ML20043F744
| ML20043F744 | |
| Person / Time | |
|---|---|
| Site: | Limerick  |
| Issue date: | 05/22/1990 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML20043F741 | List: |
| References | |
| NUDOCS 9006180067 | |
| Download: ML20043F744 (22) | |
Text
_
' (psuc%%,
UNITED STATES
>c
[
g NUCLEAR REGULATORY COMMISSION 3
ij WASHINGTON. D. C. 20555
....+
]
SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION SUPPORTING AMENDMENT NOS. 39 AND 6 TO FACILITY OPERATING LICENSE HOS NPF-39 AND NpF-85 PHILADELPHIA ELECTRIC COMPANY LIMERICK GENERAT1HG STATION, UNITS 1 AND 2 DOCKET NOS. 50-352 AND 50-353
1.0 INTRODUCTION
By letter dated November 17, 1989, Fhiladelphia Electric Company (PEco or the licensee) requested an amendment to facility Operating License Nos.-
NPF-39 and NPF-85 for the Limerick Generating Station, Units 1 and 2.
These proposed amendments would change the Technical Specifications (TSs) for Limerick 1 and 2 to:
a) remeve surveillance requirement (SR) 4.1.3.5.b.2 (and the associated footnote) which requires Control Rod Drive (CRD) scram accumulator check valve testing once per 18 months and specifies test 3.1.3.5.a.2.a to allow the reactor operator twenty (20)peration (LCO) acceptance criteria, b) modify Limiting Condition for O minutes to restart a tripped CRD pump provided that reactor pressure is greater than or equal to 900 psig or if reactor pressure is less than 900 psig, the operator will immediately place the reactor mode switch in the Shutdown position and c) change the 18 month scram accumulator pressure sensor channel calibration (setpoint), SR 4.1.3.5.b.1.b. from "970 plus or minus 15 psig" to " equal to or greater than 955 psig "
2.0 BACKGROUND
Limerick, Unit I was shutdown for the second refueling outage from January 11, 1989 to May 15, 1989. On May 9, 1989, prior to startup, the licensee performed surveillance tests on the control rod drives as required by the TSs. One of the TS surveillances (4.1.3.5.b.2) specifies that at least once per 18 months, each control rod scram accumulator shall be determined operable by measuring ar.d recording the time for up to 10 minutes that each individual accumulater check valve maintains the associated accumulator pressure above the alarm set point with no control rod drive pump operating. During the surveillance tests on May 9, 1989 of the-185 CRD accumulator check valves,17 of the check valves did not maintain hydraulic control unit (HCU) accumulator pressure above the low pressure alarm setpoint of 970 psig for the test time interval of-10 minutes (LER 1-89-042). The data acquired from performing this and previous surveillance tests of the check valves was not used to make any operability judgements, l
I but was used for trending purposes to schedule preventive maintenance.
During a review of the surveillance test data results on June 8, 1989, the 1
9006180067 900522 ADOCK0500gl2 DR
L, e.
NRC resident inspector questioned the station's interpretation of the TS requirement. The inspector's interpretation was that the results of the surveillance tests should be used to determine the operability of the accumulator for the associated HCU rather than trending for maintenance.
(InspectionReports 50-352/89-10, Section 4.1 and 50-352/89-12 with notice of violation and PECo response of August ?9, 1989). At the time this was identified, Limerick, Unit I was operating with normal system pressure.
At system pressures above 600 psig, reactor pressure provides' adequate energy to insert the control rods without the assistance of the accumu-lators, so there was no safety issue with respect to the 17 malfunctioning check valves. To resolve the innediate question of operability, we issued a temporary waiver of compliance on June 9, 1989. On June 10, 1989, the licensee requested a change to the TS surveillance requirement on the accumulator check valves to note that the requirement was only applicable when reactor vessel pressure is at or below 600 psig. This change was approved by Amendment No. 31 to License No. NPF-39 on July 10, 1989.
In the application of June 10, 1989, the licensee agreed to review all of the TS surveillance test requirements on the CRD scram accumulators. The TS changes proposed in this subject application of November 17, 1989 are the result of the licensee's reassessment.
3.0 EVALUATION The licensee'is proposing three changes to the TSs as described in the introductory paragraph above. Our evaluation of the changes is summarized below. The CPD system is described in Section 4.6.1 of the Limerick Final Safety Analysis Report (FSAR).
For each control rod, there is a hydraulic control unit (HCU). The HCU package includes two vertical cylinders, a scren water accumulator and a scram accumulator nitrogen cylinder. The latter is pressurized from a nitrogen charging beader. As stated in the FSAR, the scram accumulator stores sufficient energy to fully insert a control rod at lower reactor pressures. At -
higher vessel pressures, the accumulator pressure is supplanted by reactor vessel pressure. The accumulator is a hydraulic cylinder with a-free-floating piston. The piston separates the water on the top from the nitrogen below. A check valve in the accumulator charging line is intended to prevent loss of water pressure in the accumulator if supply pressure is lost. The check valve is located above the two occumulators as shown in the attached Figure 4.6-8 from the FSAR. The performance of these check valves is the focus of this safety evaluation.
