ML19209B708

Forwards Response to NRC 790917 Request for Addl Info Re Environ Interaction Issue.Continued Facility Operation Justified

ML19209B708
Person / Time
Site:	Farley
Issue date:	10/05/1979
From:	Clayton F ALABAMA POWER CO.
To:	Harold Denton Office of Nuclear Reactor Regulation
References
NUDOCS 7910100343
Download: ML19209B708 (12)

Text

,

• Alabama Power Company 600 North 18tn Street Post Office Box 264I Birmingnam. Alabama 35291 Telephone 205 323-5341 bboWc',' ,hfint AlabamaPower b

the sournem electnc system October 5, 1979 Mr. Harold R. Denton, Director Office of Nuclear Reactor Regulation U. S. Nuclear Regulatory Commission Washington, D. C. 20555

Dear Mr. Denton:

This is in response to your letter of September 17, 1979 concerning potential environmental interaction between non-safety grade systems and safety grade systems. This subject was further addressed in IE Information Notice 79-22, issued September 14, 1979.

Alabama Power Company, in conjunction with Bechtel Power Corporation Southern Company Services and Westinghouse Electric Corporation, has re-viewed for Plant Farley-Unit i the specific non-safety grade systems listed in Table 1 of tne Enclosure to this letter for potential environmental inter-actions. The basic conclusion of this re7iew is that these potential en-vironmental interactions do not constitute an undue risk to the health and safety of the public.

The Nuclear Safety Analysis Center (NSAC) has determined the probability of severe consequences from one of these high energy line breaks (for a typical nu lear plant) ranges from 2 x 10-6 per rea:. tor year to less than 10-7 per reactor year.

The information contained in this transmittal, including the improbability of the postulated scenarios as they apply to the Farley Nuclear Plant, the acceptability of the consequences and commitments made concerning this issue, justifies continued operation of the Farley Nuclear Plant.

I certify that the information contained herein is true and correct to the best of my knowledge, information and belief.

Yours truly,

~ . . . . .

_U _.L J % . ,~

h FLCj r/TNE/imnb L Clayton, Jr.

cc: See Attached g (\

\

Sworn to and subscribed before me this_ day of October, 1979.

1135 320 7910010 m :3f3 y

ENCLOSURE RESPONSE TO NRC REQUEST FOR ADDITIONAL INFORMATION ON THE ENVIRONMENTAL INTERACTI0tl ISSUE w

Background:

On September 18, 1979 Westinghouse presented to the NRC Staff a sumary of the investigation that had been conducted which led to the identification of four (4) potential interaction scenarios where the affect of adverse environments, result-ing from high energy line breaks, on control systems could lead to consequences more limiting than the results presented in the Safety Analysis Report. Table 1 sumarizes the scope of the investigation. Tha scope includes systems that could potentially affect core reactivity or primary or secondary inventory.

The seven (7) c:ntr:1 systems include control systems directly addressed in the cur?ent Westinghouse functional requirements. The seven (7) accidents considered encompass postulated High Energy Line Break (HELB) environments, including all break locations and a range of break sizes. Of the forty-nine (49) combinations of control system and accident environment investigatedfifteen (15) interaction scear.rios, denoted by an X in Table 1, were identified which could result in consequences more severe than reported in the Safety Analysis Reports. The fifteen (15) interactions identified are bounded by the four (4) interactions discussed in IE Information Notice 79-22. The following section discusses the applicability of these postulated scenarios with respect to Farley Nuclear Plant-Unit 1.

Probability of Postulated Interactions:

Implicit in the four (4) potential interaction scenarios identified by Westinghouse are worst case assumptions concerning the break size and location, and the type and extent of potential consequential failures in centrol systems induced by the adverse environment. These assumptions are therefore in addition to the already conservative set of assumptions ascribed to the analysis of the Design Basis Events reported in the Safety Analysis Report. It follows that

_ these scenarios represent a significantly less probable subset of the Design Basis Events that are dependent on the occurrence of additional events, each hav-ing an associated uncertainty of cccurring. The attachments define, for each of the scenarios considered as applicable to the Farley Nuclear Plant, the conserv-ative assumptions already contained in tne Design Basis Event analysis reported in the Safety Analysis Report and the additional conservative assumptions to be made to derive the postulated interaction scenario.

