI Go RefueliIg 16 K605B 3 Cantainment Isolaticri Go Refuelirq 20 Rnse A (CIA) K606B 2 CIA Go Refueling 22 K607B 1 CIA Blocked RefueliIg 24 I K612B 4 CIA Go Quarterly /Refuelirg 25 K613B/K613XB 2 CIA-Go Refuelirg 26 K614B/K614XB 2 CIA Go Refuelirg 28 K618B/K618XB 2 Containment Isolation Go Refuelirg 30 Ihase B (CIB)

-Attachment B-1, m ntinued . Proposed Technical Specification Qiange 2A-47 Page 6 of 54 TAnTR 2: Continued Train "B" Relay Test Cateaory Actuation Sicnal Tvoe Test Plan Pace # K619B 1 CIB Blocked Refueling 32 K626B/K626XB 2 CIB Go Refueling 33 ) 2 CIB/ Spray Actuation Go RefueliIg 35 K643B K644B ~2 CIB/ Spray Actuation Go Refuelirg 37 i K645B 2 CIB/ Spray Actuation Go Refueliry 39 K601B 1 Feedwater Isolation Blocked Refueling 41 K620B 1 Feedwater Isolatim Blocked Refm ling 41 K621B 1 Feedvater Isolation Blocked /Go. Refueling 42

K636B 3

Feedwater Isolation Go Pefueling 44 K616B 4 Steam Line Isolatico Go Qaarterly/ Refueling 45 K623B 1 Steam Line Isolation Blocked Refueling 46 K632B 2 Reactor Trip Go Refueliry 47 K633B 2 2/3 S/G IcVel Im-Im. Go Refueling 47 .K634B 2 2/3 S/G Ievel Im-Im Go Refueling 49 K635B 1 'Jurbine Trip Blocked Refueling 50 K625B1 -2 CIB/ Control Roce Isolation Go Refueliry 51 K630B' 2 dilorine/ Control Roca Go Refueling 53 Isolation -r

Attcchm nt B-1, continutd Proposed Technical Specification Change 2A-47 Page 7 of 54 RELAY: K602A (Train-B Relay K602B testing identical) ACTUATION SIGNAL: Safety Injection .i TEST CATEGORY: (4) RELAY ACTUATION TYPE: (Go) i MAJOR EOUIPMENT ACTUATED: 1. Trip.[2HVR*FN202B1) Control Rod Drive Mechanism (CRDM) shroud cooling fan. 2. Close (2SWM*MOV562) [2SWM*MOV56%) chlorine injection to A&B service water headers 3. Open (2HCS*SOV133A) (2HCS*SOV134A) Hydrogen ' analyzer isolation valves. DESIGN FUNCTION: The ~K602A relay actuates' on a. safety injection signallwhich protects against a loss-of-coolant, steam generator tube rupture, i or a steam line break, accident. -Automatic actuations of the safety. injection system ensures that emergency core: cooling-and reactivity control are provided.= -The K602A relay,tripsithe no longer required shroud cooling' fan and isolatesctheinon-safety grade chlorine injection lines, to prevent an undesired leak path.. The-l hydrogen analyzer valves ~are. opened to initiate campling of the containment atmosphere for-hydrogen.: OPERATIONAL IMPACT OF TESTING: 1. Operator = action is needed tofstart the CRDM? fan-if not in. serviceLand-.to re-align after relay-testing. 2. Operator action is needed Eto place the^ chlorine injection system back-in service after relay testing.. 3. Operator, action is needed to re-align hydrogen'anklyser valves after. relay testing.

SAFETY SIGNIFICANCE OF> TESTING:.

1. The CRDM fans: are used in-the EOPs to cool the reactor'headiand minimize-steam! bubble formation during.a natural: circulation cooldown. Repeated cycling of the fans increasesttheilikelihood of motor and blading

failure, repair ~of whichLwould requireLa planti shutdown.

The: fans also-exhaust the reactor, coolant; pump a r cubicles and'Jcool the control 1 rod drive coil stacks;and< digital -rod position < indication. coils, both of which are" temperature; sensitive. d

Attachhtnt B-1, continued Proposed Technical Specification Change 2A-47 Page 8 of 54 4 EELAY:

K603A, K603XA (Train-B Relays K603B,. K603XB testing identical)

ACTUATION SIGNAL: Safety Injection TEST CATEGORY: (2) RELAY ACTUATION TYPE: (Go) MAJOR EQUIPMENT ACTUATED: 1. Contactor actuation for (2CHS*LCV115B) RWST supply to charging pumps 2. Contactor actuation for (2CHS*LCVll5C) VCT supply to. charging pumps 3. Contactor actuation for (2CHS*MOV289) normal charging isolation 4. Open [2 SIS *MOV867C) cold leg injection valve (flow remains isolated) 5. Trip (or centactor actuation) for (2HVR*FN201A(C)) CNMT air recirculation fans 6. Trip (or contactor actuation) for- [2HVR*FN202A1) CRDM shroud cooling fan 7. Trip (or contactor actuation) for [2RCP*H2D);PRZR heater backup group D DESIGN FUNCTION: The K603A and K603XA relays actuate on a. safety injection (SI) signal. These relays open or close valves necessary to ensure that a flow path exists from the. refueling water storage tank (RWST) to the reactor core via the high head injection pumps during the initial phase of SI. The containmentJair recirculation and the control rod drive mechanism cooling fans are tripped by these relays since they are no longer required. The pressurizer backup heaters are tripped by these relays for the same-reason. OPERATIONAL IMPACT OF TESTING:- For items 1 thru 3 (above) If allowed-to actuate, the normal-charging valve:would begin to. close -as the RWST supply -valve begins to open.- When the RWST l supply' valve is fully open the VCT isolation valve would begin to close. For the duration of this test a boration of the RCS will The boration rate.would be at lease 15.gpm assuming seal occur. injection flow only. The significance of=this boration increases with core life. In-addition pressurizer level would decrease t 1

Attach;0nt B-1, continutd Proposed Technical Specification Change 2A-47 Page 9 of 54 1 unless letdown was isolated. One method to test this relay and contacts would require going on excess letdown and diluting the RCS to allow rods to compensate for the boration. Boration is undesirable, therefore, contactor actuation is the method used to verify relay actuation. This

method, however, requires the breakers for these valves to be placed in the OFF position rendering their automatic functions inoperable.

With the MCC breukers in the OFF position to remove 480 VAC from the valve

motors, leads are

lifted, control power fuse pullad and a MCC test set is attached to each of the three valve breakers in succession.

This test s.t uses three hookup leads and jumpers 120 VAC to the line starter to verify contactor actuation without valve motion. While these checks are performed, the slave relay is in test and is not reset until all breakers have been checked. Also electrical maintenance personnel are required to lift leads prior to the slave test and to re-land the lead after testing. Iluman error resulted in isolating charging to the RCS when a breaker was inadventenly re-closed before the SIS signal was reset during performance of this slave relay tecting (See LER 90-004-01). 1 For Items 4 thru 7 (nbove) These components are allowed to actuate and require operator action to restore to. pretest conditions. For containment air i recirculation

fans, if tripping is not desirable, relay cantacts are visually observed to have changed position.

Restoration I requires cycling the breakers to ruset the relays. SAFETY SIGNIFICANCE OF TESTlHgt One train of high head SI is made inoperable by de-energizing the valves which are required to align the high head safety injection pumps to the RWST. A single failure of the redundant train will result in loss of the initial phase of emergency core cooling and reactivity control. 1 I

u Attachmont B-1, continued Proposed Technical Specification Change 2A-47 Page 10 of 54 RELAY:

K604A, K604XA (Train-B Relay K604B, K604XB testing identical except that common HHSI mini-flow isolation 2CHS*MOV373 is rendered inoperable for contractor actuation using the MCC test set with its breaker OFF).

ACTUATION SIGNAL Safety Injection Tgst Catecory (2) RELAY ACTUATION TYPE (Go) MAJOR EQUIPMENT ACTUATED: 1 1. Open (2 SIS *MOV867A) cold leg injection 2. Contactor Actuation (or circuit continuity) for (2 SIS *MOV865A) "A" Accumulator discharge i 3. Trip (2HVR*FN202Cl) CRDM shroud cooling fan i 4. Trip (2RCP*H2A) PRZR heater backup group A 5. Trip (2HVW*FN269A) Alternate intake structure exhaust fan-6. Closure (or contactor actuation) for (2CHS*MOV275A, B, C) HHSI mini-flow recirculation valves DESIGN FUNCTION: The K604A and K604XA relays actuate on-a safety injection (SI) signal. ,These relays open the valve which' establishes cold leg injection to the reactor coolant system. _The relays also ensure i that,the accumulator discharge valve-is.open and capable of I performing its passive core injection function.- The three-(items-3-5) are tripped since they are no; longer electrical loads required. The mini-flow recirculation valves are closed to ensure all SI flow is directed to-reactor core. OPERATIONAL IMPACT OF TESTINGt i For Item 1 The cold leg injection: valve-is allowed to-open and: requires operator action-to re-close after slave testing. For Item 2 Sincef the accumulator-. discharge valve.cannot be closed:during power operation, slave actuation _is verified by banana 1 jack white light illuminated.- If the valve is closed:during shutdown, slave y actuation is verified by continuity measurement at contactor-l terminal points. _ Restoration after slave ' actuation-requires operator action to cycle the power breaker 10FF'then ON. i i

Attachmont B-1, continued i Proposed Technical specification change 2A-47 Page 11 of 54 For Items 3 thru 5 These components are allowed to trip during slave actuation. Operator action is required to energize this. equipment if not in operation and to restore to pretest conditions. ] For Item 6 Testing these valves. requires operator-action to open the recirculation velves for the charging pumps not in service. For the in-service charging pump,iresthe Mcc test set is used to verify contactor actuation but requ the valve to be de-energized rendering. Its auto closure function inoperable for the duration of the test. ] SAFETY SIGNIFICANCE OF TESTINGt i The auto closure function for the charging pump mini-flow recirculation is inoperable for the duration of the test. The auto closure function ensures that total flow from the charging pumps goes to the safety-injection system for reactor core cooling and reactivity control. One train of high head: safety injection is degraded for the duration of this test. l I

I Attcch2 nt B-1, continurd Proposed Technical Specification Change 2A-47 Page 12 of 54 3 4 EELhY: K609A (Train-B Relay K609B testing identical) I l 1 ACTUATION SIGNAL: Safety Injection l IEST CATEGORY: (2) W RELAY ACTUATION TYPE: (Go) MAJOR EQUIPMENT ACTUATED: 1. Start (2SWS*P21A) service water pump I 2. Start (2CHS*P21A) HHSI pump (High Head Safety Injection Pump) j 3. Start [2 SIS *P21A] LHSI pump (Low Head Safety Injection Pump) 4. Start (2SWS*STRN47] Train A service water seal water strainer 5. Closo (2SWS*SOV118A) normal filtered water supply to SWS pumps 6. Close (2QSS*AOV120A) suction to RWST cooling pumps DESIGN FUNCTION: The K609A relay actuates on a safety injection (SI) signal. This relay starts a service water pump which provides cooling water to the recirculation spray heat exchangers. Additionally, a high head and a low head safety injection pump are started to provide emergency core cooling immediately following a loss of coolant i accident. The normal filtered water supply to the service water pumps and the RWST cooling are isolated since-they are no longer required. OPERATIONAL IMPACT OF TESTING: For Item 1 This is an unnecessary start of the service water pump. If it is the running pump, then the other pumps must be-realigned and the "A" pump shutdown to verify its starting or its breaker closing in test. Also standby service water pump (2SWE*P21A) is placed in service contrary to biota control. For Item 2 This is an unnecessary' start of a charging pump. If "A" HHSI pump is

running, the other pumps must be realigned and the "A"

HHSI pump shutdown to verify start. Swapping pumps.is a significant-evolution causing transients on the CVCS and the RCP seal injection systems. 1

Attochm:nt B-1, continu:d Proposed Technical Specification Change 2A-47 Page 13 of 54 For Item 3 The normal LHSI pump 21A discherge valve to cold leg injection is closed to align the pump to recirculation which renders the LHSI pump inoperable during the slave relay _ test. This is an unnecessary start of the LHSI pump and requires operator action to return the system to operable status. For Item 4 Leads are lifted in reactor protection rack ~ "A" to simulate actuation of relay

K610A, which is necessary for start of.

[2SWS*STRN47). Leads must be re-landed after the slave is reset. ] For Item 5 This valve is allowed to close and is an unnecessary isolation of i normal filtered water supply to the service water pump seals. It places SWS pump seal water and motor cooling on the backup source of unfiltered river water which contributes to silting of the system. For Item 6 Closure of this valve also trips-(2QSS-P22A and B) causing loss of RWST cooling and requires operator action to restore the system to normal. SAFETY SIGNFICANCE OF TESTINGt A low head safety injection (LHSI) pump is inoperable _for the duration of the test. A single failure of theiredundant train LHSI pump would result in a significant decrease in the flow of-cooling water to the core. The RWST cooling system is. rendered inoperable for the duration of.the test. If cooling to the RWST is not returned to service-in a: timely. manner, the RWST temperature could exceed technical specification limits.- The limit lon RWST temperature is to ensure the maximum peak containment pressure-and -fuel-peak clad l temperature are not exceeded. L E L l .~ ,., ~ :._. . ~

Attcchm:nt B-1, continu d Proposed Technical Specification Change 2A-47 Page 14 of 54 RELAY:

K610A, K610XA (Train-B Relay K610B, K610XB testing similar except for testing "C" HHSI and SWS pumps when powered from the "B" train emergency bus.

Also 21c accumulator discharge valve (2 SIS *MOV865C) relay actuation is verified by white light illuminated or contactor continuity without valve operation) ACTUATION SIGNAtt Safety Injection TEST CATEGORY: (3) RELAY ACTUATION TYPEt (Go) MAJOR EOUIPMENT ACTUATED 1. Start (2CHS*P21C) HHSI (High Head Safety Injection Pump) 2. Start [2SWS*P21C) service water pump 3. Start (2HCS*HA100A] hydrogen analyzer DESIGN FUNCTION: The K610A and K610XA relays actuate on a safety injection (SI) signal. These relays start both a service water pump which provides cooling water to the recirculation spray heat exheangers, and a high head SI pump to provide emergency core I cooling immediately following a loss of coolant accident. A hydrogen analyzer is also started to provide containment sampling l for hydrogen following a loss of coolant accident. OPERATIONAL _ IMPACT OF TESTINGt For Item 1 i This is an unnecessary start of the "C" HHSI pump and may require swapping in-service charging pumps. In order to test, the pump l breaker must be racked on the "A" Train emergency bus and allowed I to auto-start. This evolution requires operator action to electrically and mechanically align pumps for testing. For Item 2 This is an unnecessary start of the "C" service water pump. In order to

test, the pump breaker must be racked on the "A" Train-emergency bus and allowed to auto-start.

This evolution requires operator action to electrically. and mechanically align service water pumps for

testing, and to. startup the stand-by service water system contrary to biota control.

Attoch2Ont B-1, continu;d Proposed Technical Specification Change 2A-47 Page 15 of 54 For Item 3 The hydrogen analyzer is allowed to start and all associated valves to and from containment stroke open. Operator action is required to reposition valves and to cycle the analyzer breaker (off to on) to return the system to a stand-by condition. SAFETY SIGNIFICANCE OF TESTING: A hydraulic transient on the RCS occurs with the start of a second charging pump, affecting pressurizer level control and RCP seal injection. The degradation of the service water system by i biota and silt buildup is accelerated by starting idle service water-and standby service water pumps.

