ML20237B257

Forwards Description of plant-specific Design Issues to Be Addressed Prior to Implementation of Westinghouse Generic AMSAC Design Provided in .Key Elements of plant- Specific Design Include Diversity & Logic Power Supplies

ML20237B257
Person / Time
Site:	Farley
Issue date:	12/09/1987
From:	Mcdonald R ALABAMA POWER CO.
To:	NRC OFFICE OF ADMINISTRATION & RESOURCES MANAGEMENT (ARM)
References
NUDOCS 8712160129
Download: ML20237B257 (19)

Text

- _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

Alabama Power Company 600 North 18th Street Post Ofhce Box 2641 B:rm:ngharn. Alabama 35291-0400 Telephone 205 250-1835 R. P. Mcdonald m

Senior Vice President / abama Power itw Southem ekctnc system December 9, 1987 Docket Nos. 50-348 50-364 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555 Gen tl eme n:

Joseph M. Farley Nuclear Plant - Units 1 and 2 Anticipated Transient Without Scram (ATWS)

By letter dated September 23, 1986 the NRC provided a list of fourteen plant-specific design issues that must be addressed by Alabama Power Company prior to implementation of the Westinghouse generic AMSAC design.

These key elements of the plant-specific design as defined by the NRC are:

1) diversity, 2) logic power supplies, 3) safety-related interface, 4) quality assurance, 5) maintenance bypass, 6) operating bypasses, 7) means for bypassing, 8) manual initiation, 9) electrical independence,10) physical separation.,11) environmental qualification,12) testability at power,13) completion of mitigative action, and 14) technical speci fi ca ti on s.

Each of the above criteria, as they apply to the Farley plant-specific design, is described in the attachment to this letter. Additionally, plant-specific informa tion concerning electrical isolation devices was requested per Appendix A of the NRC Safety Evaluation. This information was transmitted to the NRC by Alabama Power Company letter dated February 27, 1987. The same information is being included with the attachment to this letter for your convenience.

If there are any questions, please advise.

Re spectf ull s bmitted, l

8712160129 871209 ta PDR ADOCK 05000348 .

i /h. U M.

P PDR R. P. Mcdonald .

RPM /BHW: dst-D-T.S.7 7 Atta chment cc: See next page )

U. S. Nuclear Regulatory Commission December 9, 1987 Page 2 cc: ftr. L. B. Long Dr. J. N. Grace fir. E. A. Reeves Mr. Lt. H. Bradford l

l l

l l

l l

1 1

i I

AMSAC SAFETY EVALUATION REPORT RESPONSE FOR FARLEY NUCLEAR PLANT Alabama Power Company ( APCo) has selected and will implement an AMSAC actuation logic which detects a loss of heatsink by monitoring the level in each of the steam generators. This actuation logic incorporates an automatic arming and blocking circuitry based upon turbine load by monitoring the first-stage turbine impulse chamber pressure. This signal, referred to as the C-20 signal, blocks AMSAC actuation at low power levels to prevent spurious trips during plant startups. This actuation logic is depicted in Figure 1.

The basis for this design can be found in WCAP-10858P-A, AMSAC Generic Design Package, and was determined to be acceptable by tne NRC as stated in the Safety Evaluation Report (SER). The Farley design does not deviate from the submitted package. The following is the response to the fourteen (14) items requested in the SER for the plant specific submittal.

Diversity The basis for diversity of the ATWS mitigation system from the existing reactor trip system is to minimize the potential of common mode failures. This diversity is required from sensor output to, but not including the final actuation device, e.g., existing circuit breakers may be used for the auxiliary feedwater initiation. The Westinghouse AMSAC design is a microprocessor-based system with the capability to incorporate three different actuation logic  !

schemes; the Farley Nuclear Plant will employ actuation on low steam generator level. The reactor trip system is an analog-based system; therefore, the Farley Nuclear Plant fulfills the requirement of diversity through the types of technology (analog vs. digital) and hardware utilized. Where similar components are utilized for the same function in both AMSAC and the reactor trip

I AMSAC Safety Evaluation Report Response For Farley Nuclear Plant Page 2 system, the components used in AMSAC are provided from a different manufacturer. For example, relays are utilized in both systems for interfacing with the final actuation circuits. Westinghouse AR relays are utilized within the reactor trip system at the Farley Nuclear Plant while Struthers-Dunn relays are used within AMSAC for this function.

