ML20235G994
| ML20235G994 | |
| Person / Time | |
|---|---|
| Site: | 05000470 |
| Issue date: | 09/30/1987 |
| From: | ABB COMBUSTION ENGINEERING NUCLEAR FUEL (FORMERLY |
| To: | |
| Shared Package | |
| ML20235G520 | List: |
| References | |
| CEN-362, NUDOCS 8709300325 | |
| Download: ML20235G994 (26) | |
Text
-
1 , .
l i
CEN 362 Response to the NRC's Evaluation of CEN-315
)
i for i
- l R
System 80 Prepared by Combustion Engineering September, 1987 i,
j 8709300325 870918 PDR ADOCK 05000470 A PDR l
--_- \
q.
)- ,
l TABLE OF CONTENTS SECTION TITLE pAGE k
1.0 Introduction 1 1
2.0 NRC Staff's Criteria for Diversity 3 3.0 Evaluation of the Diversity of Existing Auxiliary 6 Feedwater Actuation Systems 4.0 Other Considerations in Evaluation of AFAS 15 Diversity 5.0 Independence of Power Supplies 17 6.0 Overall Diversity Conclusions 18
)
7.0 References 19
-ii-
1.0 INTRODUCTION
In September of 1985 C-E submitted CEN-315 (Reference 1) for.NRC Staff review. That report provided detailed information describing the level oof diversity which exists between the Reactor Trip System (RTS) and the Auxiliary Feedwater Actuation-System (AFAS) at plants with Combustion Engineering designed NSSSs. The CEN-315 report includedia discussion of the existing component / hardware diversity as well as generic diversity considerations. j In August of 1986 the NRC issued the Staff's evaluation of CEN-315 (Reference 2.). For PVGNS 1, 2, 3 and WNP3, the staff concluded that:
" Based on the Staff's review of the information provided, it appears that
- insufficient hardware / equipment diversity exists in the. bistable relays, matrix relays, and initiation relays to satisfy the diversity requirements of the ATWS rule. In addition, it is not apparent that adequate bistable diversity is provided, and it appears that a CMF of the Potter Brumfield relays could disable both the RTS and the AFWS.
Hardware / equipment diversity should be provided to the extent that a CMF of a given component will not disable both the RTS and AFWS function.
The additional diversity provided by the CPCs and the SPLAs appears to i
considerably reduce the potential for CMFs, and may prove sufficient to meet the requirements of 10 CFR 50.62(cM1). However, insufficient information has been provided to allow the Staff to determine the degree of diversity provided by these components."
- I Core Protection Calculators
- w Supplemental Protection Logic Assemblies
)
l The purpose of this document is to provide detailed information to demonstrate that the existing AFAS systems in the System 80 plants (PVNGS 1, 2 and 3, and WNP 3) does comply with the ATWS Rule requirement for diverse Auxiliary Feedwater System (AFWS) actuation circuitry. This document does not discuss compliance with the requirements for diverse reactor trip and turbine trip circuitry, since they were previously addressed and closed-out in Reference 3.
The conclusion of this report, therefore, is that the design of PVNGS 1, 2, and 3 and WNP-3 meet the requirements of the ATWS Rule.
i i
l i ,
1 2.0 NRC STAFF'S CRITERIA FOR DIVERSITY The ATWS Rule (10CFR50.62) requires that plants have a means to actuate Auxiliary Feedwater which is independent and diverse from the existing Reactor Trip System (RTS). The purpose of this requirement is to ensure that an adequate degree.of diversity exists to minimize the potential for a common mode failure to disable both the AFAS and RTS. It is C-F.'s contention that the ATWS Rule requirements are satisfied if each AFAS component has a degree of diversity from its counterparts in at least one of the RTS trip paths.
This would be adequate to prevent a common mode failure from disabling both the AFAS and RTS.
In the NRC's evaluation of CEN-315, the staff acknowledged that complete AFAS diversity is not required and guidance was provided on how diversity could be achieved. The staff indicated in section II of their evaluation that "It is recognized that total / absolute component / hardware divershy can be difficult to achieve. However, an acceptable level of component / hardware diversity can be achieved in accordance with the methods discussed below to eliminate the majority of potential common mode failure mechanisms leading to an ATWS event."
The evaluation also stated that diversity can be achieved by incorporating as many of the following methods as possible:
I
- a. Use of components from different mar.ufacturers.
- b. Use of electromechanical devices versus electronic devices.
I
- c. Use of energized versus deenergized-to-actuate trip status.
i l
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ . _ _ _ __ J
y ,
l The equipment guidance provided in the Statements of Consideration for
'10CFR50.62 states, " Equipment' diversity to the extent reasonable and practicable to minimize the potential for common cause* failures is required l
from the sensors to, but not including, the final actuation device."
l Section II of the NRC's evaluation of CEN-315 further. states, "In those cases i
where complete hardware / equipment diversity is not'provided, and it can be demonstrated that other factors exist that similarly reduce the potential for common mode failure to disable both the existing RTS and ATWS prevention / mitigation systems, these considerations and methods for achieving diversity will be reviewed on a plant specific bases to determine !
acceptability."
I i
- l Although this statement refers to common cause failures, it is clear from other NRC documents, including the discussion in Section 2, " Diversity -
Requirements" of Reference 2 that the intent of the ATWS rule requirements is to ensure that there exists diversity to the extent reasonable and practicable to prevent a common mode failure froia causing the simultaneous failure to actuate both the RTS and AFAS.
