ML20244B334

Rev 3 to Final Design Description of ATWS Mitigation Sys Actuation Circuitry

ML20244B334
Person / Time
Site:	McGuire
Issue date:	05/12/1989
From:	DUKE POWER CO.
To:
Shared Package
ML20244B332	List: ML20244B330 ML20244B334
References
NUDOCS 8906130072
Download: ML20244B334 (55)

Text

,_ . _ - _ _ _.

.o ,

t DUKE POWER COMPANY CATAWBA NUCLEAR STATION MCGUIRE NUCLEAR STATION FINAL DESIGN DESCRIPTION ATWS MITIGATION SYSTEM ACTUATION CIRCUITRY "AMSAC" ORIGINAL ISSUE: JANUARY 23, 1987 l

8906130072 890602 PDR ADOCK 05000369 P FDC

QQQUMENT REVISION TABLE Revision Number Dr.te 0

January 23, 1987 1 April 24, 1987 2 May 20, 1988 3 May 12, 1989 l

_7

hs- (c '

+

o y

t

7; . TABLE OF,, CONTENTS f-Section -- Ti tl e - Pace l 1.' 0_ IRIfQQl&Off 1 1.1, - BACKGROUND INFORMATION- 1-

'2. 0 ' FINAL DESIGN DESCRIPTION 2 2.1 ' DESCRIPTION OF THE SYSTEM - 2 0 2.1.1 DESIGN DESCRIPTION 2 i

2.1.2 LOSS OF MFWPT ACTUATION 3:

2.1.3 LOSS OF FEEDWATER-VALVE CLOSURE 4 3.0- RESPONSESTO'NRCAPPROVALSER_ OFT 0flCaliRE20RI 11 1 1

1 (WCAP-10858) - PLANT SPECIFIC INE0RMAT10N' i

4.0 RESPONSES T0' APPENDIX-A. AMSAC ISQLATION DEV.IfES 27 1

-l 5.0 - IMPLEMENTATION SCHEDULES '28 'j i

I

'l

'I Rev. 3 s

, .c ,

.;, . , , j.

+

d

' f'

. TABLE OF CONTENTS (Continued) 1 Section. Title.. Page 6.0 ATTACHMENT 1. RESPON_SES TO NRC_REOUESlf.0JLADDITIONAL' -29 INFORMATION LATED APRIL 9. 1987!

L7.0' ' ATTACHMENT 2. RESPONSES T0_NRC' RE0VJSLE0LADDJTI.ONAL  : 36' INFORMATION DATED JUNE 18_. 19_81 8.0 ATTACHMENT 3. RESPONSES TO NRC REQUISLEOR. ADDITIONAL =41 INFORMATION DATED OCTOBER 20.-1987-

)

i i

j l

1 Rev. 3

s 3 t

1.0 INTRODUCTION

In response to the JulyL16,~1986.NRCfStaff! Safety Evaluation Report fors

.WCAP-10858 "AMSAC Generic Design ~ Package",-Duke Power. Company submits,the following Final Design' Description for'the Catawba,and McGuire Nuclear Stations;-. Plant specific information is contained in the-final design description for each of the plants.

1.1; BACKGROUND INFORMATION On July 26, 1984 the Code of Federal Regulations (CFR) was amended to include Section 10 CFR E0.62, " Requirements for Reduction of Risk from Anticipated

- Transients Without- Scram (ATWS) Events 1for' Light' Water-Cooled Nuclear, Power Plants" (known as the "ATWS Rule"). . An ATWS is an avpected operational l

transient (such as loss of feedwater' . loss of condenser vacuum,- or loss of offsite power) which is accompanied by'a' failure of the reactor trip system (RTS) to shut down the reactor. The ATWS rule requires specific improvements in the design and operation of commercial nuclear power facilities to reduce ,

l the likelihood of failure to shut down the reactor following anticipated

.]4 transients, and to mitigate the consequences ~of.an ATWS event. j I

i l

1 q

EMEL3/1 Rev. 3 l l

- - - - _ - _ _ _ _ _ _ _ _ _ _ _ - _ - - _ _ _ _ - n

• :.. s

.I

~ 2.0 FINAL'OESIGN DESCRIPTION y

The basic requirements for Westinghouse plants'is specif.ied in Paragraph'(c)(1) of 10 CFR 50.62, "Each pressurized water reactor must have' equipment from.

sensor. output to final aqtuationl device, that is diverse'from the reactor l trip

~

system, to automatically initiate the'au'xiliary (or-emergency) feedwater system and. initiate a t'urbine trip.under conditions indicative.of.an ATWS. 'This.

equipment must be designed to perform its function in a reliable manner and be independent (from sensor output to the final. actuation device) from the

.'exi st ing reactor.tr p; isystem. "

I

2.1 DESCRIPTION

OF THE SYSTEM l

l ,

The AMSAC system that will be installed at:the Catawba and McGuire Nuclear Stations is based upon the Westinghouse Owners Group (WOG) WCAP-10858 "AMSAC Generic Design Package" generic design 3. The following sections. describe the' ,{

plant specific design for the Catawba and McGuire stations. Des'ign differences

'for Catawba ~ Unit 2, which has model D5 steam generators, are specifically-  ;

identified.  :

l 2.1.1 DESIGN DESCRIPTION 1

-)

1 l

The AMSAC design for thel Catawba and McGuire stations-is based on conditions that are indicative of an ATWS event. The system will monitor the main feed-water control valves, main feedwater control bypass valves, and the main feed-water isolation valves for position and will monitor both main feedwater pumps for operating status.

.EMEL3/2 Rev. 3

. 4 g' , j

-e Actuation of.AMSAC will. occur whenever:

0 Both main. feedwater pumpslare tripped.

- or -

LO =When main-feedwater. flow to the steam generators is blocked

'due'to inadvertent-valve closura Failures of other' Condensate - Feedwater system components or' equipment upstream of;the main feedwater pumps which could result in'the loss of, feedwater to the steam generators will not be monitored. This is because those events will result in loss of the main feedwater pumps due to low: suction . flow:

or pressure.

2.1.2 LOSS OF MAIN FEEDWATER PUMP TURBINES' ACTUATION The actuation of the AMSAC system on loss of both main'feedwater pumps will be by three pressure switches monitoring the hydraulic _ control oil pressure to the:

.stop valves for each turbine. Each of the feedwater pump turbine stop valves will close whenever there is a trip of the turbine. These pressure switches will monitor the hydraulic oil pressure holding the stop valves open. Whenever the pressure switches sense a loss of pressure, indicative of a: turbine trip,'a'

'two-out-of-three logic circuit will actuate; If both pumps ~are tripped then the AMSAC circuitry will perform the following:

.1 L

i

1) -Trip the main turbine EMEL3/3 ,

Rev. 3-

1j ,

.e .,

2) Start both motor driven auxiliary feedwater pumps:

3) 'Close the steam generator blowdown and sampling valves.

The actuation of the main-turbine ~ trip lis~ performed via the Turbine Supervisory Instrumentation system which is independent and separate from the Reactor Protection system.

Actuation of the motor driven auxiliary feedwater pumps and closure of the-I blowdown and sampling valves occurs'as-part of the nnrmal control features for' ,

each system.

l See Functional' Logic / Block Diagram'1 or 2 for examples of;the above circuits.

2.1.3 LOSS'0F FEEDWATER - VALVE CLOSURE 2.1.3.1- Loss of Feedwater for 01 m DL_D.3 Steam Generators The following describes conditions and equipment to be mon'itored for the McGuire 1 and 2 and Catawba 1 units. The differences between the D1,- D2, D3 steam generators and the D4 and D5 models deals mainly with feedwater flow conditions during normal power operations. D1, 02 and D3 models do not use the split flow to the upper nozzle at power'as do the 04'and D5 models. For plants I

with D1, D2 and D3 models, it will be necessary to monitor the feedwater control valves, feedwater control bypass valves and feedwater isolation valves

.I for closure conditions which could lead to a loss of feedwater condition.

