ML20236A889
| ML20236A889 | |
| Person / Time | |
|---|---|
| Site: | Hope Creek  |
| Issue date: | 10/14/1987 |
| From: | NRC |
| To: | |
| Shared Package | |
| ML20236A870 | List: |
| References | |
| NUDOCS 8710230215 | |
| Download: ML20236A889 (8) | |
Text
- - - - - . .. . .. .- .__
l A Rig ;
UNITED STATES .
kog je ~ g NUCLE AR REGULATORY COMMISSION g WASHINGTON, D. C. 20555 g ny 1 I
- + g l
% ' 6 9*****9 t SAFETY EVALUATION ON HOPE CREEK GENERATING STATION COMPLI ANCE WITH ATWS RULE 10CFR50.62 DOCKET NO. 50-354 1
1.0 INTRODUCTION
On July 26, 1984, the' Code of Federal Regulations (CFR) was amended to. ,
include Section 10CFR50.62, " Requirements for Reduction of Risk from l Anticipated Transients Without Scram ( ATWS) Events for Light-Water-Cooled l Nuclear Power Plants" (known as the "ATWS Rule"). An ATWS is an expected l
operational transient (such as loss of feedwater, The ATWS rule loss of conde the reactor trip system (RTS) to shutdown the reactor. l requires specific improvements in the design and operation of commercial nuclear power facilities to reduce the likelihood of failure to shutdown the reactor following anticipated transients, and to mitigate the consequences of an ATWS event.
For each boiling water reactor, three systems are required to mitigate l
the consequences of an ATWS event.
- 1. It must have an alternate rod in,iection (ARI) system that is diverse (from the reactor trip system) from sensor output to the final actuation devices. The ARI system must have redundant scram air i
l header exhaust valves. The ARI system must be designed to perform its function in a reliable manner and be independent (from the 4
l existing reactor trip system) from sensor output to the final actuation device.
- 2. It must have equipment to trip the reactor coolant recirculating This pumps automatically under conditions indicative of an ATWS.
equipment must be designed to perform its function in a reliable manner.
- 3. It must have a standbv liquid control system (SLCS) with a minimum flow capacity and boron content equivalent in control capacity of 86 gallons per minute of 13 weight percent sodium pentaborate solution. The SLCS and its injection location must be designed tn The SLCS initiation must i
perform its function in a reliable manner.
be automatic and must be designed to perform its function in a reliable manner, The systems and equipment required by 10CFR50.62 do not have to meet all f of the stringent requirements normally applied to safety-related equipment. However, this equipment is part of the broader class of structures, systems, and components important to safety defined in the h0230215e71014 p ADOCK 05000354 PDR
I
' 7 introduction to 10CFR50, Appendix A, General Design Criteria.(GDC). I GDC-1 requires that " structures, systems, and components important to '
safety shall be designed, fabricated, erected, and tested to quality standards commensurate with the importance nf the safety functions to be performed." Generic Letter 85-06 " Quality Assurance Guidance for ATWS Equipment that is not Safety Related" details the quality assurance that must be applied to this equipment.
In general, the equipment to he installed in accordance with the ATWS' Rule is required to be diverse from the existing RTS, and must be testable at power. This equipment is intended to provide needed diversity (where only minimal diversity currently exists in the RTS) to reduce the potential for common mode failures that could result in an ATWS leading to unacceptable plant conditions.
By letter dated May 21, 1985 supplemented by letter dated April 2,1987, the licensee described to the staff how the Hope Creek ARI and ATWS l
reactor coolant recirculation pump trip (RPT) systems and SLCS meet the requirements of the ATWS Rule. l The criteria used in evaluating the licensee's submittals include 10CFR50.62 " Rule Considerations Regarding Systems and Equipment Criteria" published in Federal Register . Volume 49, No.124 dated June 26, 1934, j Generic Letter 85-03 " Clarification of Equivalent Control Capacity for Standby Liquid Control Systems and Generic letter 85-06 " Quality Assurance Guidance for ATWS Equipment that is not Safety Related."
2.0 SYSTEMS DESCRIPTION The Hope Creek Generating Station has installed a redundant reactivity control system (RRCS) to mitigate the potential consequences of an anticipated transient without scram event. The RRCS consists of reactor pressure and reactor water level sensors, logic, power supplies, control room cabinets, and instrumentation to initiate the protective actions to mitigate an ATWS event. The protective actions include:
- a. Alternate Rod Injection
- b. Recirculation Pump Trip
- c. Feedwater Runback, and
- d. Standby Liquid Control Pump Trip The RRCS is independent from the RTS. It is a two divisional safety related system, Either division is capable of initiating protective 1 actions when both input channels A and B within a division are tripped.
