GO2-04-177, License Amendment Request: Control Rod Drop Accident Analysis

License Amendment Request: Control Rod Drop Accident Analysis

ML043000097
Person / Time
Site:	Columbia
Issue date:	10/12/2004
From:	Atkinson D Energy Northwest
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
+sispmjr200511, GO2-04-177, IR-97-013
Download: ML043000097 (40)

Text

E ENERGY NORTHWEST People *Vision* Solutions P.O. Box 968

• Richland, WA

• 99352-0968 October 12, 2004 G02-04-177 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, D.C. 20555

Subject:

COLUMBIA GENERATING STATION, DOCKET NO. 50-397 LICENSE AMENDMENT REQUEST: CONTROL ROD DROP ACCIDENT ANALYSIS

References:

1) Letter dated February 9, 1998, NRC to JV Parrish, "NRC Inspection Report 50-397/97-13"

2) Letter dated June 1, 1998, NRC to JV Parrish, "Notice of Violation and Exercise of Enforcement Discretion (NRC Inspection Report 5-0397/97-13)"

Dear Sir or Madam:

Pursuant to 10 CFR 50.90, Energy Northwest requests Nuclear Regulatory Commission (NRC) review and approval to amend Operating License NPF-21 for the Columbia Generating Station (Columbia). The proposed amendment requests NRC approval to update the Final Safety Analysis Report (FSAR) to reflect that the reactor core isolation cooling (RCIC) system is not required to mitigate the consequences of the control rod drop accident (CRDA).

Energy Northwest is requesting NRC permission to revise the FSAR to clarify that although the RCIC system is designed to initiate and inject into the reactor pressure vessel (RPV) at a low water level (L2), the additional RPV inventory is not required to prevent the accident or to mitigate the consequences of the CRDA. Energy Northwest believes that this clarification could be viewed as a departure from a method of evaluation described in the FSAR used in establishing the design bases or in the safety analyses (i.e., criterion 10 CFR 50.59(c)(2)viii).

The decision to submit this request is based, in part, on recent history with the NRC regarding the downgrading of the RCIC system without prior NRC approval. In Reference 1, the NRC discussed two apparent violations. The first apparent violation "involved the failure to perform an adequate safety evaluation in accordance with the requirements of 10 CFR 50.59. The violation involved the downgrading of the reactor core isolation cooling system from a safety-

,U53

LICENSE AMENDMENT REQUEST: CONTROL ROD DROP ACCIDENT ANALYSIS Page 2 related system to a non safety-related system without NRC approval. This downgrading may have increased the probability of occurrence of a malfunction of equipment important to safety previously evaluated in the Final Safety Analysis Report and increased the possibility for a malfunction of a different type than any evaluated previously in the Final Safety Analysis Report. Therefore, this downgrade apparently constituted an unreviewed safety question in accordance with the requirements of 10 CFR 50.59."

The letter further states that, as the result of review and discussions, the NRC concurred with the Energy Northwest positions that: "the reactor core isolation cooling system was identified as a nonsafety-related system when utilized for the loss-of-feedwater event, that the reactor core isolation cooling system was not an emergency core cooling system, that the automatic depressurization system is now the single failure backup to the high pressure core spray system, and that the reactor core isolation cooling system was not the designated coping system for station blackout. However, we also noted that you concluded that the reactor core isolation cooling system was classified as a safety-related system to provide a backup to the high pressure core spray system for the control rod drop design basis event and that approval of the classification downgrade was not docketed by the NRC. We also acknowledge your actions to restore the reactor core isolation cooling system to a safety-related classification."

The violation for failure to perform a safety evaluation in accordance'with 10 CFR 50.59 prior to downgrading the RCIC system from a safety-related system to a nonsafety-related system, a change which constituted an unreviewed safety question, was cited in Reference 2.

The interpretation of the FSAR that the RCIC system is credited to mitigate the consequences of the CRDA has led to the decision to report to the NRC each time the RCIC system is inoperable. This is an unnecessary burden that can also mislead the public regarding the overall safety at Columbia. With RCIC unavailable, the plant would be fully capable of responding to the CRDA, even though the reports classify the events as conditions that could prevent the fulfillment of a safety function.

The proposed change is based on the fact and limited to the clarification that the consequences of the CRDA are not dependent on the RCIC response to the CRDA. Following the proposed change, the RCIC system will remain classified as safety-related. provides an evaluation with a detailed description of the background, proposed change, and technical analysis. The No Significant Hazards Consideration Determination, and Environmental Review Consideration are also contained in Attachment 1. Attachment 2 provides the marked-up pages of the FSAR with the justification for the individual changes. provides a listing of related NRC, GE, and Energy Northwest documents.

LICENSE AMENDMENT REQUEST: CONTROL ROD DROP ACCIDENT ANALYSIS Page 3 On September 30, 2004, Energy Northwest submitted a License Amendment Request to implement the alternative source term (AST) at Columbia (GO2-04-170). Consistent with previous analyses, the CRDA analysis performed using the AST does not credit RCIC as a mitigating system, structure, or component. To avoid the potential conflict, Energy Northwest requests that the NRC respond to this submittal prior to or coincident with the approval of the AST submittal. Therefore, Energy Northwest requests that the NRC complete the review of this request within a year. Upon approval of the proposed FSAR changes, the changes will be implemented within the next 60 days.

In accordance with 10 CFR 50.91, a copy of this application, with attachments, is being provided to the designated Washington State Official.

Should you have any questions or require additional information regarding this matter, please contact Mr. Doug Coleman, Regulatory Programs Manager, at (509) 377-4342.

Respectfully, DK Atkinson Vice President, Technical Services Mail Drop PE08 Attachments: 1. Evaluation of the change

2. Marked up pages of the FSAR

3. References cc:

BS Mallett - NRC RIV WA Macon - NRC NRR RR Cowley - WDOH RN Sherman - BPA/1399 TC Poindexter - Winston & Strawn NRC Sr. Resident Inspector - 988C JO Luce - EFSEC

STATE OF WASHINGTON)

Subject:

License Amendment Request for Control Rod Drop Accident Analysis COUNTY OF BENTON

)

1, D.K. Atkinson, being duly sworn, subscribe to and say that I am the Vice President, Technical Services for ENERGY NORTHWEST, the applicant herein; that I have the full authority to execute this oath; that I have reviewed the foregoing; and that to the best of my knowledge, information, and belief the statements made in it are true.

DATE

. 2004

b.

c_

D. K. Atkinson Vice President, Technical Services On this date personally appeared before me D. K. Atkinson, to me known to be the individual who executed the foregoing instrument, and acknowledged that he signed the same as his free act and deed for the uses and purposes herein mentioned.

GIVEN under my hand and seal this /2 day of.

,1 2004.

Nota6 Public in and for the STATE OF WASHINGTON Residing at 1#

My Commission Expires 3 gz

LICENSE AMENDMENT REQUEST: CONTROL ROD DROP ACCIDENT ANALYSIS Page 1 of 9

1.0 DESCRIPTION

Pursuant to 10 CFR 50.90, Energy Northwest requests Nuclear Regulatory Commission (NRC) review and approval to amend Operating License NPF-21 for the Columbia Generating Station (Columbia). The proposed amendment requests NRC approval to update the Final Safety Analysis Report (FSAR) to reflect that the reactor core isolation cooling (RCIC) system is not required to mitigate the consequences of the control rod drop accident (CRDA).

2.0 PROPOSED CHANGE

The RCIC system is not required to mitigate the radiological consequences of the CRDA, although it can be used to facilitate the normal plant shutdown and residual heat removal after a CRDA. The long-term core shutdown cooling function is addressed in FSAR Section 5.4.6.1, "RCIC System Design Bases," and FSAR Section 7.4.1.1, "Reactor Core Isolation Cooling System." The RCIC system is designed to maintain or supplement reactor vessel water inventory during the following conditions:

• "When the reactor vessel is isolated from its primary heat sink (main condenser) and accompanied by a loss or unavailability of the reactor feedwater system; and

• When the plant is being shut down and normal coolant flow from the feedwater system is stopped before the reactor is depressurized to a level where the reactor shutdown cooling mode of the RHR system can be placed into operation."

These two conditions adequately address the design function of the RCIC system. Therefore, a third condition describing the requirement to backup HPCS during the CRDA, as discussed in FSAR Section 7.4.1.1.1, is being deleted.

"Wlhenl reureda bau to, tn he high pessusre core sr-ay (14PC-9 system for-the control rod drop accident by automatically supplying cooling water to the reactor if vesse low wateF level (level i2n is sensed."

