ML20002C806

Submits Addendum to Util 770915 Exemption Request Re ECCS Per NRC Addressed Concerns

ML20002C806
Person / Time
Site:	Big Rock Point File:Consumers Energy icon.png
Issue date:	10/12/1977
From:	Bixel D CONSUMERS ENERGY CO. (FORMERLY CONSUMERS POWER CO.)
To:	Desiree Davis Office of Nuclear Reactor Regulation
References
NUDOCS 8101120040
Download: ML20002C806 (13)

Text

.

(-

consumers 1

" ]-

pm.,cr C0mpBDy

/D,w Generet of' ices: 212 West Michigen Avenue. Jackson, Mechtgem 49201 e Area Code St I68-OSSO October 12, 1977

?

d77

.6 5'-*r V.:I.

Director of Nuclear Reacter Regulation

/f.

Att: Mr Don K Davis, Acting 3 ranch Chief

,;./-'

Cperating Reactors Branch No 2 US Nuclear Regulatory Concission

'4ashirgton, DC 20555 DOCKET 50-155, LICE:iSE DPR SIG ROCK PCIUT PLAUT - ADDF";D'24 TO EXE"PTION REQUEST By letter dated September 15, 1977, Consumers Power subnitted a request for exe=ption under the provisions of 10 CFR 50.12.

Subsequent to that submittal, more information pertinent to the request has been researched and several itens cf concern addressed by the staff have been analysed. Thus, the purpose of this letter is to provide the necessary information and responses.

Section III of Consumers Power Company's request for exe=ptien submittal dealt with a probability study on the risk assess =ent of a postulated LOCA in the redundant core spray line assuming core reflood from the reactor feed system.

A basic precise of this probability analysis is that emergency cakeup water from the fire header is necessary for feed system operation and core reflood. to this letter shows that this is not the case and, therefore, should not be considered. However, credit must be taken for the proper oper<1-tion of certain key valves in the condensate system to ensure adequate hot well cakeup and feed flow. Thus, the probability analysis has been modified to re-flect these changes.

The risk assessment of Section III now becomes:

Risk = P (P )

N F

'Jhere Pg represents the probability of a LOCA in the redundant core spray system ard PF is the probability that the reactor feed system is inoperable.

The logic diagram for P now becomes:

p g 9 k I

f/bHDoo 4

2

(

P P

P P

g g7 C1 CV ICECK 2400 480 V COND CHCK 480 VjCOND O

L P #2

[ Y 10FFSITa P =

g, p

V BUS M1 PR y

P C2 CV L2 PM2 P

P MCC g

g 23 TRAnSPER SWITCH MCC gg 1A e

P

'X

=

'P1

~

P P.

FV MV RV R

2, I FILL IGKEUP RECIRd REJECT i'1 IVALVFE VALVE VALVE l VALVE FIED

~

P #2

1. P2 CV RE RV CHCK RELIEF RECIRC V

VALVE VALVE PFC CV1 7CVl lCHCK \\1 CHCd RELIEF RECIRC Vl VALVE VALVE PCV RE RV

Thus,

( M2 + X} ( !C

• X
• P

=P + + 7 O S L1 Cl CV L2 C2

• CV s

+P +P + P +P +D +PFV + D'MV RV R TS lY 'A 'RV)] + P +P RV) x (PP2 CV RE +P +P +D [(PP1 + PCV RE +P +P FC - CV1 Note: All probabilities are taken frc= WASH 1400 unless otherwise noted. {

