PM-91-038, Rev 0 to PM 91-038, Steam Leak Detection Sys Upgrade for Hpci,Rcic,Rwcu & Rhr
| ML20128B669 | |
| Person / Time | |
|---|---|
| Site: | Brunswick  |
| Issue date: | 05/21/1992 |
| From: | CAROLINA POWER & LIGHT CO. |
| To: | |
| Shared Package | |
| ML20128B423 | List: |
| References | |
| PM-91-038, PM-91-38, NUDOCS 9302030135 | |
| Download: ML20128B669 (35) | |
Text
Plant Mod. N: 93 OW NL,5-93-017 n u am no o
Cf A TT. 9.1 2. (34-PP) pg..,
REVISION 2 10CFR50.59 PROGRAM MANUAL A'ITACHMENT A CP&L SAFETY REVIEW PACKAGE Page 1.,of.34 SAFETY REVIEW COVER SIIEET DOCUMENT NO.
PM 914)38 REV.NO.
O DESCRIPTION OF TITLE; SIfiMLLfM}LD_ETECTION SYSTEM UPGRADE FOR HPCL RCIC.
Assigned Responsibilities Safety Analysis Preparer:
Tom ickemeyer Lead ist Safety Reviewer:
Tom ickemeyer
- .;d Safety Reviewer:
Civde Fletcher 2.
Safety Analysis Preparer: Comp ete PART I, SAFL'TY ANALYSIS Safety Analysis Preparer /
M T-14-it.
'DATE
/
SIGNATURE f 3.
Lead 1st Safety Reviewer: Complete Part II, Item Classification.
4.
Lead 1st Safety Reviewer: Part III may be completed. If either question 1 or 2 is "yes,"
then Part IV is not required.
5.
Lead 1st Safety Reviewer; Determine which DISCIPLINES are required for review of this item (including own) and mark the appropriate block (s) below.
DISCIPLINES Reauired fPrint Name)
Sicnature/Date (Sten 7)
[ ] Nuclear Plant Operations
[ ] Nuclear Engineering d u/9s N '.
lX] Mechanical M u 5.Lun a t ri& Stdu.&
[X] Electrical her J.
r6 a.es a4 Sah J/8#
Tom Hokemeyer
/ M ( % e s T/2d1 Jt
[X] Instrumentation & Control
[X] Structural Leo CamobeliMWauld*Mb/dsL6/nJfsuL,, f.s/w U
/
[ ] Metallurgy
[ ] Chemistry / Radiochemistry
[ ] Health Physics
[ ] Administrative Controls 1
6.
A QUALIFIED SAFETY REVIEWER will be assigned for each DISCIPLINE marked in sten 5 and his/her name printed in the space provided. Each person listed shall perform a SAIETY REVIEW and provide input into the Safety Review Package.
7.
The Lead 1st Safety l eviewer will assure that a Part III or Part IV is completed (see step 4 above) and a Part VI.f required (see 9.b of Part 10. Each person listed in step 5 shall sign and date next to hisiner name in step 5 indicating completion of a SAFETY REVIEW.
8, 2nd Safety Reviewer: Perform a SAFETY REVIEW in accordance with Section 8.0.
2nd Safety Reviewer C
db Date i
DISCIPLINE:
Instrument 1 tion & Control
/ /
Xti M2 9.
PNSC review required? If "yes" attach Part V and mark reason
[X]
[]
below:
[ ] Potential UNREVIEWED SAFETY QUESTION N Question 9 of Part IV answered "Yes"
[ ] Other (specify):
0 AI-109 Rev. 001 9302030155 930125 PDR ADOCK 05000324 P
Plant Mod. No 4 OM O
neid Rev. N:
REVISION 2 10CFR50.59 PROGRAM L.ANUAL ATTACHMENT A CP&L SAFETY REVIEW PACKAGE Page __2., of 34 PARTI: SAFETY ANALYSIS (See imtructiorts in Section 8.4.1)
(Attach additional sheets as necessary)
DOCUMENT NO. PM 01038 REV. nom 0
DESCRIPTION OF CIIANGE:
DLntgwe functions of the Steam Leak Detection (SLD) system comeonents addresud by this plant modification m:lud;.1 o To monitor ambient tempentures in the following locations:
o Along the HPCI steam supply piping outboard of the Drywell, o
In the HPCI Turbtne room, o
Along the RCIC steam supply piping outboard of the Drywell, o
Near the RC!C Turbine, in the general Reactor Building area containing the RWCU Inlet, Return and Reject piping outside of o
the RWCU rooms.
o Inside the RWCU Pump Room., and IIcat Exchanger Room o
inside the Main Steam Tunnel o
Near the RHR Emergency Area Coclers o To monitor the vent air inlet / outlet differential temperature in the following locations:
o HPCIIRCIC nuni. team tunnel, o
HPCI Equipment Area, o
RCIC Equipment Area, o
RWCU Pump Rooms and Heat Exchanger Room, o
Main Steam Tunnel.
o RHR Areas o To monitor the differential flow between the RWCU system inlet and the two system outlet paths.
To provide alarms when any of the temperatures or the differential flow exceeds designated setpoints, o
To initiate closure of the following PCIS valve groups when the associated temperature / differential o
temperature or the RWCU differmtial flow exceeds established setooints and any delay times. Isolation initiatica response times must _.. the 13 second assumptions utilized for the Reactor Building Environmental Report.
o HPCI - Group 4 o RCIC - Group 5 o
RWCU - Group 3 The Main Steatu and RHR channels associated with the H12-P614 panel are for alarm and indication only.
To provide control room indication for the temperature locations monitored. Limited indication capability o
is provided at parel H12 P614. Only one ambient and one differential thermocouple channel temperature at a time may be displayed on the currect Riley system. 'nte Fenwal switch channels provide no indication capability, To provide control roorn tndication for the RWCU inkt, reject and differential tTow (No return fMw o
indication currently is provided).
O Al-109 Rev. 001
)
l
Plent Mod. Nr 'TI- 0 38 -
F1:ld R:v. Nr o C'I REVISION 2 10CFR50.59 PROGRAM MANUAL Pogo Na ATTACHMENT A CP&L SAFETY REVIEW PACKAGE Page ) of 34 PART I: SAFETY ANALYSIS (cont'd)
' DOCUMENT NO. PM 91-038
_REV.NO.
O_
DESCRil' TION OF CllANGE (cont'd):
To provide input to ERFIS and the Process Compute. for selected tempersture and flow channels.
o Eti< tine Hardwafr
- The current hardware configuration utilized to perform the temperature sensing portion of above funcuon consist: of a combination cf local Fenwal temperature switches, local thermocouples connected to Riley tnp smtches in the control room and supporting reky logic. Most of the control room components are located on and in H12-P614.
The hardware currently utilized to perform the RWCU flow sensing portion of above function consists of o
Rosemont, GEM AC and Agastat devices. The CEMAC and Agastat analyticalinstruments and time delay relays are located in the H12 Pbl1 and H12-P613 control room panels. The inlet and reject flows are displayed on H12 P603 and the differenti I flow is displayed on H12-P613.
PmNems With Exictine Conficuration:
1, The existieg SLD system configuration has been a chronic source of problems, resulting in many LERs.
2.
Some of the rnore significant problems with the temperature-based portion of tbt LDS involve the Riley and Fenwal hardware and include:
2.1 Spurious system isolations can be initiated by Riley switches during AC power restoration.
The susceptibility of these switches to spurious trips has been documented by GE SIL No. 416 and IE Information Notice 8649. As noted in the SIL, whencier one of the switches is re-powered, a momentary signal f-em the Riley may result in a ' relay race' within the associated system and the involved uip func: ion may eccur.
2.2 Spunous system isolations can be initiated by Riley switches due to momentary breaks in the input thermocouple continuity.
Thermocouple burmut, or own circuit, rarely occurs at either the ther.nocouple element or at the termination of the extension cable to the thermocouple. The problem at BNP has ietated more to open circuits occurring within the control raora panel H12-P614 due to intermittent evnnections caused either by vibration or by handling of wire bundles.
Two primary causes for the frequency of these open circuits are:
2.2.1 The congested wiring configuration at the Riley switch termtnals makes it difneult to perform and verify terminatiot. of the thermocouple input wires. Many of the thennoccuple lead wires are un-lugged and are fastened directly under the termmd screws, in accordance with Riley recommendation 2.2.2 The impact of the above condition is compounded since the thermocouple leads at each of the Tech Spec-related Rileys must be lifted and then reterminated monthly to permit input signal substitution during the MSTs.
O AI 109 Rev. 001
Plant Mod.16 *
- 112 l
th14 flov. No F REVis!ON :
10CFR50.59 PROGRAM MANUAL E"9' U" i
A*ITACllMENT A CP&L SAFETY REVIEW PACKAGE Page _4_ of _ M PART1: SATCTY ANALYSIS (cont'd) i DOCUMENT NO. _biRi P18 REY.NO.
O c
4 DESCRil'FION OF CllANGE (cont'd):
Further uncertainty has been introJuced by the facts that only certain Riley models include the burnout trip feature and that we do not control where modides with that burnout trip feature are installed. Either is permitted.
2.3 Maintenance and modification activities are difficult in lil2 P614. Personnel safety is jeopardized when it is necessary to reach deep into the cabmet among adjacent hot circuits. Inadvertent plant impact is always posuble and spurious system isolations have frequently occurre/ during these activities.
The Riley hardaare and the associated relay, switches and timers are poorly arranged. ne vendor.
mierconnection drawmgs are iusccurate and panially illegible. The lack of wire tags on the vendor mterconnect w1nny and the congested w1re bundling makes it nearly impossible to visually trace winns from pomt to point withoat extensive clearsaces and wire bundle separation.
2.4 Personnel safety concerns have been documented relative to the hazardous nature of the frequent and extensive climbmg required to perform MSTs on 'he 15 Fenwat switche4 located in the !!PCI, RCIC and mtm steam tunnel areas.
Monthly MSTs require local access to apply heat to each of the fifteen switches as part of the channel functional tests. Quarterly MSTs require removal and reinstallation of the eight IIPCI switches in arder to perform the shop calibrations included in the channel calibrations. Refuel MSTs require the same for the seven RCIC switches.
In contrast, heat application for channel functioned testing of the thermocouple-based steam leak detection channels is only required at quamily re refuel intervals. He thermocouples are inherently stable, passive devices, while the 1%sts are adive components. Even though a case might be made for wme increase in the surullana interval for the Fenwals, it is unlikely that it could ever be lengthened to nearly that of the thermocouples.
0.5 The seveillance testing frequency required for the Riley based instrumentation is too short.
The nature and frequency of the MST: were establ4hed barad on the characteristics of the Riley hardware and appear to be essentially appropriate. The Riley equipment is less accurete and drift-resistant than more modem equipment such as the !iUMAC. It also does not provide the eatensive Self test featutes available in the NUMAC. It is unlikely that an extention of the Riley surveillance mtervals to anywhere near those hoped for with the NUMAC system could ever be justiced.
0.6 Spare and replacement Riley parts availability is becoraing a problem.
The product line is becomie3 obsolese. The vendor continues to support with repairs and special production runs, but cost and lead times are increasing.
O Al lO9 Rev. 001
rtid Rev. Ma o i
REYlSION 2 10CFR50.59 PROGRAM MANUAL Page Nr ct A'ITACHMENT A CP&L SAFETY REVIEW PACKAGE -
Page i.of 34
- PART !! SAFLTY ANALYSIS (cont'd)
DOCUMENT NO. PM 91-038 REV,NO.
