ML17244A374: Difference between revisions

From kanterella
Jump to navigation Jump to search
(Created page by program invented by StriderTol)
(Created page by program invented by StriderTol)
 
(2 intermediate revisions by the same user not shown)
Line 3: Line 3:
| issue date = 02/16/1979
| issue date = 02/16/1979
| title = Forwards Review of Safety Actuation Circuits W/Manual Override.Reset Operation Does Not Prevent Equipment from Operating,Which Is Necessary to Mitigate a Postulated Accident
| title = Forwards Review of Safety Actuation Circuits W/Manual Override.Reset Operation Does Not Prevent Equipment from Operating,Which Is Necessary to Mitigate a Postulated Accident
| author name = WHITE L D
| author name = White L
| author affiliation = ROCHESTER GAS & ELECTRIC CORP.
| author affiliation = ROCHESTER GAS & ELECTRIC CORP.
| addressee name = ZIEMANN D L
| addressee name = Ziemann D
| addressee affiliation = NRC OFFICE OF NUCLEAR REACTOR REGULATION (NRR)
| addressee affiliation = NRC OFFICE OF NUCLEAR REACTOR REGULATION (NRR)
| docket = 05000244
| docket = 05000244
Line 17: Line 17:


=Text=
=Text=
{{#Wiki_filter:NOTES.tBEGULAT(g INFORMATION DISTBIBUTIONyYSTEM (RIDE>ACCESSION NBR-7902210226 DOC.DATEi 79/02/16NOTARIZED~
{{#Wiki_filter:BEGULAT(g INFORMATION DISTBIBUTIONyYSTEM (RIDE>
NODOCKET0FACILt50-244 RobertEmmetGinnaNuclear.PowerPlant,UnitI,Roches05000244AUTH.NAMEAUTHORAFFILIATION WHITE,L.D.
ACCESSION NBR-7902210226               DOC.DATEi 79/02/16        NOTARIZED~ NO          DOCKET 0 FACILt50-244 Robert Emmet Ginna Nuclear .Power Plant, Unit I,Roches                    05000244 AUTH. NAME              AUTHOR AFFILIATION WHITE,L.D.               Rochester Gas 8, Electric Corp.
Rochester Gas8,ElectricCorp.RECIP.NAME RECIPIENT AFFILIATION ZIEMANN,.D.L.
RECIP.NAME               RECIPIENT AFFILIATION ZIEMANN,.D.L.               ,
,Operating Rector+Branch2SUBJECTSForwardsreviewofsafetyactuation..circuits w/manualoverride.
Operating Rector+ Branch 2 SUBJECTS    Forwards review of safety actuation..circuits w/manual override. Concludes reset operation does not prevent equipment from .operating .whi'ch is necessary to nitigate a  postulated accident.
Concludes resetoperation doesnotpreventequipment from.operating
                                                                              ~ SIZE<~
.whi'chisnecessary tonitigateapostulated accident.
e DISTBIBUTI(>N CODEF AOOI S          COPIES RECEIVED(LTR       M  ENCL TITLE(     GENERAL DISTRIBUTION FOB AFTER ISSUANCE OF OPERATING          LIC ~
eDISTBIBUTI(>N CODEFAOOISCOPIESRECEIVED(LTR MENCL~SIZE<~TITLE(GENERALDISTRIBUTION FOBAFTERISSUANCEOFOPERATING LIC~((-~ll~~a<o45RFCIPIENTIDCODE/NAME ACTION-05BCA@6+~INTERNAL-t 03.EGFILE1.215KORE,PERF BR.I7ENGRBR019PLANT.SYSBR21EFLTTRT.SYSEXTERNAL.i 03LPDR23ACRSCOPIESLTTRENCL77.II22.I.I,I~1II.I,II1616RECAPIENTID'ODE/NAME 02NRCPDRI'((ITA/ED()16AD5YS/PROJ18REACSFTYBR20EEB22BRINKMAN04NSICCOPIESLTTRENCL.III.III.II.II.II.II~((UfgQt6Ad~sgagric~TOTALNUMBER.OFCOPIESREQUIRED'TTR 38ENCL38 IE1IIr,rr  
NOTES.t  (     (-~ll ~~a               <o          45 RFC I P I ENT          COPIES            RECAP I ENT        COPIES ID CODE/NAME             LTTR ENCL      ID'ODE/NAME          LTTR ENCL ACTION -   05 BC A@6+         ~           7      7 I NTERNAL-t 03. EG    FILE            .I     I  02 NRC PDR                .I     I 1.2                          2    2  I'((I  TA/ED()             I    .I 15 KORE,PERF          BR      .I    .I  16    A D 5 YS/P RO J      I    I
~Pr~*February16,1979DirectorofNuclearReactorRegulation Attention:
              .I7  ENGR BR                      ,I  18 REAC SFTY BR            .I    I 0              19 PLANT .S YS BR 21 EFLT TRT .SYS
Mr.DennisL.Ziemann,ChiefOperating ReactorBranchNo.2U.S.NuclearRegulatory Commission Washington, D.C.20555
                                            ~ 1    I  20 EEB                    .I    I I    .I  22 BRINKMAN                .I    I EXTERNAL.i 03 LPDR                        ,I      I  04 NS IC                  .I    I 23 ACRS                      16    16
                      ~((U  fgQ  t 6  Ad~s g agric~
TOTAL NUMBER. OF COPIES REQUIRED'TTR               38      ENCL    38
 