EMEL3/4 Rev. 3

-_u__ _ _ . - . - _ _ _ _ _ _ _ _ _ _

... =,-

4 The actuation of the AMSACTsystem on closure-of the'.feedwater flowpath valves

~

. position.will be by: limit switches monitoring the valves position. Closure of:

3 out.of the-4 flow paths will cause the following to occur:

1) Trip the main turbin,e

'2) Start both motor driven: aux 111ary feedwater. pumps

3) Close the. steam generator blowdown and sampling valves McGuire 1 & 2 and Catawba 1 The following description applies to the McCuire Nuclear Station Units 1 &.2 and Catawba Nuclear Station Unit 1 feedwater systems for feedwater flowpath-monitoring:

These units can be operated above the 50% power level with the feedwater control bypass valves fully open in order to make the feedwater system more Perturbations in the feedwater. control system can be

~

perturbation tolerant.

tolerated and responded to in a less operator burdensome manner with the feed-water control bypass valves open.

Limit switches on the feedwater control-bypass valves will be set to actuate-

- whenever the valve is not fully open. This typically corresponds to a 90% open-setting.

EMEL3/5 Rev. 3

2 Feedwater control valve 11mit switches' used for AMSAC applications,will- be set at a 25% open setting which relates to a 15% main'feedwater flow setting toL account for valve regulating movement. Feedwater Isolation valve limit switches wil1 be set at the-full closed valve position since these: valves are

~

operated as open-closed v,alves only.

The'feedwater control and control bypass valves position signal will be delayed-30 seconds prior to actuating the valve closure port. ion of the' AMSAC logic to prevent potential trip conditions when steam generator level perturbations'-

cause rapid feedwater. control valve movements. These valve ~ fluctuations could; cause unwanted unit trips if not for'the time delay when the unit is above.the 40% power level and the circuits have been reset automatically.

The actuation of the turbine trip'on feedwater flowpath valve closure.is performed via the Turbine Supervisory Instrumental!on system which is indepen-dent and separate from the Reactor Protection system. A "First-out"'annunci-ator installed in the control room will alert the operator that,the turbine has j tripped due to the AMSAC logic. A second annunciator is provided to' indicate the status of the AMSAC feedwater valve logic. A third annunciator alarm already exists for the loss of both main feedwater pumps condition. Status lights are provided to indicate when a feedwater finwpath (control / bypass-I valve) is closed. A status light is also provided to indicate when any  ;

feedwater flowpath has been closed for 30 seconds. ')!

l Computer points will be provided for the feedwater control valves to indicate  ;

i when these valves are in the 25% or less open condition. Computer points'are i

i EMEL3/6 Rev. 3 I

_ _ _ _ _ _ _ _ J

5l n.; . .

r- t also provided.for the'feedwater control byp' ass valves to indicate'when they are-not fully;open.

q i

Actuation of the motor driven auxiliary- feedwater pumps and closure of the.

steam generator blowdown',and sampling valves occurs.as part of the normal control features for each: system.

The: actuation.of AMSAC due to feedwater flow path valve; closure is.automati-

- cally bypassed whenever the unit is below a 40% power level. This is.necessary ,

1 to' allow proper start up of the unit due toisteam generator pre-heating.

requirements and.feedwater control valve. operational characteristics. Normal startup calls for the feedwater' control' valves.to remain closed until approximately 15% power and the feedwater isolation valves. to remain closed until steam generator preheating requirements:are mat.

The use of a 40% load value is based.upon the WCAP .setpoint submitted by the-WOG in the February 27, 1987 Addendum.

i

)

- See.Section 3.6'for a detailed discussion of the oparating bypass and reset .

mechanism.

l i

i See Functional Logic / Block Diagram.1 for McGuire 1 & 2 and Catawba 1.  ;

i 1

2.1.3.2 Loss of Feedwater for D4 and D5 Steam Generators The' following describes conditions and equipment to be monitored for the Catawba Unit 2 which uses model D5 steam generators. D5 steam generator's I

i EMEL3/7- Rev. 3i 1

J

g .u 4

-_= c l

utilize.a ' split flow feedwater arrangement where approximately 10% of the-normal; fu11 ' power feedwater(flow is' diverted through the feedwater. pre-heaterc

-bypass valve'(Westinghouse notationiFPBV). The rematrider of..the' flow followsf the ~ normal pathway through the feedwater isolation valve. Closure of the

~

U

-isolation. valves would nqt result in aJ1oss of all feedwater flow to the steam -

generator. Feedwater' flow to the upper nozzle would provide protection and mitigation against reactor coolant system overpressurization.

The_ actuation of the AMSAC system on closure 'of thn' main feedwater control and . .

bypass valves will be by limit switches monitoringLthe valves position.

. Closure of 3 out of the 4 flowpaths will.cause the following to occur:

1 1)- Trip'the main turbine

2) Start both motor driven auxiliary feedwater_ pumps 1

3) Close the steam generator blowdown.and sampling valves Catawba 2 a

I The-following description applies to the Catawba Nuclear Station Unit 2 feedwater systems for feedwater flowpath monitoring:  ;

1

!~ The unit can operate above the 50% power level with the feedwater control l-bypass valves fully open'in order to:make the feedwater system lmore perturba '-  !

tion tolerant. Perturbations in the feedwater control system can'be~ tolerated- l i

1 i

EMEL3/8 Rev.,3

_ __ - _ l

j j- a 4

l Land responded to in a~less' operator burdensome manner with the'feedwater-control bypass valves open.

. Limit switches on th'e feedwater control. bypass valves will be set to' actuate whenever,the valve is not, fully open. This't'pically y corresponds to'a 90% open  !

se'tti ng. Feedwater control valve' limit switches ~used for AMSAC applications-will be set'at a 25% open setting which relates to a 15% main feedwater flow -

setting to account-for valve' regulating movement.

The feedwater control and control bypass valves position signal will be delayed 30 seconds prior to actuating the valve closure portion of the AMSAC logic.to prevent potential trip conditions when steam generator level perturbations. .

cause rapid feedwater control valve movements. These valve, fluctuations could cause unwanted unit trips if.not for the time delay when'the unit'is above the 40% power level and the circuits have been reset automatically.

The actuation of the turbine trip en feedwater flowpath valve closure is performed via the Turbine Supervisory Instrumentation system which is indepen-dent and separate from the Reactor Protection system. A "First-out" annunci-ator installed in the control room will alert the operator that the turbine has tripped due to-the AMSAC logic. A second annunciator is provided to indicate the status of the AMSAC feedwater valve' logic. A third annunciator alarm already exists.for the loss of both main feedwater pumps condition. Status lights are provided to indicate when a feedwater'flowpath (control / bypass valve) is closed. A status light is also provided to indicate when any W <ater flowpath has been closed for 30 seconds.

EMEL3/9 Rev.'3-

t Computer points will be provided for the feedwater control valves to indicate when these valves are in the 25% or less open condition. Computer points are also provided for.the feedwater.contr'ol bypass valves to' indicate when they arel 1

not-fully open.

i

' Actuation of the motor driven auxiliary feedwater pumps'and closure'of 'the steam generator' blowdown.and sampling valves occurs as part of the normal I

control features for each system.

The actuation of- AMSAC due to .feedwater; flowpath valve closure.is automatically bypassed whenever the unit is below a 40% power. level.

2 This is necessary to allow proper start up'of the unit due'to steam generator pre-heating requirements and feedwater control valve operational ch'aracteristics. . Normal startup calls for the feedwater control valves to remain closed'until approximately 15% power and the feedwater isolation valves to remain closed j until steam generator preheating requirements are met.

The use of a 40% load value is based upon the WCAP ietpoint submitted by the WOG in the February 27, 1987 Addendum.

See Section 3.6 for a detailed discussion of: the oriarating bypass and reset l mechanism.

See Functional Logic / Block Diagram 2.for Catawba 2. j i

l l

EMEL3/10 Rev. 3

3.0' RESPONSES TO NRC SER- ' TOPICAL 1REP 0_RT (WCAP.-IDB18.). -

PLANT SPECIFIC INFORMATION 3.1' DIVERSITY The 'AMSAC ' design for the~ Catawba and McGuire' Nuclear Stations' is designed' to maximize'the diversity between equipment'used for AMSAC and the Reactor Protec-tion System (RPS).

~

The equipment used to detect conditions indicative of-an ATWS,as described in Sections 2.1.2 and 2.1.3 is independent of all equipment used in the' Reactor-

~

Protection System (RPS).

