ML20078N462

Forwards Request for Enforcement Discretion from TS 3/4.3.1, Table 3.3-1 & TS 3/4.3.2,Table 3.3-3,allowing Continued Operation of Plant for Up to 10 Days in Mode 1 for Inoperability of Either Ssps Train

ML20078N462
Person / Time
Site:	Farley
Issue date:	02/10/1995
From:	Dennis Morey SOUTHERN NUCLEAR OPERATING CO.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
NUDOCS 9502150347
Download: ML20078N462 (12)

Text

South;rn Nuclear Operating Company Por,t Offica Box 1295 Birminghtn. Alibim2 35201 Tmphon: (205) 868-5131 L

Southern Nudear Operating Company o.v. uor.y Vice President Farfey Protect the Southem elec!HC System February 10,1995 Docket Nos.: 50-348 50-364 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk l

Washington, D. C. 20555 Joseph M. Farley Nuclear Plant l

Re_ quest for Enforcement Discretion Gentlemen:

1 On February 6,1995, enforcement discretion for Joseph M. Farley Nuclear Plant, Units 1 and 2, was granted relative to Technical Specifications 3/4.3.1, Table 3.3-1, " Reactor Trip System Instrumentation," and 3/4.3.2, Table 3.3-3," Engineered Safety Features Actuation System Instrumentation," for a period of 10 days to cover the period of time to effect a design change to electrically separate the electrical power feeds for Train A Solid State Protection System (SSPS) field inputs and the logic cabinet power supplies. The i

enforcement discretion was granted because occurrence of a steam line break coincident i

with a single active failure of the other SSPS train would result in both trains of SSPS not l

being available to mitigate the consequences of the steam line break.

l On February 9,1995, it was determined that Train B of the SSPS was also susceptible to a steam line break; however, only one train of SSPS would be rendered inoperable by any given steam line break. At 7:30 p.m. CST, the Regional Administrator, S. D. Ebneter, verbally granted enforcement discretion for Joseph M. Farley Nuclear Plant, Units 1 and 2.

This discretion was granted relative to Technical Specifications 3/4.3.1, Table 3.3-1,

" Reactor Trip System Instrumentation," and 3/4.3.2, Table 3.3-3, " Engineered Safety Features Actuation System Instrumentation," for a period of 10 days from February 6, 1995 to cover the period of time to effect a design change to electrically separate the electrical power feeds for the Solid State Protection System field inputs and the logic i

cabinet power supplies.

0()\\

9502150347 950210 PDR ADOCK 05000348 i

\\\\

P PDR

l r

o If there are any rc* stions, please advise.

I Respectfully submitted, SOUTHERN NUCLEAR OPERATING COMPANY

&"1 % f Dave Morey

{

MGE ji l

Attachment cc:

Mr. S. D. Ebneter Mr. B. L. Siegel Mr. T. M. Ross i

Dr. D. E. Williamson t

i k

I

Attachment Joseph M. Farley Nuclear Plant Request for Enforcement Discretion February 10,1995 1

?

JOSEPII M. FARLEY NUCLEAR PLANT REQUEST FOR ENFORCEMENT DISCRETION BACKGROUND On Februa;y 2,1995 Diablo Canyon reported a new scenario that could result in the

)

failure of one Solid State Protection System (SSPS) train. The scenario involves a hypothesized high energy steamline break near the turbine generator, which results in destruction of an electrical panel containing SSPS turbine stop valve position input signals associated with two protection system channels. If these input signals "short to ground,"

the redundant oower supplies associated with one SSPS train will de-energize rendering the Engineered Safety Feature (ESF) actuation logic ineffective. If a single random failure of the other train h assumed, no automatic ESF protection functions will be available.

After receipt ofinformation pertaining to the Diablo Canyon scenario, Southern Nuclear Operating Company (SNC) began an investigation to determine whether Farley Nuclear Plant (FNP) was susceptible to a loss of SSPS due to a steam break. In addition, on behalf of the Westinghouse Owners Group (WOG), Westinghouse initiated efforts to determine the potential generic applicability of the hypothesized scenario to other Westinghouse plants. On February 3,1995, Farley implemented a multi-part plan to:

explicitly evaluate the potential consequences of steam breaks within the turbine building near the vicinity ofjunction boxes containing input signals to SSPS; develop contingency plans and designs; assimilate additional industry experience; review design basis requirements; assess risk significance; and inform plant operators to ensure heightened awareness. Subsequently, the NRC issued Information Notice 95-10, " Potential For Loss Of Automatic Engineered Safety Features Actuation," and Westinghouse issued a generic justification for continued operation to all Westinghouse plants (NTD NSRLA OPL 95-053).