Attach 20nt B-1, continuOd l Proposed Technical Specification Change 2A-47 Page 16 of 54 RELAYt

K611A, K611XA (Train-B Relays

K611B, K611XD Testing identical)

ACTUATION SIGNAL: Safety Injection TEST CATEGDEY: (2) RELAY ACTUATION TYPE: (Go) MAJOR EOUIPMERT ACTUATED 1. Energizo starting relays 2EGA*ES-1 and ES-2 for cmergency diesel generator (2EGS*DG2-1) 2. Open (2HCS*SOV136A,B) hydrogen analyzer 100A inlet valves. 3. Open [2SWS*MOV113A) cooling water inlet valves for 2EGS*DG2-1 heat exchanger 21A 4. Open (2 MSS *SOV120) discharge isolation for radiation monitors 2 MSS *RO101A,B,C. 5. Start [2FWE*P23A) auxiliary feedwater pump DESIGN FUNCTIQH1 The K611A and K611XA relays actuate on a safety injection (SI) signal. These relays align the components necessary to support diesel generator operation in the event a loss of offsite power occurs simultaneously with a LOCA. Each diesel generator is capable of driving all pumps, valves, and necessary instruments associated with one train of ECCS. The main steam high-range i off-line steam detectors are aligned for service to assist in i monitoring plant effluents during and following an accident in which the atmospheric dump valves.and the main steam safety valves may be used as a potential discharge path to the environment. This discharge path may contain radioactive material derived from primary to secondary leakage. The motor driven auxiliary feedwater pump is started to ensure a heat sink is available for the reactor coolant system. A hydrogen analyzer is aligned for service to monitor the containment atmosphere ) following a LOCA. OPERATIONAL IMPACT OF TESTING: For Item 1 Considerable operator action is involved in setup and restoration, including reset of DG 2-1 start failure, as well as support

systems, and re-establishing steam generator blowdown.

Diesel generator 2-1 is inoperable for the duration of this test l because starting l I i 1

4 ) Attochm3nt B-1, continusd Proposed Technical Specification Change 2A-47 Page 17 of 54 -ir is isolated to prevent an unnecessary start. Starting relay actuation is verified by visual observation locally at the excitation panel. For Item 2 Hydrogen analyzer valves are allowed to open. For Item 3 2SWS*MOV113A verified to open. For Item 4 2 MSS *SOV120 verified to open. For Item 5 Auxiliary feedwater pump P23A is inoperable for the duration of the relay test. Its normal discharge valve is shut and the. pump is started in recirculation. This test method. requires. constant communication with operators at the pump and in the control room to meet T.S. Surveillance 4.7.1.2.a.4. In addition the blowdown and blowdown sample valves are shut since they;will go closed on the feed pump start. . Secondary chemistry parameters take an undesirable trend while blowdown is isolated during relay actuation. SAFETY SIGNIFICANCE OF TESTING: A diesel generator and an auxiliary feedwater pump are made inoperable for the test duration. A-single failure of the redundant trains emergency power supply will result in a-complete loss of. these systems. This. would result in BVPS Unit 2 exceeding 10 CFR 100 limits during a design. basis accident. l --.. _,,. ~ -

AtttchmOnt B-1, continu0d Proposed Technical Specification Chango 2A-47 Page 18 of 54 RELhX: K605A (Train-B Relay K605B testing similar, but for valves (2CHS*AOV204) (2RCS*AOV519) and (2RCS-AOV101) see relay K605B cneet) ACTUATION SIGNAL: Containment Isolation Phase A TEST CATEGORY: (3) RELAY ACTUATION TYPE t (Go) MAJOR EOUIPMENT ACTUATED: 1. Close (2CHS*AOV200 A, B, C) letdown orifice 21, 23, 22 isolation valves 2. Close (2 SIS *AOV889) SI accumulator check valve test line isolation 3. Close (2GNS*AOV101-1) SI accumulator nitrogen makeup isolation valve 4. Close (2IAC*MOV130, 133) containment instrument air isolation valves DESIGN FUNCTION: The K605A relay actuates on a containment isolation phase A (CIA) signal as a result of a safety injection signal. The CIA signal is generated to isolate the containment atmosphere from the outside atmosphere in accident scenarios which result in an increased containment pressure. This isolation is accomplished by isolating system piping which penetrates containment and is not essential to reactor protection. Letdown isolation (Item 1) limits RCS inventory loss and mitigates any release in the event of fuel failure. Items 2 thru 4 (above) are lines which are not essential to reactor protection. OPERATIONAL IMPACT OF TESTING: For Item 1 Letdown domineralizers are bypassed by placing (2CHS-TCV143) to the volume control tank position. All three letdown orifice isolation valves are opened (only one is normally open) and allowed to close when relay K605A is actuated. Operator action is required to re-establish normal letdown. Should the letdown valves fail to re-open shutdown may be required due to limited RCS inventory control on excess letdown. l

Attachment B-1, continusd Proposed Technical Specification Change 2A-47 Page 19 of 54 For Item 2 (2 SIS *MOV842) SI accumulator test line isolation (inside containment) is closed while the outside containment valve (2 SIS *AOV889) is cycled. These valves isolate the same containment penetration. Cycling these valves at power is unnecessary since they are normally closed and only used during j shutdown testing of the accumulator check valves. For Item 3 Normally open (2GNS*A0V101-1) is allowed to close when relay K605A is actuated. Failure to re-open would isolate nitrogen to all three accumulators and could result in a plant shutdown if j accumulator pressure cannot be maintained to-technical specification values. For Item 4 Station instrument air is cross-connected with containment l instrument air by opening (2IAC-MOV131) and containment i instrument air compressors (C21A and B)-are stopped. Operator action is needed to re-establish containment instrument air to pretest conditions. SAFETY SIGNIFICANCE QF TESTING: Isolation of RCS letdown during power operation on a quarterly basis can result in thermal transients not accounted for in the design of the system. These transienta may result in exceeding the fatigue usage factor design limits. i yw--t-p-Ww-- wwws-Mge-g-y7 et g r y<q.y ugs -w ,,,9 .g,,,p,r.q...,og g 9 q y .pg p g g., y+a9a9,9 m,.,faiyigy -g .,,,qg,4' q t alr' ? #wF+ 4 95-'f ,e ey

Attcch20nt B-1, continu d Proposed Technical Specification. Change 2A-47 Page 20 of 54 RELAY: K605B (See Relay K605A for similar testing) ACTUATION SIGNAL: Containment Isolation Phase A TEST CATEGORY: (3) RELAY ACTUATION TYPE (Go) MAJOR EOUIPMENT ACTUATED: 1. Loss of continuity for (2CHS*AOV204) non-regenerative heat exchanger letdown inlet valve 2. Close (2 SIS *MOV842) SI accumulator check valve test line isolation l 3. Close [2GNS*AOV101-2) SI accumulator nitrogen makeup isolation valve 4. Clone (2IAC*MOV134) containment instrument air isolation valve 5. Close (2RCS*AOV519] pressurizer relief tank primary grade water makeup 6. Close (2RCS*AOV101) pressurizer relief tank nitrogen supply DESIGN FUNCTION: The K605B relay actuates on a containment isolation phase A (CIA) signal as a -result of a. safety injection signal. Letdown (Item 1) limits RCS inventory loss and mitigates any release in the event of fuel failure. Items 2 thru 4.(above are lines which are i not. essential to reactor protection). QPERATIONAL IMPAQT OF TESTING: for Item 1 ? (2CHS*AOV204) is maintained open by.by-passing the SOV that..is actuated by relay. K605B actuation. Verification -that (2CHS*AOV204) received 'a close signal is determined by lack of continuity (infinite resistance) between contact -terminal points. Operator action is again needed to verifyfthe valve:will remain. open afteri the~ relay 'is reset by measuring continuity (zero resistance) between contact terminal points. Failure of the testing scheme would-result in isolating letdown and may result in a. plant shutdown-due-to limited RCS. inventory control' on excess letdown. For Item 2 See Relay K605A for identical testing. l A r w - a,,,------_---. u -.. r-

Attach::nt B-1, continu:d Proposed Technical Specification Change 2A-47 Page 21 of 54 For Item 3 1 See Relay K605A for identical testing. j For Item 4 See Relay K605A for identical testing. ) For Items 5 and_5 These valves are normally closed and require operator action to open to allow closure on relay actuation. SAFETY SIGNIFICANCE OF TESTING: Failure of the testing scheme would result in isolation of RCS letdown during power operation. Isolation of RCS letdown during power operation on a quarterly basis can result in thermal transients not accounted for in the design of the system. These transients may result in exceeding the fatigue usage factor design limits. The isolation of letdown during power operation was recently identified by Westinghouse Electric Corporation as a potential issue which may involve thermal transients not accounted for in the design of the system.

l t AttcchOnt B-1, continu d Proposed Technical Specification Change 2A-47 Page 22 of 54 RELAY: K606A (Train-B Relay K606B testing identical) ACTUATION SIGNAL: Containment Isolation Phase A TEST CATEGORY: (2) RELAY ACTUATION TYPE: (Go) MAJOR EOUIPMENT ACTUATED: 1. Close (2CCP*MOV175-1) (2CCP*MOV177-1] Primary component cooling water supply and return isolations, "B" header. 2. Close (2SSR*SOV128A1] reactor coolant hot leg sample Close (2SSR*SOV129A1) RHR/ containment sump sample Close (2SSR*SOV130A1) pressurizer relief tank / primary drains i transfer tank sample Close (2 PAS *SOV105A1) containment air sample 3. Close (2CVS*SOV151A,

151B, 153A) containment vacuum pumps P21A and B

suction valves and containment air activity monitor isolation. 4. Timing out of [62-SSRAB) post accident sample timer for sample valves 5. Closure (or contactor actuation)(2SWS*MOV107A) "A" header service water supply to secondary component cooling water hsnt exchanger. DESIGN FUNCTION: ) The K606A relay actuate on a containment isolation phase A (CIA) signal as a result of a safety injection signal. The lines

isolated, as noted

above, are not required for reactor protection.

OPERATIONAL IMPACT OF TESTING: For Item 1 Valves are allowed to close. Component cooling flow is isolated i to blowdown evaporators, degasifiers, and sample coolers while the relay is in test. for Item 2 i Valves are allowed to close. Restoration requires operator ) action to reset control switch to dropout (CIA) seal in contacts. For Item 3 Closure of these valves requires-shutdown of the containment I vacuum pumps and air activity monitor. A technical specification i action leading to plant shutdown is entered each time this relay l is tested. Radcon support is needed to place the air activity l monitor back in service, l i

l Attcchment B-1, continuad i Proposed Technical Specification Change 2A-47 Page 23 of 54 For Item 4 Verification of timer operation on relay actuation is locally observed. This timer allows override of (CIA) to permit re-opening of sample valves under Item 2 (major equipment). For Item 5 (2SWS*MOV107A) -cannot be stroked closed with the chillers heavily loaded during operation. Therefore, its breaker is-placed in OFF and the MCC test set is used to verify contactor actuation. .The auto close function of this valve, on low service water pressure, is defeated for.the duration of this relay test. During' low chiller cooling demand this. valve can be cycled but -is unnecessary and may result in a service water system transient. SAFETY SIGNIFICANCE OF TESTING Two of the required RCS leakage detections systems are inoperable for tha duration of the test. - The containment atmosphere gaseous and particulate radioactivity monitoring system is made inoperable by closure of the. valves listed in Item'3. This monitor detects the presence. of leakage from the RCS by an i increase in activity in the containment atmosphere and is recommended by Regulatory Guide 1.45 " Reactor Coolant Pressure Boundary Leakage Detection System." Performing,this slave test during plant operation degrades-the RCS leak detection' capability and places the plant in a technical specification action statement which requires a plant shutdown within.12 hours. The automatic closure-of the service-water valve to the secondary component cooling water heat exchanger-is defeated for the duration of the test. Without-the-automatic closure =of the service water

valve, adequate. service water flow may not be available for cooling of 1 ESF heat exchangers.such as the l

recirculation

spray, the-charging pump lube oil,: and emergency diesel generator coolers-in the

.affected train. l t '"se M -f y-m to .g c-w w pe-TyAqr-4ewge e+ -ggeyc. m ~g i,g-.-, e ,wq., yam-y=-gq y-g=p,.e% g g W,-m.3 g. agi,---,,wg-gy m. w y 794,g+g.% v. -$g-g<m b-e tewe iw=1' Ev ww-

) ? Attach nt B-1, continu d Proposed Technical Specification Change 2A-47 Page 24 of 54 RELAY K607A (Train B Relay K607B testing identical) ACTUATION SIGNAL: Containment Isolation Phase A TEST CATEGORY: (1) RELAY ACTUATION TYFEt (Blocked) MAJOR EQUIPMENT ACTUATED: 1. Close 2CHS*MOV378 RCP seal leak off return DESIGN FUNCTION: The K607A relay actuates on'a containment isolation phase A-(CIA) signal as a result of a safety injection signal. The reactor coolant pump (RCP) psal leak off return is isolated since it is not required for reactor protection. OPERATIONAL IMPACT OF YESTINGt For Item 1 Closure of tnis valve isolates seal leakoffffrom all:3,RCPs,. challenging the seal return relief' valve,.and-the~RCP seals which must respond to the increased back pressure. SAFETY SIGNIFICANCE OF TESTINGt Test circuit failure would result in'an'ESF-actuation which'will change RCP seal flow conditions and' may.cause seal damage =or failure. In

addition, the seal. return relief' valve, may be 1

damaged.- ALLOCA at the.RCP shaft seals 1(failed stals). or out the i relief valve-(if stuck open)Leould. result.. l 1a 1 e

AttcchOnt B-1, c:ntinued Proposed Technical Specification Change 2A-47 Page 25 of 54 RELAY: K612A (Train-D Relay K612D testing identical) h ACTUATION SIGNAL: Containment Isolation Phase A TEST CATEGORY: (4) RELAY ACTUATION TYPE (Go) MAJOR EOUIPMENT ACTUATED: 1. Close (2DAS*A0V100A) (2DGS*AOV108A) containment-sump pump discharge valves 2. Close (2SSR*A0V100A1, 102A1, 109A1, 112A1) primary sample valves 3. Close _ [2VRS*AOV109A1) pressurizer relief tank / primary drains transfer tanks vents isolations. DESIGN FUNCTION: The K612A relay actuates on a containment isolation phase A (CIA) signal. as a result of a safety injection signal. The lines isolated in Items 1 thru 3 above:are all'11nes which are not f required for reactor protection. ? OPERATIONAL IMPACT OF-TESTING: For Items 1 thru 3 i Reactor-containment sump pumps (2DAS-P204A,B) are stopped and all-i valves are allowed to close on relay-K612A actuation.. Operator action is required to place control switches for-(2DAS*AOV100A) and (2DGS*AOV108A) to close to drop-out CIA seal in contacts-before valve-repositioning and' placing the containment _ sump _ pump control switches to auto. Until relay K612A is reset, or'if valves fail _to re-open the reactor operator loses the capability-to: y pump out the containment sump sample RCS. cold legs, SIS accumulators, pressurizer liquid = and vapor spaces vent the pressurizer. relief tank; and the primary drains tank. SAFETY SIGNFICANCE OF TESTING:. Containment sump pump controls and discharge valves out?of auto defeats .the UFSAR required. unidentified' leakrate ' monitor. Inability to vent the; pressurizer. relief tank & primary drains' tank - could lead-to - a release of RCS gases to containment. -atmosphere.

l Attcch23nt B-1, continu:d Proposed Technical Specification Change 2A-47 Page 26 of 54 RELAY: K613A, K613XA (Train-D Relay K613D, K613XB testing identical) ACTUATION SIGNAL: Containment Isolation Phase A TEST CATEGORY: (2) RELAY ACTUATION TYPE: (Go) MAJOR EOUIPMENT ACTUATED: 1. Close (2CCP*MOV176-1, 178-1) component cooling water supply and return header valve-2. Start (2HVS*CH219A) - Train A SLCRS duct heater 3. Open (2HVS* MOD 203A, 210A, 210A, 211A, 212A, 213A) SLCRS dampers 4. Closure (or contactor actuation) for (2SWS*MOV107C) "B" header service water supply to secondary component cooling water heat exchanger. DESIGN FUNCTION: The K613A and K613XA relays actuate on a containment isolation phase A (CIA) signal an a result of a safety injection signal. The accuation of ventilation components (Items 2 3) are necessary to ensure that possible radioactive leakage from ECCS components is filtered prior to release to the environment. The componenet cooling water and the service water lines (Items 1-&

4) are isolated since they are not required.

