ML19209C214

Responds to NRC 790917 Ltr & IE Info Notice 79-22. Interactions Between Safety & nonsafety-grade Sys Do Not Pose Substantial Safety Hazard.Requirements of Info Notice Are Fully Encompassed by NUREG-0578

ML19209C214
Person / Time
Site:	Fort Calhoun
Issue date:	10/05/1979
From:	William Jones OMAHA PUBLIC POWER DISTRICT
To:	Harold Denton Office of Nuclear Reactor Regulation
References
NUDOCS 7910120211
Download: ML19209C214 (7)

Text

. .

.g .

- c

_ s.

/:

Omaha Public Power District 1623 HARNEY e OMAHA. NESRASMA 68102 e TELEPHONE 536-4000 AREA CODE 402 October 5, 1979 Mr. Harold R. Denten, Director Office of :iuclear Reactor Regulation U. S. :luelear Regulatory Cc==issien Washington, D. C. 20555 Re ference : Docket :Io. 50-285

Dear Mr. Denton:

The 0=aha Public Pcuer District received your letter of Septerber 17, 1979, requesting that a review be conducted of the Fort Calhoun Staticn en the subject of a potential unreviewed safety questien on interaction between non-safety grade systems and safety grade systems. The potential problem was further addressed in IE Information :Ictice 79-22, dated September lh,1979 This letter is in respcase to your req _uest.

The District has redeved the specific non-safety grade systems listed in IE Informatica Ilotice 79-22, as well as others, for potential interactions that could constitute a substantial safety hazard. In this effort we were assisted by our reactor vendor, Ccnbustion Engineer-ing. :Io interactions constituting a substantial safety hazard were identifie d. While in sc=e cases we have identified variatiens frcm the Fcrt Calhoun Stati n FSAR licensing bases and identified control system modifications to enhance the level of safety, the basic conclusien of the FSAR that these events do not ecnstitute en undue risk to the health and safety of the public remains unchanged. Tnerefore suspension, re-vocaticn, or modification of Operating License DPR_h0 is not warranted.

As a result of the Three Mile Island accident, there are a signi-ficant number of industry, governmental and regulatory investigations underway exa=ining the licensing bases and the cperating procedures of nuclear generating facilities. These investigations are already identifying areas w'.ere studies may result in the censiderttion of new or revised events as part of the bases for assuring continued safety of nuclear facilities. :iUFIG-0578 outlines several such events and suggests remedies.

7910120 OI P

Mr. darold R. Denten October 5,1979 Page ?eo

iUEG-0578 requirements for analyses of potential safety problems envision the kinds of scenarios identified by Westinghouse and made the subject of IE Infor=aticn lotice 79-22. Secticn 3.2, page 17, states in part:

". . .The :!RC requirements for non-safety systems are generally limited to assuring that they do not adversely affect the operation of safety syste=s. . ."

Further, en page A h5 of :iUP2G-0578:

" Consequential failures shall also be considered. . ."

We therefore believe that the scope of the actica required by IE Information :Tutice 79-22 is fully enecepassed by the requirements of ITUPIG-0578 and should therefore be integrated with the planned res-pense sequence for compliance with the :iUPIG. As such, the District vill ccntinue to evaluate this concern, in conjunction with our efforts to respond te ITUEG-0578.

Since rely, W. C. Jcnes Division Manager Producticn Operations WCJ/KJM/3JH:j=m Attach.

cc: LeEceuf, Lado, Leiby & MacRae 1333 :iew Hampshire Avenue , II. w.

Washin6 ten, D. C. 20036 Sworn and subscribed to before se this day of , 1979 J otary- Puoli c e

r=-----

""Al80MY-san,w % ,y

_p: J. T. GLEASON P&aD W % Exa. Ju#y 26. 3982 i

liA4 101

. ATTAC?a:E:;; g EVALUATIO:i

SUMMARY

The Omaha Public Power District has reviewed Fort Calhoun Station instru=ent systems as required by the Cc==ission's letter of September 17, 1979, and as addressed in IE Infor=ation :Totice 79-22. The folleving sys-te=s have been identified as those which require consideration under the subject letter's guidelines.

1. Feedvater Regulation - including feed flow, steam flow, steam generator level, the analog syste=, and valve positioning.

2. Remote Operated Main Stea= Safety Valves - MS-291 and MS-292.

3 Pressurizer Power Operated Relief Valves.

h. Pressurizer Pressure Control.

