ML080300554
| ML080300554 | |
| Person / Time | |
|---|---|
| Site: | Arkansas Nuclear  |
| Issue date: | 01/30/2008 |
| From: | Chamberlain D NRC/RGN-IV/DRP |
| To: | Ho Nieh NRC/NRR/ADRO/DORL/LPLIV |
| References | |
| TAC MD7908, TAC MD7909, FOIA/PA-2010-0334 | |
| Download: ML080300554 (9) | |
Text
UNITED STATES NU CLE AR RE GU LATOR Y C O M M I S S I O N R EGI ON I V 611 R YAN PLAZA D R IV E, SU ITE 400 AR LI N GTON , TEXAS 76011-4005 January 30, 2008 MEMORANDUM TO: Ho K. Nieh, Deputy Director Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation FROM: Dwight Chamberlain, Director /RA A.Vegel for/
Division of Reactor Projects
SUBJECT:
TASK INTERFACE AGREEMENT (TIA) - REQUEST FOR EVALUATION OF INTENDED APPLICATION OF TECHNICAL SPECIFICATION (TS)
LIMITING CONDITION FOR OPERATION (LCO) 3.0.5 FOR SURVEILLANCE TESTING OF REACTOR PROTECTION SYSTEM (RPS) CHANNELS AT ARKANSAS NUCLEAR ONE (ANO)
(TIA2008-001) (TAC Nos. MD7908 and MD7909)
Region IV requests that the Office of Nuclear Reactor Regulation perform a technical review and provide concurrence on an issue involving RPS surveillance testing identified by the resident inspectors at ANO. Specifically, the resident inspectors identified that Entergy plans to invoke TS LCO 3.0.5 to restore an inoperable RPS channel to service while performing surveillance testing on the remaining RPS channels. LCO 3.0.5 states in part, Equipment removed from service or declared inoperable to comply with ACTIONS may be returned to service under administrative control solely to perform testing required to demonstrate its OPERABILITY or the OPERABILITY of other equipment. Conducting surveillance tests with the inoperable channel not tripped would place the RPS logic in a two-out-of-two trip configuration which would not meet the single failure design criterion. Standard Technical Specifications require that single failure protection be maintained for a plant condition of either one or two inoperable channels. It is possible for the licensee to demonstrate operability of the remaining RPS channels without invoking TS SR 3.0.5 by complying with TS required actions and placing the inoperable channel in trip. This would put the RPS logic in a one-out-of-two trip logic, preserving the single failure criterion, though increasing the likelihood of a spurious reactor trip. The details are described in the following paragraphs. Region IV requests NRR concurrence on the Regions technical evaluation to determine if the licensees application of TS LCO 3.0.5 is allowed.
Background:
During ANO Unit 1 Refueling Outage 1R20, the licensee replaced an excore nuclear instrument detector in the A string due to trend data that indicated declining performance on the previous instrument. During the subsequent startup, the replacement detector failed to pass its surveillance test. The licensee decided to continue with the startup without replacing the detector. This decision was based on a desire to minimize thermal cycling of Steam Generator A due to a previously identified issue that placed limits on the thermal cycles for that steam generator. Consequently, the licensee planned to replace the inoperable detector during the next refueling outage at the end of the operating cycle.
Ho K. Nieh By system design, bypassing or tripping the A detector results in bypassing or tripping all parameters in the RPS channel. The bypassed parameters in that channel may not be directly affected by the inoperable excore detector.
To address the inoperable excore detector, the licensee implemented a temporary modification to Channel A of emergency feedwater instrumentation and control (EFIC) to eliminate any adverse effects with respect to excore input to the EFIC Channel A functions. The detector remained inoperable with respect to RPS actuation in response to reactivity events. This required the licensee to perform the actions of TS 3.3.1.A.1.
TS 3.3.1.A states that with one channel inoperable the licensee can either:
A.1 Place the channel in bypass or trip within one hour.
OR A.2 Prevent bypass of remaining channels within one hour.
