ML14227A109

Bryron, Units 1 & 2 - Imposition of Facility-Specific Baskfit Compliance with Licensing Basis Plant Design Requirements

ML14227A109
Person / Time
Site:	Byron, Braidwood
Issue date:	07/09/2014
From:	Christopher Jackson NRC/NRR/DSS/SRXB
To:	Kokajko L Division of Policy and Rulemaking
S. Miranda, NRR/SRXB, 301-415-2303
References
TAC MF3206
Download: ML14227A109 (24)

Text

July 9, 2014 MEMORANDUM TO: Lawrence E. Kokajko, Director Division of Policy and Rulemaking Office of Nuclear Reactor Regulation FROM: Christopher P. Jackson, Chief /RA/ Samuel Miranda for Reactor Systems Branch Division of Safety Systems Office of Nuclear Reactor Regulation

SUBJECT:

BRAIDWOOD STATION, UNITS 1 and 2, and BYRON STATION, UNITS 1 and 2 - IMPOSITION OF FACILITY-SPECIFIC BACKFIT RE: COMPLIANCE WITH LICENSING BASIS PLANT DESIGN REQUIREMENTS (TAC NO. MF3206)

The Reactor Systems Branch (SRXB) in cooperation with the Plant Licensing III-2 and Planning &

Analysis Branch (LPL III-2) has determined that it is necessary to impose a facility-specific backfit on the Braidwood Station, Units 1 and 2 (Braidwood), and on the Byron Station, Units 1 and 2 (Byron), to ensure compliance with existing written licensee commitments, in accordance with Title 10, Part 50.109, Backfitting, of the Code of Federal Regulations (10 CFR 50.109). The backfit is imposed to ensure compliance with the following written licensee commitments [1]:

(1) Condition II events (i.e., anticipated operational occurrences) shall be accommodated with, at most, a shutdown of the reactor with the plant capable of returning to operation after corrective action.

(2) By itself, a Condition II incident cannot generate a more serious incident of the Condition III or IV type (i.e., accidents) without other incidents occurring independently.

(3) A Condition III incident shall not, by itself, generate a Condition IV fault, or result in a consequential loss of function of the reactor coolant system or reactor containment barriers.

The NRC staff has considered the content of Byron and Braidwoods plant licensing basis documents, and concluded that the existing design does not comply with the plants written license commitments regarding the possibility that certain events that are postulated in the context of the Byron and Braidwood plant designs could develop into more serious events. Since the staff's conclusion differs from a previously applied staff position, the staff has decided that it is necessary to implement the requirements of Title 10, Part 50.109, Backfitting, of the Code of Federal Regulations (10 CFR 50.109).

The enclosed backfit evaluation is being provided in accordance with NRR Office Instruction LIC-202 Rev. 2, Procedures for Managing Plant-Specific Backfits and 50.54(f) Information Requests. It provides the basis and rationale for the SRXB staffs decision to impose this backfit.

CONTACT: Samuel Miranda, NRR/DSS/SRXB 301-415-2303

July 9, 2014 MEMORANDUM TO: Lawrence E. Kokajko, Director Division of Policy and Rulemaking Office of Nuclear Reactor Regulation FROM: Christopher P. Jackson, Chief //RA/ Samuel Miranda for Reactor Systems Branch Division of Safety Systems Office of Nuclear Reactor Regulation

SUBJECT:

BRAIDWOOD STATION, UNITS 1 and 2, and BYRON STATION, UNITS 1 and 2 - IMPOSITION OF FACILITY-SPECIFIC BACKFIT RE: COMPLIANCE WITH LICENSING BASIS PLANT DESIGN REQUIREMENTS (TAC NO. MF3206)

The Reactor Systems Branch (SRXB) in cooperation with the Plant Licensing III-2 and Planning &

Analysis Branch (LPL III-2) has determined that it is necessary to impose a facility-specific backfit on the Braidwood Station, Units 1 and 2 (Braidwood), and on the Byron Station, Units 1 and 2 (Byron), to ensure compliance with existing written licensee commitments, in accordance with Title 10, Part 50.109, Backfitting, of the Code of Federal Regulations (10 CFR 50.109). The backfit is imposed to ensure compliance with the following written licensee commitments [1]:

(4) Condition II events (i.e., anticipated operational occurrences) shall be accommodated with, at most, a shutdown of the reactor with the plant capable of returning to operation after corrective action.

(5) By itself, a Condition II incident cannot generate a more serious incident of the Condition III or IV type (i.e., accidents) without other incidents occurring independently.

(6) A Condition III incident shall not, by itself, generate a Condition IV fault, or result in a consequential loss of function of the reactor coolant system or reactor containment barriers.

The NRC staff has considered the content of Byron and Braidwoods plant licensing basis documents, and concluded that the existing design does not comply with the plants written license commitments regarding the possibility that certain events that are postulated in the context of the Byron and Braidwood plant designs could develop into more serious events. Since the staff's conclusion differs from a previously applied staff position, the staff has decided that it is necessary to implement the requirements of Title 10, Part 50.109, Backfitting, of the Code of Federal Regulations (10 CFR 50.109).

The enclosed backfit evaluation is being provided in accordance with NRR Office Instruction LIC-202 Rev. 2, Procedures for Managing Plant-Specific Backfits and 50.54(f) Information Requests. It provides the basis and rationale for the SRXB staffs decision to impose this backfit.

CONTACT: Samuel Miranda, NRR/DSS/SRXB 301-415-2303 DISTRIBUTION:

SRXB R/F SMiranda CJackson JBillerbeck TLupold RTaylor JWiebe ADAMS Accession Number: ML14227A109 *via Memo OFFICE NRR/DSS/SRXB NRR/DSS/SRXB NRR/DSS/SRXB

• NRR/DORL/LPL III-2 NRR/DSS NAME JGall SMiranda CJackson JWiebe TMcGinty DATE 07/3/2014 07/3/2014 06/12/2014 07/ 9 /2014 07/ 8 /2014 OFFICIAL RECORD COPY

BACKFIT EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO COMPLIANCE WITH LICENSING BASIS PLANT DESIGN REQUIREMENTS BYRON STATION, UNITS 1 and 2, BRAIDWOOD STATION, UNITS 1 and 2 DOCKET Nos. 50-454 through 50-457 1.0 EXECUTIVE

SUMMARY

The Reactor Systems Branch (SRXB) staff has reviewed the licensing basis documents submitted by Exelon (the licensee) for its Byron and Braidwood units, particularly the Updated Final Safety Analysis Report (UFSAR) for Byron, and for Braidwood Station, Units 1 and 2 (Braidwood), and has concluded that the designs of these units do not comply with certain of Exelons written license commitments. Accordingly, the staff finds that the licensee should take steps to fulfill its written license commitments, and thereby provide adequate protection of public health and safety.

Since the staff's conclusions differ from certain previously applied staff positions regarding the licensees plant designs, the staff has decided, in this case, to apply the requirements of Title 10, Part 50.109, Backfitting, of the Code of Federal Regulations (10 CFR 50.109).

The SRXB staff and the Plant Licensing III-2 and Planning & Analysis Branch (LPL III-2) staff documented that plant specific actions may be necessary to address this issue in a letter to the licensee issuing amendments regarding the measurement uncertainty recapture power uprates at Byron and Braidwood [24].

2.0 EVALUATION 2.1 Background Operating licenses were issued for Braidwood Station, Units 1 and 2 on July 2, 1987, and May 20, 1988, respectively, and for Byron Station, Units 1 and 2 on February 14, 1985, and January 30, 1987, respectively.

The operating licenses were issued after the staff reviewed and accepted the plants licensing basis documents that included, among other things, a UFSAR, in which the licensee claimed that all applicable design requirements had been met.

Results of the plants accident analyses are presented in Chapter 15 of the UFSAR. The accident analyses are organized according to the four categories described in UFSAR Chapter 15.0.1, Classification of Plant Conditions, which states:

Since 1970, the American Nuclear Society (ANS) classification of plant conditions has been used which divides plant conditions into four categories in accordance with anticipated frequency of occurrence and potential radiological consequences to the public. The four categories are as follows:

ENCLOSURE

Condition I: Normal Operation and Operational Transients.

Condition II: Faults of Moderate Frequency.

Condition III: Infrequent Faults.

