ML20151Y760
| ML20151Y760 | |
| Person / Time | |
|---|---|
| Site: | Davis Besse  |
| Issue date: | 04/27/1988 |
| From: | Shelton D TOLEDO EDISON CO. |
| To: | NRC OFFICE OF ADMINISTRATION & RESOURCES MANAGEMENT (ARM) |
| References | |
| 1505, NUDOCS 8805050101 | |
| Download: ML20151Y760 (7) | |
Text
o TOLEDO
%m EDISON A Ceriteru Er*17 Wr DONALD C. SHELTON Vice Pni>1erotarker Docket No. 50-346
!CH"8PX" License No. NPF-3 Serial No. 1505 April 27, 1988 United States Nuclear Regulatory Commission Document Control Desk Washington, D. C.
20555
Subject:
Change to the Final Safety Analysis Report Response Regarding Single Failure Considerations for Decay Heat Removal Syctem Valves Gentlemen:
This letter provides documentation of a telephene conversation between Toledo Edison (TED) and NRC (A. W. DeAgazio, NRC Project Manager for Davis-Besse Nuclear Power Station (DBNPS), Unit No. I and P. Chopra, NRC Staff) on March 24, 1988, concerning the captioned subject.
Per that conversation, this letter also provides the information suggested to be submitted to inform the NRC of a change to a response provided by TED in the Final Safety Analysis Report (FSAR).
During licensing of DBNPS, it was requested that TED address AEC Position 7.1.1 (10/04/74). This position and the associated TED response as contained in the DBNPS FSAR are provided as attachments.
Valves HV-DH14A and HV-DH14B are Decay Heat Removal (DHR) cooler outlet valves and, as such, are in the Low Pressure Injection (LPI) flowpath.
They are air dianhragm, solenoid-valve-controlled, fail open valves which are being replaced during the Fifth Refueling Outage to facilitate ease of maintenance. Each new valve / actuator will consist of one stem-mounted switch for position indication and one solenoid coil monitor, exactly as provided on each of the currently installed valves. A redundant stem-mounted position switch which is also present on the existing valves will not be installed on the new valves.
The present configuration for HV-DH14A and HV-DH14B is as follows:
- 1) One sten-mounted position switch provides position indication on a I 0\\
control room panel by a red (open) indicating light.
-(0 i
8805050101 880427 I\\
PDR ADOCK 05000346 P
PDR THE TOLEDO EOtSON COMPANY EDISON PLAZA 300 MADtsra AVENUE TOLEDO, OH!O 43652
T Dockot No. 50-346 License No. NPF-3 Serial No. 1505 Page 2 2.
One stem-mounted position switch provides a computer alarm when the valve is not fully open.
3.
The valve cannot be remotely closed without energizing the solenoid coil. The power to the solenoid coil for the air control valve is monitored and a computer alarm occurs when the coil is energized.
j The new valves will incorporate characteristics 1 and 3 as described above. However, characteristic 2 vill not be provided. Rather, the new valves' manual actuator hand wheels will be locally locked open by chain and padlock, and administrative controls will be established to control unlocking of the manual actuators. The fact that the valves' handwheels will be locked provides protection against inadvertent local closure, thus 4
alleviating the need for a redundant stem-mounted position switch.
E The new valves cannot be remotely closed without energizing the solenoid coil in the air control valve. Therefore, since power to the coil is monitored, an equivalent provision for redundant indication is provided by a computer alarm if the open' position is compromised. This provides redundancy to the sten-mounted position switch as recommended by the cited q
AEC Position.
A 10CFR50.59 safety evaluation for this modification has been perfortned j
with a conclusion that no unreviewed safety question exists. The fact that the new valves will be locally locked open and provided with both a i
stem-mounted position mo,itor and a solenoid power monitor meets the intent of AEC Position 7.1.1 cited above.
It should be noted that NRC l
1 Branch Technical Position ICSB 18 (BTP 18) was developed after the DBNPS l
2 license was granted and appears to incorporate the provisions of the AEC Position. Although DBNPS is not required to comply with BTP 18, the 1
change also meets the intent of the BTP. The description of this position F
monitor arrangement will be reflected in Revision 8 to the Updated Safety Analysis Report.
i i
If you have any questions, please contact R. W. Schrauder, Nuclear Licensing Manager at (419) 249-2366.
Very
- yours, 1
M MC:bam Attachment l
cc: A. B. Davis, Regional Administrator DB-1 Resident Inspector A. W. DeAgazio, NRC/NRR DB-1 Project Manager 5
i I
i
- Dockst No. 50-346 License No. NPF-3 Serial No. 1505 i
Attachment D-B 7.1.1(10/4/74)
The staff has recently identified a concern with regard to the application of the single failure criterion to manually-controlled electrically-operated valves.
