ML19242A542

Safety Evaluation Supporting Amend 21 to License DPR-72

ML19242A542
Person / Time
Site:	Crystal River
Issue date:	07/03/1979
From:	Reid R Office of Nuclear Reactor Regulation
To:
Shared Package
ML19242A539	List: ML19242A542 ML19242A544
References
NUDOCS 7908030098
Download: ML19242A542 (11)

Text

.

p nas UNITED STATES NUCLEAR REGULATORY COMMISSION y

>w g

C WVASHINGTON. D. C. 20655 a.,

I s, *..../

SAFETY EVALUATION BY 7.E OFFICE OF NUCLEAR REACTOR REGULATION SU 200RTING AMENDMENT NO. 21 TO LICENSE NO. DPR-72 FLORIDA POWER CORPORATION, ET AL CRYSTAL RIVER UNIT 3 NUCLEAR GENERATING PLANT DOCKET NO. 50-302 1.0 Introcuction By letter dated December 2,1976 (Reference 1), Florida Power Corporation (the licensee or FPC) submitted to the NRC a plant-specific analysis in support of tne reactor vessel overpressure mitigating system (OMS) for Crystal River Unit 3 Nuclear Generating Plant (CR-3). The analysis was supplemented by letter dated February 17,1979 (Reference 2) and other documentation submitted by FPC (References 3, 4, 5). FPC has installed the' equipment and incorporated the procedures described in this report.

Hence, this report surrarizes past efforts by the licensee, vendor, and,NRC staff.

Currently license condition 2.C.(6) of the operating license for CR-3 requires the installation of a long-tem means of protection against reactor coolant system overpressurization prior to restart from the current outage.

'NRC staff review of all infomation submitted by FPC in support of the prooosed overpressure mitigating system is complete and has found that the system provides adequate protection from overpressure tran-sients. A cetailed safety evaluation follows.

2.0 Bacxgrcunc Over tne last few years, incicents identified as pressure transients have occurred in pressurized water reactors (PWRs). This term " pressure transients," as used in tnis report, refers to events curing wnicn the temperature pressure limits of the reactor vessel, as snewn in the facility Technical Specifications, are ee.ceedec. All of these incidents occurrec at relatively low temperature (less than 200 F) where the reactor vessel material touanness (resistance to brittle failure) is reducec.

~

The "Tecnnical Report on Reactor Vessel Pressure Transients" in NUREG 0138 (Reference 6) sumnarizes tne technical considerations relevant to this matter, ciscusses the safety concerns anc existing safety margins of operating reactors, anc cescribes the regulatory actions taKen to resolve tnis issue by recucing the likelincoc of future p essure transient events at operating reactors. A orief discuss,on is presented here.

npO

- h) aou 790803009 f 2.1 Vessel Characteristics Reactor vessels are constructed of high quality steel..ade to rigid specifications, und faoricated and inspected in accordance with the time-proven rules of the ASE Boiler and Pressure Vessel Code.

Steels used are particularly tougn at reactor operating conditions. However, since reactor vessel steels are less tougn and could possibly fail in a brittle manner if suojected to high pressures at icw temperi.tures, power reactors have always operated with restrictions on the pressure allcwed during startup and shutdcwn operations.

At operating temperatures, the pressure allowed by Appendix G limits is in excess of the setpoint of currently installed pressurizer coce saf ety valves. However, most cperating PWRs did not have pressure relief devices to prevent pressure transients during cold conditions from exceeding the Appendix G limit.

2.2 Reculatory Actions By letter dated October 1, 1976 (Reference 7), the NRC requested that FPC cegin efforts to design and install plant systems to mitigate tne consequences of pressure transients at icw temperatares.

It was also i _ quested that operating procedures be examined and administrative changes be made to guard against initiating overpressure events.

It was felt by the NRC staff that.oracer administrative controls were re-quired to assure safe operation for the period of time prior to instal-lation of the proposed overpressure mitigating' har: ware.

