ML20210U376
| ML20210U376 | |
| Person / Time | |
|---|---|
| Site: | Byron, Braidwood, 05000000 |
| Issue date: | 01/16/1987 |
| From: | SARGENT & LUNDY, INC. |
| To: | |
| Shared Package | |
| ML20210U362 | List: |
| References | |
| NUDOCS 8702180464 | |
| Download: ML20210U376 (31) | |
Text
--
4-SARGENT Q LUNDY dIaco w
January 16, 1987' Rev. I ATWS MITIGATION SYSTEM SPECIFIC DESIGN FOR BYRON /BRAIDWOOD STATIONS COMMONWEALTH-870218046 h f454 PDR ADE PDR Project Nos. 7775-52/53 P
.7725-07/08 j
c
. CARGENT 0:~ LUNDY
'E N G IN E E R S CHICAGO January 16, 1987 Rev. 1 TABLE OF-- CONTENTS.-
_P_a ge,'
Section Titie a
. 1.0 INTRODJCTION-1-1 2.0-DESIGN BASIS 2-1 3.0 FUNCTIONAL REQUIREMENTS
~3-1 4.0 PLANT SPECIFIC DESIGN DETAILS 4
5.0 REFERENCES
~5-1
c SARGENTO LUNDY i
E N GIN E E RS CHICAGO -
January 16, 1987 Rev. 1
1.0 INTRODUCTION
The purpose of this document is to provide a description of the.
specific ATWS Mitigation System design proposed for implementation at the Byron and Braidwood Stations. The description is intended for the use of the Nuclear Regulatory Comatission in evaluating the specific design for compliance to the ATWS rule of -10CFR 50.62(c)(1).
s 1-1 m----
w-SARGENT &' LUNDY f
ENGlNEERS CHICAGO January 16, 1987-Rev. 1 2.0 ATWS MITIGATION SYSTEM DESIGN BASIS The Byron /Braidwood Stations ATWS Mitigation Syste:n-(AMS) design is based on. the following requirements:
a.
The ATWS Rule (Reference 1) b.
ATwS Quality Assurance Requirements (Reference 2)
Westinghouse AMSAC Generic Design Guidance (Reference 3) c.
The foregoing documents provide the basis for the specific AMS system design as described in Section 3.0.
In addition to the details provided in Section 3.0, plant specific information, as requested by the NRC in their letter (Reference 4) stating acceptance of the Westinghouse AMSA Generic Design, is included in Section 5.0.-
2-1
r:
SARGENTO LUNDY ENGINEERS CHICAGO January 16, 1987 Rev. 1 3.0 ATwS MITIGATION SYSTEM FUNCTIONAL DESCRIPTION This section will functionally describe the proposed ATWS Mitigation System ( AMS) design for the Byron and Braidwood Stations..The operation of the proposed AMS is defined in Figure 3-1 and by the following descriptions.
3.1 System Overview The required initiating actions of the AMS are as follows:
a.
initiate the auxiliary feedwater system, and b.
trip the main turbine The plant variable that is monitored to determine loss of heat sink and provide for the actions described above is main feedwater flow to each steam generator.
Each steam generator feedwater line is monitored by two existing sets of flow instrumentation.
Either of the two flow measurements indicating low feedwater flow is an indication of loss of heat sink for that steam generator.
As shown in Figure 3-1, two identical sets of logic trains.are provided and are defined as AMS Train -A and B respectively.
Both the main turbine trip and auxiliary feedwater actuation signals are initiated by the two logic trains.
3-1
y-.
- CARGENT Q LUNDY-ENG1NEED0-
- CH IC AGO January-' 16,1987 l Rev. l' Each logic train monitors one of the two flow' transm'itters from.
~
- each steam generator feedwater line for a total of four inputs!
per train. A 3 out' of 4 coincident logic scheme is employed for each logic ~ train to interrogate these-feedwater flow' signals, therefore requiring three of the steam generators to indicate a loss of heat sink-in order to actuate the AMS.
