ML20024C188

Forwards Revised Responses to NRC Questions 031.290 & 292 Re Potential Multiple Control Sys Failures Due to High Energy Line Break Events,Per 830621 Discussion

ML20024C188
Person / Time
Site:	LaSalle
Issue date:	07/06/1983
From:	Schroeder C COMMONWEALTH EDISON CO.
To:	Harold Denton Office of Nuclear Reactor Regulation
References
6900N, NUDOCS 8307120382
Download: ML20024C188 (9)

Text

'g.u.

g

[O

\

/ One First N'tiorul Pirza, Chicigo, litinois Address Reply to: Post Office Box 767 Chicago, Illinois 60690 July 6, 1983 Mr. Harold R. Denton, Director Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, DC 20555

Subject:

LaSalle County Station Units 1 and 2 NPF-ll License Condition 2.C.(19)

Additional Instrumentation and Control Concerns NRC Docket Nos. 50-373 and 50-374

Dear Mr. Denton:

On June 21, 1983, Commonwealth Edison representatives C. W.

Schroeder and George Crane, et al met with Dr. Bournia, et al of your staff to discuss potential multiple control system failures due to High Energy Line Break events. As a result of that discussion, Commonwealth Edison Company has prepared revised responses to NRC Questions 031.290 and 031.292 which we believe should address the concerns in this area.

These are enclosed for your review.

To the best of my knowledge and belief the statements contained herein and in the attachment are true and correct. In some respects these statements are not based on my personal knowledge but upon infor-mation furnished by other Commonwealth Edison and contractor employees.

Sach information has been reviewed in accordance with Company practice and I believe it to be reliable.

Enclosed for your use are one (1) signed original and forty (40) copies of this letter and enclosures.

If there are any further questions in this matter, please contact this office.

Very truly yours, 7/c/s2 C. W. Schroeder Nuclear Licensing Administrator 1m Enclosures cc: NRC Resident Inspector - LSCS Or. A. Bournia (Fed. Express) O 6900N 8307120382 830706

'\'

PDR ADDCK 05000373 A PDR h .i

l*.

- -* (

r -

i e

Revised Response to NRC Question-Q31.290 All HELB's identified in Chapter l'5.0 were analyzed to determine the worst case event assuming the failure of all affected

~

non-safety systems in the worst direction. Affected systems are .

those that are in proximity of a specific line break, i.e.,

located within the same environmental zone as the HELB per i Appendix M delineation of HARSH environmental zones. All safety

systems are assumed'to operate as delineated in the "Ninety Day Report" for environmental qualification. Table Q31.290-4 lists i a matrix of all non-safety control systems evaluated for the HELB events. Note that for.the LOCA, MSLB and FWLB events no more than two of the non-safety control systems can be affected simultaneously because

a) By' definition, the LOCA occurs inside primary containment and none of the safety related control systems is located inside primary. containment (Zone H2). Failure ~ of the non-safety related equipment during a LOCA was treated in

j. chapter 15 safety analyses and QO31.289 responses.

I b) The ain steam line break occurs inside the main steam tunnel which is separated from the remainder of the reactor i' '

building. None of these non-safety related control systems

is located, in whole or in part, inside the main. steam i

tunnel.

c) By definition the feedwater line break occurs outside primary containment within the main steam tunnel (Zone H5). It does not affect zone H4A which is the annular zone between the primary containment and the ECCS cubicles which are environmentally separate, as is the RWCU room. This

. HELB is discussed- below and the safety: analysis for the Feedwater line break is dominated by the LOCA with respect to consequences. This feedwater line break does not affect

! the turbine control system nor the process rad monitoring i system. The effects of this HELB combined with a

( recirculation flow control system failure were noted in the responses to QO31.288.(page QO31.288-14) and QO31.289 (page

QO31.289-2)' where the conclusion is made that Chapter 15.0 l safety analyses bound these. events.

'd) .The effects of an instrument.line. break'on non-safety related control systems;is treated more completely in this i

, , supplemental response. Note-.that there is no' single line

[ break inside or outside-containment that can affect any

l. more than two of the. non-safety control systems-simultaneously due to physical: separation, etc. Further

. details for the instrument line. break section are provided in this revised response.

a

-= = . .- - - . - - - - - - . --

k j ,

I D) Instrument Line Break An: instrument line break.is assumed to occur outside primary containment.. All accident mitigation is operator initiated.

