ML20040F419

Forwards Draft Responses to NRC 811117 Ltr Requesting Info Re Instrumentation & Control Sys.Meeting Held on 820113 & 14 to Discuss Concerns & Identify Action Items

ML20040F419
Person / Time
Site:	Perry
Issue date:	02/03/1982
From:	Davidson D CLEVELAND ELECTRIC ILLUMINATING CO.
To:	Schwencer A Office of Nuclear Reactor Regulation
References
RTR-NUREG-0696, RTR-NUREG-0737, RTR-NUREG-696, RTR-NUREG-737, TASK-2.D.3, TASK-2.F.2, TASK-2.K.3.18, TASK-2.K.3.21, TASK-2.K.3.22, TASK-TM NUDOCS 8202090176
Download: ML20040F419 (31)

Text

s ,o iliE C L EV E L A N D E L E Cin!C iL L U!?ll! ATIN G C O M P A N Y P o. Box 5000 m CLEVELAND oHlo 44101 e TELEPHONE (216) 622-9800 m ILLUMIN ATING BLOG e 55 PUBLIC SoVARE Datwyn R. Davidson "U " ' " "'" '"

VICE PRESIDENT 5ySTEM E NGINEERiNG AND CONSTRUCTION

//

'/ ,

February 3, 1982 s'/ 0 Mr. A. Schwencer, Chief q N Licensing Branch No. 2 E D f .- o ' 'i ~ lP Division of Licensing v1 g'{3 ;; - ~'

,Q U. S. IMclear Regulatory Commission /

Washington, D. C. 20555 g s'(j t,g t/

Perry nuclear Power Plant Docket Hos. 50-440; 50-441 Response to Request for Meeting - Instrumentation and Control Systems

Dear Mr. Schwencer:

This letter and its attachment is submitted to provide draft respenses to several of the concerns identified in your letter dated November l'7,1981. A meeting was held on January 13 and 14 to discuss these concerns ard identify action items. Remaining agenda items will be addressed in future correspondence as agreed upon with the Instrumentation and Control Systems Branch reviewers.

Very Truly Yours, l l

• V V1 Dalwyn R. Davidson Vice President System Engineering and Construction DRD: clb cc: Jay Silberg, Esq.

M. Dean Houston Max Gildner, HRC Resident Inspector J. Mauck D

f I(

K Ohhkfo PDR

6 421.02 Page 1 of 4 421.02 Several previously reviewed BWR installations, e.g., Grand Gulf, included a start-up transient monitoring system to-provide recordings of. selected parameters during the start-up and warranty testing. There is no information in the FSAR which describes this system. If this system, or any similar 4 system, is intended for use in the Perry units, provide the 7

following information:

a. Identify all safety-related parameters which will be monitored with the transient monitoring system during start-up.

b. For each safety parameter identified above, provide a concise description of how the associated circuitry merges or connects (either directly, or indirectly by means of isolation devices) with the circuitry associated with the transient monitoring system. Where appropriate, supplement this description with detailed electrical schematics.

c. Describe provisions of the design to prevent-failures of this system from degrading safety-related systems.

Response

1. Perry intends to utilize the Emergency Response Information System C (ERIS) data acquisition system to monitor transients during startup. The ERIS is an integrated system that gathers the required plant data, stores and processes that data, generates visual displays for the operator and other personnel who need plant status information, provides printed records of transient events and has the capability of transmitting information to Technical Support Center and Emergency Operating Facility as described in NUREG 0696 " Functional Criteria for Emergency Response Facilities".

w

/'

F

• 421.02 Page 2 of 4

2. The equipment monitoring safety related functions will be permanently installed to the same standards as all other plant equipment as described in .Section.8.3.1.4.l'and will be consistent with the separation

- requirements of Regulatory Guide 1.75.

