ML22292A068
Text
NMP Unit 2 USAR Chapter 07 Rev. 25, October 2022 APPENDIX 7A SPECIAL STUDIES
NMP Unit 2 USAR Chapter 07 7A.1-1 Rev. 25, October 2022 APPENDIX 7A SPECIAL STUDIES 7A.1 AUXILIARY RELAY AND OPTICAL ISOLATOR TESTS CONCERN (QUESTION F421.13)
Various instrumentation and control system circuits in the plant rely on certain devices to provide electrical isolation capability in order to maintain the independence between redundant safety-related circuits and between safety-related circuits and nonsafety-related circuits. Provide the following information:
(1) Identify the types of isolation devices which are used as boundaries to isolate nonsafety-related circuits from the safety-related circuits or to isolate redundant safety-related circuits.
(2) Provide a summary of the performance characteristics from the purchase specifications for each isolation device identified in response to part (1) above.
(3) Describe the type of testing that was conducted on the isolation devices to ensure adequate protection against the effects of electromagnetic interference, short-circuit failures (line to line to ground), voltage faults, and/or surges.
RESOLUTION The following list identifies the types of isolation devices that are used to isolate nonsafety-related circuits from the safety-related circuits or to isolate redundant safety-related circuits.
- 1.
General Electric Company (GE) optical isolators
- 2.
Potter and Brumfield MDR relays
- 3.
TARS Isolation Modules
- 4.
Kaman Industries isolation devices
- a.
KESIMS (serial data line communication isolator)
- b.
KEI-D (digital isolation module)
- c.
KEI-A (analog isolation module)
- 5.
GE 4-channel analog output module
NMP Unit 2 USAR Chapter 07 7A.1-2 Rev. 25, October 2022
- 6.
TEC isolators
- 7.
GE relay logic card module The isolation devices used to electrically separate nonessential and essential circuits are designed to the guidelines of IEEE-384. Relay, optical, and magnetic coupling isolation devices are employed.
The optical isolators use a fiber-optic light pipe to electrically separate the input from the output. For example, an essential logic signal activates a light emitting diode; the light is transmitted through the light pipe to a photo switch; and the switch changes state upon receipt of the light signal and either blocks or transmits. These are the same types of optical isolators used in other GE plants.
The relay isolation devices provide a functionally equivalent degree of separation and are used typically for control voltage separation applications, i.e., 120 V ac and 125 V dc essential to nonessential and redundant essential circuits. The relays are designed and mounted so that a metal barrier separates the coil from the contacts with a minimum distance of 1 in between the coil and barrier and between the contact and barrier.
The designs of isolation devices are responsive to the concerns regarding susceptibility to noise, shorts, surges, and faults.
Adverse conditions affecting the coil or the semiconductor device cannot propagate through the isolation barrier (i.e.,
metal enclosure or fiber-optic light pipe). Conversely, adverse conditions affecting the contacts or receiving semiconductor cannot propagate through the isolating barrier and affect the coil or transmitting semiconductor. Therefore, essential systems or circuits are electrically isolated from nonessential and/or redundant systems or circuits.
Analog isolation amplifiers utilize magnetic coupling for both the signal being isolated and the power needed to operate the isolators input or output circuit. The isolation amplifiers are designed for low power instrumentation signals. The basic design characteristic limits the fault energy that can be transmitted across the isolation boundary such that faults in the modules output circuits (nonsafety-related side) do not propagate to its input circuit (safety-related side).
SUMMARY
OF PURCHASE SPECIFICATION A.
MDR Relay
- 1.
Design specification
- a.
MIL-R-19523
- b.
Contract specification
NMP Unit 2 USAR Chapter 07 7A.1-3 Rev. 25, October 2022
- c.
Coil specification
- d.
Insulation specification
- e.
Design life
- f.
Reliability
- 2.
Class 1E safety function
- a.
Functional specification
- b.
Reliability
- 3.
Qualification Testing
- a.
Ambient and design environments
- b.
Normal mounting B.
Isolator
- 1.
Application Data Specification
- 2.
Performance Specification
- 3.
Qualification Testing
- a.
Tested as a part of panel subassembly The documents listed above are available for review at the GE offices in San Jose, CA.
The optical isolator comprises semiconductors, resistors, and capacitors mounted on a printed circuit board. As designed, this device satisfies electrical isolation requirements.
The Unit 2 nuclear steam supply system (NSSS) uses two generations of optical isolators to provide isolation/separation between two divisional or divisional and nondivisional circuits.
The power generation control complex (PGCC) uses one generation of isolator cards, and the redundant reactivity control system (RRCS) uses a later generation. The basic difference is that the later generation has current-limiting resistors on its input circuits to protect the card more fully from damage due to excessive input signals. Installation in the panels is the same for both generations. Each is mounted in panel racks designed to hold the input and output cards separated by a 1-in quartz rod through a ceramic barrier.
Specifications control the type of testing and qualification required on the isolators. The basic difference is that
NMP Unit 2 USAR Chapter 07 7A.1-4 Rev. 25, October 2022 line-to-line voltage tests (140 V dc for 2 min and 400 V pulse for 1 msec) were performed on the new generation isolators.
Instead of this test, an input circuit 5-kV line-to-ground test was performed on the older generation isolators. In either case, subsequent to the test, it was confirmed that there was no degradation of the card on the other side of the barrier.
Additionally, the RRCS used isolated lamp drivers (card-mounted relays) to isolate Class 1E signals from certain non-Class 1E loads (e.g., indicators). As part of its qualification, a 200-V dc line-to-line test across output contacts was performed to determine no degradation will be propagated back to the input circuit on the card.
Since the same kind of panel enclosures is used for both generations of isolators, running the 5-kV test on the old generation will be sufficient to confirm the barrier (dielectric) capability for both generations of isolator cards and their housing. In addition, since the 5-kV test greatly exceeds the voltage to be applied during the line-to-line test of the new generation cards, it can be considered equivalent to the test on the new generation cards, with respect to causing detriment to the cards on the other side of the barrier.
The isolator enclosures are designed to hold either four or eight isolator cards; only cards representing circuits from the same division are contained in the same enclosure. A worse-case failure would only cause loss of function to one division; because of built-in redundancies in other divisions, safety functions would not be lost.
Copies of test plans, procedures, and results are on file at GE.
A summary of the qualification test performed on the MDR relay and the optical isolators is given in Attachments 1 and 2.
An additional test of the optical isolators to verify that they can withstand the maximum credible fault current/voltage applied in the transverse mode has been performed. This test demonstrated that the maximum credible voltage applied to the optical isolators in the transverse mode will not be propagated through the quartz barrier to the other side of the device. A summary of the test performed on the optical isolator cards is given in Attachment 3.
A summary of the qualification tests performed on the Kaman Industries isolation devices is given in Attachments 4A, 4B, and 4C. Copies of test plans, procedures, and results are on file at the Unit 2 site. A maximum credible fault test has also been performed for the Kaman serial data line communication isolator (KESIMS) and the analog isolation module (KEI-A). A summary of the test was provided under separate cover (dated April 15, 1986; April 29, 1986; and May 1986).
NMP Unit 2 USAR Chapter 07 7A.1-5 Rev. 25, October 2022 The TARS I/O equipment incorporates IEEE-323/344 qualified I/O isolation modules connected to non-qualified, nonsafety-related data acquisition chassis to electrically separate the input from the output. Due to inherent design characteristics of the I/O isolation modules, it is concluded that the guidelines of IEEE-384 have been met and no additional testing was performed The GE analog output module and the TEC isolator utilize isolation amplifiers that employ magnetic coupling for isolation. A summary of the qualification of the devices is given in Attachments 5 and 6.
The GE relay logic card module utilizes optically coupled solid-state relays. A summary of the qualification of the device is given in Attachment 7.
NMP Unit 2 USAR Chapter 07 7A.1-6 Rev. 25, October 2022 ATTACHMENT 1 TO SECTION 7A.1
SUMMARY
OF QUALIFICATION TEST PERFORMED ON MDR AUXILIARY RELAY
- 1.
General Relay Manufacturer:
Potter and Brumfield Relay Model:
MDR
- 2.
Functional Test The following tests were performed in the sequence listed.
- a.
Normal Operation Application of normal coil rating voltage to coil terminals and observance of relay contact status change. Repeat test with gradually removing applied voltage.
- b.
Contact Current Rating Test Application of contact rated load and observance of contact status change while relay coil energization and de-energization.
- c.
Dropout and Pickup Voltage Test Gradual decrease and increase of relay coil voltage application, observance of contact status change.
- d.
Response Time Test Energization and de-energization of relay coil and recording of cycle time.
- e.
Dielectric Strength Test Application of appropriate voltage based on Mil Spec R-19523A (1,230 V for 120 V ac nominal, 2,375 V for 125 V dc nominal, 1,265 V for 24 V dc nominal) for 1 min between relay coil circuit and relay main frame.
Acceptance Criteria - Relay shall not short out between coil circuit and contacts or frame during 1-min exposure to applied voltage.
- f.
Typical Test Setup (see Figure 7A.1-1)
- 3.
Seismic Test
NMP Unit 2 USAR Chapter 07 7A.1-7 Rev. 25, October 2022 Clutter and contact bounce monitoring in the energized and de-energized state at different times during seismic excitation.
Relay State NC Contact NO Contact De-energized at 6.7g 5 msec max.
No transfer of contact Energized at 17g No transfer 2 msec, max.
of contact
- 4.
Environmental Test Exposure to temperature and humidity environment of each extreme and various conditions in between and demonstration of relay operation before, during, and after such exposure.
Environmental Exposure Relative Humidity
°F
(%)
71 60 55 40 41 20 61 35 81 50 101 65 102 80 119 90
- 5.
Conclusion Test samples successfully demonstrated that the relay will function before, during, and after the test exposure environment. The relay met all functional requirements as specified.
NMP Unit 2 USAR Chapter 07 7A.1-8 Rev. 25, October 2022 ATTACHMENT 2 TO SECTION 7A.1
SUMMARY
OF QUALIFICATION TEST PERFORMED ON OPTICAL ISOLATORS
- 1.
Device Field Contact 204B6186AAG004 5 V Logic Input 204B6190AAG003 12 V Logic Input 204B6190AAG004 5 V Logic Input 204B6190AAG005 High Speed Input 204B6198AAG002 Analog Input 204B6208AAG002,G004*
Analog Input 204B6208AAG003,G005*
Floating Low Level Output 198B6241AAG003 High Level Output 204B6188AAG002 5 V Logic Output 204B6194AAG002 High Speed Output 204B6196AAG002 Analog Output 204B6220AAG002 Isolator Power Supply 198B6203AAG004 Optical Isolator 133D9947G003 Optical Isolator 133D9947G004
- 2.