5 Pressurizer Level Control.

6. Steam Du=p and Pypass System - including atmospheric du=p.

7 Reactor Regulation /Autcmatic Rod Centrol.

6. Steam Generator Slowdown.

Each of the systems was evaluated, taking into consideration the Fort Calhoun Statien thit No. 1 main steam line break; feedvater line break; LOCA snalysis; and Combustion Engineering report CEN-ll4-P, Small Break IDCA Analysis. The FSAR centrol rod ejection accident was also considered, but is not discussed further in this su==ar

• since the accident consequences were found to be bounded by the small break LOCA analysis.

The folicving assu=ptiens establish the =eans by which the =ost liniting centrol system failure scenario was developed.

1. Unqualified equip =ent, which is exposed to environmental con-diticas caused by a high energy line break, fails in the = cst adverse direction.

2. All qualified equip =ent operates as required by its inputs.

3 Equip =ent not exposed to the high energy break operates as re-quired by its inputs.

k. Random failures do not occur in the control systems.

.. )

5 Protection system operation is that assu=ed in the P3AR.

6. Operator action is the sa=e as assu=ed in the FSAR and as pre-sently indicated by operating procedures.

The following su-nry provides results and reco==endations of the District's evaluaticas.

1. Feedvater Regulation System

a. Syste= Descriptien The feedvater regulation system censista of two (cne dedicated to each steam generator) 3-element (feed flew, steam flow, level) centrol systems for automatic cperatica in the range of approximately 30% to 100%

power. The system provides the capability for remote-

=anual positiening of the main feedvater regulating valves. Ee=ote-manual cperation of feedvater bypass (around the main feedvater regulating valves) valves is also provided. This system contains no enviren-

=entally qualified control equipment. Therefore, the feedvater control system is postulated to fail as a result of a high enarcr line break in Roo= 81 (outside of contMent) or inside ecntain=ent.

b. I=nact of Feedvater Regulating System Malfretien During LOCA 4 In reviewing the 'IDCA analysis in report CEN-lik-P, it was noted that , for -line breaks above .02 sq. ft. , feed-water has no effect en the analysis; therefore, feedvater regulatien system failure would not affect the capability to =itigate the consequences of this accident. For breaks smaller than .02 sq. ft. , it has been shown in report CEN-11h-P that establishing auxiliary feedvater flow within 30 minutes results in acceptable consequences. This 30

=inute requirement is presently addressed in the station e=ergency procedures. Therefore, the loss of feedvater has no adverse consequences for the LOCA transient and current operating procedures assure initiation of auxi-liary feedvater.

The failure of the feedvater centrol system in the " full feed" =cde has the potential for overfilling the steam generators. In this case , nu=erous alar =s are available to the centrol room operator and the operator would either use manual main feedvater centrol or he can trip the main feedvater pu=ps and establish auxiliary feedvater using normal procedures. Lhder normal circu= stances , no operator e

action is required to prevent overfilling of steam generators because when ECOS is initiated main feedvater flew is auto-

=atically isolated.

1i44 103 2

=

c. I: nact of Feedvater Rezulating Syste= Malfuncti:n Durine Main Stea= Line Break Accident The main steam line break enalysis (for both inside and outside containment) shows that feedvater is assumed to ra=p to 5% in 60 seconds and the SGIS and ECCS would actuate to =itigate the accident. A failure =aintaining full feedvater ficv vould cause a slightly accelerated shrinkage of reactor coolant syste= inventory until a turbine / reactor trip is initiated and ultimately ECCS actuation occurs. At this time, the closing of the feed-vater isolatica valves would ter=inate the transient.

If the feedvater flow continued as a result of a single failure of an isolation valve, =anual action vould be taken to trip the main feedvater pumps and ter=inate the tran-sient. Emergency procedures currently provide for this action.

An i==ediate feed flew failure during a =ain steam line break would result in caly a slightly smaller steam generator inventory. This scenario would result in a less severe transient, due to the reduction in available secondary side inventory, and would cause a less severe primary syste= temperature transient than the analyzed stea= line break transient.

2. Re=ote Onerated Main Stea= Safety Valves The Fort Calhoun Station remote operated =ain stea= safety valves d (33-291 and SE-292) consist of two safeties , one on each main steam line, which are equipped with air operators attached to the =anual actuatcr handles of these code safeties. These were provided as a =ethod to remove heat from the primary syste=

with the =ain stea= isolatica valves closed. These valves are located in Roc = 81 (outside of contain=ent).

As a result of this evaluation, the solenoid operatcra en these valves have been replaced with LOCA qualified solenoids. This eliminated the poeibility of a cooldevn of both steam generators if a =ain stea= line er feedvater line broke in Roc = 81, which resulted in the failure of the solenoid valve en the intact steam line safety valve and a heat extraction with no =eans of isolating the safety valve. However, during the time the un-qualified solenoid vere installed, it was felt that this type of failure vould not be instantaneous and, due to the blevout dc=es and relative low pressure in Roo 81 (1.5 psig vs. 60 psis LOCA), the failure may never have occurred. Appendix M of the FSAR analyzed these effects on Room 31.

