Information Notice 2007-07, Potential Failure of All Control Rod Groups to Insert in a Boiling Water Reactor (BWR) Due to a Fire
| ML063540138 | |
| Person / Time | |
|---|---|
| Issue date: | 02/15/2007 |
| From: | Michael Case NRC/NRR/ADRA/DPR |
| To: | |
| References | |
| IN-07-007 | |
| Download: ML063540138 (5) | |
UNITED STATES
NUCLEAR REGULATORY COMMISSION
OFFICE OF NUCLEAR REACTOR REGULATION
WASHINGTON, D.C. 20555-0001 February 15, 2007 NRC INFORMATION NOTICE 2007-07: POTENTIAL FAILURE OF ALL CONTROL ROD
GROUPS TO INSERT IN A BOILING WATER
REACTOR DUE TO A FIRE
ADDRESSEES
All holders of operating licenses for boiling water reactors (BWRs), except those who have
permanently ceased operations and have certified that fuel has been permanently removed
from the reactor.
PURPOSE
The U.S. Nuclear Regulatory Commission (NRC) is issuing this information notice to inform
addressees of an issue discovered at Columbia Generating Station (CGS) regarding the
possibility of fire-induced hot shorts preventing all control rod groups from inserting when
required due to a postulated fire. The NRC expects that recipients will review the information
for applicability to their facilities and consider actions, as appropriate, to avoid similar problems.
However, suggestions contained in this information notice are not NRC requirements; therefore, no specific action or written response is required.
DESCRIPTION OF CIRCUMSTANCES
During an inspection at CGS completed on July 13, 2006, the NRC inspectors identified that
two hot shorts, caused by a postulated fire, could prevent one of the four groups of control rods
from inserting when the operator places the reactor mode selector switch in the SHUTDOWN
position in the control room. The inspection results are summarized in Inspection Report 05000397/200608, dated August 18, 2006 (Agencywide Documents Access Management
System, Accession No. ML062300334).
The reactor protection and control rod drive systems are identified as part of the minimum safe
shutdown systems necessary to accomplish the reactivity control shutdown function and are
credited in the post-fire safe shutdown procedures developed by this licensee. However, the
potential for fire to cause a loss of this required shutdown function has not been evaluated. The
Final Safety Analysis Report states Fail safe circuits (electrical divisions 4, 5, 6, and 7) are
designed to fail in a safe manner if subjected to fire damage. For example, reactor
scram, once initiated, cannot be overridden as a consequence of fire. The licensees analysis
was based on the assumption that the operator would initiate and confirm shutdown before
control circuiting is damaged; therefore, evaluation of the effects of fire damage to the reactor
protection (RPS) and control rod drive systems was not performed.
Fires can potentially damage circuits prior to the decision to initiate a plant shutdown using
alternative shutdown capability and control room evacuation. At CGS, a reactor shutdown
would not be initiated unless:
- there are indications that the fire threatens safe operation of the plant,
- the operator observes degraded equipment performance, or
- there is visible damage to vital plant equipment or cabling.
Since a reactor scram would possibly not be initiated until the fire had damaged vital plant
equipment, the NRC staff noted the possibility that hot shorts could occur prior to making the
decision to scram the unit.
At CGS, the licensee revised plant procedures to ensure that the RPS would be de-energized
prior to initiating depressurization. This action would ensure that all control rods insert into the
reactor prior to opening the safety/relief valves (SRVs) and starting low pressure injection. Due
to various power supplies that may be in the cabinet, the response by CGS may not be effective
for other BWR designs.
BACKGROUND
Title 10 of the Code of Federal Regulations (CFR) Part 50.48(a) requires that each operating
nuclear power plant has a fire protection plan that satisfies General Design Criterion (GDC) 3 of
Appendix A of Part 50. Criterion 3 specifies that Structures, systems, and components
important to safety shall be designed and located to minimize, consistent with other safety
requirements, the probability and effect of fires and explosions.
