RBG-18-521, Forwards Final Response to Sections 1.1,2.1,2.2 & 4.5 of Generic Ltr 83-28, Required Actions Based on Generic Implications of Salem ATWS Events. Response to Sections 3.1 & 3.2 Will Be Provided Prior to Fuel Load

Forwards Final Response to Sections 1.1,2.1,2.2 & 4.5 of Generic Ltr 83-28, Required Actions Based on Generic Implications of Salem ATWS Events. Response to Sections 3.1 & 3.2 Will Be Provided Prior to Fuel Load

ML20094J682
Person / Time
Site:	River Bend
Issue date:	08/03/1984
From:	Booker J GULF STATES UTILITIES CO.
To:	Eisenhut D Office of Nuclear Reactor Regulation
Shared Package
ML20094J685	List: ML20094J691 RBG-18-521, Forwards Final Response to Sections 1.1,2.1,2.2 & 4.5 of Generic Ltr 83-28, Required Actions Based on Generic Implications of Salem ATWS Events. Response to Sections 3.1 & 3.2 Will Be Provided Prior to Fuel Load
References
GL-83-28, RBG-18-521, NUDOCS 8408140421
Download: ML20094J682 (21)

Text

g O

GULF STATES UTILITIES CODfPANY es POST OFFICE BOX 2951

• BEAUMONT. TEXAS 77704 AREA CODE 713 830 6631 August 3, 1984 RBG-18,521 File Nos. G9.5, G9.33.4 Mr. Darrell G. Eisenhut, Director Division of Licensing Office of Nuclear Reactor Regulations U. S. Nuclear Regulatory Commission Washington, D. C. 20555

Dear Mr. Eisenhut:

River Bend Station - Unit 1 Docket No. 50-458 In a letter dated November 1, 1983 Gulf States Utilities Company (GSU) committed to respond to Generic Letter 83-28, " Required Actions Based on Generic Implications of Salem ATWS Events", Sections 1.1, 1.2, 2.1, 2.2 and 4.5 by August 3, 1984.

Attached please find forty (40) copies of CSU's final response to Sections 1.1, 2.1, 2.2 and 4.5 of Generic Letter 83-28. The response to Section'1.2 is under preparation and will be provided by October 1, 1984. The response to Sections 3.1 and 3.2 will be provided prior to fuel load as previously indicated in the November 1, 1983 letter.

Should you have any questions feel free to contact us.

Sincerely.

J. E. Booker Manager-Engineering, Nuclear Fuels & Licensing River Bend Nuclear Group JEB/LAE/kfH p Attachments

$0SI 8408140421 840803 2 PDR ADOCM 05000458 l gr A PDR t

A UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION STATE OF TEXAS 1 COUNTRY OF_ JEFFERSON I JIn the Matter of I Docket Nos. 50-458 50-459 CULF STATES l'TILITIES COMPANY I (River Bend Station, Units 1 and 2)

AFFIDAVIT J. E. Booker, being duly sworn, states that he is Manager-Engineering, Muclear Fuels, and Licensing! that this position rectiires him to submit documents to the Nuc1 car Regulatory Comiasion in behalf of Gulf States Utilities: that the documents attached hereto are true and correct t'o the best of his knowledge, 'information' and belief.

d. E. 8: du

~

[J.E. Booker Subscribed and sworn to before me, a Notary Public in and for the State and County above named, this 8 day of /5tW , 19 .