The pressure switches which detect' trip conditions of the aain feedwater pumps will provide only AMSAC.related functions. These sensors will not have'any interface with the RPS. l

,i Limit switches are used to detect valve position for the main fe'edwater isola-- 3 l

tion valves, the main feedwater control valves and. the feedwater control bypass valves and provide AMSAC input signals. The valve limit switches used for AMSAC input signals do not provide'any signals to the RPS.

~

q 3.2 LOGIC POWER SUPPLIES ..

I j

Power supplies for AMSAC logic power will be selected from existing plant  ;

i sources which will provide the maximum available independence from power I supplies used by the Reactor Protection System (RPS).

j i

EMEL3/11 Rev.'3- l

t Highly reliable non-interruptible non-safety power sources will be utilized for the AMSAC design since the parameters being monitored are also non-safety.

The AMSAC design will utilize the 125 VDC station auxiliary batteries for the power supply. Power will be distributed to the circuits through existing distribution centers.

Catawba will use Distribution Centers ICDA and 2CDA which are shown in Catawba Nuclear Station FSAR Figure 8.3.2-1.

McGuire will use Distribution Center DCA-1. The distribution center is shown in McGuire Nuclear Station FSAR Figure 8.3.2-2.

3.3 SAFETY RELATED INTERFACES The proposed AMSAC design does not have any interfaces with the existing RPS.

Therefore the RPS will continue to meet the existing safety criteria.

Auxiliary Feedwater, Steam Generator Blowdown and Steam Generator Sampling are j systems which are safety related or have safety related components which will receive AMSAC inputs as described generally in the WCAP. Interfaces with safety related systems will be designed such that the safety related system will perform its function coincident with a postulated failure of the non- j safety AMSAC input.

l l

EMEL3/12 Rev. 3

a. ca 3.4 OVALITY ASSURANCE' Inresponseto. Generic' Letter 85-06,f"QualityAssuranceGuidanceforATWS5 l Equipment that is not Safety Related", the existing. Duke. quality programs were reviewed to' determine-the need-for any necessary changes or additions.

This review indicated that no new or separate quality program'was neededito'ade-

~

l quately' cover non-safety related ATWS equipment. However, based on the eigh--

teen criteria of the NRC quality assurance guidance, some: adjustments were

~

required to the implementing practices and procedures in order to, clearly apply-these to ATWS items. The results of the review are described below on a criterion-by-criterion basis:

I '. Organization - the existing Duke organization meets the guidance of Generic Letter 85-06.

II. Program - a new and separate quality program for non-safety related ATWS equipment was not developed. The existing Duke practices and procedures were determined to be adequate in overall content to cover ATWS items.

l l However, minor changes to the existing Duke practices and procedures have been made as described for each appropriate criterion.

l III. Design Control - the existing Duke Design Engineering Department proce-dures and the Nuclear Station Modification Program were determined to meet Generic Letter 85-06.

EMEL3/I3 Rev. 3

_ - _ = _ , _ _

< F IV. Procurement Document. Control - the existing Duke Design Engineering-Department procedures and'the Nuclear Production Department Administra-

. tive Policy Manual for Nuclear Stations were determined to meet Generic Letter 85-05.

V; Instructions', Procedures, and Drawings.- a requirement for the development; and use of plant procedures on ATWS. items was added to.ti;e Nuclear Produc -

tion' Department Administrative Policy Manual for:Nurlear Stations. This was the'only change to Duke practices and procedures determined to be inecessary to. meet Generic Letter 85-06.

VI. Document Control - the existing Duke practices and procedures were deter-mined to meet Generic' Letter 85-06.

VII. Control of Purchased Items an'd Services - the' requirement to. control pur-chased items and services for ATWS equipment including receipt inspections was added to the Nuclear ~ Production Department; Administrative Policy Manual for Nuclear Stations.

VIII. Identification and Control of Purchased Items - station specific listings of ATWS related systems and components will be added to each station's Quality Standards Manual to facilitate identification. Otherwise, the existing Duke practices and procedu'res were determined to meet Generic Letter 85-06.

i I

EMEL3/14 Rev. 3 1

_ _ _ - _ - _ - - - _ _ __ _ - h

IX. Control of Special Processes - the requirement to control special pro-cesses for ATWS equipment was added to the Nuclear Production Department Administrative Policy Manual for Nuclear Stations.

X. Inspection - the ingpection of ATWS items was added to the Nuclear

' Production Department Administrative Policy _ Manual for Nuclear Stations.

XI. Testing - the testing ofLATWS items was added to the Nuclear Production Department Administrative Policy Manual for N_ucl_ ear Stations.

XII. Control of Measuring and Testing Equipment - the control of measuring and test equipment for ATWS items was added to the Nuclear Production Department Administrative Policy' Manual for Nuclear Stations.

XIII. Handling, Storage and Shipping - the existing Duke practices and proce-dures were determined to meet Generic Letter 85-06.

XIV. Inspection, Test, and Operating Status - the existing Duke practices and procedures were determined to meet Generic Letter.85-06.

XV. Non Conformances - the existing Duke practices'and procedures were deter-mined to meet Generic letter 85-06.

XVI. Corrective Action System - the existing Duke practices and procedures were determined to meet Generic Letter 85-06.

EMEL3/IS Rev. 3

XVII. Records - the existing Duke practices and procedures were determined to meet Generic' Letter 85-06.

XVIII. Audits - the existing Duke ' practices: and procedures were determined to meet Generic Letter,85-06.

3.5 MAINTENANCE' BYPASSES The components selected for the AMSAC design will be' of reliable' design and installed.in such a manne'r to enhance preventive and scheduled maintenance.-

-Where maintenance may be required at power, design features will be provided to assist the^ maintenance technicians in that performance.

Features that assist in maintenance at power.can be described as' adequate planning of system design configuration to enable the technician to service.

individual components without undue hazard and jeopardy to plant'_ operation.

Examples of the nature of the features are as follows.

1) Isolation valves in hydraulic lines such that a pressure switch that has' failed may be isolated for removal and replacement.

2) Test switches, fuses, and the locating of sliding link terminals such that i i

electrical isolation of the component can also be accomplished.

-3) Proper notification through plant monitoring systems to the operators that )

a failure of a component has occurred such that prompt corrective maintenance can be taken.

EMEL3/16 Rev. 3.

. i.

4) Location of equipment and components with' maintenance' requirements'in mind.

A human factors. review will be per' formed' on: all controls and indications to-

< ensure that they can be utilized in an efficient and'readily understood manner..

Indication of any bypass will be provided in the main control room and will be par.t of the human factors review.

3.6 OPERATING BYPASSES.

The AMSAC design for both the Catawba and McGuire plants does use an operating bypass. The purpose of this bypass is to' allow the operators to bring'the plant up in power using alternate flow paths to the steam generators and to meet steam generator preheating requirements. The nnrmal flow paths through the feedwater-control valves and the~feedwater. isolation ~ valves cannot be used because of pre-heating requirements associated with the steam generators. ,

3,6,1 MCGUIRE UNITS 1 AND 2 For .McGuire, the feedwater flow paths are aligned in different ways depending -

upon power level and steam generator. pre-heating requirements.

]

Up to 15%

.i l

! l The feedwater, control bypass valve is open to allow forward feedwater flow. ,

i The feedwater control valve is closed and the feedwater isolation valve is l

EMEL3/17 Rev. 3

. 1 4  :,; _

~

. closed.- Feedwater is aligned to the" steam' generator through the feedwater preheater bypass valves.

-Above 15%

The feedwater control bypass valve is closed while simultaneously. opening the

.feedwater control valve. When the preheating requirements have been met for -

the steam generators, the feedwater' isolation valves are opened. This typically occurs around 20-30% load.

Above 50%

The feedwater control bypass valves are reopened at 50% power level to~ provide an additional flowpath to the steam generators. This parallel operation of the.

bypass valves provides increased flexibility in dealing with feedwater control valve upsets.

The AMSAC controls must bypass the valve status inputs into the AMSAC. system below 40% unit load. In addition, for low load values typically between 30-50%, the feedwater control valves can modulate into the 25% open range. A-status light is provided in the control room for the operator to indicate when any of the four flowpaths is blocked for 30 seconds and when an individual flowpath is blocked. Computer inputs are also provided to determine which ,

l feedwater control valve is below 25% setpoint. When the unit is in a stable operating condition, the operator will increase the power. level and the valve -j status actuation will be armed due'to the fact that the bypass is automatically removed at 40% load by the turbine impulse chamber pressure switches.