During normal plant operation, one CR0 supply pump is operating at all times and the other pump is maintained in standby, The operating pump maintains the required pressure in all 185 co' n el rod scram accumulators such that the accumulators contain sufficiert 5tored energy to ensure the complete insertion of all control rods in the required time at any reactor pressure. However, when reactor pressure is close to, or at full operating pressure, reactor pressure alone will insert the control rods in the required time. The stored energy in the accumulators may assist in
o 3-accelerating the control rods initially, but this assistance is not necessary to ensure a successful scram.
In fact, reactor pressure alone is sufficient to fully insert all the control rods at a reactor pressure as low as 600'psig.
At a reactor pressure of less than 600 psig, reactor pressure alone may not be sufficient to fully insert all the control rods in the required time. Therefore, the scram accumulators must contain sufficient stored energy to ensure a complete scram under these conditions. With a supply pump operating, accumulator pressure is maintained and a successful scram is assured.
However, assuming that the charging pressure from the supply pump is lost, the accumulators alone must retain sufficient energy to complete a scram upon demand. The ball check valves in the accumulator charging lines will prevent a rapid loss of accumulator pressure when the supply pump is lost, if the balls properly seat.
1 SR 4.1.3.5.b.2, which the licensee is proposing to delete, presently requires measuring and recording the time for up to 10 minutes that each individual CRD scram accumulator ball-check valve maintains the associated accumulator pressure above the alarm set point with no control rod drive pump operating.
As part of our evaluation, the staff has reviewed the requirements on the CRD hydraulic system in the TS for all domestic BWRs, including surveillance requirements on the pumps, valves and instrumentation. There are 38 operating BWRs in this country,19 of which have " custom" TSs and 19 with some version of the "BWR Standard TSs."
Mone of the older BWRs have a similar requirement in the TSs for tem.ing the check valves. This includes Big Rock point, Brunswick 1 and 2, Cooper, Dresden 2 and 3, Duane Arnold, Fitzpatrick, Hatch 1 and 2 LaSalle 1 and 2,. Milestone 1, Monticello, Nine Mile Point 1, Oyster Creek, peach Bottom 2 and 3, Pilgrim, Quad Cities 1 and 2. Vermont Yankee, and Browns Ferry 1, 2, and 3.
In the late 1970's, and early 1980s, the staff was giving increased attention to CRD hydraulic systems in NT0L reviews due to cracking detected in some CRD return line nozzles (NUREG-0619, "BWR Feedwater Nozzle and Control Rod Drive Return Line Nozzle Cracking," Noyember 1980),
the failure of half of the control rods to scram at Browns Ferry, Unit 3
("BWR Scram Discharge System Safety Evaluation " December 1,1980),
assessment of whether there would be adequate flow if the CRD hydraulic systen was the only available emergency high-pressure water source to the core as was the case during part of the Browns Ferry, Unit 1 fire and several incidents at operating BWRs during which both the CRD pumps became temporarily disabled. Revision 3 to NUREG-0123, " Standard Technical Specifications for General Electric Boiling Water Reactors (BWR/5),
issued Fall 1980, included as Surveillance Requirement 4.1.3.5.b.2:
1
~4" "Verifyingthattheaccumulatorpressure(andlevel)remainsabovethe alarm set point (s) for greater than or equal to 20 minutes with no control-rod drive pump operating."
LaSalle, Unit 1, was the first BWR to be licensed after the accident at TMI-2. As discussed in the staff's SER on LaSalle (NUREG-0519), there were several results from the preoperational testing that focused the staff's attention on the CRD hydraulic system.
For laSalle, General Electric calculated a flow rate of 180 gpm would be required to keep the core covered assuming loss of all other makeup systems to the vessel 40 minutes after shutdown. The applicant performed a preoperational CR0 flow test and the test results indicated that the actual makeup capability was only 128 gpm, which was insufficient to meet the 180 gpm minimum recommendation of NUREG-0619. The staff recommended that the laSalle TSs include the above surveillance requirement to verify that the accumulator pressure and level would remain above the alarm set points for at least 20 minutes with no CRD pump operation.
Preoperational tests by the applicant also determined that, because of check valve leakage, accumulator depressurization below the alarm set point could occur within three minutes.
As discussed in Supplement 2 to the staff's SER (SSER 2 to NUREG-0519) the applicant proposed an alternative to the surveillance.
r requirement on the accumulator check valves. The applicant proposed installation, prior to startup after the first refueling outage, of an automatic reactor trip that would scram the control rods in the event of low control rod drive pump discharge pressure. The trip would be activated during startup and refueling modes only. The staff concluded that this proposal was acceptable, since the accumulators are only needed at lower reactor pressures. However, the staff's position was that the surveillance requirement on the accumulator check valves should remain in the TSs until the modifications were completed. Thus, laSalle Unit I was the first BWR to include a surveillance requirement on the accumulator check valves.
The requirement to test the valves for up to 20 minutes was, however, deleted. The same surveillance requirement for testing the accumulator check valve was also-incorporated in the LaSalle, Unit 2 TSs when it was licensed. The reactor scram on low CR0 pump, discharge pressure modifications were subsequently completed for both LaSalle Units 1 and 2.