FPC responded (Reference 1) with infor:"ation describing measures to crevent tnese transients along witn some discussion of proposed narcware.

The proposed hareware change was to install a icw pressure actuation set;:oint on tn; existing pressuri:er pilot operated relief valves (PORVs).

Additional NRC sta#f concerns were expressed in letters to FPC dated Novemoer 19, 1976, January 7,1977, and Novemcer 11, 1977 (References a, 9, 10).

FPC resconded to these concerns in References 2 and 4.

The correspondence focused en system design criteria discussed below.

2.3.1 Desien Criteria Througn :nis series of meetings and correscencence witn PWR vendors and licensees, we developed a set of criteria for an acceptable everoressure mitigating system. The basic criterion is that tne mitigating system will preytat reactor vessel pressures in excess of tnose allcwed my Aopendix G.

Specific criteria for system perfarnance are:

1) Coerator Action:

No credit can be taken for cperator action for ten minutes af ter the cperator is aware of a transient.

2) Sincie Failure:

The system must.ce designed to relieve tne pressure transient given a single failure in accition to tne f ailure tnat initiatec the cressure transient.

L! JO J JV

[ ()

3) Testabili ty: The systen must be testacle on a periocic basis con-sistent witn the system's employment.

4) Seismic and IEEE 279 Criteria:

Ideally, the system should meet seismic Category I ano IEEE 279 criteria. The casic objective is that the syste should not be vulnerable to a ccamon failure that would both in iate a pressure transient and disable the overpres-sure mitigating system. Such events as loss of instrument air and

-loss of offsite pcwer must De considered.

We also instructed the licensee to provide an alam which monitors the position of the pressurizer relief valve isolation velves, along witn the icw setpoint enaoling switch, to assure that the overpressure mitigating system is prcperly aligned for shutocwn condi tions.

Licensees were informed that their proposed mitigating systems were to meet the'se criteria for the most adverse of hypothesized scenarios, that is, the largest mass or heat addition whicn could occur at the specific plant.

While acministrative procecures were to be employed to recuce tne probability of an initiating event, acministrative procecures were not to be employec in lieu of barcware mocifications.

These hardware modifications were to provice sufficient relief capacity to mitigate the most adverse scenario.

.t was recognized that these criteria were of a general nature and tnat exceptions wcula De required as incividual reviews progressed.

(See Section 3.1 Evaluation.)

2.4 Design Sasis Events The incidents that have cccurred to date have been tne esult of coerator errors or equioment failures.

Two varieties of oressure transients can Oe icentified: a mass innut type from cnarging pumos, safety injection pucos, safet

.1jection accumulators; anc a heat aceition type wnicn causes tns.aal expansion from sources sucn as steam generators or decay neat.

Onl, one overpressure event at icw temperature (during hydrostatic test) nas oc_urrec at a 3accock and Wilcox (S&W) nuclear sucplied steam system (NSSS);

The most commen cause of overcressure transients to date has'been isolaticn of the letdown patn. We have identified the most limiting mass incut transient to be inadvertent injection by the largest safety injection ;:umo.

The most limiting tnemal ex::ansicn transient is tne start of a reactor coolant pump witn a large temcerature difference between the water in the reactor vessel and the water in the steam generator.

L fi

/c/s d.

).

~

. FPC has provided an evaluation of:

a.

Erroneous actuation of the High Pressure Injection (HPI) system.

b.

Erroneous opening of ce core flood tank discharge valve.

c.

Erroneous addition of nitrogen to the pressurizer.

d.

Mateup control valve (tr.akeup to the Reactor Coolant System (RCS)) ' fails full open e.

All pressurizer heaters erroneously energized.

f.

Terrporary loss of the Decay Heat Removal (DHR)' System's capability to r move decay heat from the RCS.

g.

Thermal expansion cf RCS after starting a reactor coolant purrp (RCP) due to stored thennal energy in the steam generator.

