ML20245K597
| ML20245K597 | |
| Person / Time | |
|---|---|
| Site: | Arkansas Nuclear  |
| Issue date: | 06/21/1989 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML20245K586 | List: |
| References | |
| NUDOCS 8907050185 | |
| Download: ML20245K597 (14) | |
Text
- __ --
?- ,
.*. ggg'g
/ e,,
! UNITED STATES e
- .t NUCLEAR REGULA10RY COMMISSION
- WASHING TON,0. C. 20555 8.,
[
%, ....*/
SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION ARKANSAS NUCLEAR ONE, UNIT 2 EVALUATION OF COMPLIANCE WITH THE ATWS RULE: 10 CFR 50.62 REQUIREMEN'S FOR REDUCTION OF RISK FROM ANTICIPATED TRANSIENTS WITHOUT SCRAM (ATHS) EVENTS FOR LIGHT-WATER-COOLED NUCLEAR POWER PLANTS
1.0 INTRODUCTION
On July 26, 1984, the Code of Federal Regulations (CFR) was amended to include the "ATWS Rule" (Section 10 CFR 50.62, " Requirements for R(duction of Risk frorn Anticipated Transients Without Scram [ATWS) Events for Light-Water-Cooled Nuclear Power Plants"). AnATWSisanexpectedoperationaltransient(suchas loss of feedwater, loss cf condenser vacuum, or loss of offsite power), which is accompanied by a failure of the reactor trip system (RTS) to shut down the reactor. The ATWS Rule requires specific improvernents in the c;6 sign and operation of comercial nuclear power f acilities to reduce the likelihood of failure to shut down the reactor following anticipated transients and to mitigate the consequences of an ATWS event. ,
The 10 CFR 50.62 requirements applicar:lt to pressurfred water reactors ,
s, manufactured by Conbustien ingineerirg, such es Arlansas Nuclear One, Unit 2 (ANO-2),are:
(1) Each pressurized water reactor *aust have equipment from sen:or output to final actuatica device that is diverse from the reactor trip system, which will automatically it.itiate the auxiliary (or emergency) feedwater syster arid initiate a turbine trip under conditions indicative of an ATWS. This equipment must be designed to perform its function in a reliable ranner and be independent (from sensor output to the final actuation device) frem the existing reactor trip system.
l .
8907050185 890621 DR ADOCK0500g8 .
(2) Each pressurized w6ter reactor must have a diverse scram system from the sensor output to interruption of power to the control rods. This scram system must be designed to perform its function in a reliable manner and be independent from the existing reactor trip system (from sensor output to interruption of pcwer to the controlrods).
In summary, the ATWS Rule requirements for ANO-2 are to install a diverse scram system (DSS), diverse circuitry to initiate a turbine trip (DTT) and diverse circuitry for initiation cf auxiliary feedwater (DAFW).
2.0 BACKGROUND
Paragraph (c)(6)oftheATWSRulerequiresthatdetailedinformationto deirenstrate compliance with the requirements of the Rule be submitted to the Director, Office of Nuclear Reactor Regulation (NRR). In accordance with Paragraph (c)(6) of the ATWS Rule, Ccmbustion Er.gineering Oviners Grcup (CE0G) provided information to the staff by letter dated September 18, 1985 (Ref. 1). The letter forwarded CEN-315, "Sunr.ary of the Diversity Between the Reactor Trip System and the Auxiliary Feedwater Actuation System for CE Plants," for staff review.
The staff reviewed CEN-315 and, by letter dated August 4,1986 (Ref. 2),
forwarded its conclusion to the CEOG. The staff concluded that sufficient diversity did not exist between the reactor trip system (RTS) and the auxiliary feedwater actuation system (AFAS) to achieve the degree of reduction in potential commou mode failure (CHF) mechanisms by providing hardware diversity as required by the ATWS Rule. This decisien affectet San I Onofre f,uclect Generating Station, Units 2 and 3 (SONGS-2, -3), Arkansas Nuclear One, Unit 2 (ANO-2), and Waterford Steam Electric Station, Unit 3 (WSEC-3).
