ML20235V115
| ML20235V115 | |
| Person / Time | |
|---|---|
| Site: | Arkansas Nuclear  |
| Issue date: | 02/23/1989 |
| From: | Craig Harbuck Office of Nuclear Reactor Regulation |
| To: | Tison Campbell ARKANSAS POWER & LIGHT CO. |
| References | |
| TAC-62122, NUDOCS 8903100044 | |
| Download: ML20235V115 (15) | |
Text
_
/
'o,,,
UNITED STATES 8
NUCLEAR REGULATORY COMMISSION o
g
.g wAssiwcTow. o. c.zosss
/
February 23, 1989
)
Docket No. 50-313
]
Mr. T. Gene Campbell Vice President, Nuclear Operations Arkansas Power & Light Company Post Office Box 551 Little Rock, Arkansas 72203
Dear Mr. Campbell:
SUBJECT:
ARKANSAS tlVCLEAR ONE, UNIT 1, PROPOS':D PLANT MODIFICATIONS TO MEET THE REQUIREMENTS OF 10 CFR 50.62 (ATWS RULE) - REQUEST FOR ADDITIONAL INFORMATION (TAC NO. 62122)
The staff has completed its review of your proposed plant modifications to meet the requirements of the ATWS Rule. Based on this review, the staff has concluded that most aspects of the conceptual design appear to be adequate. However,-
additional information is necessary to substantiate the staff's understanding of the conceptual design and resolve all issues. Therefore, in order for the staff to complete its review, please respond in writing to the enclosed request for information within 60 days of the receipt of this letter.
By letter dated September 21, 1988, I forwarded to you a summary of the August 17, 1988 meeting between the staff and the Babcock & Wilcox (B&W) ATWS owners group regarding the staff's generic B&W ATWS SER.
In that letter I stated that you should install, upon receipt of our approval of your conceptual ATWS design, the required ATWS equipment during Unit l's next refueling outage. Since you had just begun Unit l's eighth refueling outage, (IR8), this apparently implied a schedular extension to the fourth refueling outage after the ATWS rule issuance, which for Unit 1 is IR9. This was not the staff's intention.
However, since the staff has now essentially approved your conceptual ATWS design, except as noted in the enclosure, we expect you to complete your ATWS design modifications during IR9 (Spring 1990).
If you cannot meet this schedule, you must formally request a schedular exemption from 10 CFR 50.62.
O I \\
h0"AS8$#!s888g3 PDb l
1
____________________--_-_._-_____________-____-_-___._-__.__m_-_._
~
Mr..T.-Gene Campbell The reporting and/or recordkeeping requirements contained'in this letter affect fewer than ten respondents; therefore, OMB clearance is not required under P.L.96-511.
Sincerely,
/s >
C. Craig.Harbuck, Project Manager Project Directorate - IV Division of Reactor Projects - III, IV, Y and Special Projects Office of Nuclear Reactor Regulation
Enclosure:
As stated cc w/ enclosure:
See next page DISTRIBUTION Docket File PD4 Reading NRC PDR Local PDR JCalvo LRubenstein PNoonan CHarbuck OGC EJordan BGrimes ACRS (10)
PD4 Plant File l
PD4/L.
PD4/PM[V;[
PD4/D/
PNoon' CHarbuck:sr JChlvo 02g/89 02/23/89 02/23/89
4 Mr'. T. Gene Campbell
- The reporting and/or recordkeeping requirements contained in this letter affect fewer than ten respondents; therefore, OMB clearance is not required under P.L.96-511.
