ML20092A049
| ML20092A049 | |
| Person / Time | |
|---|---|
| Site: | Millstone  |
| Issue date: | 01/30/1992 |
| From: | Opeka J NORTHEAST NUCLEAR ENERGY CO., NORTHEAST UTILITIES |
| To: | NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM) |
| Shared Package | |
| ML20092A051 | List: |
| References | |
| B14005, GL-88-17, NUDOCS 9202060496 | |
| Download: ML20092A049 (9) | |
Text
__
y NORTHEAST UTILITIES cenmi Omce. semen street. aeron. connea.cui 1
]
[ 2.N U C P O BOX 270
.eu.m. w w "
H ARTF ORD. CONNECTICUT 06141-0270 k
A J CC.$CC.C (203) 665-5000 January 30, 1992 Docket No. 50-3M jiliq01 Re:
10CFR50.90 U.S. Nuclear Regulatory Commission Attention: Document Control Desk Washington, DC 20555 Gentlemen:
Millstone Nuclear Power Station, Unit No. 2 Shutdown Coolina System Autoj;losure Interlock Deletion Introduction Northeast Nuclear Energy Company (NNECO) hereby proposes to remove the auto-closure interlock (ACI) from the shutdown cooling system (SDCS) suction valves at Millstone Unit No. 2.
The current design provides an ACI and an open permissive interlock (OPI) on each of the isolation valves to reduce the probability of inadvertent connection of the reactor coolant system (RCS) to the SDCS when the RCS pressure is above 280 psia.
Motor-Operated Valves (MOVs) 2-SI-651 and 2 51-652, which are in series and controlled by these interior.ks, create a oouble barrier to isolate the SDCS suction line from the RCS.
The OPI prevents the SDCS suction isolation valves from being opened when the RCS is already pressurized.
The ACI closes the SDCS suction isola-
' tion valves when the RCS pressure increases above 280 psia.
The proposed modification will remove the ACI feature of the SDCS Suction Valves 2-SI-651 and 2-SI-652.
Instead, an almrm will be added on these valves to warn the operators whenever a SDCS suction isolation valve is open and the RCS pressure is greater than 280 psia.
Removal of the SDCS ACI feature addresses Commission concerns regarding the potential for - failure of the ACI circuity which could cause inadvertent isolation of the SOCS with subsequent loss of shutdown cooling capability during cold shutdown and refueling operation.
In addition, the proposed modification is consistent with the recommendations of Generic letter 88-17,
" Loss of Decay Heat Removal."
The proposed removal of ACI features will result in a change in the Millstone Unit No. 2 Technical Specifications. Therefore, pursuant to 10CFR50.90, NNEC0 hereby proposes to amend its operating license, DPR-65, by incorporating the changes identified in Attachment 1 into the Technical Specifications of Millstone Unit No. 2.
j V
h' 9202060496 920130 j
I PDR ADOCK 05000336 P
ppg
v
- U.S. Nuclear Regulatory Commission B14005/Page-2 January 30, 1992 Backaround The SDCS is designed to achieve and maintain a cold shutdown condition by removing residual energy from the RCS and decay heat from the reactor core.
While the RCS has a duign pressure of 2500 psia, the SDCS components have a design pressure of 500 psig, with the exception of SDCS Suction Line GCB-1 which has a design rating of 300 psig.
Since two piping systems of different design pressures are connected, suitable isolatin capability must be provided when the RCS is being operated at high pressure. To ensure that isolation of the SDCS will remain in effect after any credible failure has occurred, two isolation devices in series are provided (2-SI-651 and 2-SI-652).
When the SDCS is in use, the system becomes an extension of the reactor coolant pressure boundary.
Since a number of pressurization sources exist within or are connected to the high-pressure RCS, the low-pressure SDCS must b' protected against postulated pressurization transients when the systems are connected.
To accomplish this, Relief Valve 2-5I-468 is provided on the SDCS suction line.
The overpressure protection of the SDCS which is provided by the SDCS relief valve is based on those transients postulated to occur during nomal SDCS operation.
This relief salve is not intended to protect the SDCS agcinst overpressurization as a result of being inadvertently exposed to full RCS pressure during power operation. A relief device with the capacity to protect agtinst this event'would not be practical.