I 1
l In respcnse to the staff's evaluation of CEN-315, Southern California Edison l (SCE), the licensee for SONGS-2, -3, submitted CEN-349 to the staff by letter dated December 30,1986(Ref.3). CEN-349 provided additional I
b
j information to support the CE0G position stated in CEN-315. The staff reviewed CEN-349 and, by letter dated January 11,1988 (Ref. 4), again rejected the CEOG position that the existing diversity between the RTS and the AFAS meets the requirements of the ATWS Rule.
~
In a further attempt to gain a favorable staff position, Arkansas Power & Light Company (AP&L), licensee for ANO-2, by letter dated November 3, 1988 (Ref. 5),
submitted a plant-specific request for an exemption from the portion of the ATWS Rule that requires equipment ofverse from the RTS to initiate the AFAS j under conditions indicative of an ATWS. The submittal also provided catailed design information on the DSS and DTT. The staff reviewed the submittal and, by. letter dated December 28,1988(Ref.6),forwardedaRequestforAdditional Information (RAI) on the licensee's proposed DSS /DTT design. In sodition, the staff denied the licensee's request for an exemption by letter dated February 16, 1989 (Ref. 7).
The licensee respchdea to the RAI by .Util Intends to Proceed W/Installation of Mods During Refueling 2R7,contingent on NRC Approval|letter dated February 2,1989]] (Ref. 8).
A ccnference call was held with the licensee on February 10, 1989, to discuss the information contained in the response to the RAI. The licensee responded to the conference call by [[letter::2CAN028906, Forwards Supplemental Response to Request for Addl Info Re Atws.Info Covers QA Program for ATWS Per Generic Ltr 85-06 & Maint Bypass Breakers in Diverse Scram Sys one-line Diagram|letter dated February 21,1989]](Ref.9).
This safety evaluation addresst.s the licensee's conformance to the ATWS Rule at ANO-2, as detailed in References 5, 8, and 9.
! 3.0 CRITERIA The purpose of the ATWS Rule, as documented in SECY-83 293, " Amendments to 10 CFR 50 Related to Anticipated Transients Without Scram (.ATWS) Events," is to require equipment / systems that are diverse from the existing reactor trip system (R15)andcapableofpreventingormitigatingtheconsequencesofan ATWS event. The failure mechanism of concern is a commen mode failure (CMF) of identical components within the RTS (e.g., logic circuits; actuation cevices; and instrument channel components, excluding sensors).
l * ,
-4.
The hardware / component diversity required by the ATW5 Rule is ir,terded to enstire that CHFs that could disable the elt.ctrical portion of the existing reactor trip system will not affect the capability of ATWS prevention / mitigation system (s) equiptrent to perform its design functions. Therefore, the similarities and differences in the phys 1 cal ar,d operational characteristics of these components m0st be analyzed to determine the potential for CMF rrechanisms that cou'Id disable both the RTS and ATWS prevention /mitigaticn functions.
The systems and ecuipment required by 10 CFR 50.62 do not have to sr.eet all of the stringent requirements normally applied to safety-related equipment.
However, this equipment is part of the broader class of structures, systems, and compcnents important to safety defined in the introduction to 10 CFR 50, Appendix A (General Design Criteria [GDC)). GDC-1 requires that " structures, ,
systems, and components important to safety shall be designed, fabricated, erected, and tested to quality standards commensurate with the importance of the safety functions to-be performed." The criteria used in evaluating the licensee's submittal include 10 CFR 50.62, " Rule Considerations Regarding Systems and Equipment Criteria," published in the _ Federal Register, Volume 49, No. 124, dated June 26, 1984. Generic Letter No. 85-06, dated April 16, 1985, ,
" Quality Assurance Guidance fcr ATWS Equipment That 1s Not Safety Related,"
details the cuality assurance requiren nts apn11 cable to the ecuipment installed per ATWS Rule requirements.
