ML19209B768
| ML19209B768 | |
| Person / Time | |
|---|---|
| Site: | Calvert Cliffs  |
| Issue date: | 10/07/1979 |
| From: | Lundvall A BALTIMORE GAS & ELECTRIC CO. |
| To: | Harold Denton Office of Nuclear Reactor Regulation |
| References | |
| NUDOCS 7910100420 | |
| Download: ML19209B768 (15) | |
Text
J e
'3ALTI MO RE GAS AN D ELECTRIC CO M PANY GAS AN D ELECTRIC BUILDING B ALTI M O R E. M A RYLAN D 213 03 October 7,1970 ARTHun E.LUNDVALL,Jm.
vice peas es=t Sum
- Mr. Harold R. Denton, Director Office o' Nuclear Reactor Regulation U. S. Nuclear Reculatory Commission
'Jashington, D. C.
20555
Subject:
Calvert Cliffs Nuclear Power Plant Units Nos. 1 & 2, Dockets Nos. 50-317 & 50-318 NRC IE Infor ation Notice No. 70-22
Dear Mr. Denton:
This letter responds to your September 17, 1979, letter on the subject of a " potential unrevieved safety question on interaction between non-safety grade systems and safety grade systems". This pote.atial problem was further addressed in IE Information Notice 79-22, issued September lk, 1979 In conjunction with Combustion Engineering, Inc. and Bechtel Power Corporation, we have reviewed the specific non-safety grade systems listed in IE Information Notice 79-22, as well as others, for potential interactions that could constitute a substantial safety hazard.
'Je have not been able to identify such an interaction. '4hile, in some cases, we have identified potential variations from the FSAR licensing bases, the basic conclusion of the FSAR, that these events do not constitute an undue.
risk to the health and safety of the public, remains unchanced.
The Nuclear Safety Analysis Center (NSAC) has determined that the probability of severe consequences resulting from a high energy line break is typically very lov.
(Reference NSAC letter to be subnitted to the NRC titled Probablistic Analysis of I&E Information Notice 79-22 Scenarios.)
Further, such breaks ara more likely to be small cracks rather than abrupt failures so that the resulting adverse environment builds up over a period of time, providing the potential for detection orior to connonent failure.
Additionally, our reviev recornized the difference between a demonstrated deficiency (e.g. determination that a control component would operate in a fashion not within the limits cresented in the safety analysis ) and a notential unreviewed question. As creviously stated, we have not identified events that vould cha.nge the conclusions of the FSAR that these events any do not constitute an undue risk to the health and safety of the public.
As you must recogniz?, our investigation within the limited time frane required by your Settember 17 letter must be considered preliminary and could not include detailed evaluatic,.is. Based on our preliminary investigation we are cenvinced that continued operation is warranted. A sucnary of our investigaticn is provided in enclosure 1.
Our :.ong term actions to resolve this issue are continuing.
'Je are villing to meet with -
you to work out an anpropriate schedule.
y N
1139 050.,oo M
s Mr. H. R. Denton October ?
179 As a result of the Three Mile Inland accident, there are a significant number of industry, governmental and regulatory investigations under way examining the licensing bases and the operating procedures of nuclear generating facilities. These investigations are already identifying areas where studies may result in the consideration of new or revised events as part of the bases for assuring the continued safety of nuclear plants. NUREG-0578 outlines several such events and suggests remedies.
NUREG-0578 requirements for analyses of potential safety problems envision the kinds of scenarios identified by Westinghouse and made the s'bject of IE Infor=ation Notice 79-22.
Section 3.2, page 17 states in
- part,
"...The NRC requirements for non-safety systems are generally limited to assuring that they do not adversely affect the operation of safety systems... "
Further, on page A h5 of NUREG-0578.
" Consequential failures shall also be considered..."
We therefore believe that the scope of the action required by IE Information Notice 79-22 is consistent with the requirements of NURM-0578 and should therefore be integrated with the planned response sequence for compliance with the NUREG.