O i
e DESCRIITION OF CilANGE (cont'd):
l 3.
Some of the more significant problems anociated with the RWCU Differential Flow based portion of the LDS system involve the GEMAC hardware and include:
3.1 Spurious RWCU system isolations can be initiated by the differential fl6w loop, for reasons that include:
I 3.1.1 Routine upscale rudings caused by the lack of density compensation reduce the effective marl;in between the normally indicated differential flow reading and the idolation setpoint.
His increuct the vulnerability for inps due to normal system operational transients.
~
3.1.2 Apparent ddticulty in keeping the instrument sensing lines full between the flow orifice taps and the differential flow transmitters. His would offr.et the differential pressure sensed by the transnutter by a value equivalent to the lost head, ne reject line flow orifice is -
especially susceptible to this problem because it is occasionally subject to partial condenser vtcuum.
his plant modification addresses the 3.3.1.1 root c.use in that it will result in a configuration where, in the absence of a real leak, the normalized differential' reading will be approximately zero. De routine espected indicated differentist will then be approximately 43 OPM below the 43 OPM actpoint and thereby allow full ase of that margin, along with the proposed extended time delay of 30 minutes, to minimize trips due to routine operational-t transients, nis project does not provide a fix for the 3.3.1.2 root cause, ne electronic portion of the i
differential loop instrumentation is included in this project due to the capability of the.
~
NUMAC to remedy the density compensation poblem.
3.1.3 Downscale indications on the differential flow indicator 031 FDI R615. NCR A 89 052 documented this sa a potantial Mode 3 operability issue. : ha the inlet flow temperature starts to decreast below normal opeinting temperatures, the water density increaans and the volumetrie flow rate decreases, nis creates a situation where the inlet volumetric flow rate could drop below the sum of the return and reject volumetric flow ratesr The 031 FDI-R615 differential flow indicator would then urive downscale and a leak greater than the 43 OPM serpoint could potentially exist without actuating the system isolation trip units.
This condition is caused by the absence of density compensation provisions in the flow -
instrumentation.
With the NUMAC system, negative differential flow readings will not be displayed. : Each of -
the three input flow channels will be monitored for 'out of bounds' signal levels. No.
valuation of downscale differential values, such u is now permitted by Special Procedure e
86 090, will be necessary.
Based on the loop tolerance ultimately established for the NUMAC instrumentation, the L required margin between the setpoint and the Tech Spec Limit of 53 GPM might be reduced, j=
and it might then be possible to raise the setpoint (not currently planned within the scope of 3
l; this project).
L
. O Al 109 Rev 001
~. -
. - - - - =.
.==-..- -.,
Nnt Mod. Nm 9 t s inr Deld R:v. N> o REVISION 2 10CFR50 59 PROGRAM MANUAL P"7' N N ' '
A'ITACHMENT A CP&L SAFETY REVIEW PACKAGE Page 1 of 34 PARTI: SAFITY ANALYSIS (cont'd)
DOCUMENT NO, PM 91-038 REV.NO.
0 DESCRil"flON Ol' CIIANGE (cont'd):
3.1.4 Inabihty to logically compare the flow values displayed on tbc RWCU inlet, reject ard
'ifferential flow indicators.
Due to the lack of density compensation, the flow rates displayed for theAe three parameters are in volumetne umts, rather than mass units, and therciore cannot te meaningfully compared to each other, 3.1.5 There is no way to determtne the RWCU retuni Dow rate.
No indicator exists for RWCU return flow, it was not part of GE's design.
3,1.6 The differential flow instrumentation is not redundant. When it is found to be inoperable, Tech Specs require either that it te restored operable within two hours or that RWCU be polaird.
Non redundant design was nortral for GE plants of our vintage, however, and there is no regulatory requirement or operationalincentive to add redundancy at this time.
Chances To De implemented By This Plant Modifiention: The following system conGruration changes will be a:comphshed:
1.
Replace all of the Riley hardware and most of the associated components in lil2 P614 with four GE NUMAC microprocessor units.
2.
Replace the fifteen llPCI and RCIC Tenwal switchen with thermocouples. Connect these new thertrwouples to NUM AC monitoring / trip channels.
3.
Remove the OEM AC and Agastat components used for RWCU differential flow monitoring. 'Ihe existing now transmitters will be connected to one of the above four NUMAC chassis. Connect RWCU process temperature thernvcouple signals from each of the three flow paths to the NUMAC system for use in density correction.
4 The now and differential now indications will be improved as follows:
0 Move the RWCU differential flow indicator from H12 P613 to lil2 P603.
o Add RWCU return flow indication to H12 P603, Temperature compensated volumetric flow rates for the inlet, return and reject flow channels will be o
displayed on the NUMAC screen in H12 P614. In addition, the adjusted flow rates ' normalized' to a common temperature of $33*F for each of those flow paths will be displayed both on the N_UMAC screen and on vertical indicators on H12 P603. Differential flow will be displayed in normalized spm on both lil2 P614 and on H12 P603.
5.
Decrease the range of the RWCU reject flow loop fmm 250 rpm to 125 gpm @ 130'F (150 gpm normalized to 533*F).
6.
Replace the existing separately wired individual ERFIS input signals with multiplexed inputs transmitted on fiber optic cables.
O Al 109 Rev. 001
. ~ ~..
Pl::t Mod No Sl*C.!L Ple.id Rev, No J2 Page Ho M REVISION 2 10CFR50.59 PROGRAM MANUAL ATTACHMENT A CP&L S AFETY REVIEW PACKAGE Page 2. of _ 34 PART h SATITY ANAISSIS (cont'd)
DOCUMENT NO. P.11.Al;038 REY.NO.
O DESCRIPTION OF CilANGC (cont'd):
Elimmate the steel bamers and internal panel conduits that provide intr <livision sep.vntion between the IIPCI and the RCIC leak detection wmponents and circuits.
6.
Repla:e the 125 VDC power supply that currently supplies the RCIC isolation channel instruments with 120 VAC Emergency power, thereby eliminatmg the TOPAZ inverters.
9.
Subnut a Tech $pec ch nge to:
o Delete the channel check surveillance test for the RWCU a Flow. liigh holation function, o
Extend and standardire the channel functional test and channel test surveillance frequencies for the RWCU e Flow. High, llPCl Ambient and a Tempersture, RCIC Ambient and a temperature, and RWCU Ambient and a Temperature isolation functions, o
In:rease the RWCU a Flow isolation time delay from 45 seconds to 30 minutes.
o In:rease the RWCU a Flow Allowable Limit /Setpoint from $3 to 73 gpm.
Delete the instrument response time teatmg requirements for the following isolation functionst o
o llPCI steam line tunnel Temperature high, RWCU Area Temperature. l{igh and RWCU Area Ventilation a Temperature. liigh, o
o RWCU a Flow Iligh.
- 10. Revise the power source for the three RWCU flow transmittert Delete the esisting connections to the GEM AC power supply in lil2 P613 and rewire the transmitters to obtain power directly from the B21 XY 5949B NUM AC chassis.
ANALYSIS:
The hardware, software and Techmcal Specification changes described above will provide a significant upgrade of the steam leak detection instrumentation. Improvements will be achieved in the areas of reliability, accuracy, data presentation, surveillance testing, problem diagnosis, repair and system availability.
A discussion of the safety implications of each of the changes desenbed above follows:
1.
Replacement of the Riley hardware and most of the asaciated components in II12 P614 with four GE NUMAC microprocessor units.
The existing Riley thermocouple monitor units and accessories are original plant equipment that is nearly obwlete. Replacement units and repair parts are difficult to obtain. Surveillanr4 testing and maintenance activitica inside the II!2-P614 cabinet are difficult due to the poor physical arrangement of the components and internal wiring and due to the poor accuracy of the vendor drawings that describe that configuration. Numerous spurious isolations have occurred due to factors such as -
electncal noise, momentary circuit interruptions caused by poorly terminated power and signal cables, and inappropriate wire lifts based on the vendor drawings.
O Al 109 Rev. 001
~
c Plcmt Mod. Ni 4 '
- 0 3 B held R:v. Nm o REVlil0N 2 10CTR$0,59 PROGRAM MANUAL P898 NO J l
ATTACliMENT A CP&L SAFETY REVIEW PACKAOT Page J,,,of' N l
t PART1: SAIITY ANALYSIS (cont'd!
DOC 1' MENT NO. PM 01.n3tt
_REV.NO.
0 AN ALYSIS (cont'd):
The replacement NUMAC system will clinunate or reduce the occunence of problems due to all of the above causes.
r ne system has been desiped and nanufactured under GE*a nucleat QA program. NUMAC software is developed, tested and controlled io accordance with GE's V&V program. He system has been seismically quahned by OE to a genene response spectra. OE has designed and analyred the BNP mounting con 6ruration (in panel H12 P614) to assure that the seismic spectra at the installed location will be within that to which the system is qualified. The NED civil group has reviewed summary documentation of the OE analysis to confirm the applicability of the GE documentation to BNP (ref:
NED Calculation OE41-0033).
Accurate and legible General Electnc drawings w,ll be issued into the BNP vendor drawing system to desenbe the NUM AC equipment and the physical arrangement within the lil2 P614 cabinet. Many of the anociated CP&L cabmet physical and winng drawings have been redrawti within the scope of this project in order to improve the legibility and accuracy beyond that of the entsting ones.
ne NUMAC system is designed to resist influence by etternal EMI interference.
ne self test features of NUM AC us!! provide for prompt identification of failures in either input circuits or in internal components or software, ne resultant self diagnosis error messages will-facilitate performance of cortective maintenance.
With the NUMAC mcde keylock switch in the OPER(ate) position, any manipulation of the NUMAC front panel keys has no impact ou the actup or operation of the system. La order to initists calibration '
-E activities, the keylock switch tnust be turned to the INOP position. Access to the chauis and channel setup options are fucher restikted by the need for a panword.
De functional performance of the NUMAC based system will eaceed that of the Riley based system that it will replace.
2.
Replacement of the fifteen IIPCI and RCIC Fenwal switches with thermoccupies that will connect to NUM AC inonitoring/ trip channels.
This change will helpjustify the elimination of the monthly surveillance te4 ting requirements anociated with the Fenwal switches, he thermocouples that will be installed in their place are considered to be paasive devices and are not subject to routine surveillance testing. Based on the current requirements for the other steam 1-ak detection thermocouple based channels governed by the same Technical Specification, the recommended surveillance will be limited to a refuel frequency verification of an appropriate channel response (upscale or downscale deflection) when the thermocouples are either heated or cooled as part of the channel calibration MST.
This change will provide Operations with display capability (on the NUMAC screen) for these 15 previously blind chann:Is, thereby improving the range of detail information available for use in identification, mitigation and post isolation tuonitoring of systern leaks.
Removal of thew 15 locally mounted Fenwat switches will resolve a long standing personnel and equipment safety hazard succiated with the frequency and difficulty of the climbing necessary for those tests.
O Al 109 Rev. 001
I Plcset Mod Na 'Yro038 Mald 16. Na 0 ItEVlilON :
10CFR50.50 PROORAh! h1 ANUAL Page Nm 0 3 A'ITACllhtENT A CP&L $ ArlTY REVIEW PACKAGE Page 2 of l L.
PART1: SAETY ANALYSIS (cont'd)
DOCO1ENT NO. fM 91-0M REY. NO.--
0 ANALYSIS front'dh Mounttng brackets for the replacement thermacouples have ben seismically designed and analyzed (ref: NED Calculation OE410030 91038).