(/vbiMu( ? & LbcAA'b

. Notary Public in and for /

Jeffernon County. Texas My Commission Expires J -//-[{

._ i

4 GULF STATES UTILITIES COMPANY  ;

RIVER BEND STATION RESPONSE TO GENERIC LETTER 83-28

" REQUIRED ACTIONS BASED ON GENERIC IMPLICATIONS OF i

SALEM NNS EVENTS" AUGUST 3, 1984 l

f TABLE OF CONTENTS Pane No.

r

1. Response to Section 1.1 2 POST-TRIP REVIEW (Program Description and Procedure) l

2. Response to Section 1.2 7 POST-TRIP REVIEW (Data and Information Capability) ,

3. Response to Section 2.1 8 [

EQUIPMENT CLASSIFICATION AND VENDOR TKTERFACE (Reactor Trip Syncem Components)

4. Response to Section 2.2 10 EQUIPMENT CLASSTFICATION AND _ VENDOR INTERFACE '

(Programs for All Safety-Related Components)

$. Response to Section 3.1 13 POST-MAINTENANCE TESTING (Reactor Trip System Components) l

6. Response to Section 3.2 13 POST MAINTENANCE TESTING (All Other Safety-Related Components)

7. Response to Section 4.1 13 REACTOR TRIP SYSTEM RELIABILITY (Vendor-Related Modifications)

8. Response to Section 4.2 13 REACTOR TRIP SYSTEM RELIABILITY (Preventative Maintenance and Surveillance Program for Reactor Trip Breakers)

9. Response to Section 4.3 13 .

REACTOR TRIP SYSTEM REf,TABILITY, (Automatic Actitation of Shunt Trip -

Attachment for Westinghouse and B&W Plants)

10. Response To Section 4.4 13 .e

-BEACIO_R TRIP SYSTEM RELIAHILITY i (Improvements in Maintenance and Test Procedures for B&W Plants)

11. Response to Section 4.$ 14 REACTOR __ TRIP SYSTEM fiEttABI!,1TY (System Functional Tasting) o e

Y

y~^

O SECTION 1.1 POST TRIP REVIEW (Program description and procedure)

The program for review and analysis of unscheduled reactor shutdowns at River Bend Station (RBS) is under development.

However, the following information is provided on the planned program and procedures for assuring that unscheduled reactor shutdowns are analyzed and that a determination is made that the plant can be restarted safely.

Item 1.1.1 The basic restart criteria developed by the BWR Owner's Group form the basis for the RBS procedures.

Restart criteria is addressed in three (3) RBS specific procedures: ADM-0022; " Conduct of Operations", A0P-0001; " Reactor Scram", and GOP-0007 "Ecram Recovery". ADM-0022 has been issued; the other two are drafted and in the review cycle. It is anticipated they will be issued by September 1, 1984.

Based upon technical judgment, utilizing approved plant procedures, control room indication and operator knowledge, the Shift Supervisor may make the decisior to recommend restart of the plant. Authorization for restart will be obtained from either the Operations Supervisor, or Plant Manager, depending on plant conditions and the following five criteria:

Criterion A The plant is shown to be in a safe condition.

The determination of the safe condition of the plant is assumed before any other criteria need to be examined. It is necessary to determine that safety limits have not been exceeded and that the issue at hand is one of justifying restart from a stable shutdown condition. If this is the case then the operator may begin an evaluation of the advisability of restart.

Criterion B The cause of the event is either understood or, after a comprehensive investigation, is considered to have been a spurious trip with a reasonably low potential for reoccurrence. In this circumstance, the Operations Supervisor may authorize restart.

The operator has many sources of information available to him which can be used both as a diagnostic tool in evaluating the cause of an unanticipated scram and in the identification of 2

l l

f_

m other-than-expected performance of plant systems and equipment.

The readouts of both safety related and non-safety related

.adicators (including such sources as the sequence of events recorder, alarm typer, trend recorder and process computer) provide a basis upon which technically defensibic actions can be initiated to determine the cause of the event and assure that the cause of the scram no lot.ger exists. See Caution No. 3 of the BWR Emergency Procedure Guidelines (EPG's) (Attachment-1). See also the response to Item 1.1.4.

It is important to understand the cause of an unscheduled trip so that reoccurences can be minimized. However, it is not realistic to ignore the possibility for spurious trips whose cause can not be identified. In the event that the cause of the unscheduled reactor shutdown cannot be determined, the Plant Manager or designated alternate authorizes a restart based on the following conditions:

a) All reasonable actions to determine the cause have been considered.

b) No physical damage was done by the event and a determination has been made that the plant had not operated beyond the boundaries established by approved plant safety and transient analyses.

c) Safety systems have actuated properly.