EMEL3/18 Rev. 3

~

-c .:

3.6.2 CATAWBA UNITS 1 AND 2 For Catawba, the feedwater 'flowpaths 'are alignedtin' two ways depending upon 1

~

power levels' and steam generator pre-heating requirements.

Up to 15%

Catawba is aligned similarly to McGbire' for this powe:r range. The feedwater control bypass valves are open and the feedwater control. valves are closed.

The feedwater isolation valves are also closed and feedwater is aligned to the steam generators through the feedwater preheater bypass valves.

Above 15%

The feedwater control bypass valves are closed while simultaneously opening.the feedwatrr control valves. When the pre-heating requirements have been' met for the steam generators, the feedwater isolation valves are opened. This typically takes place around 20-30% unit load.

From 15% power on up to'100%, the feedwater control valves through the feed-water isolation valves is the primary flow path. Occasional exceptions do occur where the feedwater control bypass valves are opened to enhance feedwater flow and flow stability at higher power levels (i.e.. above 50%). The D5 model steam generators used on Catawba Unit 2 do have a 10% bypass as described in L Section 2.1 3.2.

1 l'

EMEL3/19 Rev. 3

.c .-

)

.- ) ,

The'AMSAC controls must bypass the valve status inputs into the.AMSAC system below the 40% unit load. In addition, for low load values typically between-30-50%, the feedwater control-valves can' modulate'into.the 25% open range. A status light'is provided in the control' room for' the operator to indicate when any of the four flowpathg.is blocked for.30 seconds and when an individual flospath.is blocked. Computer' inputs are'also provided to determine which

. feedwater control valve is below 25% setpoint. When the unit is in a stable..

operating condition, the operator will increase the power level and the valve status actuation will be armed due to the fact that'the bypass is automatically removed at 40%' load by the turbine impulse chamber pressure switches.

3.7 MEANS FOR BYPASSING 3.7.1 MCGUIRE UNITS 1 & 2 AND CATAWBA UNITS I & 2 The means for bypassing the valves' status input into'the AMSAC system is'by a control' switch mounted in the main control room and by automatic circuit logic 120 seconds after the turbine impulse chamber pressure has dropped below the 40% unit load as allowed in the WCAp. Both manual and automatic bypass cap-ability is provided. The operators have the capability to_ manually bypass the feedwater valves portion of the AMSAC circuitry before the~120 seconds have-elapsed in order to gain unit control during load reductions and prevent spurious trips.

One example of a spurious trip that could occur is an event associated with load rejection (i.e., a non-ATWS type event because the reactor trip signal is not required). The spurious trip could be produced when counterproductive i

EMEL3/20 Rev. 3

competition develops between-the need to reduc'e'feedwater flow (close down the feedwater control' valves) and the AMSAC logic monitoring those same valves. ' If the valve portion of the AMSAC logic is not by passed, low feedwater flow demand could lead to the AMSAC logic initiating a main' turbine trip. .In 4 addition to the' main turb,ine trip, a reactor trip would follow due to reactor-trip on main turbine trip. This could occur if the AMSAC logic were.to actuate (because of feedwater valve position monitoring)'. .The resulting loss of auxiliary power. induces a loss.of the main feedwater pump by tripping the-botwell and condensate booster pumps.

Both McGuire and Catawba Nuclear. Stations have procedures in place that deal

~

with the pressure switches that arm or disarm the valve monitoring portion of-the AMSAC logic through the use of a manual reset or bypass. In addition, the' McGuire Nuclear Station has modified its station emergency procedure that deals with load rejection to include the use of the manual feedwater valve position bypass. All station procedures are subject to a continual revie'w process which could lead to employing the use of the manual bypass function at both plants.

Any such use of the manual bypass function would not be'used to circumvent the 40% power threshold and would not be employed during the first 30 seconds of the normal 120 second delay. Use of the bypass switch to' circumvent the 120 second time delay is not permitted if a reactor trip signal'is present. Use of the bypass switch is restricted to the above mentioned procedures and l

conditions. 'j i I l

This control switch is provided with an indicating light to indicate whether l

the valves' status portion of the system is bypassed. An illuminated ]

indicating light will continuously indicate when the system is reset. l i

EMEL3/21 Rev. 3-

t 4

The. reset feature'of the.AMSAC design forith'e' operating bypass will also be activated automatically by two pressure switche's (in a'two'-out-of-two logic) monitoring first stage turbine impulse. chamber pressure. These pressure switches will be set to l'nitiate the automatic resetting of the bypass when turbine loading reaches a, point coincident with'a. plant'. loading of-40%. This will provide automatic resetting of the bypass independent of1the. operator contr'olled bypass switch. The' pressure switches which monitor turbine load will not have any interfaces with the RTS. A failure in-the RTS cannot prohibit this reset.

The automatic bypass is also performed by the turbine. impulse chamber pressure switches. These switches activate a. timer which will instate'the. bypass of the AMSAC feedwater valve circuitry 120 seconds after the pressure has' dropped below the 40% setting.

A human factors review will be conducted on the bypass controls provided in the main control room.

The disallowed methods of bypassing will not be utilized in the Duke AMSAC' design.

4 3.8 MANUAL INITIATION Manual controls are available in the control room to perform a turbine trip'and start auxiliary feedwater flow. These controls were reviewed as part of the control room review described in Duke Power Company's response to Supplement 1, NUREG-0737 for both Catawba and McGuire.

EMEL3/22 Rev. 3

p , , ,

These controlsL are conveniently located

near each other enabl,ing the operator; to quickly initiate manual actions if they are required.

The controls' provided for the main turbine consist of pushbuttons, which energize the= trip solenoids which'in turn'close the main turbine'stop' valves.

e .

~

Indication is'provided which accurately provides feedback =of the turbine trip condition.

The operator can start the motor driven auxiliary feedwater pumps from the control room by. pressing their, control pushbutton which in turn will close the breaker in the switchgear and start the motor. -Indicating lights and flow indicators are available to indicate a successful start of.the motor. driven pump.

3.9 ELECTRICAL INGCDENDENCE FROM EXISTING' REACTOR _ PROTECTION-SYSTEM (RPS)

Electrical independence for the Catawba and McGuire AMSAC' design with regards to the RPS is achieved by complete system separation. The AMSAC design-has no 3 q

common control devices, power supplies or sensors with the RPS. ]

'l I,

-l The Catawba and McGuire AMSAC design and their respective RPS's are completely I separate systems and have no interfaces in common. The AMSAC system will ,

l perform its designed function regardless of failures within.the RPS. i l

l l t

i l

I i

l 1

EMEL3/23 Rev. 3 l 1

, j

_ _ _ - - - - 1

3.10 PHYSICAL SEPARATION FROM EXISTING' REACTOR P.R_0TECTION SYSTEM

-The Catawba and McGuire AMSAC system designs will utilire standard Duke separa-tion' philosophy and criteria.

Since no interface is planned between the AMSAC design and the existing RPS, complete separation is achieved.- Existing separatinn between the RPS and; non-safety related circuits 'will not be violated by the AMSAC design.

3.11- ENVIRONMENTAL QUALIFICATION The AMSAC system equipment will be located in areas'of the plant that are considered a mild environment.

3.12 TESTABILITY AT POWER AMSAC equipment will be tested prier to installation to. ensure functionality.  :

I l

The proposed AMSAC design is similar to th'e NRC accepted design' option 3 as 'f listed in WCAP-10858. The portion of the design which uses main feedwater pump status as an input is fully testable at power. The portion of-the design that i

utilizes main feedwater control and isolation valve position as an input is not fully testable at power, I

L The main feedwater control, bypass and isolation valve' status is determined by-  !

valve stem limit switch inputs. These valve stem limit switches cannot be' tested for status change at power without adversely affecting the operating  !

l l

EMEL3/24 Rev. 3 1 l

.. 1 status of the unit. It. is' proposed that the ' limit; switches for these valves be

-tested at each refueling. outage during the valve stroke tests. These limit switches can be tested during'the stroke test to verify functionability.

Stroke testing the' limit switches at power would likely trip the unit due to-system instability when one steam: generator flow path is blocked.

The main feedwater pump turbine trip sensing devices can be tested at power.