On Febmary 6,1995, Farley Nuclear Plant determined that Train A SSPS in both Units 1 and 2 is susceptible to a postulated high energy steamline break inside the high pressure turbine enclosure due to the location of one electricaljunction box within the enclosure.

Thisjunction box contains the SSPS input signals from the 3 turbine auto stop oil pressure protection channels. Should these 3 channels "short to ground," the Train A automatic i

ESF actuation logic would be rendered inoperable. Train A SSPS was declared inoperable in Units I and 2 at 6:30 p.m. CST, and the applicable action requirements for Technical Specifications 3/4.3.1 and 3/4.3.2 were entered.

On February 6,1995 at 7:55 p.m. CST, the Region II NRC Staff granted verbal enforcement discretion for FNP Units 1 and 2, conditional upon receipt of an acceptable written request within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and its subsequent approval. To allow adequate time for design preparation and modification installation, the enforcement discretion is effective for 10 days or until completion of the post-modification testing, whichever is sooner.

l

Reque'st for Enforcement Discretion Page 2 On February 9,1995, Farley Nuclear Plant determined that a main steam line break

. (MSLB) outside containment could result in failure of either train of the SSPS; however, only one train of SSPS would be rendered inoperable by a given MSLB orientation.

On February 9,1995 at 7:30 p.m. CST, the Region II NRC Staff granted verbal 1

enforcement discretion for FNP Units 1 and 2 for the inoperability of either SSPS train

]

due to a postulated MSLB in the Turbine Building. To allow adequate time for design preparation and modification installation, the enforcement discretion is effective for 10 days from the February 6,1995 granting of enforcement discretion or until completion of the post-modification testing, whichever is sooner.

BASIS FOR THE ENFORCEM'ENT DISCRETION REQUEST

1. The Technical Specifications for which enforcement discretion is requested.

Technical Specification 3/4.3.1 specifies that the Reactor Trip System (RTS) must be operable. The SSPS provides redundant logic trains for the RTS. The operability requirements for the RTS automatic trip logic (Functional Unit 22) are shown in the FNP Technical Specifications on Table 3.3-1, " Reactor Trip System Instrumentation." With one train inoperable, Action 15 requires the inoperable train to be restored within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> or the Unit must be placed in Hot Standby within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

Technical Specification 3/4.3.2 specifies that the ESF Actuation System (ESFAS) must be operable. The SSPS provides redundant logic trains for the ESFAS. The operability requirements for ESFAS manual initiation and automatic actuation logic (Functional Units 1.a,1.b, 2.a, 2.b, 3.a.1, 3.a.2, 3.b.1, 3.b.2, 3.c.1, 3.c.2, 4.a, 4.b, and 6.a) are shown in the FNP Technical Specifications on Table 3.3-3," Engineered Safety Feature Actuation System Instrumentation." Actions 13,17,18,21, and 22 are applicable with one train inoperable. Action 21 is most limiting, and it requires the inoperable train to be restored within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> or the Unit must be placed in Hot Standby within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in at least Hot Shutdown within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

This request for enforcement discretion will allow for the continued operation of FNP Units 1 and 2 for up to ten (10) days in Mode I with either train of RTS automatic trip logic and ESFAS manual initiation and automatic actuation logic inoperable due to the potential consequences of a postulated high energy steamline break inside the turbine building.

2. Circumstances surrounding the situation requiring prompt action.

The RTS turbine trip signalis provided by actuation of 4 out of 4 turbine throttle (stop) valve close limit switches or 2 out of 3 auto stop (control) oil low pressure switches. The turbine trip / reactor trip is anticipatory in that it is not assumed to occur in any of the Farley FSAR Chapter 15 accident analysis. However, in conformance with FSAR Section 7.2, this trip (being a reactor trip) is designed to meet the requirements ofIEEE 279-1971.

Reque'st for Enforcement Discretion Page 3 The scope ofIEEE 279-1971 addresses such requirements as single failure, independence,

,and interaction of circuits. As stated in Branch Technical Position ICSB 26, this standard applies to the entire trip function from the sensors to the final actuated devices.

Therefore, the RTS turbine trip sensors and circuit design should allow for the effects of credible faults (i.e. grounding, shorting, or application of high voltage), and failures should not propagate back to the RTS or degrade RTS performance. However, the sensor mountings need not be seismic because of their location in the turbine building. A general acceptance of this design is provided in Farley SER Section 7.2 (NUREG-75/034 dated May 2,1975).