OPEATIONAL IMPACT OF TESTING: For Items 1 thru 3 Train A Supplementary Leak Collection and Release System (SLCRS) must be shutdown to perform this relay test. If Train A is in

service, SLCRS systems must be swapped and is an unnecessary start of the fan and cycling of associated components.

- - - -. ~.... - Attcchtont B-1, continu d Proposed Technical Specification Change 2A-47 L Page 27 of 54 i for Item 4 'l 4 If chilled water units are heavily loaded (2SWS&MOV107C).is tested by opening its breaker and using the MCC test pet.- Considerable operator action is needed for set-up, contactor ) 2 actuation verification and restoration. With the breaker for [2SWS&MOV107C) in the off

position, the auto closure of this valve on low service water header pressure is prevented.

During I low chiller cooling needs this valve can be cycled but is unnecesary and may result in a service water system transient. i i SAFETY SIGNIFICANCE OF TESTING: u 4 The automatic closure of the service water valve to the secondary component cooling water heat exchanger.is defeated for the duration of the test. Without the automatic closure of the service water

valve, adequate service water flow.may not be j

available for cooling of other ESF heat exchangers such-as the recirculation

spray, the charging -pump lube oil, and emergency-diesel generator coolers in the affected train.

i l l t- . = - _,c_

Attach 2Ont B-1, continu:d Proposed Technical Specification Change 2A-47 Page 28 of $4 RELAY

K614A, K614XA (Train-B Relay K6148, K614XB testing similar except for (FPW) fire protection valves)

ACTUATION SIGNAL: Containment Isolation Phase A TEST CATEGORY (2) i RELAY ACTUATION TYPEt (Go) MAJOL EOUIPMENT ACTUATED: 1. Close (2HVP* MOD 22A) auxiliary building exhaust filter damper 2. Close (2HVS* MOD 201A) normal leak collection damper for fan (2HVS*FN263A) 3. Open (2HVS* MOD 202A) filter leak collection damper for fan (2HVS*FN204A,B) Close 4. containm(2CCP*MOV118) (2CCP*AOV171,173) component cooling water to ent instrument air compressors and supply and return to-primary drains cooler. 5. (2FPW*AOV204,

205, 206, 221) fire protection water to containment.

DESIGN FUNCTIONt-l The K614A and K614XA relays actuate on a containment isolation l phase A (CIA) signal as a result of_a safety injection signal. 1 The actuation of the ventilation components (Items 1 thru 3) are necessary to ensure. that possible radioactive leakage'from ECCS i components is filtered prior to release to the environment. The component cooling water and the fire protection lines 'are isolated since they are not required for reactor protection. OPERATIONAL IMPACT OF TESTING: For Items 1 thru 3 { Testing these dampers to close also causes the Train-B dampers to close due to low flow and position interlocks. Also when damper (2HVP* MOD 22A)_ closes, air conditioning-unit 2HVP*ACU211B will shutdown. ' These actiona result in an auxiliary building ventilation transient = with 'Radcon. notification and operator action to restore ventilation.- . j For Item 4 Due to loss of cooling to the containment' instrument-air compressors, they.are shutdown and station instrument air is cross connected to containment instrument air. Operator action.is-needed to re-align containment instrument. air :and to restore cooling to primary; drains.

l Attcchmont B-1, continu0d Proposed Technical Specification change 2A-47 Page 29 of 54 For Item 5 These valves are normally closed and must be opetted to test to close. To preclude inadvertent introduction of fire' protection water to containment, manual valves in each line to these A0V's are closed. Therefore, fire protection to containment is isolated for the duration of this test. SAFETY SIGNIFICANCE OP TESTINGt All fire protection to containment is isolated for the duration of the test. If an actual fire in containment were to occur, action to extinguish the fire would be delayed. This.nay-result in increased equipment damage as a rasult of the delayed action. Without proper operator

action, a

loss. of cooling. to_ the containment instrument air compressors will result in tripping of the compressors. A total loss of containment instrument air will then occurr. Letdown isolation (an ESP actuation) 'will then i follow as the air operated letdown valves' drift closed. An ESF. actuation did occur at BVPS Unit No. 2 in 1990 during testing of this slave relay due to loss of containment instrument air (LER 90-009-00). i 1 =

Attachm:nt B-1, continu d Proposed Technical Specification Change 2A-47 Page 30 of 54 RELAY: K618A, K618XA (Train B Relay K618B, K618XB testing identical) ACTUATION SIGNAL: Containment Isolation Phase B TEST CATEGORY: (2) RELAY ACTUATION TYPE: (Go) MAJOR EOUIPMENT ACTUATED: 1. Close (2SWS*MOV153-1, 154-1) chilled water supply and return header isolation valves to containment air recirculation fan (2HVR-FN201A) cooling coils 2. Trip (2CCP*P21A) component cooling water pump. 3. Contactor actuation for (2QSS*P24A) chemical addition pump 4. Breaker trip for (2RHS*P21A) residual heat removal pump. DESIGN FUNCTION: The K618A and K618XA actuate on a containment isolation phase B (CIB) signal as a result of a containment high-high pressure signal. The CID signal ensures that all penetrations, not t already closed by a containment isolation phase A (CIA) are

isolated, except for ESP lines.

This action isolates the containment following a

LOCA, steam line break, or a feedwater

break, within containment, to limit radioactive releases.

The chemical addition pump is actuated by these relcys to ensure that sodium hydroxide is added to the containment spray water, which results in improved removal of radioactive iodine.- The remaining components listed above are either isolated or tripped since they are no longer required. OPERATIONAL IMPACT OF TESTING: Considerable operator action is needed to set-up and restore equipment to pre-test conditions. For Item 1-Actuation of relay K618A isolates chilled water flow-to containment air recirculation cooling coil "A." Failure of the test circuit could resut in a plant shutdown _ _due tu high containment air temperatures. For Item 2 Component cooling water (CCP) pump 21A is allowed to trip.which requires re-alignment of the CCP system to place both the "A" and 1 "B" CCP pumps in operation and the "C" pump in auto. "C" CCP pump will auto start when (2CCP*P21A) trips to maintain CCP flow requirements. Tripping of 'a running pump challenges cooling loads (RCPs) until_the system responds to the transient.

Attcchment B-1, etntinu d Proposed Technical specification Change 2A-47 Page 31 of 54 For Item 3 The breaker for chemical addition pump (20SS*P24A) is placed in the off position. Pump 24A would have no suction if allowed to start because (20SS*MOV102A] is controlled by relay K644A. Therefore, contactor actuation is verified using the MCC test set. The pump is inoperable for the duration of the test. Human error previously resultod in chemical addition pump 24B inadvertenly starting (ESF actuation) during performance of this slave relay testing (See LER 88-016) For Item 4 J To simulate RHR pump running, the pump breaker is placed in test and jumpers are installed. The pump control switch is placed in auto. The breaker is allowed to trip when the slave relay is 1 actuated. The control switch is CAUTION TAGGED if the slave is tested at power since the RHR pump cannot be bump start tested after reclosing its breaker. The RHR pump is unavailable for use. l during the slave test and may be questionable after testing conditions are restored. SAFETY SIGNJFICANCE OF TESTING Failure of the chilled water valves (Item 1) to re-open could result in a plant shutdown -due to high containment air temperatures. The tripping of a running component cooling pump challenges cooling

loads, such as the operating reactor coolant pump (s)

(RCP), until the CCP system can respond to the transient. If CCP is not restored, RCP bearing temperature may reach the administrative limit necessitating a RCP shutdown and reactor trip. A chemical addition pump is made inoperable for the test duration. A single failure of the redundant trains emergency power supply-will result in a-complete loss of this system. Loss of chemical addition will reduce the effectiveness of the quench spray system to remove radioactive iodine. The reduced removal efficency of iodine may result in an increase to offuite dose consequences. l 1 i 4 i A

Attcchm:nt B-1, continu:d Proposed Technical Specification Change 2A-47 Page 32 of 54 RELAY: K619A (Train-D Relay K619B testing identical, If the test circuit fails a partial CID will also occur.) ACTUATION SIGNAL: Containment Isolation Phase B TEST CATEGORY: (1) RELAY ACTUATION TYPE: (Blocked) MAJOR EOUIPMENT ACTUATED 1. Closes (2CCP*MOV150-2) "A" component cooling supply header to containment 2. Closes (2CCP*MOV151-1) "B" component cooling supply header to containment 3. Closes (2CCP*MOV156-2) "A" component cooling return header from containment 4. Closes (2CCP*MOV157-1) "B" component cooling return header from containment 5. Closos (2SWS*MOV106A) "A" service water supply header to CCP heat exchangers DESIGN FUNCITON: The K619A relay actuates on a containment isolation phase B (CIB) -signal as a result of a containment high-high pressure signal. The component cooling to containment and the serv 3ce water to component cooling are isolated since this cooling is no longer required. OPERATIONAL IMPACT OF TESTINQ: For items 1 thru 5 l There are no special test requirements for this relay.

However, if the test circuit fails, a partial CID actuation will occur.

Both component cooling headers to all three reactor coolant pumps and residual heat removal heat exchangers would be isolated.

Also, the "A" train service water supply header to the component cooling heat exchangers would be isolated._ Additionally, the normal and alternate supply of CCP to the control rod drive mechanism shroud coils would be isolated.

f SAFETY SIGNIFICANCE OF TESTING Failure of the test circuit-would result in a partial CIB actuation, requiring a manual reactor trip on loss'of CCP cooling to all RCPs. ) =l

Attcch::nt B-1, continu:d Proposed Technical Specification Change 2A-47 Page 33 of 54 RELAY: K626A, K626XA (Train B Relay K626B, K626XB testing identical) ACTUATION SIGNAL: Containment Isolation Phase B TEST CATEGORY: (2) RELAY ACTUATION TYPE: (Go) MAJOR EQUIPMENT ACTUATED: 1. Open (2QSS*SOV100A) chemical. injection pump discharge to containment sump 2. Open (20SS*SOV101A) chemical injection pump discharge to quench spray pump 21A 3. Open (2QSS*SOV102B) chemical injection pump discharge to quench spray pump 21B 4. Close (2SWS*MOV152-1) service water supply to containment air recirculation cooling coils B & C 5. Close (2SWS*MOV155-1) service water return from containment air recirculation cooling coils B & C 6. Trip (2CCP*P21C) component cooling water pump DESIGN FUNCTION: Relays K626A and K626XA actuate on a containment isolation phase B (CIB) signal as a result of a containment high-high pressure signal. The opening of chemical addition valves (Items 2 and 3 above) is to ensure that sodium hydroxide is added to the suction of the quench spray pumps to control pH of the containment spray water. The flow path of sodium hydroxide to the containment sump via (2QSS*SOV100A] (Item

1) ensures that the remaining contents of the chemical addition tank is directed to the sump once the RWST reaches an extreme Lo-Lo' level.

The component cooling water pump is tripped since it is no longer required. Servico water 1s-also isolated to the containment air recirc cooling coils since it is no longer required. OPERATIONAL IMPACT OF TESTING: For Items 1 thru 3 Relay K626A actuates (2QSS*SOV101A, 1028) directly. These are normally open valves and require operator action to close to test to open on relay actuation. Additional operator action is needed to set-up (2QSS*SOV100A) to open on CID by actuating the RWST extreme Lo-Lo level. simulation relay in a different panel. To restore (2QSS*SOV101A, 102B) operator action is needed to reset CIB contacts in the valve control circuit thru control switch manipulation. These actions ensure the auto closure-function for (2QSS*SOV101A, 102B) on extreme Lo-Lo in the RWST is re-instated.

Attcchm3nt B-1, continusd Proposed Technical Specification Change 2A-47 Page 34 of 54 Por Items 4 and 5 i Actuation of relay K626A isolates chilled water flow to containment air recirculation cooling coils B and C. Epr Item 6 Component cooling pump P21C is allowed to trip. This action requires re-alignment of the CCP system with the B and C pumps running and the A pump in auto. CCP pump 21A will auto start when (2CCP*P21C) trips to maintain CCP flow. SAFETY SIGNIFICANCE OF TESTING: Failure of the chilled water valves (Items 4 & 5) to rs-open could result in a plant shutdown due to high containment air temperatures. The tripping of a running component cooling (CCP) pump challenges cooling

loads, such as the operating reactor coolant pump (s)

(RCP), until the CCP system can respond to the transient. If CCP is not restored within five minutes, a manual reactor trip is required and all RCPs stopped to prevent motor damage. The chemical addition system, which normally supplies NaOH to the containment quench spray system on a CIB would be degraded. The premature opening of QSS-SOV100A by the test would divert the NaOH to the containment sump where it would not be available to reduce containment iodine concentrations until much later when (or if) recirculation spray from the sump was intitiated.

l Attech2:nt B-1, continu;d Proposed Technical Specification Change 2A-47 Page 35 of 54 RELAY: K643A (Train B, Relay K643B testing identical) i 1 ACTUATION SIGNAL: Containment Spray Actuation /CIB TEST CATEGORY: 2 RELAY ACTUATION TYPE: (Go) MAJOR EOUIPMENT ACTUATED: l 1. Open (2RSS*MOV155A, 156A) suction and discharge valves for recirculation spray system (RSS) pump 21A 2. Energize relay (3-QSSAAX) start quench spray pump P21A 3. Contactor actuation for (2SWS*MOV103A) service water to RSS heat exchangers DESIGN FUNCTION: The K643B relay actuates on a containment spray actuation signal which is generated in response to a containment high-high pressure. This signal actuates the quench spray and recirculation spray systems. These systems are designed to reduce the containment pressure to sub-atmospheric pressure within one hour following a loss of coolant accident. The components, listed

above, which are actuated by the K643B relay are part of the containment spray system necessary to achieve the design requirements.

OPERATIONAL IMPACT OF TEATE{Q: For Item i Normally open recirculation spray pump 21A suction and discharge valves are closed by operator action and allowed to open on relay actuation. For Item 2 Actuation of relay K643A would start (2QSS*P21A] and spray containment. Thero* ore, to. satisfy relay testing, one train of quench -spray is made inoperable by racking the pump breaker to test and closing the suction and discharge valves. Operator action is needed to restore the QSS system to operable pre-test conditions.