The functional performance of these new thermocouple channels will exceed that of the local switches that they will replace.
3.
Removal of the Gl:MAC and Agastat components med for RWCU differential flow monitoring.
Recon 0guration of the delta flow loop by connatJon of the taisting 00w transmitters to the 1121 XY.
894911 NUMAC t. hauls and connection of RWCU procas ternperature thermocouple Signals from each of the three now paths to the NUMAC systern for use in demity correction.
The existing differential flow function compares the magustude of a single RWCU inlet flow channel to the sum of the two effluent now channels. Any difference is interpreted as leakage, ne existing instrumentation in exh of the flow channels consists of an onfice plate pnmary element, a differential pressure transnutter arid a square root convertet. Each of the three channels provides an input to a rummer which develops a cunent output proportional to the flow difference. A differential indicator and four separate inp units are driven by that current output. Two of the inp units are used to initiate 111 and 111111 control room annunciators. The third and fourth trip units stari 45 second delay timers for closure of the Div 1 and Div !! containment h,olation valvea. respectively. Although the inlet and return How channels are subject to significant temperature variation dudng the Modes 1. 2 and 3 in which this function is required to be operable, the computed now rates are not density compensated, ne NUM AC system will continue to utilize flow onfice plates and differential pressure transmitters for the input flow signals. He NUM AC based systern will provide the following advantages over the existing anangement:
- 1) The three square root converters, one summer, four trip units and two delay timers will be clinunated by this modification, ne NUMAC processor will perform the equivalent functions more rehably, with less drift and improved accuracy.
) Density compensation will be provided utiliz.ing signals from three existing RWCU process therrnoccuples The NUMAC programming includes default logic that will assure a continuous conservative calculation for differential flow in the event that any or all of the density compensation mput thermocouples wers to fail.
- 3) All three of the involved flow orifice plates will be replaced per this modification. The reject flow orifice has been resired to accommodate a reduced full range flow rate (further discussiou in next section). He inlet and retum flow onfice plates will be replaced with new ones of the same design and bore size as the existmg ones. His action will eliminate any loop uncertainty.
attributable to wear on these plates over their current installed lifetime.
- 4) Self-testing of the NUMAC will be performed on a continuous cycle while the NUMAC is in the ;
OPERATE mode.
l l
0 Abl09 Rev. 001
Nat Mod. Na 'f' - 0 3 9 rkki nant, N O REY!$10N 2 10CTR50.59 PROGRAM M ANUAL Pcrge No Cl +
ATTACl! MENT A CP&L SAFETY REVIEW PACKAGE' Page,,EL hf ).L, PART 1: SATETY ANALYSIS (cont'd)
DOCUMENT NO. PM 01-03:
REY. NO.
O ANALYSIS (cont'dh
o Flow transmitter signal for each channel (MADC),
o Onnce plate dp for each channel ('we proportional to MADC signal),
o Flow temperature of each channel (*F) for use in density compensation, o Calculated compensated flow rate for each channel (in equivalent gpm at the respective channel design temperaturea),
o Calculated normalized flow rate for each channel (in common units of gpm at the syste n design temperature of 533'F),
o Calculated differential flow (in common units of gpm at the system design temperature of
$33'F).
Availability of tius depth of data w111 provide additional information useful for evaluating the location and/or validity of any tndicated increase in differential flow.
The functional performance of the NUM AC based differential flow loop will eaceed that of the GEMAC based loop that it will replace.
J.
Improvernent of the RWCU flow and differential flow indicatiors as follows:
o Mottinent of the RWCU differential flow indicator from Ill2 P613 to Ill2 P603.
The caisting differential flow indicator 031.FDI R615 is located on the Ill2 P613 bacic panel and is inconvenient for use in prevention, or management of the reset, of potential 111 and H1411 control -
room alarms and isolation tirner cycles. Per this modification, this indicator will be moved onto the lil2 P603 control room panel. Availability at this new location, adjacent to the RWCU pump and valve controls, willimprove the usefulness of this instrument for use by operations to avoid spurious Group 3 isolations during system transienta such as fill, startup and shutdowti, Installation of this instrument in lil2-P603 has been seismically designed and analyzed (ref: NED Calculation OE410030-91038).
o Addition of RWCU return flow indication to lil2 P603.
The caisting return flow channel providea no indication. Per this modification. the return flowrate value will be displayed both on the NUMAC screen and on the new 031 F15954 vertical indicator that will added to the II!2-P603 panel.
Since the flow channels will be normalized to a common urtits basis, the system return flow should equal the system inlet flow, as displayed on G31 F1 R609, during normal RWCU systern operation where the full system flow is returned to the reactor. Availability of this flow rate value will provide additional information useful for evaluating the location and/or validity of any indicated increase in differential flow.
Installation of this instrument in H12 P603 has been seismically designed and analyzed (ref: NED Calculation OE410030-91038).
i-0 Al 100 Rev. 001 i
Plant Mod. Ns 41
- O M Flaid R:v. No O REYl510N 2 10CFR50.!? PROGRAM MANUAL Pcne No M ATTACllMENT A CP&L SAFETY REVIEW PACKAGE Page._1L of M PART1: SAFETY ANALYSIS (cont'd)
DOCUMENT NO. PM 91-0M REY. NO.
O ANALYSIS (cont'd):
Addition of capability to dhplay itsnperature comperaated solumetric flow ratts for the inlet, o
return and reject flow channels on the NUMAC screen in lil2 N14 and to dhplay the adjusted now rates "normalind" to a common itsnperature of $33'r for each of those flow paths on both the NUStAC screen and on vertical Indicators on lil2 N03. Differential flow will be displa)ed in normallied gpm on both lil2 W14 and on Ill2.N03.
NUM AC will *normalin' the Dow rates for each of the three flow channels to a common units basis of grm at 533*F. This will permit direct comparison of the readings on the various flow channels without first having to manually calculate the density differences characteristic of the different flow onfice design temperatures. Normalisation permits direct comparison to the Tech Spec Allowable Value now rate which is itself based on the system design temperature of $33'F. These hermalized now rates will also be utiliud for the RTGB display indicatorn.
Decreasing of the range of the RWCU reject flow loop from 250 gpm to 125 gpm.
The caistmg reject flow channel is calibrated for 0 to 250 gpra (Cl30'F), Operating procedures restnct now through this path to a maaimum of 70 to 90 gpm (@ the normal operating temperature of about 120'F). Due to the square root relationship of dp to flow, openition in the low end of the calibrated range for this flow channel significantly inercasca the calibration uncertainty. Per this modification, the range of the reject flow channel will be decreaud to O to 125 gpm (Cl30'F) resulting in a full scale normalital value of about 163 gpm. De NUMAC will display that full range and a new 0 to 150 gpm indicator will be installed in place of the caisting 031 F1 R602 on the 1112-P603 panel. His range reduction helps reduce both the reject channel and the computed differential flow uncertaintica. The reject now orifice plate has been resind to permit recalibration of the auociated transmitter and will be replaced within the scope of this modification.
His change will result in a reduction of the reject flow channel instrument inaccuracy since the actual flows will now always be a greater percent of the full calibrated channel range (operation below about 30% of full span causes a large uncertainty.) ne differential flow loop accuracy is addreased in calculation ORWCU-0010.
6.
Replactment of the existing separately wired individual ERF15 input signals with multiplexed inputs trammitted on fiber optic cables.
Due to its non-safety designation, the NUMAC-wERFl$ interface has no direct saiety significance.
His interface does, however, provide several disttnet advantages over the current hard wired selection of leak detection inputs to ERFIS.
Currently, 22 temperature channels and the RWCU inlet flow channel are hard wired to ERFIS via the MUX cabinets. The fiber optic comL:udcations !!r.k to be installed between the NUMAC system and ERFIS will transmit all of the temperature, differentu! temperature, flow and differential flow channel values to ERFIS, la addition, NUMAC sycem status and various channel validity / fault status information will also be transmitted. The scope of this plant modification does not include the addition of any of these new data points to eaisting ERFIS displays; however, the dat2 will be available for direct access by selecting the assigned ERFIS point ID and will_be available for expansion ccato the ares temperature ERFIS screens at a later time. ERFIS will store all data collected for potential use in event sequence or consequence evaluations.
O Al.109 Rev. 001
~
Plcmt Mod. No @ RI3 Ittd Ibv. No P l
REY!SION 2 10CFR50.59 PROGRAM MANUAL PG7' NE ATTACllMENT A CP&L SAFETY REVIEW PACKAGE Page 12.of 34 PARTlt SATITY ANALYSIS (cont'd)
DOCll MENT NO. PM 01-038 REV.NO.
O ANALYSIS (ennt'di:
This change is also necessary to eliminate e divisional r.eparation violation between existing ERFIS input cables within lil2 P614 (Ref: NCR A 90-010 and EER 90-0199). The cables that are currently in violation sie among those that will be Voided (physically removed) within the scope of this plant modification.
His feature of the modification will result in a net incremeetal safety improvement by cumination of cable separation violation.
7.
Elimination of the statl barriers and internal panel condults that provide intra division separation between the llPCI and the RCIC leak dettttion componer.ts and circuits, and 8.
P.eplacernent of the 125 VDC power supply that currently supplits the RCIC isolation channel imtruments with 120 VAC Emergency power, thereby eliminating the TOPAZ inverters.
In order to peruut optimization of the arrangement of the NUMAC equipmem and power supplies within the til2 P614 cabinet, research was performed to evaluate the enteria upon which the intra.
divisional separation of the llPCI and RCIC PCIS components and power sources was based, his research was irutisted with the objective of justifying the following desired criteria changes:
- 1) Elimination of the requirement for the steel barriers and conduits that provide intra division separation between the llPCI and the RCIC leak detection components and circuits, as well as elimination of the requirement for separation of the llPCI and RCIC PCIS cabling and components within a separation division.
- 2) Elimination of the TOPAZ inverters that power tia RCIC components from 125 VDC (a 6tep that would also resolve problems related to reliability and obsolescence of the TOPAZ inverters).
As a result of our research into the enteria bases for those two requirements, we requested and received concurrence from GE that they could be deleted. GE issued a Revision 4 to their Separation Spec 22A3010 to delete the requirement for intra-division separation of the 11PCI and RCIC PCIS components. BNP implementation of that enteria change has been accomplished via Revision 13 to our companion specification 048-004 and includes the following revised excerpted text:
- 1) llPCI and RCIC are both designed to provide adequate core cooling in the event of loss-of-feedwater flow. HPCI is a high capacity, safety related ECCS system. RCIC is a low capacity, non-safety related, non-ECCS system. Although reliable RCIC operation will minimize the frequency of ECCS challenges, HPCI and RCIC are not considered redundant to each other, ne safety related redundant counterpart to IIPCI is the ADS system as described in the previous section (of Specification 048 004).
- 2) In the Engineered Safeguard System portion of Specification 22A3010, GE conservatively requires that RCIC, although a non ESS system, be installed in the opposite separation division from HPCI. Through Revision 3, that specification further required intra-division r.eparation between the PCIS functions related to HPCI and RCIC. CP&L Specification 048-004, through Revision 12, invoked those requirements on BNP.
In November 1991. Revision 4 to 22A3010 deleted the requirement for intra division separation between the PCIS functions related to HPCI and RCIC, nat change permits the 0 AN09 Rev. 001
.o em, rPlant Mod. N: Sl-0 M P1:ld Rev. No- 0
% No 0 M REVIS!ON:
10CFR50.59 PROGRAM MANUAL ATTACHMENT A CP&L SAFETY REVIEW PACKAGE Page,,.D., of 34 PART I: SAFETY ANALYSIS (cont'd)
DOCUMENT NO. PM 91.n3e REV.NO.
