ML20128G903
| ML20128G903 | |
| Person / Time | |
|---|---|
| Site: | Beaver Valley |
| Issue date: | 05/09/1985 |
| From: | NRC COMMISSION (OCM) |
| To: | |
| Shared Package | |
| ML20128G874 | List: |
| References | |
| NUDOCS 8507090351 | |
| Download: ML20128G903 (37) | |
Text
-
ORENA:
UNITED STATES NUCLEAR REGULATORY COMMISSION
(
i IN THE MATTER OF:
DOCKET NO:
4 BEAVER VALLEY - UNIT 2 BACKFIT APPEAL MEETING ON STEAM GENERATED WATER LEVEL CHANNEL INSTRUMENTATION ISSUE LOCATION: BETHESDA, MARYLAND PAGES:
1-35 DATE:
THURSDAY, MAY 9, 1985
'.4 4
C ACE-FEDERAL REPORTERS, INC.
OfficialReporters 444 North CapitolStreet 8507090351 850625 Washington, D.C. 20001 PDR ADOCK 05000412 (202)347-3700 T
PDR NATIONWIDE COVERAG
~~~
.e CR23079.0 1
REE/sjg g
I UNITED STATES OF AMERICA 2
NUCLEAR REGULATORY COMMISSION 3
BEAVER VALLEY - UNIT 2 BACKFIT APPEAL 4
MEETING ON STEAM GENERATED WATER LEVEL CHANNEL 4
INSTRUMENTATION ISSUE 6
Nuclear Regulatory Commission i e
Room P-110 7
Phillips Building 7920 Norfolk Avenue l
8 Bethesda, Maryland j
9 Thursday, May 9, 1985 t
The meeting convened at 10:30 a.m., Hugh Thompson i
10 presiding.
ATTENDEES:
12 l
V. NERSES NRC/NRR/DL/LB # 3 R. W.
HOUSTON NRC/NRR/DSI 33 B. W.
SHERON NRC/NRR/DSI R.
M.
BERNERO NRC/NRR/DSI
[
U T.
G. DUNNING NRC/NRR/DSI/ICSB G. W.
KNIGHTON NRC/NRR/DL/LB # 3 15 JIM TOURTELLOTTE NRC/OCM MAX CLAUSEN NRC/OCM/COMLZ 16 BRUCE BOGER NRC/NRR/DHFS/OLB JERRY MAZETIS NRC/NRR/DHFS/PSRB i
37 !l GARY L.
BEATTY DLC Lead Licensing Engineer RUSS WALLAUER DLC Backfit Manager J. C. MESMERINGER W N.S.
.18 KIRK TROXLER DLC Licensing Engineer u
THOMAS BLACKBURN W Safety Analysis 19 BRUCE LORENZ Westinghouse _ Licensing BETH EALL Westinghouse Licensing o
20 RON FEDIN Duquesne Light Company JOHN CAREY Duquesne Light Company E. KURTZ
_g Duquesne Light Company B. K.
SINGH NRC HUGH THOMPSON NRC 22 y
23 24 Ace-Festeral Reporters, Inc.
25 i
_ _. _., _ _ _.. _. ~ -.
23079.0 2
REE 1
PROCEEDINGS 2
MR. THOMPSON:
We are here today to address the 3
. appeal for the steam generator water level channel 4
instrumentation issue.
I think there are some -- a bit of 4
5 confusion on my part as to what the issue specifically is 6
with respect to the rules and which requirements that we 7
are evaluating.
8 I think it depends on one scenario, it will follow out 9
one set of regulations, and another tends to follow out 10 another set of issues.
11 It would be helpful if I asked the staff to identify 12 the Commission's requirements that, as you see them today, 13 particularly as it effects the steam generator water level
(
14 control issues, does that rule apply to Beaver Valley 2 15 and does the rule apply to Beaver Valley 1,* and do the 16 steam generator level signals serve as both the control 17 and protection function, and is this protection function 18 one that falls within the scope of 10 CFR 50.55 a(h).
l 19 So I will turn it over to you and to your staff.
i l
20 MR. BERNERO:
I would like Wayne Houston to give s
21 that summary because of my recent return here today.
l 22 MR. THOMPSON:
Welcome back to Bethesda, by the l
23 way.
l
(
24 MR. HOUSTON:
There is a provision in the 25 Commission's regulations which you identified in the last t
I j -
23079.0 3
REE 1
statement and has also been identified in Duquesne's 2
position statement, the tabular form that you had prepared.
3 This is headed " Protection Systems."
That particular 4
provision of the regulations did indicate that it was 4
5 applicable to construction permits issued after January 1, 6
1971.
w 7
The CP for Unit 1 at Beaver Valley was issued the previous year, so it is not applicable to Unit 1 on its 8
9 face.
On the construction permit for Beaver Valley 2, I
10 believe was issued in 1974, so on its face it is 11 applicable to Beaver Valley 2.
12 The key question here, I think, is, it has been-the 13 staff's understanding that the system in question, the 14 instrumentation system in question, serves both a control 15 and a protective function.
To my way of thinking, the 16 issue really hinges on the question of whether this is 17 part of the protection system for the reactor plant.
18 It is the staff's position based upon what was 19 presented in the FSAR Chat it is.
The identification of L
20 the absence of the single failure of vulnerability as 21 required by IEEE-279, which is ref erenced in 55 (h), was 22 the point of the contention.
23 We asked for Duquesne Light to address that single 24 failure vulnerability.
25 MR. THOMhSON:
To clarify my understanding, is
l i
23079.0 4
REE 1
that if it is both a control and a protective systems and 2
IEEE-279 applies, then you would normally have a two out 3
of four channel requirement to comply with IEEE-279 or --
4 why don't you explain.
