TXX-6769, Forwards Response,Addressing Plant Specific Requirements,As Designated in WCAP-10858, ATWS Mitigating Sys Actuation Circuitry (AMSAC) Generic Design Package, Per Generic Ltr 85-06.AMSAC Scheduled to Be Implemented by Mar 1988

Forwards Response,Addressing Plant Specific Requirements,As Designated in WCAP-10858, ATWS Mitigating Sys Actuation Circuitry (AMSAC) Generic Design Package, Per Generic Ltr 85-06.AMSAC Scheduled to Be Implemented by Mar 1988

ML20235V372
Person / Time
Site:	Comanche Peak
Issue date:	10/09/1987
From:	Counsil W TEXAS UTILITIES ELECTRIC CO. (TU ELECTRIC)
To:	NRC OFFICE OF ADMINISTRATION & RESOURCES MANAGEMENT (ARM)
References
GL-85-06, GL-85-6, TXX-6769, NUDOCS 8710150110
Download: ML20235V372 (14)

Text

___ _.

/

j,; b t

.o , ,

M

=M Loa # TXX-6769 W

'f, _

dJ fi h # 10035  !

= = 915.8 h p\ q H# ELECTRIC . Ref # 10CFR50.62 (c)(1) f'\ <

l-k H;Iliam G. Counsil

.Esecutive Vice President t

-l U. S. Nuclear Regulatory Commission q'y

' Attn: Document Control Desk Washingten, DC 20555 s r t' ,

SUBJECT:

COMANCHEsPEAK STEAM ELECTRIC STATION (CPSES) I DOCKET N05. 50-445 AND 50-445 '7 IMPLEMENTATION OF GENERIC LETTER 85-06 7;<

ANTICIPATED TRANSIENTS WITHOUT SCRAM (ATWS)

[f

REFERENCE:

W. G. Counsil letter TXX-6416 to NRC dated "L kS I fpril29,1987

/ 1 1

/ ) 3 m

} '

Y ,

Gentlemen: c ,

,. 4 On April 16, 1985, the NRC staff issued Generic Letter 85-06 to address <

quality as'surance requirements for non-safety ATWS equipment. Specifically j.ir, the letter requires Westinghouse near term operating licensees to submit an jl implementat6cn schedyle for the ATWS Mitigating System Actuation Circuitry (AMSAC), which will meet the requirements of 10CFR50.62 paragraph (c)(1).

Attached is TV Electric $ response which addresses the plant specific requirements, as designated in WCAP,-10358, AMSAC Generic Design Package, which was approved by thq NRC with the Safety Evaluation and WCAP-10858P-A Rev.11/

which was submitted to the NRC August 3, 1987 to provide further consideration of the AMSAC arming setpoint, C-20. CPSES utilizes the steam generator low low water level for its plant specific design logic. As stated in the reference letter, AMSAC is scheduled to be implemented at CPSES by March 1988.  !

Very truly yours, -

$$ Y 8710150110 871009 W. G. Counsil' PDR ADOCK 050C0443 A o VIP:tgj [' FDR

i s

Attachment c- Mr. R. D. Martin, Reaion IV l 4

Residentinspediors(3) g

, I 400 North Olise Street LB 81 Dallas, Texas 75201

Wk Attachment to TXX-6769

/'~i' . October 9, 1987 Page 1 of 13 ,

t

/ I 1- ,

n v j 6 ATTACHMENT M)':  ?

cm 3 ANSAC SAFETY EVALUATION REPORT RESPONSE FOR COMANCHE PEAK STEAM ELECTRIC STATION TVElectrichasselectedhdwillimplementanAMSACactuationlogicwhich detects a loss of heatsink by monitoring the water level in each of the steam

. generators. This actuation logic incorporates an automatic arming and block circuitry based upon turbine load by monitoring the first-stage turbine i

impulse chamber pressure. This signal, referred to as the C-20 signal, blocks l AMSAC actuation at low power levels to prevent spurious trips during plant

( siart-ups. This actuation logic is depicted in Figure 1.