1 J
To mir.in.1ze the pc,tential fcr conrnon mode failures, diversity is required for {
diverse scram systed (DSS) equipment from sensor output to, and including, the )
I components used to interrupt control rod power. The use of circuit breakers from different manufacturers is not, by itself, sufficient to provide tho l requireo oiversity for interruption of control rod pcher. For mit' gating l systems (f.e., diverse turbine trip and diverse auxiliary feedwater actuation I system), diversity is required from sensor output to, but not including, the l fir,a1 actuation device. j l
l 1
Electrical. independence between ATWS circuits (i.e., DSS, DTT, and DAFW) and the existing RTS circuits is considered desirable tc prevent interconnections between systems that could provide a means for CMFs.to potentially affect both systems. Where electrical independence is not provided between RTS circuits and circuits installed to prevent / mitigate ATWS events, it must be demonstrated that faults within the DSS, DTT, or DAFW actuation circuits cannot degrade the reliability / integrity of the existing RTS belcw an acceptable level. It must-also be demonstrated that a CMF affecting the RTS power distribution system, including. degraded voltage and frequency ccnditions (the effects of degraded voltage conditions over time must be considered if such conditions can go undetected), cannot compromise both the RTS and ATWS prevention / mitigation functions.
Electrical independence of nonsafety-related ATWS circuits from safety-related circuits is required in accordance with the guidance provided in IEEE Standard
' 384, "IEEE Standard Criteria for Independence of Class IE Equipment arid Circuits,"
as supplemented by Regulatory Guice (RG) 1.75, Revision 2, " Physical Independence of Electric Systems."
l The equipment required by 10 CFR 50.62 to reduce the risk associated with an ATWS event must be designed to perform its functions in a reliable manner. The DSS, DTT, and DAFW circuits must be designed to allow periodic testing to verify operability while at power. Compliance with the reliability and testability requirements of the ATWS Rule must be enstued by technical spscifirbtion operability and surveillance requitarrets cr equivalent means that govern the j availability and operation ci ATHS coutpment; thereby ensuring that the necessary reliability of the equipment is maintained.
The ATW3 prevention and mitigation systems shculd be designed to provide the operator with accurate, complete, and timely information that is pertinent to system status. Displays and controls should be properly ir.tegrated into the rr.ain centrol room and should conform to good human-engineering practices i in design and layout.
1 I
-_-x____.__m._m-______ m _ _ _ . _ _ _ _ _ . _ _ _ _
4.0 DISCUSSION AND EVALUATION The following is a discussion on the licensee's compliance to the guidance contained in the Federal Register, " Statement of Considerations" (Ref. 10) and to the requirements of the ATWS Rule as discussed in Section 3 of this report.
4.1 DIVERSE SCRAM SYSTEM A. GENERAL i
AFll intends to implement the ANO-2 DSS design as a control-grade system by using new pressurizer pressure transmitters en existing taps to provide signals to the DSS in a two-cut-of-four trip logic. High pressurizer pressure will be used as the parameter indicative of an ATWS. The DSS will consist of four measurement channels, four two-out-of-four logics, and two trip paths. Each measurement channel consists of a pressure tr6nsmitter sensor; a signal conditioner; and an alarm block and tiner block, which are part of the configured function block of a Foxboro Spec.
200 Micro Control Module.
The DSS trip setpoint will te set greater than the RPS high pressurizer pressure trip setroint ano itss than the primary safety valve relief pressure setpoint. Each of the four, two-out-of-four logics activates one of the two trip paths to open a motor-generator (MG) set output contactor. This occurs when any two of the four inputs from the fcur measurement channels reach the bish-high pressurizer pressure setpoint simultaneously.
Activation of channel 1 and/or 3 of the two-out-of-four logic energizes the Trip Path #1 relay, which opens the MG Set #1 cutput contactor.
Activation of channel 2 and/or 4 of the two-out-of-four logic energizes the Trip Path #2 relay, which opens the MG Set #2 output contactor.
c .
Activation of both trip paths is require te initiate a reactor trip.
Once the trip is actuated, it is sealed until manually reset at the DSS panel.
B. DIVERSITY Hardware / component diversity is required for all diverse scram system (DSS)equipmentfromsensoroutputsto,andincluding,thecomponents used to interrupt control rod power. The use of c'.rcuit breakers from cifferent tranufacturers is not, by itself, sufficient tc provide the rcquired diversity for interruption of control roa power. The DSS senscrs are not required to be diverse frcm the RTS sensors. 'However, separate sensors are preferred to prevent interconnections between the DSSandtheexistingreactorprotectionsystem(RPSorRTS).
