ML20202B930

SER Supporting Generic Westinghouse Mod for Reactor Trip Sys Automatic Actuation Using Shunt Coil Trip Attachments W/ Listed exceptions.Plant-specific Design Info Required for Westinghouse Plants Incorporating Shunt Trip Mod Encl

ML20202B930
Person / Time
Site:	Comanche Peak
Issue date:	08/10/1983
From:	NRC
To:
Shared Package
ML20202B815	List: ML20202B810 ML20202B930
References
NUDOCS 8604110305
Download: ML20202B930 (22)

Text

- . _ . . .. _ - _ _ _

N

• Ef; CLOSURE SAFETY EVALUATION REPORT GENERIC WESTINGHOUSE MODIFICATION FOR REACTOR TRIP SYSTEM AUTOMATIC ACTUATION USING SHUNT COIL TRIP ATTACHMENTS .

- I N T R O D U C T I O N 'A M.D SUMMkRY'.* .. .- . . ,... .. . . . . . , ,

The Westinghouse Reactor Trip System (RTS) consists of plant process instrumentation (sensors, transmitters, bistables, and _

field contacts) that provides inputs to two redundant trains of Logic circuitry (train "A" a'nd train "B"). The output of each Logic train normalLy provides power to the undervoltage (UV) coil trip attachment of its associated reactor trip breaker.

When a condition requiring a reactor t rip is sensed by a given train of logic, power is aut oma ti c a l Ly removed from its associ-ated UV coil, allowing a spring-actuated mechanical linkage to trip open the reactor trip breaker. This tripping action inter-rupts power to the control rod drive holding mechanisms, allow-ing alL rods to fall by gravity into the core, thus shutting down the nuclear fission process. The undervoltage coils and their associated' Linkage (referred to as undervoltage trip attachments) are designed'to'*com' ply wlth the " fait safe" c ri-I teria of General Design Criterion (GDC) 23 (i .e., initiate a reactor trip on loss of powe r) . There are two reactor t ri p l

i breakers in series in the Westinghouse RTS design; one actuated by train "A"'and the other by train "B" such that either b er opening wilL cause a reactor trip. This two train /two breaker arrangement was designed to assure that a reactor trip would be 4

accomplished in the event of a single f ailure. Bypass breakers a

9604110305 860401 PDR ADOCK 05000445 '

A PDR

s -

2-I are provided in parallel with the reactor trip, breakers to atlow on-line testing of the t ri p breakers wi t h out shutting down

'1 , .the reactor. A ,s i mp l j f i ed .d.i ag r a m o,f. t h,e We s t i n.g h,o,u,s e . R T,$ j s ( ,

shown in Figure 1.

On February 22, and again on February 25, 1983 at the Salem nuclear power plant, Unit.1,.both reactor trip breakers simul-taneously failed to open in response to automatic reactor t rip signals generated by the RTS. In each case, the reactor was tripped manually from the control room. Investigation into the cause of these failures revealed that the undervoltage trip attachments (UVTAs) f ailed to operate property when their UV coils were de-energized by the RTS. Investigations into other reactor trip breaker failures at operating PWRs revealed that the majority of those failures could also be attributed to malfunctioning of the UVTAs. It was determined that the UVTAs did not provide,a high degree of reliability commensurate with the safety function of the RTS. -

A nar,ual reactor trip via switches on the main control board at Westinghouse plants not only de-energizes the UVTA but simul-taneously actuates a diverse shunt trip attachment (STA) by energizing a shunt t,ria coil (see Figure 1) . When energized, the shunt trip coil wilL trip open i.ts associated breaker i

through a mechanical linkage which is somewhat simpler in

. Jesign (and thus having fewer potential failure points) than

- ~

. S' . ,1

.-- , - , - -w, , - - _ - - , - , - - - - y.y, r -. , r.- ,, .-- . , . - . . - , _ - _ . -

1

s. .

the linkage associated with the UVTA. The STA exerts a larger force on the breaker trip bar than the,UVTA. It was the STAS that functioned to successfulLy open the reactor trip breakers during the Salem ATWS events.

