U-600279, Forwards Response to 10CFR50.62 Requirements Re Reduction of ATWS Events for Light Water Cooled Nuclear Power Plants. Installation of ATWS Sys Complete.Tech Spec 3/4.1.5, Standby Liquid Control Sys, Will Be Revised

Forwards Response to 10CFR50.62 Requirements Re Reduction of ATWS Events for Light Water Cooled Nuclear Power Plants. Installation of ATWS Sys Complete.Tech Spec 3/4.1.5, Standby Liquid Control Sys, Will Be Revised

ML20133J669
Person / Time
Site:	Clinton
Issue date:	10/16/1985
From:	Spangenberg F ILLINOIS POWER CO.
To:	Butler W Office of Nuclear Reactor Regulation
References
U-600279, NUDOCS 8510210028
Download: ML20133J669 (9)

Text

g U-600279 LO8-85 (10 - 1G-L 1A.120 ILLINDIS POWER COMPANY -

October 16, 1985 Docket No. 50-461 Director of Nuclear Reactor Regulation Attn: Mr. W. R. Butler, Chief Licensing Branch No. 2 Division of Licensing U. S. Nuclear Regulatory Commission Washington, DC 20553

Subject:

Clinton Power Station Requirements for Reduction of Risk of Anticipated Transients With.sut Scram (ATWS) Events for Light-Water-Cooled Nuclear Power Plants (10CFR50.62)

This letter is Illinois Power's (IP) reply to 10CFR50.62(d) which requires each license o submit a schedule for meeting the requirements of paragraphs (c)(1) through (c)(5) of 10CFR50.62. Paragraphs (c)(1) and (c)(2) are only applicable to pressurized water reactors and not te the design of Clinton Power Station (CPS). The design of the CPS ATWS systems is complete and satisfies the requirements of paragraphs (c)(3) through (c)(5) . Installation of the ATWS systems has also been completed. Clinton Power Station Technical Specification 3/4.1.5

" Standby Liquid Control System" will be revised prior to fuel load to accommodate the 86 gallons per minute flow equivalency requirement.

Illinois Power's position is that no additional Technical Specification changes are required to implement the ATWS Rule. This is consistent with the position presented to the NRC by the BWR Owner's Group.

~

Listed in the attachment to this letter are the requirements of 10CFR50.62 paragraphs (c)(3) through (c)(5) and the CPS method of implementation. The guidance regarding system and equipment specifications published on June 26, 1984, in the Federal Register is also addressed.

Sincerely yours, F. A. ang berg g 102{O POR 9 % ha [ Manager - Licensing and Safety A

SMK/kaf Attachment cc: B. L. Siegel, NRC Clinton Licensing Project Manager NRC Resident Office Illinois Department of Nuclear Safety g Regional Administrator, Region III, USNRC 7 4

. Attachm:nt to Letter U-600279 C,PS Implementation of 10CFR50.62 Requirements REQUIREMENT - 10CFR50.62 (c)(3)

Each boiling water reactor must have an alternate rod injection (ARI) system that is diverse (from the reactor trip system) from sensor output to the final actuation device. The ARI system must have redundant scram air header exhaust valves. The ARI must be designed to perform its function in a reliable manner and be independent (from the existing reactor trip system) from sensor output to the final actuation device.

REQUIREMENT - 10CFR50.62 (c)(5)

Each boiling water reactor must have equipment to trip the reactor coolant recirculating pumps automatically under conditions indicative of  ;

an ATWS. This equipment must be designed to perform its function in a reliable manner.

CPS IMPLEMENTATION A non-safety related ARI System and ATWS Reactor Pump Trip (RPT)

System are provided to mitigate the potential consequences of an ATWS

.l event. These systems currently satisfy the requirements of paragraphs (c)(3) and (c)(5). Specific system and equipment specifications are discussed below.

Conformance to IEEE 279 " Criteria for Protection Systems for Nuclear Power Generating Stations" -

The RPT and ARI systems do not conform to the guidance of IEEE 279.

