ML16342A761
| ML16342A761 | |
| Person / Time | |
|---|---|
| Site: | Diablo Canyon  |
| Issue date: | 04/08/1999 |
| From: | NRC (Affiliation Not Assigned) |
| To: | |
| Shared Package | |
| ML16342A758 | List: |
| References | |
| GL-91-18, NUDOCS 9904130287 | |
| Download: ML16342A761 (12) | |
Text
~
~
~
qP,R RE00
~o
~i
++*++
UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATIONBY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO EMERGENCY CORE COOLING SYSTEM AUTOMATICSWITCHOVER
\\
PACIFIC GAS & ELECTRIC COMPANY DIABLOCANYON POWER PLANT UNIT NOS.
1 AND 2 DOCKET NOS. 50-275 AND 323
1.0 INTRODUCTION
By letters dated April 7, 1997, June 4, 1998, and March 11, 1999, Pacific Gas and Electric Company (PG&E) provided information regarding an NRC concern about the emergency core cooling system (ECCS) manual and automatic switchover from the refueling water storage tank (RWST) to the containment sump for Diablo Canyon Power Plant (DCPP). These letters gave the licensee's basis for concluding that manual action is an acceptable method for performing the switchover sequence, and for the licensee's desired closure of an associated NRC unresolved item (50-275;50-323/96021-07) discussed in NRC Inspection Reports 96-21 and 96-24, dated December 4, 1996 and February 26, 1997, respectively, and discussed in a meeting between the licensee and the NRC on December 18, 1996.
The staffs position regarding manual vs. automatic ECCS switchover at DCPP was stated by letter to the licensee, dated May 7, 1980, in which the staff asserted:
"We have rereviewed the manual switchover approved in the Diablo Canyon SER dated October 16, 1974 in connection with NPSH [net positive suction head] and RWST topics and find that the manual procedure with supplemental automatic RHR tResidual Heat Removal] pump trip continues to be acceptable based on analysis of time available for operator response.
However, our position is that the switchover to the recirculation mode be more fullyautomated during the longer term to reduce the operator manual actions needed subsequent to a loss-of-coolant accident."
The licensee responded by letter dated May 28, 1980, stating that PG&E did not have sufficient information to conclude that such a change was either necessary or desirable, and that further evaluation of the safety implications of such a change was needed.
No further docketed, plant-specific correspondence occurred between PG8E and the staff until the issue was raised in NRC Inspection Reports 50-275;50-323/96-21, dated December 4, 1996, and 50-275;50-323/96-24, dated February 26, 1997. As a result of subsequent discussions between the licensee and the staff, the NRC and the licensee agreed that a resolution of the manual vs.
automatic switchover concern at DCPP should be formally documented for closure of the associated unresolved item (50-275;50-323/96021-07).
9904%30287 990408 PDR ADOCK 05000275 P
POR
I
~
~
2.0 BACKGROUND
AND EVALUATION The NRC Safety Evaluation Report (SER) for DCPP (NUREG-0675, Revision 0, dated October 16, 1974), documents the staffs initial review of the ECCS switchover function at DCPP. The switchover function consists of the shift of the ECCS suction source of injection water during post-LOCA conditions from the RWST to the containment sump.
Table 6.3-5 of
'ection 6.3.1.4.4.2 of the Updated Final Safety Analysis Report (UFSAR), "Changeover from Injection Mode to Recirculation After Loss of Primary Coolant," describes the sequence and timing of actions taken by operators to perform the switchover function.
By letter dated March 20, 1980, the licensee responded to an NRC request for additional information regarding the bases for sizing of the RWST. This letter provided a calculation for the minimum contained volume in the RWST required by technical specifications (TS),
information regarding the time required for operators to complete the switchover function, and the remaining deliverable volume in the RWST following completion of the switchover (volume above the RWST low-low level alarm). This information was based upon UFSAR Table 6.3-4a (later superceded by Table 6.3-5). The original calculation from which the time frames were derived could not be located by the licensee.