In Generic Letter 83-28 dated July 8, 1983, the staff has required that the reliability of the RTS (specificalLy, the reactor trip breaker actuation devices and circuitry) be en-hanced by a design change to use the STAS (as weLL as the UVTAs) to open the reactor trip breakers automatically. The staff considers the added automatic actuation of the reactor trip breaker shunt coil trip attachment to be a safety related function. Therefore, the ci rcuit ry used to implement this function must be Class 1E.

By Letter dated June 14, 1983 the Westinghouse Owners Group (WOG) provided the generic design details for this modifica-tion. A simplified diagram of the Westinghouse RTS i nc ludi ng autcmatic actuation of the STA is shown in Fi gure 2. The added

• circuitry consists of an electromechanical relay and two push-button switches (used for testing) in each RTS t rain. The relay for each train is connected in paratlet with the UV coil for that train, and like the UV coil, is normally energized.

i

. Thus, when a condition requi ring a reactor trip.is sensed by a RTS Logic train, power wilL be automatically removed from both its UV coil and the parallel relay. When the relay is l

[ _ _ _ _ - _ - - _ _ _ _ . _ _ _ _ _ _ _ -. _ . __ _ _ - - - - . . - - - -

6 I

i -

4-

~

de-energized, its associated contacts wilL cLose to ener- .

gi.ze the di v e r s,e shunt t',r i p c o j. L o f, .t h a.t traing . ,T h,u s , .b o t,h , '. ,

the UVTA and the STA wilL operate to trip open their associated reactor t rip breakers on an automatic reactor t rip signal.

Since the RTS designs for.Wo.stinghouse plants vary from plant to plant, the automatic shunt trip modification wilL be re-viewed on a plant specific basis. Specific design information required for each plant incorporating this modification is identified below. Based on our review of the WOG generic design, the, staff has concluded that this design is acceptable conceptually; however, there are unresolved issues concerning:

(1) seismic qualification of the STA and associated circuitry, (2) the capability to test the control room switch contacts and wi ring of the manual reactor t rip circuits, and (3) poten-tial interactions between the safety related shunt trip ci rcui-try and non-safety related ci.rcuits. *These issues and the actions planned to resolve them are discussed below.

SAFETY EVALUATION i,

' Power Supply The automatic shunt trip modification provides a diverse trip

! feature (energize to actuate vs the de-energi ze to actuate UVT A) for reactor trip in response to an automatic trip signal from

. .the RTS. Since the shunt trip attachment (STA) requi res power l .

C- * . .F ..  ;-  ;:

, n.

)

l 4

. l (125 vc:) to operate, it wilL not be fail safe ( i.e., wi L L not j result in protective , action on loss of its 125 Vdc supply). .

. This power, however, wilL be supplied by a Class 1E source.

The RTS wilL retain the UVTAs to comply with the fail safe re-

~

qui re=ent of GDC.23.

Each Westinghouse Licensee should verify that the 125 Vdc power s

supplies for the STAS at their f acilities are Class 1E, and describe the loss of power indication provided in the cont rol room. In addition, each licensee should verify that the added

, relays are within the capacity of thei r associated powe r sup-i plies and that the relay output contacts are adequately sized to ac:omplish the shunt trip function. An overvoltage condition could potentialLy damage both the UV coil and the paratlel shunt 4

trip actuation relay in one train. Therefore, each Licensee shouti describe the overvoltage protection and/or alarms pro-f vided to prevent or alert th,e operato,r(s) to an overvoltage I condition.

i Single Failure i

i The staff reviewed the generic design to determine if single f ailures or undetectable f ailures .could prevent protective 4

action at the system level. A postulated failure of the added

relay or its output contacts would prevent its associated STA i

i from responding to an automatic reactor trip signal. This type i

.j

- - . .. . .-- -.- . _ = - - .-.