B11TIMORE GAS A' ELECTP C MP TY
)
Iw 3y :
s
1Ee h ehid6nt')
Supply
/
STATE OF MARYLAND:
"'O WIT:
CITY CF BALTIMORE:
Mr. A. E. Lundvall, Jr. being duly sworn states that he is Vice President of the Baltinore Gas and Electric Comeany, a corooration of the State of Maryland; that he executed the foregoing response for the purnoses therein set forth; that the statements nada in said response are true and correct to the best of his knowledge, information and belief; and that he
~as authorized to execute the response on 'cehalf of said cornoration.
WITNESS my hand and Notarial Seal.
7
,y My Commission expires:
</
1139 '51
Mr. H. R. Denton October 7, 1979 cc:
J. A. Biddison, Esquire G. F. Trowbridge, Esquire Mr. E. L. Conner, Jr. - NRC Mr. P. W. Txuse - CE Director of Reactor Operations Insnection Office of Inspection and Enforcese'It Washington, D. C.
20555 1139 'S2
Resnonse to TE Inforention !!otice 79-22 Ebelosure 1 Our preliminary evaluation indicates that the four Westinghouse scenarios do not result in my significant safety hazard at Calvert Cliffs.
A su= mary of this evaluation is provided in attachments 1 through h to this enclosure.
Conbustion Engineering conducted a review of potential control gystem interactions during high energy pipe break events. CE initially established a matrix of high energy pipe break events and control functions.
This matrix was then reduced to include only those systems and events which required f2rther evaluation. It should be noted that the limited time available did not allow for extensive analysis. Prudent engineering judge-ment was utilized to eliminate those events interactions which did not change th's conclusion of the SAR analysis.
The CE review idantified eight potential interactions in addition to the four Westinghousc scenarios. Six of the eight additional potential interactions are sim3* ar to the four Westinghouse scenarios. A discussion of those six interactions is not included in this summary because the discuasion and conclusions provided for the Westinghouse scenarios are pertinent. l'hese six interactions are:
- 1) Effect of steam line break in containment on pressurizer PORY -
similar to effect of feedline break on pressurizer PORV.
- 2) Effect of feedvater line br eak in containment on CEA control system - similar to effact of steam line break on CEA cetrol syste=.
- 3).Effect of small LOCA on CEA control system - similar to effect of steam line break on CEA control system.
h) Effect of small steam line break inside containment on feedvater flow control system - similar to effect of feedvater line break effect on feedvatar flow control system.
- 5) Effect of feedvater line break outside of containment on atmos-pheric steam dump control system - similar to steam line break effect on atmospheric cteam du=p control system.
- 6) Effect of CEA mechanism housing break due to CEA ejection on the feedvater flow control system - similar to effect of feedvater line break effect on feedvater flow control system.
A discussion of the re=aining two interactions ic provided in attachments 5 and 6 to this enclosure.
1139 '53
. Attach =ent 1 VESTINGHOUSE SCENARIO '70. 1 STEAM GE'TERATOR PORV CONTFOL SYSTD4 POS'IULATED BREAK Feedvater rupture in the main or auxiliary feedvater line in the auxiliary building between the containment penetration and the syste=s check valves.
WETINGHOUSE IDENTIFIED POTENTIAL PROBL24 AREAS 1.
Multiple steam generator blevdown in an uncontrolled m ner due to environmental impact on the steam generator PORV control system.
2.
Ioss of steam for the turbine driven auxiliary feedvater pumps due to multiple steam generator blevdown.
3.
Resulting primary hot leg boiling following a feedvater line rupture.
CALVERT CLIFFS NUCLEAR POWER PLANT DESIGN 1.
Individual main feedvater and auxiliary feedvater lines are provided to the steam generators.
+
2.
Feedvater line(s) check valve (s) are located inside contain=ent.
3.
The Westinghouse cteam generator PORY is costarable to the Calvert Cliffs at=ospherie du=p valves CV-3937 & 3938 vhich are located in auxiliary building.
h.