( ) 3 I The new ter=s in the diagram and equation relate to the necessity of having two condensate pu=ps available and adequate feed makeup from the condensate storage tank. To acco=plish this, the condensate fill valve (PFV) a41 =akeup valve (PMV) TS, P y) and air (P ) must open as designed. Therefore, power.(PM1, Pga, Fx, P l A must be available. The possibility that the condensate recirculation valve (PRV). condensate reject valve (Pa), feed pu=p recirculation valves (PRV) or feed pu=p re-lief valves (Ppy) spuriously ope =, thereby decreasing the available flow, must also be considered. The individual probabilities are developed below. P = pr bability that =otor control cencer bus 23 is lost due to short to M2 ground or brea'ter inadvertently opening. Assu=e 100 vires and a one-hour need ti=e. 4 = 3 x 10 /h-vire x 100 wires x 1 h x 1x10 /h x 1 h -5 = 3.1 x 10 P = probability of transformer shorting or open circuiting. Assu=e a one-y hour need ti=e. = (1 x 10 /h + 1 x 10 /h) x 1 h = 2 x 10 k P = probability that transfer switch fails. Assu=es a one-hour need ti=e g and a failure of a normally open contact to shut (assu=es pre =ature breaker transfer). = 1 x 10 /h x 1 h = 1 x 10 P = probability that motor control center bus 1A is lost due to short or 'y breaker failure. Assessed as same value as PM2* -5 = 3.1 x 10 P = probability that I&C Panel lY is lost due to short or breaker failure. yy Assessed as same value as P -5 = 3 1 x 10 P. = prcbability that control air is lost.' Since there are no auto =atie valves that can preclude a source of air to the valves, the probability that air ^ is lost is cc= parable to the probability that a connection or elbow is blo*.m and the syste= depressurizes. This is conservative in that no credit is taken for co= pressor operation to renew air supply. Assu=e 1000 joints and a one-hour need time. -T = 3 x 10 / joint-h x 1000 joints x 1 h / = 3 x 10-

( i k ( P = probability that condensa.te fill valve does not open. This is comprised g of the probability that an air-operated butterfly valve does not open and,a limit switch fails. = (1 x 10 /d) + (3 x 10 /d) = h x 10~ /d P = probability that nakeup valve does not open. This is co= prised of the g probability that an air-operated valve does not open, a solenoid valve does not open and a limit switch fails. -3 = (1 x 10~ /d) + (1 x 10 /d) + (3 x 10~ /d) -3 = 1.h x 10 /d P = pr bability that the recirculation valve fails open. Since this valve RV fails shut on loss of air or electrical power, the only feasible action causing the valve to open vould be a failure of the differential pressure switch cr the valve fails to close (assu=e one-hour need ti=e). = 1 x 10 /d + 3 x 10 /h x 1 h = h x 10 P = pr bability that condensate reject valve fails open. This valve operates R like the recircalation valve; thus, it vill open on a direct short of the level switch, failure of the level controller, or the valve fails to re=ain closed (the do=inant factor). = 1 x 10 P = probability relief valve opens pre =aturely. Assu=e one-hour need time. g = 1 x 10 '/ h x 1 h = 1 x 10 ' ~ P = probability that feed pump recirculation valve opens. These valves fail open gy on loss of air or loss of power; therefore, the overriding failure = ode is failure of the solenoid operator. -3 = 1 x 10 Thus: ( M2 X} ( M1 X + + 3 O S L1 Cl CV L2

• C2 CV P

=P ^ + Pg+Pg g+Pg+Pg gy + P3+ +P +P I py CV RE RV P2 C7 RE + RV } * [(P +P FC CV1 { \\ i

l, 5 = 1x10-3 +.03x10-3 +.033x10-3 + 1.03x10-3,1xyg-3 i' .033x10-3 + 1.03x10-3 +.1x10-3 + ((3 1x10-5 +.2x10-5) (3.1:t10-5 +.2xt0-3) 1x10 +.03x10-3 +.3x10-3 +.hx10-3 + 1.kx10-3 + hx10 + 1x10 [(1.01x10-3 +.1x10-3 +.01x10-3 + 1x10-3) (1.01x10-3 +.ix10-3 .01x10" + 1x10-3)] 2-(1x10- ) + (.03x10- ) + (2.32x10-3) + (1.0x10-9) + (1x10-6) + (.03x (.3x10-3) + (.hx10-3) + (1.hx10-3) + (hx10 ) + (1x10 ) + (h.h2x10 ) -3 .. P 5 98x10 F Thus the Risk now becomes Risk = PN (P ) F 2 9 x 10-3 (5 98 x 10-3) s -7 = 5 38 x 10 The recainder of this letter vill provide the responses to specific ite=s of concern addressed by the staff. ITE4 The probability of total reliance on the redundant core spray syste= calculated in Sections I and III of Consu=ers Power Cc=pany's submittal dated Septe=ber.'.7,, 1977 should include error bands since the =ean failure probability for each co=- ponent has been utili::ed. RESPO'.SE The appropriate upper and lover bounds given in the WASH 1h00 report for co=ponent failures utilized in our sub=ittal of September 15, 1977 are as follows: CP Co Value/ Event Lover Bound Uccer Eeund WASH 1h00 Median -l -9 -9 LOCA (> 3" Pipe Segment) 3 x 10 /h 3 x 10 /h 1 x 10 /h -l -2 DG Failure To Start 1 x 10 /d 1 x 10 /d 3 x 10 /d -2 -3 DG Failure To Run 3 x 10 /h 3 x 10 /h 3 x 10 /h -3 -3 Brkr Failure To Transfer 3 x 10 /d 3 x 10 /d 1 x 10 /d -I Bus Short 3 x 10 /h 3 x 10 /h 3 x 10 /h -3 -3 Pu=p Failure To Start 3 x lo /d 3 x 10 /d 1 x 10 /d -3 Pump Failure To Run 3 x 10 /h 3 x 10 /h 3 x 10 /h -3 -3 Relief Valve Openins 3 x 10 /h 3 x 10 /h 1 x 10 /h -3 Air-Op Valve Failure 1 x lo /d 1 x 10 /d 3 x lo /d M