I E
1 I
Ir, rr
 
  ~ P r
            ~
* February 16, 1979 Director of Nuclear Reactor Regulation Attention: Mr. Dennis L. Ziemann, Chief Operating Reactor Branch No. 2 U.S. Nuclear Regulatory Commission Washington, D.C.       20555


==Subject:==
==Subject:==
ReviewofSafetyActuation CircuitswithOverrides R.E.GinnaNuclearPowerPlantDocketNo.50-244
Review of Safety Actuation Circuits  with Overrides R.E. Ginna Nuclear Power Plant Docket No. 50-244
 
==Dear Mr. Ziemann:==
 
4 Your letter dated November 29, 1978 requested restrictions be placed on containment purging during normal operation and that a  review of    all safety actuation signal circuits which incorporate manual    override features be made. The Rochester Gas and Electric Corporation (RGB) letter dated January 2, 1979 transmitted the RG6E commitments on purging during normal operation and stated that the required review of override features would be completed by mid February 1979. The purpose of this letter is to transmit the results of that review. Details of the review are presented in  Appendix A.
The review of all safety actuation signal circuits which incorporate a manual override feature indicates that actuating a particular override (reset) does not cause the bypass of other safety actuation signals. The reset switches described in Appendix A are push button switches located on the control board with no physical restraints.
In all cases where the safety actuation signal is generated automatically and the reset switch is actuated, the safety actu-ation signal will be inhibited until all logic paths for auto-matically generating the safety actuation signal have opened.
Once all logic paths open, the particular safety actuation signal reset relays de-energize and re-establish the ability to auto-matically generate the safety actuation signal. Since the reset remains actuated only      if the input signals causing the automatic safety actuation signal persist and these input signals are annunciated, no separate annunciation for the reset actuation is necessary.      The operator has sufficient information to deduce a certain system is in the reset mode.                                p0
                                                                              ~
v80zzaoww4                  e,'g~(g',
 
ROCHFST=R GwS AiVO L= CTR)C CORP.                                  ryEET,VO February 16, 1979 Tc    Mr. D.L. Ziemann, Chief does actuation of a particular reset switch 1
Zn no case prevent the operator from manually operating the equipment from the control board. Therefore, operation of a reset does not prevent equipment from operating which is necessary to mitigate the consequences of a postulated accident.
Very truly yours,
                                        ~~+
L. D. White, Jr.
LDW:np Attachment
 
Appendix A Review  of Safety Actuation Signal Circuits Incorporating manual Overrides The  following summaxizes the results of a review of safety actu-ation signal circuits which incorporate a manual override feature.
The purpose of the review is to ensure that overriding of one safety actuation signal does not also cause the bypass of any other safety actuation signals:
SAFETY INJECTION CIRCUIT:
This circuit has a reset switch which gives the operator the means of resetting safety injection one- minute or longer after initiation. Actuation of the reset. swatch in itself does not change the state of any equipment, but permits the operator to place the equipment affected by safety injection to the position desired.
If safety in]ection is caused by automatic actuation, and the reset switch is actuated, automatic safety ingection will be inhibited until all logic paths for automatic safety injection have opened. Once all logic paths open, the safety injection reset relays de-energize and re-establishes automatic safety injection capabilities.
Manual safety injection initiation is available at all times.
There is no annunciation of the safety xngection circuit being in the reset mode.
The purpose of the reset switch on the safety injection system is to allow equipment to be realigned for the recirculation phase of a postulated LOCA.
: 2. CONTAINMENT VENTILATION ISOLATION CIRCUIT:
This circuit has a reset switch which gives the opexator the means of resetting containment ventilation isolation.
Once the reset switch has been actuated, most 'of tne equipment. will automatically return to the state selected prior to the isolation signal.
If  containment ventilation isolation was caused automatically, either by safety injection or high radiation alarm on containment gas and/or particulate monitors, and this condition continues to exist: after the xeset switch has been actuated, then containment ventilation isolation cannot be achieved automatically or by the manual isolation switches until th'is logic clears. Once the automatic logic clears, the containment ventilation isolation reset relays de-energize and re-establishes automatic or manual isolation capabilities.
 
