ML20084K217
| ML20084K217 | |
| Person / Time | |
|---|---|
| Site: | Limerick  |
| Issue date: | 05/08/1984 |
| From: | Boyer V PECO ENERGY CO., (FORMERLY PHILADELPHIA ELECTRIC |
| To: | Eisenhut D Office of Nuclear Reactor Regulation |
| Shared Package | |
| ML20084K220 | List: |
| References | |
| GL-83-28, NUDOCS 8405110146 | |
| Download: ML20084K217 (16) | |
Text
.._
PHILADELPHIA ELECTRIC COMPANY 2301 M ARKET STREET P.O. BOX 8699 PHILADELPHIA. PA.19101 8.
O V. S. BO Y E'R SR. VICE PRESIDENT NUCLE A R POWE R May 8, 1984 Re: Docket Nos. 50-352 50-353 Mr. Darrell G. Eisenhut Division of Licensing U.S. Nuclear Regulatory Commission Washington, DC 20555
References:
- 1) Generic Letter 83-28, " Required Actions Dased on Generic Implications of Salem ATWS Events", July 8, 1983
- 2) Le t te r, J. F. S tolz, USNRC, to E. G.
Bauer, Jr, PECo, " Clarification of Required Actions Based on Generic Implications of Salem ATWS Events",
October 21, 1983
- 3) Letter, V. S. Boyer, PECo, to D. G. Eisenhut, USNRC, " Response to Generic Letter 83-28, November 10, 1983
Dear Mr. Eisenhut:
This letter is a follow-up to the Reference 3 letter describing the current status of Philadelphia Electric Company's program to address the positions contained in Generic Letter 83-28, " Required Actions Based on Generic Implications of Salem ATWS Events", July 8, 1983.
Philadelphia Electric Company has been participating in industry wide generic efforts conducted by the BWR Owners Group and INPO to address certain positions in Generic Letter 83-28.
Additionally, where these generic efforts have not been applicable to Philadelphia Electric Company, we have taken actions that we believe conform to the positions in Generic h
tP 8405110146 040500 l
DR ADOCK 05000352 i I PDR
\\
1
Mr..D. G. Eisenhut Page 2 Letter 83-28 applicable to Limerick Generating Station Units 1 and 2.
Those positions-in Generic Letter 83-28 to which we committed to respond in the Reference 3 letter are as restated below along with our response.
ITEM 2.l' E LUIPMENT CLASSIFICATION AND VENDOR INTERFACE (REACTOR
~-
TRIP 5757ER UDRP5HERTS)
Position Licensees and applicants shall confirm that all components whose functioning is required to trip the reactor are identified as safety-related on documents, procedures, and information handling systems used in the plant to control safety-related activities, including maintenance, work orders, and parts replacement.
In addition, for these components, licensees and applicants shall establish, implement and maintain a continuing program to ensure that vendor i
i information is complete, current and controlled throughout the life of.the plant, and appropriately referenced or incorporated in plant instructions and
[
procedures.
Vendors of these components should be l
contacted and an interface established.
Where vendors 1
cannot be identified, have gone out of business, or will not supply the information, the licensee or; applicant shall assure that sufficient attention is-paid to equipment maintenance, replacement, and repair, p
to compensate for the lack of vendor backup, to assure reactor trip system reliability.
The vendor interface program shall include periodic communication with vendors to assure.that all applicable'information has L
been received.
The program should use a system of positive feedback with' vendors for mailings containing technical information.
This could be accomplished by licensee acknowledgement'for receipt of technical mailings.
The program.shall also define the interface 1
and division of responsibilities among the licensees and the nuclear and non-nuclear divisions'of their 4
vendors that provide service on reactor trip system components to assure that requisite control of and applicable instructions for maintenance work are provided.
9 4
Mr. D.13. Eisenhut Page 3
Response
Currently, vendor manuals are maintained up to date by the Architect-Engineer's Document Control Group as specified in the Reference 3 letter in response to position 3.1.2.