Condition IV: Limiting Faults.

These plant conditions are defined in ANS-N18.2-1973 [1], which is cited in the Byron and Braidwood UFSAR (i.e., in Chapter 15.0.8, Plant Systems and Components Available for Mitigation of Accident Effects, and in Chapter 15.5.1, Inadvertent Operation of Emergency Core Cooling System during Power Operation).

2.2 Regulatory Basis According to the UFSAR, the taxonomy of events is based upon the expected frequencies of event occurrences and resulting consequences. The UFSAR states:

The basic principle applied in relating design requirements to each of the conditions is that the most probable occurrences should yield the least radiological risk to the public and those extreme situations having the potential for the greatest risk to the public shall be those least likely to occur.

The relevant design requirement is stated in UFSAR Chapter 15.5.1:

An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

This design requirement specifies that the plant design must not allow a condition of moderate frequency (i.e., a Condition II incident) to become a more serious and less frequent Condition III or Condition IV accident, without the occurrence of another, independent fault.

The licensing bases of the Byron and Braidwood units do not adequately demonstrate that their plant designs are in compliance with this design requirement. This is evident, for example, in UFSAR Chapter 15.5.1, Inadvertent Operation of Emergency Core Cooling System during Power Operation.

The backfit evaluation that follows will focus upon this event, and also upon other events that could develop into more serious events.

The regulatory basis lies in the licensees commitment to comply with:

The design requirements of ANS-N18.2-1973 [1], specifically:

1. Condition II events (i.e., anticipated operational occurrences) shall be accommodated with, at most, a shutdown of the reactor with the plant capable of returning to operation after corrective action.

2. By itself, a Condition II incident cannot generate a more serious incident of the Condition III or IV type (i.e., accidents) without other incidents occurring independently.

3. A Condition III incident shall not, by itself, generate a Condition IV fault, or result in a consequential loss of function of the reactor coolant system or reactor containment barriers.

Water relief through valves that are designed for steam relief [2] could cause valve damage, and a spill of borated water into containment that could impede or delay the plant from returning to operation after corrective action. Any Condition II event that results in water relief from the pressurizer, especially for a prolonged period, should be evaluated in terms of compliance with the first ANS design requirement (1).

Compliance with the second ANS design requirement can be demonstrated with accident analysis results that predict the pressurizer would not become water-solid. Since only steam is relieved from the pressurizer, no consequential valve damage is expected. However, for the Byron and Braidwood plants, certain UFSAR analyses predict that the pressurizer would fill and cause water relief to occur.

When the pressurizer is predicted to fill, compliance with the second ANS design requirement can be shown by other means. The staff is asking the licensee, via this backfit, to provide the required demonstration of compliance.

Compliance with the third ANS design requirement is also necessary, as applicable. So far, the staff has not identified any events or scenarios in which the third ANS design requirement is applicable.

The licensee is also committed to comply with the General Design Criteria (GDCs) [3]. Three GDCs, in particular, pertain to the relief of water through the pressurizer power-operated relief valves (PORVs) and safety valves (PSVs).

GDC 15Reactor coolant system design [3]

The reactor coolant system and associated auxiliary, control, and protection systems shall be designed with sufficient margin to assure that the design conditions of the reactor coolant pressure boundary are not exceeded during any condition of normal operation, including anticipated operational occurrences.

GDC 15 is generally interpreted to mean that the integrity of the RCS pressure boundary is not jeopardized by overpressurization. Sufficient margin is provided by means of valve relief capacity, opening set pressures, and other protection system features. If pressure boundary valves are expected to open and relieve water, then sufficient margin can also be interpreted to mean that these valves shall be designed for water relief (i.e., not fail open if water is relieved), if water relief is an intended mode of operation. It can be inferred that GDC 15 is not satisfied (i.e., the RCS pressure boundary is jeopardized) if any pressure boundary valves fail to reseat after having relieved water.

The staff also notes that steam relief is more effective in controlling pressurization than water relief. If water relief is an intended mode of operation, then compliance with GDC 15 must be demonstrated with water relief.

GDC 21Protection system reliability and testability [3]

The protection system shall be designed for high functional reliability and inservice testability commensurate with the safety functions to be performed.

Redundancy and independence designed into the protection system shall be sufficient to assure that (1) no single failure results in loss of the protection function and (2) removal from service of any component or channel does not result in loss of the required minimum redundancy unless the acceptable reliability of operation of the protection system can be otherwise demonstrated

GDC 21 pertains to the design of protection systems that are needed to comply with the ANS design requirements (e.g., water-qualified relief systems or modified ECCS actuation logic).

GDC 29Protection against anticipated operational occurrences [3]

The protection and reactivity control systems shall be designed to assure an extremely high probability of accomplishing their safety functions in the event of anticipated operational occurrences.

Pressure boundary valves must close, as well as open. Pressure boundary valves that do not close, when required, are not reliably accomplishing all their safety functions.

2.3 Technical Evaluation The staffs evaluation focuses upon several Condition II events that could develop into Condition III events without the occurrence of any independent equipment failures or operator errors.

There are some events that could cause the pressurizer to fill, by adding water to the reactor coolant system (RCS) inventory. Events of this type are classified as mass addition events. The pressurizer pressure could rise during mass addition events, and reach the opening setpoints of the PORVs or PSVs. If the pressurizer is in a water-solid condition, then the opened PORVs or PSVs will relieve water. In accident analyses, it is assumed that water relief through a valve that is not qualified for water relief will cause that valve to stick in its fully open position. This, in effect, would produce a Condition III small-break loss of coolant accident (SBLOCA) that originates as a Condition II event, and thereby violates the second ANS design requirement.

Chapter 15.5 of the Byron and Braidwood UFSAR lists two Condition II events (or anticipated operational occurrences (AOOs)) that will cause an increase in RCS inventory (i.e., a mass addition):

15.5.1 Inadvertent Operation of Emergency Core Cooling System during Power Operation (IOECCS), and 15.5.2 Chemical and Volume Control System Malfunction that Increases Reactor Coolant Inventory (CVCS Malfunction)

There is a third AOO that, in its latter stage, should be evaluated as a mass addition event:

15.6.1 Inadvertent Opening of a Pressurizer Safety or Relief Valve (IOPORV)

The first two events, the IOECCS and the CVCS malfunction, are listed in Regulatory Guide 1.70 [4].

The third event is included herein as a mass addition event, since it becomes a mass addition event if timely operator action is not taken.

Mass addition events do not lead to fuel clad damage or overpressurization of the RCS Mass addition events do not lead to any fuel clad damage, since they do not produce conditions that tend to reduce core thermal margin. For example, a condition that would erode core thermal margin might be depressurization of the RCS while the reactor is at power.

Mass addition events do not overpressurize the RCS, since the maximum RCS pressure that can be achieved cannot exceed the shutoff head of the water source (i.e., the charging pumps). The shutoff

head of the centrifugal charging pumps is less than 110% of the RCS design pressure. Positive displacement charging pumps can produce higher RCS pressures; but these pumps have lower flow capacities, and this would afford the operator more time to shut off the charging flow before the pressurizer can become water-solid. See Section 2.3.1.8 for further information regarding RCS pressurization.

For these reasons, the staffs backfit evaluation does not pertain to fuel clad damage or RCS overpressurization. The staffs backfit evaluation focuses upon the possibility that mass addition events could become more serious events. A mass addition event that develops into a more serious event, without the occurrence of another, independent fault, indicates that the plant is not designed in accordance with the second or third ANS design requirement in Section 2.2.

1. IOECCS The IOECCS event must be evaluated for plants that employ charging pumps in their ECCS designs (e.g., the Braidwood and Byron Stations). Charging pumps, by design, are capable of pumping water into the RCS during normal plant operating conditions. The shutoff head of the charging pumps (typically about 2,600 psia) could cause the pressurizer PORVs and PSVs to open. If either the PORVs or the PSVs open, and relieve water, then they could fail to reseat, and thereby create an SBLOCA at the top of the pressurizer.

The IOECCS automatically trips the reactor, as part of the ECCS actuation sequence.

2. CVCS Malfunction The CVCS malfunction event also causes the charging pumps to add water to the RCS; but at a lower rate, since theyre not operated in the safety injection mode, and theyre not necessarily operated at maximum flow capacity. In this event, the reactor is not immediately tripped. Power generation will continue until a reactor trip signal is produced by the automatic reactor protection system (e.g., a high pressurizer water level trip signal). RCS pressure is not decreased, and core power is not increased.

