ML20012D962
| ML20012D962 | |
| Person / Time | |
|---|---|
| Site: | Arkansas Nuclear  |
| Issue date: | 03/19/1990 |
| From: | Ewing E ARKANSAS POWER & LIGHT CO. |
| To: | NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM) |
| References | |
| REF-GTECI-A-47, REF-GTECI-SY, RTR-NUREG-1217, RTR-NUREG-1218, RTR-NUREG-CR-3958, TASK-A-47, TASK-OR GL-88-20, GL-89-19, NUDOCS 9003290162 | |
| Download: ML20012D962 (9) | |
Text
y h
~
s
-(
)
f3 8
s Po
& UghtCompany g
Route 3. Box 137 a Au%ende. AR 72801 Tel 501964 3100 i
March 19, 1990 2CAN039001 U. S. Nuclear Regulatory Commission Docuhent Control Desk Mail. Station P1-137 Washington, DC 20555
Subject:
Arkansas Nuclear One - Unit 2 Docket No. 50-368 License No. NPF-6 Response to Generic Letter 89-19 Gentlemen:
NRC Generic Letter (GL) 89-19, dated September 20, 1989 (0CNA098921), was issued as a result of the technical resolution of Unresolved Safety Issue (USI) i A-47, " Safety Implications of Control Systems in LWR Nuclear Power Plants".
GL 89-19 described the NRC staff's concerns regarding steam generator overfill events and the staff's conclusion that all PWR plants should provide automatic
-e steam generator overfill protection, with associated technical specifications for periodically verifying its operability, to mitigate main feedwater overfeed events during normal operation.
GL 89-19 required that each licensee provide, pursuant to 10CFR50.54(1),-a statement regarding a plan and schedule for implementation of the recommendations in GL 89-19 Enclosure 2, or appropriate justification for not implementing the recommendations.
Items (4)(a) and (b),
regarding Combustion Engineering (CE) plants, are applicable to ANO-2.
Because the discharge pressure of the ANO-2 High Pressure Safety Injection (HPSI) pumps is greater than 1275 psi, Item (4)(c) is not applicable to ANO-2, as recognized by GL 89-19.
In conjunction with the Combustion Engineering Owners' Group (CEOG), AP&L t
has reviewed the NRC staff's concerns described in GL 89-19 Enclosure 2, as well as'NUREG/CR-3958, NUREG-1217 and NUREG-1218, upon which the GL is based.
Based upon our concerns for the potential negative safety impact associated with the proposed modification (a loss of feedwater event) and that the safety benefits derived from the Calvert Cliff study are not directly applicable to ANO-2, AP&L intends to address the steam generator overfill concerns described in GL 89-19 by the Individual Plant Examination (IPE) process for ANO-2, presently scheduled for completion by the end of 1991. _AP&L's proposed IPE program was discussed in our response to GL 88-20, dated November 1, 1989 (OCAN118906).
The NRC reviewed and approved AP&L's IPE approach, methodology and schedule as stated in NRC letter dated January 12, 1990 (0CNA019010).
AP&L is confident that this approach will provide the necessary technical basis for resolving competing safety con-cerns while effective ~1y using the IPE process to identify optimum solutions.
T 9003290162 900319
- 4 o0\\
i PDR ADOCK 05000368 a
P -;
PDC j
An ENew CompaY
b L
L U. S. NRC Page 2 03/19/90 t
AP&L has evaluated the generic documents upon which GL 89-19 was based, in order to determine their applicability to the appropriate resolution of steam generator overfill concerns specific to ANO-2.
The recommendations of GL 89-19 for CE plants are based on a probabilistic risk assessment (PRA) of Calvert Cliffs Unit 1 performed by Pacific Northwest Laboratory (PNL) as documented in NUREG/CR-3958.
While generic work of this nature may be considered sufficient for regulatory decision making, AP&L must evaluate the plant-specific implications prior to implementation.