The Philadelphia Electric Company Independent Safety Engineering Group (ISEG) is preparing procedures for the independent review of information supplied by the NSS Supplier for the on-going vendor interface program to assure that vendor manuals are maintained current for the life of the plant and that plant procedures are in accordance with vendor recommendations.
These procedures are expected to be completed by June 1, 1984.
For reactor trip function components which were all supplied by'the NSS supplier, these procedures will be utilized to address the following types of General Electric Company technical reporting:
Service Information Letters (SIL)
Customer (Urgent) Communications 10CFR21 Reporting Service Advice Letters (SAL)
Application Information Documents (AID)
Additionally, to further improve our control of vendor manuals once Limerick Unit 1 becomes operational, the Engineering and Research Department has re-classified vendor manuals as drawings.
By doing this, the vendor manual becomes part of the drawing file and is subject to the same Engineering and Research Departmental Procedures (ERDP) regarding drawing control and requires updating of the manuals just as drawings are updated following modification work.
A new ERDP~
specifically addressing control of the vendor manuals in this manner has been prepared and is in the approval process.
It is expected that.this procedure will be in effect'by September 1, 1984.
I 5
J e,em-r--
g---,o v-e-p we e v.e y
-,m,,-g-p-,,,wgm m.w, mp,e m,-, -
, y
,-p e, m m ig.e-s
--w
, -w wn e v m e mmm -m m-m e
-w-,v--wm-re-9,-,mv,r =wmv sw www-es--*-
Mr. D. G. Eisenhut Page 4 ITEM 2.2 EQUIPMENT CLASSIFICATION AND VENDOR INTERFACE JPROGRAMS FOR ALL SAFETY-RELATED COMPONENTS)
Position For vendor interface, licensees and applicants shall establish, implement and maintain a continuing program to ensure that vendor information for safety-related components is complete, current and controlled throughout the life of their plants, and appropriately referenced or incorporated in plant instructions and procedures.
Vendors of safety-related equipment should be contacted and an interface established.
Where vendors cannot be identified, have gone out of business, or will not supply information, the licensee or applicant shall assure that sufficient attention is paid to equipment maintenance, replacemerit, and repair, to compensate for the lack of vendor backup, to assure reliability commensurate with its safety function (GDC01).
The program shall be closely coupled with action 2.2.1 above (equipment qualification).
The program shall include periodic communication with vendors to assure that all applicable information has been received.
The program should use a system of positive feedback with vendors for mailings containing technical information.
This could be accomplished by licensee acknowledgement for receipt of technical mailings.
It shall also define the interface and division of responsibilities among the licensee and the nuclear and non-nuclear divisions of their vendors that provide service on safety-related equipment to assure that requisite control or applicable instructions for maintenance work on safety-related equipment are provided.
Response
Philadelphia Electric Company participated in the Nuclear Utility Task Action Committee (NUTAC) on Generic Letter 83-28, Section 2.2.2 along with 56 other utilities.
The report issued by the NUTAC titled
" Vendor Equipment Technical Information Program",
February, 1984, is attached for your reference.
It documents a Vendor Equipment Technical Information Program (VETIP) that responds to the concerns on vendor information and interface addressed in Section 2.2.2 of the generic letter.
The VETIP is an industry-controlled program that does not rely on vendor action, other than the NSSS supplier, to provide information to
Mr. D. G. Eisenhut Page 5 utilities.
We conclude that this approach will be more effective than the vendor-oriented program suggested in the generic letter for reasons discussed on pages 5 and 6 of the NUTAC report.
In response to Section 2.2.2 of Generic Letter 83-28, we will assure conformance with the various elements of the Vendor Equipment Technical Information Program using the guidance provided in the NUTAC report.
The specific programs involving utility implementation responsibilities are described in Section 4.1.1 of the NUTAC report and summarized below.
Administrative controls will be strengthened in several areas to assure full compliance.
Development of the administrative procedures to ensure implementation of the programs described in Section 4.1.1 will be completed by March, 1985.
These programs are summarized as follows:
1.