Should the SDCS be exposed to RCS pressure during power operation, the SDCS could rupture at a point outside the containment causing an interfacing system loss-of-coolant accident (ISLOCA) outside containment.
To guard against this,- appropriate alarms and two instrumentation interlocks are used t reduce the probability of the inadvertent connection of the RCS to the SDCS when the RCS is pressurized.
These interlocks are generally
' described in Reactor Systems Branch Technical Position (BTP) 5.1.
The first interlock is designed to prevent opening the SDCS isolation valves when RCS pressure is above the SDCS design pressure.
This feature is the OPI.
It-protects against the spectrum of events which result from the SDCS suction isolation valves being opened when the RCS is already pressurized.
The proposed design modification does not involve any change to this interlock.
The second interlock automatically provides a close signal to the isolation valves when RCS pressure exceeds 280 psia.
Therefore, should these valves be inadvertently ?ef t open during RCS heatup a.id pressurization, the SDCS isola-tion valves would automatically close epon reaching a predetermined pressure set point.
This feature is the ACI.
Removal of ACI is being proposed as a way to decrease the probability of loss of shutdowr, cooling events.
As previously described, it is necessary to have two valves in series to form a reactor coolant pressure boundary so that no single failure can result in complete loss of this barrier.
The double barrier is established by the
S
~
U.S. Nuclear Regulatory Commission B14005/Page 3 January 30, 1992 operator closing both valves when-going from SDCS operation to steam generator cooling during plant heatup.
Failure to establish this double barrier is possible due to a failure of the valvo, valve operator, valve controls, or by operator error.
A potential operator error is the cicsure of only one valve followed by RCS pressurization.
It is this operator error that ACIs (and alarms) are intended to guard against.
The design of ACI presents an optimization issue between two competing safety functions.
When the SDCS is needed, the uction valves must remain open.
Failures resulting in valve closure are a safety concern due to the loss of decay heat removal.
Conversely, when ACI action is required, failures which leave the valves open adversely impact safety by overpressurizing the SDCS.
t The industry has txperienced a number of spurious valve closure events caused at least in part by the presence of the ACI. A frequent cau.;e of spurious ACI action is the accidental or intentional de-energization of a power supply during refueling.
This event frequently results from maintenance work per-formed during refueling outages.
The ACI circuit can be actuated after losing any of several power supplies.
A second spurious valve closure is an ACI actuation following receipt of-an invalid high RCS pressure signal due to testing. Again, ti.is type of testing is usually performed only during refuel-ing outages.
While redesign of the pressure loops and ACI t,rcuit could eliminate the loss of power supply problems, it would not protect against invalid pressure signals.
Resolution of issues related to less of shutdown cooling events has been a topic of increasing concern to both the NRC and the industry for several years.
Studies have identified spurious operation of ACI as causeofreportedlossofSDCSeventsbetween1976and1983.gemostfrequent Spurious operation of ACI results.in the closure of the SDCS pump suction valves.
This has two potential impscts.
The most immediate result of valve closure is loss of SDCS flow and corresponding loss of decay heat removal from the core.
The resultant RCS temperature rise can result in pressurization of l
a closed system or loss of fluid through boiling if the reactor vessel head is l
removed for refueling.
The second. result of valve closure may be significant L
damage to the SDCS pumps due to loss of suction..This event is serious due to the potential for complicating the short-term recovery of core cooling and the longer repair time.
Since ACI is a significant contributor to loss of SDCS events at other plants, l
NNECO is propasing removal of the feature from Millstone Unit No. 2.
The NRC has encouraged removal of ACI in Generic letter 88-17.
In that document, the i
NRC suggests 'that utilities seeking removal of ACI consider the approach taken by Pacific Gas and Electric in removing the ACI from the Diablo Canyon units.
l l
(1)
Reference NRC Case Study Report AE00/C503 dated December 1985.
j U.S. Nuclear Regulatory Commission B14005/Page'4 January. 30, 1992 Safety Assessment In September
'989, Combustion Engineering (CE) completed a
- report, CE NSPD-550, " Risk Evaluation of Removal of Shutdown Cooling System Auto-Closure Interlock," which documents the results of an analysis of the impact of removing the ACI from the SDCS.