O ANALYSIS kont'd):
liPCI PCIS circuits to share common enclosures, trays and racewayr with the same division RCIC PCIS circuits. The non PCIS ponions of the HPCI sad RCIC yter:.s are still required to be installed in opposite divisions.
GE's criteria that no single component malfunction or failure be cap:ble of disabling the required isolation function of either HPCI or RCIC remains applicable. The continued divisional separation within toth the IIPCI and RCIC PCIS logic assures that no single failure can prevent the isolation of both the inboard and the outboard valves of either system. Elimination of the intra-division separation between the HPCI and RCIC PCIS compoacnts marginally increases the probabitity that a single failure could cause a simultaneous spunous isolation of both HPCI and RCIC: bowr.ver, that probability is low and an occurrence of such a spunous dual isolation would present no safety concern.
- 3) RCIC, except for it's containment isolation valves and PCIS related instrumentation, has been designed and installed as a Division !! system but also receives actuation signals from Division I instruments, The Division i safety related RCIC equipment and cable should continue to be analynd to detennine if a sinF e failure at an instrumentation rack or cabinet l
or in a raceway could disable both RCIC and HPCI.
If a single failure could prevent operation of both systems, then suitable separation should be provided for the Division i RCIC equipment or cables, i.e.,1) route Division I RCIC cables in a raceway isolated from IIPCI cables, and 2) provide separation in instrumentation cabinets and racks equivalent to that specified in Section 2.2.4.1 (of Spec 248-004).
- 4) HPCI. eacept for it's containment isolation velves and PCIS related instrumentation, has been designed and installed as a Division I system but also receives actuation signals from Division I! instruments, no Division 11 safety related HPCI equipment and cables should be analynd to determine if a single failure at an instrumentation rack or cabinet or in a raceway could disable both RCIC and HPCI.
If a single failure could prevent operation of both systems, then suitable separation should be provided, i.e.,1) route Division !! HPCI cables in a raceway isolated from the RCIC cables, and 2) provide separation in instrumentation cabinets and racks equivalent to that specified in Section 2.2.4.1 of Spec M8-ON.
- 5) If the failure of a Division I RCIC or a Division !! HPCI cable or equipment does not prevent both the IIPCI and RCIC systems from perfonning their functions, then standard separation practices apply.
- 6) he PCIS isolation instrumentation and control logic for HPCI and RCIC is designed and installed in a redundant, fully divisionalind configuration. The prudent separation criteria for the HPC1/RCIC PCIS valves and instrumenteion shall be that no single component malfunction or failure can prevent the successful isolation of these two systems when required. The probability of a dual spurious isolation should be rninimized, but such an occurrence would present no safety concern......'
Elimination of the TOPAZ inverters that power the RCIC components from 125 VDC also resolves problems related to reliability and obsolesence of the TOPAZ inverters.
O Al 109 Rev. 001
Plant Mod. Nm 4i-ola Ihld Rev. Na-D REVISION 2 10CFR50.59 PROGRAM MANUAL Po9' No-dI9 ATTAC!! MENT A CP&L SAFETY REVIEW PACKAGE Page _L4. of 34
~
PART 1: SAIITY ANALYSIS (cont'd)
DOCUMENT NO. PM 014M._
REV.NO.
O ANALYSIS (cont'd):
9.
Sulmittal of a Tech Spu change to:
Delete the daily channel check surveillance test for the RWCU a Ilow. Itigh isolation function.
o Elinunatior of this daily surveillance is justified by addition of the NUMAC self-test espabilitica. In the OPERATE mode, the NUMAC system perfonna a continuous self test that completes a cycle every thirty minutes. NUM AC willidentify any faults detected, characterne them as either ' critical
- or 'non-entical*, and trutiste a control room overhead ' Test / Trouble
- annunciator. The self-test capabilities include momtonng of:
o each flow and compensation tnput signal for 'out-of bounds' values, o the two internal power supplies, o cha.rmel functionality In the event of loss of external power, the relay that initiates the ' Test / Trouble
- annunciator will fail to the alarm state.
The relocation of the G31 FDI R615 differential flow indicator from the H12 P613 back panel up to the lil2 P603 RTGB will make this parameter much more accessible for routine observation by the control operators.
Based on the above NUMAC feanaes and the relocation of the differential flow indicator, it is concluded that daily channel checks are no longer necessary, o Extend and standardise the CHANNEL FUNCTIONAL and CIIANNEL CALIBRATION test surveillance frequencies for the RWCU a flow. High, HPCI Ambient and a Temperature, RCIC Ambient and a tempenture, and RWCU Ambient and a Temperature isolation functions.
The pnmary reason for performance of the CHANNEL FUNCTIONAL test is to demonstrate instrument operability. As discussed in the preceeding item, NUMAC features a continuous self-test-monitoring capability that will detect any gross failures in either the input signals or inside the NUMAC. The presence of this feature justifies extension of the CHANNEL FUNCTIONAL test frequency beyond the current monthly requirement.
De Technical Specification change being submitted recommends that the CHANNEL FUNCTIONAL surveillance test interval be extended from Monthly to Semi Annual for each of the NUMAC
- channels, ne Technical Specification change also recommends that the CHANNEL CALIBRATION surveillance frequencies be extended from Quarterly to Refuel for the the HPCI Equipment Area Temperature - High, RCIC Equipment Room Ambient Temperature High and RCIC Equipment Room a T Temperature - High inp functions.
The thermocouples used as inputs to these NUM AC channels are stable desices and not subject to significant drift. Thermocouples are considered staSle since they perform a ' passive' function owing to the relatively small change in normal ambient service conditions (with respect to their overall temperature measunng range. The NUMAC system features a high degree of stability, with a drift 0 Al 109 Rev. 001
F;cmt !.iod. No '~4 I
- O29 neld Rev. Ns C'
REY!sION 2 10CFR50.59 PROGRAh! M ANU AL Pave Na M ATTACllMENT A CP&L SAFETY REVIEW PACKAGE Psge,,11, of 34 PART1: SAF1'.TY ANALYSIS (cont'd)
DOCUMENT NO. PM ol-m9 REY.NO..
0 ANALYSIS Ront'dn spee fication much lower than that experienced with the Riley instruments. NED Calculation ORWCU 00ll demonstrates that the snargtn for the temperature channelt between the field calibration setpomt values and the Technical Specification Trip Setpoint/ Allowable Value litnits is adequate to justify extensmn of the CilANNEL CALIBRATION frequency to Refuel frequency.
o Increme the RWCU a How holation time delay frorn 45 snonds to 30 minutes.
The purpose for increasing this time delay duration is to minirr the recurrence of spurious Group 3 nolatiom that can be attnbuted to actual flow t'ansients that can occur during RWCU system fill, vent, startup, and shutdown.
i The RWCU a Flow isolation function is intended to detect and initiate isolation of cold RWCU leaks.
Hot leaks are adequately addressed by the temperature-sensitive leak detection channels. The sole design basis function for the a Flow function then in to limit control room and offsite radiation doses to withm the linuts specified by 10CFR20. The a Flow function is not intended for protection of textor vessel water level or for limitmg the reactor building environment for equipment qualification purposes.
NED Calculation ORWCU 0012 documents CP&L acceptance of a GE calculation that demonstrates that a leak of 300 gpm of 145'F RWCU water can be permitted to persist un isolated for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> without exceeding the control room and offsite dose limita.
De 30 minute delay time has been selected as one which provides a reasonable time in which to su.bilize RWCU flow rates during system transient operations. It will also permit operations a reasonable time in which to venfy the validity of a impending a Flow initiated Group 3 isolation.
His delay time is justified based on the minimal safety consequences that would result from an actual 30 minute RWCU cold leak as demonstrated by the NED calculation, o
increase the RWCU a Row Allowable Limit /Setpoint from 53 to 73 gpm.
The overall RWCU a Flaw loop securacy is improved by replacement of the GEMAC instruments with the NUMAC system and the addition of density compensation to account for varying system flow temperatures. However, the loop still exhibits significant total uncertainty due primarily to the high degree of uncertainty present when one or more of the three flow channels is operstmg below about 30% of its calibrated span.
NED calculation ORWCU-0010 documents the overall loop uncertainties based on selected flow combinations. For the specific flow simulation case planned for use in the surveillance test, it has been detennined that the Technical Specification Trip Setpoint/ Allowable Value should be increased frotn the current 53 gpm to 73 gpm (normalized C 533'F). This will provide the necessary margin above the 43 gpm (normalind @ 533'F) field calibrated setpoint to allow for the loop calibration uncertainties that will be present during the CHANNEL CALIBRATION surveillance test and still be restnetive enough to assure a meaningful demonstration of instrument operability.
O Al 109 Rev. 001
Plcmt Mod. NW
- MO Tield H ey, N ^ O O#
REVlMON 2 10CFR50.57 PROGRAM M ANUAL Po78 No ATI ACllMENT A CP&L SAFETY REVIEW PACKAGE Page 16 of 34 PART 1: SAFETY ANALYSIS (cont'd!
DOC'l MENT NO. PM MnM REV.NO.
O ANALYSIS (cont'd):
Delete the instrument rtsponw time testing requirtsnents for the following isolation functions:
o o IIPCI steum line tunnd Ttsnperature high, o RWCU Area Ttsnperature. Iligh and RWCU Artsi Ventilation a Tesnperature. Illgh, o RWCU6 110w liigh.
The response time requirements for containment isolation instrumentation are based on the need to hmit the peak temperatures that can result from design basis line breaks to values lower than those temperatures utdized for environmental quahlication of safety related equipment.
For the inp functions listed above, the current Technical Specification response time limit is 13 seconds af ter the sensed temperature setpoint lirmt. "ais allows 10 seconds for DG start in the event of loss of AC power and 3 seconds for the actual mstrutnent channel to tnp.
Revinon 4 of the Reactor Building Environmental Report relies on the 300% high flow sensors for initiation of HELB isolations for the IIPCI and RCIC systems. The temperature-based channels are also capable of irutiating isolation of IIPCI and RCIC within 13 seconds after sensed temperatures exceed setpomts and would be relied on for smaller breaks. For RWCU, the report takea credit for the tempmture. based channels initiating flELB isolations for the RWCU system within 13 seconds after the thermocouple sensors are subjected to temperatures exceeding setpoint. Since margin is incit:ded in the analysis for all of the6e temperature based isolation initiations, a precise response time of 13 seconds is not essential. Neither the thermocouples nor the NUMAC components involved in these llPCI and RWCU temperature-based isolations are subject to significant drift in response time.
Periodic testing of the response time for similar temperature isolation channels is not currently required for either the RCIC system or for the other temperature channels in the llPCI system. Other EWRs similar to BNP do not have response time testing requirements for these isolation functions Further, based on the conservative results of the RWCU leakage consequence calculation ORWCU.
0012, it is clear that prompt isolation of RWCU cold leaks is not important to safety, it has been determmed that other BWRs similar to BNP do not have response time testing requirements for this isolation tnp function.
- 10. Resision of the power source for the three RWCU Dow transmitters. Deletion of the existing connect ons to the GEMAC power supply in 1112 P613 and rewiring of the transmitters to obtain power directly from the B214T 5949B NUMAC chassis.