. s -

of failure would not affect the corresponding UVTA or operation

- cf the r e d u n d a n t t r a i n, '.a'nd woul d b e det e ct ed-dur.ing t he pe ri -

odic on-line RTS surveillance tests. If the " test auto shunt t rip" pushbutton switch should fail open, a reactor trip would be initiated via the STA. Thus, this failure mode results.in the protective action. T'his switch is spring loaded to return to the closed position. If the switch should f ai t closed (i . e . ,

contacts shorted), the STA wilL not actuate during periodi c testing. However, this f ailure mode wilL not disable the auto-matic STA t rip function and wilL be detected during surveillance testing.

If the " block auto sh'unt trip" pushbutton switch should f ail i

open, the STA wilL not respond to an automatic reactor trip j signal. The UVTA must then be relied upon to open the reactor 4

t rip breaker in the train with the failed switch.' Although this failure mode defeats'thi added automatic shunt trip func-I tion, the periodic RTS surveillance test procedure proposed by the WOG has been developed such that this type of f ailure can j be detected. Steps nine and ten of the test procedure require i ,

independent verification of. STA operability by depressing the i

" test auto shunt trip" pushbutton and confirming operation of

] the breaker through the shunt trip device. If the " block auto i

shunt trip" pushbutton has f ailed open, the breaker wilL not j

-respond as desi red, thus indi cating the failure. Since testing i

p. ,

,. .C .- P ,

i I

I

. s. 3 of the STA folLows testing of the UVTA (The " block auto shunt

~

t ri p" switch,is used.ducing testing'of the UVTA; steps 2 thr'ough i

7), successful completion of the STA test' indicates that the

" block auto shunt trip" switch has returned to its closed posi-

~

tion. It is essential that this test switch be verified to be closed prior to leaving the test mode, and thus, that the test sequence proposed by the WOG b'e strictly followed.

l If the " block auto shunt" t ri p switch should fait closed, the UVTA cannot be tested independently f rom the STA since both wilL actuate in response to a trip signal. Steps 2 and 3 of the pro-posed test procedure, however, require that test personnal use i

this switch to block an automatic shunt trip, and then try to actuate the breaker using the " test auto shunt t rip" pushbutton.

1 j If the breaker opens under these conditions, this indicates that I the " block auto shunt trip" switch has failed closed. Thus this failure mode is also de.tectabLe during testing. ,

ia :S Licensee should verify that the test procedure proposed by the WOG wilL be used to independently verify UVTA and STA oper-a bi li t y at their plant (s).'If a different test procedure or i test sequence is used, it should be submitted for staff review l

1 including justification of any differences from the WoG generic procedure.

. . l l

l

, k *

• i

e .%*

i

^

Safety Cla s si fi ca t i on/Qua li fi c at i on Automatic actuation o.1 the STA is to be a safety related func-tion. Previously, the STA was considered to be non-safety re-Lated at Westinghouse f acilities. Therefore, each Licensee should verif y that the components and ci rcui t ry us ed t o imp'L e-ment the automatic shunt. trip modification wilL be Class 1E'and classified as safety related. In addition, each Licensee should verify that the procurement, i nst alLation, operation, testing, i and maintenance of the automatic shunt trip circuitry wilL be in accordance with the quality assurance criteria set forth in Appendix B to Part 50 of the Code of Federal Regulations, Title 10.

l The shunt trip attachments and the added shunt trip circuitry have not been sei smi calLy qualified. Tests have been performed to demonstrate that the existing STAS wilL not degrade the oper-ation of the breakers or,the UVTAs. ,

,The STAS and associated circuitry must be seismi calLy qualified (i .e., be demonst rat ed to be operable during and after a seismic event) in accordance with the provisions of Regulatory Guide 1.100, Revision 1 which

.  ; endorses IEEE Standard 344, "IEEE Recommended Practices for Seismic Qualification of Class 1E Equipment for Nuclear Power ,

i Generating Stations." In addition, it must be demonstrated that alL circuitry in physical proximity to or associated with the STAS (e.g., breaker closing circuits) wilL not degrade

operation of the STA during and after a seismic event. The WOG .

