ML20012D652

Responds to Generic Ltr 89-19 Re USI A-47, Safety Implications of Control Sys in LWR Nuclear Power Plants. Individual Plant Exam Approach Will Result in Best Safety Solution to Generic Ltr 89-19 & Listed NUREGs

ML20012D652
Person / Time
Site:	Arkansas Nuclear
Issue date:	03/19/1990
From:	Ewing E ARKANSAS POWER & LIGHT CO.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
REF-GTECI-A-47, REF-GTECI-SY, RTR-NUREG-1217, RTR-NUREG-1218, RTR-NUREG-CR-4386, TASK-A-47, TASK-OR 1CAN039001, 1CAN39001, GL-88-20, GL-89-19, NUDOCS 9003280190
Download: ML20012D652 (9)

Text

_ _ _ . . . . . . . . . . . . . . . .. . . . . . . .

..I Arkansas Power & Ught Company Aam e Non,m O m

• I CC" Route 3 (Un 137 G hwnsule Ah /;mol I to 501 W 3100 March 19, 1990 1CAN039001 U. S. Nuclear Regulatory Commission Document Control Desk Mail Station P1-137 Washington, DC 20555

Subject:

Arkansas Nuclear One - Unit 1 Docket No. 50-313 License No. DPR-51 Response to Generic Letter 89-1; Gentlemen:

NRC Generic Letter (GL) 89-19, dated September 20, 1989 (OCNA098921), was issued as a result of the technical resolution of Unresolved Safety Issue (USI)

A-47, " Safety Implications of Control Systems in LWR Nuclear Power Plants" GL 89-19 described the NRC staff's concerno regarding steam generator overfill events and the staff's conclusion that all PWR plants should provide automatic steam generator overfill protection, with associated technical specifications for periodically verifying its operability, to mitigate main feedwater overfeed events during normal operation. GL 89-19 required that each licensee provide, pursuant to 10CFR50.54(f), a statement regarding a plan and schedule for implementation of the recommendations in GL 89-19 Enclosure 2, or appropriate justification for not implementing the recommendations. Items (3)(a) and (b),

regarding Babcock and Wilcox (B&W) plants, are applicable to ANO-1. Item (3)(c) is not applicable to ANO-1, as recognized by GL 89-19.

AP&L has reviewed the NRC staff's concerns described in GL 89-19 Enclosure 2, as well as NUREG/CR-4386, NUREG-1217 and NUREG-1218, upon which the GL is based. AP&L is also actively participating in a Babcock & Wilcox Owners' Group (B&WOG) evaluation of the overfill concerns discussed in GL 89-19.

Based upon our concerns for the potential negative safety impact associated with the proposed modification (a loss of feedwater event) and that the safety benefits derived from the Oconee study are not directly applicable to ANO-1, AP&L intends to address the steam generator overfill safety concerns described in GL 89-19 by the Individual Plant Examination (IPE) process for AN0-1, presently scheduled for completion by the end of 1991.

AP&L's proposed IPE program was discussed in our response to GL 88-20, dated November 1, 1989 (0CAN118906). The NRC reviewed and approved AP&L's IPE approach, methodology and schedule as stated in NRC letter dated January 12, 1990 (0CNA019010). AP&L is confident that this approach will provide the necessary technical basis for resolving competing safety con-cerns while effectively using the IPE process to identify optimum solutions.

9003280190 900319 (/O PDR ADOCF OSOOO31:

P FDC 4

y

U. S. NRC l

! Page 2 03/19/90 l g

! AP&L .has evaluated the generic documents upon which GL 89-19 was based, in order to determine their applicability to the appropriate resolution of steam  ;

, generator overfill concerns specific to ANO-1. The recommendations of GL 89-19 '

for B&W plants are based on a probabilistic risk assessmeht (PRA) of the Oconee plants performed by Pacific Northwest Laboratory (PNL) as documented i in NUREG/CR-4386. While generic work of this nature may be considered

j. sufficient for regulatory decision making, AP&L must evaluate the plant-

• fp specific implications prior to implementation.