Consequently, the licensee issued PG&E calculation STA-060 which reconstituted the basis for Table 6.3-5. The licensee stated that the most limiting single failure for completing the switchover was the failure of one of the RHR pumps to trip when the RWST level reached 33 percent.
This failure reduced the remaining deliverable volume in the RWST following completion of the switchover from approximately 78,000 gallons (Table 6.3<a) to approximately 60,000 gallons.
The NRC letter dated May 7, 1980, also requested that the licensee submit a proposed conceptual design identifying changes necessary for automating the ECCS suction source switchover function, and committing to a schedule for submittal of a final design package for NRC review within 120 days of receipt of the letter.
In June 1980, the staff issued Supplement 9 to the Diablo Canyon Safety Evaluation Report (SSER) which documented the staff's acceptance of the minimum contained volume requirements for the RWST. The staffs acceptance was based, in part, on the information provided by the licensee in the March 20, 1980 fetter. However, the staffs analysis concluded that the minimum deliverable volume remaining in the RWST, following completion of the switchover and with consideration of the most limiting single failure, could be as little as 32,500 gallons. The staff reiterated the acceptance of manual ECCS suction switchover with the eventual addition of a more fullyautomatic switchover design.
By letter dated May 28, 1980, the licensee responded to the staff's May 7, 1980, letter stating that they did not have sufficient information to conclude that a change to automatic ECCS suction swapover is either necessary or desirable.
The licensee observed that the safety implications of such a change must be evaluated before a conclusion could be reached concerning the advisability of more fullyautomating the switchover and before any conceptual design could be completed.
The licensee, therefore, requested a meeting with the NRC to review and discuss the issue.
This letter was, in part, in response to industry concerns at the time regarding the possibility of full or partial spurious actuation of the automatic switchover
~ r
~ ~
~
3 feature.
No further docketed correspondence occurred between the NRC and the licensee on the topic of manual or automatic swapover.
Subsequent licensee documents used to track open licensing issues did not list the ECCS switchover as an open item.
As a result of several related events at Davis-Besse, the staff initiated Generic Issue (GI) 24, "Automatic Emergency Core Cooling System Switch to Recirculation" in 1981.
Revision 0 to NUREG-0933, "APriorization of Generic Safety Issues," dated November 30, 1983, discussed Gl-24 and notes that the issue was scheduled for priorization. Revision 1 to NUREG-0933, dated December 31, 1991, noted that Gl-24 had been given a medium priority ranking.
Revision 2 to NUREG-0933, dated June 30, 1995, stated that GI-24 was still under review.
Revision 3 to NUREG-0933, dated December 31, 1997, documented resolution of Gl-24 and stated:
"Installing automatic or semi-automatic systems reduces human error. However, the estimated risk reduction from installing actuation systems that are less prone to human error was offset somewhat by an increased risk due to spurious actuations.
An evaluation of the PRAs for four PWRs indicated that the conversion from manual to semi-automatic ECCS switchover to recirculation would produce a small reduction in CDF (core damage frequency).
However, the regulatory analysis, published in NUREG/CR-6432, "Estimated Net Value and Uncertainty for Automating ECCS Switchover at PWRs," dated
'ebruary 1996, indicated that this solution was not justified on a cost/benefit basis.
Consideration of a license renewal period of 20 years did not affect this conclusion.
Thus, the issue was resolved with no new requirements."
Consequently, Gl-24 was resolved without additional generic requirements.
However, in those individual instances where licensees consider temporary or permanent changes to the facility which credit operator actions, the NRC continues to rely on the guidance provided in Generic Letter (GL) 91-18, "Resolution of Degraded and Nonconforming Conditions and on Operability,"
dated November 7, 1991, and the criteria contained in NRC Information Notice (IN) 97-78, "Crediting of Operator Actions in Place of Automatic Actions and Modifications of Operator Actions, Including Response Times" for evaluating such changes.
