ML20236J262
| ML20236J262 | |
| Person / Time | |
|---|---|
| Site: | Limerick  |
| Issue date: | 11/03/1987 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML20236J253 | List: |
| References | |
| NUDOCS 8711050235 | |
| Download: ML20236J262 (9) | |
Text
_ _ _ _ _ _
y 1
o.
UNITED STATES
!' ' ~
NUCLEAR REGULATORY COMMISSION n
i E
WASHINGTON. D. C. 20555 q
R l
\\
L SAFETY. EVALUATION ON LIMERICK GENERATING STATION, UNITS 1 AND 2 COMPLIANCE WITH ATWS RULE 10CFR50.62 M ATING TO ARI, RPT AND SLC SYSTEMS-DOCKET N05. 50-352 AND 50-353 L1.0g ' INTRODUCTION I
On/ July 26, 1984, the Code of Federal Regulations-(CFR) was amended to I
include Section 10CFR50.62, " Requirements for Reduction of Risk from Anticipated: Transients Without Scram (ATWS) Events for Light-Water-Cooled NuclearPowerPlants"(knownasthe"ATWSRule"). An ATWS is an expected operational transient (such as loss of feedwater, loss of condenser -
4
' vacuum, tor:. loss of offsite power) which is accompanied by a failure of the reactor trip' system (RTS) to shutdown the reactor.
The ATWS rule requires' specific' improvements in the design and operation of commercial nuclear power facilities to reduce the likelihood of' failure to shutdown
.the' reactor following anticipated transients, and to mitigate the l
consequences of an ATWS event.
i For each boiling water reactor, three systems are required to mitigate the consequences of an ATWS event.
l 1.
It must have an alternate rod injection (ARI) system that is diverse (from the reactor trip system) from sensor output to the final actuation devices.
The ARI system must have redundant scram air header exhaust valves.
The ARI system must be designed to perform 1
its function in a' reliable manner and be independent (from the existing reactor trip system) from sensor output to the final actuation device.
2.
It must have a standby liquid control system (SLCS) with a minimum flow capacity and boron content equivalent in control capacity to 86 gallons per minute of 13 weight percent sodium pentaborate solution.
The SCLS and its injection location must be designed to perform its function in a reliable manner.
3.
It must have equipment to trip the reactor coolant recirculating pumps automatically under conditions indicative of an ATWS.
This equipment must be designed to perform its function in a reliable manner.
ThissafetyevaluationreportaddressestheARIsystem(Item 1),the SLCS (item 2) and the ATWS/RPT system (item 3).
B711050235 871103 PDR ADOCK 05000352 p
2,0 REVIEW CRJTERIA f
'The systems and equipment required by 10CFR50.62 do not have to meet all of the stringent requirements normally applied to safety-related equipment.
However, this equipment is part of the broader class of structures, systems, and components important to safety defined in the
{
3
. introduction to 10CFR50, Appendix A, General Design Criteria (GDC).
GDC-1 requires that " structures, systems, and components important to safety shall'be. designed, fabricated, erected, and tested to quality standards commensurate with the. importance of the safety functions to be i
. performed." Generic. Letter 85-06 " Quality. Assurance Guidance for ATWS Equipment that'is not Safety Related" details the quality assurance that
. must be applied to this equipment.
In general, the equipment to be installed in accordance with the ATWS Rule is required to be diverse from the existing RTS, and must be testable at power. This equipment is intended to provide needed
. diversity (where only. minimal dive.sity currently exists in the RTS) to I
reduce the potential for common. mode failures that could result in an ATWS leading to unacceptable plant conditions.
The criteria used.in evaluating the licensee's submittal include 10CFR50.62 " Rule Considerations Regarding Systems and Equipment Criteria" i
published in Federal Register Volume 49, No.124 dated June 26, 1984 and 3
Generic Letter 85-06 " Quality Assurance Guidance for ATWS Equipment that is not Safety Related."-
l 3.0 LIMERICK ARI & RPT SYSTEM DESCRIPTION The Limerick Generating Station has installed a Redundant Reactivity Control System (RRCS) to mitigate the potential consequences of an anticipated transient without scram event.
The RRCS consists of reactor pressure and reactor water level sensors, logic, power supplies, control room cabinets, and instrumentation to initiate the protective actions to mitigate an ATWS event.
The protective actions include:
a.
Alternate Rod In,iection (ARI),
b.
Recirculation Pump Trip (RPT),
c.
Feedwater Runback, and d.
Standby Liquid Control Pump Trip The RRCS is independent from the reactor trip system.
It is a two divisional safety related system.
Either division is capable of initiating protective actions when both input channels A and B within a division are tripped.
The RRCS output will energize the devices to start the protective actions.