It has been con-cluded that where a single failure in an electric system can result in loss of capability to perform a safety function, the effect on public safety must be evaluated. This is necessary regardless of whether the loss of safety function is caused by an active component failing to perform a requisite mechanical motion, or by a passive component performing an undesirable mechanical motion.- The following staff position presents an acceptable means for meeting the single failure criterion with regard to this type of single failure.
1.
Single failures of both active and passive components in the electric systems of valves and other fluid system components should be considered in designing against single failure, even though the fluid system
{
component may not be called upon to function in a given safety system operational sequence.
2.
Where it is determined that failure of a single active or passive component in an electric system can cause
]
mechanical motion of a passive component in a fluid system and this motion results in loss of capability to perform the system safety function, it is acceptable, in lieu of design changes that also may be acceptable, to disconnect power to the electric systems of the component. The plant technical specifications should include a list of all electrically-operated passive valves, and the required postions of these valves, to 10 which the requirement for removal of electric power is applied in order to satisfy the single failure criterion.
I 3.
Electrically-operated valves which are classified as i
active valves, but which are manually-controlled should be operated from the main control room.
Such valves may 1
not be included among those valves from which power is i
removed in order to meet the single failure criterion i
i unless:
(a) electric power can be restored to the i
valvos from the main control room, (b) valve operation is not necessary for at least 10 minutes following indication of a plant conditioa requiring such operation, (c) it is demonstrated that there is reasonable assurance that all necessary operator actions will be performed within the time shown to be adequate by the analysis.
The plant technical specifications should includo a list of the required positions on manually-controlled, clectrically-operated valves and should identify those valves to which the requirement for removal of electric power is applied in order to satisfy the single failure criterion.
Revision 10 December 1974 1
P7.1.1-1
.-.--j
Docket No. 50-346 License No. NPF-3 Serial No. 1505 Attachment D-B 4.
When the single failure criterion is satisfied by removal of electric power from passive valves or from active valves meeting the requirements of (3) above, the associated valves should have redundant position indication in the main control room and the position indication system should itself meet the single failure criterion.
5.
The phrase "electrically-operated valves" includes both valves operated directly by an electric device (e.g.,
a motor operated valve and a solenoid-operated valve) and those valves operated indirectly by an electric device (e.g., air operated valves whose air supply is controlled by an electric solenoid valve).
Therefore, please provide:
An evnluation of all safety-related fluid systems to a.
identify all valves whose fai.1.ure can result in the loss of capability to perform a system safety function.
b.
A description of the means provided to meet the single 10 failure criterion in a safety-related fluid systems where it is identified that a single failure will result in the loss of capability to perform the system safety
)
- function, If the single failure critorion is satisfied by meeting c,
the requirements of 3 above, your response addressing Item 3(c) should include:
(1)
The procedural instructions given the operators for performing the required actions.
(2) The identification of the equipment provided for monitoring the system status and to facilitate operator action.
(3)
The definition of plant conditions for which opera-tor action is required.
RESPONSE
All Jafety-related fluid systems were Ovaluated With regard to the appli-c.
cation of the sirgle failure criterion and with regard to manually controlled electrically-operated valves.
The following safety-related fluid systems are identified as falling into this category:
1.
Auxiliary feedvater system (HV599 & HV608) 22 2.
Hydrogen purge system (HV5037 & HV5038)
Revision 22 October 1976 P7.1.1-2
Docket No. 50-346 Licente No. NPF-3 Serial No. 1505 D-B Attachment t
3.
Core ficoding system (EV-CF1A & HV-CFIB) 4.
Decay heat removal system (HV-DH1A & HV-DH1B) 22 5.
Decsy heat rcmoval system (RV-DR14A & HV-DH14B) 6.
Decay heat removal system (EV-DH11 & HV-DH12) 24 b.
A description of the means provided to meet single failure criterion as a result of the above analysis:
1.
The valves HV599 and HV608 are normally open.
The type of failure is a spurious closure of the valve.
To meet the single failure criterion, two (2) independent starters with two independent manual control switches for each valve will be
{
provided to avoid any common event to close the above valves except for operator actica which is required to push the two associated control switches to close or open the valve.
The valve position is monitored by redundant and diverse position switches which provide (1) an essential indication on the main control board and (2) a separate input to the plant computer, which is alarmed in thu control room when the valve is not open.
j 2.
The valves HV5037 and EV5038 are normally closed.
Both valves receive SA signals te ensure their closure for containment isolation.
Containment isolation may be met accommodating a single failure.
However, : Sould long-term post-LOCA hydrogen purging be required (a minimum of 24 days post-LOCA), a j
single failure could result.
It is for this reason that both i
22 isolation valves are located external to the containment vessel.
Should a single failure occur, the operator can manually open the valve which failed.
1 3.
The valves HV-CFLA and HV-CF1B are normally open.
The type of failure is a spurious closure of the valve.
To meet the 4
single failure criterion, after the core flooding tank isolation valves are fully open and before the reactor coolant pressure reaches or exceeds 725 psig, the breakers of the combination line starters of each isolation valve will be tripped open and padlocked.