The basis for this design can be found in WCAP-10858, AMSAC Generic Design Package, which was approved by the NRC with the Safety Evaluation and WCAP-10858P-A Rev. 1, which was submitted to the NRC August 3, 1987 to provide further consideration of the AMSAC arming setpoint, C-20. The Comanche Peak design does not deviate from the submitted package and the following is the response to the fourteen (14) items requested in the SER for the plant specific submittal.

Diversity The basis for diversity of the ATWS mitigation system from the existing reactor trip system is to minimize the potential of common mode failures.

This diversity is required from sensor output to, but not including, the final actuation device, e.g., existing circuit breakers may be used for the auxiliary feedwater initiation. For Comanche Peak, the existing transmitters, transmitter )ower supplies, and new isolators associated with the turbine impulse cham 3er pressure and narrow range steam generator level loops in the 7300 process protection system will provide the input for AMSAC. The Westinghouse AMSAC design is a microprocessor-based system with the capability to incorporate three different actuation logic schemes: Comanche Peak will employ actuation based on low steam generator water level. The reactor trip system utilize an analog-based process protection system and discrete component logic system. Therefore, Comanche Peak fulfills the requirement of diversity through the types of technology (analog vs. dig;tal) and hardware utilized. Where similar components are utilized for the same function in both AMSAC and the reactor trip system, the components used in AMSAC are provided from a different manufacturer. For example, relays are utilized in both systems for interfacing with the final actuation circuits. At Comanche Peak, Potter-Brumfield and SR relays are utilized within the reactor trip system while Struthers-Dunn relays are used within AMSAC.

Logic Power Supplies According to the rule, the AMSAC logic power supply is not required to be safety related. However, the logic power supply should be from an instrument s

i

-_ __--__ / >

Attachment to TXX4769 s  ! >

. October 9, 1987 Page 2 of 13 '

power supply that is independent from the reactor protection system power supplies. At Comanche Peak, AMSAC logic cabinets will be powered from a non-class IE uninterruptible power supply (UPS) source. This will ensure availability of power during lost of off-site power.  ;

Safety-Related Interface d

/

Thd hM40 rin$ts for measuring turbine impulse charber spessure and narrow rangs steam generator water level are derived from exding transmitters.

Connections ta those channels are made downstream of class IE isolation devices which areJacated within the process protection cabinets. These isolation devices ensure that the existing protection system continues to meet >

all applicable safety criteria by providing isolation as demonstrated in Appendix A of this submittal. 7M o Tput isolation device is the interface ',

that separates the ATWS equ yment from the safety related equipment. To show that the implementation of the, interface is such that the existing protection. . 2 system continues to meet all' applicable safety criteria, the isolation device l will be a qualified device ccnsistent' with the requirements of Appendix A of 3 the NRC SER ant ~can be foted in Appendix A of this document. '

l a ;l Quality Assurance <

, i Generic letter (GI,) 85 06 provides explicit QA guidance for non-cafety related  !

ATWS equipment as required by 10CFR50.62. The GL specifically states that the i QA program fonthuun-safety related ATWS equipment does not need to meet the i requirements of 10CFR50 Appendh B nor would compTiance be judged in terms of

, the Appendix. Detaile( CA guidance will be in accordance with the enclosure to the GL. For Manufactiwing, the hostinghouse program exceeds the above requirement. Quality Assuruce, for plant modifications involving, design, procurement & installation fWAMSAC equipert will be in accordance with existing plant pf f:edures. For testing tnd maintenance, procedures will be developed based on tha Westinghouse recommendations /' technical manua's' } "for the equipment as required.

) ,

Maintenance Bypasses liaintenance at power is' accomplished through a permanently in.;talled bypass switch. This complies with the NRC SER because this method does not involve lifting leads, pulling fuses, tripping breakers or physically blocking relays.

Rotating of the AMSAC bypass switch to the " bypass" position inhibits operation of the system's outpot raleys which operate the final actuation ,

devices. Status outputs to the plant computer and main control board. ,

indicating that a general warning condition (AMSAC trouble) exists with AM5AC, areL initiated when the bypass switch is placed in 'the " bypass" position.