The licensee implemented a second temporary modification to de-energize the Channel A excore string and install shorting plugs to make the instrument output zero. After completion of this modification, the licensee invoked TS 3.3.1.A.2 to maintain the channel untripped and unbypassed (with one or more inoperable functions). To prevent the bypass of the remaining three channels, the licensee tagged the remaining operable channels under administrative controls. During normal operations, the licensee has thus been maintaining RPS Channel A in operate (untripped and unbypassed) in accordance with TS 3.3.1.A.2 using administrative controls on the B, C, and D channels. This places the RPS system in a two-out-of-three trip configuration for high flux trips and a two-out-of-four configuration for all other functions associated with Channel A.
To test the redundant channels with the unit in this condition, TS 3.3.1.B requires tripping the inoperable channel and then bypassing the channel to be tested. This places the RPS logic in a one-out-of-two trip configuration.
Licensees proposed use of TS LCO 3.0.5: The licensee has briefed the resident inspectors that they intend to invoke TS LCO 3.0.5 to perform required routine surveillance testing of RPS Channels B, C, and D. Specifically, the licensee stated they intend to leave Channel A in operate and place Channel B, C, or D in bypass to test that channel. This configuration would place the unit in a two-out-of-two trip configuration, thereby avoiding placing the unit in a one-out-of-two trip configuration and, therefore, reducing the likelihood of a spurious reactor trip.
The licensee concluded the reduction in risk from reducing the likelihood of a spurious reactor trip justified placing the RPS logic in a two-out-of-two trip configuration.
LCO 3.0.5 states:
Equipment removed from service or declared inoperable to comply with ACTIONS may be returned to service under administrative control solely to perform testing required to demonstrate its OPERABILITY or the OPERABILITY of other equipment. This is an exception to LCO 3.0.2 for the system returned to service under administrative control to perform the testing required to demonstrate OPERABILITY.
Ho K. Nieh Bases - LCO 3.0.5:
LCO 3.0.5 establishes the allowance for restoring equipment to service under administrative controls when it has been removed from service or declared inoperable to comply with ACTIONS. The sole purpose of this Specification is to provide an exception to LCO 3.0.2 (e.g., to not comply with the applicable Required Action(s)) to allow the performance of required testing to demonstrate:
- a. The OPERABILITY of the equipment being returned to service; or
- b. The OPERABILITY of other equipment.
The administrative controls ensure the time the equipment is returned to service in conflict with the requirements of the ACTIONS is limited to the time absolutely necessary to perform the required testing to demonstrate OPERABILITY. This Specification does not provide time to perform any other preventive or corrective maintenance.
An example of demonstrating the OPERABILITY of the equipment being returned to service is reopening a containment isolation valve that has been closed to comply with Required Actions and must be reopened to perform the required testing.
An example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to prevent the trip function from occurring during the performance of required testing on another channel in the other trip system. A similar example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to permit the logic to function and indicate the appropriate response during the performance of required testing on another channel in the same trip system.
Licensee Position: The licensee has determined that application of TS LCO 3.0.5 to support testing of redundant channels is permissible since the LCO is established in support of testing only, and that it is assumed that configurations resulting from placing inoperable equipment in service are short lived. The Entergy position is described fully in the attached white paper.
NRC Staff Position:
The licensees proposed surveillance test using LCO 3.0.5 accommodates the licensees desire to reduce risk of a spurious plant trip. However, by applying LCO 3.0.5, the licensee would establish a conditional non-compliance with TS. It is the staff position that the licensee must comply with required action A.1 or A.2 and that intentional non-compliance with these actions is not permitted by applying LCO 3.0.5 since LCO 3.0.5 is limited to plant conditions where simultaneous testing and compliance with the TS required actions is not possible. Therefore, performing the surveillance in the method proposed by the licensee would require an amendment to the ANO TSs.
TS LCO 3.0.5 specifically states that equipment removed from service or declared inoperable to comply with ACTIONS may be returned to service under administrative control solely to perform testing required to demonstrate the OPERABILITY of other equipment. However, by system design, Channel A is not required to be in operate to demonstrate the operability of the
Ho K. Nieh redundant channels. The other channels may be tested by complying with technical specification to maintain single failure trip protection by tripping the inoperable channel (Channel A), thus placing the RPS in a one-out-of-two trip logic.