The discussion of the qualifications and responsibilities of the personnel making the restart recommendation is included in sections 1.1.2 and 1.1.3.

Criterion C The expected on-off automatic operation of plant safety related systems has been verified.

If the operator determines that a particular system should have initiated for a particular event, he need only establish that the systea did indeed initiate and in the proper sequence. A detailed analysis of the actual performance of that system following an unscheduled shutdown is not-a criterion for restart. Such a detailed analysis is accomplished through the normal surveillance testing procedure done at regular intervals. This step is consistent with the philosophy espoused in Caution No. 1 of the NRC approved BWR EPGs.

Since confidence in the accuracy of Control Room readout is provided both by the routine maintenance and surveillance activities associated with Engineered Safety Features, and normally scheduled and performed calibration activities associated 3

i

with such devices, adherence to these efforts mitigates the need to enter into a complete recalibration (i.e., pressure, flow, operating times, etc.) or performance reevaluation of the adequacy of system _ operation.

Criterion D Any need for corrective action has been determined and appropraitely implemented.

Once the cause of the event is determined the operator then needs to determine what, if any corrective action (s) need to be implemented.

If no corrective action has been determined to be necessary, normal restart procedures apply. If corrective action is necessary but is not required to meet Technical Specification requirements, then restart procedures apply and the needed corrective actions are taken following restart. If corrective action is required then it would be necessary to complete the effort before initiation of restart activities. These actions range in effort from a simple recalibration of the device causing the scram to replacement and/or recalibration of major portions of a system. This determination also needs to be based on the Technical Specification associated with startup activities (i.e.,

Technical Specifications allow restart with some devices out-of-service). Before startup activities are commenced, compliance to the Technical Specification must be assured.

Criterion E

~The approval of the Operations Supervisor, Plant Manager or designated alternate has been obtained.

The review of- the reactor trip is performed by the Shift Supervisor. The recommendation to restart is then made by the Shift Supervisor to the Operations Supervisor or Plant Manager.

The recommendation must be approved by the Operations Supervisor,

Plant Manger or designated alternate in order to authorize restart.

-Item 1~.1.2 The review and analysis of the unscheduled reactor trip will be performed by the Shift Supervisor. Input to.the review process comes from operators or maintenance, Instrumentation & Control and i

other personnel involved in the reactor trip or correct.ve

. actions.

The responsibilities and. authorities of the Shift Supervisor are

detailed in FSAR Section 13.1.2.2.5 and includes ". . . compliance 4

~

(Nl ' .n

. aug

~

s C

with4 applicable license and regulatory requirements, and the; safety of plant personnel:and equipment". The Shift Supervisor

.also has the responsibility "...to shut down the plant if, in his

' judgment, conditions warrant this action."

.The responsibilities and authorities of the Plant Manager who

, approves the restart.are: included'in FSAR Section 13.1.2.2.1.

-Item.1.1.3 LA position on Regulatory Guide 1.8 " Personnel Selection and

. Training" is presented in RBS FSAR Section 1.8. _ Plant Operations Structure and River Bend Shift Organization are found in FSAR.

figures 13.1-2 and 13.1-5 respectively. Resumes are found in FSAR f,

Appendix 13A.

L .As discussed in FSAR section 13.2.1.1, SRO candidates who will serve in the dual role'SR0/ Shift Technical Advisor (STA) capacity

, ?will have as a minimum, the education and training provided in

.NUREG-0737, " Clarification of TM1 Action Plan Requirements".

~

Present plans make use of Memphis State University's Advanced Technical Principle Program which contains, but.is not limited.to:

-Differential &-Integral Calculus, AdvancedLReactor Physics,.

Material Study, Fracture Mechanics, Corrosion Processes, Computer Technology, Electric Generation and Transmission, Thermodynamics,

Heat Transfer, Fluid Mechanics,EHuman Behavior and Project Course.