3. The following parameters in safety-related systems will be monitored for startup transient testing.

System Parameters Neutron Monitoring System (NMS) APRM Output APRM Heat Flux APRM Flow Biased Rod Block LPRM Output Recire Sys Drive Flow Reactor Core Isolation Cooling RCIC Steamline AP (RCIC) RCIC Control Valve Position RCIC Stop Valve Position RCIC Steam Admission Valve Position RCIC Initiation RCIC Vessel ~ Injection Valve Position RCIC Discharge Flow RCIC Turbine Speed RCIC Turbine Controller Outputs RCIC Flow Controller Outputs RCIC Steam Pressure RCIC Discharge Pressure -

RCIC Suction Pressure l

RCIC Turbine Exhaust Pressure Low Pressure Core Spray (LPCS) LPCS Flow f

Residual Heat Removal (RHR) RHR Initiation i-RHR Heat -Exchanger Level i

, , - _ , , . . . ~ . - _ - _ , _ . . . ~ _- _. , _ . _ - . _ . . _ . _ - _ - , . _ - .. _ ._ . _ . _ . -

421.02-Page 3'of 4 System Parameters RHR Heat Exchanger Inlet Pressure RHR Heat Exchanger Pressure Controller

. Output RHR System Flow Rod Control ~ and Information Rod Scram Times -

(RCIS) Selected Rod Pilot Solenoid Nuclear Boiler / Nuclear Steam Outboard MSIV~ Position Supply Shutoff Inboard MSIV Position MSIV Isolation Initiation Signal Vessel Wide Range Level Standby Diesel Generator (D/G) D/G Initiation 4.16 kV-Power Distribution Emergency Bus'1 Status Emergency Bus 2 Status n

p ,[ Emergency Bus 3 Status x #

g. Reactor Systems Reactor Vessel Pressure l Safety Relief Valve Initiation Containment. Isolation Logic Status L' Recirc. Pump Trip Breaker Status i-

!? ~ ,,

RPS Logic Status Jh , s "

~

4. Isolation will be accomplished by converting signals for transmission via optical fiber cable. The optical isolation will be is . accomplished downstream of signal conditioning, multiplexing, and

.s analog-to-digital conversion. These remote multiplexers shall be

• ' - classified as divisional devices. Thus, within a given multiplexer only signals of one safety division will be connected. The signal conditioning and multiplexer unit will be qualified in accordance

., . with Regulatory Guides 1.89 and 1.100. The associated portion of the optical isolation shall be qualified in accordance with Regulatory Guides 1.75, 1.89, and 1.100.

a.

t-

m 421.02-.Page 4 of 4

)

.a

5. To maintain the signal conditioning and multiplexing equipment as divisional devices,'the power for these devices will be supplied from divisional power sources. In addition,_each signal input to the multiplexers will be individually conditioned and buffered from all other signals in the same multiplexer.

I i

?

)

l

..-w._ .

il

. -421.06 Discuss conformance with the following TMI action items as required by NUREG-0737:

a .- II.D.3 Relief and safety valve position indication

b. _II.F.2 - Inadequate Core Cooling

c. II.K.3.18 ADS actuation

d. II.K.3.21 - Restart of LPCS and LCPI

e. II.K.3.22 - RCIC automatic-switchover

Response

a. II.D.3 Relief and Safety Valve-Position Indication The SRV open/close monitoring system is'a single channel safety grade system consisting of a sensing element and a pressure switch connected to the discharge pipe at the downstream side of_the SRV

~ ~

discharge pipe. The electrical outputfof the pressure switch operates a relay which provioes input to the annunciator, process computer,._

and indicator lights. This system will be environmentally and seismically qualified. This system is identical to that recently-proposed by Grand Gulf and approved by NRC.

b. This item will be addressed through LRG-II.

c. This item will be addressed through LRG-II.

d. II.K.3.21 Restart of LPCS and LPCI CEI endorses the BWR Owners Group position that providing controls to restart the low pressure core cooling systems would not enhance the overall BWR safety. However, CEI will modify the current HPCS control to provide automatic reset capability. This automatic reset modification of the HPCS resets the auto-initiation signal for low water level and blocks-the_ continuing auto-initiation signal for high drywell pressure.

