ML20155F421

Safety Evaluation Supporting Amend to 10CFR50.62, Requirements for Reduction of Risk from ATWS Events for Light-Water-Cooled Nuclear Power Plants

ML20155F421
Person / Time
Site:	Millstone
Issue date:	10/06/1988
From:	Office of Nuclear Reactor Regulation
To:
Shared Package
ML20155F418	List: ML20155F413 ML20155F421
References
GL-85-06, GL-85-6, NUDOCS 8810130260
Download: ML20155F421 (8)

Text

. .

8

+f k o UNITED STATES NUCLE AR REGULATORY COMMISSION h k WASHINGTON, D C. 20555 y...+j SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION MILLSTONE NUCLEAR POWER STATION UNIT 1 COMPLIANCE WITH ATWS RULE 10CFR50.62 RELATING TO ALTERNATE R0D INJECTION AND RECIRCULATION PUMP TRIP SYSTEMS DOCKET NO. 50-245 1.0 J,NT,RODUCTION On July 26, 1984, the Code of Federal Regulations (CFR) was amended to include Section 10 CFR50.62, "Requirements for Reduction of Risk from Anticipated Transients Without Scran (ATWS) Events for Light-Water-Cooled Nuclear Power Plants" (known as the "ATWS Rule"). An ATWS is an expected operational transient (such as loss of feedwater, loss of condenser vacuum, or loss of offsite power) which is acconipanied by a failure of the i. tor trip system (RTS) to shutdown the reactor. The ATWS rule requires specifu improvements in the design and operation of comercial nuclear power facilities to reduce the likelihood of failure to shutdown the reactor following anticipated transients, and to mitigate the consequences of an ATWS event. <

For each boiling water reactor, three systems are required to mitigate the consequences of an ATWS event.

1. It must have an alternate rod injection (ARI) system that is diverse (from the reactor trip system) from sensor output tu the final actuation device.

The ARI system must have redundant scram air header exhaust valves. The ARI system must be designed to perfonn its function in a: reliable manner and be independent (from the existing reactor trip system) from sensor output to the '

i final actuation device. '

I l

G810130260 GS1006 PDR ADOCK 05000245 P PDC

2. It must havc a standby liquid control system (SLCS) with a minimum flow capacity and boron content equivalent in control capacity to 86 gallons per minute of 13 percent by weight of sodium pentaborate solutten. The SLCS and its injection location must be designed to perform its function in a reliable manner.

3. It must have equipment to trip the reactor coolant recirculating pumps automatically under conditions indicative of an ATWS. This equipment must be designed to perform its function in a reliable manner.

This safety evaluation report addresses the ARI system (Item 1) and the ATWS/RPT system (Item 3). The SLCS (Item 2) was addressed in Technical Specification Amendment No. 5 issued July 30, 1937.

2.0 PEVIEWCRITEly The systems and equipment required by 10CFR50.62 do not have to meet all of the stringent requirements nonvally applied to safety-related equipment. Nowever, this equipment is part of the broader class of structures, systems, and components important to safety defined in the introduction to 10CFR50, Appendix A General Design Criterie (GDC). GDC-1 requires that "structures, systems and components important to safety shall be designed, fabricated, erected and tested to quality standards comer.surate with the importance of the safety functions to be perfonned."

Generic Letter 85-06 "Quality Assurance Guidance for ATWS Equipment that is not Safety Related" details the quality assurance that must be applied to this equipment.

In general, the equipment to be installed in accordance with the ATWS Rule is requi-ad to be diverse frori the existing RTS, and must be testable at power. This equir $r , is intended to provide needed diversity (where only minimal diversity  !

currently exists in the RTS) to, reduce the potential for comon mode failures that  !

could result in er. ATWS leading to u* acceptable plant conditions. The criteria used in evaluating the licensee's submittal include ICCFR50.62 "Rule Considerations Regarding System and Equipment Criteria" published in Federal Register Volun.e 49, No. 124 dated June 26, 1984 and Generic Letter 85-06 "Quality Assurance Guidance for ATWS Equipment that is not Safety Related."

3.0 MILLS 10NE NUCLEAR POWER STATION UNIT 1 ARI & RPT SYSTEM DESCRIPTION Northeast Utilities by letter dated May 5,1987 and supplemental infonnation submitted in July 1988 has provided information regarding conformance with the ATWS Rule. The plant has installed the ARI/RPT system which is composed of two independent divisions. The trip logic is one-out-of-two taken twice; that is, any two high reactor pressure or low reactor water level or a combination of one high reactor pressure and one low reactor water level indications in channel A and C or B trd D will initiate a recirculation pump trip and alternate rod injection. The system can be manually initiated.