Functional Test The optical isolators were tested to verify that they met the requirements as specified in 272A8638, Isolator Application Data Information Document.
- 3.
Seismic Test The optical isolators were tested using 22A4320 Seismic Qualification Procedure for Class 1E Electrical Equipment Test Specification.
- 4.
Environmental Exposure Relative Temperature (°F)
Humidity (%)
Duration (hr) 137 80 100 153 80 8
7015 (ambient) 5015 (ambient) 12 40 80 100 Safety Evaluation No.98-029 contains GEs evaluations for nuclear safety impact and for parts equivalency pertaining to replacement models 204B6208AAG004, G005. These later model isolator cards fully comply with the conclusions stated below.
NMP Unit 2 USAR Chapter 07 7A.1-9 Rev. 25, October 2022
- 5.
High Voltage Test A 5-kV hi-pot test was performed on the isolators to ensure that electrical isolation between the input or output will not impair the function of devices on the other side of the barrier. For typical test setup, see Figure 7A.1-2 and Figure 7A.1-3.
- 6.
Determination of Test Voltage A generic review of the voltage sources present within the plants utilizing optical isolators indicated that 4,160 V is the maximum voltage that conceivably could be present.
Therefore, a test voltage source of 5,000 V was chosen.
The actual voltages that could be present in a panel are determined by a specific plant analysis.
- 7.
Conclusion Test samples successfully demonstrated that the optical isolators will function before, during, and after the test exposure environment and meet the qualification requirements of IEEE-323-1971 and IEEE-344-1975. It also was demonstrated that electrical isolation is maintained between input and output.
NMP Unit 2 USAR Chapter 07 7A.1-10 Rev. 25, October 2022 ATTACHMENT 3 TO SECTION 7A.1 MAXIMUM CREDIBLE VOLTAGE/CURRENT TESTING OF OPTICAL ISOLATOR CARDS
- 1.
Test Objective The purpose of this test was to confirm that the maximum credible voltage/current can be applied to isolator cards without impairing the function of the cards on the other side of the barrier.
- 2.
Test Description*
Eleven different pairs of input/output isolator cards, as shown in Table 7A.1-1, were subjected to the maximum credible voltage test. The isolator assemblies in which the cards were mounted were a bolted assembly (Figure 7A.1-4) and a cast assembly (Figure 7A.1-5).
The input values used in the test were as follows:
Source Source Branch Voltage Current Capability Fuse/Breaker 125 V ac 1965 amps 30 amps 140 V dc
>1600 amps 30 amps The testing consisted of applying the maximum ac/dc voltages to one side of the eleven pairs of cards under the following four conditions:
- a.
140 V dc on the high side of all input power and signal lines with the isolator assembly grounded.
- b.
140 V dc across all signal and power lines (connected in parallel).
- c.
Same as Item a. except 125 V ac.
- d.
Same as Item b. except 125 V ac.
GE analog input isolator cards, models 204B6208AAG004, G005 are later revisions which replace originally-installed models 204B6208AAG002, G003, respectively. Although not part of the 11 pairs tested (see Test Description above),
GE documentation contained in Safety Evaluation 98-029 documents the equivalency of the replacement models. The test results stated below are valid for the replacement models.
NMP Unit 2 USAR Chapter 07 7A.1-11 Rev. 25, October 2022 The test configurations for each of the four conditions listed above are shown on Figures 7A.1-6 through 7A.1-9, respectively.
- 3.
Test Results The cards to which the maximum voltage was applied failed (i.e., resistors exploded, transistors popped, etc.) when the maximum voltages were applied across all lines. The cards did not fail when the voltages were applied relative to case ground.
The cards on the opposite side were removed after each test and checked for functional operability. All cards were found to be operating satisfactorily. In no case did the arcing, flame, or smoke penetrate the isolator assembly barrier or affect the optical isolator cards on the other side, thus confirming the adequacy of the isolator assemblies and cards.
NMP Unit 2 USAR Chapter 07 7A.1-12 Rev. 25, October 2022 ATTACHMENT 4A TO SECTION 7A.1
SUMMARY
OF QUALIFICATION TEST PERFORMED ON KESIMS (SERIAL DATA LINE COMMUNICATION ISOLATOR)
- 1.
General Isolation is achieved by a dual TTL compatible optical isolator, Hewlett-Packard part number HCPL-2630. Optically coupled isolators allow direct circuit control with complete electrical isolation of input from output. This isolator is qualified by similarity to the tested sample in Action Test Report No. 16435-A.
- 2.
Functional Test Functional tests were performed to verify that the KESIMS performs its function as specified in Qualification Report No. 16435-A.
- 3.
Seismic Test The KESIMS is seismically qualified by analysis based on the similarity of its components to the components tested under different reports from Kaman.
- 4.
Environmental Exposure All Class 1E components of the KESIMS have passed the environmental exposure specified below:
Relative Temperature (°F)
Humidity (%)
Duration (hr) 80 50 4
33 95 4
33 15 4
130 15 4
130 95 4
78 50 4
- 5.
Conclusion The test sample successfully demonstrated that the KESIMS will function before, during, and after the test exposure environments and meets the requirements of IEEE-323-1974 and IEEE-344-1975.
NMP Unit 2 USAR Chapter 07 7A.1-13 Rev. 25, October 2022 ATTACHMENT 4B TO SECTION 7A.1
SUMMARY
OF QUALIFICATION TEST PERFORMED ON KEI-DM (DIGITAL ISOLATION MODULE)
- 1.
General Isolation between the input and output is provided by a relay. Isolation is provided in that there is no electrical contact between the coil and the contacts of the relay. The relay is an Aromat flat series relay for PC board mounting with two sets of contacts and a 24-V dc coil.
- 2.
Functional Test The following tests were performed on the relay in the sequence listed:
- a.
Insulation Resistance Test Insulation resistance was measured using a General Radio megohm bridge and a test voltage of 500 V dc 50 V dc. The electrification time was 1 min prior to each measurement. The insulation resistance was measured between the coil terminals connected together and all contact terminals connected together.
Acceptance Criteria: Insulation resistance should be greater than 10 MSL.
- b.
Pull-In Voltage Test Gradual increase of relay coil voltage until the normally open contacts closed as indicated by the indicating light.
Acceptance Criteria: Maximum pull-in voltage of 19.2 V dc.
- c.
Dropout Voltage Test Gradual decrease of relay coil voltage until the normally closed contacts returned to the closed position as indicated by the indicating light.
Acceptance Criteria: Minimum dropout voltage of 16.8 V dc.
- d.
Contact Resistance Test Contact resistance was measured using a 24-V dc power supply.
NMP Unit 2 USAR Chapter 07 7A.1-14 Rev. 25, October 2022 Acceptance Criteria: The contact resistance should not reach a value where the power dissipated through the contacts impedes the operation of the unit. The contact resistance was conservatively chosen as 1 ohm.
- 3.
Seismic Test Relay chatter was monitored for any chatter which exceeded 2.0 msec during the seismic test. No chatter exceeded the 2.0-msec threshold.
- 4.
Environmental Test During the environmental test, the relay was energized and the normally open circuit was attached to a 24-V dc power source and an indicator light. The light remained on throughout the environmental test.
Relative Temperature (°F)
Humidity (%)
Duration (hr) 80 50 4
33 95 4
33 15 4
130 15 4
130 95 4
78 50 4
- 5.
Conclusion The test sample successfully demonstrated that the relay will function before, during, and after the test exposure environment and meets the qualification requirements of IEEE-323-1974 and IEEE-344-1975.
NMP Unit 2 USAR Chapter 07 7A.1-15 Rev. 25, October 2022 ATTACHMENT 4C TO SECTION 7A.1
SUMMARY
OF QUALIFICATION TEST PERFORMED ON KEI-AM (ANALOG ISOLATION MODULE)
- 1.
General Isolation is achieved by a linear isolation amplifier (Intronics P/N 1A184). In this device, a Class 1E dc signal is amplified by an integrated circuit operational amplifier, modulated at 25 kHz, transformed across a toroidal coil, demodulated, and filtered. Electrical isolation is provided by the coil air gap.
- 2.
Functional Test The linear isolation amplifier was tested to verify that it performs its function as specified in Qualification Report No. K-84-99 U(R).
- 3.
Seismic Test KEI-AM is seismically qualified by analysis based on the similarity of its components to the components tested under different reports from Kaman.
- 4.
Environmental Test All Class 1E components of KEI-AM have passed the environmental exposure specified below:
Relative Temperature (°F)
Humidity (%)
Duration (hr) 80 50 4
33 95 4
33 15 4
130 15 4
130 95 4
78 50 4
- 5.
High Voltage Test A 1.5-kV hi-pot test was performed on the linear isolation amplifier to ensure that electrical isolation between the input or output will not impair the function of the device on the other side of the barrier. In this test, no isolation breakdown or loss of function was detected in the intronic isolation amplifier. Additionally, each linear isolation amplifier is tested to 2,500 V by the manufacturer.
- 6.
Determination of Test Voltage
NMP Unit 2 USAR Chapter 07 7A.1-16 Rev. 25, October 2022 Kaman has reviewed the design of the analog isolation module and has concluded that the maximum voltage the isolator may have to withstand is 1500 V dc. Therefore, a test voltage source of 1500 V dc was chosen.
- 7.
Conclusion The test sample successfully demonstrated that the analog isolation module will function before, during, and after the test exposure environment and meets the qualification requirements of IEEE-323-1974 and IEEE-344-1975. It also was demonstrated that electrical isolation is maintained between input and output.
NMP Unit 2 USAR Chapter 07 7A.1-17 Rev. 25, October 2022 ATTACHMENT 5 TO SECTION 7A.1
SUMMARY
OF QUALIFICATION TEST PERFORMED ON GE MODEL 148C6130G001 (4-CHANNEL ANALOG OUTPUT MODULE)
- 1.
General Some of the safety-related instruments within the power range neutron monitoring (PRNM) system send low-level analog signals to external meters and recorders that are not safety related. The 4-channel analog output module is a device that provides the necessary electrical isolation for up to four such signals per module.
The module is a completely metal-enclosed assembly having one input connector (for the four analog signals coming from a safety-related instrument), and four output connectors (one per external meter/recorder). The input and output connectors are on opposite sides of the assembly.
Inside the assembly is a printed circuit board with four identical signal processing channels plus a small area for input power (from the safety-related instrument). At the heart of each channel is an isolation amplifier that employs magnetic coupling for both the signal being isolated and the power needed to operate the channels output circuits. The board is laid out such that the four channels are separated from each other and that the input circuits are separated from the output circuits. Metal barriers are placed around each of the four output circuits (nonsafety-related side) so as to provide additional electromagnetic compatibility (EMC) shielding and to assure that circuit damage that might occur on the output side of the isolation barrier will not propagate to the input (safety-related) side.
