ML16161A321

Safety Evaluation Supporting Amends 234,234 & 233 to Licenses DPR-38,DPR-47 & DPR-55,respectively

ML16161A321
Person / Time
Site:	Oconee
Issue date:	12/07/1998
From:	NRC (Affiliation Not Assigned)
To:
Shared Package
ML16161A320	List: ML16161A319 ML16161A321
References
IEB-80-04, IEB-80-4, NUDOCS 9812110125
Download: ML16161A321 (9)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION t

WASHINGTON, D.C. 20565-001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO. 234 TO FACILITY OPERATING LICENSE DPR-38 AMENDMENT NO. 234 TO FACILITY OPERATING LICENSE DPR-47 AND AMENDMENT NO.

233 TO FACILITY OPERATING LICENSE DPR-55 DUKE ENERGY CORPORATION OCONEE NUCLEAR STATION, UNITS 1, 2. AND 3 DOCKET NOS. 50-269, 50-270, AND 50-287

1.0 INTRODUCTION

By letter dated July 15, 1997, as supplemented March 3, April 13, June 16, October 26, and November 5, 1998, Duke Energy Corporation (DEC/the licensee), submitted a request for changes to the Oconee Nuclear Station, Units 1, 2, and 3, Technical Specifications (TSs). The proposed amendments would add new requirements for the main steamline break instrumentation to the TSs and resolve DEC's response to Inspection and Enforcement (IE)

Bulletin 80-04. The March 3, April 13, June 16, October 26, and November 5, 1998, letters provided clarifying information that did not change the initial proposed no significant hazards consideration determination.

2.0 BACKGROUND

By letter dated February 8, 1980, the staff issued IE Bulletin 80-04, "Analysis of a PWR

[pressurized water reactor] Main Steam Line Break with Continued Feedwater Addition." The bulletin request included the following actions:

1. Review of the containment pressure response analysis to determine if the potential for containment overpressure for a main steamline break (MSLB) inside containment included the impact of runout flow from the auxiliary feedwater system and the impact of other energy sources, such as continuation of main feedwater (MFW) or condensate flow. In that review, licensees were asked to consider the ability to detect and isolate the damaged steam generator (SG) from these sources.

2. Review of the reactivity increase, which results from an MSLB inside or outside containment. If the previous analysis did not consider all potential water sources (such as in action 1.) and the reactivity increase was greater than the previous analysis, licensees were asked to include additional information. This additional information included the identification of the boundary conditions for the analysis, the most restrictive single active failure in the safety injection system, the effect of extended water supply to the affected SG, 9812110125 981207 PDR ADOCK 05000269

-2 the hot channel factors corresponding to the most reactive rod in the fully withdrawn position, and the Minimum Departure from Nucleate Boiling Ratio.

3. If the potential for containment overpressure exists or the reactor-return-to-power worsens, provide a proposed corrective action and schedule for completion of those actions.

4. Within 90 days of the date of the bulletin, complete the review and evaluation and provide a written response describing the reviews and actions taken in response to each item.

The licensee's initial 1980 response to IE Bulletin 80-04 identified that containment pressure would not be exceeded and that no modifications were necessary in response to the bulletin. In an October 14, 1982, Safety Evaluation Report, the staff concluded that the licensee's response to IE Bulletin 80-04 was acceptable and that no further action was required.

By letter dated May 7, 1993, the licensee informed the staff that a reanalysis of the containment response to an MSLB showed that the containment design pressure would be exceeded without operator action to isolate MFW flow to the SGs. Errors in the original Babcock and Wilcox (B&W) analyses (circa 1970) did not include the modeling of passive structural metal in the reactor coolant system (RCS) as a heat source. The reanalysis indicated that this metal was a significant heat source. The reactivity increase analysis requested by IE Bulletin 80-04 assumed continued MFW (no isolation) flow throughout the event and was not affected by this discovery.