/

l

~

Attachment to TXX-6769

. October 9, 1987 Page 3 of 13 Operating Bypasses Letter 00-87-10 dated February 26, 1987 has been submitted to the NRC by the Westinghouse Owner's Group (WOG) to provide the basis for the C-20 setpoint.

The C-20 permissive signal uses the existing turbine impulse chamber pressure sensors. Short term protection against high reactor coolant system pressures is not required until 70% of nominal power. However, in order to minimize the amount of reactor coolant system voiding during an ATWS, AMSAC will operate at and above 407 of nominal power. Furthermore, the potential exists for spurious AMSAC actuations during start-up at the lower power levels. To assure these requirements are met, AMSAC will be automatically blocked by the C-20 permissive at turbine loads less than 40%.

The operating bypass status of the AMSAC system will be indicated (status light) on ,the main control board at the permissive and control interlock panel and will also be an input to the plant computer. The indication of maintenance bypass mentioned earlier and operating bypass will be consistent with the existing control room design philosophy and human factors engineering considerations, For guidance on diversity and independence for the process equipment and logic power supplies, see those specific sections.

Means for Bypass Bypassing of AMSAC is accomplished with a permanently installed, human factored bypass switch. It does not involve lifting leads, pulling fuses, triNNg breakers or physically blocking relays.

Manual Initiation At Comanche Peak, manual AMSAC actuation is not provided since the turbine can be tripped manually in the Control Room or locally at the turbine. Manual tripping is accomplished by depressing the " turbine trip-push button" or by

" pulling-to-lock" the control switch for the control fluid pumps. The push button and control switch are located at the main control board. The turbine can be manually tripped via a local trip valve located at the hydraulic control rack.

The auxiliary feedwater pumps can be manually started in the control room or at the hot shutdown panel. Manual starting is accomplished by positioning the individual auxiliary feedwater control switches to the " START" position.

Manually tripping the turbine and starting the auxiliary feedwater pumps are accomplished in accordance with existing plant operation procedures.

~

Attachment to TXX-6769

. October 9, 1987 )

Page 4 of 13 i Electrical Independence I

l Electrical independence from the existing reactor trip system is required from the sensor output to, but not including, the final actuation device. This is a separate safety related circuit from the non-safety related circuits. The Conianche Peak AMSAC fulfills this requirement. For the turbine impulse chamber pressure input, TV Electric has elected to use the existing pressure a transmitters, loop power supplies, and new isolation devices within the 7300 J system process protection cabinets. In a like manner, existing narrow range level transmitters, loop power supplies and new isolation devices within the )'

process protection cabinets will be utilized for measuring level in each steam generator and therefore, will also be electrically independent from the reactor trip system. Moreover, the non-class 1E logic circuitry and outputs of AMSAC are isolated from the class 1E turbine trip circuits and the class 1E auxiliary feedwater start circuits. Information pertaining to the isolation devices utilized can be found in Appendix A of this document.

Physical Separation The ATWS equipment must be physically separated from the existing protection system hardware. This requires that the ATWS cable routing be independent of protection system cable routing and the location of the ATWS equipment cabinets, such that there is no interaction with the protection set cabinets.

The basis of this requirement is Regulatory Guide 1.75, Revision 2, which endorses and augments IEEE 384-1974 requirements and criteria applicable to class 1E instrumentation cabinets. The AMSAC actuation outputs to the redundant turbine trip and auxiliary feedwater pump circuits are separated by providing separate relay panels within the AMSAC cabinet. Additionally, the isolation fault tests mentioned in Appendix A will demonstrate that credible faults will not disable channels associated with other protection sets. All non-class IE AMSAC inputs and status outputs will be routed to a separate ,

logic cabinet and therefore, will be separate from the class 1E actuation '

circuits. Figure 2 depicts the system block diagram along with the cable I separation groups.

l Equipment Qualification The SER requires that only the isolation devices comply with environmental qualification (10CFR50.49) and with scismic qualification, which is discussed in Appendix A. The environmental qualification of the remaining portion of the hardware will be addressed here. The ATWS mitigation system is not required to be safety related and therefore, is not required to meet IEEE-279-1971, nor be environmentally qualified. The portion of the ATWS mitigation '

equipment located outside containment in a mild environment area follows the same design standards as non-class 1E control-grade equipment. For this modification, there is no additional equipment inside containment; the existing equipment inside containment is qualified.