These devices are pressure switches which sense' oil pressure on the stop valve control oil'11ne. The proposed AMSAC design will utilize three pressure.

switches per turbine to sense oil pressure and will provide a trip signal.upon two-out-of-three' actuation. A selector switch and indicating light will be used to test each switch individually. It is proposed that each pressure switch will also be tested at each refueling. cycle.

Controls and indications used for testing purposes wi~11 include'a human factors examination to ensure proper operation.

3.13 COMPLETION OF MITIGATIVE ACTI_0!!

The actuation of plant turbine trip, auxiliary feedwater start,' closure of the blowdown valves and closure of the sampling valves. nnce actuated, will L

continue to completion as part of the AMSAC system design.

This is commensurate with Duke's design philosophy for important plant functions.

I EMEL3/2:i Rev. 3

o i,S 4 ,

. Operators can reset"at the.. system 1.evel the AMSAC: initiated signal,to the auxiliary feedwater system with the signal present in-order to modulate auxiliary feedwater flow. This reset allows.the operator an additionalJmethod to. control. steam generator level with the blowdown vslves to' prevent any possible' overfilling. This reset.is provided as part of;the existing normal ',

I auxiliary feedwater' system' controls.

The AMSA'C signal'itself can onlysbe reset by either 1) resetting the main feedwater pump turbines and 2) opening two feedwater control and isclation valves or placing the valves' status bypass switch in the bypass mode below 40%

load.

3.14 TECHNICAL SPECIFICATION By letter dated September ~15, 1986, Duke Power proposed a means_by which items that do not meet the~ proposed technical. specification.. selection criteria may be maintained. Duke considers that the AMSAC system does not meet any one of-three criteria proposed by the AIF (and endorsed by the Staf f in SECY-86-10) in that ATWS is an event that is'beyond the Design Basis of the plants.

Due to the high degree of reliability of the components of the system, Duke

[

considers that testing on an 18 month frequency is sufficient. l i

i i

i i

i j

EMEL3/26 Rev. 3 o- 1

, , t

.- .l b ' .m.

4.0 RESPONSE TO' APPENDIX A. AMSAC ISOLATION DEV. ICES The present design concept' for ATWS/AMSAC does_ not call for the 'use;of - ..

1solators'between it and;the existing RPS; ~The.use of'an isolator to access

available sensors also utilized by the-RPS wo'uld' require a. detailed response to.

' Appendix A. Because our design concept'does.not use those sensors,fno Appendix

A response is provided.

f

.EMEL3/27~ Rev. 3

_==___--____-_________.

5.0 IMPLEMENTATION _ SCHEDULE Potential outages have already been identified which would allow installation prior to the July 1989 deadline on each unit as outlined in the SER. The most current forecasted dates for these proposed outages is as follows:

McGuire Unit 2 EOC4 - June 1988*

McGuire Unit 1 EOC5 - November 1988*

Catawba Unit 1 EOC3 - February 1989*

Catawba Unit 2 EOC2 - March 1989*

NRC approval is needed by May 1, 1987 to accommodate the proposed installation schedule.

l

• Note: AMSAC Equipment has been installed as forecasted 1

EMEL3/28 Rev. 3

o a .

6.0 AllACHMENT 1. RESP 0NSES TO NRC REQUESlf,pH ADDITIONAL INFORMATION DATED ~APRI_L_9 J Z-

.L

1. - Identify the types- of isolation devices used -to isolate. the AMSAC from -

Class IE circuits'.

Response: ' The isolation devices-employed to isolate the AMSAC. signal:from the

' Class 1E circuits'are existing in place devices.

For.the Catawba Nuclear Station, the isolation device used'.is an-Optical Isolator manufactured by E-MAX Incorporated. -These' .

isolators are in wide spread use throughout the p.lant for applications where Class IE to Non-1E isolation is. required.

Information on the analog model optical isolator was provided.in H.B. Tucker's Letter to E.G.-Adensam dated November 1, 1985. .These devices were found acceptable for Class 1E to Non-1E isolation as described in Section 18.3.6.of the Catawba Safety Evaluation Report ~

NUREG-0954 Supplement No. 5 dated February 1986. The digital optical isolator has generically the equivalent isolation cap-abilities and has been tested for'its plant application.

For the McGuire Nuclear Station, the isolation device used is the coil to contact separation provided by the system relays. Relay isolation is applied at the McGuire Nuclear Station for most $11 i

l intersystem signal transfer. Relays used in this application are Cutler-Hammer Type'D26.

EMEL3/29 Rev. 3

m , ,

The Duke' design for.the ATWS/AMSAC. system'doestnot utilize sensors common to the Reactor Trip System (RTS). Therefore _no isolators 'are '

required for sensor isolation ~. The control. interfaces between the-non-safety ATWS/AMSAC system and the already' existing plant.systemsg described-in'!iection 3.3'are the only places where isolation ~ occurs.

and this employs existing and accepted devices.

2. , Provide a block diagram _of the ATWS/AMSAC design. As'a minimum, the block diagram should show.the~ Class IE to non-Class 1E interfaces and the classification and point-of application of the power . source for the AMSAC' equipment and isolation devices.

Response: A functional logic / block diagram of the'ATWS/AMAC design'is enclosed to replace the logic drawings' submitted in the original Design Description of January 23, 1987.

1

3. -The WCAP-10858P-A report, as' approved by'the Commission, specifies'a 30-second time delay upon the initiation of the AMSAC signal and a 120-second time delay upon the termination of the AMSAC signal. The proposed system design does not provide for these.two time delays.

Discuss why they are not included in the system design.

I Response: The 30 second time delay specified in the WCAP report is not a required time delay for AMSAC signals in Design Option 3 except for. {

the trip signal which.goes to the turbine. The turbine trip signal 'l j

i originated in AMSAC will be delayed by the WCAP specified amount when that value is determined by the Westinghouse Owner's Group. i l

The 120 second time delay upon termination of the AMSAC: signal as l l described and shown in the WCAP is provided to delay automatic removal of the signal when the plant load decreases below 40% to allow for completion of the AMSAC actions following a turbine' trip.  !

)

EMEL3/30 Rey; 3 1 1

x______-__--. _- .I

d e .

j

' The Duke. design does not use automatic ~ removal of the AMSAC. load permissive signal. The. Duke design has a manual _' removal of the' load

. bypass to the valve's status portion of the'AMSAC logic. Thisz  :

manual bypass'.does not,become automatically installed at any. time-during a trip, event.

It-is provided to allow the' operators the

. ability to bypass'the valve's closed input. signal during start-up'-

conditions. The feedwater pump's status signal is always present in.

the AMSAC logic and is not operator bypassed at any time.

4. Expand upon the technical merits of inhibiting AMSAC be' low the'56% power level rather than the 70% power level specified by WCAP-10858-A. Justify the 56% power level.

Response: Based upon the Westinghouse Owner's Group Letter " Addendum.1 to WCAP-10858-P-A and WCAP-11293-A: "AMSAC Generic Design Package",

dated February 26, 1987 the AMSAC manual bypass permissive-will be changed to 40% power level. This change reflects the load changes identified in the WCAP addendum.

5. ' Section 3.5 of your submittal' states that' FEATURES will be provided to assist in maintenance. Discuss the nature of these features.

Response: Features that assist in maintenance at power can be described as

. adequate planning of system design configuration to enable the technician to service individual components without' undue hazard and jeopardy to plant operation. Examples of the nature.of the features are as follows:

1) Isolation valves in hydraulic lines such that a pressure switch that has failed may be isolated for removal and replacement.

EMEL3/31 Rev. 3'

2) Test' switches, fuses, and the locating of sliding link terminals such that electrical isolation of the component can also be accomplished.

3) Proper notification through plant monitoring systems to' the operators that a failure of a component has occurred such that' prompt corrective maintenance can be taken.

l 4) location of equipment and components with maintenance requirements in mind.

l l

l

6. Your submittal did not verify that the disallowed methods of bypassi,ng are not utilized. Under what conditions are the actions of lifting leads, pulling fuses, tripping breakers, or physically blocking relays employed?

Response: As described in Sections 3.6, 3.7 and 3.17 means for bypassing the l feedwater valves input below 40% power and testing the Main Feedwater Pump Turbine trip oil pressure switches at any power level is provided. These provisions do not employ any of the disallowed l methods of bypassing.

Lead lifting, fuse pulling and breaker tripping are not allowed as means for providing any bypass.

