ML20040A719
Text
.
/
\\
UNITE D STATES j
NUCLEAR nEGULATORY COMMISSION f
r 4
WASHING TON, D. C. 20%5
'$. )6 * #
FEB 101978
~
0cket Nos. 50-514/515 MEMORANDUM FOR:
D. B. Vassallo, Assistant Director for LWR's, DPM FROM:
D. F. Ross, Jr., Assistant Director for Reactor Safety, DSS
SUBJECT:
SER SUPPLEMENT INPUT FOR PEBBLE SPRINGS UNITS 1 and 2 Plant Name: Pebble Springs, Units 1 and 2 Docket No.: 50-514/515 Milestone No.:
Licensing Stage: CP Responsible Branch LWR-4 and Project Manager:
C. Stable Systems Safety Branch Involved: Reactor Systems Requested Completion Date: N/A Review Status: Awaiting Information
References:
1.
Pebble Springs Units 1 and 2 Safety Evaluation Report Supplement No. 4 Reference 1 describes the fourteen issues in the Reactor Systems Branch area. The applicant submitted responses to these staff issues and our review of this infomation is attached as an SER supplement input. We are awaiting additional information on three issues: passive failures during long term cooling, feedwater isolation valves and CMpter 15 long term actions. The decay heat removal system isolation valve design concept, which has been proposed for Pebble Springs, was previously discussed with the Assistant Director for Plant Systems and we concur that this design is acceptable.
I
~
- l Jy u.-,_,
q,
D. F. Ross, Jr., Assi'stant Director for Reactor Safety Division of Systems Safety
Enclosure:
SER Supplement Input cc:
S. Hanauer G. Mazetis R. Mattson T. Novak D. Ross S. Israel S. Vcrga S.Newberr/6 l
C. Stable T. Ippolito H. Li W. Lefave l
V. Benaroya
Contact:
S. Newberry, NRR l
x27341 G201210457 810403 PDR F01A f1AODEN80-515 PDR
SAFETY EVALUATION REPORT f
PEBBLE SPRINGS Docket Nos. 50-514/515 5.2.2 Overpressure Protection While Shutdown at low Temoeratures Overpressure Protection for the reactor vessel in accordance with Appendix G is provided by the pressurizer safety valves at reactor coolant system temperatures greater than 305*F. Below 305*F, the safety valves in the decay heat removal syste'm (DHRS) i suction lines from the reactor coolant system will be used to provide the necessary protection. Operations at lov temperatures are always conducted with a gas' volume in the pressurizer.
The Pebble Springs design was evaluated according to the following criteria:
b (1) Credit for operator action, No credit can be taken for operator action until 10 minutes af ter the operator is made -
aware that a transient is in progress.
(2) Single failure criteria. The pressure protection system should be designed to protect the reactor vessel, given any event initiating a pressure transient, and followed by a single active component failure. Redundant or diverse pressure protection systems will be considered as meeting the single failure criteria.
I
(3) Testabili ty.
Provisions for periodic testing of the over-1 pressure protection system (s) and components shall be provided.
The program of tests, and frequency or schedule thereof will be selected to assure functional capability when required.
(4) Seismic Desien and Standard 279-1971 Criteria.
Ide?.lly, the pressure protection system (s) should meet both seismic Category 1 and Standard 279-1971 criteria. The basic objec-tive, however, is that the system (s) should not be ' vulnerable to an event which both causes a pressure transient and causes a failure of equipment needed to terminate the transient.
(5) Reliability. The system (s) provided must not reduce the reli-ability of the emergency core cooling system or residual heat removal systems.
The staf f required additional information to verify that the worst-case overpressure event had been selected and analyzed.
The applicant provided an analysis of all three High Pressure In-jection Pumps which is a bounding calculation af other potential overpressure events for operation at low temperatures. Each safety valve is rated at 2000 gallons per minute at a setpoint
.l of 455 psig which provides adequate relief capacity for this transient.