This is consistent with the requirements of 10CFR50.62.

Redundancy and Diversity -

The equipment used in the ARI and RPT systems are independent and diverse from the Reactor Protection System (RPS) equipment, where possible. The ARI system functions independently of the RPS by providing an alternate means of venting the scram air headers by opening the redundant scram valves. The ARI function is initiated manually, or I automatically by either Reactor Pressure Vessel (RPV) high pressure or RPV low water level. A two-out-of-two logic system for the diverse trip

- signal is used. The RPT system functions independently of the nuclear safety-related RPS system by providing an alternate means of tripping the recirculation pump motors and the low frequency motor / generator (LFMG) setc. A two-out-of-two logic system for the diverse trip signal i

is used. The trip logic for the system is initiated by either RPV high pressure or RPV low water level. The trip logic activates the trip coils in the recirculation pump and the LFMG set motor circuit breakers.

Once the trip logic is automatically initiated, the circuit breakers are manually reset through the normal breaker controls.

Four locally mounted (outside primary containment), non-safety related, non-indicating pressure transmitters measure reactor pressure for the ARI and RPT functions at four (reactor vessel quadrant) physically separated locations, similar to those used for RPS. These trarsmitters sense pressure from the same sensing lines used for the RPS. Cables from thase transmitters are routed to the ATWS panels.

Each pressure transmitter provides a signal to a trip module in its instrument channel (two channels per ATWS system). High reactor l

l

! I r

. - _ _ . . . - _ _ _-_ - -- , __ __ _m , -

Attachm:nt to L2tter U-600279 pressure initiates a trip signal in that channel. Both pressure trip inputs in either system must be initiated to cause ARI and RPT.

Four locally mounted (outside primary containment), non-safety related, non-indicating level (differential pressure) transmitters measure reactor water level for the ARI and RPT functions at four (reactor vessel quadrant) physically separated locations, similar to those used for RPS. These transmitters sense pressure from the same sensing lines used for the RPS. Cables from these transmitters are routed to the ATWS panels. Each level transmitter provides a signal to a trip module in its instrument channel (two channels per ATWS system).

Low reactor water level initiates a trip signal in that channel.

The ARI function is also capable of being manually initiated from the main control room by pushbutton switches. Both pushbutton switches for either channel must be armed by rotating the collar and depressed before the manual ARI function will be initiated for that channel.

" Electrical Independence -

Two separate and independent non-safety related 125VDC power

~

sources are provided tur the transmitters, control logic and solenoid coils. These power supplies are 20 minute time duration batteries

separate from the RPS.

• Physical Separation -

The ARI and RPT systems electrical components and wiring (transmitters, cabling, switches, and logic circuitry) assigned to each di. vision are separated from the other division's components and wiring by six inches or a metallic barrier. AR1 and RPT systems electrical components and wiring are separated from RPS components and wiring by six inches or a metallic barrier.

• Environmental and Seismic Qualifications -

The ARI and RPT systems equipment are qualified to meet the normal and abnormal environmental conditions. The equipment is not seismically qualified.

• Quality Assurance -

The ARI and RPT systems are classified as non-safety related.

Current design, procedures and/or practices are considered adequate for the testing, surveillance, and maintenance of these systems. Specific NRC requirements for non-safety related quality assurance for the ARI and RPT systems will be addressed by IP following the issuance of guidance from the Staff in addition to that provided in Generic Letter 85-06 " Quality Assurance Guidance for ATWS Equipment that is not Safety Related".

• Power Supply -

Two separate and independent non-safety related 125VDC power soerces are provided for the transmitters, control logic and solenoid oils. The system shall remain functional following an ATWS event including loss of off-site power and shall function to prevent the consequences of an ATWS event throughout the first 20 minutes of the event, based on the battery supply discussed under Electrical Independence.