Tais change will mmimize the current mixture of Division I and Division !! components that comprise the differential flow loop. It will also eliminate the need for, and remove, the caisting
- temporary condition
- capacitors installed on the RWCU different.at flow transmitter power supply per Unit !
EER 910014. Rev.1 (EER Action item 1) and Unit 2 EER 90-0265, Rev.1 (EER Action item 1).
In the fel:ouing *ections of this safety analysis, the primary potential failure modes for the post modification configuration of this ponion of the steam leak detection system are identified and evaluated:
0 Al-109 Rev. 001
Plant Mod. No. @ o 5 9 neld Rw, No 0 pg 16 C 2 i REV!510N 7 10CFR$0.59 PROGRAM M ANUAL A'ITACllMENT A CP&L SAFETY REVIEW PACKAGE Page 17 of 34 PART1: SAFETY ANALYSIS (cont'd)
DOCUMENT NO. PM 01-038 REV.NO.
O ANALYSIS (cont'd):
Total Lms of Offsite Power hustained or momentaru The leak detection instrumentation that is being replaced per this modification denves it's power as follows:
Division. Groups 3 (RWCU) and 4 (liPCD: 480/120 VAC via E5 Emergency Bus Division 11 Groups 3 (RWCU) and 4 (llPCD: 480/120 VAC via E6 Emergency Bus Dividon I Group 5 (RCIC): Div i 125 VDC Battery Bus Division !! Group 5 (RCICh Div 11125 VDC Battery Bus This modincation eliminates the DC power supply to the Group 5 isolation instrumentation. The replacement NUM AC system will be powered as follows:
/'
Division i Groups 3,4, and 5: 4?0/120 VAC via E5 Emergency Bus Division !! Groups 3,4, and 5: 480/120 VAC via E6 Emergency Bus The onginal design provided DC power for the Group 5 isolation instrumentation as one of the design considerations necessary to satisfy the requirements stated in GE Specification 22A3010 for separation between the llPCI and RCIC iwlation valve circuits, even within the same Division. In addition to the diverse power supply teature, CP&L Specification 048 044 implemented GE's requirement for physical separation between the Group 4 and 5 isolation valve cabling, internal panel wiring and components.
Within the scope of this project, GE reevaluated the Group 4/ Group 5 isolation valve separation -
requirements defined in their Specification 22A3010. As a result, GE provided CP&L with a Revision 4 to that spccification which eliminates the requirement for separation between the Group 4/ Group 5 isolation valve wiring within the same separation division. 'the basis for this enteria change is that RCIC is not considered redundant to HPCI. RCIC is not safety related and it's flow capacity is much smaller than HPCI. GE advised that they have not imposed this separation requirement on other plants. CPAL research determines that we are not specifically conmu*ted to such separation in the FSAR. This design basis change permits the following design advantages:
The bamered compartments that currently separate the HPCI components from the RCIC components in H12-P614 will be removed. ' Itis change will allow a cleaner and more maintainable arrangement of the NUMAC hardware and wiring within H12-P614.
The DC power supply and TOPAZ inverters that currently supply the RCIC Riley components and associated relays will be eliminated and will be replaced by an Emergency AC power supply, in the event of total loss of AC power, the leak detection system response will be as follows:
The Group 3 NUMAC output relay will be set up as 'Deenergize to trip (isolate)'. On loss of power, these normally energized relays will fail to the shelf state which wili initiate closure of the RWCU isolation valves. The outboard isolation valve 031 P004, which is DC powered, will then start closing immediately. The inboard isolation valve G31-F001, which is AC powered, can start closing upon restorstion of the ES Emergency 480 VAC bus via Diuel Generator No.1. Since RWCU serves no Safety Related or Safe Shutdown purpose, isolation of this system following Loss of AC power is an acceptable response. This post-modification Group 3 isolation logic will be the same as currently exists.
0 AI 109 Rev. 001
Nat Mod. Nam 1-r>38 held R:v. No 0 REV!S!ON 2 10CFR50.59 PROGRAM MANUAL P09* N^
c 2. 2.
ATTACllMENT A CP&L SAFETY REVIEW PACKAGE Page,,,11 of 34 PART1: SAIETY ANALYSIS (cont'd)
DOCUMENT NO. PM 91038t REV. NO.
O ANALYSIS (cont'd):
The Group 4 and Group 5 NUMAC output relays will be set up as 'Energire to trip (isolate)". On loss of power, these relays will failin the shelf state and will not cause either the llPCI or RCIC isolation valves to close.
For the purpose of HPC1/RCIC availability, it is nccessary that the isolation valves fail 'as is' in order to not block the potential operation of either HPCI or RCIC. both of which can start and operate with only DC power available.
la the event that a leak actually occurs on either the HPCI or RCIC system during the AC power outage, the NUMAC output relays will still inp within 13 seconds as assumed during IIELD response calculations. The 13 seconds in:!udes 10 seconds for the Diesel Generators to restore power to the E5 and E6 busses and 3 seconds for the NUMAC system to respond to the high temperature input and actuate the correspondmg isolation output relay.
If an output isolation relay had already been tnpped pnor to the loss of AC power, the NUMAC relay would fail back to the shelf state; however, each of the Group 3. 4 and 5 isolation logic circuits-include seal in features that would prevent reset of those isolation commands without intentional operator action.
Loss of One Division of AC Power hustained or momentarvt nis scenano is bounded by the above discussion for Total less of Offsite Power, Loss of DC battery power huitained or momentarvt This modification deletes the 125 VDC power supply that feeds the Group 5 Riley instruments.
Herefore, loss of either or both divisions of the 125 VDC battery system will have no impact on the NUM AC portion of the leak detection system isolation initiation control.
The Group 4 and Group 5 isolation logics to which the NUMAC outputs contnbute are cttrently, and will remain powered from the 125 VDC battery busses. Upon loss of one division of the 125 VDC supply, that same division of both the Group 4 and Group 5 isolation logies would lose power and cause the isolation valves controlled by those logics to fail as-is ne opposite division of 125 VDC power is assumed to remain available and, therefore, one division of both the Group 4 and Group 5 -
isolstion logic remains operable to initiate isolation of HPCI and RCIC should that be necessary. De Group 4 and Group 5 logic desenbed in this paragraph is unchanged by this modification.
[ailure of one or both of the NUM AC low voltare power sunolies.
The NUM AC Leak Detection Monitor design features redundant internal low voltage power supply modules, the outputs of which are auctioned and used to powei ti c NUMAC bus.
Failure of one of those modules will not impact operability of the NUMAC. A *non critical error' self-test message willidentify which bus and power supply is bad and the control room ' TEST / TROUBLE
- annunciator will alert operations that the NUMAC requires maintenance attention at the next convenient opportunity.
O Al 109 Rev. 001
Plcmt Mod. Nr 01 - 018 Tield Rw, No-. o REV1510N 2 10CFR50.59 PROGRAM M ANUAL Page No M 3 ATTACHMENT A CP&L SAFETY REVIEW PACKAGE Page 19 of 34 PART1: SAFETY ANALYSIS (cont'd)
DOCUMENT No. PM 0103:
REV.No.
O ANALYSIS (cont'd):
I Failure of both low voltage power supplies would cause total failure of that NUMAC. The consequences would be the same as desenbed above for ' Loss of One Division of AC Power *. Pailure of the B21 XY.
594EA or B NUM AC would leave the corresponding division's Group 4 isolation initiationlogic inoperable, resulting in that division's HPCI isolation valves staying 'as.is' and leaving the HPCI system available for initiation if required. The opposite division HPCI isolation logic and salves would still be available to isolate HPCI in the event of a leak.
Replacement of one or both power supplies requires that the external power supply be disconnected, a step that willleave all channels in that chassis inoperable. The Group 4 isolation channels have been assigned i
to a separate NUM AC chassis from the Group 5 isolation channels within each division in order to mmmuze the probability that concurrent LCO's nught be required on llPCI arid RCIC. De Group 3 isolatmo channels have been assigned to the same NUMAC chassis, B21 XY 5949 A and B, as the Group 5 chaanels (and thereby are also separate from Group 4) based on a BNP-espressed preference to mininute the probabihty for simultan.cus RWCU and HPCI unavailability, failure of an indisidual NUMAC hk'h ambient or differential temocrature channel or output relay.
Failure of an individual NUMAC high ambient or differential temperature channel or a o' tput relay failure could cause either initiation of a spunous Group 3,4, or 5 isolation or else prevent generation of the isolation signal when required due to an actual leakage incident. An evaluation of the consequence of each of there two failure modes on each isolation group follows:
Group 3-Spurious isolations of RWCU would have no safety consequence, since RWCU is not Safety Related.
All Group 3 temperature-based isolation channels have redundant counterparts in the opposite division, herefore, failure of one division to initiate a required isolation is an acceptable occurrence due to the availability of the opposite division redundant channel or relay.
Groun 4:
Spurious isolations of RCIC would have no safety consequence, since RCIC is not Safety Related.
RCIC would be inoperable during the isolation and until the cause of the spunous isolation is remedied. Ilowever Technical Specification 3/4.7.4 permits power operation to continue for 31 days with RCIC inoperable as long as HPCI is operable.
All Group 4 temperature based isolation channels have redundant counterparts in the opposite division.
Therefore, failure of one division to initiate a required isolation is an acceptable occurrence due to the availability of the oppmite division redundant channel or relay.
Groun 5:
Spurious isolations of IIPCI would have little safety consequence. HPCI is a Safety Related system, but has a fully redundant counterpart function in ADS. HPCI would be inoperable dunng the isolation and until the cause of the isolation is remedied. However. Technical Specification 3/4.5.1 permits continued power operation for 14 days with IIPCI inoperable as long as ADS, CSS and LPCI are operable.
O Al 109 Rev. 001
Phmt Mod. Nt.SR.03L rkld Rev. Nr 0 i
REY!SION 2 10CFR50.59 PROGRAM MANUAL Page Na- 0M ATTACilMENT A CP&L SAFETY REVIEW PACKAGE Page f l of 34 PART1: SAETY ANALYSIS (cont'd)
DOCUMENT NO. Pmol.rH REY.NO.
O ANALYSIS kont'd) 1 All Group 5 temperature based it.nlation channels have redundant counterparts in the opposite division, j
Therefore, failure of one division to initiate a required isolation is an acceptable occurrence due to the -
1 availability of the opposite division redundant channel or relay.
Within a separation division. the Group 4 and Group 5 signals are processed through separate NUMACs in order to nuninure the probabihty that a single failure or chassis mamtenance function could cause both 11PCI and RCIC to isolate or be otherwise inoperable at the same time (an occurrence that would start a 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> to llot Shutdown LCO).
Trouble shooting and repair of hUMAC failures is expected to require minimal time due to it's self-diagnostic features and module replacement repair concept.
Le NUM AC design ine!udea a feature whereby it blocks the contribution of any channel that is found to be faulted via the contmuous self test cycle, from the isolation tnp logic. When such faults are detec ed, appropnate erwr messages will be generated and a control room alarm will result. This design feature will mirumire the frequency at which failed channels will cause spurious isolations.
NUMAC is configured to handle a maximum of 36 ambient and differential temperature channels in each chassis. Within that chassis, six channels are proccased through each module. The channels that contnbute to the varteus Group isolation logics have been spread out among the modules so as to minimize the number of Tech Spec-related channels processed by any single module. In most cases, if a module fails without first causmg a spurious isolution, it will be poasible for power operations to continue since Technical Specification Table 3.3.21 pernuts some channels to be moperable without invoking an LCO.
This feature will allow scbduling of some repairs until a convenien plant condition exists.
