ML16341E545
| ML16341E545 | |
| Person / Time | |
|---|---|
| Site: | Diablo Canyon  |
| Issue date: | 02/17/1988 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML16341E544 | List: |
| References | |
| NUDOCS 8802240328 | |
| Download: ML16341E545 (14) | |
Text
~gg AEgg
+4
~
0 o"
+**++
UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, O. C. 20555 ENCLOSURE 1 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATING TO REMOVAL OF AUTO CLOSURE INTERLOCK FUNCTION PACIFIC GAS & ELECTRIC COMPANY DIABLO CANYON UNITS 1 AND 2 DOCKET NOS.
50-275 AND 50-323
1.0 INTRODUCTION
By letter dated August 4, 1987 (Reference
- 1) Pacific Gas 8 Electric Company (PG8E) requested staff concurrence with their 10 CFR 50.59 evaluation which has determined that removal of the RHR autoclosure interlock (ACI) function does not constitute an unreviewed safety question or require modification of Technical Specifications.
The staff review of this issue has focused on the effect that the proposed change has on the Event V (intersystem LOCA outside of containment) sequence and we have reviewed the licensee's PRA analysis of the Event V sequence.
In addition, we have explored alternatives to total removal of the ACI circuitry and have discussed enhanced operating procedures with the licensee which will decrease the probability of the Event V sequence.
- 2. 0 EVALUATION
- 2. 1 Hardware Chan es PG8E proposes to remove the autoclosure interlock function from the residual heat removal (RHR) suction valves.
The open permissive interlock will remain intact.
An alarm will be added to each valve which will actuate if the valve is open and if RCS pressure is above a value set between 390 psig and 450 psig which is above the RHR valve open permissive setpoint.
In addition, the status lights on the operator's panel which indicate that these valves are open or closed will remain functional after power has been removed from these valves.
88022 o
0275 PDR ADOCK 0>00PDR P
~
~
- 2. 2 Procedural Chan es In addition to the above hardware
- changes, the licensee has committed, (Reference
- 2) to enhancing his operating procedures to further reduce the probability of the Event V sequence.
The following are the major changes which will be implemented.
1.
Plant operating procedures will now include a new procedure for the response to the RHR suction valve being open.
This procedure wi 11 require that no further pressurization be initiated until the reason for the alarm is ascertained and the operator has verified that both RHR suction valves are closed.
2.
A surveillance procedure will be added to ensure that these alarms remain operable.
3.
An additional step will be added to procedures which will require that these alarms and valve status lights are checked.
This check will be performed after the valves are leak-checked, closed and have power removed.
4.
Power will be removed from the RHR suction valves prior to their being leak-checked in order to ensure that they remain in the tested configuration.
2.3 Reasons for Removal of Autoclosure Interlock The main reasons for removing ACI has been previously elucidated by the staff in the AEOD report concerning Decay Heat Removal Problems at U.S. Pressurized Water Reactors (Reference 3).
This report points out that of the 130 loss of RHR events that were documented at U. S.
PMRs between 1976-1983 37 of these events were caused by the automatic closure of the suction/isolation valves.
The AEOD report also quotes a Sandia Laboratory study (Reference
- 4) which
evaluated the competing risks associated with RHR suction/isolation valve closures and Event V.
Sandia concluded that:
"The lowest core melt frequency due to the combination of loss of RHR suction during cold shutdown and V-LOCAs is obtained when there are no autoclosure interlocks on the RHR suction valves...removing the overpressure interlocks from the RHR suction valves gives the best RHR suction arrangement for PMRs based upon this analysis.
...when interlocks are present, loss of RHR suction is the largest contributor to core melt frequency for all assumed values of P(CH-LRHRs).
- However, when the interlocks are not present, the core melt frequency due to loss of RHR suction is comparable to or less than the V-LOCA core melt frequency for the "best estimate" cases".
The AEOD report concluded, that, even though it was most likely a good idea to remove ACI, the effects of ACI removal upon plant safety must be evaluated on a plant by plant basis because of numerous plant specific differences.
The licensee's submittal (Reference
- 1) contains such a plant-specific analyses.
An additional benefit associated with removal of ACI is that the isolation valves will remain open during low temperature overpessurization (LTOP) events which allows the RHR relief values to relieve pressure and aid in the LTOP protection of the RCS.
2.4 Safet Function of the ACI The licensee has shown in Reference 1 that the RHR relief valves have adequate capacity to mitigate pressure transients which occur during RHR operation.
Therefore, the purpose of ACI is to ensure that there is a double barrier between the RCS and the RHRS when the plant is at normal operating conditions being hot and pressurized and not in the RHRS cooling mode.
The ACI function is to preclude conditions that could lead to a LOCA outside containment, Event V, due to operator error.