This allows auto-restart of HPCS pump on low water level after the operator stopped the HPCS pcmp. The auto restart on high drywell

421.06 (Page 2 of 2) Cont'd pressure is blocked unless the high drywell pressure decreases below setpoint and again increases. Decrease in drywell pressure below trip level returns HPCS logic to original status,

e. II.K.3.22 RCIC Automatic Switchover The RCIC pump suction automatic.switchover fion condensate storage tank to suppression pool has been committed by CEI for Perry and can be found in Perry FSAR Section 7.4.1.1.

{.

~]

l 421.07 Describe the separation criteria for protection channel circuits, protection logic circuits, and non-safety related circuits. For example are channel circuits and logic circuits separated from one another?

Response

References to various FSAR sections of 8.3.1.4 were discussed in detail. The staff required no further action.

i I

i 0 .

Q 421.08 Table 7.1-2 of the FSAR states that the design of the Perry Reactor Protection System is similar to the design of the Grand Gulf Reactor Protection System. Provide a comparative discussion identifying specific differences between the two designs.

Response

Perry RPS design is functionally similar to Grand Gulf at this time. Some differences exist on turbine stop valve position sensors. The staff required no further action on this item.

. ~. 7 421.11 Revise the discussion concerning compliance with IEEE Standard 279 to verify that all portions of the RPS comply.

Response

The response to this question is provided in revised Section 7.2.2.2 attached.

l l

I I

. ~. 7 The RPS is highly reliable and will provide a reactor scram in the event of anticipated operational occurrences.

7.2.2.2 Conformance to IEEE Standards The following is a discussion of conformance to those IEEE standards which apply specifically to the RPS system. Refer to Section 7.1.2.3 for a discussion of IEEE standards which apply equally to all safety related systems. The non-essential RPS power and its electrical protection assembly (EPA) are discussed in Section 8.3.1.1.5.1.

~ 4s

a. IEEE Standard 279 Criteria for Protection Systems for Nuclear Power )b Generating Stations - The RPS design complies with the requirements of IEEE-279. The following is a discussion of specific conformance.

1. General Functional Requirement (IEEE Standard 279, Paragraph 4.1)

The RPS automatically initiates the appropriate protective actions, whenever the conditions described in Section 7.2.1.1.b reach predetermined limits, with precision and reliability assuming the full range of conditions and performance discussed in Section 7.2.1.2.

2. Single Failure Criterion (IEEE Standard 279, Paragraph 4.2)

Each of the conditions (variables) described in Section 7.2.1.1.b is monitored by redundant sensors supplying input signals to redundant trip logics. Independence of redundant RPS equipment, cables, instrument tubing, etc. is maintained and single failure criteria preserved through the application of the PNPP separation criteria as described in Section 8.3.1 to assure that co single credible event can prevent the RPS from accomplishing its safety function.

3. Quality of Components and Modules (IEEE Standard 279, Paragraph 4.3)

For a discussion of the quality of RPS components and modules, refer to Section 3.11.

7.2-20

q W

421.12 In the discussion in Section 7.2.2.2 concerning conformance to Criterion 4.15 of IEEE Standard 279, the statement is made that there are no multiple setpoints within the RPS. Discuss the effects on RPS setpoints of mode switch operation.

Response

The response to this question is provided in revised Section 7.2.2.2.a.15 attached.

15. -Multiple' Set Points (IEEE Standard 279, Paragraph 4.15)

The reactor mode switch implements more restrictive scram trip setpoints when it is shifted from RUN to STARTUP. As the mode switch is moved to STARTUP . . .

(a) The APRM upscale neutron scram trip is replaced by the restrictive APRM setdown scram trip at 15 percent power.

-(b) The IRM range switch dependent scram trips are enabled.

Each IRM range switch enables successively more restrictive scram trip setpoints as it is ranged down.

N N

In addition to the mode switch dependent multiple setpoints, the flow 4

, channels which supply control and reference signals for the APRM 'M upscale thermal scram continually vary the scram setpoint as_ flow-changes. A sensed reduction in flow results in more restrictive scram trip setpoints.