? 6 ( CP Co Value/ Event Lover Bound Upper Bound WASH 1h00 Median ~I Check Valve Failure 3 x 10 /d 3 x 10~ /d 1 x 10~ /d -3 -3 Solenoid Valve Failure 3 x 10~ /d 3 x 10 /d 1 x 10 /d. ~I Premature BrKr Transfer 3 x 10 /h 3 x 10 /h 1 x 10 /h -T Connection, Elbow Failure 1 x 10 /h 1 x 10 '/h 3 x 10 /h ~0 ~ -3 MOV Failure 3 x 10 /d 3 x 10~ /d 1 x 10 /d Transfer Switch Failure 1 x 10 /h 1 x 10 /h 1 x 10~ /h ~9 ~0 3 x 10-7/h 3 x 10 /h 1 x 10 /h Transformer Shorting -T Transformer Opening 3 x 10 /h 3 x 10 /h 1 x 10 /h L1=it Switch Failure 1 x 10~ /d 1 x 10~ /d 3 x 10 /d -9 -7 Li=it Switch Short 1 x 10 /h 1 x 10 /h 1 x 10~ /h Tm =ajor co=penents of the probability study, the nonavailability of off-site power and the probability of a LCCA in the redundant core spray' line, were taken directly frc= the staff's letter of April 19, 1976 and do not have associated upper and lover bounds; therefore, a meaningful error band on the risk assessments cannot be calculated. Further, although Consumers Power Company did use the cor-putational =edian values of the WASH 1h00 report, the calculated risk assessment is felt to be nearer the upper bound of the analyses since many assu=ptions utiliced ( in the final computations (ie, nu=ber of pipe segnents, run times, number of wires, etc) were exceptionally conservative. ITE'4 Discuss the effects of testing and maintenance unavailability on the redundant spray syste= failure probability analysis and or the feed syste failure probability.

RESPONSE

Surveillance testing of redundant core spray system co=ponents at Big Rock Point eensists of =onthly auto =atic actuation checks of the emergency diesel generator, the electric fire pu=p, and the diesel fire pump. Additionally, monthly =anual actuation of valves MO-TOTO and MO-7071 are proposed for Cycle 15 Quarterly At operability checks on all ECCS sensors are proposed to ensure operability. no time during any of these tests is the availability of ECCS affected. The valve, pu=p and generator tests are performed with the equip =ent in the condition nects-sary to perfo::t its assigned ECCS fune:icn.' Thus, if a LOCA vere to occur during any of the testing, the equip =ent being tested is already in position, or operating as designed, for core cooling purposes. The only exception to this is the oper-ability checks on the ICCS sensors. As delineated in our letter of August 12, 1977, the operability of ECCS during sensor testing is affected by changing the inputSince logic frc= one out of two sensors necessary for actuation to one out of one. the sensor testing takes approxi=ately two to three hours, aad is acccmplished once per quarter, it is concluded that it has insignificant i= pact on the probability [ analysis. Thus, required ECCS surveillance testing has virtually no effect on the overall probability analysis. " Note: When the diesel fire pu=p is being tested, the breaker for the electric fire . pu=p is opened since this would operate first on a decreasing syste= pressure.