The isolation amplifiers used are low power devices operating from 15-V dc power. The amplifiers are designed for low power signals (nominally 75 MW output power). This basic design characteristic limits the fault energy that can be transmitted across the isolation boundary to levels that are insufficient to cause significant damage.
In the application, the purpose of the isolator is to assure that faults in the modules output circuits (nonsafety-related side) do not propagate to its input circuit (safety-related side).
- 2.
Specifications The GE specifications for the 4-channel analog isolator module are defined in performance specification 23A5238.
Key isolation specifications are:
- a.
2500 Vrms sine wave isolation, input to output.
(Note: This is the isolation capability of the
NMP Unit 2 USAR Chapter 07 7A.1-18 Rev. 25, October 2022 amplifier. One or more interface connectors will arc to ground before this level is reached.)
- b.
500 Vrms hi-pot to ground.
- c.
100 Megohm insulation resistance.
The complete specification is on file at the GE offices in San Jose, California.
- 3.
Functional Testing Full functional testing was performed as part of the development program for the isolator (type testing).
Functional testing of all production equipment is performed as part of the manufacturing process. Complete records of both development (type) testing and manufacturing testing are on file at the GE offices in San Jose, California.
- 4.
Qualification Testing Full environmental and seismic qualification tests were performed on the isolator assembly as part of the development program. Hi-pot testing to 500 Vrms and insulation resistance tests were performed before and after environmental qualification of the 4-channel analog isolator module. In addition, hi-pot tests for inputs and outputs to greater than 4,000 V dc were performed as part of the development tests. EMC testing was done as part of the original development, but was repeated as part of the nuclear measurement analysis and control (NUMAC) PRNM development program to specifically cover the NUMAC PRNM application.
The above tests and supplemental analysis demonstrate qualification of the 4-channel analog output module in the PRNM application to the limits and requirements, including environmental, seismic, and EMC, identified in the GE Licensing Topical Report, NEDC-32410P-A, October 1995.
NMP Unit 2 USAR Chapter 07 7A.1-19 Rev. 25, October 2022 ATTACHMENT 6 TO SECTION 7A.1
SUMMARY
OF QUALIFICATION TEST PERFORMED ON TEC MODEL 156B, GE MODEL 343A1116P001 (ANALOG-TO-ANALOG)
- 1.
General Some of the safety-related instruments within the PRNM system must provide low-level analog signals to external transient recording and monitoring equipment that is not safety related. The TEC Model 156B analog-to-analog isolator is a device that provides the necessary electrical isolation for such signals. Each isolator processes one signal. Thus, several isolators are mounted on a plate to provide a "multi-channel" isolator assembly.
The isolator is a completely metal-enclosed box having a 3-point barrier strip on one side for input wiring and another such strip on the opposite side for output wiring.
At the heart of the isolator is an isolation amplifier that employs magnetic coupling for both the signal being isolated and the power needed to operate the isolators input circuits (the isolator is powered from an external source connected to its output side).
The analog-to-analog isolators are low-power devices operating from 24 Vdc power. The amplifiers are designed for low power signals (nominally 100 MW output power).
This basic design characteristic limits the fault energy that can be transmitted across the isolation boundary to levels that are insufficient to cause significant damage.
In the application, the purpose of the isolator is to assure that faults in the modules output circuits (nonsafety-related side) do not propagate to its input circuit (safety-related side).
- 2.
Specifications The specifications for the TEC Model 156B analog-to-analog isolator are defined in TEC data sheets and GE specification 343A1116. Key isolation specifications are:
- a.
2,000 V dc continuous, input to output
- b.
2,000 Vrms (up to one minute), input to output, and
- c.
Common mode input impedance of 5E+10 Ohms.
The complete specifications, including copies of the TEC specifications, are on file at the GE offices in San Jose, California.
NMP Unit 2 USAR Chapter 07 7A.1-20 Rev. 25, October 2022
- 3.
Functional Testing Full functional testing was performed as part of the qualification program for the isolator (type testing) and documented in TEC Qualification Report No. 157-TR-01. A copy of the TEC qualification report is on file at the GE offices in San Jose, California.
- 4.
Qualification Testing Full environmental and seismic qualification tests in accordance with IEEE-323-1974 and IEEE-344-1975 were performed on the isolator assembly as part of TECs qualification program. EMC testing was done as part of the qualification program. The qualification levels are documented in TEC Qualification Report No. 157-TR-01.
The qualification testing covered operating temperatures up to 70°C.
The TEC Qualification Report No. 157-TR-01 states that EMC qualification was done in accordance with TEC Procedure No.
156-QP-04. GE performed additional EMC qualification testing to the applicable EMC specifications identified in the GE Licensing Topical Report, NEDC-32410P-A, October 1995.
NMP Unit 2 USAR Chapter 07 7A.1-21 Rev. 25, October 2022 ATTACHMENT 7 TO SECTION 7A.1
SUMMARY
OF QUALIFICATION TEST PERFORMED ON GE MODEL 148C6797G001 (RELAY LOGIC CARD MODULE)
- 1.
Description Some of the safety-related instruments within the PRNM system must provide binary output signals (i.e., contact closures) to external (remote) annunciators, indicator lamps, and computers that are not safety related, and for the RRCS outputs, outputs to a channel in a different division. The relay logic card module is a device that, when mounted in the two-out-of-four logic module in the PRNM system, provides the necessary electrical isolation.
The isolating devices on this module are optically coupled solid-state relays. Each device contains a light-emitting diode and a photo-sensitive-receiver diode with two associated solid-state relay contacts. These contacts may either be normally opened or normally closed, depending on the solid-state relays design. Energizing the light-emitting diode (i.e., the relays input) causes the relays output contacts to change state. There are no electrical connections between input and output (i.e.,
across division boundaries), only optical. For added contact current capabilities, several solid-state relays may be wired in parallel. That is, their inputs are tied together and their output contacts are wired in parallel.
Again, there is no electrical connection between input and output, only optical.
The module contains three input/output connectors along one of its edges. One of these connectors allows for connection of circuits between the module and other same-division NMS components. The other two connectors are for connection to circuits leaving the division.
In the application, the purpose of the isolator is to assure that faults in the modules output circuits do not propagate to its input circuit and, in the case of the RRCS interface, that faults on the input circuit side do not propagate to the output side.
- 2.
Specifications The GE specifications for the relay logic card module are defined in performance specification 24A5250. Key isolation specifications are:
- a.
Common mode voltage contact-to-ground of 1,200 V dc.
NMP Unit 2 USAR Chapter 07 7A.1-22 Rev. 25, October 2022
- b.
Hi-pot test of 1,200 V (10 A max.) and 4,000 V (1 mA max.).
- c.
Input-to-output isolation of 3,750 Vrms.
The complete specification is on file at the GE offices in San Jose, California.
- 3.
Functional Testing Full functional testing was performed as part of the development program for the isolator (type testing).
Functional testing of all production equipment is performed as part of the manufacturing process. Complete records of both development (type) testing and manufacturing testing are on file at the GE offices in San Jose, California.
- 4.
Qualification Testing Full environmental and seismic qualification tests were performed as part of the development program. In addition, hi-pot tests for inputs and outputs to greater than 3,000 V dc were performed as part of the development tests. EMC testing was done as part of the NUMAC PRNM development program to specifically cover the NUMAC PRNM application.
The above tests demonstrate qualification of the relay logic card module in the PRNM application to the limits and requirements, including environmental, seismic, and EMC, identified in the GE Licensing Topical Report, NEDC-32410P-A, October 1995.
NMP Unit 2 USAR Chapter 07 7A.1-23 Rev. 25, October 2022 TABLE 7A.1-1 ISOLATOR COMBINATIONS
- 1.
Field Contact Input/High Level Output
- 2.
Field Contact Input/5-V Logic Output
- 3.
Field Contact Input/12-V Logic Output
- 4.
Field Contact Input/Floating Low Level Output
- 5.
High Speed Input/High Speed Output
- 6.
Analog Input/Analog Output
- 7.
5-V Logic Output/Field Contact Input
- 8.
12-V Logic Output/Logic Input
- 9.
High Speed Output/High Speed Input
- 10. Analog Output/Analog Input
- 11. Power Supply/Power Supply
NMP Unit 2 USAR Chapter 07 7A.2-1 Rev. 25, October 2022 7A.2 VESSEL LEVEL TAP AND SENSING LINE FAILURE CONCERN (QUESTION F421.20)
Operating reactor experience indicates that a number of failures have occurred in boiling water reactor (BWR) reactor vessel level sensing lines, and that in most cases the failures have resulted in erroneously high reactor vessel level indication.
For BWRs, common sensing lines are used for feedwater control and as the basis for establishing vessel level channel trips for one or more of the protective functions (reactor scram, main steam isolation valve (MSIV) closure, reactor core isolation cooling (RCIC), low-pressure coolant injection (LPCI), automatic depressurization system (ADS), or high-pressure core spray (HPCS) initiation). Failures in such sensing lines may cause a reduction in feedwater flow and consequential defect of a trip within the related protective channel.
If an additional failure, perhaps of electrical nature, is assumed in a protective channel not dependent on the failed sensing line, protective action may not occur or may be delayed long enough to result in unacceptable consequences. This depends on the logic for combining channel trips to achieve protective actions.
Identify each case where a reactor vessel water level tap or sensing line failure concurrent with an additional random single electrical failure induces a transient and precludes the automatic operation of reactor scram and/or engineered safety feature (ESF) system. For each case identified, provide an evaluation which demonstrates how the redundancy or diversity of the plant design provides for reactor scram or safety system operation within acceptable limits. Where manual action is required by the Operators, discuss the instrumentation and time available for the Operator to take such corrective action.
To reduce the consequences of sensing line failures in combination with a single failure in a protection channel not dependent on the failed sensing line, a modification of the protection system logic may be required. Logic configurations which may be considered for NRC approval on this plant are described in the BWR Owners Group (BWROG) study entitled "Review of BWR Reactor Vessel Water Level Measurement Systems,"
SLI-8211, prepared by S. Levy Inc.
RESOLUTION A postulated break in an instrument line, plus an additional failure, is beyond the design basis for this plant; however, an assessment of plant response to this event has been performed on the basis of the following methodology and assumptions.
Methodology
NMP Unit 2 USAR Chapter 07 7A.2-2 Rev. 25, October 2022
- 1.
Determine the logic for combining channel trips to achieve protective actions.
- 2.
Identify each case where a reactor vessel water level tap or sensing line failure, concurrent with an additional random single electrical failure, induces a transient and precludes the automatic operation of a reactor protection system (RPS) and/or ESF system.
- 3.