Item 1.1.4

[

~

LAs stated in Item 1.1.1 above -the RBS procedures which will address the sources of information used to conduct the review and

~

analysis of an unscheduled reactor trip are under development and will be available for review when completed.

Section 1.2 (scheduled for submittal by October 1, 1984) will

~

address plant information sources avullable at RBS for analysis of unscheduled reactor shutdowns. These include the Annunciator / Sequence of Events Recorder for assessing sequence of -

events.during the scram,.as well as analog recorders for assessing.

the time history of analog variables and the functioning of safety-related equipment.

'When the plant computer is available there is additional sequence of events information on the sequence of events log,'and time history and equipment functioning information on the post-trip logs In addition to.all of the above, supplemental plant information is-available through the Emergency Response Information System (ERIE).

5

- , - ,.. -- ,, - , - - ., 1

f. '

- .1

The information gleaned from the above instrumentation is combined with operator observations during the transient, operatcr knowledge of the plant, post-trip observations of equipment status and-available information from previous surveillance tests and transients in order'to reconstruct the* event accurately.

' Item 1.1.5 As stated in Item 1.1.1 above, the RBS procedures for Post-Trip Review which will address'the methods and criteria for comparing the event information with expected plant behavior are under development and will be available for review when completed.

Item 1.1.6 As stated in Item 1.1.1 above, the RBS procedures for Post-Trip Review which will address the need for independent assessment on an event are under development and will be available for review when' completed. Guidelines on the preservation of physical

. evidence to support independent analysis of the event will also be included in those procedures.

Item 1.1.7 RBS is establishing a systematic method to assess unscheduled reactor-shutdowns. The procedures which address the above items will be available for review as stated above.

J 6

0-O SECTION 1.2 POST-TRIP REVIEW (Data and Information Capability)

GSU will submit the report required by Section 1.2 by October 1, 1984.

M e

7

P

.c SECTION 2.1 EQUIPMENT CLASSIFICATION AND VENDOR INTERFACE

-(Reactor Trip System Components)

Generic Letter 83-28, Section 2.1 requires confirmation that all components whose function is. required to trip the reactor are identified as safety-related on documents, procedures, and information handling systems used in the plant to control safety-related activities. In addition, for the same components, a program to ensure that vendor information is complete, controlled, and current must be established, implemented, and maintained.

The BWR reactor trip system, as described in Section 3.1.2.5 of

-NUREG-1000, differs from the PWR designs. The GE reactor trip system consists of redundant plant process instrumentation that feed one-out-of-two taken twice logic that initiates a reactor trip by de-energizing solenoid operated scram pilot valves which

' vent' air from the scram valve diaphragms and insert the control rods. The components used in this process are contained within

^

~several systems'at River Bend Station rather than one system called a reactor trip system. The components which provide the 51 reactor trip function are in the following plant-sytems: -

u, System Description Control Rod Drive Scram Valves, Scram Discharge Volume Water Level Sensors, Backup Scram Valves-Reactor Protection Logic, Power Supplies, Drywell Pressure Sensors, Turbine Sensors.

Neutron Monitcring Nuotron Flux S'ensors, Trips, Bypasses g; . Nuclear' Boiler Reactor Pressure and Level Sensor, Main Steam Line Isolation Valve Sensors-a Process Radiation Main Steam Line Radiation Sensors

. 1 Monitoring-Creation of a new system called the'" Reactor Trip System":with

~

1 components from established systems would cause confusion with-exisiting documentation. The specific components that would form al" Reactor TripfSystem"'are not_ separately,1dentified. 'Thus,

River Bend, Station's response to Section 2.1 is based-on the systems which contain components'that: perform the reactor trip 4 .

. function.

~

" Item 2.2.1 describes River Bend Station's equipment. classification

program for these' systems along with other systems-which contain safety-related components. This program will:ensuru that all,

~

x a

8.

/

q

^

i

- 1 r .g m .

e ~

l c

\

components whose function is required to trip the reactor are identified as safety-related.