NSSS Vendor
Contact:
This program consists of a technical bulletin system and necessary contact with the NSSS supplier.
Administrative controls will be established to ensure an assessment of the technical information by qualified personnel, and that the appropriate actions are taken as deemed necessary by the assessment.
2.
NPRDS: the current level of participation in Nuclear Plant Reliability Data System will be expanded as needed to conform with INPO requirements.
3.
Other Vendors: We will continue to seek assistance and equipment technical information from other safety-related equipment vendors when our evaluation of an equipment problem concludes that such direct interaction is necessary or would be beneficial.
4.
Handling of Equipment Tecnnical Information:
Administrative procedures will provide control of incoming equipment technical information that is received from a vendor or from other' industry or regulatory sources.
This includes, but not limited to, information received from vendors (drawings, instruction manuals, etc.), INPO (NPRDS, SOERs),
NRC (Bulletins, Information Notices, and NUCLEAR NETWORK).
Administrative procedures will be established to ensure it receives the appropriate L
Mr. D. G. Eisenhut Page 6 technical review, evaluation, distribution, and control for future reference.
Appropriate actions will be taken as deemed necessary by the evaluation.
Technical information will be incorporated into the maintenance or operating procedures, purchasing records, and training program as appropriate.
5.
Internal Handling of Vendor Services: The vendor, contractor, or t echnical representative who will perform safety-related cervices will be an approved / qualified supplier and will perform the service in accordance with Philadelphia Electric company's QA program.
ITEM 4.5 REACTOR TRIP SYSTEM RELIABILITY JSYSTEM FUNCTIONAL
{EEMRC)
~~
~
Position On-line functional testing of the reactor trip system, including independent testing of the diverse trip features, shall be performed on all plants.
l 1.
The diverse trip features to be tested include the breaker undervoltage and shunt trip features on Westinghouse, B&W (see Action 4.3 above) and CE plants; the circuitry used for power interruption with the silicon controlled rectifiers on B&W l
plants (see Action 4.4 above); and the scram pilot valve and backup scram valves (including all initiating circuitry) on GE plants.
2.
Plants not currently designed to permit periodic on-line testing thall justify not making modifications to permit such testing.
Alternatives to on-line testing proposed by licensees will be considered where special circumstances exist and where the objective of high reliability can be met in another way.
3.
Existing intervals for on-line functional testing required by Technical Specifications shall be reviewed to determine that the intervals are consistent with achieving high reactor trip system availability when accounting for considerations such as:
a.
Uncertainties in component failure rates.
Mr. D. G. Eisenhut Page 7 b.
Uncertainty in common mode failure rates.
c.
Reduced redundancy during testing.
d.
Operator errors during testing.
e.
Component " wear-out" caused by the testing.
Response
Table 1 specifies the frequencies for testing the reactor protection system as submitted to the Commission in the proposed Limerick Technical I
Specifications, i
i I
k 4
t I
i I
1 t
i
Page 8 TABLE 1 REACTOR PROTECTION SYSTEM INSTitUMENTATION SURVEILLANCE REQUIREMENTS CHANNEL OPERATIONAL CHANNEL FUNCTIONAL CHANNEL CONDITIONS FOR WHICH FUNCTIONAL UNIT CHECK TEST CALIBRATION (a )
SURVEILLANCE REQUIRED
(c)
(g)
- a. Neutron Flux - High S/U, S, ( b)
S/U
,W R
2 S
W(9)
R 3,4,5 (g)
- b. Inoperative NA W
NA 2,
3, 4, 5 (f)
- 2. Average Power Range Monitor:
(c)
(g)