'I i Attachm3nt B-1, continued Proposed Technical Specification Change-2A-47 Page 36 of 54 q For Item 3 Relay K643A actuation would open (2SWS*MOV103A? directing service water to the RSS heat exchangers. This conditton is unacceptable - and would require draining the ' heat exchangers for biota and corbicula control. Therefore, the breaker for (2SWS*MOV103A) is placed in the OFF position and contactor actuation verified:by -1 using the MCC test-set. Operator-action is.needed to remove the ~; control power fuse - and attach test set-leads at the breaker. Service water valve (2SWS*MOV103A]-auto open function to supply' water to the RSS-heat exchangers A and C is inoperable., One train of ECCS is alsc degraded since the."C"'RSS subsystem is parttof transfer to recirculation. i I SAFETY SIGNIFICANCE OF' TESTING one. train of the quench-spray system and the recirculation spray system are made inoperable.for_the-test-duration. This reduces-s the overall availability of these systeam. - A single failure of. I the redundant ' trains emergency power supply will result in a complete loss of these systems..This would result in-BVPS: Unit. exceeding 10_CFR=100 limits during.a design: basis-accident. ? 4 i A 'h ? 1 f a I l o . ~. _. _........._.- _. -,__-

1 i Atttchm:nt B-1, continu$d Proposed Technical Specification Change 2A-47 Page 37 of 54 RELAY: K644A (Train B, Relay K644B testing identical) ACTUATION SIGNAL: Containment Sprey Actuation /CIB TEST CATEGORY: (2) 1 RELAY ACTUATION TYPE: (Go) MA. TOR EOUIPMENT ACTUATED: 1. Open (2QSS*MOV100A, 101A] suction and discharge valves for quench spray pump P21A 2. Energize timer relay (62-RSSAS]-for recirculation spray pump P21A 3. Contactor actuation for (2QSS*MOV102A] suction valve to chemical injection pump P24A DESIGN FUNCTION: The K644A relay actuates on a containment spray actuation signal r which is generated in response to a containment high-high pressure. The components, listed above, which are actuated by the K644A relay are part of the containment spray system necessary to achieve the design requirements. OPERATIONAL IMPACT OF TESTING: For Item 1 Actuation of relay K644A opens 1(2QSS*MOV100A, 101A). To allow the valves to open they must be closed first. The quench spray i pump P21A is placed in Pull-To-Lock to protect'the pump while its suction valve is isolated. Therefore, one train of quench spray is inoperable. For Item 2 Actuation of relay K644A starts RSS pump 21A with'no water in the containment sump. 'This situation is undesirable. Therefore, the breaker for (2RSS*P21A) is placed in test. Contactor actuation is verified by observing that timer (62-RSSAA) starts. Operator action is required to reset the timer. RSS pump P21A is inoperabla for the duration cf this relay test. 4

Attachmsnt B-1,=continutd l Proposed Technical-Specification Change 2A-47 Page 38 of 54 For Item 3 l Actuation of relay K644A causes (2QSS*MOV102A] to open allowing RWST water-in the quench spray piping system to communicate with a high concentration of. Sodium hydroxide (NaOH) in the chemical addition system.. Subsequent. ASME chemical addition:and_ quench 4 spray pump testing each: quarter causes a buildup of NaOH in the RWST.- To -preclude sodium hydroxide. cross contamination of the-1

RWST, (2QSS*MOV102A]

is left closed. To satisfy _ slave testing-the breaker for (2QSS*MOV102A]- is placed in OFF and contactor actuation verified using the MCC test set. One train of chemical addition Lis,_ therefore, inoperable for the duration of this: relay. test. SAFETY SIGNIFICANCE OF TESTINGt One train of-the quench spray system, chemical _ addition system-and the-recirculation spray' system _are made inoperable for the-test duration.- This reduces the-overall availability of these systems. A single failure--of the-redundant trains-emergency power supply will fresult in a-complete loss of these; systems, i This would result in BVPS Unit 2 exceeding 10 CFR 100-limits during a design basis accident. i l

1 I -Attachm2nt B-1, continu d Proposed Technical Specification Change-2A-47 Page 39 of 54 RELAY: K645A (Train B Relay K645B testing identical) i ACTUATION SIGNAL: Containmerit Spray Actuation /CIB TEST CATEGORY: (2) i RELAY ACTUATION TYPE: (Go)' ]) -i MAJOR EOUIPMENT ACTUATED: 1. Open (2RSS*MOV

1550, 156C) suction and-discharge for-recirculation spray. pump P21C-2.

Energize timer relay (62-RSSCA) for recirculation spray pump P21C DESIGN FUNCTION: The K645A relay actuates on a containment spray actuation-signal which is. generated in response oto a, containment high-high-pressure. The components, listed-above, which-are-actuated by the K645A relay-are part yof 'the containment-spray-system necessary to achieve the design requirements. ~ OPERATIONAL IMPACT OF TESTING: For Item 1 Recirculation spray pump P21C suction and discharge valves are i normally open and-require operator action to: close to allow the-valves to open on a relay actuation. 4 For Item 2 i Actuation of relay 'K645A-starts RSS1 pump P21C-with no-water!in the containment sump and suction.and discharge valves closed as stated in Item 1 above.- 'This situation is -undesirable. Therefore, the breaker for ( 2RSS *P21C]._ is -placed Lin?, test. Contactor actuation is . verified by-observing that timer (62-RSSCA) starts. Operator; action-is' -required to reset the timer. -RSS Pump P21C'is inoperableifor the-duration'of the test'.

i Attcchm3nt B-1, continund Proposed Technical Specification Change 2A-47 Page 40 of 54 SAFETY SIGNIFICANCE OF TESTING: one suosystem of recirculation spray is inoperable and one train of emergency core cooling system (EeCS) is also degraded since I the "C" RSS subsystem is part of transfer to recirculation. See Relay K643A. This reduces the overall effectiveness of one train of ECCS in recirulation mode. The (2RSS*P21C) pump transfers from being a low head safety injection pump to become a recirculation spray pump during the switch over for injection to recirculation phase for core-cooling. A single failure of the redundanu trains emergency power supply will result in a partial loss of amergency core cooling. x a i a a2 --_m ..____________________s_ _mmm--__.U

Attachm:nt B-1, continutd Proposed Technical Specification Change 2A-47 Page 41 of 54 RELAY: K601B and K620B ACTUATION SIGNAL: Feedwater Isolation (Train-B) TEST CATEGORY: (1) 4 RELAY ACTUATION TYPE: (Blocked) MAJOR EOUIPMENT ACTUATED:

1. Close all main feedwater regulating valves [2FWS*FCV478, 488, 498)

A. 2FWS*FCV478; Supply feedwater flow to 'A' steam generTtor-B. 2FWS*FCV488: Supply feedwater flow to 'B' steam generator l C. 2FWS*FCV498; Supply feedwater flow to 'C' steam generator DESIGN FUNCTION: I These relays actuate on a safety injection signal to close the feedwater regulating valves in response-to a main steam line or feedwater line break inside or outside containment. For breaks inside containment, isolating feedwater will limit the amount of energy transferred to the containment atmosphere and thus limit the peak containment, pressure. For a break outside of containment, isolating feedwater ensures that an excessive RCS cooldown does not any thermal-hydraulic design limits. occur and prevents the reactor from exceeding OPERATIONAL IMPACT OF TESTING: Since these valves are block tested,.there is no operational impact except upon test circuit failure. Testing the relays with the reactor trip breakers open (i.e. Modes 3 & 4) requires lifting a lead in the reactor protection system to simulate the selector switch in the STEAM PRESSURE MODE. breakers are closed and placing ~, reactor trip RAFETY SIGNIFICANCE OF TESTING: Provided that the test circuit does not fail there is no safety significance in testing this relay. However, if the circuit does

fail, significant safety concerns exist.

A loss of normal feedwater will occur challenging the reactor protection system to initiate a reactor trip and actuate auxiliary feedwater. Closure of all the valves would result in aLloss of normal feedwater

accident, a

condition II event. The lifted lead changes the status of the P-4 protection interlock which affects SI reset, turbine trip on closure of main feed reg valves on low RCS temperature. reactor trip, condense and

See Relay (K622A) for (Train-A) feedwater isolation.

-Attachmant B-1, continued Proposed Technical Specification' Change 2A-47 Page 42 of 54 RELAY: K621A (Train B Relay K621B testing identical) ACTUATION SIGNAL: Feedwater Isolation TEST CATEGORY: (1) i I Relav Actuation-Tvoe: (Blocked /Go) MAJOR EQUIPMENT ACTUATED:

1. Trip turbine trip via (99-TMAAAX1)=

2. Trip (2FWS*P21A, P21B]. main feedwater pumps

3. Trip (2FWS-P24) start-up feed pump-(Not Blockable) 1 DESIGN FUNCTION:

The K621A relay is actuated by a safety injection'(SI) signal or a steam generator high-high water level. The operation.of this relay serves two purposes. On a SI.in response to'a main steam or feed line

break, this relay _ ensures that all~feedwater and main steam to -the_ turbine is isolated'.

-The-isolation of feedwater is accomplished -by-tripping of-the_ main and. start-up feed pump (s). ' Isolating-main Jsteam tcr the turbine is accomplished by

closing the. turbine governor. and throttle valves.

The second purpose'is to-actuate on a steam generator high-high level which'. prevents an excessive reactivity: addition from a

cooldown,

_ prevents: filling---the _ main' steam piping with ' water, and prevents excessive moisture carry over-to the turbine. L OPERATIONAL IMPACT OF TESTING: l For Items 1 thru 3 Testing with main feedwater-pumps running-requires operator action to.installijumpers and to rack'the. supply breaker for-the start-up. feed-pump-(2FWS-P24)ito-the-test position. Theistart-up feed-pump =will trip: since the feedwater fisolation-signal: to (2FWS-P24): is, Not Blockable. If1'the : start-up~ feed pump is . supplying? main feedwater, srelay K621A cannot be tested.. If the-l . plant is ' shutdown -(i.e. Modos or 4 ): testing _' relay K621A1 ~ requires -operator action to~. install a-__ jumper to. simulate the reactor -trip breakers areLclosed and toiplace the steam dump modet p . selector switch :in the steam-pressure mode, i SAFETY SIGNIFICANCE OF TESTING:. Test circuit failure will result in a turbine:and reactor trip ~. l I L \\

Attachmant B-1, continuad Proposed Technical Specification Change 2A-47 Page 43 of 54 4 RELAY: K622A ACTUATION SIGNAL: Feedwater= Isolation (Train-A)

See Relays I

K601B/K6208 for Train-B feedwater isolation 1 TEST CATEGORY: (1) (Blocked) RELAY ACTUATION TYPE: MAJOR EOUIPMENT ACTUATED: 1. ( 2 FHS *HYV157 A', B, C) main feedwater isolation. valves-j DESIGN FUNCTION: The K622A relay actuates on a feedwater. isolation signal generated by a safety injection signal to close the main feedwater isolation valves in response to a main steam line or feedwater line break inside or outside containment. OPERATIONAL-IMPACT OF TESTING: For Item 1 There are no special requirements for testing, this relay at power.

However, testing. this' relay with reactor-trip breakers.

open ( i. e '., Modes 3 & 4). requires operator action to lift a lead-to simulate the reactor trip breakers are closed and to' place the steam dump mode. selector switch in the STEAM PRESS, MODE. -SAFETY SIGNIFICANCE OF TESTING:. Failure of the test circuit will result'in a reactor. trip due to: closure of the main feedwater isolation valves. i L Closure of all the main feedwater isolation valves-would result' =in a loss of normal feedwater accident,,a condition:II event.- p 1. l i L u l 1

Attachment B-1, continued Proposed Technical Specification Change 2A-47 Page 44 of 54 RELAY: K636B ACTUATION SIGNAL: Feedwater Isolation (Train B)

TEST CATEQQEY:

(3) RELAY ACTUATION TYPE: (Go) MAJOR EOUIPMENT ACTUATED: 1. Close (2FWS*FCV479, 489, 499) main feedwater bypass valves DESIGN FUNCTION: Relay K636B actuates on a feedwater isolation signal to close the feedwater bypass regulating valves in response to a main steam line or feedwater line break inside or outside containment. OPEATIONAL IMPACT OF TESTING: For Item 1 Testing these valves requires manipulation of the steam generator level control system. At 100% power the bypass valves are open approximately 10% while allowing the MFRVs (main feed regulating valves) (See relay K601B) to control in auto. -When the bypass valves close the MFRVs will have to compensate. A feedwater transient may occur if the MFRV's are slow too respond or incapable of responding if the bypass valves were open too far initially. At 30% power, this test would be much harder since the MFRVs will be erratic at low feed flow conditions. Therefore, to minimize feedwater oscillations-the bypass valve isolation valves (2FWS*MOV155A, B, C) are closed. Then (2FWS*FCV479,

489, 499) are opened and allowed to auto-close on relay actuation.

Operator action is needed to re-establish feed flow balance with the main feed bypass valves approximately 10% open. SAFETY SIGNIFICANCE OF TESTING: A reactor trip may occur during feedwater valve manipulation due reaching the Lo-Lo steam generator reactor trip setpoint. Feedwater system transients are the largest single contributor to reactor trips. See Relay K622A for Train A Feedwater Isolation

Attachmnnt B-1, continu2d 1 l Proposed Technical Specification Change 2A-47 Page 45 of 54 RELAY : K616A (Train B Relay K616B testing identical) ACTUATION SIGNAL: Steam Line Isolation TEST CATEGORY: (4) a RELAY ACTUATION TYPE: (Go) MAJCR EOUIPMENT ACTUATED: 1. Close (2SDS*AOV129A) residual heat release valve piping drain valve 2. Close (2SDS*AOV111A1,

111B1, 111C1] steam lines drain valves to condenser 3.

Close [2 MSS *AOV102A, B, C) main steam bypass valves i DESIGN FUNCTION: The K616A relay actuates on steam.line isolation signal in response to.a steam line break. This action stops the sudden and large release of energy in the form of steam,' which in turn prevents rapid cooling of the RCS. This' relay closes the remaining normally open drain paths that were not closed by the K623A relay. The main steam bypass valves are normally closed valves. OPERATIONAL IMPACT OF TESTING: For Items 1 and 2 Valves are normally open and closed -when testing this relay. Failure of these drain valves to re-open would result in water (condensate) accumulation and when placed back in service, water hammer could result.- All four valves are stroke tested and-timed quarterly per the ASME program. For Item 3 Valves are normally

closed, opened-for 'this relay. test.and allowed to close during relay actuation.