For each case identified, demonstrate how the redundancy or diversity of the plant design provides the RPS or ESF system operation within acceptable limits. For the worst failure combination scenarios, perform transient analyses to demonstrate that plant safety is not compromised.
Assumptions
- 1.
Instrument reference line failure (break).
- 2.
Single electrical device failure (no power supply failure).
- 3.
Alternate rod insertion (ARI) operable.
- 4.
No Operator action.
A review of various failure combinations resulted in identification of the worst postulated failure path as failure of the Division 1 instruments reference leg line (i.e.,
connected to condensing chamber B21-D004A), combined with a failure "high" of B21-N080A.
The manual selection switch for the feedwater controller is assumed to be on the failed instrument line, and the Operator is assumed not to switch control to the other instrument line as would be expected. This causes the feedwater controller to respond to the high water level error signal by reducing the feedwater flow. Following the loss of feedwater, water level will decrease to Level 4, initiating a low water level alarm.
Water level will further decrease to Level 3, initiating a second low water level alarm, and reactor scram will not occur due to the assumed failure. When water level decreases to Level 2, a third low water level alarm will be initiated, and reactor scram will occur due to ARI. The RCIC system will automatically start, and both recirculation pumps will trip. The HPCS system is unavailable (tripped) due to the assumed failure.
The core thermal hydraulic analysis, using the REDY transient code, shows that the water level inside the shroud drops to a minimum of 2.23 ft above the top of the active fuel (TAF) at 1,436 sec and slowly rises thereafter. Since the core remains covered throughout the transient, no core heatup is expected.
NOTE: The justification of Assumption 2 is as follows:
NMP Unit 2 USAR Chapter 07 7A.2-3 Rev. 25, October 2022 Section 4.4.3 of BWROG-8253, BWR Owners Group Reactor Vessel Water Level Measurement System Report, from T. J. Dente (BWROG) to H. R. Denton (NRC), dated August 13, 1982, stated, "the ATWS eventsindicate that mechanical failures, not instrument failures, in the systemare the largest contributor to core melt. Events involving electrical failure, which included instrument failures, are less than 0.1% of the total core melt frequency."
NMP Unit 2 USAR Chapter 07 7A.3-1 Rev. 25, October 2022 7A.3 COMMON ELECTRICAL SYSTEMS FAILURE CONCERN (QUESTION F421.37)
If reactor controls and vital instruments derive power from common electrical distribution systems, the failure of such electrical distribution systems may result in an event requiring Operator action concurrent with failure of important instrumentation upon which these Operator actions should be based. IE Bulletin 79-27 addresses several concerns related to the above subject. You are requested to provide information and a discussion based on each IE Bulletin 79-27 concern. Also, you are to:
- 1.
Confirm that all ac and dc instrument buses that could affect the ability to achieve a cold shutdown condition were reviewed. Identify these buses.
- 2.
Confirm that all instrumentation and controls required by emergency shutdown procedures were considered in the review. Identify these instruments and controls at the system level of detail.
- 3.
Confirm that clear, simple, unambiguous annunciation of loss of power is provided in the control room for each bus addressed in item 1 above. Identify any exceptions.
- 4.
Confirm that the effect of loss of power to each load on each bus identified in item 1 above, including ability to reach cold shutdown, was considered in the review.
- 5.
Confirm that the re-review of IE Circular No. 79-02, which is required by Action item 3 of Bulletin 79-27, was extended to include both Class 1E and non-Class 1E inverter supplied instrument or control buses. Identify these buses or confirm that they are included in the listing required by item 1 above.
RESOLUTION The Nine Mile Point Nuclear Station - Unit 2 (Unit 2) study was submitted under separate cover. The methodology provides for a systematic and comprehensive analysis to ensure that, in the event of a single power bus failure, sufficient control room indicators, instruments, and controls exist for the Operators to achieve reactor cold shutdown. The following paragraphs outline the methodology used in addressing the concerns identified in IE Bulletin 79-27.
- 1.
Review the Class 1E and non-Class 1E buses, including inverters, supplying power to instrumentation and controls in systems used in attaining the cold shutdown condition.
All buses that could affect the ability to achieve cold shutdown are identified. Existing plant operating
NMP Unit 2 USAR Chapter 07 7A.3-2 Rev. 25, October 2022 procedures and procedures already developed for the event of certain power bus failures are used to ensure the identification of all potential power buses.
- 2.
Identify the instrumentation and control devices connected to each identified power bus. Evaluate the effects of a power loss to each load, including the limiting effects on the ability to achieve cold shutdown.
- 3.
Create "bus trees" denoting the bus hierarchy and cascading bus configuration of all buses that power instrumentation and controls used by the Operator to achieve cold shutdown.
- 4.
Determine the annunciators and alarms that would alert the operators to a failure of any of the identified buses.
- 5.
Determine the effect of any single power bus loss on the ability to continue in the particular shutdown path being used at the time the bus loss occurs. This analysis includes the cascading effects of any bus loss and considers alternative indications and controls powered by unaffected buses that may aid the Operator in the event of a bus loss. Identify alternative shutdown paths available in the event of a bus loss and existing procedures for restoration of the affected bus.
RESULT
SUMMARY
The results, as documented in "Control Systems Common Power Failures Evaluation Report" (Niagara Mohawk Power Corporation
[NMPC] letter to the Nuclear Regulatory Commission [NRC], dated November 14, 1985), confirmed that no failures would lead to consequences beyond what have been analyzed in Chapter 15.
NMP Unit 2 USAR Chapter 07 7A.4-1 Rev. 25, October 2022 7A.4 COMMON POWER AND SENSING LINE FAILURE CONCERN (QUESTION F421.42)
The transient and accident analyses included in the Final Safety Analysis Report (FSAR) are intended to demonstrate the adequacy of safety systems in mitigating anticipated operational occurrences and accidents.
Based on the conservative assumptions made in defining these "design bases" events and the detailed review of the analyses by the staff, it is likely that they adequately bound the consequences of single control system failures. To provide assurance that the design basis event analysis for Unit 2 adequately bounds other more fundamental creditable failures, provide the following:
- 1.
Identify those control systems whose failure or malfunction could seriously impact plant safety.
- 2.
Indicate which, if any, of the control systems identified in Item 1 receive power from common power sources. The power sources whose failure or malfunction could lead to failure or malfunction of more than one control system, and should extend to the effects of cascading power losses due to the failure of higher level distribution panels and load centers.
- 3.
Indicate which, if any, of the control systems identified in Item 1 receive input signals from common sensors. The sensors considered should include common taps, hydraulic headers and impulse lines feeding pressure, temperature, level or other signals to two or more control systems.
- 4.
Provide justification that any malfunctions of the control systems identified in Items 2 and 3 resulting from failures of malfunctions of the applicable common power source or sensor, including hydraulic components, are bounded by the analyses in Chapter 15 and would not require action or response beyond the capability of Operators or safety systems.
RESOLUTION Two system interaction studies, common power failure analysis and common sensor failure or sensing line analysis, are required to address the issues of this question. The methodology applied for these analyses for Unit 2 has already been approved by the NRC for Grand Gulf, Shoreham, and WNP-2 analyses. The studies have been performed to evaluate the consequences of single power source or sensing line failures on control grade systems, and determine whether the limiting case events are bounded by
NMP Unit 2 USAR Chapter 07 7A.4-2 Rev. 25, October 2022 Chapter 15 analyses. These studies were submitted under separate cover.
Common Power Source Failure The following paragraphs outline the methodology used in the common power source failure analysis.
- 1.
Identify all nonsafety control grade systems that could affect the critical reactor parameters, i.e.,
water level, pressure, and power.
- 2.
Review these control systems at the component level.
Identify the effect of the loss of power to each system component and subsequent interactions with other components and systems.
- 3.
Generate "bus trees" which represent the bus hierarchy and cascading configuration of all power buses that supply components of control systems under study.
- 4.
Perform a combined effects analysis. Evaluate the failure of each power bus, i.e., load center, motor control center (MCC), etc., starting with the lowest level source common to multiple control systems and working up the "bus trees" to the highest common power level. At each level, examine the effects of the single bus failure and consequential cascading bus failures on all control systems' components affected.
- 5.
Postulate the limiting transient events as a result of the combined effect analysis. Compare these events to those analyzed in Chapter 15.
- 6.
Perform any additional transient calculations or analyses required to determine whether the postulated transient events are bounded* by Chapter 15 analyses, assuming there is a single active failure in a safety system required to mitigate effects of the event.
Common Sensor or Sensing Line Failure The following paragraphs outline the methodology used in the common sensor or sensing line failure analysis.
- 1.
Identify all nonsafety control grade systems that could affect the critical reactor parameters, i.e.,
water level, pressure, and power.
- 2.
Identify all instrument sensing lines and sensors common to two or more of these control systems.
- 3.
Analyze the effects of a failure of a common sensor, a complete plug, or a guillotine break in each of these
NMP Unit 2 USAR Chapter 07 7A.4-3 Rev. 25, October 2022 common instrument lines. Examine the effects of the erroneous signals on each affected instrument and on each function, i.e., scrams, trips, permissives, etc.,
actuated or rendered inoperative.
- 4.
Examine the interactive effects among all systems affected by the common sensing line failure and the consequential combined effect on the critical reactor parameters.
- 5.
Compare the consequences of these postulated events with the Chapter 15 analyses to ensure that Chapter 15 bounds the effects, and the events would not require action or responses beyond the capability of Operators or safety systems. Perform any additional transient calculations or analyses necessary to determine whether the postulated limiting events are bounded* by those events analyzed in Chapter 15, assuming there is a single active failure in a safety system required to mitigate effects of the event.
RESULT
SUMMARY
The results, as documented in "Control Systems Common Sensor Line Failure Analysis Evaluation Report" (NMPC letter to the NRC dated November 4, 1985), confirmed that no failures would lead to consequences beyond what have been analyzed in Chapter 15.
The term "bounded" means within the consequence limits for abnormal operational transients given in Section 15.0.3.1.2 of the FSAR or, if the combined probability of occurrence of both the initiating event and the single active failure is similar to the occurrence probabilities of limiting faults (see Section 15.0.3.1), "bounded" means within the consequence limits for limiting the faults given in Section 15.0.3.1.3.
NMP Unit 2 USAR Chapter 07 7A.5-1 Rev. 25, October 2022 7A.5 HIGH-ENERGY LINE BREAK (IE INFORMATION NOTICE 79-22)
CONCERN (QUESTION F421.43)
If control systems are exposed to the environment resulting from the rupture of reactor coolant lines, steam lines, or feedwater lines, the control systems may malfunction in a manner which would cause consequences to be more severe than assumed in safety analyses. I&E Information Notice 79-22 discusses certain nonsafety-grade or control equipment which, if subjected to the adverse environment of a high-energy line break (HELB), could impact the safety analyses and the adequacy of the protection functions performed by the safety-related systems.