- a. Neutron Flux -
S/U, S, ( b)
S/U
,W SA 2
Upscale, Setdown S
W(9)
SA 3,5
- b. Neutron Flux - Upscale:
(c)
(d) (e)
- 1) Flow Biased S
S/U
,W W
,SA 1
(c)
(d) (e)
- 2) High Flow Clamped S
S/U
,W W
,SA 1
(g)
- c. Inoperative NA W
NA 1,
2, 3, 5
(g)
- d. Downscale S
W SA 1
- 3. Reactor Vessel Steam Dome Pressure - High S
M R
1, 2
Low, Level 3 S
M R
1, 2
- 5. Main Steam Line Isolation Valve - Closure NA M
R 1
a
- 6. Main Steam Line Radiation -
(i)
High S
M R
1, 2
- 7. Drywell Pressure - High S
M R
1, 2
- 8. Scram Discharge Volume Water (j)
Level - High NA M
R 1, 2, 5
Page 9 TABLE 1 REACTOR PROTECTION SYSTEM INSTTtDRERTATION SURVEILLANCE REQUIREMENTS CHANNEL OPERATIONAL CHANNEL FUNCTIONAL CHANNEL CONDITIONS FOR WHICH FUNCTIONAL UNIT CHECK
-TEST CALIBRATION (a)
SURVEILLANCE REQUIRED
- 9. Turbine Stop Valve - Closure NA M
R 1
- 10. Turbine Control Valve Fast Closure Valve Trip System Oil Pressure - Low NA M
R 1
- 11. Reactor Mode Switch Shutdown Position NA R
NA 1,2,3,4, 5
- 12. Manual Scram NA M
NA 1,2,3,4,5 (a) Neutron detectors may be excluded from CHANNEL CALIBRATION.
(b). The IRM and SRM channels shall be determined to overlap for at least 1/2 decades during each startup after entering OPERATIONAL CONDITION 2 and the IRM and APRM channels shall be determined to overlap.for at least 1/2 decades during each controlled shutdown, if not performed within the previous 7 days.
(c) Within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> prior to startup, if not performed within the previous 7 days.
(d) This calibration shall consist of the adjustment of the APRM channel to conform to the power values calculated by a heat balance during OPERATIONAL CONDITION 1 when THERMAL POWER > 25% of RATED THERMAL POWER. Adjust the APRM channel if the absolute difference is greater than 2% of
. RATED THERMAL POWER. ANy APRM channel gain adjustment made in compliance with Specification 3.2.2 shall not be included in determining the absolute difference.
(e) This calibration shall consist of the adjustment of the APRM flow biased channel to conform to a calibrated flow signal.
(f) The LPRMs shall be calibrated at least once per 1000 effective full power hours (EFPH) using the TIP system.
(g) If.RPS shorting links are required to be removed, they may be installed for up to two hours for performance of this test. During the time that the links are installed, core alterations shall be suspended and no control rod shall be wit.hdrawn from its existing position.
(i) This function is not required to be OPERABLE when the reactor pressure vessel head is removed per Specification 3.10.1.
(j) With any control rod wit.hdrawn. Not applicable to control rods removed per Specification 3.9.10.1 or 3.9.10.2.
~
Mr. D. G. Eisenhut Page 10 TABLE 1 SURVEILLANCE FREQUENCY NOTATION NOTATION FREQUENCY S
At least once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.
D At least once per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
W At least once per 7 days.
M At least once per 31 days.
Q At least once per 92 days.
SA At least once per 184 days.
A At least once per 366 days.
R At least once per 18 months (550 days).
S/U Prior to each reactor startup.
N.A.
Not applicable.
TABLE 1 OPERATIONAL CONDITIONS MODE SWITCH AVERAGE REACTOR CONDITION POSITION COOLANT TEMPERATURE
- 1. POWER OPERATION Run Any temperature
- 2. STARTUP Startup/ Hot Standby Any temperature
- 3. HOT SHUTDOWN Shutdown #
> 200 F
- 4. COLD SHUTDOWN Shutdown #
< 200 F
- 5. REFUELING
- Shutdown or Refuel **
3 140 F The reactor mode switch may'be placed in the Run or Startup/ Hot Standby position to test the switch interlock functions provided that the control rods are verified to remain fully inserted by a second licensed operator or other technically qualified member of the technical staff.