The system can be manually initiated by depressing two pushbuttons (tripping both Channels A and B) in the sane division.
l L
F 3 L
.c The ARI logic will cause the immediate energization of the Alternate Rod Insertion valves when either the reactor vessel high pressure trip sttpoint or the low water level-2 trip setpoint is reached, or the manual pushbuttons are armed and depressed.
The ARI valves and bleed paths are sized to allow insertion of all control rods to begin within 15 seconds.
The status of the ARI system is indicated in the main control room.
The function of the RPT.is to reduce the severity of thermal transients on
- fuel elements by tripping the recirculation pumps early in the transient events (such as turbine trip, or load rejections). The rapid core flow reduction increases void content and thereby introduces negative reactivity in the reactor to reduce the thermal power.
There are two separate and independent systems to trip the recirculation pumps.
One is thereactortripsystemend-of-cyclerecirculationpumptrip(E0C/RPT),
which detects turbine control valve fast closure and main stop valve:
closure..The other.is the redundant reactivity control system (ATWS/RPT) which detects high reactor pressure or low reactor water level.
The Limerick design has two breakers in series for each reactor coolant recirculation pump.
Each breaker has two independent trip coils; one receives a trip signal from the reactor trip system and the other receives a trip signal from the redundant reactivity control system.
Both trip coils are Class 1E qualified. The Class IE RTS and RRCS trip coils are separated from each other.
Each trip coil is capable of tripping the associated breaker independently of the other.
The RRCS detects high reactor pressure. After 25 seconds time delay, it initiates the feedwater runback provided the APRM (nuclear instrument average power monitor) downscale signal is not present. After a
-100-setond time delay, it isolates the reactor water cleanup system and automatically initiates the standby liquid control system.
The RRCS recirculation pump trip and feedwater runback are not initiated by manual initiation of the RRCS. However, these may be manually initiated at the' respective system control panels.
The RRCS is continually checked b.y a solid state microprocessor baced self-test system.
It11s self-test system checks the RRCS sensors, logic, and actuated devices.
The RRCS sensors, logic and actuated devices and the APRM permissive circuits are Class 1E, independent of the RTS, and environmentally qualified.
The ARI function can be reset by the ARI reset switches after 30 seconds time delay to ensure that the ARI scram goes to completion.
The other RRCS functions can be reset by the RRCS reset switches, provided the high reactor pressure or the low water level signal no longer exists.
4.0 EVALUATION OF ARI SYSTEM I
l, 4.1 SAFETY RELATED REQUIREMENTS (IEEE STANDARD-279)
The ATWS Rule does not require the ARI system to be safety grade, but the implementation must be such that the existing protection system continues to meet all applicable safety related criteria. The licensee stated that the ARI system (a subsysten of the RRCS) is classified as a Class IE system.
It is electrically diverse and independent from the reactor trip l
system, and it meets IEEE Standard 279-1971 in all applicable areas.
The l
RRCS interfaces with control systems through the qualified isolation devices. Any electrical failures in the control systems will not propagate into the RRCS to prevent ARI system from performing its protective functions.
The staff finds this acceptable.
l 4.2 REDUNDANCY The ATWS Rule requires that the ARI system must have redundant scram air l
header exhaust valves, but the ARI system itself does not need to be l
redundant.
Limerick's ARI system has redundant scram air header exhaust valves.
The initiation and control circuits are redundant.
All vent paths will allow insertica of all control rods to begin within 15 seconds and to be completed within 25 seconds.
The ARI performs a function redundant to the backup scram system.
The staff finds this acceptable.
4.3 DIVERSITY FROM EXISTING RTS The ATWS Rule requires the ARI system to be diverse from the existing reactor trip system.
Limerick's ARI system uses energize-to-function valves instead of deenergize-to-function valves.
It has DC powered valves and logic instead of AC powered valves and logic.
Four reactor high pressure sensors and four low reactor vessel water level sensors are dedicated for use to detect the ATWS events.
The detection logic
)
circuitries, power supplies and final actuated devices are independent l
from the reactor trip system.
The built-in continuous self-testing feature will provide an additional assurance of reliability for the ARI l
system. The staff finds this acceptable.
4.4 PHYSICAL SEPARATION FROM EXISTING RTS l
The ATWS Rule guidance states that the implementation of the ARI system must be such that separation criteria applied to the existing protection system are not violated.
The Limerick's ARI system sensors, transmitters, trip units and associated circuits are Class lE.
It is separated and independent from the Reactor Trip System.
It has redundant divisions from sensor to the ARI valves actuation.
Either division can perform the protective action. The separation between two redundant divisions satisfies the guidance provided in Regulatory Guide 1.75.
The staff finds this acceptable.