Qr i T I Big Rock Point Technical Specification 11.3.1.L.E states that if any ECCS com-t is inoperable a normal reactor shutdown shall be initiated within 2k hours .ponen and the reactor shut down within 12 hours. Thus, _ if maintenance were required on an ECCS component, such that that component were classified as inoperable, the-condition vould exist for a mavimum of 36 hours. If the postulated inoperable component was one of.the redundant core spray valves, the risk of having a LOCA concurrent with an inoperable redundant core spray system essentially becomes the risk of having a LOCA during a 36-hour period. This value is equal to Since the-1 x 10 sessent x'36 hours x 100 pipe segments or 3.6 x 10 Probability of having an individual ECCS component inoperable is extremely small (reference our September 15, 1977 s'ubmittal) and the probability _of a LOCA occur-ring during the period of radundant core spray system inoperability is also ex-tremely small, Consumers Power Company considers the overall risk assessment to l -be acceptable. During normal reactor. operation, there is no maintenance or testing scheduled that Big Rock Point has only . ill affect the capability of the reactor feed system. W For maintaining rated power two reactor feed pumps and only two condensate pumps. If it is postulated that either one of the condensate all pumps are necessary. pumps or reactor feed pu=ps is inoperable, the plant vould be limited to approxi-mately 50 !Ge operation and, of course, if no pumps were available, the plant would i= mediately shut down._ Eevever, to consider the effects of this' event on .the probability study provided in our September 15, 1977 submittal, one of the g redundant parallel reactor feed system paths must te considered inoperable. When this is done, the overall probability of the inoperability of the feed 'sys-

tem is increased by approximately 2.2 x 10-3 This is exceptionally conservative, however, since it does not account for the fact that power operation is signifi-

-cantly less than rated (approximately two-thirds) and it assumes that the inoper-able component is lost fo;- the ertire operating cycle (approxi=ately one year). Thus, Consumers Power Company concludes that even when the effects of inoperable equipment are considered the overall risk of a LOCA in the redundant core spray line, assu=ing feed system availability, remains acceptable. ITEM Estimate the probability of personnel error in the operation of the feed system after a LOCA. J REOONSE Quite obviously, this is a difficult, if not impossible, entity to deter =ine since it deals with a:3 signing values to the reliability of heum response during Since there is no method of quantifying this determination abnormal conditi'ons by examining past records and practices at Big Rock Point, the most reasonable course of action is to rely on values developed in the WASH 1h00 report. The basic operator actidh required is that the operator shut the feed-water regulating valve, start two condensate pu=ps and then start a reactor feed pump after five minutes has elapsed, and then open the feed-water regulating '{- . valve after ten minutes has elapsed;-all other actions, unless equipment faults The factors involved in this risk assessment are the arise, are automatic. general confusion that exists at the time of the event, the indications and e w ~ .-,,,y ,,s y op - m-g-