In the May 7, 1993, letter, the licensee also identified that the acceptance criteria for the MSLB in the Oconee Final Safety Analysis Report (FSAR) requires that the core remain intact for effective core cooling, no loss of primary boundary integrity occurs, and doses remain within Title 10 of the Code of Federal Regulations (10 CFR) Part 100 limits. The licensee stated that those criteria were still met with the reanalysis. The offsite dose analysis presented in the FSAR evaluates the MSLB outside containment, thus, no credit is taken for containment integrity. The MSLB outside containment for Oconee is limiting from the dose standpoint because there are no main steam isolation valves in the Oconee design; therefore, containment integrity following an MSLB would not provide any 10 CFR Part 100 dose reduction. The dose analysis for an MSLB outside containment would bound any dose analysis for an MSLB inside containment with consequential containment leakage.

In the May 7, 1993 letter, the licensee also committed to propose a long-term resolution and schedule as a supplemental response to IE Bulletin 80-04 by August 19, 1993. The licensee further identified that it was relying on the integrated control system and operator action to mitigate this event until long-term resolution was determined and implemented.

By letter dated August 19, 1993, the licensee provided the supplemental response to IE Bulletin 80-04, which identified the long-term proposed solution. In that letter, the licensee stated that in order to alleviate the reliance on operator action, MFW isolation will be initiated by an automatic signal during an MSLB. The signal would actuate MFW isolation whether the MSLB was inside or outside containment. The licensee provided a brief description of the design that included a combined reactor trip and SG low pressure signal that would initiate the closure of all MFW main control valves and the startup feedwater control and block valves,

-3 along with the MFW main block valve (upstream of the main control valve) on the affected SG.

Both the reactor trip and SG pressure signal would be generated by redundant safety-related instrumentation.

By letter dated October 6, 1993, the staff informed the licensee that, although the staff had not performed a technical review of the design modification, the approach provided an acceptable response to address the concerns of IE Bulletin 80-04. The staff also concluded that the proposed schedule for implementation was acceptable.

By letter dated June 14, 1995, the licensee proposed a revised schedule for implementation of the long-term corrective action and also identified changes to the "conceptual" design of the automatic isolation feature. It was stated that the revised design would not only isolate all normal feedwater to both SGs but would also trip both MFW pumps (to assure adequate closure of the MFW control valves) and prevent the turbine-driven emergency feedwater (TDEFW) pump from starting (or trip the TDEFW pump if already running). The licensee further identified that the MFW equipment being controlled by the new MSLB circuitry is nonsafety-related and, therefore, not single-failure proof. However, the associated transmitters, logic, and control circuitry installed by the modification was designed to be safety related. The licensee also identified that a TS change would be required to address the equipment added by the proposed modifications.

By letter dated June 30, 1995, the staff responded to the licensee's June 14, 1995, letter by acknowledging the schedule change for the implementation of the modifications, but did not address the design changes to the modifications that were described in the licensee's letter.

The licensee's July 15, 1997, letter proposed TS changes discussed herein, provided the licensee's proposed TS changes to complete the MSLB modification, and completed the response to IE Bulletin 80-04.

3.0 DESCRIPTION

OF PROPOSED CHANGES By letter dated July 15, 1997, the licensee proposed amendments to change the TSs for the Oconee Nuclear Station, Units 1, 2, and 3. The proposed amendments would add channel functional tests for the analog instrumentation for detection of an MSLB and digital instrumentation for isolation of the main feedwater system, all of which would be performed only at refueling outage frequencies since the design of the circuitry did not accommodate testing with the unit operating (online testing). The staff found the proposed TS changes unacceptable since the interval was not consistent with the guidance in the standard TSs and the analog system was consistent with instrumentation that required online testing.