2

Attachmsnt to Letter U-600279

• Testability -

Provisions for testing the systems control logic and valve solenoid coil continuity are provided. A test switch activates relay logic which inhibits the solenoid valve coils and the ARI and RPT activating relays from being energized. During testing, a signal is injected into the trip units for either two reactor pressure signals or two reactor water level signals to simulate a trip condition. Relay contacts that energize the solenoid valves and the activating relays are checked and then returned to normal. Indicating lights show the ARI and RPT systems are in test. Returning the systems from the test mode to normal function requires reset of both the test switch and a test circuit seal-in switch. This two-step process is provided since otherwise resetting the test switch to normal during a test would scram the reactor.

• Inadvertent Actuation -

In order to minimize the chance of inadvertent ARI or RPT -6 actuation, an unavailability goal of inadvertent actuation of 1x10 spurious actuations/ year has been established. This assumes testing of the systems on a quarterly basis. Power supply failure has not been included. This goal is consistent with the unavailability goals of safety systems and is also comparable to similar designs of ATNS mitigating equipment. The two-out-of-two logic configuration used in the CPS design meets the unavailability goal.

REQUIREMENT - 10CFR50.62 (c)(4)

Each boiling water reactor must have a standby liquid control system (SLCS) with a minimum flow capacity and boron content equivalent in control capacity to 86 gallons per minute (gpm) of 13 weight percent sodium pentaborate solution. The SLCS and its injection location must be designed to perform its function in a reliable manner. The SLCS initiation must be automatic and must be designed to perform its function in a reliable manner for plants granted a construction permit after July 26, 1984, and for plants granted a construction permit prior to July 26, 1984, that have already been designed and built to include this feature.

CPS IMPLEMENTATION Clinton Power Station has an SLCS with an 86 gpm injection capacity. The CPS Technical Specification 3/4.1.5, " Standby Liquid Control System" will be revised prior to fuel load to require a minimum of 10.0 weight percent sodium pentaborate concentration . This will satisfy the 13 weight percent equivalent requirement for a 218 inch diameter reactor vessel as described in Generic Letter 85-03

" Clarification of Equivalent Control Capacity for Standby Liquid Control Systems". The CPS SLCS is manually initiated. The operators are procedurally (CPS No. 3314.01 " Standby Liquid Control") required to start both 43 gpm standby liquid control (SLC) pumps'for SLC injection.

Specific system and equipment specifications are discussed below.

'Conformance to IEEE 279 " Criteria for Protection Systems for Nuclear l Power Generating Stations" -

The SLCS is in general conformance with IEEE 279. Specific compliance with IEEE 279 is detailed below.

3

Attachmtnt to Letter U-600279 General Functional Requirement (Paragraph 4.1) - The SLCS is manually initiated by operator action, in accordance with the CPS upgraded Symptomatic Emergency Operating Procedures, as approved by the Staff.

Sodium pentaborate injection is required if the suppression pool Boron Injection Initiation Temperature Limit is exceeded and reactor power is indeterminate or greater than 3 percent. The basis for these limits is in accordance with the Staff approved BWR Owner's Group Generic Emergency Procedures Guidelines.

Single Failure Criterion (Paragraph 4.2) - The SLCS is a backup method of manually shutting down the reactor to cold subcritical conditions by independent means other thar. the normal method by the control rod system. However, the discharge pumps and pump motors, the explosive valves, and the storage tank discharge valves are redundant so that no single failure in one of these components will cause or prevent initiation of SLCS.

Quality of Components and Modules (Paragraph 4.3) - The control components of SLCS are qualified Class 1E in accordance with IEEE 323, "IEEE Standard for Qualifying Class IE Equipment for Nuclear Power Generating Stations."

Equipment Qualification (Paragraph 4.4) - Equipment qualification is discussed under Environmental Qualification.

Channel Integrity (Paragraph 4.5) - The SLCS is not required to operate during a design basis accident. It is designed to remain functional following an SSE.