Therefore, core thermal margin is not eroded. The possibility of DNB is ended when the reactor is tripped.

3. Inadvertent opening of a pressurizer power-operated relief valve (IOPORV)

The IOPORV is evaluated in the UFSAR as an AOO that causes a decrease in reactor coolant inventory. It is evaluated, in the UFSAR, to show that the resulting RCS depressurization, while the reactor is at power, would not lead to fuel clad damage (i.e., the minimum DNBR will not fall below its safety limit value). The analysis of this event is ended shortly after the automatic reactor trip. The evaluation is most conclusive when it predicts that the automatic reactor trip will be demanded by the portion of the reactor protection system that is triggered by a reduction in thermal margin (e.g., the overtemperature T trip).

Although the reactor trip prevents fuel clad damage, it does not end the RCS depressurization.

Manual action must be taken to close the inadvertently opened PORV, or else close its block valve. If the PORV is not closed or isolated, then the continuing depressurization will lead to an actuation of the ECCS on low-low pressurizer pressure. If this occurs, then the resulting ECCS flow rate will be relatively higher than the ECCS flow of an IOECCS, since the RCS backpressure will be lower, possibly low enough to allow some additional flow from the high head safety injection pumps to enter the RCS. This will soon lead to a water-solid pressurizer, and relief of water through the inadvertently-opened PORV. If the PORV, or its block valve, is not closed before the ECCS actuation signal is

generated, and ECCS flow begins, then the operator will have to end the ECCS flow before isolating the PORVs. If the PORVs are isolated before the ECCS flow is terminated, then the PSVs could open, relieve water, stick open, and produce the equivalent of a hot leg SBLOCA.

In each of these three mass addition events, there is the possibility that the PORVs or the PSVs could open and relieve water. If the PORVs or PSVs are not qualified to relieve water, then they could stick in the wide open position, and thereby create an SBLOCA. Then the mass addition event, a Condition II event, would become a Condition III event (an SBLOCA) due to the consequential failure of a PORV or PSV, a violation of the ANS design requirements [1]. In effect, the result will be a Condition III event that has the frequency of occurrence of a Condition II event (e.g., an IOECCS).

2.3.1 Licensing basis analyses of mass addition events In 1993, Westinghouse Electric Corporation published a Nuclear Safety Advisory Letter (NSAL) [5],

addressed to its customers who operate plants with ECCS designs that employ charging pumps to perform a safety injection function. Unlike the safety injection pumps, the charging pumps are capable of pressurizing the RCS to levels that can exceed the opening setpressures of the PORVs and PSVs.

(The Byron and Braidwood units are equipped with this type of ECCS.) The staff notes that the licensee has adopted several of the recommendations that Westinghouse described its NSAL.

The staffs positions regarding several points of this NSAL are discussed below:

2.3.1.1 LOCA is redefined In NSAL 93-013 [4], Inadvertent ECCS Actuation at Power, Westinghouse states:

ANS 51.1/N18.2-1973, lists Example (15) of a Condition II event as a minor reactor coolant system leak which would not prevent orderly reactor shutdown and cooldown assuming makeup is provided by normal makeup systems only. Here, normal makeup systems is defined as those systems normally used to maintain reactor coolant inventory under respective conditions of startup, hot standby, power operation, or cooldown; using on-site power. Since the cause of the water relief is the ECCS flow, the magnitude of the leak will be less than or equivalent to that of the ECCS (i.e.,

operation of the ECCS maintains RCS inventory during the postulated event and establishes the magnitude of the subject leak).

In UFSAR Chapter 15.5.1.2, Analysis of Effects and Consequences, the licensee states:

American Nuclear Society standard 51.1/N18.2-1973 (Reference 2) describes example 15 of a Condition II event as a minor reactor coolant system leak which would not prevent orderly reactor shutdown and cooldown assuming makeup is provided by normal makeup systems only. In Reference 2, normal makeup systems are defined as those systems normally used to maintain reactor coolant inventory under respective conditions of startup, hot standby, power operation, or cooldown, using onsite power. Since the cause of the water relief is the ECCS flow, the magnitude of the leak will be less than or equivalent to that of the ECCS (i.e.,

operation of the ECCS maintains RCS inventory during the postulated event and establishes the magnitude of the subject leak).

In effect, the NSAL redefines the SBLOCA as a leak that can be remedied by using normal makeup systems. The ECCS is not a normal makeup system. It is an emergency system. The charging

pumps, when started by a safety injection signal, operate at maximum capacity to cool the core, not at a flow rate that is controlled to maintain a programmed pressurizer level.

In the short term, the water flowing out of the RCS, through the failed PORV(s) or PSV(s), far exceeds the rate of water flowing into the RCS from the ECCS. The water relief rate is determined by the critical flow of saturated water, through the stuck-open valves, due to the pressure difference between the RCS and the pressurizer relief tank or the containment. Each of the Byron and Braidwood units is equipped with three Crosby PSVs, with orifice areas of 3.64 sq in. These PSVs, if stuck in the wide-open position, would have a combined flow area of 10.93 sq in. The resulting SBLOCA could be equivalent to a 3.73 inch hot leg break (i.e., located near the top of the pressurizer).

In the long term, as RCS pressure falls, and the ECCS flow rate increases, the relief flow could eventually be offset by the ECCS flow. This long term flow equilibration is typically seen in the end stage of an SBLOCA, a Condition III event.

2.3.1.2 Water relief through the PORVs is permissible In NSAL 93-013, Inadvertent ECCS Actuation at Power, Westinghouse states:

Water relief through the PORVs is not a concern because the PORV block valves would be available to isolate the PORVs should they fail to close.

In UFSAR Chapter 15.5.1.2, Analysis of Effects and Consequences, the licensee states:

The SI flow refills the pressurizer until the pressurizer is water solid, and the SI flow results in liquid discharge through the pressurizer safety relief valves.

The UFSAR does not mention the fact that, since the opening setpressure for the PORVs is lower than the PSV opening setpressure; the PORVs will open and relieve water before the PSVs open.

During a mass addition event, the opening of one PORV would limit the pressurizer pressure to pressure levels that are below the opening pressure setpoint of the PSVs.

The licensees analysis of the IOECCS is based solely upon operation of the PSVs for relief. The staff construes the licensees reliance upon the use of PSVs, and not PORVs, as an application of Westinghouses NSAL rationale. That is, the opening and failure of the PORVs is not a concern, since the PORV block valves can be closed to isolate the PORVs should they fail to close. The staff does not agree with this reasoning [6], since isolation of a stuck-open PORVs is an operation that is undertaken to mitigate a Condition III SBLOCA, not a Condition II IOECCS. This is, in effect, an admission that the plant is not designed in compliance with the aforementioned ANS design requirements.

2.3.1.3 Post-accident return to operation is not addressed

NSAL 93-013, Inadvertent ECCS Actuation at Power, states:

Two additional concerns must also be addressed in conjunction with potential water relief through either the PORVs or PSRVs (if qualified for such). The definition of a Condition ll incident states that the event at worst should result in a reactor shutdown with the plant being capable of returning to operation. In order to meet this condition, the piping downstream of the PSRVs and/or PORVs must be qualified for water relief.

Secondly, water relief may result in overpressurizing the Pressurizer Relief Tank (PRT), breaking the rupture disk, and spilling contaminated fluid into containment.

Therefore, the radiological consequences of this occurrence must also be evaluated.

UFSAR Chapter 15.5.1.2, Analysis of Effects and Consequences, states:

Water relief from the pressurizer PORVs and safeties may result in overpressurization of the pressurizer relief tank (PRT), breaching the rupture disk and spilling contaminated fluid into containment. The radiological releases (offsite doses) resulting from breaking the PRT rupture disk are limited by isolation of the containment.

ANS-N18.2-1973 [1] requires that, Condition II events (i.e., anticipated operational occurrences) shall be accommodated with, at most, a shutdown of the reactor with the plant capable of returning to operation after corrective action.

The licensee has not addressed the questions of how long it would take to clean up a contaminated containment, and whether the time required completing the cleanup effort and repairing or replacing any damaged PSVs could be long enough to delay the plants return to operation beyond the short period that is implied in the ANS design requirement.