The surveillance requirement on the accumulator check valves was deleted from the Unit 2 TSs by Amendment No. 6 to License No. NPF-18 on December 17, 1984 and was deleted from the Unit 1 TSs by Amendment No.
33 to License No. NPF-11 on February 4, 1986.
The surveillance requirement on the accumulator check valves was included in TSs for those BWRs licensed af ter LaSalle, l' nit 1 in 1982,1983,1984, and 1985. The plants included Susquehanna Unit I which was issued a full power license on November 12, 1982 through Limerick, Unit 1 and River Bend, which were issued full power licenses on August 8. 1985 and November 1985, respectively. For all of these plants, the TSs required holding the pressure above the alarm set point for up to 10 minutes. The 10 minutes was the estimated time it would take to startup the standby CRD pump if the operating pump failed.
1 As a result of the NTOL review for LaSalle, Unit 1, the staff initiated Generic issue No. 98 - CRD Accumulator Check Valve Leakage. The issue was not actively pursued. By memorandum dated August 13, 1984 from the Chief, Auxiliary Systems Branch to the Chief, Safety program Evaluation Branch, the latter was requested to prioritize the issue. On February 19, 1985, the Director, NRR' approved " Dropping" this generic issue. The memorandum and evaluation supporting this action are enclosed to this i
safety evaluation. According to the staff who were involved in this assessment, the resolution of generic issue no. 98 was to have been the-basis for removing the surveillance requirement on the accumulator check valves from the TSs. Or. tMt basis, Hope Creek, Perry and Clinton, which were issued full power licenses on July 25, 1986, November 13, 1986, and April 17, 1987, respectively, do not have the surveillance requirement-on the check valves in their TSs. The reouirement is in the Limerick, e
Unit 2 TSs since the criteria was to have identical TSs for Units 1 and 2 insofar as possible.
Although the enclosed evaluation provides justification for removing the surveillance requirement on the accumulator check valves from the TSs, the staff has performed a supplemental evaluation.
As a result of these evaluations, the staff is proposing that the surveillance requirement be removed from the other 8 operating BWRs that have this requirement as l
part of the TS Improvement Program.
Removal of SR 4.1.3.5.b.2 does not eliminate testing and maintenance of the scram. accumulator check valves. Surveillance requirement 4.0.5 in the TSs requires that inservice testing (IST) of ASME Code Class 1, 2, and 3 pumps and valves shall be performed in accordance with Section XI of the ASME Boiler and pressure Code. The IST program requires a reverse flow surveillance test of the scram accumulator check valves once per calendar quarter if the plant is in Cold Shutdown. As a minimum, this requires testing of the check valves at least during every refueling outage (i.e., 18 months). To verify that the ball check valves will properly seat, the supply pump is secured, the charging water header is depressurized and the accumulator pressure and low pressure alarms-are monitored to verify that the valves have closed (are on their seats) on loss of pump flow. The IST test requires that the check valves maintain-the pressure above the low pressure alarm setpoint for about 30 seconds whereas the surveillance requirement being deleted required maintaining the pressure for 10 minutes. The IST program demonstrates that the scram accumulator check valves are operable and are functioning. The IST program is the basic requirement that ensures the all valves in safety-related systems (including the scram accumulator check valves) are periodically tested, that identifies the need for maintenance, that demonstrates that the valves are installed properly and function as intended and that requires retesting following maintenance. The present surveillance requirement on the check valves which is being deleted is in addition to the tests performed on the same check valves by the IST program. Therefore, testing and operation of the scram accumulator check valves will continue to be demonstrated by the TS required IST program.
e' d" The only difference between the two tests is that the SR assesses the leak-tightness of the accumulator check valves for 10 minutes whereas the IST. test interval is about 30 seconds. The bases for the 30 seconds could not be determined.
It was beyond the scope of the evaluation to determine what percentage of check valves in BWRs pass the IST testing but not the 10 minute leak test. While it is suspected that dirt may be one of the reasons some ball-check valves do not tightly seat, the staff did not review maintenance records to assess whether corrosion and pitting may also be factors.
The CRD hydraulic system is described in Section 4.6.1.2.4 of the FSAR.
A very simplified drawing of the overall system, Figure 2-14 from the General Electric BWR Technology Manual, is attached. The CRD hydraulic system supplies and controls the pressure and flow to and from the drives through the HCOs. There is a HCU for each of the 185 control rods. Two drive water supply pumps pressurize the system with water from the condensate treatment system and/or condensate storage tank. Normally, only one supply pump is operating with the other on standby.
The supply p(The pressure is ump maintains a nominal 1400 to 1500 psig in the charging water header.
monitored in the control room and can range from about 1250 psig to 1510 psig.) As long as a supply pump is operating, the accumulators are not needed even at low reactor pressure, since the pump maintains the pressure upstream of the check valves discussed above. Thus,.the leak-tightness of the CR0 scram accumulator check valves is not a safety concern as-long as one drive water si:pply pump is operating.