By letter dated October 26, 1998, the licensee committed to modify the analog instrument circuity to allow online testing and proposed a revision to the related channel functional test frequency to quarterly when the modification is completed. Subsequently, following a conference call with the staff, the licensee proposed, by letter dated November 5, 1998, changing the functional test to a monthly frequency when the modification is completed for each unit. In order to perform the online test, the licensee committed to install the instrumentation modifications by November 2000, refueling outage (RFO) 1EOCI9 (end-of-cycle 19) for Unit 1;

-4 October 1999, RFO 2EOCI7, for Unit 2; and March 2000, RFO 3EOC18 for Unit 3. The licensee has installed the hardware changes associated with the isolation circuitry during previous refueling outages.

The proposed TS changes would add new TS 3.5.7, "Main Steam Line Break Detection And Feedwater Isolation," revise TS 3.5.1, "Operation Safety Instrumentation," and revise Tables 3.5.1-1, "Instruments Operating Conditions," 4.1-1, "Instrument Surveillance Requirements," and 4.1-2, "Minimum Equipment Test Frequency." The proposed changes address the addition of the MSLB protection circuitry that has been installed to complete the closure of IE Bulletin 80-04. New and revised TS Bases were also proposed.

TS 3.5.7 would be applicable to the MSLB detection and feedwater isolation circuitry when main steam header pressure is greater than 700 pounds per square inch gauge (psig) and to the MFW main and startup control valves when RCS temperature is greater than 250 oF. The objective of TS 3.5.7 is to ensure the availability of the MSLB detection and feedwater isolation circuitry and the MFW control valves, in order to protect against exceeding the containment design pressure during an MSLB accident inside containment. Limiting Condition for Operation (LCO) 3.5.7.1 would require that the MSLB detection and feedwater isolation circuitry be operable in accordance with TS Table 3.5.1-1, Items 20, 21, and 22. LCO 3.5.7.2 specifies that the MFW control valves shall be operable. LCO 3.5.7.2.1 allows the provisions of LCO 3.5.7.2 to be modified as follows:

a. A Main Feedwater control valve in one or more flow paths may be inoperable provided the affected valve(s) are closed within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> from discovery and verified closed once per 7 days.

b. If the required actions and associated completion times of 3.5.7.2.1.a cannot be met, the reactor shall be placed in a hot shutdown condition within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, and be less than or equal to an RCS temperature of 250 OF in an additional 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br />.

Items 20, 21, and 22 would be added to Table 3.5.1-1. Item 20 specifies the minimum required number of operable main steam header pressure and MSLB detection (analog) channels per SG. Item 21 of Table 3.5.1-1 specifies the minimum required number of operable feedwater isolation circuitry (digital) channels. Item 22 specifies the minimum required number of operable feedwater isolation circuitry (digital) channels manual pushbutton. If the minimum number of channels for any of these items are not operable, the proposed change would require that the plant be in the hot shutdown condition within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and less than 700 psig within an additional 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

The proposed changes to TS 3.5.1 are administrative in nature and reflect the addition of TS 3.5.7 and the changes to Table 3.5.1-1. TS Tables 4.1-1 and 4.1-2 would be revised to reflect the testing frequencies of the associated electrical and mechanical equipment, respectively.

-5 4.0 EVALUATION 4.1 Response to IE Bulletin 80-04 The licensee's revised response to IE Bulletin 80-04 includes modifications to automatically isolate MFW flow to the affected SG in the event of an MSLB (isolates all MFW flow). The automatic MFW isolation function is not single-failure proof with respect to exceeding the containment design pressure (59 psig) in the event of an MSLB inside containment. If the MFW main control valve fails to close following an MSLB inside containment, there is a backup automatic MFW isolation feature performed by the closing of the MFW block valve. However, the block valve may not be capable of full closure against the differential pressure developed as a result of continued condensate pump (condensate booster pump) operation. Even without condensate pump operation, the stroke time of the MFW block valve is not fast enough to prevent exceeding containment design pressure assuming the most limiting MSLB inside containment. Therefore, no credit is assumed for the MFW block valve closure in the containment analysis and no TS for this feature has been proposed by the licensee.