Several other changes are needed in the FSAR to clarify the design functions of the RCIC system. The proposed revised FSAR pages and the justification for the individual changes are included as Attachment 2.

LICENSE AMENDMENT REQUEST: CONTROL ROD DROP ACCIDENT ANALYSIS Page 2 of 9 In summary, Energy Northwest is requesting NRC approval to revise the FSAR to clarify that although the RCIC system is designed to initiate and inject into the reactor pressure vessel (RPV) at a low water level (L2), the additional RPV inventory is not specifically required to prevent the accident or to mitigate the consequences of the CRDA. Energy Northwest believes that clarification could be viewed as a departure from a method of evaluation described in the FSAR used in establishing the design bases or in the safety analyses (i.e., criterion 10 CFR 50.59(c)(2)viii). The decision to submit this request is based, in part, on recent history with the NRC regarding the downgrading of the RCIC system without prior NRC approval.

3.0 BACKGROUND

3.1

System Description

The RCIC system is a high-pressure reactor coolant makeup system that will operate independently of an AC power supply. The system provides sufficient water to the reactor pressure vessel (RPV) to cool the core and to maintain the reactor in a standby condition if the vessel becomes isolated from the main condenser and experiences a loss of feedwater (LOF) flow. The system is also designed to permit a plant shutdown under conditions of loss of feedwater flow by maintaining the necessary reactor water inventory until the vessel is depressurized to the point where the residual heat removal (RHR) system can function in a shutdown cooling (SDC) mode.

The RCIC system consists of a steam-driven turbine-pump unit and associated valves and piping capable of delivering makeup water to the RPV through a head spray nozzle. Water removed from the RPV following a shutdown from power operation is normally made up by the feedwater system and supplemented by inleakage from the control rod drive system. If the feedwater system is unavailable, the RCIC system starts automatically when the RPV water level reaches the low-level two (L2) trip setpoint or when the system is manually started from the control room. The system is capable of delivering rated flow within 30 seconds of initiation. For rapid RPV level decreases associated with accident scenarios and severe transients, the HPCS system and RCIC system initiation would be essentially simultaneous.

For slow RPV level decreases due to small leaks or slow transients, adequate time exists for manual initiation of RCIC prior to HPCS auto-initiation. As such, the RCIC system, if available, has the potential for backing up the HPCS system during events that result in a low reactor water level. The primary water supply for the RCIC system comes from the condensate storage tank (CST) with a secondary supply from the suppression pool. A Seismic I automatic suction source switchover from the CST to the suppression pool is provided for low level in the (non-seismic) CST to ensure a water supply in the event of a safe shutdown earthquake.

Essential components of the RCIC system are designated seismic Category I, Quality Group B.

The RCIC system is housed within the reactor building that provides protection against wind, tornadoes, floods, and other weather phenomena.

LICENSE AMENDMENT REQUEST: CONTROL ROD DROP ACCIDENT ANALYSIS Page 3 of 9 3.2 FSAR Discussion: The control rod drop accident The evaluation of the CRDA is discussed in FSAR Section 15.4.9, "Control Rod Drop Accident." The discussion of the sequence of events ends with: "Although other normal plant instrumentation and controls are assumed to function, no credit for their operation is taken in the analysis of this event. No operator actions are required to terminate this event. Subsequent to reactor scram which terminates the event, normal vessel inventory makeup systems will be used as available including reactor core isolation cooling and/or high-pressure core spray (not simulated)." Many people have interpreted this, and other similar statements in the FSAR, to indicate that the accident analysis credits the RCIC system to mitigate the consequences of the CRDA. However, as stated in FSAR 15.4.9, the CRDA is terminated by the reactor protection system (RPS) scram signal. The core performance model predicts that no fuel rod enthalpy will reach 170 cal/gm, the assumed threshold for fuel failure. In FSAR Section 15.4.9.5, the radiological consequences are based on an assumed failure of about 850 fuel rods (based on an 8x8 array). The calculated exposures based on this release are within the limits of 10 CFR 100. The accident analysis is based on the most limiting core parameters, the parameters that would cause the highest fuel rod enthalpy. The radiological consequences are based on an assumed fuel damage; that is, the consequences are based on a radiological release from fuel damage that significantly exceeds the analytical results.

In effect, two events are evaluated as the CRDA. One event involves establishing the core in a limiting configuration to increase the worth of a control rod. The other event is based on a radiological release from the condenser. In the CRDA, the reactor goes on a positive period, and the fuel temperature reactivity feedback terminates the initial power increase. The reactor scrams on the high flux scram signal. The scram terminates the accident. The analyses of the core, performed using methodologies approved by the NRC, predict no fuel failures.

Supporting calculations performed by Energy Northwest have shown that, at the low power levels assumed for this accident, no significant RPV water level transient is anticipated. At this point, the operators would follow normal plant procedures to reach cold shutdown. The factors credited for mitigating the accident include the core design, Doppler feedback and the Average Power Range Monitor (APRM) scram. The APRM system is safety related and designated as Seismic I.

Although the accident, the core response to the dropped rod, would be effectively terminated by the scram, the FSAR includes an analysis of the radiological consequences consistent with the guidelines presented in Regulatory Guide 1.77. The dose is based on a radiological release from the main condenser. Mitigating factors include the small number of damaged fuel rods, the integrity of the main condenser, and the dispersion of the ground release. The postulated radiological consequences for the event are not dependant on which system provides the post-scram decay heat removal. The consequences depend on the fission products released from the assumed number of damaged fuel rods.

Section 15.4.9 of the FSAR presents a quantitative analysis of the CRDA from the limiting core configuration. The rod pattern for the configuration with a very low initial reactor power would produce the largest fuel rod enthalpy increase. The accident could happen at any power level, but as power level increases, the local power excursion is more limited. Following the

LICENSE AMENDMENT REQUEST: CONTROL ROD DROP ACCIDENT ANALYSIS Page 4 of 9 APRM scram, the RPV may become isolated from the normal (feedwater and condensate) inventory make up systems. There is nothing specific to the CRDA that would isolate the RPV from the feedwater system. Although long-term shutdown cooling can be supported by the HPCS system, the RCIC system, or both systems, the acceptability of the outcome of the CRDA is evaluated based on the short-term consequences and are independent of the method or systems used to achieve and maintain a safe shutdown condition. As stated, this shutdown phase occurs after the termination of the event and the actions taken are the same actions taken for any normal plant shutdown that uses a combination of safety and non-safety related structures, systems, and components (SSCs).

3.3 Columbia Generating Station History In early BWR product line design, General Electric (GE) regarded the RCIC system as a backup to the HPCS (or high pressure coolant injection [HPCI] system). However, the RCIC system was not classified as an emergency core cooling system (ECCS). Following the accident at Three Mile Island (TMI) in 1979, significant changes were made in the nuclear power industry. One of the many changes involved providing the automatic depressurization system (ADS) as a single failure proof ECCS backup to HPCS. One of the concerns regarding the manual ADS initiation for certain events resulted in the requirement to modify the ADS logic. For the accident scenarios with the RPV at high pressure, the HPCS system was designed to automatically provide the required makeup flow. Because the HPCS system is not single failure proof, a HPCS failure would leave the plant without an ECCS high-pressure system. The ADS and the low pressure ECCS were normally credited as a backup to HPCS to mitigate the consequences of the spectrum of LOCAs. However, the ADS would not automatically initiate for the loss of various reactor feedwater events unless the event caused an increase in containment pressure. Most events that employed the RCIC system would not cause the containment pressure increase. Therefore, the NRC required that Energy Northwest modify ADS to allow an automatic initiation on reactor water level without the coincident containment high pressure.

Manual initiation of the RCIC system is the preferred option for high-pressure inventory makeup during non-accident transients when the RPV is isolated from feedwater, until depressurization would allow the use of the RHR system in the SDC mode. The HPCS system can also provide RPV makeup in nonaccident transient situations, as a backup to the RCIC system. Additionally, if needed, the ADS valves can function as part of the alternative SDC mode. This alternative SDC mode is credited at Columbia for compliance with General Design Criterion (GDC-34).

This history is documented in various generic BWR reports and Columbia plant specific documents. As a result of the regulatory and design changes, some of the Columbia documents have lead people to reach inappropriate conclusions regarding the RCIC system.

Notable among these are the various discussion of the design function of the RCIC system.

Some of the documents that discuss the relationship between RCIC, HPCS, and ADS are listed in Attachment 3. In various places, these documents state that RCIC is the backup for HPCS; that ADS is the backup for HPCS and that HPCS is the backup for RCIC.