The ANO-2 DSS design consists of four safety-relate instrument channels, each of which provides an input to two, separate, two-out-of-four, energize-to-actuate logic matrices. The output of each logic is used to cpen one of the.two RPS motor-generator (MG) set output contacturs. Both contactors must open to remove power from the control element assemblies (CEA), causing a reactor scram. The instrument channels consist of sensors, bistables, bistable relayt, and actuation relays.
The sensors used in ths DSS are separate, from the existirg P.PS pressure l
transmitters. They do, however, share existing pressure sensing lines thrc, ugh instrument valves. The DSS transmitter circuits are ccmpletely independent from the existing RPS instrument loopt. Additionally, the
! DSS transmitters are qualified for Clast, IE application and are Seismic Category I in design. This sensor design exceeds the requirements of the ATWS Rule.
The ANO-2 DSS design does not specifically use bistables or bistable 1 l relays in its design. The functions are perfcrmed by the Foxboro Spec. 200 Micro Control Mcdule. For this function, the RPS uses
- _ _ _ _ . _ _ _ . . _ _ _ _ . _ . - - b.
i j
3 .. a i
bistables manufacture by Gould and Electro-Mechanics and bistable relays mar.ufactureo by Electro-Mechanics. The DSS actuation devices are Foxboro output relay modules and MG set trip relays, which open thc M-G set output load contactors. The actuation cevices are powered from a non-Class IE instrument AC-power panel. The parallel device in the RPS is a mechanical circuit breaker powered by a Class IE vital bus.
Based cn the above, the staff concludes that the level of hardware / component oiversity provided between the DSS circuits and the txisting RPS'circu.its at ANO-2 is sufficient to comply with the requirements of 10 CFR 50.62 (the ATWS Rule) and.is, therefore, acceptable.
C. DSSELECTRICAL-I!SEPENDE_NCELFCKER.SUPPLQ The purpose of the electrical ir. dependence requirements of the ATWS Rule is to prevent interconnections between the DSS and RPS (thereby reducing the potential for CMFs that could affect both systems) end to ensure that faults within DSS circuits cannot degrade the RPS. Electrical independence of DSS circuits from RPS circuits should be maintained from sensor outputs up to the final actuation devices. The use of a common pcher source for the 055 and RPS sensors is acceptable because, in accordance with the ATWS Rule, ti.e sensors can be shared between these two systenis.
The DSS at ANO-2 receives power from two, sepe. tate, nor.-Class IE instrument AC power sources. The logic power is supplied by four Foxboro power supplies. The power supplies for logic char.r.els 1 and 2 operate in parallel, and the power supplies for logic channcIs 3 and 4 operate in parallel. Dual !
power supplies, tranufactured by Computer Products, Inc. (CPI), supply power to the multiplexer. The RPS power source is a Power Mate 12 VDC power supply - l that takes its power from the Class IE AC vital bus. In addition to power !
l e
____-._______m___ . _ _ _ . _ _ _ . . . _ _ _ _ . - _ . . _ _ . . _ _ _ _ . _ . _ . . . _ - . _ _ _ . _ _ . . _ __
.g-supply diversity and independence, electrical separatior, is also maintained; therefore, the proposed design coes not need or use electrical isolation devices.
The two, separate, non-Class 1E instrument AC power sources are both diesel backed. They supply power to two small battery chargers that maintain two, 24 VDC batteries. Upcn the loss of offsite power, these two batteries will meet the DSS electrical load requirements for more than 15 minutes.
Based on the above, the staff concludes that the DSS power supply configuration is acceptable, as it minimizes the potential for CMFs and other faults to degrade both the DSS and RPS. The power supply configuration is operable upon the loss of offsite power.
D. _ DSS RELIAF.ILITY/ TESTABILITY / MAINTENANCE To ensure that the DSS circuits perform their safety functions when called on, the Consnission issued Generic Letter (GL) 85-06 (Ref. 9), " Quality Assurance Guidance for ATWS Equipment that is not Safety Related," which details the quality assurance requires for equipment installed per ATWS l Rule requirements. In dooition, the staff requires that circuits be n.aintained and periodically tested at power in accordance with technical specifications operability and surveillance requirements or equivalent q means.