3.0 System Descriction The CMS consists of active and passive subsystems. The active suosystem 1s simply the mocification of the actuation circuitry of tne misting electrical PORV to provide dual setcoints, a ncmal a setooint of 2450 psig and a low pressure setpoint of 550 psig.

o-

. w cressure setcoint is emoloved when the RCS is below 280'F. This system

., manually enaoled. An alam w111 funct1on snould the operat -

fail to enable the system. An alam has also been installed tv

nonitor the position of the pressurizer relief block valve, RC-V2.

The passive suosystem consists of the introduction of a nitrogen blanket at the 'op of the pressurizer. The reactor is operated during heatup and cooldewn with a steam or nitrogen bucole. The bucole functiens as a meenanical damper. This subsystem is part of the original 3&W cesign.

3.1 System Evaluation The CR-3 CMS is both recundant and functionally diverse. The plant, by virtue of a gas (nitrogen er steam) olanxet in the pressurizer and tne relatively small size, and hence heat capacity, of tne once tnrougn steam generators, is not susceptiole *a neat addition tran-sients. The plant is never cperated in a water solid condition.

In contrast, the CMS of a Westingncuse or Canoustion Engineering NSSS consists of two relief valves with indecendent low setpoint actuation circuitry. The two trains are identical, i.e.,

not diverse.

(It is noted the diversity althcugn desiracle was never an NRC staff des'en criteria.) These systems are susceptible to heat addition transiend. These systems are operated in a water solid condition.

C

J. '

c rJ o teu 4

5-FPC has suomitted analyses of the desigt

.,es events shown in Section 2.4 (Reference 2). We accept them. analyses.

These analyses show that, in the event of a postulated mass accition, actuation of the relief valve will limit RCS pressures to the relief valve setpoint and hence below Appendix G limits. Should the relief valve fail closed, or actuation circuitry fail, the system pressure would continue to increase. With the exception of postulated high pressure safety injection, the nitrogen Dubble in the pressurizer will provide at least ten minutes, and in some cases substantially longer time, for operator action. The analyses also shew that in the event that decay heat removal was lost, more than 29 minutes would pass cefore the relief valve setpoint would be reached. Pos tu-l a ted RCP starts with steam generator secondary

~

water temperature greater than primary water temperature will not result in RCS pressure increases to the relief valve setpoint value.

Hence, CR-3 is not considered susceptible to overpressure transients due to inadvertent heat addition.

System pressure overshoot, that is, increase of primary coolant pressure after pressure reaches the low setpoint value, does not occur on B&W NSSS due to the rapid action of the electrical PORV and the relatively slow rates of pressure increase due to the nitrogen blanket in the pressurizer.

The CR-3 CMS is tolerant of seismic events.

FPC nas performed analyses for the pilot assemoly connection pipe assuming seist.1ic motion of 3.0 horizontal and 3.0 vertical. The actual valve meets Class 1 requirements. Testing with simulated seismic loadings has not been performed. This was not a requirement at the time the plant was designed and constructed. Even if it is assumed that the valve, connection pipe, or actuation circuitry, failed cue to a seismic event, the nitrogen blantet in the pressurizer would provice protection for postulated icw temperature overpressure events.

'he system is testacle and is to be testec prior to use. The PCRV li to ce testec each snutccwn.

The system coes not strictly meet lEEE279 criteria. The basic cojec-tive of this criterion, prevention of common moce f ailure, is met by virtue of tne suosystem diversity.

For all postulated neat accition transients and for all mass accitions other tnan inadvertent hign pressure safety injectior:, the CR-3 CMS n ats single failure and operator action criteria.

In the event that the largest possible mass accition were to occur, one HPI train, actuation of the relief valve would terminate the transient.

Should this valve fail, the RCS pressure would exceed system pressure in four to five minutes (depending on the initial system conditions). Hence, for this postulated event, the system does not meet single failure /ocerator action criteria. For lesser mass addition rates, in the event that the relief valve failed, the pressurizer cubble would act as a pressure damcer providing more than ten minutes for operator action.