Sincerely, f
C. Craig Ha buck, Project Manager Project Directorate - IV Division of Reactor Projects - III, IV, V and Special Projects Office of Nuclear Reactor Regulation
Enclosure:
As stated cc w/ enclosure:
See next page
i e -
Mr. T. Gene Campbell Arkansas Power & Light Company-Arkansas Nuclear One, Unit I cc:
Mr. Dan R. Howard, Manager Licensing Arkansas Nuclear One P. O. Box 608 Russellville,. Arkansas 72801 Mr. Jemes M. Levine, Executive Director Nuclear Operations Arkansas Nuclear One P. O. Box 608 Russellville, Arkansas 72801 Mr. Nicholas S. Reynolds Bishop, Cook, Purcell & Reynolds 1400 L Street, N.W.
Washington, D.C.
20005-3502 Mr. Robert B. Borsum Babcock & Wilcox Nuclear Power Generation Division 1700 Rockville Pike, Suite 525 Rockville, Maryland 20852 Resident Inspector U.S. Nuclear Regulatory Commission 1 Nuclear Plant Road Russellville, Arkansas 72801 Regional Administrator, Region IV U.S. Nuclear Regulatory Commission Office of Executive Director for Operations 611 Pyan Plaza Drive, Suite 1000 Arlington, Texas 76011 Honorable William Abernathy County Judge of Pope County Pope County Courthouse Russellville, Arkansas 72801 Ms. Greta Dicus, Director Division of Environmental Health Protection i
Arkansas Department of Health 4815 West Me.rkam Street Little Rock, Arkansas 72201
ENCLOSURE 1
ARKANSAS NUCLEAR ONE. UNIT 1 10 CFR 50.62 (ATWS RULE)
REQUEST FOR ADDITIONAL INFORMATION Introduction and Discussion On July 26, 1984, the Code of Federal Regulations (CFR) was amended to include the ATWS Rule (Section 10 CFR 50.62, " Requirements for Reduction of Risk from AnticipatedTransientsWithoutScram[ATWS]EventsforLight-Water-Cooled NuclearPowerPlants"). An ATWS is an expected operational transient (such as loss of feedwater, loss of condenser vacuum', or loss of offsite power), which is accompanied by a failure of the reactor trip system to shut down the reactor. The ATWS Rule requires specific improvements in the design and operation of commercial nuclear power facilities to reduce the likelihood of failure to shut down the reactor following anticipated transients and to mitigate the consequences of an ATWS event.
Paragraph (c)(6) of the Rule requires that information sufficient to demonstrate compliance with the requirements of the Rule be submitted to the Director, Office of Nuclear Reactor Regulation. The ATWS Rule requirements forBabcockandWilcox(B&W)plantssuchasArkansasNuclearOne, Unit 1 (ANO-1), are to provide a diverse scram system (DSS) and diverse (from the existing reactor trip system) ATWS mitigation system actuation circuitry (AMSAC).
Based on review of the information provided with the Arkansas Power and Light Company (AP&L) letters dated October 9, 1985 and December 16, 1988 and of the information received during recent clarifying discussions, the staff has concluded that this request for additional information is needed to detemine fully whether the ANO-1 design complies with the ATWS Rule requirements of
hardware diversity, electrical independence, and reliability and testability at power. This infomation should include block diagrams showing DSS and AMSAC circuit components with a description of manufacturer, model, principle of operation (electro-mechanical, solid-state, etc.), mode of operation (e.g.,
energize or de-energize to trip, etc.), power supplies (e.g., AC or DC, operating voltages, etc.), and identification and location of all Class 1E/non-Class 1E system interfaces.
The principal function of the DSS at ANO-1 is to mitigate an ATWS event by tripping the reactor if, for any reason, the rods fail to drop in response to a reactor protection system (RPS) trip. The DSS must function to provide a reactor trip, diverse from the existing Reactor Trip System (RTS), for all ATWS transients that require a reactor trip (in addition to AMSAC actions) to prevent the potential for damage to, or over-pressurization of, the Reactor Coolant System (RCS).
