ML20008G344

Forwards Safety Evaluation Re SEP Topic VI-10.A,testing of Reactor Trip Sys & Engineered Safety Features,Including Time Response Testing

ML20008G344
Person / Time
Site:	La Crosse File:Dairyland Power Cooperative icon.png
Issue date:	06/25/1981
From:	Linder F DAIRYLAND POWER COOPERATIVE
To:	Eisenhut D Office of Nuclear Reactor Regulation
References
TASK-06-10.A, TASK-6-10.A, TASK-RR LAC-7628, NUDOCS 8107070339
Download: ML20008G344 (31)

Text

. _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _.

o v

D IRYLAND COOPERAT/VE

• PO box 817

• 2615 EAST AV SOUTH

• LA CROSSE. WISCONSIN S4601 1608) 788 4 000 June 25, 1981 s

9 03 n reply, please fer to LAC-7628

$$*$g%I'%

KET N0. 50-409 i

U. S. Nuclear !!egulatory Commission o.S ATTN:

Mr. Darrell G. Eisenhut, Director g'p g

Division of Licensing Office of Nuclear Reactor Regulation Division of Operating Reactors Washington, D. C.

20555

SUBJECT:

DAIRYLAND POWER COOPERATIVE LA CROSSE B0ILING WATER REACTOR (LACBWR)

PROVISIONAL OPERATING LICENSE NO. DPR-45 SEP T0FIC VI-10.A, TESTING OF REACTOR TRIP SYSTEM AND ENGINEERED SAFETY FEATURES, INCLUDING TIME RESPONSE TESTING

REFERENCE:

(1) DPC Letter, LAC-7387, Linder to Eisenhut, Dated February 27, 1981 Gentlemen:

Enclosed find Safety Evaluation Report (SER) for SEP Topic VI-10.A, Testing of Reactor Trip System and Engineered Safety Features, including Time Response Testing, which we have prepared for the La Crosse Boiling Water Reactor.

Our letter, Reference 1, identified topics for DPC to submit for NRC evaluation. The subject topics were listed in the schedule submitted with Reference 1.

If there are any questions regarding this letter, please contact us.

Very truly yours, DAIRYLAND POWER COOPERATIVE b4 l

Frank Linder, Geners) Manager FL:RMB: abs CC:

J. G. Keppler, Reg. Dir., NRC-DRO III NRC Resident Inspectors 8107070339 810625 "'

.O

(, / li l

i PDR ADOCK 05000409.

7 P

PDRj i

r.

l 1

TECHNICAL ASSESSMENT OF SEP SAFETY TOPIC VI-10.A FOR LA CROSSE l

l-l l

1 - ---__ _

Y TECHNICAL ASSESSMENT OF ONE SAFETY TOPIC FOR LA CROSSE 1.

VI-10.A: Testing of Reactor Trip System and Engineered Safety Features, Including Response Time Testing TABLE OF CONTENTS I.

INTRODUCTION II. REVIEW CRITERIA III. RELATED SAFETY TOPICS AND INTERFACE IV. REVIEW GUIDELINE V.

TESTING OF RTS AND ESF AT ' '0BWR 1.

Reactor Protection System General Description 2.

Reactor Protection Trip Function 3.

Reactor Protection System Testing 4.

Engineered Safety Features General Description 5.

Engineered Safety Feature Testing Table 1.

LACBWR Technical Specification Operating Limits for RPS and ESF Table 2.

LACBWR Technical Specification Minimum Frequency for Testing, Calibrating, and/cr Checking of Instrumentation for RPS and ESF VI.

EVALUATION AND CONCLUSION l

l l

l l

i i

SAFETY EVALUATION REPORT TOPIC VI-10.A TESTING 0F REACTOR TRIP SYSTEM AND ENGINEERED SAFETY FEATURES, INCLUDING RESPONSE TIME TESTING 1.

INTRODUCTION This SEP safety topic deals with the testability and operability of the Reactor Protection System (RPS) and the Engineered Safety Features (ESF)

Systems.

The RPS test program should demonstrate a high degree of availability of the systems and the response times assumed in the accident analyses to be within the design specifications. This repoi t reviews the plant design to assure that all RPS components are included in the component and system test, the frequency and scope of the periodic testing is adequate, and the test program meets the requircments of the Gederal Design Criteria and the Regulatory Guides defined in Section II of this report.

This evaluation report is limited to a comparison of the RPS and EFS testing program with the review criteria and the review guidelines defined in Section II and IV.

II. REVIEW CRITERIA The following General Design Criteria govern the topic review:

GDC 21 - Protection System Reliability ca.d Testability.

The following Regulatory Guides and Branch Technical Presitions provide acceptable basis for RPS and ESF testing program:

RG 1.22

- Periodic Testing of Protection System Actuation Functions.

l RG 1.118 - Periodic Testing of Electric Power and Protection Systems.

RG 1.105 - Instrument Setpoint.

Branch Technical Position ICSB 24 - Testing of Reactor Trip System and Engineered Safety Feature Actuation System Sensor Response Times.

Standard Review Plan, Section 7.2 and 7.3.

III. RELATED SAFETY TOPICS AND INTERFACES III.12 - Environmental Qualification of Safety Related Equipment.

i l,

IV. REVIEW GUIDELINES 1.

GCC 21 states that the redundancy and independence designed into the protection system shall be sufficient to assure that (1) no single failure results in loss of the protection function and (2) the protection system shall L 3 designed to permit periodic testing of its functioning when the reactor is in operation, including a capability to test channels indvendently to determine failures and losses of redundancy that may have occurred.

2.

Regulatory cuide 1.22 provides the acceptable methods for testing actuation devices and actuated equipment.

3.

