ML20151W184

Forwards Addl Info Re 14 Key Elements of plant-specific Design for Westinghouse ATWS Mitigating Actuation Circuitry Sys Per NRC & 880209 Telcon

ML20151W184
Person / Time
Site:	Farley
Issue date:	04/28/1988
From:	Mcdonald R ALABAMA POWER CO.
To:	NRC OFFICE OF ADMINISTRATION & RESOURCES MANAGEMENT (ARM)
References
NUDOCS 8805030320
Download: ML20151W184 (9)

Text

. .

Alabama Power Company

, 600 North 18th Street Post Offece Box 2641. '

Birmingham, Alabama 352914400 Telephone 205 250-1835 "4 Nee"l%,4een, Msumme the sourten ctctic system 10CrR50.62  !

April 28, 1988 Docket Nos. 50-no ,

50-364 t

U. S. Nuclear Regulatory Conaission ATIN: Document Control Desk

Washington, DC 20555 ,

^

i Gentlemen:

Joseph M. Farley Nuclear Plant - Units 1 and 2 i

Anticipated Trip Without scram (AWrs) on February 9, 1988 a telephone conversation was held between the NRC and Alabama Pcver Compar.y to discuss Alabama Power Conpany's December 9,1987 -

sutaittal. %is subnittal addressed the fourteen key elements of plant-specific design for the Westinghouse Ah3AC system as defined by the .

NRC in their letter dated Ftpteabor 23, 1986. We result of this j

conversation was a request by the NRC to provide more information on several areasofofthe each concern. Provided as an attachment to this letter is a recoonse to NRC's requests, i

If there are any further questions, please advise.

Respectfully submitted, ,

h).N* ke 4

PF'YBHN: dst-TS1-8.7 R. P. Mcdonald i

Attachment cct Mr. L. B. Long Dr. J. N. Grace Mr. E. A. Reeves _p 0*> g Mr. W. H. Bradford

(

i 8805030320 880428 '

PDR P ADCCK 05000348 1

PDR

ATTACHMENT l Provided belov are responses to questions raised by the NRC regsrding the Farley Nuclear Plant design for the inscollation of the Vestinghouse

, generic AMSAC system.

1. NRC Request Provide a description of the testing that was performed on the output relays that isolate the non-Class lE AMSAC circuits from the Class lE safety-related final actuation device circuits. Verify that this 4

testing bounds the plant-specific maximum credible faults that could occur in the Parley AMSAC circuits.

APCo Response Relays are provided at the output of AMSAC for isolating the non-Class 1E AMSAC circuits (relay coli) from the Class lE safety-related final actuation device circuits (relay contacts). These isolation relays are located in two separate vall mounted relay panels. The relays are Struthers-Dunn Type 219 plug-in, with four single-break double-thtov

' contacts, fnr 120VAC. Three Struthers-Dunn Type 219 relays have been +

subjected to a series of tests at the Vestingnouse Instrumentation Technology and Training Center.

The relays have been tested with a voltage of 590VAC applied to the i

relay coil in the transverse mode. The fault voltage applied to the relay coil and the induced voltage on the relay contacte vere measured and recorded. The fault current passed through the relay coils was in the range of 0.38 to 1.08A and was limited by the coil impedence itself. Based upon the performed tests Vestinghouse concludes that the i

subject relays clearly demonstrated their isolation capability by i limiting any propagation of the faulted condition from the non-lE coil to the lE contacts to a negligible value (maximum of 1.4 volts).  :

The Farley AMSAC is an energize-to-actuate system, and as such the output relays are energized (from the 120VAC power supply provided to 4

the AMSAC system) cn AMSAC actuation.

The configuration of the AMSAC power supply is as follows:

Power to the AMSAC system is provided from a dedicated i

uninterruptible power supply (UPS). A 108VAC normal supply and a '

110VAC alternate supply are provided from 600 V HCC's through 600/208 V step-down transformers. The normal power supply has a 48VDC battery back-up. The UPS Inverter output provides the l

normal 120VAC supply to the AMSAC system, through a line regulator.