The AMSAC must function to actuate emergency feedwater (EFW) and trip the turbine on ATWS transients, where required, to prevent serious RCS over-pressurization, to maintain fuel integrity, and to meet 10 CFR release requirements. Considerations for avoidance of inadvertent actuation dictate that there be at least two channels, powered from separate sources and coupled with appropriate coincidence capability. The ATWS transients of concern for the B&W Owners Group (BWOG) plants have been shown to be a loss of main feedwater (LMFW) and the loss of oftsite power (LOOP) leading to LMFW.
The following discussion and associated questions are applicable to the AP&L
" conceptual design" for the DSS and AMSAC at AND-1.
Diversity from the Existing RPS In accordance with B&W Document 47-1159091-00, the generic design requirements for DSS and AMSAC diversity are such that the " primary input signals will be diverse from existing protection systems from the sensor output." Also, the
logic " system shall be diverse from existing protection systems," except that "certain plant-specific configurations may require enabling signals and power supply interconnections with existing prctection systems." The output of the DSS"willdegateSCRs[ silicon-controlledrectifiers]usingrelaysdifferent from RPS SCR degate relays." The AMSAC " actuation devices will be shared with existing systems."
For the DSS, equipment diversity to the extent reasonable and practicable to minimize the potentici for comon cause (mode) failures is required from the sensors to, and including, the components used to interrupt control rod power. For the ANSAC, equipment diversity to the extent reasonable and practicable to minimize the potential for comon cause (mode) failures is required from the sensors to, but not including, the final cctuation device.
It is the staff's understanding that. AP&L's " conceptual design" for the DSS at ANO-1 will use the post-accident monitoring (PAM) system. Regulatory Guide (RG) 1.97, reactor coolant pressure transmitters with Foxboro Model Spec 200 signal cor.ditioning equipment; while the RPS reactor coolant pressure transmitters use Bailey Model 880 signal conditioning equipnent. Diversity of sensors is not required, and the use of Foxboro signal conditioning equipment for the DSS and Bailey signal conditioning equipment for the RPS appears to provide adequate diversity. AP&L's " conceptual design" does not indicate how i
diversity of the DSS logic and final actuation devices for interrupting power to the SCRs will be accomplished.
It is also the staff's understanding that AP&L's " conceptual design" for the AMSAC at ANO-1 will use the Gama Metrics (GM) RG 1.97 fission chambers for indication of reactor power levels and main feedwater flow signals from the Nonnuclear Instrumentation (NNI) cabinets to detect an 85% loss of main feedwater flow, while the RPS uses uncompensated ion chambers to detemine reactor power and does not use main feedwater flow as an input signal.
Therefore, diversity of the sensors and signal conditioning equipment appears to be adequate for the ANO-1 AMSAC " conceptual design." AP&L's " conceptual
1 design" indicates that the Emergency Feedwater Initiation and Control System (EFIC) will use the AMSAC outputs to provide the AMSAC coincidence logic and to initiate and control emergency feedwater and that EFIC may be used as a diverse final actuation device. The EFIC system does not constitute a final actuation device for use in AMSAC (i.e., the circuit breakers for emergency feedwater pumps and the motor contattors for emergency feedwater control valves represent the final actuation devices). EFIC may be used as part of the AMSAC design only if it can be demonstrated that the EFIC equipment is diverse from equipment used in the RPS. Therefore, the final plant-specific ANO-1 design provided by AP&L should address, in detail, how diversity is achieved between the AMSAC logic and the RPS.
Adequate diversity between the DSS /AMSAC and the RPS is best achieved by the use of components from different manufacturers / manufacturing processes, the use of mechanical versus electronic devices, AC versus DC equipment, or the use of equipment employing different principles of operation. Therefore, AP&L should consider these methods of detemining diversity when addressing the DSS logic ar.d final actuation devices and the logic and use of EFIC for the AMSAC cesign. This infumation should be included in the AP&L final plant-specific ANO-1 submittal in order for the staff to make a determination of compliance l
with tha ATWS Rule.