This is'an unnecessary cycling of these valves. All three valves are stroke tested and timed quarterly per the ASME program.- SAFETY SIGNIFICANCE OF TESTING: Failure of the test relay to reset would keep the steam'line drain valves closed, causing condensate to accumulate in the main steam lines. The water could resuli in a steam line break'due to water hammer or turbine-blading damayn. q

Attachasnt B-1, continued Proposed Technical Specification Change 2A-47 I Page 46 of 54 RELAY: K623A (Train B Relay K623B testing identical) ACTUATION SIGNAL: Steam Line Isolation TEST CATEGORY: (1) RELAY ACTUATION TYPE: (Blocked) 6 MAJOR FOUIPMENT ACTUATED: 1. [2 MSS *AOV101A, B, C) main steam trip valves DESIGN FUNCTION: The K623A relay actuates on a steam line isolation signal to close all three main steam trip valves in response to a main steam line break downstream of the trip valves. If a main steam line breaks occurs between the trip valves and a steam' generator, only that steam generator will blowdown. Closure of the trip valve in the ruptured line prevents blowdown from the other steam generators. 0]M: RATIONAL IMPACT OF TESTING: for Item 1 Since this is a block test, there is no operational impact unless the test circuit fails. SAFETY SIGNIFICANCE OF TESTING: Failure of the test circuit will result in steam line isolation and a reactor trip. I \\

l Attachment B-1, continued Proposed Technical Specification Change 2A-47 Page 47 of 54 RELhX: K632A (Train B, Relay K632B testing identical) l K633A (Train B, Relay K633B testing identical) j ACTUATION SIGNAL: Reactor Trip (K632A) 1 2/3 S/G level low-low (K633A) TEST CATEGORY: (2) RELAY ACTUATION TYPE: (Go) u MAJOR EOUIPMENT ACTUATED: 1. Start (2FWE*P22] steam driven auxiliary feedwater (AFW) pump DESIGN FUNCTION: I The K632A relay actuates oon a undervoltage condition;on the I reactor coolant pump bus in anticipation of unit blackout. This relay actuates the steam supply valves to start the steam driven auxiliary feedwater pump. The K633A relay actuates-on a steam generator Lo-Lo level. This relay starts the steam driven auxiliary feedwater pump. The starting of the steam driven auxiliary feedwater pump ensures that an adequate heat sink is available when the unit trips. OPERATIONAL IMPACT OF TESTING: For Items 1 thru 3 To prevent an undesirable start of the auxiliary ~feedwater system the "A" motor driven auxiliary feedwater pump control switch is placed-in Pull-To-Lock and the steam supply isolation - (2FWE*TTV22) to the turbine. driven auxiliary feedwater pump is-closed. Steam generator blowdown' will isolate when the steam supply valves to the turbine driven AIN pumps Lare opened. Therefore, blowdown' is slowly isolated by closing (2BDG-HCV101A, B, C) and requires -operator-action to restore the-system to operation after slave relay. testing. The motor driven'AFW pump' P23A and the-steam driven AFW: pump are -inoperable and' blowdown remains isolated for three (3) relay tests in succession (K632A, K633A, K634A). NOTE: Relays K632A and K633A require the same test conditions and actuate the same steam supply valves to the turbine' driven AFW pump. Each relay is actuated independently in succession and (2 MSS *SOV105A, C, D) are' stroked twice. In addition 2 of 3 AFW pumps are disabled while testing the above (2)-relays. 1 I

Attachm:nt B-1, continutd Proposed Technical Specification Change 2A-47 Page 48 of 54 SAFETY SIGNIFICANCE OF TESTING: Two of the three auxiliary feedwater pumps, which are solely relied upon as the primary heat sink during an accident, are rendered inoperable for the period of the test. During this period of

testing, the auxiliary feedwater system does not meet single failure criteria as the failure of the one remaining pump would result in a total loss of auxiliary feedwater.

This would place the unit in a condition which is outside the design analysis and in certain accident scenarios could result in core damage.

Attcchm nt B-1, continucd Proposed Technical Specification Change 2A-47 Page 49 of 54 RELAY: K634A (Train B Relay K634B testing identical) ACTUATION SIGNAL: Motor Driven Auxiliary Feedwater Pump Start (2/3 S/G level Low-Low) TEST CATEGORY: (2) RELAY ACTUATION TYPE: (Go) MAJOR EOUIPMENT ACTUATED: 1. Start [2FWE*P23A) motor driven auxiliary feedwater (AFW) pump DESIGN FUNCTION: The K634A relay actuates on a steam generator Lo-Lo level. This relay starts one of the motor driven auxiliary feedwater pumps (2FWE*P23A). The starting of the motor driven auxiliary feedwator pump ensures that an adequate heat sink is available when the unit trips and a safety-injection is not required. OPERATIONAL IMPACT OF TESTING: For Item 1 Operator action is required-to align the pump for recirculation testing. The normal discharge _ valve-is shut rendering the pump inoperable and constant communications are established and maintained between operators at the pump and in the contorl room. Communications are required to comply with technical specification Surveillance Requirement 4.7.1.2.a.4. Steam generator blowdown is isolated as discussed for relays K632A and K633A. SAFETY SIGNIFICANCE OF TESTING: One motor driven auxiliary feedwater pump is. rendered inoperable during the testing of_ relay K634A. -This test reduces the overall availability of the auxiliary feedwater system and increases the probability that an RCS heat sink will not be available if'an accident would occur during the test.

~ Attachm3nt B-1, continusd-Proposed Technical Specification _ Change 2A-47 Page 50 of 54 7 RELAY: K635A (Train B Relay K635B testing identical) i ACTUATION SIGNAL: Turbine Trip (30 second trip delay on generator) ~ TEST CATEGORY: (1) RELAY ACTUATION TYPE: (Blocked) l i MAJOR EOUIPMENT ACTUATED: ) 1. Generator Trip via [62-TMAAA) -DESIGN FUNCTION: The K635A relay is actuated by a turbine trip. _There is a 30 second time delay following a turbine-trip to prevent overspeeding the turbine. { OPERATIONAL IMPACT OF TESTING: For Item 1 There are no special test-requirements if the relay _.is tested with the main turbine latched. However, if the test circuit j

fails, a

reactor trip -will occur.- To test this relay-with the 1 main turbine not latched requires operator action to_ install 3 three (3) jumpers to simulate turbine stop valves nottshut and auto-stop-oil not low. SAFETY SIGNIFICANCE OF TESTING: A failureL o f-the. test circuit will lead to.a turbine trip and-above 49% power a reactor trip will occur. 1 1 4 f e E rm e ~.y -~ me t n ~,

Attcchm:nt B-1, continund Proposed Technical Specification Change 2A-47 Page 51 of 54 i RELAY: K625A (Train-B Relay K625B testing identical) ACTUATION SIGNAL: Containment Isolation Phase B/ Control Room Isolation TEST CATEGORY: (2) RELAY ACTUATION TYPE: (Go) MAJOR EOUIPMENT ACTUATED: 1. Close all control room ventilation dampers (Unit-1 & Unit-2) (2HVC

MOD 201A, 201B, 201C, 201D) (Unit-2)

[1VS-D-40-1A, 1B, 1C, 1D] (Unit-1) 2. Open all control air SOV's for control room pressurization (SOV-1VS-103A1, A2, B1, B2, C1, C2, D1, D2, El, E2] (Unit-1) 3. Start timers (62-HVCAP and 62-HVCBP) (60 minutes) to start control room pressurization fans 2HVC&FN241A,B DESIGN FUNCTION: The K625A or K625B relay actuates on a containment isolation phase B (CIB) signal and initiates the control room emergency bottled air pressurization system (CREBAPS). The control room is isolated from outside air and the bottled air system begins discharging. The bottled air system assures that the control room will be maintained positive for 1 hour followed by the start of the control room pressurization fans to continue long term habitability. OPERATIONAL IMPACT OF TESTING: Considerable operator action and coordination from both units is needed to set-up, test and restore equipment to pretest conditions. Both relays K625A and K625B are tested independently and in succession with the bottles isolated since each slave actuates a set of 5 parallel SOV's. Otherwise, 15 manual valves would be cycled twice to isolate and unisolate the bottles for each relay test increasing the probability of an inadvertent bottle actuation. FOR ITEM 1 All of the control room supply and exhaust dampers for both units are allowed to close on slave actuation. Unit-1 and Unit-2 operators are needed to return dampers to pre-test conditions. i

Attachment B-1, continued Proposed Technical Specification Change 2A-47 Page 52 of 54 FOR ITEM 2 The bottled air pressurization system is comprised of 10 bottles in parallel (5 subsystems 2-bottles per subsystem) and-by technical specifications must be maintained operable in all modes for both units at > 1825 psig. All ten bottles are located in Unit-1 and 3 groups of 5 manual valves have to be repositioned in) a three different locations in the Unit-1 auxiliary building. .If j the bottles were allowed to discharge on slave relay actuation they could not be recharged-fast enough to meet technical specification requirements and would result in shutting down both units. To avoid a forced shutdown, all ten. bottles are manually isolated and all SOV's allowed to-open on slave actuation. Technical specifications provide an 8 hour period for isolation of the bottles for performance of instrumentation and control system i testing. The control room bottled air pressurization system is inoperable for the-duration of slave relay testing and renders-actuation of the bottles air system by CIB, chlorine or high-high radiation ineffective. FOR ITEM 3 t Timers 62-HVCAP and 62-HVCBP are-allowed to start and if not reset within 60 minutes would start control room pressurization fans 2HVC*FN241A, B. Fan switches are placed-to stop after the timers are started to prevent unwanted fan starts. SAFETY SIGNIFICANCE OF TESTING:- Both trains of the bottled air pressurization system are disabled for the duration of slave relay testing. CREBAPS actuation due-- to High-High radiation or chlorine are also-ineffective. The total radiological dose to the control. room operatorsLwould-increase significantly in certain accident scenarios without the operation of CREBAPS. Inadvertent actuation of,the bottled ac pressurization system would "depr.essurize the -bottles and may require a-shutdown of both units. 1 1 ~.. .J

I Attachmsnt-B-1, continutd Proposed Technical Specification Change 2A-47 Page 53 of 54 RELAY: K630A (Train-B Relay YG30B testing identical) ACTUATION SIGNAL: 2/3 Chlorine Detectors / Control Room Isolation TEST CATEGORY: (2) RELAY ACTUATION TYPE: (Go) MAJOR EOUIPMENT ACTUATFJ: 1. Close all control room ventilation dampers (Unit-1 & Unit-2) (2HVC* MOD 201A,'201B, 2010, 201D) (Unit-2) [1VS-D-40-1A, 1B, 1C, 1D) (Unit -1) 2. Open.all control air SOV's for control' Room pressurization: (SOV-1VS-103 A1, A2, B1, B2, C1, C2, D1, D2, E1, E2) (Unit-1)' DESIGN FUNCTION: The -K630A or K630B relay actuates on a chlorine detection signal and initiates control room emergency bottled air pressurization system (CREBAPS). The. control room is isolated from outside air and the bottled air system begins discharging. The bottled air system assures that the control room will be maintained positive for-1 hour. (Fans are not started on chlorine actuation of CREBAPS). OPERATIONAL IMPACT OF TEST M : Considerable operator action and coordination!from both units is needed to set-up,- test. and restore equipment' to 1 pretest conditions. Both relays K630Azand K630B are tested independently l and in cuccession with the bottles. isolated:since each slave; j l actuate,s-a. set of.5 parallel SOV's...Otherwise,115 manual valves would be cycled twice. to isolate and unisolate the bottles for each. relay test increasing the probability; of an inadvertent ' bottle actuation. FOR ITEM 1. All of the. control room-supply and exhaustidampers for.both. units are allowed to close on-slave actuation.- Unit-1 and. Unit-2. operators are needed-to return dampers to pre-test conditions.-

Attachannt B-1, continu:d Proposed Technical Specification Change 2A-47 l Page.54 of 54 FOR ITEM 2 The bottled air pressurization system is comprised of 10 bottles in parallel (5 subsystems 2 bottles per subsystem) and by i technical specifications must be maintained operable in all modes for both units at > 1825 psig. All ten bottles are located in Unit-1 and 3 groups of 5 manual valves have to be repositioned in three different locations in the Unit-1 auxiliary building. If I the bottles were allowed to discharge on slave relay actuation I they could not be recharged fast enough to meet technical specification requirements and would result in shutting down both units. To avoid a forced shutdown, all ten bottles are manually isolated and all SOV's allowed to open on slave actuation. Technical specifications provide an 8 hour period for isolation of the bottles for performance of instrumentation and control system testing. The control room bottled air pressurization system is inoperable for the duration of slave relay testing and renders actuation of the bottles air system by CIB, chlorine or high-high radiation ineffective. SAFETY SIGNIFICANCE OF TESTING: 1 Both trains of the battled air pressurization system are disabled I for the duration of slave relay testing. CREBAPS actuation due l to High-High radiation or chlorine are also ineffective. l Inadvertent actuation of the bottled air pressurization system would depressurize the bottles and may require a shutdown of both l units. l l ) l

i ATTACHMEllT B-2 Beavor Valley Power Station, Unit 2 f Proposed Technical Specification Change lio. 47 Test Circuit Operation ( l The attached information describes the basic test circuits used in the Safeguards Test Cabinet, I l

'"uww.w ew_a,w,-.mg,

. ~. -. - -.. - -. -

l q

ATTACHMENT B-2,. continued ~ Proposed Technical! Specification; Change No.-47 Page 2 TEST CIRCUIT DETAILED DESCRIPTION 't 1. GENERAL ~ The Engineered Safety. Features _ Actuation System (ESFAS) final actuation device cnt actuated equipment testing is performed from-the Engineered Safeguards Test _ Cabinets.. There 'is'one test cabinet provided 'for_ each-of the two protection. trains "A" and "B". Each cabinet contains individual 1 test switches necessary?to actuate -the ~1ogic. output or slave _ relays (K601, K602, etc.)nand since.many' of the slave relays are' latch type, aLeommon_ reset switch per train is_also:Jprovided.. .. To prevent 1 accidental actuation, testLswitches.arelofLthe typeLthat must be rotated and then depressed to_ operate 1 the slave relays.. Assignments:of contacts of the slave relays for actuation Lof various1 final devices' or. actuators has been made such that most of.the= slave 4

relays, and: thus groups of devices.or' actuated equipment, can-be operated individually during plant operation-(See-Section11.1).

Those final. actuation devices that cannot-be actuated during t 3 plant operation 'have been : assigned Eo slave relays for,which-additional-test circuitry'has been provided_to individually block actuation .o f ; a final device upon 'operati'oniof the associated t slave -relays during _ testing'. ((See Section11.2).- Operation of these slave relays,Dincludingccontact operations, and continuity of the. electrical circuits 1 associated'~with. thenfinal devices control are checked -in ' 'l'ieu; of tactualioperation. : Interlocking? i prevents blocking the output :from mors1than: one ' outputDrelay Lin ya; protection train atiaLtime. - Interlocking;between; trains is:also provided .to prevent-continuity- ; testing 1.n both l trains-simultaneously,; therefore the_' redundant :' device 1 associated With the protection. train-not_;under; test will.be available-lubevent protective action-is_ required. cIfanfaccidentioccurs_during

testing, the automatic.

actuation-Lcircuitry -will Loverride testing-- One _e'xcept-lon :to this:isLthat'if theDaccident occurs-while : testing a slave / relay whose output mustibeSblocked,xthose. ~ . final -actuation devices associated.withothistslave'relayfwill1not be~ overridden.- 1 1 The following symbology-is_used':-to. represent 1the various' system-1 equipments involved 1.nLthe::attachedLFigure'slA?thruiD.: ?SPSE-PEQ - SolidfStateLProtection?. System; ~ ' Slq7 . Safeguards Test; Cabinet. X: Field : Connections'; -l. e., J SWGR, f MCC,1 etc. ' K*? PSC' Relay;'i.el,-K601,.K602,, etc. 1.K8*c STC Relay; i.e.',7K801,lK811, etc.s l 'S* .STC Test: Switch;Li,e.,fS801-~,4 S811,.etc. DS* ' 'STC Test jIndicator Lamp;EDS8001, JDS8011, Eetc. H 1 q J 2 s

ATTACHMENT B-2, continusd Proposed Technical Specification Change No. 47 Page 3 1.1 Circuits With No Blockina Schemes Reauirqd In the typical circuit, Figure A, depressing the test switch "S*" will result in relay "K*" contact to close and allow bus voltage to be applied to load Z1. If load 21 is functioning properly, some indicator (such as a lamp on another panel) will operate, indicating that the circuit is, functioning properly. The "K*" relay is returned to an open condition by returning the test switch "S*" to the Normal position. 1.2 Actuator Blockina and Continuity Test Circuits The typical schemes for blocking operation of selected protection function actuator circuits are shown in Figures B, C and O. The schemes operate as explained below and are duplicated ;or each safeguards train. Figure B shows the DC or AC circuit for contact-closure for protection function actuation. Under normal plant operation, and equipment not under

test, the. test lamps "DS*"

for the various circuits will be energized. Typical circuit path will be through the normally closed test relay contact "K8*" and through test lamp connections 1 to 3. Coil "X2" will be capable-of being energized for protection-function actuation upon closure of solid state logic output relay contacts "K*". Coil "X2" is typical for a breaker closing auxiliary coil, motor starter master-coil, coil of a solenoid valve, auxiliary relay, etc. Actuation of the test relay associated-with the protection functions or devices to be tested is-accomplished by.using the appropriate test switch "S*". In the typical circuit, Figure B, depressing the test switch "S*" will result in output relay "K8*" contact to open and "K*" to close. Verification that continuity exists in the associated actuator coil-circuit is accomplished by depressing the appropriate test lamp assembly and observing that the lamp becomes energized. The circuit path will be through the I test lamp connections 2 to 1 (contact "K8*" open), through solid l state logic output relay contact "K*" (now closed) and finally through actuator coil "X2". Sufficient current will flow.in the circuit to cause the lamp to glow, but insufficient to cause actuator coil "X2" to operate. Resetting the solid state ~ logic. -output relay is accomplished using the. test cabinet reset switch .(S821). Confirmation. that the safeguards output reluy contacts l are open, is accomplished by noting that the test lamp "DS*" will not energize when depressed. -The test relay "K8" is reset by i positioning the appropriate test switch "S" to the Normal position and observing that the test lamp "DS*" is energized indicating reclosure of associated test relayLcontacts "K8" and the existance of control power.

