ML18043B089
| ML18043B089 | |
| Person / Time | |
|---|---|
| Site: | Palisades  |
| Issue date: | 10/09/1979 |
| From: | Bixel D CONSUMERS ENERGY CO. (FORMERLY CONSUMERS POWER CO.) |
| To: | Ziemann D Office of Nuclear Reactor Regulation |
| References | |
| NUDOCS 7910160311 | |
| Download: ML18043B089 (12) | |
Text
e.
General Offices: 212 West Michigan Avenue, Jackson, Michigan 49201 * (517) 788-0550 October 9, 1979 Director, Nuclear Reactor Regulation Att:
Mr Dennis L Ziemann, Chief Operating Reactors Branch No 2 US Nuclear Regulatory Commission Washington, DC 20555 DOCKET 50-255 - LICENSE DPR PALISADES PLANT -
RESPONSE TO QUESTIONS REGARDING INTERACTION BETWEEN NON-SAFETY GRADE AND SAFETY GRADE SYSTEMS NRC Office of Inspection and Enforcement Infonnation Notice 79-22, issued Sep-tember 14, 1979, discussed a concern involving potential effects of non-safety grade equipment on safety analyses and performance of safety grade equipment.
This concern related to the effect on non-safety grade equipment of an adverse environment which might be produced by failure of a high energy line.
Constm1.ers Power Company was requested by NRC letter dated September 1 7, 1979, to evaluate the concerns discussed in I&E Information Notice 79-22 as they apply to the Palisades Plant.
Consumers Power Company was specifically requested to consider whether an tmreviewed safety concern could exist and to provide information to enable the NRC Staff to determine whether modification of License DPR-20 was required.
Consumers Power Company has evaluated the effect that adverse environments which might be created by a high energy line break might have on non-safety grade control equipment at Palisades.
The results of this evaluation are reported in the attachment to this letter as a matrix of possible effects of non-safety grade equipment :failures and explanatory notes.
For purposes of preparing the attached matrix of possible adverse effects, each non-safety grade system was arbitrarily assumed to fail in the most adverse way regardless of design features which might prevent such a failure.
No potential failures were identified which could constitute a substantial safety hazard.
Accordingly, no modification of License DPR-20 is needed as a result of the concerns discussed in I&E Information Notice 79-22.
David A Bixel Nuclear Licensing Administrator CC:
JGKeppler, USNRC
'1910160311
~
I EVALUATION OF POTENTIAL CONTROL SYSTEM INTERACTIONS DURING HIGH ENERGY PIPE BREAK EVENTS At the request of the C-E Owners Group on post-TMI Efforts, Combustion Engin-eering conducted a review of potential control systems interactions during high energy pipe break events.
C-E initially established a matrix of high energy pipe break events and control functions within CE's ability to properly evaluate.
A list of separate systems that should also be considered was developed and forward-ed to the utilities participating in this effort along with a list of control function and events under consideration by C-E.
These lists are attached.
In the time available, C-E reduced this matrix to include only those systems and events which required further evaluation.
Some of these events were further eliminated for Palisades on a plant specific basis.
A general description of the procedure used to reduce this matrix is listed below.
I.
An initial review of each postulated Control Function failure for each pipe break was completed and served as the basis for consideration.
Where a postulated failure could potentially increase the severity of a high energy pipe break, the following criteria were employed to resolve the concern:
- 1.
Is the postulated Control Function failure mode credible?
- 2.
Is the Control Function Equipment (Sensor, Cables, etc) in a
- location which could be impacted by the environment?
- 3.
Is the Control Function Equipment (Sensor, Cables, etc) quali-fied to operate properly in the postulated environment?
- 4.
Where the postulated Control Function failure is credible, could its impact potentially affect the conclusions presented in the SAR?
Considerations such as Maximum Control Function capabilities, and delayed, but proper operator action were employed in this effort.
It should be noted that the limited time available did not allow for extensive analysis.
Prudent engineering judgment was utilized to eliminate those events/
interactions which did not change the conclusions of SAR analyses.
Extensive evaluations involving the Auxiliary Feedwater system and other long term cooling mechanisms were previously performed for Palisades.
This evalua-tion is documented in Special Report No 6, Revision 3, entitled, "Analysis of Postulated High Energy Line Brea.ks Outside of Containment" and dated June 30, 1975.
A review of this study indicates that all potential interactions with these systems have already been considered.
Auxiliary feed.water is also being evaluated under Bulletins and Orders and Lessons Learned (NUREG-0578).
The potential adverse impact of high energy pipe breaks on reactor coolant pumps was considered.