The RRCS output will energize the devices to start the protective ~
actions. The system can be manually initiated by depressing two pushbuttons (tripping both Channels A and B) in the same division.
The ARI logic will cause the immediate energization of the ARI valves j when either the reactor vessel high pressure trip setooint or the low 3 water level-2 trip set point is reached, or the manual pushbuttons a l armed and depressed. Positive i insertion of all control rods to begin within 15 seconds. l position (open or closed) is indicated for all eight (8) ARI valves at l the RRCS control panels. i The function of the RPT is to reduce the severity of thermal transients l on fuel elements by tripping the recirculation p' umps early)in Thethe rapid l transient events-(such as turbine trip, or-load rejections . i core flow reduction increases void content and thereby introduces There are I l
negative reactivity in the reactor.to reduce the thermal. power.
two separate and independent systems to trip the recirculation pumps.
One is the RTS end-of-cycle RPT (E0C/RPT), Thewhich other isdetects the RRCS turbine control valve fast closure and main stop valve closure.ATWS/RPT whi The Hope Creek design has two breakers in series for each reacto' r recirculation pump (total of 4).
coils, one receives a trip signal from the RTS.and the other receivn a Both trip coils are Class 1E qualified. The Class 1 i
trip signal from the RRCS.1E RTS and RRCS trip coils are totally. indepe After 25 seconds time delay, it The RRCS detects high reactor pressure. ;
initiates the feedwater runback provided the nuclear instrument average j power monitor (APRM) downscale signal isThenot presen automatically initiates the standb.y liquid control system i 4
concentration into the core coolant sufficient to bring the reactor to a l hot shutdown.
j The RRCS is continually checked by a solid state microprocel self-test system. The RRCS sensors, logic and actuated devices and j and actuated devices.
the APRM permissive circuits are Class 1E, independent of the RTS, and I environmentally qualified.
I The ARI function can be reset by the ARI reset switchesThe after 30 seconds other i
-l time delay to ensure that the ARI scram goes 'to completi l downscale permissive signal is presented.
3.0 EVALVATION OF ARI SYSTEM !
The ATWS Rule does not require the ARI system to be safety grade,.but the -l implementation must be such that the existing prctection sy. stem contin t to meet all applicable safety related criteria. l the ARI system (a subsystem of the RRCS) is classified as a Class IE l system.
It is electrically diverse and independent from the RTS l
i
l l
.. j 1
)
. - 4'- !
279-1971 in all applicable' areas. The RRCS and it meets IEEE Standard interfaces with control systems through the qualified isolation devices.
Any electrical failures in the control' systems will not propagate into_ the RRCS to prevent the ARI system from performing its protective functions. >
The ATWS Rule requires tht_ the ARI system must have redundant scram air header exhaust valves, but the ARI system itself does not need to be Hope Creek's ARI system has redundant scram air header exhaust reiundant.The valves. initiation'and control' circuits are redyndant. All vent paths will allow insertion of all control The ARIrods performs _to ab~ ttn within function 15 secon'ds. .{
redundant i and be completed within 25 seconds. l to the backup scram syste. l The ATWS Rule requires that the ARI system should be diverse from the existing RTS'. Hope Creek'.s ARI' system uses energize-to-function valves It has DC powered _ valves and instead of deenergize- to-function-valves. . Four reactor high pressure j
logic instead of AC powered valves and logic. sensors and four low f The detection logic circuitries, power supplies and the ATWS events.
final actuated devices are independent from the RTS.
The built-in continuous self-testing feature will' provide an additional- assurance of-reliability for the ARI system.
The ATWS Rule guidance states that the implementation of the_ARI' system must be such that separation criteria applied to the existing protection system are not violated. Hope Creek's ARI systemItsensors, transmitters, is separated and trip units and associated circuits divisions It has redundant are Class from1E.sensorindependent to the from Either division can perform the protective action.
ARI valves actua' tion.- .l The separation between two redundant divisions satisfies the-guidance I provided in Regulatory Guide 1.75.