The staff also disagrees with the concept of disregarding operation of the PORVs, in the licensing basis analyses, and relying solely upon PSVs to deal with Condition II events. The PORVs are designed to give the plant the capability to tolerate RCS pressure increases caused by most Condition II events (e.g., load rejections), and possibly to stay online during some Condition II events. The PSVs provide protection against overpressurization during Condition III and IV events (e.g., feedline break);

since the plant will have already tripped by the time they open. The staff views the Byron and Braidwood plants reliance upon the PSVs for mitigation of Condition II events as a departure from the design (or functional) objectives of the PSVs [2].

2.3.1.4 Water relief through the PSVs is permissible In NSAL 93-013 [5], Inadvertent ECCS Actuation at Power, Westinghouse states:

Licensees should determine if their Pressurizer Safety Relief Valves are capable of closing following discharge of subcooled water. If the PSRVs were designed or qualified to relieve subcooled water, the inadvertent ECCS Actuation at Power accident will not degrade into a more serious Condition lII event, since these valves will close once ECCS flow has been terminated. It should be noted that the licensees may have qualified these valves in compliance to NUREG-0737, Item H.D.1 [18].

Exelon addressed the qualification of the PSV for water relief [7] when it responded to a question from the staff regarding its Stretch Power Uprating (SPU) application of 2000. The staff asked:

Regarding the Spurious Safety Injection event, what will be the temperature of the water being passed by the pressurizer safeties and what is the length of time the

safeties are expected to pass water. Also discuss what Electric Power Research Institute (EPRI) tests are applicable to the Byron and Braidwood Stations condition.

(Question G.9)

Exelon responded:

Results of testing by the Electric Power Research Institute (EPRI) support the conclusion that the spurious Sl event would not transition into a higher Condition event. Although they may not be leaktight, the Pressurizer Safety Valves (PSVs) would close after passing water, and the leakage from up to three leaking PSVs is bounded by one fully open PSV.

The Licensee has not provided information to show that leaking PSVs can be repaired or replaced in time to meet the ANS design requirement regarding the plants return to operation after a Condition II event.

The comparison of flow from three leaking PSVs to the flow from one fully open PSV seems to be based upon the licensees claim that the existing analysis of an inadvertently opened PORV or PSV adequately addresses leaking PSVs (see below).

Exelons response continued:

The Inadvertent Opening of a Pressurizer Safety or Relief Valve is analyzed as a Condition II event in the Byron Station and Braidwood Station UFSAR, section 15.6.1.

The staff does not agree that the IOECCS is comparable to the IOPORV.

Exelons response cited an EPRI report [23], and continued:

Relief of subcooled water was part of the EPRI testing of the Crosby safety valves (Reference EPRI Report #NP-2770-LD Volume 1 and 6). Two water relief tests were performed at a water temperature as low as 635°F (i.e., Test #926 with lowest temperature between 635°F and 640°F, and Test #931 with lowest temperatures near 640°F) and another performed at a water temperature of approximately 530°F (i.e., Test #932). The results of the tests at 635°F - 640°F show stable valve operation. Valve chatter was experienced during the testing at 530 °F, resulting in damage to the valve internals. However, as indicated in EPRI Report #NP-2770-LD Volume 1, page S-6, in all cases, the safety valve closed in response to system depressurization.

The lowest water temperature predicted for the expected duration (i.e., 20 minutes) of the Spurious SI transient at Byron Station and Braidwood Station is significantly higher (i.e., 590°F) than the lowest temperature (i.e., 530°F) for the EPRI tests.

Consequently, although stable valve operation cannot be assured, any valve damage would be expected to be less than the damage experienced during the EPRI testing.

In any case, the safety valve will close upon system depressurization.

More importantly, it can be concluded that the Spurious SI event does not progress into a higher Condition transient (i.e., LOCA, Condition IIl). All three PSVs may lift in response to the event, but they will close and the resulting leakage from up to three PSVs is bounded by flow through one fully open PSV.

The staff cannot conclude, from the reported EPRI test results that the IOECCS event will not lead to a Condition III LOCA. Even if all the PSVs were to reseat, they could be damaged and leaking. The licensee has not shown that returning to operation, in accordance with the requirements of the first ANS design requirement, could be accomplished.

Exelons response continued:

The assumed duration of the event is 20 minutes from initial SI signal to the time when system pressure is restored to below the PSV lift setpoint. Normally, the PORVs will automatically open by means of the control system grade actuation circuit, preventing the RCS pressure from ever reaching the PSV lift setpoint. The inadvertent SI event is terminated by operator action. Analyses show that during this 20 minute time frame, a PSV will cycle a number of times (i.e., approximately 20) with a duration of 5-8 seconds per cycle. Only one PSV is required to mitigate the pressure transient. Even though the three PSVs are set to lift at the same pressure, from a statistical standpoint, one valve would lift earlier than the other two. This would ensure that no more than one valve is challenged at a time. For the power uprate, the minimum expected discharge water temperature is 590°F (at t = 20 minutes).

The staff agrees that the opening of a single PORV or PSV would provide adequate pressure relief capacity for the IOECCS event. However, the prospect of 20 opening and closing cycles per valve raises the concern that failure to close, in just one cycle, could create a Condition III LOCA.

Exelons application for a Measurement Uncertainty Recapture (MUR) uprating [8] states:

Pressurizer Overfill The Inadvertent ECCS event results in an increase in the RCS inventory that leads to a water solid pressurizer. This event has been evaluated to assess its potential to progress into a SBLOCA event via a Pressurizer Safety Valve (PSV). The PSVs were qualified for water relief though EPRI testing performed in Reference III.11-3, which showed they would reclose following water relief.

The most limiting cases occur with the reactor at full power operation prior to the event. As the current evaluation is based on an NSSS power level of 3672.6 MWt, this evaluation remains bounding for the MUR power uprate, and the conclusions presented in the UFSAR remain valid.

The quoted reference (Reference III.11-3) is EPRI Document NP-2770-LD, EPRI/C-E PWR Safety Valve Test Report, which was issued in January, 1983. EPRI issued a more recent report [9], for the Byron and Braidwood units, which did not address the conditions of an IOECCS (i.e., an Extended High Pressure Injection Event). This report stated:

4.2.3 Extended High Pressure Injection Event The limiting extended high pressure injection event is the spurious actuation of the safety injection system at power (Reference 7). For a four-loop plant, both the safety valves and PORVs will be challenged. Both steam and water discharges are expected. In this event, however, the safety valves or PORVs open on steam and liquid discharge would not be observed until the pressurizer becomes water solid.

According to Reference 7, this would not occur until at least 20 minutes into the event which allows ample time for operator action. Thus the potential for liquid discharge in extended HPI events can be disregarded.

The quoted reference (Reference 7) is EPRI NP-2296, Valve Inlet Fluid Conditions for Pressurizer Safety and Relief Valves in Westinghouse-Designed Plants, issued in January 1983. EPRI states that their decision to disregard the IOECCS conditions is based upon the licensees assertion that the pressurizer will not fill before 20 minutes. However, the UFSAR (Chapter 15.5.1.2) states that, The SI flow refills the pressurizer until the pressurizer is water solid, and the SI flow results in liquid discharge through the pressurizer safety relief valves.

There seems to be some confusion regarding the 20 minute time period. The Licensee referred to EPRI valve test results [7], conducted in 1983, to show that the subcooled water conditions, measured in the tests, would be applicable to the water temperatures that would be present in the Byron and Braidwood plants during an IOECCS that would have an expected duration of 20 minutes. By 1988, EPRI had not conducted any valve tests that could be relevant to IOECCS events, since the licensee had claimed that there would be no water relief for at least 20 minutes. The UFSAR contradicts that claim.

The 1988 EPRI report [9] states:

The generic test results and piping analyses showed that the valves tested functioned correctly and safely for all relevant steam discharge events specified in the test program and that the pressure boundary component design criteria were not exceeded. Analysis and review of the test results and the Licensees justifications indicated direct applicability of the prototypical valve and valve performances to the in-plant valves and systems intended to be covered by the generic test program. The Licensee must document a formal procedure to inspect the safety valves each time they discharge the loop seal or water.