Inadvertent opening of the decay heat removal system while the reactor coolant system is at high pressure has been precluded through the use of interlocks which orevent opening 1
, 15.1 of the isolation valves when the reactor coolant system
( cont' d) pressure reaches 675 pounds per square inch, gauge, and automatically close the valves when the reactor coolant i
system pressure reaches 675 pounds per square inch gauge.
The interlock set point is sufficiently above the 455 pounds per square inch set point of the decay heat i
removal suction safety valves so as not to interfere with their function.
(The set point was previously 400, pounds per square inch gauge).
Since this protection system is redundant, in that there are two decay heat removal trains, each train containing i
a safety valve, the single failure criterion of the staff position is met if both trains are in operation. Therefore, the Technical Specifications will require that all four decay heat removal system suction valves be open when the Appendix G pressure limit is below the pressurizer safety valve set point. The staff identified a potential over-pressure event scenario in the review of this system on a similar Babcock and Wilcox plant which could occur if one decay heat remc. val system train was operating and all four suction valves were open in accordance with the Technical 3
Specifications. The sequence of events would be started by the postulated closure of one suction valve in the operating train due to equipment failure or operator error, causing loss of decay heat removal removal and a resultant
7 reactor coolant system pressure increase., Imposing the single failure criterion, the inadvertent closure of one suction valve in the other train is then postulated. A loss of cooling tran-sient could then exist while both decay heat removal system safe-ty valves are isolated from the reactor vessel. At.the request of the staff, Babcock and Wilcox provided analyses with respect to the probability of such an event and the resultant rate of pressure increase. Additionally, a transient analysis performed by B&W with the CADD code shows a pressure increase due to' the loss of cooling to be approximately 6 pounds per square inch in 10 minutes.. Increasing reactor coolant pressure and temperature. indication, closed decay heat re-moval system suction valve position indication, and a low flow alarm and meter indication would be indicated to the control room operator. Since the normal plant operating procedure is to maintain plant temperature and pressure well below the Appendix G limit and the 455 psig safety valve set point, and the rate of pressure increase is low for this event, it is the staff judgment that the operator would have at least 10 minutes to terminate the transient prior to exceeding the Appendix G limit. Although the staff does not agree with all of the assumptions used by Babcock and Wilcox in their probability analysis, we do believe that the combined probability of violating Appendix G limits for this event is
= _. _ _
5-relatively low. To further minimize the probability that the closure of. the decay heat removal system safety valves could result in exceeding Appendix G limits, we require that an alarm be provided in the control room which would annunciate if reactor coolant system temperature is below 305'F (the temperature above which the pressurizer I
safety valves provide sufficient protection) and any of the four decay heat removal system suction valves is not open. Any maintenance performed on the standby train necessitating isolation of one or both notor operated valves must be accommodated for this period of maintenance by an operator stationed at the console continuously observing the status of the operating train.
The relief capacity of the system will be certified by tests in accordance with the ASME Code Section XI. The system design, since an integral part of the decay heat removal No redu' tion in system, is fully seismic Category I.
c reliability of either the emergency core cooling system or the decay heat removal system is caused by the use of the decay heat removal system suction safety valves for reactor vessel protection at low temperatures. This design meets the above criteria and is therefore acceptable at the construction permit stage. We will r! view the details of the l
fluid conditions during relief valve operation at the operating license stage.
l l
l l
a 1
5.2.2 The staff is currently developing a generic position on (cont'd) overpressure protection at low temperatures.. Any modiff-
?
l cations required by this position will be considered for the application to Pebble Springs plant.
f 5.5.5 DECAY HEAT REF0 VAL SYSTEM i
5.5.5.1 Decay Heat Removal Isolation Valves The power supply arrangement to the decay heat removal system i
suction isolation valves was such that during a pipe break outside containment, one train of the system could not be isolated from the Reactor Coolant System assuming the single failure of one ele.ctrical bus. The appl 1 cant has incorporated the following design change so that such a i
break could be isolated assuming a single failure.
A normally open motor-operated valve, operated from the j
control room, immediately outside the containment, will be provided in each decay heat removal train. The power supply to each valve will be opposite of that for all other components in the train, i.e., "B" bus power will i
be provided for the valve in the " A" train and vice-versa.