N00

. In contrast, the OMS of a Westinghouse or Concustion Engineering MSSSs will (with specific olant exceptions), assuming that one of the two relief valves or associated circuitry were to f ail, ter ninate this transient.

Acministrative controls to mitigate HPI must be found acceptacle or additional hardware installed. Both options were consicered and are discussed below.

A makeup / charging pump is run to provide RCS main coolant pump seal water.

Actuation of a HPI train consists of opening a HPI motor operated valve, MOV, pennitting flow from the makeup / charging pump to the RCS. Circuit breakers for the closed HPI MOVs are " racked out" and " tagged" during plant coolcown.

With the motor operator " racked out", Flow througn the valve would represent a passive failure and need not be con-sidereo. One must insure that these valves are closed when HPI is not neeced without decreasing the procability that tney can De opened when HPI is needed.

Inadvertent HP safety injection is of interest curing cooldowns f rom approximately 280*F to 1:0*F.

The licensee has estimated that the time during the six typical cold shutdowns a year the RCS is betwe these temperatures is approximately one and one-nalf nours. Above tnis temperature, the vessel can withstand higner pressures. Belcw this temperature the RCPs and, hence, the operating makeup / charging pump which supplies seal water to the RCP would be shutdown.

In order to initiate an event it would then be necessary to:

(1) inadvertently turn on the makeup pump (s), and (2) inadvertently open a HPI valve (s). The pumps and valves are Ectn " racked out."

To preclude HPI in the temperature range of 280 F to 150*F, the licensee must " rack out" the HPI isolation valve circuit breakers with the valves in their normally closed position. HPI pump operation within this range is still necessary for makeup and RCP seal flow.

In orcer to insure that the operator " racks out" tne kPI valves, tne licensee has installed an alarn to alert the coerator if tne RCS temoerature is ::elow 280*F and the valves nave not oeen "racxec out."

Witn pcwer to the valve motcr operators, the valves would open on a safety injection actuation signal. This signal is cypassec curing normal cepressurization at a pressure of 1750 psig. Failure to follow this procecure will also result in an alara.

Harcware moci fications were ciscussed with FPC and other Ba'a NSSS licensees. Metropolitan Ecison Company suomitted several options and associated costs (Reference 11).

nhile actual plant mocifica-tions and costs wcuid vary amongst licensees, it is Delieved tnat tnese options &re apresentative of possiole nareware mocifications.

Options consicered incluce: modification of tne DHR system, modification of the makeup anc purification system, acci tior, of a second pressure relief valve on the pressurizer. These options were estimated to cost 5200,000 to 5400,000. These cotions introcuce acci tional safety concerns.

Relief cacacity adoition to the DHR system is only of value with respect to low temoerature overpressurization when tne DHR is aligned. This system is autcmatically clocked at an RCS pressure of 284 psig. Modification of the system would re-quire modification of the DHR autoclosure interlocks.

Spurious f ailure of these modified interlocks would increase the probacility of primary breaks outside of containment.

Installation of relief and block valves downstream of the HPI valves (that is, modification of the makeup system) would increase tne prooability that HPI, if required, would be impaired.

Hence, although these barcware modifications would comply with the letter of our guicelines, they are not considered necessary. Admin-istrative controls supplemented by tne single pressure relief train,le anc pressure and level indication and alarms are considered a suitab and acceptable alterr.ative.

Credit for administrative controls is consistent with past NRC staff actions. We have permitted a manually enabled system, credit for blocking safety injection actuation signal, crecit for successfully blocking one of two hign pressure safety injection trains, and crecit for blocking accumulator in.iection. On Comcustion Engineering and Westingnouse NSSSs we have assumed administrative control of the primary to secondary cifferential temperature for heat accition analyses. For S&W NSSS, we have assumed that the nitrogen bubble will be established la manual procecure) and that the initial pressurizer level will be controlled.

i A.0 Acministrative Controls To supplement the hardware modifications and Vo limit the magnitude of postulated pressure transients to within :na counds of the analysis proviced by tne licensee, a defense in cepth aporoach is aceptec using procecural and acministrative controls.