The licensee's most recent switchover sequence introduces and credits new operator actions.
GL 91-18 states that in a "... situation in which substitution of manual action for automatic action may be acceptable, the licensee's determination of operability must focus on the physical differences between automatic and manual action and the ability of the manual action to accomplish the specified function. The physical differences to be considered include, but are not limited to, the ability tb recognize input signals for action, ready access to or recognition of setpoints, design nuances that may complicate subsequent manual operation such as auto-reset, repositioning on temperature or pressure, timing required for automatic action, etc.,
minimum manning requirements, and emergency operating procedures written for the automatic mode of operation.
The licensee should have written procedures in place and training accomplished on those procedures before substitution of any manual action for the loss of an automatic action." IN 97-78 discusses estimation of reasonable response times for
operator actions and allows licensees to use time intervals derived from independent sources, provided they are based on analyses with consideration given to human performance.
The staff evaluated the task-analysis-related information provided by the licensee with regard to the following considerations:
specific operator actions and the times to perform those actions, environmental conditions expected, ingress/egress paths taken by operators to accomplish functions, procedural guidance for the required actions, support personnel and/or equipment required to carry out the required actions, specific operator training necessary to carry out the required actions, information requirements including qualified instrumentation, recovery from plausible errors, and risk significance of the proposed operator actions.
As a result of issues raised in NRC Inspection Reports 96-21, dated December 4, 1996, and 96-24, dated February 26, 1997, and discussions with the NRC at a meeting on December 18, 1996, the licensee and the NRC agreed that the resolution of the manual vs. automatic ECCS suction switchover concern should be formally documented.
The licensee reviewed NUREG/CR-6432 and determined that its conclusion is applicable to DCPP and that conversion to a semi-automatic or automatic ECCS switchover function at DCPP is not warranted.
The licensee determined that sufficient water is available between the low-level alarm setpoint (and RHR pump trip setpoint) at 33 percent of RWST level (149,200 gallons) and the low-low level alarm setpoint at 4 percent of RWST level (18,700 gallons) using the total instrument loop uncertainty (TILU)from the sensor through the bistable. The instrument driftfor the sensors and the bistables of the RWST level instrument loops was based on the statistical analysis of
. actual plant calibration data using a 95/95 probability and confidence level criteria. There was insufficient calibration data to establish the instrument drift at a 95/95 confidence level for one of the six level sensors in both DCPP Units (LT-920 in DCPP Unit 1). For this sensor, a conservative drift of 1 percent span was assumed versus the 0.6 percent span determined statistically for the other sensors.
The water volume available for switchover was then calculated on the basis of the TILUfor the RWST level instruments.
The distribution of probable low level alarm or RHR pump trip actuation setpoints was determined by combining the setpoints and TILUfor the three instrument loops in the two-out-of-three logic consistent with the system design.
The distribution of the low-low alarm actuation setpoints was based on just one instrument TILU in each DCPP unit consistent with the system design.
The setpoint distribution was subtracted to determine the distribution of the difference (or switchover volume) between the low and low-low alarm setpoints.
The correlation between the sensor error in the low-low alarm instrument loop and one of the three low alarm instrument loops was considered.
In addition, there is a vortex cage surrounding the ECCS suction line from the RWST. This physical system limitation was used to limitthe low end of the low-low alarm distribution of setpoints.
Because the low and low-low level alarm setpoint distributions were subtracted, this limitation due to the vortex cage has the effect of making the difference (the switchover volume) smaller. Therefore, the switchover volume available reflects the TILUof the low and low-low level alarm instrument loops incorporating the two-out-of-three logic of the low level alarm/RHR pump trip, the correlation of the sensors errors in the low and low-low.level alarm instrument loops for one channel and the physical vortex cage at the RWST outlet. The resulting switchover volume represents the 95 percent probable amount of water which is available at the time of manual ECCS switchover.