As can be seen from the attachments, for each of the scenarios consider d, the improbability of all the additional sets of assumed conditions occurring simul-taneously, over and above the already low probability of the Design Basis Event itself, leads to the conclusion that continued operatio'n of the Farley Nuclear Plant can be justified.

Since the electrical design of control and protection systems conforms to the separation requirements of IEEE-279, the only interaction mechanisms identified in the above scenarios result from conservatively assuming an adverse environment at the location of the control systems and the consequential equipment failure in the worst direction.

hbb b h

i / _ . . . ..

Consequences of Postulated !nteratticns:

In lieu of performing a plant specific analysis in an effort to address each of the potential postulated interactions involving a feedline break, Westinghouse has referred to bounding accident analyses. that have been submitted to the NRC in WCAP-9600, Report on Small Break Accidents for Westinghouse NSSS. Section 4.2 of the report provides transient results following a total loss of main and auxiliary feedwater. Sensitivity studies as a function of time of auxiliary feedwater initiation and opening of the pressurizer power operated relief valves are presented folicwing the initial transient. Calculations have been performed to show that the consequences following the control interactiom scenarios for the steam gererator PORV control system, main feedwater control system and pressurizer

_ PORV con:rol system are in fact bourded by the analyses in WCAP-9600. For these accident scenarios, the calculations indicated that the operator need not take corrective action to mitigate the consequences for at least thirty (30) minutes following initiation of the event.

A typical bounding analysis has been performed to address the rod control system interaction scenario. The results of the analysis indicate that no fuei damage occurs and the consequences are within the assumptions made in the Safety Analysis Reports.

I135 322

1 '

}

s EONTROL STEAM M PRESSURIZER GENERATOR STEAM REACTOR PRESSURE LEVEL FEEDWATER PRESSURE DUMP TURBINE ACCIDENT CONTROL CONTROL CONTROL CONTROL CONTROL SYSTEM CONTROL Small Steamline Rupture X X X Large Steamline Rupture X X Small Feedline Rupture X X X X Large Feedline Rupture X X X Small LOCA X X X Large LOCA Rod Ejection TABLE 1 Z PROTECTION SYSTEM CONTROL SYSTEM POTENTIAL ENVIRONMENTAL INTERACTION u

t_r. I t

u X -

P01cNTIAL IflTERACTION IDENTIFIED TilAT COULD DEGRADE ACCIDENT AFALYSIS e rv *

'^ ~

NO SUCli INTERACTION MECilANISM IDENTIFIED a

[. I ATTACHMEilT 1 MAlft FEEDWATER C0flTROL SYSTEM

1. Sumary of Postulated Sce1ario Following a small feedline ruature the main feedwater control system mal-functions in such a manner that the liquid mass in the intact steam generators is less than for the worst case presented in Safety Analysis Reports. The reduced secondary liquid mass at time of automatic reactor trip results in a core severe reactor coolant system heat up following reactor trip.

2. Accident Consecuences A de ailed review of tne rain feedwater control system showed that the postulated accident scenario for this case does not result in a liquid mass in the steam generator less conservative than the worst case presented in the FSAR. Therefore, no further action is required.

t ""

1135 324

L- / -

ATTACHMENT 2 STEAM GENERATOR PORV CONTROL SYSTEM

1. Summary of Postulated Scenario Following a feedline rupture outside containment in the auxiliary building, the steam generator PORV's are assumed to exhibit a conse-quential failure due to an adverse environment. Failure of the PORV's in the open position results in the depressurization of multiple steam generators, two of which are the source of steam for the turbine-driven auxiliary feedwater pump. Eventually, the turbine-driven auxiliary feedwa ter pump will not be capacle of deliverirg auxiliary feedwater to the intact steam generators.