Additionally, if the assumed single failure is a failure of the TDEFW pump autostart inhibit (or failure to trip if already running) following an MSLB inside containment, the potential for exceeding containment design pressure exists due to continued feedwater addition from the emergency feedwater (EFW) system. However, the amount that the containment design pressure could be exceeded is considerably reduced under these conditions and is not expected to threaten containment integrity. Credit is also taken in the containment analysis for isolating EFW flow (in accordance with the emergency operating procedures) from the motor driven EFW pump within 10 minutes following indications of an MSLB. Although not part of the design basis, the TDEFW inhibit/trip signal may also provide additional runout protection for the TDEFW pump following a large MSLB either inside or outside containment. Since the motor driven pump to the intact SG is also protected from damage due to runout by the intact SG pressure, at least one EFW pump would be available in the event of a single failure of any of the three EFW pumps.

The Oconee main steam system does not include main steam isolation valves and an MSLB inside containment was not considered in the original licensing and design bases. The most limiting (dose consequences) and design basis MSLB for Oconee is a break outside containment. Since the MSLB outside containment cannot be isolated resulting in the continuous release directly to the atmosphere, the potential doses from an MSLB outside containment will always bound the potential doses from an MSLB inside containment given the same initial conditions and assumptions. Also, the core reactivity analysis associated with an MSLB assumes continued MFW addition to the affected SG taking no credit for MFW isolation within the first 10 minutes. Therefore, credit for MFW isolation following an MSLB inside or outside containment is not taken in the reactivity analysis.

The worst case single failure of the MFW isolation system in the event of an MSLB inside containment is the concurrent failure of the MFW control valve to close upon receipt of the closure signal. In its June 16, 1998, response to the staffs April 13, 1998, request for additional information, the licensee provided the results from a containment analysis assuming the concurrent MFW control valve failure to close during an MSLB inside containment. The analysis assumed continued feedwater addition via the condensate pumps. The analysis

-6 results indicated a peak containment pressure of 100 psig at 445 seconds following initiation of the event. The licensee provided additional analysis results to show that, although containment design pressure could be exceeded by about 41 psig, there is a high probability that failure of the containment would not occur. These additional analyses included calculations to assess the ultimate capacity of the Unit 3 containment. The overall containment mean ultimate capacity was determined to be 144 psig with a standard deviation of 1.95 psig. While the staff has not verified the results of the licensee's additional analyses, it has concluded that failure of the containment to the extent of affecting MSLB mitigation is not expected to occur at 100 psig.

Therefore, any containment leakage effects due to exceeding the containment design pressure should be bounded by the MSLB outside containment.

The potential for the MFW control valve failing to close upon receipt of a close signal from the redundant MSLB circuitry, concurrent with a large double ended MSLB inside containment, is considered by the staff to be remote. Because the MFW control valve is necessary for SG water level control, failure to function for any reason would be detected quickly during normal plant operation by loss of level control. Therefore, most failures (such as a stuck valve, air line rupture, or actuator coupling failure) that could affect valve closure resulting in exceeding containment design pressure would have to occur coincident with the already low probability double ended MSLB inside containment. Although the control valves fail as is on loss of air pressure to their controller, the licensee has identified in its April 13, 1998, submittal that in the event of loss of all sources of compressed air to the air system, sufficient air inventory exists in the reservoirs (air receivers) to close the valves within 25 seconds of the initiation of the MSLB circuitry. The licensee also indicated that no single active failure to the electrical/electronic controls would prevent closure of an MFW control valve. The licensee has identified that an MSLB inside containment, concurrent with an MFW control valve sticking open was evaluated to have a probability of occurrence of <1.0 E-6 per reactor year.