Regulatory Guide 1.105 states that instruments should be calibrated so as to ensure the required accuracy of the setpoint. The accuracy of all setpoints should be equal to or better than the ac. curacy assumed in the safety analysis.

4.

Regulatory Guide 1.118 describes the methcd acceptable to the NRC staff of complying with the Commission's regulations with respect to the periodic testing of the protection systen and electric power system for systems important to safety.

5.

Systems important to safety as defined by R.G.1.105 are as follcws: Those systems that are necessary to ensure (1) the integrity of the reactor coolant pressure boundary, (2) the capability to shut down the reactor, cr (3) the capability to prevent or mitigate the consequences of accidents.

6.

Branch Technical Position ICSB 24 states that periodic tests for verification of system response times of RTS should include the response time of the sensors whenever practical.

7.

b' anch Technical Position ICSB 22 states that all portions of the r

protection system should be designed in accordance with IEEE Standard 279-1971 and all actuated equipment that is not tested during reactor operation should be identified and justified to the provisions of Position D.4 in R.G.1.22.

8.

Standard Review Plan, Section 7.2, Appendix A, Items 9,10,11, and 13 provide more specific guidance to review Reactor Trip System Testing.

9.

Verify the following:

a.

Test conditions come as close as possible to the actual performance required by RTS.

l b.

Compliance with the single failure criterion during testing. 1

V e

c.

The results of licensee response time testing data (it available' for the RPS are within the delay times used in the FSAR accident analysis, d.

Test can be made to ensure the readiness or the operability of system components.

e.

The Auto Mode of actuation does nct inhit'it the Manual Mode of actuation, and vice versa, at any time.

f.

The power supplies satisfy the Single failure Criterion.

g.

The overlapping tests indeed overlap from one test segment to another.

h.

Transducer calibrations are adequate.

1.

Comparator calibrations are adequate.

V.

TESTING OF RPS AND ESF AT THE LACBWR PLANT 1.

Reacter Protection System General Description The RPS automatically trips the reactor to protect against reactor core or coolant system boundary damage.

The system monitors and initiates safety action under preset conditions for the following parameters:

a.

Period.

b.

Flux level.

c.

Reactor water level, d.

Reactor pressure.

e.

Power-fl ow.

l f.

Low recirculation flow rate.

g.

Bus voltages.

h.

Condenser vacuum.

1.

Reactor Building main steam isolation, Turbine Building main steam isolation shutoff valve.

J.

Turbine main stop valve.

k.

Individual rod drive accumulator oil level and gas pressure.

1.

Single 2400-volt bus voltage.

~ l

In addition, there are manual scram buttons on the control panel and in the Contairinent Building.

Safety action includes a full 29-rod scram or a partial 13-rod scram.

All of the plant parameters providing inputs to the safety system actuate individual alarms at the main console when a scram signal is i nitiated. Where feasible, anticipatory alarms are also provided to warn the operator of an abnormal condition prior to initiation of scram action. Redundancy and/or backup are provided throughout the system by duplicate full scram channels which monitor the same variable and initiate scram action independently through two independent full scram circuits, and by one partial scram channel which monitors other variables and initiates a partial scram action to bring the reacter to a sub-critical condition before a full scram is necessary.

LACBWR uses 29 VARD control rod drive mechanisms. These CRDM's are independently controlled. Two independent power sources, an electric mor.or for normal or backup scram shimming and an hydraulic scram motor for high speed rod insertion are mechanically linked through a power transmission to the output shaft for each rod drive.

Each hydraulic scram motor has an independent gas pressurized accumulator to provide positive shutdown capabilitics in the event of a loss of electrical power.

Two redundant trains of circuitry provide full scram capabilities.

Each CRDM has a parallel solenoid valve controlling the hydraulic fluid to the scram motor. One of the coils of the dual solenoid is powered frcm one scram circuit train and the second coil from the redundant scram circuit train. Either coil de-enargizing is sufficient to provide a con'N1 rod insertion within the specified time in the LACBWR Techn'.ui Specifications.

The RPS is designed on a channelized basis to achieve independence between redundant protection channels. Due to the age of the plant, the design of the RPS mainly requires a one-out-of-two trip logic.

Any single failure of a protection channel may result in a plant scram. Any single failure which does not cause a scram will not prevent other parameters in its associated train or in the redundant train from providing the required scram protection.

l The reliability of the LACBWR facility has not been greatly l

affected by safety system instrument failures in the 14 years of plant operation.

All reactor protection channels are provided with sufficient redundancy to permit channel calibration and testing. Bypass switches are provided for periodic testing of individual parameters.

Bypassing a paramater in one protection train does not disable the other parameters in the same train from initiating a protective L

W action. Actuation of any RPS bypass switch is annunciated in the Control Room. Figure 8.17 of the SAR shows the redundant and independent full scram circuits. Neither the manual mode nor the automatic mode overr!de or prevent the other mode from performing the required safety function. The partial scram circuit is shown in Figure 8.17A of the SAR. These figures are reproduced on the following pages.

Where possible, physical separation has been used to ach..

isolation of redundant transmitters. Due to the design and size of the plant, the criteria that was used whea the facility was constructed did not provide for the separation of field wiring.

The power supplies to the channels are fed fran three instrument buses. All of the buses are supplied by inverters.

Each bus is energized from a separate d-c power feed. Each reactor trip circuit is designed so that a trip occ.cs when the circuit is de-energized.

An open circuit or the loss of channel power, therefore, causes the system to go into its trip mode. Reliability and independence are obtained by redundancy within each tripping function.

In a one-out-of-two circuit, the thannels are equipped with separate primary sensors and each channel is energized from an independent electrical bus. A single failure may be applied in which a channel fails to de-energize when required; however, such a malfunction can affect only one channel. The trip signal furnished by the remaining channel is unimpaired in this event.