L The fundamental issue which must be addressed in evaluating the recommendations of GL 89-19 is how to assemble sufficient plant-specific data and analyses to assure that a proposed overfill protection system's safety benefit is not overridden by the increased risk posed by the system.
AP&L's responsibility under 10CFR50.59 requires, at a minimum, that the following questions be satisfactorily answered; 1.
Are the PNL results a valid basis for resolving overfill concerns?
2.
Is ANO-2 sufficiently similar to Calvert Cliffs to warrant adoption of the PNL results as a technical basis for plant-specific changes?
3.
What is the negative impact on safety from installation of an overfill protection system?
4.
Will the increased risk from system installation exceed the safety benefit?
5.
Are there alternative procedural, training or h(rdware fixes that would provide increased safety benefit or are more cost-beneficial?
AP&L must essentially duplicate the PNL process on a plant-specific basis in order to provide a sufficient technical and regulatory basis for installa-tion of an overfill protection system.
This is particularly important for the issues raised in GL 89-19 because the GL and its supporting documents do not address the magnitude of increased risk due to inadvertent operation of the overfill protection system (e.g., leading to a loss of feedwater accident).
Coupled with the apparent overstatement of safety benefit from installing such a system, detailed plant-specific reviews must be conducted to assure that plant safety is not degraded.
The following discussions provide an overview of AP&L's concerns associated with answering these questions.
Based on these concerns, and consideration of the ANO-2 IPE presently in progress, AP&L has determined that the IPE is the optimum vehicle for resolving the issue of steam generator overfill.
Each of the questions mentioned above is addressed individually as follows:
i 1.
Are the PNL results a valid basis for resolving overfill concerns?
It does not appear that the PNL results are completely applicable for ANO-2.
l AP&L recognizes that there are many sources of uncertainty and numerous judgement calls in any PRA effort, which may have little effect on the ultimate outcome of the analysis.
For that reason, we have not engaged in a detailed
}
I i
~
V. S. NRC Page 3 03/19/90 review of the assumptions, analyses and calculations associated with NUREG/CR-3958.
Nonetheless, there are several key assumptions /judgements made by the analysts which appear to be unsupported and incorrect, and which significantly affect the outcome of the analyses.
Because such judgement would not be acceptable in a plant-specific 10CFR50.59 analysis, the applicability of the PNL results to ANO-2 is questionable.
These assumptions fall into three areas:
a.
The probability of a main steam line break (MSLB) ocurring in an unisolable location, b.
The likelihood of operator failure to terminate a potential overfill event, and c.
The probability of water loading on the main steam line piping leading to a MSLB.
To place these assumptions in context, it is worthwhile to briefly describe the major core damage scenario analyzed by PNL.
Note that because of their low contribution to public risk, the Overfill & MSLB, and Transient Shutdown, core damage sequences are not discussed.
However, our concerns with the PNL assumptions are also applicable to those sequences.
The overfill transient begins with one of two control system failure scenarios:
- 1) the main feedwater (MFW) regulating valve fails to close given a turbine trip signal following a reactor trip, or 2) the turbine trip fails to signal the feedwater valve to close following a reactor trip.
In either case, the operator fails to manually terminate or isolate feedwater flow.
As the steam generator overfills, water spills into the main steam line, eventually resulting in a MSLB due to the static and dynamic water loads on the piping.
The steam generator experiences a pressure transient upon blowdown of the secondary side following the postulated MSLB.
The pressure differential across the steam generator tubes is then postulated to induce one or more steam generator tube ruptures (SGTR).
High pressure injection into the primary system continues to i
maintain core cooling as long as a water source (reactor building sump or refueling water storage tank (RW)) is available.
If the MSLB location is outside containment but upstream of the main steam isolation valve (MSIV),
sufficient primary water is lost through the ruptured tubes to eventually exhaust the RW inventory, at which point core damage is assumed to occur.
The public risk due to this scenario as described in NUREG/CR-3958 dominates the total risk associated with the control system failure scenarios.