As discussed in the FSAR, at system pressures above 600 psig, reactor pressure provides adequate energy to insert the control rods without the assistance of the accumulators. Thus, during normal operation, the leak-tightness of the scram accumulator check valves is not a concern, since the scram accumulators are not necessary to safely shutdown the plant.
Reactor pressure in excess of 600 psig is sufficient to fully insert a control rod with a failed check valve. At 600 psig reactor pressure,-the scram insertion time.of an individual control rod with zero accumulator pressure would be within TS and design basis requirements. Also, the average scram time for all drives would continue to meet design require-ments. Therefore, failure of an accumulator or accumulator check valve is not significant with respect-to the ability to shut down the plant during normal operating conditions.
If there were a loss of reactor pressure, the isolation actuation instrumentation would initiate a scram before the pressure dropped to 600 psig due to MSIV closure (756 psig trip setpoint). Below 600 psig, the nitrogen accumulator would provide adequate pressure to scram a control red even if the charging water pressure was reduced and the check valve did not retain water pressure in the accumulator.
One of the other postuleted scenarios evaluated by the staff was loss of the operating CRD charging pump during startup when the reactor pressure is below 600 psig. As discussed previously, the nitrogen pressure in the accumulator is adequate to scram a control rod even if the check valve is
not holding and pressure in the header bleeds down.
Below 600 psig, the reactor is critical but all heat is being used to build up pressure. The MSIVs cannot be opened to start warming up the steam lines until pressure is above the 756 psip trip setpoint.
If a CRD pump were to fail during startup, the plant would be shutdown to repair it. The check valves would not have to retain pressure in the accumulators for any significant length of time to make the reactor subcritical.
With the assistance of the NRC resident inspectors, the Limerick regulatory i
engineers and the Limerick CRD system engineer, the staff evaluated the overall operation, maintenance and testing of the CR0 hydraulic systems at Limerick. One operable CRD water supply pump maintains sufficient charging.
water pressure to scram the control rods under all conditions, irrespective i
of whether the accumulator check valve functions as intended. Limerick is one of the minority of plants that has TS requirements on the CRD pumps.
The TSs for most BWRs have no operability or surveillance requirements on the CRD pumps. This is the case for Big Rock Point, Browns Ferry 1, 2.-
and 3, Brunswick 1 and 2 Cooper, Dresden 2 and 3, Duane Arnold, Fitzpatrick, j
Hatch 1 and 2 Millstone 1, Monticello, Nine Mile Point 1, Oyster Creek, Peach Bottom 2 and 3, pilgrim, Quad Cities 1 and 2, and Vermont Yankee.
The pressure in the charging water header is shown in the control room from pressure indicating switch 46-1N600. The operators are alerted if there is a trip of the CRD pump or charging water low pressure. The operators are also alerted if the pressure in any of the accumulators were to drop below the alarm setpoint. This cannot occur as long as the CRD pump is operating and pressure is maintained in the charging water header.
There is a pressure switch in the charging water line to each accumulator downstream of the check valve, located adjacent to the instrumentation block at the base of-the HCU, (See attached Figure 1 from the I&C surveillance test procedure.) The alarm setpoint is listed in Section 4.1.3.5.b. of the TSs. One of the proposed changes is to decrease the alarm setpoint from 970 to 955 psig. The functional and calibration requirements on these pressure switches are also specified in the same section of the TSs.
These TS requirements are implemented by Surveillance Test Procedures ST-2-047-400, Rev. 5.
" Control Rod Drive Scram Accumulator Level and Pressure Detector Calibration / Functional Test." If the operating CRD charging pump was lost (which has not occurred at Limerick), there could be a reduction in pressure in the charging water header during the time it takes the operators to manually start the standby pump. If an accumulator check valve was not fully seated, pressure in the accumulator could bleed down. As soon as pressure in the accumulator reached 955 psig (in the proposed TSs), this would alarm in the control room. When a HCU accumulator alarm condition occurs (either a low N, bottle or a high N water level), the Main Control Room (MCR) reactor operators receive a,
flashing accumulator trouble alarm indication on the Full Core Display panel in the MCR for the specific HCU (panel *0C600). The reactor operator must examine the Full Core Display to identify the specific HCU accumulator-that is in alarm. Any alarmed accumulator trouble alarm on
e.
i the Full Core Display will flash until the reactor operator acknowledges the alarm on a specific accumulator trouble alarm acknowledge button on the reactor console (panel *00603), This alarm condition is accompanied by an audible and flashing annunciator alarm, " Accumulator Trouble," in the MCR. The Reactor Operator must acknowledge the alarm on a general annunciator acknowledge button to silence the alarm noise and stop the flashing alarm window.
If a second HCV accumulator alarm is received after the first alarm is acknowledged, the annunciator re-alarms and the operator must again acknowledge the alarm to silence the alarm noise and stop the flashing alarm window. The second HCtl accumulator trouble alarm also flashes on the Full Core Display. This sequence is the same for multiple HCU accumulator alarms.