The staff notes that (1) EPRIs conclusions were limited to steam discharge events, and (2) that EPRI recommended that PSVs be inspected following discharges of loop seals or water. In 1988, the staff asked Commonwealth Edison (the licensee for Byron and Braidwood at that time) to develop and adopt plant procedures to inspect the PORVs and PSVs after each lift involving loop seal or water discharge [10]. Byron and Braidwood have such procedures in place [11].

In 2000, ComEd (Exelons predecessor as the licensee and operator of Byron and Braidwood units) responded to the staffs questions regarding ComEds application for an SPU [11]:

ComEd has compared the temperatures from the EPRI subcooled water relief testing against the lowest temperature expected during a spurious SI event at Byron and Braidwood Stations, and has concluded that some valve chatter may occur; however, the resultant valve degradation will be less than the damage seen in the EPRI test.

Since the EPRI tested valves were capable of closing in response to system depressurization, we have concluded that Byron and Braidwood Station valves would also be capable of closing in response to system depressurization. After use to relieve subcooled water, the safety valves may have some seat leakage through the closed valves due to the valve degradation; however, the leakage from three PSRVs would be less than the flow through one fully open PSRV. Thus, the spurious SI transient may result in a limited version of an inadvertent opening of a pressurizer safety or relief valve transient, which is also a Condition II event.

The staff does not agree with ComEds (and now Exelons) conclusion, that the EPRI valve test results show that the PSVs will be capable of closing after having relieved water.

The staff does not regard the first ANS Design Requirement as having been satisfied if a Condition II event results in damaging the PSVs.

The licensee has invoked the PSVs as a mitigation system, relieving water, for the mass addition events; but has not applied the single failure assumption (required in accident analyses to show compliance with GDC 21) to that system (i.e., failure of a PSV to close). The failure of a PSV to close does not transform a mass addition Condition II event into an inadvertent opening of a pressurizer safety or relief valve transient (another Condition II event). The failure of a PSV to close, which relieves water, is a small break LOCA, not an inadvertently opened PSV, which relieves steam.

Similarly, the staff does not agree that leakage from three PSVs can be considered as a limited version of an inadvertent opening of a pressurizer safety or relief valve transient.

In summary, the staff regards the EPRI valve tests results as inconclusive with respect to the operability of the PSVs when relieving water during IOECCS events. More information would be necessary to qualify the PSVs for water relief:

(1) Pursuant to ASME Code requirements [19], it is necessary to provide the original Overpressure Protection Report showing the IOECCS event as a Condition II event and defining the operating conditions and required relief capacities associated with it. It is also necessary to provide the manufacturers certification of the valves relief capacity, under pressurized water conditions, and including test results.

(2) According to the ASME OM Code [20], it is necessary to provide the inservice test history (procedure and results) for the pressurizer PSVs, including both water and steam tests, or alternatively provide a certified correlation test procedure and justification for use of an alternative test fluid.

2.3.1.5 The IOECCS will proceed as an IOPORV UFSAR Chapter 15.5.1.2 states:

If the pressurizer safety relief valves do not reseat, then the transient will proceed and terminate as described in Section 15.6.1, Inadvertent opening of Pressurizer Safety or Relief Valve. This event is also classified as an event of moderate frequency.

The Inadvertent opening of Pressurizer Safety or Relief Valve, as reported in Section 15.6.1, is a Condition II event that is analyzed to demonstrate that no fuel clad damage will occur. This event, also known as the RCS Depressurization, will cause a reduction in thermal margin (i.e., DNB ratio),

since the RCS depressurization will occur while the plant is operating at full power. The analysis is performed to show that the Overtemperature T reactor trip protection logic will trip the reactor before DNB can occur. In fact, the MUR application [8] states: The criterion of interest for the accidental depressurization of the RCS analysis, which conservatively models the inadvertent opening of a PSV, is that the DNB design basis is satisfied. The duration of the analysis extends to the time of reactor trip (< one minute), and little more. There is no safety injection and no water discharge through a PORV or PSV at any time during the reported analysis.

If the analysis of the Inadvertent opening of Pressurizer Safety or Relief Valve were to be extended past the time of reactor trip, without assuming operator action, then the RCS depressurization would

eventually reach the low-low pressurizer pressure SI actuation setpoint. This is a valid signal that would start the ECCS. The ECCS would deliver flow at a relatively higher rate, due to the reduced RCS pressure. Consequently, the pressurizer would fill very rapidly, and cause water to exit the RCS through the open PORV. The water discharge, if allowed to continue, would eventually cause the pressurizer relief tank (PRT) rupture disk to break open and allow RCS water to spill into the containment. Recovery will require cleanup of the containment and repair or replacement of one or more pressurizer PORVs or PSVs. Under these circumstances, it is reasonable to question whether the first ANS design requirement can be met. There is no evaluation of this scenario in the Byron and Braidwood licensing basis.

The staff does not agree that UFSAR Section 15.6.1, Inadvertent opening of Pressurizer Safety or Relief Valve is an adequate or even relevant evaluation of the latter stage of an IOECCS. The staff maintains that the IOECCS would proceed as an SBLOCA, as reported in UFSAR Section 15.6.5.2.2.

Specifically, the IOECCS would resemble a four inch diameter break in the hot leg, with full ECCS flow available. Although this would not be considered to be the limiting SBLOCA case, it would nevertheless be classified as a Condition III event. This Condition III event will have originated as a higher-frequency Condition II event, and this is the type of scenario that the second ANS design requirement aims to prevent. (Similarly, the third ANS design requirement addresses the possibility that a Condition III event could develop into a Condition IV event.)

2.3.1.6 CVCS malfunction is not evaluated In its MUR application [8] the Licensee states:

This event is bounded by the evaluation of the boron dilution event in Section II.2.8 and the analysis of the inadvertent ECCS operation at power event in Section III.11.

Therefore, the conclusions presented in the UFSAR remain valid.

The UFSAR (Chapter 15.5.2, Chemical and Volume Control System Malfunction that Increases Reactor Coolant Inventory) states:

An increase in reactor coolant inventory which results from the addition of cold, unborated water to the reactor coolant system is analyzed in Subsection 15.4.6, chemical and volume control system malfunction that results in a decrease in boron concentration in the reactor coolant. An increase in reactor coolant inventory which results from the injection of highly borated water into the reactor coolant system is analyzed in Subsection 15.5.1, inadvertent operation emergency core cooling system during power operation.

The Licensee claims that the conclusions presented in the UFSAR remain valid. A reading of the UFSAR (above) does not identify any conclusions. The UFSAR merely refers to Subsections 15.4.6 and 15.5.1, which discuss the boron dilution, and IOECCS events, respectively. By the time the MUR application [8] is submitted, the Licensee concludes that the CVCS malfunction that increases RCS inventory is bounded by the boron dilution, and IOECCS events. The staff disagrees.

RG 1.70 [4] specifies two CVCS malfunction events. One is to be evaluated, in the UFSAR, as a reactivity anomaly, and the other is to be evaluated as a mass addition event. The former event, the CVCS malfunction that results in a decrease in boron concentration in the reactor coolant is a Condition II event that is evaluated to show that it will not result in any fuel clad damage. The latter event, the CVCS malfunction that increases RCS inventory, is a Condition II event that is evaluated to show that it will not develop into a more serious event, and that it will not jeopardize the integrity of the

RCS. The Standard Review Plan contains guidance for the review of both CVCS malfunction events.

The licensee has not shown the staff how one CVCS malfunction event can bound (or even be compared to) the other.

If the CVCS malfunction that increases RCS inventory were to be compared to the IOECCS, then the results would be inconclusive. It is expected that the charging flow rate during a CVCS malfunction would not be as high as the charging flow rate during and IOECCS; but this would not be sufficient to conclude that the CVCS malfunction is bounded by the IOECCS. Unlike the IOECCS, there is no immediate reactor trip during a CVCS. The reactor trip, if it occurs, would occur sometime after the CVCS malfunction begins. There would be relatively less post-trip cooling to shrink the pressurizer water level during a CVCS malfunction. Therefore, it cannot be concluded that the IOECCS will always bound the CVCS malfunction. It is necessary to analyze or evaluate both the IOECCS and the CVCS malfunction events.

