ML13333A417

Forwards Info Re Potential Interaction Between safety- & nonsafety-grade Sys,In Response to NRC

ML13333A417
Person / Time
Site:	San Onofre
Issue date:	10/05/1979
From:	Baskin K Southern California Edison Co
To:	Ziemann D Office of Nuclear Reactor Regulation
References
NUDOCS 7910170370
Download: ML13333A417 (8)

Text

Southern California Edison Company P. 0. BOX 800 2244 WALNUT GROVE AVENUE ROSEMEAD, CALIFORNIA 91770 October 5, 1979 Director of Nuclear Reactor Regulation Attention: Mr. D. L. Ziemann, Chief Operating Reactors Branch #2 Division of Operating Reactors U. S. Nuclear Regulatory Commission Washington, D.C. 20555 Gentlemen:

Subject:

Docket No. 50-206 Potential Interaction Between Safety and Non-Safety Grade Systems San Onofre Nuclear Generating Station Unit 1 Mr. H. R. Denton's letter of September 17, 1979 requested information regarding a potential unreviewed safety matter related to the effects of the environment resulting from high energy line breaks inside or outside containment on control systems and the consequential effects on required safety systems.

In particular, that letter referred to four specific control system interactions which had been identified by Westinghouse as pos sibly being more limiting than results presented in Safety Analysis Reports.

This letter is provided in response to Mr. Denton's request.

The specific scenarios have been evaluated with respect to the design of San Onofre Unit 1 to determine the capability of the plant to be placed in a safe shutdown condition. A discussion of the applicability of each scenario to San Onofre Unit 1, the acceptability of the consequences and any specific action to be taken to resolve each issue are included as an enclosure to this letter. Based on the acceptability of the consequences as discussed in the enclosure, it is our conclusion that operation of San Onofre Unit 1 can continue without undue risk to the health and safety of the public.

In a meeting with the NRC staff on September 18, 1979, Westinghouse presented a summary of all of their investigations to date on this subject. In addition to the four specific scenarios addressed above, Westinghouse identi fied all of the combinations of control systems and accident conditions which they had evaluated and determined to have acceptable consequences. Since the evaluation by Westinghouse was done on a generic basis, it is appropriate that the potential for adverse interaction mechanisms be investigated for San Onofre Unit 1 specifically with respect to the remainder of the scenarios which Westinghouse determined acceptable on a generic basis, as well as additional scenarios which may be possible involving other control systems at San Onofre Unit 1.

c2f

-2 However, as you are aware, San Onofre Unit 1 is one of several plants included in the NRC's Systematic Evaluation Program (SEP), which includes several topics which relate directly to the effects of high energy pipe breaks.

Specifically, the following examples are noted: III-5.A, Effects of Pipe Break on Structures, Systems and Components Inside Containment, III-5.B, Pipe Break Outside Containment, XV-2, Spectrum of Steam System Piping Failures Inside and Outside of Containment (PWR), and XV-6, Feedwater System Pipe Breaks Inside and Outside Containment (PWR).

The evaluation of the addi tional adverse interaction scenarios will be accomplished as part of the assessment of these SEP topics.

In view of the fact that in general the probability of the interaction scenarios is low and that Westinghouse has determined on a generic basis that the additional scenarios do not have any adverse effects, it is concluded that continued operation of the plant is justified until completion of the additional evaluations in connection with the SEP.

If you have any questions concerning any of this information please let me know.

Subscribed on this

(

day of

, 1979.

Bly K. P. Baskin Manager, Generation Engineering Subscribed and sworn to before me this day of 1979.

AGNES CRABTREE NOTARY PUMAC -CAtFORNA LOS ANGELM COUNT My Commissio Exp. Aus27,1982 Not y Public in and for the County of Los Angeles, State of California Enclosure

Enclosure Potential Interaction Between Safety and Mon-Safety Grade Systems San Onofre Nuclear Generating Station, Unit 1 On September 18, 1979 Westinghouse presented to the NRC staff a summary of their generic investigations of the effects of adverse environments resulting from high energy line breaks on control systems and the consequential effects on safety grade systems. That investigation led to identification of four potential interaction scenarios with adverse consequences. The applicability and consequences of each of these events is discussed below.