I The additional isolation valve will not effect other safety l
design bases for this system. The applicant states that no i
single electrical or mechanical failure will prevent the initiation or isolation of the decay heat removal system from I
.I e
wi w-~--
m
-,y---
---m,->
--irw---e-
-w
+
-y i --
g 9y.
-4 E
the control room with or without offsite power in accordance with Appendix A to 10 CFR 50, General Design Criterion 34.
This design change enables the decay heat removal system to mcet the requirements of General Design Criteria 34 and there-fore resolves this open issu'e.
5.5.5.2 Provisions for Shutdown 4
The applicant must demonstrate that the plant can remain for a prolonged period in a hot shutdown condition assuming loss of offsite power and using only safety-grade equipment or show that the plant can be cooled and depressurized using only
{
safety-grade equipment (assuming loss of offsite power) to the level required for decay heat removal system actuation.
The apolicant states that he will provide information in a future PSAR amendment to demonstrate that the Pebble Springs plant meets this criterion. The committment by the applicant to meet the staff position is acceptable at the construc-J tion permit stage. We will review the details of the applicant's proposal when submitted.
i 1
i l'
L
i
~
5.5.5.3 Decay Heat Removal Systen Cooler Bypass Valves The staff identified the concern that a loss of control air to the pneumatic decay heat removal 3ystem cooler bypass valves, causing them to fail closed, could result in maximum flow being directed through the coolers. Since the rate of cooldown is controlled by changing cooler bypass flow, the termination of bypass flow could result in an excessive cooldown rate.
i The applicant proposes to modify the pneumatic valve operators to incorporate a " fail-in-position" feature. We believe that this modification sufficiently reduces the 1
j likelihood of an excessive cooldown rate of the RCS during i
operation of the decay heat removal system and is therefore acceptable. The details of the modification will be reviewed in the FSAR.
L l
4 i
l E
l l
?
+,
6.3' Emergency Core Cooling System
^
- 6. 3.1 Performance Evaluation Supplement 2 to the Pebble Springs Nuclear Plant Units 1 and 2 Safety Evaluation Report concluded that the ECCS performance com-plied with the criteria of 10 CFR 50 and Appendix K.
Since the issuance of Supplement 2 to the SER, additional analyses were requested to address recent ECCS analysis changes made by Babcock and Wilcox (reference 2) and to compare the 2
difference in the Pebble Springs power level and reactor coolant pump flow parameters to the generic analysis in BAW-10102 (reference 3).
Analyses were provided in. reference 4 to show that the 2
8.55 ft. double ended pump discharge break (C = 1.0)
(
D still produces the worst results for Babcock and Wilcox 205 Fuel Assembly Plants. The peak cladding temperature of 2114*F at the core midplane is 12*F less than previously
~
calculated in BAW-10102.
The applicant references the plant specific analysis for Greene County, another 205 fuel assembly plant, which has the identical power and flow parameters. The minimum containment backpressure calculation used in the Greene County analysis is conservative (lower) with respect to 4
i
the Pebble Springs back pressure throughout the accident.
Accordingly, the Greene County analysis is an appropriate reference for the Pebble Springs plant. The computer models were modified to be consistent with the most recent evaluation model determined to be acceptable by the staff. The following changes were included in this analysis:
(1) a 0.25 psi penalty in the cold leg pressure drop due to high pressure 4
injection during reflooding as required by reference 6, (2)
THETA revised post-CHF heat transfer logic as approved in reference 7, (3) CRAFT 2 revisions as approved in reference 8.
Reference 5 confirms that the referenced Greene County analysis l
was performed with an approved evaluation model.. The results of this analysis yielded a peak cladding temperature of 2059'F at the core midplane which is 67'F below the equiva-lent temperature in BAW 10102 and 55*F below the temperature reported in reference 4.
The maximum local oxidation was calculated to be 4.2%, which is below the value reported in BAW-10102 and the 17% limit specified in 10 CFR 50.46. This calculation also concludes that the whole-core metal-water reaction will be less than 1% and that the core geometry remains amenable to cooling such that long-term cooling can be esta-blished. These additional analyses tnerefore show that the conclusions stated in Supplement 2 to the safety evaluation report remain applicable.
i i
We conclude, that the ECCS calculations for the Pebble Springs plant are wholly in conformance with 10 CFR 50.46 and App. K and therefore acceptable at the construction permit stage.
