ML20101S061
| ML20101S061 | |
| Person / Time | |
|---|---|
| Site: | Sequoyah  |
| Issue date: | 07/09/1992 |
| From: | Joshua Wilson TENNESSEE VALLEY AUTHORITY |
| To: | NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM) |
| References | |
| NUDOCS 9207160341 | |
| Download: ML20101S061 (9) | |
Text
. _ - _ _ _ - _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
l 4
0 k
+
a.
m L wt n o.,
1.
July 9, 1992 U.S. Nuclear Regulatory Commission ATTN:
Document Control Desk Washington, D.C. 20555 Gentlemen:
In the Matter of
)
Docket No. 50-328 Tennessee Valley Authority
)
SEQUOYAH NUCLEAR PLANT (SQ11) - UNIT 2 - EAGLE 21 SIX-MONT9 REPORT Referencei NRC letter to TVA dated October 31, 1990, " Reactor Protection System Upgrades and Enhancements (TAC 75844) (TS 89-27) -
Sequoyah Nuclear Plant, Unit 2" By the reference letter, WA is committed to submit periodic reports at approximately six-month intervals describing del.ign hardware, design cof tware, and maintenance problems encountered with the Eagle 21 react or protection system during Unit 2 Cycle 5 operation.
The information in provides the last of three reports and completes the Unit 2 commitment. This report covers the period from December 12, 1991, to May 15, 1992.
Picane note that this final six-month report interval is only about five months long because of fuel cycle and outage duration.
Unit 2 entered Mode 2 and began Cycle 6 operation on May 15, 1992.
In additloa, Enclosure 2 provides the Westinghouse Electric Corporation evaluation (letter WA-92-060) on SQN's use of data loggers to perform cross calibrations of resistance-temperature detectors and the associated effects of connections to Eagle 21 equipment. This information is being provided at NRC's request during conversations in March 1992 on the cross-calibration methods used at SQN.
9207160341 920709 Q'
PDR ADOCK 05000328 l
()p' O r
P PDR i
4 U.S. Nuclear Regulatory Commission Page 2 July 9, 1992 If you have any questions concerning the enclosed information, please contact Keith C. Weller at (615) 843-7527.
I Sincerely, l
k n
J. L Wilson Enclosures cc (Enclosures):
Mr. D. E. LaBarge, Ptoject Manager U.S. Nuclear Regulatory Commission One White Flint, North 11555 Rockville Pike Rockville, Maryland 20852 NRC Resident Inspector Sequoyah Nuclear Plant 2600 Igou Ferry Road Scddy Daisy, Tennessee 37379 Mr. B. A. Wilson, Project Chief U.S. Nuclear Regulatory Commission Region II 101 Marietta Street, NW, Suite 2900 Atlanta, Georgia 30323
_-___.--.___.._m o
ENCLOSURE 1 SEQUOYAH NUCLEAR PLANT (SQN)
EAGLE 21 UNIT 2 EQUIPMENT AND/OR SYSTEM FAILURES AND PROBLEMS FRDM DECEMBER 12, 1991, TO MAY 15, 1992 Item _1 On Feb uary 13, 1992, during performance of a channel functional test in Rack 2-R-13, it was discovered that the time-base reference signal at the front test panel was erratic.
Ac ti.on_Taken The time-base reference signal is verified at the front test panel during every channel functional test.
The actual time-base reference signal was operating properly within the rackt however, the update to the front tester panel via ribbon cable had failed. The ribbon cable from the test sequence processor and the front test panel was replaced and the time-base reference signal verified at the front test panel test points. The ribbon cable is for front test panel test points only und is not required for rack cperability.
LLen.2 During the Unit 2 Cycle 5 refueling outage, 16 resistance temperature detector (RTD) tennination networks in various racks were replaced due to a potential failure.
Action _Iakens these diode networks provide a closed circuit in the event an Eagle resistive input circuit board is removed for maintenance whet.
multiple racks are fed from common sensors. The diode networks are strictly a maintenance tool and have no affect on normal operation of a rack. The RTD networks were tested as they were removed from the racks and appeared to fail the bench checkt howe /er, they will ba sent to the vendor for verification. This condition was initially reported aa Item 7 in Enclosure 2 of the Eagle 21 Six-Month Report dated July 10, 1991.
Item _3 on May 13, 1992, while performing channel calibrations in Rack 12, it was observed that the front tester panel, " SIR BUS FAILURE" and " TROUBLE" light emitting diodes were lit.
ection_Iaken Troubleshooting with the man machine interf ace cart identified that the bit-bus communication ports on the Eagle partial trip (EPI) circuit board in Termination Frame 8 had f ailed.
The bit-bum communication link on the EPT circuit board is required for survei}1ance testing and periodic diagnestics. Losing the bit-bus communications did not cause the channel trip functions to fail or for the channel to be inoperable. Failure of the bit-hus communication link on the EPT board cannot prevent the channel from performing its intended function.