4
r Based on this guidance, Combustion Engineering interprets the Staff's position l te be the following:
(L The ATWS Rule requires a diverse AFAS (i.e., AFAS system diversity). It does not require that every AFAS component be diverse from its counter parts in every RTS trip path.
o AFAS system diversity can be achieved by incorporating as many of the component diversity methods (a) through (d) listed previously as possible, o Diversity is required to the extent that it is reasonable and practicable to minimize the potential for common mode failures.
o The licensee may take credit for design features that reduce the potential for common mode failures. In their evaluation of the diversity of a particular plant, the Staff will consider unique hardware features of the plant and other diversity considerations.
l
I l
i
- l l
[ 3.0 EVALUATION OF THE~ DIVERSITY OF EXISTING AUXILIARY FEEDWATER ACTUATION SYSTEMS l PVNGS 1, 2 and 3, and WNP 3 each have four redundant reactor trip paths for parameters indicative of an ATWS. These are the Supplemental Protection j System (SPS), Core Protection Calculator (CPC) trip function, the High l Pressurizer Pressure (HPP) trip function, and the Steam Generator Low Level (SGLL) trip function. This report will show that the AFAS is completely i diverse from the SPS trip. This diversity
- guards against common mode failure that might affect both the RTS and AFAS functions, and is adequate to satisfy the requirements of paragraph (C) (1) of 10 CFR50.62. The AFAS is diverse from the other three RTS trip paths in various ways described in this report. This provides additional redundancy and diversity and helps to ensure that the existing RTS will trip the reactor under conditions indicative of an ;
ATWS. The sensors used by these trip paths monitor parameters that are diverse from one another. Most important for ATWS considerations are pressurizer pressure, steam generator level, and high core inlet temperature. ;
The SPS is part of the reactor trip system. It monitors pressurizer pressure, with a trip setpoint of 2409 psia. The SPS utilizes four identical safety grade channels which are refered to as a Supplemental Protection Logic Assemblies (SPLAs). Each SPLA is physically separate and electrically independent from the other SpLAs and from any other control or protection channels. They are also diverse from the rest of the RTS and the Engineered Safety Features. The SPS uses a selective two-out-of-four logic to interrupt the power supplied to the Control Element Drive Mechanisms (CEDMs) and thereby cause a reactor trip. If any SPLA is removed from service for testing or maintenance, it is placed in the trip condition. Thus, the SPS can perform its function during the testing of an individual SPLA.
- Unless otherwise stated, for this report the term " diversity" refers to l diversity from the RTS. This diversity can be based on component / hardware considerations and/or other diversity aspects. l i
f .
The CPC, HPP, and SGLL trip paths each consist of four safety grade channels that are electrically independent and physically separate from one another.
The reactor will trip if a trip occurs on any two out of four channels in any one of these three trip paths.
The CPCs are part of the RTS. They will generate a reactor trip signal when the Departure from Nucleate Boiling Ratio (DNBR) approaches a preset value or when the calculated core peak Local Power Density (LPD) reaches a preset value. The input parameters i.o the CPCs include core inlet (cold leg) temperature, core outlet (hot leg) temperature, pressurizer pressure, Reactor Coolant Pump (RCP) speed, excore flux power, and information about Control Element Assembly (CEA) position. The CPCs use algorithms to compute the DNBR and LPD. They will also generate a reactor trip signal whenever any input parameter is outside the range for which the algorithms have been validated.
For example, the CPCs will generate a trip if the core inlet temperature exceeds the temperature limit (typically 610 F for System 80). This is indicative of an ATWS. The CPCs will also generate a reactor trip if the pressurizer pressure exceeds the pressure limit (typically 2388 psia for System 80). This condition is also indicative of an ATWS.
Figure 1 is a block diagram illustrating the component / hardware diversity between the RTS and the Auxiliary Feedwater Actuation System at PVNGS 1, 2 and 3. Figure 2 is a similar diagran for WNP 3. The upper portions of Figures 1 and 2 illustrate the Supplemental Protection System.
The middle portions depict the Core Protection Calculator trip function and the High Pres.arizer Pressure (HPP) trip function. The lower portions of these figures illust' rate the AFAS function. The Steam Generator Low Level >
(SGLL) reactor trip function is not shown in Figures 1 and 2. The SGLL trip function shares level sensors with the AFAS function. The balance of the SGLL trip function's components are identical to those shown for the HPP trip function.
t .
l Following is a discussion of the diversity between individual AFAS components and the functionally corresponding RTS components for ANPP 1, 2, and 3, and WNP3. The components for each plant are discussed in order from left to right in Figures 1, and 2. The discussion is summarized in Tables 1, and 2. Each row in these tables describes the diversity of an individual component. The first column lists the individual AFAS components. The headings of the next columns are the criteria for diversity provided by the NRC Staff. The entry
" Diverse" under the heading " Diversity Criteria" means that an individual component satisfies the diversity criterion listed above it. Conversely, the entry "Not Diverse" under the heading " Diversity Criteria" means that an individual component does not satisfy the diversity criterion listed above it.
The last column in these tables provides a summary of the overall diversity of each component based on the various diversity criteria.
This diversity evaluation demonstrates that all AFAS components for FVNGS 1, 2, and 3 and WNP 3 are diverse from their counterparts in one RTS trip path; the SPS, based on the Staff's criteria for diversity. As is discussed in Sections 3.1 and 3.2 of this report, most AFAS components are also diverse from their counterparts in at least one of the remaining trip paths.
