ML20246E309

Forwards Request for Addl Info Re ATWS Rule (10CFR50.62). Subjs Include Diversity from Existing Reactor Protection Sys & Electrical Independence from Existing Reactor Protection Sys

ML20246E309
Person / Time
Site:	Davis Besse
Issue date:	05/03/1989
From:	Wambach T Office of Nuclear Reactor Regulation
To:	Shelton D TOLEDO EDISON CO.
References
TAC-59086, NUDOCS 8905110220
Download: ML20246E309 (10)

Text

_. _ - _ . - -- . _ ___ . - _ - . _ - _ _ - . _ _ _ _ _

. p,

'May 3, 1989

. Docket No. 50-346 .,r )1STRIBUTION:,

G.meret F11es O NRC & Local PDRS PDIII-3 r/f GHolahan MVirgilio JHannon TWambach PKreutzer Mr. Donald C. Shelton 0GC EJordan Vice President - Nuclear BGrimes ACRS(10)

Toledo Edison Company PDIII-3 Gray Edison Plaza - Stop 712 300 Madison Avenue Toledo, Ohio 43652

SUBJECT:

ANTICIPATED TRANSIENTS WITHOUT SCRAM (ATWS 10 CFR 50.62 IMPLEMENTATION REVIEW (TAC N0. 59086)

In the course of our review of the information provided in your submittals dated October 9,1985 and February 28, 1989 regarding the subject issue, we find that we require additional information to complete our review. The enclosure identifies the additional information required. In a telephone discussion with members of your staff regarding this information request, they indicated that a final submittal which includes this information can be made by June 30, 1989. We find this acceptable to allow us time to complete our review with sufficient margin for the scheduled implementation at the next refueling outage for the Davis-Besse Nuclear Power Station.

Sincerely,

/s/

Thomas V. Wambach, Sr. Project Manager Project Directorate III-3 Division of Reactor Projects - III, IV, Y and Special Projects t

Office of Nuclear Reactor Regulation l

l

Enclosure:

As stated cc: w/ enclosure See next page , - f  ;

Office: LA/PDJ11-3 PMhPDIII-3 PD/PDIII-3 i Surname: PKfWtit'zer TWambach/tg JHannon Date: 3 / ,s /89 g / Q /89 f/) /89 l

8905110220 890503 PDR ADOCK 05000346 P PDC L_________ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ ___ __

.. . , , j

. Mr. Donald C. Shelton Davis-Besse Nuclear Power Station Toledo Edison Company Unit No. I cc:

David E. Burke, Esq.

The Cleveland Electric Radiological Health Program Illuminating Company Ohio Department of Health P. O. Box 5000 1224 Kinnear Road Cleveland, Ohio' 44101 Columbus, Ohio 43212 1

Mr. Robert W. Schrauder Attorney General

' Manager, Nuclear Licensing Department of Attorney Toledo Edison Company General Edison Plaza 30 East Broad Street 300 Madison Avenue Columbus, Ohio 43215 Toledo, Ohio '43652 Mr. James W. Harris, Director Gerald Charnoff, Esq. (AddresseeOnly)

Shaw, Pittman, Potts Division of Power Generation ,

and Trowbridge Ohio Department of Industrial Relations 2300 N Street N.W. 2323 West 5th Avenue Washington, D.C. 20037 P. O. Box 825 Columbus, Ohio 43216 Regional Administrator, Region III U.S. Nuclear Regulatory Commission Ohio Environmental Protection Agency 709 Roosevelt Road 361 East Broad Street Glen Ellyn, Illinois Columbus, Ohio 43266-0558 President, Board of Mr. Robert B. Borsum County Commissioners of Babcock & Wilcox Ottawa County l Nuclear Power Generation Division Port Clinton, Ohio 43452 l

Suite 525, 1700 Rockville Pike Rockville, Maryland 20852 State of Ohio Public Utilities Comission

( Resident Inspector 180 East Broad Street l U.S. Nuclear Regulatory Comission Columbus, Ohio 43266-0573 1 5503 N. State Route 2 l Cak Harbor, Ohio 43449 l

1 DAVIS-BESSE-NUCLEAR POWER STATION 10 CFR 50.62 (ATW5 RULE)

REQUEST FOR ADDITIONAL INFORMATION Introduction and Discussion On July 26, 1984, theCodeofFederalRegulations(CFR)wasamendedtoinclude theATWSRule(Section10CFR50.62,"RequirementsforReductionofRiskfrom Anticipated Transients Without Scram [ATWS] Events for Light-Water-Cooled Nuclear Power Plants"). An ATWS is an expected operational transient such as loss of feedwater, loss of condenser vacuum, or loss of offsite power)(, which

-is accompanied by a failure of the reactor trip system to shut down the reactor. The ATWS Rule requires specific improvements in the design and operation of commercial nuclear power facilities to reduce the likelihood of failure to shut down the reactor following anticipated transients and to mitigate the consequences of an ATWS event.

