ML19344E612
| ML19344E612 | |
| Person / Time | |
|---|---|
| Site: | Rancho Seco |
| Issue date: | 07/31/1980 |
| From: | Weber D EG&G, INC. |
| To: | Shemanski P Office of Nuclear Reactor Regulation |
| References | |
| CON-FIN-A-6256 EGG-EA-5204, TAC-6710, NUDOCS 8009020366 | |
| Download: ML19344E612 (16) | |
Text
.
a 9,
hEGnG......
FCpuEG4G300 (Rev 11.FM INTERIM REPORT Accession No.
Report No.
EGG-EA-5204 Contract Program or Project
Title:
~
Electrical, Instrumentation and Control System Support
. Subject of this Document:
Electrical, Instrumentation and Control Aspects of the Lov Temperature Overpressure Mitigating System, Rancho Seco Unit 1, Docket No. 50-312, TAC No. 6710 Type of Document:
Informal Report 1
Author (s):
D. A. k'eber Det) of Document:
July 1980 R:sponsible NRC Individual and NRC Office or Division:
Paul C. Shemanski, Division of Licensing This document was prepared primarily for preliminary or internat use. it has not received full review and approval. Since there may be substantive changes, this document snould not be considered final.
EG&G Idaho, Inc.
Idano Falls, Idaho 83415 Prepared for the U.S. Nuclear Regulatory Commission Washington, D.C.
Under DOE Contract No. DE AC07 76tD01570 NRC FIN No.
A6256 INTERIM REPORT l
l l&
~
5#
ts00902036h
' [.;.,Of
v.
1825F TECHNICAL EVALUATION ELECTRICAL, INSTRUMENTATION, AND CONTROL ASPECTS OF THE LOW TEMPERATURE CVERPRESSURE MITICATING SYSTEM RANCHO SECO UNIT 1 (Docket No. 50-312)
TAC 6710 D. A. Weber j
Reliability and Statistics Branch Engineering Analysis Division EG&G Idaho, Inc.
4 6
-. ~ -
TECHNICAL EVALUATION ELECTRICAL, INSTRUMENTATION, AND CONTROL ASPECTS OF THE LOW IEMPERATURE OVERPRESSURE MITIGATING SYSTEM RANCHO SECO UNIT 1 (Docket No. 50-312) 1.
INTRODUCTION 1
By letter dated August 11, 1976, the NRC requested Sacramento Mini-cipal Utility District (SMUD) to evaluate the Rancho Seco Unit 1 "overpres-sure protection system designs to deter
.aeir susceptibility to over-pressurization events," and their ab;.ity to mitigate the consequences of these events.
It was also requested that operating procedures be examined and administrative controls be implemented to guard against initiating overpressure events at temperatures below the Nil Ductility Transition Temperature (NDTT).
2 3
By letters dated October 14, 1976, and October 28, 1976, SMUD submitted to the NRC a plant specific analysis. The NRC questioned portions of this analysis in a letter dated December 10, 1976'.
In responding, 5
SMUD, in a letter dated March 17, 1977, revised their analysis and answered the NRC questions. The NRC requested additional information 6
regarding modifications in letters dated November 2,1977, and March 13, 7
1978. SMUD supplied the additional information in their letter of 8
March 29,1978,
The electrical, instrumentation, and control system aspects of the existing SMUD low temperature overpressure mitigating system (CMS) and the proposed design changes have been reviewed in this report.
Section 2 describes the two events which SMUD's analysis indicates would result in an overpressure transient. Section 3 describes the Rancho Seco Unit 1 over-pressure protection and SMUD's proposed design change.
Section 4 provides an evaluation of the existing CMS and the proposed design change as they apply to the staff requirements. Section 5 lists recommendations as they apply to Technical Specifications, the existing OMS, and the proposed design changs. Section 6 is a sunmaary of this report.
I
2 2.
DESIGN BASIS EVENTS (DBE)
SMUD has analyzed seven low temperature overpressure events to deter-0 mine whether they are applicable to Rancho Seco Unit 1.
l l
Based on the SMUD analysis, erroneous actuation of the high pressure injection (HPI) system and the makeup control valve (to RCS) failing open, have been identified as the limiting mass addition overpressure transient which require action to prevent overpressurization within 10 minutes of initiation. Operation of an HPI pump, which is capable of delivering flow l
against full system operating pressure, is required whenever a reactor coolant pump is in operation (provides RCS pump seal water). Since the discharge of an HPI pump is isolated from the reactor coolant system by a single injection valve, a single error or equipment failure could open the injection valve and overpressurize the reactor coolant system (RCS).