In order to maximize the extent of the harsh environment, the

! break is assumed to occur in the open area of the reactor i building, as opposed to occurring in one of the ECCS or RWCU equipment rooms.

i The design of the LaSalle BWR 5/ Mark II is.such that any line

~

break,in a specific environmental zone can create a HARSH environment only within that zone. That is, an HELB in the i annular area of the reactor building-zone H4A-eventually i produces a harsh environment throughout_the annular zone of the

! reactor building but it cannot affect the turbine building, i main steam tunnel, ECCS cubicles or the RWCU equipment rooms.

j Those cubicles or rooms are environmentally separated from the open annular zone of the reactor building. The redundancy of 4 safety systems provides for safe shutdown with a loss of any

one of the ECCs cubicles with its primary ESF power supplies or j its backup standby diesel generator power supply.

In order to analyze the most limiting event, all non-safety control systems were assumed to simultaneously fail in the I worst direction if any part of those non-safety control systems j is located in the zone (AA) affected by any single instrument j line break within zone AA.

i- .The local panels for the level sensors (C34-N004ABC) of the

feedwater systems are located in zone H4A. These sensors are being upgraded to Class lE Rosemount 1153 differential pressure

! devices mounted on seismically qualified panels. Even though l the feedwater control system is not safety grade, these level i

sensors are of.that quality. The impulse lines for these sensors are discussed in the response to-QO31.292(2) where it j is established that a single impulse line failure can cause no more than two of these sensors to fail in the maximum demand

~ condition. ~Also from that reference, failure of the' reference leg for C34-N004-A and B causes a minimum demand condition on

the feedwater controller, not a maximum demand.

! 'The logic, controllers, and trip units for the feedwater control system are located in environmental zone C-1.which is

not-affected.by the-HELB events;or instrument line breaks l- located in zone =4A of the reactor building. .Likewise, the common elements of the feedwater. control and recirculation Lcontrol systems or the' common elements of the'feedwater control

. and turbine control systems (as tabulated in QO31.288 response) i are located in panels-not'in-zone 4A but rather in zone C-1 (the control room environment)'. -There is no credible single

'line-break, therefore,-that simultaneously invalidates all

.three of these non-safety related control systems.

n

~

i3185L. ~

. , - ,= , , _ _ . . . , . . _ _ , , . _ _ . _ ___ _.m .___.

The design of the instrument lines (impulse lines) includes a

. quarter-inch orifice located just outside the primary j containment penetration for each instrument line. This orifice 1 is placed in these pressure sensing lines to constrain the

amount of radioactive steam release should an instrument line fail. The H4A zone is equipped with safety related sumps and additional radiation monitors which can be relied upon to indicate the advent of an instrument line break. Failure of i all effected non-safety related break. detection logic would in

no way effect the course of the HELB event.

I A detailed evaluation of initiators' for failures in all non-safety control systems was performed to determine what 3

simultaneous failures could be ascribed to each specific instrument line break. Factor's such as physical separation, commonality of sensors, power supplies, and impulse lines, and the consequent impact on each FSAR Chapter 15 event were examined. It was concluded that at most two of the non-safety s- control systems could be simultaneously affected by any single

, line break (see Table 031-290-4). As a result, the limiting

~

instrument line break was identified as a break in the open area of the reactor building--zone H4A. That zone contains sensor equipment related to both the recirculation control i system and the feedwater control system which includes the high

water level (L8) trip for the main turbine and the feedwater pumps. All safety related control systems are either qualified or are being qualified, as needed, for service in that zone.

The turbine generator is.in the turbine building, the turbine controls are in the auxiliary electric equipment room (mild environment area) and the sensors controlling the EHC system I (turbine bypass) are in the turbine building basement. -

Even though it is not plausible to hypothesize that a single instrument line failure can cause immediate failure of all non-safety related control systems because of their distributed locations outside zone AA at LaSalle, such a worst case 1 scenerio has been postulated by the NRC staff given that a limiting instrument line break occurs which mechanistically creates the HARSH environment of an HELB in LaSalle zone AA.