Relative to HELBs in the turbine building, Farley FSAR Section 3K.4.1.1.3 states that the main steam system in the turbine building is not located near any safety-related equipment.

Therefore, it was not necessary to considerjet impingement and pipe whip effects of a main steam line break in the turbine building. As a result, the SER Section 6.4 discussion on the impact ofjet impingement and pipe whip effects does not address the turbine building. The FNP design for high energy line breaks is addressed in FSAR Section 3K, which stipulates a verification be made that the " rupture of a pipe carrying high energy fluid will not directly or indirectly result in loss of redundancy in any portion of the protection system (as defined in IEEE-279), Class lE electric system (as defined in IEEE-308), engineered safety feature equipment... required to mitigate the consequences of that accident and place the reactor (s)in a cold shutdown condition.. " IEEE 279 Section 4.7.4 also requires that protective equipment be designed against credible single events and an additional single failure.

Following receipt ofinformation pertaining to a new steamline break scenario in the Diablo Canyon turbine building which could potentially render one SSPS train inoperable, Farley initiated efforts (including background licensing research, field walkdowns, and engineering modeling) to determine the applicability to FNP Units 1 and 2. Subsequently, based on the Farley-specific as-built configuration and high energy line break analysis, t' e FNP designers determined the SSPS input circuits associated with the RTS turbine trip sensors are susceptible to a postulated high energy steamline break inside the turbine building.

Should RTS turbine trip channels (I & II or III & IV)"short to ground," the 120 vac vital electrical power associated with the RTS/ESFAS channelized field input signals in SSPS Train A or Train B would be interrupted due to blown input power fuses in the respective input relay bays. Loss of Channels I & II or III & IV 120 vac input power de-energizes l

both sets of the affected train logic cabinet redundant low voltage power supplies (15 vde l

and 48 vde), which renders the Train A or B RTS automatic trip logic and the ESFAS manual and automatic actuation logic inoperable. However, the associated reactor trip breaker would open, and the manual trip capability would be retained.

The root cause of this condition is attributed in part to the original SSPS design l

configuration, wherein each set ofiogic circuit power supplies (15 vdc and 48 vdc) and l

the RTS/ESFAS field input circuits (e g., RCP UV, RWST Lo-Lo Level, Turbine Stop

l Reque'st for Nnforcem:nt Discretion Page 4 Valve Position, etc.) are provided channelized 120 vac input power through a common se:

,of fuses. (If the common electrical power source for the logic power supplies and field input circuits had been fused separately, the logic circuit power supplies would not be affected by faults on the field input circuits.)

To resolve the SSPS design discrepancy, FNP Unit I and Unit 2 design changes must be i

incorporated. The proposed modifications inciude re-routing power supply wiring and the coordination of breaker and fuse sizing. Since the Farley designers and staff require suflicient time to ensure that the proposed modifications are correctly designed and implemented, SNC respectfully requests a 10 day enforcement discretion,

3. Safety basis for the request for enforcement discretion.

Background

The RTS/ESFAS sensors are divided into 4 protection channels (I, II, III & IV). The SSPS receives input signals from the protection channels through 4 separate input bays.

Input signals are provided by the Nuclear Instrumentation System (NIS), the 7300 Process Protection System, and field inputs. The NIS and 7300 System input signals to SSPS are powered by circuits from within these systems. The field input signals in each SSPS input bay are powered from one of the four 120 vac vitalinstrument busses. The SSPS logic power is provided by redundant low voltage power supplies. In Train A, the logic cabinet power is provided by Channels I & II, and the ESF output relay power is provided by a separate Channel I feeder breaker. In Train B the logic cabinet power is provided by Channels Ill & IV, and the ESF output relay power is provided by a separate Channel IV feeder breaker.

The input signals are processed through the SSPS voting logic circuitry to determine when reactor trip and/or ESF equipment actuations will be generated to mitigate the consequences of an accident.

Effect ofliypothesized Condition on Safety Function The failure of the fuses for the SSPS logic redundant power supplies in one train would render the train inoperable. If a single active failure renders the other SSPS train inoperable, no automatic ESF equipment actuation would occur to mitigate the consequences of the main steam line break.