4 Therefore, adequate MCR indication exists for the operator to be alerted to multiple HCU accumulator trouble alarms.
The proposed TSs require that if more than one accumulator is inoperable and if no CRD pump is operating and if reactor pressure is less than 900 psig, the reactor mode switch is to be placed in the shutdown position.
Based on our evaluation, the staff concludes that 1) the IST program will demonstrate that the CRD accumulator check valves are operable and that-they are not leaking at an excessive rate and 2) the present surveillance requirement for leak-testing the check valves for up to 10 minutes is not necessary and can be deleted.
The second of the three TS changes requested by the licensee was to change the 18 month scram accumulator pressure sensor channel calibration (setpoint),
SR 4.1.3.5.b.1.b. from "970 plus or minus 15 psig" to " equal to or greater than 955 psig." A number of TS violations have occurred at operating nuclear power plants due to setpoint drift of the nitrogen accumulator pressure sensors.
As a result, General Electric Service Information Letter (SIL) 429, Revision 1, "HCV Accumulator Pressure Switches," issued January 19, 1988, reconnends lowering the low nitrogen pressure alarm setpoint of {b' tion is-intended to scram accumulators to equal to or greater than 940 psig. This recommenda maintain the validity of the alarm sitpoint while reducing the risk of a TS violation which could occur due tt setpoint drift.
General Electric performed a safety assessment to suppirt the SIL and concluded that the slightly lower setpoint still provideo adequate notification to the MCR operators of loss of pressure in the accumulators.
PEco has determined l
that GE SIL 429, Rev. 1 is applicable to Limerick, although they have not experienced a TS violation due to setpoint drift of the pressure sensor for the low nitrogen pressure alarm. The 'icensee is proposing a TS change consistent with the intent of the GE SIL. However, the change they are proposing is more conservative than the change recommended by GE in that the proposed alarm setpoint is equal to or greater than 955 psig.
l
,__.i__i__._________._________
9 All BWRs have pressure and level alarms for each accumulator but most BWRs do not list the pressure setpoint limit in the TSs. Of the 14 BWRs other than Limerick that do list the limit in the TSs, 10 have the 940 psig limit recommended by GE. The 955 psig alarm setpoint proposed by PEco is more conservative than that recommended by GE since it will result in earlier detection of decreasing pressure. The proposed change to the pressure sNsor channel calibration is acceptable.
The third change to the TSs requested by the licensee was to modify LCO 3.1.3.5.a.2.a to allow the reactor operator twenty (20) minutes to restart a tripped CR0 pump provided that reactor pressure is greater than or equal to 900 psig.
If reactor pressure is.less than 900 psig the operator will immediately place the reactor mode switch in the Shutdown position. As discussed previously, there are two CRD pumps, one of which is operating and the other of which is on standby. The CRD pumps are located on the 201' elevation of the turbine building to have a positive suction head from the condensate storage tanks located at ground level.
The switchover from one pump to another is not automatic. An operator has to reposition various valves and manually start the standby unit. Because of the high reliability of the CRD pumps in BWRs, an automatic transfer arrangement has not been considered to be warranted. Limerick is one of i
the minority of BWRs that has an operability requirement for the CRD pumps in the TSs. Twenty-three BWRs have no requirement to have an operable CRD pump, even if a number of accumulators have been determined to be inoperable.
The TS change proposed by the licensee is the same as that approved for Fermi 2, Hope Creek and Perry. As discussed previously, at reactor pressures above 600 psig, system pressure alone is sufficient to scram the control rods. Having an operable CR0 pump to maintain pressure in the charging water header is not a significant safety concern while the plant is operating. The operators in the control room are immediately alerted if the operating CRD pump trips and/or if there is low pressure in the charging water system. With reactor pressure greater than 900 psig, the allowance of 20 minutes to restart a CRD pump is not unreasonable and is the time approved for three other BWRs.. The proposal to trip the reactor if pressure is less than 900 psig and if no CR0 pump is in operation and there is more than one inoperable accumulator is a conservative reaction. The staff finds the proposed changes to the TSs acceptable.
4.0 ENVIRONMENTAL CONSIDERATION
These amendments involve a change to a requirement with respect to the installation or use of a facility component located within the restricted area as defined in 10 CFR Part 20 and changes to the surveillance require-ments. The staff has determined that these amendments involve no significant increase in the amounts, and no significant change in the types, of any effluents that may be released offsite and that there is no significant increase in individual or cumulative occupational radiation exposure.
The Commission has previously issued a proposed finding that these amendments involve no significant hazards consideration and there has been no public
.
- o
+
i gI.
1 comment on such finding. Accordingly, these amendments meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9).
Pursuant to 10 CFR 51.22(b), no environmental impact statement nor-environ.
mental assessment need be prepared in connection with the issuance of these amendments.
5.0 CONCLUSION
The Commission made a proposed determination that these amendments involve no significant-hazards consideration which was published in the Federal Register (54 FR 51258) on Decenter 13, 1989 and consulted with the Commonwealth of Pennsylvania.
No public comments were received and the Commonwealth of Pennsylvania did not have any comments.