. -. ~ -. i 8 procedures available to the operator, the coupling of operator actions and the familiarity of the operator with complying with the specific task. Since these , factors are not independent of each other, they must be dealt with concurrently. i The general confusion approximately five minutes after a LOCA gives a Basic Operator Error rate of about .9, or nine out of ten times the operator will do the wrong thing. Hovsver,. this error rate is based on several factors in-cluding the operator not being familiar with the action ocessary (ie, has i never actually performed the evolution) and the action involving switches, handles or instrunents the operator may not have used in actual operation before. Clearly, this is not the case with operator action required to start-the reactor feed system. This is an evolution operators are routinely famil-iar with and often accomplish. There is a concise procedure that details this evolution, one that the operators routinely train on and use in plant evolutions. 4 Further, there is no question that the instrumentation and switch locations are readily known and routi ely used or monitored. They are adjacent to each other i on the bench censole and clearly marked. _ Thus, overster error under these con-ditions should clearly be less than the Basic Era.r rate. A more accurate value would be half that or about.h5 Further, since there would be at least th ee operators in the ecatrol room at this point in a LOCA (taking credit for the thift l supervisor), the probability that all three make the same error would be (.k5)3 or 9 1 x 10. This value takes no credit for the fact that the operator will I have indication available to him that vr:1d specify that the feed and condensate _' systems were not operating. The probability of the operator (s) failing to respond to this indication can be assessed at .l. Since the starting of the condensate pumps is directly coupled to the starting of the reactor feed pump, it.can be assumed that once the operator recognizes that the conilensate pu=ps must be started and starts them, the prc'; ability that he starts a feed pu=p is essen-tially 100".. Given that the feed pump has been started, the probability that the operator does not operate the feed-water regulating valve properly cust be addressed. Since (a) this action is one that the operator has performed during normal plant operation, (b) recognition of this action is directly associated with feed pu=p operation, prcper hotvell level and reactor pressure and (c) the operator receivers i=nediate feedback (through instrumentation response); a con-servative estimate of the probebility of his making an error can be assessed at 1 x 10-2 However, this tnkes no credit for the " recovery factor" (the operator i going through the procedure again if no flow is noted); this can conservatively decrease the overall probability by a factor of 10. Thus, the probability of operator error in starting the {eed system during a LOCA can be conservatively esti=ated at (91 x 10-3 + 1 x lo- ) x lo-1 or 1 9 x 10-3 j. 1 ITE'4 1 ~ Estimate the probability that the operator erroneously isolates the redundant core spray system under LOCA conditions. JRESPONSE ( lThis event is not considered credible. There is no situation tha*. could arise ~ i that would necessitate the ' solation of a broken pri=ary or redundant core spra'/ line-to ensure adequate cors spray cooling under LOCA conditions. Tu basis for this' state =ent lies in the "Hydraulie Evaluation of the Big Rock Point Plant .o, e y g. _g, ,m

=__.. _ - I .9 i Emergency Core Cooling System" developed by MPR Associates, Inc. August 1977 Ynis analysis shows that with a break in the primary core spray system and with the worst single failure in the fire header / core spray system, the redundant l core spray flow will'be sufficient to keep the core cooled without having to isolate the primary core spray break. Further, the combined use of the feed system and primary core spray vill keep the core covered in the case of a LOCA caused by a break in the redundant ' core spray system, with no isolation of the break. Therefore, Emergency Procedures at Big Rock Point vill be modified to ensure no operator action to isolate a broken spray line during the initial phases of ECCS operation. r- >I FX r [ k. .b t-t _ / David A Bixel l ' ' Nuclear Licensing Administrator CC: J3Keppler, USNRC

4. '

e t i \\

(. ) ATTACM3T 1 l CORE REFLOOD CAPABILITIES FOLI MING REDUTDANT CORE SFRAY LINE EREAK In the case of a redundant core spray line break, it becomes necessary to use the plant feed-water system to reflood the core, thereby ensuring that PCT v111 not exceed 2,200*F.. A blowdown analysis for the redundant core spray line break has been performed by the General Electric Co, using the SAFE Code. The results indicate that if feed-vster flow is available at 600 seconds after the start of the accident and increases linearly to 1,600 gym at 610 seconds, core midplane vin be recovered at 691 seconds; during this period, 2,293 gallons of feedvater would have been added to the core and PCT win not exceed 2,200 F. Based upon the above results, Consumers Power Company has performed an analysis of the condensate and feed-water system characteristic:s of the plant. This analysis considers the feed-water flow transient and makeup capacities for the condenser hot well frem the condensate storage tank after a LOCA in the redun-dant core spray line. The results indicate that the condensate pu=ps vill trip on low level in the condenser hot ven within 152 seconds fonoving the LCCA, and that sufficient water to recover the core vill be added to the hot vell via the condenser makeup between the time of pu=p trip and 600 seconds (refer to Table 1). 1 In the case of a partial break ocuring in the redundant core spray line, the blevdcvn transient will be slower because of.the smaller break flow area. But in all redundant core spray line break cases, regardless of break areas, the reactor depressurization system blevdown valves win open when the water level in the reactor reaches 2 ft 8 inches above the top of active fuel. Since the RDS valves have a total flow area of hk.72 sq inches, which is much larger than the break flow area at the broken redundant core spray line, the blevdown transient following the opening of the RDS valves win be practicany independent of the size of the break. Therefore, the heatup transient of the fuel is independent of the break size, and dependent only on the time period between the opening of the RDS valves and feed-water availability. In the case of a co=plete redundant core spray line break, the RDS valves open at 261 seconds and feedvater is available at 610 seconds. The difference between these two events is 349 seconds. For a partial redundant core spray line break, the RDS valves vill open at a later time (compared to 261 seconds for the full break case) because of the slower blevdown transient associated with a smaller break. Therefore, feedvater win be needed at a correspondingly later time. Since the makeup capacity to the condenser hot well re=ains unchanged for a n breaks, there vin be more water in the Mndenser available for reflooding of the core via the feed pumps at the time feedvater is needed. Therefore, there is adequate assurance that for au redundant core spray line breaks the PCT vill not exceed 2,200*F. The above analysis shows that there vill be sufficient water in the hot well at 600 seconds after the redundant core spray line break to recover the core =id-plane before PCT exceeds 2,200 F. It should be noted that the fee? pu=p would trip again en lov condenser hot well level within a short period of time fonoving [ core midplane recovery.