-The fundamental issue which must be addressed in evaluating the recommendations of GL 89-19 is how to assemble sufficient plant-specific data and analyses to assure that a proposed overfill protection system's safety benefit is not

, overridden by the increased risk posed by the system. AP&L's responsibility

under 10CFR50.59 requires, at a minimum, that the following questions be ,

satisfactorily answered: i

1. Are the PNL results a valid basis for resolving overfill concerns?

2. Is ANO-1 sufficiently similar to Oconee to warrant adoption ef the PNL resulte, as a technical basis for plant-specific changes? .

3. What is the negative impact on safety from installation of an overfill  ;

protection system? '

4. Will the increased t'isk frora system installation exceed the safety benefit?

5. Are there alternative procedural, training or hardware fixes that would  ;

provide increased sefety Denefit or are more cost-beneficial?  ;

AP&L must essentially duplicate the PNL process on a plant-specific basis in order to provide a sufficient technical and regulatory basis for installa-tion of an overfill protection system. This is particularly important for the issues raised in GL 89-19 because the GL and its supporting documents do not address the magnitude of increased risk due to inadvertent operation of the overfill protection system (e.g., leading to a loss of feedwater accident). Coupled with the apparent overstatement of safety benefit from installing such a system, detailed plant-specific reviews must be conducted to assure that plant safety is not degraded. The following discussions provide an overview of AP&L's concerns associated with answering these questions. Based on these concerns, and consideration of the ANO-1 IPE presently in progress, AP&L has determined that the IPE is the optimum vehicle for resolving the issue of steam generator overfill. Each of the questions mentioned above is addressed individually as follows: ,

1. Are.the PNL results a valid basis for resolving overfill concerns?

It does not appear that the PNL results are completely applicable for ANO-1.

AP&L recognizes that there are many sources of uncertainty and numerous judgement calls in any PRA effort, which may have little effect on the ultimate

.c .

U. S. NRC l Page 3 l' 03/19/90 outcome of the analysis. For that reason, we have not engaged in a detailed  :

review of the assumptions, analyses and calculations associated with  :

NUREG/CR-4386. Nonetheless, there are several key assumptions /judgements made by the analysts which appear to be unsupported and incorrect, and which significantly affect the outcome of the analyses. Because such judgement f would not be acceptable in a plant-specific 10CFRSO.59 analysis, the applicability'of the PNL results to ANO-1 is questionable. These assumptions  :

fall into three areas: j

a. The probability of a main steam line break (MSLB) ocurring in an  !

unisolable location, ,

l

b. The likelihood of operator failure to terminate a potential overfill l event, and

c. The probability of water loading on the main steam line piping l leading to a MSLB.  ;

To place these assumptions in context, it is worthwhile to briefly describe  ;

the major core damage scenario analyzed by PNL. Note that because of their low contribution to public risk, the Overfill & MSLB, and Transient Shutdown, core  ;

damage sequences are not discussed. However, our concerns with the PNL i assumptions are also r.pplicable to those sequences.  :

The overfi?1 transient scenarios described for Oconec required failures that initiated a main feedwatt;r (MFW) overfeed, f ailure o# the MFW trip signal, i and f ailat e of the operator to isolate feodwater flow. As the steem generator over fills, water spills inte the main stean line, eventually resulting in a MSLB due to the static enc dynamic water loads on the piping. The steam generator experiences a pressure tr60sient upon blowdown af the secondary side following the postulated MSLB. The pressure differential across the steam generator tubes is then postulated to induce one or more steam generator tube ruptures (SGTR). High pressure injection into the primary system continues to maintain core cooling as long as a water source (reactor building sump or borated water storage tank (BWST_)) is available. If the MSLB location is outside containment but upstream of the main steam isolation valve (MSIV),

sufficient primary water is lost through the ruptured tubes to eventually exhaust the BWST inventory, at which point core damage is assumed to occur.