For the Byron and Braidwood units, the licensee has not shown that the CVCS malfunction that increases RCS inventory event is bounded by the IOECCS. Therefore, our analysis or evaluation of the CVCS malfunction that increases RCS inventory event would be necessary to draw a regulatory conclusion.

2.3.1.7 The transient is ended automatically In Section III.11 of the Licensees application for an MUR [8] it is claimed that the transient is eventually terminated by the reactor protection system low pressurizer pressure trip or by the manual trip. The staff disagrees. This transient, the IOECCS, begins with a reactor trip; and not terminated by a reactor trip. The ECCS flow continues until it is ended by the operator. The IOECCS, a mass addition event, is not remedied by inserting rods. Inserting rods only adds more negative reactivity to that which is already being added by the ECCS flow. For the IOECCS, protection is provided by (1) ending the ECCS flow, or by (2) removing the excess water from the RCS through water-qualified relief valves, or by (3) preventing the IOECCS from occurring (e.g., by use of a cold leg safety injection permissive).

2.3.1.8 Analyses are not conservative A UFSAR, Chapter 15 accident analysis is often reported in more than one version (or case),

depending upon the analysis objective. This is especially true of Condition II events, since each event must be shown to meet three criteria: (1) no fuel damage, (2) no overpressure of the RCS or main steam system, and (3) no progression into an event of a more serious category without the occurrence of another, independent fault. Thus, a Condition II event could require analysis of as many as three or more cases, each based upon assumptions and methods designed to demonstrate compliance with one of the three specific analysis criteria.

The Licensees MUR application [8] Section III.11 reports the results of an IOECCS analysis case that shows there would be no fuel clad damage during an IOECCS. The results indicate that the minimum DNB ratio would not drop below its initial value. This is because the spuriously-generated ECCS actuation signal also trips the reactor, as part of the ECCS actuation logic. This IOECCS analysis, which is designed to show that there would be no fuel damage, is superfluous.

The IOECCS event would also not approach the RCS or main steam system overpressure safety limits. Since the IOECCS adds mass, not heat to the RCS, the maximum RCS pressure could not be higher than the shutoff head of the pumps that are adding the mass (e.g., the charging pumps in the ECCS). The shutoff head of these pumps is more than 100 psi lower the safety limit (e.g., 110% of

the RCS design pressure). Any post-trip heat addition would be removed via steam dumping or relief through the main steam system. It is not necessary to analyze or evaluate an IOECCS to show that the RCS would not be overpressurized.

The IOECCS event is analyzed to demonstrate compliance with the ANS design requirement that prohibits an event from developing into a more serious event, i.e., that it would not develop into an event of a more serious category without the occurrence of another, independent fault. If a valve that is designed for steam relief relieves water and fails open, then the result would be a small break LOCA at the top of the pressurizer; and a violation of the second ANS design requirement. The ANS design requirement that prohibits an event from developing into a more serious event can be met when the mass addition is ended, by the operator, before the pressurizer can become water-solid. If there is not enough time for such operator action, then it is necessary to show that water can be relieved, as a reliable safety function. In either case, it would be conservative to maximize the rate at which the pressurizer fills during an IOECCS. This is done by assuming that the pressurizer PORVs and sprays are operable, since they tend to limit the rate of RCS pressurization, which would permit a relatively higher rate of ECCS delivery. Thus, the pressurizer fills more rapidly as steam is relieved through the PORVs. Eventually, when the pressurizer fills, the PORVs relieve water. The Byron and Braidwood licensing basis IOECCS analysis is based upon the assumption that the PORVs and sprays are not available. The analysis predicts that the pressurizer PSVs will open and relieve water. It is further assumed that the PSVs will reseat after having relieved water.

The staff concludes that, since the Byron and Braidwood licensing basis IOECCS analysis is not conservative with respect to demonstrating compliance with the ANS design requirement that prohibits an event from developing into a more serious event.

2.3.1.9 Consideration of the single failure criterion The protection system that is assumed to mitigate the IOECCS in the Byron and Braidwood licensing basis IOECCS analysis is the relief of water through three pressurizer PSVs. The PSVs must open to limit the RCS pressure, and then they must close to prevent the event from progressing to a more serious event.

The PSVs are designed to open and relieve steam. A single failure is not imposed upon the opening of the PSVs [13]. However, the Byron and Braidwood licensing basis IOECCS analysis relies upon all the PSVs to close, after having relieved water. The Licensee effectively imposes a new design requirement upon the PSVs (i.e., to be capable of closing after having relieved water). It cannot be inferred from [13] that the PSVs would be exempt from the single failure assumption when closing.

The staff maintains that the sticking open of a PORV or PSV that is not qualified for water relief, after having relieved water, fails to demonstrate compliance with the ANS design requirement that prohibits an event from developing into a more serious event. The sticking open of a PORV or PSV that is qualified for water relief, after having relieved water, could be assumed, in analyses, as the single active failure in a safety-related system that is called upon to serve a protection function during the event. This failure would not be construed to be a consequential failure that could lead to the development of a more serious event. It would be an assumption that is required for an analysis that is intended to show that the protection system employing the PORVs or PSVs meets GDC 21.

Since the Licensee claims the pressurizer PSVs are fully qualified for water relief, and relies upon them to operate during an IOECCS, then the PSVs are defined as a protection system, subject to the requirements of GDC 21. A single active failure must not result in the loss of the systems protection function. If one of the PSVs fails to close, then the systems protection function is lost, since the PSVs

do not fulfill the Licensees self-imposed design requirement for this protection system (i.e., that all PSVs must close, as well as open, after having relieved water).

It is possible to upgrade the pressurizer PORVs for use as a protection system during an IOECCS.

This requires upgrading the PORVS automatic control system circuitry to meet Class 1E requirements, qualifying the PORVs for water relief, assuring there is sufficient power (or air) to operate the PORVs throughout an IOECCS event, and qualifying the block valves and discharge piping for service under water-solid conditions. The sticking open of a PORV that is qualified for water relief, after having relieved water, could be assumed, in the IOECCS analyses, as the single active failure in a safety-related system that is called upon to serve a protection function during the event.

This failure would not be construed to be a consequential failure that could lead to the development of a more serious event.

The failure of one PORV to close would cause the PORV systems protection function to be lost.

However, the PORV systems protection function can be restored by the operator, by closing the stuck-open PORV, or by closing its block valve. The PORVs can be regarded as a protection system that can lose its protection function due to a single failure; but is equipped with a diverse, redundant, manually-operated backup system (i.e., the PORV control system and block valves). Manual operation would have to be justified by showing that there is sufficient time for the operator to diagnose the situation and take the corrective action(s). Closing a stuck-open PORV, or closing its block valve, is a relatively simple operation that could be performed in a short time, without reference to procedures. In 1974, a stuck-open PORV was manually isolated in less than three minutes (see the table, below). As a result of the Three Mile Island accident, operators are now mindful of the potential for sticking open a PORV. It can reasonably be expected that, today, the same operation would be completed in less than a minute. Operators must also be aware that, during an IOECCS, isolating all PORVs before the ECCS flow is ended could lead to the lifting of the PSVs.

2.3.2

SUMMARY

The following is a brief chronology of events that adds some background and perspective to the staffs decision to impose this backfit.

Date Event Comments October, 1972 RG 1.70, Rev 1 includes a list of events The IOECCS and the CVCS to be reported in FSARs (Table 15-1) [4]. malfunction are listed as events that increase RCS inventory.

Aug 6, 1973 ANS 18.2-1973, Nuclear Safety Criteria ANS 18.2-1973 states, By itself, a for the Design of Stationary Pressurized Condition II incident cannot generate Water Reactor Plants [1] is published. a more serious incident of the Condition III or IV type without other incidents occurring independently.

Aug 20, 1974 A turbine tripped at Beznau-1, a PORV The cast iron frame between valve opened, and stuck open [12]. The body and operator was broken, and operator closed the PORV block valve in the valve spindle was bent, probably 2 - 3 min. High indicated pressurizer due to water hammer (slug flow) and water level delayed actuation of ECCS. a poorly supported discharge line.

Both low pressure & low level indication (Ginna was equipped with PORVs of were required for ECCS actuation. This the same PORV design.) The requirement has since been eliminated. operator ended ECCS flow before the pressurizer became water-solid.