4 l

! l 1

' Attachment Page 2 4

! The cables carrying the power supplies to the AMSAC UPS, the i cables betv an the UPS and the AMSAC logic cabinet, as well as the cables connecting the AMSAC output relay panels to the AMSAC logic cabinet are routed in cable trays containing cables with maximum  ;

voltage levels of 208VAC and 125VDC.

l From the configuration of the AMSAC power supply and the routing of the ,

associated cable it can be concluded that the maximum credible fault  !

the AMSAC output relays can be subjected to is 208VAC.

The tests performed by Vestinghouse, and the above analysis of the Farley AMSAC configuration demonstrate that the Struthers-Dunn Type 219 relays provide acceptable isolation devices for the Class lE portion of ,

the AMSAC System. i 1 Compliance with Appendix A of the ATVS SER dated September 23, 1986 is l provided herein and in Alabama Power Conpany letter dated February 27, 1987. This information is available at Farley Nuclear Plant for inspection by the NRC Staff. l i 2. NRC Request Provide a specific reference within the FSAR that describes the 4

^

separation criteria that was employed in the design for the installation of the AMSAC system. t 1 r i

APCo Response l 1 The AMSAC is a nonsafety-related system which provides a back-up to the Reactor Protection System (RPS) for initiating turbine trip and  ;

auxiliary feedvater.  !

The AMSAC system installed in each unit of Farley Nuclear Plant is independent and diverse from the existing RPS, with the exception of 1

the final actuation devices. The interfaces between the AMSAC outputs '

and the existing safety-related turbine trip and the auxiliary i

feedvater pump start circuits are achieved through qualified Class 1E '

isolation relays. This design ensures that the existing safety-related

systems, inclu6ing RPS, continue to meet all applicable safety '

criteria.

4 ,

2 Electrical independence, isolation, and physical separation have been l

provided in the design to assure and maintain independence between the ,

! nonsafety-related AMSAC system and the existing safety-related RPS. j The electrical independence and isolation of the AMSAC system from the  :

I RPS is achieved by the following means: l l  !

I i t

i i I

Attachment Page 3 t

i a) The input sensors for AMSAC are not part of the RPS. The AMSAC steam generator rater level inputs are derived from the existing non-Class IE narrov range steam generator level transmitters.

For the turbine first stage pressure inputs, two dedicated ,

transmitters have been added.

1 b) Power to the AMSAC logic and the new pressure transmitter loops is provided from a dedicated uninterruptible power supply (UPS) in each plant unit, independent of the power supplies for the RPS. The AMSAC-UPS has battery and diesel back-up. The station battery supplying power to the AMSAC is independent of those used for the RPS.

c) Qualified Class IE isolation relays are provided to isolate the non-Class lE ANSAC outputs from the Class 1E safety-related turbine trip and auxiliary feedvater pump start circuits.

< d) Qualified Class 1E circuit breakers are provided to isolate the non-Class lE AMSAC dedicated UPS from the Class 1E safety-related power distribution system.

l The physical separation of the AMSAC system from the RPS is achieved as follovs:

a) The locations of the ANSAC equipment have been selected to provide physical separation from the existing RPS hardware, to ensure that there is no interaction with the RPS cabirets. The AMSAC logic cabinet is located in the cable spreading room, and the train orientad A and B output relay panels, in the respective train A and B 4160V svitchgear rooms. ,

b) The output signal cables from the AMSAC logic cabinet to the train A output relay panel are routed separately from the output signal cables from the AMSAC logic cabinet to the train B output relay panel. These circuits are routed in accordance with FSAR paragraph 8.3.1.4.5. The cables connecting the isolated AMSAC actuation signals to the Class 1E safety-related systems vere routed in accordance vith FSAR paragraphs 8.3.1.4.3, 8.3.1.4.8 and 8.3.1.5. The Class lE portion of the AMSAC system complies with Regulatory Guide 1.75, as do the existing Class 1E safety-related systems.

i

" ' i Attachment Page 4  !