The main feedvater lines inside the auxiliary building are encapsulated.
5 Ms.in feedvater system and at=ospherie du=p valves are not required to place the plant in a safe shutdown condition.
DISCUSSION A postulated main feedvater break inside the auxiliary building is not un-controllable since the blevdown from either steam generator into the auxiliary building is prevented due to the feedvater line(s) check valve (s) located inside contain=ent. In addition, the =ain feedvater pu=ps which are located in the turbine building can be stopped to ter=inate the feedvater spillage.
In the event of a postulated =ain feedvater break inside the auxiliary building, the main feedvater line encapsulation vould direct the subsequenu feedvater blevdown to the turbine building area and the =ain steam penetration room located in the auxiliary building. The main steam penetration room is provided with a seven foot - six inch vent stack for direct venting of the room environment to thu outside atmosphere. The main steam atmospheric dump valves are located in a roca directly above the main steam penetration 1139 '54
.3-room physically separated from the rupture area. The atmospheric du=p valves are separately encapsulated to protect the room in which they are installed. The installation is such that the area within the encapsulation is exposed to the same environ = ental conditions as the =ain steam penetration room. The at=ospheric dump valve control components located within the encapsulated area are the valve positioner, limit switches and solenoid valve. The valve positioner is a totally rechanical device which is quslified for the postulated ambient temperature conditions. The valve limit switches are not intrrlocked with the atmospheric du=p valve controls other than to provide indication of the open er close valve pcsition, such that the device failure vould not result in automatic mistositioning of the at=ospheric du=p valve. The at=ospherie du=n valve is normally closed with its associated solenoid valve nor= ally de-energi::ed. An environmental condition which would da= age the solenoid valve vould render the valve incapable of the quick opening mode of ve.lve operation. The relative short section of electrical cabling associated with the solenoid valve and limit sivtches located within the encapsulated area is LOCA envircrarentally qualified. There are no additional electrical power sources located vithin the encapsulated area and all air or electrical encapsulation penetrations are sealed. Subsequently, the atmospheric du=p valve vould re=ain closed unless required to open by the steam dump contro~. systems. The steam dump control components are located in the r.ain control room and on the remote shutdown panel isolated from the postulated break and subsequent environmental condition. The Tave and quick opening input to the steam du=n control system is provided from the reactor regulating system. Although the cabling from the Th and Te instruments is environ =entally qualified, the connections at those instr':ments have yet. to be qualified. As an extension of the Westinghouse scenario, it could be postulated that severe containment environ = ental conditions could cause Tayg to fail high, which could cause the opening of the at=ospheric du=p valves if it autenatic. This is a re=ote possibility which cannot be eliminated in this preliminary investigation.
The auxiliary feedvater system main steam supply motor operated valves and associated electrical cabling system located in the =ain steam penetration room are qualified for operation in a steam environment. Re=aining auxiliary feedvater control systems are located in Other plant areas re=ote from the postulated =ain feedvater break. Since the auxiliary feedvater system is not functioning during nor=al plant operation and is provided with feedline check valves located incide contain=ent to prevent stea= generator blevdown into the auxiliary building, a postulated auxiliary feedvater line break in the auxiliary building vill not a *fect the =ain feedvater control syste=s or the at=ospheric dump valves.
CONCLUSIOqi With regard to Calvert Cliffs, scenario No. I does not apply for a feedvater rupture in the auxiliary building. A feedvater break in the containment, however, could possibly impact the at=ospherie dump valve control system. The plant operators vill be infor=ed of this possibility so that during conditions that cause severe containment environ =ents the atmospheric du=p valve can be placed in manual until control is assured. This investigation vill be continued to detem.ine if this failure =echanism is plausible, and if it is necessaryto upgrade the instruments to withstand adverse environmental conditions.
1139 '55
h.
