ML19254F683

Forwards Response to IE Info Notice 79-22.Safe Shutdown Can Be Achieved Even If Postulated Accident Compounded by Environmentally Induced Control Sys Actuation

ML19254F683
Person / Time
Site:	Sequoyah
Issue date:	11/09/1979
From:	Mills L TENNESSEE VALLEY AUTHORITY
To:	Rubenstein L Office of Nuclear Reactor Regulation
References
IEIN-79-22, NUDOCS 7911160434
Download: ML19254F683 (6)

Text

., T TENNESSEE VALLEY AUT1HORITY CH ATTANOOGA, TENNESSEE 37401 400 Chestnut Street Tower II November 9, 1979 Director of Nuclear Reactor Regulation Attention: Mr. L. S. Rubenstein, Acting Chief Light Water Reactors Branch No. 4 Division of Project Management U.S. Nuclear Regulatory Commission Washington, DC 20555

Dear Mr. Rubenstein:

In the Matter of the Application of ) Docket Nos. 50-327 Tennessee Valley Authority ) 50-328 Enclosed is our response to IE Information Notice 79-22 on qualification of control systems as requested in your letter to H. G. Parris dated October 23, 1979. An interim response was submitted on November 2, 1979.

If you have any questions, please get in touch with D. L. Lambert at FTS 854-2581.

Very truly yours, TENNESSEE VALLEY AUTHORITY s p

~

../. V (.l .!,

L. M. Mills, Man ger Nuclear Regulation and Safety Enclosure 1347 134 Bool ES An Equal Opcortunity Emolayer 7011160 e'

2 . s ENCLOSURE RESPONSE TO IE INFORMATION NOTICE 79-22 Introduction TVA has performed a systematic (matrix) evaluation of the environmental effects resulting from high energy pipe breaks inside and outside contain-ment upon nonsafety-related systems. Specifically, safety features required to mitigate the consequences of high energy pipe break and those required to obtain and maintain a safe shutdown following such an event were evaluated to determine if a single inappropriate actuation of an interfacing nonsafety-related system could unacceptably affect the required safety feature. TVA's conclusion is that although there is a possibility for disruptive signals to be generated, these are in every case acceptable because the operator will always have sufficient indication and time to take corrective action.

Where appropriate, operating instructions have been modified as an additional precaution to preclude the event or to alert the operator to the possibility of the event.

Methodology The following approach was used in analyzing the potential for disruption of required safety features by the consequential inappropriate actuation of interfacing nonsafety systems. -

1. Required safety features for LOCA, main steam and feedwater, and other postulated high energy pipe rupture events were identified from the appropriate safe shutdown logic diagram. These requi md features were screened against a list of plant systems to determine if, f Jnctionally, sufficient interface existed between the required feature and the system to merit further evaluation. That is, without regard for the credibility of the event a single spurious actuation wasAspostulated to this spurious occur anywhere within the system under consideration.

actuation was postulated, the question was asked, is there sufficient -

interfact< between the system and the required safety feature so that functionally there is potential for an unacceptable condition to exist.

(See figure one, screening matrix.)

2. All cases identified as potentially unacceptable in step one were subjected to an individual evaluation for credibility and acceptability.

All nontrivial cases are discussed in the results.

Results.

1347 135 RCS Inventory and Pressure Control The pressurizer PORV's might be subject to inappropriate opening due to environmental effects which could exist from high energy pipe breaks inside containment. Such inappropriate opening has been judged to be acceptable because (1) adequate annunciation is provided to alert the operator to the

Plant System Required Safety Feature ,

Long Control SG Inventory Term Rm.& Aux. -

RCS Inventory EGTS ,

and Pressure ECCS Reactivity Heat Contain. Habitab.

and Pressure Isol. (HVAC) Response control control Response Control Removal X

tin and Reheat Steam

. traction Steam X sin and Auxiliary Feedwater X

2ndensate 2ater Drains and Vents .