Dilure of NUMAC Softwarg NUMAC software has been designed, documented and tested by General Electric in accordance with a controll-d Verification and Validation program. As a result of those comrols, the probability of software related functional failures is expected to be low, in the event that failures do occur, the consequences are considered to be no greater than those that would occur due to any other cause of channel logic failure; i.e., initiation of spunous isolation of one or more systems or else failure to initiate isolation when required. Those failure consequences are discussed throughout this analysis.
Failure of a 6-channel NUMAC module.
Failure of an individual module could cause up to six channels to either spuriously trip or else fail to trip when requir. '
The consequences of a module failure are essentially an extension of the single channel failure described above.
Since Group 4 and Group 5 channels are assigned to separate chassis, there is no potential for a single module failure to innpact both IIPCI and RCIC operability. Both IIPCI and RCIC also feature a 300%
high flow leak isolation which provide additional detection and isolation initiation in the event of major 0 AI 109 Rev. 001
~..
I Plcznt Mod. NAT.RlfL rteld Rev. Ha O REV!5!ON 2 10CTR$0.59 PRCGRAM MANUAL Page Ha d15 ATTACl! MENT A CP&L SAFETY REVIEW PACKAGE Page 2.1., of _ 34 PARTIt SAIITY ANALYSIS (cont'd)
DOCUMENT NO. PM OMM REV.No.
0 ANALYSIS (cont'd):
system leakage. Fct smaller than design basis magnitude leas, the reactor building rump monitoring and buement floodmg alarms provide additional detection capability that in turn triggers entry to leaksge identification 0,,erations procedures.
IMurtr'T.ht RWCU DifTerential Mow isolation Function T.P's RWCU differential flow isolation function consists cf a single non redundant channel. This design is consistent with other General Electne BWR's of BNP's vmtage. A few earlier plants have no flow-bascJ leak detection system for RWCU r.nd a few have high flow systems sitnitar to the 30015 flow channels on BNP's llPCI and RCIC systems. The differential flow function espanded to redundant channels on plants later than BNP. BNP's non redundant design was desenbed in the original FSAR and as such is an accepted element of our licensed design.
Due to it's non redundant configuration, it is acknowledged that both the current and the proposed modified designs are vulnerable to a vanety of potential single failures. Discussion below includes a -
desenption of the predicted effects of some of thow failure modes and a discussion of the conservative design feature incorporated to mininute the probability and consequences of such failures, Potential failure modes for the RWCU Differential Flow function and the predicted effects are as follows.
Failure of a RWCU finw trammitter or it's connectine cable to the NUMAC Inout board.
He caisting Rosemount differential pressure transmitters will continue to be utilind for the flow inputs to the NUMAC proccuor. De potential failure modes for the transmitters themselves are unchanged by this modification; however, the following features of this modification should help f
reduce the probability that such failures will occur:
- 1) Due to the non-redundancy of the existing loop, the power supplies and signal cabling associated t
with the three ilow channels curnntly is mined between Division 1 and Division II.
{
his modification will establish the differential flow loop as a Division II loop. The differential flow function will be handled in a Division II NUMAC chassis energized from the Division 11 Emergency AC bus. De DC power for the transmitter loops will be provided from within the
,, yUMAC, removing these loads from the GEMAC power supply in lil2 P612. Changes will be made in the interconnecting cabling between lil2 P613 control room cabinet and the ll21 P002 reactor building instrument rack that will result in all three transmitter signal cables being routed in Division !! raceway. New cabling between lil2 P614 and the benchboard indicators on 1112 P603 will all be routed in Division II,
- 2) While in the operate trale, the NUMAC processor will continuously monitor the transmitter signal for gross failures such as an open circuit and high or low out of rsnge cunent signals.
Detected failures will be annunciated via a control room overhead alarm. Such failures are not detectable with the current GEMAC system.
1 i
0 Al 109 Rev. 001 L
Plant Mod. Na *
- O N neld Rev. Na_ O Pcg> 14o. G E REVl$10N 2 10CFR50.$9 PROGRAM MANUAL ATTAClIMENT A CP&L SAFETY REV!EW PACKAGE Page 1 of 34 PART1: SAFETY ANALYSIS (cont'd)
DOCDf ENT NO, Pmol @t REY.No.
O ANALYSIS (cont'dh Ltiture of a differential now inoMLIDdib Gross failure of the differential now iriput module could result in either a spurious isolation signal or in a failure to isolate when necesary. Since this function is non redundant, vanous single failures could result it either of those failure modes.
Spunous isolations of RWCU, although both undesirable and NRC reportable, would have no ufety consequence since RWCU is not Safety Related.
Failure of the differer4tial flow loop to initiate isolation in response to an actual leak would also have httle safety consequence, based on the following:
- 1) The redundant fully divisionalized reactor low level contnbution to the Group 3 isolation logic assures that RWCU leakage cannot threaten fuelintegnty.
2; Calculation ORWCU 0012, which establishes an ANALYTICAL LIMIT for use in set point analysis of the differential flow loop, demonstrates that a RWCU cold water (145'F) leak rate of 300 rpm far as long as ?4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> would not cause control roon or offsite dose rates to escee41 the 10CFR20 limits.
- 3) llot leaks on RWCU would raise either the RWCU Pump and ilX Room or the Reactor Building general area temperatures high enough to trip the fully divisionalized temperature based isolation channels in those areas pnor to permitting the Reactor Building temperatures to exceed equipment qualification limits.
Failure of a RWCU orocess temocrature thermocouple or it's connectine cable to the NUMAC Inout hf.U1DL This modification adds a density compensation feature to the differential Dow. Three existing RWCU process thermocouples, whose current outputs are an lil2 P603 indicator and process computer points, are being connected to the NUMAC for use in calculating the density changes. Several safety considerations are described below related to this interface:
- 1) All three of the caisting th6tmocouples to be used for these compensation inputs are installed as non-Q and non seismic, which is consistent with the non-Q classification of the RWCU system.
The interconnecting cables kre run in divisionalized raceway; however, two are in Division 11 and the other one is in Division 1. As discussed above, the non redunda it differential flow function will be performed in a Division 11 NUM AC chassia.
The design for this modification directs that these density compensation thermocouple cables will be connected directly to the NUMAC thermocouple and/or differential now input terminal boards, without use of isolation devices. 'this design accepts a configuration wherein a transition from non-Q to Q will be made for all three thermocouple cables across a tenninal strip in lil2 P603 -
and from Division I to Division 11 for one of the thermocouple cables across that same terminal stnp. Justification for this design approach is as follows:
0 Al 109 Rev. 001
, _- q Plcrat Mad. No.91-012 Field Bev/ No- 0 REVISION 2 10CFR$0.59 PROGR8N MANUAL pega N. d M '
ATTACllMENT A CP&L SAFETY REVIEW PACKAGE Page 21of 34 PART1: SAFETY ANALYSIS (cont'd)
Doct* MENT No. PM 91038 REV.No.
O ANALYSIS (cont'd):
- 1) no NUMAC software provides grow failure and 'out of bounds mV signal checks for these t
flow density wmpensation thermocouple input signals. When either of thou conditions is sensed to exist. the NUMAC trouW relay will de anergize and alarm via the 'RCIC/RWCU-STM LEAX DET TEST /TROttsLE' Control Roo overhead annunciator. NUMAC will display an error message ide* tifying the affected channel and the nature of the failure.
Simultaneously, the softwve algonthm will substitute conservative values for the faulted inputs; i.e., all trip fur tions will be conservative in the presence of faulted input signals.
- ) nerefore, the remaining separation related issue of concern in this case is that a failure of any of the thermocouples or the interconnecting cables shall not physically damage the NUMAC ;
system and not prevent proper operation of it's safety related functions, ne thermocouple signal level is of such low energy (mV) that failure of the thermocouple or failure within the ;
extension cable itself(open or internal short) cannot physically damage the NUMAC hardware.
- 3) Two of the interconnecting cables are run in Division !! raceway, the same divialon as the ~
NUM AC chassis that will perform the differential flow function. These two inputs are E therefore subject to only those antw failure modes involving adjacent cables as are assumed for the safety related cabler in those raceways.
- 4) The one existing Division I thermocouple will be cross-tid to' Division !! in the following.
manner. In the ll!2 P603 cabinet, the divisional transition will be made directly at terminal points. There is n a credible event that could transmit faults from either division to the other.
through that interiace terminal point that would have the potential to affect adjacent cables in both Division raceway systems.
l-
REFERENCES:
Tech Soec. Sectionc 3/43.2.3/4,5.1.3/4.6.3 FS AR Sectione 1.9. 3.7. 3.10. 3.11. 5.2.5. 5.4.6. 5.4. 8. 6.2.4. 6.3. 7.1.a. 7.1.1. 7.1.2. 7. 3.1. 7.4. 7. 5.
B.3.1.3. 9.419.4.3.15 NED Calculatione ORWCU-0010. ORWCU 0011. ORWCU 0012. OE41-00M-91038. OE41-0033 General Electric NUM AC Leak Detection Monitor Performance Specification 23 A5227 Rev. O -
Proiect Desien Basis Document BG00511 Resetor Buildine Environmental Rwort. Rev. 4 l
lL i
L 0 AlJ109 Rev. 001 L
l' i
.=-
-.,. - =
-.-.a
.
>'V'
, ;r.en w,2 % plats l' bid ibv. No 0 REVISION 2 10CFR50.59 PROGRAh! h1ANUAL Page W N
A'ITACilblENT A CP&L SAFETY REVIEW PACKAGE Page 24 of _ 34 PA RT !!! ITEh! CLASSIFICATION
]
DOCUhlENT NO. PM 01-038
_ REV,NO.
0 1.
Does this item represent:
Xsi En a.
A change to the facility as described in the SAFETY
[X)
[]
ANALYSIS REPORT 7
- b. A change to the procedures as described in the SAFETY II IXI ANALYSIS REPORT?
c.
A test or experiment not described in the SAFETY II IXl ANALYSIS REPORT?
2.
Does this item involve a change to the individual plant Operating IXl lI License or to its Technical Speci0 cations?
3.
Does this item require a revision to the FSAR?
[X)
[]
4 Does this item involve a change to the Ofhite Dose Calculation Il-IXI hianual?
5.
Does this item constitute a change to the Process Control Program 7 II
. lXI 6.
Does this item involve a major change to a Radwaste Treatment.
II IXl System?
7 Does this item involve a change to the Technical Specification IXl II Equipment List?
8.
Does this item impact the NPDES Permits (all 3 sites) or constitute II IXI an "unreviewed environmental question" (511NPP Environmental Plan, Section 3.1) or a "significant environmental impact" (BSFP)7 9.
Does this item involve a change to a previously accepted:
I l-IXl
- a. Quality Assurance Program
- b. Security Plan (including Training, Qualification, and II IXl Contingency Plans)?
II IXl c.
i II IXl d. independent Spent Fuel Storage installation license? ~(if "yes,"
refer to Section 8.4.2, " Question 9," for special considerations.
Complete Part VI in accordance with Section 8.4.6)
SEE SECTION 8.4.2 FOR INSTRUCTIONS FOR EAC11 "YES" ANSWER, REFERENCES. List FSAR and Technical Specification references used to answer questions 19 above. Identify spect' c reference sections used for any "Yes" answer, Tech. Snee. Sectiom: 3 /4.3.2. B3/4.3.2. 3 /4.5.1. B3 /4.5.1. 3/4.5.2. B3/4.5.2. 3 /4.6.3. 3/4.7.4. B3/4.7.4.