- A ootential exisu that inadequate auxiliary feedwater will be injected into the intact steam generators until the operator takes corrective action to isolate the auxiliary flow spilling e ' the rupture.

2. Proba bili ty Assumotions Affectino Event Probability and Consequences:

a. Standard Safety Analysis Report Assumptions Concerning Feedline Break Conservative initial assumptions -

. . . Appendix K decay heat model .

... Engineered safeguards power plus calorimetric error.

... Programmed RCS temperature plus control deadband and instrument errors.

... Initial conservative S/G inventory.

. . . Conservative core physics.

-. Conservative accident assumptions -

... Break (all sizes) in Safety Class 2 feedline piping.

... Maximum adverse environmental errors for protection ins trumenta tio n.

... Worst single active failure (loss of one motor-driven auxiliary feed pump) .

b. Discussion of FNP Steam Generator PORY Control System One PORV is p:ovided on each main steam line upstream of the MSIV's outside of containment. (See FSAR Figure 10.3-1, sheet 1) . The valves are air-operated, are of fail closed design, and will close on loss of the required air or electrical supply.

The only components in tne PORV control circuit which may be exposed to a steam /feedline break environment outside the containment are the 1135 325

L . l Attachment 2 Page 2 ,

required electrical cabling, the air supply piping, and the valves themselves. Other control components are isolated from the postulated environment by design.

The control cabling can safely withstand the ptstulated environment and the cables are physically routed such that a break associated with one steam generator will not adversely affect the cables routed to PORV's on the other genera tors.

The air supply header, which provides the air suppiy required to open the PORV's will be exposed to the break environme-t. Failure of the air supply header will resolt in closure of the PORV's.

~

As cutlined in Ac:endix 3K, separation walls and/or physical separation has been provided to protect the Class 2 portions of the main steam and feedwater piping associated with the steam generator from t eing directly affected from breaks associated with the other generators. Thus, jet impingement on more than one PORV has been eliminated by design.

The only control component whose performance in the postulated environ-ment can not be fully defined is the valve positioner, which is mounted on the PORV, and which, in conjunction with a control signal, controls the opening air supply to the PORV. It could be postulated that if air is available, and the positioner fails in some adverse direction, the PORV's could be opened. It is extremely unlikely that the PORV's will fail in an

_ adverse direction as they are designed to fail safe and will close on loss of air or electrical supply. Further design evaluations are being con-ducted to determine appropriate steps to eliminate this concern.

c. Additional Assumptions Required for This Scenario

... Break must occur outside containment between the penetration and feedline check valve. (

Reference:

See FSAR Figure 3K 4-4)

... Adverse environment resulting from the rupture can impact the steam generator PORV control systems associated with the ruptured loop and the intact loops. Control systems associated with PORV's cor.3ists of pressure transmitters, air-operated valves, and inter-connected calbe. The only components which could potentially be affected by the adverse environment are the valve positioners on each pressure-operated relief valve.

...The single active failure is a motor-driven auxiliary feed pump.

The loss of a turbine-driven auxiliary feed pump as the single active failure or no active failure would invalidate the postulated scenario.

(

Reference:

See FSAR Section 6.5)

...Due to the adverse environment, the steam generator PORV control system initiates a spurious signal to open the PORV(s). Should the control system continue to operate within specification or initiate a spurious signal to close the PORV(s) the scenario is invalidated.

...PORV on steam generators supplying steam to terbine-driven auxiliary feed pump is assumed to open as a result of spurious signal. If this PORV is not affected or fails closed, the scenario is invalidated.

11E 326

L I ..

Attachment 2 Page 3

3. Accident Cansequences Section 4.2 of WCAP-9600, Report on Small Break Accidents for Westinghouse NSSS Systems, describes transient analyses for postulated loss of all main and auxiliary feedwater (no. pipe rupture). The results indicate that the op-erator has at least 4,000 seconds following the loss of all feedwater to re-initiate auxiliary feedvater flow to the steam generators before the core begins uncovering.