7. Section 3.13 implies that the operator can abort the mitigative action of AMSAC before it goes to completion. This is contrary to the approved design described in WCAP-10858P-A. Clarify this section of your submittal and justify the proposed design. Also, can the operator abort the AMSAC initiated turbine trip signal before the turbine trips?

Response: The design of the ATWS/AMSAC circuits and their interfaces with the EMEL3/32 Rev. 3

l' { , c Y'

' mitigative' systems already-installed at the plant is in conformance.

with'the approved' design described;in the WCAP.

As' described in Section 2.0 of the.WCAP under design criteria item

14) "AMSAC shall be designed'so that,'once actuated,'the completion of mitigating action'.shall be consistent with the plantiturbine trip _

and auxiliary feedwater circuitry."-

F

- The Duke design for AMSAC is consistent with our: plant turbine. trip and auxiliary feedwater system circuitry. :These systems and their design have been approved through the licensing review. process.

The last paragraph of Section 3.13 will be revised to change."or" to "and" as printed prior to 2).

The operator can only reset or bypast the AMSAC. signal'as described in Sections 3.6 and 3.13. He cannot abort the.AMSAC initiated signal for a turbine-trip unless the unit is below 40% power level.

The WCAP does not require automatic initiation of AMSAC below 40%; '

power.

The operator cannot block the mitigative actions of,the plant

~

l

]

i l- systems required by AMSAC. AMSAC level bypass of'the feedwater- -

i valve status signal can only be done manually below 40% unit-load.

8. The. logic diagrams with-your submittal do not show'all of the operator

- initiated resets, inhibits, blocks, and bypasses described in the submittal. Re-submit or supplement the logic diagrams showing the logic

- function of all operator initiated actions.

.EMEL3/33 Rev. 3

s

]

.i

,. . -l

q

' Response: The Duke design submittal;for AT'S/AMSAC W did not: intend to.show al'1 of the existing system level resets, inhibits, blocksand. bypasses.

The.ATWS/AMSAC' logic. diagrams,were provided consistent:with the level of detail'provided in the WCAP to enab1'e review of the

.o 1

specific AMSAC design. logic developed.by Duke. ,

d

.The brief descriptioof n the existing system level operator initiated action was provided to assist in the review of plant shutdown conditions once the. reactor had been manually. tripped by

~

the' operator and the control off steam generator water level'was <

' required.

Supplemental logic diagrams are enclosed for the mitigative actions required by the ATWS/AMSAC to.show operatnr initiated actions which would impact the performance of the Auxiliary Feedwater Motor Driven Pumps, Steam Generator Blowdown Isolation Valves and the Steam Generator Sampling Valves.

i The main-turbine cannot be reset with any' trip signal present. The' AMSAC signal will' maintain the turbine tripped until the AMSAC initiating conditions have been cleared.-

The operator cannot bypass the ATWS/AMSAC signal to trip the turbine i

as above 40% unit load as described in Section-3.6.and 3.13, and.the response to question 7. The operator also cannot abort the ATWS/  ;

i AMSAC signal above' 40% unit load.  !

i i

l l

J R

EMEL3/34 Rev. 3

9. The Westinghouse Owner's Group (WOG) plans to transmit to the NRC a supplement to WCAP-10858P-A containing a new permissive power level (40%)

for AMSAC and new actuation setpoints for the optional designs previously l discussed in the WCAP. Discuss whether the new permissive and new l setpoints have been taken into account for both the McGuire and Catawba AMSAC designs. If not, state whether you intend to provide revised l permissive level and actuation setpoints and when.

l Response: Yes, the Duke *ATWS/AMSAC design will take into account, for both McGuire and Catawba, the new information contained in the WCAP addendum. The new power level permissive (40%) has been integrated l

into the design. Also a review of the impact of the turbine trip l

time delays will be undertaken once that information is available from the WOG.

The original submittal of January 23, 1987 will be revised to reflect any WOG changes that impact the Duke design.

EMEL3/35 Rev. 3

-7.0 ' ATTACHMENT'2. RESPONSES TO NRC_ REQUEST F01 ADDITI0._NAL INFORMATION DATE0 JUNE 17. 1981 i

.I

1. The response to Question 3 of the April:9, 1987 letter stated that the WCAP recommended a time delay of 30 seconds for the initiation of the AMSAC- signal is not required. The staff'needs additional information/

justification regarding the omission of the 30 second time delay as recommended by the WCAP.

Response: The response to Question 3 of the. April 9. 1987 letter stated.that

.the'30 second time delay utilized in the WOG Design Option 3, contained in WCAP-10258P-A Section 4.0, is not required for the McGuire and Catawba AMSAC designs. The justification for'the omission of the 30 second-time delay as recommended-in the WCAP is based upon the original design of the Auxiliary Feedwater system interfaces with the Main Feedwater system concerning loss of the main feedwater pumps.

The existing design of the McGuire and Catawba plants utilize starting the motor driven Auxiliary Feedwater (CA) upon loss of both /

Main Feedwater Pump Turbines (MFWPTs). When both MFWPTs trip, the CA motor driven pumps automatically start without any designed-in.  !

t ime E'/ ay. This feature is described in both-the Catawba and McGuire FSAR Sections 7.4.1 and 10.4.7. ,

I The existing design starts CA anticipatory to the low-low steam generator level set point used in the protection system to_ start auxiliary feedwater. Experience has shown that when forward feed-water flow is stopped, the low-low setpoint is reached very quickly.

i EMEL3/36 Rev. 3 i

^:

e

s'- .

The omission of the 30 second- AMSAC signal time-delay allows the original design'of the auxiliary feedwater motor driven pumps to be maintained with respect to s' tarting directly upon loss of all (both) the main feedwater i

pumps.

1

-2. The response to the RAI (April:9,'1987) is not clear.as to why the C-20 TD00 provision is not being implemented. This TD00 ensures that the AMSAC mitigative action once started goes to completion. . Provide the details of how the AMSAC initiation signal'is maintained upon.AMSAC actuation.

Response: The C-20 TD0D provision is not being implemented inLthe'same auto- i matic fashion as contained in the WCAP. The Duke design of the C-20 permissive is electrically latched in place thus allowing the AMSAC mitigative action once started to go to completion and requires manual action to place the valve position portion of AMSAC in bypass-below 40%.

As described in the response to Question 3 of the April 9,1987 letter, the 120 second time-delay to remove.the C-20 permissive-signal (i.e., put in a bypass) is based upon an automatic system.

The WCAP requires the time delay to allow for completion of the AMSAC initiated actions'following turbine trip.

.i The Duke design does not use an automatic feature' for instating a total system bypass below 40% load. The Duke system is entirely ')

l- j manual. A control room located switch is used to instate the bypass below the 40% (C-20). load value. .The bypass is automatically removed when unit load increases above 40%. The feedwater valve  ;

position AMSAC signal cannot be bypassed above 40% load and it can l

.EMEL3/37 Rev. 3 l 1

4 b t_Q ,: ~

only be; bypassed' manually below 40% load.' :The loss'of both main feedwater pumps portion of the'AMSAC logic is not interlocked with the'C-20 permissive. '

It is functional at all unit load conditions.

-The AMSAC signal.is.' maintained uponLAMSAC actuation as described' above and as contained in-the responses to questions 3 and 7 of the April 9, 1987. letter.

3. The submittal 'of' January 23, 1987 discusses system instabilities bel'ow the 56% power level. Addendum No. 1.to.the.WCAP calls for arming AMSAC at the

'40% level. Discuss-how the steam generator preheating: requirements and the feedwater control valve operational characteristics are being handled at this lower AMSAC' arming set point.

Response: The January.23, 1987 submittal briefly discussed feedwater system operating characteristics while at low power levels. Low power (0-60%) has typically been more sensitive to feedwater system upsets. Steam generator preheating requirements are associated with.

steam generator water hammer prevention during startup. A Feedwater a

Bypass System (FBS) is provided to allow proper preheating'of the feedwater piping downstream of the feedwater isolation valve. In  !

i

. order to warm this line, the feedwater control valves (FCV) and R feedwater isolation valves-(FIV) are closed and the FBS used to warm  !

the line. ]

The discussions in the January 23, 1987 submittal reflected'a design which allows manual control of bypassing the FCV and FIV inputs to q i

.the AMSAC logic for less than 56% power level. This value was chosen because it is where we typically have'both Main Feedwater l 1 Pumps (MFWPS) operating. The 56% value was also more conservative than the 70% power level previously required by the WCAP. Since the t

EMEL3/38 Rev. 3

_--- .-_--_-_ - - - _ .- -- _ i

f a .