B3/4.7.2 FS AR Sectiom:
1.8. 3 7. 3.10. 3. I 1. 5.2.5. 5,4.6. 5 4. 8. 6.2.4. 6. 3. 7.1.a. 7.1.1. 7.1.2. 7. 3.1. 7.4. 7.5.
8.3.1.3. 0.4.2. 9.4.3. 15 0 Al 109 Rev. 001
. ~.
Nat Mod. Na 9' W FWdRev. W O g p C 29 REVIS!ON 2 10CFR50.59 PROGRAM MANUAL ATTACllMENT A CP&L SAFETY REVIEW PACKAGE Page _.21_ of 34 PAltT 111: UNiti: VIEWED SAFETY QUINTION DETERMINATION SCitEEN DOCUMENT NO. PM 01-0M REV. NO.
0 1.
Is this change Julh adJtesud by ancther completed y.o N_g UNREVIEWED SAFETY QUESTION deterrrunation? (See
[] [X)
Sections 7.2.1, 7.2.2.5, and 7.9. l.1))
REFERENCE DOCUMENT N/A REV.NO.._
Y.tl H2 2.
For procedures, is the change a non intent change which enh (check)
Not Appi; cable
[] (X) check all that apply); (Sec Section 7.2.2.3)
[]
Corrects typographical errors which do not alter the meaning or intent of the procedure; or,
[]
Adds or revises steps for clarification (provided they are consistent with the original purpose or applicability of the procedure); or,
[]
Changes the title of an organiutional position; or,
[]
Changes names, addresses, or telephone numbers of persons; or.
[]
Changes the designation of an item of equipment where the equipment is the same as the onginal equipment or is an authorized replacement; c,r,
[]
Changes a specified tool or instrument to an equivalent substitute; or,
[]
Changes the format of a procedure without attenng the meaning, intent, or Content; or,
[]
Deletes a part or all of a procedure, the deleted portions of which are wholly covered by approved plant procedures?
If the answer to either Question 1 or Question 2 in PART 111 is 'Yes,' then Part IV need not be completed.
O Al 109 Rev. 001
r Ned Mod. No 3L*M!8 Nld Rev. NoA REVISION 2 10CFR50.59 PROGRAh! htANUAL Page Ho d o ATTACHhtENT A CP&L SAFETY REVIEW PACKAGE Page _2ft_ of._31 PART IV: UNREVIEWED SAFETY QUESTION DETERS 11 NATION DOCUh1ENT NO. PM 91-038 REY. NO.
O Uu.ig the SAFETY ANALYSIS developed for the change, test or espenment, as well as other required references (f.lCENSING BASIS DOCUMENTATION, Design Drawings Design Basis Documents, codes etc.), the preparer of the Unteviewed Safety Question Determination must disoctly answer each of the following seven questions and make a determination of whether an UNREVIEWED SAFETY QUESTION esists.
A WRITTEN BASIS IS REQUIRED FOR EACit ANSWER Xt1 En 1.
May the proposed activity increase the probability of occurrence
[][X1 of an accident evaluated previously in the SAFETY ANALYSIS j
REPORT!
i SEE ATTACHED 2.
May the proposed activity inctease the cousequences of an accident
[ ] [X]
evaluated previously m the SAFETY ANALYSIS REPORT?
SEE ATTACllED 3.
May the proposed activity increase the probability of occurrence of
( ) [X]
a malfunction of equipment important to safety evaluated previously in the SAFETY ANALYSIS REPORT 7 SEE ATTACllED 4.
May the proposed activity ir crease the consequence of a
[ ] [X) malfunction of equipment important to safety evaluated previously in the SAFETY ANALYSIS REPORT 7 SEE ATTACHED 5.
May the proposed activity create the possibility of an accident of a
[ ] [X) different type than any evaluated previously in the SAFETY ANALYSIS REPORT?
SEE ATTACHED 0 Al-109 Rev. 001
% % go W.oFB j
riend Rev. He- 0 REVISION 2 10CFR50.59 PROGRAM MANUAL N'*
ATTACilMENT A CP&L SAFETY REVIEW PACKAGE Page 27 of 34 PART IV: (Continued) lti b'2 6.
May the proposed activity create the possibility of a malfunction of
() (X) equipment important to safety of a different type than any evaluated previously m the SAFETY ANALYSIS REPORT 7 SEE ATTACllED 7.
Does the proposed activity reduce the margin of safety as defined
[] [X]
in the basis of any Technical Specification?
SEE ATTACllED S.
Based on the answers to questions 1 7 does this item result in an
!] [X)
UNREVIEWED SAFETY QUESTION? If the answer to any of the questions 1 7 is 'Yes', then the item is considered to constitute an UNREVIEWED SAFETY QUESTION.
9.
Is PNSC review required for any of the following reasons?
[X] l) 11, in answering question 1 or 3 'No,' it was determined that the probability inercase was small relative to the uncertainties; or, in answering question 2 or 4 'No,' it was deternuned tiuit the dosca increased, but the dose was still less than the NRC ACCElrTANCE LIMIT; or, in answermg question 7 'No,' a parameter would be closer to the NRC ACCEPTANCE LIMIT, but the end result was still within the NRC ACCEPTANCE LIMIT; then PNSC review is required.
REFERENCES:
Tech Snee. Sectiont 3/4 3.2. B3/4.3.2. 3/4 5.1. B3/4 5.1. 3/4.(.2. B3/4 5.2. 3/4.6.3. 3/4,7.4. B3/4.7.4.
B3/4.7.2 FSAR Sectione 1 8. 3.7. 3.10. 3.11. 5.2.5. 5.4.6. 5.4 8. 6.2.4. 6 3. 7.1.a. 7.1.1. 7.1.2. 7.3.1. 7 4. 7.5.
8.3.1.3. 9.4.2. 9.4 3. 15 NED Calculationc ORWCU-0010. ORWCU-0011 and ORWCU 0012 Gentpl Electrie NUM AC Leak Detection Monitor Performance Soccification 23 A5227 Rev. O Proieet Decien Batis Document BG0051 1
(
Reactor Buildine Environmental Reoort. Rev. 4 This unreviewed Safety Question Determination is for the following DISCIPLINE (s):
(Additional Part IV forms rnay be included as sppropnate.)
[ ] Nuclear Plant Operations N Structural
[ ] Nuclear Engineering
[ ] Metallurgy N Mechanical
[ } Chemistry / Radiochemistry N Electrical
[ ] Health Physics
[X) Instrumentation & Control
[ ] Administrative Controls 1
1 0 Al 109 Rev. 001
Pkmt Mod. No M + o 59 Deld Rev. Na-o REVISION 2 10CFR50.59 PROGRAM MANUAL
% Ih U E ATTACilMENT A CP&L SAFETY REVIEW PACKAGE Page _2L of 34 PART IVt (Continued)
Answers to Questions 17 1.
May the proposed activity increaw the probability of occurrmce of an accident evaluated previously in the SAFETY ANALYSIS REPORT 7 FSAR Sections 15.1 ttt.ough 15.8 describe the Anticipated Operational Occurrences and Postulated Accidents that have been previously evaluated, ne discussions of each of those operations and events have been reviewed. Based on that review, only Section 15.6, ' Decrease in Reactor Coolant Inventory', warrants detailed consideration relative to this plant modification.
The function of the instrumentation involved in this modification is to detect the presence of leaks in various pipmg and equipment that consutute portiota of the reactor coolant preasure boundary that is located outside of the drywell and to initiate isolation of the llPCI, RCIC and RWCU systems when ne:essary.
Section 15.6 takes no specific credit for the function of these instruments since breaks outside the drywell but within the reactor building mocar to have been bounded by both the leu of Coolant (inside drywell) and Main Steam I.ine Break (in turbh building) events.
Since the instrument function affected by this modification constitutes part of the design response to coolant leakage, rather than to prevention of it, this plant modification will have no effect on the probability of occurrence of any accidents previously evaluated in the FSAR.
2.
May the proposed activily increase the consequences of an accident evaluated previously in the SAFETY ANALYSIS REPORT 7 The instrumentation and controls affected by this modification are part of the Primary Containment Isolation System.
FSAR Section 15.0A.6.4 Event 36 describes the safety requirements and protection sequences for a ' Pipe Breaks Outside Primary Containment' accident The FSAR Figure 15.0A.6 24 protection sequence block disgrarr. shows the safety actions required for that event. It identifies the " Primary Contammmt and Reactor Vessel I>olation Control Sys' as part of the protection sequence required to assure that the ' Reactor Vessel isolation' safety action is achieved in response to either large or small breaks during Operating State D (head oninot shutdown),
The accuracy and response characteristics of the replacement leak detection instrumentation will equal or exceed that of the caisting instruments. The modification will implement all design, material and onstruction standards applicable to Q list, seismic instrumentation.
Beyond the PCIS instrumentation itself, the FSAR Figure 15.0A.6 2 identifica the auxiliary systems required to support various front line safety systems. For the pnmary front line system effected by this plant modification, the ' Primary Containment med Reactor Vessel Isolation Control System ' the identified auailiary systems are the 125V DC Power System, the Auxiliary AC Power System and the 250V DC Power System.
The last two of the above systems supply isolation valve motive power. No changes are made to any valve operators or valve power circuits by this rcodification.
0 Al 109 Rev,001 i
Pkmt Mod. No + RIL Fleid Rev. No &
REVISION 2 10CFR50.59 PROGRAM MANUAL PSP NL ATTAC11 MENT A CP&L SAFETY REVIEW PACKAGE Page 22 of,li_
PART IV: (Continued)
The 125 VDC Power System provides power to the valve controllogic circuitry. Impacts oi the three syr.tems which receive isolation signals from this instrumentation are as follows:
HPCI:
nat portion of the isolation logic which is designated as part of the HPCI system (Retsys E41 K44. K36. K34 and K3] and beyond; 1.FP 50039)is powered from 125 VDC. nere is no change to this part of the logic or to its power supply.
The etisting Riley and Fenwal instruments and logic relays that generate the isolation initiation signal to the HPCI isolation circuit (B21B K4A, K4D, K6A, K6B, K8A, K8B: 1 FP 05839) are powered from 120 VAC emergency power, ne logic is arranged such that the HPCI isolation valves will not close upon loss of AC power, ne HPCI isolation logic is intentionally not " failed <losed* on loss of AC power in order to assure that i:'s steam and water paths will be -
open if it is called into service. Per this modification, all of these components will be replaced by a NUM AC chassis, monitoring channels and rel:.fs that will be powered from 120 VAC. He same iwlation logic will be naintained. De HPCI isolation will remain ' fall as is' after this modification.
De HPCI isolation logic will therefore be dependent on the same sources of power after this plant modification as it was prior to the modification.
ECIC:
nat portion of the isolation logic which is designated as part of the RCIC system (Relays E51 K33, K54, K15 and K55 and beyond; l FP 50098)is powered from 125 VDC. %ere is no change to this part of the logic or to its power supply, The existing Riley and Fenwal instruments and logic relays (B21B K3A, K3B, K5A, K58,.
K7A, K7B; l FP 05839) that generate the isolation initiation signal to the RCIC isolation circuit are powered from 123 VDC power. The logic is arranged such that the RCIC isolation valves will not close upon loss of that 125 VDC powei supply, ne RCIC isolation logic is intentionally not " tailed closed' on loss of that DC power supply in order to assure that it's steam and water paths will be open if it is called into service.