The public risk due to this scenario as described in NUREG/CR-4386 dominates the total risk associated with the control system failure scenarios. A major contributor to the risk is the assumption that the MSLB occurs with a 50% probability in a location where water would not be collected by the containment building sump for recirculation, which is then always assumed to result in core damage. The break location probability used by PNL is based on the simplified assumptions that a MSLB has an equal probability of occurring upstream or downstream of the MSIVs, and that a MSLB upstream will result in core damage and subsequent offsite release. This latter assumption is invalid for several reasons. The ANO-1 MSIVs are located relatively close to the outside containment wall compared to the length of main steam line piping

s I

r f;

U. S. NRC Page 4  ;

03/19/90  ;

inside containment, as well as the length downstream of the MSIVs. Should a l MSLB occur inside containment, the water lost through the break will be collected at the containment sump for recirculation, assuring an adequate supply for high pressure injection and containment. spray. The maximum  ;

potential for core damage therefore cannot exceed the product of 50% and the ratio of the main steam line piping length outside containment up to the a MSIVs, to the total main steam line piping length up to the MSIVs. For f ANO-1, this value is .16, a greater than 60% reduction over the 50% assump- t tion of NUREG/CR-4386. This results in a proportionate reduction in public j risk. ,

Considering only the effects of the MSLB break location probability discussed  !

above, the actual estimated risk will be significantly lower. There are other j presently unquantifiable factors affecting the probability of an MSLB occurring in an unisolable location and leading to core damage. For example, the main steam line piping qualification is different for piping upstream of the MSIVs from that piping downstream of the MSIVs. It is intuitive that the difference in piping quality would result in a higher probability of a MSLB d:,wnstream of i the MSIVs (i.e., an is,olable break which would not lead to core damage). -

Further, it is not clear that an unisolable MSLB combined with a SGTR leads  ;

to core damage in all cases. The reactor coolant system (RCS) inventory  :

lost should be no more then for a SGTR without a MSLB since the MSLB causes significant cooldown and depressurizatinre of the RCS toward shutdown cooling entry conditions muc5 faster than is assumed in SGTR analyses.

Two other critical assumptions of NUREG/CR-4386, regarding the probability L of an operator failing to termintte an overfill scenario, and the probability  ;

of an overfill event leading to an MSLB, should also be addressed. The probability of operator failure to terminate the cverfill was estinated at L 0.7 (recognized by PNL as an upper bound estimate of operator error). It i plant-specific PRAs, such overfill scenarios would be assigned an operator failure probability an order of magnitude lower, resulting in en associated t order of magnitude further reduction in public risk. It should be noted that

• NUREC/CR-4386 recognized that the A-47 issue dealt with control systems routinely under operator control, and therefore interaction of the operator with failure diagnosis and recovery is an appropriate consideration, and also recognized that the average failure probability would be lower in plants with simulator programs stressing proper diagnosis of failures. For ANO-1, as well as other B&W plants, MFW overfeed due to control system malfunctions receives special attention in operator training, due to the smaller secondary volume of 1 the B&W once-through steam generator (OTSG), and its associated responsiveness.

The use of a probability of 0.95 for a MSLB given an overfill is also unrealistic. NUREG/CR-4386 recognized that this was a high failure probability do to the uncertainty in this factor, and also recognized that further study could significantly reduce the risk associated with these scenarios. AP&L understands that B&W is presently conducting further study of overfill concerns.

The bases for the recommendations in GL 89-19 are discussed in NUREG-1218, which used the calculations of NUREG/CR-4386 to estimate the safety benefit and value impact of various proposed upgrades. The feedwater control system

V. S. NRC Page 5 03/19/90 at ANO-1 is significantly different from Oconee, and the values for both costs and benefits of the proposed upgrades which were used in the NRC's regulatory analysis do not apply to ANO-1. For example, ANO-1 has made major improvements in the MFW control system, and in the Integrated Control System (ICS) over the past several years, which make the actual probability of a MFW overfeed due to control system failures significantly lower than assumed for Oconee.

A further examination of the factors discussed above should lead to an estimated risk reduction for the applicable control system failure scenarios well below the point at which the NRC's value/ impact guidelines would conclude that hardware changes are a viable option. More significantly, when plant specific factors are taken into account, the actual risk reduction due to an overfill protection system may actually be less than the risk increase due to spurious operation of the system. Based on the above concerns, AP&L believes for ANO-1 that the actual risk due to overfill scenarios is substantially lower than estimated in the basis NUREGs for GL 89-19.