Additionally, Alabama Power Company will add two new turbine impulse chamber pressure transmitters to provide input into AMSAC, which will be diverse from the reactor trip system input sensors. The narrow range steam generator water level channels utilized for AMSAC are not part of the reactor trip or engineered safeguards features actuation systems for the Farley Nuclear Plant. These inputs will be derived from existing non-1E narrow range steam generator level transmitters.

Logic Power Supp.ies l

According to the rule, the AMSAC logic power supply is not required to be safety-related. However, the logic power supply should be from an instrument power supply that is independent from the reactor protection system power supplies. The Farley AMSAC logic power supply will be provided by a dedicated AMSAC uninterruptable power supply (UPS) backed by a battery which is totally independent from the existing battery supply for the reactor trip system. This power supply will also power the two added turbine impulse chamber pressure transmitters. This UPS is connected to a motor control center which is backed by diesel generators.

AHSAC Safety Evaluation Report Response For Farley Nuclear Plant Page 3 Safety-Related Interface The output isolation device is the interface that separates the ATWS equipment from the safety-related equipment. To show that the implementation of the interface is such that the existing protection system continues to meet all applicable safety criteria, the isolation device will be a qualified device consistent with the requirements of Appendix A of the NRC SER and can be found in Appendix A of this document.

Quality Assurance Generic letter (GL) 85-06 provided the explicit QA guidance for nonsafety-related ATWS equipment as required by 10CFRSO.62. The GL specifically states that the QA program for the nonsafety-related ATWS equipment does not need to meet 10CFR50 Appendix B requirements nor would compliance be judged in terms of the Appendix. Detailed QA guidance is provided in the enclosure to the GL. For manufacturing, the Westinghouse program exceeds the above requirement.

Installation and maintenance of the nonsafety-related ATWS equipment will be performed consistent with current plant QA practices for nonsafety-related equipment.

Maintenance Bypass Maintenance at power is accomplished through bypassing by way of a permanently installed bypass switch. This method complies with the NRC SER by not involving lif ting leads, pulling fuses, tripping breakers or physically blocking relays.

Placement of the AMSAC bypass switch to the bypass position inhibits operation of the system's output relays which operate the final actuation devices. Status

AMSAC Safety Evaluation Report Response For Farley Nuclear Plant Page 4 outputs to the plant computer and main control board, indicating that a general warning condition exists with AMSAC, are initiated when the bypass switch is placed in the bypass position.

Operating Bypasses The Farley AMSAC design includes operating bypasses which are continuously indicated in the control room via bypass status light on the main control board. A bypass signal is also sent to the plant computer.

Letter WOG-87-10 dated February 26, 1987 has been submitted to the NRC by the WOG providing the basis for the C-20 setpoint. ihe C-20 permissive signal uses the new turbine impulse chamber pressure sensors. The indication of bypass status will be consistent with existing control room design philosophy. For guidance on diversity and independence for the process equipment and logic power supplies see those specific sections.

Means for Bypassing As stated earlier, the means for bypassing AMSAC is accomplished with a permanently installed bypass switch, it does not involve lifting leads, pulling fuses, tripping breakers or physically blocking relays.

I

l AMSAC Safety Evaluation Report Response For Farley Nuclear Plant Page 5 Manual Initiation The WOG position regarding the ability to manually actuate the AMSAC system is that it is unnecessary because the ability to manually trip the turbine and start the auxiliary feedwater pumps is already available in the control room.

If a turbine trip signal is automatically initiated and the turbine does not trip, the operator would recognize this by checking the turbine trip status light box. The turbine would then be manually tripped using the main turbine emergency trip switch. If the turbine still does not trip using the emergency trip switch, then the operator would trip the turbine EH fluid pumps causing the turbine throttle and governor valves to close. To manually initiate auxiliary feedwater flow the operator would start the motor-driven auxiliary feedwater pumps and the turbine-driven auxiliary feedwater pump if necessary.