I C- *

,. f .  ;- '

. . _ . , , . ,._._,m -

! is currently developing a seismi c quali fication test program that would include bo.t.h.t,he DB-50 and DS-416 breakers, and

)

would be generic to alL Westinghouse plants. The WOG believes

that such a testing program may take several months. Instal-i Lation of the automatic shunt trip modification need not be delayed pending completio,n of the seismic qualification test-ing. Each Licensee should verify that these components are/wilL l be seismically qualified in accordar.ce with the provisions of 1

Regulatory Guide 1.100, Revision 1 which endorses IEEE Standard 344 1

The STAS and associated actuation circuitry are typically Lo-

, cated in mild environments (as opposed to harsh environments such as inside containment). They must be designed for the maximum expected values f or tempe rature, humidity, and radi-

{ ation expected,to occur. Each Licensee should verify that the STAS and a ssoci at ed actuati o.n, ci.rcuit ry at their f acilities, are designed f or this envi ronment.

J f Channel Independence / Integrity I

i The ci rcuit ry for the automatic shunt t ri p function must not l

. compromise channel integrity or the independence between redun-j dant > channels. Since the circuit modi fications are made to each individual train, and do not involve any interconnections i

\ - i .

f .

I 1

. .- s or di re ct interdependencies between redundant trains, the

~

physical s epa rat i on and .e,L e ct ri..t a'l 'i .-so lat i on p r. o,...

vi ..d e d i n. ..t h e'. .

existing RTS design wilL be maintained. It is feasible that l the modifications to each train can be accomplished totally j within the existing reactor t rip switchgear cabinets for th'at I

train. Each Licensee sho,uld verify that the physical separation and elect rical isolation between redundant trains of the RTS wilL not be compromised.

i 1

1 l Although the added circuitry for the automatic shunt trip func-tion should not compromise channe L/t rain independence, the

)

1 staff is concerned that existing circuitry used to actuate the STAS on a manual reactor trip signal from the control room may not be separated appropriately for the upgraded status (to 1

! safety related) of the STAS. Each Licensee should rev;ew the

} physical and e,Lectrical separation provided between the circuits used to manually actuate.the., STAS of the redundant reactor trip breakers. Where physical separation is not maintained between i these circuits, it must be demonstrited that no postulated 1

fault within these circuits can degrade both redundant trains.

The shunt trip circuits share common fuses with breaker closing circuits and auxiliary relays used for indication / annunciation purposes. The circuitry for these~ functions (breaker closing *l j' , ,and breaker status information) may not be safety reLated. The )

. \

staff is concerned that the wi ring for these nonsafety related

, . r . .>. v 1 l

- - - - - - - . _ . - - - - - - . . . . . - , , - ~ , . . - - . - - , . - - , - - - . - - - - - , -

e .

. .- s

- 11 -

(associated) circuits may not be adequat ely isolated and sepa-

~

._ . rated f rom t h e, s a f e t f "r e t at ed ,s, hunt. t rj p c i r c3 i t,s,,, , A .f,a u l t. I.

within the non-safety related ci rcuit s, resulting in a blown fuse, would prevent actuation of the STA in a given train by both automatic and manual means. This interaction between safety and non saf ety rekated circuits is unacceptable. Such designs should be modified so that postulated faults within the non-safety related circuits cannot degrade the safety re-Lated circuits. The potential interaction between saf ety and non-safety related circuits was not addressed in the WOG pro-posal. The automatic shunt t ri p modification must be implemented in accordance with the independence and separation requirements of IEEE Standard 279-1971. Further guidance is provided in Regulatory Guides 1.32, Revision 2 and 1.75, Revision 2 which endorse IEEE Standards 308 and 384, respectively. This item wi LL be reviewed on a plant specific basis.