The EPT circuit board was replaced and all channels verified to operate normally during surveillaace testing.
ltem_A During Unit 2 cycle 5 operation and after the cycle 6 start-up, several spurious RTD f ailure alarms were received in the main control room.
Actinn_Iakens iTroubleshooting identified that the two reactor coolant system narrow range. cold-leg temperatures in Loop 1 had periodic spiking that sometimes exceeded the redundant sensor algorithm limit of 2 degrees Fahrenheit (F) and were thereby causing the alarm.
The spiking was i
-limited to Rack 2-R-1, which contains the Protection Set I environmental allowance modifler and trip time delay (EAM/TTD) channels while the differential temperature and temperature average channels were unaffected. The spiking cold-leg temperature signal was seen last cycle, but was thought to _be fixed during the Unit ? Cycle 5 refueling outage when the digital filter processor was replaced.
The spiking cold-leg temperature signal has been temporarily removed from scan since the peak spikes would sometimes exceed 2 degrees F and cause an alarm.
The spiking condition was not seen in any other loop in Rack 2-R-1 nor any other temperature. input of Units 1 or 2.
The only function fed from the l
narrow range, cold-leg temperature channels in Pack 2-R-1 is the calculation of the steen generator, level trip time delay, which is set to zero-for-full power operation.
The magnitude of the spikes seen to date is not large enough to exceed the calibration tolerances and therefore does not af fect the operability of EM1/TTD. An action plan has been developed for detailed troubleshooting in the rack during the Cycle.6 operation.
l p
l L
ENCLOSURE 2 SEQUOYAH NUCLEAR P! ANT (SQN)
EAGLE 21 UNITS 1 AND 2 RESISTANCE TEMPERATURE DETECTOR (RTD) CROSS CALIBRATION TEST CONFIGURATION REGULATORY COMPLIANCE CONSISTENCY This enclosure provides the discussions associated witn the use of a single data logger connected to all four reactor protection sets for RTD cross calibrations.
TVA has performed the evaluations described in Item 1 of the evaluation section of Westinghouse Electric Corporation Letter TVA-92-060 dated April 10. 1992.
Th1s evaluation considered the potential for failures of the data logger that would apply the operating voltages into the Eagle 21 system and the potential for multiple points to be connected to the data logger simultaneously.
The maximum voltages utilized by the data logger were determined to be within the input ratings of the Eagle 21 RTD input boards and therefore would not caust:
any damage to the Eagle 21 system.
The data logger utilizas normally open reed relays to select each RTD channel one at a time sequentially.
This method has minimal risk for multiple points to be connected simultaneously however, as an added precaution, an extra channel is utilized to monitor the data logger inputs for identification of reed relay malfunctions.
Even though these failures are unlikely, the attached Westinghouse evaluation provides additional discussions on the capabilities of the Eagle 21 system to prevent common mode failures for this test configuration.
1 L
ENCLOSl'RE 2 Tennessee Valley Authority Sequoyah Nuclear Plants Units 1 and 2
)
RTD Cross Calibration Test Configuration Regulatory CompIlance Consistency Per TVA request, this letter evaluates the Regulatory compliance of the proposed RTD cross calibration test configuration for Sequoyah Units 1 & 2.
The recommended means for gathering RTD cross calibration data is to measure the resistances of all RTDs simultaneously under isothermal conditions during plant heatup For the narrow range RTDs TVA plans to achieve this by connecting a data logger in parallel to 1) the RTD voltage at the rack field termination panel inputs, and 2) the excitation current test points, while the RTDs remain in service. In a recent telecon, TVA was asked by the NRC whether they are satisfied that this test configuration meets IEEE Std-279, IEEE Std-338, and Reg Guide 1.118. This letter addresses that question.
REGULATORY CONSIDERATIONS Based upon a review of the above identified Regulatory documents, several requirements pertinent to this test configuration were identified and are summarized below:
1.
Reg Guide 1.118 Rev. 2 Regulatory Position 6 temporary test setups are acceptable if the equipment to be tested is designed to accommodate connection. The temporary test setup must be considered part of the safety system. Although this Reg Guide is not identified in the Sequoyrh FSAR, it is
=,1 included here based on the NRC inquiry.
2.'
IEEE Std - 279 - 1971 Section 4.2: Single Failure Criterion - a single failure in the protection system must not cause loss of function. Per Regulatory Guide 1.118 (above) the test instrumentation must be considered part of the protection system.
Section 4.6: Channel Independence - redundant channels must be independent and physically separated.
4 em.,
y
.e
-s-ns.
-~n-
2.
IEEE Std - 338 - 1971 Section 5.2 - test equipment must not caese a loss of independence between redundant channels.
EV.ALUATION Based on the regulatory requirements identified above, it must be demonstrated that the proposed cross calibration test configuration does not degrade performance of tha protection system, assuming a single failure hi the test instrumentation and considering the independ.xe end isolation capabilities provided by the test setup. In panicular, it must be assumed that a maximum credible fault of 120 VAC originating from the data logger power supply could potentially propagate to the test connections at one or more Eagle RTD !nput cards. Such a fault or short could originate from a single failure, seismic event, etc. within the data logger or test connections.