6.3.2 HPI Line Break i
The staff required additional information to evaluate the consequences and necessary operator actions to mitigate the consequences of a break in a high pressure injection line be-tween the reactor coolant system piping and the last HPI' check valve. The applicant states that the Pebble Springs HPI system is functionally identical to the corresponding design in l
B-SAR-205 and that the PSAR will be updated to reflect this.
Therefore, the description of consequences and necessary operator actions described in B-SAR-205 are applicable to i
Pebble Springs. The additional information provided by Babcock and Wilcox for B-SAR-205 shows that for a high pressure injec-tion line break and any associate' single active failures, the design permits the closure of one High Pressure Injection isolation valve from the control room by the operator which will isolate the break from an ECCS flow path and assure that sufficient flow is provided for core cooling.
The analysis assumed that the control room operator will close the motor-operated isolation valve necessary to isolate the break 20 minutes af ter the initial indications of the break. The k
-c, - -,
=-
i necessary indication for this or/mtion is provided in i
the control room by observing the higher injection flow i
in the ruptured ifne.
5 The credit taken for operator action at 20 minutes is in t
accordance with USNRC Standard Review Plan 6.3, " Emergency Core Cooling Systern". Since the required action by the i
operator based on the high pressure injection flow indica-tions in each injection train is straight-forward and in f
t accordance with the staff's criteria, the Pebble Springs A
design and analyses with respect to the high pressure injec-tion line break are acceptable at the construction permit stage.
6.3.3 Passive Failures During Long Tem Cooling _
We require that detection and alarm systems be provided to alert the operator to passive Emergency Core Cooling System failures during long-term cooling following a LOCA which allow sufficient time to identify and isolate the faulted ECCS line.
[
The passive failures considered are limited to leaks re-sulting from failure of valve stem packing and pump seals, i
I i
i l
l 1.
~ ~
The leakage detection system must meet the following requirements:
i (1)
Identification and justification of maximum leak rate should be provided.
(2) Maximum allowable time for operator action should be provided and justified.
(3) Demonstration should be provided that the leak detection system will be sensitive enough to initiate (by alarm) operator action, permit identification l
of the faulted line, and isolaticn of the line prior to the leak creating undesirable consequences such as flooding of redundant equipment. The minimum time to be considered is 30 minutet.
(4) It should be shown that the leak detection system j
can identify the faulted ECCS train and that the leak is isolable.
a (5) The leak detection system must meet IEEE 279 require-ments except for single failure, and must include a control room alarm.
't l
I
-r, c
L i
' 6.3.3 We require the applicant to commit to the above requirements l
(cont'd)
)
at the construction permit stage of review.
i 8
1 2
l 6.3.4 Essential Manual Valves in the Emergency Core Cooling System The applicant states that the status of essential manual t
valves in the ECCS will be verified in the following manner:
I (a) those valves which have to be operated during the sequence of a normal plant start-up and/or shutdown will be provided with position switches and will be monitored as part of the " inoperable status" indica.
tion for that system.
(2) Those valves located in normally accessible areas will i
be visually verified for correct position at least
(
once every 31 days in accordance with administrative j
procedures.
(3) Those valves located in normally inaccessible areas, where routine visual serification is undesirable, will be provided with position switches and will be mon-itored for correct position from the control room.
These criteria meet the intent of Regulatory Guide 1.47,
" Bypassed and Inoperable Status Indication for Nuclear Power Plant Safety Systems" and is acceptable at the construction permit stage.