Per this modification, the source of power for the NUMAC chassis, monitoring channels and relays that will replace the Rileys, Fenwals and logic relays will be changed from 125 VDC te the 120 VAC emergency bosa. The RCIC isolation initiationinstruments will be configured fully redundant and separated between Divisions I and 11. Power willle from the E5 and E6 busses.
The logic will be set up such that an isolation signal will not result from a loss of AC power, The RCIC isolation valves in the division that lost AC power will remain in the 'as is' position.
His satisfies the design basis criteria that RCIC be capable of starti:;g and operating independently of AC power. In the event that a RCIC leak is detected, the isolation will be appropnately initiated in time to complete the isolation within trie time utilized in the current line break analyses.
The present use of DC for the RCIC isolation-initiationinstrumentation was based on an original General El :tric requirement that the HPCI and RCic isolation instrumentation be separated from each other. CP1L has obtained concurrence from General Electric that their original position may be reversed. This change does not contradict any existing licensing commitments.
O Al 109 Rev. 001
Mome Mod. No..:t f ' Oi8 nold Rec. Na o REYlSION 2 10CTR50.$9 PROGRAM MANUAL Pc'4' No#
ATTACilhfENT A CP&L SAFETY REVIEW PACKAGE Page )A of M PART IVt (Continued) ne post modifiution RCIC isolation logic will continue to assure that the two Ley logic requirements are satisfied: RCIC renains capable of operating withcat AC power, and RCIC will be isolated upon detection of a leak exceeding the desigrated setpoint witido the time utilized in the line break analyses.
RWCU:
s nat portion of the isolation logic which is designated as part of the RWCU (NSSS) system (Relays A71 K35. K37. K25 and W26 and beyond; l FP 55109)is powered from 120 VAC.
There is no change to this part of the logic or to its power supply.
The custing Riley tratruments that generate the isolation initiation signal to the RWCU (NSSS) isolation circuit (1 FP45839) are powern! from 120 VAC emeigency power. The logic is arranged such that a RWCU isolation signal will be generated upon loss of AC power. This is a conservanve logic action and is the preferred failure anode sir.ce RWCU is s ion safety system.
Per this modification, the Riley components will be replaced by a NUMAC chassis, monitoring chamiels and relays that will be powered from 120 VAC. ne same RWCU isolation!ogic will be matntained. The RWCU isolation logic will cor.tinue to generate a 'close' signal upon loss of i
AC power after this modification. Redundant and separated NUh!AC channels will assure that isolation signals are generated in the event of actual RWCU high area temperature / differential temperature leakage indications.
The RWCU isolation logic and power sources will therefore be the same after this plant modification as it was prior to the anodification. The safety actions described in Otepter 15 will-continue to be accomplished.
Based on the sbove discussion of the primary affected system PCIS, and the associated auaillary teaponse systems, the consequences of any accident evaluated previously in the FSAR will not be increased.
3.
Stay the proposed activity increase the probability of occurrence of a malfunction of equipment Important to safety evaluated previously in the SAIT.TY ANALYSIS REPORT?
The following major equipment items that are currently part of the Primary Containment and Reactor Vessel Control System Isolation will remain and be integrated with the new equipment described below to perform the sarne PCIS design function in a more accurate and reliable manner:
- 1) Local ambient and area differential thermxouples
- 2) 120 VAC emergency bus power supplies
- 4) Isolation valve control circuita
- 5) Isolation valve motive and control power sources ne following major equipment items that are currently part of the Prinary Containment and Reactor Vessel Control System Isolation will be removed by this plant modification:
- 2) Riley nermocouple Trip Units and accessory modules
- 4) GEhlAC Square Root Converters, Summer Trip Units in the RWCU Isifferential Flow Loop
- 5) Agastat time delay relays in RWCU Differential Flow circuit 0 Al 109 Rev. 001
Not Mod. No 4 P W N1d Itn. No 0 a
REVISION 2 10CFR$0.59 PROGRAM MANUAL Page No _Gli..
A'ITACllMENT A CP&L SAFETY REVIEW PACKAGE Page J.L of 34 PART IYt (Continued)
- 6) GE vertical panel meters on RWCU Tiow and Differential riow channels h 125 VDC supply to the RCIC Riley Switches and RCIC relays in lil2 P614
- 8) RCIC ltem i local switches will be replaced with thennocouples identical to those currently installed in the temperature channels that connect to the Riley switches. The functions of the item 2 through 5 instruments and relays will be abt. orbed toto the NUMAC microprocessors. Three cristing item 6 tueters will be replaced with sinular Intemational lastruments meets. The item 7 DC power supply will be deleted for this appliwon.
Ea:h of the NUMACs will be powered frotn 120 VAC.
The repla:ement equipment will be selected, procured and installed to criteria that meet or exceed the corresponding attnbutes of the removed equipment. The replacements directed by this plant modification will he in accordance with normal critens for safety related equipment. All applicable seismic and environmental quahficatmn cntens have been addressed and satisfied. Divisional separation criteria will continue to be apphed.
Cal:ulations have been performed to verify that there is no negative impact on the AC or DC power di>tnbutica systerns.
Adequate post modification testing will be performed to ensure proper operation of the instrumentation and logic ciremts.
The probability of occurrence of a malfunction of equipment important to safety evaluated previously in the FSAR will not be increased.
4.
May the proposed activity incrase the conseqtrmce of a malfunction of equipment important to safety evaluated previoudy in the SAFETY ANALYSIS REPORT 7 Since all of tha isolation logic and isolation valve control circuita to which the replacement instrument provide initiation signals is unchanged, the consequences of the failure of any equipment installed per this modification would be the same as the consequences of the equipment item that was replaced.
The consequence of a malfunction of equipment important to safety evaluated previoustr ' t the FSAR will not be inercased.
5.
May the proposed activity creew the gibility of an accident of a different type than any evaluated previously in the SAFL'TY ANALYSIS REPORT 7 only two credible failure modes can be postulated for evaluation for the NUMAC-based isolation instrumentation to be installed per this modification:
- 1) Failure to isolate in response to an actual leak, or
- 2) Spurious isolation when isolation is not necessary.
O AI 109 Rev. 001 l
o
Pkad Mod. Na *
- 039 neld Rae. No 0 REVISION 2 10CFR50.59 PROGRAM MANUAL Page N^ cd ATTACHMENT A CP&L SAFETY REVIEW PACKAGE '
Pagt,H.of _3L.
PART IVt (Continued)
In case 1, the isolation functmo is designed to be single failure proof. The system design will assi're that the appropriate isolation signal is generated and that the approprtate isolation valves will close despite any of the following failures:
Total or partial malfunction of one or both NUM AC c'A - to within either the Division 1 or the Division 11 separation division.
(The opposite division will be available and achieve the isolation function),
. Loss of one division of emergency AC power.
(De opposite division will be available and achieve the isolation function).
Total loss of offsite power.
(The DGs will start and energize the E busses within 10 seconds. The isolation function will occur wthin the analyzed duration).
Loss of one division of DC power (NUMAC is independent of DC power. The relay logic within the HPCI and RCIC systems is DC powered; however, it is redundantly arranged and the oppaite division would be available and would a:nieve the isolation function).
In case 2, a spurious isolation of any or all of the three systems affected by this modification would not create a signifiesnt safety hazard.
112C.1: Spurious isolations of HPCI would have little safety consequence. HPCI is a Safety Related system, but has a fully redundant counterpart function in ADS. HPCI would be inoperable during the isolation and until the cause of the isolation was remedied. However, Technical Specification 3/4.5.1 permits continued power operation for 14 days with HPCI inoperable as long as ADS, CSS and LPCI are operable.
- RWC2 Spurious isolations of RWCU would have no safety consequence, since RWCU is not Safety Related.
RCIC: Spurious Isolations of RCIC would have no safety consequence, since RCIC is not Safety Related. RCIC would be inoperable during the isolation and until tbe cause of the spurious isolation i
is rtmedied. However, Technical Specification 3/4.7.4 permits power operation to continue for 31 l
days with RCIC inoperable as long as HPCI is operable.
i Based on the above disciusion, the lack of creation of new failure modes demonstrates that this modification cannot create the possibility of an accident of a different type than any evaluated previously in the FSAR.
l l
l I
l 0 Al-109 Rev. 001 l
l
r-x, Mme Most A 9 i-o ss M e W Bev. F C REVISION 2
-10CFR50.59 PROGRAM MANUAL-3'o9e l'"#
a ATTACHMENT A1 CP&L SAFETY REVIEW PACKAGE Page __11 of l 34 l
PART IV: (Continued) 6.
May the proposed activity create the possibility of a malfunction of equipment important to safety of a different type than any evaluated previously in the SAFETY ANALYSIS REPORT? -
The venery of potential causes of malfunctions will change due to utilization of a different type of equipment (digital microproces.,or based, mu!' %nnelinstruments vs. separate analog devices).: However, only the-following two credible ultimate n
- e. 'ose malfunctions are significant f1om c safety perspective:
- 1) Failure to isolate in response to sn actual leak, or
- 2) Spurious isolation when isolation is not necess.vy.
The potential consequences of these two failure modes were evaluated as being acceptable in the response _to -
Question 5 above.
The frequency of malfunction'. is expected to be reduced by implementation of this modification. Contributing factors will include the reduction in the number of total components, simplification of the interconnecting -
wiring configuration, specified stability (drift resistance) of the NUMAC equipment, self test acd diagnostic.
features of the NUMAC and a reduced scope and frequency of surveillance testing.
This modification will not create the possibility for a malfunction of equipmer :%ortant to safety of a different type than any evaluated previously in the FSAR.
7.
Does the proposed activity reduce the margin of safety as defined in the basis of any Technical Specification?
Tlie Technical Specification bases sisted as references on the PART IV form were reviewed. No direct mention is provided of any specific margins of amfety, Based on the responses to questions 1 through 6 above, it is clear that the performance of the ieplacement equipment provided by this modification will meet or exceed that of the existing equipte.ed.
Since there is no reduction in system qualification or performece, their is no possibility that czty current margins of safety will be reduced.
O AI-109 Rev. 001
/;
Pkxn Moo No 'h- 033 M k. No O ATTACHMENT 2 (Cent' d) e Page W d18 REVISION 2 10CFR50.59 PROGRAM MANUAL Page 65 ATTAOBIENT A CP&L SAFETY REVIEW PACKAGE Page 39 of M PART V: PNSC REVIEW DOCUMENT NO, fM 91-038 REN, NO.
Dete:mination/ Evaluation:
Acton Taken:
i Basis:
PNSC Chairman:
Date:
0 AI 109 Rev, 001 Page 81 of 87
F IJL S - 9 3 < o 17 Data:
A T T. lY. l (l PP)
IComEutcdbySillor alcula RWCUOhonID:
'Jef rsy M.
CAROLINA POWER & LICHT COMPANY-U o
Checked by:
.Date Pg. 37 Rev, O TAR /PID No.:
CALCULATION SIffEr p11,h1BDEAS43 C0051 B/C BC00.
Project.
Title:
Units 1&2 RWCU Differential Flow Leak Detection Calcula5fon
Title:
01/02 RWCU Flow Accuracy Calculation Status:
Prelim.-O Final E Void O 8.0 Firutca 8.1 Setpoint Diagram i
i 300 gpn i Anotytical Liriit 4
Total lincertalaties (141.68 gfn) 1r I
Conserative Hergin 4
(115.12 grn) f Non-Conserva t i
7.1 spn i Tech Spec Alto **te Value Hensirable IJncertainties a
1r (12.73 gpn) 4 43 gpn i Setpoint