Electrical Independence from the Existing RPS In accordance with B&W Document 47-1159091-00, the generic design requirements for DSS and AMSAC electrical independence are such that "the system will be electrically independent from existing protection systenis, except for power supplies and certain enabling signals, which will be appropriately isolated."
Electrical independence of the DSS tYom the existing RTS should be provided from the sensor output up to, and including, the final actuation device.
Electrical independence of the AMSAC systems from the existing RTS should be provided from the sensor output up to, but not including, the final actuation device.
1 It is the staff's understanding that AP&L's " conceptual design" for the DSS /AMSAC at ANO-1 provides for power to be supplied to the ATWS circuitry from an existing non-1E 120 VAC instrumentation bus, which will be connected to either an uninterruptible power supply (UPS) or a DC battery supply. It is also the staff's understanding that the " conceptual design" for the Ah0-1 AKSAC ties the AMSAC to the EFIC system upstream of the final actuation device and that the EFIC and the RTS both share the same vital AC power. As described in the September 7,1988, letter from G. Holahan (NRC) to L. C. Stalter (BWOG), this design falls into Option 2.
The Option 2 criteria st6te that if EFIC is powered from 120 VAC RTS buses, then AP&L must identify all DSS and AMSAC system compenents at ANO-1 that receive power from the same sources used to provide power to the existing RTS.
Since RTS powe'r supplies will be used, AP&L has provided information to demonstrate that faults within the DSS or AMSAC circuits cannot degrade the reliability / integrity of the existing RTS. This information demonstrates that 4
it is highly unlik(ly that a common mode failure affecting the RTS power distribution system could compromise both the RTS and ATWS prevention / mitigation functions simultaneously.
Even though the Class IE to non-Class 1E isolators used in the DSS and AMSAC at ANO-1 have been previously reviewed and accepted by the staff for use in the PAM, EFIC, and GM equipment AP&L must make a determination that the new DSS /AMSAC applications are bounded by the previously documented testing and so state in the final ANO-1 plant-specific submittal.
Physical Separation from Existing RPS 1
In accordance with B&W Document 47-1159091-00, the generic design requirements for DSS and AMSAC are such that
- channel separatier. shall be provided in accordance with plant-specific requirements for routing non-safety signals."
To allcw the staff to detemine if this part of the Ah0-1 design complies with the current approved plant design requirements, specific details on component location and physical separation should be supplied in the plant-specific submittal.
/
Environmental Qualification'(EO), and Out;11ty Assurance (0A) for Testing, Maintenance, and Surveillance In accordance with B&W Document 47-1159091-00, the generic design twquirements for DSS and AMSAC are such that "equireent shall be cualified for a nonnal environment in accordance with plant-specific EQ program requirements; quality assurance measures are to be provided on a plant-specific basis equal to or better than the requirements promulgated by NRC's Generic QA guidance letter, GL 85-06."
It is the staff's understanding from the ANO-1 " conceptual design" that all ATWS equiptrent will be designed and qualified for a normal environment in accordance with ANO-1 plant-specific, nonsafety-related EQ program requirements and that the equipment will be operational for the anticipated operational environment in its location. Also, the staff understands that the
'ANO-1 Quality Assurance program encompasses the requirements of GL 85-06
" Quality Assurance Guidance for ATWS Equipment that is not Safety-Related."
The approach to the EQ and QA requirements identified above appears to be acceptable.
It should be noted that the EQ and QA programs will be audited periodically during NRC regional inspections to assure continued compliance.
During the life of comercial light-water-cooled nuclear power plants, many
, components reach their end of life and must be replaced, including components installed in the RTS, DSS, and AMSAC. In its plant-specific submittal, AP&L should provide a description of the measures / programs implemented for ANO-1 to assure that the equipment diversity provided in accordance with the ATWS Rule will be maintained during component repair, replacement, and modifications and/or design changes, etc. throughout the life of the plant.