The AMS Train A logic will. actuate the auxiliary feedwater system-(i.e., motor driven auxiliary feedwater pump and.related equipment) and trip th'e main turbine (through the emergency trip). Similarly the AMS Train B logic will. actuate the auxiliary feedwater system (i.e.,- dies'el driven auxiliary' feedwater pump and related equipment) and trip the main turbine (through the auto stop trip).
In both logic trains a time. delay (approximately 25 seconds) is provided to allow the unfaulted main feedwater pump.to automatically increase flow in. the event of a single main feedwater pump failure and avert an' AMS initiation.
Arming of the AMS is accomplished manually by placing a
" Bypass / Arm" control switch in the " Arm" position when the C-20' power level (70% of nominal full power) permissive is satisfied. Upon a decrease.in powerLoelow the C-20 power level-the AMS will be automatically disarmed. The C-20. power level 3-2
(-
CARGENT O LUNDY ENGINEERG CHICAGO January 16, 1987 Rev. 1 permissive is developed in the AMS system based on turbine impulse pressure.
Af ter an AMS initiation of the auxiliary feedwater system and tripping of the main turbine, the AMS will self reset. That is, af ter AMS initiation as power decreases and af ter a time delay (approximately 60 seconds), the C-20 interlock will inhibit the logic trains thus allowing shutdown of the auxiliary feedwater system and reset of the main turbine trip.
The time delays allows the AMS to remain armed long enough to perform its function in the event of a turbine trip.
The logic provides for two inhibiting signals which are manually implemented under administrative control that prevent the logic from initiating its intended functions (i.e., start the auxiliary feedwater system and trip the main turbine). The first of these is an AMS " Bypass / Arm" control switch. When the switch is in the
" Bypass" position, the operation of both AMS logic trains is inhibited. The intent is to provide the operator with a positive method of bypassing the AMS manually.
The second inhibiting signal results from the requirement that the AMS must have the capability for testing during power operation.
Each logic train can be tested independently thus allowing a logic train to remain in service while the other is in the test mode. When the operator selects the AMS test mode for either logic train, the final AMS actuation output devices 3-3
7 CARGENT Q LUNDY ENGINEERG CHIC AGO January 16, 1987 -
Rev.'1 (relays) for that train are inhibited from' operating and inadvertently initiating the auxiliary feedwater system or tripping the main turbine during power operation.
Control of the auxiliary feedwater system and main turbine -are provided for by existing controls and are not in the scope of the AMS design.
3.2 Main Control Room Interface The control room interface between the AMS and the ~ operator includes the following alarms and indications located at the main control boards:
a.
Alarms
' AMS Initiated AMS Inoperable Train A*
AMS Inoperable Train B*
125 VOC/24VDC P/S Failure b.
Indications - AMS Initiated Train A - Red Light AMS Initiated Train B - Red Light
,AMS Armed Train A - Green Light AMS Armed Train B - Green Light AMS In Test Mode Train A - Red Light AMS In Test Mode Train B - Red Light 3-4
r '
SARGENT~O LUNDY ENGINEERS CHICAGO January 16, 1987 Rev. I c.
Bypass Permissive Light Box - AMS Bypassed C-20 Permissive
- Inoperable alarm includes loss of power, AMS in test, manual. and automatic bypass.
3.3 Termination of Steam Generator Blowdown Steam generator blowdown will not be automatically terminated by the AMS. Since the immediate effect of steam generator blowdown,-
in the event of an ATWS event, is to remove heat from the steam generator, automatic isolation is not necessary. Once AMS-is initiated, steam generator inventory can be adequately satisfied with both trains of auxiliary fosdwater operating. Auxiliary feedwater flow per steam generatcr will be approximately 320 gpm with maximum blowdown flow per s$eam generator of'90 gpm.
Operating procedures could be developed, however, if necessary, to address the manual termination of steam generator blowdown flow if the AMS is initiated.