We do not believe that this constitutes a substantial safety hazard because-1.
the possibility of a pipe break is s=all, 2.
a break if it occurs is moi e likely to be s:All rather than abrupt, instruments are inside of the prima:y shield wall and 3.
the th and te remote from the main feed line, and h.
plant operators vould have ti=e to prevent the inadvertant opening of the valves since instrument failure if it ocearred would be delayed.
1139
56
-5_
VESTINGHOUSE SCEN/..!IO NO. 2 MAIN FEEDWATER CONTROL SYSTIM PCS'IULATED BREAK S=all feedline rupture in the main or auxilieuy feedvater lines in the auxiliary building between the containment penetration and the check valve.
WESTINGHOUSE IDE?uuls POTENTIAL PROBLDi AREAS 1.
All =ain feedvater is lost to the intact steam generators following a s=all feedline rupture due to environ = ental i= pact on 'he main feed-c vater control syste=s.
2.
Resulting pri=ary hot leg boiling occurs following feedline rupture.
CALVERT CLIFFS NUCLEAR POWER PLANT DESIGN 1.
The feedvater re6ulating control valve and associated appurtenances are located in the turbine building (elevation 27'-0") with the exception of:
level instru=entatt?n which is located in the containment. Main steam The feed-water regulating control system is located in the control room.
2.
The plant design provides en individual feedvater regulating system for each steam generator.
3.
Individual =ain feedvater and auxiliary feedvater lines are provided to the steam generators.
h.
Feedvater line(s) check valve (s) are located inside contain=ent.
5.
The =ain feedvater lines inside the auxiliary building are encapsulated 6.
The main feedvater pu=p and turbine control syste=s are located in the turbine building with respective controls provided in the main control room.
7.
There are no auxiliary feedvater control systems inside the contain=ent or the turbine building.
8.
The main feedvater system is not required to place the plant in safe shutdown condition.
DISCUSSION The implication of scenario no. 2 is that a nostulated s=all auxiliary feedvater line break =ay cause =alfunction of all main.
e or control syste=s to terminate main feedvater flov to the steam generators.
- vater To apply this scenario to Calvert Cliffs, three plant areas were considered for the postulated small feedtater line break.
1139 157
. 1.
Postulated s=all =ain or auxiliary feedvater line break inside contain=ent In consideration of:
The containment volume available, the physical the similarity between regulating syste= instrumentation and environmentally qualified instru=entation, and electrical cabling environmental qualification, a s=all feedvater break inside containment affecting both =ain feedvater regulating syste=s is not considered credible.
2.
Postulated s=all main or auxiliary feedvater line break in the auxiliary building.
Per the discussion for scenario no.1, and due to the location of building portion of the =ain or auxiliary feedvater lines vill notc expose the feedvater regulating control systems to adverse environmental conditions.
The environ =entally qualified interconnecting cables for the main stes= flow, =ain feedvater flow and stea= generator level instrumentation are routed through areas in the auxiliary building which are isolated from the postulated break.
vater contain=ent isolation valves located in the =ain stea:The =otor operated =ain are qualified for operation in a stea= environment.
penetration 3.
Postulated sen11 =ain feedvater line break in the turbine building As a result of the postulated rupture, the co=ponents of the =ain feedvater replating syste=s which are located in the turbine building can be exposed to environ = ental conditions which could result in =al-function of the =ain feedvater system.
valve (s) solenoid valves are nor= ally energi::ed to allow throttling ofThe the valve.
A pressure switch is provided to =onitor. instru=ent air and air supply.to subsequently de-energi::e the solenoid valves uton loss of instru=ent valves or pressure switch would cause the regulating control v fail "as is. "
Conversely, since the main feedvater regulating control syste= vhich provides input for throttling the regulating control valve interconnectinare located in areas isolated fro: the postulated break and since the s electrical cabling is environmentally qualified, postulated continuous operation of the solenoid valves and pressure svitch exposed to adverse environ =ent vould allow nor=al operation of the regulating control valve.
of the main feedvater pu=p and turbine control systems i building could result in loss of the main feedvater to the stea= generato rs.