Paragraph (c)(6) of the Rule requires that information sufficient to demonstrate compliance with the requirements of the Rule be submitted to the

. Director, Office of Nuclear Reactor Regulation. The ATWS Rule requirements for Babcock and Wilcox (B&W) plants, such as Davis-Besse Nuclear Power Station (Davis-Besse),aretoprovideadiversescramsystem(DSS)anddiverse(from the existing reactor trip system) ATWS mitigation system actuation circuitry (AMSAC)..  !

I Based on review of the information provided with the Toledo Edison letters  ;

dated October 9,1985 and February 28, 1989, and on other subsequent  !

clarifying discussions, this request for additional information (RAI) is needed to allow the staff to determine fully whether the Davis-Besse design complies with the ATWS Rule requirements of hardware diversity and electrical independence and reliability and testability at power. The response to the RAI should include block diagrams showing DSS and AMSAC circuit components withadescriptionofmanufacturer,model,principleofoperation(e.g.,

electro-mechanical, solid-state,etc.),modeofoperation(e.g.,energizeor de-energize to. trip, etc ), power supplies (e.g., AC or DC, operating voltages,etc.),andidentificationandlocationofallClass1E/non-ClassIE system interfaces.

The principal function of the DSS at Davis-Besse is to prevent an ATWS by tripping the reactor if, for any reason, the rods fail to drop in response to a Reactor Protection System (RPS) trip. The DSS must function to provide a reactor trip, diverse from the existing Reactor Trip System (RTS), for all ATWS transients that require a reactor trip (in addition to AMSAC actions) to prevent the potential for damage to, or over-pressurization of, the Reactor Coolant System (RCS).

8 t

The AMSAC must function to actuate emergency feedwater (EFW) and trip the turbine on ATWS transients, when required, to prevent serious RCS over-pressurization, to maintain fuel integrity, and to meet 10 CFR release requirements. Considerations for avoidance of inadvertent actuation dictate that there be at least two channels, powered from separate sources and coupled with appropriate coincidence capability. The ATWS transients of concern for theB&WOwnersGroup(BWOG)plantshavebeenshowntobealossofmain feedwater (LMFW) and the loss of offsite power (LOOP) leading to a LMFW.

It is the staff's understanding that Toledo Edison intends to detect a loss of 3 feedwater event using low steam generator level. This method of detection is  !

not a direct measure of feedwater flow and is inconsistent with the analyses I described in B&W Document 47-1159091-00 for the BWOG generic design.

Therefore, Toledo Edison and B&W performed analyses that support this method of detecting a loss of main feedwater and demonstrated that peak RCS pressures l will remain acceptable for an ATWS event.

The following discussion and associated questions are applicable to the Toledo ~,

Edison " conceptual design" for the DSS and AMSAC at the Davis-Besse Station.

Diversity from the Existing RPS In accordance with B&W Document 47-1159091-00, the generic design requirements for DSS and AMSAC diversity are such that the " primary input signals will be diverse from existing protection systems from the sensor output." Also, the

" logic system shall be diverse from existing protection systems," except that "certain plant-specific configurations may require enabling signals and power supply interconnections with existing protection systems." The output of the DSS "will degate SCRs [ silicon-controlled rectifiers] using relays different from RPS SCR degate relays." The AMSAC " actuation devices U ll be shared with existing systems."

l For the DSS, equipment diversity to the extent reasonable and practicable to

} minimize the potential for comtr.on cause (mode) failures is required from the j sensors to, and including, the components used to interrupt control rod I power. For the AMSAC, equipment diversity to the extent reasonable and practicable to minimize the potential for common cause (mode) failures is required from the sensors to, but not including, the final actuation device.

It is the staff's understanding that Toledo Edison's " conceptual design" for the DSS at Davis-Besse will use Rosemont reactor coolant pressure transmitters, which were designed and installed to be qualified to meet post accident conditions. Rosemont pressure transmitters are also used for the RPS; however, diversity of sensors is not required. Toledo Edison's

" conceptual design" indicates that signal conditioning will not be required, and the DSS bistables, logic channels, logic power supplies, and relays will be from manufacturers different from the RTS equipment manufacturers.