Westinghouse Generic Evaluation Westinghouse has performed evaluations and analyses for two different four loop plants to determine the results of a main steamline break (MSLB) outside containment if the SSPS is inoperable. The evaluations determined that a MSLB initiated at-power would be bounded by the zero power analysis. The zero power analyses assumed the following: 1)

A double-ended rupture of a main steam header resulting in an effective break size of 5.6

Reque'st for Enforcement Discrction Page 5 square feet (1.4 square feet per steam generator), which corresponds to the total effective

, flow area of the flow restrictor in each steam generator; 2) Initial plant condition: of hot zero power to maximize the volume of water in the steam generators and minimize initial stored energy in the RCS; 3) End-of-life reactivity coeflicients; 4) No decay heat; 5) All rods fully inserted with the exception of the most reactive rod fully withdrawn; 6) No operator action; 7) No automatic equipment actuation with the exception of the passive actuation of the safety injection accumulators; 8) 100% nominal main feedwater flow; and

9) Maximum auxiliary feedwater flow. The analyses results demonstrated that, even though the four steam generator blowdown transient results in a more severe RCS cooldown and depressurization actuation of the passive cold leg accumulators and a more symmetric reactivity transient rasults in less-limiting peaking factors and DNBR value.

Westinghouse has evaluated these results and determined that since no automatic mitigation functions were assumed, the results of these analyses indicate that the same conclusion (that is, the current FSAR licensing basis steamline break core response analysis would remain bounding) would be reached for other four loop plants. For three and two loop plants, the event would be even less limiting since these types of plants have higher shutdown margins than four loop plants. Thus, the conclusions of these analyses would also apply to a three loop plant such as Farley.

Although the cooldown evaluated was greater than that in the design basis MSLB, Westinghouse performed an evaluation on the effect of the condition on pressurized thermal shock (PTS) and concluded the increased cooldown had no appreciable effect on PTS risk. Westinghouse has also considered the effect of this scenario on long-term core cooling and determined that the core will remain in a coolable geometry, pressures will be maintained below 100% of design pressures, and fuel cladding integrity will be maintained assuming the operators take corrective action within the first 10 minutes of the event by starting at least one motor driven auxiliary feedwater pump.

Probability of Main Steam Line Failure Coincident with SSPS Train Failure An FNP evaluation was performed to determine the impact on the core damage frequency

)

resulting from a specific potential failure mode of the Solid State Protection System initiated by a secondary side break in the turbine building. The evaluation was performed using the Farley IPE Post Processing model. The increase in core damage frequency resulting from a postulated failure of the SSPS hardware with a secondary side break downstream of the MSIVs was determined to be on the order of 1.77E-07 per reactor-year. The probability of core damage with this condition over the next 10 days is 4.8E-09.

Based upon the drafl EPRI "PSA Applications Guide" transmitted by NEI on June 10, 1994, temporary increases in core damage probability ofless than 1.0E-06 over eighteen months are considered to be non-risk significant. Based upon this, continued operation with the existing condition for a full 18 month fuel cycle would be considered non-risk significant. In addition, this condition does not increase the probability oflarge early releases from containment.

Request for Enforcement Discrction Page 6 The time for modification of the SSPS has not been rnodeled. However, since this time is expected to be relatively short, i.e., less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, it is not expected to impact the overall conclusion that the existing condition is non-risk significant.

Opsator Action The Farley operations staff personnel training includes contingency actions including event diagnosis and manual alignment of ESF equipment. In addition, Farley emergency response procedures include contingency response guidelines should RTS/ESFAS automatic protective functions not be fulfilled in response to a plant transient requiring event mitigation. For a postulated steam break in the turbine building with a concurrent failure of either train of ESFAS logic, a reactor trip would occur when the SSPS logic cabinet power supplies de-energize. In addition, the Reactor Trip System and ESF Actuation System analog indications (e.g., pressurizer pressure, steam generator level, steam flow, etc.) and ESF equipment (e.g., main steam line isolation valves, high head safety injection pumps, etc.) will remain operable. Therefore, the contr01 room operators can diagnose the event and perform emergency actions stipulated in emergency response procedures by starting ESF pumps and stroking valves; i.e., the operator would initiate main steamline isolation and start the auxiliary feedwater pumps.

Corrective Action To assure that a high energy line break in the Farley turbine building will not cause short circuits which could result in the failure of one SSPS train, a design change will be implemented to electrically separate the electrical power feeds for the SSPS field inputs and the logic cabinet power supplies. Following approval of the design change, I&C crews responsible for the implementation of the design change will be briefed. When plant conditions permit, these crews will begin to implement the design change in one SSPS train at a time in only one unit.

l

4. Proposed compensatory measures.

The following actions will be taken to provide additional assurance that the public health and safety will not be adversely affected by this enforcement discretion request.

l

1) The design change will be performed on only one train of the SSPS at m ; given time. This action will provide assurance that at least one train of SSPS would perform its required function to mitigate the consequences of Condition II, III and IV transients. In addition, the modifications will be implemented in only one unit at a time.