The sequence which we are concerned with in
particular is that case where the operator closes one of the isolation valves and not the other since if both valves were left open, the operator would not be able to pressurize the plant.
- 2. 5 Justification for Removal of ACI The principal justification for the removal of the ACI is the PRA analysis given in Reference 1 which examines the Event V sequence associated with the RHRS suction path.
The fai lure combination examine in this analysis are the simultaneous rupture of the two motor operated valves 8701 and 8702 and combinations of a valve fai ling open and subsequent rupture of the other valve.
Failure of both valves to close during the startup operation is not considered since the operator could not pressurize the plant in this confiquration.
The licensee presented the following equation for analysis of the Event V sequence:
F(VSEQ) = hgQ(Vg) + A,qQ(Vz) + A2Q(V>R) where
= failure rate of MOV 8701 (rupture)
= failure rate of MOV 8702 (rupture)
Q(V>)
= probability that MOV 8701 is open Q(Vz)
= probability that MOV 8702 is open Q(V,R)
= probability of rupture of MOV 8701.
Using this equation, the licensee compared their present configuration with their proposed modification which consists of the removal of ACI and the addition of the valve position alarm.
Their analysis did not take credit for
I
'It
the procedural modifications which are listed in Section 2.2.
The results of the licensee's PRA analysis are as follows:
With Present Confi uration With Modification MOV 8701 Q(V1)
MOY 8702 Q(YR) 2.39E-5 2.39E-5 1.27E-8 1.27E-8 Using these values and substituting into the V-sequence equation yields the following results:
With Present Confi uration With Proposed Modification F(V
)
- 6. 17E-7/yr 5.76E-7/yr At first glance the overall safety benefit of the modification seems small (a
7X reduction from 6.17xlO /yr to 5.76xlO /yr).
- However, when you consider that the term 3<Q(V,R), the double rupture of MOV 8702 and MOV 8701, contributes 5.75xlO to the total probability of the V sequence and realizing that deletion of the ACI has no impact on this contributor we notice that the other contributors (the rupture of one valve while the other valve has failed open) decrease from 4.19x10
/yr to l.llx10 which is a substatial relative
-8
-11 reduction even if we question the low absolute value of these probabilities.
The major reason that such a reduction can be obtained by removing the ACI and adding an alarm is that the sequences which lead to either MOV 8701 or MOV 8702 remaining open are dominated by the operator's ability to detect that the valve has been left open.
A particularly vulnerable sequence occurs if we postulate a mechanical failure of one the valves since the ACI system would provide no protection.
Also, if we consider possible failures of the alarm system, we note that many of the dominate sequences are associated with the failure of the pressure transmitter which would also cause the ACI system to fail as well.
In addition to showing that there is an overall reduction in the probability of the Event V sequence, the licensee also presented an analysis of the increase in RHRS availability as a result of the removal of the ACI circuit.
This analysis showed that RHR system unavailability is reduced by 62K during short term cooling (72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />) and by 31K during long term cooling (1008 hrs).
- 2. 6 Alternatives to Com lete Removal of ACI 1.
Remove power to isolation valves during shutdown.
Both the staff and the licensee agreed that this would be a bad practice since the valves would not be available to perform their isolation function should the need arise during shutdown.
2.
Defeat the ACI circuitry during shutdown and rearm it during startup.
The rearming of this circuit would require a procedural step.
Therefore, this would not provide any better protection than the enhanced procedures discussed in section 2.2.
3.
Have valves fail as is on a loss of power during shutdown.
This alternative would prevent losses of RHR due to spurious closure of the suction valves on loss of power events.
However, this alternative would not prevent suction valve closure due to spurious pressure signals.
- 3. 0 STAFF POSITION The staff finds that the removal of the autoclosure interlock and the installation of the alarm of Diablo Canyon Units 1 8
2 produces a net safety benefit and is acceptable.
In addition, the staff believes that the procedural enhancements proposed by the licensee add considerably to plant safety and are highly recommended.
4.0 REFERENCES
1.
Letter, J. Shiffer (PG&E) to USNRC, "Removal of RHR System Autoclosure Interlock Function," August 4, 1987.
2.
Letter, J. Shiffer (PGKE) to USNRC, "Removal of RHR Suction Valve Autoclosure Interlock Function," January 19, 1988.
3.
H. 0. Ornstein, "Decay Heat Removal Problems at U.
S. Pressurized Water Reactors,"
December
- 1985, AEOD/C503.
4.
D.
R. Gallup, D. N. Kunsman, N. P. Bohr, Sandia National Laboratories, "Potential Benefits obtained by Requiring Safety-Grade Cold Shutdown Systems,"
NUREG/CR-4335, July 1985.
A