The ARI/RPT logic trip systems can be tested while the plant is operating. The test checks the system operation from the sensor output thru the logic to the final actuation devices. The ARI/RPT sensors, logic, actuated devices and the circuits are separate from the RTS, and environmentally qualified to the anticipated operational cccurrence conditions.

The API function can be reset by the ARI reset switches after a 30 second time

]

deley to ensure that the ARI scram goes to completion. The PPT functi~on can be l reset by the RPT reset switches, provided the pennissive signal is presented.

4.0 EVALUATION OF ARI SYSTEM 4.1 ARI SYSTEM FUNCTION TIME 1 The licensee stated that it is expected that'the control , rod c' rives will start to move within 15 seconds and there is a high level of confidence that all rods will be inserted within the 25 second limit. The staff finds that these statements are not sufficient to assure that the ARI system meets the required function time. During a telecon on September 13, 1988, the licensee described two preoperational tists that were perfonned which verified the AP.! function time. The licensee is required to document these test results.

The staff verification of these test results will be part of the post-implementation review to be perfonned by NRC.

l

\

l l

4.2 SAFETY RELATED REQUIREMENTS (IEEE STANDARD-279)

The ATWS Rule does not require the ARI system to be safety grade, but the implementation must be such that the existing protection system continues to meet j

all applicable safety related criteria. 1 The licensee stated that the ARI system is designeci as a safety-related Class 1E  :

system with Class 1E power sources. Any single electrical failure in the ARI l system will not prevent the safety related systems from perfoming their protective ,

functions. This is in conformance with the ATWS rule guidance, and therefore is accepteble.

l 4.3 REDUNDANCY l

The ATWS Rule requires that the ARI system must have redundant scram air header exhaust valves, but the ARI systen itself does not need to be redur. dant. l The Millstone Unit 1 ARI system has redundant scram air header exhaust valves.

Thi initiation and control circuits are redundant. The ARI system perfoms a function redur.c' ant to the backup scram system. This is in confonnance with the ATWS rule guidance, and therefore is acceptatile.

4.4 O!VERSITY FROM EXISTING RTS l

The ATWS Rule requires that the ARI system should be diverse from the existing reactor trip system.

1 i

The ARI system uses energize-to-function valves instead of deenergize-to-function l

valves". It has de powered valve actuators anti logic instead of ac powered valve actuators and logic for the RTS. Four reactor high pressure sensors and four reactor vessel low water level sensors (Rosemount transmitters) are used to detect the ATWS events. The transmitters and circuitry of the ARI/RiT system are diverse I from the reactor trip system (RTS uses Yarway instrument) for level detection and meletron pressure switch for pressure detection.) This is in confomance with the ATWS rule guidance and therefore is acceptable.

^o 4.5 ELECTRICAL INDEPENDENCE FROM THE EXISTING RTS The ARI system sensors, actuation logics, and power supplies are independent from the RTS. The ARI/RPT instrument components are located in separate panels from the RTS. The electrical independence from the existing RTS is in conformance with the ATWS rule guidance and theref>ro i: acceptable.

4.6 PHYSICAL SEPARATION FROM EXISTING RTS The ATWS Rule guidance states that the implementation of the ARI system must be such that separation criteria applied to the existing protection system are rot violated.

The ARI system is separate and independent from the Reatter Trip System. The ARI/RPT system is composed of two independent divisions. The channels of one division are routed independent of the other in accordance with IEEE Standard 384-1977.

Either circuit train can perform the protective action. The separation between the ARI/RPT system and the non-Class IE annunciators is by relay to contact isolation. The staff finds this acceptable.

4.7 ENVIRONMENTAL OVALIFICATION The ATWS Rule guidance states that the qualification of the ARI system is for anticipated operational occurrences only, not for accidents.

2 The ARI system is qualified to the anticipated operational occurrence condition.

The staff finds this acceptable.

4.8 QUALITY ASSURANCE ,

NRC Generic Letter 85-06 datcd April 16, 1985 provides quality assurance guidance for the ARI system. The licensee has committr( to follow thi! ;uitince. The staff finds this acceptable.

l

-f-  !

4.9 SAFETY RELATED (IE) POWER SUPPLY The ATWS Rule guidance states that the ARI system must be capable of perfonning its safety function with loss of offsite power, and that the power source should be independent from the existing reactor trip system.