2) Maintenance and surveillance activities which impact the RTS or ESFAS will be restricted during implementation of the design change.

Request for Enforcement Discretion Page 7 3.) High risk plant evolutions which could result in reactor or turbine trip will be avoided.

4) An operations night order describing this condition and the proper implementation of the emergency procedure for responding to a MSLB that affects the SSPS has been routed to the on-shift operations staff.

5) Activities on the 187 foot elevation of the turbine deck which could result in damage to the steam lines (such as movement ofloads over the high pressure turbine) will be restricted until implementation of the design change is complete.

6) The proposed design change and implementation procedures will consider experience gained and lessons leamed during the implementation of similar modifications at Diablo Canyon and Salem. In addition, the Farley designers will consider the proposed North Anna design changes.

5. Justification for duration of the request for enforcement discretion.

As discussed above, approximately 10 days are required to complete the preparation and approval of a design change; to finalize plans and procedures for implementation of the modification; to accomplish the SSPS modification; and perform post modification inspections and testing which may be required.

6. No significant safety hazards considerations.

In accordance with 10 CFR 50.92(c), the SNC evaluation of the proposed enforcement discretion for no significant hazards considerations is as follows:

1) Does the enforcement discretion involve a significant increase in the probability or consequences of an accident previously evaluated?

The probability of a MSLB accident is not affected by the proposed enforcement discretion. The only equipment failure potentially affected is failure of one SSPS train. Using the EPRI draft "PSA Application Guide," a PRA was performed that indicated the increase in probability resulting from the proposed enforcement discretion was insignificant. The effects of a malfunction of the SSPS due to a MSLB in the turbine building coincident with a single active failure of one train of the SSPS was evaluated generically by Westinghouse. The evaluation was supported by analyzing two four loop Westinghouse plants. These analyses are considered bounding for three loop plants due to three loop plants having greater shutdown margin than the four loop plants. It was concluded the DNBR limits would be satisfied even if the MSLB occurred with no automatic ESF actuation.

With DNBR limits maintained no clad damage occurs; thus, there will be no significant increase in the consequences of the MSLB. Therefore, the request does

r W

^

Request for Enforcement Discretion Page 8 7

. not involve a significant increase in the probability or consequences of an accident or' malfunction previously evaluated.

2) Does the enforcement discretion create the possibility of a new or different kind of accident from any accident previously evaluated?

A MSLB has been evaluated in the FSAR. The evaluation assumes that at least one train of the SSPS is available to mitigate the consequences of the MSLB.

However, the MSLB in the turbine building could render both trains of the SSPS inoperable when a single active failure is considered. NUREG-0800 allows operator action to be credited in mitigating the consequences of an accident. A review of the operator response to the MSLB without SSPS was performed. This review indicates that the operators would be capable of mitigating the consequences of the MSLB in adequate time to prevent core damage.

Westinghouse also performed a bounding evaluation of a MSLB without any SSPS available or operator action. The Westinghouse evaluation concluded that DNBR limits would be satisfied. Therefore, enforcement discretion does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3) Does the enforcement discretion involve a significant reduction in the margin of safety?

t A PRA was performed that determined that the probability of a MSLB that i

disables one train of SSPS coincident with a single active failure of the other SSPS train during the period of the enforcement discretion was insignificant. A preliminary review of the operator response to the MSLB without SSPS demonstrates that the operators would be capable of mitigating the consequences of the MSLB in adequate time to prevent core damage. Westinghouse also performed a bounding evaluation of a MSLB without any SSPS available or operator action. The Westinghouse evaluation concluded that DNBR limits would.

be satisfied. Therefore, the enforcement discretion does not involve a significant i

reduction in the margin of safety.

j In conclusion, based on the above safety evaluation, SNC believes that the activities associated with this enforcement discretion request will not be a detriment to the public j

health and safety and will satisfy the requirements of 10 CFR 50.92(c). Accordingly, a no significant hazards consideration finding is justified.

i

7. Consequences to the environment.

SNC has evaluated the proposed request for enforcement discretion and determined the request does not involve a significant hazards consideration, any significant change in the types of efiluents that may be released offsite, or a significant increase in the individual or t

a Request for Nnforc: ment Discretion Page 9 i

cumulative occupational radiation exposure. Therefore, this request for enforcement

. discretion does not involve any significant environmental consequences.

8. Review by the Plant Operations Review Committee.

i 13efore requesting this enforcement discretion, the request was reviewed and approval was recommended by the organization tasked to advise the General Manager - Nuclear Plant on all matters related to nuclear safety at Farley Nuclear Plant (i.e., the Plant Operations Review Committee).

l r

- +.... -

,