1 3-5 4
_e er
SGA SGB SGC SGD SGA SGB SGC SGD FW FW FW FW FW FW FW FW FLOW FLOW FLOW FLOW FLOW FLOW FLOW FLOW
~
<50 %
<50%
<50%
<50%
<50%
<50%
<50%
<50%
ARM SYSTEM ABOE C-20 1rirtrir 1ririr1r 2/4 LOGIC 3/4 3/4 SWC TRAIN A l
TRAIN B d
1r 1 r LOGIC
\\QN)
LO GIC
\\QN)
(OFy QFf
' r 1 P
IP 1r TRAIN A 1r 1 r TRAIN B yp 1p AND AND INHIBIT SYSTEM FOR TEST AND INHIBIT SYSTEM FOR TEST AND I
CONT CONT SWCH SWCH 1r 1r 1r 4r A!O ANO l
1r 1r 1r 1F INITIATE MOTOR DRIVEN TRIP MAIN TURBINE INITIATE DIESEL DRIVEN TRIP MAIN TURBINE AUX FW PUMP S ELATED (EMERGENCY TRIP)
AUX FW PUMP &RELATED (AUTO STOP TRIP)
SYSTEM COMPONENTS SYSTEM COMPONENTS FIGURE 3-1 ATWS MITIGATION SYSTEM SIMPLIFIED LOGIC DIAGRAM
SARGENT O LUNDY
'"SE"AGO
~
January 16, 1987 Rev. 1 4.0 PLANT SPECIFIC DESIGN DETAILS The following section provides the plant specific design details as requested by the NRC. Each topic is addressed in the order in which they are listed in Reference 4.
4.1 Diversity The ATWS Mitigation System (AMS) design for the Byron and Braidwood Stations uses equipment which is largely diverse from that used in the Reactor Protection System (RPS). AMS inputs are derived from the existing feedwater flow instrumentation which, while they are located in the RP3 Westinghouse 7300 protection cabinets, no longer provide a reactor trip function, (instrumentation provides indication and alarm function only).
The AMS feedwater flow inputs are isolated from the existing feedwater flow instrumentation loop signals by Technology for Energy (TEC) Analog Signal Isolators.
These isolators are classified as safety related. After isolation the feedwater flow
~
signals are fed to Rosemount master trip units which generate the feedwater low flow logic inputs to the Rochester Solid State Logic System. The Rochester Solid State Logic System provides implementation of the coincidence logic, permissives, test inhibits, time delays and other AMS functions. Outputs from the logic system are then used to trip the turbine and start 4-1
e SARGENT O LUNDY
" $$[oo
~ January 16, 1987.~
Rev. 1 auxiliary feedwater.via a number of interposing relays.
The interposing relays interlocking safety related circuits are classified as safety related. These relays are the same as other safety related relays used in similar circuits elsewhere in the Byron and Braidwood Station designs.
Power supplies used within the AMS for DC to DC voltage reduction.
are supplied by Lambda. Major components of the AMS are therefore provided by manufacturers who are diverse from those used in the Westinghouse 7300 protection cabinets and Westinghouse solid state logic cabinets.
4.2 Logic Power _ Supplies The 125 VDC system at Byron /Braidwood consists of two independent safety related trains.
Each train consists of a battery, battery charger and DC distribution center.
Each train's DC distribution center is divided into two sections. One section is dedicated to feeding the safety related DC system loads. The other section is-dedicated to feeding the non-safety related DC system loads.
The non-safety related loads are isolated from the safety related DC bus by two safety related breakers in series (Ref. FSAR, Appendix A, compliance with Reg. Guide 1.75).
Figure 4-1 illustrates the Train A DC system configuration.
Each train of the AMS shall be powered from one of the Independent trains of the 125 VDC system..
4-2
CARGENT Q LUNDY ENGlNEERS CHIC AGO January 16.-1987 c:
Rev. 1 The guidelines in 10CFR40.62 ( ATWS Rule)' state that:
The AMS power supply is not required to be safety-related.
o
. >y,,
4.