Safety-Related (IE) Power Supplies In accordance with B&W Document 47-1159091-00, the generic design requirements l
for DSS and AMSAC are such that a " safety-related power supply is not required." However, " operability during Loss of Offsite Power is required."
l l
A s.
Although the use of safety-related (IE) power supplies is not required for t5 DSS and AMSAC systems, the logic and actuation device pcwer for the DSS and logic power for.the AMSAC designs must be from an instrument power supply independent from the power supplies for the existing RPS. In this regard, it is the staff's understanding that the ANO-1 " conceptual design" for DSS and AMSAC provides for power to be supplied by non-vital 120 VAC power with a UPS or battery backup to the ATWS logic circuitry. Therefore, the AP&L final submittal should indicate how the UPS or battery supply will be implemented.
Also, for the staff to make a final determination of acceptance, the concerns noted in the diversity and independence sections with respect to the use of EFIC equipment in the ATWS designs should be addressed.
Testability at Fower In accordance with B&W Document 47-1159091-00, the generic design requirements for DSS and AMSAC testability at power are such that "the system shall be testable at power." At-power tests shall be perfomed at 6-month intervals with the complete system test being perfonned every refueling. The following exceptions exist.
"The DSS input sensors and the AMSAC input sensors and 1
final actuation devices will be tested only at refueling outages."
To ensure that the DSS circuits perfom their safety functions in a reliable manner, the circuits must be maintained and periodically tested at power in j
l accordance with technical specification operability ano surveillance requirements or equivalent means.
It is the staff's understanding that the portion of the ANO-1 " conceptual design" that will allow testability at power is provided by the design of the DSS and AMSAC systems. These systems are designed so that both are two-out-of-two logic-actuated systems, and provisions are incorporated that inhibit the second channel when a channel is placed in the test condition.
^
c
~
- 8 l
This approach appears to be in accordance with the above mentioned design requirements. However, the plant-specific submittal should also address the time limits associated with channel testing, disabling of channels, actions to be taken if one channel fails, etc.
Inadvertent Actuation i
In accordance with B&W Document 47-1159091-00, the generic design requirements for DSS and AMSAC to prevent inadvertent actuation are such that "the system shall be designed to minimize challenges to safety systems" by using at least two channeh witi: appropriate coincidence logic; the use of two channels concurrent wid de snergize-to-trip design should minimize the number of inadvertent actuations.
To avoid the potential for inadvertent actuations of this nonsafety system, "the system shall be designed so as not to revert to a one-out-of-one status curing channel test. For systems designed using the minimum two-channel logic, this dictates that the system shall become inoperable during channel test.
It is the staff's understanding that the ANO-1 " conceptual design" is in accordance with the above mentioned design requirements.
Maintenance Bypasses, Operating Bypasses, Indication of Bypasses, and Means fcr Bypassing In accordance with B&W Document 47-1159091-00, the generic design requirements for DSS and AMSAC bypassing are such that "the system shall incorporate a channel test capability; the test function should simultaneously test an input and output channel together from sensor to final actuation device."
System status during testing shall be annunciated in the control room. The system should be designed to provide output to the control-raom mounted alarms for input channel trip conditions, output channel trip conditions, system
trip, and test status. The. system status will also be annunciated when the i
system is in the Startup Bypass mode / condition and reactor power is less than 25% of rated full power.
It is the staff's understanding that the ANO-1 " conceptual design" concerning bypassing provices for disabling of a channel for maintenance, testing, repair or calibration by placing the other channel in test. Administrative controls will be provided to require placing a DSS or AMSAC channel in test in order to provide Control Room annunciation any time work is to be performed which would disable operation of the other channel. These administrative controls will also prohibit personnel from working on more than one DSS or AMSAC channel simultaneously.
In addition, this design provides for automatically bypassing the AMSAC logic below a reactor power level of 25%. The DSS cystem does not require an operational bypass, and none is provided. The " conceptual design" also provides for indication of DSS and AXSAC status, including maintenance bypasses in the control room. The "cenceptual design" provides these bypass capabilities for maintenance and test by using installed test devices.