2.

Reactor Protection Trip Functions a.

Manual Trip A manual trip is provided to permit the operators to trip the reactor. The manual actuating devices are independent of the automatic reactor trip circuit *y and are not subject to failures which could make the automatic circuitry inoperable.

Two manual switches on the operator's bench actuate a full and partial scram by directly de-energizing full or partial scram relays in the rod control part of the system. A third manual switch located in the Containment Building de-energizes the full-scram relays and actuates an annunciator on the main control panel. Each of the full scram switches has redundant contacts so that a full scram will be initiated in both full scram circuits.

b.

Period Protection (Intermediate Range)

An all rods reactor scram is initiated upon abnormally short periods in one-out-of-two intermediate range neutron monitoring channel s.

This trip protects the core from a raf fdly increasing power escalation.

V r

G0v c ual21 R33 TEST ni

.g hTEST Pst - dhRN BLt>c MCC. Ik

'EST Pe2 h n [EpS5 2

h.fd v OPE'.M OM UuCERVot T"AC,E T 8)bjNA1NT E LN OM 1 1 M'X) BUS i A 2400 EUS IE I le T T 227 Ax^

227si: T-LCW VOLTAGE

}CTEAC*

427 RXA.[-

GEcTO4 eu:LOiNG

~

~ ~

MOTC4 CONT 40L CEt4TER IA 548 /i i Tu w au:twr, Igien LSI:

und STEau SiCP

Lc2 T BY PS5 Br FASS T vAtvE noi rutL o;Es S19/i1 PEAOT04 EgitCING 1 e 49f 2, t.Sn Vain STE Av '50dTION

LS:

SY FASS T

\\ALVE t.GT rUtt CPEN T Sf %s S 20/t 1

. LCW CCNCENSER LON CO*.:ENSE:

1 520/2 BY PAS 5 T

' vats Y I

' ACc u 2 TEr#453 5-8 1

' v00E SK VODE 5.'.

-f S-5 Sf 155 B f-? ASS "

g.g c:,,,;;gg egg 7;; 3,g:,

5:aAu T LEVEL i?^ l LE.E. LPA 2 S::Av

' 'Ej ? - -

TE5'_C %2 1:EA-' :. 2Em

E CT;; AATE

.

+

'--5; BY-No

" LE.EL - :m i LEVEL W 3" 2 ?

S 10 l

1 5?

Ev PASS

.. E :n v0D' 5A 2 i "= S T

f :EcT:: ::E33.:E

EcT : ::E33.:t s:::v S-TEs'uvC2

-t-:

7 E:t C-i e< 2A55 e : 53 v::E :.t :

v::E s.s POWER.rtow 2 {ry [ $3'-

-Ydh3 y y.POAERFLOW8 4 tow ru)w t te* ivw ~z 5 V 3- "/3 S-v/3 =

.6 1

.s3 N :- 2 t:G. C. :

1 :7 BY A55J

~ :E4 02 < 3 5-C

E'100 < 3 5E

"

T i'- ^ai-I 1

, W S."n.1

.a.

1

1..

.w Cu 1 S^:w

.u.

3:A35

.T I.,

w5 sy Ass

.I I.-a

c. C.

<-.*4.,

, 9. 'O 5"'55 C n :., t. F1I +:" ;

. m ss TJ % r F. f. 7 Ilt-2.

5-s I'w3 S-3 J. I

~~ 6 I I :..

SKK,/s :

a Sc6/I 5C6/2 "

Sv.i6/

T Pe6 &

"$$Tc$$5il"

- & E6 VANUAL FUtL SC:AV

_ g" PE

pg,po C0t4SCLE PES l

SC;AV[i-

^ Kl!4/l PE9 "f-

Kil4/2 ESET

{

SC;Av RESETx Ruerog WATER LtdtL G K-E.25

$=Y l

Low J EVPA15 l

• 114 /1 Ktt4/2 I

[,

~

dr/O FULL SCRAM CIRCUITS Revised FIG. 8.17 8-

120V AC E

~

O LOW VOLTAGE i

2400V BUS IA e.-

1 f-l 2 2 7 A X A ::-

227AXC

.i

, _ ~ _ _,

1 l

LOW VOLTAGE 2400V BUS IB 2 27B X A ::

-- 227 BXC T

S-14 1

__ TURBINE STCP VALVE BY-PASS --

N0. FULL OPEN t

S-15 INDIVID.'AL CONTRCL ROD drive BY-PASS T I Accum.'0it LEvEt tow S-16 INDIVIOUAL CONTROL ROD DRIVE BY-PASS --

ACCUM. GA5 PRESSURE LOW u

MANUAL PARTIAL 77 PB3 SCRAM-CONSOLE e

DA9TI AL o

SCRAM PB7"-

Kil5 RESET

[ Kils r

PARTIAL SCRAM CIRCulT Revised FIG. S.17A I

c.

Flux level Protection (1) At power levels less than approximately 15%, a i

one-out-of-two trip logic from the two extended power range neutron monitors provides a high flux level all rods reactor trip.

(2) At power levels greater than approximately 15%, a two-of-four coincident trip lcgic from the two extended and two narrow power range neutron monitors provides a high flux level all rods reactor trip.

d.

Reactor Water Level Three reactor water level channels provide input for a low reactor water level all rods scram. A low water level condition in Channel 1 or Channel 3 will initiate an all rods scram in one protection train and Channel 2 provides the input for the other protection train.

On an abnormally high reactor water level, channels 1 and 2 in a ane-of-two trip logi<: initiate an all rods scram.

e.