A major contributor to the risk is the assumption that the MSLB occurs with a 50%
probability in a location where water would not be collected by the containment building sump for recirculation, which is then always assumed to result in core damage.
The break location probability used by PNL is based on the simplified assumptions that a MSLB has an equal probability of occurring upstream or downstream of the MSIVs, and that a MSLB upstream will result in core damage and subsequent offsite release.
This latter assumption is invalid for several reasons.
The ANO-2 MSIVs are located relatively close to the outside containment wall compared to the length of main steam line piping inside containment, as well as that downstream of the MSIVs.
Should a MSLB occur
s.
U. S. NRC Page 4 03/19/90 inside containment, water lost through the break will be collected at the containment sump for recirculation, assuring an adequate supply for high pressure injection and containment spray.
The maximum potential for core damage therefore cannot exceed the product of 50% and the ratio of the main steam line piping length outside containment up to the MSIVs, to the total main steam line piping length up to the MSIVs.
For ANO-2, this value is
.22, a greater than 50% reduction over the 50% assumption of NUREG/CR-3958.
This results in a proportionate reduction in public risk.
Considering only the effects of the MSLB break location probability discussed above, the actual estimated risk reduction will be significantly lower.
There are other presently unquantifiable factors affecting the probability of an MSLB occurring in an unisolable location and leading to core damage.
The main steam line piping qualification is different for piping upsteam of the MSIVs from that piping downstream of the MSIVs.
It is intuitive that the difference in piping quality would result in a higher probability of a MSLB downstream of the MSIVs (i.e., an isolable break which would not lead to core damage).
Further,.it is not clear that an unisolable MSLB combined with a SGTR leads to core damage in all cases.
The reactor coolant system (RCS) inventory lost should be no more than for a SGTR without a MSLB since the MSLB causes significant cooldown and depressurization of the RCS toward shutdown cooling entry conditions much faster than is assumed in SGTR analyses.
Two other critical assumptions of NUREG/CR-3958, regarding the probability of an operator failing to terminate an overfill scenario, and the probability of an overfill event leading to an MSLB, should also be addressed.
The probability of operator failure to terminate the overfill was estimated at 0.1 per demand.
In plant-specific PRAs, such overfill scenarios would be assigned an operator failure probability an order of magnitude lower, resulting in an associated order of magnitude further reduction in public risk.
It should be noted that NUREG/CR-3958 stated that a relatively high operator error probability was assumed because there is considerable uncertainty about the value of that parameter.
It also recognized that the operator error probability could be reduced significantly through the use of effective training and emergency procedures, thus lowering the estimates of core-melt frequency and associated risk proportionally.
The core-melt potential for the scenarios as estimated in NUREG/CR-3958 was clearly stated as being highly conservative.
The use of a probability of 0.5 for a MSLB due to water loading given an overfill event is also unrealistic.
NUREG/CR-3958 recognized that this was a high failure probability due to the uncertainty in this factor, and stated that this assumption had little basis other than to be consistent with the approach use in the previous value/ impact analysis.
No MSLBs have occurred as a result of overfill events in the United States.
Although there are a couple of instances of steam line damage due to overfill in Europe, those events also did not result in MSLBs.
In addition, the steam generator tube l
integrity program conducted by the NRC used a 1 x 10E-3 probability of MSLB for overfill following a SGTR event.
By these indications, the actual probability of an overfill event leading to an MSLB should be significantly lower than 0.5, resulting in a further reduction in public risk.
m o
s.-
g.;
U. S. NRC Page 5 03/19/90 The bases for the recommendations in GL 89-19 are discussed in NUREG-1218, which used the calculations of NUREG/CR-3958 to estimate the safety benefit and value impact of various proposed upgrades.
Due to differences in the L
specific systems arrangement and hardware between Calvert Cliffs and ANO-2, t
the values for both costs and benefits of the proposed upgrades which were used in the NRC's regulatory analysis do not apply to ANO-2.
r L
A further examination of the factors discussed above should lead to an' L
estimated risk reduction for the applicable control; system failure scenarios i
well below the point at which the NRC's value/ impact guidelines would conclude that hardware changes are a viable option.