LICENSE AMENDMENT REQUEST: CONTROL ROD DROP ACCIDENT ANALYSIS Page 5 of 9 As documented in NRC Inspection Reports 50-397/96-11 and 50-397/97-13, Energy Northwest (then known as Washington Public Power Supply System) downgraded the RCIC system safety and seismic classification without obtaining the required prior NRC approval of the change.

The NRC issued a notice of violation (NOV) because the change constituted an unreviewed safety question in that it increased the probability of occurrence of an accident or malfunction of equipment important to safety previously evaluated in the safety analysis report. Actions taken by Energy Northwest, in response to the violation included restoring the RCIC system to Safety Related, Seismic I, and revising the FSAR.

A letter from AT Howell, NRC, to JV Parrish, dated February 9, 1998,

Subject:

NRC Inspection Report 50-397/97-13, Notice of Violation and Exercise of Enforcement Discretion stated that: "As the result of this review and discussions, we concur with your positions that the reactor core isolation cooling system was identified as a nonsafety-related system when utilized for the loss-of-feedwater event, that the reactor core isolation cooling system was not an emergency core cooling system, that the automatic depressurization system is now the single failure backup to the high pressure core spray system, and that the reactor core isolation cooling system was not the designated coping system for station blackout. However, we also noted that you concluded that the reactor core isolation cooling system was classified as a safety-related system to provide a backup to the high pressure core spray system for the control rod drop design basis event and that approval of the classification downgrade was not docketed by the NRC. We also acknowledge your actions to restore the reactor core isolation cooling system to a safety-related classification."

4.0 TECHNICAL ANALYSIS

The change to the FSAR, clarifying that the RCIC system is not credited in the mitigation of the CRDA, will provide a consistency between analyses, the FSAR, and the Technical Specifications. The CRDA is mitigated by the Doppler feedback, APRM scram signal, the core design, and control rod configuration controls. As a result, RCIC should not be categorized as a mitigating system for a CRDA. Removing this specific description for the RCIC system will reduce the regulatory reporting requirements for the system.

This change only affects the design and licensing basis descriptions of the RCIC system as a mitigating system for the CRDA. There is no change to the system hardware, logic, setpoints, system operation, testing, or maintenance requirements. The system can still be used to provide RPV inventory at reactor pressures above the pressure permissive of the SDC mode of the RHR system. The RCIC system also continues to respond to the previous system initiation signals, regardless of the specific event causing the initiation.

The RCIC system function is similar to that provided by the HPCS system, providing cooling to the core at reactor pressures above the ECCS or SDC low pressure permissive. The RCIC system and the HPCS are sources for high-pressure injection for the loss of off site power events. The RCIC system can also provide a high-pressure injection source during an anticipated transient without a scram (ATWS) event. The importance of the RCIC system functioning in these events; although they are not specifically design basis events for the

LICENSE AMENDMENT REQUEST: CONTROL ROD DROP ACCIDENT ANALYSIS Page 6 of 9 system, is adequate basis for maintaining the system as safety related and maintaining existing system and testing requirements.

5.0 REGULATORY SAFETY ANALYSIS No Significant Hazards Consideration Determination and Environmental Review Consideration Energy Northwest is submitting a request for NRC approval of a change to the Columbia Generating Station Final Safety Analysis Report (FSAR). The proposed FSAR revision clarifies that reactor core isolation cooling (RCIC) system is not required to mitigate the consequences of the control rod drop accident (CRDA).

5.1 No Significant Hazards Consideration Energy Northwest has evaluated whether or not a significant hazards consideration is involved with the proposed FSAR change by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of Amendment," as discussed below:

1. Does the proposed amendment involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No This change clarifies, in various sections of the FSAR, that RCIC system operation is not required in order to mitigate the consequences of the CRDA. The proposed change involves no changes to plant systems or accident analyses. The accident analysis for the CRDA demonstrates that core design, the control rod pattern controls, and the scram signal from the reactor protection system (RPS) effectively prevent damage to the fuel rods as a result of the dropped rod. Furthermore, based on a prescribed source term provided from an assumed damage to less than 2% fuel in the core, the resulting radiological consequences are not affected by RCIC operation or failure to operate.

As such, the change does not affect initiation of analyzed events or assumed mitigation of accidents or transients. Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No This change clarifies, in various sections of the FSAR, that the RCIC system operation is not required in order to mitigate the consequences of the CRDA. The proposed change does not involve a physical alteration of the plant, add any new equipment, or require any existing equipment to be operated in a manner different from the present design. Therefore, the proposed change does not create the

LICENSE AMENDMENT REQUEST: CONTROL ROD DROP ACCIDENT ANALYSIS Attachment I Page 7 of 9 possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed amendment involve a significant reduction in a margin of safety?

Response: No This change clarifies, in various sections of the FSAR, that the RCIC system operation is not required in order to mitigate the consequences of the CRDA. The change has no effect on plant systems, operating practices or safety analyses assumptions. For these reasons, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, Energy Northwest concludes that the proposed amendment does not warrant a significant hazard consideration under the standards set forth in 10 CFR 50.92(c) and accordingly, a finding of "no significant hazards consideration" is justified.

5.2 Applicable Regulatory Requirements/Criteria As discussed in Regulatory Guide 1.70, "Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants," the structures, systems, and components (SSCs) important to safety are to be evaluated for their susceptibility to malfunctions and failures. In FSAR Chapter 15, the effects of anticipated process disturbances and postulated component failures are examined to determine their consequences and to evaluate the capability built into the plant to control or accommodate such failures and situations. The situations analyzed include anticipated operational occurrences, off-design transients that induce fuel failures above those expected from normal operational occurrences, and postulated accidents of low probability.

Regulatory Guide 1.70 recommends that events can be grouped together, with only the most limiting (based on consequences rather than initiation) events presented with a detailed, quantitative evaluation. The evaluation should include a step-by-step sequence of events from initiation to a final stabilized condition. The evaluation should discuss the required operation of engineered safety systems. A failure mode and effects analysis (or similar) of the required SSCs is then used to demonstrate that the safety actions required to mitigate the consequences of an event are provided by the safety systems essential to performing each safety action.

This information is then compared to the four criteria in 10 CFR 50.36, to identify those limiting conditions for operation (LCOs) that should be included in the plant technical specifications. Those SSCs that are part of the primary success path and that function or actuate to mitigate a design basis accident or transient that either assumes the failure of or presents a challenge to the integrity of a fission product barrier are included in the technical specifications (Criterion 3). A fourth criterion was also developed to include in technical specifications those SSCs that operating experience or probabilistic risk assessment has shown to be significant to public health and safety.

LICENSE AMENDMENT REQUEST: CONTROL ROD DROP ACCIDENT ANALYSIS Page 8 of 9 When the NRC issued NUREGs 1433 and 1434, the standard technical specification (STS) for BWRs 4 and 6, respectively, the NRC acknowledged that few BWRs credit the RCIC system as mitigating a design basis accident. In the Applicable Safety Analyses Sections for LCO 3.5.3, RCIC System, the STS state that the RCIC system is not an Engineered Safety Feature System and no credit is taken in the safety analyses for RCIC System operation. Based on this, RCIC is included in the STS for BWRs because it satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii). This position is true for Columbia and was approved by the NRC as part of the Columbia conversion to the new STS in 1997.

The Boiling Water Reactor Owners' Group (BWROG) documented a position regarding the reportability of RCIC system failures in a letter to the NRC.' As a clarification of the RCIC system design basis, the letter states: "Following a postulated RDA (Rod Drop Accident), the RCIC (assuming the HPCI/HPCS is inoperable) would provide inventory control/decay heat removal function in response to the reactor vessel isolation caused by the RDA. RCIC does not mitigate the RDA."

The reportability of RCIC system failures is discussed in an NRC Regulatory Issue Summary (RIS) 2001-14. In that RIS, the NRC concludes that: "reporting of RCIC system failure or inoperability is required by the relevant regulations only for plants whose final safety analysis report explicitly credits the RCIC system for mitigating the consequences of a rod ejection accident."

The proposed change does not impact the compliance with any regulatory requirements. The RCIC system design and operation are not changed. The CRDA analyses will not be changed, resulting in continuing consistency with NUREG 0800, Section 15.4.9 and Regulatory Guide 1.77. Removing the description of the requirement that RCIC system response mitigates the consequences of the CRDA has no impact on Columbia compliance with the limits established in 10 CFR 100. Correcting the FSAR will allow Columbia to discontinue reporting that the plant has experienced a loss of system needed to protect the health and safety of the public.