Additionally, section 4 of this report details some of the System 80 design features which further reduce the potential for common mode failures.
i
3.1 DIVERSITY OF THE PVNGS 1, 2 AND 3 AFAS COMPONENTS (Figure 1 and Table 1) l The first components in the trip path are sensors. The existing RTS sensors which measure parameters indicative of an ATWS include the Resistance Temperature Detectors (RTDs), pressurizer pressure sensors, and steam generator level (SGL) sensors. The RTDs provide core inlet temperature input to the CPCs. The AFAS steam generator level sensors are diverse from the pressurizer pressure sensors used by the SPS in manufacturer (ITT Barton devices with 24 VDC Foxboro power supply for the AFAS vs Rosemount devices which utilize 39 VDC power from a Hyperion multi-output power supply for the SPS), design principle (mechanical bellows / strain gauge transducer for the AFAS vs capacitance sensing element transducer for the SPS). Additionally, the steam generator level sensors used by the AFAS are diverse from the RTDs used by the RTS in manufacturer and design principle. The RTDs are manufactured by RdF utilize resistance to current converters (and a wheatstone bridge principle) manufactured by Foxboro. Thus, the AFAS steam generator level sensors are both diverse from the RTDs which provide input to the CPCs and from the pressurizer pressure sensors used by the SPS.
The second level of componer,ts in the trip path are the bistables. The bistables used by the AFAS are diverse in manufacturer from the SPS bistables (Electro- Mechanics (E-M) number 33441 with a 12 VDC Todd power supply for the I t
AFAS vs Simmonds Precision comparator module, model number 104-13-D10419, j which takes 15 VDC power from a Hyperion multi-output power supply for the f SPS) and design details. The bistables used by the AFAS are also diverse in design principle and manufacturer from the CPC bistables, as the CPCs use f digital devices made by Gould-Systems Engineers Laboratory. Therefore, the I AFAS steam generator level bistables are diverse from the SPS bistables and the RTS CPC bistables.
4 a 1
i The third and fourth- levels of components in the trip path are the bistable relays and matrix relays respectively. The SPS does not use either bistable I or' matrix relavs. Also, the logic for the SPS is different from that of the AFAS trip path in that the SPS does not utilize a two out of four coincidence l logic network. The SPS logic circuitry, which is manufactured by Simmonds Precision, actuates in a selective two out of four configuration directly from the bistable output to the SPS initiation relays. Thus, a common mode failure of either the AFAS bistable or matrix relays, which are manufactured by E-M, could not also impact the SPS. The bistable relays used by the AFAS are identical to those used by the CPC, SGLL, and HPP trips and do not satisfy the ,
Staff's criteria (provided in Section 2 of Reference 2) for component diversity. However, additional protection against a common mode failure that 4 disables both the RTS and AFAS is provided through the nature of the system design. C-E contends that this additional protection, described in Section 4, exceeds the requirements of the ATWS Rule.
The fifth level of components in the trip path are the initiation relays. The initiation relays used by the AFAS are diverse from the SPS initiation relays in manufacturer (Potter and Brumfield model number KR3-DH12 with a Todd 12 VDC
. power supply for the AFAS vs Leach model number 9207-8053 which take 24 VDC power from a Hyperion multi-output power supply for the SPS). This diversity alone is adequate to satisfy the Staff's criteria for diversity.
The initiation relays used by the AFAS are not diverse from the initiation relays used by the CPC, SGLL, and HPP trips, however their design does provide protection against the potential for common mode failures to occur in both the AFAS and RTS. Specifically, they are of diverse construction, as the AFAS uses heavy duty relays while the CPC, SGLL, and HPP trips use Potter and Brumfield KA11DG general duty relays. Table 3 summarizes the design l
characteristics of these initiation relays. It shows that they differ in manufacturer model, construction material, breakdown voltage rating, insulation resistance, and contact rating.
l The sixth level of components in the trip path are the actuation devices. In order to comply with paragraph (c) (2) of 10 CFR 50.62, PVNGS 1, 2, and 3, l will. add control grade circuitry to allow two SPLAs to trip the CEDM motor-generator output load contactors. This circuitry, with appropriate isolation, will be diverse and independent.from the RPS actuation of the reactor. trip breakers. All four SPLAs will' continue to trip the reactor trip j
breakers. The isolation devices will maintain the current reliability of the SPS as a safety grade system. The actuation devices used by the AFAS are diverse from:the actuation devices used by the SPS, CPC, HPP, and SGLL trips.
The AFAS uses electromechanical rotary relays with multiple contacts, model numbers MDR-7032, MDR-7033, MDR-7034, MDR-136-1, manufactured by Potter-Brumfield. The AFAS uses auctioneered 36 VDC power supplies manufactured by Power Mate. The SPS, CPC, HPP, and SGLL trips' actuation devices are mechanical circuit breakers manufactured by General Electric, model number AK-2-25, and Westinghouse, model number DS206. These are 125 !
volt devices powered by 125 VDC power supplies. Both the AFAS and SPS, CPC, HPP, and SGLL trips' actuation devices are deenergize to trip. In addition, the SPS, CPC, HPP, and SGLL trips actuation devices have a redundant energize to trip feature, (the shunt trip coils). Thus, the AFAS actuation devices have additional diversity from the TcTS.
1 i
i I
l I
3.2 DIVERSITY OF THE WNP 3 AFAS COMPONENTS (Figure 2 and Table 2)
The first components in the trip path are sensors. The existing RTS sensors which' measure parameters indicative of an ATWS include the Resistance Temperature Detectors (RTDs), pressurizer pressure sensors, and steam generator level-(SGL) sensors. The RTDs provide core inlet temperature input to the CPCs. In the original design, the AFAS steam generator level sensors were variable reluctance devices manufactured by C-E with a combination of C-E and Foxboro signal conditioning circuitry. Although there is some uncertainty regarding the replacements, they will probably be similar to or the same as the mechanical bellows / strain gage devices used by the PVNGS AFAS. These would be diverse from the pressurizer pressure sensors used by the SPS and the RTDs used by the RTS in manufacturer and design priciple. The SPS uses Rosemount capacitance sensing element transducers which utilize 39 VDC power from a Hyperion multi-output power supply. The RTDs, are manufactured by RdF and utilize resistance to current converters (and a wheatstone Bridge principle) manufactured by Foxboro. Since the CPC's RTDs and SPS pressurizer pressure sensors are diverse from one another. SGL sensors used by the AFAS would be diverse from at least one of these trip paths. Thus, the AFAS steam generator level sensors are diverse.