The evaluation was performed to determine the change in ISLOCA frequuicy, the change in SDCS unavailability, and the impact on mitigating lo+ temperature overpressure events due to the removal of ACI.
This evaluation addresses seven guidelines for ACI removal recommended by the NRC in a memorandem from R. W. Sharon (Chief, Reactor Systems Branch) dated January 28, 1985.
In recmiary, the following discussion describes how each of the seven items will be met.
It should be noted thagjhis discussion closely parallels that accepted by the NRC for Diablo Canyon 1.
Means available to prevent a LOCA outside containment.
The Millstone Unit No. 2 design provides for a duble barrier between the RCS and the SDCS.
The design prevides a very high probability that at least one barrier can be established and maintained under postulated conditions.
Procedural controls, training, alarms, snd the OPI function minimize the potential that the operator will fail to achieve double isolation during normal heatup and pressurization of the RCS.
In addi-tion, a review and valuation have m.en performed for Millstone Unit No. 2 (see Attachmer
- 2) to justify removal of the ACI associated with the Millstone Unit No. 2 SDCS. suction valves.
This evaluation has shown that removal' has no measurable imp 6ct on the ISLOCA frequencies.
2.
Alarms to notify the operator that SDCS suction valves are mispositioned.
Visual and acdible alarms will be provided in the main control room to l
I inform the operator if either of the SDCS suction valves is not fully l
closed when RCS pressure is above 280 psia.
These alarms, located on the l
main control boards, are annunciator type which provide operators with l
both flashing lights and audible signals.
The alarm set points will be l
tested _at least once every 18 months to verify operation, and is designed L
to alert the operators upon alarm circuit failure.
3.
Verification of the adequacy of relief valve capacity.
As a part of the original system design, calculations were performed by CE to ensure that the relief device in the SDCS suction line had adequate capacity to prevent overpressurization of the SDCS.
These calculations i
have been reviewed to confirm that ACI was not credited in the selection (2) Reference U.S.
Nuclear Regulatory Commission, "NRC Safety Evaluation Relating to Removal of Auto Closure Interlock Fur. tion at Diablo Canyon,"
february 17, 1988.
l-
4 U.S. Nuclear Regulatory Commission B14005/Page 5 January 30, 1992 of limiting events or mitigation of the resulting transieats. Therefore, the calculations remain applicable with the ACI removed.
Based on a plant-specific probabilistic risk assessment analysis (see Attachment 2),
it is concluded that the capacity of SDC Relief Valve 2-SI-468 is ade-(;uate except for the overpressure transient where one or more safety injection (SI) pumps may actuate.
The operating practices at Hillstone Unit No. 2.have minimized the potential for SI pump actuation as far as practicable and cannot be reduced further without adversely affecting the shutdown
'.0CA risk.
Millstone Unit No. 2 Technical Specifications Surveillance Section 4.5.3.2. requires that all but one high-prassure safety injection (HPSI) pump be verified inoperable whenever RCS temperatt ce is at or below 275'F.
In addition, Procedure OP2207 also specifically directs this action and then tautions against allowing work that can cause a HPSI pump start until all pumps are disabled.
4.
Means other than ACI to ensure that both isolation valves are closed.
As described in Item 2 above, the proposen mo'.ification-involves alarms, position indication, procedures, and training to-ensure that the double barrier is established upon heatup.
5.
Assurance that the Opl is not affected by ACI removal.
The OPI function will be maintained in its present form, and this inter-lock will be tested at least once every 18 months to verify operability.
6.
Assurance that valvt position indication will remain available in the control room af ter ACI removal.
The. current design provides for valve position indication on the main control board and on the computer display located in the main control room.
This indication will be present even when valve operation is L
locked out during pm er operation.
Additional indiution that-the valve is closed will be provided by the lack of alarm at any pressure above the alarm set point.
-7..
Assessment of the effect of ACI ramoval on SDCS avai?cbility and low-l temperature overpressure event.
l A plant-specific evaluaticn (Attachment 2) was conducted to ' investigate the risk impact of removing the ACI from the Millstone Unit No. 2 SDCS Svetion Val a s 2-St-651 and 2-SI-652.
In place of the ACI, an alarm will be provided to alert the operator that the SDCS suction valve is not fully closed when the RCS pressure is above the alarm set point.