Reactor Pressure Two reactor pressure channels are connected in a one-out-of-two trip logic to provide an all rods scram for an overpressure condition in the system.

f.

Power-Flow Comparisons of the two narrow range power channels and the total flow from the recirculation loops provide a one-out-of-two trip l ogic. An all rods scram is initiated if the value of flow drops below the required level for the existing power.

g.

Low Recirculation Flow Rate The reactor protection system in a one-out-of-two logic will initiate an all rods scram if the recirculation flow drops oelow a preset value.

h.

Bus Voltages (2400-Volt Main Bus, 480-Volt Reactor MCCIA, and 480-Volt Turbine Building MCCIA)

An undervoltage condition on both 2400-volt main buses or either 480-volt bus will initiate an all rods scram on redundant protection trains. Phase A is monitored for one train and Phase C for the redundant train.

c i

W 1.

Main Condenser Vacuum Loss of condenser vacuum below a preset value in onc rut-of-two channels initiates a full scram.

j. Reactor / Containment Building Main Steam Isolation Valve and Turbine Building Main Steam Shutoff Valve The Reactor / Containment Building steam isolation and Turbine Building steam isolation valves actuate a full scram when either is not in the full-open position. Travel limit switches that are an integral part of each valve have redundant output contacts.

k.

Turbine Main Stop Valve A 13-rod partial scram is initiated when the limit switch indicates the valve has left its full open position.

1.

Individual Rod Drive Accumulator Oil Level and Gar, Pressure Level and pressure sensing devices monitor individual CRDM's and initiate a partial scram if either parameter falls below a preset value.

m.

Single 2400-Volt Bus Voltage An undervoltage condition on one of the two 2400-volt main buses initiate a partial scram.

3.

Reactor Protection System Testing a.

Protective System Capability for Testing and Calibration The relays of the protective systems provide trip signals only after signals from the digital or analog portions of the system l

have reached a preset value.

l The capability is provided for calibrating and testing the l

performance of the bistable portion of protective channels during reactor operation.

All analog and digital tr' ' signals are capable of being l

byp*ssed during reactor operation except the 480-volt TB MCCIA, 480-volt Reactor Building MCCIA, and the 2400-volt main buses iA and 18. Due to the design of the plant electrical distribution system, these 480-volt and 2400-volt buses are tested at each refueling outage.

Although bypass switches are provided for the Generator Plant i

Shutoff Valve, Reactor Plant Main Steam Valve and Condenser Vacuum, tnese parameters are tested only when the plant is in a shutdown mode. Due to physical and/or electrical interconnections, plant operations wou?d adversely be affected.

The analog portion of a protective channel provides signals of reactor or plant parameters. The following means are provided to permit checking of the analog portion of a protective. channel during reactor operation:

(1) Varying the monitored variable.

(2)

Introducing and varying a substitute transmitter signal.

(3) Cross-checking between identical channels or batween channels which bear a known relationship to each other and which have readouts available.

This design permits administrative control of the:

(1) Means for manually bypassing channels or protective functions.

(2) Access to all trip settings, module calibration adjustments, test points, and signal injection points.

b.

Reactor Trip Signal Testing Provisions are made to manually bypass individual parameter relay trip contacts for testing portions of a specific trip circuit.

Provision is made for the insertion of test signals in each analog loop. Verification of the test signal is made by station instruments at test points specifically provided or designated by procedure for this purpose. This allows testing and calibration of meters and bistables. Transmitters and sensors are checked against each other and can be monitored by precision read-out equipment durir.g normal power operation.

c.

RPS Analog Channel Testing The basic elements comprising an RPS analog nrntaction channel consist of a transmitter, power supply, am, lifier, and bistable comparator.

Administrative procedures require that the channel to be tested be bypassed prior to testing to prevent a scram in the one-out-of-two logic. The bypassing of a reactor trip function is annunciated in the Control Room. At the completion of testing, the bypass switch is returned to nonnal which clears the annunciator alarm.

Actual channel calibration is conducted by injecting a calibrated test signal into the current loop or instrument circuit and verifying proper accuracy and response.

Transmitters ar other sensing devices except the nuclear ir,strumentation are_ calibrated by varying the process signal.

All testing is done at the frequencies indicated in the Plant Technical-Specifications (Table 2).

l,

W d.

RPS Channel Testing The general design features of the RPS logic are described bel ot.

The trip logic for a typical one-out-of-two trip function are shown in Figure 8.17 of the SAR.

The reactor trip relays de-energize to trip and are tested at the prescribed frequencies in the Plant Technical Specifications (Table 2).

The full scram relays (K-114/1 and K-114/2 on Figure 8.17 of the SAR) which control slave relays to the rod drive scram solenoids are de-energized to perform their safety function. These relays are actuated monthly to prove operability.

In addition to the calibration and tests performed on the RPS, time response tests are conducted on the control rods in accordance with the Plant Technical Specifications. Each of the 29 control rods is individually time tested from the fully withdrawn to the fully inserted position.

The rod scram timer is utilized to measure the lapsed time beginning with the operation of full scram relay K114 and ending with the closing of the rod full-in relay of the selected rod under test.

The instrument strings from sensors through the bistable devices are not time response tested. The operating experience over the past 14 years with the installed plant equipment in conjunction with the ongoing calibration and '.esting program gives a high assurance of instrument reliabi;ity and operability-4.

Engineered Safety Features General Description Engineered safety features (ESF) are provided in the facility to mitigate the consequence of the design bases accidents.

ESF's have been designed to cope with any size reactor coolant pipe breaks, up to and including the circumferential rupture of any pipe assuming unobstructed discharge from both ends.

They are also designed to cope with any steam or feedwater line break, up to and including the main steam or feedwater headers.

ESF's in the La Crosse plant are conprised of the following systems:

l a.