Attachment to TXX-6769 J

~

October 9, 1987 Page 5 of 13 Testability at Power The non-safety related ATWS circuitry is testable with the plant on-line.

Testing of the AMSAC outputs to the final actuation devices may be performed with the plant shutdown.

The AMSAC systems for Comanche Peak provide for periodic testing through a series of overlapping tests. These tests are performed with the AMSAC outputs bypassed as described in the " Maintenance Bypasses" section.

Once the system bypass is established, a series of overlapping tests are performed to verify analog channel accuracy, setpoint (bi-stable trip) accuracy, coincidence logic operation including operation and accuracy of all timers, and continuity through the cucput relay coils. Switches will be i provided for each output relay to allow testing of AMSAC outputs to the final actuation devices with the plant shutdown. Figure 3 is a simplified block diagram reflecting the test overlaps for the periodic on-line tests. A summary of each of the overlapping tests is provided below:

Analoa Inout Channel Testing - The field input to each analog input channel .is replaced with a variable test reference which is used to confirm accuracy of the channel gain and offset. The test referer.ce is then ramped up and down throughout a portion of the channel range to verify accuracy of the channel setpoint and associated deadband. This test confirms operation of the input channel signal conditioning circuitry, analog-to-digital converters, and the processor.

Processor Loaic Testina - The second sequence of testing verifies that each Actuation Logic Processor performs the preoer coincidence logic, including timing functions, and generates the proper outputs. In this test, the field input to each input channel for the processor under test is replaced with test references. The test references simulate the channel values as either above or below the setpoint to verify combinations of coincidence logic to perform the generation of the proper processor outputs to the majority voting modules. This test confirms operation of the input channel signal conditioning circuitry, analog-to-digital converters, processor operation and output circuitry to the majority voters.

Ma.iority Voter and Output Relav Tests - Each majority voting module and associated output relays are tested to verify operation of the majority vote (2 out of 3) and that continuity exists for each of the output relay coils. Integrity of the relay coils along with associated wiring is verified by exercising the voting logic.

Attachment to TXX-6769

. October 9, 1987 Page 6 of 13 Completion of Mitigative Action The AMSAC output contacts automatically reset through processor logic and can not be manually reset'at the AMSAC cabinet. These contacts are connected in parallel or series with the existing actuation contacts in the plant control circuits. These control circuits have seal in/ latching and manual reset features.

AMSAC output contacts, once actuated, will complete the mitigative action as discussed below:

Turbine Trip - The AMSAC output contact on momentary closure energizes the turbine trip solenoid valve. This releases valve hydraulic fluid pressure which results in closing of the main stop valves. Return to normal operation is accomplished by the operator.  !

Motor Driven Aux. Feedwater Pumps - The AMSAC output contact on momentary l Bosure energizes the DC closliig coil to close the motor driven auxiliary feedwater pum) breaker. The breaker remains closed until a trip signal occurs. The areaker closure starts the auxiliary feedwater pump. Return to normal operation is accomplished by the operator.

Turbine Driven de-energizes theAux. Feedwater solenoid Pump'the isolation valve.-On

~to open The AMSAC opening output contac of the valve, the valve limit switch contact in the control circuit opens to keep the solenoid de-energized. Return to normal operation is accomplished by the operator.

Steam Generator Blowdown and Sampling Isolation Valves - The AMSAC output contact, on opening, de-energizes the solenoid to close the valve. On closing of the valve, the valve limit switch contact in the control circuit opens to keep the solenoid de-energized. Operator action is required for opening the valve.