0 5
If that is not correct, explain to me what the 6
significance of that requirement is as it applies in this 7
case.
8 MR. HOUSTON:
It is my understanding that each 9
of the steam generators at Beaver Valley, Unit 1 and 2, 10 have three channels of steam generator high level 11 instrumentation.
One of the three for each steam 12 generators serves a control function.
It is appropriately, 13 as I understand it, isolated so that failures in the i
14 control system are not fed back into the other channels.
15 This leaves two channels for the staff, for what the 16 staff believes is a protection function.
If a failure 17 occurs in the control channel so that it fails on the low 18 side, this leaves two other channels available for 19 carrying out the protective action.
And it does not meet 20 the -- if you then postulate a single failure, it does not 21 meet the IEEE-279 standard.
22 Perhaps Tom Dunning can amplify that.
He is more 23 familiar with the details of the system.
If I have 24 misspoken, correct me.
25 MR. DUNNING:
I believe that is essentially
23079.0 5
REE The question th'ough in part related to, doec 1
correct.
2 this necessarily dictate the addition of a fourth level 3
channel.
And with respect to that question, I would like 4
to say that is in our viewpoint one potential solution to 4
5 the regulatory conformance aspect.
6 There are also other potential solutions, but this 7
solution that you mentioned of adding the fourth level 8
channel is one which has been used most commonly in 9
licensing reviews of Westinghouse plants for plants like 10 Shearon Harris and the recent Westinghouse plants that 11 have gone into licensing.
They have elected that option 12 to address the regulatory conformance issue.
13 MR. THOMPSON:
What other options have the staff 14 found acceptable or would find acceptable in this case?
15 MR. DUNNING:
Well, there is -- I can give a 16 specific example with respect to Watts Bar.
That plant 17 had a little bit different configuration in that they had 18 additional level measurement signals that were available 19 for each of the steam generators.
20 In that situation, they used additional channels to s
21 initiate the actions that would be initiated by the system 22 that was within the scope of the Westinghouse protection 23 system.
24 Basically they used two additional level channels 25 configured such tha't if both of these additional channels
23079.0 6
REE 1
sensed high level, they would initiate the safety actions 2
that were initiated by the original two out of three 3
system that was shared with the control functions.
4 So this was an option that they had because they had b
5 additional level channels.
6 There are also other available options such as just 7
providing a separate nonsafety-related level channel and 8
using that channel for a control function such that the 9
control and protection would not be shared within the 10 existing systems.
This is perhaps a third alternative.
11 More recently we have looked at features that have been 12 incorporated in advanced Westinghouse plant designs with 13 regard to using control signals for protection.
These 14 newer designs are microprocessor-based systems.
Functionaklywhat they do is they look at all three level 15 16 measurement signals or four, whatever is available, and 17 they use software circuitry configured such that the i
18 signal that they feed to the control system is taken as l
19 the median value of all the measurement signals that are l
l 20 available.
21 Basically what the system does is if a channel fails 22 high or a channel fails low, as far as the measurement l
23 signal goes, the system rejects this information and I
24 therefore you don't get into a problem of adverse control 25 system interaction problem that leads you to a case where l
l l
I i
23079.0 7
REE 1
you need the protection provided by the high level trips.
2 MR. THOMPSON:
So it is clear, the issue that we 3
are concerned about here is steam generator overfill with 4
respect to this particular issue, as we have discussed it 4
5 so far.
6 MR. BERNERO:
Yes.
To answer your question more 7
generally, Tom has been speaking of the -- I will call 8
them control solutions that might be found to the problem.
9 We are dealing with steam generator overfill and there is 10 also the alternative of analyzing that overfill for either 11 the tolerabi.lity of the event or at least the temporary 12 tolerability of the event and this is where you get -into 13 questions of operator response.
Enunciation, detection 14 and manual action could overcome it.
Those are 15 theoretical solutions as well.
16 MR. THOMPSON:
So there would be a potential for, 17 under certain analytical scenarios, for Duquesne Light to 18 analyze the operator action and if they responded within a 19 set period of time or had some reasonable assurance that 20 they responded within a set period of time, the Staff has s
21 found that acceptable?
22 MR. BERNERO:
Yes.
The steam generator overfill 23 is not an instantaneous event.
That is a theoretical 24 solution also.
25 MR. THOMPSON:
Okay.
23079.0 8
REE 1
MR. BERNERO:
But that is Duquesne Light's 2
option.
3 MR. HOUSTON:
I would like to hear from Duquesne 4
Light.
e 5
MR. THOMPSON:
I am trying to understand what we 6
have found acceptable.
What are the ranges that we have 7
looked at?
8 I guess there are two things.
One, if you meet 9
IEEE-279, there are certain hardware aspects.
Then if you 10 do not meet IEEE-279, then there is another alternative 11 approach that we have evaluated, the acceptable analysis 1.2 '
and approach that may be acceptable to the staff in the 13 past.
14 Anything else you think to add to kind of understand 15 where the staff's position is?
16 MR. BERNERO:
The only other thing is the staff 17 does not have a formal cost / benefit analysis because it is 18 not considered a backfit.
19 MR. THOMPSON:
That is complying with the 20 current Standard Review Plan?
21 MR. BERNERO:
Yes.
I 22 MR. THOMPSON:
Just for the record, what 23 particular section of the Standard Review Plan are we
(
24 addressing?
25 MR. DUNNING:
That would be chapter, section 7.2.