Fuel in the reactor vessel with the vessel head closure bolts less than fully tensioned or with the head removed.
Mr. D. G. Eisenhut Page 11 The reactor protection system is made up of two independent trip systems.
There are usually four channels to monitor each parameter with two channels in each trip system.
The outputs of the channels in a trip system are combined in a logic so that either channel will trip that trip system.
The tripping of both trip systems will produce a reactor scram.
The system meets the intent of IEEE-279 for nuclear power plant protection systems.
With the dual trip system arrangement, it can be tested during reactor operation without causing a scram.
The RPS can be tested during reactor operation by an overlapping series of tests.
The manual scram t3st is as follows: By depressing the manual scram button for one trip channel, appropriate scram contactors are de-energized, opening contacts in the scram contactor logics.
After the first trip channel is reset, the second trip channel is tripped manually and so forth for the four manual scram buttons.
The total test verifies the ability to de-energize the scram pilot valve solenoids without scram by using the manual scram push-button switches.
In addition to control room and computer printout indications, scram group indicator lights verify that the scram contactor contacts have opened and interrupted power in these scram solenoids.
A calibration test of the Neutron Monitoring System (NMS ) is performed by means of simulated inputs from calibration signal units.
The single rod scram test verifies the capability of
~.
each rod to scram.
It is accomplished by operating two toggle switches on the hydre;11c control unit for the particular CRD.
Timing traces can be made for each rod scrammed.
Before the test, a physics review must be conducted to ensure that the rod pattern during scram testing does not create a rod of excessive reactivity worth.
MSIV position switches, turbine control valve fast closure sensors, and turbine stop valve position switches can be checked for operability.
The alarm typewriter provided with the process computer verifies the correct operation of many sensors during plant startup and shutdown.
The verification provided by the alarm typewriter is not considered in the
Mr. D. G. Eisenhut Page 12 i
selection of test and calibration frequencies and is not re uired for plant safety.
The overall RPS response time from sensor trip to l
channel relay de-energization and scram contactor de-energization is verified by test.
The fourth test involves one of two methods for applying test signals to each RPS channel in turn and observing that a logic trip results.
This test also l
verifies the independence of the channel circuitry.
The test signals can be applied to the process-type sensing instruments (pressure and differential pressure) through calibration taps, or a calibration input may be applied to each instrument trip unit by use of a built-in calibrator.
In addition to the above test, the operability of the I
pressure and level sensors may be verified by cross-checking instrument readouts in the auxiliary equipment room at any time during operations.
The CRD scram discharge volume level sensors are tested by valving the sensor out.of service and injecting and varying a test source to the level sensor.
The main steam line radiation sensors are removed from service and exposed to a test source to demonstrate operability.
The backup scram valves will be tested each refueling outage to avoid spurious full scrams.
Since testing of these valves will result in depressurizing the scram air header which will open the scram valves, the test will be performed with all HCU accumulators depressurized and the reactor pressure vessel depressurized.
Each backup scram valve is tested individually on its ability to bleed down the scram air header by jumpering out the scram relay for the backup scram valve to be tested and observing that all scram valves open as shown on the Full Core Display in the control room. - Since the testing f requency is essentially the same for the backup scram valves as for.
the scram pilot valves and because of the increased likelihood of spurious full scrams due to the nature of this testing, on-line functional testing of the backup scram valves is not justified.
The reliability of the reactor protection system is ensured by design through the selection of reliable components, configuration of components in redundant
Mr. D. G. Eisenhut Page 13 logic, the use of components based on previous design and periodic testing.
Sensors, channels and logics of the teactor protection system are not used directly for control o.f process systems.
Therefore, failure in the controls and instrumentation of process systems cannot induce failure of any portion of the protection system.
The dual trip system is advantageous because it can be tested thoroughly, as mentioned above, during reactor operation without causing a scram.
This capability for a thorough on line testing program significantly increases the reliability of the reactor protection system.
The following bases ensure that the RPS is designed with sufficient reliability:
1.