Manual operation    of the valves from the control board is available at all times.
There is no annunciation of the automatic containment ventilation isolation system being in the reset mode.
IJ The purpose of the reset switch on the containment venti-lation isolation system is to allow purging of containment in order to limit potential hydrogen concentration buildup following a postulated LOCA when high containment activity and safety injection signals could be present.
: 3. CONTAINMENT ISOLATION CIRCUIT:
This circuit has a reset switch which gives the operator the means of resetting containment .isolation. Once the reset switch has been actuated, some equipment will return
  ,automatically to the position selected prior to the iso-lation signal.
If    containment isolation was caused automatically by an automatic safety injection signal, and containment iso-lation reset switch is actuated without resetting safety injection, containment isolation cannot be obtained injec-by the manual containment isolation    switches until safety tion is reset.
Actuation of the reset permits the operator to place the valves affected by the containment isolation signal in the position~desired. This capability is necessary so that the operator has flexibility in dealing with post accident conditions within containment.
There is no annunciat'ion of the automatic containment isolation being in the reset mode.
: 4. CONTAINMENT SPRAY CIRCUIT:
This circuit has a reset switch which gives the operator the means of resetting containment spray. Once the reset switch has been actuated the spray additive tank discharge valves will return automatically to the position called for by the controller prior to the containment spray signal. The containment spray pumps and their discharge valves would require operator action to change state.
If    containment spray was caused automatically by the high containment pressure logic, and this logic continues to exist after reset, containment spray cannot be initiated by the manual spray switches. Once the high pressure logic has cleared, the containment spray reset relays de-energize and re-establishes automatic or manual contain-ment spray capabilities.