The licensee has stated that the ANO-2 DSS circuits will be installed, maintained, tested, and modified in accordence with the plant's Quality i Assurance Manual-Operations. This manual has been compared with GL j 85-06, and its requirements meet or exceed those of GL 85-06. The operability and reliability cf the DSS will be demonstrated and
_ _ . _ _ _ _ _ _ _ _ _ ___ m [
I maintained by maintenance and surveillance programs that are designcd I for the DSS and incorporated into the plant's Reliability Assurance Program. Testing of the DSS will be performed prior to installation.
The following test schedule will be established: I
- 1. At-Power Testing Monthly and prior to each return to criticality after a forced or scheduled outage greater than 7 days in length.
- 2. End-to-End Testing - Refueling cutage basis.
The licensee ccnfirmed that maintenance and test bypasses will be built in and will be part of the circuits. Temporary modifications of the circuits for testing ano maintenance will not be required. When a protection action is activated, or When any part of the DSS is placed in a bypass concition, an alarm annunciato is actuated in the main control room.
Based on the above, the staff concludes that the DSS surveillance testing proposed by the licensee, the means used to bypass the DSS for test and maintenance purposes, and the indication of the bypass condition are in accordance with good design practiccs and the requirements of 10 CFR 50.62 (tne ATWS Rule) and are, therefore, acceptable.
E, 0,THER DSS C0fiSIDERATIONS Other system design considerations that enhance the DSS at All0-2 include:
- 1. The energize-to-trip circuits will be used to exclude the activation I of a trip by component failure. !
- 2. The DSS cquipment will be qualified for the environment in which it will be installed.
____m___ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _
sx
- 3. The DSS will have provisions for manuel ir.itiation of the system.
4.- Once initiated, the DSS will seal-in and require deliberate manual operator action to reset the system.
- 5. The DSS alarms will be consistent with the plant's Control Room Design Review and good human-trigineering practices. As a minimum the following will be annunciated:
o DSS Reactor Trip Confirmed o DSS Reactor Trip Demana o DSS Chanr.el Trip o DSS Channel in Test / Bypass o DSS System Trouble.
F. CONCLUSION Based on the above evalustion, the staff concludes that the prcposed design of the Diverse Scram System for Arkansas Nuclear One, Ur.it 2, conforms to the requirements of 10 CFR 50.62 (the ATWS Rule) and is, therefore acceptable.
4.2. DIVERSE. TURBINE TRIP _
A. GENERAL The DTT design for ANO-2 consists cf four, control-grado instrument channels that sense control eierent drive achanicm (CEDM) power bus undervoltage in a selective two-out-of-four logic. When the DSS causes a reactor scram, power is interrupted to the CEDM ceils upstream of the red power. bus undervoltage relays. The de-energizing of these undervoltage relays actuatec the turbine trip circuitry.
O
- m. ____m_ _ _ _ . _ _ - _ _ _ _ _ . . . _ _ _ _ - - .
R >. , . .
g ,
,,J ...
The DTT design shares all circuit components with the DSS up tc, but rct including, the final turbine trip device. Those components.that are unique to the DTT (i.e., undervoltage relays,. trip relays, master
. trip relays, and the master solenoid) do not. appear in any of the RTS trip paths. All of the information that'is applicable to the DSS.
-components and system, as discussed in Section 4.1 of.this report, is also applicable to DTT components up to, but not including, the firal trip device.
B. CONCLUSION Based cn the above evaluation, the staff _ concludes that the proposed
. design for the Diverse Turbir.e Trip for ANO-2 conforms to the requirements of 10 CFR 50.62 (the ATWS Rule) and is, therefore, acceptable.
4.3 DIVERSE AUXILIARY FEEDUATER ACTUATION A. GENERAL-As discussed in Section 2.0 of this report, the Auxiliary Feedwater Actuation System (AFAS) at ANO-2 was the sbbject of a Request for Exwption l
(RFE) from the ATWS Rule. By letter dated February 16, 1989 (Ref. 7), the staff informed the licensee that the RFE to the ATWS Rule had been denied.
