ML19296C215
| ML19296C215 | |
| Person / Time | |
|---|---|
| Issue date: | 01/23/1980 |
| From: | Israel S Office of Nuclear Reactor Regulation |
| To: | Angelo J Office of Nuclear Reactor Regulation |
| Shared Package | |
| ML19296C199 | List: |
| References | |
| REF-GTECI-A-17, REF-GTECI-SY, TASK-A-17, TASK-OR NUDOCS 8002250400 | |
| Download: ML19296C215 (7) | |
Text
o ENCLOSURE 2 UNITED STATES n asco
'o, NUCLEAR REGULATORY CoMMisslON l
f 7, c,g k
WASHINGTON, D. C. 20555 2..
g
?,
e s,,
y JAW 2 31980 MEMORANDUM FOR: John Angelo, Task Manager, Systems Interactions FROM:
S. L. Israel, Section Leader, Reactor Systems Branch, DSS
SUBJECT:
COMMENTS CONCERNING SANDIA'S REPORT ON SYSTEM INTERACTION The enclosed questions and discussion on the " Systems Interaction Methodology Applications Program - Phase I" draft report from Sandia Laboratories concern areas we believe need additional corrent or work. Major areas of interest to RSB are criteria used in making decisions aad delineation of areas not covered or included in the report.
b m
[
C7 GYW Sanford L. Israel, Sect - Leader Reactor Systems Branch Division of Systems Sa-
Enclosure:
As Stated cc:
T. Novak R. Denise G. Kelly H. Hanauer M. Aycock
Contact:
Glenn Kelly, NRR Ext. 27591 8 0 0 2 2 5 0 #f-N
ENCLOSURE Potential Areas to be Modified in the Final Report - Phase I Systems Interaction Application Program (1) pg. vi, Detennine interaction probability: When discussing soft spots found in the Standard Review Plan (SRP), indicate how the potential for an interaction was determined to be reasonably high.
(2) pg.1-2, Bases for public safety:
Describe the bases used for determining whether a particular systems interaction is important to public safety.
(3) pg.1-3, Likelihood of interaction:
Describe how the estimated likelihood of an interaction occurring was calculated. Against what bases or criteria was it measured to determine if the interaction has safety significance.
(4) pg.1-4, pg.1-17, Sabotage:
Justify-that the methodology developed is applicable to sabotage.
(5) pg. 1-11, pg. 1-17, Water hammer:
The discussion of consec-ions on pg. 1-11 includes water hammer while Table 1.1 on pg.1-17 indicat' water hammer is not considered.
(6) pg. 1-15, Methodology step 9: Step 9 needs elaboration or explanation concerning what is meant by " Eliminate any specific events which are not applicable to the mode / occurrence category."
(7) pg.1-16, Ranking potential interactions: Provide and discuss your bases for ranking potential interactions not covered by the SRP.
(8) pg. 2-1, Model criteria:
Provide the bases or criteria used in determining what parts of a system affect the undesirable top event.
Provide or discuss the criteria used to determine it all or a portion of a system is to be model ed.
(9) pg. 2-2, Cut sets: Define cut sets on pg. 2-2 rather than wait for Section 3.0.
(10) pg. 2-3, Logic models: Provide the bases for discarding 40 logic models which are "similar" to others.
(11) pg. 2-4, PORV setpoints: A number of nuclear power plants use PORVs with a dual setpoint for protection against violation of 10 CFR 50 Appendix G during low temperature operation.
Under low temperature operations the PORV setpoint is usually fixed about 450 psig.
This application should be
\\
included in the discussion.
(
(12) pg. 2-5, All Other Categories ( AOC):
Justify why the chosen set of events is adequate for determining important system interactions.
In particular, why was not the mesh made larger to include more events?
(13) pg. 2-5, Important cut sets:
A stated objective of_the fault tree analysis is to " evaluate important cut sets." Expand on the meaning of important cut sets.
(14) pg. 2-6, Necessary and sufficient:
Justify that the faultstree models identify and delineate the necessary and sufficient functions required to respond to an initiating event.
(15) Section 2.3, Inadvertent RCP start:
In response to staff questions and requirements, W provided a report on low temperature Water Solid Over-pressure (WSOP) to the staff and the W Owners Group. The report detailed a methodology for calculating a WSOP event, evaluated several initiating events, and discussed proposed mitigating equipment.
In this report, W indicated that the most limiting WSOP event analyzed was the inadvertent startup of an idle RCP in conjunction with the secondary side being 50 to 100 degrees Fahrenheit hotter than the primary system.
This event was not analyzed nor discussed in the systems interaction report.
(16) Section 2.3, Water-solid overpressure: The discussion of overpressure does not mention the fact that 10 CFR 50, Appendix G, prohibits violation of certain pressure / temperature limits during any condition of normal
. operation including anticipated operational occurrences.
In general, the section on RCPB is meaningless without some criteria to judge the resulting pressures / temperatures against. Quantitative values should be provided to indicate if coupled pressures and temperatures are acceptable or not. Unless acceptance criteria for anticipated operational occurrences can be provided by the staff to Sandia, the discussion on RCPB should be deleted from this report.
(17) Operator mitiaation:
In general, it was unclear in the report exactly what credit was allowed for operator action (positive and negative).
Clearly ine ate where operator action was permitted and where it was
~ ~ "
prohibited in your analyses.