The interaction scenario postulated above is similar to that presented in

~

Section 4.2 of WCA?-9500. The only additional assumption rade is that a feedline rupture Occurs outside containment between the containment gene-tration and the feedline check valve. Conservatively assuming that all liquid inventory in the steam generator associated with the ruptured feedline is lost via the rupture without removing any heat (i.e., liquid blowdown), calculations have shown that the heat removal capability of the liquid inventory blowdown requires operator action 1200 seconds earlier than reported in WCAP-9600. Thus, if a feedline rupture is assumed coincident with the analyses performed in WCAP-9600 the operator still has at least 2800 second; to take corrective action to increase auxiliary feedwater to the intact s team r,enerators.

~

4. Solution The operator will be alerted to the possibility of the steam generator PORV's failing in the open position following a secondary high energy line rupture outside containment in the auxiliary building and the operator will.be cautioned that the steam-driven turbine auxiliary feedwater pump could potentially be lost due to loss of steam supply. The operator can determine if the turbine-driven pump is running by a speed indicator on the Main Control Board.

If the turbine-driven pump fails, the operator must rely upon the motor-driven auxiliary feedwater pumps to supply the minimum auxiliary feedwater requirements following a secondary line rupture.

Other than the caution to the operator discussed above, the actions that must be taken by the operator that are currently delineated in emergency operating procedures continue to be applicable. No additional actions are required to mitigate the consequences of the accident.

1135 327

ATTACHMEfiT III PRESSURIZER PORV C0flTROL SYSTEM

l. Summary of Postulated Scenario Following a feedline rupture inside containment, the pressurizer PORV control system malfunctions in such a manner that the power-operated relief valves fail in the open position. Thus in addition to a feedline rupture between the steam generator nozzle and the containment penetration, a breach of the reactor coolant system boundary has occurred in the pressurizer vapce space.

2. Probability Assumotions Affecting Event Probability and Consequences

a. Standard Safety Analysis Report Assumptions Concerning Feedline Break Conservative initial assumptions - .

. . . Appendix K decay heat model .

... Engineered safeguards power plus calorimetric error.

... Programmed RCS temperature plus control deadband and

' ~

instrument errors.

... Initial conservative S/G inventory.

.. . Conservative core physics.

Conservative accident assumptions -

... Break (all sizes) in Safety Class 2 feedline piping.

... Maximum adverse environmental errors for protective ins trumenta tion.

... Worst single active failure (loss of any one auxiliary feed pump).

b. Additional Assumptions Required for This Scenario

... Break must occur inside the containment between the steam generator nozzle and the contair. ment penetration. (

Reference:

FSAR Figure 3.6-3, sheets 1 and 2)

... Double ended break leads to limiting consequences. Smaller breaks permit longer operator action times.

... Adverse environment resulting from the break can impact the pressurizer power operated relief valve control system. (

Reference:

FSAR Section 5.5.13)

...Due to the adverse environment the pressurizer PORV control system initiates a spurious signal to open the PORV(s). The system consists of pressure transmitters, solenoid valves, air-operated valves, and i135 328

L- / . . __

Attachment 3 Page 2 associated electrical cables and connectors. The only component failure due to the adverse enviro ment that would cause the PORV's to open or prevent the PORV's from closing is the solenoid valves on the PORV's.

...Should the PORV's fail to the preset safe position (i.e., closed) the scenario is invalidated.

3. Accident Consequences

_ Section 4.2 of WCAP-EO, Report on Small Break Accidents for Westinghouse ilSSS Systems, descri es transient analyses for a postulated loss of all main and auxiliary feedwater (no pipe rupture). The results indicate that, in tke event that the operator cannot restore auxiliary feedwater to the steam generators, the operator is required to open the pressurizer PORV's within 2,500 seconds to maintain adequate core coolant inventory.

The interaction scenario postulated above is similar to that presented in Section 4.2 of WCAP-9600. The additional assumptions made are the following:

a. A feedline rupture is assumed to occur between the steam generatJr nozzle and the containment penetration.