Action would be required within 4.4 minutes to maintain the RCS pressure below Appendix G limits. For the event in which the makeup valve to the RCS fails full open, SMUD's analysis shows that action would be required within seven minutes to maintain the RCS pressure below the Appendix G limits 5, l
3.
OVERPRESSURE PROTECTION l
3.1 Description 1
i i
For the Rancho Seco Unit 1, overpressure protection censists of oper-ator action and the Overpressure Mitigating System (OMS). The Decay Heat Removal (DHR) system can also provide some additional relief protection l
from overpressure transients; however, it is very small and intended only to provide thermal relief.5 l
l l
3.1.1 Operator Action With a steam or nitrogen bubble in the pressurizer, the operator has l
4.4 minutes or 7 minutes to prevent an overpressurization with a HPI, or an i
l open makeup valve transient, respectively. The operator action necessary 2
to prevent overpressurizatica is to determine the cause of the transient and to deenergize or control the responsible equipment before the RCS pressure reaches the PORV setpoint.
3.1.2 overpressure Mitigating System (OMS)
The OMS consists of a single, dual setpoint, power-operated relief valve (PORV). The valve has a high overpressure setpoint of 2255 psig for reactor operation and a low temperature overpressure s 2tpoint of 550 psig for reactor cooldown and heatup. A manually operated switch under admini-t rative control is provided to change the PORY setpoint. An enabling alarm alerts the control room operator to switch to the lower setpoint when the RCS pressure is below 550 psig.,
5 SMUD has stated in their letter of March 17, 1977, that the PORY has a steam (or nitrogen) relief capacity greater than the injection rate of two HPI trains, and a liquid relief capacity equal to or greater than the injection rate of one HPI train.
3.1.3 Transient Indications and Alarms Alarms and equipment whici give indication that a transient is in progress include, wide-range pressure transmitters (0-2500 psig) used for actuation of the engineered safeguards systems; a pressure transmitter (0-600 psig) on the pressurizer sample line that controls the power-operated relief valve; two pressurizer level instruments and associated high and high-high level alarms; a letdown storage tank low level alarm; makeup system flowrate indication; and makeup valve position indication.
SMUD provides three acoustic monitors, downstream of the PORV and each of the two pressurizer safety valves, to provide direct indication of the positions of each valve. A single alarm is actuated if any of the three monitors detects flow.
The operator then checks the indicators for each valve to determine which has lifted.
3 l
l
j 3.1.4 Procedural Precautions The staff position with regard to the inadvertent operation of compo-nents capable of causing a low temperature overpressurization requires the deenergization and either lockout or alarming of unused equipment capable of causing the overpressurization.
Procedural steps requiring the removal of equipment from operation, s
e.g., the opening of pump and valve circuit breakers, require initialling 4
5 to indicate satisfactory completion of each step. Critical steps performed under administrative control are included.
To prevent the erroneous action of an HPI train, circuit breakers for the closed HPI motor-operated valves are opened during plant cooldown and prior to start-up of the DER system. This is accomplished by opening and tagging the valve circuit breakers at the motor control center. These i
circuit breakers are not closed again until startup when RCS temperature is above 280 F.4 The operator has indication that power has been removed 0
as the status lights in the control room will be off. SMUD has incorporated changes into the valve indicator pov r supplies so the valve positions are indicated in the control room even though the circuit breakers have been opened.
3.2 Proposed HPI OMS Addition With the initial RCS conditions at NDTT and a pressure of 250 psig, the ' analysis has determined the time required for a pressure transient to reach 550 peig'(required relief setting) after initiation varies between I
4.4 and 46.6 minutes, depending on the transient source. Only a pressure transient caused by the actuation of an HPI train or on open makeup valve will reach the vessel overpressure point of 550 psig in less than ten minutes. Therefore, SMUD preposes an overpressure protection system modification which provides control room annunciation for an over-pressurization incident caused by HPI system actuation, an open makeup valve, or when the PORV block valve is closed.0 4
4
When the reactor coolant system pressure drops below 550 psi, the control room operator receives an alarm to enable the low pressure setpoint circuit of the dual setpoint PORV. This is accomplished by closing a keylock switch which aligns the low pressure setpoint. The switch also sets up four annunciator circuits. An alarm is provided when (a) power is available to either of the two EPI pumps, (b) high flow to the RCS is detected (which would be caused by the failure of a makeup valve in the full-open position), (c) either of the four motor-operated injection valves are open, and (d) the PORV block valve is closed, removing the PORV from service.0 4.