A similar potential may exist at light water facilities.
Utilities are, therefore, requested to perform a review per the I&E Information Notice 79-22 concern to determine what, if any, design changes or Operator actions would be necessary to ensure that HELBs will not cause control system failures to complicate the event beyond the FSAR analyses. Provide the results of the review including all identified problems and resolutions.
The specific scenarios discussed in the above-referenced Information Notice are to be considered as examples of the kinds of interactions which might occur. The review should consider analogous interactions as relevant to the BWR design.
RESOLUTION Introduction IE Information Notice 79-22 identifies the concern that the performance of nonsafety-grade equipment subjected to an adverse environment could impact the protective functions performed by safety-grade equipment. An evaluation was performed to determine if a malfunction of a nonsafety control system, associated with a HELB, might result in a severe event not bounded by FSAR Chapter 15. The results of the study were provided under separate cover to the NRC. The following is a description of the methodology used to perform this evaluation.
Methodology The HELB/control system failure evaluation was analyzed as follows:
- 1.
Identify all nonsafety control systems and components within these systems which may impact critical reactor parameters (water level, pressure, power).
- 2.
Establish the criteria for energy lines, break postulation, and consequence evaluation.
NMP Unit 2 USAR Chapter 07 7A.5-2 Rev. 25, October 2022
- 3.
Identify critical nonsafety-grade components located in areas of high-energy piping.
- 4.
Postulate breaks in these areas and determine the resultant effects on the components.
- 5.
Evaluate the events to determine if the event is bounded by FSAR Chapter 15. If not bounded, additional analysis or a corrective action will be taken.
Nonsafety Control Systems All plant nonsafety control systems are included in the initial evaluation for HELB. The following criteria are used for the elimination of systems from the initial list prior to performing a detailed HELB analysis.
- 1.
Dedicated inputs into the process computer, as well as the computer itself.
- 2.
Control systems which have no direct or indirect interaction with reactor operating parameters.
Examples are communications, lighting, ventilation for exterior buildings, machine shop systems, refueling or maintenance systems, etc.
- 3.
Control systems that do interact or interface with reactor operating systems, but which cannot affect the reactor parameters either directly or indirectly.
- 4.
Electrical systems, the loss of which will result in a condition similar to total or partial loss of offsite power (LOOP), e.g., the station transformers, ac instrument power, and dc instrument power.
- 5.
Systems which are not used during normal power operation, e.g., refueling systems, turning gear, and turbine bearing lift pumps.
- 6.
Safety systems or safety portions of control systems.
- 7.
Mechanical-and structural-type systems. Examples include structural steel, turbines, cranes, etc.
All control components, including power sources, within systems not eliminated by these criteria are evaluated for component elimination by the following criteria prior to the final HELB analysis.
- 1.
Instruments which provide only indication or position status information are excluded from the detailed analysis.
NMP Unit 2 USAR Chapter 07 7A.5-3 Rev. 25, October 2022
- 2.
Components which provide passive inputs into the control logic, e.g., arming-type permissives which require additional manual action to command equipment to operate, are excluded from the detailed analysis.
- 3.
Instruments and other dedicated inputs to the process computer are excluded from the detailed analysis.
- 4.
Position switches on air-and motor-operated valves which are not interlocked with other equipment but rather provide position indication or position status to the process computer are excluded from the detailed analysis.
- 5.
Mechanical-type components, such as structural steel, tanks, and pipes are not considered components which can fail. However, associated instruments, taps, tubing, and control components not eliminated by Items 1 through 4 and physically located on the aforementioned mechanical components, are evaluated.
Pipe Break Criteria The pipe break criteria are taken directly from FSAR Section 3.6.
- 1.
Pipe Criteria High-energy piping is defined as including those systems or portions of systems in which the maximum operating temperature exceeds 200°F or the maximum operating pressure exceeds 275 psig during normal full power operation. Those lines that operate above these limits for only a relatively short period of time (less than 2 percent) to perform their intended functions are classified as moderate energy and excluded from consideration.
- 2.
Break Postulation High-energy pipes are assumed to break only at terminal ends and at each intermediate pipe fitting or weld attachment. Each longitudinal or circumferential break in high-energy fluid system piping is considered separately as a single postulated initial event occurring during normal plant conditions.
- 3.
Consequence Evaluation Pipe breaks are evaluated for the effects of pipe whip, jet impingement, and environmental effects.
- a.
Pipe Whip
NMP Unit 2 USAR Chapter 07 7A.5-4 Rev. 25, October 2022 Pipe whip is assumed to occur in the plane defined by the piping geometry and to cause movement in the direction of the jet reaction.
- b.
Jet Impingement Jet impingement loads are determined by taking the jet force as being constant at all effective distances from, and normal to, the break area and by assuming that the jet stream diverges conically at a solid angle of 20 degrees.
Analysis
- 1.
Utilizing current plant drawings, the nonsafety control components and high-energy systems are located in particular zones.
- 2.
In small zones it is assumed that any HELB would incapacitate all nonsafety control components in the zone.
- 3.
In large zones the effect of a HELB on each component is evaluated based upon the pipe criteria.
- 4.
Postulate breaks and evaluate the effects on the controls equipment.
- 5.
Compare postulated effects with events as reported in FSAR Chapter 15 to determine if they are bounded.
- 6.
If not bounded, determine if protection or relocation of the controls equipment is appropriate.
- 7.
If required, additional analysis may be performed to determine if the effect is significant, and then a corrective action will be taken.
RESULT
SUMMARY
The results, as documented in the reference, conclude that safe reactor shutdown is ensured for all events postulated, and the consequences of these events are bounded by the existing Chapter 15 analyses.
REFERENCE
- 1.
NMPC Letter NMP2L0643, C. Mangan (NMPC) to E. Adensam (NRC), dated March 3, 1986.
Enclosure:
"High Energy Line Break Evaluation Report (Effect on Nonsafety-Related Control Components)," Revision 2, dated February 1986.
NMP Unit 2 USAR Chapter 07 7A.6-1 Rev. 25, October 2022 7A.6 FIRST-OF-A-KIND INSTRUMENTS CONCERN (QUESTION F421.3)
Identify any "first-of-a-kind" instruments used in or providing inputs to safety-related systems. Identify each application of a microprocessor, multiplexer or computer system where they are in or interface with safety-related systems.
RESOLUTION For BOP The Unit 2 transient analysis recording system Validyne system hardware was replaced with RTP 3000 TAS distributed I/O system and is now fully integrated in to the Plant Process Computer (PPC Reference Chapter 7.7). A stand-alone isolator system hyas been installed to ensure that no negative interaction, with Safety-related signals, will occur.
This equipment performs no control function and is used for nonsafety plant monitoring.
The Unit 2 digital radiation monitoring system (DRMS) provides isolation of Class 1E digital, analog, and communication signals from non-Class 1E equipment.
The following modules describe the DRMS isolators.
- 1.
KESIM Kaman safety radiation monitoring system isolation module provides electrical isolation between the serial data lines of the Class 1E data acquisition units and the non-Class 1E redundant microcomputers.
- 2.
KEI-D Kaman digital isolation module provides isolation between the Class 1E and non-Class 1E digital signals.
- 3.
KEI-A Kaman analog isolation module provides isolation between the Class 1E and non-Class 1E analog signals.
For details of testing against EMI, short circuit failures, voltage faults and/or surges, and the summary of performance characteristics, see Section 7A.1.
The DRMS Computer and software has been replaced with a Programmable Logic Controller (PLC). Integrated testing of hardware and software has been performed to validate the functionality of the complete DRMS system.
DIGITAL RADIATION MONITORING SYSTEM
NMP Unit 2 USAR Chapter 07 7A.6-2 Rev. 25, October 2022 Acronyms DPS Data Processing Subsystem (redundant PLCs located in computer room) - non-Class 1E DAU Data Acquisition Unit (microcomputer located local to process/area) - Class 1E and non-Class 1E applications ADDS Alarm and Display Subsystem (Class 1E control room cabinets 2CEC*PNL880A-D)
ACU Auxiliary Control Unit (located in ADDS 1 for each monitor) - Class 1E SRMS Safety Radiation Monitoring System module located in ADDS provides parallel communication with Class 1E DAUs associated with Class 1E monitors.
SIM Safety Isolation Module located in ADDS for isolating the communications channel from the SRMS to the DPS while maintaining required separation and isolation of Class 1E and non-Class 1E devices.
PAM Post-accident Monitor
=
System Description===
The digital radiation monitoring's data acquisition system consists of eight serially connected loops of radiation monitoring units. Six of these monitoring loops are comprised of non-Class 1E radiation monitors. The two remaining monitoring loops contain Class 1E, nuclear safety-related radiation monitors. Each monitoring loop communicates with the DRMS via an EIA-RS-422 interface. The Class 1E radiation monitors measure radiation levels in certain processes and areas critical to personnel safety. These Class 1E radiation monitors interface with the data processing subsystem to ensure electrical isolation/separation. This Class 1E wiring will maintain electrical integrity and improve response times to personnel-threatening alarm conditions. Data acquisition from Class 1E monitors and non-Class 1E monitors is similar. The only exception is the manipulative control of the Class 1E monitors. Manipulative control of the Class 1E monitors is available only from the ACU located in the alarm and data display ADDS 2CEC*PNL880A-D. The non-Class 1E monitors' manipulative control is available from the DPS, as well as locally. Refer to Figure 7A.6-1 for DRMS functional diagram.
The DPS may communicate with a Class 1E DAU to retrieve all accumulated data. However, the DPS Operator cannot alter any information acquired by the Class 1E DAU or command any monitor functions. Software checks in both the DPS and the DAU ensure that the above conditions are met. In order to ensure that the DPS Operator has the current status of the Class 1E monitors for
NMP Unit 2 USAR Chapter 07 7A.6-3 Rev. 25, October 2022 display and logging, the Class 1E DAU will notify the DPS of any data base changes made by an ACU Operator. This update of the DPS data base will be accomplished by means of an "upload" message from the DAU. The Class 1E DAU utilizes a dedicated serial channel to communicate with its associated ACU. The SRMS modules provide the Class 1E to non-Class 1E isolation to the DPS. Analog and digital isolators also are provided to separate the ACU outputs from the non-Class 1E interfaces. The ADDS contains Class 1E recorders which monitor and document radiation levels.
For NSSS
- 1.
There are no "first-of-a-kind" instruments used in or providing inputs to safety-related systems.
- 2.
Microprocessors are used as an integral part of the RRCS. Four microprocessors (two per division) receive input signals (e.g., low water level, high dome pressure, average power range monitor [APRM]
downscale), process them against a time base formula, and generate output signals (e.g., ARI, recirculation pump trip [RPT], feedwater runback) to other systems.