More significantly, when plant specific factors are taken into account, the actual risk reduction due to an overfill protection system may actually be less than the risk' increase due to spurious operation of the system.
Based on the above concerns, AP&L believes for AND-2 that the actual risk due to overfill scenarios is substantially lower than estimated in the basis NUREGs for GL 89-19.
Consequently, a plant-specific evaluation under a program such as the IPE
)
must be conducted to determine the actual risk associated with overfill issues.
2.
Is ANO-2 sufficiently similar to Calvert Cliffs to warrant adoption of the PNL results as a technical basis for plant-specific changes?
Although the designs are similar in many respects, there are significant plant-specific differences between Calvert Cliffs and ANO-2 which would alter the PNL results.
The PNL study generally recognized that care must be taken in applying the Calvert Cliffs results to other CE plants because of these differences.
We believe this is particularly important in the care of ANO-2.
In addition to differences in hardware reliability, operator response and plant response, fundamental design differences exist between Calvert Cliffs and ANO-2.
The NUREG/CR-3958 analysis for core damage frequency given a MSLB (but no SGTR) employed an MSLB/overcool event tree modified froin an earlier study conducted by INPO.
This event tree predicted a core damage frequency of 1.1 x E-5; however, half of the core damage contribution is due to a single sequence which involves opening a PORV and subsequent failure of the PORV to close.
AN0-2 does not have PORVs.
Additionally, ANO-2 has an existing portion of the feedsater control system that provides a high-level override signal to close the MFW regulating valves and set the MFW pumps at minimum speed upon actuation by a high steam generator level si0nal.
Given the fact that there are at least some significant design or operational differences between ANO-2 and Calvert Cliffs, AP&L believes this is further justification for allowing the IPE process to determine if overfill scenarios are really risk significant ct AN0-2, considering the plant-specific differences from PNL's results.
3.
What is the negative impact on safety from installation of an overfill protection system?
Although GL 89-19 and its supporting documents each recommend installation of an overfill protection system which will assure that feedwater is isolated to
,.4
[,,. 1 r
U. S. NRC Page 6 03/19/90 the steam generators, they do not address the negative impact on safety through implementation of such a system.
An overfill protection system can itself initiate a loss of feedwater accident, regardless of the safety ~
qualification.of the system (GL 89-19 allows implementation of a commercial grade system).
Spurious actuation of the system during the course of other initiating events may also have adverse safety consequences.
Using the same approach as the PNL study, including highly conservative failure assump-tions, multiple failures, a high probability of operator failure to restore feedwater,.etc., the public risk due to installation of the overfill protec-
~
tion system may be significant.
At a minimum, it cannot be ignored and must
- ~
be included in the evaluation of any proposed modifications.
4.
Will the increased risk from system installation exceed the safety benefit?-
As discussed in Items 1 and 2, above, the actual plant-specific public risk due to overfill scenarios may be substantially lower than the risk estimated in
~;
the supporting documents for GL 89-19.
As discussed in Item 3, the adverse
- effect on other accident scenarios of installing an overfill protection system i
may exceed the overfill risk reduction.
Before proceeding with plant-specific implementation of the recommendations of GL 89-19, AP&L must have a technical basis to resolve this question of competing safety effects.
The PNL analysis will not represent an adequate basis for plant-specific resolution and there is no specific technical information available on the risk associated with an overfill protection system, although AP&L is aware that plants with some form of overfill protection have had spurious actuations.
Implementation of an overfill protection system will require an evaluation pursuant to 10CFR50.59.
Such an evaluation is likely to find an increase in the probability of a loss of all feedwater because of the increased likelihood of the initiating event, a loss of main feedwater.
The increased probability of a loss of all feedwater may bring this type of accident (not previously 1
evaluated in the Safety Analysis Report) into the realm of possibility.
t 5.
Are there alternative procedural, training or hardware fixes that would provide increased safety benefit or are more cost-beneficial?