Then the most adverse scenerio is as follows. The feedwater and recirculation control systems fail in their maximum demand position, providing excess feedwater . flow and a subsequent slow i power rise. The area radiation and temperature monitors

adjacent to the~ break are assumed to fail; however, all other monitors and safety related leak-detection sumps continue operating properly. The operator would therefore know-that

+

there was a radioactive line break both by the unanticipated power. rise as noted by the APRM's, by leak detection

annunciation and by the failure of the localized process

. sensors. . Assuming no. operator action (or none of these obvious indicators),-reactor power would continue-to rise as water level increases;past the level 8 trip (assumed failed) until

I l

eventually, a turbine trip with consequent scram and a recirculation pump trip occur due to high turbine vibration.

This turbine trip and reactor scram comes from the turbine stop valves which have redundant sensors on each stop vlave located in the turbine building. Following scram, the operator would follow the usual and accident procedures that have been developed to assure core coverage, heat removal, containment integrity, etc.

This hypothesized event is basically a Feedwater Controller Failure-Maximum Demand event (FSAR Chapter 15.1.2) which is bounded by the Turbine Trip Without Bypass case.

The turbine control system is available throughout this event.

Ascending power caused by added feedwater/ recirculation flow would cause the main turbine bypass valves to open. The nuclear boiler safety / relief valves are available to control vessel pressure to the Tech Spec limits. Also, water carry-over into the feedwater turbines would cause feedwater set-back to about 30 percent flow capacity of the motor-driven feedwater pump.

If the instrument line break were inside one of the ECCS cubicles, the HELB environment is limited to that room. All equipment within the affected cubicle is assumed failed (both safety and non-safety) as well as that divisional diesel which powers the particular (HPCS) equipment in the cubicle (see Ninety Day Report). The redundant ECCS and all other safety and non-safety egipment outside the affected cubicle are unaffected. This event is non-limiting.

l we-w r-w* e w

LSCS-FSAR - AMENDMENT 62- -

FEBRUARY 1983 MATRIX OF NON-SAFETY CONTROL SYSTEMS

. AFFECTED BY HELB EVENTS HELB EVENTS INSTRUMENT NON-SAFETY CONTROL SYSTEMS LOCA MSLB FWLB: .LINE BREAK Reactor Vessel Instrumentation and Controls X sReactor Manual Control Systems X

• Recirculation Flow Control System X

- Feedwater Control System X X

, Pressure Regulator and Turbine Generator Controls X X Neutron Monitoring Systems (Non-Safety Portion)

Process Computer System Reyctor Water Cleanup System Area" Radiation Monitoring System X X Gaseous Radwaste Control System Liquid Radwaste Control System Spent Fuel Pool Cooling and Cleanup System Refueling Interlocks System Process Radiation Monitoring System X X Leak Detection System x NOTE:

Blank related areas mean Control that HELB Systems. events do not affect non-safetv-For the instrument line break, note tHat all individual non-safety control systems cannot be affected by a single (L .

or common type HELL due to physical and electrical separation of these control systems throughout the_ plant.

Q31.290-4 Y I  %

1

r <

4 .t LSCS-FSAR AMENDMENT 62-FEBRUARY 1983 MATRIX OF NON-SAFETY CONTROL SYSTEMS AFFECTED BY HELB EVENTS HELB EVENTS INSTRUMENT NON-SAFETY CONTROL SYSTEMS LOCA MSLB FWLB: ,LINE BREAK Reactor Vessel Instrumentation and Controls X

~

~~

sReactor Manual Control Systems X 6 Recirculation Flow Control System X

- Feedwater Control System X X

• Pressure Regulator and Turbine Generator Controls X X Neutron Monitoring Systems (Non-Safety Portion)

Process Computer System Reactor Water Cleanup System Area Radiation Monitorin'g System X X Gaseous Radwaste Control System Liquid Radwaste Control System Spent Fuel Pool Cooling and Cleanup System Refueling Interlocks System Process Radiation Monitoring System X x Leak Detection System x

NOTE:

Blank relatedareas mean that HELB Control-Systems. events do not affect non-safetv-For the instrument line break, note t5at all individual non-safety control systems cannot be affected by a single.

