ML20012D622

Forwards Response to Generic Ltr 89-19, Resolution to USI A-47. Recommends All Westinghouse Plant Designs Provide Automatic Steam Generator Overfill Protection to Mitigate Main Feedwater Overfeed Events

ML20012D622
Person / Time
Site:	Beaver Valley
Issue date:	03/13/1990
From:	Sieber J DUQUESNE LIGHT CO.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
REF-GTECI-A-47, REF-GTECI-SY, TASK-A-47, TASK-OR GL-89-19, NUDOCS 9003280143
Download: ML20012D622 (8)

Text

~,- y,,. r-

.t.

a

, p*2 e.,.,

+z.

I , . , Bo

~

s

, Shippingport, PA 1$077 0004

j. ,

U

~

L JOHN D. SIEBER . .. (412) 393-6265 .

' vice Pmoent Nuckat Group M8TCh 13, 1990 i-9-q LU.: S. Nuclear Regulatory Commission Attn: Document' Control-Desk Washington,-DC 20555

Reference:

~ Beaver Valley Power Station,-Unit No. 1 and No. 2 BV-1 Docket No. 50-334, License No. DPR-66 BV-2 Docket No. 50-412,. License No. NPF-73' Response to Generic Letter 89-19, Resolution.to-Unresolved Safety Issue A-47 Gentlemen:

Attached is our response to the recommendations as requested by_- Generic- Letter-89-19, Request for Action Related to Resolution of Unresolved Safety Issue .A-47, Safety Implication of Control Systems in LWR Nuclear Power Plants partiuant to 10CFR50.54(f).

Please : note that this submittal- -provides information-

' addressing'both Beaver Valley-Unit 1 and' Unit 2.

If.-you- have any questions'- regarding this response, please-contact my office.

Very truly yours,

• r 6.Lr J.-D. Sieber Vice President

. . Nuclear Group cc:. Mr. J.-Beall, Sr. President Inspector Mr. W. T. Russell, NRC Region I Administrator Mr. P. Tam, Sr. Project Manager

'Mr. R. Saunders (VEPCO) f s

f(i(

1 9003280143 900313 4 y

l l

PDR ADOCK 05000334 l

_p PDC n

. 8 f '. "

- .n

(.

.t j p.1 ,

L' i

J.~ COMMONWEALTH'OF PENNSYLVANIA) .

(' .) SS:. ,

b _ COUNTY OF.' BEAVER ')

b e i 4 <

b On. this day of OM .__- , : 1990,

'b'efore J12

, me, ld// /) '

a Notary Public in;and for said-(/ /

Commonwealth and County,' personally appeared J. D. Sieber, who'being  !

duly sworn,' deposed, and said that (1) he is Vice President ~~ Nuclear.

'of Duquesne Light,..(2) he is duly authorized to execute and' file the.

foregoing- Submittal'on behalf of said Company, and (3) the' statements 1 4 set forth in. the Submittal are true and correct to the best of~his  !

' knowledge, information and belief. 1 s

V n

,m n -

s1 M~kPuw

'nter, Per% q a

i-

F l'-

, ATTACHMENT Response to Generic Letter-89-19 Request for Action Related to Resolution of Unresolved Safety. Issue'A-47 Safety Imolication for Control Systems in LWR Nuclear Power Plants Enclosure 2 (2) Westinahouse-Desianed PWR Plants (a).It is recommended that all Westinghouse plant designs provide automatic ~ steam generator overfill protection to mitigate Main Feedwater overfeed events. The design for the overfill protection - system -should be sufficiently separate from the MFW control system to ensure that the MFW pump will trip on a reactor high-water-level signal when required.

Response

BV-1 The Beaver Valley Unit i design provides automatic steam L generator overfill protection which is separate from the steam generator water level control system. The overfill protection is provided by a safety grade feedwater isolation signal as described in Beaver Valley Unit 1 Updated Final Safety Analysis Report (USFSAR) Section 7.2.2.3.5. This overfill protection is part of the original design for the L Westinghouse; 7100 series process instrument racks and solid state protection system used for the reactor trip system, shown in UFSAR Figure 7.2-1 sheets 1 through 16. The overfill protection employs a two train two-out-of-three high steam generator water level signal input to initiate a feedwater isolation signal. The feedwater isolation signal closes- the main' feedwater isolation valves, _the main feedwater regulating valves, the main feedwater bypass I

valves, trips all main feedwater pumps, and initiates auxiliary feedwater pumps.

The steam generator water level control system is described in UFSAR Section -7.7.1.7. Steam generator water level signal input to the water level control system comes~from one of the three level signals which is also used by the protection system. However the protection system is designed to be independent of the control system as explained in UFSAR Section 7.2.2.2.1. Subsequent control of the auxiliary feedwater system after automatic actuations is by operator action.