The ARI system's two divisions are powered from the Class 1E 125 Vdc station batteries. The ARI system is capable of oerfonning its safety functions with loss of offsite power. The ARI power sources are independent from the existing RTS system. The staff finds this acceptable, l

4.10 TESTABILITY AT POWER The A1MS Rule guidance states that the ARI system should be testable at power.

The ARI system is testable from sensor outputs to the final actuation devices while plant is operating. The ARI system uses a redundant 1-out-of-2 coincident logic arrangement. Each individual level and pressure instrument can be tested during plant operation without initiating the ARI system since two signals either level and/cr pressure must be present in the same channel to initiate the action.

A spring-loaded calibration switch is provided at the manual test panel which allows bypass of a channel when that charrel is being calibrated for a short period of time (1 to 2 minutes per channel). If a channel is required to be out i of service for a longer period of time, a keylock switch will be used to trip that channel. The staff fir.h *Ais acceptable.

4.11 INADVERTENT ACTUATION ,

The ATWS Rule guidance states that inadvertent ARI actuation which challenges other safety systems should be minimized.

The ARI system uses coincident logic circuits and two charnels must be tripped to initiate a protective action. The manual initiation also requires the activation of two switches to initiate the action. As a result, inadvertent actuation is minimized. The staff finds this acceptable.

l 4.12 MANUAL INITIATION An ATWS Channel A (A&B) or C (C&D) manual trip pushbutton on the control room  !

panel is used to test the ATWS system. Depressing both the ATKS A train manual trip and the ATWS C train manual trip pushbuttons simultaneously results in an l

ATWS system initiation. The staff finds this acceptable. l l

4.13 INFORMATION READOUT The ARI/RPT system provides alarms in the control room for each division initiation and system malfunction. Pressmce and level ir.dications are provided l frerr each channel. The staff finds this acceptable.

l 4.14 COMPLETION OF PROTECTIVE ACTION ONCE IT IS INITIATED The ARI/RPT system has a seal-in feature for 30 seconds to ensure the completion of protective action once it is initietto. After icidai ccMitior.! return to l

normal, deliberate operator action is required to reset the ARI/RPT system leoic to normal. The staff finds this acceptable.

4.15 CONCLUSION ON ARI SYSTEM Based on this review, the Millstone ARI design basis requirements identified above are in compliance with the ATWS Rule 10 CFR 50.62 paragraph (C)(3) and the guidance published in Federal Register Volume 49 No.124 dated June 26, 1984, and I therefore are acceptable. ,

, i 5.0 EVALUATION OF ATWS/RPT SYSTEM The ATWS/RPT system shares the same instrument sensors and logic with the ARI system. Twotripcoilsareutilizedineachmotor-generator (MG)setgenerator field breaker, with the input logic being one-out-of-twc taken twice. Also the energize-to-function capabilities, diversity, and separation from the existing RTS equipment are provided. The RPT breakers employ separate but non-isolated 4

- _ . _ , . _ - _ , . , _ _ . . _.-_,e ~_.._w.., - y

b

, trip coils and single active component failures cannot affect more than a single division of the ATWS/RPT system. The ATWS/RPT system is environ-mentally qualified to the anticipated operational occurrence conditions.

The 'iicensee has committed to follow NRC Generic Letter 85-06 dated April 16, 1985 which provides quality assurance guidance for the ATWS/RPT system.

The ATWS/RPT system is powered from Class IE station batteries and is continuously available during any loss-of-offsite power event. Therefore, the ATWS/RPT system is capable of performing its safety functions with the loss of offsite power.

The system is testable during power operation except for the pump trip breaker. This is in confomance with the ATPS rule guidance.

Based en this review, the staff finds that the ATWS/RPT design is in compliance with ATWS Rule 10CFR50.62 paragraph (C)(5) and the guidance published in Federal Register Volume 49 No. I?4 dated June ?6,1984, and, therefore, is acceptabic.

A ONS 6.C; TECHNI CAL,,S,P,ECI FJ,CA,TJ The equipment required by the ATWS Rule to reduce the risk associated with an ATWS event must be designed to perfom its function in a reliable manner. A method acceptable to the staff for demonstrating that the equipment satisfies the reliability requirenents of the ATWS Rule is to provide equipment technical specifications including operability and surveillance requirements. The staff will provide guidance on technical specification requirements for the ARI and the RPT systems in a separate document. .

Principal Contributor: H. Li l

l

_ - _ _ - _ _ ___