The AMS must-be capable of performing its' safety-related o
J function following a loss of offsite power.
o The AMS logic power must be independent from the power supply for the Reactor Trip System.
' Jean Selection of the 125 Vdc system, as.the AMS power supply, complies with the guidelines in 10CFR50.62 as discussed below:
a.
Safety Classification of AMS Power Supply n
As illustrated in Figure 4-1, each train of the AMS shall be powered from an independent division of the 125 VDC 3[
system. The AMS cabinet shall be powered from the section of the DC distribution center dedicated for non-safety 5
related loads. The power feed shall be from a dedicated.
circuit breaker. The ultimate power supply for each train of the AMS cabinet is a safety-related 125 VDC battery.
Utilization of a safety-related power source exceeds the requirements of the guidelines provided in 10CFR50.62.
f a
- +
.4-3
e g-
'.f s
y 25 CARGENT O LUNDY E Ff G I N E E R O s
x s
[
'. }N j CHIC AGO January 16, 1987
- Rev. 1 4
x b.
Operation Following Loss of Offsite Power _
4 s
~,
e Since each train of the AMS cabinet is powered;from a dc source (i.e. the 125 VOC batteries), the system is capable of performing its' function following a loss of 6(fs'lte power. The Byron /Braidwood DC system design does not rhuire load shedding of non-safety related loads following 6
a loss of of fsite power.
c.
Independence From Reactor Trip System Power Supply As$,lustrated in Figure 4-1, the Reactor Protection Sys' tem
\\
cabinets are energized from an NSSS Instrament Power-(IP)
's r
w
?
The normal power su'pply to the Inverter is 'from inverter.
?
the station Auxiliary,Fower System. The de supply sei ves as the reserve power sIpfiy.
Several levels of circuit
\\,
breaker:: (e.g., circul.t breakers 'at IP distributim papels.
IP inverters And dc distribution panels) ensure that malfunctions?(e.g., short circuits) in the Reactor r
y Protection System do not result in loss'of the 125 Vdc,
j' u
[
System.
?
s, As illustratq* in Figure 4-1, the Reactor Trip Switchgear" is fred from the safety-rei3ted 125 Vdc bus. Fuses and circ it breakers ensure that malfunctions (e.g., short 4 J
s a s, fs o
g 4
/g 44y s
s 1,
\\'
7 _,
r, j
w CARGENTOLUNDY
,/
ENGINEERS CHICAGO -
d January 16,:1987
.Rev. 1 circuits) in the Reactor Trip Sw'itchgear do not result in loss of the 125 Vdc system..
'It is recognized that utilization of the'125 VDC system as the AMS' logic power supply does not result in~ a power
.,!i supply totally independent of the reactor trip system power s:
?
supply. However, as di[3 cussed above, the DC. system design provides. sufficient isolation to ensure that malfunctions in the reactor trip?Iystem do not disable the ATWS Mitigation System.
v 1
4.3 Safety-Related Interface Two safety-related interfaces exist between the AMS and the existing protection system. The first is-the interface between the AMS and the ma)h feedwater flow ' instrumentation
^
circuits. As previously discussed in Subsection 4.1, isolation is provided by th'e use of; Technology for Energy; \\ >
',a Corporation analog signal isolators'. The existing criteria for. physical separation between reactor-protection and~ non-
. safety system wiring will also be utilized.
Specifica11k RPS Chil main feedwater flow si,gnal inputs.will be routed to AMS Train A for isolation and RPSjCh. 2 main feedwater.
~
flow signal inputs will be routed to AMS Train B.. Both t-j s
4-5
jc CARGENT Q LUNDY-E N GIN E E R S CHICAGO January 16, 1987 Rev. I trains of AMS are located in the same cabinet, however, the.
f.
,E cabinet-is physically divided into two sections by a metal N
barrier.
f r.