Based on the unique design of the Oconee main steam system (i.e., no main steam isolation valves) that results in the dose consequences from the design basis MSLB outside containment bounding the dose consequences from an MSLB inside containment (even with containment leakage), the low probability of an MSLB inside containment coupled with the coincidental failure of an MFW control valve to close, and the licensee's analysis, which shows no fuel damage even with continued feedwater addition, the staff concludes that with the MSLB modifications, the licensee has adequately addressed the issues identified in IE Bulletin 80-04.

The licensee's revised response to IE Bulletin 80-04 is, therefore, acceptable and IE Bulletin 80-04 for Oconee should be considered closed.

4.2 Proposed TS Changes

New TS 3.5.7 The proposed TS applicability requirements of 700 psig SG pressure and 250 OF RCS temperature are consistent with the procedural enabling/disabling of the MSLB detection system during startups and shutdowns. The 700 psig requirement provides a 150 psig operating margin from the actuation setpoint of 550 psig to minimize the potential for inadvertent actuation while still providing adequate detection of a large MSLB that could threaten containment design pressure. The 250 *F RCS temperature requirement assures that

-7 the isolation equipment will be operable whenever significant amounts of stored energy may be attributed to the SGs. Below 250 *F, there is not enough energy available to exceed the containment design pressure. Because these applicability requirements provide an adequate amount of operational flexibility, while still providing adequate containment pressure protection from an MSLB, the staff concludes that they are acceptable. The staff also concludes that for the short and infrequent periods of time when RCS temperature is >250 OF and SG pressure is

<700 psig reliance on operator action to isolate MFW flow is acceptable.

The proposed specification includes an allowed outage time (AOT) of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> for an inoperable MFW control valve and specifies that operation may continue provided the inoperable valve is closed within that 8-hour time frame and verified closed once every 7 days. The 8-hour AOT for an inoperable (and not closed) control valve is consistent with the B&W standard TS (STSs

[NUREG-1430]) for two inoperable MFW isolation valves in the same flow path. In both cases (Oconee and NUREG-1430), the automatic isolation function is inoperable without any additional single failures. The staff considers that the 8-hour AOT or completion time is reasonable based on the low probability of an event during this time period (see Bases in NUREG-1430) requiring MFW isolation and based on past operating experience related to affecting repairs and restoring the valve to operable status or to complete actions to close the affected valve. The proposed AOT of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> is, therefore, acceptable.

If the valve cannot be closed or otherwise made operable within the allowed 8-hour AOT, the proposed action is to place the reactor in a hot shutdown condition within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and be less than or equal to an RCS temperature of 250 OF in an additional 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br />. These specified completion times of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br /> provide adequate time to permit a safe controlled shutdown and cooldown and are consistent with the completion times associated with the Oconee TSs for other post-accident mitigation systems. The proposed completion times are, therefore, acceptable.

The staff has also reviewed the proposed Bases for TS 3.5.7 and conclude that they adequately reflect the system design and provide adequate support for the proposed TSs.

TS Table 4.1-2 The proposed changes to Table 4.1-2 would add Item 12 for the MSLB isolation feature to perform a functional test every 18 months. The functional test would verify that the MFW pumps, MFW control valves, and the TDEFW pumps are appropriately actuated/inhibited by the MSLB isolation feature. The equipment identified for the proposed functional tests is acceptable since it includes all of the equipment relied upon in the MSLB analysis, and the frequency of testing is also acceptable because it is consistent with the testing frequency of other accident mitigation equipment for Oconee that cannot be functionally tested during power operation. The test frequency is also consistent with the testing frequency identified in NUREG-1430 for similar equipment.

K2 1Ii

-8 4.3 Instrumentation TS Table 3.5.1-1, Functional Units 20, 21, and 22, and Notes (k) and (1)

The parameters provided for the above added functional units are consistent with the system design and parameters provided.for similar instrumentation in the current Oconee TSs and/or B&W Owners Group STS, NUREG-1430, Rev. 1, 1995.