CONCLUSIONS With regard to Calvert Cliffs, scenario no. 2 vould only apply for the1139 '58 s=all feedvater line break in the turbine building.
For this scenario, a malfunction of the =ain feedvater syste= does not result in a = ore severe condition than that analy::ed (or the loss of =ain feedvater analysis provided in FSAR section lb.
The possibility of overfeeding the intact stea=
generator (s) as a result of a s=all feedline rupture has also been reviewed (Note:
This is a extension of the Westinghouse scenario).
le= in this case is structural problems associated with an overfilled steaThe potential pro
_7_
generator.
This scenario is not considered a significant safety hasard due to the following factors:
1.
The probability of a pipe break is small 2.
The available contain=ent volume is large enough to =igitate the environ = ental effects of a small line break.
3.
The cable to the stes= generator level instruments is qualified for a LOCA environment.
h.
The feedvater control stea= generator level instru=ents are similar to the safety grade stea=
generator level instruments.
5.
This event can be prevented if it occu s by pro =pt operator action. Safety grade level instrumentation exists to co= pare to control grade instru=ents,and the feed syste= can be controlled =anually.
The plant operators vill be infor=ed of this potential failure = ode so that they can take prompt corrective action, should it occur.
The investigation of this scenario vill be continued to detemine if this failure =echanis=
is plausible, and, if so, wh.it plant =odification are required.
1139 '59
WESTINGHOUSE SCHIARIO NO. 3 s
PRESSURIZER POWER OPERATED RELIEF VALVE (PCRV) CQiTROL SYSTEM POSTUIATED BREAK Feedwater line rupture occurs in the main feedwater line inside containment between the steam generator nozzle and the containment penetration.
WESTINGHOUSE IDENTIFIED POTETI'IAL PROBLD4 AREAS 1.
Control system environmental failure causes small LCX:A in steam space of the pressurizer due to secondary high energy line rupture.
2.
Resulting primary hot leg boiling occurs following a feed line rupture.
CALVERT CLIFFS NUCLEAR POWER PIANT DESIGN 1.
The plant design provides: Two redundant electromatic relief valves (ERV),
two redundant motor operated valves (block valves), and two redundant ecde safety relief valves for the pressurizer.
2.
The electrcmatic relief valves are located within the pressurizer ca::partment physically separated frem the main feedwater lines.
3 The electrcmatic relief valves and the motor operated block valves are supplied ssfety related power.
4.
The electromatic relief valves and associated block valves are powered free opposite safety related power.
~
5 Pressurizer instru=entation is located outside the secondary shield wall which is physically separated frem the main feedwater lines.
The pressurizer pressure centrol system is a 2 out of h coincident logic pcwered fran independent safety related sources.
6.
The electrematic relief valves are not required to place the plant in a safe shutdown condition.
DISCUSSIQi If a large main feedwater line break occurs inside containment, the motor operated block valves, ERV's, code safety's, and pressuriner instrumentation would be exposed to adverse environmental conditions. As stated in FSAR Section 1h.10, the main steam line rupture analysis would represent an upper limit for containment environmental conditions for a main feedwater line break.
The pressurizer instrumentation which is a part of the reactor regulating system and associated cabling (including ERV cabling) are cualified for operatien under LOCA conditions and would not be affected by the conditions stated above.
1139 NO
_9-The ERV solenoid is nomilly de-energized and the ERV fails closed on loss of power. The solenoid is etuated by the reactor protective syste:n controls located outside centair=ent. The EV electrice'. power cabling integrity is maintained throughcut the centainment divorced frcm any junction boxes, cable splices, etc. which could cause interaction with other systems. Any environ-mental condition which could damage the ERV solenoid would render the valve incapable of opening or would cause the valve to close if already open. This does not result in any condition r.ot previously analyzed.