.4 l
i i
5
~4. 5 ENVIRONMENTAL QUALIFICATION The ATWS Rule guidance states that the qualification of the ARI system is
'for anticipated operational occurrences only, not for accidents.
The Limerick's ARI system is a Class IE system.
It is qualified to the anticipated operational occurrence conditions.
The staff' finds this l
acceptable.
4.6 SEISMIC QUALIFICATION No seismic qualification is required for the ARI system hardware.
4.7 ' QUALITY ASSURANCE NRC Generic Letter 85-06 dated April 16, 1985 provides quality assurance guidance for the.ARI system. The licensee is required to follow this guidance.
4.84 SAFETY'RELATED (IE) POWER SUPPLY LThe ATWS Rule guidance states that the ARI system must be capable of
' performing its safety functions with loss of offsite power, and that the power source should be independent from the existing reactor trip i
system. The Limerick's ARI systems are powered from the Class 1E 125 Vdc power sources which are independent 'from the existing reactor trip system power sources.
Division I RRCS is powered by 125 Vdc from bus B division II. These DC buses are backed up by station batteries.
The staff finds that the ARI system is capable of performing its safety functions with loss of offsite power and the ARI power sources are independent from the existing RTS power source, and therefore is acceptable.
4.9 TESTABILITY AT POWER The ATWS Rule guidance states that the ARI system should be testable at power.
The Limerick's ARI system is continually self tested by a microcomputer based self-test system which tests the signal, trip setpoint and logic.
. An analog ' trip module (ATM) failure or out of calibration condition, or a lack of system continuity condition will be annunciated.
The ARI system uses a redundant 2-out-of-4 logic arrangement.
Each individual level and pressure instrument can be tested during plant operation without l
initiating the ARI system since two level or two pressure signals must be present in the same division to initiate the action.
The staff finds this acceptable.
__--__a
g 4.10 INADVERTENT ACTUATION The ATWS Rule guidance states that inadvertent'ARI actuation which l
challenges other safety systems should be minimized.
~The Limerick's ARI system has redundant channels in each division and both channels A and 8 must be tripped in order to initiate the protective actions.
The manual' initiation also requires arming the switch and depressing two pushbuttons to initiate the action.. As a result, inadvertent actuation is minimized. The staff finds this acceptable.
4.11 MANUAL INITIATION
.The Limerick's ARI system has two sets of manual initiation switches (two switches in each division) in the control room.
The operator first rotates the pushbutton's collar to arm the switches, then depresses both switches to initiate the protective actions. The staff finds this acceptable.
i 4.12 INFORMATION READOUT The Limerick's RRCS system provides status indications in the control room for potental ATWS, confirm ATWS, ARI initiated, RRCS ready for reset and other RRCS system related malfunctions. With continuous self-testing i
capability, the operator always has current status of the RRCS.
The staff finds that the information readout is adequate.
'4.13 COMPLETION OF PROTECTIVE ACTION ONCE IT IS INITIATED
' The Limerick's RRCS has a seal-in feature to ensure the completion of protective action once it is initiated.
After initial conditions return to normal, deliberate operator action is required to reset the safety system logic to normal. The. staff finds this acceptable.
4 4.14 MAINTENANCE BYPASS There is no manual bypass of the RRCS. The staff finds this acceptable.
j 4.15 CONCLUSION ON ARI SYSTEM Based on its review, the staff concludes that the ARI design basis
' requirements identified above are in general compliance with ATWS Rule 10CFR50.62 paragraph (C)(3) and the guidance published in Federal Register Volume 49 No. 124 dated June 26, 1984, and is therefore, acceptable.
5.0 EVALUATION OF ATWS/RPT SYSTEM j
L C_________.____
I t
h
~7-h 5.1 : SAFETY RELATED REQUIREMENTS The ATWS/RPT system is a subsystem of the'RRCS which is classified as a
-Class IE> system.
It is electrically diversed and independent from the reactor trip system, and it meets IEEE Standards 279-1971 in all appl.icable areas. The. staff. finds this acceptable.
i 5.2 REDUNDANCY The. ATWS/RPT system itself is a redundant. system. The ATWS/RPT function is. redundant to the reactor trip function (End-of-cycle RPT1.
The staff finds this acceptable.
5.3 DIVERSITY FROM EXISTING RTS The ATWS/RPT. system uses energize-to-function logic, instead of l
- deenergize-to-function logic for the RTS.
The sensors, trip units, and power supplies of ATWS/RPT are diverse and independent from the RTS. The
.l staff finds this acceptable.
5.4. PHYSICAL SEPARATION FROM EXISTING RTS
.The~ATWS/RPT system sensors, transmitters, trip units and associated circuits are Class IE.
It is separate and independent from the reactor trip system. The staff finds this acceptable.