TS Table 4.1-1, Channel Description 62, Main Steam Header Pressure and MSLB Detection (analog) Channels The monthly channel functional tests and the 18-month calibration interval specified for the instrumentation are in conformance with that specified for similar channels in the current TSs and NUREG-1430. The licensee indicated that the MSLB detection circuitry will be designed such that testing of the analog portion of the MSLB logic circuit will not actuate the digital portion of the feedwater isolation logic circuits and the end devices. The licensee further stated that the design of the analog circuit will be suitably modified to meet the single failure criterion and allow online testing. The staff finds the design and surveillance to be consistent with staff guidelines and, therefore, are acceptable.

TS Table 4.1-1, Channel Description 63, Feedwater Isolation Circuitry (Digital) Channels and Manual Pushbutton The feedwater isolation circuitry is divided into two redundant digital channels and feedwater isolation will occur when either channel is actuated. The licensee indicated that digital components are more reliable than analog components and are less susceptible to drift.

Therefore, channel functional testing and calibration on the digital circuitry is proposed only during refueling outages. The staff finds the above design and surveillances to be consistent with staff guidelines and, therefore, acceptable.

TS 3.5.7, Main Steamline Break Detection and Feedwater Isolation The licensee added this section to the TSs to address operability of equipment installed for the MSLB detection and feedwater isolation instrumentation. The parameters specified in this section are in conformance with similar parameters in the current Oconee TSs and/or NUREG-1430, and the staff, therefore, finds this TS change acceptable.

5.0

SUMMARY

As a result of its review, the staff has concluded that the design of the MSLB isolation system, although not single-failure proof, is acceptable because the design basis and most limiting MSLB for Oconee is a break outside containment that does not rely on automatic MFW isolation. If the containment design pressure were exceeded as a result of an MSLB inside containment and a failure of an MFW control valve to close, the resultant dose to the public would be less than the design basis break outside containment. Therefore, the health and safety of the public is adequately protected.

-9 The staff has also concluded that the proposed TSs associated with the MSLB automatic isolation equipment are consistent with the TS requirements for other systems at Oconee that perform similar safety functions and are also consistent to the extent practical with NUREG-1430. The proposed TSs and Bases also adequately reflect the design and operation of the added equipment and complete the licensee's response to IE Bulletin 80-04. The proposed TS changes are, therefore, acceptable.

The staff has reviewed the licensee's proposed TS changes to address operability and testability of the new equipment installed to detect an MSLB and initiate automatic isolation of the main feedwater system and the schedule to perform the necessary circuitry changes so the analog instruments can be tested online. Based on that review, the staff concludes that the proposed TS modifications are consistent with the current Oconee TSs and/or B&W Owners Group STS, NUREG-1430, for similar systems and are, therefore, acceptable. In addition, testing of the analog instrumentation at a refueling outage interval until the circuitry changes are made according to the schedule previously discussed, followed by a monthly testing schedule, is acceptable.

6.0 STATE CONSULTATION

In accordance with the Commission's regulations, the South Carolina State official was notified of the proposed issuance of the amendments. The State official had no comments.

7.0 ENVIRONMENTAL CONSIDERATION

The amendments change requirements with respect to installation or use of a facility component located within the restricted area as defined in 10 CFR Part 20 and change surveillance requirements. The NRC staff has determined that the amendments involve no significant increase in the amounts, and no significant change in the types, of any effluents that may be released offsite, and that there is no significant increase in individual or cumulative occupational radiation exposure. The Commission has previously issued a proposed finding that the amendments involve no significant hazards consideration, and there has been no public comment on such finding (62 FR 50001, dated September 24, 1997). Accordingly, the amendments meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9). Pursuant to 10 CFR 51.22(b) no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendments.

8.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendments will not be inimical to the common defense and security or to the health and safety of the public.

Principal Contributors: William LeFave Subinoy Mazumdar Date:

December 7, 1998