The staff has concluded, based on the considerations discussed above, that:
(1; there is reasonable assurance that the health and safety of the p(ublic will not be endangered by operation in the proposed manner, and2) such a regulations and the issuance of these amendments will.not be inimical to the common defense and the security nor to the health and safety of the public.
Dated: May 22, 1990-Principal Contributors:
Richard Clark, PM, NRR Herb Williams, Reactor Engineer, R1 Larry Scholl, Resident Inspector Ron Emrit, Generic Issues, RES
Enclosures:
Figure 4.6-8 Figure 2-14 Figure 1 Memo to R. Bernero from H. Denton dated February 19, 1985
I ii
-c. _
l SCRAM A VE P L A
-O
~
ISOLATION V ALVE EXHAUST WATER RtSER h
ISOLATION VALVE WlIHORAWAL RISER ISOLATION VALVE
- 4. _
ISOLATION VALVE ORIVE WATER RISER SCR AM plLOT VALVE ASSEMety ISOLATION V A LVE -
COOLING WATER RISER f
/
/
ISOLATION VALVE SCRAM DISCHARGE RISER 3}
1 5
OIRECTION AL CONTROL VALVE
>^
(WITHORAW)
OIRECTION AL CONTROL V ALVE S X (INSERT)
\\
MA...
[ OIRECTION AL CONTROL VALVE (INSE RTI MANIFOLD M
OheL valve y WIRING OVOHAm W p
OIRECTION AL CONTROL VALVE IWITHORAW ANO SETTLE)
SHUTOFF VALVE WATER ACCUMULATOR ORAIN "2
YL ND SCR AM WATER ACCUMULATOR #"
t v
\\*"#r ACCUMULATOR N2 #AEIIUAE FRAME INOICATOR CARTRIOGE VALVE ACCUMULATOR N9 CHARGING ACCUMULATOR INSTRUMENTATION ASSEMSLY LIMERICK GENERATING STATIW UN1TS 1 AND S
,#r1!5/
FINAL SAFETY ANALYSIS REPOhT CONTROL ROD DRIVE HYDRAULIC CONTROL UNIT FIGURE 4.H
usoo 102so i
L b
j Q
c..... _ =
g CONDENSATE STORAGE TANK o
e-
}
1600 psig REACTOR y
v o
1 d
i PUMP ui i
n i
k PISTON
,I l [ [
FILTER 8
N
%i:
i m
= !'!
i fi d
nim i l 4
ji DRIVES
! ij h
d i
= id;M l
i i
1500 psig CHARGING WATER HEADER l
>l
(
50 psi)
VALVES LATOR
, DRIVE (Pr + 20 psi)
SCRAM l
0" RIVE $
f50 ps g l
ULATOR p
3CR VAL E i
h, COOLING PRESSURE SCRAM DISCHARGE HEADER REGULATOR (0 psig)
I
/
COOLING WATER HEADER.#l OP ERATING STABILIZING y' VALVES l
VALVE DRIVE WATER HEADER EXHAUST HEADER
[
Q TO REACTOR
- Pr = REACTOR PRESSURE TO OTHER DRIVES Figure 214. Basic Control Rod Drive System 2 25
1 ST-2-047-400=1 REV. 5 F1 pure 1 Page 1 of 1 EWC/JPMigaw CRD SCRAM _ACCUNULAtog INSTRUMENT 31,0CK FIGUR2 1 h
PRES 5URE MYEL SWITCH INDICATOR l
E t PRESSURE
\\
I SWITCH m
e
~
INSTRUMENTATION
\\w stoex cARTuoca conuscroR P6 VALVE l
{
~
\\-
U
'l
g g ggg7g93g
--o
!,'4., v,jf %-
NUCLE AR REGULATORY COMMISSION
.c I
'{Q+M=r]
wA HINGTON, L. C 20558 t
III 19 M5 fiEMORANDlM FOR:
Robert M. Bernero, Director Division of Systems Integration FROM:
Harold R. Denton, Dinctor Office of Nuclear Reactor Regulation
SUBJECT:
SCHEDULE FOR RESOLVING AND COMPLETING GENERIC ISSUE NO. 58 - CRD ACCUMULATOR VALVE LEAKAGE i
This memorandum apprcves of a' priority ranking of " DROP" for Generic issue 98, "CRD Accumulator Valve Leakage." The evaluation of the subject issue is provided in the enclosure.
In accordance with NRR Office Letter No. 40, " Management of Proposed Generic Issues," there is no resolution to this issue to be monitored by the Generic Issue Management Control System (GIMCS).
However, the attached prioritization evaluation will be incorporated into NUREG-0933, "Prioritization of Generic Safety Issues," and is being sent to other NRC offices, the ACRS, and PDR for comments on the technical accuracy and completeness of the prioritization evaluation. Any changes as a result of comments will be coordinated with you.
Should you-have any questions pertaining to the contents of this memorandum, please contact' Louis Riani (24563).
/
Harold R. Denton, Director Office of Nuclear Reactor Regulation
Enclosure:
Prioritizatio'n Evaluation ec:
See next page
~c' 1
l
'o 5
i 9
ENCLOSURE 1 i
l i
PRIORITIZATION EVALUATION
.i GENERIC ISSUE NO 98 "CRD ACCUMULATOR VALVE LEAKAGE" I
e f
l 1
I
?