Implicit in the four scenarios are worst case assumptions concerning the postulated break size, the break location, the type and extent of consequential failures in control systems induced by the adverse environment, and the worst case single failure. These assumptions are therefore in addition to the already conservative set of assumptions which are typically included in acci dent and transient analyses. While no quantitative analysis has been conducted concerning the. improbability of overall scenarios, where appropriate, specific conservative assumptions that must be made to derive the postulated interaction scenario are described in the discussions below.

A. Steam Generator PORVControl System

1. "Summary of Postulated Scenario Following a feedline rupture outside containment, the steam generator POBV's are assumed to exhibit a consequential failure due to an adverse environment. Failure of the PORV's in the open position results in the depressurization of the steam generators which are the source of steam supply for the turbine driven auxiliary feedwater pump. Eventually, the turbine driven auxiliary feedwater pump will not be capable of delivering auxiliary feedwater to the intact steam generators.

2. Applicability of Postulated Scenario to San Onofre, Unit 1 A review of the steam dump control system layout at San Onofre Unit 1 has identified only one area of the plant where the environment created by a feedwater line break could impact the functioning of the control system. Equipment for the control of the atmospheric steam dump valves (PORV's) is located at the north wall of the turbine building at the mezzanine level. The feedwater lines are routed through this area.

Although this area is open and vented, the concern remains due to the proximity of control equipment to the lines.

All other control system equipment is either located in the control room, in a completely open area, or at a considerable distance from feedwater lines.

9

-2 Following a feedline break in the turbine building mezzanine area, depressurization of all three steam generators would likely occur at San Onofre Unit 1 because of the absence of main steam isolation valves. Therefore, the steam driven auxiliary feedwater pump is not relied on for supply of feedwater to the steam generators. Therefore, the concern with regard to a PORV opening does not result in adverse consequences at San Onofre Unit 1, since other means of feedwater supply are available in lieu of the steam driven auxiliary feedwater pump.

The normal source of auxiliary feedwater flow to the steam generators following a main feedwater line break outside containment or other similar accident or transient is the motor driven auxiliary feedwater pump. The auxiliary feedwater piping bypasses the feedwater control valves so that a break can be isolated anywhere on the feedwater side and auxiliary feedwater supplied to the steam generators of the intact loops.

If for some reason the motor driven auxiliary feedwater pump is unavailable (e.g. due to a postulated single failure), the same auxi liary feedwater flow path can be manually aligned to the main feedwater pumps. As a backup or in the event of a coincident loss of offsite power, the onsite diesel generators at San Onofre Unit 1 have suffi cient capacity to power the main feedwater system.

The steam generator water inventory at the time of reactor trip is an important parameter in determining the consequences of the feedwater line break, and therefore the capability of station operators to bring the plant to a safe shutdown condition. In this respect, at San Onofre Unit 1tthe reactor trip is initiated on a steam flow-feedwater flow mismatch only, rather than coincident with low steam generator water level. Therefore, for a large break which would result in a measured feedwater flow reduction of 25%, the reactor trip would occur early into the event and secondary water inventqry would be greater than for a plant which requires concident low steam generator level.

If the feedwater line break is too small to reduce measured flow by 25%, a steam flow-feedwater flow mismatch trip would not occur.

However, the smaller break results in a slower transient, so more time is available for operator action which is specified in station operating procedures for this event. These procedures require that in the event of low steam generator level, the operator first reduce power in an attempt to reestablish water level.

If this proves to be unsuccessful in restoring level, the operator is instructed to trip the reactor. These events would take place early into the transient so that at the time of reactor trip the secondary water inventory would be approximately the same as that for a plant with reactor trip on coincident low steam generator level and steam flow-feedwater flow mismatch.

-3 Whether or not steam flow-feedwater flow mismatch trip occurs, the secondary water inventory at the time of reactor trip is such that it is concluded that sufficient time for the above described operator actions is available based on the analysis provided in WCAP-9600, "Report on Small Break Accidents for Westinghouse NSSS Systems".