- ..- .. - - ~ . -

3

. ATTACHMENT.

" Response to Generic Letter 89-19 Page 1 ,

BV-2 The Beaver. Valley Unit 2 design also provides automatic' steam generator overfill protection which is-separate from I the steam generator water level control system. The ,

overfill protection is provided by a safety grade feedwater

-isolation signal as described in Beaver Valley Unit 2 UFSAR Section 7.2.2.3.5.. This overfill protection is part of the original- design for- the Westinghouse 7300 series process instrument racks and solid state protection-system used for the ' reactor trip system, shown in UFSAR Figure 7.2.1 sheets:

1 through 18. The overfill protection employs a two train two-out-of-three high steam generator water level signal input to initiate a feedwater isolation signal. The feedwater isolation signal closes. the . main feedwater isolation valves, the main feedwater regulation valves, the main feedwater bypass valves, trips all- main feedwater' pumps, and initiates auxiliary feedwater pumps.

4 The steam generator water level contcol system is described ~

in UFSAR Section 7.7.1.7. Steam generator water level  ;

signal . input to. the water level control system comes from-l all three level signals also used- by- the protection A median signal selector is-used to select the L system. . signal from the three existing protection system middle level channels through . safety grade isolators. Thus the L . protection system is designedEto be independent of the L control system as explained in UFSAR Section 7.2.2.2.3.

l- This design was approved per NUREG-1057. Subsequent control- of the auxiliary feedwater system after automatic actuation is by operator action.

Enclosure 2 1 (2) (b) It 'is recommended that plant procedures and technical ,

p specifications- for all Westinghouse plants include l provisions to periodically verify the operability of MFW ,

L overfill protection and ensure that the automatic overfill protection is operable during reactor power operation.. The-instrumentation should be demonstrated. to.be operable-by.

the performance of a channel check, channel functional testing, and channel calibration, including appropriate LCOs. These technical specifications should be commensurate with existing plant technical specification requirements for channels that initiate protective actions. Plants that have previously approved technical specifications for surveillance intervals for overfill protection are considered acceptable.

l

b ATTACHMENT'

' Response to' Generic. Letter 89-19 Page 2

-Response: Beaver. Valley Power Station Unit 1 and Unit 2 Technical-Specification 3.3.2.1 . currently both contain a Limiting Condition for Operation- (LCO) .for turbine trip and feedwater isolation on high-high steam-generator water level. (P-14) to be operable during Modes 1, 2, and 3.

This Technical Specification also contains LCO's for Engineered Safety Feature Actuation System (ESFAS)

Instrumentation and thus the . overfill protection criteria- is commensurate: with- these ESFAS protective, functions. The Technical Specification surveillance criteria requires that operability be determined by '

periodic performance of a channel check, channel functional' test, -and channel calibration. These Technical Specifications for BVPS Unit 1 and 2 have previously been approved' by the Nuclear Regulatory.

Commission and appropriate plant procedures are in place implementing these requirements.

Enclosure 2 Desians for Overfill Protection Several different . designs for overfill-protection are already provided in most operating plants. The following discussion identifies the different groups of plant design and.provides guidance for acceptable designs.

GrouD I: Plants that have overfill-protection system initiated on a- steam generator high-water-level signal based on a 2-out-of-4

. initiating logic which is safety grade, or a 2-out of 3 initiating logic which is: safety grade but uses one out_of the-three channels for -both control and protection. .The system isolates MFW by closing the MFW isolation valves and tripping the.MFW pumps.

~

The staff concludes that the design is acceptable, provided that the overfill protection system is sufficiently separate from the control' portion of the MFW control system so that it is not powered. from the same power source, not located in the.same cabinet, and not routed so that a fire is likely to affect both systems. The design for the overfill protection system should be

'sufficiently separate from the MFW control system to ensure that the MFW pump will trip on a high-water-level signal when required, even if a loss of power, a loss of ventilation, or a fire in the control portion of the MFW control system should occur.

Common-mode failures that could disable overfill protection and the feedwater control system, but would still result in the feedwater pump trip, are considered acceptable failure modes.

i

I. ,,

l so

• o ATTACHMENT Reeponse to Generic Letter 89-19  !

'Page 3_

l

,. 1 1

l Response Both. Beaver. Valley Power Stations Unit 1 and 2 have an i L overfill ~ protection. system initiated on a : steam-  !

generator high-water-level signal' based on a-2-out-of-3

-initiator's logic which .is safety grade with Unit 1

using. one. of the three- channels for both control and.

protection and Unit 2 using all three channels for control and protection through a median signal selector maintaining the required separation between control and.

protection systems. These overfill protection systems  !