Electrical Independence Electrical independence from the existing reactor trip system is required from the sensor output to, but not including the final actuation device. This is to separate safety-related circuits from nonsafety-related circuits. The Farley AMSAC fulfills this requirement. For the turbine impulse chamber pressure input, Alabama Power Company has elected to add two new transmitters. These transmitters will be powered by the independent dedicated AMSAC power supply and thus are completely independent from the reactor trip system. Additionally, the steam generator level inputs will be provided from the process control cabinets j and therefore, are also electrically independent from the reactor trip system.

Moreover, the non-1E logic circuitry and outputs of AMSAC are isolated from the 1E turbine trip circuits and the 1E auxiliary feedwater start circuits.

AMSAC Safety Evaluation Report Response For Farley Nuclear Plant Page 6 Physical Separation The ATWS equipment needs to be physically separated from the existing protection system hardware. This requires that the cable routing be independent of protection system cable routing, and that the ATWS equipment cabinets be located to prevent any interaction with the protection set cabinets. The AMSAC actuation outputs to the redundant turbine trip and auxiliary feedwater pump circuits are separated by each being provided fran separate wall mounted boxes.

Additionally the isolation fault tests (to be conducted) will demonstrate that credible faults will not disable channels associated with other protection sets. All non-1E AMSAC inputs and status outputs will be routed to a separate logic cabinet and therefore, will be separate from the 1E actuation circuits. 1 Figure 2 depicts the system block diagram along with the cable separation groups.

Environmental Qualification The SER requires that only the isolation devices comply with environmental qualification (10CFRSO.49) and with seismic qualification, which is discussed in Appendix A. The remaining portion of the hardware environmental qualification will be addressed here. The ATWS mitigation system is not required to be safety-related and therefore, is not required to meet IEEE-279-1971, " Criteria for Protection Systems for Nuclear Power Generating Stations" or be qualified as safety-rel ated equipment. The portion of the ATWS mitigation equipment located outside containment in a mild environment follows the same design standard as currently exists for non-1E control grade equipment.

AMSAC Safety Evaluation Report Response For Farley Nuclear Plant Page 7 Testability at Power The nonsafety-related ATWS circuitry is testable with the plant on-line.

Testing of the AMSAC outputs to the final actuation devices may be performed with the plant shutdown.

The AMSAC systems for the Farley Nuclear Plant provide for periodic testing through a series of overlapping tests. These tests are performed with the AMSAC outputs bypassed. This bypass is accomplished through a permanently installed bypass switch which negates the need to lift leads, pull fuses, trip breakers or physically block relays. Status outputs to the plant computer and main control board, indicating that a general warning condition exists with AMSAC will be I

initiated when the system's outputs are bypassed. Status outputs in the main I control room will be consistent with human f actor practices. Once the system l bypass is established, a series of overlapping tests are performed to verify analog channel accuracy, setpoint (bistable trip) accuracy, coincidence logic operation including operation and accuracy of all timers, and continuity through the output relay coils. Switches will be provided for each output relay to perform testing of AMSAC outputs through the final actuation devices with the l plant shutdown. A simplified block diagram is shown in Figure 3 reflecting the test overlaps for the periodic on-line tests. A summary of each of the 1

overlapping tests is provided below.

l I

AMSAC Safety Evaluation Report Response For Farley Nuclear Plant Page 8 Analog Input Channel Testing The field input to each analog input channel is replaced with a variable test reference which is used to confirm accuracy of the channel gain and offset. The test reference is then ramped up and down throughout a portion of the channel range to verify accuracy of the channel setpoint and associated deadband. This test confirms operation of the input channel signal conditioning circuitry, analog-to-digital converters and processor operation.

Processor Logic Testing The second sequence of testing verifies that each Actuation Logic Processor performs the proper coincidence logic, including timing functions, and generates the proper outputs. In this test, the field input to each input channel for the processor under test is replaced with test references.