'l i

addendum to the WCAP changed the power level for.the C-20 permissive

'from 70% power to 40% power the. Duke design was changed accordingly.

4 1

This power lev 61 change (70% to 40%) . required additional system changes. Minor changes in the'AMSAC. system design developed by Duke are being made. . The preheating of the feedwater lines .is typically completed betw?sn 25% and 30% power. This condition.should not be affected by the power level change.- The. statements provided in-Sections 2.1.2. page 6 and 2.1.3.2 page 8_ reflected additional Duke and Westinghouse steam generator requirements that justified the design of a manual bypass switch below a power level which supported the Duke design of a manual bypass switch. This switch would allow i

manually closing the FCVs and FIVs below the WCAP specified power level and not actuating the AMSAC signal.

With respect to feedwater control valve operational charact' eristics, the power level change did necessitate an additional change in the Duke AMSAC logic; In response to some plant transient conditions,.3 j out of the 4 FCVs may close below the 25% open setpoint required in the WCAP and cause generation of an AMSAC signal.. In order to. ,

i reduce the possibility of this occurring, Duke installed a 10 second 4 time delay in the FCV signal to the AMSAC logic which would activate when a FCV reached the 25% open position. Duke now plans to in-  !

i i

crease the time delay to the WCAp allowed 30 seconds. The 30 second l time delay allowed for AMSAC signal delay will be utilized on the-FCV position signal (25% open) only. This time-delay should prevent FCV fluctuations from causing unwarranted AMSAC initiations. FCV EMEL3/39 Rev. 3

e fluctuations will still occur during startup of the standby main feedwater pump at around 50% - 60% power but the 30 second time delay will allow sufficient time for the operators to control the FCVs and adjust main feedwater pump turbine speed accordingly.

.I l

i l

i EMEL3/40 Rev. 3

_ -_ .-_ - - ___-_ A

8.0 . ATTACHMENT 3. Resp 0NSES TO NRC RE0MEST FOR ADD M INFORMATION DAFED OCTOBER 20. 1987

1. Discuss the changes made in Revision 1 to the WCAP-10858P-A with respect to their impact on the Duke Power' AMSAC design. 'Specifically, discuss (a) the turbine trip variable time-delay as'specified'in the revised WCAP and (b) the C-20 permissive mechanisms.

Response: Specific items which affect the Duke Power Company AMSAC design and arn contained in the WCAP' revision are:

(a) The Turbine Trip variable time-delay based upon unit load and, (b) The C-20 permissive arming adjustment with respect to the turbine trip variable time-delay.

Duke Power Company intends to delete the turbine trip variable time delay from its logic diagrams submitted to'the NRC and to maintain the plant designs for Catawba and McGuire in their original design .j status. Section 10.2.2 of each plant's FSAR describes the-Turbine Trip inputs. We feel that it is conservatively. desirable to main-tain the plant design as close to that which was originally licensed and analyzed. Tripping the turbine directly (without' time delay) I upon loss of both Main Feedwater Pump Turbines'(MFWPT) and' pumps 'is 1

anticipatory to a low-low steam generator level initiated trip through the- Reactor Protection System (RPS). ' The Catawba and McGuire plant designs included the loss of both MFWPTs as part of-the main turbine trips in their original designs. A complete loss

'l EMEL3/41 Rev. 3 i

.i

4

' of feedwater event which would develop from loss of both pumps is not an event which allows continued plant op'eration even at extreme-ly low power levels. The most prudent and conservative approach is

. tha't upon loss of both feedwater pumps,- the main turbine .should trip

' to. avoid unnecessary depletion .of . steam generator inventories and -

reduce the amount.-of relatively cold auxiliary feedwater required to stabilize steam generator levels.

For loss of load events, of which'the most severe is a loss of condenser vacuum event, the main turbine would trip and the main-feedwater pump turbines would also trip. Loss'of both main feed-water pumps would not be required to trip the main turbine because it would already be tripped and a time-delay in the turbine trip circuit.would not provide any input anyway.~ Loss of both main feedwater pumps will initiate auxiliary feedwater as required. Loss of load (i.e., turbine trips without loss of vacuum) does not cause a loss of feedwater and therefore, operator action would be' relied upon to trip the reactor, trip both main feedwater pumps and verify )

j initiation of auxiliary feedwater.

The Westinghouse prescribed turbine trip variable time delay pro-i vides no beneficial actions because of the existing plant designs j

, i for Catawba and McGuire based on the above explanations.

I l I The C-20 permissive as described in the revision to the WCAP adds a variable timer whose time-delay is based upon the same turbine loads j I

associated with the turbine trip time-dalay. In fact, these two.  ;

I l

EMEL3/42 Rev. 3 i o

timers are varied according to turbine l'nad jointly. lThe same argument.for the Duke AMSAC design exclusion of these: time delays'as described above applies to:the'C-20 time-delay. The Duke AMSAC

' design for Catawba and McGuire will: maintain'the' original-turbine; trip- upon.losq of both main feedwater pump turbines'and therefore,.

.no turbind load input'is planned for the C-20' permissive- circuitry _

to automatically: instated a bypass of the AMSAC below 40% load as in the WCAP; .The' Duke AMSAC design incorporates an administrative 1y_-

controlled C-20 bypass below 40% load. The Duke bypass only affect's the valve position portion of AMSAC. Feedwater pump's status cannot be bypassed.

The Westinghouse prescribed C-20' time-delay variance;upon unit load between 40% and.100% provides no beneficial actions because the Duke AMSAC design includes a manual bypass below 40% unit load.

2. Discuss what administrative procedures will be used:to direct operators regarding the use of the C-20 permissive _ (reset) below the 401; load.value.

Response: The administrative procedures:used to direct the-operators regarding use of the C-20 permissive below the 40% load value.are developed as part of.the Duke Nuclear Station modification process. The Administrative Policy Manual for the Nuclear Production Department requires that as part of the Safety Evaluation-process per.10 CFR 50.59, each modification is evaluated for any required changes or additions to the station procedures.

EMEL3/43 Rev. 3

Information pertaining.to.the precautions governing use.of the C-20 permissive bypass.below 40% unit load prior.to the timing out of the

-30 second time-delay in the Feedwater-Control valve status. logic will be. included in the Final Scope _ Document for the modification.

The Final Scope Document is 'used as the collection document for'all significant design inputs into the modification. ,This document,is transmitted'to'the station.for review and used in. developing the implementation package for, the modi fication. The Final Scope.

Document is also used in the development of the:10,CFR 50.59 safety evaluation performed by the Design Engineering Safety Evaluation group prior to development of the' implementation package at the station.

3. Discuss the turbine trip on (a). loss of both main Feedwater Pump Turbines and (b) closure of the MFW control / isolation valves with respect to the ATWS scenarios contained Section 2.0,' Design Bases of the WCAP (Loss of Main Feedwater and Loss of Load).

Response

(a) The Turbine Trip on loss of both main feedwater pump turbines is' parti of the origina11y' licensed Catawba and McGuire plant designs. The response to Item 1 discusses much of.the relationship regarding the above trip and the two ATWS scenarios as' described.in the WCAP Section 2.0. The'only additional discussions to add to those previously given are that the original plant designs for Catawba and:

McGuire previously contained much of the ATWS rule required. The Duke design for AMSAC adds the feedwater valve status inputs,.yet.

does not implement the various time delays also described in. Item 1 1

EMEL3/44- Rev. 3-

because of the previously discussed reasons. There is no.value

~

gained _ in .trying' to' continue main turbine operation when the water

_ source for-the'turbineisteam requirements does not function.

~

~

Tripping thei turbine during either of the..twoiscenarios- results in an anticipatory response 'to low-low steam generator _ water level.-

Maintaining the steam generator _ inventory and not continuing turbine operation to the low-low-level' set point.during loss of feedwater .

events is-conservatively more desirable. $1

'(b)' The main turbine. trip on closure of;the MFW control or~ isolation. d valves is initiated by the AMSAC circuits directly~as contained in the Final Design Description.

With' respect to.the ATWS scenarios containadLin Section 2.0, Design.