Although this report is generic in nature and the results of specific scenario analyses may not be directly applicable to San Onofre Unit 1, the general system behavior included in the analysis of loss of feed water are considered applicable.

In particular, Section 4.2 of WCAP-9600 describes transient analyses for postulated loss of all main and auxiliary feedwater (no pipe rupture).

The results indicate that the operator has at least 4,000 seconds following the loss of all feedwater to reinitiate auxiliary feedwater flow to the steam generators before the core begins uncovering.

The scenario postulated above is similar to that presented in Section 4.2 of WCAP-9600. The only assumption added to the WCAP-9600 analysis is that a feedline rupture occurs outside containment between the containment penetration and the feedline check valve. Conservatively, assuming that all liquid inventory in the steam generator associated with the ruptured feedline is lost via the rupture without removing any heat (i.e., liquid blowdown), calculations have shown that the loss of the heat removal capability of this liquid inventory blowdown requires operator action 1200 seconds earlier than reported in WCAP-9600. Thus, if a feedline rupture is assumed coincident with the analyses performed in WCAP-9600 the operator still has at least 2800 seconds to take cor rective action.to inject auxiliary feedwater into the intact steam generators.

3.

Proposed Action In order to improve operator response to a feedwater line break, the existing procedures will be modified to clearly specify appropriate operator actions and the available redundant sources and flow paths of feedwater including the main feedwater system in a post-accident con dition and to alert the operators to the time constraints associated with restoration of feedwater to the steam generators. Consistent with the implementation schedule associated with procedural modifications in NUREG-0578, this procedure will be revised by January 1, 1980.

B. Main Feedwater Control System

1. Summary of Postulated Scenario Following a small feedline rupture the main feedwater control system malfunctions in such a manner that the liquid mass is at a low level in the intact steam generators. The reduced secondary liquid mass at time of automatic reactor trip results in a more severe reactor coolant system heatup following reactor trip.

e-4

2. Applicability of Postulated Scenario to San Onofre, Unit 1 In order for the post-accident environment to affect the feedwater control system, the feedline break must occur in the north wall mezzanine-area of the turbine building. The three feedwater lines are routed through this area for approximately 25 feet. A break in any other location would not result in any environmental impact on feed water control.

In addition, if the control system does not cause the valves to close, there would be no impact on the scenario. The pos tulated'environmental conditions must cause a spurious signal to close the feedwater control yalve to adversely affect the scenario.

As was discussed in Section A above the steam flow-feedwater flow mismatch trip does not require a coincident low steam generator water level.

For a large break, the additional malfunction of the feedwater control valves would not result in a reduction in the water inventory at the time of reactor trip since the steam flow-feedwater flow mismatch trip would occur at an early time into the transient.

For the smaller break where the steam flow-feedwater flow mismatch trip does not occur, the malfunction of the feedwater control valves would cause the low steam generator level to be reached at an earlier time so that the operator actions discussed in Section A for this size break would have to be implemented at an earlier time. The water inventory at the time of reactor trip would be approximately the same as for the small break event of Section A.

Since for both break sizes the event results in water inventories at reactor. trip time which are approximately. the same as for the event in Section A, the same consideration on operator action time based on WCAP-9600 is applicable. Therefore the same set of procedures for operator action following a feedwater line break are also applicable and will result in the establishment of a safe shutdown condition.

3. Proposed Action In order to improve operator response to a feedwater line break, the existing procedures will be modified to clearly specify the appropriate operator actions and available redundant sources and flow paths of feedwater including the main feedwater system in a post-accident con dition, and to ensure that the operator is aware of the possibility of not obtaining an immediate trip on steam flow-feedwater flow mismatch.

Consistent with the implementation schedule associated with procedural modifications in NUREG-0578, this procedure will be revised by January 1, 1980.

-5 C. Pressurizer PORV Control ystem

1. Summary of Postulated Scenario Following a feedline rupture inside containment, between the steam generator nozzle and the containment penetration, there is a consequential failure of the pressurizer PORV control system due to the adverse environment. Failure of the system causes the PORV's to inadvertentlyopen. Thus, in addition to a feedline rupture, a breach of the reactor coolant system boundary has occurred in the pressurizer vaporspace.