EVALUATION OF THE EXISTING AND PROPOSED CMS The OMS, present and proposed, as it is designed to respond to transi-ents, is evaluated relative to the staff requ trements as follows:
l.
Requirement Operator Action - No credit can be taken for operator action until ten minutes after the operator is aware, through an alarm, that a pressure transient is in progress.
Evaluation The existing dual setpoint PORV OMS, when in service, will relieve all low temperature pressure transients.
However, it is not single failure free. The proposed OMS does not meet this requirement. Operator action is required as the primary protectien for two events.
The events which would require operator action in less than ten minutes are an HPI transient and failure of the makeup valve in the full-open position.
5
2.
Requirement Seismic and IEEE 279 Criteria - Ideal v, ti t system should meet Seismic Category I and IEEE 279 criteria.
The basic objective is that the system should not be vulnerable to a common failure that would both initiate a pressure transient and disable tho overpressure miti-gation system.
The original intent of the NRC staff was that at least two independent automatic low pressure protection chan-nels should make up the OMS. Each channel should include separate sensors, alarms, power trains, and relief valves. Each channel should have complete elec-crical and physical independence from each other to prevent common mode failures. The OMS should be over-able upon loss of offsite power.
In addition, each OMS channel should not be susceptable to seismic events that could cause a transient and fail the :hannel at the same time.
Evaluation The existing and proposed Rancho Seco Unit 1 OMS does not comply with the IEEE 279 or Seismic criteria.
Regarding the IEEE 279 criteria, the existing and pro-posed OMS does not provide for a second independent automatic low pressure protection channel. The addition of the enabling alarm will assure proper alignment of the overpressute protection system. The four additional alarms will annunciate if power is available to the RP1 pumps, the injection valves are open, the makeup valve is open, and/or the PORV block valve is closed. These additional alarms do not qualify as a second auttsstic icw pressure protection channel for the CMS. Regarding Seismic criteria, SMUD states that detailed 6
--w
stress ar alyses have been performed for the pilot-actuar e rilief valve in accordance with ASME Sec-tion III, . ass 1 requirements and have been found ade tate for Class 1 applications. However, testing th simulated seismic lo.tdings has not beer. perfor=ed as this was not a requirement at the time the plant was designed and constructed.5 3.
Requirement Single Failure - The system must be designed to relieve the pressure transient given a single failure in addi-tion to the failure that initiated the pressure transient.
Evaluation The Rancho Seco OMS does not comply with the single failure criteria in that there is only one RCS low temperature overpressure p-otection channel, i.e.,
there is ne channel redundancy.
4.
Requirement Testability - The system shall include provisions for testing on a schedule consistent with the frequency that the system is relied upon for pressure protection.
Evaluation The single existing PORV system is designed to allow testing of the system prior to its use.
7 e
w
5.
RECOMMENDATIONS 5.1 Technical Specifications It is the staff position that administrative controls shall appear in the Technical Specifierticus as Limiting Conditions for Operation when administrative controls arc. used to limit overpressurization scenarios.
Therefore, it is recommended that the licensee be required to submit Tech-nical ?pecifics. tion changes for Rancho Seco Unit I consistent with the following:
4 i
1.
Any operation or failure of the PORV to operate to relieve pressure transients must be reported to the NRC.
2.
The existing CMS and alarms must be operable (in oper-0 acion) when the RCS temperature is below 280 F.
If the OMS modification is installed and in operation, j
then the system and its related alarms must be operable when the RCS temperature is below the minimum pressur-'
i:ation temperature. If these cenditions are not met, the primary system must be depressurized and vented to j
the atmosphere within eight hours.
3.
The four HPI motor-operated valves must be closed and a
the supplying circuit breakers open and tagged when the temperature is below 280 F and the reactor coolant is i
not vented to the atmosphere.
4.
The low temperature overpressure protection system and i
added alarms must be tested on a periodic basis censis-tent with the need for its use. A system functional test and a setpoint verification test shall be performed
~
prior to enabling the overpressure protection system during cooldown and startup. The system shall be cali-i braced, and the PORV and related OMS alarm operations
' tested at re fueling intervals. The HPI valves will be 8
1 allowed to be cycled only if (a) all HPI pumps are out of service, or vessel temperature is above the minimum value for which the vessel can be fully pressurized, or (b) the reactor vessel head is removed.