5.5 ENVIRONMENTAL QUALIFICATION The ATWS/RPT system is a Class 1E system.
It is qualified to the
' anticipated operational occurrence conditions.
The staff finds this acceptable.
5.6 SEISMIC QUALIFICATION
.No seismic qualification is required for the ATWS/RPT hardware.
5.7 QUALITY ASSURANCE NRC Generic Letter 85-06 dated April 16, 1985 provides cuality assurance
. guidance for.the ATWS/RPT system.
The licensee is required to follow this guidance.
5.8 SAFETY RELATED (IE) POWER SUPPLY The ATWS/RPT system is powered from the Class IE 125 Vdc power sources, which are independent from the existing reactor trip system. The DC buses are backed up by station batteries; therefore, the ATWS/RPT system is capable of performing its safety functions with loss of offsite power.. The staff finds this acceptable.
4 AJ 1..
~..
5.9 TESTABILITY AT P9WER The ATWS/RPT system uses a redundant 2-out-of-4 logic arrangement.
Each individual levM and pressure instrument can be tested during plant operation.
the ATWS/RPT system is continuously self tested by a microcomputer based self-test system which tests the signal, trip setpoint and logic. An analog trip module failure or a out-of-calibration condition, or a lack of system continuity condition will be annunciated.
The staff finds this acceptable.
.5.10 INADVERTENT ACTUATION The ATWS/RPT system has redundant chanrels in each division and both channels A and 8 must be tripped in order to initiate the protective actions. The ATWS/RPT actuation setpoints on reactor vessel pressure high is set at 1093 psig and reactor water level low is set at -38
< inches. The RTS actuation setpnints on reactor vessel pressure high is set at 1037 psig and reactor water level low is set at 12.5 inches.
Therefore, the ATWS/RPT actuation will not challenge the RTS. The staff finds this acceptable.
5.11 CONCLUSION ON ATWS RPT SYSTEM Based on its review, the staff concludes that the ATWS/RPT design basis requirements identified above are in general compliance with ATWS Rule 10CFR50.62 paragraph (C)(5) and the guidance published in Federal Register Volume 49 No. 124 dated June acceptable.
26, 1984, and is therefore 6.0 EVALUATION OF SLCS 4
6.1 SAFETY RELATED REQUIREMENTS j
t The' standby liquid control system (SLCS) must have a minimum flow capacity and boron content equivalent in control capacity to 86 gallons j
.per ninutes of 13 weight percent sodium pentaborate solution, j
6.2 LIMERICK SLCS The SLCS installed in Limerick Unit I and the SLCS being installed in Limerick Unit 2 has a minimum flow capacity of 86 gallons per minute (maximum flow capacity of 129 GPM with 3 pumps) of 13 weight percent sodium pentaborate solution and is automatically initiated to inject into the reactor.
6.3 EVALUATION The SLCS design information given by the licensee have been reviewed by the staff against the requirements of the ATWS Rule (10 CFR 50.62), and
p
[
r.
~
t' !
Generic Letter 85-03 " Clarification of Equivalent Control Capacity for Standby Liquid Control System," dated January 28, 1985.
Limerick has a l.
P51" reactor vessel. The flow capacity and solution concentration indicated by the licensee exceeds the ATE'S Pule requirement of 86 nPM of l
13 weight percent sodium pentaborate. This is acceptable.
The licensee's plan to periodically test only one SLCS system pump at a time is also acceptable. This is based upon the licensee's statement that tests were performed on Limerick-1 during the start-up which verified that the SLCS is capable of operating under the increased pressures associated with more than one pump operation.
(The test acceptance criteria did not require 3 pump injection into the vessel.
Ac' cording to the licensee, the system is designed for simultaneous operation of 3 pumps.) Furthermore, the test criterion of 41.2 GPM per pump (3 pumps in total) for the positive displacement pumps provides reasonable assurance that 86 gpm will be achieved during three pump operation.
6.4 CONCLUSION
ON SLCS The licensee's design for the SLCS in acceptable because it will provide a boron content of 86 gpm of 13 weight percent sodium pentaborate as required by 10 CFR 50.62.
.7.0 TECHNICAL SPECIFICATIONS The equipment required by the ATWS Rule to reduce the risk associated with an ATWS event must be designed to perform its function in a reliable manner. A method acceptable to the staff for demonstrating that the equipment satisfies the reliability requirements of the ATWS Rule is to provide equipment technical specifications including operability end surveillance requirements.
The Limerick plant technical specifications have incorporated the requirements for the ATW3/RPT SLC systems.
The staff will provide guidance on technical specification requirements for the ARI system in a separate document.
{
Principal Contributors:
H. Li and G. Thomas Dated: November 4 1987 l
l i
- _ _ _ - - _