The devices used to prevent improper use of the less restrictive setpoints (the mode switch, IRM range switches, the IRM and APRM signal conditioning equipment, and the flow channels) are designed in accordance with criteria regarding the performance and reliability of protection system e.quipment.

16. Completion of Protective Action Once it is Initiated (IEEE Standard 279; Paragraph 4.16) r Once the RPS trip logic has_been deenergized as a result of a trip channel becoming tripped, or the actuation of a manual scram switch, the trip-logic seal-ir contact opens _and completion of protection action is achieved without regard to the state of the initiating sensor trip, channel.

7.2-25

. . 7 After initial conditions (variable trip and logic deenergization) return to normal, deliberate operator action is required to return (reset) the RPS logic to normal (energ" zed).

17. Manual Initiation (IEEE Standard 279, Paragraph 4.17)

Refer to the discussion of Regulatory Guide 1.;22 in Section 7.2.2.3.a.

18. -Access to Set Point Adjustments, Calibration, and Test Points (IEEE Standard 279, Paragraph 4.18)

During reactor operation, access to set point or-calibration controls is not possible for the following RPS trip variables:

(a) Main steam line isolation valve' closure trip (b) Turbine stop valve closure trip (c) Turbine control valve fast closure trip Access to set point adjustments, calibration controls, and test points for all other RPS trip variables are under the administrative control of the' control room operator.

7.2-25a

. . R 421.13 Discuss the logic used for bypassing the turbine stop valve closure. Can a single failure in this pressure transmitter system cause a bypass of this closure to occur. Provide a similar discussion for the turbine control valves.

Response

The details of the bypass circuit werc discussed and the staff had no further questions.

. ~ .

D

• 421.17 Identify any sensors or circuits used to provide input signals to the protection system which are located or routed through nonseismically qualified structures. This should' include sensors or circuits providing input for reactor trip, emergency safeguards equipment such as the Emergency Core Cooling system, and safety grade interlocks. - Verification should be provided that the sensors and circuits meet IEEE 279 and are seismically and environmentally qualified. Testing or analyses performed to insure that failures of non-seismic structures, mountings, etc., will not cause failures which could interfere with the operation of any other portion of the protection syrrem should be discussed.

Response

! Safety Related Inputs Routed in Non Seismic Structures I

RPS and ESF inputs routed in non seismic structures involve only inputs from

- sensors located on'the turbine or in the turbine building. These inputs go to the Reactor Protection System _(RPS) and the Main Steam Line Isolation Valve System (MSIV).

a.) RPS, trip reactor on turbine stop valve closure or control valve fast closure with bypass of both when turbine first stage pressure is below the equivalent of 40% power. Reference'Section_7.2.1.1; page 7.2-15 and 7.2-27.

b) 'MSIV, valve closure actuation on turbine inlet low pressure or main condenser low vacuum or high temperature in the steam line area of the turbine building. Reference Section 7.3.1.1.2, pages 7.3-16, 7.3-17 and 7.3-21.

All of these inputs and their circuits are treated in the same way all other safety related inputs and circuits are in terms of identification, location, mounting, and separation.

421.17 (Page 2 of 2) Cont'd In addition, all of these circuits, except the thermocouple circuits in the MSIV logic, are split with one conductor running on one side of the turbine building and the other running on the opposite side of the turbine building in order to minimize the possibility of a short due to damage resulting from a seismic event. The thermocouple circuits, because of the nature of their special wire requirement, are not split in their routing. However, since thermocouple wire carries no significant voltage or current and a thermocouple junction requires firm and substantial contact, the probability of cable damage resulting in a false thermocouple junction is small; the thermocouple temperature switch will trip upon detection of thermocouple open or burnout.

These, as well as all inputs to the RPS or MSIV logic, are isolated from other logic channels by trip units or relays, such that any failure of one channel will not prevent another channel from performing its function.

l l

l l

q 421.18 Identify the physical location of-the equipment that actuates the reactor trip on turbine trip and indicate whether this equipment and associated circuitry meets the criteria applicable to equipment performing a safety function.