, 3 Pressuriner Pcver.Cperated Relief Valves The Fort Calhoun Station pressurizer power operated relief valves censist of two electrically (solenoid plunger) actuated valves, which operate in the high pressuricer pressure mode and in the lov te=perature overpressure protection mode. These valves are 1144 104 3

~

also equipped with =anually actuated motor operated block valves.

In analyzing the operating modes of these two control syste=s, it was found that neither system f a capable of laadvertently actu-ating the PORV's during any evaluated accident. The high pressurizer pressure 2-out-of-h logic to open system from the RPS uses LOCA qualified equip =ent to generate the signal. Therefore, no further consideration is required. Although the lov temper-ature protection equipment is not qualified, it is interlocked with the station pressurizer pressure lov block signal, such that when the ECCS actuation (PPLS) is ar=ed the lov temper-ature system is not ar=ed. '"hus, no matter what the failure mode of the unqualified equipment, it does not actuate the valve.

In addition, the solenoid itself is a passive device and vill not actuate by itself un ler high energy break conditions.

4. Pressurizer Pressure Centrol System The pressurizer pressure centrol system consists of two inde-pendent control systems (pressurizer spray valves and pres-surizer prcportional heater 0), only one of which is selected to control pressurizer pressure by the operators. The pres-sure transmitter inputs and the spray valve controls to this system could be affected in the high energy line break situ.

atien. In either failure mode (maximum spray with all or no heaters or minimum spray with no or maximum heaters) there is no effect on the LOCA or the main steam line break analysis, since this heat input from the proportional heaters or heat removal from pressurizer spray is not significant.

2 5 Pressurizer Level Centrol System The Fort Calhoun Station pressurizer levo.' control system is a two-channel system (either may be selected to centrol),

which =aintains the pressurizer water inventory as a function t.f ,, -

of average reactor coolant te=perature (T average). Included

'4 in this centrol scheme are charging pu=p starts and stops, ' ^ };

backup pressurizer heater starts and stcps, regenerative heat q' exchanger centrols, and letdown valve control. The various equip =ent is actuated to correct level, depending on the ' ;c ' " [,

deviatica from the T average calculated level. -

r.,

.d In reviewing the LOCA and main steam line break accident, no h ,5 safety problem was identified. Report CE7-lik-P for small 6  ;

breaks does not identify any charging or letdown ccncems. ' !,

The initiaticn of ECCS will isolate letdown and trip all backup .'

he aters. ,

,~ ,

I For the large break IDCA, pressurizer level control has no ii'~-

limiting cases which would affect the analysis. , ,]

The main steam line break also uses ECCS to =itigate the con-sequences. This essentially overrides all level centrol equip- ,

=ent. However, assu=ing a small break in the main feed line occurs inside of containment, the potential exists for an in-creased pressurizer inventory. This is because the pressurizer level transmitters may fail causing the pressurizer to fill for a short period of time before a re tetor/ turbine trip is initiated en icv steam generator level.

1144 105 a

LOCA qualified leve' transmitters vill be installed cn the pres-surizer level control system in order to provide proper post-acciden; indication to cperating personnel and to mitigate the possibility of overfilling the pressurizer. These transmitters will be replaced during the next refueling outage.

6. Steam Durn and Broass System The Fort Calhoun Station du=p and bypass system censists of two centrol systems and the associated valves, which are de-signed to limit prima:7 and secondary transients as a result of a turbine trip. The steam du=p is designed to actuate on turbine trip and stay open until the average coolant temper-ature is 5320F. The steam bypass system also opens en tur-bine trip and centrols the secondary system pressure at 900 psia and 5320 F saturation temperature.

For the main steam line break accident, a steam dump failure would either centribute to the initial blevdown or have no effect (if closed). In either case, the closure of the =ain steam isolatica valves will =itigate the steam du=p failure.

For the s-al' break IOCA, no credit was taken for the steam du=p system.

A large break IOCA vould initiate CPES, which c1cses the =ain steam isolatica valves, mitigating the effect of the steam du=p and bypass.

j- Also censidered under this category was the steen du=p sys-tem, which includes atmospheric du=p, downstream of the main steam isolation valves in Room 81. This evaluation provides the same results as for the steam du=p to the condenser dis-cussed above.

7 Resetor Regulatien System The reactor regulatica system (automatic rod control system) was disabled electrically on August 5,1973 No control sys-tem failure can reault in automatic rod =ove=ent.

Blevdown S.

8. .3 The failure at the blevdevn system was evaluated and no adverse unanalyzed consequences were identified.

1144 106 5

.