ML103230177
| ML103230177 | |
| Person / Time | |
|---|---|
| Site: | Byron  |
| Issue date: | 12/20/2010 |
| From: | John Jolicoeur Division of Policy and Rulemaking |
| To: | O'Brien K Division of Reactor Safety III |
| References | |
| TIA 10-002 | |
| Download: ML103230177 (8) | |
Text
December 20, 2010 MEMORANDUM TO: Kenneth G. OBrien, Deputy Director Division of Reactor Safety Region III FROM: John R. Jolicoeur, Acting Deputy Director /RA/
Division of Policy and Rulemaking Office of Nuclear Reactor Regulation
SUBJECT:
FINAL RESPONSE TO TASK INTERFACE AGREEMENT (TIA) 2010-002, LICENSING BASIS FOR SINGLE FAILURES AT THE BYRON STATION By letter dated January 21, 2010, Agencywide Documents Access and Management System Accession No. ML100210993, the U.S. Nuclear Regulatory Commission Region III Office requested the Office of Nuclear Reactor Regulation (NRR) provide answers to the following TIA questions regarding single failures at Byron Station:
- 1. Is the failure of a breaker to perform its safety function regardless of how that failure occurs (active or passive) considered a single failure as defined by 10 CFR Part 50 [Title 10 of the Code of Federal Regulations], Appendix A?
- 2. Specific to the Byron Station, does the licensing basis for the steam generator
[(SG)] tube rupture event include the assumption of a single failure as defined in 10 CFR Part 50, Appendix A? That is, based on the above answer, is it within the licensing basis to assume an active or passive electrical failure of a SG PORVs [power operated relief valve] power supply breaker in the analysis of the steam generator tube rupture event?
The NRR staffs assessment is documented in the enclosed evaluation.
Enclosure:
As stated CONTACT: Barry W. Miller, DPR/PLPB (301) 415-4117
MEMORANDUM TO: Kenneth G. OBrien, Deputy Director Division of Reactor Safety Region III FROM: John R. Jolicoeur, Acting Deputy Director /RA/
Division of Policy and Rulemaking Office of Nuclear Reactor Regulation
SUBJECT:
FINAL RESPONSE TO TASK INTERFACE AGREEMENT (TIA) 2010-002, LICENSING BASIS FOR SINGLE FAILURES AT THE BYRON STATION By letter dated January 21, 2010, Agencywide Documents Access and Management System Accession No. ML100210993, the U.S. Nuclear Regulatory Commission Region III Office requested the Office of Nuclear Reactor Regulation (NRR) provide answers to the following TIA questions regarding single failures at Byron Station:
- 1. Is the failure of a breaker to perform its safety function regardless of how that failure occurs (active or passive) considered a single failure as defined by 10 CFR Part 50 [Title 10 of the Code of Federal Regulations], Appendix A?
- 2. Specific to the Byron Station, does the licensing basis for the steam generator
[(SG)] tube rupture event include the assumption of a single failure as defined in 10 CFR Part 50, Appendix A? That is, based on the above answer, is it within the licensing basis to assume an active or passive electrical failure of a SG PORVs [power operated relief valve] power supply breaker in the analysis of the steam generator tube rupture event?
The NRR staffs assessment is documented in the enclosed evaluation.