In response to the vendor interface concern, Gulf States Utilities joined with 55 other utilities and formed an Institute of Nuclear Power Operations (INPO) Nuclear Utility Task Action Committee (NUTAC). This committee has developed and approved an industry-wide Vendor Equipment Technical Information Program (VETIP), which is described in detail in Attachment 2. This program promotes interaction among the major organizations involved in the generation of commercial nuclear power. As illustrated in Figure 1 to the previously mentioned attachment, individual Utilities exchange and disseminate safety related system and component information with vendors, the NRC, INPO and other Utilities. This exchange of information takes place via written notification (i e. , License Event Reports, NRC I&E Bulletins and Information Notices, industry newletters, etc.) as well as industry meetings and day-to-day verbal communications. The purpose of these information exchanges is to share equipment technical information to improve the safety and reliability of nuclear power generating stations. The primary purpose of the VETIP program is to ensure that current information and data will be made available to those personnel responsible for developing and maintaining plant instructions and procedures. These information systems and programs currently exist and are capable of identifying to the industry precursors that could lead to a Salem-type event. It should be noted that the VETIP_is industry-controlled and is mainly a hardware oriented program that does not rely on vendor action, other than the NSSS supplier, to provide information directly to Utilities. Instead, the VETIP provides information developed by industry experience through Significant Event Reports (SERs) and Significant Operating Experience Reports (SOERs) to the equipment vendor for comment before it is circulated to the Utilities concerned.

River Bend Station has an existing vendor equipment information program with General Electric Company (GE). This program consists of two major categories: (a) information regarding safety-related sytems and components; and (b) technical information intended to enhance safety and non-safety related eouipment reliability and improve plant performance. These programs include, but are not limited to:

(a) 10CFR21 Reporting. The General Electric Company has established a reporting system to handle safety concerns that complies with the requirements of 10CFR21.

Urgent Communications. In addition to the 10CFR21 reports, a procedure for handling urgent communications to BWR owner / operators has been established for use in providing fast notification of safety concerns. Theses communications 9

a

(

are usually in the form of a short letter which provides a brief explanation and advice or precautionary measures to be

~

observed to avoid potential operational hazards. As a result i- of their urgent nature, these communications are processed to operating plants by the most effective method, either by telephone or, if transmitted in written form, they will be followed up or preceded by telephone call.

(b) Service Information Letters (SILs). These documents provide recommendations for equipment modification, plant design improvements or changes to procedures to improve plant performance.

Service Advice Letters (SALs). These letters are used to provide notification of product problems and/or service information on a broad range of GE consumer and industrial products. Those SALs that are recognized by the issuing product department as applying to devices used in nuclear plants are specially identified and are flagged for distribution to all nuclear plants.

Turbine-Information Letters (TILs). These documents are issued by GE's Large Steam Turbine Generator Department to -

provide descriptions of product problems / improvements and to recommend modifications that will mitigate problems or improve product performance.

Further description of River Bend Station's vendor interface program is included in Item 2.2.2.

SECTION 2.2 EQUIPMENT CLASSIFICATION-AND VENDOR INTERFACE (Programs for All Safety-Related Components)

Item 2.2.1.

This section describes.GSU's program for ensuring that all components of safety-related systems necessary for accomplishing required safety functions, are identified as safety related on.

documents, procedures,'and information handling systems used in the plant to control safety-related activities.

Item 2.2.1.1-River _ Bend Station's quality classification system, or Q-list, identifies-as safety-related those plant systems, portions of system,tstructures,3and equipment whose' failure or malfunction could cause a release of radioactivity in. excess of those limits

- specified in 10CFR100. . This class (GSU Quality. Class 11) also nincludes equipment:which is vital to a safe shutdown of the-plant-10

$ _ - L _# b

v and to the. removal of decay and sensible heat, or equiment which is necessary to mitigate the consequences of a costulated design basis accident. -All ASME Code Class 1, 2, and 3 items, fabricated and installed under ASME Section III, are classified as safety-

-related.