(18) pg. 2-14, RHR isolation valves: RHR isolation valves take 1 to 2 minutes to go from the full open to full closed position.
These valves are not designed to mitigate an overpressure event in progress as implied b'y' i report; rather they are to assure that as the primary system pressu-icreases to above a certain pressure set point (525 to 750 psig), the R suction valves will be automatically closed. The concern is that the operator might only close one of these valves in series and then might pressurize the primary.
Should the single isolation valve subsequently fail, the low pressure RHR system would then t,e lost.
(19) pg. 2-18, RHR atmospheric relief mode failure: The discussion of the RHRS atmospheric relief mode is confusing.
Describe this mode and indicate why a plant is in that mode if the primary pressure is below 180 psig.
(20) pg. 3-1, Systems important to safety: Cn pg. 3-1 it is stated that the large member of systems and subsystems which could be subject to inter-actions was first reduced to those important to safety.
Describe this process and the criteria used.
. (21) pg. 3-6, Adverse environment: The report states that if a location were found to be important to safety and there existed a potential for adverse environmental conditions, then the adverse condition was reviewed to determine whether or not it could cause all the components in the location to fail in the manner needed to bring about the top event.
Discuss the bases used for these determinations.
(22) pg. 3-7, Manual valves:
The report assumes that manual valves are not subject to potential interactions which could change their position.
Obviously, in the real world this isn't true due to component or train tests, maintenance, or human error.
Provide a statement noting that this consideration was eliminated since human actions which increase the severity of an event are not considered in the study.
(23) pg. 3-13, Fire and flooding:
In discussing the steps taken in comparing the SRP with questions developed from _ system interactions it was implied that fires and floods were reviewed and included in the body of the report.
However, Table 1-1 indicates that fires and floods were not reviewed.
m~,
(24) pg. 4-1, System interactions which failed the pressure boundary:
The report states that any system interaction which causes the pressure boundary to fail and also results in the failure of one or more of the mitigating systems was not analyzed. Justify such an exclusion and discuss the implications of not reviewing these events.
(25) pg. 4-2, Missiles inside containment: The staff has very limited acceptance criteria for missiles generated inside containment.
(26) pg. 4-2, Check valves:
The report states that check valves are assumed not to be subject to potential interactions other than water hammer phenomena.
This implies that the effect of water hammer was included in the report.
It is not, as stated in Table 1-1 and should be so noted here.
Also, failure of a check valve can be caused by debris in the line, or parts of a failed check valve can jam other valves.
There are LERs on just such events.
Justify the assumption that check valves are not subject to system interactions.
~
. (27) Loss of offsite power:
Can the loss of a single bus or inverter be more limiting than the total loss of offsite power?
If so, how has this been factored into the report?
(28) Multiple events: Throughout the report, the number of reviewed or reported cut sets was limited to three or less. Will not some of the cut sets with more than three events have a higher probability of occurring than some two or three event cut sets? How is this reflected in the report so that the reader is made aware that some important events (probability wise) have not been presented?
(29) pg. 4-4, Overpressure cut sets: Justify why only overpressurization cut sets involving ov. charging to a water-solid state were actually reviewed.
(30) pg. 4-4, Pressurizer safety valves:
Justify considering failure of all 3 safety valves three independent events when they have a common location.
.+
(31 ) pg. 4-15, Water-solid transients: Many water-solid overpressure transients are quite fast, such that they reae.h their peak pressures in seconds.
(The report incorrectly states these transients are not fast.) The report also implies that if a plant can take a hydro-test then it can take ordinary overpressure events,which may not be true.
Hydro-tests are done with an unieradiated vessel at the beginning of the vessel's life.
These over-pressure events can occur throughout the life of the plant when radiation damage has weakened the vessel, leaving it subject to possible failure when stressed.
l i
(32) pg. 5-3, Auxiliary feedwater trains: Three trains of auxiliary feedwater were considered in the analysis presented in the report.
Most operating plants have two trains of auxiliary feedwater and two train systems have very different cut se'.s.
This fact should be presented in the report.
8 (33) Section 6.1.2, Boron dilution:
Explain why Sandia did not seek an answer to the question of how the SRP treats boron dilution.
(34) pg. 6-9, ECCS boration:
The report states that "there are almost no requirements for ECCS boration." This is not true in that indirectly through the accident analyses for SLB, LOCA, FWLB, and other accidents it is clear that the ECCS must inject boron into the core in order to satisfy acceptance criteria. Modify the report to indicate that the ECCS needs to be borated to meet acceptance criteria.
(35) Methodoloay limitations: The report indicates a number of areas where the methodology of determining system interactions can be applied.
However, the report does not provide sufficient discussion on how the methodology is limited, does not indicate-wheri it'is not applicable, and does not detail the consequences of the listed and unlisted assumptions.
Provide a discussion of the above listed items. The general steps Mken in following the systems interaction methodology are listed on pages 1-14 to 1-16.
Expand this discussiUN.o point out where engineering judgments were made by Sandia and provide a reference to the bases for these judgments.
It is very important for potential users of this methodology to understand not only what is included and covered, but what is not.
(36)
PORV isolation: On many operating nuclear facilities the PORVs leak and, therefore, they are isolated. This condition changes many cut sets and their implications and should be noted in the report.
i
'