Enclosure:
As stated CONTACT: Barry W. Miller, DPR/PLPB (301) 415-4117 DISTRIBUTION:
PUBLIC PLPB Reading File RidsRgn3MailCenter RidsNrrDeEeeb RidsNrrPMByron RidsNrrDpr RidsRgn4MailCenter RidsNrrDirs RidsNrrDssSrxb JJolicoeur RidsNrrDprPgcb RidsNrrDirsItsb RidsNrrDra RidsRgn1MailCenter RidsAcrsAcnwMailCtr RidsNrrDss RidsNrrDraAadb RidsRgn2MailCenter RidsNrrDe RidsNrrDssSbpb RidsNrrLADBaxley ADAMS ACCESSION NO: ML103230177 NRR-043 OFFICE NRR/DPR/PLPB NRR/DPR/PLPB NRR/DE/EEEB NRR/DSS/SBPB NRR/DSS/SRXB NAME BMiller DBaxley RMathew GCasto AUlses DATE 11/19/10 11/19/10 12/6/10 12/3/10 OFFICE NRR/DRA/AADB NRR/DPR/PLPB NRR/DPR NAME TTate MAsh JJolicoeur DATE 12/3/10 12/15/10 12/20/10 OFFICIAL RECORD COPY
TASK INTERFACE AGREEMENT (TIA) 2010-002 LICENSING BASIS FOR SINGLE FAILURES AT THE BYRON STATION
1.0 INTRODUCTION
By letter dated January 21, 2010 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML100210993), the U.S. Nuclear Regulatory Commission (NRC)
Region III Office requested the Office of Nuclear Reactor Regulation (NRR) provide answers to the following TIA questions regarding the licensing basis for single failures at Byron Station:
- 1. Is the failure of a breaker to perform its safety function regardless of how that failure occurs (active or passive) considered a single failure as defined by 10 CFR Part 50 [Title 10 of the Code of Federal Regulations], Appendix A?
- 2. Specific to the Byron Station, does the licensing basis for the steam generator
[(SG)] tube rupture [(SGTR)] event include the assumption of a single failure as defined in 10 CFR Part 50, Appendix A? That is, based on the above answer, is it within the licensing basis to assume an active or passive electrical failure of a SG PORVs [power operated relief valve] power supply breaker in the analysis of the steam generator tube rupture event?
2.0 BACKGROUND
Byron Station is a 4-loop Westinghouse design with a single, safety-related SG PORV on each of the four main steam lines. These valves have electro-hydraulic actuators supplied by 480 volts alternating current (Vac) power. Byron Station has two vital Class 1E buses and each bus provides power to two of the four valves. These valves are also provided with hand pumps for local operator action. In the event of an SGTR, the operators would identify the SG with a ruptured tube and close the associated PORV to minimize releases.
During a Component Design Bases Inspection, regional inspectors identified a concern related to the appropriateness of the component failure assumed in an SGTR event. Specifically, the inspectors noted that after an SGTR, the operators open the SG PORVs associated with the intact SGs to cooldown and begin depressurization of the reactor coolant system (RCS). This operation would be time critical to prevent overfilling the SG with a ruptured tube and allowing liquid to enter the steam piping. The licensees (Exelons) SGTR accident analysis for margin to overfill (MTO) assumed the limiting single failure of one SG PORV to open when required; this assumption was consistent with Updated Final Safety Analysis Report (UFSAR) Section 15.6.3 and Table 15.0-15. Failure of one SG PORV during an SGTR event would enable operators to cooldown the RCS using the remaining two SG PORVs on the intact SGs. However, these electro-hydraulic actuators require 480 Vac power to operate. The four SG PORVs (MS018A-D) are powered from two redundant 480 Vac safety-related electrical buses (Bus 131X and Bus 132X for Unit 1, for example). Each bus provides power to two SG PORVs: Bus 131X provides power to MS018A and MS018D; Bus 132X provides power to MS018B and MS018C.
Therefore, the failure of a single electrical power supply could result in the failure of two SG PORVs to operate. For example, if we assume an SGTR on B SG, the failure of motor control center (MCC) 131X2 (Bus 131X) or associated breaker would result in the failure of MS018A ENCLOSURE
and MS018D, leaving only one SG PORV, MS018C on the C SG, on one intact SG available for cooldown. The inspectors noted the following:
UFSAR Section 15.0.8, Plant Systems and Components Available for Mitigation of Accident Effects: Table 15.0-7, identifies plant systems and equipment credited for transients and accident conditions. In determining which systems were necessary to mitigate the effects of these postulated events, the classification system of ANSI-N18.2-1973 was utilized. The design of systems important to safety (including protection systems) is consistent with Institute of Electrical and Electronics Engineers (IEEE) Standard 379-1972, IEEE Standard Application of the Single-Failure Criterion to Nuclear Power Generating Station Safety Systems, and Regulatory Guide (RG) 1.53, Application of the Single-Failure Criterion to Nuclear Power Plant Protection Systems in the application of the single failure criterion.
