ML20077L966
| ML20077L966 | |
| Person / Time | |
|---|---|
| Site: | Crystal River  |
| Issue date: | 08/25/1983 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML20077L960 | List: |
| References | |
| TAC-49356, NUDOCS 8309120049 | |
| Download: ML20077L966 (5) | |
Text
.
f%
/
,g UNITED STATES
- o y*
NUCLEAR REGULATORY COMMISSION
,, e {' / el W ASHINGTON, 0. C. 20555, t%
g u dg SAFETY EVALUATIOfi BY THE OFFICE OF fluCLEAR REACTOR REGULATI0f4 SUPPORTIf4G At1Ef1Df!ENT ti0. 66 TO FACILITY OPERATIT G LICEf4SE tl0. DPR-72 FLORIDA POWER CORPORATI0ft, ET AL CRYSTAL RIVER UtlIT NO. 3 fiUCLEAR GEttERATI!1G PLAtiT CJCKET tiO. 50-302 INTRODUCTION Florida Power Corporation (the licensee), in a letter dated January 14, 1983, requested a change to the Crystal River Unit 3 Technical Specification requirement to perform monthly functional testing on manual and automatic initiation logic circuitry associated with the engineered safsty #eatures.
The change would incraase the time interval between testing for certain components which can result in undesirable effects on the plant if tested during power operation.
The staff's evaluation of this request involved a number of recueste #0r additional information from the licensee and two eetings (January 17 ar.d July !?, ' M:) M t' t'.e ' M em ee. 'The results of our evaluation are included herein.
BACKGROUND In Amendment 61 to the operating license for Crystal River Unit 3, tne tecnnicai specification requirements to conduct monthly channel functional tests of manual initiation and automatic actuation logic for the engineered safety feature actuation sys.tems were waive.d un'til refueling IV scheduled for March 1983.
This action was taken in response to the licensee's change request dated January 14, 1983, wherein it was noted that although the engineered safety feature systems were designed to be tested during power operation, the tech-nical specification requirements to conduct such testing had not been incorporated into the plant surveillance procedures for some safety functions.
Further, it was noted that where such testing had been included in surveillahce procedures, several adverse consequences had occurred as a result of testing and additional potential adverse consequences had been identified which could result from such testing.
Since the licensee concluded that these adverse consequences posed a significant threat to plant reliability and may pose safety concerns of varying severity, he was compelled to cease such testing during power operation.to maintain an adequate level of plant reliability and
' safety.
!\\
\\\\
d The licensee acknowledged that heretofore they had not tested the engineered gga@.safety feature actuation systems in the manner implied in the Final Safety Analysis Report (FSAR) and as required by plant technical specifications.
oo SS Further, recognizing the need to maintain an adequate test program to assure O
o reliable operation, the licensee proposed the following program:
os f
l rac oo 1)
Defer all such testing until Refuel IV.
h 2)
Develop appropriate surveillance tests before restart from Refuel IV to no allow safe and reliable testing during power operating in Cycle V and thereafter for those test groups which can be so tested without j
modi fications.
3)
Parform a review to datermins what actions are ntcessary to allow optimum testing on a schsdule to support performance of any neecec plant modifica-tions in Refuel V.
For item 1) above, the licensee proposed changes to the plant technical speci-fications that would change the frequency of channel functional tests for manual initiation from monthly to every refueling.
Also, the channel functional tasts for automatic actuation logic would be annotated to indicate that testing need not include operation of actuated equipment where such operation could affect the safety ar operability of the plant or where equipment is normally in its post accident configuration.
The NRC staff concluded that the licensee riad provided a sufficient basis for not testing in the interim period for which relief was requested based on the demonstrated operability of actuated equipment covered by the inservice test-ing program, the relatively low probability of relay contact and circuit continuity failures which would be revealed by the deferred tests, and the potential for adverse consequences that could pose a threat to plant safety due to testing during power operation.
However, in the absence of a more thorough review of the testing features incorporated in the system design, the NRC staff with the concurrence of the licensee waived the requirements for testing until Refuel IV in lieu of incorporating the language of the technical specifications as proposed by the 1icensee.
This action sas taken since the changes proposed by the licensee did not limit the period in which relief would be granted to those few months preceding Refuel IV.
EVALUATION The design of the Crystal River engineered safety feature actuation system consists of three sensor channels and two trains of logic channels.