Part 58.48(b) of Title 10 of the Code of Federal Regulations identifies some methods to comply
with 10 CFR 50.48(a) and imposes a backfit requirement for plants licensed to operate prior to
January 1, 1979, to comply with section III.G of Appendix R. For plants licensed to operate
after January 1, 1979, similar requirements were incorporated into NUREG-0800, Standard
Review Plan, Section 9-5.1, Fire Protection Program, and were incorporated into the licensee
programs during the licensing process for these plants. These licensees then had planned
implementation as a condition of the Operating License for the facility. To satisfy GDC 3, each
licensee must have fire protection features that are capable of limiting fire damage so that:
a. One train of systems necessary to achieve and maintain hot shutdown conditions from either
the control room or emergency control station(s) is free of fire damage; and
b. Systems necessary to achieve and maintain cold shutdown from either the control room or
emergency control station(s) can be repaired within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.
DISCUSSION
The control rods are divided into four control rod groups. The scram of each control rod group
is controlled by separate circuits within the RPS system. The system design has two trip logic
channels functioning in a 1-out-of-2 twice arrangement. This design requires that one trip logic
be satisfied in both trip logic channels before the control rod group will scram. The RPS circuits
are a fail-safe design in that the circuits are normally energized, and the loss of power will
initiate a scram. Also, the RPS scram circuits are routed separately from other circuits to
prevent any possibility for interaction.
For CGS, in all fires other than a control room fire, the circuits will be de-energized when the
mode switch in the control room is placed in the SHUTDOWN position and circuit damage does
not prevent the scram. For fires in the control room, a hot short between conductors to the
mode switch could keep the associated trip channel logic energized. Two hot shorts without the
occurrence of an open circuit or short to ground have the potential of affecting the scram
function. A hot short as described above would have to be present in both of the trip channel
logic circuits associated with the same trip channel. This would keep the trip channel energized
so that half of the 1-out-of-2 twice logic would not be satisfied. The result would be that the
associated rod group would not scram. The other three rod groups would not be affected and
would scram as expected.
CGS is a BWR-5 design. This plant design has the Power Generation Control Complex which
provides cable separation in the control room subflooring when the wires exit the control
cabinets. In part, due to this cable separation, the NRC determined this issue at CGS to be of
very low safety significance.
To accomplish alternative safe shutdown, for a fire in the control room, most BWRs rely upon
using three to six SRVs to depressurize the reactor vessel. The vessel is then reflooded with a
low pressure coolant injection system using a residual heat removal pump in the low pressure
coolant injection mode. By design, the negative reactivity, added by all four rod groups during a
scram, provides adequate shutdown margin to offset the positive void and temperature
reactivity would have been added to the vessel. A typical BWR reactor has about 180 control
rods. One of the four rod groups remaining in the fully out position would place the reactor
outside of the design basis.
RELEVANT GENERIC COMMUNICATIONS
Regulatory Issue Summary 2004-03, Revision 1, Risk-Informed Approach for Post-Fire
Safe-Shutdown Circuit Inspections discusses the probability of two hot shorts occurring for a
postulated fire.
CONTACT
S
This information notice requires no specific action or written response. Please direct any
questions about this matter to the technical contacts listed below or the appropriate Office of
Nuclear Reactor Regulation (NRR) project manager.
/RA/
Michael Case, Director
Division of Policy and Rulemaking
Office of Nuclear Reactor Regulation
Technical Contacts: John M. Mateychick, R IV Edward McCann, NRR
817-276-6560 301-415-1218 E-mail: JMM3@nrc.gov E-mail: EVM@nrc.gov
Phillip M. Qualls, NRR
301-415-1849 E-mail: PMQ@nrc.gov
ML063540138 RIV/SRI AFPB/FPE AFPB/FPE AFPB/BC TECH EDITOR PGCB/PM PGCB/LA PGCB/BC DPR/DD
JMateychick PQualls EMcCann SWeerakkody CClark QNguyen CHawes - CJackson MCase
CMH
12/20/06 2/05/2007 2/02/2007 2/08/2007 02/12/2007 2/01/2007 2/14/2007 02/15/2007 02/15/2007