Item 2.2.1.'2 The River Bend Station Q-list is being developed by Stone and WebsterLEngineerng Corporation, GSU's architect / engineer. The Q-list'was generated from computerized lists of mechanical and electrical equipment, instruments, valves, and piping. The compiled lists are validated against a controlled data base containing valid Piping and Instrument Diagram information, and against design documents. . The process of generating and updating the Q-list is controlled by a Stone and Webster project procedure.

GSU will use a similar procedure to control the Q-list data base.

The Q-list format will include, for each component listed, the marked number (identification number), a description and/or dimension, the electrical overlay code, the purchase order and/or specification number, the vendor name, the storage code, and the

~

GSU Quality Class (QC). All components will be classified as-either GSU QC 1, 2, or 3. The scope of components on the Q-list will include all major electrical and mechanical equipment, and all piping,.but will not includ cable, racks, panels, supports (including cable trays, pipe h..tgers, and snubbers), or sub-component items.

Item 2.2.1.3-Activities are defined as safety related in 10CFR50, Appendix B, if they affect the safety-related functions of those systems, structures, and components which prevent or mitigate the consequences of postulated accidents which could cause undue risk to the health and safety of.the public. These activities may include designing, purchasing, fabricating, handling, shipping, storing, cleaning, erecting, installing, inspecting, testing, operating, maintaining, repairing, refueling, and modifying.

River Bend Station personnel will'use a project procedure which is-currently under development to determine whether a component is safety-related. All other procedures which control any of the activities listed above, are being revised to assure that the Q-list Utilization procedure is consulted during the course of the activity to determine whether components affected by the activity are safety related.

Item 2.2.1.4 The management controls utilized to verify that the procedures for preparation, validation, and routine utilization of the River Bend 11

l Station Q-list are contained by audits and surveillances in accordance with the GSU Quality Assurance Program.

Item 2.2.1.5 Plant Administrative Procedures require that spare parts are procured to the original specification requirements or that design verification is performed if the new part cannot be supplied to meet the original requirements. The original specifications include qualification testing for expected safety service conditions. GSU procedures will be in place to provide the same assurances when'GSU assumes the procurement function for equipment other than spare parts.

Item 2.2.2 Vendor Interface In response to the positicn stated in Generic Letter 83-28 Section 2.2.2, Gulf States Utilities participated in the development of a vendor equipment technical information program (VETIP) by the INPO Nuclear Utility Task Action Committee (NUTAC) on Generic Letter 83-28, Section 2.2.2. A detailed description of the VETIP is included as Attachment 2.

GSU Administrative Procedurcs have been established to provide a uniform,. systematic method for review of NRC I&E Bulletins and Notices, INPO Significant Event Reports, INP0/NSAC Significant Operating Event Reports, General Electric Service Information Letters, vendor manuals and other documents generated offsite and transmitted to the site. GSU will, prior to commercial operation establish administrative controls to ensure active participation in NPRDS.

Currently, River Bend Station's technical information such ar vendor manuals and drawings, is received, reviewed, approved, and controlled by Stone and Webster Engineering Corporation (SWEC). '

SWEC transmits this information to Gulf States Utilities, River Bend Administrative Support Group, which controls this documentation for use by River Bend Station project personnel and contractors. These functions are controlled by SWEC and GSU project procedures. When GSU assumes the functions presently performed by SWEC, GSU procedures will be in place to control this technical information.

The intent of Generic Letter 83-28, Section 2.2.2 is tc improve the safe operation of nuclear power generating stations by ensuring that utility personnel are provided with complete and curren'. technical information concerning safety-related equipment.

GSU procedures concerning control of technical information along with GSU's participation in VETIP meet this intent.

12

y:.

S SECTION 3.1 POST-MAINTENANCE TESTING

'(Reactor Trip System Components)

As stated in GSU's November 1, 1983 letter (Booker to Eisenhut, RBG-16285) a response to Section 3.1 of Generic Letter 83-28 will be provided prior to fuel load.