~. ,

Testability Tne staff has reviewed the proposed WOG test procedure to inde-pendently verify the operability of the UVTAs and STAS during power operation. For $$PS* plants, the automatic shunt trip f unction is blocked (via the " block auto shunt trip" pushbutton switch described earlier) and a condition requiring a reactor-t rip is simulated by depressing the appropriate number of

. ." manual function input" switches on the $$PS semi-automatic

. t . .

L____ _- _ _,

- - . - - _ . _. _ = - --

. o

. .. m -

1 t

1 12 -

i test panel to satisfy the trip Logic for a given monitored.

1 , parameter (e.g., pressurizer.high'

, ., ptessure). Jhese, signals [, ,

l are simulated upstream of the RTS Logic such that the RTS cutput ci rcui t ry and the UVTA are fully tested. The Logic  ;

I -

l combinations for the remaining parameters are tested without I -

! repeatedly actuating the.UVTA. The RTS inst rument channels

! are tested separately. FolLowing the UVTA testing, the shunt trip device is verified to operate by using the " test auto -

shunt trip" pushbutton switch. For celay protection system 1

l plants, the automatic reactor trip is simulated by actuating switches at the RTS test panel which interrupt current flow

)

through the relay contact Ladder ( Logi c) network to the UV

. coil. The remainder of the test is identical to that for the ,

i SSPS plants.

I j The above test, procedure does not verify operability of the j

i control room manual reactor trip switch contact's and wi ring 1

l used in the manual initiation circuits. This testing should 1

l be performed prior to startup from each refueling outage. The j combination of this test and the previous WOG proposed test

is considered to be suf fiefent to assure the operability of i both the UVTA and the STA in response to both automatic and manual initiation signals. A test procedure to verif y that t *the manual trip switch contacts and associated wiring are i

. . operating properly is being developed by the WOG. This pro-

{

j eedure should not involve installing jumpers, lifting . Leads, 1

I c- -

. .c . -

b i

i.

I

, __ . , _ _ . . . , - , _ . - . - . ._-,_..__,.n,.~.,__._,._._y -__.r.-,.m__m. - - _.-.-_,,__,_-__._-,,.-__.,c__,.__ _ . _ . , . m,_ . , . . _, , . ,

. .. m 13 -

- or put Lin; fuses. Permanently installed test connections (e.g., to facilitate connection of a voltmeter) are acceptable.

It is not necessary to physicativ trip the breakers during ,

this test. The procedure mur'; demonstrate that the power to the UV coil (and the added shunt trip actuation relay) is interrupted. This i'dicates that the normalLy closed manual I

reactor t-ip switch contacts (in the circuits providing power to the UV coils) have functioned properly. In addition, the procecure cust independently verify operability of the normalLy open contacts (in the manual trip circuits providing power to the shunt coils). AlL manual trip switches must be tested.

t Indepencent testing of the manual trip switch contacts wilL be reviewed on a plant specific basis.

I Byoass Breakers The autoestic sh'unt trip modification wilL not be made to the

~. .

two bypass breakers used during testing of the reactor trip b e.t a k e r s . The RTS wilL remain susceptible to single failures during testing. The test duration, however, is considered to be short enough that the probability of failure in the automatic

reactor trip function is Low. The staf f wilL, however, require that the operability of each bypass breaker be* verified prior to it being placed into service. Each Licensee should verify that this testing of the bypass breakers is being performed.

4

'I f - ,

. - ~ _ = . - - - - - - . ._- -. ._ . .-

I i . .  %

i

Further, the WOG has indicated that it is not cost benefit i ._

i _, , effective to.make the sh,unt t.r,i 0 . m o,'d i f i, c a t,i o n),t,o , t h e b y p a s, s, (

! breakers and the staff agrees.