2. Applicability of Postulated Scenario to San Onofre, Unit 1 The postulated break in the feedwater piping must occur between the steam generator nozzle and the containment penetration. The three feedwater lines at San Onofre Unit 1 are routed around the secondary shield to their respective steam generators and pass through the secondary shield immediately adjacent to the steam generator.

A break in any one of the feedlines will produce an adverse environment in containment that could possibly impact the pressurizer power operated relief valve (PORV) control system. The PORV control system consists of two control valves, CV545 and 546, their associated solenoid valves and the pressurizer pressure transmitters, PT430 and 431.

All of this equipment is located inside containment. CV545 and 546 are located inside the secondary shield at the top of the pres surizer at an elevation of 56 feet.

The solenoids for each valve are located at the valve. Pressure transmitters, PT430 and 431, are inside the pressurizer instrumentation cabinet which is located outside the secondary shield at an elevation of 13 feet.

Control valves CV545 and 546 are BS&B 70-18-9 DRTX valves. These valves have no environmental qualification documentation. However, this same BS&B valve was addressed in the San Onofre Unit 1 Environ mental Qualification Program (Amendments 30, 37 and 47 to the FSAR) in connection with CV 202, 203 and 204, the letdown isolation valves.

Subsequent to a LOCA or MSLB, the valves are required to close isolating the letdown line and to maintain their structural integrity throughout the course of the accident. The Environmental Qualification Program indicated that valves CV 202, 203 and 204 would be expected to retain their structural integrity for up to one year, subsequent to the postulated LOCA conditions. It was also indicated that failure of the solenoid valve, that is, loss of power or air, would not affect the valves closed position. Since the pressurizer PORVs, CV545 and 546, are also required to remain closed, the same conclusions can be made concerning the operability in the post-accident environment, namely, that they will remain in a closed position.

9

-6 The pressurizer pressure transmitters, PT-430 and 431, provide the input signals to the automatic control of the power operated relief valves. CV 546 will open when a pressure of 2190 psig is sensed by the transmitters. CV 545's opening depends on the amount of pressure deviation, the rate at which pressure is changing and the period of time the deviation has existed.

The transmitters are Foxboro El-GM's.

The qualification of these units was reported in our.letter to the NRC dated February 13, 1979 in response to the staff's request on the Systematic Evaluation Program topic on environmental qualification.

That submittal indicated the transmitters were qualified, per Foxboro's Test Reports No.'s T3-1013 and T3-1013 (Supplementary), to conditions that exceeded the postulated LOCA and MSLB conditions at San Onofre Unit 1.

In the event a feedline break occurs inside containment between the steam generator nozzle and the penetration, the same action as that described in Section A above will be taken to bring the plant to a safe shutdown. Based on the previous Environmental Qualification Program work discussed above, it is concluded that the pressurizer PORV's will remain in the closed position after being subjected to the adverse environment resulting from the break, and therefore will not impact the capability to bring the plant to a safe shutdown condition.

D. Rod Control System

1. Summary of Postulated Scenario An intermediate steamline rupture occurs inside containment between the steam generator nozzle and containment penetration at 70 to 100 percent power.

Under normal conditions, a reactor trip on overpower delta-T function would occur.

However, the Nuclear Instrumentation System (NIS)'is impacted by the adverse environment of the steamline rupture.

This results in a consequential failure in the rod control system causing the rods to begin stepping out prior to a reactor trip.

The minimum DNBR falls below 1.30 prior to a reactor trip on overpower delta-T function.

2. Applicability of Postulated Scenario San Onofre, Unit 1 At San Onofre Unit 1, the design of the Rod Control System differs from that in the postulated scenario. The NIS inputs into the speed compen sation unit only. The NIS does not have an input into the control rod withdrawal system.

Failure of the NIS at San Onofre Unit 1 would not cause the rods to withdraw. Therefore, this postulated scenario does not apply to San Onofre Unit