Essential indication is a
provided oa the main control board to indicate the breaker is l
tripped and the valve is opsn.
A diverse and redundant stem-mounted limit switch provides an input to the plant computer, which is alarmed in the control room, when RC pressure is above 750 psig and the valve is not fully open.
4.
The valves HV-DH1A and EV-DH1B are normally open.
The type t
of failure is a spurious closure of the valve.
To meet
{
the single failure criterion, control power has been removed from the contactors This is accomplished by means of an
^
isolation switch on the main control board.
Essential indication is provided on the main control board to indicate 1
3 Revision 24 December 1976 P7.1.1-3 l
Dock:t No. 50-346
- Liccn:3 No. NPF-3
- B S rial No. 1505 Attachment
,y the isolation switch is in the "CONTROL POWER OFF" position
[
and the valve is open. A diverse and redundant stem-mounted
\\
limit switch provides an input to the plant computer, which is alarmed in the control room, when the valve is ot open or the isolation switch is not in the "CONTROL POWER OFF" j
position or the disconnect switch is in the local position l
and bypasses the isolation switch.
1 5.
The valves HV-DH14A and HV-D1114B are normally open.
The type of failure is the spurious closure of the valve. To meet 22 the single failure criterion by administrative procedure, both the hand / auto control station (analog control) and the open/ auto control switch (digital control) are ke pt in the OPEN position. An alarm relay is provided to monitor the solenoid coil and input to the plant computer, which is alarmed in the control room if the solenoid is energized.
Essential position indication is provided on the main control board. A diverse and redundant limit switch has been added on the valve stem to provide an input to the plant computer, which is alarmed in the control room when the valve is not open.
6.
The valves HV-DH11 and HV-DH12 are closed during power operation, but must be opened to initiate decay heat removal.
The type of failure is a spurious closure of the valve during decay heat removal. To meet the single failure criterion, after the valves 24 are fully open and before the decay heat removable pumps are 26 (/
started. the breakers of the combination line starters of each valve will be tripped open and padlocked (see Section 7.6.1.1.2 27 for further details). Essential indication is provided on the main control board to indicate the valve is open.
c.
1.
The valves HV599 and HV608 can have power restored by the operator from the main control room by properly aligning the l
,/
control switches of both starters to the same position.
The l
plant condition which requires operation of the valve is a 22 steam line or feedwater line rupture. A signal from the l
SFRCS will assure proper alignment of the two starters to I
return power to the valves.
If the automatic signal to close l
the valve to the affected steam generator fails, no operator l
action is required since the appropriate auxiliary feedvater j
alignment valves will also remain closed.
{
\\
2.
The valves HV5037 and HV5038 do not have control power l
removed.
For a discussion of conditions requiring l
operator action,see the discussion under item b, above.
I 23 f
3.
The valves HV-CFlA and HV-CF1B have no system safety function that requires them to be closed except as described in subsection 6.3.2.15 and summarized here.
Power will be removed from the valves after depressurizing the reactor coolant system below 300 psig and prior to initiating decay heat removal if the core flood tanks are Revision 27
'7.1.1-4 August 1977
Dock t No. 50-346 Lic:na No. NPF-3 Ssriel No. 1505 D-B Attachment pressurized. With power removed, the possibility of the valves opening and causing either the pressure-temperature
.'imits of the RC system or the design pressure limits of ths DHR system to be exceeded, is precluded.
23 4.
The valves HV-DH1A and HV-DH1B have no system safety function that requires automatic closing, although they are containment isolation valves which can be closed remote manually.
However, the operator can restore power to the valve from the main control board by use of the isolation switch.
5.
The valves HV-DH14A and HV-DH14B may have control power restored from the main control board (for throttling in the post-LOCA long term cooling mode of operation) when the operator pushes the AUTO button on the valve control switch if the normal air supply is available.
If it is not available, the valve can be throttled manually by use of a seirnically qualified air supply provided locally in 23 a low-radiation area for utilization of a portable air bottle. A local essential flow indication is available to the local operator.
6.
Valves HV-DHil and HV-DH12 are operable from the control room; removal and restoration of electric power is accom-plished from the breaker et the motor control center for each valve.
Should the valve inadvertantly close after being opened but prior to the operator removing power from the breaker, decay heat can continue to be removed by the 24 auxiliary feedvater system via the steam generators. The decay heat pumps will be started af ter the valves are opened and power is removed to preclude damage to the pumps (see 27 Section 7.6.1.1.2 for further details).
Should the valve be open when the operator intended for it to be closed upon unit startup, this could not lead to an unsafe condition since the only consequence would be that the unit could not be pressurized.
If, after power has been returned to DH-ll and DH-12, only one valve closes,
{
an interlock is provided to trip off the pressurizer 27 heaters as described in FSAR Section 7.6.1.1.2 which prevents the unit from being pressurized.
.s Revision 27 August 1977 P7.1.1-5