Specif:c concitions requirec to assure tnat the plant is operated within tne Sounds of the analysis are descriced below.

4.'

Procecures A numoer of provisions for prevention of pressure t ransients are incorporatec in :ne piant operating procecures.

1)

The CMS is to De manually enablec wnen the reactor coolant system temperature is less tnan 280*F. The leu pressure setcoint is 550 asig.

An alann will scund if tne coerator f ails to enaole tne system. This recuirement is to :e in-corporated in :ne plant Technical Specifications.

An alarn will also De actuated if tne coerator closes the PCRV isolation valve and tne RCS temceraturs is below 2S0*F.

500

'0'

-S-2)

The plant is to be operated with a steam or nitrogen blanket in the pressurizer curing plant coolccwns and he:atups. The initial pressuri:er water level is to be less tnan or equal to the high level alarm at system pressures above 100 psig and less tnan the high high level alarm for pressures less than or equal to 100 psig.

3)

The makeup tank water level is to be less than the hign level al am.

4)

Core Flood Tank oischarge valves are to be cicsed and circuit breakers for the motor cperators " racked cut" curing plant cooldewn before the RCS pressure is decreased to 700 psig.

The valve positions are also alamed. This is nomal precedure.

5)

HPI MOVs are " racked out" during plant cooldown prior to reaching 280*F system temcerature. Power to these valves is also alarmed.

Extensive use of alarms insures that the operator is aware of vital. plant conditions outside the bounds of those assumed in tne safety analysis. The operator must take corrective action to clear tnese alams. Overpressurization of tne vessel might only occur if an initiating event was coincident with ignoring these alans.

5)

Testing of HPI pumps curing shutacwn will only be performed witn the vessel head removed.

Ws fina that the,nrocedural and administrative controls described are acceotable.

a.2 Iecnnical Soecifications To ensure operation of tne icw temoerature overpressure mitigating system, and decrease the probability that an initiating event wnich will challenge the system occurs, FPC has proposed (Reference 5) to incorporate operability recuirements of the pressurizer relief valve in tne plant Technical Specifications. While ocerability require-ments for the relief valve are necessary, we have detemined that additional Technical Soecifications are also necessary. These soecifications would require that plant parameters, such as pressurizer level, are maintained witnin the limit assumed in the analyses and plant instruments, such as pressurizer level instruments, are operable when relied upon by operators to maintain parameters within soecified limits.

Therefore, the proposed Tecnnical Specification is not sufficient.

By letter dated July 3,1979, the licensee has committed to propose changes to tne Technical Specifications to address the concern discussed above wi tnin 30 days.

,o

)00 i

As noted previously, the licensee will make the HPI isolation valves inoperable for automatic and remote manual operation when below 2800F (Mode 4, 5 ani 6). Currently Technical Specification 3.5.3 requires that one HPI pump and flow path be operable during Mode 4 Table 3.3-3 in the Technical Specifications further defines this requirement as the capability to manually initiate HPI during Mode 4.

" Racking out" the pover supply to the HPI isolation valves still allows manual initiation of HPI by " racking in" the breakers and then operating the valves. However, this requires operator action outside.he control room. We have indepe:1dently verified that in the unlikely event of a loss of coolant accident which does not depressurize the reactor coolant system such.nat low pressure injection is functional, the operators have adequate tin (greater than 30 minutes) to initiate high pressure injection.

This assumes, o credit for make-up flow.

Based on the above, we conclude that " racking out" the power supply breakers to the high pressure injection valves in Mode 4 is acceptable. We will add a note to Technical Specification 3.5.3 to clarify this requirement.

5.3 Conclusion The administrative controls and hardware changes proposed by FPC provide protection for CR-3 from pressure transients at low temperatures by reducing the probability of initiation of a transient and by limiting the pressure of sucn a transient to below the limits set by Appendix G.

We find that the overpressure mitigating system is acceptable as a long-term solution to the problem of overpressure transients and satisfies the requirements of license condition 2.C.(6).