ATTACHMENT'B-2, continued- . Proposed Technical Specification Change No. 47 -Page 4-Figure C shows the DC circuit for contact opening for protection-function actuation. Under normal-plant operation,1and equipment-not under-test, the white test lamps ."DS*" for.the various 'l circuits will be energized, -and green-test lamp "DS*" will be de-energized. Typical circuit path for white lamp "DS*" will be through the normally closed solid state -logic output relay contact "K*" and-through test lamp connections 11 to 3.. -Coil "Y2" will be capable of-being de-energized for_ protection. function actuation upon opening of solid state. logic output relay; contacts "K*". . Coil "Y2" is typical for a solenoid valve coil, auxiliary relay, etc. Actuation of.the test relay associated. with the. protection functions or_ devices to be tested-is accompl-ished by using the appropriate test switch "S*". In the-typicaliDC circuit, Figure C, . positioning the test switch "S*" tocthe Test-position will result in relay "K8*" contact to close to block de-energizing.of L coil "Y2". Verification- ;that'variousz testLrelaytcontacts have closed to block de-energizing-of the_"Y2" coil-is~ confirmed-by the energizing of -the. associated green test -lamp,' "DS*".. 4 Depressing the test switch."S*" and observing that-the White test. lamp "DS*" de-energizes-'is a Verification thatsthe output relay's contacts "K*" have opened.. Coil "Y2".will'be:kept energized = during the test by the' circuit through :testi relay-contacts J "K8*". False operations' - of ' test: lamps will be blocked'by t diodes. Kith the diodes working, as well as a'ssumption of proper operation of the slave relay,iand with-the test switch-turned to the right and depressed,Lfirst'the green' light;goes on,-then_the; white ' light goes: out.- AnyLother sequence-wouldLmean a: failed-test of either the slave _ relay or .the< testing. circuitry. Resetting the solid-_stateEl logic output relaysis accomplished-using the test cabinet reset switch (S821). _Confirmationi!that-the safeguards outputirelay contacts areiclosed',?is accomplished-by-noting that the white'testilamp;"DS*"Lisienergized indicating that the solid state logicioutput relay 1 contacts?are closed. The-test relay "K8" is reset- 'by positioning the appropriate _-test switch "S" to-the left' _and observing that the green test 11 amp i 3 "DS" is-de-energized indicating: opening.of the: associated test relay contact "K8*". ~ The' typical AC circuit,, Figure D,"functionsiin'the same manner as the DC5 Circuit. (Figure C) = except that? a current > monitoring q device, ' consisting of 'a

Zener diode,andiLEDLtype? indicator Jis used in placeiof the._regula'r test lamp (s)._-

q h

i ATTACHMENT B-2, continued Proposed Technical Specification Change No. 47 Page 5 Ficture A h i - l ^ PSC PSC t /N /N h $fC /\\ STC /\\ g 4 MI J802 jg jg - t L21 _ _ . L2 2 ~ ~,, M 118 VAC

",3jf.

3 (PSC) 118 VAC - on. _ K' STC v STC V . 125 m asoi-aso2

mo-V V

v - E- ' v - E .0 1 g. g. I' -(0) - (a) y n u - AC or DC Test Circuit with No Blocking Schema Required 2 y ,w-_ e t -ev. < me

.b ATTACHMENT'B-2, continued Proposed Technical Specification change No. 47 Page 6 Fiaure B (x) n k /\\ /\\ 10 E /\\ v\\ $_TCO<>>"uw's'CAca' n tR$ STC /\\ STC /\\ /s ./N-R8 2 I w DS' j; x i. -( 3 Rest? -- 142 : 118 YAC (PSC ) g y ~ 250 VDC. 2 20. V AC. 125 VOC 04 118v&C .-a= g [ STC N/ STC 'N / ' 751ft Jeo2 s / gf. . C)( > - 'ss O. L. s/ s/. !?$$ s, '!.K ' ' T C. ?) ': sy: t l. li()l x-x *.. (0) ~(R) x2 'I V (N) I DC or AC Test Circuit with Contact Closure for Actuation k 4 m. w

~. 1 ATTACHMENT B-2, continued Proposed Technical Specification Chango No. 47 Page 7 i Fiaure C TYPICAL ftRMih&L .muuttes - () n n m^ ^* m () a ()(') g- ,,, n n,,e

m. m sa2

,s M u i _ _,, un -- 1 Rest, 3 2, ne. to) , r" ,rQ t l,*

a*

( (s ,c ,,t.., sz sz b 3,e sy N / E$,, ne,(}gia)_{}(io) ts'f, s!"* 1 O-O c.) m m I i DC Test Circuit with Contact open for Actuation-i

ATTACHMENT B-2, continued i Proposed Technical Specification Change No. 47 Page 8 Eigure D l a n 1 PSC PSC /\\ /\\ PSC STC (9) TYPICAL TERMINAL NUN 8ERs [K'

Ks*

sTC /\\ /\\ STC soon fs f s Jeo2 L21 _ s-50 L22

luf' m O (' +

118vaC (PsC) K8' 11g os* os' 8 v AC (i) (2)- STC N/ N/ sTC -_E (12) CURRENT WONITot

O E'

' ' Est DS* x ZtutR A' ~ (0gNEAT' .stus) ,A,(L) -O sCNEMATIC otAGRAM t' t' 8 I ' ~~ (0) '(R) l-n u n u (s) syugog (a) ' AC Test Circuit with Contact Open for Actuation = l i

ATTACHMEt1T B-3 Beaver Valley Power Station, Unit 2 Proposed Technical Specification Change tio. 47 l Safeguards Testing Cabinet Blocking Circuit Failure Analysis i l The attached information provides a failure analysis for blocking type test circuits. l t i i i l l l l l l l 4 i i

ATTACHMENT B-3, continued Proposed Technical Specification Change No. 47 Page 2 SAFEGUARDS TESTING CABINET BLOCKING CIRCUIT FAILURE ANALYSIS The Safeguards Test Cabinet (STC) is designed to test the integrity of the ESF Protection Safeguards System output slave relays. This is accomplished by energizing various slave relays and utilizing the test circuitry of the STC to verify that certain-protection relays have been energized and their contacts are opening or closing properly. Two basic types of testing arc performed, "GO" testing, in which the protection slave relay is actuated and its operation verified by observation of the equipment, the " BLOCK" testing, in which actuation of the ESP equipment is blocked, and circuit integrity is verified by continuity testing. Each of the Blocking schemes and their functions are explained in Attachment B-2 titled " Test Circuit Operation" and are provided for the reader's information. This report will only address the possible failures that have been analyzed for each of the blocking schemes. Beaver Valley Unit 2's STC employs basically four-types of blocking schemes and they will be referred to as Detail A, B, C, or_D (see attached drawings). The selection of what type of blocking scheme is required depends upon two factors; the individual contact (normally open or normally closed) of the slave relay and the power supply (AC or DC) which the final actuator requires. With two types of contacts and two possible power supplies there are four possible combinations, thus the four details. The analysis will describe the failure mechanisms that could occur to these four circuits, it should be noted that a failure of any blocking circuit to block actuation of the ESF equipment would either cause a significant plant transient or unit trip. DETAIL A: A detail "A" blocking scheme is used for slave relays that are powered from a 120 volt AC source and have contacts which are normally open. An example.of equipmentothat requires this type of blocking scheme is a motor operated valve (MOV). Most MOV's require a contact to close to give the controlling circuitry the logic to l stroke the valvo. l The failure mechanisms are as follows: 1) During the

test, the K600 (K*) slave relay is energized by the circuitry in the STC.

The continuity path of this circuit is through the light bulb path 2 to 1 down through the closed contact of the slave relay through the coil of the actuated equipment to the AC return. The voltage is dropped across the light bulb which reduces the power to a level such that there is insufficient voltage to actuate the equipment (X1). If for any reason the K8* test relay in the STC de-energizes, all the actuated equipment that slave relay controls will actuate.

AT'.ACHMENT B-3, continued P'/oposed Technical Specification Change No. 47 page 3 2) If a contact resistance on the STC K8* relay increases due to oxidation products or dirt / dust build up, there exists a j possibility that there will not be sufficient voltage available to energize the actuated equipment when a valid ESF signal is requiring actuation because of the voltage drop across the contacts. This as lef t condition af ter STC t asting would not be readily detectable. An it has been pointed out in the discussion so far, a failure of one component will cause iSF equipment to actuate when not desired or not be available to actuate when a valid ESF signal is present. DETAIL B: A detail "B" blocking scheme is used for a slave relay that is powered from 125 volt DC source and has a contact which is normally open. The continuity path for this blocking circuit is similar to the one described in detail "A". Therefore it will not be discussed again. The " allure mechanisms and consequences for this circuit are the same as the ones mentioned in detail "A". As shown in detail "B" there is an additional component in parallel with the push to test lamp socket. The component is a varistor. A varistor is a two-electrode semiconductor device with a voltage dependent nonlinear resistance that drops as the applied voltage is increased.- These devices were incorporated into the test circuit design to protect the lamps from burning up due to voltage surges. DETAIL C: A detail "C" blocking scheme is used for nlave relays that are powered from 120 volt AC source and have contacts which are normally closed. An example of equipment which de-energizes to actuate is a solenoid operated valve (SOV). Many SOV's are used as controllers to r containment isolation air operated valves.' When power is removed from the SOV it de-energizes. This action causes air to be removed from the trip valve and the valve shuts. The detail "C" circuit has the following current path. When no ESP signal is procent the current path is a follows: The path starts at the AC power supply and continues down through the closed contacts of the slave relay through a zoner diode,down through the actuating equipments coil to the AC return. The zoner diode is there to provide a voltage drop of approximately .7 volts to a status indicating LED wired in parallel to the zener diode. During a test of the K* relay, the current is-maintained to the coil of the actuated equipment (Y1) through the closed contacts of the test relay. When the test switch on the front of the STC is turned to the PUSH TO TEST position the contacts of the test K8* relay close. The current path is similar to the one mentioned above.

ATTAC;iMENT B-3, continued Proposed Technical Specification Change No. 47 Page 4 The failure mechanisms are the following: 1) Since the contacts of the test relay are normally open, the contacts are susceptible to oxidation and dirt / dust build up. If for any reason the contact resistance increases, there may not be sufficient voltage to keep the actuated equipments coil energized during the test and the coil may drop out. 2) The other failure that is possible is that the coil of K8* relay opens while testing; this will have the same impact on plant equipment as the failures mentioned above. DETAIL D A detail "D" blocking scheme is used for slave relays that are powered from a 125 volt DC source and have contacts which are normally closed. The detail "D" circuit operates very similar to the detail "C" circuit. The differences are that lights and diodes are used in lieu of LED's and zoner diodes. As in detail "C" one of the diodes stays in the circuit regardless of testing. The failure mode is the following: 1) The K8* test relay's contact is also normally open. A normally open contact is more susceptible to oxidation and or dirt build up. If for any reason the contact resistance increases, there may not be sufficient voltage to keep the actuated equipments coil energized during the test and the coil may drop out. A basic design problem in the blocking schemes is the fact that the test circuitry is designed to be an integral part of the actual ESP circuit flow path. With this design a single device failure results in either, 1) ESP equipment not automatically actuating when called upon or 2) actuation when the unit is on-line causing a significant plant transient or a unit trip. i i l .____m_ _ _ _. _. -.. _ _. _ _ _ _... _..

ATTACHMENT B-3, continued Proposed Technical Specification Change No. 47 Page 5 SIC E ) %) / K8' 2 h K8' 2 i i E d> Y a b @\\ E%) g me g I K' K' { R M i ~ ~ i SSE! O E E @E E @ E l 1 X1 X2 i 1 1 U U DETAIL "A. DETAll "B' ) l Typical Protection Actuaction Circuit Blocking Schemes (Contact Closure for Actuation) Elementary Representation 6 of Dews A & B O'Oi I-4O W Det. V E ESK 2C O c' 6 m.c Push to Test x Lamp Detail E51 - I X L N) t' ..i 3 -m-.- P

M'TACHMENT B-3, continued Proposed Technical specification Chango No. 47 Page 6 JL JL

4 Ns

= A h> m

p8::: K*

?

gt$: K

K8*

K8* a E 2 .3 g s (,) " " %o) o R R () {Z34p' n v = n, K m' I g q[n OE e I Y2 I O l Y1 l (Typical) U U g Detall "C' Detall "D' / Typical Protection Actuation Circuit Blocking Schemes (coniaan open tw Aavam Elementary nepreeentation et DeteIIe C & D i m arc / K* g d:: K

j q))=

>= q o,.c-u o- ~ EM E EM E a #, j m Y1 I i Y2 l l l L-

--m_ l l ATTACH!4E!1T C Beaver Valley Power Station, Unit tio. 2 Proposed Technical Specification Change 11o. 47 l l i l Typed Pages: 3/4 3-15 3/4 3-33 3/4 3-34 1 3/4 3-35 3/4 3-36 3/4 3-37 3/4 3-38 l l l l l l _ __._.__~~--.~-. -., _ .m _.--_,.m.......m.m..---.mw.w.v%. _.w,

INSTRUMENTATION 2/4.3.2 ENGINEERED SAFETY PEATURE ACTUATION SYSTEM IESTRUMENTATION SURVEILLANCE REQUIREMENTS 4.3.2.1.1 Each engineered safety feature actuation system instrumentation channel and interlock and the automatic actuation logic with master and slave relays shall be demonstrated OPERABLE by the performance of the ESPAS Instrumentation Survo111ance Requirements during the MODES and at the frequencies shoWq in Table 4.3-2. 4.3.2.1.2 The logic for the interlocks shall be demonstrated OPERABLE during the at power CHANNEL FUNCTIONAL TEST of channels affected by interlock operation. The total interlock function shall be demonstrated OPERABLE at least onco por 18 months during CHANNEL CALIBRATION testing of each channel affected by interlock operation. 4.3.2.1.3 The ENGINEERED SAFETY FEATURES RESPONSE TIME of each ESF function shall be demonstrated to be within the limit at least onco per 18 months. Each test shall include at least one logic train such that both logic trains are tested at least once per 36 months and one channel per function such that all channels are tested at least onco per N times 18 months where N is the total number of redundant channels in a epocific ESF function as shown in the " Total No. of Channels" Column of Table 3.3-3.