Details of RRCS operation are discussed in Section 7.6.1. In addition to these data processing microprocessors, the RRCS has four microprocessors (two per division) for monitoring power supply status, two microprocessors (one per division) for assisting in the calibration of RRCS process instrumentation, and two microprocessors (one per division) to perform automatic on-line testing of the safety-related RRCS system. Hardware failures are annunciated and faults localized via the use of a local keyboard/display.
The Plant Process Computer (PPC) system, which interfaces with safety-related systems, is a nonsafety-related system. Isolation of safety-related inputs to the PPC was shown functionally in the logic diagrams and elementary diagrams listed in FSAR Table 1.7-1 and provided to the NRC.
NMP Unit 2 USAR Chapter 07 Rev. 25, October 2022 APPENDIX 7B ELECTRICAL SEPARATION
NMP Unit 2 USAR Chapter 07 7B-1 Rev. 25, October 2022 APPENDIX 7B ELECTRICAL SEPARATION CONCERN (QUESTION F421.47)
From its review of the Nine Mile Point Nuclear Station - Unit 2 (Unit 2) Final Safety Analysis Report (FSAR), the Nuclear Regulatory Commission (NRC) staff has been unable to conclude that the separation of Class 1E components and interconnecting circuits is acceptable. Regulatory Guide (RG) 1.75, "Physical Independence of Electrical Systems," which endorses IEEE-384, "IEEE Trail-Use Standard Criteria for Separation of Class 1E Equipment and Circuits," provides guidance with regard to separation. To provide the level of detail necessary to complete our review, we request that you submit a comparison of the Unit 2 design to the criteria contained in RG 1.75 and IEEE-384. This comparison should focus on the instrumentation and control systems within both the Power Generation Control Complex (PGCC) and the balance of plant. The information provided should supplement FSAR Table 1.8-1 and FSAR Sections 7.1.2, 7.2.6 and 8.3.1 such that each regulatory position of RG 1.75 and each separation criterion of IEEE-384 is addressed.
Alternate methods of providing separation to those contained in RG 1.75 and IEEE-384 should be identified and justified. Where barriers (e.g., flexible conduit, sheet metal enclosures, fire-retardant tape) are used to provide separation, the details of the testing used to qualify the barriers should be provided.
Where analyses have been used to justify lesser separation than that recommended in RG 1.75 and IEEE-384, a detailed discussion of the analyses including the assumptions, methods, supporting tests and conclusions should be provided.
RESOLUTION (PENDING)
A comparison of the Unit 2 design to the criteria contained in RG 1.75 and IEEE-384-74 is shown in Table 7B-1 for instrumentation and control systems within the PGCC and balance of plant (BOP).
NMP Unit 2 USAR Chapter 07 7B-2 Rev. 25, October 2022 TABLE 7B-1 SEPARATION EVALUATION IEEE-384-74 Criteria Reg. Guide 1.75, Rev. 1 Regulatory Position C Design Conformance PGCC BOP Isolation device - A device in a circuit which prevents malfunctions in one section of a circuit from causing unacceptable influences in other sections of the circuit or other circuits.
C.1 Supplement IEEE-384 definition as follows: "interrupting devices actuated only by fault current are not considered to be isolation devices within the context of this document."
Since interrupting devices (fuses and/or circuit breakers) actuated only by fault current are not considered as isolation devices, a combination of two interrupting devices or an EPA in conjunction with an interrupting device is used. For a limited number of cases involving low-energy circuits, a single interrupting device has been used. These cases have been justified by analysis.
A summary of this analysis was submitted to the NRC under separate cover on January 28, 1986.
Interrupting devices actuated only by fault current are not used as isolation devices for isolating non-Class 1E power circuits from Class 1E power circuits. In the case of control and instrument circuits, a combination of two interrupting devices actuated by fault current have been used to isolate non-Class 1E devices and circuits from Class 1E circuits.
Both of these interrupting devices are Class 1E and are coordinated with the circuit breaker upstream.
Any circuit breaker associated with this redundant protection will be tested periodically.
Raceway - Any channel that is designed and used expressly for supporting wires, cable, or busbars. Raceways consist primarily of, but are not restricted to cable trays conduits, and interlocked armor enclosing cable.
C.2 Interlocked armor enclosing cable should not be construed as a "raceway."
Interlocked armor cable is not used as a raceway.
Meets this requirement.
Criteria 4.1 Required Separation Separation shall be provided to maintain the independence of sufficient number of circuits and equipment so that the protective functions required during and following any design basis event can be accomplished.
The degree of separation No comment.
Separation is provided to maintain the independence of sufficient number of circuits and equipment required for protective function.
Independence is achieved through equipment arrangement, materials, wiring practices and isolation devices and/or space or by analysis.
Meets this requirement.
NMP Unit 2 USAR Chapter 07 7B-3 Rev. 25, October 2022 TABLE 7B-1 (Cont'd.)
IEEE-384-74 Criteria Reg. Guide 1.75, Rev. 1 Regulatory Position C Design Conformance PGCC BOP required varies with the potential hazards in a particular area.
4.2 Equipment and Circuits Requiring Separation Equipment and circuits requiring separation shall be determined and delineated early in the plant design and shall be identified on documents and drawings in a distinctive manner.
No comment.
Equipment and circuits requiring separation are delineated in the plant design documents and identified in a distinctive manner.
Meets this requirement.
4.3 Methods of Separation The separation of circuits and equipment shall be achieved by safety class structures, distance, or barriers, or any combination thereof.
C.3 Whenever practicable and where its use does not conflict with other safety objectives, locate redundant circuits and equipment in separate safety class structures.
The separation of circuits and equipment is achieved by locating them in separate safety class structures, distance, or barriers, or any combination thereof or by analysis.
Meets this requirement.
4.4 Compatibility With Mechanical Systems The separation of Class 1E circuits and equipment shall be such that the required independence will not be compromised by the failure of mechanical systems served by the Class 1E systems. For example, Class 1E circuits shall be routed or protected such that failure of related mechanical equipment of one redundant system cannot disable Class 1E circuits or equipment essential to the operation of the other redundant system(s).
No comment.
Class 1E circuits are routed and/or protected such that failure of related mechanical equipment of one Class 1E system will not disable Class 1E circuits or equipment essential to the operation of its redundant system(s).
Meets this requirement.
NMP Unit 2 USAR Chapter 07 7B-4 Rev. 25, October 2022 TABLE 7B-1 (Cont'd.)
IEEE-384-74 Criteria Reg. Guide 1.75, Rev. 1 Regulatory Position C Design Conformance PGCC BOP 4.5 Associated Circuits Associated circuits shall comply with one of the following: (1)
They shall be uniquely identified as such and shall remain with, or be separated the same as, those Class 1E circuits with which they are associated, (2) They shall be in accordance with (1) above from the Class 1E equipment to and including an isolation device.
Beyond the isolation device a circuit is not subject to the requirements of this document provided it does not again become associated with a Class 1E system, (3) They shall be analyzed or tested to demonstrate that Class 1E circuits are not degraded below an acceptable level.
C.4 and C.6 Associated circuits should be subject to all requirements placed on Class 1E circuits such as cable derating, environmental qualification, flame retardance, splicing restrictions and raceway fill unless it can be demonstrated that the absence of such requirements could not significantly reduce the availability of the Class 1E circuits.
Analysis should be submitted as part of Safety Analysis Report, and should identify those circuits installed in accordance with this section.
Associated circuits are either subject to all requirements placed on Class 1E circuits or are analyzed to demonstrate that the associated circuits will not degrade the Class 1E circuits below an acceptable level. Such an analysis, when performed, is maintained as part of the design record. See Note 5. A summary of these analyses was submitted under separate cover to the NRC on January 28, 1986.
Associated circuits are treated as Class 1E circuits, including seismic requirements, or are analyzed to demonstrate that the associated circuits will not degrade the Class 1E circuits below an acceptable level. Such an analysis, when performed, is maintained as part of the design record. See Note 12.
4.6 Non-Class 1E Circuits 4.6.1 Separation from Class 1E Circuits Non-Class 1E circuits shall be separated from Class 1E circuits by the minimum separation requirements specified in Sections 5.1.3, 5.1.4 or 5.6, or they become associated circuits.
No comment.
Non-Class 1E circuits comply with the requirements of IEEE-384 Sections 5.1.3, 5.1.4, or 5.6, or they are treated as associated circuits.
Meets this requirement. For 600-V systems and less, acceptable lesser minimum separation distances have been determined by analysis/tests in accordance with Section 5.1.1.2. See Section 1.8, RG 1.75 position for details.
4.6.2 Separation from Associated Circuits Non-Class 1E circuits shall be separated from associated circuits by the minimum separation requirements specified in Sections 5.1.3, 5.1.4, or 5.6.2 or (1) the effects of lesser separation between the Non-Class 1E circuits and the associated C.6 Analysis performed in accordance with this section should be submitted as part of Safety Analysis Report and should identify those circuits installed in accordance with this section.
Non-Class 1E circuits are separated from Class 1E and associated circuits in accordance with the requirements of IEEE-384, Sections 5.1.3, 5.1.4, or 5.6.2, or effects of lesser separation are analyzed to demonstrate that Class 1E circuits are not degraded below an acceptable level. Such analysis, when performed, is a Meets this requirement. For 600-V systems and less, acceptable lesser minimum separation distances have been determined by analysis/tests in accordance with Section 5.1.1.2. See Section 1.8, RG 1.75 position for details.
NMP Unit 2 USAR Chapter 07 7B-5 Rev. 25, October 2022 TABLE 7B-1 (Cont'd.)
IEEE-384-74 Criteria Reg. Guide 1.75, Rev. 1 Regulatory Position C Design Conformance PGCC BOP circuits shall be analyzed to demonstrate that Class 1E circuits are not degraded below an acceptable level or (2) they become associated circuits.
Non-Class 1E instrumentation and control circuits are not required to be separated from associated circuits.
Figure 1 shows examples of acceptable circuit arrangements.
C.7 Non-Class 1E instrumentation and control circuits should not be exempted from the provisions of Section 4.6.2.
part of the design record.
Non-Class 1E instrumentation and control circuits are not exempted from the provisions of Section 4.6.2.
- 5.
Specific Separation Criteria 5.1 Cables and Raceways 5.1.1 General 5.1.1.1 The routing of Class 1E circuits and location of equipment served by these Class 1E circuits shall be reviewed for exposure to potential hazards such as high-pressure piping, missiles, flammable material flooding, and wiring that is not flame retardant.
C.8 Section 5.1.1.1 should not be construed to imply that adequate separation of redundant circuits can be achieved within a confined space such as a cable tunnel that is effectively unventilated.