Each sensor channel deenergizes a separate relay in each logic channel on a channel trip.
Contacts of the logic channel relays associated with each sensor channel are used to form a two out of three logic matrix to perform each pratective action, such as start a pump or change the position of a valve.
The channel functional tests performed on each sensor channel trips all of its associated relays in each train of the logic channels.
These tests confirm the operation of the logic channel relays by the use of status lights which are in series with a contact of each logic channel relay.
The logic channel relays are divided into three groups for each protective function Test switches in series with the logic channel relays permit testing of each two out of three combina-tion of logic channel relays within each group.
The channel functional test of the logic channels therefore confirms the operability of the two out of three logic for all safety actions associated with each group.
However,.since the two out of.three matrix of logic channel relay contacts are wired directly to the actuated components, the testing of each group requires that all actuated components in the group change state to verify one combination of the logic.
There are two major considerations that impact the channel functional testing of the actuation logic in this design.
The first is that in order to confirm the operability of the logic, each actuated component must be cycled from the nonsafety state to the safety state three times in order to confirm each combi-nation of the two out of three logic matrix relay contacts.
The second con-sideration is that all components associated with each group must undergo a change in state in order to perform the channel function test of the actuation logic.
These considerations will be addressed as they relate to the request for relief from the current testing requirements.
2
As a basis to support the requested relief from the requirements for channel functional tests of the automatic actuation logic, the licensee has reference *d the guidance provided in Regulatory Guide 1.22, " Periodic Testing of Protection System Actuation Functions" Specifically, Regulatory Position 4 excludes testing of actuated equipment during reactor operation where such action would adversely affect safety or operability of the plant, the probability of pro-tection system failure is acceptably low without such testing, and it can be routinely tested when the reactor is shut down.
While the NRC staff concludes that one or more components associatad with each test group satisfies this criteria, many components do not.
However, as noted above, the dosion provi-sions for logic testing allow either an all or nothing approach to be taken for channel functional tests for each test group of a protective function.
The NRC staf f did not accept the licensee's proposed Statencnt for the technical sneci-fication modifications since it would permit exclusion of all components in a test group when any component associated with that group was judged to have an l
adverse affect on operation.
It was concluded that the proposed change went beyond the intent of the regulatory position with regard to exceptions to func-tional testing requirements due to the specific nature of the automatic actua-tion logic test capabilities.
In the evaluation of the requested relief from the current technical specifica-tion requirements, consideration was given to a number of factors that have a bearing on the safet.y significance of this action.
First, it is noted that channel functional tests which are performed on a monthly basis for sensor channels do confirm the operability of a majority of functional aspects of the actuation logic matrix relays.
This includes the operation of the relay coil and a change in state of one of the relay contacts.
The only aspect of logic matrix relay that is not checked is the change in state of the relay contacts that form the matrix of the two out of three logic and the continuity of the wiring from the relay contacts to the actuated devices.
Therefore, the NRC staff requested that the licensee' indicate what experience they had on failures of these types from tests that had been conducted since the plant went into commercial operation in 1977.
Based on a review of the testing and maintenance history of these systems, no failures were identified to have occurred in the logic matrix relay contacts or associated wiring continuity.
Therefore, it may be concluded those failures as would.be revealed by channel function tests of the automatic actuation logic have a low probability of occurrence.
Another factor bearing on this matter is the testing which has been performed in order to verify that these systems are operable.
The licensee had noted that channel functional tests of the automatic actuation logic would be con-ducted when the unit was shutdown for Refuel IV.
As noted above, the channel functions test of the two out of three matrix relay logic requires that the actuated equipment change state three times in order to confirm the operability of each logic combination.
In discussing this facet of the testing, the licensee noted that the plant surveillance procedures only required that one l
combination of the two out of three logic be tested at any one time.
During l
subsequent tests, other combinations are used such that only on the third time l
that the procedure was used would all combinations of the logic have been tested.
Further, it was learned that this approach was also used for those channel func-tional tests which had been previously conducted on a monthly basis in con-formance to the technical specification requirements.
In regard to this matter, I
the MRC staff concludes that this is another arca in which the licensec has incor-rectly interpreted and applied the surveillance requirements of the plant 3
technical specification's.
Specifically, it is noted in the bases of the plant technical specifications that the operability of these systems ensure that 1) the specified coincidence is maintained and 2) sufficient redundancy is main-tained to permit a channel to be out of service for testing or maintenance.