1
23079.0 9
REE l
1 MR. SHERON:
There is also some in chapter 15, 2
1.1 through 1.4, specifically item Roman numeral II and 3
under specific criterion necessary to meet th e 4
requirements of GDC 101526 for incidents of moderate o
5 frequency.
It would be items, subitems 2 and 3.
6 MR. HOUSTON:
For clarification if I may add, 7
what we are going to now is into the subject area of the 8
basis for the staff's decision up to this point in time 9
that, yes, this is part of their protection system.
10-Because it is tied to the analysis of the feedwater 11 transient.
12 MR. THOMPSON:
Jack, I guess I would like to ask 13 you the same basic kind of questions as you see them and 14 then maybe an explanation as to your position with respect 15 to either the adequacy of your current designs and the 16 acceptability of those and why we should find those 17 acceptable.
That is, I think you agree the Commission as 18 a rule as it applied to Beaver Valley 1, does it apply to 19 Beaver Valley 2, are they considered a part of the control l
t 20 and protection system, and do you -- and is the protection i
21 function one that falls within the scope of 50.55 a(h).
22 MR. KURTZ:
We do agree that the regulation 23 50.55(h) does apply to the protection systems.
- However, 24 we intend to amplify on this specific issue relative to 25 whether this system falls within the guise of protection i
1 l
i
23079.0 10 REE l
4 f
\\
l systems.
e 2
I would also like to point out that this is a backfit 3
undet+ the current NRC regulations, 50.109, in that as used, l'
4 and I quote the language, as used in this section, o
a 5f backfitting of a production or utilization facility means 6
the addition, elimination or modifications of structures,
/
7 systems or components of a facility after the construction 8
permit has been issued.
9 So under the current regulations of title 10, it is in lU 10 fact a back, fit, the backfitting procedures apply.
11 With that, I would like to have Ron Fedin elaborate on 12 the~ position of how this system, how we believe that this 13 system does not fit in within the context of a protection
(
14 system.
15 MR. FEDIN:
The current Beaver Valley Unit 2 16 steam generator feedwater control and protection system is 17
the standard Westinghouse de*53n system and it is the same
,4 T If design that is now beinc.cfe in 24 operating nuclear 19
~ plants.
The Beaver Va. s.ey c:.ct 2 design is safe and will 20 maintain an acceptable level of safety as shown by the 21 Beaver Valley Unit 2,FSAR and as demonstrated by the many 22 operating reactor years of the Westinghouse designs
~
23 currently in use.
I 24 The addi' tion of.a fourth steam generator water level channel /Ec5 high steam generator water level control will 25 t
i.
9 Q l
+
23079.0 11 REE 1
not provide a substantial increase in the level of 2
protection for public health and safety as required by 10 3
CFR 50.109.
4 Duquesne Light believes this issue is a backfit in 0
5 accordance with Generic Letter 84-08.
In the Beaver 6
Valley Unit 2 PSAR, the Commission approved the Beaver 7
Valley Unit 2 feedwater control and protection systems and 8
indicated that IEEE-279 was adequately considered.
No 9
changes to this 1971 regulatory criteria or to the 10 feedwater design have occurred since.
However, the staff 11 now finds this same feedwater. design not acceptable.
12 MR. THOMPSON:
Let me ask you a question on that.
13 When you look at IEEE-279 and read it today, do you say 14 that it meets IEEE-279 today?
15 MR. FEDIN:
I believe the rest of my statement 16 will address that question.
17 No changes to this 1971 regulatory criteria or to the 18 feedwater design have occurred.
However, the staf f now 19 finds this same feedwater design not acceptable.
20 Clearly the NRC has changed its interpretation of an 21 existing unrevised regulation for which major 22 modifications to Beaver Valley Unit 2 systems and 23 components would be required to meet this new 24 interpretation.
25 10 CFR 50.55 a(h) provides the regulatory basis for
23079.0 12 REE l
1 application of IEEE-279 to the protection systems of 2
nuclear power plants.
Part 50.55 a, which became 3
effective on July 12, 1971, applies to all plants which 4
received construction permits after January 1, 1971.
5 At least 12 other Westinghouse plants, which have 6
received construction permits since 1971, use two out of 7
three logic for the high steam generator water level 8
The staff must have determined that these 9
12 plants comply with 10 CFR 50.55 a(h) and IEEE-279, 10 since no exemptions to 10 CFR 50.55 a(h) have been 11 required.
12 Duquesne Light believes adding a fourth steam generator 13 water level channel will result in a negligible increase 14 in public safety.
This backfit is being considered by the 15 staff to address a very narrow event.
16 First, the plant must be operating with the feedwater 17 control system in automatic.
The first failure must be a 18 failure in the steam generator water level channel that is 19 providing input to the control systems.
It must be fail 20 low; it cannot be fail as-is or fail high.
21 Second failure must be on the same steam generator in d
22 one of the other two remaining channels and the failure 23 must be a fail as-is failure.
It cannot be a fail high, 24 cannot be a fail low, cannot be a loss of power or short 25 or open within the circuit.
23079.0 13 REE 1
Thirdly, the operator is not credited with taking any 2
operator action.
The operator will receive numerous 3
alarms.
He will receive high level alarms, low level 4
alarms and steam feed mismatch alarms.
5 MR. THOMPSON:
How many -- would you go through 6
those alarms for me?
How many high level alarms do you 7
have on the steam generator?'
8 MR. FEDIN:
He would get low level alarms for 9
the fail low channel.
If he took no action as the water 10 level rose, he would get a high level alarm from the third 11 and final channel that is continuing to operate correctly.
12 MR. THOMPSON:
So he would get one alarm?
13 MR. FEDIN:
One high and one low.