For the automatic actuation logic, tho surveillance requirements shall be the application of various simulated input conditions in conjunction with each possible interlock logic stato and verification l

of the required logic output including, as a minimum, a continuity check of output devices. For tho. actuation relays, the surveillance requirements shall be the energization of each master and slave roley and verification of OPERABILITY of each relay. The test of master relays shall include a continuity check of each associated. clave relay. The test of slave relays shall include, as a minimum, a continuity check of associated actuation devices that are not.

testable, i

i BEAVER VALLEY - UNIT 2 3/4 3-15 (Proposed Wording)

j. i k' t "IABIE 4.3-2 Deumt.t2e SM.* FEAPEE ACIURTIN SYSIDE DEIRatavud10N i N f I- <m ltt ~# CHMeEEL MRSIER SIAVE MDE S IN IGIIQi [ - 4 l GiM43EL OiMOIEL FUICl*IONAL REIAY REIAY SURVEIIIANCE i l_ 'h IU8CTIGEL WIT QEXX G LIIRATIN 2EET "IE3T 3EIT REIOUIIED } m" -

.1.

SAFErk IRTIITIN AND FEEDSGER ISOEJG7CM c E a. Marmaal Initiatim N.A. N.A. M(1) N.A. N.A. 1, 2, 3, 4 I +4 M ' b. Attr=atic Actuatima Icgic and N.A. N. A.~ M(2) M(2) Q(3) 1, 2, 3, 4 ? Actuatica Relays i c. Cbntainmerst Wwe-flic$1 S R M N.A. N.A. 1, 2, 3 l t O

d. _ PmWmr Wwe-Im S

M N.A. N.A. 1, 2, 3 A 4y. e. 51 tease Line hwe-Im - S R M N.A. N.A. 1,2,3 I o% e e. o

~ w

1.1, SAEEIY INJECTIN 7 d, . FR31 INJECTION 'IU 'DE ,w RemmIAT10N xxs.

c. ~

.i . ~.

s :

C3 ' a. Astrwetic Actuation : N.A. N.A. M(2) N.A.. N.A. 1, 2, 3, 4 5 12gic, CbirrMerft with'- Safety Injectim Signal b. Refuelirg Isater Storage S R M N.A. N.A. 1, 2, 3, 4 Tank Ieml-Extname Im k b s r I 1 l' N .g y - __,____..____m

'IABE 4.2-3 (Oantinue31 i to BCINEIRID SAFEIY FIK1UE ACIULTIN SYSITN DEIREENDLTIGt SLRVEIII.ANCE RIDJDufENIS

ll ser OEMeEL DESTER SIAVE N IN ISIIOt

<p OEMeEL 01ADDEL FUICIIGOLL REIAY REIAY RRWTTIJWetZ g PGECIIGEL IMIT QEK2C CAIII51KTI W 'IE3r 'IEST TEST Rm 2. O[NIhDGENT SERAY .E a. Mmuel Initiation N.A. N.A.- M(1) N.A. N.A. 1, 2, 3, 4 G-y b. Autauntic M=tist and N.A. N.A. M(2) M(2) Q(3) 1, 2, 3, 4 Ingic W=*ir=1 Relays c. Contairuussilt Pr===sre-Hi@r-S R M N.A. N.A. 1,2,3 ^ Hi@t m 3. CINDLDOENT ISOULTIN w us7. [ a. Ihase "A" Isolation "u c e-1. Marmaal Initiation N.A. N.A. M(1) N.A. N.A. 1,2,3,4 .N $ ,C-2. JafMc M=tial Logic N.A. N.A. M(2) M(2) Q(3) 1, 2, 3, 4 g and W= tion Relays v

3. ' Safety Injectim See Fiaw+innal 1. hit 1 above for all Safety Irr}ectim Surveillarnoe Requii_Am.

b. Phase sa Isolatim 1. Manual Initiation N.A. N.A.. M(1) ' N.A. N.A. 1,2,3,4 2. Ja*r==&ic Achutim N.A. N.A. M(2) M(2) Q(3) 1, 2, 3, 4 _Iogic and Deh mtion Relays, 3. Cantainummt Pr-uwe-- S R M N.A. N.A. 1, 2, 3, 4 Hi@t-Hi@2

Ircltxtes testing of CIB act21ated slave relay (s)===rv-iated witta Centrol Ptxzt hya. y Ventilation.

i TAntr.4.3-2. (nwelrasal) ~ DaGINEDCD SAFELY FEXIWE ACItRTIN SYSIDE INSIIDENDLTIN SLRVEIIIN82 REQUIRDENIS j g. tu. 315 - f OINGIEL MASTER SIAVE M[EE5 IN 1GIIG 43~ 09NGEL OINelEL M38CITOULL RELAY REIAY SLRETf2 ANT E-PtmecrIount w IT omat cnLumarIN usT .2Esr TEr REREED l , 14 t r '3 L 4. SIERM LINE ISOIATIN c: -

z y

a. Marmaal Initiation i Nr 1. IndividuralJ N.A. N.A. . M(1) N.A. N.A. 1, 2, 3 2. Systeun N.A. N.A., .M(1)

N.A.

N.A. 1, 2, 3 w b. Adr== tic Actuation Logic and N.A.; N.A. M(.r.) M(2) Q(3) 1,' 2, 3 7 Actuation Relays- .t o1M c. Otntainment Pr===we-5 ~R M N.A. N.A. 1, 2, 3 - .d ? Intermediate-Hi@-Hi@ ' ~ n. t,a - ' ~ ~ - e' d. Stan Line Pressure-Irnt, S

R~

M L N.A. - N.A. 1, 2, 3 .O t,a : .sv 1 . e. ; Sta= Line Pr=ne Rate-Hi@ S~ R. M N A.. N.A. 1, 2,. 3 - f Negative 4. .5. 'ITEBDE 11tIP AND FEEDdRIER ISOLATIN ~ a. A#rmatic Actuation Iogic and N.A.. N.A.l M(2) M(2)' Q(3) 1, 2, 3

b. : Sta= Generator Water S'

R M: N. A.- N.A. 1,' 2, 3 Level-Hi@-Hi@,5 P-14 '

c. - Safety Infection See Functional. thrit 1 above.for all Safety Injection Surveillance Regairements.

4 ~ 1' 4 i. . a .m. m 2.. a

i t i 4 "IABLE 4.3-2. (Omtirued) t c Q-Hwiret 2ED SAFEIY FEKIURE ACITATIN SYSIEM INFIRirsvuulm SLRVEIIIANT BEDU'REFE2CS m i -.M 4 5 != - <= OUNEL MAS'IER SIAVE POES IN '3GIIG t* QUNEL 09HEL M NCII G ULL REIAY REIAY SURWTTIABIT t ' N EU8CTIC992,12GT 0E3 CAT.TMATIGI 'IE5'T-M 'IT3T REEATH ED l i e 't, ~ { ' c 2: 6. TN OF POWER m H. l a. 4.16ky naprtyency Ikas N.A. R M N.A. N.A. 1, 2, 3, 4 1. Undervoltage (Trip Feed) l 2. Undervoltage (Start Diesel)- N.A. R ~ M N.A. N.A. 1, 2, 3, 4 i O. N.A. R M - N.A. N.A. 1, 2,-3, 4 4-b. 4.16kv. Dep m,-f - t 4w Btas ( W Voltage) i ~ o4 - t o s. - -. c. 480 vblt Duertpency BLas. N.A. R M N.A. N.A. 1, 2, 3, 4 "w (fWJrarkwi Voltage) Ee o.u se-i 4 c.- 7. AUXTTIARY FEEDSGER*. - :s ' 04 ii. a.. Autamtic Wi= tion Irgic and N.A. N.A. M(2) M(2) Q(3) 1, 2, 3 j Actanatimi Relays 1 1 1i b. Sta = Generator Water level-low-Im I 1. Start 'narbine Driven-S R M N.A. N.A. 1, 2, 3 ) l l 3

2.. Start Motor Driven ~

S R M N.A. N.A. 1, 2, 3 i u t PV -c. Undervoltage - RCP (Start 'S. R M N.A. N.A. 1, 2

Ibrbine Driven Pump) y-i
Manual initiation is included in specification 4.7.1.2.

'oa. ..em.,_- ,._m_. -r g .r.-- p gr p~, ,.,y-- ,rm- ,,g,. ,7,q_,.,

N 4.3-2. (Oratismed) m Hwuezae.v SAFEN ETA 2 tete JCRRTIG8 SYSTDI DETIRemawinIIG6 fk St.NerIIIZAM2 REKXIIREFE2rIS . ser 09NfEL MPGIYR SIA%T N IN WIIQt .b 05998 1 QUfDEEL FueCTIGed. REIAY REIAY SONEIIDIMM f3 mcriant, wrr omz caummm nr mr mT muman .t 7. AUXILIARY FHIMPGER'(carth) e .z .5: d. Safety Injection (Start Ittc,r-See 1 above (all SI surveillance mquirements) .: M. -Iriven Raps) Trip of Main Feehnter Pumps N.A. N.A. R N.A. N.A. 1, 2, 3 e. (Start hiven Raps) n-m - n -4y 8.- DeGDEERED SMEIY FEMt5tE INTUtIDCIS - ow-

E#'

a. Reactor Trip, P-4 N.A. N.A. R N.A. N.A. 1, 2, 3

c. t,a '

y6

b.c Pmssurizer Pr===we, P-11 N. A.'

R M N.A. N.A. 1, 2, 3 .,~ -N.A. R M N.A. N.A. 1, 2, 3 c. Iow-Irnt Tg, P-12 aa. v-. m ~ d' 4 ..m.

1 IAELE 4.3-2 (Continued) TABLE NOTATION (1) Manual actuation switches shall be tested at least once por 18 months during shutdown. All other circuitry associated with manual safeguards actuation shall receive a CHANNEL FUNCTIONAL-TEST at least once per 31 days. (2) Each train or logic channel shall be tested at least every other 31 days. (3) Slave relays that satisfy at least one of.ttu) following criteria are required to be functionally tested on a refueling frequency basis only, all other slave relays will be tested on a quarterly frequency: a. A single failure in the Safeguards Test Cabinet circuitry would cause an inadvertent RPS or ESF. actuation. b. The test will adversely affect two or more components in.one ESF system or two or more ESF systems. c. The test will create a transient (reactivity, thermal, or hydraulic) condition on the RCS. BEAVER VALLEY'- UNIT 2 -3/4. 3-38 (Proposed Wording). r w.

ATTACHMEliT D Bouver Valley Power Station, Unit !Jo. ? Proposed Technical Specification Change lio. 47 Applicable UFSAR Changes l

BVPS 3 UFSAR 7.1.2.4 Requirements for Periodic Testing Periodic testing of the RTS and ESTAS is described in Sections 7.2.2 and 7.3.2. Testing complies with Regulatory Guide 1.22 and IEEE Standard 338-1977, Criteria for the Periodic Testing of Nuclear Power Generating Station Class IE Power and Protection Systems. The surveillance requirements of the Technical Specifications, Chapter 16, ensure that the system functional operability will be \\ maintained comparable to the original design standards. Periodic testing shall be conducted at the intervals specified in Chapter 16, Paragraph 4.3.1.1.1 for reactor trip, Paragraph 4.3.2.1.1 for ESF actuation, and Paragraph 4.3.3.6 for post accident monitoring. Sensors will be demonstrated adequate for the design by test reports, analysis, operating experience, or by suitable type testing. The NIS detectors are excluded since delays attributable to them do not constitute a significant portion of the overall channel response. Where the ability of a system to respond to a bona fide accident signal is intentionally bypassed for the purpose of performing a test during reactor operation, each bypass condition is automatically indicated to the reactor operator in the main control room by a separate annunciator for the train in test. Test circuitry does not allow two trains to be tested at the same time so that extension of the bypass condition to the redundant system is prevented. The actuation logic for the RTS and ESFAS is tested as. described in Sections 7.2 and 7.3. As recommended by Regulatory Guide 1.22, where actuated squipment is not tested during reactor operation, it has been determined thatt 1. There is no practicable system design that would permit operation of the equipment without adversely affecting the safety or operability.of BVPS-2, 2. The probability that the protection system will f ail to initiate operation of the equipment is'and can be maintained acceptably low without testing the equipment during reactor operation, and 3. The equipment can routinely be tested when the reactor'is Em ).se$ quipeant that cannot be-testod at full power so as not to damage' i' equipment or upset plant operation are 1. Manual actuatica switches for-system level actuation of protective function, 2. Reactor coolant pump circuit breakers, 3. Turbine trip, 7.1-14 l' 1-f u .iI

l BVPSo3 LTSAR feedwater flow and pressure conditions necessary for proper operation of the steam generator water level control *ystem. Based on these identified problems incurred with periodic testing of the feedwater isolation valves at power, and since 1) no practical system design will permit opezaLion of these valves without adversely affecting the safety or operability of BVPS-2, 2) the probability that the protection system will fail to initiate the activated equipment is acceptably low due to testing up to final actuation, and 3) these valves will be routinely tested during refueling outages, the proposed resolution meets the guidelines of Section D.4 of Regulatory Guide 1.22. 6. Feedwater control valves These valves are routinely tested during refueling outages. To close them at power would adversely affect the operability of BVPS-2. The verification of operability of feedwater control valves at power is assured by confirmation of proper operation of the steam generator water level system. Th: sperability of th; : lave reley which actnet'es bh: celeneid, uhieb is th-actu=* N A-vica, is "=a

led de#4ng thin te:t.
14heu;h the -40$u 1 010:ing--ef--thees control valv;; i: b!;;h:d when the-shve relay is - tested, a44-4unccions-are - tested te !eeure the4 :: :les&c4+a1 meMune*4::: h:v: eeuer4Hi-which :::M--defoes-th: p::::: tit:

functi:r It is noted that.the solenoids work on the de-energize-to-actuate principle so that the feedwater control valves will fail closed upon either the loss of electrical power to the solenoids or loss of air pressure. Based on the preceding,.the testing of the isolating function of feedwater control valves meets the guidelines of Section D.4 of Regulatory Guide 1.22, 7. Reactor coolant pump primary component cooling water isolation valves (close) The primary component cooling water (PCCW) supply cud return containment isolation valves are routinely tested during refueling outages. Testing of these valves while tho' RCPs are operating introduces an unnecessary risk of costly damage to all the RCPs. Loss of PCCW to these pumps is of economic consideration only, as the RCPs are not required to perform any safety-related function. The RCPs will not seize due to complete loss of component cooling water. Information from the pump manufacturer indicates that the bearing babbitt would eventually break down but not so rapidly as to overcome the inertia of tt.e flywheel. If the pumps are not stopped within approximately 7.1-17

BVPS 2 UFSAR

10. Main generator trip The main generator trip cannot be actuated during BVPS-2

) operation without causing plant upset or equipment damage. cuitry for these devices has been provided 1 ind ally block actuation of a final devic upon operation the associated solid state logic put relay during testing. eration of the output ay, including its contact operat and continui of the electrical circuit associated with e f devices control, is checked in lieu of actual o n. Interlocking prevents blocking the output from e than o output relay in a protection train a time. Interlockin tween trains is also provided t revent continuity testing in h trains simultaneo Therefore, the redundant device as ated with protection train not under test will be avalla vent protection act. ton is required.

11. Primary component cooling to containment The PCCV containment isolation valves are required to perform a containment isolation function and will be leak-tested and exercised in accordance with the requirements of 10 CFR 50 Appendix J.