==DearMr.Ziemann:==
Actuation of the reset permits the operator to place the valves and pumps affected by the containment spray signal in the state desired. This capability is necessary so that the operator has flexibility in dealing with post accident conditions within containment.
4YourletterdatedNovember29,1978requested restrictions beplacedoncontainment purgingduringnormaloperation andthatareviewofallsafetyactuation signalcircuitswhichincorporate manualoverridefeaturesbemade.TheRochester GasandElectricCorporation (RGB)letterdatedJanuary2,1979transmitted theRG6Ecommitments onpurgingduringnormaloperation andstatedthattherequiredreviewofoverridefeatureswouldbecompleted bymidFebruary1979.Thepurposeofthisletteristotransmittheresultsofthatreview.Detailsofthereviewarepresented inAppendixA.Thereviewofallsafetyactuation signalcircuitswhichincorporate amanualoverridefeatureindicates thatactuating aparticular override(reset)doesnotcausethebypassofothersafetyactuation signals.Theresetswitchesdescribed inAppendixAarepushbuttonswitcheslocatedonthecontrolboardwithnophysicalrestraints.
There is no annunciation of the automatic containment spray system being in the reset mode.
Inallcaseswherethesafetyactuation signalisgenerated automatically andtheresetswitchisactuated, thesafetyactu-ationsignalwillbeinhibited untilalllogicpathsforauto-matically generating thesafetyactuation signalhaveopened.Oncealllogicpathsopen,theparticular safetyactuation signalresetrelaysde-energize andre-establish theabilitytoauto-matically generatethesafetyactuation signal.Sincetheresetremainsactuatedonlyiftheinputsignalscausingtheautomatic safetyactuation signalpersistandtheseinputsignalsareannunciated, noseparateannunciation fortheresetactuation isnecessary.
: 5. FEEDNATER ISOLATION RESET:
Theoperatorhassufficient information todeducea~certainsystemisintheresetmode.p0v80zzaoww4 e,'g~(g',
This circuit has a reset switch which gives the operator the means of resetting the isolation signal to the feed-water bypass valves only. The main feedwater valves will remain closed until the isolation logic clears, and then they automatically assume the position requested by their control circuit.
ROCHFST=R GwSAiVOL=CTR)CCORP.February16,1979TcMr.D.L.Ziemann,ChiefryEET,VO1Znnocasedoesactuation ofaparticular resetswitchpreventtheoperatorfrommanuallyoperating theequipment fromthecontrolboard.Therefore, operation ofaresetdoesnotpreventequipment fromoperating whichisnecessary tomitigatetheconsequences ofapostulated accident.
If  feedwater level logic, isolation is caused by high steam generator and  this condition still exists after the reset switch is actuated,-a safety injection sign'al would not cause an isolation to that particular feedwater bypass valve. It should be noted that a safety injection signal also causes the main feedwater pumps to be tripped, therefore, closing the feedwater bypass valves on a safety injection signal is redundant.
Verytrulyyours,~~+L.D.White,Jr.LDW:npAttachment AppendixAReviewofSafetyActuation SignalCircuitsIncorporating manualOverrides Thefollowing summaxizes theresultsofareviewofsafetyactu-ationsignalcircuitswhichincorporate amanualoverridefeature.Thepurposeofthereviewistoensurethatoverriding ofonesafetyactuation signaldoesnotalsocausethebypassofanyothersafetyactuation signals:SAFETYINJECTION CIRCUIT:Thiscircuithasaresetswitchwhichgivestheoperatorthemeansofresetting safetyinjection one-minuteorlongerafterinitiation.
There is no annunciation of the automatic feedwater iso-lation system being in the reset mode.
Actuation ofthereset.swatchinitselfdoesnotchangethestateofanyequipment, butpermitstheoperatortoplacetheequipment affectedbysafetyinjection tothepositiondesired.Ifsafetyin]ection iscausedbyautomatic actuation, andtheresetswitchisactuated, automatic safetyingection willbeinhibited untilalllogicpathsforautomatic safetyinjection haveopened.Oncealllogicpathsopen,thesafetyinjection resetrelaysde-energize andre-establishes automatic safetyinjection capabilities.
6    NUCLEAR INSTRUMENTATION SYSTEM DEFEAT ~ BYPASS        g AND BLOCK SWITCHES:
Manualsafetyinjection initiation isavailable atalltimes.Thereisnoannunciation ofthesafetyxngection circuitbeingintheresetmode.Thepurposeoftheresetswitchonthesafetyinjection systemistoallowequipment toberealigned fortherecirculation phaseofapostulated LOCA.2.CONTAINMENT VENTILATION ISOLATION CIRCUIT:Thiscircuithasaresetswitchwhichgivestheopexatorthemeansofresetting containment ventilation isolation.
  ~
Oncetheresetswitchhasbeenactuated, most'oftneequipment.
This system has several switches which are used for the following purposes:
willautomatically returntothestateselectedpriortotheisolation signal.Ifcontainment ventilation isolation wascausedautomatically, eitherbysafetyinjection orhighradiation alarmoncontainment gasand/orparticulate
(a)     Defeat Switches - Defeats a permissive which rein-states    a  trip logic.
: monitors, andthiscondition continues toexist:afterthexesetswitchhasbeenactuated, thencontainment ventilation isolation cannotbeachievedautomatically orbythemanualisolation switchesuntilth'islogicclears.Oncetheautomatic logicclears,thecontainment ventilation isolation resetrelaysde-energize andre-establishes automatic ormanualisolation capabilities.
(b)     Bypass Switches  Bypasses      a trip or runback function for calibration or maintenance purposes. Protection is still provided by redundant channel or channels.
Manualoperation ofthevalvesfromthecontrolboardisavailable atalltimes.Thereisnoannunciation oftheautomatic containment ventilation isolation systembeingintheresetmode.IJThepurposeoftheresetswitchonthecontainment venti-lationisolation systemistoallowpurgingofcontainment inordertolimitpotential hydrogenconcentration buildupfollowing apostulated LOCAwhenhighcontainment activityandsafetyinjection signalscouldbepresent.3.CONTAINMENT ISOLATION CIRCUIT:Thiscircuithasaresetswitchwhichgivestheoperatorthemeansofresetting containment
(c)     Block Switches      Blocks  trips  generated by source,
.isolation.