This practice has inappropriately skewed indications of safety system functional failures.

In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation after the proposed change, (2) operation after the change will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or the health and safety of the public.

' Letter; BWROG-00087, dated October 24, 2000; JM Kenny, Chairman BWROG to NRC Document Control Desk.

LICENSE AMENDMENT REQUEST: CONTROL ROD DROP ACCIDENT ANALYSIS Page 9 of 9

6.0 ENVIRONMENTAL CONSIDERATION

S Energy Northwest has determined that the proposed amendment would change a requirement with respect to the described design function of a system located within the restricted area, as defined in 10 CFR 20. However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluent that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(c)(9), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

7.0 REFERENCES

provides a list and brief description of references.

LICENSE AMENDMENT REQUEST: CONTROL ROD DROP ACCIDENT ANALYSIS ATTACHMENT 2 Proposed FSAR Changes (marked up) and Justification

COLUMBIA GENERATING STATION Amendment 56 FINAL SAFETY ANALYSIS REPORT December 2001 including a temperature of 140°F. The mixture of the RCIC water and the hot steam does the following:

a.

Quenches the steam,

b.

Removes reactor residual heat by reducing the heat level (enthalpy) due to the temperature differential between the steam and water, and

c.

Replenishes reactor vessel inventory.

The RCIC system uses an electrical power source of high reliability, which permits operation with either onsite power or offsite power.

The steam supply to the RCIC turbine is automatically isolated on detection of abnormal conditions in the RCIC system or in RCIC equipment areas. See Section 7.4.1.1.2.

The high pressure core spray (HPCS) provides backup for-RCIC should RCIC become isolated, hence providing single failure protection for the control rod drop accident event.

tdiioal he automnatic depressurization system (ADS) widi low

rsuciietiett sexwee*

as a backup to the HPCS. Sec Section 6.3 The RCIC system is not an ECCS nor an engineered safety feature (ESF) system and no credit L(simulation) is taken in the accident analysis of Chapter 6 or 15 for its operation. Hewei'e-,

as-part of the original plant licensing, the RCIC system waz considered as a backup to IIPGS foi the control rod drop accident The design bases with respect to General Design Criteria 34, 55, 56, and 57 are provided in Chapter 3. Reactor core isolation cooling containment isolation valve arrangements are described in Section 6.2.

The RCIC system as noted in Table 3.2-1 is designed commensurate with the safety importance of the system and its equipment. Each component was individually tested to confirm compliance with system requirements. The system as a whole was tested during both the startup and preoperational phases of the plant to set a base mark for system reliability. To confirm that the system maintains this mark, functional and operability testing is performed at predetermined intervals throughout the life of the plant.

In addition to the automatic operational features, provisions have been included for remote-manual startup, operation, and shutdown of the RCIC system, provided initiation or shutdown signals have not been actuated for startup and operation.

The RCIC system is physically located in a different quadrant of the reactor building and uses different divisional power (and separate electrical routings) than the HPCS system. The system operates for the time intervals and the environmental conditions specified in Section 3. 11.

LDCN-00-056,01-009 5.4-15

COLUMBIA GENERATING STATION Amendment 56 FINAL SAFETY ANALYSIS REPORT December 2001 5.4.6.2.3 Applicable Codes and Classifications The RCIC system components within the drywell up to and including the outer isolation valve are designed in accordance with ASME Code Section III, Class 1, Nuclear Power Plant Components. Safety-related portions of the RCIC system are Seismic Category 1.

The RCIC system component classifications and those for the condensate storage system are given in Table 3.2-1.

5.4.6.2.4 System Reliability Considerations To ensure that the RCIC will operate when necessary and in time to prev ent inadequate core cooling the power supply for the system is taken from immediately available energy sources of high reliability. Added assurance is given by the capability for periodic testing during station operation. Evaluation of reliability of the instrumentation for the RCIC shows that no failure of a single initiating sensor either prevents or falsely starts the system.

To ensure RCIC availability for the operational events noted previously and RCIC2 and/or RC-tS: nperntin fer-t-he canal red drop accident, the following are considered in 4bet system desigrV GYP

a.

The RCIC and HPCS are located in different quadrants of the reactor building.

Piping runs are separated and the water delivered from each system enters the reactor vessel via different nozzles.

b.

Prime mover independence is achieved by using a steam turbine to drive the RCIC and an electric motor-driven pump for the HPCS system.

c.

The RCIC and HPCS control independence is secured by using different battery systems to provide control power to each system for system operation. Separate detection initiation logic is used for each system.

d.

Both systems are designed to meet appropriate safety and quality class requirements. Environment in the equipment rooms is maintained by separate auxiliary systems.

e.

A design flow functional test of the RCIC is performed during plant operation by taking suction from the CST and discharging through the full flow test return line back to the CST. The discharge valve to the head-spray line remains closed during the test, and reactor operation is undisturbed. All components of the RCIC system are capable of individual functional testing during normal plant operation. Control system design provides automatic return from test to LDCN-01-039 5.4-27

COLUMBIA GENERATING STATION Amendment 56 FINAL SAFETY ANALYSIS REPORT December 2001 operating mode if system initiation is required. The three exceptions are as follows:

1.

The auto/manual station on the flow controller. This feature is required for operator flexibility during system operation.

2.

Steam inboard/outboard isolation valves. Closure of either or both of these valves requires operator action to properly sequence their opening.

An alarm sounds when either of these valves leaves the fully open position.

3.

Bypassed or other deliberately rendered inoperable parts of the system are automatically indicated in the control room.

f.

Periodic inspections and maintenance of the turbine-pump unit are conducted in accordance with manufacturer's instructions. Valve position indication and instrumentation alarms are displayed in the control room.

g.

Specific operating procedures relieve the possibility of thermal shock or water hammer to the steam line, valve seals, and discs. Key lock switches are provided for positive administrative control of valve position. Operating procedures require throttling open the outboard isolation valve RCIC-V-8 to remove any condensate trapped between the isolation valves, warming up the steam line by throttling open the warmup valve RCIC-V-76 located on a pipe line bypassing the inboard isolation valve, and then opening the inboard isolation valve RCIC-V-63. All the condensate is removed from the steam supply line by a drain pot located at the lowest point. An alarm sounds when any of these valves leaves the fully open position.

h.

Emergency procedures address the operation of RCIC during a station blackout (SBO) event. The RCIC keepfill pump, RCIC-P-3, is powered by a Class lE ac source, and will be unavailable during an SBO. Upon loss of ac power, the 5LI-DL4 operator manually initiates RCIC (and/of IPGS). RCIC may be used during an SBO event by maintaining the RCIC discharge header continuously pressurized.

The system can be operated in this manner without its keepfill function.

5.4.6.2.5 System Operation 5.4.6.2.5.1 Automatic Operation. Automatic startup or restart (after level 8 shutdown) of the RCIC system due to an initiation signal from reactor low water level requires no operator action. To permit this automatic operation, Technical Specifications operability requirements ensure that all necessary components are available to perform their required functions. In addition, the following are periodically verified:

LDCN-00-056 5.4-28

COLuMBIA GENERATING STATION Amendment 56 IFINAL SAFETY ANALYSIS REPORT December 2001

a.

The flow controller has the correct flow setpoint and is in automatic mode;

b.

Each RCIC manual, power-operated, and automatic valve in the flow path that is not locked, sealed, or otherwise secured in position, is in the correct position; and

c.

The RCIC system piping is filled with water from the pump discharge valve to the injection valve.

The turbine is equipped with a mechanical overspeed trip. The mechanical overspeed trip must be reset out of the control room at the turbine itself. Once the mechanical overspeed trip is reset, the trip throttle valve can be reset.

RCIC System Operation and Shutdown:

During extended periods of operation and when the normal water level is again reached, the HPCS system may be manually tripped and the RCIC system flow controller may be adjusted and switched to manual operation. This prevents unnecessary cycling of the two systems. The RCIC flow to the vessel is controlled by adjusting flow to the amount necessary to maintain vessel level. Subsequent starts of RCIC will occur automatically if the water level decreases to the low level initiation point (Level 2) following a high level shutdown (Level 8). Should RCIC flow be inadequate, HPCS flow will automatically initiate.

RCIC flow may be directed away from the vessel by diverting the pump discharge to the CST.