High Pressure Core Spray b.

Alternate Core Spray c.

Containment Isolation d.

Shutdown Condenser

a.

High Pressure Core Spray Sy:: tem The Emergency Core Spray System consists of a spray header with individual spray lines for each fuel assembly mounted inside the reactor vessel, two positive displacement-type pumps which take suction from the 42,000-gc11on Overhead Storage Tank or the high pressure service water heeder.

The two Emergency Core Spray Pups are positive displacement-type pumps rated for 50 gpm at a design pressure of 1450 psig. The motors are supplied from Essential Bus IA and Essential Bus 1B respectively.

The pumps are installed in parallel to supply 100 gpm of water to the spray header whenever the indicated reactor water level is -12 inches or less. An all rod scram shall have taken place.

Neither pump can be started manually by placing the pump switch in the " START" position unless an all rod scram condition exists. The ccre spray pumps will start from Containment Building pressure switches at 5 psi and above. Switch 37-35-701 starts pump 1A and 37-35-702 starts Pump 18.

All the manual and remote operated valves in the flow path from the Overhead Storage Tank, through the positive displacement pumps, to the spray header are open whenever the reactor is pressurized and no boron injection has been initiated.

b.

Alternate Core Spray System The Alternate Core Spray System consists of two diesel-driven H.P. service water pumps which take a suction from the Mississippi River and discharge through duplex strainers to two motor-operated valves installed in parallel.

4 The diesel-driven pumps are located in the Crib House. They are installed in parallel; both pumps serve the Alternate Core Spray System and Fire Suppression System.

The Emergency Service Water Supply System was recently installed to provide a backup pumping source to the diesel driven pumps.

This system consists of three portable engine driven pumps joined by a common manifold and connected to the alternate core spray piping at the Turbine Building by a high volume 5-inch hose. -Either pumping system is capable of delivering the required capacity.

When Containtnent Building pressure exceeds 5 psig, both diesels will start automatically and supply cooling water to the reactor vessel 4-inch nozzle through two motor-operated valves which open automatically when Containment Building pressure reaches 5 psig coincident with reactor vessel level of -12 inches.

[

a f.

The cooling water falls from the 4-inch nozzle down through the tube bundle of the High Pressure Core Spray System, impinges on the perforated flow deflector plates, and then flows through the deflector plates downward through the core. A 3-inch skirt is welded on the outer periphery of the deflector plates to provide for even distribution of the cooling water to all fuel elements.

Flow to the vessel commences when reactor vessel pressure drops to approximately 150 psig. A minimum flow of 900 gpm is reached when reactor vessel pressure drops to 50 psig. Flow terminates by automatic closure of the two motor-operated valves on recovery of vessel level above the low-level scram point of

-12 inches. Manual closure of the valves and/or manual trip of the diesels will also terminate flow, c.

Containment Isolation Containment isolation is initiated automatically by various Reactor System and Containment Building parameters. The enclosed table lists the containment penetrations that are automatically closed on one or more of the containment isolation si.jnals.

All containment utomatic isolation valves are pneumatically or hydraulically actuated and will fail closed on lose of electrical power to their control circuits.

Containment integrity must be established within a short time after a major system rupture to prevent escape of fission products from melted fuel elements to the outside atmosphere.

Valves in the piping and duct work that penetrate the containment vessel assure containment integrity in the event of a rupture, and they permit isolation of the containment atmosphere when desired. The criteria for the number, placement, and operation of the valves are as follows:

(1) Two va.lves in series are used at containment penetrations for piping connected directly to the primary system. At least one of these valves closes automatically following an accident, unless one is nonnally closed during plant operation. The second valve is operable either from the Control Room or from some other location which will be accessible after an accident. The valves are on different sides of the Containment Building wall.

(2) Two isolation valves in series are also used for any piping open to both the building atmosphere and to the outside atmosphere. Unless one of the valves is normally closed, at least one of the valves must be a quick-closing fail-safe valve interlocked to prevent reopening until conditions are safe. The second valve is operable either from the Control Room or from.some location which will be accessible after an accident..

(3) Piping that is open to the outside atmosphere but that enters and leaves the Containment Building without being open to the Containment Building atmosphere or to the primary system does not require isolation.

Isolation is required for this type of penetraticn, however, if its chances for rupture are significantly increased by the conditions that require containment isolation.

Piping penetrations open to the primary system are the 10-inch main steam line and bypass, the 8-inch feedwater return line, the 2-inch blowdown line from the decay heat system to the main condenser hotwell, the shutdown condenser off-gas vent line, and the low-pressure emergency core spray system.

The steam line has a rotoport valve (Main Steam Isolation Valve) in the Containment Building that can be manually controlled from the Control Room and that closes automatically within 10 seconds after receiving a signal caused by low steam pressure at the turbine stop valve, low vacuum in the main condenser, or low reactor water level.

The Containment Building MSIV bypass valve is pneumatically controlled and is shut during normal plant operations.

Although, it is nonnally shut, the bypass valve will close automatically on the same signals that actuate the MSIV.

A second main steam line isolation valve in the Turbine Building is motor-operated by a signal from a control switch in the Control Room.

The 8-inch feedwater return line has both a check valve and a shutoff valve.

The check valve is in the Contaiment Building and fulfills the requirements for automatic closure.

The i

shutoff valve is in the Turbine Building and has a valve operator that is actuated from the Control Room.

The 2-inch blowdown line (3 inches at the Contaiment Building penetration) from the decay heat system has a control valve in l

the Containment Building and manual valves in the Containment Suilding and piping tunnel area. The control valve is normally closed during plant operation.