5.
When the reactor vessel temperature is below the minimum value for which the vessel can be fully pressurized, the PORV may be removed from service for a maximum of two hours only if (a) charging pumps are out of service and all HPI injection valves are closed and power removed, or (b) the vessel head is removed.
5.2 Existing OMS With regard to recommendations concerning the existing CMS, the licensee should:
1.
Submit Technical Specifications to comply with the requirements listed in Section 5.1 2.
Identify, in the Technical Specifications, the enabling 0
temperature and PORV setpoint 3.
Propose Technical Specifications related to system 0
testing 4.
Ins :all pressure alarms to give the operator direct indication that a low temperature-pressure transient is in progress and that the RCS pressure has exceeded 550 psig 9
9
o 5.
Examine the maintenance and testing restrictions to aneure compatibility with present/ proposed Technical Specifications regarding the operability and periodic testing of ECC and emergency boration system.6 5.3 Proposed OMS It is recommended that the following be required of the licensee:
1.
All alarms, instrumentation, control circuits, and power required by the operator to detect EPI overpr' essure transients should be electrically and physically separated from the PORV system (i.e., meet IZZE 279 criteria) 2.
Assure that the new equipment is seismic qualified and testable.
6.
SUMMARY
~
^
The NRC letter of August 11, 1976, regarding reactor vessel overpres-surization, requested the Sacramento Municipal Utility District to evaluate 4
their low temperature overpressure mitigating systems for Rancho Seco Unit 1 to determine their susceptibility to overpre3sure events.
The evaluation that SMUD provided indicated that there were two events, a transient caused by the inadvertent operation of the high pressure injec-tion system and the makeup valve failing full open, that would require opes.cor action in less than the ten minutes allowed by the staff require-ment to prevent overpressurization. On March 29, 1978, SMUD provided details of a proposed overpressure protection system modification in addi-tion to an existing PORV dual setpoint system that would provide control-room alarms if the PORV block valve was closed, the four motor-operated injection valves were open, power was available to the two HPI injection pumps, and/or the makeup valve was open.
10 D
e The existing and proposed system does not meet the staff positions regarding operator action for an overpressurization and the seismic and single failure requirements.
Although the Rancho Seco Unit I does not comply with all of the original staff positions, there are other factors which should be considerea. The staf f positions for an OMS vere originated -for plants that are operated with the RCS in a water-solid condition during cooldown and startup. With a water-solid condition, a transient can cause an over-oressurization of the vessel within seconds of initiation. This step transient makes it impossible for an operator to detect a transie at and act in time to prevent overpressurizrtion. The B&W-designed plant never operates with a water-solid condition. A steam or nitrogen bubble is maintained in the reactor pressurizer at all times, which does not allow step transients to occur.
Instead, transients occur as a ramp function with the EPI transient or the makeup valve failing open transient reaching
~
the overpressurization point 4.4 minutes and seven minutes or more af ter initiation and all other transients requiring over ten minutes. This delay allows the operator time to detect the transient and take action to prevent the RCS pressure from reaching the PORV relief point. There has been only one lov temperature overpressurization at the B&W-designed plants.
In order that the Rancho Seco CMS be found acceptable in the areas of EI&C the licensee should be required to implement the additional changes described in Section 5.0 of this report.
7.
REFERENCES 1.
R. W. Reid, NRC letter to SMUD, Re: " Reactor Vessel Overpressurization in Pressurized Water Reactor Facilities," August 11, 1976.
2.
J. J. Mattimoe, "Evaluetion of Potential Vessel Overpressurization,"
October 14, 1976.
11
~
2 3.
J. J. Mattimoe, " Reactor Vessel Overpressurization Events," October 28, 1976.
4.
R. W. Reid, NRC letter to SMUD, Re:
" Additional Information to Evalu-ate Overpressure Mitigating System," December 10, 1976.
5.
J. J. Mattimoe, " Evaluation of Potential Vessel Overpressurization,"
March 17, 1977.
6.
R. W. Reid, NRC letter to SMUD, Re:
"RCS Overpressurization,"
November 2,1977.
7.
R. W. Reid, NRC letter to SMUD, Re:
" Dual Setpoint PCRV," March 13, 1978.
8.
J. J. Mattimoe, " Proposed Overpressure Protection System Modification,"
March 29, 1978.
A e
i a
F-i
~
12 e
-