I
' The ATWS Rule guidance states that the qualification of the ARI systemThe . j is for anticipated operational occurrences only, Itnot is for accidents.
qualified to the 1 Hope Creeks's ARI system is a Class 1E system. No seismic qualification is l anticipated operational occurrence condition. I required for the ARI system hardware.
16, 1985 provides quality assurance '
NRC Generic Letter 85-06 dated AprilThe licensee stated that the quality guidance for the ARI system. assurance requirements of ATWS componen 1.30, Rev. O which is more stringent than the guidance provided by Generic Letter 85-06.
The ATWS Rule guidance states that the ARI system must be capable of ,
performing its safety functions with loss of offsite power, and that the power source should be independent from the existing RTS. Hope Creek's ARI systems are powered from the engineering safety features-(ESF) power sources (Class IE 125 Vdc power sources) which are independent from the
- - _ - _ _ _ _ _ _ _ _ - _ - - - . _ a-
f
' existing RTS power sources. Division I RRCS logic is powered by 125 Vdc I. Division from bus A division These DC 11 RRCS logic is powered by 125 Vdc from buses are backed-up by station batteries.
bus 8 division II.
The staff finds that the ARI system is capable of performing its safety functions with loss of offsite power and the ARI power sources are independent from the existing RTS power source.
The ATWS Rule guidance states that the ARI system should be testable at power. The Hope Creek ARI system is continually self tested by a microcomputer based self-test system which tests the signal, trip setpoint and logic. An analog trip module failure or out of calibration condition, or a lack of system continuity condition will be annunciated.
Each The ARI system uses a redundant 2-out-of-4 logic arrangement.
individual level and pressure instrument can be tested during plant operation without initiating the ARI system since two level or two pressure signals must be present in the same division to initiate the action.
The ATWS Rule guidance states that inadvertent ARI actuation which challenges other safety systems should be minimized. Hope Creek's ARI system has redundant channels in each division and both channels A and B must be tripped in order to initiate the protective actions. The manual l initiation also requires aming the' switch and depressing two pushbuttons to initiate action. As a result, inadvertent actuation is minimized. l i
4 The Hope Creek's ARI system has two sets of manual initiation switches (two switches in each division) in the control room. The operator first ,
J rotates the pushbuttons collar to arm the switches, then depress both switches to initiate the protective actions. l The Hope Creek's RRCS system provides status indications in the control :
room for potential ATWS, confirm ATWS, ARI initiated, RRCS ready for reset and other RRCS system related functions. With continuous self-testing capability, the operator always has the current status of the RRCS.
. dope Creeks's RRCS has a seal-in feature to ensure the completion of protective action once it is initiated. After initial conditions return to normal, deliberate operator action is required to reset the safety system logic to normal. There is no manual bypass of the RRCS. j Based on its review, the staff concludes that the ARI design basis f
{
requirements identified above are in compliance with ATWS Rule 10 CFR j 50.62 paragraph (c)(3) and the guidance published in Federal Register Volume 49 No. 124 dated June 26, 1984 and are acceptabla. j i
I i
- I
li
. 1 i
4.0 EVALUATION OF ATWS/RPT SYSTEM The ATWS/RPT system is a subsystem of the RRCS which is classified as Class 1E system. It is electrically diverse and independent 1am the RTS and it meets IEEE Standards 279-1971 in all applicable arees. The ATWS/RPT system itself is a redundant system. The ATWS/RPT function
' is redundant to the RTS E0C/RPT function. The ATWS/RPT system uses energize-to-function logic, instead of the deenergize-to-function logic used for the RTS.
The sensors, trip units, and power supplies of the ATWS/RPT are diverse and independent from the RTS.
The ATWS/RPT system is a Class 1E system. It is qualified to the anticipated operational occurrence conditions. No seismic qualification ,
s is required for the ATWS/RPT hardware.
NRC General Letter 85-06 dated April 16, 1985.provides quality assurance The licensee stated that the quality guidance for the ATWS/RPT system.
assurance requirements of ATWS components comoly with Regulatory Guide 1.30, Rev. O which is more stringent than the guidance provided by Generic Letter 85.06.