The second level of components in the trip path are the bistables. The bistables used by the AFAS are diverse in manufacturer from the SPS bistables (Electro- Mechanics (E-M) number 33441 with a 12 VDC Todd power supply for the AFAS vs Simmonds Precision comparator module, model number 104-13-010419, which takes 15 VDC power from a Hyperion multi-output power supply for the SPS) and design details. The bistables used by the AFAS are also diverse in design principle and manufacturer from the CPC bistables, as the CPCs use digital devices made by Gould-Systems Engineers Laboratory. Thus, the AFAS
, steam generator level bistables are diverse from the RTS CPC bistables, l
[ , -___- _-_-____ -
l l The third and fourth levels of components in the trip path are the bistable l relays and matrix relays respectively. The SPS does not use either bistable or matrix relays. Also, the logic for the SPS is different from that of the AFAS trip path in that the SPS does not utilize a two out of four coincidence logic network. The SPS logic circuitry, which is manufactured by Simmonds Precision, actuates in a selective two out of four configuration directly from the bistable output to the SPS initiation relays. Thus, a common mode failure of either the AFAS bistable or matrix relays, which are manufactured by E-M, could not also impact the SPS. The bistable relays used by the AFAS are identical to those used by the CPC, SGLL, and HPP trips and do not saticfy the Staff's criteria (provided in Section 2 of Reference 2) for component diversity. However, additional protection against a common mode failure that disables both the RTS and AFAS is provided through the nature of the system design. C-E contends that this additional protection, described in Section 4, exceeds the requirements of the ATWS Rule.
The fifth components in the trip path are the initiation relays. The initiation relays used by the AFAS are diverse from the SPS initiation relays in manufacturer (Potter and Brumfield model number KR3-DH12 with a Todd 12 VDC power supply for the AFAS vs Leach model number 9207-8053 which uses 24 VDC power from a Hperion multi-output power supply for the SPS). This diversity alone is adequate to satisfy the Staff's criteria for diversity. The initiation relays used by the AFAS are not diverse from the initiation relays used by the CPC, SGLL, and HPP trips, however their design does provide I protection against the potential for common mode failures to occure in both the AFAS and RTS. Specifically, they are of diverse construction, as the AFAS ,
1 uses heavy duty relays while the CPC, SGLL, and HPP trips use general duty relays. Table 3 summarizes the desing characteristics of these initiation relays. It shows that they differ in manufacturer model, construction material, breakdown voltage rating, insulation resistance, and contact rating.
The sixth components in.the trip path-are the actuation devices. In order to comply with paragraph (c) (2) of 10 CFR 50.62, WNP3 will add control grade
. circuitry to allow two SPLAs to trip the CEDM motor generator output load.
contactors. This circuitry will, with appropriate isolation, wil1~be diverse and independent from the RPS actuation of the reactor trip breakers. All-four SPLAs will continue to trip the reactor trip breakers. The isolation devices will maintain the current reliability of the SPS as a safety grade system.
The actuation devices used by the AFAS are diverse frc 1 the actuation devices used by the SPS, CPC, HPP, and SGLL trips. The AFAS uses electromechanical rotary relays with multiple contacts, model numbers MDR-7032, MDR-7033, MDR-7034, MDR-136-1, manufactured by Potter-Brumfield. The AFAS uses auctioneered 36 VDC power supplies manufactured by Power Mate. The SPS, CPC,
-HPP, and SGLL trips' actuation devices are mechanical circuit breakers manufactured by General Electric, model number AK-2-25, and Westinghouse, model number DS206. These are 125 volt devices powered by 125 VDC power supplies. Both the.AFAS and SPS, CPC, HPP, and SGLL trips' actuation devices are deenergize to trip. In addition, the SPS, CPC, HPP, and SGLL trips-actuation devices have a redundant energize to trip feature, (the shunt trip coils). Thus, the AFAS actuation devices have additional diversity from the RTS.
i
i 4.0 OTHER CONSIDERATIONS IN EVALUATION OF AFAS DIVERSITY l
i The System 80 design includes features which exceed the requirements of the ATWS rule. The design is not vulnerable to a common mode failure which could disable the AFAS and the four redundant RTS trip paths. Consider the AFAS bistable relays and matrix relays. A common mode failure of these relays,
.could not disable the SPS, as the SPS does not utilize bistable or matrix relays. 'These features alone are adequate to comply the ATWS rule requirements. ;
Additionally, the System 80 design includes features that minimize the
' potential for common mode failures that could disable both the AFAS and the CPC,-HPP, and SGLL trip paths. Common mode. failures can be categorized into j three classes: (1) those due to a common manufacturing defect, (2) those due to an external fault that causes multiple failures of like components, and (3) those due to common operating history. The bistable and matrix relays have not exhibited failures due to a common manufacturing defect. Relays of this type have been used for a number of years in C-E plants with only isolated random failures of individual relays. A failure as a result of an external fault or a common operating history is considered to be a very low probability since a large number of components performing separate functions would have to fail simultaneously in several channels. This is discussed in detail below.