This is accomplished by closing injection valve RCIC-V-13 and opening the test return valves (RCIC-V-22 and 59). The system is returned to injection mode by closing RCIC-V-59 and then opening RCIC-V-13. This mode of operation will not be used during events where an unacceptable source term is identified in primary containment. RCIC control in this mode is (not a safety-related function nor does.t-affect the ability of RCIC to meet its safety function 5-.-C5Sfor a control rod drop accident. -T>eynsten automatically switch# to injection mode if the water level decreases to the low evel initiation point (Level 2).

When RCIC operation is no longer required, the RCIC system is manually tripped and returned to standby conditions.

5.4.6.2.5.2 Test Loop Operation. This operating mode (described in Section 5.4.6.2.4) is conducted by manual operation of the system.

5.4.6.2.5.3 Steam Condensing (Hot Standby) Operation. The steam condensing mode of RHR for Columbia Generating Station has been deactivated. However, the major pieces of equipment are installed with the exception of the steam supply relief valves and are shown on the RCIC and RHR piping and instrumentation diagrams (P&IDs) (Figures 5.4-11 and 5.4-15, LDCN-01-009 5.4-29

INSERT FOR 5.4-06 5.4.6.2.5 (RCIC) System Operation (page 5.4-30) 5.4.6.2.5.4 Manual Actions. The RCIC system will automatically initiate and inject into the reactor when the reactor water level drops to a low level (L2, -50 in.). No manual actions are required to operate the system. However, control room operators can manually initiate the system prior to reaching the low level.

COLUMBIA GENERATING STATION Amendment 56 FINAL SAFETY ANALYSIS REPORT December 2001 respectively). Deletion of this mode of operation for RCIC and RHR will not adversely affect either system's capability to bring the reactor to cold shutdown.

5.4.6.2.5.4 Manual Actions. The most limiting single failure in the combined function of

( SCIC and 11PG9 for-the control fed drop-accident is the failure of HIPGS. The eapact l nerti GI RCCshould be adequate te provide vessel--makeup until depr-essurizatien and eperation-o

,L-

<*t-o0' low pressure injection and heat removal systems. If, hewever, RCIC were also to fail, the ADS with low prcssure injection should provide adequate backup as it scrvcs as a backup to IIPCS for the LOCA. Sc Scetion 6.3.1. No oeperater ations arc required forthcsc functions 5.4.6.2.5.5 Reactor Core Isolation Cooling Discharge Line Fill System. See Section 6.3.2.2.5. The description in this section is also applicable to the RCIC line fill system.

5.4.6.3 Performance Evaluation The RCIC system makeup capacity is sufficient to avoid the need for ECCS for normal shutdowns and shutdowns resulting from anticipated operational occurrences.

5.4.6.4 Preoperational Testing The preoperational and initial startup test program for the RCIC system is presented in Chapter 14. Regulatory Guide 1.68 compliance is described in Section 1.8.

5.4.6.5 Safety Interfaces The balance-of-plant/GE nuclear steam supply system safety interfaces for the RCIC system are (a) preferred water supply from the CST, (b) all associated wire, cable, piping, sensors, and valves that lie outside the nuclear steam supply system scope of supply, and (c) air supply for testable check and solenoid-actuated valve(s).

5.4.7 RESIDUAL HEAT REMOVAL SYSTEM 5.4.7.1 Design Bases The RHR system is comprised of three independent loops. Each loop contains its own motor-driven pump, piping, valves, instrumentation, and controls. Each loop has a suction source from the suppression pool and is capable of discharging water to the reactor vessel via a separate nozzle, or back to the suppression pool via the suppression pool return line. In addition, the A and B loops have heat exchangers which are cooled by standby service water.

Loops A and B can also take suction from the RRC suction and can discharge into the-reactor recirculation discharge or to the suppression pool and drywell spray spargers. Spool-piece 5.4-30

COLUMBIA GENERATING STATION Amendment 57 FINAL SAFY ANALYSIS REPORT December 2003 6.3.1.2.4 Automatic Depressurization System The ADS utilizes seven of the reactor safety/relief valves (SRVs) to reduce reactor pressure during small breaks in the event of HPCS failure. When the vessel pressure is reduced to within the capacity of the low pressure systems (LPCS and LPCI), the systems provide inventory makeup so that acceptable postaccident temperatures are maintained in the core.

6.3.2 SYSTEM DESIGN 6.3.2.1 Schematic Piping and Instrumentation Diagrams The process and flow diagrams for the ECCS are specified in the various Sections of 6.3.2.2.

6.3.2.2 Equipment and Component Descriptions The starting signal for the ECCS comes from at least two independent and redundant sensors of drywell pressure and low reactor water level, except ADS which requires low reactor water level and indication that LPCI or LPCS is available. The ECCS is actuated automatically and requires no operator action during the first 10 minutes following the accident.

The preferred source of power for all three ECCS divisions is from regular ac power to the plant. Regular ac power is from the main transformers [TR-N(1) and (2)] during plant operation or from the startup transformer (TR-S) (an offsite power source) when the main generator is off-line. Should regular ac power be lost, Division 1 (LPCS and LPCI loop A) and Division 2 (LPCI loops B and C) would be transferred to a second offsite power supply and backup transformer (TR-B). Division 3 (HPCS) would be powered from its onsite standby diesel. If the backup transformer were also lost, Divisions 1 and 2 would then be powered from their respective and independent onsite standby diesels. A more detailed description of the power supplies for the ECCS is contained in Section 8.3.

6.3.2.2.1 High-Pressure Core Spray System Process and flow diagrams are shown in Figures 6.3-3 and 6.3-4. The HPCS system consists of a single motor-driven centrifugal pump, a spray sparger in the reactor vessel located above the core (separate from the LPCS sparger), and associated system piping, valves, controls, and instrumentation. The system is designed to operate from regular ac or from a standby diesel generator supply if offsite power is not available. The system is designed to the requirements of ASME Section III.

With the exception of the check valve on the discharge line, all active HPCS equipment is located outside the primary containment. Suction piping is provided from the condensate storage tanks and the suppression pool. This arrangement rovide the capability to use high t quality water from the condensate storage tanks whe s

tem functions to back-up LDCN-02-010,03-003 6.3-6

COLUMBIA GENERATING STATION Amendment 57 FINAL SAFETY ANALYSIS REPORT December 2003 (fi -D I -ethe-RG1Q system. In the event that the condensate storage water supply becomes exhausted or is not available, automatic switchover to the suppression pool water source will ensure a closed cooling water supply for continuous operation of the HPCS system. The HPCS pump suction is also automatically transferred to the suppression pool if the suppression pool water level exceeds a prescribed value. The condensate storage tanks contain a reserve of approximately 135,000 gal of water just for use by HPCS and RCIC.

Remote controls for operating the motor-operated components and diesel generator are provided in the main control room. The HPCS controls and instrumentation are described in Section 7.3. 1.

The system is designed to pump water into the reactor vessel over a wide range of pressures.

For small breaks that do not result in rapid reactor depressurization, the system maintains reactor water level. For large breaks the HPCS system cools the core by a spray. The HPCS also provides for core cooling in the event of a station blackout. If a LOCA should occur, a low water level signal or a high drywell pressure signal initiates the HPCS and its support equipment. The system can also be manually placed in operation.

The HPCS injection automatically stops with a high water level in the reactor vessel by signaling the injection valve to close and it automatically starts again when a low water level signals the injection valve to open. The HPCS system also serves as a back-up to the RCIC system in the event the reactor becomes isolated from the main condenser during operation and.

feedwater flow is lost.

The HPCS system head flow characteristic used for LOCA analyses is shown in Figure 6.3-5.

When the system is started, initial flow rate is established by primary system pressure. As vessel pressure decreases, flow will increase.

When vessel pressure reaches 200 psid the system reaches rated core spray flow. The HPCS motor size is based on peak horsepower requirements.

The elevation of the HPCS pump is sufficiently below the water level of both the condensate storage tanks and the suppression pool to provide a flooded pump suction and to meet pump net positive suction head (NPSH) requirements with the containment at atmospheric pressure and the suction strainer bed entrained with debris washed into the wetwell following a LOCA.

The available NPSH at the pump suction is greater than 30 ft, compared to the specified minimum NPSH requirement of 24 ft. The available NPSH also ensures that no cavitation occurs anywhere in the pump suction line between the wetwell strainers and the pump suction.

A motor-operated valve is provided in the suction line from the suppression pool. The valve is located as close to the suppression pool penetration as practical. This valve is used to isolate psid - differential pressure between the reactor vessel and the suction source.