However, for the staff to make a determination of complete compliance, AP&L should assure that all items of concern addressed in the testability section of this document and that are applicable to bypassing at ANO-1 are discussed in the plant-specific submitt61.
o Completion of Protective Action In accordance with B&W Document 47-1159091-00, the generic design requirements for DSS (AMSAC is not addressed) to assure completion of the protective action once it has been initiated are such that "the DSS shall incorporate a trip lockup with manual reset capability in the output channels when activated by a true DSS trip."
It is the staff's understanding that the AP&L " conceptual design" for the DSS at ANO-1 provides lockup of the DSS trip function such that reset of the DSS trip function requires manual operator action from the control room.
It is o
?
also the staff's understanding that the AMSAC does not use a lockup trip function. AP&L should provide specific infomation which confims that both the DSS and AMSAC at ANO-1 are designed such that, upon receipt of a trip signal, the protective action goes to completion and deliberate operator action is required to reset the systems in order to comply with the ATWS Rule.
In addition to the specific infomation on the system's design, AP&L should include a discussion of any required operator actions.
Information Readout Although this item is not specifically addressed in E&W Document 47-1159091-00, it is the staff's understanding that AP&L's " conceptual design" for ANO-1 provides for indication of DSS and AMSAC system status. This type of design appears to be acceptable. However, in the AP&L plant-specific submittal for ANO-1, more detailed information relating to how the operator is provided with accurate, complete, and timely infomation (i.e., what actuates or deactuates alams, annunciators, lights, and what functions are perfomed byspecificswitches,etc.)pertinenttosystemstatusshouldbeprovided.
In addition, AP&L should provide a discussion of how human factors engineering practices are incorporated into the design of ATWS prevention /mitightion system components located in the control room. The coordination of displays used to provide the status of ATWS systems / equipment to the operator with existing displays should be addressed specifically.
Safety-Related Interfaces In accordance with B&W Document 47-1159091-00, the generic design requirements for safety-related components / interfaces are such that "the DSS and AMSAC are not required to be safety related nor designed to meet IEEE 279, however must be designed and engineered for high reliability to preclude unnecessary challenges to existing safety systems."
It is the staff's understanding that the AP&L " conceptual design" for the ANO-1 DSS and AMSAC does include interfaces with the existing reactor
t protection systems, as noted in the previous discussions of this report.
These concerns (i.e., the sharing of power supplies via EFIC/AMSAC and the adequacy of isolation devices) should be adequately addressed in the plant-specific submittal in order for the staff to evaluate the applicability of the devices for use in the DSS /AMSAC systems.
Technical Specifications The staff, in its Technical Specification Improvement Program, is presently evaluating the need for technical specification operability and surveillance requirements. This evaluation includes those actions considered to be appropriate to ensure that equipment installed per the ATWS Rule will be maintained in an operable condition when operability requirements cannot be met (i.e.,limitingconditionsforoperation).
In its Interim Commission Policy Statement on Technical Specification Improvements for Nuclear Power Plants [52 Federal Reoister 3778 February 6,1987], the Comission established a specific set of objective criteria for detemining which regulatory requirements and operating restrictions should be included in Technical Specifications. The staff will provide guidance regarding the Technical Specification requirements for DSS and AMSAC at a later date.
l Installation of ATWS prevention / mitigation system equipment should not be delayed pending the development or staff approval of operability and surveillance requirements for ATWS equipment.
Conclusion In order for the staff to make a determination on the ANO-1 compliance with the ATWS Rule and issue a Safety Evaluation Report, the additional infomation requested in the body of this document will be required. This additional information, as well as pertinent previously supplied information, should be submitted to the staff in a single ATWS system final design package. This will assure that only the most complete and up-to-date information is reviewed.