These test references simulate the channel values as either above or below the setpoint to verify that all combinations of coincidence logic result in the generation of the proper processor outputs to the majority voting modul es . Tnis test confirms operation of the input channel signal conditioning circuitry, analog-to-digital converters, processor operation and output circuits to the majority voters.

l I

l 1

- - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ . . - - - - --- _ _ _ _ _ _ _ _ _ _ _ _ - _ _J

i AMSAC Safety Evaluation Report Response ,

For Farley Nuclear Plant i Page 9 )

l i

1 Majority Voter and Output Relay Tests Each majority voting module and associated output relays are tested to verify operation of the majority voter (2 out of 3) and that continuity exists for each of the output relay coils. Integrity of the relay coils q along with associated wiring is verified while exercising the voting logic.

Completion of Mitigative Action Completion of mitigative actions are performed through existing plant circuits for all auxiliary feedwater pumps and for the turbine trip circuits.

Technical Specifications The WOG has stated by letter (cf. OG-171, dated February 10, 1986) that Technical Specifications for AMSAC are unnecessary, do not enhance the overall safety of nuclear power plants, and constitute a backfit. The WOG believes that normal nuclear plant administrative controls are sufficient to control AMSAC.

Alabama Power Company agrees with the WOG position that Technical Specifications are not necessary for the AMSAC system.

APPENDIX A - AMSAC ISOLATION DEVICE Electrical independence of AMSAC from the existing Reactor Protection System is provided through several means for the Farley Nuclear. Plant. A block diagram showing the relationship of AMSAC to the existing Reactor Protection System (RPS) is provided in Figure 4 which details the AMSAC/RPS connections and points of isolation.

The steam generator narrow range level inputs to AMSAC will be derived from existing non-1E signals within the process control cabinets. These signals are provided from non-1E differential pressure transmitters which are routed directly to the control cabinets. This arrangement does not require the use of existing or new isolators to provide electrical independence of these instrument channels from the existing reactor protection system.

For measuring turbine load at the first stage, Alabama Power Company has elected to add two pressure transmitters. This addition, and the addition of new sensor power supplies and signal conditioning circuits, will provide complete independence of these channels from the existing Reactor Protection System.

The Farley AMSAC logic power supply will be provided by a dedicated AMSAC uninterruptable power supply backed by a battery which is totally independent from the existing battery supply for the RPS. This UPS is connected to a motor control center which is backed by a diesel generator.

Relays are provided at the output of AMSAC for isolating the non-class 1E l

AMSAC circuits from the class IE final actuator circuits. For the Farley Nuclear Plants, these relays will be mounted in two separate wall mounted enclosures, one for the Train A related actuator circuits and one for Train B. These relays will be tested with the maximum credible faults applied to the relay coil in the transverse mode. Tests will be performed with the relay coil operating contact in both the open and closed position. Figure 5 depicts the simplified diagram of this output isolation circuit, and point of application for the maximum credible faults. Details of the actual tests, fault levels and their origin, test data, and the pass / fail acceptance criteria will be submitted upon completion of the test.

Additionally, the SER requires that the isolation devices comply with the environmental qualifications (10CFR50.49) and with the seismic qualifications which were the basis for plant licensing. The isolation device is the boundary between safety related and non-safety related circuits and therefore must be qualified. For the Joseph M. Farley configuration, the isolation device will be qualified in accordance with the current Westinghouse seismic qualification program. This program has developed and implemented the requirements of IEEE-344-1975, 'IEEE Standard for Seismic Qualification of Class 1E Electrical Equipment for Nuclear Power Generating Stations' for l

Westinghouse supplied instrumentation and control systems. Environmental Qualification Reports are not applicable to the AMSAC output relays since i these are located in a mild environment. The methodology for this qualification is contained in WCAP 8587 Rev. 6-A, " Methodology for Qualifying Westinghouse WRD Supplied NSSS Safety Related Electrical Equipment'.