LDCN-03-003 6.3-7

COLUMBIA GENE RATING STATION Amendment 53 FINAL SAFETY ANALYSIS REPORT November 1998 7.1.1.9 Reactor Core Isolation Cooling System The I&C provide makeup water to the reactor vessel in the event the reactor becomes isolated accompanied by a loss of flow from the reactor feedwater system during normal plant

. I-L>} § operation or as a backup to IIPCS in the event of a red drop accident.

7.1.1.10 Standby Liquid Control System The I&C in conjunction with manual initiation provide a redundant reactivity control system that can shut the reactor down from rated power to the cold condition in the event that all withdrawn control rods cannot be inserted manually by the reactor manual control system to achieve reactor shutdown.

7.1.1.11 Leak Detection System The I&C provide various temperature, pressure, level, and flow sensors to detect, annunciate, and isolate (in certain cases) water and steam leakage paths in selected reactor systems.

7.1.1.12 Residual Heat Removal System - Reactor Shutdown Cooling Mode The I&C in conjunction with manual initiation provide cooling to remove decay and sensible heat from the reactor vessel so that the reactor can be refueled and serviced.

7.1.1.13 Fuel Pool Cooling and Cleanup System The I&C monitor fuel pool water temperature.

7.1.1.14 Suppression Pool Temperature Monitoring System The I&C are provided to determine when special operating procedures are required to avoid elevated suppression pool temperatures.

7.1.1.15 Standby Gas Treatment System The I&C control standby gas treatment system (SGTS) operation during abnormal conditions to limit radioactive material releases.

7.1.1.16 Main Steam Line Isolation Valve Leakage Control System The I&C monitor and control main steam isolation valve (MSIV) bypass leakage and minimize the release of fission products to the atmosphere following a LOCA.

7.1-3

COLUMBIA GENERATING STATION Amendment 53 FINAL SAFETY ANALYSIS REPORT November 1998

a.

High-pressure core spray (HPCS) system,

b.

Automatic depressurization system (ADS),

c.

Low-pressure core spray (LPCS) system, and

d.

Low-pressure coolant injection (LPCI) mode of the RHR system.

The following plant variables are monitored and provide automatic initiation of the ECCS when these variables exceed predetermined limits:

a.

Reactor vessel water level A low water level in the reactor vessel could indicate that reactor coolant is being lost through a breach in the reactor coolant pressure boundary (RCPB) and that the core is in danger of becoming overheated as the reactor coolant inventory diminishes. See Figure 10.3-2 for a schematic arrangement of reactor vessel instrumentation.

b.

Drywell pressure High pressure in the drywell could indicate a breach of the RCPB inside the drywell and that the core is in danger of becoming overheated as reactor coolant inventory diminishes.

7.3.1.1.1.1 High-Pressure Core Spray System.

Function The purpose of the HPCS is to provide high pressure reactor vessel core spray for a small line break loss-of-coolant accident (LOCA) which does not depressurize the reactor vessel. In addition HPCS is redundant to the ADS system for mitigation of the consequences of various (events described in Chapter 15. The HPCS is also--a baektito eaete e

.iselatie

rec,

'7.3 -C)l {IRCI) fcr thc control rod drop accident and various design basis transients described in 5 7.3 -D2 Chapter 15. See also Section 6.3.2.2.1. The HPCS also provides for core cooling during a station blackout event.

Operation Schematic arrangements of system mechanical equipment is shown in Figure 6.3-5. The HPCS system component control logic is shown in Figures 7.3-4 and 7.3-7. Instruments are listed in Table 7.3-1. Operator information displays are shown in Figures 6.3-5, 7.3-7, and 7.3-4.

The HPCS is initiated automatically by either reactor vessel low water level (trip level 2) or drywell high pressure. The system is designed to operate automatically for at least 10 minutes 7.3-2

INSERT FOR 7.3-2 The HPCS is also a backlup to reactor core isolation cooling (RCIC) for the control rod drop accid-nt:an provide core coolini or reactor vessel inventory makeup following accidentsd various design basis transients described in Chapter 15.

eIser-1

COLUMBIA GENERATING STATION Amendment 54 FINAL SAFETY ANALYSIS REPORT April 2000 4

a.

Normal Operation. When the reactor vessel is isolated from its primary heat sink (main condenser) and accompanied by a loss or unavailability of the reactor feedwater system; and

b.

When the plant is being shut down and normal coolant flow from the feedwater system is stopped before the reactor is depressurized to a level where the reactor shutdown cooling mode of the RHR system can be placed into operation.

Cc.-W emrequ d a-a backup to the high pressure core spry (HPCS) stem for the contro ed drop accident, by-eutomatieallysuppyi coolnt-the

(_

~~reactor. if-ve-s-sel low -water. level,(ell~se 7.4.1.1.2 Operation Schematic arrangements of system mechanical equipment are shown in Figure 5.4-11. The RCIC system component control logic is shown in Figure 7.4-1. Instruments are listed in Table 7.4-1. Operator information displays are shown in Figures 5.4-11 and 7.4-1.

The RCIC system can be initiated either manually or automatically. The control room operator can initiate RCIC by operating the manual initiation push button which simulates an automatic initiation or by activating each piece of equipment sequentially as required.

The RCIC system is automatically initiated by four redundant level switches, arranged in a one-out-of-two-twice logic configuration, which sense reactor vessel low water level (trip level 2).

The RCIC steam line isolation and the turbine steam exhaust motor-operated valves are normally open with their control switches key locked in the open position, and the turbine trip and throttle valve is normally open and these valves require no change of position for automatic system initiation. (Note: the key locked control switches do not prevent automatic isolation of these valves.)

The RCIC system responds to an automatic initiation signal as follows (actions are simultaneous unless stated otherwise):

a.

The pump suction from the condensate storage tanks valve RCIC-V-10 (MO F010) is signaled open;

b.

To ensure pump discharge flow is directed to the reactor vessel only, the test return line to the condensate storage tanks valves RCIC-V-22 (MO F022) and RCIC-V-59 (MO F059) are signaled closed; LDCN-9S-116,99-000 7.4-2

COLUMBIA GENERATING STATION Amendment 56 FINAL SAFETY ANALYSIS REPORT December 2001

c.

The turbine steam inlet and the turbine lube oil cooler cooling water supply valves RCIC-V-45 (MO F045) and RCIC-V-46 (MO F046) are signaled to open;

d.

When the turbine steam inlet valve RCIC-V-45 (MO F045) starts to open, the RCIC pump discharge to reactor vessel valve RCIC-V-13 (MO F013) and the turbine lube oil cooler supply valve RCIC-V-46 (F046) are signaled open.

Valves RCIC-V-13 (MO F013) and RCIC-V-46 (F046) are prohibited from opening or if open, automatically closes when RCIC-V-45 (MO F045) or the turbine trip and throttle valve RCIC-V-1 (MO F001) is closed. A one-out-of-two-twice limit switch logic trips the main turbine on the opening of RCIC-V-13 (MO F013) and RCIC-V-45 (MO F045) to limit moisture introduction;

e.

The barometric condenser vacuum tank vacuum pump is signaled to start; and

f.

When valve RCIC-V-45 (MO F045) leaves the closed position the RCIC turbine is accelerated until the automatic flow controller setpoint is reached and the system discharge flow is controlled by the turbine electronic governor mechanism.

RCIC flow may be directed away from the vessel by diverting the pump discharge to the CST.

This is accomplished by closing injection valve RCIC-V-13 and opening the test return valves (RCIC-V-22 and 59). The system is returned to injection mode by closing RCIC-V-59 and then opening RCIC-V-13. This mode of operation will not be used during events where an unacceptable source term is identified in primary containment. RCIC control in this mode is not a safety-related function nor does this mode affect the ability of RCIC to meet -ts-afety-L ftinction for a control rod drop accident. The system automatically switchft to injection mode if the water level decreases to the low level initiation point (Level 2).

During system operation if the barometric condenser vacuum tank water level becomes high the condenser condensate discharge pump is automatically started and the condensate returned to the RCIC pump suction. When the system is not operating excess tank water is discharged through isolation valves RCIC-V-4 (AO F004) and RCIC-V-5 (AO F005) to the equipment drain system.

In the event the water level in the condensate storage tanks should become low the RCIC pump suction is automatically transferred from the condensate storage tank(s) to the suppression pool by opening valve RCIC-V-31 (MO F031). Two level switches mounted on a Seismic Category I standpipe in the reactor building are used to detect low water level in the condensate storage tank(s). Either switch can cause automatic suction transfer. Once valve RCIC-V-31 (1031) is fully open the condensate storage tank valve RCIC-V-10 (MO F010) is

.)

automatically closed.