You would 14'.also get steam feed mismatch alarms that would also come 15 in.
He would receive,these alarms, look at his 16 indications, see that he has got contradictory indications 17 which would lead him to believe that he wasn't sure which 18 one of these was working.
l 19 Looking at steam feed flow, he would see that the other 20 two steam generators are still working correctly and he 21 would note that feedwater would be increasing rapidly
~
22 above the steam flow in the operating steam generator.
l i
l 23 The actions that he would need to take to intervene and 24 stop this event are very quick and easy.
Taking the 25 feedwater control system out of automatic into manual
23079.0 14 REE 1
stops the feedwater regulation valve from going full open.
2 And once he takes it into manual, he recognizes his 3
responsibility for controlling the feedwater flow on that 4
steam generator and he would manually close the feedwater 5
control valve ending the event.
6 MR. THOMPSON:
What time frame do you see this 7
normally occurring, or have you analyzed that?
8 MR. FEDIN:
Normally operators are very attune 9
to watching the feedwater level.
Of all the parameters in 10 the plant, this is the one that they have a lot of 11 training on simulators in the plant.
This is the one 12 where they have specific attention controlling because it 13 tends to be a parameter that is a little more difficult to 14 control than some of the others.
15 So they are very attune to watching this.
16 On the January 16 event, they actually, out of the many 17 alarms that came in due to the loss of power to the 18 inverter, they picked up the situation and actually took 19 the feedwater control system out of automatic and into 20 manual within the first eight seconds of the event.
i 21 MR. THOMPSON:
Have you seen the training 22 program lesson plans as they relate to this particular 23 incident?
i 24 MR. FEDIN:
We have actually gone through the 25 simulator training.
This is one event that virtually
.23079.0 15 REE 1
every operator that has ever gone through the training 2
experiences, which is the failure of channel.
3 MR. THOMPSON:
But you have that as one of the 4
modules in your program as part of both the lesson plans
~
5 as well as the simulator training program?
6 MR. FEDIN:
Yes.
7 Duquesne Light believes the probability of this event 8
occurring as just described, which is two failures --
4 9
first failure must be failing low, the second failure must 10 be failing as-is, and third, the operator taking no 11 action -- we believe the probability of this event 12 occurring is quite remote.
13 Duquesne Light believes that a backfit to address this 14 very specific scenario would only slightly reduce the i'
15 relatively small probability of steam generator overfill 16 from all causes.
However, even if the addition of a
.1'7 fourth steam generator level channel to Beaver Valley 2 18 was postulated to provide a minimal increase in the 19 protection, it would not be cost beneficial.
The addition 20 of a fourth steam generator level channel would result in l
21 a cost of over $1 million and may well result in a' delay 22 in the startup of the plant.
23 Duquesne Light believes that if the Commission were to 24 complete its own cost / benefit evaluation, as required by 25 Generic Letter 84-08, it would also find that this backfit
J 23079.0 16 REE 1
is not cost beneficial.
2 Beaver Valley Unit 2 FSAR has shown in section 15.1.2 3
for excess feedwater events that the fuel limits for 4
departure from nucleate boiling are not exceeded at any 5
time, radiological dosec are within 10 CFR 20 limits and 6
the reactor coolant system pressure boundary is not 7
breached.
8 Section 15.1.2 of the FSAR meets the current 9
Standard Review Plan acceptance criteria fcr increase in 10 heat removal events.
11 MR. THOMPSON:
You are saying this is what our 12 FSAR position was?
13 MR. FEDIN:
Yes.
The FSAR shows that the fuel 4
14 limits for DNB are not exceeded.
The r.eactor coolant 15 system pressure boundary is not breached.
16 MR. HOUSTON:
Is that with or without taking 17 credit for the operating of the steam generator --
18 MR. FEDIN:
That is as it is shown in section 19 15.1.2 right now.
20 MR. SHERON:
The analysis typically stopped 21 after the minimum DNBR is reached.
They don't address the 22 question of what happens with the water continuing to fill 23 the generator.
It is not there.
24 MR. THOMPSON:
Our analysis?
25 MR. SHERON:
Theirs.
t
23079.0 17 REE I
1 MR. FEDIN:
We use it as a convenient ending 2
point in the analysis.
We don't 3
MR. BERNERO:
You don't speak to secondary 4
system integrity and consequent effects.
5 MR. KURTZ:
We are talking about safety systems 6
addressing the attributes of 10 CFR part A, no DNB fuel.
7 MR. BERNERO:
But you stopped at the DNB.
8 MR. FEDIN:
The Standard Review Plan does not 9
specifically address steam generator overflow.
10 MR. SHERON:
The question here is, have you 11 considered the operator error?
Then you would have to, A, 12 address that to show that the consequences of an overfill 13 did not result in a steam line failure and B, that if it 14 did, the radiological consequences wouldn't exceed part 15 100.
That wasn't done.
16 MR. FEDIN:
If we look at the statement that 17 says if we have an overfill event without other faults 18 occurring, we have had the -- we still have the two out of 19 three channels to provide high level.
20 MR. SHERON:
The logic that is used is that the 21 staff gives credit for equipment that is considered safety 22 related.
It meets IEEE-279.
We don't give credit for 23 equipment that does not safety grade.
I think what the 24 question boils down to is, you are taking credit for 25 nonsafety grade equipment.
4
23079.0 18 REE 1
MR. THOMPSON:
Maybe you can explain why you 2
feel comfortable taking credit for nonsafety grade i
3 equipment, if that is --
4 MR. KURTZ:
I think we need to refer back here 5
to the Westinghouse.