Response

The equipment that actuates reactor trip on turbine trip is located as shown:

Location Installation C71-N005A-D Turb. CV Fast Closure On Turb.40-021 (137D2407)(1)

C71-N006A-H Turb. Stop VLV Closure On Turb.40-853 (142D8582)(1)

C71-N052A-D Turb. 1st Stage Pressure 811-006,105 814-026, 027 (1) GE Turbine Drawing Numbers This equipment meets the criteria applicable to equipment performing safety functions that are described in Section 7.2.1.2, page 7.2-15; and-Section 7.2.2, pages 7.2-19, 7.2-22, 7.2-23, 7.2-25, and 7.2-28.

1Y

m 421.20 'It has been noted during past reviews that' pressure switches or other devices were incorporated into the final actuation control. circuitry for large horsepower safety-related motors which are used to drive pumps. These switches or devices preclude automatic (safety signal) and manual operation of-the motor / pump combination unless permissive conditions, such

-as lube oil pressure, are. satisfied. Accordingly,; identify any safety-related motor / pump combinations which are used in the Perry design that operate as noted above. Also, describe the redundancy and diversity which are provided for the pressure switches or other permissive devices that are -

used in this manner.

Response

The response to this question has been provided as the response to Question 430.86 (submitted November 11, 1981).

7 421.22 The FSAR states that each ADS trip system has a time delay that can be reset manually to delay system initiation. Discuss the conditions under which the operator would reset the ADS timers.

Also, discuss the consequences of resetting the timers if the HPCS fails to start.

Response

The operation of the ADS trip system was discussed and the staff had no further questions.

e

7 421.24 Discuss the' testing procedures used to demonstrate that the main. steam isolation valve closure time is within the 3 to 5' seconds assumed in Section 15.2.4.3.2.

Response

~ The cold stroke closure time of the main steam isolation valves will be set during preoperational testing.

The hot stroke closure time of-the main steam isolation valves will be determined during startup testing, as described in Section 14.2.12.2.22.1 of the FSAR. The Level 1 acceptance criteria are given in Section 14.2.12.2.22.ld.

Periodic testing of main steam isolation valves to determine closure times will be conducted. The acceptance criteria are that the main steam ,

isolation valves closure time, exclusive of electrical delay, shall be no faster than 3.0 seconds (average of the fastest valve in each steam line) -

and no slower than 5.0 seconds (each valve, not averaged).

421.25 Discuss how the Main Steamline Isolation Valve-Leakage Control System conforms to the requirements. of Paragraph 4.1 of IEEE..

Standard 279 concerning automatic initiation capability.

Response

This item was discussed, and it was concluded that auto-initiation of MSIV-LCS was not required. This system is designed to limit the long-term leakage through the MSIV af ter a LOCA is detected and, therefore, it is not needed to be manually initiated in the first 20 minutes after the MSIV auto closure.

This system is similar to Grand Gulf's.

7 O

4 421.26 Discuss how the Suppression Pool Cooling Mode of the Residual Heat Removal System conforms to the requirements of Paragraph 4.1 of IEEE Standard 279 concerning automa;ic initiation capability.

Response

Operation of the system was discussed and the staff had no further questions.

s

7 t

'421.30 The P&I diagrams for the Annulus Exhaust Gas Treatment-System are shown in Figure 6.5-1, Sheets.I and 2. However, Sheets 1 and 2 appear identical except for the FDIB and the

- FDRB valves. - Explain the significance of the two drawings.

Response

A discussion of instrument' tag numbers distinguishing units was held. 'The staff required no further action on this item.

4 F

i

.. ___ ________--__m._ - - - - - -- - - - - - - -- -

7 421.34 Table 7.1-2 of the FSAR identifies many ESF systems that are-similar to the design of the Grand Gulf ESF systems. Provide a comparative discussion identifying specific differences between designs of similar systems.

Response-The ESF Systems in the NSSS scope are functionally similar to Grand Gulf at this time.

s e

421.50 Using detailed system schematics, describe'the implementation of the bypassed and inoperable status indication provided for engineered safeguards features. Discuss how the design of the bypass.and inoperable status indication systems comply with positions B1 through B6 of Branch Technical Position ICSB No. 21.

l

Response

This item was discussed and the staff required no further action.