LDCN-00-056,01-009 7.4-3

l 5.48.9.2. S EP Q.U&

NCXG of E5JgTS PVN1%S qSTRIE l)FKRAnDIV COLUIBIA GENERATING STATION Amendment 57 FINAL SAFETY ANALYSIS REPORT December 2003

7.

If the mechanical vacuum pump (MVP) is maintaining condenser vacuum (e.g.,

the plant was operating at 5 % power or less) and the main steam line radiation (MSLR) monitors detected radiation levels above the setpoint, the MSLR monitors would trip the MVP to reduce the fission product release from the condenser.

Although other normal plant instrumentation and controls are assumed to function, no credit for their operation is taken in the analysis of this event. No operator actions are required to terminate this event. Subsequent to reactor scram which terminates the event, normal vessel lb 4i- 0 l<inventory makeup systems will be used as available.including reactor core isolation cooflfn

(-andier high pressure core spray (not simulated).

15.4.9.2.1 Effect of Single Failures and Operator Errors As discussed, the event is terminated, and therefore mitigated, by the APRM high flux scram signal to RPS. The RPS design meets the single failure criteria. The event is further mitigated by an initial control rod configuration that complies with the BPWS. The withdrawal (or insertion) sequence is implemented by the operator and enforced by the RWM. An operator error in control rod movement will be detected and stopped by the RWM. If the RWM system is not operable, rod movement can only continue with a backup for the operator verifying compliance with the BPWS sequence. Failure of the RWM concurrent with an operator error of moving an out-of-sequence rod, contrary to procedures would be required to result in a potentially more limiting event. Therefore, sufficient redundancy exists such that termination of this transient within the limiting criteria is assured.

At low power levels, the MVP trip maintains the condenser leak rates within the analytical assumptions. The MSLR monitor design meets the single failure criteria and no active failure would prevent the trip signal (Reference 11.5.2.1).

15.4.9.3 Core and System Performance 15.4.9.3.1 Mathematical Model A complete cycle-specific analysis of this accident is fundamentally a two-step approach. The first step involves determination of possible candidates for the control rod that would cause the most severe consequences resulting from a CRDA. The evaluation of dropped control rod worth is performed within the constraints of permissible control blade withdrawal sequencing and assuming a limiting selection error by the operator.

LDCN-03-003 15.4-16

COLUMBIA GENERATING STATION Amendment 56 FINAL SAFETY ANALYSIS REPORT December 2001

h.

When pump discharge pressure reaches a predeternined pressure, the minimum flow valve opens until system flow reaches a predeterminedflow, then it will close.

RCIC flow may be directed away from the vessel by diverting the pump discharge to the CST.

This is accomplished by closing injection valve RCIC-V-13 and opening the test return valves (RCIC-V-22 and 59). The system is returned to injection mode by closing RCIC-V-59 and then opening RCIC-V-13. This mode of operation will not be used during events where an unacceptable source term is identified in primary containment. RCIC control in this mode is snot a safety-related function nor does this mode affect the ability of RCIC to meet its safec

,\\- 1> L_ unction for a control rod drop accident. The system automatically switchtt to injection mode if the water level decreases to the low level initiation point (Level 2).

Th7e HPCS system will start automatically upon receipt of a low water level (level 2) initiation signal. Upon receipt of this initiation signal, the following events occur simultaneously unless othenvise noted:

a.

High-pressure core spray diesel generator starts;

b.

High-pressure core spray pump starts;

c.

High-pressure core spray suction valve and HPCS injection valve open;

d.

Condensate storage tank and suppression pool test return and bypass valves close (if open);

e.

Minimum flow bypass valve automatically opens if HPCS pump is delivering pressure and system flow is low. Minimumflow bypass valve automatically closes when theflow rate from the pump reaches a predetermined flow;

f.

High-pressure core spray service water pumps starts; and

g.

High-pressure core spray room cooler fan starts.

The operator can manually initiate the HPCS and RCIC systems from the control room before the level 2 automatic initiation level is reached. The operator has the option of manual control after automatic initiation. The operator can verify that these systems are delivering water to the reactor vessel by

a.

Verifying reactor water level increases when systems initiate,

b.

Verifying systems flow usingflow indicators in the control room, and LDCN-00-018.01-009 B.2-28

LICENSE AMENDMENT REQUEST: CONTROL ROD DROP ACCIDENT ANALYSIS Page 1 of 6 Justification for changes to FSAR CHANGE FSAR FSAR SECTION TYPE OF DESCRPTION JUSTIFICATION NO.

SECTION TITLE.

CHANGE NO.

5.4-01 5.4.6.1 (REACTOR DELETE "The high-pressure core. spray This paragraph is not needed in the discussion of the CORE (HPCS) provides backup for RCIC design function. RCIC and HPCS are both high-ISOLATION RCIC should RCIC become pressure injection systems. However, HPCS is an ECCS COOLING isolated, hence providing with the ADS providing the required diverse system SYSTEM) single failure protection for backup for ECCS. RCIC is not an ECCS and its Design Bases the control rod drop accident function is not required to mitigate the consequences of event. Additionally the the CRDA. The relationship between HPCS and ADS is automatic depressurization redundant to the ECCS descriptions provided in other system (ADS) with low-section of the FSAR, such as 6.3.

pressure injection serves as a backup to the HPCS. See Section 6.3.1."

5.4-02 5.4.6.1 (REACTOR DELETE "However, as part of the This sentence can be deleted. The RCIC system is a CORE original plant licensing, the non-ESF system that can provide inventory with or in ISOLATION RCIC system was considered place of the HPCS system. However, the CRDA COOLING as a backup to HPCS for the analyses do not credit either RCIC or HPCS in the SYSTEM) control rod drop accident" mitigation or prevention of the accident. The ADS Design Bases system was designed and installed at the plant prior to operation as the required diverse system (single failure proof) backup to the HPCS system. Therefore, the sentence is misleading.

't I

I LICENSE AMENDMENT REQUEST: CONTROL ROD DROP ACCIDENT ANALYSIS Page 2 of 6 CHANGE FSAR FSAR SECTION TYPE OF DESCRIPTION JUSTIFICATION NO.

SECTION TITLE.

CHANGE NO.

5.4-08 5.4.6.2.4 (RCIC) System DELETE "and in time to prevent The phrase was deleted because the system is not an Reliability inadequate core cooling,"

ECCS or an ESF system as implied. The discussion Considerations concerns RCIC reliability. The system design discussion adequately describes the design requirement; when the system is needed. This phrase in an unnecessary detail that implies an additional design requirement.

5.4-03 5.4.6.2.4 (RCIC) System DELETE "and RCIC and/or HPCS The phrase was deleted because no special considerations Reliability operation for the control rod for the design or operations have been placed on the Considerations drop accident",

RCIC system and HPCS system to ensure operation to mitigate the CRDA. As revised, the discussion will be describing special considerations for the RCIC design as related to the HPCS design.

5.4-04 5.4.6.2.4.h (RCIC) System DELETE "(and/or HPCS)"

This was deleted because the unavailability of the RCIC-Reliability P-3 has no impact on the operator initiation of the HPCS Considerations system.

5.4-05 5.4.6.2.5.1 (RCIC)

DELETE 'meet its safety function for a The RCIC system is not necessary to mitigate the Automatic control rod drop accident. The consequences of the CRDA, so this statement was Operation system" deleted.

at iw 4

LICENSE AMENDMENT REQUEST: CONTROL ROD DROP ACCIDENT ANALYSIS Page 3 of 6 CHANGE FSAR FSAR SECTION TYPE OF DESCRIPTION JUSTIFICATION NO.

SECTION TITLE.

CHANGE N O.

5.4-06 5.4.6.2.5.4 (RCIC) System ADD "The RCIC system will Reg Guide 1.70 recommends that all operator actions Operation -

automatically initiate and needed to properly operate the system be discussed in Manual inject into the reactor when the this section. Since RCIC can operate automatically (as Actions reactor water level drops to a described in other locations) no manual actions are low level (L2, -50 in.). No necessary for the system to function.

manual actions are required to operate the system. However, control room operators can manually initiate the system prior to reaching the low level."

LICENSE AMENDMENT REQUEST: CONTROL ROD DROP ACCIDENT ANALYSIS Page 4 of 6 CHANGE FSAR FSAR SECTION TYPE OF DECRPSC TION NO.

SECTION TITLE.

CHANGE NO.

5.4-07 5.4.6.2.5.4 (RCIC) System DELETE "The most limiting single Reg Guide 1.70 recommends that this section discuss the Operation -

failure in the combined most limiting single failure of the combined HPCS and Manual function of RCIC and HPCS RCIC system. This guidance is no longer applicable.