            .intermediate, and power range channels. These switches are actuated as permissive setpoints are reached to permit taking reactor critical and up in power. These blocks automatically reset as power is decreased below its particular setpoint.
Oncetheresetswitchhasbeenactuated, someequipment willreturn,automatically tothepositionselectedpriortotheiso-lationsignal.Ifcontainment isolation wascausedautomatically byanautomatic safetyinjection signal,andcontainment iso-lationresetswitchisactuatedwithoutresetting safetyinjection, containment isolation cannotbeobtainedbythemanualcontainment isolation switchesuntilsafetyinjec-tionisreset.Actuation oftheresetpermitstheoperatortoplacethevalvesaffectedbythecontainment isolation signalintheposition~desired.
All the above switches        if  actuated, are indicated by one or more of the following: status light, alarm on the computer, or actuate      an  annunciator.
Thiscapability isnecessary sothattheoperatorhasflexibility indealingwithpostaccidentconditions withincontainment.
: 7. INSTRUMENT AND CONTROL DEFEAT SWITCHES:
Thereisnoannunciat'ion oftheautomatic containment isolation beingintheresetmode.4.CONTAINMENT SPRAYCIRCUIT:Thiscircuithasaresetswitchwhichgivestheoperatorthemeansofresetting containment spray.Oncetheresetswitchhasbeenactuatedthesprayadditivetankdischarge valveswillreturnautomatically tothepositioncalledforbythecontroller priortothecontainment spraysignal.Thecontainment spraypumpsandtheirdischarge valveswouldrequireoperatoractiontochangestate.Ifcontainment spraywascausedautomatically bythehighcontainment pressurelogic,andthislogiccontinues toexistafterreset,containment spraycannotbeinitiated bythemanualsprayswitches.
The  following switches and their circuits were reviewed to insure that they are only performing their intended function, and no other safety functions are being bypassed. The
Oncethehighpressurelogichascleared,thecontainment sprayresetrelaysde-energize andre-establishes automatic ormanualcontain-mentspraycapabilities.
  -purpose for these switches is to be able to switch control from one sensor loop to another for testing, calibration and maintenance purposes. In all cases, reactor trip and safety injection signals are generated prior to defeat switches, and are not affected by switch position.
Actuation oftheresetpermitstheoperatortoplacethevalvesandpumpsaffectedbythecontainment spraysignalinthestatedesired.Thiscapability isnecessary sothattheoperatorhasflexibility indealingwithpostaccidentconditions withincontainment.
(a)   P/429A Pressurizer Pressure Selector Switcn  Used to select two of the four pressurizer pressure channels for controlling pressurizer heaters, sprays, and power  relief valve PCV-430.
Thereisnoannunciation oftheautomatic containment spraysystembeingintheresetmode.5.FEEDNATER ISOLATION RESET:Thiscircuithasaresetswitchwhichgivestheoperatorthemeansofresetting theisolation signaltothefeed-waterbypassvalvesonly.Themainfeedwater valveswillremaincloseduntiltheisolation logicclears,andthentheyautomatically assumethepositionrequested bytheircontrolcircuit.Iffeedwater isolation iscausedbyhighsteamgenerator levellogic,andthiscondition stillexistsaftertheresetswitchisactuated,-a safetyinjection sign'alwouldnotcauseanisolation tothatparticular feedwater bypassvalve.Itshouldbenotedthatasafetyinjection signalalsocausesthemainfeedwater pumpstobetripped,therefore, closingthefeedwater bypassvalvesonasafetyinjection signalisredundant.
(b)   L/428A Pressurizer Level Selector Switch - Vsed to sele'ct two of the three pressurizer level channels for controlling charging pump speed, letdown iso-lation, and pressurizer heaters.
Thereisnoannunciation oftheautomatic feedwater iso-lationsystembeingintheresetmode.6NUCLEARINSTRUMENTATION SYSTEMDEFEAT~BYPASSgANDBLOCKSWITCHES:
(c)   T/405E and T/405F Delta T Defeat Switches  Vsed  to defeat  a channel from the over temperature and over power turbine runback circuit, and to remove a channel Delta T signal from the input of the summer for generating the average Delta T signal or the Rod Insertion Limit Circuit.
~Thissystemhasseveralswitcheswhichareusedforthefollowing purposes:
(d)   T/401A and T/401B Tavg Defeat Switches  Used to defeat a Tavg channel from the input to the average Tavg summer which is used for full length rod control, condenser steam dump, and pressurizer level setpoint.}}
(a)DefeatSwitches-Defeatsapermissive whichrein-statesatriplogic.(b)BypassSwitches-Bypassesatriporrunbackfunctionforcalibration ormaintenance purposes.
Protection isstillprovidedbyredundant channelorchannels.
(c)BlockSwitches-Blockstripsgenerated bysource,.intermediate, andpowerrangechannels.
Theseswitchesareactuatedaspermissive setpoints arereachedtopermittakingreactorcriticalandupinpower.Theseblocksautomatically resetaspowerisdecreased belowitsparticular setpoint.
Alltheaboveswitchesifactuated, areindicated byoneormoreofthefollowing:
statuslight,alarmonthecomputer, oractuateanannunciator.
7.INSTRUMENT ANDCONTROLDEFEATSWITCHES:
Thefollowing switchesandtheircircuitswerereviewedtoinsurethattheyareonlyperforming theirintendedfunction, andnoothersafetyfunctions arebeingbypassed.
The-purposefortheseswitchesistobeabletoswitchcontrolfromonesensorlooptoanotherfortesting,calibration andmaintenance purposes.
Inallcases,reactortripandsafetyinjection signalsaregenerated priortodefeatswitches, andarenotaffectedbyswitchposition.
(a)P/429APressurizer PressureSelectorSwitcn-Usedtoselecttwoofthefourpressurizer pressurechannelsforcontrolling pressurizer heaters,sprays,andpowerreliefvalvePCV-430.(b)L/428APressurizer LevelSelectorSwitch-Vsedtosele'cttwoofthethreepressurizer levelchannelsforcontrolling chargingpumpspeed,letdowniso-lation,andpressurizer heaters.(c)T/405EandT/405FDeltaTDefeatSwitches-Vsedtodefeatachannelfromtheovertemperature andoverpowerturbinerunbackcircuit,andtoremoveachannelDeltaTsignalfromtheinputofthesummerforgenerating theaverageDeltaTsignalortheRodInsertion LimitCircuit.(d)T/401AandT/401BTavgDefeatSwitches-UsedtodefeataTavgchannelfromtheinputtotheaverageTavgsummerwhichisusedforfulllengthrodcontrol,condenser steamdump,andpressurizer levelsetpoint.}}