Equipment from different manufacturers, alone, does not ensure diversity of the equipment. Therefore, Toledo Edison must further describe how diversity is to be achieved between the DSS and RTS equipment.

i

l l

'It is also the staff's understanding that Toledo Edison's " conceptual design" for the AMSAC at Davis-Besse will use the existing Steam and Feedwater Rupture ControlSystem(SFRCS). Toledo Edison's " conceptual design" indicates that the SFRCS will be initiated on a low steam generator level (an indication of a loss of main feedwater) and will actuate the auxiliary feedwater (AFW) system and trip the main turbine. The SFRCS is a Class IE system, which is not part 1 of the RTS. The SFRCS is a digital system, which uses optical isolation 2 technology for its interfaces and is manufactured by Consolidated Controls Corporation. The RTS at Davis-Besse is a Bailey 880 analog system with relays and operational amplifiers. Therefore, the SFRCS appears to be diverse from i' the RTS.

Adequate diversity between the DSS /AMSAC and the RPS is best achieved by the use of components from different manufacturers / manufacturing processes, the

-use of. mechanical versus electronic devices, AC versus DC equipment, or the use of equipment that uses different principles of operation. Therefore,

• Toledo Edison should consider these methods of determining diversity when addressing the DSS bistables, logic, and final actuation devices and the use of SFRCS for the AMSAC design. This information should be included in the Toledo Edison final, plant-specific, Davis-Besse submittal in order for the staff to make a determination of compliance with the ATWS Rule. t Electrical Independence from the Existing RPS In accordance with B&W Document 47-1159091-00, the generic design requirements for DSS and AMSAC electrical independence are such that "the system will be i electrically independent from existing protection systems, except for power supplies and certain enabling signals, which wi?1 be appropriately isolated."

j Electrical independence of the DSS from the existing RTS should be provided r from the sensor output up to, and including, the final actuation device.

I

., Electrical independence of the AMSAC systems from the existing RTS should be provided from the sensor output up to, but not including, the final actuation device.

It is the staff's understanding that Toledo Edison's " conceptual design" for the DSS at Davis-Besse provides for power to be supplied to the DSS circuitry directly from the 480 VAC offsite power sources, with no battery backup capabilities upon loss of offsite power. It is also the staff's understanding that the " conceptual design" for the Davis-Besse AMSAC uses the SFRCS and that both the SFRCS and the RTS share the same vital AC power. As described in the

-September 7,1988,letterfromG.Holahan(NRC)toL.C.Stalter(BWOG),this design falls into Option 2. The Option 2 criteria state that a battery-backed DSS power source is not required and, if the SFRCS is powered from 120 VAC RTS buses, Toledo Edison must identify all DSS and AMSAC system components at Davis-Besse that receive power from the same sources used to provide power to L

the existing RTS.

1 l

l '

Since RTS power supplies will be used, Toledo Edison has provided information to demonstrate that faults within the DSS or AMSAC circuits cannot degrade the reliability / integrity of the existing RTS. This information demonstrates that it is highly unlikely that a common mode failure affecting the RTS power distri-bution system could compromise both the RTS and ATWS prevention / mitigation functions simultaneously.

Even though the Class IE to non-Class IE isolators used in the DSS and AMSAC at Davis-Besse may have been qualified previously, Toledo Edison must ensure that the DSS /AMSAC applications are bounded by the previously-documented testing and so state in the final Davis-Besse plant-specific submittal.

Physical Separation from Existing RPS In accordance with B&W Document 47-1159091-00, the generic design requirements for DSS and AMSAC are such that " channel separation shall be provided in accordance with plant-specific requirements for routing non-safety signals."

To allow the staff to determine if this part of the Davis-Besse design complies with the current approved plant design requirements, specific details on component location and physical separation should be supplied in the plant-specific submittal.

Environmental Qualification (EQ) and Quality Assurance (QA) for Testing, Maintenance, and Surveillance In accordance with B&W Document 47-1159091-00, the generic design requirements for DSS and AMSAC are such that " equipment shall be qualified for a normal environment in accordance with plant-specific EQ program requirements; quality assurance measures are to be provided on a plant-specific basis equal to or better than the requirements promulgated by hRC's Generic QA guidance letter, GL 85-06."