Further, the channel functional tests are defined as inclusive of those actions required to demonstrate that the automatic actuation logic is operable.
Based on the licensee's approach used to test these systems, it is concluded that many of these systems have only been tested once since the plant went into commercial operation.
This includes one logic combination test during each of the first three refueling outages.
Therefore, noting this possibility, the NRC staff requested that the licensee confirm that the operability of these systems would j
be demonstrated by testing all logic combinations prior to resumption of power operation following Refuel IV.
In response, the licensee has noted that the surveillance procedures were modified to insure that these systems are operable by tests of all logic combinations and that these tests will be completed prior to subsequent power operation.
Further, these tests will be performed during each subsequent refueling outage as well as during each cold shutdown in excess of two weeks as a compensatory measure while operating under any interim relief.
In the licensee's initial request for relief, their proposed progran for permanent resolution of this matter indicated that before restart from Refuel IV, appro-priate surveillance procedures would be developed to perform channel functional tests of the automatic actuation logic for those test groups of protective functions that.did not include components which could adversely affect safety
- ur operability of the plant.
This action has been completed and includes all test groups of low pressure injection and test group 3 of high pressure injec-tion.
With regard to these tests, the licensce's past practice of testing only one logic combination has been considered.
It is noted that the low pressure injection function only involves the repositioning of four valves and that test group 3 of high pressure injection involves the starting of 13 pumps and fans.
Further, the licensee has noted that all pumps are started nonthly as well as two of the five fans associated with test group 3 of the high pressure injection.
Therefore, we conclude that the monthly testing of these actuated components reduces the potential for undetected failures and that the addi-tional assurance provided by testing all logic combinations to demonstrate the operability of the automatic actuation logic as well as the increased operating cycles imposed upon the actuated equipment is not warranted.
Therefore, the technical specifications have been revised to require that only one combination of logic matrix relay contacts be verif.ied operable by the monthly channel functional tests.
The licensee requested that the surveillance interval for the channel functional tests of manual initiation of safety functions be changed from monthly to each refueling outage.
The manual initiation of safety actions is performed by a separate push button switch for each safety function which energizes a set of auxiliary relays.
Contacts of these auxiliary relays are used to duplicate the action of the automatic actuation logic matrix relay contacts to provide the required safety action.
In that the proposed change is consistent with standard plant technical specification requirements for surveillance of manually initiated safety actions, we find this acceptable.
Further, testing of the manual initia-tion will have been completed prior to entry into Mode 4 following Refuel IV.
Recognizing that manual initiation of safety functions provides an additional means to assure that safety actions are initiated, the licensee has noted that i
4
~-,
-,.-4
-s y p +
operator training and procedures require the operator to fdllow automatic actuation of safety functions with manual actuation once it has been verified that the automatic actuation was not spurious.
We conclude that this further reduces the safety impact on those safety functions for which relief from the monthly testing requirements has been requested.
Finally the licensee has noted that they have committed to pur uing the detailed engineering study and related redesign ef forts to bring about a permanent resolution of this matter.
To that end they have committed to provido a detailed schedule including the opportunity for NRC pre-implementation review by no later than October 1983.
Therefore,withconsiderkionoftheactionsthathavebeentakentodemonstrate that the automatic actuation logic is fully operable prior to subsequent opera-tions from Refuel IV, the relative low probability for failures in those por-tions of the logic for which relief from the technical specification require-ments for monthly channel functional tests has been requested, and the licensee's commitment to a plan of-action for permanent resolution, we find that the requested relief is acceptable throughout the fuel cycle V on an interim basis.
The specific format of this relief as reflected in the change to the technical spet.ications was discussed with and accepted by the licensee.
\\
RNVIRONMENTAL CONSIDERATION
\\
We have determined that the amendment does not authorize a change in effluent types or total amounts nor an increase in power level and will not result in any significant environmental impact.
Having made this determination, we have further concluded that the amendment involves an action which is insignificant from the standpoint of environmental impact, and pursuant to 10 CFR 551.5(d)(4), that an environmental impact statement, or negative declaration and environmental impact appraisal need not be prepared in connection with the issuance of this amendment.
CONCLUSION We have concluded, based on the considerations discussed above, that:
(1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, and (2) such activities will be conducted in compliance with.the Commission's regulations and the issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public.
l Dated:
August 20, 1983 I
Principal Contributors:
T. Dunning I
l l
5 l
.-