Consequently, a plant-specific evaluation under a program such as the IPE must be conducted to determine the actual risk associated with overfill issues.

It should be noted that NUREG-1218 incorrectly acsumed that all B&W plants other than Oconee either had in place or had committed to modify their designs to include a safety grade overfill protection system. The Emergency Feedwater Initiation and Control (EFIC) system at ANO-1, a safety grade system, was r.riginally designed with the capability for MfW overfill protection. However, due to the concerns discussed above, related to adverse consequences due to spurious operation, questionable cost / benefit (cost estimated in excess of

$1 eillinn dollars), 5nd recent improvements in tN MFW and ICS control systems, AP&l determined that overfill protection implementation was not appropriate The MFW overfill issue was specifically addrer, sed by AP&L as part of the B&WOG Safety & Performance Improvement Program (SPIP).

2. Is ANO-1 sufficiently similar to Oconee to warrant adoption of the PNL results as a technical basis for plant-specific changes?

Although ANO-1 and Oconee are similar in many respects, there are signifi-cant plant-specific differences between Oconee and ANO-1 which would alter the PNL results. The PNL study generally recognized that care must be taken in applying the Oconee results to other B&W plants because of these differences. We believe this is particularly important in the case of ANO-1. In addition to differences in hardware reliability, operator response and plant response, fundamental design differences exist between Oconee and ANO-1. For example, Oconee does not have MSIVs and ANO-1 does, the power supply configuration for the ICS at ANO-1 is significantly dif-ferent, and the MFW control system at ANO-1 is significantly different.

This is further justification for allowing the IPE process to determine if overfill scenarios are really risk significant at ANO-1, considering the plant-specific dif f erences f rom PHL's results.

a. ,

U. S. NRC ,

Page 6 ,

03/19/90 '

3. What is the negative impact on safety from installation of an overfill protection system? r Although GL 89-19 and its supporting documents each recommend installation of an overfill protection system which will assure that feedwater is isolated to the steam generators, they do not address the negative impact on safety through ,

implementation of such a system. An overfill protection system can itself  :

initiate a loss of feedwater accident, regardless of the safety qualification of the system (GL 89-19 allows implementation of a conemercial grade system).

Spurious actuation of the system during the course of other initiating events may also have adverse safety consequences. Using the same approach as the PNL study, including highly conservative failure assumptions, multiple failures, a high probability of operator failure to restore feedwater, etc., the public risk due to installation of the overfill protection system may be significant. At a .I minimum, it cannot be ignored and must be included in the evaluation of any I proposed modificetions.

4. Will the increased risk from system installation exceed the safety benefit?

f As discussed in Items 1 and 2, above, the actual plant-specific public risk due to overfill scenarios may be substantially lower than the risk estimated in the supporting documents for GL 89-19. As discussed in Item 3, the adverse effect on other accident-scenarios of installing an overfill protection system  ;

may exceed the overfill risk reduction. Before proceeding with plarst-specific implementation of the recommendations of GL 89-19, AP&L must have a technical basis to resolve this question of competing safety ef fects. The PNL analysis will not represent an adequate basis for plant-specific resolution and there is no specific technical information available on the risk associated with an overfill protection system, although AP&L is aware that the B&W plants >

with some form of overfill protection have had tpurious actuations.

Implementation of an overfill protecticn system will require an evaluation >

pursuant to 100FR50.$9. Sah an ovaluation is likely to find an increase in .

the probability of a loss of all feedwater because of the increased likelihood '

of the initiating event, a loss of main feedwater. The increased probability of a loss of all feedwater may bring this type of accident (not previously i evaluated in the Safety Analysis Report) into the realm of possibility. l

5. Are there alternative procedural, training or hardware fixes that would provide increased safety benefit or are more cost-beneficial?