It is the staff's understanding from the Davis-Besse " conceptual design" that all ATWS equipment will be purchased and installed to meet the requirements for the expected environmental conditions and that the equipment will be operational for the anticipated operational occurrences at its location. It is also the staff's understanding that the ATWS equipment at Davis-Besse will be controlled in accordance with the general requirements of the Toledo Edison Quality Assurance Program and will meet or exceed the " Quality Assurance Guidance For ATWS Equipment That Is Not Safety-Related," as set forth in GL 85-06. Maintenance, testing, and determination of operating status will be performed with approved procedures.

l The approach to the EQ and QA requirements identified above appears to be acceptable. It should be noted that the EQ and QA programs will be audited periodically during NRC regional inspections to assure continued compliance.

During the life of commercial light-water-cooled nuclear power plants, many components reach their end of life and must be replaced, including components installed in the RTS, DSS, and AMSAC. In its plant-specific submittal, Toledo Edison should provide a description of the measures / programs implemented for Davis-Besse to assure that the equipment diversity provided in accordance with ,

the ATWS Rule will be maintained during component repair, replacement, and modifications and/or design changes, etc. throughout the life of the plant.

i Safety-Related (IE) Power Supplies In accordance with B&W Document 47-1159091-00, the generic design _ requirements

. for DSS and AMSAC are'such that a " safety-related power supply is not

- required." However, " operability during Loss of Offsite Power is required." i Although the use of safety-related (IE) power supplies is not required for the DSS and AMSAC systems, the logic and actuation device power for the DSS and logic power for the AMSAC designs must be from an instrument power supply independent from the power supplies for the existing RPS. In this regard, it is the staff's understanding that the Davis-Besse " conceptual design" for the DSS provides for power to be supplied directly from offsite power sources, which are not backed up by emergency diesel _ generators. Power for the AMSAC (i.e., SFRCS) is partially provided by the same vital power as the RTS. For the staff to make a final determination of acceptance, the concerns noted in the diversity and independence sections with respect to the use of SFRCS equipment in the ATWS designs should be addressed.

Testability at Power

- In accordance with B&W Document 47-1159091-00, the generic design requirements for DSS and AMSAC testability at power are such that "the system shall be testable at power." At-power tests shall be performed at 6-month intervals with the complete system test being performed every refueling. The following exceptions exist. The DSS input sensors and the AMSAC input sensors and final actuation devices will be tested only at refueling outages.

P To ensure that the DSS and AMSAC circuits perform their safety functions in a reliable manner, the circuits must be maintained and periodically tested at power in accordance with technical specification operability and surveillance requirements or equivalent means.

It is the staff's understanding that the portion of the Davis-Besse

" conceptual design" that will allow testability at power is provided by the design of the DSS and AMSAC systems. The DSS is designed to be a two-out-of-two logic-actuated system, and provisions are incorporated that disable the second channel when a channel is placed in the test bypass condition. The AMSAC is four channel, Class 1E system with testing defined by technical specifications.

This approach appears to be in accordance with the above mentioned design requirements. However, the plant-specific submittal should also address the time limits associated with channel testing, disabling of channels, actions to be taken if one channel fails, etc.

______m._______m___ _ _ _ _ _ . _ _ _ _ . _ _ _ . . . _ . _ . _ _ . _ _ __ _ _ _ . . _ _ _

l

.)

Inadvertent Actuation In accordance with B&W Document 47-1159091-00, the generic design requirements for DSS and AMSAC to prevent inadvertent actuation are such that "the system ,

shall be designed to minimize challenges to safety systems" by using at least {

two channels with appropriate coincidence logic; the use of two channels j concurrent with the energize-to-trip design should minimize the number of inadvertent actuations. l To avoid the potential for inadvertent actuations of this nonsafety system, 1 the system shall be designed so as not to revert to a one-out-of-one status during channel test. For systems designed using the minimum two-channel logic, this dictates that the system shall become inoperable during channel-test.

It is the staff's understanding,that the Davis-Besse " conceptual design" is in accordance with the above mentioned design requirements.

Maintenance Bypasses. Operating Bypasses, Indication of Bypasses, and Means for Bypassing In accordance with B&W Document 47-1159091-00, the generic design requirements for DSS and AMSAC bypassing are such that "the system shall incorporate a channel test capability; the test function should simultaneously test an input and output channel together from sensor to final actuation device."

System status during testing shall be annunciated in the control room. The system should be designed to provide output to the control-room mounted alarms for input channel trip conditions, output channel trip conditions, system trip, and test status. The system status will also be annunciated when the system is in the Startup Bypass mode / condition and reactor power is less than 25% of rated full power.

It is the staff's understanding that the Davis-Besse " conceptual design" provides for bypassing to allow maintenance, testing, repair, or calibration during. power operation. Testing will be controlled as part of the existing plant administrative controls.