Actions for the control rod drop The ADS system was installed with a modification that accident is the failure of allowed automatic initiation (no operator actions HPCS. The capacity of RCIC required) in the situation of HPCS failure. Earlier BWR should be adequate to provide product lines used RCIC and HPCS as backup for one vessel makeup until another, to address the lack of single failure proof depressurization and operation protection for HPCS. The automatic initiation of the of low-pressure injection and ADS system resolved that concern.

heat removal systems. If, however, RCIC were also to fail, the ADS with low-pressure injection should provide adequate backup as it serves as a backup to HPCS for the LOCA. See Section 6.3.1. No operator actions are required for these functions to occur."

6.3-01 6.3.2.2.1 High-Pressure DELETE "when the HPCS system This change was made because the arrangement provides Core Spray functions to back-up the RCIC high quality water regardless of the reason the system is.

System system" being used.

-@ r.

LICENSE AMENDMENT REQUEST: CONTROL ROD DROP ACCIDENT ANALYSIS Page 5 of 6 CHANGE FSAR FSAR SECTION TYPE OF DESCRIPTION JUSTIFICATION NO.

SECTION TITLE.

CHANGE NO.

7.1-01.

7.1.1.9 Reactor Core DELETE "or as a backup to HPCS in This change helps to clarify that RCIC is not credited for Isolation the event of a rod drop mitigating an event that causes low RPV level.

Cooling accident" System 7.3-01 7.3.1.1.1.1 (High-Pressure DELETE "is also a backup to reactor HPCS is a high pressure injection system that can Core Spray core isolation cooling (RCIC) provide makeup inventory, regardless of the event that System -

for the control rod drop initiated the vessel level inventory reduction.

Function accident" 7.3-02 7.3.1.1.1.1 (High-Pressure ADD "can provide core cooling or HPCS is a high pressure injection system that can Core Spray reactor vessel inventory provide makeup inventory, regardless of the event that System -

makeup following accidents" initiated the vessel level inventory reduction.

Function 7.4-01 7.4.1.1.1 (Reactor Core DELETE

c. "When required as a The two conditions under which RCIC is required to Isolation backup to the high-pressure operate are adequately addressed in items a and b. The Cooling core spray (HPCS) system requirement to automatically initiate on Level 2 is System) -

for the control rod drop adequately described in the following section and in Function accident by automatically Chapter 5. The system is designed to initiate on Level 2, supplying cooling water to regardless of the event that lead to the decrease in reactor the reactor if vessel low water level.

water level (level 2) is sensed."

7.4-02 7.4.1.1.2 (RCIC)

DELETE "meet its safety function for a The RCIC system is not necessary to mitigate the Operation control rod drop accident. The consequences of the CRDA, so this was deleted.

system"

g} Ir. C LICENSE AMENDMENT REQUEST: CONTROL ROD DROP ACCIDENT ANALYSIS Page 6 of 6 CHANGE FSAR FSAR SECTION TYPE OF DESCRIPTION JUSTIFICATION NO.

SECTION TITLE.

CHANGE NO.

15.4-01 15.4.9.2 Sequence of DELETE "including reactor core Deletion of excessive detail and the removal of Events and isolation cooling and/or high-information redundant to system descriptions. The Systems pressure core spray (not normal systems include, not only RCIC and HPCS, but Operation simulated).

condensate and feedwater. These also depend on availability. The accident does not model a decrease in reactor water level or the subsequent refilling of the vessel.

B.IH-01 (Appendix Proper DELETE "meet its safety function for a The RCIC system is not necessary to mitigate the B)

Functioning of control rod drop accident. The consequences of the CRDA, so this statement was II.K. 1.22 Heat Removal system" deleted.

Systems

LICENSE AMENDMENT REQUEST: CONTROL ROD DROP ACCIDENT ANALYSIS ATTACHMENT 3 Page 1 of4 V

REFERENCES No.

Document title Document Document Summary Comments number date 1

Reactor Core Isolation Cooling (GE Design Specification)

23A1862, Rev 1 9/23/83 RCIC is designed to provide core cooling when the reactor is isolated from the feedwater system EN accepted design change control of this document from GE in 9/83 2

Additional Information Required for NRC Staff Generic Report on BWRs, Vol 1

&2.

3 Clarification of TMI Action Plan Requirements NEDO 24708A NUREG 0737 GE analysis, accepted by NRC to demonstrate ADS with low pressure ECCS is acceptable backup for HPCS 11/1980 Required that licensee modify ADS to automatically actuate if no HPCS 4

Letter, GC Sorensen, EN, to A Schwencer, NRR G02 660 7/26/83 Informed NRC that because ADS was automatic, the RCIC system would not be maintained in EQ Internal NRC IOM, 2/2/84, agreed.

Referenced similar situation at Susquehanna 5

Safety Evaluation, Amendment 11 to NPF-21, WPPSS Nuclear Project NO. 2 6

Letter, GC Sorensen, EN to WR Butler, NRC GI2 098 G02 694 6/25/85 10/4/85 NRC approved ADS modification ADS provides an automatic independent backup for HPCS.

Therefore, RCIC as backup to HPCS is not needed.

LICENSE AMENDMENT REQUEST: CONTROL ROD DROP ACCIDENT ANALYSIS ATTACHMENT 3 Page 2 of 4 REFERENCES No.

Document title Document Document Summary Comments number date 7

Interim Federal 2/6/87 Discusses RCIC "Commission Policy Statement on Technical Specification Improvements for Nuclear Power Reactors" Register 52 FR 3788 inclusion in TS as 4t criterion, because several systems were to remain in TS based on their importance to risk. The RCIC system did not meet any of the 3 criteria for features that are safety related.

8 Letter, RB Samworth, NRR to GC Sorensen, EN G12 040 5/2/89 Denied removing RCIC from TS based on importance to risk.

Did not mention that system was required in a safety analysis to mitigate accident.

9 Final Policy Statement on Technical Specifications SECY 067 3/17/93 Discusses the 4' criterion for inclusion in Tech Specs, such as RCIC for the risk significance of some systems not fully recognized in DBA or transient analyses.

10 Inspection Report, NRC to JV Parrish, EN 50-397/

96-11 9/12/96 Opened unresolved item (9611-02) to address RCIC downgrade.

11 IOM, Response to TIA, II Bateman, NRR, to TP Gwynn, Region IV Task number-96-TIA-005 1/31/97 Stated that RCIC should remain classified as safety related because RCIC is ECCS when HPCS is inop Also comments that ITS retain RCIC because PRA indicates system is "important to safety".

LICENSE AMENDMENT REQUEST: CONTROL ROD DROP ACCIDENT ANALYSIS ATTACHMENT 3 Page 3 of 4 REFERENCES No.

Document title Document Document Summary Comments number date 12 Letter, PR G02 12/23/97 Though RCIC is not a Bemis, EN to 228 required backup to NRC response to TIA-005 & IR 96-11 HPCS for the CRDA, it serves as the basis of safety related classification.

13 Letter, PR Bemis, EN to NRC, Response to IR 97-13 14 NOV from IR 50-397/97-13, Letter EW Merschoff, NRC to JV Parrish, EN G02 051 EA 97-573, in letter #

GI2 097 3/10/98 6/1/98 Reason for violation included the fact that RCIC is not considered in the quantitative analyses for the CRDA.

Cited EN for a change made to the facility involving a USQ, downgrading RCIC.

15 Letter, JM Kenny, BWROG, to NRC, Position paper for Reporting RCIC inoperability BWROG-11/24/00 00087 Summarize that RCIC is designed to respond to AOO, but not to DBA.

Describing RCIC as a potential water makeup source, does not imply that it is relied upon to mitigate a DBA.

16 IOM, SC Black, NRR to GE Grant, RIJI, Reportability of RCIC System Failures TIA 99-030 3/15/01 NRC concludes that:

"RCIC failure is reportable if the plant's safety analysis considered RCIC as a system needed to mitigate a rod ejection accident."

LICENSE AMENDMENT REQUEST: CONTROL ROD DROP ACCIDENT ANALYSIS ATTACHMENT 3 Page 4 of 4 REFERENCES No.

Document title Document Document Summary Comments number date 17 NRC Position on RIS 2001-7/19/01 Reporting RCIC No analyses at Reportability 14 failure or inoperability CGS takes credit Requirements for RCIC System Failure is required only for those plants where the FSAR explicitly credits the RCIC system for mitigating the consequences of a rod drop accident.

for RCIC mitigation of the consequences of a CRDA.