Technical Specifications The WOG is on record (cf. 0G-171, dated February 10,1986) that Technical Specifications for AMSAC are unnecessary. As of May 30, 1987, the NRC has not responded to the WOG letter.

TV Electric feels that Technical Specifications for AMSAC do not enhance the overall safety of the nuclear plant and constitute a backfit. TV Electric also believes that normal nuclear administrative controls are sufficient to control AMSAC.

j

~

LA'tachment'to t TXX-6769-

-. " October 9, 1987 Page 7 of-13 APPENDIX A - AMSAC ISOLATION DEVICE

- Electrical . independence. of AMSAC- from the existing Reactor Protection System

-(RPS) is provided .through several means at Comanche Peak. A block diagram

-. showing the rela _tionship of AMSAC to the existing RPS is provided in Figure 4 which details the AMSAC/RPS connections and points of isolation.

The steam generator narrow range level inputs.to AMSAC will be derived from existing signal loops within the process protection cabinets. These signals are provided from differential pressure transmitters to the process protection

-cabinet'and from the protection cabinet to the AMSAC cabinet. Additional isolator cards will be added in the process protection cabinets to provide isolated . signals to AMSAC.-

'TU Electric has elected to utilize the existing pressure transmitters for 1 measuring turbine load at the first stage. As with the narrow range steam generator level inputs, the isolated signals for turbine load will be provided from the process protection cabinets to the AMSAC cabinet.

Isolation is.provided in the process protection cabinet for the signals used as input for AMSAC. As reported in WCAP-8892A, Westinghouse 7300 Series Process: Control System' Noise. Tests, these isolation devices which are powered 1

.from a class'1E source, have been tested to demonstrate that the device is acceptable for its application. The purpose of the tests was to determine whether protection circuitry could be disturbed to the extent that protective action would be prevented by the pick-up or presence of credible interference on control wiring in close proximity to protection wiring within the process control racks. Isolation devices are used in the Process Control System 7300 Series equipment to electrically isolate the protection. circuits inside the  ;

process control racks from control circuits outside the cabinets. The system  !

was subjected to tests that included magnetic noise test, output cable voltage  !

faults (maximum credible voltages: 550 VAC, 250 VDC), cross talk, random noise test, etc... The acceptance criteria for these tests were a) the postulated fault should not prevent required protective action, and b) spurious protective action caused by the postulated fault should be acceptable.

As mentioned, the subject of interferences that could negate protective  ;

actions was covered in various tests carried out for the WCAP (Westinghouse 7300 Series Process Control System Noise Tests). This report includes a l, series of tests that were performed before any faults or circuitry abnormalities were applied. These tests demonstrated that a credible disturbance in the control wiring would not degrade protective action or be

)

reflected back into the protection wiring. Any of these interferences (i.e., 1 noise, crosstalk. etc.) that would be generated by AMSAC falls under the same category as those tested in the test report. Since AMSAC is separate from the RPS.and the cable is not routed in an area that exceeds the 550 VAC 250 VDC test limits, any interference from AMSAC would not affect the RPS.

I. I L l l

l

i

. Attachment to TXX-6769 October 9, 1987 Page 8 of 13 Under all test conditions the protection circuitry operated as intended. The test showed conclusively that electrical interference imposed onto the isolator output wiring (control wiring) does not affect proper operation of the perturbed channel nor any adjacent channels. The recordings verify that the interference imposed onto the control wiring was not induced into the protection wiring. The magnitude of the electrical interference introduced into the system and the stringent test procedures far exceeded any conditions that would be present in actual plant operations. l Relays are provided at the output of AMSAC for isolating the non-class 1E l AMSAC circuits from the class 1E final actuator circuits. At Comanche Peak, the AMSAC outputs are provided from separate relay panels within the AMSAC cabinet. Separation of the Train A and B circuits within the AMSAC cabinet is achieved through a combination of metal barriers, conduit and distance. These relays will be tested with the maximum credible faults applied to the relay coil in the transverse mode. Tests will be performed with the relay coil operating contact in both the open and closed position. Figure 5 depicts the simplified diagram of this output isolation circuit, and point of application for the maximum credible faults. Details of the actual tests, fault levels and their origin, test data, and the pass / fail acceptance criteria will be submitted upon completion of the test.