5
'y
'l The second interface, while it is not a direct' interface between the reactor protection system and the AMS,-.is.
between the AMS and the safety-related station batteries.-
A discussion of this, interface is included in Subsection -
4.2.
- 4. 4.
Quality Assurance.
'4.
Safety-related compon'ents which are part of the AMS will.5e procured witih the appropriate quality assurance required.
~
for safety-related _ equipment. All other components. in ' the -
AMS design will be procured using the quality' assurance'-
requirements stated in Generic Letter 85-06 (Reference 2).
1 4.5 Maintenance Bypasses-
~ Maintenance at power can be accomplished by taking' the
..ll i
affected AMS train out of service administratively and.
t removing power to that train.
It-i s recommended that. the "
main test switch for that. train, located in' the AMS cabinet, be placed in the test modeito ensure that maintenance activities do not result in spurious actuation of the: AMS' output relays.. 'It'is not however_ a requirement 4-6.
u
CARGENT& LUNDY
"!Jat!"*
January 16, 1987 Rev. I to do so since' power must be available. for the AMS to
~
actuate auxiliary feedwater and trip the turbine. -Loss of power to a train of the AMS or placing a train in test mode
^
will result in an AMS inoperable main control alam. ' This alarm along with other AMS alarms and controls will. be grouped and. located on the main control board utilizing human factors engineering practices.
4.6 Operating Bypasses The AMS shall' be manually armed by the operator coincident' with power above C-20 (70% of nominal full power) as a permissive. Bypass of the AMS shall be either manually initiated by the operator or automatically-initiated if the
~
power is reduced.below C-20.
The C-20 power:1evel is measured by dedicated transmitters'for each AMS train. The transmitters will measure first stage impulse pressure at-the high pressure turbine. The basis for:the 70% of' full power setpoint is provided in.WCAP-10858 (Ref. 3). The manual or automatic bypass of the AMS. is ~ alarmed as AMS -
inoperable. Separate annunciator windows _ are provided for AMS Train A&B.- The C-20 power level permissive and AMS.
bypass will be indicated at the Bypass Permissive Light Box.
4-7
-I
CARGENT Cr LUNDY
$$?c5 "'
January 16, 1987 Rev. 1 4.7 Means for Bypassing The manual bypass switch discussed in Section'4.6 is a
.I permanently installed selector switch with three positions, arm, normal and bypass. This control switch is located i
with the AMS indicating lights and annunciator alarms at a main control board location selected in accordance with human factors engineering practices.
4 4.8 Manual Initiation 4
Manual actuation of the AMS is not provided. Manual initiation-of auxiliary feedwater and manual tripping of the turbine can be accomplished by the operator at existing -
1 controls provided on the main control boards.
~
i 4.9 Electrical Independence From Existing Reactor Protection System And Other Safety Related Circuits The interface between the main feedwater flow 4
instrumentation loops and the AMS is made through -
Technology for Energy Corporation ~(TEC) Model 156 Nuclear Qualified Analog Isolators.- These isolators, which are located in'a mild environment, have been fully qualified by the' vendor according to the guidelines set forth in the applicable IEEE Standards.- The results of the -
f environmental qualification testing envelope the
/
4-8
~
i' h
CARGENT Q LUNDY-
""Ed"55"#
January 16, 1987 Rev. 1 Byron /Braidwood Stations requirements. -In addition, the.
isolators were functionally tested for input isolation (i.e., ' signal degradation) during short circuits, open circuits and faults on the output side. The maximum credible voltage transient which the non-saf tey-related (output) side of the circuits would be exposed to is approximately 140 volts dc (i.e.. the ' isolators are powered with 24VOC, however, the AMS cabinets where the isolators are located, are powered from the 125 volt DC System as described in Section 4.2a).
The. isolators were tested to.a fault voltage of up to 2,000 volts de between. terminals.
For current transients, the 125V circuits will be appropriately protected (e.g., fuses and circuit breakers) in order to interrupt a fault on the non-safety-related circuit side before the operability of the ' isolation function is affected.