O 9

m 421.52 Why are the indicator lights or annunciators required by R. G. 1.47 not included in Table 7.5-1 or any other table in Section 7.57

Response

This item was discussed and the staff required no further action.

t 421.57- In the discussion concerning the leak detection instrumentation for fission product monitoring, Section 5.2.5.2.1, reference is made to Section 7.6. However, no information is provided in Section 7.6 relative to fission product monitoring. Discuss this instrumentation and the need to include a description of-it'in Section 7.6.

Response

The' leak detection instrumentation for fission product monitorin?, is discussed in Section 12.3.4. The correct reference is provided in revised Section 5.2.5.2.1, attached. .

5

d. Temperature Measurement.

The ambient temperature within the drywell is monitored by four single element thermocouples located equally spaced in the vertical direction within the drywell. An abnormal increase in drywell temperature could indicate a leak within the drywell. In addition, the drywell exit end of the containment penetration guard pipe for the main steam line is also monitored for abnormal temperature rise caused by leakage from the main steam line. Ambient temperatures within the drywell are recorded and alarmed on the LD&IS (Leakage Detection and Isolation System) control room panel.

e. Fission Product Monitoring.

1 The drywell air sampling system is used along with the temperature, pressure, and flow variation method described above to detect leaks in the nuclear system process barrier. The system continuously monitors the drywell and drywell atmosphere for airborne radioactivity (iodine, noble gases and particulates). The sample is drawn from the ventilation.

exhaust of the containment and drywell. A sudden increase of activity, h

which may be attributed to steam or reactor water leakage, is annunciated  %

v in the control room. (C2e Section 12.3.4). 4

\k

f. Drywell Pressure Measurement.

The drywell pressure varies slightly during reactor operation and is monitored by pressure sensors. The' pressure fluctuates slightly as result of barometric pressure changes and outleakage. A pressure rise

, above the normally indicated values will indicate a possible leak within the drywell. Pressure exceeding the preset. values will be annunciated in the main control room and safety action will be automatically initiated, i

. g. Reactor Vessel Head Seal.

The reactor vessel head closure is provided with double seals with a leak of f connection between seals that is piped through a normally closed 5.2-48 4

--. -,, - .. . _ - . . , . _ . . . + --

N

-e - \

l'

~1 421.62 Discuss the safety aspects of the Perry design for the following trips and interlocks:

~

a. Recirculation flow ntrol valve motion interlocks;-

^

a

b. Low reactor vessel-level and high vessel pressure recirculation pump trips;

c. High reactor vessel water level trips for the feedwate'r pumps and plant turbine.

- ~'-

Response

a. Recirculation Flow Control Valve Motion Interlocks i

These interlocks are not safety grade. The. failures of the recirculation ,

flow control are analyzed in Chapter 15.

b. Recirculation Pump Trip .

The trip on Low Vessel Water level and high vessel pressure is.the ATUS trip utilizing redundant sensing logic developed to trip a single breaker and is not safety grade. This is consistent with the HatchJVPWS fix.

c. The high vessel water level trips for the feedwater pumps and plant turbine are not safety grade and are intended only to protect the turbine.

1

.D

i. - .

o

/: ./

=' . ~

c 421.63 :/ , ' Identify the non-safety grade equipment .used to mitigate the 7

/ effects of Anticipated Transients Without' Scram'(ATWS).

Inciude ' a discussion of the ATWS . recirculation pump trip -

. n- '(ATVSRPT).

/

- Response

- + z ;.

• ~

? -

G The enrrent equipment used in Perry to mitigate the effects of ATWS is .imilar i to the so-called Hatch fix 'which consists of non-safety grade circuitry- that

~ ' trips the recirculation pumps without transfer to the low frequency motor

' generator set' upon receipt of a high reactor pressure or low level (2) vessel 1

water level signals. This fix is similar to what Grand Gulf has. at this time.

/

4 A

'k.-

j i

I f

i i

J i

i l.