Date Event Comments Mar 28, 1979 A PORV sticks open at TMI-2, leading to The PORV remained open for more inaccurately high pressurizer water level than two hours, leading to core indication, and manual shutoff of ECCS. uncovery and extensive fuel melting.

Apr 14, 1979 IE Bulletin 79-06A is issued. ECCS is to be initiated on low pressurizer pressure, regardless of water level indication.

Jun 15, 1979 NRC issues Amendment 27 to Ginna. In response to IE 79-06A: Ginna removes pressurizer level/pressure coincidence.

Aug, 1980 SRP 15.5.1 - 15.5.2, NUREG-75/087, SRP indicates that a Condition II Standard Review Plan (SRP) is issued. incident cannot generate a more serious incident; but does not mention pressurizer filling.

June, 1982 WCAP-10105, Review of Pressurizer The WCAP states: the design Safety Valve Performance, as Observed specification for pressurizer safety in the EPRI Safety and Relief Valve Test valves in Westinghouse designed Program [2], is published. nuclear power plants is for steam service only.

Feb 14, 1985 OL is issued for Byron Unit 1. The UFSAR cites ANS 18.2-1973 [1].

Jan 30, 1987 OL is issued for Byron Unit 2. The UFSAR cites ANS 18.2-1973 [1].

Jul 2, 1987 OL is issued for Braidwood Unit 1. The UFSAR cites ANS 18.2-1973 [1].

January, 1988 EGG-NTA-8028, Technical Evaluation EGG-NTA-8028 states that IOECCS Report, TMI Action- NUREG-0737 (II.D.l), conditions were not considered in the Byron Units 1 & 2 [9] is published. EPRI PSV tests.

May 20, 1988 OL is issued for Braidwood Unit 2. The UFSAR cites ANS 18.2-1973 [1].

August 18, NRC issues letter to licensee: NUREG- Staff requests licensee to develop 1988 0737, Item II.D.1, Performance Testing and adopt plant procedures to on Relief and Safety Valves for Byron inspect the PORVs and PSVs after

[10]. each lift involving loop seal or water discharge.

Jun 30, 1993 In NSAL-93-013 [5], Westinghouse Westinghouse dismisses the need to recommends three possible solutions to deal with a stuck open PORV, since it customers whose plant accident can be isolated by closing its analyses predict the pressurizer will fill associated block valve.

during an IOECCS. Westinghouse also argues that a stuck valve is a leak, not a LOCA.

Apr 7, 1994 An IOECCS occurred at Salem. Pressurizer filled, PORVs opened, and relieved water. In 1997, Salem qualified their PORVs for water relief.

Aug 4, 1994 IN 94-55 is issued, regarding problems The Salem IOECCS of April 7, 1994 with Copes-Vulcan PORVs. is evaluated.

Oct 28, 1994 NSAL-93-013, Suppl 1 [5] is issued. PDP flow is added to charging flow.

Apr, 1996 SRP 15.5.1 - 15.5.2, NUREG-0800, SRP also indicates a Condition II Standard Review Plan (SRP), is issued. incident cannot be allowed to generate a more serious incident; but still does not mention pressurizer filling.

Jun 4, 1997 NRC staff accepts the use of safety- FSAR Amendments 194 and 177

Date Event Comments grade PORVs for water relief in licensing [15] are issued.

basis accident analyses for Salem 1 & 2.

Feb 23, 1998 Diablo Canyon files LER (1-98-001) PG&E determined that PSVs could reporting that the RCS is outside design open and pass water that is colder basis for IOECCS. than the 613°F temperature that is required by EPRI test results.

Jun 5, 1998 Millstone 3 upgrades PORVs for water Millstone application referenced relief (Amendment 161) [14]. Salems PORV upgrade [15].

May 25, 2000 Callaway applies for TS revisions to Amendment 137 is issued.

upgrade PORVs [16].

May 4, 2001 NRC staff authorized SPUs for Byron Licensees IOECCS analysis was and Braidwood [7]. based upon the use of water-qualified PSVs.

Dec, 2003 RS-001, Rev 0, Review Standard for Section 2.1, Matrix 8 specifies that Extended Power Uprates is issued. RS- control-grade PORVs may not be 001 is also used for SPUs. used to mitigate the IOECCS, and that the pressurizer must not fill.

Jul 2, 2004 Diablo Canyon upgrades PORVs Diablo Canyons application [21] is (Amendment 171). dated Sept 24, 2002 Oct 4, 2004 Beaver Valley 1 & 2 EPU submittal PORVs were qualified for water relief indicates pressurizer would fill in less prior to EPU approval.

than ten minutes.

Apr 17, 2005 IOECCS occurred at Millstone 3. PORVs relieved water, reseated, and leaked.

Dec 14, 2005 RIS 2005-029 is issued [6]. Licensees were informed that the staff will review Condition II event analyses with respect its possibility of developing into a Condition III event.

Mar, 2007 SRP 15.5.1 - 15.5.2, NUREG-0800, SRP cites RIS 2005-029 [6].

Standard Review Plan, Rev 3 is issued.

Nov 7, 2007 NSAL-07-10 [17] is issued, repeating the NSAL-07-10 pertains to Loss of FW block valve closure rationale of NSAL and LOOP analysis PORV modeling 013 [5]. assumptions.

Jun 23, 2011 Exelon applies for MURs for Byron and IOECCS (overfill) analysis is Braidwood [8]. unchanged (continues to be based upon use of water-qualified PSVs).

March 13, Seabrook 1 submits an LAR to install a This permissive prevents delivery of 2013 cold leg safety injection permissive [22]. ECCS water until RCS pressure The modification is modeled after the drops below the permissive setpoint permissive in Millstone 3 [14]. (usually set near the reactor low pressure trip setpoint).

The staff makes the following observations and conclusions, based upon the facts and perspective of this chronology:

1. The Byron and Braidwood are alone among Westinghouse designed four-loop plants that claim to have qualified their PSVs for water relief. Diablo Canyon had considered qualifying their PSVs; but qualified their PORVs instead (in 2004). Plants of this design class are typically equipped with same PSVs (i.e., Crosby 6M6 PSVs with a

relief rating of 420,000 lbs/hr steam). Some of the plants, in which the pressurizer is predicted to fill during an IOECCS event analysis or evaluation, have chosen to qualify their PORVs for water relief. Application of the PORVs, as a mitigation system operating under water relief conditions requires qualification of the PORV discharge piping to support water flow, and an upgrade of the automatic control system circuitry to Class 1E quality.

2. In 1974, a Condition II turbine trip incident at Beznau 1 (in Switzerland) [12] caused both PORVs to open, as designed; but it is believed that the discharge of a slug of water or a water hammer damaged one of the PORVs, so that it failed to reseat when pressure dropped. Thus, a Condition II turbine trip became a Condition III small break LOCA. The Westinghouse-designed reactor protection system logic, at that time, required the presence of both low pressure and low level to actuate the ECCS. The open PORV(s) caused a swell in the pressurizer water volume that delayed ECCS actuation, and this provided the operator enough time to close the PORV block valve, and end the ECCS delivery before the pressurizer could become water solid. About five years later, an open PORV at TMI 2 also caused a swell in the pressurizer water volume that misled operators to end the flow of ECCS water that was needed for core cooling. The requirement that both low pressure and low level must be present in order to actuate the ECCS was eliminated after the TMI accident (IE Bulletin 79-06A).

3. In 2001, the staff accepted the Licensees PSV water relief qualification, along with its authorization of the Byron and Braidwood SPUs. The staffs acceptance was based upon the Licensees assertion that EPRI valve test results indicated that the PSVs can be relied upon to reseat after having relieved water. A recent review of EPRIs test results, for the Byron and Braidwood plants, reveals that EPRI had not conducted tests for PSV operation under IOECCS conditions. The staff concludes that there was no basis for the licensees claim that their PSVs were qualified for water relief, nor for the staffs acceptance of that claim.

4. The inconclusive EPRI valve tests results, the licensing basis analysis results (which predict a prolonged period of cyclical water relief through the PSVs, which causes a spill from the PRT, and some minor damage in the PSVs), and the suppliers assertion that the PSVs are designed for only steam relief, lead the staff to conclude that the pressurizer PSVs cannot be relied upon to mitigate Condition II events, and still meet the ANS design requirements.