The isolators were tested at 20 -
amps, as applied to the non-safety-related side, without degrading the safety-related side below an acceptable level. The design-of the isolators is b' sed on an-a inherently fail-safe principle which ensures isolation, even if all power is removed from the device. The stainless steel case will_ be grounded which generally.
eliminates electrom'agnetic : interferences..These isolators have been used in many other nuclearL plants and.have _been evaluated by the NRC. More detailed documentation 4.
U' SARGENT O LUNDY
" fi"n! "
- January 16, 1987 Rev. 1 addressing qualification and testing is availtble in the qualification test reports.
The AMS output interface' to the safety related auxiliary feedwater circuits is provided 'at the output relays via coil to contact separation. The output relays. are Westinghouse auxiliary relay model numbers ARD 880VR and ARD 4400R.
These relays, which are located in a mild environment, have been qualified by the vendor according to the guidelines set forth in the applicable IEEE Standards.
The results of the environmental qualification testing envelope the Byron /Braidwood Stations requirements. In addition, the relays were functionally tested. The maximum credible voltage transient which the non-safety-related side of the circuits would be exposed to is approximately 140 volts dc (i.e., the AMS cabinets'where the relays are located, are powered frcm the 125 volt 3C System as described in Section 4.2a). The relays are rated 600V for isolation between contacts and between contacts and coils. The relays were tested to withstand a voltage of up to 1,500 volts ac between terminals..For current transients,-the circuits will be appropriately protected (e.g., fuses and circuit breakers) in order that a fault on the non-safety-related circuit side will be interrupted by the protective devices before the operability of the isolation function is affected.- The' relays are rated'10 4-10
CARGENT Q LUNDY ENGINEERS C HIC AGO January 16, 1987 Rev. 1 amps non-inductive and 6 amps inductive. The relays are inherently fail-safe because power is not required for the relays to function as isolation devices. Typically electromagnetic interference is not a problem with relays. These relays are used throughout the Byron /Braidwood Stations as isolation devices and. have been evaluated by the NRC. More-detailed documentation addressing qualification and testing is available in the qualification test reports.
4.10 Physical Separation From Existing Protection System The AMS hardware is located in its own. cabinet which is separate from the existing reactor protection system cabinets. Actual isolation of the main feedwater flow signals will be done in the AMS cabinet. The two sets of main feedwater flow signals (RPS Ch.1 - four signals routed to AMS Train A and RPS Ch. 2 - four signals routed to AMS Train B) will be the only direct interface between the reactor protection system and the AMS.
4.11 Environmental Qualification The AMS cabinet is located in a mild environment. The environmental parameters for the location,- Zone A1, are listed in the Byron /Braidwood FSAR Table 3.11-2.
4-11
E SARGENTQ LUNDY
' " u"5! "
January 16, 1987 Rev. 1 The existing main feedwater flow transmitters are also located in a mild environment. The environmental parameters for the location, Zone A8, are listed in the Byron /Braidwood FSAR _ Table 3.11-2.
Both non-safety and safety-related components of the ATWS cabinet and the main feedwater flow transmitters will be designed to meet the environmental conditions existing' in.-
the zones they are located.
Seismic qualification will be provided for the AMS cabinet and internal safety-related components which provide the input and output AMS interface to external _ safety related circuits.
4.12 Testability of Power The AMS is designed to allow testing of the master trip units, solid state and relay logic system, and final AMS output relays during power operation as well as below the C-20 power level permissive. AMS testing is subdivided-into three areas which are described individually below.
a.
Testing of master trip units (MTU) - Each logic train-
~
requires four MTV's (one per steam ' generator) which are housed in a single MTU chassis. A calibration unit with a dual readout assembly is 'provided to 4-12
SARGENT Q LUNDY ENGINEERS CHICAGO January 16, 1987 Rev. l insert in the MTU. chassis and calibrate each individual MTV. One calibration unit will serve both.
trains of logic since only one train of logic is to be tested at a time allowing the other train to remain in service.