Both the seized sha~ and the simultaneous three or four pump loss of flow were eliminated from consideration based on judgment that these
2-failures are not considered credible within the time frame limited by opera.tor action ( 30 minutes) due to environmental impact alone.
The impact of other potential loss of flow events (eg, one or two pump loss of flow) during high energy pipe breaks was reviewed by C-E and it was judged that the resulting rapid reactor trip was sufficient to ensure that the conclusions of the SAR would not change.
This attachment details specific event/interaction scenarios identified and defines specific short term actions which will be taken to minimize the proba-bility and impact of the postulated events.
Also, it describes the long term corrective actions which* have been tentatively identified.
C-E has not identified any changes that need to be made to emergency pro-cedures as a result of the preliminary investigation.
However, where specific failures cannot be ruled out, Consumers Power Company will review plant emergency _
procedures to confirm that the operator actions currently called for are suffic-ient to mitigate these postulated failures.
Any decision to revise emergency procedures will only be made a~er enough information is available to determine that a concern is valid and the impact of those changes on the event has been evaluated.
CONTROL FUNCTIONS AND EVENTS Control Functions Considered by CE and Utility Pressurizer Level Pressurizer Pressure PORV' s & Block Valves PCP's Rod Position (eg, RRS, CEDS) (Pretrip)
Boron Concentration (eves)
Feed.water Flow (FWCS)
Steam Flow to Turbine (Turbine C.S.)
Steam By-Pass to Condenser ( SBCS)
Steam Dumps to Atmosphere Downstream of MSIV' s Steam Dumps to Atmosphere Upstream of MSIV' s Steam Generator Blowdown Assumption of Loss of Condenser Because of
- Condensate Trans fer
- Condenser Operation Additional Control Ftmctions Considered by Utility Containment Ventilation Containment Sump Transfer Service Water Component Cooling Water Instrument Air Non ESF Power (including Fast Transfer Failures)
Extraction/Auxiliary Steam Pressure Controllers Events Considered Small Steam.line Rupture Inside Containment Small Steam.line Rupture Outside Containment Large Steamline Rupture Inside Containment Large Steam.line Rupture Outside Containment Small Feedline Rupture Inside Containment Large Large Small Small Large Feedline Rupture Inside Feedline Rupture Outside LOCA Inside Containment LOCA Outside Containment LOCA Small Feedline Rupture Outside Containment Rod Ejection Containment Containment
DESCRIPTION OF REMAINING EVENTS AND CONTROL FUNCTIONS I. Assessment of Control System Failures on Steam Line Break Event A.
Sequence of Events for Generic SAR Steam Line Break at Full Power, Inside or Outside Containment
- 1.
Double-ended steam line break occurs
- 2.
Reactor trip on low steam generator pressure
- 3.
MSIS initiates to isolate the steam generators
- 4.
RCS temperature decreases due to excessive steam removal
- 5.
Total reactivity increases due to moderator cooldown effect
- 6.
MSIVs close
- 7. Pressurizer empties
- 8.
Low pressurizer pressure initiates SIAS
- 9.
MFIVs close (Note:
for Palisades main feedwater pumps would be ramped down over 60 seconds)
- 10.
Safety injection boron reaches core
- 11.
Affected steam generator empties, terminating cooldown effect, the transient reacti:Vi ty reaches peak and decreases gradually due to boron injection
- 12.
Limited or no post-trip return-to-power
- 13.
No fuel in DNB B.
Steam Line Break with Atmospheric.Dump Valve Control System Failure
- 1.
Significant Interaction
- a.
Post-accident controlled cooldown
- 2.
Assumptions a *. Steam line break inside containment and upstream of MSIV
- b.
Atmospheric dump valves on opposite steam line open and remain open*
- c.
SAR conservatism
- 1) no operator action within 30 minutes
- The failure mechanism identified is a failure of the input signals that would cause the valve to open if operating in the automatic mode.
Although no operator action is ass1ll!led for 30 minutes prompt operator action to shut the open valve would mitigate any effects of this event.
- 3.
Sequence of Events
- a.
A steam line break inside of containment but upstream of the MSIV occurs
- b.
Reactor trip on low steam generator pressure
- c.
Atmospheric dump valves upstream of MSIV's open and remain open due to control system failure
- b.
Long term
- 1)
Assess the need of upgrading steam generator level indication to the feed.water control system
- 2)
Assess the need to install a safety grade high steam generator level alarm II.
Assessment of Impact of. Control System Failures on Feed Line Break Event and Cont:rol: Rod Ejection A.
SAR Feed Line Break
- 1.
Sequence of Events
- a.
Main feed line break occurs downstream of reverse flow check valve, discharging main feed and steam generator fluid
- b.