! Other Considerations i

The automatic shunt trip.aodifications do not interface with f plant control systems. The existing reactor t rip breaker i

j status information (i .e., position indi cation, computer inputs, j first out annunciation, etc.) is obtained directly from breaker

! position switches, not from the UVTA operation. Thus, this information is not affected by the automatic shunt trip modifi-i

! cation. The modification does not involve any setpoint changes, i

j or any additional bypasses (except for the " block auto shunt t ri p" function described earlier) over those currently used in i

j the Westinghouse RTS design.' Once protective action is initi-l ateo, it wilL go to completion through the opening of the reactor I t rip breaker. The RTS is manually reset by reclosing the breaker.

I i

i Technical Specifications j Each Licensee should propose Technical Specification changes to explicitly provide for periodic independent testing of the UVTAs l

and STAS during power operation and the control room manual

]

switch contacts during each refueling outage. These Technical

) Specification changes wilL be reviewed on a plant specific i . . basis. Each Licensee should verify that the periodic on-line i

'- 4 ,. .C ..  ;-  ?

_ _ . _ _ _ _ _ _ , _ _ . _ _ _ _ . . - . _ _ . _ _ - _ . , _ _ , , . ~ . . , , . _ _ _ . _ . _ ~

f  %

+ .

1 I test procedures require that proper breaker operation be con-f i rm e d b y o b s e r vi ng bo't $ "Lo c ' a'l- b r e a k e r i n di c a rFo n- 41 u c h a s - t h e -

breaker flag) and i ndi cat i on in the main control room (e.g.,

i i

1 control board status Lights and annunciation). It is not a,ccept-l -

able to veri f y STA operation by observing only the actuation

{ relay's armature movement', or by so,Lely relying on . Local indica-tion. Proper breaker status information in the control room must be veri fied. In addition, each Licensee should verify that j the response time of the automatic shunt trip function is tested periodically and shown to be consistent with that assumed for

! automatic reactor t rip in the FSAR analyses or that specified in plant techni cal specifications.

Plant Soecific Desions

! RTS designs vary somewhat from plant to plant. Exceptions are expected to th6 WOG design described herein, although it is 4

considered to be generic'to 'most' plan'ts. Each Licensee mus't l provide to the staff, along with the information identified throughout this Safety Evaluation, the electrical schematic /

elementary diagrams of the reactor trip and bypass breakers 3

showing the UV and shunt trip circuitry as we LL as the breaker control (closing) ciredits and circuits providing breaker status information to the control room.

1 ,

. . 1 1

D

~

!  ?

l CONCLUSION

-- - Based on our review.df th*e.WOG. conceptual. design,...we. conclude .

i that the design complies with the requi rements of IEEE Standard 279-1971 " Criteria for Protection Systems for Nuclear Power

~

I 1 Generating Stations," and therefore, is acceptab Le with the following exceptions:

1. The shunt t ri p coi l .att achment s and a s so ci at ed f

circuitry have not yet been seismi calLy qualified, i

2. The shunt coil trip attachments are not suf fi cient ly

{

electrically independent from non-safety related 1

l breaker closing circuitry and auxilary relays, and

3. A test procedure to verif y the operability of the I control room manual reactor trip switch contacts and I

! associated wiring has not been developed.

1 i

In addition tos t.he above, each Westinghouse plant' incorporating the' automatic shunt trip ' modi fication" wilL be reviewed by the staff to determine the acceptablility of any deviations from the WOG generic design. Proposed Technical Specification l changes wilL also be reviewed on a plant specific basis. The information necessary to perform the plant specific reviews is 1

Listed in the eatteevre to this evaluation.

~

. .,', j, , 2, i

i

. . l i *. [" 9 , .(. e ,4 ' ,

q e l

a .