Latest revision as of 21:12, 29 October 2019

Forwards Review of Safety Actuation Circuits W/Manual Override.Reset Operation Does Not Prevent Equipment from Operating,Which Is Necessary to Mitigate a Postulated Accident
ML17244A374
Person / Time
Site: Ginna Constellation icon.png
Issue date: 02/16/1979
From: White L
ROCHESTER GAS & ELECTRIC CORP.
To: Ziemann D
Office of Nuclear Reactor Regulation
References
TASK-06-04, TASK-6-4, TASK-RR NUDOCS 7902210226
Download: ML17244A374 (8)


Text

BEGULAT(g INFORMATION DISTBIBUTIONyYSTEM (RIDE>

ACCESSION NBR-7902210226 DOC.DATEi 79/02/16 NOTARIZED~ NO DOCKET 0 FACILt50-244 Robert Emmet Ginna Nuclear .Power Plant, Unit I,Roches 05000244 AUTH. NAME AUTHOR AFFILIATION WHITE,L.D. Rochester Gas 8, Electric Corp.

RECIP.NAME RECIPIENT AFFILIATION ZIEMANN,.D.L. ,

Operating Rector+ Branch 2 SUBJECTS Forwards review of safety actuation..circuits w/manual override. Concludes reset operation does not prevent equipment from .operating .whi'ch is necessary to nitigate a postulated accident.

~ SIZE<~

e DISTBIBUTI(>N CODEF AOOI S COPIES RECEIVED(LTR M ENCL TITLE( GENERAL DISTRIBUTION FOB AFTER ISSUANCE OF OPERATING LIC ~

NOTES.t ( (-~ll ~~a <o 45 RFC I P I ENT COPIES RECAP I ENT COPIES ID CODE/NAME LTTR ENCL ID'ODE/NAME LTTR ENCL ACTION - 05 BC A@6+ ~ 7 7 I NTERNAL-t 03. EG FILE .I I 02 NRC PDR .I I 1.2 2 2 I'((I TA/ED() I .I 15 KORE,PERF BR .I .I 16 A D 5 YS/P RO J I I