The bases for this rejection were that (1) the licensee had presented no new information in the RFE and (2) the cost-benefit and value/ impact ratios had been considered during the preparation of, and prior to issuance of, tne ATWS Rule. Therefore, the AFAS design will not be evaluated at this time, and the diversity of the AFAS with respect to the RPS is an open item for the purpose of this report. The staff has informed the licensee (Ref. 7) that implemer.tation of the ATWS Rule should be independent of the staff's review of the proposed equipirent design.
1
.,- p
,l3 ,
B. CONCLUSIONS The licensee should begin or continue the schedule for implementing the.
diverse AFAS as agreed upon by CEOG with the staff and which is to be docurented on April 17, 1989. The staff recommends that the oesign documentation associated with the diverse AFAS design be 'provided to the staff for our review as soon as it is available. However, the final compliance of the AFAS with the ATWS Rule will be determined by a post-implerrentation inspection at ANO-2.
t 5.0 TECHi!ICAL SPECIFICATION REQUIREMENT _S The staff is presently evaluating the need for techr.ical specification operability ar.d surveillance requirements, including actiocs considered appropriate wher.' operability requirernents cancet be met (i.e., limiting cenditions for operation) to ensure that equipment installed per the ATWS Rule will be traintained in a cper6ble ccr.dition. In its Inter in Comission Policy Staternent on. Technical Specification Iniprovements for Nuclear Power Plants [52 Federal Register 3778, February 6,1987], the Commission established a specific set of ob,iective criteria for determining which regulatory requirements anc operating restrictioris shculd be included in Technical Specifications.
This aspect'of the staff's review of ANO-2's design compliance with the ATWS Rule remains open pending completion of the staff's review to determine whether and to what extent Technical $ specifications are appropriate. The staff will provide guidance regarding the Technical Specification requirements for DSS, DTT, and DAFW at a later date. Insta'ilation of ATWS prevention /niitig6 tion system equipment should not be delayed pending the development or staff approval of operability and surveillance requirements for ATHS equipnier.t.
Principal Contributor: H. Li Dated: June 21, 1989
_ _______.__m_____.___.___m.____._______._______m _.________m._. _m. _ . . _. _ _ _ . _ . _ _ . . _ _ . _ . _ _ . _ _ _ _ _ _ _ _ _ = _ _ _ _ _ _ _ _ . . _ _ _ _
d.' ji' ,
)
J
6.0 REFERENCES
j
- 1. Letter, R. G. Wells'.(CEOG) to F. Rosa (NRC), "CEN-315 Sunnary of the Diversity Between the Emergency Feedwater Actuation System fcr C-E Plants," September 18, 1985.
)
2.. Letter, D. M. Crutchfield (NRC) to R. W. Wells (CEOG), " Staff Evaluation of CEN-315 " August 4, 1986.
]
- 3. Letter, M. O. Medford (SCE) to G. W. Knighton (NRC), " San Onofre y Nuclear. Generating Station, Units 2 and 3'(Submittal of CEN-349),"
December 30, 1986.
1
- 4. Letter, G. W. Knighton'(NRC) to K. P. Baskin (SCE) and J. C. Holcombe I (SDG&E),"NRCEvaluationofCEN-315andCEN-349," January 11,.1988.
- 5. Letter, D. R. Howard (APEL) to J. A. Calvo'(NRC), " Request for Partial Exemption for ANO-2'From the Requirements of 10 CFR 50.62,"
Noven,ber 3,1988.
- 6. Letter, C. Posiusny, Jr. (NRC) to T. G. Campbell (P&L), " Request for Additional Information," December 28, 1988.
- 7. Letter,G.M.Holahan(NRC) tot.G. Campbell (AP&L),"NuclearReactor Regulation Response to the Arkansas Power and Light Request for Partial Exemption from the Requirements of 10 CFR 50.62 for Arkanses Nuclear One, Unit 2 (TAC No. 59069)," February 16, 1989.
B. Letter, D. R. Howard (AP&L) to J. A. Calvo (NRC), " Response to NRC Request for Additional Information - Diverse Scram System, "
February 2,1989.
9.= Letter, D. R. Howard (AP&L) to J. A. Calvo (NRC), "ANO-2 ATWS Request for Additional Information, Supplemental Pesponse," February 21, 1989. !
i
- 10. Statement of Corisiderations, Federal Register, Vol 49, No.124, June 26, 1984 C