Bases of the WCAP the turbine trip occurs as a direct result of either scenarios. Closure of the. valves is'a direct trip input.

Whenever three out of four feedwater control valves are closed for 30 seconds or three out of four feedwater isniation valves _are closed, J

'l the main turbine will trip. This response is!the loss of feedwater' scenario described in the WCAP.

The loss of Load scenario results in no action by the feedwater  !

1 valves. The feedwater control valves may open up_more in response to .

loss of feedwater due to a main feedwater pump trio on loss of vacuum .j

' assuming the Feedwater Control System is' functional. The turbine .

trip will still occur due to loss of vacuum. For loss of_ load events where the turbine trips but there was no loss of vacuum, there is no l

4

'EMEL3/45 Rev. 3 ,

loss of feedwater, the feedwater c.ontrol/ isolation valves do not close, and operator actions is relied upon to trip the reactor, trip both main feedwater pumps and verify initiation of auxiliary feedwater.

4. Provide updated Logic Diagrams showing:

(a) The time-delay increases to 30 seconds in the Feedwater Control Valve signal circuit.

(b) The deletion of the time-delay in the Turbine Trip circuit.

Response: The two updated logic diagrams are enclosed with this submittal.

EMEL3/46 Rev. 3

..t 6 ,

e 21 3.. __

8 k!

l l i l 1

lI 8

i-rl!!' !!

- ==- I i,.

• ""S*~> ,,

g l[ f

-J gg l ,111 1 3-

-e ij -!

v f! s

.I

-mene9 '

--eme m-

}*

FMM- g a 81 11

--wE w - !g h

i I!n-

,E-m k

~

• cirdf $- P!

FMM-}- s o I

I I L

""a"W EM- l s t y a

_ _ _ _ _ _ _ _ l

a i.;! -

t

, i' jl, i ,,

g - w.c A %"5! ] l 1llj MiMTm 3- ,,l l

~

- wg _m- n 3- b r . . ,s ., -v "

_ , si

. 9' J

~ O--liaf lB e g! -

I I

it'=

i,li- b

- !Il[si is.lii r2E -] !j!- Iil51 i l i

_,,_ r_im o igilj ram -]

-s a

i!d"i).

j!!!:l

! ==T'm- m , j a-v --

a ,n

!2 4"J r 2 -  !! } ,,

• IlfitilI

! =N -- _______j __

I -a -

-. =na -ox RG-il

[51 s.

4

!!Ill II s!,1 .

8; 15 a gg l

I p al l

" I ar =i-8 3__il !.!i

Gi3 "

l

,, !I !j,.5 g

i.  !

>_a g8 e

i a  ;'l a I i M.M.~-b l s,-

g!

anum  !! l-g3 $

'ra .

h 1

i W

- h i

sa :gb'! , l L=E"!

}' gethi j g g s .lll sjgt l f

i c0E!lvl {, f f i kli iiii: in- i

! hI!!'! I iiiii,,, t pg "o il!'l!!' i

! I'!

1 p" til-  ! I iiii !!'

'{"

d

!= ii!!)ii l

.Is. 3.g,! ii: --li  !

l a g15.,-l 8 i 8 A b if .sgy*1 Jf2Edoiu :a*'. ,

i iV Ft,uEi g ,

-m I.p u  % ~O--!i iist5I i i

=~ =d l' gg!-l: i l

-h""!!fd s 1 3 555 l! MhEE!l =,

!i 'I E I

i*elk"N

!i!!!!

--rsTd

- "~}- phim!a !I!!N!v l ,

, *gg_q "Q__

' "d d

'~

.o&.a WJ"Asua ~ -H

...........=

jrn

. W l

! l D

_ _ ,_ ,  : i , -i l

~

n W '

hb i .. v is l l

9'.ou

<t'd Mexrmas M! _

l i) a 5

................................. g

.5, 84

.m. J',5 2 ___v ib8

==12,%t*! "

Ir.

5 p.

tsass bI 8

+I o

=

m. =%ntsm = m vn 1 E is  ! a i v

L- H

-s 1

e- ehr g

8 j i

,$iMf!JK -

• l 1

h .

J f v v .^i i

r .

,g-

,----g,-,

i >

i .. - r,8l!. k [ D- l , ~ III -

Illz g - F~m i

s 8_!

s- g ilti d!  !, W9gs .

m. -

Jai s

I w {g ~ jll W.

6 1-I E $sa--

11 3 ~

l '~4 n !  !<lj  ! a i-E e -

X s $gi !'!

s l.

l g E a 2

!3 8 S i

!c -

s- 6

-l  ! . i - v il 8! r l-a!

~

ije lIl I 3 g

~

g=

l  !  !!i"< 1 I l!!. E g

g ?lill [I I If;!' r!! hl! TIT i p

, $)

!l!-l!'l!=i l!! r~ . 'y iL_., '58 it i ~ lj I 58 1 egs S >

da 89i !n'i!! g a si --a s a i . .

q-- g ]-

i ,lt! Wg sL- 't I!i :!l l I Ei i' yi !I I I E ! 3 I $ g g -

~~

h i; 1

!! li efll l&4484ST 9f @ l! ll $[

j'lEe gg ~$- e l l!'189 l! -s l s  :

ill _ 'an-;< !

IIA E :-

e .

! l ES i~)- l

. Is .

. i i lii!S@ l! -e : ii E

' EO __ _ ijk g 5

hl{g, EG@ l_i m

Y #

T -b sv Ib I e

g.O..e #, i ;i2J !

1. r r ag ,

g ,

g g gg, i l'i

~

51 9

! i 8 Ii l,j,IEO as" 9 lj

~

}-

! . [l ]lI~

c.!

!g" lr! l" e

8-

'- J -s ["8 ii l-24 l i; or 9'aIi I;,j g =

1 l!l16; E h !:'}; I 1v IQ i!l a- l Mit!

i;gigmitt i --------- -

j;; y 5

j Or f ijf

=* I

=

lieP%2E u,.gis.- :

l& - :l s'l6"g

!I  : la 4 E!!

lri- g=6 s!gg f-

-  !!$'~3P9 Ejinhirr;tfii-[

i s . a g r,e_.gl i b-  !  ! !gi E$ d! !!!!h jfg' G g; lii e--

' ~

.t %n i

i

!.---p-,i-6 .til

,g!' Ehn

!Ii is j l j~ ,

-l 9j i  !

"! {1

!l 5

I 1j1- l = Sa!El

• s fjHls "gi

l,

1. 3  !=

th l r=

li I 3 1 5 X i fir l ag a li! '

, i IS o g

[= rj !l g=  ;

Ei [i p

, vr .!!!I g, e" [ " !!d!*[! fI *a ' a- ' ' I" li js[ [e!ggr- --

s'=

g ~ ~ 1, V .,

8 i!

~ lfl!!

! v a5 !! It --

an a fl!! ! i

Ha l-+ i" r g; Fi li t id i i l i l }si [ g ' - -

33. i l

l  !

~

I,i!I!ll l !jo-4486fTf@ li !! Mf  !

f*!* lire 'o ' > l& a jij -

as a

! [i  ! I 8 8 s!!gg 9 _

pl

_ab .. ,

L ;;!4,gj..

i i .

i ,/ 5

~

-  : ,\ j .

I r lll t p'fl@

I $!l - g E

}!

l' . ME! ll 4 .5

-j

!I Sil5~ .

FHi s

'il =t

$4 lil:  ;

III !@@ayLa=l!l

- !r!I=

1,.Pl

-d e

1l 7 ie" ~

~I t, _

Ergjg I III  !!

$!s 9 l l I!!

Jl1, 1l!!!

'g'56 r l t ll ,li E.! !j$qfI!'!g;jgj qj si!

'il _ L343] g;  ;;

l-lie n :I !  ! i  !!arijs!

id V 4v -(!i

-g is, gij g t' [*Hrd 5.r.,arrisi l O-[

$ 65 ;5-f i; i i II'- f. li

,I g =

llle=3- "' 'l ,I it!!!l sei!!!

• il g=i L <2 r , I!I- li I!

~

lli!@El fig 11 i 6 .:' 0

+' ra

!!i

- p!!

i l!g'

. -iggg,r r Essir

[jj d$1- li idlia  !!!!' . ~m!

ili 6--

- _ - - _ - _ _ _