Based on current procedures and staff evaluation of the licensee's setpoint analysis, the NRC finds that sufficient volume is available to ensure the successful completion of manual switchover of ECCS suction supply from the RWST to the containment sump for cold leg recirculation.
p g 4 V
1 The licensee has since recalculated the time available to complete the switchover and documented it in STA-061, Revision 0, dated January 14, 1997.
In addition, STA-061 included an update to UFSAR Table 6.3-5 to incorporate the step in the current revision to Emergency Operating Procedure (EOP) E-1.3, "Transfer to Cold Leg Recirculation." The updated table showed that the total time needed to complete the switchover was 9 minutes and 35 seconds.
This time did not include the time required to perform steps 1, 2, 3a, 3b, and 3c of EOP E-1.3.
Inclusion of the time to perform these steps would increase the time to perform the switchover by 1 minute and 20 seconds.
Based upon the containment spray (CS) pump flow rate used in STA-061, this additional time would result in a margin of 14,500 gallons remaining in the RWST following the switchover. Acknowledging conservative flow rates for the RHR and CS pumps and incorporating the impact of one of the RHR pumps failing to trip on an RWST low level condition, STA-061, Revision 0, had determined the minimum deliverable volume remaining in the RWST would be 23,000 gallons.
Licensee reanalysis supported in STA-061, Revision 1, dated February 14, 1997, supported by simulator validation, determined that switchover willbe completed with 32,500 gallons available water volume in the RWST. NRC Inspection Report 50-275;50-323/96024 expressed two additional concerns regarding STA-061. First, the calculation assumed a containment pressure of 20 psig which was non-conservatively inconsistent with recent analysis performed by Westinghouse.
Second, STA-061 did not adjust the calculation to reflect the higher flow rate for the limiting single failure of an RHR pump to automatically trip at the RWST low level alarm.
Based upon these concerns and subsequent licensee reanalysis, the licensee revised affected portions of STA-061, EOP E-1.3, and the UFSAR (Revision 11A).
3.0 CONCLUSION
The original design of the licensee's safety systems and the systems'bility to respond to design-basis accidents are described in the licensee's FSAR and reviewed and approved by the NRC. Most safety systems, including the licensee's ECCS, were designed to rely on automatic system actuation to ensure that the safety systems were capable of carrying out their intended functions.
In a few cases, limited operator actions, when appropriately justified, were approved.
Proposed changes that substitute manual operator actions for automatic system actuation or modify existing operator actions, including operator response times, previously reviewed and approved during the original licensing review must be evaluated under the criteria of 10 CFR 50.59.
r By letter dated March 11, 1999, the licensee provided information that satisfactorily addressed each of the above considerations.
The licensee stated that this event requires a control room operator and a non-licensed operator outside the control room to perform steps in accordance with EOP E-1.3. The licensee conservatively timed the performance of these steps through simulation by operating shift crews, and determined that all operator actions required for the switchover can be accomplished within the time and environmental constraints of this event.
The licensee provided simulator data indicating that operators demonstrated the abilityto perform the necessary actions in a timely manner.
The licensee modiTied procedures to enhance the efficiency of the switchover functions. The licensee does not require additional support personnel and/or equipment to carry out the required actions.
Operators have received and are scheduled to receive detailed knowledge-based and skilled-based training on this specific function through crew briefing, simulator training, and continuing training. The licensee ensured that information requirements have been met regarding the operator actions.
0
'Z I' The NRC staff has completed its review of the licensee's manual ECCS switchover sequence and concludes that that conversion of the DCPP ECCS suction source switchover for recirculation from manual to semi-automatic or fullyautomatic is not justified. The NRC staff concluded that the licensee's'use of specified manual operator actions to perform switchover of the ECCS suction source for injection water from the RWST to the. containment sump during post-LOCA conditions is consistent with GL S1-18, does not endanger public health and safety, and is an acceptable method for ensuring available water for post-LOCA recirculation and the concern for automatic ECCS switchover is resolved.
Principle Contributers:
J.Arildsen S. Rhow Date:
April 8, 1999
r,