Separation of Class 1E circuits and equipment makes effective use of such features as different safety structures and separated areas for redundant circuits and equipment. A degree of separation commensurate with the damage potential of the hazard is provided such that the independence of the redundant Class 1E systems is maintained at an acceptable level.
- 1. The non-Class 1E cables within PGCC are routed in two ways:
- a. They are routed in non-Class 1E ducts whenever practical.
- b. When it is impractical, such as certain utility and fire protection circuits, they are routed in divisional ducts with grounded flexible conduit.
In this case, they are routed mostly in one Generally, different divisional equipment is located in different rooms; different divisional cables are routed through different areas; separate tunnels are used for routing cables of different divisions.
NMP Unit 2 USAR Chapter 07 7B-6 Rev. 25, October 2022 TABLE 7B-1 (Cont'd.)
IEEE-384-74 Criteria Reg. Guide 1.75, Rev. 1 Regulatory Position C Design Conformance PGCC BOP A degree of separation commensurate with the damage potential of the hazard shall be provided such that the independence of redundant Class 1E systems is maintained at an acceptable level. The separation of Class 1E circuits and equipment shall make effective use of features inherent in the plant design such as using different rooms or opposite sides of rooms or areas.
divisional duct only or occasionally in more than one divisional duct. All non-Class 1E cables routed in divisional ducts in flexible conduit are provided with redundant circuit protective devices.
The circuit breakers associated with this redundant protection will be tested periodically.
- 2.
All cables used within PGCC meet or exceed IEEE-383 flame propagation requirements.
See also Section 8.3.1.4.2 for exception.
See Section 8.3.1.4.2 for details.
5.1.1.2 In those areas where the damage potential is limited to failures or faults internal to the electrical equipment or circuits, the minimum separation distance can be established by analysis of the proposed cable installation.
This analysis shall be based on tests performed to determine the C.6 Analysis performed in accordance with this section should be submitted as part of the Safety Analysis Report, and should identify circuits installed in accordance with these sections.
Cable installations within PGCC have been analyzed for separation adequacy.
For 600-V systems and less, acceptable minimum separation distances have been established by analysis/tests. See Section 1.8, RG 1.75 position for details.
NMP Unit 2 USAR Chapter 07 7B-7 Rev. 25, October 2022 TABLE 7B-1 (Cont'd.)
IEEE-384-74 Criteria Reg. Guide 1.75, Rev. 1 Regulatory Position C Design Conformance PGCC BOP flame-retardant characteristics of the proposed cable installation considering features such as cable insulation and jacket materials, cable tray fill, and cable tray arrangement.
5.1.1.3 The minimum separation distances specified in Sections 5.1.3 and 5.1.4 are based on open ventilated cable trays of either the ladder or trough type as defined in NEMA VE 1-1971, Cable Tray Systems. Where these distances are used to provide adequate physical separation:
- 1. Cables and raceways involved shall be flame retardant.
- 2. The design basis shall be that the cable trays will not be filled above the side rails.
- 3. Hazards shall be limited to failures or faults internal to the electric equipment or cables.
If less separation distances are used, they shall be established as in Section 5.1.1.2.
C.9 This section should be supplemented with Item 5.1.1.3(4) as follows: "Cable splices in raceways should be prohibited."
NOTE: Cable splices are not, by themselves, unacceptable. If they exist, the resulting design should be justified by analysis. The analysis should be submitted as part of the Safety Analysis Report.
Open ventilated cable trays and cable splices are not used.
Meets this requirement. Cable splices in raceways are prohibited; splicing in electrical penetrations for cable termination is considered to be exempt from this requirement. Also, condulets and junction boxes used as a termination point, at the load, are considered to be exempt from this requirement.
5.1.2 Identification Exposed Class 1E raceways shall be marked in a distinct permanent manner at intervals not to exceed 15 ft and at points of entry to and exiting from enclosed areas.
Class 1E raceways shall be marked prior C.10 The phrase "at a sufficient number of points" should be understood to mean at intervals not to exceed 5 ft throughout the entire cable length. Also the preferred method of marking cable is color coding.
Meets the requirement.
Meets the requirements except that the cables are marked at intervals of 15 ft instead of 5 ft; see FSAR Section 1.8, RG 1.75 position for the explanations. See FSAR Section 8.3.1.3 for the details of the methods of identification used.
NMP Unit 2 USAR Chapter 07 7B-8 Rev. 25, October 2022 TABLE 7B-1 (Cont'd.)
IEEE-384-74 Criteria Reg. Guide 1.75, Rev. 1 Regulatory Position C Design Conformance PGCC BOP to the installation of their cables. Cables installed in these raceways shall be marked in a manner of sufficient durability and at a sufficient number of points to facilitate initial verification that the installation is in conformance with the separation criteria. These cable markings shall be applied prior to or during installation.
Class 1E cables shall be identified by a permanent marker at each end in accordance with the design drawings or cable schedule.
The method of identification used to meet the above requirements shall readily distinguish between redundant Class 1E systems and between Class 1E and non-Class 1E systems.
C.11 This section should be supplemented as follows: "The method of identification used should be simple and should preclude the need to consult any reference material to distinguish between Class 1E and Non-Class 1E circuits, between Non-Class 1E circuits associated with different redundant Class 1E systems, and between redundant Class 1E systems.
5.1.3 Cable Spreading Area The cable spreading area is the space(s) adjacent to the main control room where instrumentation and control cables converge prior to entering the control, termination, or instrument panels.
The cable spreading area shall not contain high-energy equipment such as switchgear, transformers, rotating equipment, or potential sources of missiles or pipe whip and shall not be used for storing flammable materials. Circuits in the cable spreading area should be limited to C.12 Pending issuance of other acceptable criteria, those portions of Section 5.1.3 (exclusive of the Note following the second paragraph) that permit the routing of power cables through the cable spreading area(s) and by implication, the control room, should not be construed as acceptable. Also, Section 5.1.3 should be supplemented as follows: "Where feasible, redundant cable spreading areas should be utilized."
Cables feeding power to control and instrumentation circuits are not required to run in conduit within PGCC. These cables are treated as control and instrumentation cables and are run in PGCC ducts along with other cables in the same division.
Meets the requirements; separate cable riser areas are used for the redundant circuits. Power cables in the riser areas are routed in enclosed raceways. See Section 8.3.1.4.2. For 600-V systems and less, acceptable lesser minimum separation distances have been established by analysis/test in accordance with Section 5.1.1.2.
See Section 1.8, RG 1.75 position for details.
NMP Unit 2 USAR Chapter 07 7B-9 Rev. 25, October 2022 TABLE 7B-1 (Cont'd.)
IEEE-384-74 Criteria Reg. Guide 1.75, Rev. 1 Regulatory Position C Design Conformance PGCC BOP control and instrumentation functions and those power supply circuits and facilities serving the control room and instrument systems. Power supply feeders to instrument and control room distribution panels shall be installed in enclosed raceways that qualify as barriers.
Other power circuits that are required to traverse this area shall be assigned to a minimum number of routes consistent with their separation requirements and allocated solely for these power circuits. Such traversing power circuits shall be separated from other circuits in this area by a minimum distance of 3 ft and barriers.
NOTE: An acceptable alternative routing for such traversing power circuits would be to route them in imbedded conduit or in a separate enclosure designed as safety class structure (for example, a concrete duct bank or other suitable enclosure) which in effect removes them from the area defined as the cable spreading area.
The minimum separation distance between redundant Class 1E cable trays shall
NMP Unit 2 USAR Chapter 07 7B-10 Rev. 25, October 2022 TABLE 7B-1 (Cont'd.)
IEEE-384-74 Criteria Reg. Guide 1.75, Rev. 1 Regulatory Position C Design Conformance PGCC BOP NOTE: Horizontal separation is measured from the side rail of one tray to the side rail of the adjacent tray. Vertical separation is measured from the bottom of the top tray to the top of the side rail of the bottom tray. (See also Section 5.1.4).
Where termination arrangements preclude maintaining the minimum separation distance, the redundant circuits shall be run in enclosed raceways that qualify as barriers or other barriers shall be provided between redundant circuits. The minimum distance between these redundant enclosed raceways and between barriers and raceways shall be in 1 in. Figures 2, 3, 4 and 5 illustrate examples of acceptable arrangements of barriers and enclosed raceways where the minimum separation distance cannot be maintained.
C.13 No significance should be attached to the different tray widths illustrated in Figure 2.
See Notes 2, 3, 4, 6, 7, 9 and 10.
5.1.4 General Plant Areas In plant areas from which potential hazards such as missiles, external fires, and pipe whip are excluded, the minimum separation distance between redundant cable trays shall be determined by Section 5.1.1.2 or, where the conditions of Section 5.1.1.3 are met, shall be 3 ft between trays separated horizontally and 5 ft between trays separated vertically. If, in addition, high-energy electric equipment Not applicable.
Meets requirements. See position in Section 5.1.1.2.
NMP Unit 2 USAR Chapter 07 7B-11 Rev. 25, October 2022 TABLE 7B-1 (Cont'd.)
IEEE-384-74 Criteria Reg. Guide 1.75, Rev. 1 Regulatory Position C Design Conformance PGCC BOP such as switchgear, transformers, and rotating equipment is excluded and power cables are installed in enclosed raceways that qualify as barriers, or there are no power cables, the minimum separation distance may be as specified in Section 5.1.3.
Where plant arrangements preclude maintaining the minimum separation distance, the redundant circuits shall be run in enclosed raceways that qualify as barriers or other barriers shall be provided between redundant circuits. The minimum distance between these redundant enclosed raceways and between barriers and raceways shall be in 1 in. Figures 2, 3, 4 and 5 illustrate examples of acceptable arrangements of barriers and enclosed raceways where the minimum separation distance cannot be maintained.
5.2 Standby Power Supply 5.2.1 Standby Generating Units Redundant Class 1E standby generating units shall be placed in separate safety class structures.
C.14 Section 5.2.1 should be supplemented as follows: "and should have independent air supplies."
Not applicable.
Meets this requirement. See Section 8.3.1.1.2.
5.2.2 Auxiliaries and Local Controls The auxiliaries and local controls for redundant standby generating units shall be located in the same safety class structure as the unit they serve Meets this requirement. See Section 8.3.1.1.2.
NMP Unit 2 USAR Chapter 07 7B-12 Rev. 25, October 2022 TABLE 7B-1 (Cont'd.)
IEEE-384-74 Criteria Reg. Guide 1.75, Rev. 1 Regulatory Position C Design Conformance PGCC BOP or be physically separated in accordance with the requirements of Section 4.