RCS heatup due to loss of subcooled feed flow
- c.
Reactor trip occurs on steam generator low water level or high pressurizer pressure.
Turbine trip occurs on reactor trip
- d.
Rapid RCS heatup and pressurization due loss o*f heat transfer as the ruptured steam generator empties
- e.
Depressurization of the ruptured steam generator initiates MSIS and isolates the intact generator
- f.
RCS pressurization terminates with opening of primary relief/safety valves and decreasing core heat flux
- g.
RCS cool down begins, controlled by the main steam safety valves
- h.
Auxiliary feed is initiated automatically or by operator action B.
Feed Line Break with Feedwater Control Failure
- 1.
Significant Interaction Effects
- a..overfilling of the steam generator( s) causing potential structural problems
- 2.
Assumptions
- a.
Small feed line break inside containment
- b.
Feed control in automatic mode
- c.
Adverse environment causes steam generator level indication to fail low which causes the feed control system to increase feed flow above the steam now
- d.
No operator action for 30 minutes
- 3.
Sequence of Events
- a.
A small feed line break occurs inside containment
- b.
Main feed spills from break
- c.
Steam generator level instrument fails indicating low and causes increased feed flow in excess of steam flow
- d.
Stei:µn generator begins to fill causing increased moisture content of steam
- e. If no operator action occurs undefined structural problems could result
- f. It should be emphasized that this event can be prevented by prompt operator action.
Safety grade level instrumentation exists to compare to control grade instruments.
The feed system can then be controlled manually 3
- d.
If no operator action takes place there would be the potential for dry-out and depressurization of both steam generators
- e.
Failure to shut atmospheric dump valves could inhibit a control-led plant cooldown by limiting the ability of the auxiliary feed pumps to deliver to the steam generator(s)
- 4.
Actions
- a.
Short term
- 1) operate atmospheric dump valves in manual mode (this option is tmacceptable as it would increase the probability of steam line safety valve actuation), or
- 2) ensure operator shuts atmospheric dump valves on steam line until control is assured
- b.
Long term
- 1) continue investigation to determine if this failure mechanism is plausible, or
- 2) upgrade atmospheric dump valve control system to withstand the adverse environment, if required C.
Steam Line Break. with Feed.water Flow Control System Failure
- 1.
Significant Interaction Effects
- a.
Steam generator filling - causing potential piping structural problems
- 2.
Assumptions
- a.
Small steam line break inside containment that does not cause an immediate reactor trip
- b.
Feed.water flow exceeds steam flow due to failure of steam generator level instrument, indicating flow
- c.
SAR conservatism
- 1) no operator action within 30 minutes
- 3.
Sequence of Events
- a.
Small steam line break occurs which does not cause an immediate reactor trip
- b.
Steam generator level instrument fails, causing an increase of feed.water flow in excess of steam flow
- c.
Steam generator begins to fill causing increased moisture content of steam
- d.
If no operator action occurs tmdefined piping structural problems could result
- e. It should be emphasized that this event can be prevented by prompt operator action.
Safety grade steam generator level instrumenta-tion exists, enabling comparison with control grade level instru-ments of the feed system.
- 4.
Action
- a.
Short term l) Ensure the operator is aware of this potential interaction so that he ma\\Y" take prompt corrective action should it occur 2
- 4.
Actions
- a.
Short term
- 1) ensure the operator is aware of the potential failure mode so that he may take prompt corrective action, should it occur
- b.
- Wng term
- 1) assess the need of upgrading steam generator level indication to the feedwater control system
- 2)
~sess the need to install safety grade high steam generator level alarm C.
Feed Line Break with Atmospheric Steam Dump Control Failure
- 1.
Significant Interaction Effects
- a.
Controlled plant cooldown
- 2.
Assumptions
- a.
Feed line break inside containment and downstream of reverse flow check valve
- b.
Adverse environment impacts the atmospheric steam dump control on unaffected steam generator causing an uncontrolled steam release upstream of the MSIV' s *
- c.
No operator action until 30 minutes
- The failure mechanism identified is a failure of the input signals that would cause the valve to open if operating in the automatic mode.
Although no operator action is assumed for 30 minutes, prompt operator action to shut the open valve would mitigate any effects of this event.
- 3.
Sequence of Events
- a.
Feed line break occurs inside of containment downstream of check valve
- b.
Steam generator fluid and/or main feed spill from break
- c.
Reactor trip occurs on steam generator low water level or high pressurizer pressure.
Turbine trip occurs on reactor trip
- d.
Steam* generator pressure increases following turbine trip
- e.
Environment could cause atmospheric dump valves upstream of MSIV in unaffected steam generator to open and remain open
- f.