If failure of a control or regulating system causes a plant condition that requires a reactor scram but also prevents action by necessary RPS channels, the remaining portions of the RPS meet safety design basis 6, below.
2.
The loss of one or both power supplies does not prevent a reactor scram.
3.
Once initiated, an RPS action goes to completion.
The return to normal operation requires deliberate operator action.
4.
There is sufficient physical separation between redundant instrumentation and control equipment monitoring the same variable to prevent environmental factors, electrical transients, or physical events from impairing the ability of the system to respond correctly.
5.
Ground motions of a safe shutdown earthquake (SSE) magnitude as amplified by building and supporting structures do not impair the ability of the RPS to initiate a reactor scram.
6.
No single failure within the RPS prevents proper RPS action, when required, to satisfy the safety design bases of the system.
7.
Any one intentional bypass, maintenance operation, calibration operation, or test to verify operational availability does not impair the ability of the RPS to respond correctly.
o Mr. D. G. Eisenhut Page 14 8.
The system is designed so that the required number of sensors for any monitored variable exceeding the scram setpoint initiates an automatic scram.
The following bases reduce the probability that RPS operational reliability and precision are degraded by operator error:
1.
Access to trip settings, component calibration controls, test points, and other ter.ninal points is under the control of plant operations supervisory personnel.
2.
Manual bypass of instrumentation and control equipment components is under the control of the control room operator.
If the ability to trip some essential part of the system has been manually bypassed, this fact is continuously annunciated in the control room.
We trust that the information contained in the above responses is sufficient for Nuclear Regulatory Commission review of Philadelphia Electric Company's current conformance with these positions stated in Generic Letter 83-28.
We have provided to the best of our knowledge our current status regarding these positions and schedules and future courses of action have been proposed.
Should you require any further information,.please do not hesitate to contact us.
Very truly yours, cca J. T. Wiggins Site Inspector a
t COMMONWEALTH OF PENNSYLVANIA :
ss.
l COUNTY OF PHILADELPHIA t
1 V. S. Boyer, being first duly sworn, deposes and says:
That he is Senior Vice President, Nuclear Power, of Philadelphia Electric Company, the Applicant herein; that he has read the foregoing response to Generic Letter 83-28 and knows the contents thereoft and that the statements and matters set forth therein are true and correct to the best of his knowledge, i
information and belief.
+
.h%..
.2..
2..
L/
c I
~
Subscribed and sworn to c4L ~
f before me thisc day of
)(Ou 19I'4 d
GYhteta ni(c.
l f
I Notary Publjc i
PAffDCIA A. JONES 3gg l
1 L
l l
l l
t i
cc: Judge Lawrence Brenner (w/ enclosure)
Judge Richard F. Cole (w/ enclosure)
Troy B. Conner, Jr., Esq.
(w/ enclosure)
Ann P. Hodgdon, Esq.
(w/ enclosure)
Mr. Frank R. Ranano (w/ enclosure)
Mr. Robert L. Anthony (w/ enclosure)
Charles W. Elliot, Esq.
(w/ enclosure)
Zori G. Ferkin, Esq.
(w/ enclosure)
Mr. Thanas Gerusky (w/ enclosure)
Director, Penna. Dmrgency (w/ enclosure)
Managermnt Agency Angus R. Love, Esq.
(w/ enclosure)
David Wersan, Esq.
(w/ enclosure)
Robert J. Sugarman, Esq.
(w/ enclosure)
Spence W. Perry, Esq.
(w/ enclosure)
Jay M. Gutierrez, Esq.
(w/ enclosure)
Atanic Safety & Licensing (w/ enclosure)
Appeal Board Atatic Safety & Licensing (w/ enclosure)
Board Panel Docket & Service Section (w/ enclosure)
Martha W. Bush, Esq.
(w/ enclosure)
Mr. James Wiggins (w/ enclosure)
Mr. Timothy R. S. Campbell (w/ enclosure)
Ms. Phyllis Zitzer (w/ enclosure)
Judge Peter A. Morris (w/ enclosure) g.-