In addition, the control valve can be operated from the Control Room and is automatically closed upon receipt of a low reactor water level signal from the reactor safety system.

l The shutdown condenser system contains control valves which nomally isolate the system from the primary system when the plant is operating. When the shutdown condenser is operating and the automatic off-gas vent control valve is open, the 1

off-gas passes to the radioactive waste gas disposal system which is designed for contaiment and automatic control of the radioactive gases. A manual gic valve in the off-gas vent line in the piping tunnel area r."mits manual isolation of the line.

w e

The alternate core spray system has two check valves in series inside of containment, and it has a manual isolation valve outside of containment in the Turbine Building.

Penetrations which are open to both the Containment Building and outside atmospheres include the ventilation inlet and exhaust ducts, the off-gas vent header from the Containment Building, and the two vacuum breaker lines. Each ventilation duct contains two quick-closing butterfly valves in series. All these valves can be manually controlled from the Control Room; and they will close automatically after receiving a signal caused by high Containment Building pressure or high reactor pressure, or upon receipt of a high radiation signal from the gaseous or particulate monitors in the ventilation exhaust duct.

These valves are spring-loaded and they are held open by a pneumatic cylinder so that they fail in the closed position on loss of air or electricity.

The off-gas vent header from the Containment Building contains a control valve on each side of the containment vessel wall. The control valve inside the Containment Building is automatically closed upon receipt of a signal caused by high reactor pressure, high radiation or by high pressure of the Containment Building atmosphere. The control valve in the piping tunnel area can be manually closed from the Control Room.

Three additional containment penetrations are automatically closed on a high Containment Building pressure or low reactor water level signal. These small pneumatically controlled valves isolate the heating steam condensate return, retention tank discharge, and shutdown condenser leg drain. Manual isolation outside containment is possible on all of these lines.

The piping penetrations for the vacuum breakers are an exception l

to the criteria, since shutoff valves are not placed in these lines. Valves in these lines would constitute a hazard to containment vessel integrity should an excessive external differential pressure exist during an inadvertent closing of a l

building isolation valve.

l I

i l

l 1

i t I

V t'

Containment Isolation Signal Table Contairment Radiation Monitor High Containment Building Ventilation Dampers 4-Inch Yent Header Valve Containment Building Pressure High Containment Building Ventilation Dampers 4-Inch Vent Header Valve Retention Tank Discharge Heating Steam Condensate Return Decay Heat Blowdown Shutdown Condenser Condensate leg Drain Low Water Level Channels 1 and 2 Containment Building Ventilation Dampers 4-Inch Vent Header Valve Retention Tank Discharge Valve Decay Head Blowdown Valve Heating Steam Condensate Return Shutdown Condenser Condensate Leg Drain Reactor Building Main Steam Isolation Valve Reactor Building Main Steam Isolation Bypass Valve Low Steam Line Pressure and Low Vacuum Reactor Building MSIV Reactor Building MSIV Bypass Reactor Pressure High Containment Building Vent Dampers 4-Inch Vent Header Valve The containment isolation signals can be reset in the Control Room. All control circuits have been modified to prevent automatic reopening of any valve when the initiating signal is reset.

e e

[

d.

Shutdown Condenser The shutdown condenser is located on a platform 10 feet above the main floor in the Reactor Building. Steam from the 10-inch main steam line passes through a 6-inch line, two parallel inlet steam control valves, back to a 6-inch line and into the tube side of the condenser where it is condensed by evaporating cooling water on the shell side. The steam generated in the shell is exhausted to the atmosphere through a 14-inch line which penetrates the Reactor Building. An area monitor is located next to the steam vent line near the containment shell penetration in order to detect excessive activity release in the event of a shutdown condenser tube failure. The main steam condensate is collected in the lower channel section and returned to the reactor vessel by gravity flow. The condensate line leaving the condenser is a 6-inch line along the horizontal run and is reduced to 4. inches for the remainder of the vertical section. Two parallel condensate outlet control valves are located in the 4-inch return line. The condensate line also contains two 2-inch vent lines which join together and return to the laver channel secticn of the condenser. The vents are provided for returning any vapors and/or noncondensible gases which are carried into the condensate line back to the condenser. The lower channel scction in turn is vented to the off-gas system through a 1-inch vent line. Flow in this vent line is restricted by 1/16-inch orifice, which is built into and is an integral part of the Shutdown Condenser Off-Gas Control valve seat.

A vent line containing two parallel control valves is connected to the 6-inch condensate return line. The valves discharge l

directly to the Reactor Building atmosphere and will be used, in l

an emergency, to vent air from the reactor vessel in the event that it should become necessary to flood the Reactor Building due to a large leak below the reactor core. This would permit i

(

the water level in the building to equalize with that in the reactor vessel.

i Cooling water to the shell of the condenser is supplied by two l

3-inch lines from two independent sources. The normal supply is from the Demineralized Water System. Should the normal supply fail, the backup supply automatically takes.over in maintaining the water level in the condenser shell.

The shell and tube sides each have drain lines which join l

together and are piped to the retention tanks. The drains permit draining and blowdown of the shell side and draining of the tube side. The shell side drain line has a sample connection. Vents are provided in the system to aid in filling l

for hydrostatic test.

i f

r.

N During normal plant operation, the manual system isolation valves are open and the condenser is isolated from the main steam system by the air operated control valves. Two steam inlet control valves, installed in parallel, each having a manual shutoff valve, and two condensate outlet control valves, also in parallel operation, each having a check valve and a manual shutoff valve are provided to assure operation of the shutdown condenser when needed in spite of any single fault.

Startup and operation of the shutdown condenser is completely automatic.

5.

Engina red Safety Feature Testing a.