3. NRC Request Verify that Quality Assurance requirements specified in Generic Letter (

85-06 for the AMSAC system are being met.

l APCo Response 1

The purchase order's Quality Assurance (0A) requirements for the AMSAC system addresses each applicable area described in Appendix B of 10CFR Part 50. Control of special processes van ".ot required since AMSAC is I

not a pressure boundary system. Generic Letter 85-06 provides guidance for the QA requirements for the AMSAC system and is based upon 10CFR50 Appendix B. Therefore, in meeting the applicable requirements of 10CFR50 Appendix B, Alabama Power Company exceeds the OA requirements listed in Generic Letter 85-06. Flant GA practices for the AMSAC system, which is nonsafety-related, are similar to those for a safety-related system. Quarterly surveillance testing is performed on the system to ensure its continued reliability. The quarterly test is an internal system diagnostic which is performed in semi-automatic i mode. This test checks the internal calibration and functioning of the AMSAC test maintenance processor, actuation logic processors, input processing, processor logic, voter and output relays, and the deadman circuit (System Failure Monitor). This test utilizes internally generated calibration signals, and is performed with the system in "bypass". t

4. NRC Request Provide a description of the AMSAC system annunciators and alarms, and' describe when thase annunciators and alarms are actuated. Also state the location of the bypass svitch. ,

APCo Response In addition to the system status displayed locally on the AMSAC test  !

panel, AMSAC produces status outputs for remote indication and alarm.

The main control room indication including bypass indication vn3 reviewed against the control room design conventions. These remote indications and alarms are as follovs:

Main Control Board Annunciator Two vindows habe been assigned in each plant unit to alarm AMSAC status on the Main Control Board (MCB) Annunciator System.

a) Vindov G-61 "AMSAC TURB. TRIP AFV START" located on the First Out Panel G of the MCB Annunciator System. This annunciator vindow is initiated when AMSAC actuation is the initiating event.

l 1

.1

-  ; )i Attachment i Page 5 j I

b) Vindov E-35 "AMSAC SYS TRBL" located on Panel E of the MCB  :

. Annunciator System. This annunciator vindow is actuated when 4

the Ar. SAC General Varning output is initiated. The AMSAC

! abnormalities are. internally diagnosed and indicate that either ,

a test is in progress or that fault conditions exist. The ,

following is a list of conditions that vill generate an AMSAC General Varning output r 4

• loss of any system power supply including incoming AC supplies.

• the Mode Selector switch out of the Normal position the System Bypass switch (located on the logic cabinet in the cable spreading room) out of the Normal position '

• a partial trip an on-line diagnostic error

• any Actuation Logic Processor malfunctions i

• any Test / Maintenance Processor malfunctions

• any input common to the Actuation Logic Processors, i  :

determined to be inconsistent '

the cabinet temperature exceeding a high temperature '

-l setpoint

.i In addition to the AMSAC General Varning, the annunciator vinC3v ,

E 35 is actuated on AMSAC-UPS trouble.- The following is a list '

of conditions that vill generate an AMSAC-UPS trouble signal ground leakage l

• battery lov voltage 1

• inverter failure

• AC input and/or charger failure i

]

i '

auto bypass not ready Main Control Board Bypass and Permissive Status Indication AMSAC has cae vindov (vindov 2.7 "LOV TURB IMPULSE PRESS AMSAC TRIP i

, BLOCKED") in the Bypass and Permissive Light Box (BPLB) located on the MCB - area A3. This vindow is actuated (ON) when turbine load drops below the predetermined setpoint, which disables AMSAC actuation.

Plant Computer l AMSAC produces outputs to indicate in the plant computer. The computer j of each plant uni

• receives status on each steam generator level

]

channel (3 inputs), both turbine load channels (2 inputs), AMSAC i actuation (1 input) and AMSAC General Varning (1 input) to indicate any j abnormal conditions.

1

o l

l

- At tachtuent )

Page 6 l

1 l

5. NRC Request  !

Verify that the Parley-specific C-20 permissive time delay of 260 seconds is consistent with VCAP-10858, Rev. 1.

AFCo Response Vestinghouse has performed an analysis for Alabama Power Company to  ;

determine the proper value for the C-20 permissive signal time delay.

Vestinghouse determined that a 260 seconds time delay on de-e.nergizing the AMSAC systta vill ensure that the AMSAC actuation logic can be satisfied for a sufficient period of time. The 260 seconds value differs from the 360 seconds value stated in VCAP-10858, Rev. 1; '

however, 360 seconds is a conservative generic value that falls within the range of 180-420 seconds shown in Figures 1-1, 1-2 and 1-3 of VCAP 10858. The Parley-specific value of 260 seconds is within this range and has been reviewed and determined to be conservative

6. NRC Request i

State whether the AMSAC system is tested from end-to-end each refueling i

outage.