5. The Licensees IOECCS analysis does not credit operation of the PORVs. The implication is that failure of a PORV to reseat need not be addressed, since a stuck-open PORV could be easily remedied by closing its block valve. This approach was recommended by Westinghouse in 1993 [5], and rejected by the staff in 2005 [6]. This recommendation was repeated by Westinghouse in 2007 [18]. This backfit is imposed because, among other things, the licensee is continuing to apply Westinghouses unacceptable recommendations, which are most recently seen in the licensees MUR application of 2011 [8].

6. PORVs and PSVs that are not qualified as protection systems for operation under water relief conditions are conservatively assumed to stick open after having relieved water. This assumption is regarded as a consequential failure, and as an indication of failure to meet the ANS design requirement that prohibits an event from developing into a more serious event. If the PORVs or PSVs are qualified as protection systems,

for operation under water relief conditions, then a sticking open a PSV or PORV could be assumed as the single failure that is required test a protection systems compliance with GDC 21.

7. If a PORV that is qualified as a protection system for operation under water relief conditions is assumed to stick open, as the single failure assumption, then GDC 21 can be met by manually closing the PORV or its block valve. These are redundant and diverse components that do not exist in a water-qualified PSV-based protection system. For other LARs, the staff has accepted the use of water-qualified PORVs to mitigate mass addition events; but not the use of PSVs. Even water-qualified PSVs have not been accepted for use, as a protection system, since the GDC 21 requirement has not been satisfied.

3.0 CONCLUSION

The SRXB and LPL III-2 staff have determined that it is necessary to impose a facility-specific backfit on the Braidwood and Byron plants, to ensure compliance with existing written licensee commitments, in accordance with Title 10, Part 50.109, Backfitting, of the Code of Federal Regulations (10 CFR 50.109). Specifically, this backfit is imposed in the following manner:

1. Correct the plant design with respect to mass addition events, and revise the licensing basis mass addition event analyses and evaluations.

2. Complete the licensing basis by evaluating or analyzing the CVCS malfunction, and the inadvertent opening of a PORV. Both evaluations are to be performed to address the effect of adding mass (water) to the RCS.

3. Revise the plant design(s) and/or the licensing basis evaluations and analyses of all other affected Condition II and III licensing basis events to comply with the ANS design requirements [1] listed herein as (1), (2), and (3).

4. Negotiate a schedule for implementation of the aforementioned revision(s) with the staff, based upon the MD 8.4 Handbook, i.e., paragraph (II)(B)(9).

5. The staff will review the Licensees choice of any method by which the aforementioned modifications or revisions can be accomplished that does not rely upon the operation of the PSVs to mitigate any of the Condition II events, discussed herein.

4.0 REFERENCES

1. ANS-N18.2-1973, Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants

2. WCAP-10105, Review of Pressurizer Safety Valve Performance, as Observed in the EPRI Safety and Relief Valve Test Program, E.M. Burns, et al, June 1982 (Proprietary Class 3), the design specification for pressurizer safety valves in Westinghouse designed nuclear power plants is for steam service only

3. 10 Code of Federal Regulations, Part 50, Appendix A, General Design Criteria

4. Regulatory Guide 1.70, Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants, Rev 3, November 1978 (ADAMS Accession No. ML011340116)

5. NSAL-93-013, Inadvertent ECCS Actuation at Power, G.G. Ament and K.J. Vavrek, Westinghouse ESBU, June 30, 1993, and NSAL-93-013, Supplement 1, J.S. Galembush, Westinghouse ESBU, October 28, 1994 (ADAMS Accession No. ML052930330)

6. NRC RIS 2005-029, Anticipated Transients that Could Develop into More Serious Events, dated December 14, 2005 (ADAMS Accession No. ML051890212).

7. Letter no. RS-01-110 from Exelon to USNRC, Response to request for Additional Information Regarding the License Amendment Request to Permit Uprated Power Operations at Byron and Braidwood Stations, January 31, 2001 (ADAMS Accession No. ML010330145) and Issuance of Amendments: Increase in Reactor Power, Byron Station Units 1 and 2, and Braidwood Station, Units 1 and 2, May 4, 2001 (ADAMS Accession No. ML011420274)

8. Exelon Nuclear, Request for License Amendment Regarding Measurement Uncertainty Recapture (MUR) Power Uprate Measurement Uncertainty, RS-11-099, dated June 23, 2011 (ADAMS Accession No. ML1117900030)

9. EGG-NTA-8028, Technical Evaluation Report, TMI Action- NUREG-0737 (II.D.l),

Byron Units 1 & 2, dated January, 1988

10. Letter from L.N. Olshan, NRC, to H.E. Bliss, Commonwealth Edison, NUREG-0737, Item II.D.1, Performance Testing on Relief and Safety Valves for Byron Station, Units 1 and 2, dated August 18, 1988

11. ComEd Letter no. RS-00-132, Response to Request for Additional Information Regarding the License Amendment Request to Permit Uprated Power operations at Byron and Braidwood Stations, dated November 27, 2000

12. Letter from A. Thadani, NRC, to D.F. Ross, NRC, Stuck Open Power Operated Relief Valve at Foreign PWR, dated May 15, 1979 (ADAMS Accession No. ML100540310)

13. ANSI/ANS-58.9-1981, Single Failure Criteria for Light Water Reactor Safety-Related Fluid Systems -- 4.1 Where the proper active function of a component can be demonstrated despite any credible condition, then that component may be considered exempt from active failure. Examples of such component functions may include opening of code safety valves and certain swing check valves.

14. License Amendment No.161, Issuance Of Amendment -Millstone Nuclear Power Station, Unit No. 3, June 5, 1998 (ADAMS Accession No. ML011800207)

15. License Amendment Nos.194 and 177, Salem Nuclear Generating Station, Unit Nos.

1 and 2, NRC, June 4, 1997 (ADAMS Accession No. ML011720397)

16. Union Electric Company, Application for TS revisions re Pressurizer Safety Valves and PORVs, Callaway Plant, May 25, 2000 (ADAMS Accession No. ML003719636)

17. NSAL-07-10, Loss-of-Normal Feedwater/Loss Offsite AC Power Analysis PORV Modeling Assumptions, J.T. Crane and A.J. Macdonald, Westinghouse ESBU, November 7, 2007

18. NUREG-0737, Clarification of TMI Action Plan Requirements, November, 1980

19. ASME Boiler and Pressure Vessel Code,Section III, 1974 Edition (See Sections NB-7320, Content of [Overpressure Protection] Report, NB-7810, Responsibility for Certification of Pressure Relief Valves, and NB-7820, Capacity Certification Tests)

20. ASME OM Code, 2001 Edition thru 2003 Addenda, including Mandatory Appendix I, Inservice Testing of Pressure Relief Devices in Light-Water Reactor Nuclear Power Plants (See Sections I-8100, Set Pressure Testing, I-8200, Seat Tightness Testing, and I-8300, Alternative Test Media)

21. PG&E Letter DCL-02-115, Pacific Gas & Electric Company, License Amendment Request (LAR) 01-08, Credit for Automatic Actuation of Pressurizer Power Operated Relief Valves: Pressurizer Safety Valve Loop Seal Temperature, Sept 24, 2002 (ADAMS Accession No. ML031290380)

22. NextEra Energy Seabrook, SBK-L-12179, License Amendment Request 12-04, License Amendment Request Regarding Cold Leg Injection Permissive, March 13, 2013 (ADAMS Accession No. ML13079A122)

23. EPRI Document NP-2770-LD, EPRI/C-E PWR Safety Valve Test Report, January, 1983

24. Letter from J. Wiebe, NRC, to M. Pacilio, Exelon Generation Company, LLC, Braidwood Station, Units 1 And 2, and Byron Station, Unit Nos. 1 and 2 -

Issuance of Amendments Regarding Measurement Uncertainty Recapture Power Uprate, February 7, 2014 (ADAMS Accession No. ML13281AOOO)

25. Letter from C. Jackson, NRC, to T. Tate, NRC, Braidwood Station, Units 1 and 2, and Byron Station, Units 1 and 2 - Imposition of Facility-Specific Backfit Re:

Compliance With Licensing Basis Plant Design Requirements, June 12, 2014 (ADAMS Accession No. ML14078A619)

Principal Contributor: S. Miranda Date: August 18, 2014