q The CPC, HPP, and SGLL trip phths and the AFAS function each have four channels, and each channel has three bistable relays. T1us, there are 48 ,
bistable relays that are of interest. A trip of any bistable relay causes a trip in its associated coincidence logic matrix. Since the PPS uses a two-out-of-four coincidence logic, a minimum of 24 out of 48 bistable relays would have to simultaneously fail in the no trip state to prevent both a reactor trip in these three trip functions and actuation of the Auxiliary Feedwater System. As many as 44 out of 48 bistable relays could ,
simultaneously fail in the no trip state without preventing either a reactor trip in these three RTS functions or actuation of the Auxiliary Feedwater i System. In either case, the SPS would be available to trip the reactor.
l There are six matrices associated with the RTS and' twelve matrices associated-with the AFAS function. Since each matrix has four relays, there are a total of 72 matrix relays of that are considered in evaluating the impacts of postualted common mode failures. A minimum of 12 out of 24 RTS matrix relays and 12 out of 48 AFAS matrix relays would have to simultaneously fail in the 1
no trip state to prevent both a reactor trip in these three trip functions and i
actuation of the Auxiliary Feedwater System. As many as 22 out of 24 RTS matrix relays and 40 out of 48 AFAS matrix relays could simultaneously fail in the no trip state without preventing either a reactor trip in these three trip functions or actuation of the Auxiliary Feedwater System. In either case, the SPS again would be available to trip the reactor.
L . _ _ _ _ _ _ _ . . _ _ _ - _ _ - _ - _ _ - _ _ _ _ _ _ _
- f. i I
i 1
5.0 INDEPENDENCE OF POWER SUPPLIES paragraph (c) (1) of the 10 CFR 50.62 requires that the ATWS Rule equipment.be diverse and independent of the existing reactor trip system from sensor output to final actuation devices. As stated on page 2 of Enclosure A of SECY-83-293, Reference (4), the reactor trip system includes power sources.
Page 21 of Reference (2), however, states that power supply diversity is not required. Reference (2) further states, " Power supply independence is required such that faults within the AFWS diverse actuation circuitry can not degrade the reliability / integrity of the existing RTS below an acceptable level, and that a ' common mode failure mechanism affecting the RTS power distribution system (including degraded voltage conditions such as overvoltage I
and undervoltage) can not compromise both the RTS and AFWS diverse actuation functions."
As was stated in Section 3.0 of this report, the AFAS is electrically independent from the SPS. This design feature provides protection against common mode failures due to the failure of power supplies, and is adequate to satisfy the ATWS rule requirements for electrical independence.
The design of PVNGS 1, 2, and 3, and WNP 3 includes features to ensure that a common mode failure mechanism can not cause the simultaneous failure of the CPC, HPP, and SGLL trip functions to trip the reactor and failure of the AFAS function to actuate. Failure mechanisms can be overvoltage, undervoltage, or zero voltage. All of power supplies used by these functions have two components that are independent of one another. One component provides power while the other provides overvoltage protection. In order for a overvoltage condition to cause the failure of CPC, HPP, and SGLL trip functions to trip the reactor and the failure of the AFAS function to actuate, the simultaneous occurrence of two different types of common mode failures; one failing the overvoltage protection and the other causing an overvoltage condition on the same circuits, would be required. An undervoltage condition which fails a component in one of these functions would result in that component failing in the tripped state. Similiarly, a zero voltage condition would cause the affected components to fail in the tripped state.
.: a ,
6.0 OVERALL DIVERSITY CONCLUSIONS As shown in Tables 1 and 2 all major components in the AFAS are diverse from the RTS for each plant.
The System 80 design includes features which exceed the requirements of the-ATWS rule. The diversity of the AFAS from the SPS portion of the RTS.is sufficient to satisfy the requirements of the rule. The RTS includes three additional distinct trip paths for parameters indicative of an ATWS. These are the CPC, SGLL, and HPP trips. As detailed in Section 4, only the simultaneous failure of a large number of bistable relays or matrix relays in different functions and physically separate channels, could possibly prevent a reactor trip in these additional three paths and automatic actuation of the Auxiliary Feedwater System. In any case the SPS would still be available to trip the plant. Therefore, is is C-E's contention that the existing level of diversity of the AFAS from the RTS for PVNGS 1, 2 and 3, and WNP 3 exceeds the ATWS Rule requirements.
..< u :,
7.0 REFERENCES
- 1. CEN-315, Summary of ~ the Diversity Between the Reactor Trip System and the Auxiliary Feedwater Actuation System for C-E Plants", September,
'1985.
- 2. D. M. Crutchfield (NRC) to R. W. Wells (CEOG), "NRC Staff Evaluation of CEN-315, Summary of the Diversity Between the Reactor Trip-System and the Auxiliary Feedwc.ter Actuation System", August 4,1986.
- 3. . A. E,. Scherer(C-E) to F. J. Miraglia (NRC), "CESSAR Compliance with the ATWS Rule (10CFR50.62), LD-87-012, dated February 27, 1987.