C NCLUSICN Scenario No. 3 is not applicable to calvert Cliffs.
m9 m
t Attachment h WESTINGHOUSE SCENARIO NO. h AUTOMATIC CEA CONTROL SYSTEM POSTULATED BREAK Intemediate steamline rupture occurs inside contain=ent.
WESTINGHCUSE IDHTTIFIED POTHEIAL PROBLDI AREAS 1.
CEA withdrawal due to control system environmental consequential failure.
(Power range excore detector and associated cabling).
2.
Minimum DNBR falls below 130 prior to reactor trip.
CALVERT CLIFFS NUCLEAR POWER PLANT DESIGN 1.
The power range excore detector cabling is qualified for LOCA conditions.
The excore detectors associated with the reactor regulating system are identical to the safety grade excore detectors.
2.
The reactor is tripped by high containment pressure at h psig.
DISCUSSIQi The CEA control system is used in the manual mode only, therefore the possi-bility of a steamline rupture causing an autccatic CEA withdrawal is not applicable to Calvert Cliffs.
CONCIUSION Scenario No. 4 is not applicable to Calvert Cliffs.
1139 M2
a Attachment 5 PRESSURIZER LETIL CONTRCL SYSTEM POSTULATED 3REAK hall feedline break inside containment.
pol'ENTIAL PRO 3LEM APEAS 1.
Adverse envirer m.t impacts pressurizer level instrument causing indication to fail low, which causes the control system to increase inventery (and pressurizer level). RCS heatup results frem rapid decrease in SG heat transfer due to loss of fluid frc= the ruptured steam generator. Pressurizer relief and/or safety valves open.
2.
Relief / safety valve relief capacity reduced by liquid discharge.
CALVERT CLIFFS NUCLEAR POWER PIRiT DESIGN 1.
Pressurizer level instrument cables are qualified for LOCA environment.
2.
Pressurizer level instruments are being qualified for LOCA conditions.
DISCUSSION 1.
After the pressurizer level system is qualified for LOCA conditions this scenario will not apply to Calvert Cliffs.
2.
In the interim the probability of this scenario is extremely low.
3 There is time for the plant operators to take the apprcpriate action to keep from overfilling the pressurizer. The failure of the pressurizer level instruments if it occurs will be delayed.
CONCLUSICN 1.
Plant operators will be infor=ed of the possibility of this scenario ao that they can take the appropriate action to control primary syste=
charging.
2.
Due to the low probability of the scenario and because it is possible for the plant operator to control primary system charging this scenario is not considered a significant safety hazard.
3 Efforts to qualify the pressurizer level instruments for LCCA conditions will continue. If we are not able to ecmplete this action in a reasen-able time period we will perfom a plant specific analysis to determine the upper limit allowable for pressurizer level which is consistent with the maximum rate of level increase and the maximum RCS expansion during the potentially rapid heatup associated with feed line breaks.
} } 39
' b
' Attachment 6 FAIN STFAM PATHS DCWNSTREAM OF MSIV'S POSTULATED BREAK Large stesmline break inside containment. MSIV on unaffected steam generator fails to close.
POTENTIAL PROBL2M AREAS 1.
Main steam paths downstres= of.MSIV open or fail to close due to control system malfunction caused by adverse environment following large steam line break.
2.. Open main steam paths increase the steam blowdown and increase moderator cooldown effect which adds positive reactivity to core. A post trip return-to-power is more severe under these conditions.
DISCUSSICN The number of failures which must occur during this event are significant.
First a pipe break which is unlikely must occur. The pipe break must be large, also unlikely. Then the MSIV on the opposite steam generator must fail to close. There is a stuck rod on reactor trip (assu=ed in SAR analysis). All of the foregoing are assu=ptions of our existing accident analysis. Inaddition to these failures, paths downstream of the MSIV's must fail open (these include turbine control valves and turbine bypass valves), but these are unaffected by the adverse containment environment.
CONCLUSION The probability of this sesnario is so low as to eliminate it as a significant safety hazard. This investigation will be continued to detemine if this series of events warrants further consideration.
1139 V4
.