If no operator action takes place there would be a potential for dry out and depressurization of both steam generators
- g.
Depressurization of both steam generators ma;y limit the ability of the auxiliary feed pumps to deliver to the steam generator( s)
- 4.
Actions
- a.
Short term
- 1)
Operate atmospheric steam dump valves in the manual mode (this option is unacceptable as it would increase the probability of steam line safety valve actuation), or
- 2)
Ensure that the operator is aware of this potential interaction so that prompt corrective action can be taken 4
J
- b.
Long term
- 1)
Continue investigation to determine if this failure mechanism is plausible, or
- 2)
Upgrade atmospheric dump valve control system environ-mental qualification, if required III. Potential Effect of Reactor Regulating System During High Energy Pipe Break Events A.
Control Rod Position MaJ.functions due to Steam and Feedline Breaks and Control Rod Ejection
- 1. Significant interaction effect:
- a.
Potentially higher reactor power levels prior to reactor trip than presently analyzed
- 2.
Assumptions
- a.
Small high energy pipe break inside containment
- b.
Reactor regulating system in automatic mode
- c.
Adverse environment results in a low indicated power level from the ex-core sensor input to the Reactor Regulating System causing control rods to be withdrawn
- 3.
Sequence of Events
- a.
High energy pipe break inside containment of a small enough size where immediate reactor t*rip does not occur
- b.
Control grade ex-core sensor indication fails low due to adverse environmental impact
- c.
Reactor regulating system causes control rods to be withdrawn
- d.
Reactor power exceeds the power previotisly assumed during the transient
- e.
R~actor trip occurs due to high* energy pipe break at conditions not considered in present analyses
- 4. *Actions
- a.
Short term
- 1)
Place the control rod drive system in manual
- 2)
Modify emergency procedures to state that the operator should not take any control action based upon reactor
- power as measured by the control grade ex-core detectors during high energy pipe breaks
- b.
Long term
- 1)
- 2)
Evaluate the consequences of small high energy pipe breaks in containment with control rod withdrawal, if required If required, upgrade the environmental qualification level of the control grade excore detector system B.
Small Break LOCA With Reactor Regulating System Malfunction
- 1. Significant interaction effects
- a.
Potential exists for increasing power.
This would cause pressure to remain above low pressurizer pressure trip for a longer period than previously assumed 5
- 2.
Assumptions
- a.
Small break LOCA inside containment
- b.
Reactor regulating system in automatic mode
- c.
Adverse environment impacts reactor regulating system or related sensor resulting in consequential failure
- d.
Control system causes control rods to with draw
- e.
Standard LOCA licensing assumptions
- 3.
Sequence of events
- a.
Small break LOCA occurs inside containment
- b.
Reactor regulating system in automatic mode
- c.
Adverse environment caused by rupture potentially causes excore power indication to indicate low power level
- d.
Should control rods begin to withdrawn, the magnitude of the overpower excursion prior to scram would be increased.
This could produce a higher primary system pressure which would then delizy reactor trip and SIAS and result in higher*
peak clad temperatures
- 4.
Action
- a.
Short te:nn
- 1) Place the control element drive system in manual
- 2)
Modify emergency procedures to state that the operator should not take any control action based upon reactor power as measured by the control grade excore detectors during a LOCA
- b.
Long term
- 1) Evaluate the consequences of a small break LOCA with control rod withdrawal, and
- 2) If required upgrade the environmental qualification level of the control grade excore instrumentation.
6
Pipe Break Control Function Control Rod Position Feedwater Flow Steam Dump Upstream of MSIV MATRIX OF EVENTS/CONTROLS FUNCTIONS FOR FURTHER CONSIDERATION & ACTION SLB FWLB Control Rod Ejection SBLOCA x
x x
x x
x x
I I
Conclusion Based on the review of potential control system interactions during high energy pipe break events, Consumers Power Company has not been able to identify any interactions that could constitute a substantial safety hazard.
The concerns identified in Inspection and Enforcement Information Notice 79-22 are addressed in this attachment with all short term actions to be addressed prior to the start of Cycle 4 (scheduled for November, 1979). Additional analyses will be completed by mid-1980 to evaluate what long term actions are required (this attachment pre-sents possible long term actions).
No modifications to License DPR-20 are required.
CONSUMERS POWER COMPANY
/(fl'.' d!J
(** k~'J 1/U<; I fit RB DeWitt, Vice President Nuclear Operations ff~x///i~dJ Dorothy/ff Bartkus, Notary Public Jackson County
~ commission expires March 26, 1983 Sworn and subscribed to before me this 9th day of October, 1979.
7