These valves cannot be full stroked or leak-tested during BVPS-2 operation. Closing of any of these valves would result in a loss of cooling water to ones, or two RCPs. These valves will be full-stroked and leak-tested during cold shutdown conditions, utilizing the leakage monitoring connections provided, in accordance with 10 CFR 50 Appendix J. Type C testing requirements. 12. Service water header isolation valves The service water header isolation valves cannot be full-stroked or leak-tested during BVPS-2 operation. -Closing of these valves will upset flow to the PCCW and turbine plant component cooling water. heat exchangers, and' will potentially cause damage to the service water pump due to run out. These valves will. be tested during BVPS-2 shutdown, when the heat load on the component cooling system is low and only; one heat exchanger. is needed- (Section g g g p p 7.6.7.4). "l" 7.1.2.5 C'onformance to Regulatory Guide 1.47' Bypass /inoperability indication is _ in agreec,ent with Regulatory Guide - 1.47 with the following clarifloation: 1. An indicator of. bypass /inoperability will be provided for redundant or-diverse portions of each safety system. (Bypass' includes any deliberate action' which renders a safety systen inoperable.) f.1 -

INSERT "1" The slave relays and associated actuation of plant equipment, which do not satisfy at least one of the following three criteria are tested during reactor operation in accordence with plants technical specifications: 1) A single failure in the safeguards test cabinet circuitry would cause on inadvertent ESF or KPS actuation. 2) The test will adversely affect two or more components in one ESF system or two or more ESF systems. 3) The test will create a transient creativity, thermal, or hydraulic) condition on the RCS. L

BVPS 2 UTSAR incorporates the capabilities for test and calibration as set forth in Paragraphs 4.9 and 4.10 of IEEE Standard 279-1971. Final actuation devices, as defined by IEEE Standard 379-1972, are capable of periodic testing in accordance with R9gulatory Guide 1.22. The final actuation devices which cannot be fe ly tested during reactor operation (for reasons as stated in Positions 4.a through 4.c of Regulatory Guide 1.22) c en -be sub "c t ed te e - per.t441-tes t eith the un44-on - 14ne and tidullyoperational testing during reactor shutdown. These devica m tened-end di::::::d i.- Scotien ' I'2 .c d Taken as a whole, the operability of all active components necessary to achieve protective functions can be demonstrated via the testing program described in this item. 3. Vith re;ard to Position C.3 of Regulatory Guide 1.53, single switches supplying signals to redundant channels are designed with at least 6 inches separation or suitable barriers between redundant circuits. 4. Compliance with the single failure criteria can be verified based on a collective analysis of both the protective system defined in IEEE Standard 279-1971 and the final actuation devices or actuators defined fu IEEE Standard 379-1972. 7.1.2.7 Conformance to Regulatory Guide 1.63 Conformance to Regulatory Guide 1.63 is discussed in Section 8.3. 7.1.2.8 Conformance to IEEE Standard 317-1976 Conformance to IEEE Standard 317-1976 Electric Penetration Assemblies in Containment Structures for Nuclear Power Generating l Stations, is discussed in Section 8.3. 7.1.2.9 Conformance to IEEE Standard 336-1971 The quality assurance requirements for installing, inspecting, and testing for instrumentation and electric equipment conforms to-IEEE Standard 336-1971. 7.1.2.10 Conformance to IEEE Standard 338-1977 The periodic testing of the RTS and ESFAS conforms to the requirements of IEEE Standard 338-1977, with the following comments: 1. The surveillance requirements of the Technical l Spacifications for protection system ensure that the system l functional operability is maintained comparable to the 7.1-21

BVPS 2 UFSAR are met as closely as possible without causing an actual safety injection. Testing described in Sections 6.3.4, 7.2.2.2.3, and 7.3.2.2.3 provides complete pericdic testability during reactor operation of all logic and components associated with the ECCS. This design meets the requirements of Regulatory Guide 1.22, as discussed in the previous sections. The program is as follows: 1. Prior to initial plant operations ESF system tests will be conducted. 2. Subsequent to initial start up, ESF system tests will be conducted during each regularly scheduled refueling outage. 3. During on line operation of the recctor, all of the ESF analog and logic circuitry will be fully tested. N +n addition, er entielly-211 ef th: EST final n ue ere wiM4e fu44y testei Se

!ning f:e fin:1 n :::::: wheee eperatien 1: net--rr;:tible ui P ::n:in;;d ;n-ida; pleat

,opues4en ui!! 5: chnh:d b'; n:=: cf antinui;y tee;ing. Performance Test Acceptability Standard for Safety Injection Signal and Automatic Signal for Containment Depressurization et_uation Generation During reactor operation, the basis for ESTAS acceptability will be the successful completion of the overlapping tests performed on the initiating system and the ESTAS (Figure 7.3 3). Checks of process indications verify operability of the sensors. Analog checks and tests verify the operability of the analog circuitry from the input of these circuits through and 1.ncluding the logic input relays except for the input relays during the solid state logic testing. Solid state logic testing also checks the digital signal path from and including logic input relay contacts through the logic matrices and master relays and perform continuity tests on the coils of the output i slave relays. Final actuator testing operates ~ the output slave relays and verifies operability of those devices which require safeguards -actuation and which can be testad without causing plant apset. A ::n:Am Mty ;i ni i; pu fer d se :he ;;;;e;ere of ;he '- untut:51: dr ie::. Operation of the final devices is confirmed by-control board indication, and by visual observation that the appropriate pump breakers close and automatic valves have completed-their travel. The basis for acceptability for the ESF interlocks will be control board indication of proper receipt of the signal upon introducing the required input at the appropriate set point.- i hM,A A sebk pp et W.63 acL\\% w,\\\\ be k\\\\y rm.miy py et Al mLA w,\\\\ b u on.aq 4en ea uh e is s b % n R R \\,9. h A \\ c h. w s o n reAh , wn 9u.h %,1p soud Lp ~4 udut surod).m hJs gnM cbemg f.ek 7 I 1 5

BVPS 8 UFSAR i i valve (HOV) contactors, solenoid operated valves, emergency diesel generator starting, etc. j Analog Testing Analog testing is identical (except as noted) to that e ed for reactor trip circuitry and is described in Section 7.2. An exception l to this is containment spray, which is energized to actuate two out of four and reverts to two out of three when one channel is in test. Solid State Logic Testing Except for containment spray channels, solid-state logic testing is the same as tnat discussed in Section 7.2. During logic testing-of one train, the other train can initiate the required EST function (Katz 1971). Katz (1971) gives additional information on solid-state logic testing, j Actuator Testi?.a At this point, testing of the initiation circuits through operation of the master relay and its contacts to the coils of the slave relays I has been accomplished. Slave relays do not operate because of the reduced voltage. 4g 4 oyer.\\e b) %s e. Jed nel TheA ESTAS final actuation dev4*e or actuated equipmenthtecting will i be performed from the engineered safeguards test cabinets. These i cabinets are-normally located near the SSPS' equipment. One test i cabinet is provided for each of the two protection-trains, Trains A i and ** Each cabinet contains individual test switches necessary to act. w the slave relays. To prevent accidental actuation, test sw N ues are of the type that must be rotated and then depressed to 1 l operate the slave relays. Assignments of contacts-of-the-slave relays for actuation of various final devices or actuators have be:n j made such that groups of devices or actuated' equipment can be operated individually. d"-ix; "'# M ;;; :, tie., with;;t c;;;ing pi n t i _...__.a.--- In the unlikely event ~ that-a(safety injection signal is initiated during the test of'the final device l that is actuated by this test -the device will already be in its i sateguards, position'. onhe,t\\ovtic\\q4es%e, During Athi: !=t prn ;dur close communication-between the main l control room operator and.the operator at,the test panel is required. } Prior to the energizing of a slave relay, the: operator in the main i control room assures that plant conditions will permit operation of the equipment that is to be actuated by the relay..After the test panel operator has energized the slave relay, the main control room operater observes that allhequipment has operated,; as indicated by WS00d C appropriate indicating lamps, monitor lamps, an.d-annunciators on - the main control -board, : d

in;

. prep =:d th::E!!:t, :::::d: ell-

p: retire. This operator-then resets.all devices andg prep =::

f:r ' f th: := :1=: :: ley-:: tun :d :qWpe+nt.o ep::: tie -f rebvM plan dth 5 7. 3 - 15 '- ,jo prebsk ceMonS.: J C

4 y

vwt-vv wf e 4 e-

i BVPS*2 UTSAR' ] i 1 ans of the procedure outlined previously, all tsr A H -- actuate SFAS initiation circuits W.;. a ceptions noted p " W tomatic h@ tussion of Regulatory Guide 1.22, are in Section 7.1.2. i ut;;t:: S hin; ::d C:stituit; T:: Ci : it: e ese. few finil actuation devices that cannot be designed to ] ac ted during BVPS 2 operation (discussed-in Sectton 7.1.2.4) ave -) been saigned to slave relays, for which additional test c uttry has been rovided to individually block actuation of,a. fin device- 'l upon ope tion. of the associated slave relay dur testing.- H Operation of ese slave relays,. including : contact erations _and continuity of e electrical circuits associate with the final' devices': control, e checked in-lieu of. actu operation. 'The circuits. provide fo monitoring of the sla -relay contacts, the_ devices' control circui cabling, control vo go, and the.. devices' actuation solenoids. Int locking preven blocking the output from more than -one output. rela

in: a p ection train at a-time.-

Interlocking between Trains _A and' is also provided to prevent i -continuity testing.in. both train s imultaneous ly.-- - The -redundant device associated -'with the pr oc on train.not under test will be available in the event protect e actio is required..If an accident ~ occurs during testing,- e automatic ctuation circuitry will override testing as note reviously.- One.e option to thisuis'=that if' the accident occur hile-testing a slave ay whose" output:must be blocked, those f final actuation devices as isted. with this slave relay will be overridden 0 however.the re ' dant devices.in; the other trai ould.be operational.and would perfore ha' required-c safety.func on. Actuation devices to be blocked are ntified in 4 Section 7. 2.4. 'j The ntinuity test circuits for those components that canno be-ac sted on line are verified by providing' indicating-lights on" t foguards test racks < ADO TNSE6 - up The-typical schemes.-for _ blocking _' operation of colected' protection. . function actuator circuits are shown on Figure'7.3 4 as-Details A and B. The schemes operate -as explained by' the 'followinslandlare i 4 duplicated for each safeguards train.- Detail A shows the circuit.for contact. closure forL protection function' actuation. Under normal-BVPS 2 operation, and equipment not-under. test,- the-test-lamp DS*- for Lthe-_various circuits will be energized.; Typicalfcircuit-path will be through.the normally 1 closed testy relay l contact Kg* L and1 throu'shb test lamp-connections 1 to 3.1 Coll X2-will be capable,of being energized for -protection' function-I actuation :upon closure of solid state logic output' relay' contact K*.e Coil.X2,isitypical?for;aLbreaker. closing : auxiliary -coil ;isotoru starter-: master coil, coil of a solenoid-valven auxiliary relay, etc.; When'the contact Kg*:is opened-toLblock energising of coil X2,. the t white _ lamp islde energized and.the'slavet relay K* may~beienergized-to u7.3-16 L w ,-,,J .m, -~ ,,._,G,,,.m_ ._._,...-A.ri, erc _,_i., .e.

Il!M:RT "2" The remaining slave relays and associated final actuation devices are functionally tested during the refueling outages. Various performance tests are conducted during the refueling outages to ensure ESP system operability. The slave relays are verified to be operable during these tests. The performance tests verify that each contact in the slave relay performs its safety function.

BVPS 2 LTSAR perfors continuity testing. This continuity testing is verified by depressing test lamp DS* and observing that the lamp lights through connection 2 (Contact K8* open) through solid state logic output relay contact K* (now closed) and finally through actuator coil X2 Sufficient current will flow in the circuit to cause the lamp to glow but insufficient to cause the actuator coil X2 to operate. To verify operability of the blocking relay in both blocking and restoring normal service, open the blocking relay contact in series with lamp connections - the test lamp should be de-energized; close the blocking relay contact in series with the lamp connections the test lamp should now be energized. This test verifies that the circuit is now in its normal, that is, operable condition. Detail B shows the circuit for contact opening for protection function actuation. Under normal BVPS-2 operation, and equipment not under test, the white test 1 rap DS*, for the various circuits will be energized, and green test laap DS* will be de-energized. Typical circuit path for white lamp DS* will be through the normally closed solid state logic output relay contact K* and through test lamp connections 1 to 3. Coil Y2 will be capable of being de energized for protection function actur, tion upon opening of solid-state logic output relay contact K*. Coil Y2 is typical for a solenoid valve coil, auxiliary relay, etc. When the contact K8* is closed to block i de energizing of coil Y2, the green test lamp is energized and the slave relay K* may be energized to verify operation (opening of' its contacts). To verify operability of the blocking relay in both blocking and restoring normal

service, close the blocking relay contact to the green lamp the green test lamp should be energized; open this blocking relay contact the sreen~ test lamp'should be de-energized, which verifies thst the circuit is now -in its normal (that is, operable) condition.

3 I Time Required for Testing i. It is estimated that analog testing can be performed at a rate of several channels per hour. Logic testing of Train A or B can be performed in less than 2 hours. Testing of actuated components -(in:1 din; th:::. rhi*h ::: ::!y 5: 70:0i:117 :::::d) will be-a function of main control room operator availability. It is expected to require several shifts to accomplish these tests. During this procedure automatic actuation circuitry will override testin a,am**FC' for-thcag_few devices associated with a single e ay whose outputs amat os el::4 anjd__then-on w ile blocked. It' 'is anticipated that. contin y-testing asseoi : d with a blocked slave relay coul several sinutes. During this time, tne redundant devita n the other trains would be functional. Summary of On-Line Testing Capabilities The procedures described provide capability.for checking completely from the process signal to the -logic cabinets and from there to the individual pump and f an circuit breakers or starters, valve 7.3-17 t -4.

) BVPSo8 UTSAR contractors, pilot solenoid valves, etc. including all field cabling actually used in the circuitry called upon to operate for an accident condition. For those 6ew devices whose operation could adversely l affect BVPS 2 or equipment operation, the same procedure provides for checking from the process signal to the logic rack. sg; ;t.;;; tr.:_ 44aa4--escuation-d: fie: a centinuity-:::t :f th: individu;; centce f hkg s W s rel (* 4 ths b N o 6 \\ h Cy,3\\gh.,&ispeMtstbduf ,arfor==d-sirtuite !? n The procedures require testing at various locations:g tek\\g ed l ep. p, 1. Analog testing and verification of bistable set points are l accomplished at the process analog racks. Verification of bistable relay operation is done by the main control room status lights. 2. Logic testing through operation of the master relays and low voltage application to slave relays is done a t -- the logic i rack test panel. st\\ed 3. Testing ofApumps, fans, and valves-is done.at a test' panel located in tne vicinity of the logic racks, in combination' i with the main control room operator. 4. C x:i -ity

' ; ";; d::: ci rit: d:: ::- :: h op ::: d i; d;;; :t d: :eee-4eet p r:1 ::::i:::d 1-ite: J.

The reactor coolant pump (RCP) essential service isolation valves consist of the-isolation valves for the component cooling water-(CCW) and the seal water-return' header. For the discussion of testing limitations of these valves, refer to Section 7.1.2.4,-Items 7 and.9. Containment spray system tests will be performed periodically. The-pump tests will be performed with the isolation valves in the. spray supply lines at the containment and spray _ chemical additive tank closed. The valves tests-are performed with the pump _ stopped. During this testing, automatic actuation. circuitry will override testing. I Testina Durina Shutdown j h ECCS tests 'will be performed at each major fuel reloading with. i the RCS isolated from the ECCS by elosing the appropriate valves. A l test; _ safety injection.-signal will then be applied to initiate operation of active components (pumps and valves) of the ECCS.- This-is in compliance with GDC 37. The. c m M b'

6 Y#

{ h'd m Wkpe& b d'C > 1 S'g g 6 % %4u Pw;"~yjaDD.dd_gok: l A T"g' - ou + A' W Y P s 7.3-18 0}}

ML20073D431

Text

1.1 DESCRIPTION

Navigation menu

Search