- 4. 'W. R. Dirks, NRC Staff, to the Commissioners, " Amendments to 10 CFR 50 Related to. Anticipated Transient Without Scram (ATWS) Events",
SECY-83-293, dated July 19, 1983.
i 1
s eo t t e ot L a c e d L tl d i r ,tu G sae v a np S ci e ipif d s ot d ni e i u n rad g l so a th o i
n b a ice ,
oe cm 3 s t el P t mr n s rb P b 8 e i P a H ee s b t zrl
, ss '.
ig al e C 2 c .CP di nb P r ee
,iw noC o C 1
ar me e nsS t o; mh euP S ib n it h .eoS G N -
cxo S T sdh ge N TYO e e e e e aoi e - c V NT I s s s s s s pF s yh
.ih nh P EI S r r r r r r a i bt ttit NSU e e e e e e cyc ssit v v v v v v b e d m yi ws ,
T ORL e r eo ar ey A PEC i i i rr esWl MVN D D iD iD D iD rdP let y M DI O ae uf l E CDC rs t rcad a sud cy al nn T rt n al h reao S car Y oco f t i S sam uc ah Et nf m ne ecyGi P eui ar L r d I snS mi l a yd R a d CatbA S my s T
e ) I ) I ) P b i n .DVi rd co R l 2 3 3 5 S s hip oS 4tlr rr. e O np I ( I ( I ( ed T gi e e e e e e ece cts 2 caue C ic s s s s s s hi r i a ect w A sn r r r r r r t vu h resl i co wuh eenap
'E ei e e e e a e et R D r v v v v v v ;d c gt s af P i i i i i i n a ,i udh uC E D D D D D D oef yf m ncnD H t gu rnoS aeaV T rd n t orP mm 5 M
C s e e 3 I )
3 e e Eaiab rm icu -cfS r e' no ot e2 eicr1 O s y s rusht ea R D re - s '
s I ( s y F ec t r t r e e t r t r b ei ort cl swr oe oe s s oe oe n icf e uehb Y vou N v r r v N v d oe - v r c T P o i N iv e e N i esl cfi .t eir C S D D v v D iD rt u odd srh e I
S A i uad ig- l naww o R
E V
D iD t eo ch m aw r ot eeo , s l uric oaf d
,p I A f S - mnl es D I uh o P osuiecu I ntt S wyr iit R d s t aBSf va M E eu e ) I aia E T d zt e s 3 e s
I e
mwr a e h eedF ud s l A met T I e ia s r ( I Y R z gt t r t e e e t r s sF p T vr nE r S C i srS oe ov s s oe r ed m i a B np x e- oi N Y gve r np N v i
Ni D
r e
r e N i v e v icR vy oc .t cirh ri r O T e ei D v v D Mer et ett n - r i iD ebS - tt t a I
T I
S E eT D iD d dS P E smooottleat mt s uo .
A R D ee y P rP c r U E gr; b ad f aeo T V ny - y zt C I a uM A D gt - d nab rbLi c cE ei e L ga r
R E
l a ina aub f y usl ef eS en t eb rir edfdG rt no T c rn ct aud ud ec A i aatt t n e W n c ) I I t ad D a i s e 2 3 3 e s
e s
sme r .futiusct aaa cadd a
E h ne s ( I I / ,r o E c .oc t r e e e t r t r seu) ncbfhf F esri oe s s s oe oe wrtL aa ut uP ol r r r N v S n nP Y
mvt o
v c e N v e e e N v i i loacE aS m't A asaH et zu R r eD iD v v v D D l sf( eiF mym A t l i i eD u r E a ,i p iD bT nd ae sl eC gt I c E D D R al seyerP r u L e I l musuh arac eo X lE aS cT sGac oyatl eCh
,net U ,rD cS e A iR e l e n cyebh ViPt s aeib r cC hS n E hh v suD2 w a r H r '
ct ed x ysV1 ed o T e I ) I I I e d eia ,h nt r I 2 # m; r rl s2 ysT ua F u I ( I I I t gut eA1 t e d r O t e e e Ies e e enot ar uc ee c s s s s s r ul cm ydi .r n Y a r r r r r r aoaa x .t v s e
_ R f e e e e e e mnfdi sul eeh g s e a u n r yd ad ct A u v v v v M n i iv iv rs nat a al yenv wo r ii r M a D D D iD iD iD ooea t
- U M sR r memev noe
_ S n ey a l raeid so egt . r m sb r
- sb seaonh aC e
_ ect o euDkM
_ 1 Ldl i seiestV aD y e G eb vil t suc eE E a S raebb au a8 rC L T y l ic utd ai s 2b e
B N a e v St ; SttS nS A E l y R e Acil A siA oA eth T N e a D F ab aFi nFiF sit O R l n Ef tEbiEtE uu cp P e o n uSi c M e e R io enA gees ened ri O s l it h aFi h sPh uh ni r C r b lb x a t : T mEdT uSTfT act
- o a a i a s
- S s t t r it u e ) )
- A n is is t t t ) ) )
_ F e a in c o 1 2 3 4 5
_ E S B B M i A N ( ( ( ( (
j I{a
u o
_ t t
_ s t t
_ L a l y ab e
r ib L G
tld sae c a e S ci d sS pif ine s uP d ni ar h u e
t S n a
irad tho ct lb oe cm ec a nh ,
oe ma f t
s s t P P
t me b
eu i eo H ee b n b ot z rl a d ,
al ym C ,tu C ig
,i P P r w lbae s C h p ct C ee nsS b c ;
au e euP 3 oi n eo h . eoS N rv o L T sdh P TYO e e e e e pe i e c ge N NT I s s s s s s s yl h nh W EI S r r r r r r l d bb .ittit NSU e e e e e e l g ic a ssit ,
T ORL v v v v v v n e dt yi ws A PEC i i i i iwi r es ar ey MVN iD D D D D iD s P ri letesWl y M OI O sn ub l E CDC t e s t r cada T ns
.dn ce al nn S e ah h reao Y meoo f t c ar i S ecrm u ah Et cnom n e e c yGi P aabi ah L r d I t xS mt l a yd R lpi o C atbA ecF y Dco T
e I } ) I I ) ra b ismo Vi rd R l I 2 3 3 4 5 py r r e O np ( I I ( eabd hf 4 tl rr.