APCo Response The AMSAC system has been functionally tested from the turbine impulse pressure and steam generator level transmitters to the output relays that initiate the turbine trip and auxiliary feedvater pump start. 1 This test was accomplished by a combination of three separate testing procedures: j

1) the individual transmitters were calibrated through the AMSAC cabinet to verify their outputs vere within an expected tolerance, 2) using simulated inputs the AMSAC logic vas verified to generate the proper actuation signal to the output relays, and 3) surveillance tests verified that the output relays properly initiate the mitigative actions. These tests vill be repeated at each refueling outage.

i l

7. NRC Request l I

State the frequency of surveillance testing of the AMSAC system. I

APCo Response i

' i l

The AMSAC system is functionally tested using simulated inputs once per '

quarter. A description of this test is provided in response to NRC Question No. 3  !

i

Attachment Page 7 J

8. NRC Request Provide details on the completion of mitigative actions. Describe how the actuation circuits are sealed in once an AHSAC system signal is received.

APCo Response AMSAC mitigative actions, once actuated, go to completion. Completion of the AMSAC mitigative actions is accomplished at the actuated component level, through the existing circuits, as described below:

Turbine Trip The AMSAC turbine trip signal is latched in at the turbine electro-hydraulic control systnm. Deliberate operator action is then necessary to clear the tt:bine trip signal using the main control board turbine trip reset switch.

Motor Drisen Auxiliary Feedvater Pump and Associated Valves AMSAC actustion provides closing signals to the 4KV motor breakers -

associated with the auxiliary feedvater pumps. The 4KV breaker once closed remains latched in this position regardless of the status of the signal which initiated the closing. Deliberate operator action is required to terminate the operation of any motor driven auxiliary feedvater pump, by tripping its associated 4KV breaker, using the main control board breaker control svitches.

The elementary diagram of the auxiliary feedvater pump motor breaker shows that any breaker closing signal (nergizes relays 95 and SGBX and that these relays remain energized (sealad-in through a contact of SGBX  !

in series with a breaker contact) for as long as the breaker remains closed, regardless of the status of the signal which initiated the closure of the breaker.

Relays 95 and SGBX initiate the opening of the motor driven auxiliary feedvater discharge valves and the isolation of the steam generator blovdown and sample lines. Completion of these actions is accomplished

through relays 95 and SGBX vhich, once energized, remain energized regardless of the status of the AMSAC actuation signal. Deliberate operator action is required to change the position of the subject valves.

4 1

4 1

J

v Attachment Page 8 f

P Turb'ne Driven Auxiliary Feedvater Pu,mp and Associated Valves AMSAC actuation provides opening signals to the turbine driven auxiliary feedvater pump steam admission and discharge valves. The

steam admission valves HV 3235A and HV 3235B are "energize to open",

while HV 3236 is "de-energize to open". Once the openirig signals are initiated, HV3235A AND HV3235B energize and open, and remain energized through the valve limit switch contact and a contact of the control switch, regardless of the status of the signal whicn ini iated tne opening of these valves. Once the opening signal is ini isted the existing seal-in of HV3226 breaks, HV3226 de-energizes and opens, and remains de-energized (due to the valve limit switch conta tt and the seal-in circuit which opens when the valve opens), r gardless of the status of the signal which initiated the opening of tnis 'alve.  ;

Deliberate operator action is r(quired to terminate the operation of i

the turbine driven auxiliary feedvater pump, by closing the steam 3

admission val"ts.

Turbine driven auxiliary feedvater pump discharge valves open once the j opening signal is initiated. Completion of this action is accomp?.ished by an electrically reaet lock-out relay which seals-in the initiating signal at the component level. As a result, these discharge val /es

remain open regardless of the status of the AMSAC initiating signal, and deliberate operator action is required to reset the lock-out relay and change the position of these valves.

i i

I I

i i

)

I BHVidst-DTSI-8.8 j j

4 I

.-. ,