Mr. Blackburn and Mr. Mesmeringer 6
pointed out to us that the fact of having the level trip 7
on the program as an ending point for the program -- is 8
that correct?
Could you elaborate on the fact that we do 9
not take credit for this in chapter 157 10 MR. BLACKBURN:
The function is assumed to occur.
11 It does -- my name is Tom Blackburn with Westinghouse.
12 The excess feedwater malfunction analysis presented in 13 section 15.1.2 does show feedwater isolation and turbine 14 trip on high stream generator water level.
If you look at i
15 the transients, you will see that we have identified the 16 point of minimum DNBR as to occur before feedwater 17 isolation and before turbine trip.
In addition, it occurs 18 before the high high level signal itself.
That is our 19 basis for saying that we have met the fuel limits for 20 acceptance criteria of this transient.
We have not 21 defined the high high level signal as ESF in addition.
22 MR. SHERON:
The question is though, if you 23 didn't take credit for it, then we would have to say, is 24 the event considered to be over, because you would have 25 filled the steam lines, you would have pushed water out of
23079.0 19 REE 1
the' secondary relief valves.
Your valves are probably not 2'
designed to relieve water.
We don't know if your steam 3
lines are designed to hold the dynamic loads of filling 4
them with water, whether it is water hammer or dead weight 5
or Whatever.
That is really What the question is.
6 You have said the event is over because I didn't
-7 violate the commission's criteria.
The Commission's 8
criteria says, no fuel failure for this event.
9 Or, Which says, if it did overfill, then you would say, 10 show me that the steam line doesn't fail so that I don't-11 fail fuel or if you say gee, I did take a single failure 12 which is where an operator error, as the review plan says, 13 where the operator fails to act to stop the overfill, then 14 it says you have to show that you don't violate those 15 limits of part 100.
This means that we are postulating:
16 the over' fill occurs, the operat'or error is assumed for the 17 Standard Review Plan, and if the operator is assumed, then 18 a generator overfills, you need to demonstrate to us why 19 the steam line doesn't fail and cause a steam line break 20 which results in those consequences which exceed part 100.
21 MR. KURTZ:
I think we have something on that.
22 If Mr. Fedin is allowed to continue with his process.
i 23 Under the FSAR chapter 15, the event in there, we have 24 addressed that.
That is taken care of.
25 Now we are talking about steam generator overfill.
If
23079.0 20 REE 1
Mr. Fedin can continue reading here --
2 MR. THOMPSON:
I have one question before that 3
I thought Tom was going to address.
I guess the quality 4
of the instrumentation was that -- you indicated there i
5 wasn't a safety grade instrumentation they were relying on 6
but other instrumentation.
7 MR. KURTZ:
We said we weren't relying on it.
8 MR,. THOMPSON:
Whether you are relying on it or 9
not, would you please tell me what the quality is?
Is 10 this --
1 11 MR. KURTZ:
Westinghouse quality.
i 12 MR. THOMPSON:
Maybe Westinghouse can tell us 13 the Westinghouse circle bar W instrumentation.
14 MR. KURTZ:
It is probably no different than any 15 of the' safety grade.
16 MR. MESMERINGER:
I would like to amplify the 17 pedigree of the instrument channels that are there.
There 18 are three of them.
They are fully safety grade; each 19 instrument channel is in a separate process cabinet that 20 is, you know, equipment qualified and fully safety grade 21 in the sense of being class lE equipment.
i 22 One of those channels is stared between the safety 23 grade channel and the control channel.
That control 24 channel is isolated from the safety grade channel so that 25 a disturbance in the control system will not feed back
23079.0 21 REE 1
into the protection system.
So in a sense, the way the 2
instrumentation was designed, it was designed safety 3
graded.
4 I hope -- does this answer your question?
5 MR. THOMPSON:
I think it was helpful.
6 MR. HOUSTON:
Westinghouse does intend with this 7
system that it meet the IEEE-279 criteria?
8 MR. MESMERINGER:
No.
9 MR. HOUSTON:
What is your definition of safety 10 grade then?
11 MR. MESMERINGER:
A class lE, qualified 12 separated, independent from other channels and measure 13 redundancy.
But that purpose was not to provide reactor
(
14 protection.
The purpose was to provide turbine protection, 15 equipment protection to prevent carry-over of moisture 16 into the turbine.
17 MR. THOMPSON:
When is the turbine protection 18 method -- does it trip on high vibration or what would be, 19 assuming you did not have the feedwater trip and you 20 continue to overfill, what would be your turbine 21 protection?
22 MR. CAREY:
It would have to be tripped manually.
23 The vibration indicators and alarms, but there would be no 24 automatic action.
25 MR. THOMP' SON:
What level of carry-over do you
23079.0 22 REE 1
think would require to give sufficient vibration for the 2
operators to either get the alarm and then be aware of to 3
take any action to trip the turbine?
4 MR. CAREY:
I would say certainly any 5
significant amount of water carry-over would give us a 6
vibration signal of 10 mils.
7 MR. FEDIN:
Section 15.1. 2, the Beaver Valley
+
8 Unit 1 FSAR has been modified to correct an error as 9
described in the March 27 Duquesne Light letter issued to 10 the Commission.
The initiation of a turbine trip on high 11 steam generator water level is a control function to 12 provide protection for secondary nonsafety related 13 components.
It is not an engineered safeguard feature 14 system actuation.
15 Summary table 15.0-6 in the FSAR inadvertently listed y
16 this function as ESF and will be corrected in the future 17 FSAR amendment to accurately show this function as non-ESF.
