ML13303A909
| ML13303A909 | |
| Person / Time | |
|---|---|
| Site: | San Onofre  |
| Issue date: | 08/17/1988 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML13303A908 | List: |
| References | |
| NUDOCS 8808230409 | |
| Download: ML13303A909 (3) | |
Text
UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.-C. 20555 ENCLOSURE SAFETY EVALUATION REPORT FOR OPERATING LICENSE CONDITIONS 2.C.(12) AND 2.C.(10)
SAN ONOFRE UNITS 2 AND 3 DOCKET NOS. 50-361 AND 50-362 INTRODUCTION License Conditions 2.C(12) for San Onofre Nuclear Generating Station (SONGS)
Unit 2 and 2.C(10) for SONGS Unit 3 required the licensee to submit an Evaluation of Control System Failures caused by High Energy Line Break (HELB),
and by failures of any power sources, sensors, or sensor impulse lines which provide power to two or more control systems. Southern California Edison (SCE) provided this evaluation and additional information requested by NRC in a number of letters since March 31, 1983.
By letter dated August 7,. 1986 the staff transmitted to SCE a Safety Evaluation which concluded that the conse quences of control system failures caused by power sources, sensors, and sensor impulse lines are bounded by the existing FSAR analyses. The Safety Evaluation resolved that portion of the license conditions. However, during the licensing review the licensee used less conservative assumptions in the HELB analyses than those used in the FSAR analyses. In addition, the steam line break (SLB) event was not analyzed for a simultaneous failure of the bypass control system and reactor regulating system since credit was taken for a single, nonsafety (control system) interlock. This resulted in the staff questioning the licensee's conclusion that the HELB initiated event is bounded by the FSAR analyses. The staff informed the licensee that the removal of the FSAR calculational uncertainties from the conservatism used in the HELB analyses was unacceptable and that HELB analyses should be performed using the same conservative assumption values as used in the FSAR analyses unless additional information could be provided to support the current HELB evaluation. The staff requested that each postulated HELB event be analyzed where necessary based on the staff's position.
Another steam line break analysis performed by the licensee stated that the steam bypass control system (SBCS) and reactor regulating system (RRS) mal functions cannot occur simultaneously during a steam line break event because of the presence of the automatic withdrawal prohibit (AWP) signal.
The generation of a quick open signal by the SBCS will produce an AWP signal which is sent to the control element drive mechanism control system (CEDMCS) to block its response to RRS demands to withdraw CEAs. The SBCS will (1) block a CEA withdrawal signal from the RRS if generated after the AWP command, or (2) terminate an automatic CEA withdrawal if already in progress after receiving a signal to actuate an AWP. The licensee provided information to confirm that the SLB event common to the SBCS and RRS will not affect the control system interlock circuitry. However, a review of drawings supplied by the licensee 8808230409 880817 PDR ADOCK 05000361 PNU
-2 revealed that credit is being taken for a single, nonsafety-related interlock, to prevent the simultaneous malfunction of the RRS and SBCS. The staff found this unacceptable since nonsafety-related equipment (control grade) should not be relied upon to remain functional for the mitigation of an event such as a SLB. Consequently, the staff's position was that the SLB event should be analyzed assuming simultaneous malfunctions for the SBCS and RRS to confirm that the event is not complicated beyond the FSAR analyses, or it may be demonstrated that the consequences of these malfunctions are acceptable.
EVALUATION AND DISCUSSION In an effort to respond to these two remaining concerns, the licensee performed additional research into the original control system HELB analysis and sub mitted this information by letter dated February 20, 1987. As a result of environmental qualification upgrades and plant design changes implemented since the HELB analysis was performed, several of the failures incorporated in the original HELB analysis are no longer required to be assumed. Specifically, the coincident failure of both SBCS flow transmitters or pressure transmitters which led to consequences outside the FSAR analyses is no.longer required to be assumed. Therefore, the SLB event can be removed from consideration.
The original HELB analysis evaluated the potential adverse effects on main steam flow control due to HELB. The MSLB limiting case for the control systems HELB analysis is based on a steam line break inside containment and failure of the main steam isolation valve (MSIV) on the intact steam generator. All other valves receiving a main steam isolation signal (NSIS) are assumed to close.
The HELB analysis assumed failure of both steam flow transmitters in the SBCS.
Failure of both steam flow transmitters would result in the generation of a quick opening signal to the turbine bypass valves (TBVs). The analysis deter mined that both transmitters are inside containment and both would fail during the MSLB inside containment since the Foxboro transmitters were not environ mentally qualified (EQ).
The discussion below provides the detailed basis for our evaluation:
- 1. Recent design changes to comply with R.G. 1.97, Rev. 2, have included replacement of the steam flow transmitters with qualified transmitters.and placed the instrumentation on the uninterruptable power supply (UPS).
Since these transmitters are qualified and physically located such that a single SLB in containment could only fail one transmitter due to jet impingement, generation of a quick open signal by the SBCS cannot occur. Therefore the MSLB inside containment analyzed in FSAR Chapter 15 is the bounding event and further analysis is no longer required.
- 2. A coincident failure of the steam header pressure transmitters, PIT 8241 and PIT 8239, In the high pressure direction will cause the TBVs to modulate open. Both of these transmitters are located outside containment and the original analyses assumed they would both fail during an MSLB outside containment since
-3 the transmitters were not environmentally qualified. The cause of concern is a break in the steam line between the containment penetration and the MSIV with the other MSIV (from the intact steam generator) failing open.
The location of the steam line and MSIV for each steam generator is physically separated in distance such that the break of concern could not physically impact on the opposite pressure transmitter. As a result, since a coincident failure of both steam pressure header transmitters is precluded by physical layout, the FSAR Chapter 15 analysis is bounding and therefore further analysis is not required.
- 3. The Automatic Motion Inhibit (AMI) interlock prohibits the SBCS from directing the RRS to initiate control rod motion when the control element drive mechanism control system (CEDMCS) is in Automatic Sequential (AS) mode. The AMI interlock does not operate when CEDMCS is in the Manual Sequential (MS) mode because automatic control rod motion does not occur in MS mode.
The AS mode of operation is provided to allow the RRS to auto matically control the rate and direction of Control Element Assembly (CEA) motion. SCE has completed plant modifications which disabled the AS mode at SONGS Units 2 and 3. No changes were made internal to the SBCS, which generates the AMI signal, or to the RRS. Signals will still be transmitted to CEDMCS from these systems, but they will have no effect since the AS mode wlll not be able to be selected. Therefore, a malfunction of the SBCS cannot affect CEA withdrawal because the interlock will not propagate a SBCS failure into the RRS.
CONCLUSION We have reviewed the licensee's evaluation of the two concerns identified by NRC letter dated August 7, 1986 regarding control system and HELB interactions.
Based on this review we agree with their conclusions that:
- 1. Failure of the SBCS cannot cause motion of the control rods because the plant cannot be operated with CEDMCS in AS mode.
- 2. Environmental Qualification upgrades prevent simultaneous steam flow transmitter failure thereby preventing TBVs from quick opening.
- 3. The SBCS pressure transmitters are separated by distance that will prevent simultaneous failure (from a SLB) thereby precluding the TBVs from modulating open.
We conclude that the original control system/HELB interactions are bounded by the FSAR Chapter 15 analysis, no further evaluation is required, and that this concern is resolved.