The calibration unit when placed into the MTU chassis allows testing or calibration of each MTU (only one MTV can be tested at a time). The calibration unit generates a calibrate command signal, calibration 4
current, and a calibration status signal. Cal ibra-tion of any selected MTU in the chassis is initiated by the calibrate command signal directed to that MTU, which causes the MTU under test to' accept a calibra-tion current in place of the input signal. The input signal is switched to a fixed resistor (located in the MTU), while the MTU is under test, to prevent opening the input circuit. The calibrate command signal also causes the MTU under-test to generate a
-calibration / gross failure output signal which energizes the cal / gross ' failure relay. While the MTU is under test an AMS inoperable alarm for the logic train under test is annunciated in the MCR via the cal / gross failure relay.
4-13
r SARGENT O LUNDY ENGINEERO CHICACO January 16, 1987 Rev. 1 During testing, the MTU receives a calibration current (continually adjustable) from the calibration unit which is simultaneously displayed on the readout assembly as the calibration status signal. A second display on the readout assembly tracks the calibra-
-tion status signal until the MTU changes state (non-trip to trip state or vice versa). The calibration current reading at that point is latched on the trip current display by the trip status signal from the MTU under test. This allows an accurate determina-tion of the MTU trip setpoint setting.
When the MTU is returned to normal operation, the input signal is switched back to the MTU, and the cal / gross failure relay is de-energized (provided the input signal is within its normal range of 4-20 ma DC).
Each MTU is provided with a process indicator which will display the input process signal (differential pressure) or the calibration current.-
Although each MTU can be tested on an individual basis,- the AMS actuation signal for the train under test should be blocked from inadvertently actuating the final AMS output relays. This is accomplished by placing the AMS test mode selector switch in the test position. This action will illuminate an indicating:
4-14.
'SARGENT Q LUNDY E N GlN E E R S CHICAGO January 16, 1987 Rev. I light both at the MCR and AMS cabinet and also will activate the AMS inoperable annunciator alarm for the logic train under test. To return the AMS logic train under test to normal service a two step process is required since otherwise resetting the AMS test mode selector switch to normal during a test would inadvertently actuate the final AMS output relays.
Once testing for.a particular logic train is completed the operator would return the AMS test mode selector switch to normal and then press the respective logic AMS train test reset pushbutton.-
b.
Testing of system logic (solid state and relay) -
Since the MTV's are tested individually, it is not possible to force more than one MTU into a trip status simultaneous 1y'from the calibration unit.
To artificially initiate the system logic for testing, external MTU test switches are provided for each MTU. The'MTU test switch:is a three position switch with each position accomplishing the following respective function:
MTU Test Switch Posi tion Function Norm Allows the MTU to directly operate the MTU trip relay.
4-15 w
e
~r
}
SARGENT,Q LUNDY
+-
ENGINEERG CHICAGO January 16, 1987 Rev.'l MTV Test Switch Position Function Test-Trip Disconnects the MTU trip relay from the MTU and energizes the trip relay creating an artificial " trip situation."
Test-No rm Disconnects the MlU trip relay from the MTU and de-energizes the trip relay creating an artificial "non-trip or normal situation."
This position allows logic testing during fuel load and maintenance when the input signal. would normally maintain the MTU in a tripped state.
Placing the MTU in either test mode from the MTU test switch causes the AMS inoperable alarm for the logic train under test to be annunciated in the MCR.
An indicating light for each MTU at the AMS cabinet alerts the operator when the MTU trip relay is artificially energized by the MTU test switch.
To test either train of system logic the AMS test mode selector switch-for that train would be placed in the test mode. As described previously this action would prevent the actuation of the final AMS output relays during test. The AMS-test mode indicating light for the train under test would illuminate in the MCR and at the AMS cabinet and the 4-16
m SARGENTLQ LUNDY ENGlNEERS CHICAGO January 16, 1987 Rev. 1 AMS inoperable annunciator alarm would be activated. The operator would proceed to place two or more MTV's in the tripped state until all combinations are tested for the train under test.