18 The text description in 15.1.2, which has not been 19 modified, continues to state that no ESF systems are used 20 to mitigate excess feedwater events.
i 21 Section 7.7 of the Standard Review Plan does not 22 require control systems to meet IEEE-279.
Therefore, 23 IEEE-279 is not applicable for the high steam generator 24 water level turbine trip.
25 NRC action to risolve unresolved safety issue A-3,
~ _ -
23079.0 23 REE i
i i
steam generator tube integrity, was recently issued 2
through Generic Letter 85-02 and NUREG-0844 by the NRC 3
director of licensing.
Steam generator overfill was 4
addressed in that NUREG.
However, no NRC actions were 5
recommended at this time, but instead as stated in section 1
6 4.3.1 of NUREG-0844, the NRC study on steam generator 7
overfill is being performed as part 'of the unresolved 8
safety issue A-47, control system failures, safety 9
implications of control systems.
10 Thus, an addition of a fourth steam generator level 11 channel now on B.eaver Valley Unit 2 to address control 12 system interaction with steam generator overfill is 13 premature and at best would be considered only an interim 14 change pending resolution of unresolved safety issue A-47.
15 If the NRC believed that adding a fourth steam s
16' generator level channel to this standard design was truly 17 required to maintain a minimum level of safety, then a l
18 generic bulletin or order would certainly have been 19 initiated or issued to operating plants with the two out l
20 of three feedwater level design rather than awaiting the i
21 outcome of unresolved safety issue A-47.
22 In fact, the Commission continues to allow, we believe, 2
i 23 nine plants to operate without any form of high steam 24 generator water level turbine trip function.
I 25 Duquesne Light sees no justification for imposition of i
[
+
-~
23079.0 24 REE 1
an interim solution now when the final resolution of A-47 2
is scheduled to be available in 1986.
3 Duquesne Light believes their current generic design 4
provides an acceptable level of safety.
Duquesne Light 5
will meet any requirements that evolve from the resolution 6
of A-47 to allay steam generator overfill concerns.
7 In summary, IEEE-279 is not required for a control 8
function such as the high steam generator water level 9
turbine trip as per Standard Review Plan 7.7.
10 However, Duquesne Light believes their current standard 11 Westinghouse-designed feedwater control and protection 12 system maintains an acceptable level of safety as 13 demonstrated by the Beaver Valley Unit 2 FSAR and the many 14 operating plants using the standard Westinghouse design 15 systems.
16 An addition of a fourth steam generator water level 17 channel will not provide a substantial increase in the, 18 protection of the public health and safety.
19 Any generic backfits concerning the control system 20 interactions which the Commission believes is warranted 21 should be implemented through the unresolved safety issues 22 medium and not on a plant specific licensing review just 23 before the unresolved safety issue study is completed.
24 Resolution of unresolved safety issue A-47 is scheduled 25 for 1986 and should be the forum for closing out control l
I
23079.0 25 REE 1
I system interactions and steam generator overfill concerns.
2 MR. THOMPSON:
As I understand your position, 3
you are prepared to say for the pending resolution of A-47, 4
you believe that your system provides an adequate level of i
5 safety as designed and that you are prepared to comply 6
with whatever the requirement that comes out of A-47 as 3
i 7
would the other nine plus 13 plus how many folks there are --
8 MR. FEDIN; 33 plants.
9 MR. THOMPSON:
Your brethren of 32.
10 MR. KURTZ:
Certainly.
11 MR. HOUSTOM:
May I ask a question?
12 MR. THOMPSON:, Let me -- save yourself.
9 13 One of the things in, 1 guess in an earlier submittal,
l 14 that you talked a bit about operator action and I guess 15 some experience you had on Unit 1 with respect to the 16 operator, you take any credit for the -- I think you did, 17 you didn't say them at the end -- do you not have some 18 additional assurance on operator actions on your training j
19 programs and your simulator that this is an evolution that 20 they are well trained en and they would take actions to o
21 prevent a steam generator overfill as adding to your level 22 of assurance?
23 MR. CAREY:
That is one of the program 24 malfunctions on the simulator is the failure of a steam 25 generator level cha'nnel control.
The operators, we feel, i
+
....L..
~.,-.,___,_m._..____._,,_m.,,r,c_,,
...,,y_
__.v..____m..,, _ _ _. -,..
1 j
23079.0 26 i
REE 1
are trained to recognize this type of malfunction very j
2 quickly.
Certainly we believe that it is more likely that r
3 a steam generator overfill would be caused by a i
4 malfunction of the steam generator level control itself l
5 and not the instrument channels that feed the control f-6' system.
l' 7
The operator certainly has two actions in the event 4
{
8 that he suspects he does have a control malfunction.
One 9
is to go over and select another channel as an input to 10 the control system.
So he doesn't even have his first 11 action but probably not be able to take the level of i
12 control into manual but rather to change channels.
13 We certainly believe that the event that we are trying i
t 14 to protect against here is, we question whether it really 15 requires protection.
I believe that is really our point 16 is that, is a protection grade system required to protect 17 against steam generator overfills.
18 Since the unit when operating is operating at 19 essentially full power, our analyuis indicates that we 20 have got 10 minutes for operator action.
i 21 MR. THOMPSON:
Have you looked at something -- I 1
22 understand that a more critical period of operator action 4
23 or a more timely period is probably at some power less, i
24 power level less than 100 percent.
More like the 25, 30, i
l 25 40 percent level.
Have you looked at the time available
)
i l
L I
l i
i i
23079.0 27 REE 1
for operator action in that time frame?
2 MR. CAREY:
In that time frame there would be 3
much less time for the operator to act.