During its review the NRC staff identified certain features which, although not necessary for satisfactory operation of the CMS, would be beneficial in the event a pressure transient occurs at low temoerature. These additional features would provide direct indication that the transient was in progress and ensure that tne transient was recorded for later evaluation.

In its letter of June 27, 1979, the licensee crocosed to imolement the following modifications by the end of the next scheculed refueling outage.

1) A pressure alam witi1 a setooint below that of the PORV setooint to give the operator dir'-t indication of a low temperature pressure transient in progress and,

t' the RCS pressure is on a t.end that might exceed the FORV setpoint (550 osig).

2) Recorder (s) to ccntinuously record RC3 pressure and temoerature. This will provide a permanent record of all low temcerature pressure transients.

Pressure recorders with a capability in the range of 100 psig per second recording are being investigated.

We find these procosed modifications provide the benefits discussed above and the schedule for implementation is acceptacie.

)e Environmental Consideration We have determined that the amendmen't does not auth0ri:e a change in ei-luen; ty:es or tota,i amcunts nor an increase in ;;wer leve,s anc will not resu t in any sign 1TTcant envir0nmenta,a im:act.

..aving l

n mace this determination, we nave fur'her concluded that tne amencnent involves an 20:icn whicn is insignificant fr:= the stand:cin: cf envircnmental im:act and, pursuant to 10 CFR 151.5'd)(a), :na: an envir nrental im act statement,,0r negative ceclara-icn anc envir0n-mental impact a;;raisai need not be prepared in connec 1:n witn the issuance f :nis amencment.

ent'usion We have concluded, based on the considerations discussed above, that:

(1) be ause the amendment does n:t involve a significan: increase in the :r0: ability or Consequences of accidents previcusly considered and 00es n:: involve a significan: de:rease in a safe y margi., tne amencment d:es no involve a signi'itant ha:ards considsra:icn, (2) there is reasonable assurance :na: the health and safety of ne public will not be endangered by cperaticn in the pro:csed manner, and (3) suqn activities will be conducted in comoliance with the Commission's regulations and the issuance cf this ame-dment will not be inimica.1

:ne ::mmen defense and security or to the health and safety of

.,,,, w,i i c..

Dated:

July 3,1979

') i) U

~ a r

References:

1)

J. T. Rodgers, " Interim Response to Overaressuri:ation at

{

Shutdown Conditions," Decemoer 2,1976, FPC letter.

l 21 J. T. Rodgers, " Response to NRC Request for Addi tional j

Information," February 17, 1977, FPC letter.

j l

3)

J. T. Rodgers, Status report to John Stolz, NRC, June 3,1977, FPC letter.

4)

W. P. Stewart, " Response to NRC Request for Additional Information," January 5,1978, FPC letter.

5)

W. P. Stewart, " Technical Specification Change Request No.17,"

January 23, 1978, FPC letter.

6)

" Staff Discussion of Fifteen Technical issues Listed in Attachment G, Novemoer 3,1976 Memorandum from Director NRR to NRR Staff," NUREG-0138, Novemoer 1976.

7)

J. F. Stol:, "'lerification for Ccmpliance with Appenoix G Pressure-Temperature Limits During Startup and Shutacwn,"

NRC letter, October 1,1976.

8)

J. F. Stol:, NRC lettar to FPC in regard to overpressure protection system, NRC letter, Novemoer 19, 1976.

9)

J. F. Stol:, "'leri fication for Ccepliance wi th Appenoix G Pressure-Temoerature Limits During Startuo and Shutccwn,*

(Cr/stal River Uni t 3 Nuclear Generating Plant), NRC letter, January 7,1977.

10)

R.

W. Reid, NRC letter to FPC in regara to overpressure protection system, Novemoer 11, 1977.

11)

J. G. Hercein, ' Overpressure Protection System," Januarj 13, 1978, Met-Ed letter GCL 0048.

5'.)0

,2,> ;r