~

b. Auxiliary feedwater is injected into the intact steam generator following the feedline rupture.

Conservatively assur.ing that all liquid inventory in the stean't generator associated with the ruptured feedline is lost via the rupture without removing any heat (i.e., liquid blowdown), the loss of heat sink due to the liquid in-ventory blowdown of the ruptured steam generator is more than counterbalanced by the auxiliary feedwater being injected into the intact steam generators following reactor trip. Therefore, the result:; of the analyses present in WCAP-9600, Section 4.2, which illustrates that the operator is not required to take corrective action for at least 2,500 seconds following the loss of feedwater, also applies to this scenario.

4. Solution The operator will be alerted to the possibility of the pressurizer PORV's failing in the open position following a high energy line rupture inside contai nment. Af ter identifying a high energy line rupture inside contain-ment the operator has instructions to close the block valves in the relief lines of the pressurizer PORV's, Closure of the block valves will ensure that a secondary high energy line rupture inside containment will not resuit in a break of the primary pressure boundary integrity. Emergency operating procedures instruct the operator to close the pressurizer PORV's af ter a high energy line rupture is diagnosed.

After the operator closes the PORV relief line block valves, no additional actions are required to mitigate the consequences of-this scenario.

Ilh 329

L I . _

ATTACHMENT IV ROD CONTROL SYSTEM

l. Summary of Postulated Scenario Following an intermediate steamline rupture inside containment, the auto-matic rod cr 1 trol system exhibits a consequential failure due to an adverse environment which causes the control rods to begin stepping out prior to receipt of a reactor trip signal on overpower delta-T. This scenario results in a lower DflB ratio than presently presented in Safety Analysis repsets.

2. Probability Assumotions Affectinc Event Probability and Consequences

a. Standard Safety Analysis Report Assumptions Concerning Steamline Break -

Conservative initial assumptions -

... Nominal rated power plus calorimetric error.

~

...Progra :med RCS temperature plus control deadband and ins tru er.: errors.

... Conservative end of life core physics.

Conservative accident assumptions -

... Break (all sizes) in Safety Class 2 steamline piping.

... Maximum adverse environmental errors for protective ins trumen ta tion.

... Worst single active failure (loss of any one Safety Injection pump).

b. Additional Assumptions Required for This Scenario -

... Break must occur inside the containment between the steam generator nozzle and the containment penetration.

... Intermediate steamline breaks (0.1 to 0.25 sq. ft. per loop) at power levels from 70 to 100 percent. Other break sizes and power levels invalidate the scenario.

...The Nuclear Instrumentation Systen (NIS) consists of excore neutron detectors, connectors, and cabling. The components that are exposed to the adverse environment are the excore detectors, the connectors, and cable. The only component that could potentially be affected by the adverse environment was determined to be the excore detectors.

Should the NIS equipment not be affected until af ter reactor trip (i.e., later than 2 minutes) the scenario is invalidated.

1135 330

t /

Attachment 4 Page 2

...Due to the adverse environment the NIS system initiates a spurious low power sigr.a1 without causing a reactor trip on negative flux ra te . Should the NIS continue to operate within specification, initiate a spurious high power signal or cause a reactor trip on negative power rate the scenario is invalicated.

3. Accident Consecuences A typical bcur.dirg aralysis of the intermediate steanline rupture was performed to calculate the extent of fuel damage due to rod control system withdrawal prior to reactor trip. Based upon the reduction in radial peaking factor with burn-up and conservative end-of-life physics parameters, no fuel damage was calculated to occur following the intermediate steamline rupture with a consequential rod control system failure.

4. Solution As discussed above, typical bounding analysis of an intermediate steamline rupture inside contaircent which results in control rod withdrawal due to a control system er.vironmental interaction prior to reactor trip was analyzed.

The resuits of the analysis indicated that no fuel damage occurred, which is consistent with the conclusions made in the Safety Analysis Reports.

1I35 331

.