SECTION 3.2 POST-MAINTENANCE TESTING (All other Safety-Related Components)

As stated in GSU's November 1, 1983 letter (Booker to Eisenhut, RBG-16285) a response to Section 3.2 of Generic Letter 83-28 will be provided prior to fuel load.

SECTION 4.1 REACTOR TRIP SYSTEM RELIABILITY (Vendor-Related Modifications Section 4.1 is not applicable to River Bend Station SECTION 4.2 REACTOR TRIP SYSTEM RELIABILITY (Preventative Maintenance and Surveillance Program for Reactor Trip Breakers)

Section 4.2 is not applicable to River Bend Station SECTION 4.3 REACTOR TRIP SYSTEM RELIABILITY (Automatic Actuation of Shunt Trip Attachment for Westinghouse and B&W plants)

Section 4.3 is not applicable to River Bend Station SECTION 4.4 REACTOR TRIP SYSTEM RELIABILITY (Improvements in Maintenance and Test Procedures for B&W Plants)

Section 4.4 is not applicable to River Bend Station 13

t l

SECTION 4.5 REACTOR TRIP SYSTEM RELIABILITY (System Functional Testing)

Item 4.5.1 The diverse reactor trip system features of the reactor protection system (RPS) include the normal scram logic and a backup scram logic.

On-line functional testing of the RPS will be performed consistent with RBS Technical Specifications. Channel functional testing is performed on the multiple and diverse reactor transient trip sensors. During the required trip sensor channel tests identified above, each scram contactor which actuates the scram pilot solenoid valves is tested. The simple operation of the scram contactors minimizr.s concerns of wear, and frequent testing assures that any failures are detected early. The scram pilot solenoid valves which are actuated by the scram contactors are all tested regularly. Redundant electrical protection assemblies (EPAs) which protect the scram pilot solenoid valves from low voltage chattering and the associated potential consequence of accelereted wear are also functionally tested. These surveillance testing requirements related to.the scram pilot solenoid valves assure that the probability of undeteced failures of these independently acting solenoid valves is small.

Channel functional tests are performed on-line for the following sensor trips:

a) Reactor Vessel Dome Pressure-High b) Reactor Vessel Water Level-Low c) Reactor Vessel Water Level-High d) Main Steam Line Isolation Valve-Closure e) Main Steam Line Radiation-High f) Drywell Pressure-High g) Turbine Control Valve Fast Closure, Control Oil Pressure-Low h) Turbine Stop Valve-Closure Channel functional tests are also performed for the average power range monitors (APRMs) and intermediate range monitors (IRMs).

It is shown that each of the above plant variables used to initiate a protective function is backed up by a completely different plant varaible as indicated by References 1 and 2. In fact, for the most frequent transients, scram is initiated by three diverse sensors in all but one case. This indicates that adequate redundancy exists in the design to provide protection against multiple independent sensor failures. Also, diversity among sensor types reduces the potential for common mode failures, 14

e  ;

failures due to human error, and increases in failure rate due to wearout.

Each sensor channel functional test includes full actuation of the assoc lated logic, the two output scram contactors in each channel, and the individual CRD scrap pilot solenoid valves for the associated logic division (both "A" and "B" solenoids are required for scram initiation) .

The most credible failures within the RPS logic will de-energize a set of scram solenoids which causes a half scram (i.e. , one of the two scram solenoids required for scram initiation is de-energized at some or all hydraulic control units). These failures would be

" SAFE" failures that would increase the probability of plant shutdown.

The less credible logic failures which prevent a channel from de-energizing will be detected during channel functional tests in compliance with Technical Specification requirements. The tests described above ensure that an increase in failure rate due to a wearout condition or a common mode failure potential will be detected early and corrective action taken before the failure condition becomes systematic.

Other channel functional tests include testing of the scram discharge volume (SDV) water level-high trip, manual scram trip, and resctor mode switch in the shutdown position every refueling.