Ie Ie e e e e r c c 2caue re i y T gi C c s s s s s s e d ect w A isn r r r r r r h eeu hl S sl i co E ei e e e e e e T r rt wtP eenap R D r v v v v v v auc ,c$ s af P i i i t a e udh uC E iD D iD iD D D .scf yre ncnD H E rau rihS aeaV T - of n t dtP mm 5 C sua i S no M
D C - s e e I
e e yca nnm unm cooeicr1 ot e2 R D re s s I I s s b sms rirht ea F ec t r t r e e t r t r i itfT cl y swr vou o e
- o. v e s r
s r
oe oe dS s ca re r uehb c
Y N N v N v eP ee T P o iv t i e e i i cus .t eir I C S D D v v D D rS u iclu i grd srh e S A i t evd gi el na ww R iD D ch eo ofniicveo , o E aTd m l ,p V f odf d s I A u n .
er go S c mnl es D I P euiecu R d s ) asdt S r r r iit M E eu e I ) 5 mti a uaBSf va E T d izta e s 3 e ( nrr eo A met T I e s r I s e sab a hf sdF uds Y R z gt t r to ve Ies e s
t r oe s
r el p T - ynE r S C igvesrS oe icpem f aa B np N v Ni r r N v e no e- oi N Y r np i D e e i v vd oc . -ol erh rir O T e ei D v v D ees Mt ret ett I I n - r i iD d ntS - u t t a T S i eT D iD gap E oxt mt uo .
A R J eieS - i ooott s U E csh yorP rP c r T V n e w; b wt f y
aeo C I ad M t ay zt A D t h - d mb rbLi c cEtE ee e L ga R l u - i r vddfdGrt E a l C wy uinef eS en T c e b tt a ri r n o A rff cc ud udec W in c ) I I odd aeet t ne D a i s e 2 3 e e e R e ct c add E h ne s ( I I s s l r .fl ueb aaal ,ro a E c oc t r e e e t r t r b layu) nsafhf F oe s s s oe oe acbtL a t ut uP ol esr mvt iv N i v r r r N v N v i r ipd cE aSmasn nP Y o ce e e e i i asaHet R r eD D v v v iD D a yef( enb mym ,izu p A t l i i i vt r u ri a I c E D D D und a S sl eCgt L e yet al sA yerP r u I l r cmuseF a raCeo X
U lE l aa a f sG aa oytEl eCh
,n et A nt ue l uerD cS e ancyeth igh aib rct C ViPt hS n s
E it mv a D2 w ar H r r ed x ,V1 ed o T e ) I ) I ) osed eith ,h nt r 2 3 4 5 er rric2 ysT ua F u ( ( I ( I ( ecagut u1 t e d r O t e e e e e e ri ot aes uc ee c s s s s s s evsl cms ydi .r n Y a r r r r r r weDaa ust vs e R f e e e e e e dT nf d aA ul eeh g A u v v v v v v s R aunc ct M n i i i r e nae dyenvwo rad ii r M a D iD D iD D iD o gC e a U M sap r me n gC a bsyaeid
- s. v noe so t
S l e sb yaegt rm sneseaal h ace i h ectl e euDk M 2 L atl i ser estV aD y e G r b vi r s uc eE E a c St ;aeb nu a8rC L T y l i stt d x o s 2b B N a e v S/ns SiiS nS e A E l y R e A s uil A rtA oA eth T N e a D F wob aft aFiF sit O R n E om tE aiEtE uu P le o n l eSi mt c cp M e e R i o el sA ge i ened ri O s l l t h eoFih rnh uh ni r C r b b x a it : TbREdT oiT fT act o a a i a s S s t t r it u e A n s t i t t ) ) ) ) )
F e is i a n c o 1 2 3 4 5 E S B B M I A N ( ( ( ( (
hw' r
I TABLE 3 l'
SUMMARY
OF AFAS AND CPC, HPP AND SGLL TRIP INITIATION ROTARY RELAYS DESIGN PARAMETER AFAS CPC, HPP, AND SGLL KR3 (Heavy Duty) KA (General Duty) !