The data logger is not a class lE qualified device and has not been tested to ckmanstrate tbst it will provide class-lE isolation or independence between the redundant protecuon sets to which it will bc connected. Thus, it cannot be concluded the the proposed test configuration meets the etter of the identified regulatory requirements. However, it is judged that this configuration is defendable for this application and may be employed based on a variety of considerations, as discussed below.
Tha defense of the proposed test configuration must consider the isolmion/ independence capabilities of the data logger and the consequences of a fault applied to the Eagle-21 Process Protection instrumentation.
1.
Data Loccer CanabPik The first line of defense against a 120 VAC fault is the isolation cspability of the data logger.
TVA personnel are evaluating this capability and have stated that the data logger employs separate input relay multiplexor cards to interface to each Eagle 21 protecFon set. TVA is eva.!uating the associated isolation capability, and feels that this evaluation will demonstrate a low probability that a fault within the data logger would simultaneously propagav o more then one Eagle protection channct set. In addition, although hight: 'mlikely, a is conceivable that a short could be applied across all inputs to the data logger due to the lack of separation in the test wiring inputs to the data logger.
2.
Eagle-21 Process Instrumentation if i is assumed that a postulated fault or short circuit is applied to more than one 1,rotection t
channel set due to failure of the data logger's isolation capability or damage to test wiring, it is then necessary to evaluate the impact on the Eagle P.. as Protect!on system. Tus evaluation must consider the impact on the RTD related functions being tested, as well ds the impact on other protection functions located in the Eagle-21 cabinets.
e 4
a.
RTD Ihsed Functions R'lD cross calibration testing is performed in Modes 3 and 4. In Mode 3, TVA-Sequoyah Technical Spect."ications require operability of the RCS Loop Delta T input to the Trip Time Delay (TfD) function associa'ed with Auxiliary Feedwater initiation.
Application of a 120 VAC fault or a short to an Eagle-21 RTD input (ERI) card or RTD current test point would, at a minimum, cause erroneous temperature indications, and would potentially cause failure of the RTD element and the Eagle
)
precision resistor usui to measure RTD sense current. During RTD cross calibration testing the loop Delta T is at zero deg F (core is Juberitical) whien corresponds to the maximum (least conservative) trip t;me delay. Thus, it may be conclLded that there are no erroneous temperature indications or failures to the hot and/or cold leg Narrow Range RTDs or inputs that could increase the calculated time delay beyond this maximum value. Any postulated failures which result in a non zero calculated C:!ta T would be conservative, since the calculated time delay will be reduced. In summary, any impact on TID due to a postulated 100 VAC fault or short circuit at the input to an ERI card would be in the conservative direction. Also, note that a fault or short will not degrade the Eagle-21 Loop Calculation Processor (LCP) funct!ans since the LCP is protected by buffers located on the RTD input cards.
b.
Other Protection Functions Since there are a variety of other protection functions required by the TVA-Sequoyah Technical Specifications during modes 3 and 4, the impact of a 120 VAC fault voltage or short circuit on other protection functions has been a"21uated. As discussed previously, a fault er short wiil not degrade the LCP functions since the LCP is a
protected by buffers located on the ERI cards. The other area of concern is the potential for a fault or short to affect other functions in the same Rack by degrading the shared 15 VDC power supplies which power all analog inputs, analog outputs, and partial trip boards in a cabinet.
Per the equipment specifications for the ERI boads, the fic!d inputs are rated at 125 VAC RMS continuous voltage without damage. This protection is provided by voltage suppressors in the input circuitry to the voltage measurement and current source sections of the board. Hence, although RTD damage could poteutially occur, there would be no damage to the RTD inputs and no propat. don to ott r functions as s result of a 120 VAC fault or short circuit, if a fault voltage or short circuit is applied to the RTD curTent measurement test pointr, the precision 50 ohm,1/3 watt resistor will potentially fail. However, a fault or short will be prevented from -
propagating back to the shared power supply by the isolation capabilities of the isolated DC/DC converter which powers the precision current source.
The above discussion has concluded that it is highly unlikely that a 120 V AC fault or short circuit could impact functions other thhn those derived from the RTD inputs due to the propagation to the shared 15 VDC power supplies. Nevertheless, if it is assumed that the shared power supplies are iapacted, the Eagle-21 system is designed to set the Reactor Trip and Engineered Safety Features comparators to the preferred failure mode (conservative state) upon loss of both primary and secondaiy 15 VDC power supplies.
COMCLUSIONS This evaluation has demonstrated that acquisition of RTD cross calibration data using a data logger connected simultaneously to all protection channel sets has a low probability of degrading protection system performance due to a reduction in protection channel independence.
Additionally, it should be noted that the proposed test configuration will be in use over a period of only several days end under strict administrative controls. The likelihood of a fault or short circuit condition occurring while under test is considered remote, but would be immediately detectable by test personnel as a result of an0malous voltage measurements en the test instn1ments and control room and test panel indications / alarms / annunciators provided by the protection system, ah
_