While NUREG/CR-4386 examined several alternatives for reducing risk associated with overfill events, it did not examine all possibilities. There may be other more risk- and cost-beneficial solutions which a plant-specific review would uncover. Another approach to reducing overfill risk involves operator training and/or procedure changes. GL 89-19 cited the potential for signi-ficant reduction in operator error probability through the use of effective training and emergency procedures, as the preferred resolution for the SBLOCA concerns on CE plants. Any significant reduction in operator error probability which would thus lower the estimated core-melt frequency and

t .

L U. S. NRC Page 7 03/19/90

! associated public risk would remove hardware changes as viable options under the NRC's value/ impact criteria. NUREG/CR-4386 did recognize that recom-mendations for USI A-47 might well be integrated with operator training and transient response programs.- As discussed previously, it is AP&L's position that the MFW pump control system improvements, the.ICS improvements and

! enhancements, and existing operator training related to MFW overfeed events

! are preferred to implementation of an overfill protection system at this F time. As mentioned above, this was also the basis for AP&L's determination L not to implement the Main Feedwater Isolation portion of EFIC.

It is AP&L's opinion that the IPE process is particularly well suited for i identification of a range of alternative solutions, should they be neces-sary, with E. built-in process for evaluating and choosing the best solution.-

The IPE process is underway at ANO-1, with a Level I and a limited Level II i PRA being performed. This process involves a search for risk-significant accident sequences coupled with a structured approach to identifying and evaluating a range of possible risk reduction measures. _The IPE therefore

, presents an ideal solution and framework to resolve the overfill issues raised by GL 89-19. Because the basis for the GL is largely PRA-based, PRA techniques should form the core of the plant-specific resolutions. Further-more, a stated sub purpose of the IPE is resolution of USIs/GIs on a plant-specific basis. For these reasons, AP&L has chosen to incorporate the overfill scenarios into its IPE. The concerns of GL 89-19 will be addressed L in AP&L's IPE submittal. AP&L is convinced that this approach will resuit in the best safety solution to GL 89-19 while avoiding unforseen safety concerns which could occur through another, less structured, approach.

Should you have any questions regarding this issue, please don't hesitate to contact me.

Very truly year *,

[

arly . g

~

General Manage Technical Support and Assessment JJF/RBT Attachment

{<

p.

'; ,, s

[ . .. '!

U. S.: NRC -

Page 8 '

03/19/90 _ 1 1

j I

cc: Mr. Robert Martin U. S. Nuclear. Regulatory Commission '

Region'IV I 611 Ryan Plaza Drive, Suite 1000 l

]( Arlington -TX 76011  ;

.E NRC Senior Resident. Inspector {

e '

Arkansas Nuclear One - ANO-1 & 2 -

. Number 1,. Nuclear Plant Road  !

Russellville, AR 72801 +

Mr.; Thomas W. Alexion l NRR Project Manager,- Region IV/ANO-1 '!

U. S. Nuclear Regulatory Commission i NRR Mail Stop 13-D-18 {

One White Flint North ~{

11555 Rockville Pike- l Rockville, Maryland 20852 I Mr. Chester Posiusny {

NRRProject. Manager,RegionIV/ANO  !

U. S. Nuclear Regulatory Commission - ]

NRR Mail Stop 13-D-18  :

One White Flint North a 11555 Rockville Pike- -

Rockv?lle, Maryland 20852 lj

.c

.. {

'[.'

f f

5 i

~

m. ---

,g e-

p. - :e.' . r STATE OF ARKANSAS )

) SS COUNTY Of POPE )

L, P I, Early C. Ewing, being duly sworn, subscribe to and say that I am General Manager, Technical Support and Assessment for Arkansas Power & Light Company; that I have full authority to execute this oath; that I have read the document numbered ICAN839881 and know the contents thereof; and that to the best of my knowledge, information and belief, the statements in it are 4

'true.

_ '/ _ N._

w M N Ea/

rly C. Ewing L SUBSCRIBED 'AND SWORN 10 before me, a Notary Public in and for the County and State above named, this c40 day of f///epel ,

1990.

l /2l Y5 -

Notary Public t

- My Commission Expires:

Y f tf.9j l}