i, 2 ATTACE!ENT 1 ( However, the S/JE blevdown results indicate that reactor level starts recovering at 528 seconds which is before the time that feedvater is available. Therefore, upon feed punp trip, after core midplane recovery, the reactor vill continue to refill due to primary core spray flow, so that PCT will be controlled. Because feedvater is assuted to be available at 10 minutes after the LOCA, operator action vill be necessary after 5 minutes of event occurrence to perform the steps necessary for feed system operation. These steps vill include the following: 1. Close the feed-water control valve. 2. Start both condensate pu=ps. 3 Start one feed pump. h. Observe reactor pressure and condenser water level. 5 Open the feed-water control valve until the required flow is established. i O

TABLE 1 FULL REDU'iDA'IT CORE SPRAY LDE BREAK SCDARIO At: t=0 - Condenser level at high level alarm. Nozzle sprny line LOCA. t = 10 Seconds - Feed-vater control valve opens to pass 2,200 g;m. Assume feed flow stays at 2,200 gym until conden-sate pumps trip on low condenser level. t u 23.T Seconds - Makeup valve to condenser hot well opens. Makeup rate 116.h gym. J t = 36.2 Seconds - Fill valve to condenser hot well opens, makeup flows and fill valve flows = Shk.h gpm. t = 151.6 Seconds - Condensate pu=ps trip due to condenser lod level, makeup to condens6r continues at 270 sps. t = 600 Seconds - 2,018 gallons available in condenser hot well for feed pump to restart and core reflood. t = 610 Seconds - 1,600 gpm available frem one feed pu=p. t = 691 Seconds - Core midplane recovers. f

DiSTRIEL ION AFTER ISSUAN 'OF OPERATING LICENSE u.s. Nuct An r.touLArosv ccuusssicN occxstNuuSan e NZCpenu 195 _a Jgf l 's2.Tes li 'NRC DISTRIBUTION PoR PART 50 DOCKET MATERI AL FROM: oArt cP cect.,uts2; i

• 70:

Consumers Power Company f cs -/ E. 7 / l i Mr. Don K. Davis Jackson, Michigan 3,7,,,gg,y g g David A. Bixel / c - y ,7 '/ CsoTomiza0 P4cP lNPUT Pomu NUuSER CP CCPIES PECElvtO - lEn.zTran 25;;i:4NAl= M NC1. ASS 8 PIE D 'l CecPv j3 g g y/ca 7_ yf,77 Consists of addcndum to request for etemption I g" under the provisions of_10 CFR 50.12......... 8 ( 9-P) ' (3-P) 1 f i i PLANT NAME: Big Rock Point RJL 10/14/77 $0 [AJOL. 1 SAFTTY FOR AC~;CN/INFORMATION l I I BRANCH CHIEF: (7) l 4AW/ 5 1 l l l l l I i ! I I t i 4 I e A N_ INTERNAL DISTRIBUT1CN M G FILE J l l ( l 4 W C'PDR' I ( i

1. t i i I C E (::)

t OELD i ' l lHM!AUER 'I l l i 1 CHECK i i l M i EISENHUT t SHA0 ( BAER BUTLER 1 1 l GRLES u J. COLLDS m ~ 11 b 1 l I 1 l \\ i EXTERNAL DISTRIBUTICN CONTROL NUMEER I i ( LPDR: /'//4fN X M i TIC NSIC 16 CYS ACRS SENT CATELORY f_6 ~ T 2 '1 4 2

l

! l .}}