+
l I
l I
1 I
l 1
-I-
m.
A TSSUE 98:
CR0 ACCUMULATOR VALVE LEAKAGE DESCRIPTION Historical Backaround.:
During the review of LaSalle the ASB identified a potential problem which could be generic to all BWRs.a. b The problem relates to ability of the control rod drive accumulato'rs to retiin pressure for a sufficient period of time after the failure of.a control rod drive (CRD) hydraulic pump.
The CRDs are safety-related, as are the accumulators and their associated check valves.
For rapid reactor shutdown, the stored hydraulic pressure in the accumulator, in conjuncti'on with the reactor system pressure, rapidly inserts all the control rods.
At-reactor pressures below 500 psig the accumulators provide all the motive force to insert the control rods.
Each control rod is provided with its own accumulator. With the reactor pressure above 500 p'sig the accumulators provide the initial acceleration force for the control rods with the majority of the work provided by the reactor pressure.
8 The technical specifications for BWRs have a CRD accumulator check _ valve s
~
Teakage survei s iance statement wnich is ambiguous ind does not have an
_ action statement for failure to pass the surveillance requirement.c Safety Sionificance The concern of this issue is the potential for the loss of control rod drive hydraulic system pump at a low reactor vessel pressure with leakage of multiple check valves followed by an accident situation that would require a reactor shutdown.
During such an event it'is possible that there would be a failure to scram the reactor and the Standby Liquid Control System (SLCS) j would be required to achieve cold shutdown.
l l
~
f" 2
Possible Solutions Two possible solutions have been identified as follows:
First,the CRD pumps, associated valves, 'and instruinentation could be made safety-related with the redundant pump automatically starting upon failure of the running pump.
The second possible solution would require that with the reactor pressure less than 500 psig and more than one control rod withdrawn that both CRD pumps be running.
For those plants requiring manual action to open a stop check valve for the redundant pump to perform its function, an operator must be stationed by the valve, monitor the header pressure, and to-operate the valve when the header pressure drops to a predetermined value.
PRIORITY DETERMINATION Assumptions I
For this issue it is assumed that operation below 500 psig will occur only during ascent to power and controlled descent from power operation.
Further it will be assumed that to achieve 500 psig operation during controlled l
descent from power operation the CRDs will be inserted by the time reactor pressure will'have been reduced to 500 psig.
During ascent to power, the time interval between going critical and reactor pressure reaching 500 psig l.
is estimated to be usually one hour.
It will also be assumed that a power ascent will occur, on an average, monthly for purposes of this calculation.
-The assumption of monthly power ascents will result in conservative calculations since the average number of plant trips is about eight per year, not all of which' result in. reactor pressure falling below 500 psig.
For this prioritization it will be assumed that check valve leakage will reduce the accumulator pressure below the pressure required to insert the control rod in ten minutes.
l e
i
s' 3
It is assumed that the accident requiring a scram is one that results in the loss of primary system pressure. With system pressure at or be. low 500 psig the negative reactivity feedback wi11, with decreasing temperatu,re as a
~
result of decreasing pressure, increase reactivity wi,thout control rod insertion. -Thus, only those accident situations in which system pressure is lost and primary coolant temperature decreases requires' the insertion of the control rods to limit the core reaction, which would be the LOCA events.
4 Major PRA studies have assumed that a minimum of three adjacent control rods in a BWR must remain withdrawn for the reactor to remain critical.
For this analysis the same assumption will be considered valid.
FREQUENCY / CONSEQUENCE ESTIMATE The undesired event (U), that of being unable to shutdown the reactor with the reactor, protection system in an accident situation due to tge loss' of control rod drive accumulator pressure can be defined as the product of the following probabilities.
They are:
A, the probability that an accident event requiring reactor trip occurs
- during any one year (1.4E-03).
This quantity is based upon the total LOCA initiating event frequency as given in WASH-1400.is B, the probability'that the reactor vessel pressure is less than 500 psig with the reactor critical (1.7E-03).
This probability is based upon the assumption that 12 ascents to power occur annually; that one hour elapses from attaining criticality until tha reactor vessel pressure is greater than 500 psig; and that the average operating time per year is 7000 hours0.081 days <br />1.944 hours <br />0.0116 weeks <br />0.00266 months <br />.
e e
G
. o i
i
.C, is the probability the operators fati to scram the reactor w th n 10 minutes following the failure of the CRD hydraulic pump, (0.1).
This valueisbasedupon'.theHumanReliabilityHandbook888 nom,inalmodelfor operator error.
D, is the frequency that"the on-line CRD hydraulic pump' fails during a one year interval, (0.73 The WASH-140018 failure rate for pumps was between 3E-06/hr and 3E-04/hr with a median of 3E-05/hr.
Since the CRD 3
hydraulic pump is not a safety related classified component, but is believed to have a quality level above standard off-the-shelf hardware a failure rate value of IE-04 per hour was assigned.
As previously stated, an annual operating time of 7,000 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> was assumed.