The ATWS/RPT system is powered from the Engineered Safety Feature (ESF) I The ESF DC power sources, which are independent from the existing RTS. !
buses are backed-up by station batteries, therefore, the ATWS/RPT system is capable of performing its safety functions with loss of offsite power. l Each j The ATWS/RPT system uses a redundant 2-out-of-4 logic arrangement. i individual level and pressure instrument can be tested during plant l operation. The ATWS/RPT system is continuously self tested by a ?
microcomputer based self-test system which tests the signal, trip setpoint and logic. An analog trip module failure or an out-of-calibration condition, or a lack of system continuity condition will be annunciated. 1 J
The ATWS/RPT system has redundant channels in each division and both i channels A and B must be tripped in order to initiate the protective j actions. The ATWS/RPT actuation setpoints on reactor vessel pressure high is set at 1070 psig and reactor water level low is at -38 inches. :
~
The RTS actuation setpoints on reactor vessel pressure high is set at 1037 Therefore, the j psig and reactor water level low is at 12.5 inches. j ATWS/RPT actuation will not challenge the RTS. !
l Based on its review, the staff concludes that the ATWS/RPT design basis l requirements identified above are in compliance with ATWS Rule 10CFR50.62 paragraph (c)(5) and the guidance published in Federal Register Volume 49 No. 124 dated June 26, 1984 and are acceptable.
I I
i l
i
4
. l 5.0 EVALUATION OF SLC SYSTEM The current Hope Creek Technical Specifications (Surveillance Requirement 4.1.5.c) only require the two SLCS pumps to provide a minimum flow of 82.4 gpm, whereas 10 CFR 50.62 (c)(4) requires that the SLCS operate at 86 gpm if the concentration of sodium pentaborate in the SLCS is 13 weig percent as currently specified by the Hope Creek Technical Specifications As a result ,
(Hope Creek has a 251 inch diameter reactor pressure vessel). l of discussion with the staff concerning the inadequacy of the current meets the ATWS Rule requirements, the licensee, by 1987, the SLCS.
requested changes to the Technical Specifications The proposed changes i 4.1.5.b.2, Figure 3.1.5-1 and Bases Section 3/4.1.5. <
reflect the licensee's plan to increase the minimum req)uired to 13.6 weight concentration of sodium pentaborate in the SLCS tank (Figure 3.1.5-1 percent by increasing the required minimum availabl It also lowered the SLCS by 16 pounds (i.e. from 5760 to 5776 pounds). storage tank l and 4997 gallons to 4782 and 4880 gallons respectively.
concentration in conjunction with the capability to operate both SLCS pumps simultaneously at a total combined flow rate of 82.4 gpm is propos to satisfy the requirements of 10 CFR 50.62 (c)(4). ;
The licensee's proposed increase in minimum sodium pentaborate concentration to 13.6 weight percent in conjunction with a flow ratetoof86 82.4 gpm will provide a boron content equivalent in control capacit/This is in gpm of 13 weight percent sodium pentaborate.
As a result of these changes, the sodium pentaborate solution saturation F from 59' F (approximately 5%). The l! temperature increases to 62 increased saturation temperature is still less maintained by the electrical heater system which maintains the SLCS tank F. The performance of Technical solution between 75 F and 85 Specification Surveillance Requirements 4.1.5.a.1 and a.3, on a daily basis, assures that the SLCS system heat tracing and SLCS tank electrical heater system maintains system temperature at greater than or equal to 70' F. Additionally, the areas in which the F.SLCS system is located are maintained at temperatures of at least 70 On the basis of our review, as discussed above we have concluded that the proposed changes are acceptable and will assure that the SLCS is in compliance with 10 CFR 50.62 (c)(4).
The licensee's plan to periodically test only one SLCS system pump This at a time instead of both pumps simultaneously is also acceptable.
finding is based upon the licensee's statement that tests were performed at Hope Creek during startup which verified that the SLCS is capable of
[
1 i'.. .
. operating under the increased pressures associated with two pump operation.
6.0 TECHNICAL SPECIFICATIONS 1 The equipment required by the ATWS Rule to reduce the risk associated with an ATWS event must be desianed to perform its function in a reliable manner. A method acceptable to the staff for demonstrating that the equipment satisfies the reliability requirements of the ATWS Rule is to provide equipment Technical Specifications including operability and surveillance requirements. The Hope Creek Technical Specifications have incorporated the requirements for the ATWS/RPT system, and as discussed above, for the SLCS. The staff will provide guidance on Technical Specification requirements for the ARI system in a separate document.
Principal Contributors: H. Li, G. Thomas and G. Rivenbark Dated: October 14, 1987 6
- _ _ _ - _ _