1 i
t
t J
\\
j
- 4 i
j I
6.3.5 Makeup Line Break l
The Pebble Springs makeup and purification /HPI pump suction.
l and discharge header design has been revised (reference 9) to incorporate changes which are functionally identical to B-SAR-205. The third makeup pumo and supporting balance l
of plant auxiliaries in the Pebbie Springs design can be manually transferred to either ESF safety train. The
]
piping and identification diagrams and the makeup line b'reak i
sequence of events provided by the applicant ' describing a l
i break in the normally pressurized makeup line considering t
i a single active component failure show that the Pebble Springs design provides the ca7atility to isolate such
/
a break from the control room assuming a single active i
component failure.
l We have reviewed the above design change and conclude that i
it satisfies the pipe break out$;de of containment criteria i
/
and is therefore acceptable.
b 1
i
~
1 i
I
~.
. 15.0 Accident Analyses 15.1 Excessive Heat Removal Events The applicant originally referenced the main steam line break 4
as a bounding analysis for several excessive heat removal events of moderate frequency. Since DNBR is less than 1.32 for the main steam line break analysis, additional analyses were requested by the staff to show that no fuel damage occurs for these events.
(DNBR>1.32).
i The excessive heat removal events due to a reduction in feed-I water temperature or an increase in feedwater flow have been analyzed and result in a DNBR71.32.
The applicant references the B-SAR-205 analyses for excessive steam flow due to in-
{
advertent opening of a steam safety, atmospheric dump, or turbine bypass valve by the operator or an equipment mal-function such as a pressure regulator failure. The B-SAR-205 I
'l analysis shows that DNBRil.32 for a 15% increase in steam flow at full power. The increase in steam flow resulting from a stuck open main steam " safety or modulating atmospheric dump valve would be limited to about a 6% or a 7% step increase, respectively.
The applicant states that maloperation of the turbine bypass system, however, may result in a steam flow greater than 15 percent rated flow and that interlocks i
I i
-17 (or alternative means) will be provided to ensure that the rated steam flow is limited to a maximum 15-percent step in-creasebyp'reventingmoderatefrequencyincidentsffromcausing i
spurious opening of the atmospheric and condenser 4 ump valves.
The interlocks will not inhibit normal valve operation for a turbine trip, generator trip, or load rejection when dump valve operation is desirable.
The Pebble Springs aralyses for excessive cooldown events of moderate frequency now meet the acceptance criteria of the j
Standard Review Plan. This committment for interlock design is' acceptable at the construction permit stage, while the details of the design will be reviewed on the operating
[
license application.
15.2 Feedwater Isolation The main feed system contains two headers, one for each steam generator. Each header contains one safety grade feedwater isolation valve which receives redundant ESFAS, signals. The i
feedwater control valves which receive redundant ESFAS closing signals also serve as an isolation backup to the feedwater isolation valves. Additional protection is provided by ESFAS signals that trip the turbine driven feeowater pumps. This 1
system arrangement meets the staff's position that credit may be taken for non-seismic Category I systems as a backup i
. 2 isolation device (NUREG 0138, " Staff Discussion of Fifteen Technical Issues Listed in Attachment to November 3,1976 kemorandum from Director, NRR, to NRR Staff").
j The applicant has not yet shown, however, that the charac-
]
teristics of these backup isolation features have been considered in the accident analyses requiring feedwater 1561a-tion. This item requires resolution prior. to issuance of a' construction permit.
1 15.3 Chapter 15 Events The applicant was required to provide a discussion for each Chapter 15 event describing all of the operator actions re-l quired in the recovery mode following a transient or accident.
i Our interest is in evaluating the operator's role in achieving and maintaining stable plant conditions. Concerns include the need for the operator to terminate ECCS flow subsequent i
to a steam line break or loss-of-coolant accident and the potential for, and effects of, premature termination. The applicant states that this information will be provided in a future PSAR amendment prior to issuance of the construction permit. The staff will report on the review of this area in a supplement to the Safety Evaluation Report.
l v.,-
.v-
i 15.4 Non-Safety Grade Equiooment The applicant was requested to show that the overpressure l
and fuel damage criteria for the moderate frequency events ;l-in Chapter 15 would be met with no credit assumed for unique actions performed by,.non-safety grade systems. The part-icular non-safety grade systems in question are the turbine bypass system and the turbine trip via the control rod drive control system. BAW-10043, " Overpressure Protection for.
l Babcock and Wilcox Pressurized Water Reactors with 205 Fuel Assemblies analyses a turbine trip without bypass and shows acceptable consequences.