The subject of interferences that could negate protective actions was covered in various tests that can be found in WCAP-8892A, Westinghouse 7300 Series

Process Control System Noise Tests. This report includes a series of tests that were performed before any faults or circuitry abnormalities were applied. These tests were carried out to demonstrate that a <redible perturbation in the control wiring would not degrade protection action or be reflected back into the protection wiring. Any of these interferences (i.e.

noise, crosstalk, etc.) that would be generated by AMSAC falls under the same category as those tested for in the WCAP. Since AMSAC is separate from the reactor protection system and the cable is not routed in an area that exceeds the test lirits in the WCAP, any interference from ANSAC would not affect the reactor protection system.

The Class 1E loads operated by the isolation relay contacts are powered from a Class 1E source. The plant specific details of the wiring configuration can be found on the Alabama Power Company elementary drawing if needed.

G i ?il i iO 5*

l, 5 S .

d I '

iG .

i s

k -

I pi n 5 -

i lig O  ; S ;6 i S >

i s

EXISTING NARROW RANGE NEW TURBINE PRESSURE ~ FROM S/G LEVEL TRANSMITTERS TRANSMf1TERS MCC 1[ Q1 ll1 }l ll y NON-lE NON-lE NON-lE U V U AMSAC U V UPS XMfiTER POWER SUPPUES ,

PROCESS C0EROL CABINETS l

& SIGNAL CONVERTERS NON-lE y v v MAIN CONTROL BOARD 1

SECDON B y v u v v 5

AVSAC _EC R0s CS CA3 E- :

l 9 9 PLANT COMPUTER MAIN CONTROL BOARD

- Ause ACTUATED - TURBINE TRP FIRST OlH

- AMSC GENERAL WARNING ANN. - AMSAC

- S/G A, B & C LOW LEVB.

- AMSAC GENERAL WARNING ANN.

- CN.1&2 TURBINE PRESSURE LOW  ;

- AMSAC BfPASSED (C-20)

~

WLL W NTED RELAY WAU.W M REW PANEL - TMN A PNEL - TMN B ISOLATION I ISOLATION l

l 1 I I lE  !

9 9 9 9 sTAgrS TDATWP

- TRIPS TURBINE $g,, SNUR TD 1RW A

- clas sm am WPLIs tats 1

FIGURE 2: AMSAC BLOCK DIAGRAM

8 d 8

i I z L , O h ll

• 3 I

}) f$ 4I O

       =                                                 o.

2 m O 3 O I m + 3*E3 y, _ + 0  !!

                                            $OE          Z  y
                                                            ~

8 F y) m c 6 8 W W l%% - H @ w g - 3g -- Z

                                                         ]I 2

O

            =

Ig

g. . gs~I

                <6

NON-SAFETY RELATED HELD AMSAC 1ST STAGE

                                    % W W TED                 BSORS NCLENG AME                                WRBINE IMPUE DELD SENSORS                                                        PRESSURE TRANSMITTERS S/G N.R.tEVEL TRANSMITTERS 1          T                  1 T

1r 1r 1r v 1 r 1r "ANSMRE PROCESS PROCESS 3 SU ' PROTECTON s CONTROL

                                                                  '                                                SIGNAL CABINETS                            CABINETS                              CONDmDNERS I                                 I If                 f          V CONTROL                 AMSAC OUTPUTS                  LOGIC E

Rors E. mas I I I r l 1r y t , l SSPS SSPS TRAIN B TRAIN A 1r 1f REACTOR l REACTDR ' TRIP TRIP it ir 1r 1 r RNAL ACTUATION RNAL ACTUATION DEVICES DEVICES TRAIN A TRAIN B FIGURE 4: RPS-AMSAC BLOCK DIAGRAM

D RT R L Ol t A ATu C .OT TU AC mTIUR UR TI CC CC A A q 3 i J

                  >              > s<

r'

                                              /     '
                            /"                

N

                                      \,g
                                          \                    OY T

TA .

                                 /                             AL LE 0R Y li 5

g A L E R N O ET I T TC A tAA s L

   -        ORT                                                   O S

C POEN I OC  : 5 E R

                         -     g                                   U G

I F Ng NM OUE fR TMLS I AIXtBTL l E UK C AD U CA UM E A RE CR I B [TO O \ P RF PFC AO r ( ( . C Azr VHu e 0Ou 2Sr 1 . t IL ! -}}