E, is the probability that the operators will fail to start the standby CRD hydraulic pump within 10 minutes after-the failure of the on-line pump (0.1).
This value is also. based on the Human Reliability I
Handbooksas nominal model for operator error.
Pump failure to start t
i is negligibly small in comparison.
F, the probability that three adjacent accumulator check valves leak, (0.1).
This probability value was chosen with tta belief that it conservatively covers common-failure causes as well as the multitude of 3 adjacent control rod combinations involving independent failures.
~
Even with an ambiguous action statement, it is unlikely that a large number of check valves will leek.
G, the probability that the operator failed to follow procedures by pulling a control rod adjacent to two other rods which are already.
pulled,(0.1).
9
5-i.
H, the probability that the reactor protection system failed to detect the pulling of the out-of-sequence rod and then failed to initiate a scram signal, (0.01).
Z, the probability that the loss of CRD hydraulic pressur'e occurs before the accident event (0,5).
llence U=A B
C D
E F
G H
Z
= (1.4E-03)(1.7E-03)(0.1)(0.7)(0.1)(0.1)(0.1)(0.01)(0,5) a
= 8.4E-13 per reactor year.
2 Suberiticality following a LOCA can not usually be maintained by the SLCS, but may be maintained for a time in some LOCAs.
The ECCS could control some LOCAs even if some of the control rods are not inserted.
As a conservative assumption no credit will be taken for the SLCS and it will be assumed that the accident initiating event and the failure of the reactor protection syst'em I
willresu15inacoremeltaccident.
As defined in the Grand Gulf RSSMAP study,54 accident sequences involving
~
LOCAs-and the reactor protection system were dominated by the category 2 s4 releases.- The whole body man-rem dose obtained by using the CRAC code assuming an average population density of 340 persons per square mile (which is the mean for U.S. domestic sites) fr.om an exclusion area of a one half mile radius about the reactor out to a 50 mile radius about the reactor.
A typical midwest meteorology is also assumed.
Based upon these assumptions-the public dose resulting from a BWR category 2 release is 7.1E+06 man-rem.
Based upon an average life of 25 years for each BWR the public risk per reactor is 1.5E-04 man-rem.
For the class of all BWRs, 44 reactors, the risk i
is 6.6E-03 man-rem.
i 4.
[-
6-4 Cost Estimate The least expensive resolution to this issue involves turning on the standby CRD hydraulic pump and as' signing a dedicated operator at the si.op check valve control to monitor pres' ure and to transfer to the standby system it s
the hydraulic pressure drops.
While it is not exactly known'the number of plants having this configuration, for, purposes of the calculation it will be assumed that 25% are so configured.
For each reactor requiring the dedicated operator, assuming 12 power ascents and descents per year at one hour per change, will utilize 24 operator-hours per year.
Based upon 1984 dollars and assuming a cost of $52 per operator-hour for 11 reactors the lifetime cost for all BWRs wi11 be 80.3M.
The cost of upgrading the CRD hydraulic system to a safety related quality level system will be much more expensive.
If 0.5 person years of technical experience were required for evaluation of the existing system and no
(
hardware changes were required the cost would be $50,000 per reactor or
$2.2M for the 44 reactors involved.
Value/ Impact Assessment
\\
Based upon a reduction in risk of 6.6E-03 man-rem and a cost of $0.3M the (S) score is-calculated to be (6.6E-03 man-rem)/($0.3M) 5 2.2E-02 man-rem per $M.
CONCLUSION In general, accident frequencies on the order of 1018/yr.,.even for a very specific sequence, must be used with caution.
Errors of incompleteness, and overlooked dependencies, as well as other modeling errors, will generally be very large compared to such frequency estimates.
In'this case, a conscientious effort has been made to identify other sequences and dependencies.
Even with a large error, this issue poses a very small risk.
~
Therefore the issue should be placed in the DROP category.
v.
t
.. ; ~j o t
References:
Memorandum from 0. Parr to W. Minners, "Prioritization of Proposed Generic Issue on CRD Accumulator Check Valve Leakage," dated August 1984.
D Memorandum from C. Thomas to 0. Parr, "CRD Accumulators-Proposed Improved Technical Specification," dated August 1984.
C NUREG-0123, " Standard Technical Specifications for General Electric Boiling Water Reactors (BWR-5) Rev. 3," U.S. Nuclear Regulatory Commission, Fall 1980.
16' WASH-1400 (NUREG-75/014), " Reactor Safety Study, An Assessment of Accident Risks in U.S. Commercial. Nuclear Power Plants," U.S. Nuclear Regulatory Commission, October 1975.
54 NUREG/0R-1659, " Reactor Safety Study Methodology Applications' Program,"
U.S. Nuclear Regulatory Commission,1981.
64 NUREG/CR-2800, "baidelines for Nuclear Power Plant Safety Issue Prioritization Infccmation Development," U.S. Nuclear Regulatory Commission, February 1983.
1 l
339 NUREG/CR-1278, " Handbook for Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications," U.S. Nuclear Regulatory Commission, February 1983.
L
\\
t l
4 i
i l
e e
_,_.