-' JUL 2 81983 ATTACHMENT

-MCLG5vnt PLANT SPECIFIC DESIGN INFORMATION REQUIRED FOR WESTINGHOUSE PLANTS INCORPORATING THE AUTOMATIC SHUN.T TRIP MODIFICATION

1. Provide the e le ct ri cal schematic / elementary diagrams for j the reactor trip and bypass breakers showing the under-i voltage and shunt coil actuation ci rcuits as weLL as the

.i breaker control (e.g., closing) circuits, and circuits -

providing breaker status information/ alarms to the control room.

2. Identify the power sources for the shunt trip coils. Verify that they are Class 1E and that alL components providing

.l power to the shunt t rip ci rcui t ry are Class 1E and that any f aults within non-class 1E circuitry wilL not degrade the

shunt t ri p function. Describe the annunciation / indication 1

. provided in the control room upon loss of power to the

snunt t rip ci rcuits. Also describe the overvoltage pro-tection and/or alarms provided to prevent or alert the coerator(s) fo an overvoltage condition that could affect i l both the UV coil and the paralLet shunt trip actuation relay.

l 3. Verify that the relays added for the automatic shunt t ri p i

function are within the capacity of their associated power supplies and that the r,eLay contacts are adequately sized ,

to accomplish the shunt trip function. If the added relays are other than the Potter 8 Brumfield MOR series relays (P/N 2383A38 or P/N 955655) recommended by Westinghouse, i

provide a description nf the relays and thei r design speci-j . .

l fications.

i

~ 1.' - l

s

-B-

4. State whether the test procedure / sequence'used to indepen-dently verify operability of ,the undervoltage and shunt,

~~ ~

.~ .

~

trip devices i n r e s p o n s e t o' a n ' a u t 'o m a t'i c 'r e Ec'i*o'r t 'r'i p ' ~ '

signal is identical to the test procedure proposed by the Westinghouse Owners Group (WOG). Identify any differences between the WoG test procedure and the test procedure to be used and provide the rationale / justification for these differences.

5. Ve ri f y that the circuitry used to implement the automatic shunt trip function is Class 1E (safety related), and that the procurement, installation, operation, testing, and main-tenance of this circuitry wilL be in accordance with the quality assurance criteria set forth in Appendix 8 to 10 CFR Part 50.

6. Verify that the shunt trip attachments and associated circuitry are/wilL be seismically qualified 01.e., be demonstrated'to be operable during and af ter a seismic

. .~, ,

event) in accordance with the provisions of Regulatory Guide 1.100, ' Revision 1 which endorses IEEE Standard 344, and that alL non-safety related circuitry / components in physical proximity to or associated with the automatic shunt trip function wilL not degrade this function during or af ter a seismic event.

7. Verify that the components used to accomplish the automatic

, shunt trip function are designed for the environment where they are Located.

f- * ,. .f.' ., P D

+ e

. .m -

-C-

8. Describe the physical separation provided between the cir-cuits used to manually initiate the shunt trip attachments of the redundant reactor trip breakers. . If physical separa-tion is not maintained between these ci rcuits, demonst rat e that 'aults within these circuits can not degrade both' re-dundant trains. ,

9. Verify that the operability of'the control room manual reactor trip switch contacts and wiring wilL be adequately tested prior to startup after each refueling outage.

Verify tnat the test procedure used wilL not involve i ns t a lli ng jumpers, Lifting Leads, or putLing fuses and identify any oeviations from the WOG procedure. Permanent-Ly installed test connections (i .e., to allow connection of a voltmeter) are acceptable.

10. Veri f y that each bypass breaker wilL be tested to d.emon-strate its operability prior to placing it into servi ce i

for reactor trip b r e a k e,r t e s t i ng .