While NUREG/CR-3958 examined several alternatives for reducing risk asso-ciated with overfill events, it did not examine all possibilities.
There may be other more risk-and cost-beneficial solutions which a plant-specific review would uncover.
Another approach to reducing overfill risk involves operator training and/or procedure changes.
GL 89-19 cited the potential for significant reduction in operator error probability through the use of effective training and emergency procedures, as the preferred resolution for the SBLOCA concerns on CE plants.
Any significant reduction in operator error probability which would thus lower the estimated core-melt frequency and associated public risk would remove hardware changes as viable options under the NRC's value/ impact criteria.
NUREG/CR-3958 did recognize that recommendations for USI A-47 might well be integrated with operator training w
_y...
U. S. NRC b
03/ge 7 Pa 19/90
(,
.and transient response' programs.
As discussed previously it is AP&L's positionthattheexistingfeedwatercontrolsystemoverflll~ protection L-system and existing operator training related to MFW overfeed events are preferred to implementation of an overfill protection system at this time.
ItLis AP&L's opinion that the IPE process is particularly well-suited for-
[
identification of a range of alternative solutions, should they be necessary, with a built-in process for evaluating and choosing the best solution. The IPE process is underway at ANO-2, with a Level I-and a limited Level 11 PRA being performed.
This process involves a search for risk-significant accident sequences coupled with a structured approach to identifying and evaluating a range of possible risk reduction measures.
The IPE therefore presents an ideal solution and framework to resolve the overfill issues L
raised by GL 89-19. - Because the basis for the GL is largely PRA-based, PRA -
3 techniques should form the core of the plant-specific resolutions.- Further-more a stated sub purpose of the IPE is resolution of USIs/GIs on a plant-speelficbasis.- For these reasons, AP&L has chosen to incorporate the overfill scenarios into its IPE.
The concerns of GL 89-19 will be addressed in AP&L's IPE submittal.
AP&L is convinced that this approach will result in the best safety solution to GL 89-19 while avoiding unforseen safety concerns which could occur through another, less structured, approach.
Should you have any questions regarding this issue, please don't hesitate to contact me.
Ver truly yours, v
. /E r1 C. Ewing General Manager, 3
Technical Support and Assessment j
JJF/RBT Attachment r
i J
i
a
.;14 e "
,.p.
' d i D' U.I S. NRC Page 8
- 03/19/90 cc:
Mr.' Robert Martin U
-S.'. Nuclear Regulatory Commission Region IV 611 Ryan Plaza Drive, Suite 1000 Arlington, TX 76011 NRC. Senior Resident Inspector
-Arkansas Nuclear One - ANO-1 & 2 Number 1, Nuclear Plant Road Russellville,-AR 72801 Mr. Thomas W. Alexion NRR m (ject Manager, Region IV/ANO-1
~
U. ? ho: lear Regulatory Commission NRR P.aia'Stop 13-D-18 One White Flint North 11555 Rockville Pike.
1 Rockville, Maryland 20852 Mr. Chester Poslusny NRR Project Manager, Region IV/ANO-2 U. S. Nuclear Regulatory Commission NRR Mail Stop 13-D-18 One White Flint North 11555 Rockville Pike Rockville, Maryland 20852, l
-j i
y g.
m j.c -..
4%
- g.
I:
s l
STALE OF ARKANSAS
)
o
)'
SS s
= COUNTY OF POPE
-)
p 1.- Early C. Ewing, beitig duly sworn, subscribe to and say that I am General Manager, Technical Support and Assessment for Arkansas Power & Light Company; _that I have full authority to execute this oath; that I have read the document numbered 2CANB39001 and know the contents thereof; and that to the best of my knowledge, information and belief, the statements in it are true.
i f
w n
~
/
m Ear,ly C. Ewing L,
SUBSCRIBED AND SWORN T0 before me, a Notary Public in and for the County and State above named, this clo day of' V77ad 1990.
j
[
.t Notary Public l
My' Commission Expires:
S. 9 91