.I7 ENGR BR ,I 18 REAC SFTY BR .I I 0 19 PLANT .S YS BR 21 EFLT TRT .SYS

~ 1 I 20 EEB .I I I .I 22 BRINKMAN .I I EXTERNAL.i 03 LPDR ,I I 04 NS IC .I I 23 ACRS 16 16

~((U fgQ t 6 Ad~s g agric~

TOTAL NUMBER. OF COPIES REQUIRED'TTR 38 ENCL 38

I E

1 I

Ir, rr

~ P r

~

  • February 16, 1979 Director of Nuclear Reactor Regulation Attention: Mr. Dennis L. Ziemann, Chief Operating Reactor Branch No. 2 U.S. Nuclear Regulatory Commission Washington, D.C. 20555

Subject:

Review of Safety Actuation Circuits with Overrides R.E. Ginna Nuclear Power Plant Docket No. 50-244

Dear Mr. Ziemann:

4 Your letter dated November 29, 1978 requested restrictions be placed on containment purging during normal operation and that a review of all safety actuation signal circuits which incorporate manual override features be made. The Rochester Gas and Electric Corporation (RGB) letter dated January 2, 1979 transmitted the RG6E commitments on purging during normal operation and stated that the required review of override features would be completed by mid February 1979. The purpose of this letter is to transmit the results of that review. Details of the review are presented in Appendix A.

The review of all safety actuation signal circuits which incorporate a manual override feature indicates that actuating a particular override (reset) does not cause the bypass of other safety actuation signals. The reset switches described in Appendix A are push button switches located on the control board with no physical restraints.

In all cases where the safety actuation signal is generated automatically and the reset switch is actuated, the safety actu-ation signal will be inhibited until all logic paths for auto-matically generating the safety actuation signal have opened.

Once all logic paths open, the particular safety actuation signal reset relays de-energize and re-establish the ability to auto-matically generate the safety actuation signal. Since the reset remains actuated only if the input signals causing the automatic safety actuation signal persist and these input signals are annunciated, no separate annunciation for the reset actuation is necessary. The operator has sufficient information to deduce a certain system is in the reset mode. p0

~

v80zzaoww4 e,'g~(g',

ROCHFST=R GwS AiVO L= CTR)C CORP. ryEET,VO February 16, 1979 Tc Mr. D.L. Ziemann, Chief does actuation of a particular reset switch 1

Zn no case prevent the operator from manually operating the equipment from the control board. Therefore, operation of a reset does not prevent equipment from operating which is necessary to mitigate the consequences of a postulated accident.

Very truly yours,

~~+

L. D. White, Jr.

LDW:np Attachment

Appendix A Review of Safety Actuation Signal Circuits Incorporating manual Overrides The following summaxizes the results of a review of safety actu-ation signal circuits which incorporate a manual override feature.

The purpose of the review is to ensure that overriding of one safety actuation signal does not also cause the bypass of any other safety actuation signals:

SAFETY INJECTION CIRCUIT:

This circuit has a reset switch which gives the operator the means of resetting safety injection one- minute or longer after initiation. Actuation of the reset. swatch in itself does not change the state of any equipment, but permits the operator to place the equipment affected by safety injection to the position desired.

If safety in]ection is caused by automatic actuation, and the reset switch is actuated, automatic safety ingection will be inhibited until all logic paths for automatic safety injection have opened. Once all logic paths open, the safety injection reset relays de-energize and re-establishes automatic safety injection capabilities.

Manual safety injection initiation is available at all times.

There is no annunciation of the safety xngection circuit being in the reset mode.

The purpose of the reset switch on the safety injection system is to allow equipment to be realigned for the recirculation phase of a postulated LOCA.

2. CONTAINMENT VENTILATION ISOLATION CIRCUIT:

This circuit has a reset switch which gives the opexator the means of resetting containment ventilation isolation.

Once the reset switch has been actuated, most 'of tne equipment. will automatically return to the state selected prior to the isolation signal.

If containment ventilation isolation was caused automatically, either by safety injection or high radiation alarm on containment gas and/or particulate monitors, and this condition continues to exist: after the xeset switch has been actuated, then containment ventilation isolation cannot be achieved automatically or by the manual isolation switches until th'is logic clears. Once the automatic logic clears, the containment ventilation isolation reset relays de-energize and re-establishes automatic or manual isolation capabilities.

Manual operation of the valves from the control board is available at all times.