The fligh Pressure Core Spray and Alternate Core Spray System are periodicclly tested in accordance with the Technical Specifications (Table 1). The required initiating signals are simulated by using mechanical or electrical test inputs to actuate the required safety actions. Performance parameters are measured to assure the capability of the system.

b.

Containment isolation valve timed closure tests are conducted prior to every cold startup but not more often than every 30 days. The closure signals are generated by simulating a trip condition by mechanical or electrical signals as close to the sensor as possible to test the major portion of the trip chain.

VI. EVALUATION AND CONCLUSION Based on the information available, the La Crosse plant testing program for the Reactor Trip System and Engineered Safety Features in general are in conformance with the reliability and testability criteria discussed in Section II of the report. The following listed items summarize the major deviations from the criteria:

1.

The IEEE Standard 384-1977 and 279-1971 were used as a guide to compare the La Crosse plant design. Sections 4.5.1 and 5.1 of IEEE-384 and Section 4.22 of IEEE-279 that dea' with identification and separation of Class IE equipment and cables is not satisfied.

The design and construction of the La Crosse reactor predates the IEEE Standards 279 and 384 initial issue.

2., Some test procedures require the lifting of leads and/or the installation of jumpers to block equipment operation. This is not

.. in conformance with IEEE 279-1971, Section 4.13 and 4.20.

The design and construction of the La Crosse reactor predates the proposed standard in August 1968. These deviations from the standard are incorporated in the procedure to assure the systems are returned to normal at the end of the test.

l.,

~

3.

Due to the physical construction of the Main Steam Isolation Valve and Turbine Building Steam Isolation Valve, redundant limit switch contacts are actuated by a common arm or rotating cam. This common j

linkage is not in accordance with Section 4.2, " Single Failure Criteria," of IEEE Standard 279-1971.

The design and construction of the la Crosse reactor predates the original IEEE Standard 279.

i J

I l

m CONDENSED FROM TECHNICAL SPECIFICATIONS TABLE 1 OPERATING LIMITS Keyswitch Bypass Item No.

Condition Channel cg, Sensor Set Point Action Provisions 1

reactor two of four nuclear Table full scram none power high channels 5, 6, 7, and 4.0.2.2.1-1 8'if power level is >

5% of full power either nuclear channel Table full scram one channel may 5 or 6 if power level 4.0.2.2.1-1 be bypassed for is < 5% of full power calibration and testing 2

reactor nuclear channel 3 or 4 Table full scram (1) both channels period short 4.0.2.2.1-1 may be bypassed e

only when reactor y

power exceeds 3 Mwt (2) one channel may be bypassed for calibration and testing 3

reactor pressure safety channel

< 1325 psig (1) full one channel may pressure 1 or 2 scram be bypassed for high (2) shutdown calibration and coadenser testing operates (3) closure of venti-lation dampers and 4-in. vent header valve from reactor building 4

reactor power-flow safety Tabic full scram one channel may coolant Channel 1 or 2 4.0.2.2.1-1 be b passed for flow rate c$sking a bn orinal t

TABLE 1 - Operating Limits (Continued)

Keyswitch Bypass Item No.

Condition Channel or Sensor Set Point Action Provisions 5"

reactor power-flow safety channel Trble full scram one channel may coolant 1 or 2 4.0.2.2.1-1 be bypassed for flow rate calibration and low testing i

6 reactor water level safety Table (1) full water level channel 1 or 2 4.0.2.2.1-1 scram one channel may high be bypassed for calibration and testing (1) Nominal indicated unvoided saturated water level shall be permitted to vary from 2 ft. 9 in.

above the fuel to up to 4 ft. 6 in. above the fuel during reactor heat up and operation).

7 reactor water level safety

< 12 in.

(1) full one channel of water level channel 1 or 2 Helow nominal scram Item No. 7 or m

low indicated (2) initia-channel 3 of Item I'

level tion of No. 7A may be high bypassed for pressure calibrati9n and core testing.

spray pumps.

(3) closure of reactor building steam isolation valve and its bypass (4) prevention of reac,ir blowdown through decay heat cooling system

• P = reactor power level, % of full power F = circulation flow rate, % of full flow (30,000 gpm)

~ - -.

TABLE 1 - Operating Limits (Continued)

Keyswitch Bypass Item No.

Condition Channel or Sensor Set Point Action Provisions 7A reactor water level safety

< 12 in.

(1) full one channel of water level channel 3 below nominal scram Item No. 7 or low indicated (2) initia-channel 3 of Item level' tion of No. 7A may be high bypassed for pressure calibration and core testing spray pumps 8

main con-vacuum switches 1 or 2

> 19 in. Hg.

(1) full (1) one channel denser scram may be by-vacuum low (2) closure passed during of reactor calibration building and testing n,

a steam (2) may be by-e isolation passed during valve plant startup and shutdown 9

reactor reactor building steam

> 90% full (1) full (1) may be by-building isolation valve closure open travel scram passed during steam iso-relays 1 or 2 (2) shutdown plant startup lation condenser or shutdown valve not operates (2) may be by-fully open passed during plant startup or shutdown 10 turbine turbine building steam

> 90% full (1) full (2) may be by-building isolation valve closure open travel scram passed during steam iso-relays 1 or 2 (2) shutdown testing lation condenser valve not operates (2) may be by-fully open passed during plant startup or shutdown

TABLE 1 - Operating Limits (Continued)

Keyswitch Bypass Item No.