But at that point 4
in time the operators, when you are going through a 5
transient, the operators are sensitive to the fact that 6
the steam generator levels can possibly get out of hand.
7 The last thing I need is another steam generator level 8
trip.
It is about 50 percent.
9 MR. THOMPSON:
As I remember, most people 10 usually have an operator right at the feedwater panel at 11 that period of time simply because history will tell us 12 that you are able to chock up a rather good -- not you 13 personally but other utilities.
I am sure you have only 14 had one or two of those low trips.
15 How many hours a year would you expect to see your 16 plant operate at this lower power level?
I guess we are 17 really talking about the 20 to 40 percent range.
You 18 normally, how many hours a year would you expect to 19 operate?
20 MR. CAREY:
During a period of time between when o
21 you put the plant on and when you put it on after refueling, 22 we take two to three days to get up to 100 percent power, 23 mainly to follow the Westinghouse fuel division's recommendation with respect to ramp rates have power after 24
(
25 an extended outage.-
23079.0 28 REE 1
At other times we are operating at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or less.
2 Assuming that less than one week a year, we figure less 3
than 2 percent.of the time we would be operating in that 4
at these intermediate power levels.
5 MR. THOMPSON:
Do you normally station 6
additional RO during these evolutions, during the startup?
7 Do you augment your crew?
+
8 MR. CAREY:
Yes.
9 MR. THOMPSON:
With an additional RO?
10 MR. CAREY:
Yes.
11 MR. THOMPSON:
Somebody that stays by the 12 feedwater panel?
13 MR. CAREY:
That is right.
And even then we 14 still have trips, particularly at the very low power.
You 15 are in manual.
16 MR. THOMPSON:
If you can finally get the sucker 17 to auto -- forget the " sucker" on that --
18 (Laughter.)
19 MR. CAREY:
We feel we are home free if we can 20 get it into auto.
9 21 MR. HOUSTON:
Do I understand then that the 22 siaple answer to the question raised earlier as to whether 23 Duquesne Light regards this system as a protection system 24 in the sense of 50.55 a(h), the answer to that question is 25 "no"?
23079.0 29 REE 1
MR. CAREY:
The answer to that question, we 2
don't believe that for high steam generator. level that a 3
protection grade system is necessary.
As far as we are 4
concerned, our steam generator level instrumentation 5
system is a safety grade system.
i 6
MR. HOUSTON:
55a(h) does not apply.
f 7
MR. CAREY:
Not to this particular steam 8
generator overfill.
9 MR. HOUSTON:
In what you read --
10 MR. THOMPSON:
Just tell me, is that --
11 MR. HOUSTON:
It seems to me that is very 12 germane to the issue, as to whether it is or is not part 13 of the protection system.
That is the source of the
(
14 authority.
15 The second question, you have made periodic frequent 16 reference to a staff requirement of " addition," the l
17 addition after fourth steam generator level channel.
Has i
j 18 the staff ever proposed to Duquesne Light a requirement i
19 that was articulated in that fashion?
i 20 MR. FEDIN:
I believe that was mentioned in 0
j 21 their January 10 letter that came back to us.
22 MR. HOUSTON:
It was mentioned that it was an 23 alternative that you had to resolve the issue.
Was it 24 stated as a staff requirement in writing?
25 MR. CAREY:
As I see the alternative, one is to i
d 5
23079.0 30 REE 1
provide a totally separate channel for control --
2 MR. BERNERO:
This question is directed toward, 3
did the staff try to give you one and only one solution to 4
the issue?
5 MR. FEDIN:
It said it can be met by addition 6
after fourth steam generator --
7 MR. HOUSTON:
That is r.ot a phraseology that one 8
would use to make a staff requirement.
That is my point.
9 MR. FEDIN:
They did not ascertain that that was 10 the only way to meet it.
11 MR. BERNERO:
I would hope not.
12 MR. THOMPSON:
As I say, certainly there are 13 various ways to meet different requirements.
That was one 14 which we had historically found acceptable.
15 MR. BERNERO:
I would like to recapitulate in my 16 own words what I think I heard your statement say, because 17 I think you made some very important points and Wayne just 18 flagged one of them.
19 First of all, in your argument, you made the argument t
20 that we are dealing with a backfit and not with an 21 implementation of the Standard Review Plan and, therefore, 22 cost / benefit analysis does prevail here.
Secondly and 23 very importantly, you said that 50.55 a(h) applies to 24 proper section systems and in this context, the steam 25 generator level system is a class lE system but not a
23079.0 31 REE 1
protection system and, therefore, the full requirements of 2
IEEE-279 do not apply.
That is the single failure aspect 3
in particular.
4 Then you went on and said that you have, as such, as 5
such systems go, a rather complete system and it takes a 6
highly improbable combination of events to defeat it and 7
even get us into the argument.
8 You then went on to say that operator action is 9
trustworthy, reliable and can be expected to be prompt 10 because they are trained for it, the operators are there 11 at that panel typically, even in the more sensitive times.
12 And then last, I take it as an argument over and above 13 all this, that if there is genuine concern about steam 14 generator overfill, there is a generic bin called A-47 for 15 dealing with that issue and, therefore, at worst, if we 16 are to press the issue at all, it should be pressed in 17 A-47.
The answer is coming next year and why not wait for 18 it?
It is premature to deal with the issue in an 19 individual licensing case.
20 Do I fairly track your arguments then?
21 MR. FEDIN:
That is correct.
22 MR. KURTZ:
Yes.
23 MR. THOMPSON:
I think I understand the issue.
24 I would like a five-minute recess while we are here to 25 talk to my operator' advisors.
Any agreement you guys
23079.0 32 REE 1
reach while I am out of the room, I will not be a party to.