The plant-specific-report (Attachment 2) for Millstone Unit No. 2 justifies removal of the ACI based on a safety assessment of the effect of ACI removal on low-temperature overpressure protection (LTOP), SDCS availa-bility, and ISLOCA potential.
t l-l
I l.'
U.S. Nuclear Regulatory Commission B14005/Page 6 s
January 30, 1992 Based on the plant-specific analysis (see Attachment 2), it is concluded that the impact of the ACI removal on the ISLOCA frequency is negligible.
Based upon industry experience, it is concluded that the frequency cf loss of SDCS events could be reduced by approximately 28 percent when the ACI is removed.
At Millstone Unit No. 2, the SDCS isolation H0Vs are de-energized in the OPEN position during midloop operation. This operat-ing practice minimizes the risk associated with the inadvertent ACI event. Therefore, the 28 percent reduction in SDCS unavailability is not totally applicable to Millstone Unit No. 2.
However, ACI removal pro-vides a definite safety benefit since a potential for leaving the SDC isolation valves de-energized in the OPEN position is eliminated when the ACI is deleted and the need for the above-mentioned operating practice is eliminated.
Inadvertent ACI actuations that cause the loss of the SDCS are risk-significant if they occur during midloop operations.
The analysis (Attachment 2) determined that LTOP play: a significant role in l
the mitigation of overpressure transients.
Based on insights gained J
during tM analysis, the 90tential for common-cause failure of LTOPs was identified as significant.
Therefore, as part of the analysis it was verified that at Millstone Unit No. 2, LTOP consists of two complet11y independent trains which are used to mitigate LTOP events that may occur during SDC operations.
The report concludes that the risk attributej to overpressure transients is not significantly affected by the ACI removal.
The analytical methods used to determine ISLOCA frequency involve fault-tree analysis along with mechanical and ht. man error probabilities.
The NRC has previously approved ACI removal for several plants utilizing this approach, including Waterford, San Onofre, and Diablo Canyon.
The discussion presented above oe.nstrates an adequate level of safety to support the proposed design mod.fication.
,53 Qescrintion of the Proposed Chanaes The proposed Technical Specification change would delete the surveillance requirement (Section 4.5.2.C.') associated with the SDCS ACI concurrent with the deletion of ACI circuitry planned for the next refueling outage.
Surveil-ldnCO Requirement 4.5.2.C.1 of the Millstone Unit No. 2 Technical Specifica-tioris requires that the automatic isolation of SDCS from the RCS be verified on an 18-month interval.
However, with the ACI function removed, there is no longer a need to retain this surveillance requirement within the Technical Specifications.
In addition, a surveillance requirement is proposed to be added in place of the existing Requiremert 4.5.2.C.l.
Specifically, the new surveillance requirement would verify the operation of the OPI that prevents opening of the SDCS suction valves when the RCS pressure is greater than 300 psia.
This new survei'. lance requirement would ensure that the significant components that were shared by the ACI and OPI and tested under the requirements of i
1
s l.-
U.S -Wuclear Regulatory Commission B14005/Page 7 January 30, 1992 Surveillance 4.5.2.0.1 will continue to be appropriately tested.
NNEC0 has determined that any changes to the bases section are not needed.
.Sianificant Hazards Consideration In accordance with 10CFR50.92, N'IECO has i wiewed the attached proposed changes and has concluded that they do not involve a significant hazards consideration.
The basis for this conclusion is that the three criteria of 10CFR50.92(c) are not compromised.
The proposed changes do not involve a significant hazards consideration because the changes would not:
1.
Involve a significant increase in the probability or consequences of an accident previously evaluated.
The removal of the SDCS ACI was evaluated generically in CE NSPD-550 in terms of the frequency of an ISLOCA, the availability of the SDCS, and the effect on overpressure transients, i
This generic evaluation has been supplemented by the plant-specific submittal (Attachment 2) for Millstone Unit No. 2.
There is a negligible change in the ca sated probability of an ISLOCA event associated with ACI removal.
The evaluation demonstrates that removing ACI, and replac-ing it with a valve position alarm, will reduce the number of spurious closures of suction valves and thus increase the availability of SDCS.
The present LTOP system will remain available per Technical Specifica-tion 3.4.9.3 to mitigate a pressure transient.