Condition Channel or Sensor Set Point Action Provisions 11 turbine limit switch Table partial (1) may be by-stop valve 4.0.2.2.1-1 scram passed during i

not fully testing open (2) may be by-passed when-ever the 4

turbine load is less than 10 Mwe I

12 low oil limit switches Table partial (1) may be.by-level in 4.0.2.2.1-1 scram passed during any control testing rod drive (2),may be by-accumulator

' passed prior s,

us to withdraw-a ing control rods in order to charge accumulators 13 low gas pressure switches Table partial (1) may be by-pressure in 4.0.2.2.1-1 scram passed during i

any control calibration 1

rod drive and testing accumulator (2) may be by-passed prior to withdraw-ing control a

rods in order to charge accumulators i

s a

TABLE 1 - Operating Limits (Continued)

Keyswitch Bypass Item No.

-Condition Channel or Sensor Set Point Action Provisions 14 low voltage 2400 v bus 1A under-Table partial none (for a time voltage relay 1 or 2 or

~

4.0.2.2.1-1 scram longer than 2400 v bus 18 under required for ' voltage relay 1 or 2 reserve feed breakers to operate auto-matically) 2400 v bus IA under-Table full scram none voltage relay 1 and 2400 4.0.2.2.1-1 y bus 1B undervoltage relay 1 or 2400 bus 1A under voltage relay 2 and 2400 v bus IB under-Si voltage relay 2 i

reactor building motor Table full scram none control center IA relay 4.0.2.2.1-1 1 or 2 15 low main main steam pressure

), 1000 psig closure of may be bypassed steam transmitter reactor during plant pressure building startup or shut-steam iso-down lation valve

TABLE 1 - Operating Limits (Continued)

Keyswitch Gypass Item No.

Condition Channel or Sensor Set Point Action Provisions 16 reactor reactor building pressure 1 5 psig (1) initi-none building transmitter 1 or 2 ation pressure of high high pressure Core spray pumps (2) closure of venti-lation

dampers, 4 in. vent j

header valve from e

reactor y

building and r

retention tank pump discharge valve 17 reactor radiation monitors

< radiation closure of none building Tevels which ventilation ventilation correspond dampers i

exhaust to Column 2 of the limitations give in Sec.

4.2.7.2 18 simultaneous reactor building 1 5 psig and opening of high reactor pressure transmitter

< 12 in.

motor opera-building 1 or 2 and reactor Tiel ow nomi-ting valves pressure and water level safety nal indicated and start of reactor low channel 1 or 2 level engine driven water level pumps of low pressure coolant in-jection system

r h

f.

CONDENSED FROM TECHNICAL SPECIFICATIONS TABLE 2 MINIMUM FREQUENCIES FOR TESTING, CALIBRATING, AND/0R CHECKING OF INSTRUMENTATION CHANNELS

~ ACTION MINIMUM FREQUENCY

1. Reactor Water Level Calibration Monthly when in service.

• Test Monthly when in service and prior to each reactor startup if test has not been performed within 30 days.

Check Daily.

2. Reactor Pressure Calibration At each refueling shutdown.

• Test Monthly when in service and prior to each reactor startup of test has not been performed within 30 days.

Check Daily.

3. Reactor Power - Flow Calibration At each refueling shutdown.

)

• Test Monthly when in service and prior to each reactor startup if test has not been performed within 30 days.

Check Daily.

4. Reactor Coolant Flow Rate Calibration At each refueling shutdown.

Low

• Test Monthly when in service and prior to each re. : tor startup if test has not been performed within 30 days.

5. Intermediate Range Test {10-10 Prior to each reactor startup (Channels 3 and 4)

& 10- Amps; if test has not been performed Period *)

within 30 days.

Check Once per shift when in service.

~

- l l

I TABLE 2 MINIMUM FREQUENCIES FOR TESTING, CALIBRATING, AND/0R CHECKING OF INSTRUMENTATION CHANNELS ACTIO!!

MINIMUM FREQUENCY

6. Wide Range and Power Range Check %By Heat Monthly when in service.

(Channels 5, 6, 7, and 8)

Balance

a. Nuclear Instrumentation

• Test Monthly when in service and and Automatic Gain prior to each reactor startup Control Subsystem if test has not been performed within 30 days.

b. Nuclear Instrumentation Check Once per shift when in and Automatic Gain service.

Control Subsystem

c. Automatic Gain Control Calibration At each refueling shutdown.

Subsystem NOTE: Testing of the Nuclear Instrumentation and Automatic Gain Control Subsystem shall be done concurrently.'

7. Full Scram Circuits Test f/ Hot Once a month.

Short By Means of Builtin Test Switch

8. Main Condenser Vacuum Calibration At each refueling shutdown.

• Test Prior to each plant startup if I

test has not been performed within the last 30 days.

l

9. Reactor Building Pressure Calibration At each refueling shutdown.

l l

10. Low Main Steam Pressure Calibration At each refueling shutdown.

l ll.' Reactor Building Main

• Test Prior to each plant startup if Steam Isolation Valve test has not been performed within 30 days.

12. Turbine Building Main

• Test Prior to each plant startup if Steam Isolation Valve test has not been perfonned within 30 days.

l l

l..

s-l TABLE 2 MINIMUM FREQUENCIES FOR TESTING, CALIBRATING, AND/0R CHECKING OF INSTRUMENTATION

~

CHANNELS ACTION MINIMUM FREQUENCY

13. Reactor Building MCC 1A

• Test At each refueling shutdown.

Undervoltage Relays

14. 2400-Volt Buses IA and IB

• Test At each refueling shutdown.

Undervoltage Relays

15. CRD Accumulators Low 011 Test Prior to each plant startup if Level Scra:n Relay test has not been performed within 30 days.

16. CRD Accumulators Low Gas Test Prior to each plant startup if Pressure Scram Relay test has not been performed within 30 days.

Check Weekly.

Pressure Indication

17. Turbine Stop Valve Test Prior to each plant startup if test has not bee.; performed within 30 days.

• Test shall include tripping of the scram relays K-114.

i

-