2 (Recess.)
3 MR. THOMPSON:
I have had an opportunity to 4
consider the discussions here today and they appear to be 5
two major issues.
I seem to be able to address one fairly 6
straightforward 1y and hopefully it is one which we can 7
understand.
That is the hardware issue.
That is, I am 8
convinced that there is no undue risk to the public health 9
and safety for the interim period of time it will take to 10 resolve the A-47 issue and apply that to Beaver Valley 2 11 as it would be applied to Beaver Valley 1, with respect to 12 specifically identifying any hardware changes that might 13 be. needed with respect to the facility.
14 The documentation purposes for this interim issue is a 15 more complicated and more complex thing.
Whether or not 16 this particular system comes under 50.55 a(h), whether is 17 it is a backfit, not a backfit, how I document this, how 18 we document, you know, our staff's position is one that 19 there is some debate on.
There is a question of whether 20 or not this falls within the rules and regulations.
I r
21 forgot to bring all my lawyers.
The next time I will add 22 lawyers to these meetings so that we can -- I got one back 23 here.
24 (Laughter.)
25 MR. TOURTELLOTTE:
Don't you want to use me7
23079.0 33 REE 1
MR. THOMPSON:
No.
I am not sure how I would 2
classify you right now.
3 (Laughter.)
4 MR. THOMPSON:
For purposes of trying to 5
articulate how this particular issue is addressed with 6
respect to documentation, I can't answer that.
For 7
purposes of moving forward and resolving this issue, 8
technically, I am prepared to -- I guess we will obviously, 9
the next step may be an appeal of this issue above me to 10 Mr. Der. ton and if either party is unsatisfied with the 11 technical issue and with the procedural issue, I would 12 think it can be appealed on either grounds.
I think for 13 purposes of your proceeding with the construction, I am 14 satisfied right now that there will be no undue risk.
15 There is one other issue I should get on the table.
I' 16 would like to ask Jack -- you -- to specify to me what is 17 the operating history with Westinghouse steam generator 18 overfills?
19 MR. CAREY:
To the best of my knowledge, the 20 only steam generator overfills that have occurred have e
21 occurred as a result of steam generator tube ruptures and 22 th e --
23 MR. THOMPSON:
For Westinghouse plants?
24 MR. CAREY:
Yes.
C.
25 MR. THOMPSON:
I do believe, there have been
23079.0 34 REE 1
steam generator overfill occurrences in the once-through 2
type steam generators.
Maybe anyone else wants to 3
articulate for the record any knowledge whatsoever of a 4
steam generator overfill event from control system 5
failures associated with Westinghouse steam generators?
6 MR. BERNERO:
No.
7 MR. THOMPSON:
Okay.
Hopefully I will be able 8
now to document this particular issue as soon as Vic gets 9
me a lawyer that can write better than I can.
10 Any last minute comments, Bob?
11 MR. BERNERO:
Nc.
12 MR. THOMPSON:
Jack?
13 MR. CAREY:
No, I don't have any.
14 MR. THOMPSON:
Anyone here in the room want to 15 provide -- yes?
16 MR. DUNNING:
I was not really clear, you made 17 some suggestions that this issue could be appealed further.
18 Do I understand that the licensee's appeal to this issue 19 was turned down or accepted?
20 MR. THOMPSON:
It is, as I would, if I were in 21 their shoes, I think they won.
But as I understood it, it 22 is an issue which the staff may appeal this decision to 23 Denton and they may not be accurate in their r
24 characterization of this being a backfit or a not backfit 25 issue.
That is, the way they apply, the way 50.55 a(h)
23079.0 35 REE 1
applies, I think we are still needing to make sure we 2
understand how it applies becsuse obviously it is our 3
regulations that we have to apply.
I did not I did not 4
recognize that was going to be one of the major issues 5
that I was going to have to decide or I would have been 6
better prepared for that today.
7 I assume that, on the one hand you could care less how 8
I resolve that issue to a certain extent.
I mean, on the 9
other hand, if you had to install a fourth channel or had 10 to do some other system modification, you may be more 11 interested.
However, I will leave that up to you.
You 12 certainly may appeal that decision, if you are not 13 satisfied with it, to Harold Denton.
14 It kind of turns out to be a strange way to appeal a 15 legal interpretation in a backfit arena.
I don't know 16 precisely how you may want to appeal it, in some other 17 sense of the word.
18 Hopefully that will resolve this issue at least as it 19 is resolved as far as the dotting of the I's and crossing 20 o f th e T ' s.
21 Any last minutes words?
If not, thank you very much.
22 (Whereupon, at 11:40 a.m.,
the meeting was 23 adjourned.)
24
{
25
4 CERTIFICATE OF OFFICIAL REPORTER This is to certify that the attached proceedings before g
the UNITED STATES NUCLEAR REGULATORY COMMISSION in the matter of:
NAME OF PROCEEDING: BEAVER VALLEY - UNIT 2 BACKFIT APPEAL f
MEETING ON STEAM GENERATED WATER LEVEL CHANNEL INSTRUMENTATION ISSUE DOCKET NO.:
PLACE:
BETHESDA, MARYLAND s
DATE:
THURSDAY, MAY 9, 1985 were held as herein appears, and that this is the original transcript thereof for the file of the United States Nuclear Regulatory ComaLi3Sion.
(sigt)
CCM i
IT: rib) e REBECCA E.
EYSTER official Reporter ACE-FEDERAL REPORTERS, INC.
(_
Reporter's Affiliation
- )
-.n
_.....,.,__....-.n.._,
-...,.----,-----_,n.--