UFSAR Table 15.0-7 lists the SG PORVs as equipment available to respond for a SGTR event.
UFSAR Section 15.0.13, Limiting Single Failures, states:
The most limiting single failure of safety-related equipment, where one exists, is identified in each analysis description, and the consequences of this failure are described therein. In some instances, because of redundancy in protection equipment, no single failure which could adversely affect the consequences of the transient has been identified.
The failure assumed in each analysis is listed in UFSAR Table 15.0-15.
UFSAR Table 15.0-15, Single Failure Assumed in Accident Analysis, lists a single PORV for a SGTR MTO event.
The inspectors questioned if the single failure assumptions used in the SGTR MTO analysis were in accordance with the Byron Station licensing basis. The inspectors identified this item as unresolved item (URI) (URI 05000454/455/2009007-03).
Licensee Position The licensee disagrees with the application of the Appendix A definition of a single failure to the SGTR event. The licensee stated that single failures, as defined in Appendix A, and the General Design Criteria are applicable to the design of systems, structures, and components to ensure the limitations of the regulations of 10 CFR are not exceeded. The licensee stated that the SGTR event falls under the Standard Review Plan (NUREG-75/087) which limits dose to 10 percent of the Standard Review Plan limits. The licensee contends that the SGTR event is not a limiting design bases event, that is, the SGTR event will not result in exceeding any 10 CFR limits (10 CFR 50.46, 10 CFR 50.67, or 10 CFR Part 100). The licensee also confirmed a large break loss-of-coolant accident is a limiting design bases event and, therefore, subject to the Appendix A definition of a single failure. The licensee queried other sites and determined that other sites also assumed single active failures (the failure of one PORV), and therefore contends that application of passive electrical failures would constitute a generic backfit.
3.0 EVALUATION Question 1: Is the failure of a breaker to perform its safety function regardless of how that failure occurs (active or passive) considered a single failure as defined by 10 CFR Part 50, Appendix A?
Response: Yes. The failure of a breaker to perform its safety function regardless of how that failure occurs (active or passive) is considered a single failure as defined by 10 CFR Part 50, Appendix A.
The Byron Stations conformance with Appendix A to 10 CFR Part 50 is shown in Byron Station UFSAR Section 3.1, Conformance with General Design Criteria. Section 3.1 of the Byron Station UFSAR states that Byron Station fully satisfies and is in compliance with the NRC General Design Criteria.
The definition of a single failure as defined in 10 CFR Part 50 Appendix A is:
A single failure means an occurrence which results in the loss of capability of a component to perform its intended safety functions. Multiple failures resulting from a single occurrence are considered to be a single failure. Fluid and electric systems are considered to be designed against an assumed single failure if neither (1) a single failure of any active component (assuming passive components function properly) nor (2) a single failure of a passive component (assuming active components function properly), results in a loss of the capability of the system to perform its safety functions.2 2
Single failures of passive components in electric systems should be assumed in designing against a single failure.
This footnote emphasizes that for electric systems, no distinction is made between failures of active and passive components and all such failures must be considered in applying the Single Failure Criterion. This position is clarified in NRC SECY-77-439, Information Report by the Office of Nuclear Reactor Regulation, the Single Failure Criterion, dated August 17, 1977.
The Electrical Engineering Branch (EEEB) staffs review of the Byron Station licensing documents did not identify any exemptions granted from 10 CFR Part 50 Appendix A requirements. Therefore, the Byron Station licensing basis includes single failure of electrical components (no distinction is made between failures of active and passive components).
Electrical cables are considered passive components and breakers are typically considered active components. For example, a short circuit or fault in an electrical cable feeding Bus 131X or the bus which provides power to PORVs MS018A and MS018D is considered a failure of a passive electrical component disabling a train of electric power supply. Another example, failure of a breaker that feeds PORVs MS018A and MS018D regardless of how that failure occurs is considered a failure of an active electrical component.