In addition, an analysis of turbine trip with and without bypass has been performed for the Bab-cock and Wilcox Standard Plant, B-SAR-205 application and also demenstrates acceptable consequences. The applicant states that recent analyses performed assuming no turbine bypass show negligible differences from the analyses (other than turbine trip) presented in Chapter 15 of. the Pebble Springs PSAR. This analysis demonstrated that adequate steam relief capacity is available through the main steam safety valves or atmospheric dump valves which are safety grade.
l The effect of the turbine trip via the control rod drive I
control system (CRDCS) has also been addressed by the applicant.
l t
A sensitivity study using the excessive cooling event caused i
by a steam pressure regulator malfunction was referenced which shows transient response for a similar plant with and without turbine trip via CRDCS. This study indicates that turbine trip does not significantly affect such cooldown transients. DNBR has already reached its minimum value and is rising before the effects of the turbine trip genera-ted by the C00CS are seen. Since the use of turbine trip via CRDCS for transients that are undercooling in nature is conservative, it is concluded that the operation of turbine trip via CRDCS does not significantly alter the consequences of the moderate frequency events analyzed in Chapter 15 of the Pebble Springs SAR. The staff believes that the addi-i tional sensitivity studies and justification provided by the applicant provide adequate assurance at the construction permit stage that the Pebble Springs design meets the over-pressure and fuel damage criteria for the moderate frequency events in Chapter 15.
The staff will require that the FSAR analyses reflect no credit assumed for non-safety grade systems at the OL stage.
15.5 Boron Dilution Events 1
The applicant was requested to provide additional analyses of t
boron dilution events considering the plant conditions other I
than power operation or refueling as specified in SRP 15.4.6.
l
a
~ '
\\
The Pebble Springs PSAR shows the chemical volume and control system (CVCS) to be similar to that of B-SAR-205, t
the standard B&W NSSS. The applicant states that these systems also have identical interldcks and alarms.
The current Pebble Springs design does not incorporate a makeup tank bypass line as reflected in B-SAR-205, however, this difference does not alter the CVCS dilution rate since it is still limited to the capacity of the makeup pumps. The applicant states that the dilution analysis in B-SAR-205 i
is appropriate for the Pebble Springs plant. We have reviewed the system diagrams of both the Pebble Springs and B-SAR-205 CVCS designs and believe that the reference of the B-SAR-205 boron dilution analysis is acceptable due to the
(
CVCS system similarities.
It is the staff position, as was required for B-SAR-205, that alarms be available during refualing and audible count rate instrumentation to detect changes in reactivity conditions of the core and provide the operator a prompt and definite indication of any boron dilution. The applicant will be required to provide such a system and describe its capability to perform this functionn in the FSAR.
The staff also requires the applicant to identify and analyze dilution sources in the plant other than the chemical volume and control system. This information must be submitted in the applicants FSAR.
i l
l l
References
(
- 1. ' Safety Evaluation Report Supplement No. 2 for Pebble Springs Nuclear Plant Units 1 and 2, February 1976.
2.
Letter from S. Yarga (NRC) to J. H. Taylor (B&W), Request for Addi-tional Information on BAW-10102, May 10,1977.
3.
BAW-10102 - ECCS Evaluation of B&W's 205-FA NSSS Revision 2, Dec.1975.
4.
Large Break ECCS Evalaution of B&W 205 FA NSS Using the August,1977 ECCS Evaluation Model (BAW-10104, Rev. 30, September 30, 1977).
5.
Memorandum for T. M. Novak from Zoltan R. Rosztoczy dated December 7,1977, "ECCS Analysis for Greene County."
6.
Letter from A. Schwencer (NRC) to K. E. Suhrke (B&W), January 8,197f.
7.
Letter from S. A. Varga (NRC) to K. E. Suhrke (B&W), February 18, 1977.
8.
Letter from S. A. Yarga ()!RC) to K. E. Suhrke (B&W), May 13, 1977.
9.
Letter from W. J. Lindblad (PGE) to S. A. Varga (NRC), dated September 7,1977.
.