'{- ' '. or comon type.HELB due to physical and electrical separation of these control systems'throughout the plant.

Q31.290-4 It S

4 1 i 1

Revised Response-to NRC Question 031.292 2). Common Impulse Lines J- '

F The limiting non-safety control-system instrument line failure

.is postulated to be the common sensing line containing two of

[ the.three reactor differential pressure (level) transmitters for'feedwater control (C34-N004B, C34-N004A). This failure occurs in the annular open area of the reactor building (zone 4A). A failure of this instrument line causes the transmitters i to read low and it is assumed that.the high water level (L8) is non-operative, thus main turbine trip and feedwater turbine

, trips are disabled. Failure of both these feedwater control

[

channels would not affect feedwater flow.if it were operating on transmitter C34-N004C, however, a worst failure assumption i

' i requires that feedwater failure occurs on either N004B or '

N004A. The failed transmitters would output a minimum water level, thus resulting in a feedwater control system demand to

j. increase flow to the maximum.

i With these worst case assumptions, there would be no high water level trip of the main turbine nor of the turbine-driven feedwater pumps. The main turbine is not affected directly by j this failure of an impulse line in the reactor building because it is in the turbine Duilding. The turbine control system is located in the auxiliary electric equipment room (zone C-1) and the steam flow sensors controlling the turbine bypass system (EHC) are located in the basement of the turbine building.

. Consequently, with this separation of equipment, as power is f

increased due to higher feedwater flow (and water level), the.

turbine bypass' valves will open due to the steam flow mismatch, thus bypassing 25 percent of rated steam flow directly to the-condenser.

The maximum turbine power isslimited in this non-controlled flow situation to 95 percent rated power by the.APRM neutron flux thermal power trip which has a maximim limit of 120 percent power; ie, 120 percent limit minus the 25 percent bypass energy (flow).

1 As the feedwater flow-continues and the water level in the vessel reaches into the-main steam lines, the main turbine begins to vibrate, thus causing a turbine trip.via. turbine stop valves.- A turbine stop valve ~ trip also scrams the reactor.

'The two turbines driving the feedwater pumps also' trip due to high vibration from -fluid carry-over. . With the trip of the turbine-driven :feedwater pumps, the feedwater flow coasts down -

toja preset level of about 30 percent.(motor' driven-feedwater-pump). The.cperator vill have data available from the third t~ feedwater levelisensor (C34-N004C) indicating an increase in water. level'that is-both unexpecte'd and continuous ~due.to the

feedwater controller failure. The operator can attempt to runback feedwater or if that fails, he can manually trip the turbine to protect it from damage due to the increase in carry-over. This operator action would most likely occur prior to the main turbine trip due to high turbine vibration. The main turbine trip will initiate scram and recirculation pump trip (RPT) via safety-related logic. Closure of the turbine stop valves results in a RPV pressure spike with consequent opening of the safety-related safety / relief valves (SRV) to control vessel pressure. SRV action assures pressure control of the vessel. No fuel failures result from this transient which is fully treated in Section 15.1.2 of the FSAR.

With the L8 failure, the motor-driven feedwater pump continues to raise the water level, assuming no operator actions after scram, until it reaches the RPV steam lines and starts to fill the steam lines. Such water will eventually be discharged through the SRV's to the suppression pool if operator action is not taken early to manually turn off feedwater. EPRI tests at Wyle Lab have demonstrated that the Crosby SRV's can adequately function with two-phase flow. The SRV elevation is approximately 60 feet below the elevation of the steam line nozzles on the RPV so that even if water enters the steam lines, it will enter the SRV's as a mist or in droplets rather than as a slug of water. This information has been previously reviewed by the NRC Reactor Systems Branch during May 1981, when the decision was made that high pressure two-phase tests were not justified for the Crosby SRV's.

This hypothetical event is essentially a Feedwater Flow Controller Failure - Maximum Demand event (FSAR Chapter 15.1.2)

-that is bounded by the Turbine Trip Without Bypass case.

3185L L --