There is no annunciation of the automatic containment ventilation isolation system being in the reset mode.

IJ The purpose of the reset switch on the containment venti-lation isolation system is to allow purging of containment in order to limit potential hydrogen concentration buildup following a postulated LOCA when high containment activity and safety injection signals could be present.

3. CONTAINMENT ISOLATION CIRCUIT:

This circuit has a reset switch which gives the operator the means of resetting containment .isolation. Once the reset switch has been actuated, some equipment will return

,automatically to the position selected prior to the iso-lation signal.

If containment isolation was caused automatically by an automatic safety injection signal, and containment iso-lation reset switch is actuated without resetting safety injection, containment isolation cannot be obtained injec-by the manual containment isolation switches until safety tion is reset.

Actuation of the reset permits the operator to place the valves affected by the containment isolation signal in the position~desired. This capability is necessary so that the operator has flexibility in dealing with post accident conditions within containment.

There is no annunciat'ion of the automatic containment isolation being in the reset mode.

4. CONTAINMENT SPRAY CIRCUIT:

This circuit has a reset switch which gives the operator the means of resetting containment spray. Once the reset switch has been actuated the spray additive tank discharge valves will return automatically to the position called for by the controller prior to the containment spray signal. The containment spray pumps and their discharge valves would require operator action to change state.

If containment spray was caused automatically by the high containment pressure logic, and this logic continues to exist after reset, containment spray cannot be initiated by the manual spray switches. Once the high pressure logic has cleared, the containment spray reset relays de-energize and re-establishes automatic or manual contain-ment spray capabilities.

Actuation of the reset permits the operator to place the valves and pumps affected by the containment spray signal in the state desired. This capability is necessary so that the operator has flexibility in dealing with post accident conditions within containment.

There is no annunciation of the automatic containment spray system being in the reset mode.

5. FEEDNATER ISOLATION RESET:

This circuit has a reset switch which gives the operator the means of resetting the isolation signal to the feed-water bypass valves only. The main feedwater valves will remain closed until the isolation logic clears, and then they automatically assume the position requested by their control circuit.

If feedwater level logic, isolation is caused by high steam generator and this condition still exists after the reset switch is actuated,-a safety injection sign'al would not cause an isolation to that particular feedwater bypass valve. It should be noted that a safety injection signal also causes the main feedwater pumps to be tripped, therefore, closing the feedwater bypass valves on a safety injection signal is redundant.

There is no annunciation of the automatic feedwater iso-lation system being in the reset mode.

6 NUCLEAR INSTRUMENTATION SYSTEM DEFEAT ~ BYPASS g AND BLOCK SWITCHES:

~

This system has several switches which are used for the following purposes:

(a) Defeat Switches - Defeats a permissive which rein-states a trip logic.

(b) Bypass Switches Bypasses a trip or runback function for calibration or maintenance purposes. Protection is still provided by redundant channel or channels.

(c) Block Switches Blocks trips generated by source,

.intermediate, and power range channels. These switches are actuated as permissive setpoints are reached to permit taking reactor critical and up in power. These blocks automatically reset as power is decreased below its particular setpoint.

All the above switches if actuated, are indicated by one or more of the following: status light, alarm on the computer, or actuate an annunciator.

7. INSTRUMENT AND CONTROL DEFEAT SWITCHES:

The following switches and their circuits were reviewed to insure that they are only performing their intended function, and no other safety functions are being bypassed. The

-purpose for these switches is to be able to switch control from one sensor loop to another for testing, calibration and maintenance purposes. In all cases, reactor trip and safety injection signals are generated prior to defeat switches, and are not affected by switch position.

(a) P/429A Pressurizer Pressure Selector Switcn Used to select two of the four pressurizer pressure channels for controlling pressurizer heaters, sprays, and power relief valve PCV-430.

(b) L/428A Pressurizer Level Selector Switch - Vsed to sele'ct two of the three pressurizer level channels for controlling charging pump speed, letdown iso-lation, and pressurizer heaters.

(c) T/405E and T/405F Delta T Defeat Switches Vsed to defeat a channel from the over temperature and over power turbine runback circuit, and to remove a channel Delta T signal from the input of the summer for generating the average Delta T signal or the Rod Insertion Limit Circuit.

(d) T/401A and T/401B Tavg Defeat Switches Used to defeat a Tavg channel from the input to the average Tavg summer which is used for full length rod control, condenser steam dump, and pressurizer level setpoint.