Dockets: 50-313; 50-368
Attachment:
Application of TS 3.0.5 to Support ANO-1 Excore Testing cc via E-mail:
D. Chamberlain, D/DRP (DDC)
J. Clark, C/DRP/PBE (JAC)
A. Vegel, DD/DRP (AXV)
G. Miller, DRP/SPE/E (GBM)
F. Sanchez, DRP/SRI/E (AAS1)
J. Josey, DRP/RI/E (JEJ1)
M. Case, D/NRR/ADRO/DRP (MJC)
S. Rosenberg, C/NRR/PSPB (SLR1)
S. Peters, PM/NRR/PSPB (SEP)
T. Kobetz, C/NRR/ITSB (TJK1)
C. Schulten, NRR/ITSB (CSS1)
A. Wang, NRR/PM, NRR/LPL4 (ABW)
Ho K. Nieh SUNSI Review Completed: _GBM__ ADAMS: ; Yes No Initials: _GBM__
Publicly Available ; Non-Publicly Available Sensitive ; Non-Sensitive S:\DRP\DRPDIR\TIA\ANO_TIA2008-001.doc ML080300554 RIV:SRI:DRP/E RIV:C:DRP/E D:DRP NRR/ITSB NRR/ITSB/BC NRR/PSPB/PM JJosey JClark DDChamberlain CSchulten TKobetz SPeters
/RA electronic/ /RA/ GBM for /RA AVegel for/ /RA/ /RA GMW for/ /RA/
1/16/08 1/17/08 1/17/08 1/24/08 1/24/08 1/24/08 NRR/PSPB/BC NRR/DPR/DD SRosenberg HNieh
/RA/ /RA/
1/28/08 1/29/08 OFFICIAL RECORD COPY T=Telephone E=E-mail F=Fax
Attachment White Paper Application of TS 3.0.5 to Support ANO-1 Excore Testing LCO 3.0.5 Equipment removed from service or declared inoperable to comply with ACTIONS may be returned to service under administrative control solely to perform testing required to demonstrate its OPERABILITY or the OPERABILITY of other equipment. This is an exception to LCO 3.0.2 for the system returned to service under administrative control to perform the testing required to demonstrate OPERABILITY.
Bases - LCO 3.0.5 LCO 3.0.5 establishes the allowance for restoring equipment to service under administrative controls when it has been removed from service or declared inoperable to comply with ACTIONS. The sole purpose of this Specification is to provide an exception to LCO 3.0.2 (e.g.,
to not comply with the applicable Required Action(s)) to allow the performance of required testing to demonstrate:
- a. The OPERABILITY of the equipment being returned to service; or
- b. The OPERABILITY of other equipment.
The administrative controls ensure the time the equipment is returned to service in conflict with the requirements of the ACTIONS is limited to the time absolutely necessary to perform the required testing to demonstrate OPERABILITY. This Specification does not provide time to perform any other preventive or corrective maintenance.
An example of demonstrating the OPERABILITY of the equipment being returned to service is reopening a containment isolation valve that has been closed to comply with Required Actions and must be reopened to perform the required testing.
An example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to prevent the trip function from occurring during the performance of required testing on another channel in the other trip system. A similar example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to permit the logic to function and indicate the appropriate response during the performance of required testing on another channel in the same trip system.
During startup from refueling outage 1R-20, it was noted that one of the two excore detectors in the A Excore detector string failed to pass operability checks. The channel was bypassed and a temporary modification was installed to eliminate any adverse effects with regard to the excore input to Emergency Feedwater Instrumentation and Control (EFIC) functions. The detector, however, remained inoperable for purposes of Reactor Protective System (RPS) actuation in response to reactivity events. Due to system design, bypassing or tripping the A Excore string also results in bypassing or tripping the entire RPS channel, even though these parameters may not be directly affected by the inoperable excore detector. The typical RPS channel trip parameters are:
Low RCS Pressure Trip Variable Pressure Trip High RCS Pressure Trip High Flux Trip*
Power Unbalance Trip* High RCS Temperature Power to Pump Trip* Turbine Trip Reactor Building High Pressure Trip Feedwater Pump Trips
- Affected by inoperable excore detector ANO-1 Technical Specifications (TS) provide a means of testing redundant channels by placing the inoperable channel in the tripped condition and then bypassing the channel to be tested.