11. Verify that the test procedure used to determine reactor trip breaker operability wilL also demonstrate proper operation of the associated control room indication / .

annunciation. ,

12. Verify that the response time of the automatic shunt t rip f eature wilL be tested periodically and shown to be less than or equal to that assumed in the FSAR analyses or that c specified in the technical specifications.

, '( . .

1

e. > l

. .**g

• N, l

- )

. \

o- )

13. Propose technical specification changes to require periodic

~

-- - testing.of t h e u n d e r.v o l t a g..e a n'd

. .- s h u n t. t r i p .

fun

. . ..c t i o n s . .a ri.d the manual reactor trip switch contacts and wi ring.

4 S

f I

i 4

i i

4 i

i J

l i

S i '

i

) . ,

i ,

i e

• . Y" 9

,. .$. e, ,

e* * *f

- , ,---w.. ..%-,

__ , , , , , - - - , ,- ,- -- ,-- , - - . - , __m,-. .,m_--, .---,, -.m. ,

I WESTINGILOUSi REACTOR TRIP SYSTEM

. noo cosetect--7 (BEFORE AUTGMATIC SilUHT TRIP H0DIFICATION)

_ j"8ETS , _ _

MANUAL REACTOR REACTOR TRIP I

SYSTEM LOGIC b d' h*4 r

, TRAIN "A" l '"

- ' " RTE SVI 125 Vdc l

' .A" ' " A' '

I r,:

Q PLANT PROCESS h '

I 1

INSTRUENT CilANNELS (SENSORSAND TRAflSHITTERS' j@ . 8 s

l '

8 I

BISTABLES,ETC.lAND h I I FIELD Col 4 TACTS -

I ,7 8 L-h ,

l 8

I -

I

{ 3

. m i

l / REACTOR TRIP s

[ b d:

SYSTEM LOGIC r

TRAIN "B" '

e 8

h' ' ~ t, RYI RTS.

.g 125,Vdc l < . g.

1 g -

=-

l

' IN - UNDERVOLTAGE TRIP DEVICE 3 r ST - SliUI4T TRIP DEVICE I nos coesfado l RTB - REACTOR TRIP BREAKER systru Ie g

- ~~ *

. BYB - BYPASS BREAKER

,I rictii t l o To Roos j

)

~

WESTINGHOUSE I

~

REACTOR TRIP SYSTEM r%  ;;;,- 1 .

(AFTER AUTOMATIC SilutlT TRIP N0DIFICATION) ujsETS__ .

J

, MANUAL. REACTOR '

l  ; TRIP BUTIONS .

1 m

REACTOR TRIP SYSTEM LOGIC

^l 1 " Q(/

. i f

r TRAIN "A" 125 Wc s  ! A RTE 'bBVB

,,j,,, e SilVNT TRIP c/ "A" t

i e

, g c/"A"

' t i F . :e~ l u.

j PtAgli PROCESS iIslauMNT CHANIIELS @.

b 8

hA----d

(SENSORS ANO - I *-

q .

BLOCK g

' AUTO

TRAleSMITTERSl, iSTABLES, ETC. A410 h- I SiluNT I i '

FIELD CcIliACTS I ' '

I TRIP

@, / I 8 I

L s

' - I e

\ / .

' p' I g 1

REACTOR TRIP \-  !-

h 't j

{

S yIC l e AUTO gg L STE 125 Vdc f ,

l 8

' SiluNT TRIP 51 f *O f s,$I i

_L ' -

i

w I .

J B--

J j ' W - LRIDERV0LTASE TRIP DEVICE & T ,' y_,

ST - SHLEIT TRIP DEVICE BLOCK AUTO SilDNT TRIP II _aos co,sistos. )I sysTEas

, . .. BTR - REAC10R TRIP BREAKER 1_,_l BVB-DVFASS3R,E.*KR

!. , . A,B - ItLLAYS AllDI D 10 ACC0!!PL1511 uir memwn er r.insur Tutti riturTifw flGURE 2_ ,-

0 i

!