The first two trips involve on-line testing and the latter mode switch test can only be conducted during reactor shutdown. The manual scram trip can be tested on-line without creating a scram.

The testing of the SDV water level-high trip is considered adequate based on the current designed redundancy and diversity incorporated into the system. There are two diversity incorporated into the sytem. There are two diverse and redundant sets of level sensors which scram the reactor in the unlikely event of high water level in either SDV. These trips are designed to allow sufficient scram water discharge volume given the scram trip point is reached.

Reference 2 concludes that reactor shutdown can be achieved if at least 50% of the control rods in the checkerboard pattern and 69%

in a random pattern are inserted in the core. The probability of independent failure of enough rods to prevent shutdown is negligible. The most unlikely type of failure would be some common mode mechanism that if undetected over a long period of time could cause unsafe shutdown. RBS Techincal Specification surveillance requirements adequately ensure that a failure mechanism affecting several individual drives which is considered to be very remote would not go undetected. One of the major features that ensures that several drives do not fail at one time 15

I due to wearout or a common mode failure is.the staggered maintenance and overhaul of selected CRDs or hydraulic control units (HCUs) at refueling outages. This ensures a mix of drives Jby age, component lot, maintenance time, servicing personnel, and testing.

The scram insertion time tests include, in addition to drive timing and insertion capability, a test of operability of the HCU scram insert and discharge valves including associated scram pilot solenoid valves. As stated in the previous paragraph, the required testing ensures that a systematic failure mechanism in the HCUs would be detected early enough and corrective action taken before the condition becomes a critical failure preventing

' scram.

In summary, the current reactor protection system on-line surveillance testing requirements, in conjunction with multiple and diverse sensors, assures thct the probability of failure of enough. control rods to prevent reactor shutdown is negligible.

Item 4.5.2 Included in Item 4.5.1 Item 4.5.3~

Gulf States Utilities (GSU) is participating in the BWR Owners -

Group Technical Specification Improvements Committee program.

This program will review existing intervals for on-line functional testing required by Technical Specifications to determine that the intervals are censistent with a'chieving high reactor trip system availability when. accounting for considerations such as:

a) Component failure rates b) Common mode failures rates c) Reduced redundancy during testing d) Human error rates during testing e) Component "wearout" rates caused by testing GSU will then utilize the results for specific application to RBS Unit 1.

The schedule for the above generic approach is currently being prepared by the Technical Specification Improvements Committee of the BWR Owners Group.

REFERENCES

1. NEDO-1-189,_"An Analysis of Functional Common-Mode Failures in GE BWR Protection and Control. Instrumentation," L. G.

Frederick, et. al., July 1970, 16

fi:'

w. '

'2. "BWR Scram System Reliability' Analysis," W. P. Sullivan, et.

al., September 30, 19876 (Transmitted'in letter from E. A.

Hughes (GE) to D. F. .Ross (NRC), " General Electric Company.

' A'NS Reliability Report," September 30, 1976).

17 L - - _ . - . . - - _ . - _ . _ _ _ _ _ . . _ - - - - - - - - - - - _ _ _ _ _ _ _ _ _ ...

. . - ._ .. - - - .. --- - . . - . -.=

Attachment 1  %

OPERATOR PRECAUTIONS GENERAL This section lists " Cautions" which are generally applicable at all times.

CAUTION #1 Monitor the general state of the plant. If an entry condition for a

[ procedure developed from the Emergency Procedure Guidelines] occurs, enter that procedure. When it is determined that an emergency no longer exists, enter [ normal operating procedure].

CAUTION #2 Monitor RPV water level and pressure and primary containment temperatures and pressure from multiple indications.

4 CAUTION #3 If a safety function initiates automatically, assume a true initiating event has occurred unless otherwise confirmed by at least two independent indications.

CAUTION #4 Whenever RHR is in the LPCI mode, inject through the heat exchangers as soon as possible.

(I-5) Rev. 3 i-e y -m . .-- - ,-ry.4 - ,, ,- .