Successful generation of th'e AMS actuation signal by the system logic is verified when the AMS initiated indicating lights are illuminated in the MCR and at the AMSC and also by actuation of the-AMS initiated annunciator alarm.
Prior to_ returning the train' under test to the normal mode by the AMS test mode selector switch and pushbutton, each MTU test switch should be placed in the normal mode, c.
Testing of final AMS output relays - The testing circuits used for the final AM5 output relays and final actuated devices will be similar to the testing i
schemes used in the Byron /Braidwood Safeguards Test j
Cabinets. However, for the purpose of the AMS, testing of the final AMS output relays and final actuated devices will'be-limited to a continuity test only of the circuits and not full actuation of the final devices _ (control relay which operates the auxiliary feedwater pump, for example). _
Continuity testing of the~ circuits will be used
- because, 4-17
SARGENTC: LUNDY ENGINEERS CHICACO January 16, 1987
'Rev. I o
the AMS is not safety-related, o
any additional periodic cycling of safety related system components in the auxiliary feedwater
~
system as a result.of AMS testing should be Y
limited in order to maximize the qualified life of those components, and tripping of the turbine at power is obviously o
unacceptable.
4.13 Completion of Mitigative Action Once initiated the AMS actuation signal will go to-completion except as delayed by the 25 second time delay which allows for main feedwater pump recoveryLin the event of a single main feedwater pump failure. The C-20 permissive is delayed from de-energizing for 60 seconds to ensure that the permissive signal is present so that AMS i
operates.
Seal-in of the AMS actuation signal is not necessary at the logic level, since the final actuated or tripped equipment control circuits (auxiliary feedwater and turbine trip) will remain in that condition until stopped or reset by the
'I main control room operator.
4-18
7.
~
SARGENT & LUNDY ENGINEERS C H IC/4GO January 16, 1987 Rev. 1 4.14 Technical Specification No specific technical specification is proposed at this time.
4-19 1
~~
BATTE RY CHARGER 9
0) o' A
O C
U) U
,,,0 U)
U) of n OJ of 3g@
^
FEED TO AMS m
12 5V DC
", TRAIN A
~
n n
BATTERY OTHER 0, NWc, LOADS FEED TO OTHER
^
^
LOADS 3 oHWc U
DISTRIBUTION PANEL FOR NON-SAFETY RELATED LOADS REACTOR TRIP FEED TO SWITCHGEAR OTHER LOADS V
\\
($. - (U IP
^3%[.cc o c:
DISTRIBUTION STATION PANEL
^
AUXILIARY O@
($**(Un POWER SYSTEM NSSS INVERTER p
p FEED TO RPS CABINETS FIGURE 4-1 POWER SUPPLY ARRANGEMENT FOR AMS CABINETS, RPS CABINETS AND REACTOR TRIP SWITCHGEAR TRAIN A.
TYPICAL FOR TRAIN B-
(-
N
- ' SARGENT Cr LU'NDY'-
~,.8
'ENGINEERD January 16-l'987j l
Rev.-l' 5.0 References 1.
ATWS Final Rule --Code of' Federal Regulations 10CFR50.62'and Supplementary Information Package, " Reduction of Risk Lfrom Anticipated Transients Without Scram (ATWS) Events for' Light-Water-Cooled Nuclear Power Plants".
2.
" Quality Assurance Guidance for ATWS Equipment.That is Not-Safety-Related", Generic Letter.85-06; April 16, 1985.
3.
" AMSAC Generic Design Package", WCAP-10858..
4.
Rossi, C.
E., " Acceptance for Referencing of Licensing R'eport" NRC.
Letter to L. D. Butterfield, Chairman of-ATWS Subcommittee, Westinghouse Owner's Group, July 7,-1986.
s r
I 5-1 l'
.....