X Temical and Volume Control X X X isidual Heat Removal X afety Injection ~

ce Condenser Refrigeration axiliary Boiler ube Oil rimary '%ter hemical Cleaning '

X adiation Waste Disposal ondenser Circulating Water _

aw Water otable Water X

'uel Oil

. land Seal nsulating 011

arbon Dioxide X X X

ssential Raw Cooling Water X

ervice Air

ontrol Air tydrogen ire Protection

. tation Drainage t ~:

X r uel Pool Cooling.and Cleaning A N

emineralized Water f'

ondenser Tube Cleaning X

,:omponent Cooling Water [ X X 3ampling ieating, Ventilating, and Air-: .

y' X

Con'ditioning igure One - Screening Matrix - Systems marked "X" functionally have the potential to interact with required safety

'aatures. These systems have been fuither evaluated to determine the existence of unacceptable environmentally-induced ontrol system actuations.

event, (2) adequate time is available for operator action, and (3) the control system design is such that operator action is possible.

RCS inventory and pressure control could also be jeopardized by , inappropriat control circuit actuations which would lead to a reactor coolant pump (RCp) seal failure. Control system modifications have been made to both the com-ponent cooling water system, which supplies cooling to the pumps therma barrier and to the chemical and volume control syste spurious control system actuations. In that these modifications would also render the seals immune to damage due to pipe brea Steam Generator Inventory and pressure Control The control system for the SG power operated relief valves (p0RV's) This could be affected by high energy pipe breaks in the main steam valve room.

inappropriate opening is considered to be acceptable because (1) adequate annunciation is provided to alert the operator to the event, (2) adequate time is available for operator action, and (3) the control system design assures that the operator can override the inappropriate open signal.

An inappropriate opening of a main steam isolati6n valve bypass valve would defeat steam generator isolation. The potential for this event has been fire evaluation by identified and resolved during the Sequoyah Nuclear Plant requiring the operator to deenergize the control circuit to these valves once they are closed during plant startup.

ECCS Response _

An inappropriate actuation of the reactor building auxiliary flow and equipment drain sump pump could jeopardize long term ECCS response b pumping water out of the ECCS active sump.

to be acceptable because (1) adequate indication is provided to alert the operator to the event, (2) adeuqate time is available for operator action, and (3) control system design is such that operator action is possible.

A number of other controlIncircuits whose inappropria that this action would also in compliance with FSAR Question 7.51.

prevent environmentally induced inappropriate actuations, these contr systems were not evaluated further. i Other Safety Features water (ERCW) system has the potential to disrupt 1347 137

Safety features. This system had been previously evaluated for unacceptable

, ' fire-induced inappropriate actuation. A number of cases were discovered where  ;

an inappropriate actuation would cause unacceptable load inbalance within the system. The modifications taken to precl'ude such fire-induced actua-tions would also make the control systems immune to pipe break environmental  :

effects. Hence, the system was considered to be acceptable without further evaluation.

Additional Considerations The study thus far has considered the system being evaluated as There a target arein the zone of influence of the postulated high energy pipe break.

two cases where this evaluation has made use of previous efforts to control the zone of influence of the postulated event. The events, which are identified in the SQN pipe break analysis, are a RHR break in the 690 ft. el.

of the auxiliary building, and a break along the route of the auxiliary boiler steam line in the auxiliary building. Trainized temperature sensors have been provided to alert the operator of an adverse environment within I the RHR pipe chase. Similarly trainized temperatured switches (9 per train) }

have been located along the route of the auxiliary boiler steam line. These switches will automatically terminate steam flow via two series isolation valves.

Conclusion The conclusion of this evaluation is that a safe shutdown can be achieved at SQN even if a postulated accident is compounded by environmentally induced inappropriate control system actuation.

!347 138 0

9 e

e

JE ,

Figure One - Screening Matrix Systems marked "X" functionally have the potential to interact with required safety features. These systems have been further evaluated to determine the existence of unacceptable environmentally-induced control system actuations.

G 1347 139 l

i a

9

'b?