Channel Independence (Paragraph 4.6) - The SLCS is a backup method of manually shutting down the reactor to cold saberitical conditions by independent means other than the normal method by using the control rod system. It is therefore kept independent of the control rod scram system. There are two channels of control circuits for discharge pumps and motors, explosive valves and storage tank discharge valves. These two channels are independent of each other, so that failure in one channel will not prevent the other from operating.

Control and Protection Interaction (Paragraph 4.7) - The SLCS has no interaction with plant control systems. It has no function during normal plant operation and it is completely independent of control systems and other safety systems.

Derivation of System Inputs (Paragraph 4.8) - Display instrumentations in the main control room provide the operator with information on suppression pool water temperature, neutron flux level and control rod position. Based on this information, the operator can manually initiate SLCS, as required by CPS Emergency Operating Procedure 4404.01,

" Reactivity Control - Emergency."

Capability of Sensor Checks (Paragraph 4.9) - The explosive valve control circuits continuity is continuously monitored and is indicated in the main control room.

4

Attachm:nt to Letter U-600279 Capability for Test and Calibration (Paragraph 4.10) - The explosive valves may be tested during plant shutdown. The explosive valve control circuits are continuously monitored and indicated in the main control room. The remainder of the SLCS may be tested during normal plant operation to verify each element, passive or active, is capable of performing its intended function. In the test mode, demineralized water instead of sodium pentaborate solution is circulated from, and back to, the SLCS test tank.

Channel Bypass or Removal from operation (Paragraph 4.11) - The discharge pumps and pump motors are redundant, so that one pump may be removed from service during normal plant operation.

Operating Bypass (Paragraph 4.12) - The SLCS han no function during normal plant operation.

Indication of Bypass (Paragraph 4.13) - Removal of components from service is manually indicated in the main control room.

Access to Means for Bypass (Paragraph 4.14) - Removal of components from service during normal plant operation is under administrative control.

Multiple Set Points (Paragraph 4.15) - The actual injection operation of SLCS is not dependent on, or affected by, set points, because the system is manually initiated.

Completion of Protective Action Once it is Initiated (Paragraph 4.16) -

The explosive valves remain open once fired, and once initiated the injection valves will not close and discharge pump motors will not stop running unless terminated by operator action.

Manual Initiation (Paragraph 4.17) - The SLCS may only be manually initiated.

Access to Set Point Adjustments Calibration and Test Points (Paragraph 4.18) - The actual injection cperation of SLCS is not dependent on or affected by any set point adjustment or calibration, because the system is manually initiated. The control circuits, discharge pumps, pump motors, and motor-operated valves are accessible for test and service.

Setpoint adjustment for the sodium pentaborate solution temperature and level are inside the containment or within the main control room and are under administrative control.

Identification of Protective Actions (Paragraph 4.19) - The following ,

items are located in the main control room for operator information:

Analog Indication 1

(1) Storage tank level (2) System pressures (3) Explosive valve continuity 5

Attachm:nt to Letter U-600279 Indicating Lamps (1) Pump status and automatic trip (2) Explosive valve continuity (3) Position of injection line manual service valve in SLC sparger line (4) Position of storage tank outlet valve (5) Position of test tank discharge manual service valve Annunciators and Status Lights The standby liquid control system main control room annunciators and status lights indicate:

(1) Manual or automatic out of service condition of SLC system "A" and/or "B" due to:

a. Operation of manual out-of-service switch,

b. The loss of continuity of any explosive valve primers.

c. Storage tank outlet valve in test / status,

d. Overload trip or power loss in pump or storage tank outlet valve controls.

(2) Standby liquid storage tank high or low temperature (3) Standby liquid tank high or low level (4) Standby liquid pump "A" or "B" auto trip.

Instrument indications for the following are mounted locally at the equipment for operator utilization:

Analog Indication (1) Storage tank level (2) System pressures (3) Storage tank temperature Indicating Lamps (1) Pump status (2) Storage tank operating heater status (3) Storage tank mixing heater status Information Readout (Paragraph 4.20) - The discharge pressure of sodium pentaborate pumps is indicated in the main control room. Also, storage tank level is indicated in the main control room.