For Comanche Peak, the isolation devices comply with the environmental qualifications (10CFR50.49) and with the seismic qualifications which were the basis for plant licensing.

The class '1E loads operated by the isolation relay contacts are powered from a class 1E source. The plant specific details of the wiring configuration can be found on the TU Electric elementary drawing.

WkKEY MaMe E A8% Y * ~

2E* C ea a

ccn r a _

Fc

~ aAa

_ eRE e

mooE c D a oM-In A s

. To O e L

E . -

N t

e t 2 R n /

U i 2

f i

T H _ h (i _

G t _

H t m.

_ C I

_ D G O

N L O

z A 4 N -

- ES O m E LE I

o C T c.

a NwPN I

FML I A U

BA A R C T

SN A

_. UE T T W C L _ A GO A E PT SW I I I

/D S M

V 3 RN A E TI ETOL L p  :

o A. B 1 R o t

t O O E T S R U

A _

I G

R I F

E N

E C a 4 f i 2 M

e o

n n / i

/ f

/ V A o i 3 i 2

E T

t h

S W _ N O

L i cOo eye W

O L

- p o

e t

@ san La oEo oDo C

oMv T

. Attachment to TXX-6769-September 25,'1987 TWBhI PRESSWE

'"' Page 10 of 13 TRANSIGDt5 &

"80 N M FRoM UNINTERRUPTIBLE POWER SUPPLY I 1 I l I DISTRi BUTION . PANEL..

9 o -p meetsS moram ceauas .

ISOMDON

, NON-lE NON-lE

\

, a n 0

.I' AVSAC E_EC~RON CS CA3 \ E"  :  !

I F t PLANT COMPUTER MAIN CONTROL BOARD

- AWSAC ACTUATED - AMSAC ACTUATED '

- AW9C TROUBLE TURBlNE TRIP ( ANN.)

-S/G l. 2,3 4 4 LEVEL LOW - M9C TROUBLE. ( ANN ) q

- CN.1&2 TURBINE PRESSURE LOW - MMC BLOCKED J TURBINE < 40% POWER I C-20 ( STATUS L(GHT) j 1

lE lE l t

I I U t t U  !

- START 5 TIWW - TRPS TURBNE - STARTS WW swtAR 70 TRm A

- 0.0SC5 STW. BLOWDOWN LNES

- CLDSCS STW., BLOWDOWN SWPLIS UNES FIGURE 2 : RPS-AMSAC BLOCK DIAGRAM

,- e e r2 1h Page 11 of 13 i

Z o

@-11-sj-fj-g:p_4hO-[3 71 a.

- 3 O G

• g>_ O I*

1. 5ghl*

0 3E -

p

@ M W -

H !

f g_I-  : .

m Z

"i 8

Z O

I. ,8 4

a

Attachnent to TXX-6769 Septembe '25, 1987 l Page'12 of 13 sarm RaAtto TURBINE IMPULSE PRESSURE TRANSMITTERS ,

naD SDGORS i S/G N.R. LEVEL TRANSMITTERS

_g...@_ - 1 P P ISOL PROCESS rnoctss COWOL PROTECTON s CANG CABINETS '

i Y

f ama w-g 0@m LOGIC U 7

O O I e I

( t SSPS .

$$ps TMNA TRAN B e p l RIACTOR RIACTOR TRIP TRP o y y p ANAL ACTUATION AR ACTUATION 5 OfMCES DEVICES TMNA TMN B -

4 Fl&ljRE 4 : RPS - AMSAt/ if P5 BL0tK DIA& RAM 1

I L

l I i Ci___. _ _ _ . _ . . _ _ . _ .

.w..

Attachment to TXX-6769 September 25, 1987 Page 13 of 13 1ll 1ll J 4 / k J4 J 4 N ,

A I E

I lQ U

A*

ll'(. -llli ,

/

!s! l

_ _ _ _