This results in the unit being in a 1-out-of-2 trip configuration with regard to RPS actuation (i.e.,
only one of the remaining two RPS channels would need to actuate for any one of the above parameters to result in a unit trip). This configuration provides ample safety from an accident or event perspective, but also places the unit in a configuration such that a spike on either of the remaining two channels would result in an inadvertent trip of the unit.
In contrast to the above, ANO-1 TS 3.0.5 provides a means of returning an inoperable component to service temporarily to support testing of that component or required testing of other equipment, as necessary. An inoperable channel or trip system is one of the examples provided in the ANO-1 TS Bases and in the improved standard TSs (NUREG 1430). As stated above, an inoperable RPS channel must be placed in the tripped condition during testing of a redundant channel. Application of TS 3.0.5, however, would permit the channel to be returned to service while testing a redundant channel. By applying TS 3.0.5, the risk of an inadvertent trip is greatly reduced, since two channels will be required to trip for a unit trip to occur.
Restoring an inoperable channel temporarily in service places the plant in a 2-out-of-2 configuration with regard to the affected RPS parameters listed above. However, other RPS parameters associated with the channel are fully operational; therefore, an acceptable 2-out-of-3 configuration will exist for remaining parameters (trips initiated due to pressure and temperature and anticipatory trips). The risk of inadvertent trip due to a spike or other momentary glitches on a redundant channel is eliminated by application of TS 3.0.5. However, the three trip parameters listed above that are affected by the inoperable excore will be in a 2 out-of-2 configuration, which is single failure vulnerable. In other words, if a single failure were assumed to occur in one of the two operable and unbypassed channels, a valid trip signal of the remaining RPS excore-related channel parameters would not result in a plant trip. Therefore, a 2-out-of-2 configuration is normally avoided without further evaluation and in some cases, additional compensatory measures established. In light of the current A Excore detector failure on ANO-1, the following information is provided to evaluate the implications of TS 3.0.5 application in support of testing of the redundant RPS excore channels until the A Excore detector can be repaired.
During steady state power operations, the only major fast-acting reactivity event expected would be as a result of a rapid cooldown of the Reactor Coolant System (RCS). This would normally be caused by the creation of an excess steam path, probably via a failed open main steam safety valve or similar. Note that main steam safety valves are normally closed and are not expected to inadvertently fail open from a closed state. In addition, during rapid cooldown events the unit normally trips on low RCS pressure before core reactivity could cause a trip on high reactor power. Because other design features protect against such excursions and because a significant steam release event is unlikely during normal operations, the risk of
temporary operation in a 2-out-of-2 configuration is minimal. Note also that RPS testing is not normally permitted during transient or abnormal plant conditions.
Compensatory action to reduce the probability of a plant transient during the maintenance evolution should be considered. Restricting other maintenance activities, ensuring steady-state operations, and verifying the reliability of the offsite power grid are obvious measures that can help eliminate risk associated with temporary operation in a 2-out-of-2 configuration. In addition, appropriate job planning and briefs should be used to strictly control and minimize the time in which the plant is in this configuration to support testing of redundant channels.
Furthermore, methods should be established to quickly restore a channel being tested to operation if unforeseen changes in plant conditions or other events occur during the maintenance window. These compensatory measures are examples of those which may aid in reducing overall plant risk; however, other similar measures or additional measures may be better suited to fulfill this function.
In summary, application of TS 3.0.5 to support testing of redundant channels is permissible by TSs. Because TS 3.0.5 is established in support of testing only, it is assumed that configurations resulting from placing inoperable equipment in service are short lived.
Nevertheless, additional consideration should be given to the single failure vulnerability established when apply TS 3.0.5 is with regard to the failed excore detector. Based on the above, it is evident that given effective compensatory measures, plant risk can be appropriately managed during the short time frame in which an inoperable RPS channel is returned to service in support of redundant channel testing. These actions are consistent with the maintenance rule expectations of 10 CFR 50.65.