• System Repair (Paragraph 4.21) - The control circuits, pumps and pump motors may be repaired or replaced during normal plant operation. This is possible because of the redundant electrical control train provided.

Identification (Paragraph 4.22) - All controls and instrumentation located in main control room panels are clearly identified by nameplates.

• Redundancy and Diversity -

The SLCS is functionally redundant to the control rod drive system in achieving and maintaining the reactor suberitical. Therefore, the SLCS as a system by itself is not required to be redundant, although the active components and control channels are redundant for serviceability.

Diversity of initiating circuits is not employed for the SLCS design.

The SLCS provides, however, a diverse means for reactivity control.

6

Attachment to Letter U-600279

• Electrical Independence and Physical Separation -

The SLCS is separated both physically and electrically from the control rod drive system. The SLC system electrical control channels are separated in accordance with the requirements of Regulatory Guide 1.75, Revision 2 - Physical Independence of Electrical Systems.

• Environmental Qualification -

No components of SLCS are required to operate in the drywell environment. A maintenance valve and isolation check valve are the only components located inside the drywell and the maintenance valve is normally locked open. Other SLCS equipment is located outside the drywell and is capable of operation following a safe shutdown earthquake (SSE). The controlo essential for the injection of SLCS are qualified Class 1E. Specific conformance to the requirements of IEEE 323 " General Guide for Qualifying Class 1 Electric Equipment for Nuclect Power Generator Statien=" is met by the development of written procedures and responsibilities for the dcsign of all Class IE electric equipment.

This includes preparation of specifications, qualification procedures, and documentation. Standards manuals are maintained containing specification, practices, and procedures for implementing qualification requirements, and an auditable file of qualification documents is available for review.

"Scismic Qualification -

The standby liquid control process equipment, instrumentation, and controls essential for injection of the neutron absorber solution into the reactor are designed to withstand Seismic Category I carthquakn loads. Non-direct process equipment, instrumentation, and controls of the system are not required to meet Seismic Category I requirements, however, the local and main control room mounted equipment is located in seismically qualified panels.

' Quality Assurance -

The SLCS is in compliance with the Illinois Power Quality Assurance Program. The Quality Assurance Program for design and construction of CPS is described in the Illinois Power Nuclear Power Construction Quality Assurance Manual. The Quality Assurance Program during the operational phase of CPS is described in the Illinois Power Nuclear Power Operational Quality Assurance Manual.

' Power Supply -

The power supply to one explosive-operated injection valve, storage tank outlet valve, and injection pump and control circuit is powered from Division 1, 480 VAC. The supply to the other explosive-operated injection valve, storage outlet valve, and injection pump and control circuit is powered from Division 2, 480 VAC. The power supply to the tank heaters and heater controls is provided from a reliable AC source.

The ,$ower supply to the main control room benchboard indicator lights and the level and pressure sensors is powered from an emergency instrument bus.

7

Attachm2nt to Letter U-600279

' Testability -

Testability is in conformance with Regulatory Guide 1.22, Revision 0 - Periodic Testing of Protection System Actuation Functions.

The SLCS is capable of testing initiation to actuated devices, except the explosive valves, during normal operation. In the test mode, demineralized water is circulated in the SLCS loops rather than sodium pentaborate. The explosive valves may be tested when the plaat is shut down. Otherwise, continuity in the explosive valve initiation circuits is continuously monitored during plant operation.

• Inadvertent Actuation -

The standby liquid control is manually initiated in the main control room by turning a key-lock switch for System A, or a different key-lock switch for System B to the RUN position. The switch slip contacts remain in the activated position, but the mechanisms spring returns to the center (NORMAL) position from which the key may be removed. This design minimizes the frequency of inadvertent actuation by placing system initiation under sdministrative control.

8

_ _ . _ . _