In either case, a worst-case single failure of an electrical component (active or passive), only two of the PORVs will have power for mitigating design basis events. For a SGTR event, one of the two remaining PORVs would be on the SG with the tube rupture. The licensee assumes in its UFSAR Chapter (15) accident analysis for a SGTR that the limiting case scenario is the
failure of one PORV to open. The failure of MCC 131X2 (Bus 131X) or associated breaker would result in the failure of MS018A and MS018D, resulting in a more limiting case, where two PORVs would fail to open. Therefore, the NRR staff has identified a possibly more limiting single failure than the failure the licensee identified in its accident analysis for SGTR.
Based on our review, the NRR staff concludes that the failure of a breaker to perform its safety function regardless of how that failure occurs is considered a single failure as defined by 10 CFR Part 50, Appendix A. The NRR staff also concludes that the Byron Station licensing basis includes consideration of the most limiting single failure in the design of safety systems as defined in Appendix A to 10 CFR Part 50. The existing design does not conform to the single failure criteria defined in Appendix A to 10 CFR Part 50 and Section 3.1 of Byron Station UFSAR.
Question 2: Specific to the Byron Station, does the licensing basis for the SGTR event include the assumption of a single failure as defined in 10 CFR Part 50, Appendix A? That is, based on the above answer, is it within the licensing basis to assume an active or passive electrical failure of a SG PORVs power supply breaker in the analysis of the SGTR event?
Response: Yes. The licensing basis for the SGTR event includes the assumption of a single failure as defined in 10 CFR Part 50, Appendix A. That is, single failure includes both active and passive electrical component failures.
As discussed in response to Question No. 1, the NRR staffs review of the Byron Station licensing documents did not identify any exemptions granted from 10 CFR Part 50, Appendix A requirements. Therefore, the Byron Station licensing basis includes single failure of electrical components (no distinction is made between failures of active and passive components). In addition, the NRR staffs conclusion is based on the following information.
The licensee states in Section 3.1 of the UFSAR that Byron Station fully satisfies and is in compliance with Appendix A to 10 CFR Part 50.
UFSAR Section 15.0.8, Plant Systems and Components Available for Mitigation of Accident Effects: Table 15.0-7, identifies plant systems and equipment credited for transients and accident conditions. In determining which systems were necessary to mitigate the effects of these postulated events, the classification system of ANSI-N18.2-1973 was utilized. Table 15.0-7 lists the SG PORVs as equipment available to respond for a SGTR event.
In Chapter 15.0.8, the licensee states The design of systems important to safety (including protection systems) is consistent with IEEE Standard 379-1972 and RG 1.53 in the application of the single failure criterion. Also, the licensee states that it complies with RG 1.53, Revision 0, for application of the single failure criteria to nuclear power plant protection systems.
RG 1.53 and IEEE 379 state that:
The safety systems shall perform all safety functions required for a design basis event in the presence of (1) any single detectable failure within the safety systems concurrent with all identifiable but nondetectable failures;
(2) all failures caused by the single failure; and (3) all failures and spurious system actions that cause or are caused by the design basis event requiring the safety function.
UFSAR Section 15.0.13, Limiting Single Failures, states:
The most limiting single failure of safety-related equipment, where one exists, is identified in each analysis description, and the consequences of this failure are described therein. In some instances, because of redundancy in protection equipment, no single failure which could adversely affect the consequences of the transient has been identified.
The failure assumed in each analysis is listed in Table 15.0-15.