The proposed change related to testing of existing OPI has no impact on the design basis accidents.
Therefore, the proposed changes would not increase the consequences of an accident previously analyzed.
2.
- Create the possibility of a new or different kind of accident from any
~
previously evaluated.
The effect of an overpressure transient at cold shutdown conditions will not be altered by removal of the ACI function.
The ACI is intended to ensure that the low-pressore pioing of the SDCS is properly isolated from the RCS pressure during start-up operations, it does not protect against hardware fatiure. The valve position alarm will warn against both operator error and i ardware failure.
While it is true that the ACI initiates an autoclosure of the SDCS suction valves on high RCS pressure, overpressure protection of the SDCS is provided by the SDCS relief valve and not by the slow-acting suction valves that isolate the SDCS from the RCS.
The oossibility of a loss of SDCS is reduced by the proposed change because the potential of the SDCS isolation valves being closed by a spurious signal will be eliminated.
No other failures are introduced by ACI removal.
Therefore, the proposed changes will not create the possi-bility of a new or different kind of accident from any previously evalu-ated.
3.
Involve a significant reduction in a margin of safety.
The SC' ACI function is not a consideration in a cargin of safety for any Technical
U.S. Nuclear Regulatory Commission B14005/Page 8 January '10, 1992 Specification.
However, since the evaluation of CE NSPD-550 and the Millstone Unit No. 2 plant-specific evaluation indicates that the avail-ability of the SDCS is increased with removal of ACI, implementation of the modification (addition of a control room alarm) and procedural changes will produce an increase in overall safety.
Moreover, the Commission has provided guidance concerning the application of standards in 10CFR50.92 by providing certain examples (51FR7751, March 6, 1986) of amendments that are considered not likely t.o invohe a significant hazards consideration.
Although the proposed change related to the ACI surveillance is not enveloped by a specific example, the proposed change would not involve a significant change in the probability or consequences of an accident previously analyzed.
With the removal of ACI and an addition of a control room alarm, 'he Millstone Unit No. 2 plant-specific evaluation pre-dicts a negligible change in ISLOCA.
The proposed change related to the testing of OPl is enveloped by Example (ii), a change that constitutes an additional limitation, restriction, or control not presently included in the Technical Specifications.
The proposed change will verify the operation of the existing OPI at least once per 18 months.
The OPI prevents the SDCS/RCS isolation valves from being opened when the RCS pressure is greater than 300 psia.
Based upon the information contained in ths :ubmittal and the environmental assessment for Mill tone Unit No. 2, there m. o radiological or ntnradiolog-ical impacts associated with the proposed change, and the proposed license amendment will not have a significant effect on the quality of the human environment.
The Millstone Unit No. 2 Nuclear Review Board has reviewed and approved the attached proposed revision and has concurred with the above determinations.
To allow for implementation of the design change related to this Technical Specification change during the next refueling outage, currently scheduled to start May 1992, your timely review and approval of the proposed license amendment is requested.
In accordance with 10CFR50.91(b), we are providing the State of Connecticut with a copy of this proposed amendment.
Very truly yours, NORTHEAST NUCLEAR ENERGY COMPANY A
J. F.'Opeka' 7T Executive Vice President cc:
See next page i
4 6
U.S. Nuclear. Regulatory Commission B14005/Page 9
-January 30, 1992
.cc:
T. T. Martin, Region 1 Administrator G. S. Vissing, NRC Project Manager, Millstone Unit No. 2 W. J. Raymond, Senior Resident inspector, Millstone Unit Nos. 1, 2, and 3 Mr. Kevin McCarthy, 0irector Radiation Control Unit Department c' Environmental Protection Hartford, CT 06106 STATE OF CONNECTICUT)
) ss. Berlin COUNTY OF_ HARTFORD )
Then personally appeared before me, J. F. Opeka, who being duly sworn, did state that he is Executive Vice Presi_ dent of Northeast Naclear Energy Company, a Licensee herein, that he. is authorized to execute and file the foregoing.
information in the name and on behalf of the Licensee herein, and that the statements contained in 'said information are true and correct to the best of his knowledge and belief.
J Vhb?wN?
r &s. oe lotary Publgv AyCcmmbtkn Eghs kh31,im i
t
_-