5.3 Dc System 5.3.1 Batteries Redundant Class 1E batteries shall be placed in separate safety class structures.
C.15 Where ventilation is required, the separate safety class structures required by Section 5.3.1 should be served by independent ventilation systems.
Not applicable.
Meets this requirement. See Section 8.3.1.4.2.
5.3.2 Battery Chargers Battery chargers for redundant Class 1E batteries shall be physically separated in accordance with the requirements of Section
- 4.
No comment.
Not applicable.
Meets this requirement. See Section 8.3.1.4.2.
5.4 Distribution System 5.4.1 Switchgear Redundant Class 1E distribution switchgear groups shall be physically separated in accordance with the requirements of Section
- 4.
Section 8.3.1.4.2.
Meets this requirement. See Section 8.3.1.4.2.
5.4.2 Motor Control Centers Redundant Class 1E motor control centers shall be physically separated in accordance with the requirements of Section 4.
Meets this requirement. See Section 8.3.1.4.2.
5.4.3 Distribution Panels Redundant Class 1E distribution panels shall be physically separated in accordance with the requirements of Section 4.
Meets this requirement. See Section 8.3.1.4.2.
5.5 Containment Electrical Penetrations Redundant Class 1E containment electrical penetrations shall be No comment.
Not applicable.
Meets this requirement. See Section 8.3.1.4.2.
NMP Unit 2 USAR Chapter 07 7B-13 Rev. 25, October 2022 TABLE 7B-1 (Cont'd.)
IEEE-384-74 Criteria Reg. Guide 1.75, Rev. 1 Regulatory Position C Design Conformance PGCC BOP physically separated in accordance with the requirements of Section
- 4. Compliance with Section 4 will generally require that redundant penetrations be widely dispersed around the circumference of the containment. The minimum physical separation for redundant penetrations shall meet the requirements for cables and raceways given in Section 5.1.4.
Non-Class 1E circuits routed in penetrations containing Class 1E circuits shall be treated as associated circuits in accordance with the requirements of Section 4.5.
5.6 Control Switchboards 5.6.1 Location and Arrangement Main control switchboards shall be located in a control room within a safety class structure. The control room shall protect from and shall not contain high-energy switchgear, transformers rotating equipment, or potential sources of missiles or pipe whip.
Local control switchboards shall be located so that hazards such as fires, missiles, vibration, pipe whip, and water sprays shall not cause failures common to redundant Class 1E functions.
Separation of redundant Class 1E equipment and circuits may be achieved by locating them on No comment.
See BOP.
Not applicable.
Controls for redundant Class 1E equipment are located on separate control panels.
Meets the requirements.
The main control switchboards (PGCC) are located in the control building which is a seismic Category I structure. The main control room does not contain any high-energy equipment. See Section 3.8.
Meets this requirement.
Meets this requirement.
NMP Unit 2 USAR Chapter 07 7B-14 Rev. 25, October 2022 TABLE 7B-1 (Cont'd.)
IEEE-384-74 Criteria Reg. Guide 1.75, Rev. 1 Regulatory Position C Design Conformance PGCC BOP separate control switchboards physically separated in accordance with the requirements of Section
- 4. Where operational considerations dictate that redundant Class 1E equipment be located on a single control switchboard, the requirements of Sections 5.6.2, 5.6.4, and 5.6.6 shall apply.
However, due to operational considerations, the redundant Class 1E controls are located on the same control panel. These items are provided with adequate separation to meet the single failure criteria.
5.6.2 Internal Separation The minimum separation distance between redundant Class 1E equipment and wiring internal to the control switchboards can be established by analysis of the proposed installation. This analysis shall be based on tests performed to determine the flame-retardant characteristics of the wiring, wiring materials, equipment, and other materials internal to the control switchboard. Where the control switchboard materials are flame retardant and analysis is not performed, the minimum separation distance shall be 6 in. In the event the above separation distances are not maintained, barriers shall be installed between redundant Class 1E equipment and wiring.
No comment.
The minimum separation distance between redundant Class 1E equipment and wiring inside the control panels is maintained at 6 in. Due to the circuit configuration, if 6 in is not achievable, alternate means are used to justify lesser degree of separation, such as metallic barriers, enclosures, conduits, isolation devices and/or analysis.
See Notes 2, 3, 4, 5, 7, 9 and 10.
Meets this requirement.
5.6.3 Internal Wiring Identification Class 1E wire bundles or cables internal to the control boards shall be identified in a distinct permanent manner at a sufficient number of points to readily distinguish between No comment.
Class 1E wires and cables internal to panel are identified to distinguish between redundant Class 1E and non-Class 1E wiring.
See Notes 5 and 8.
Meets this requirements.
NMP Unit 2 USAR Chapter 07 7B-15 Rev. 25, October 2022 TABLE 7B-1 (Cont'd.)
IEEE-384-74 Criteria Reg. Guide 1.75, Rev. 1 Regulatory Position C Design Conformance PGCC BOP redundant Class 1E wiring and between Class 1E and non-Class 1E wiring.
5.6.4 Common Terminations Where redundant Class 1E wiring is terminated on common device, the provisions of Section 5.6.2 shall be met.
No comment.
Common terminations within the control panels meet the provisions of IEEE-384, para. 5.6.2. See Note 1.
Meets this requirement.
5.6.5 Non-Class 1E Wiring Non-Class 1E wiring not separated from Class 1E wiring by the minimum separation distance (determined in Section 5.6.2) or by a barrier shall be treated as associated circuits in accordance with the requirements of Section 4.5.
No comment.
Non-Class 1E wiring within the control panels is separated from the redundant Class 1E wiring.
Wherever the non-Class 1E wiring cannot be separated from the Class 1E wiring, (1) it is treated as associated wiring, or (2) an analysis is performed to demonstrate the adequacy of lesser separation, or (3) proper isolation (barrier or common device) is provided to achieve the required separation.
Meets this requirement.
Acceptable lesser minimum separation distance between Class 1E and non-Class 1E has been determined by analysis/test. See Section 1.8, RG 1.75 position for details.
5.6.6 Cable Entrance Redundant Class 1E cables entering the control board enclosure shall meet the requirement of Section 5.1.3.
No comment.
Redundant Class 1E cables entering the control board enclosure are (1) separated by a minimum distance of 6 in or a barrier, or (2) enclosed in a raceway. See Notes 2 and 9.
Meets this requirement.
5.7 Instrumentation Cabinets Redundant Class 1E instruments shall be located in separate cabinets or compartments of a cabinet. Where redundant Class 1E instruments are located in separate compartments of a single cabinet, attention must be given to routing of external cables to the instruments to assure that cable separation is retained.
C.16 The first paragraph of Section 5.7 should be augmented as follows:
"The separation requirements of 5.6 apply to instrumentation cabinets."
Redundant Class 1E instruments are located in separate cabinets or separate compartments of a cabinet. If redundant instruments are required to be located on a single cabinet or single compartment, barriers are provided. Cables entering such cabinets are separated by a minimum distance; or, barriers are provided between redundant components and wiring.
Meets this requirement.
NMP Unit 2 USAR Chapter 07 7B-16 Rev. 25, October 2022 TABLE 7B-1 (Cont'd.)
IEEE-384-74 Criteria Reg. Guide 1.75, Rev. 1 Regulatory Position C Design Conformance PGCC BOP In locating Class 1E instrument cabinets, attention must be given to the effects of all pertinent design basis events.
See BOP response.
Meets this requirement.
5.8 Sensors and Sensor to Process Connections Redundant Class 1E sensors and their connections to the process system shall be sufficiently separated that functional capability of the protection system will be maintained despite any single design basis event or result therefrom. Consideration shall be given to secondary effects of design basis events such as pipe whip, steam release, radiation, missiles, or flooding.
Large components such as the reactor vessel can be considered a suitable barrier if the sensor to process connecting lines are brought out at widely divergent points and routed so as to keep component between redundant lines.
Redundant pressure taps located on opposite sides of a large pipe may be considered to be separated by the pipe, but the lines leaving the taps must be protected against damage from a credible common cause unless other redundant or diverse instrumentation is provided.
No comment.
Sufficient number of redundant sensors are provided to perform system level safety function.
Adequate separation is maintained between required number of redundant sensors to maintain the functional capability of the protection system. Neutron monitoring sensor cables under the vessel are exempt from this criterion because of the space limitations.
Meets this requirement.
5.9 Actuated Equipment Locations of Class 1E actuated equipment, such as pump drive motors and valve operating motors are normally dictated by No comment.
Redundant Class 1E actuated equipments are separated to meet the single-failure criteria and assure sufficient safety function to mitigate a DBE.
Meets this requirement.
NMP Unit 2 USAR Chapter 07 7B-17 Rev. 25, October 2022 TABLE 7B-1 (Cont'd.)
IEEE-384-74 Criteria Reg. Guide 1.75, Rev. 1 Regulatory Position C Design Conformance PGCC BOP the location of the driven equipment. The resultant locations of this equipment must be reviewed to ensure that separation of redundant Class 1E actuated equipment is acceptable.
Meets this requirement.
GENERAL NOTES:
Non-Class 1E circuits not separated by 6 in from Class 1E or associated circuits have been analyzed to demonstrate the adequacy of lesser separation.
The items analyzed are:
- 1.
Common devices such as relays and contactors for Class 1E/Class 1E and Class 1E/non-Class 1E interfaces. Test reports and analyses are available in GE Design Record Files (DRF). Common devices include scram contactors, HFA relays, Agastat relays, and reactor mode switches.
- 2.
Sil-Temp tape as a separation barrier. The test report and analysis are available in GE DRFs.
- 3.
Use of flexible or rigid conduit or steel enclosures as a separation barrier. The test report and analysis is available in GE DRFs.
- 4.
Justification of separation less than 6 in between smoke detector, its wiring and Class 1E wiring is available in GE DRFs. Common devices are also covered in Appendix 7A.1. Sil-Temp tape and flexible conduit are covered in Appendix 8A.
- 5.
NMS panels P606 and P633 are exceptions to RG 1.75. The NUMAC PRNM system installed in P608 under modification PN2Y93MX002 is designed to meet RG 1.75, except in some cases where the adequacy of separation or isolation is based on analysis.
- 6.
Justification of running bare cable along with a conduit is available in GE DRFs.
- 7.
Justification of separation of less than 1 in between redundant enclosed raceways and between barriers and raceways is available in GE DRFs.
- 8.
Prewired vendor equipment that does not meet color coding is identified in GE specification.
- 9.
Use of cable connector housing as an acceptable separation barrier is available in GE DRFs.
- 10.
Justification of separation of less than 6 in between utility devices and its wiring and Class 1E wiring is available in GE DRFs.
- 11.
All analyses/justification for any exceptions are documented in GE DRFs and are available on request.
- 12.
An analysis/justification is documented in Design Change Package #N2-02-215.