It is also the staff's understanding that the Davis-Besse " conceptual design" for the DSS does not require an operational bypass, and none is provided. The

" conceptual design" does provide for indication of DSS status, including maintenance bypasses in the control room. The " conceptual design"'provides these bypass capabilities for maintenance and test by using test switches under key-lock control.

The Davis-Besse " conceptual design" does not provide information describing the use of operational bypasses, the means of bypassing, or any indications of bypass conditions for the AMSAC. Therefore, Toledo Edison should include this information in the plant-specific ATWS design submittal for Davis-Besse.

Completion of Protective Action In accordance with B&W Document 47-1159091-00, the generic design requirements for DSS (AMSAC is not addressed) to assure completion of the protective action once it has been initiated are such that "the DSS shall incorporate a trip lockup'with manual reset capability in the output channels when activated by a true DSS trip."

It is the staff's understanding that the Toledo Edison " conceptual design" for the DSS at Davis-Besse requires deliberate operator actions to reset the DSS trip function. The " conceptual design" does-not indicate that the AMSAC will complete its protective action nor does the design indicate what action must be taken by the operator once the system is initiated.

Toledo Edison should provide specific information which confirms that both the  !

DSS and AMSAC at Davis-Besse are designed such that, upon receipt of a trip 'j signal, the protective action goes'to completion and deliberate operator )

action is required to reset the systems in order to comply with the ATWS. 1 Rule. In addition to the specific information on the system's design, Toledo Edison should include a discussion of any required operator actions.

Information Readout Although this item is not specifically addressed in B&W Document 47-1159091-00, it'is the staff's understanding that Toledo Edison's " conceptual cesign" for Davis-Besse provides for indication of USS system status to the operator via the plant computer and other alarms in the control room. The " conceptual design" does not provide any information describing how the AMSAC status will be displayed or what information is available to the operator.

Therefore, the Toledo Edison plant-specific submittal for Davis-Besse should provide more detailed information relating to how the operator is provided with accurate, complete, and timely information (i.e., what actuates or deactuates alarms, annunciators, lights, and what functions are performed by specific switches, etc.) pertinent to the DSS /AMSAC system status. In

.iddition, Toleco Edison should provide a discussion of how human-factors engineering practices are incorporated into the design of ATWS prevention / mitigation system components located in the control room. The coordination of displays used to provide the status of ATWS systems / equipment to the operator with existing displays should be addressed specifically.

Safety-Related Interfaces In accordance with B&W Document 47-1159091-00, the generic design requirements for safety-related components / interfaces are such that "the DSS and AMSAC are not required to be safety related nor designed to meet IEEE 279, however must be designed and engineered for high reliability to preclude unnecessary challenges to existing safety systems."

i It is the staff's understanding that the Toledo Edison " conceptual design" for the Davis-Besse DSS and AMSAC does include interfaces with the existing reactor protection systems, as noted in the previous discussions of this request for additional information. Theseconcerns(i.e.,thesharin power supplies via SFRCS/AMSAC and the adequacy of isolation devices)g should of I be adequately addressed in_the plant-specific submittal in order for the staff to evaluate the applicability of the devices for use in the DSS /AMSAC systems.

Technical Specifications The staff, in its Technical Specification Improvement Program, is presently  ;

evaluating the need for technical specification operability and surveillance requirements. This evaluation includes those actions considered to be appropriate to ensure that equipment. installed per the ATWS Rule will be maintained in an op~erable condition when operability requirements cannot be

. met (i.e., limiting concitions for operation). In its Interim Commission Policy Statement on Technical Specific 6 tion Improvements for Nuclear Power Plants [52 Federal Register 3778, February 6,1987], the Commission >

established a specific set of objective criteria for~ determining which

_ regulatory requirements and operating restrictions should be included in Technical Specifications. The staff will provide guicance regarding the

' Technical Specification requirements for DSS and AMSAC at a later date.

Installation of ATWS prevention / mitigation system equipment should not be delayed pending the development or staff approval of operability and surveillance requirements for ATWS equipment.

Conclusion In order f' or the staff to make a determination on the Davis-Besse compliance with the ATWS Rule and issue a Safety Evaluation report, the additional information requested in the body of this document will be required. This additional information, as well as pertinent information supplied previously, should be submitted to the staff in a single ATWS system final design package. This will assure that only the most complete and up-to-date information is reviewed.

Principal Contributors: V. Thomas B. Collins, EG&G

- _ _ - _ _ _ _ _ - _ _ _ _ _ _ - _ _ _