, isolates main feedwater by closing the main feedwater

isolation valve, regulating valves,- bypass valves and

. tripping the main feedwater pumps.  :

Forf Beaver- Valley Unit 1, the three channels on each

.: steam generator for water level protection L instrumentation are powered'from Vital Bus No. 1, 2 and 3, respectively, providing diverse power sources <

(PNL-VITBUS-1, -2, -3). .The feedwater. isolation valves '

are supplied with orange train power (MCC-1-ES). The' feedwater control valves' two trains of prompt closure solenoids are powered -from orange train (BATT #1, DIST PNL #3) and purple -train (BATT #2,_ DIST. PNL #2), i respectively. Thus, a single loss of a power supply will7 not prevent feedwater from being isolated on a high; steam generator water level condition. The three '

channels of _ steam generator water- level -used for overfill . protection- are provided typical- protection:

system channel separation. and thus are not all located

in the same instrument cabinet and are not located.in the same cabinet as the feedwater level control system.

Thus, overfill- protection would' not be prevented by a loss of ventilation to one cabinet. Therefore, adequate ,

protection is provided against a fire in the non-safety

, related feedwater level control . system. ~ A small fire would not affect both control and protection systems  !

since each of the three protection channels and the.

feedwater control' system are housed in separate cabinets. Larger fires were previously evaluated as part of the Appendix R analysis conducted on Beaver Valley Unit 1. This includes a significant fire in the .

room housing the process racks (which-includes both the feedwater level control and protection system instrument racks). A procedure for alternate safe shutdown from outside control room (Operating Manual 1.56C.4) was developed for a fire in the process rack room. This procedure, as part of its actions, instructs operators to deenergize various electrical besses to prevent spurious fire-induced actuations. The primary concern in this postulated fire scenario is providing adequate auxiliary feedwater after an automatic or manually induced reactor trip with subsequent steam generator

n +x

(

c'

=1

/4-. . , 1

-ATTACHMENT: ,

' Response to Generic Letter 89-19 1

+

Page 4 ,

j q

l water . level. shrink rather than . overfill protection.

y However, this = procedure .deenergizes~ non-essentialf i equipment,. which includes the main feedwater pumps, with operators controlling post-trip- steam generator water, level via the. auxiliary- feedwater system. Thus, overfill; protection is sufficiently separate for  :'

postulated small fires in the main feedwater instrumentation and procedures are" approved and in place-  :

. for larger postulated fire events -for Beaver Valley Unit 1.-

For Beaver Valley Unit 2, the three channels on each a steam generator for water level protection i instrumentation are powered from Vital' Bus No. 1, 2'and (

3, respectively, providing diverse power sources-(PNL*VITBS 2-1A, -2A, -3A). The feedwater isolation .

valves are supplied with orange train power  !

(PNL*DC2-11). The feedwater control valves are supplied  ;

with purple train power (PNL*DC2-06). Thus, a single

~

loss of- a power supply will not prevent feedwater from L being isolated on a high steam generator water level L condition. The three channels of steam. generator. water p level used for overfill protection are provided typical protection system channel separation and'thus are'not all located in the same instrument cabinet and are not L located in the same cabinet as the feedwaterilevel i

control system. Thus, overfill protection would not.be .

prevented by a loss of ventilation to one cabinet. T y .Therefore, adequate protection is provided- .against a f fire- in .the non-safety related feedwater level control-system. A small fire would not affect both control and L

L protection systems since each of the three protection channels and the feedwater control system are housed in separate cabinets. Larger fires were previously evaluated .as part of the analysis conducted on Deaver .

Valley Unit 2 as described in UFSAR Section 9'.5 and approved per NUREG-1057. This includes a significant fire in the room housing the process racks (which includes both the feedwater level control and protection .

system instrument racks) or a fire in the cable tunnel which carries all instrument input to both the feedwater control and protection systems. .

A procedure for alternate safe shutdown from outside control room (Operating Manual 2.56C.4) was developed for a fire in the process rack room or cable tunnel. This procedure, as part of its actions, instructs operators to deenergize various electrical busses to prevent spurious

i n 9:

. ~ ATTACHMENT ~

, ' Response.tx) Generic Letter 89-19.

p :Page 5 t

fire-induced actuations. The primary concern in this '

postulated fire scenario is providing adequate auxiliary.

feedwater after an automatic or manually induced reactor trip with its subsequent steam generator water level shrink rather .than. overfill protection. However,.this-procedure deenergizes non-essential equipment,. which includes- the main feedwater. pumps with operators '

controlling post-trip steam generator.' water level via the auxiliary -feedwater system. Thus, overfill protection -is sufficiently separate for postulated small fires in the main feedwater instrumentation and procedures are approved =and in place for larger postulated fire events for Beaver Valley Unit'2.'

l L

l l-.

t 4

.. {

!