Series Input Voltage 12 VDC 12 VDC Insulation Material Laminated Phenolic Molded Phenolic Insulation Resistance 1000 100 6
(ohm x 10 )
Coil Current (amps) 0.100 0.100 DC Coil Resistance (ohm) 120 120 UL Contact Rating (amps) 20 at 120 VAC 10 at 120 VAC Breakdown Voltage 500 at 60 Hz 1500 at 60 Hz j (VAC RMS between all elements)
)
i
ETY TR I DSUC 3 CI R S,ACCI XEYT R AC UESCI
_ 2
, C S 1 I R
_ S R5E S S E R E T2K Y T C O S6C - AT A I I RRTT2 U0E2ENL D L
_ N V OOUC O2L - RUI ND 1E U E TTP AE HSEKBHO AL234 - R D OAT TT GD A SC E3336 N MRU NO N L T RI 0003Y
_ O N EO ON ! LALI &P EF7 7 7 1 R O MN C T EREU T M - - - - A SDEDCVRI I
T I DET E T URRRRT A T EGE DE E ONORUT ORDDUOO T A U
C S AS WMEMI PBMMMMR S O G C T L G C N A TI
. A R
E N
E G
_ D D p R S L L L i A Y E A E L r E A GC I A t C
L L E
IFDI M1 N F2C C
U R M1 I P U1 A UHN N RAH RDA C N # 5 BKC B - HY E O 0 EY 3CA d D I HL8 Y D MA DREL n R T CE - A NL - L NKME a E A AD7 L AEOE A - R V I EO0 E DRR LO P T LM2 R ROT RER P O I 9 EMC EDT H N
L T E T OC A I T L T ME e P O E O L h P P E t R
O o F t Y
R T
- n o
m I
U
'S
_ o m
C c R Y D D D I A Y R L Y R E Y RE e C L S O E S O E S OE r E S5T RS S 5T RS S5T RS a N R MA3S - Y MA 3S - Y MA3S - Y O - 3I RA - 3I RA - 3I RA s I X EL3S EL EL 3SE L EL 3SEL r T I E3N E 3NVE E 3NVE o A R D A R D AI R D AI R s U T A
O R RIVE O RR O RR n T M T D M TD M T D e C M l s A
e R r E u T s A s W e D r E Y p E A D D D F L Y R E Y RE Y RE r E S O E S OE S OE e Y R S5T RY S 5T RY S5T RY z R MA3S - A MA 3S - A MA3S - A i A E - 3I RL - 3I RL - 3I RL r I L EL3SEE EL3SEE EL3SE E u L B E3NVR E3NVR E3NVR s I A D AI D AI D AI s n X T O RR O RR O R R e o U S M T D M T D M TD r i A I p t B
G e n N h I : T f T S S E I )
T X 9 O 1 E 1 N (
NR 4 R Y R Y R E E SOO #0 EO S EO S EO H L DI T E 1 D)GT S1 L T S1 L T T B NSALL D L L AA MA4 BA MA4BA A OI RUE - UE T R - 4AR - 4AR F T MCADD3 OS LA EL3TA EL3T A O S I IMERMMMP OO1-G(OP VM E3SP D I M E 3SP D I M Y B SPO 4 O O BO O BO T C 0 C M C I 1 M C S
R E
V I
D l
1 E E R E R E E E E 1 E E UT C U BT R / N B S L G R SNNGT S UEU w O E USE L A/A U R SUANN SNT LT OT RNT WT E NCSG G O EOT I E CEO NAORSE ZUO OO VOI W I S RMI SM PRT NI RT OT G RST NL N F N E T N0N PECNE CPRU ERBAD PSROL 1 RA1 I E SAE L ADE P X EI E ADE E S ZOPSE AHL A ZBRR MfOHR RBRBE GBCE R RRA R OOE dFWB P U/S S E BT P C P BCT R B M S a
$L'
- l l
STR CI AC XEYTR AC UESCI AF AC C S 5 I R R R5E S E R T O2 E T2K Y ORUT S6C - AT A IC T OPC E U0E2ENL D L V OI TA T O2L - RUI ND 1 E 3 E MAUT O H5EKBHO AL234 - R D RON N G0 A SC E3336 T ME O N L T RI 0003Y C N DNTC E I LALI &P EF77 7 1 R E O EEE TEREU T M - - - - A J
O I
T CGSD S A
E SDEDCVRI EONORUT TURRRRT ORDDDDO R A O WMEMI PBMMMMR P U L G C T
R C A A E
L ly C b U a N b p
N O o r he i p T r T D D t G S L L L N Y E A E L l l . C I A I GC I A i S P H L FDI F2C S E M1 N M1 I w G C A R U1 A UHN N W 3 RAH RDA s V d N # 5 BKC B - HY r P n R O 0 EY 3CA o a O I HL8Y D MA DREL s )
F T CE - A NL - L NKME n b P A AD7 L AEOE A - R e P Y ! EO0E DRR LO s d H R T LM2R ROT RER e T I 9 EMC EDT l s e I N T E T OC e u h U I T L T ME v t C O E O L e s R P P E l r o I o t C r s o n n N t e o O a s m I r m T e n o n o c A
U T S
_ e t g r e C Y D D D a b A A Y RE Y RE Y RE m B L S OE S OE S OE a l R E S5TR S S5 TRS S5TRS e e l E R MA3S - Y MA3 S - Y MA3S - Y t h i T - 3I R A - 3 I RA - 3I RA s t w A X EL3SE L EL3 SEL EL3SEL d s s W I E3NV E E3 NVE E3NVE D R D AI R D AI R D AI R n a r E T O RR O RR O RR a o E A M TD M TD M TD e s F M e m n r a e Y u s s R s A s e e I e h r L r t u I
p s X r s U Y r o e A A D D D e r L Y RE Y RE Y RE z o p G E S OE S OE S OE i t N R S5TR Y S5T RY S5T RY r r I MA3S - A MA3S - A MA3S - A u r e T E - 3I RL - 3I RL - 3I RL s s a iz l
S L EL3SEE EL3SE E EL3SE E r I B E3NVR E3NVR E3NVR e i u X A D AI D AI D AI r m p i s t E T O RR O RR O RR s s c S M TD M TD M TD e e E I H B h e rp u T : T b S
F E T )
O O 1 Y N (
T 9 I 1 S NR 4 R Y R Y R R E SOO #0 EO S EO S EO E L DI T E 1 D)GT S1 LT S1 LT V B NSALL0 L LAA MA4BA MA4BA I A OI RUE - UETR - 4AR - 4AR D T S NCADD3 F EPOO1 OS LA G(OP EL3TA E3SP EL3T A E3SP I I RMMM - VM D I M D I M
- B SPO 4 O O BO O BO 2 C 0 C M C M C 1
E R
_ U G
I F
L E R E R E E E UTC U BT R N S SNNGT S UEU O E L R SUANN SNTL TDOT R 1 E 1 O EOTI E CEO NATRSE ZUE VE S RMI SM PRTNI RROTG RSEE EEE N PECNE E BAD PSST LST E
S SAEL . CPRU ADEPI XlI E O O ZOPSE ZBRRMdOHR R N G N RRA R OOERFWB P S P C P BCT I
5 Di O
'