The NRR staff notes that although the Byron Station licensing basis for SGTR events was based on the generic Westinghouse analysis, SGTR Analysis Methodology to Determine the Margin to Steam Generator Overfill, WCAP-10698-P-A (proprietary)/WCAP-10750 (nonproprietary), the analysis points out that common mode failures of all SG PORVs were not evaluated since electrical power and air supplies to the PORVs are largely plant specific. NRC evaluation also had pointed out that the worst single failure should be identified if different from the analysis and the effect of the difference on the MTO should be provided. Based upon a more in depth electrical analysis of SG PORV power supplies, the licensee failed to identify the most limiting single failure (an electrical component failure rather than a mechanical component failure), during the Byron Stations implementation of the WCAP-10698-P-A analysis for SGTR. The NRR staff also notes that Commonwealth Edisons letter dated November 13, 1996, to the NRC regarding SGTR analysis states that the compatibility of the Byron/Braidwood systems with WCAP 10698-P-A bounding plant analysis has been evaluated in ComEd Report, "Steam Generator Tube Rupture Analysis for Byron and Braidwood Plants, Revision 1", February 1990. The conclusion that no major design differences affecting the MTO exist and the use of the same limiting single failures as identified in WCAP 10698-P-A and Supplement 1 of WCAP 10698-P-A are applicable for this analysis. In addition, Commonwealth Edisons letter dated June 24, 1997, in response to the NRC staffs request for justification why the single failures chosen for the different cases remains bounding considering the changes in the procedures, plant configuration, and analysis method, the licensee clearly stated that the most limiting single active failure remains the intact SG PORV failure. The licensee failed to evaluate the electrical component failures as required by the plants licensing basis (consideration of single failures (both active and passive) of electrical components). In letters dated January 28, 1998, and May 25, 1999, the NRC staff found the Commonwealth Edison revised analysis acceptable; however, the staffs finding was based upon an incomplete evaluation performed by the licensee.
In a letter from C. Rossi (then Assistant Director of the Division of PWR Licensing-A) to A. Ladieu (then Chairman of the SGTR Subgroup, Westinghouse Owners Group) dated March 30, 1987, the following key statements were documented:
The offsite radiation doses were calculated for various single failure cases considered for the evaluation of the MTO using the mass releases from the SGTR analysis for the referenced plant.
The WCAP-10698 analysis is conservative with respect to prediction of MTO; however, we acknowledge that design differences between plants and required plant specific information listed in Section D of the enclosure. In Section D, the NRC states Primary and secondary PORV designs vary from plant to plant with regard to motive power and controls and specifically asked the licensees to provide plant specific information. In addition, the NRC reiterated that the worst single failure should be identified.
The design basis SGTR analysis assumes a loss-of-offsite power, the most reactive stuck rod, conservative initial conditions, safeguards capacities and setpoints, turbine runbacks, 120 percent of 1971 ANS decay heat rate, and the worst single failure.
The NRR staffs position for a single failure analysis is that the licensee must consider both passive and active failures of electrical systems in the SGTR event.
Further, the NRR staff notes that in accordance with accident dose guidance in Regulatory Guide 1.183, Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Plants, the SGTR accident dose acceptance value is dependent on the specific case that is being evaluated. For the case in which the SGTR results in any appreciable fuel damage and for the pre-incident spike case, the acceptance value is the same as the maximum credible accident. It is only for the coincident spike case that the acceptance criterion is stated as one tenth that of the maximum credible accident. Therefore, the licensees statement that the SGTR event falls under the Standard Review Plan (NUREG-75/087) which limits dose to 10 percent of the Standard Review Plan Limits, does not align with Regulatory Guide 1.183.
The NRR staff notes that even if the licensees position is valid, i.e., only single active failures are assumed in the Byron Stations licensing basis, a failure of the breaker, which is an active device, that supplies power to the SG PORVs (single active failure) will leave one PORV on one intact SG and one PORV on the SG with a tube rupture rather than the failure of a single PORV on an intact SG as had been approved in the licensees earlier SGTR analyses.
4.0 CONCLUSION
Based on its review of TIA 2010-02, the NRR staff finds the following:
- 1. The failure of a breaker to perform its safety function regardless of how that failure occurs (active or passive) is considered a single failure as defined by 10 CFR Part 50, Appendix A.
- 2. The licensing basis for the SGTR event includes the assumption of a single failure as defined in 10 CFR Part 50, Appendix A. That is, single failure includes both active and passive electrical component failures. The licensee did not correctly identify the most limiting single failure to the NRC when the licensee performed their WCAP-10698 analysis for a SGTR.