ML20125D457

Reactor Sys Branch Technical Position,Overpressurization Protection of PWRs While Shutdown & Cooled Down

ML20125D457
Person / Time
Issue date:	04/29/1977
From:	Office of Nuclear Reactor Regulation
To:
Shared Package
ML20125D401	List: ML20125D398 ML20125D406 ML20125D412 ML20125D419 ML20125D424 ML20125D431 ML20125D437 ML20125D443 ML20125D451 ML20125D457
References
REF-GTECI-A-26, REF-GTECI-RV, TASK-A-26, TASK-OR NUDOCS 8001140312
Download: ML20125D457 (7)

Text

.'

REACTOR SYSTEMS BRANCH TECHNICAL POSITION OVERPRESSURIZATION PROTECTION OF PRESSURIZED WATER REACTORS WHILE SHUTDOWN AND COOLED DOWN

Background

General Design Criterion 15 of Appendix A,10 CFR 50, requires that "the RCS and associated auxiliary, control, and protection systems shall be de-signed with sufficient margin to assure that the desian conditions of the reactor coolant pressure boundary are not exceeded during any condition of normal operation, including anticipated ooerational occurrences."

Anticipated operational occurrences, as defined in Accendix A of 10 CFR 50 are "those conditions of normai operation which are exoected to occur one or more times during the life of the nuclear power unit and include but are not limited to loss of power to all recirculation pumps, tripping of the turbine generator set, isolation of the main condenser, and loss of 2' c ~fsite power."

Apendix G of 10 CFR 50 provides the fracture toughness requirements for reactor pressure vessels under all conditions. To assure that the Appendix G limits of the reactor coolant pressure boundary are not exceeded during any anticipated operational occurrences. Technical Soecification oressure-tenverature limits are provided for operating the plant.

900171AS .

s con 40 '

2 The primary concern is that during startuo and shutdown conditions at low temperatures, the reactor coolant system oressure micht exceed the reactor vessel pressure-temoerature limitations in the Technical Soecifications established for protection against brittle fracture. This inadvertent overpressurization could be generated by any one of a variety of mal-functions or operator errors.

Section III - Division 1, Subsection NB, subparagraph NB-3113.2 of the SSME Boiler and Pressure Vessel Code defines upset conditions (incidents of moderate frequ5ncy) as follows:

"Any deviations from Normal Conditions anticipated to occur often enough that desion should include a capability to withstand the conditions without ooerational impairment. The Uoset Conditions in-clude those transients which result from any single operator error or control malfunction, transients caused by a fault in a system component requiring its isolation from the system, and transients due to less of load or power."

from this definition of Voset Conditions and the demonstrated incidents in which the reactor coolant system pressure exceeded the pressure-temperature limitations on the reactor vessel, events which result in pressure transients while in a shutdown condition are to be considered under the Upset Condition.

Additional discussion on the background of this topic is contained in Reference 1. .

90017iA6

3 ,

B. Branch Position

1. A system shall be designed and installed which will prevent the ex-ceeding of the applicable technical specifications and Appendix G limits for the reactor pressure vessel during plant cooldown or startup. The system shall be capable of relieving pressure during overprassurization events at a rate sufficient to satisfy Upset Condition limits, particularly while the RCS is in a water solid condition.

((BASIS:

It is documented that at least thirty violations of l

Pressure / Temperature Tech Spec 'simits have occurred on PWR plants.

These incidents demonstrate the need for a system which will mitigate the consequences of such overpressurization events. As described in the background of this proposed position, these events are anticipated operational occurrences and as indicated in General Design Criterion (GDC) 15, a system should be provided to prevent exceeding specified limits. The water solid condition permits a much more rapid pressure transient than a condition which includes a gas space in the pressurizer.))

2. The system should be able to perfonn its function assuming any single active component failure. Analyses must be provided which demonstrate that the system will provide the required pressure relief capacity assuming the most limiting single failure. The cause for initiation of the event, i.e., operator error, component malfunction, etc., will not be considered as the single active failure. The analysis ,

should assume the most limiting conditions (e.g., one RHR train 90017 M7 l

l

operating or available for letdown, other components in normal operation when the system is water solid such as pressurizer heaters and charging pumps).

((BASIS:

Criterion 21 states that "no single failure results in loss of the protection function..." The statement that the transient analysis should assume the most limiting conditions is consistent with the requirements and intent of the GDC as well as past transient analyses required by the staff.))

3. The system should operate automatically, providing a completely independent backup protective feature for the operator.

GDC 20 states that "the protection system shall be designed

((BASIS:

to initiate automatically the operation of appropriate systems..."

Also, since a large number of observed events were due to operator errors, it would seem prudent to exclude the operator from the protection sequence.

It should also be noted that the staff recently gave conceptual approval for a fully automatic overpressure protection system.))

4. The overpressurization protection system should be tested prior to placing the plant in a shutdown and cooled-down condition, or sub-sequent to maintenance on the protection system.

((BASIS: The system should be capable of testing to assure proper operation prior to placing the plant in a mode of operation during which l

I this system may be called upon to operate.))

- 900171A8

5. The system equipment should be of high quality to assure operability when required and should provide protection against potential safety problems from inadvertent initiation during normal operation when it is not required. The system should possess the redundancy required by IEEE 279 electrical standards.

l

((BASIS: GDC 20 states that protection systems must be designed for l high functional reliability. It should be capable of providing adequate protection during nomal operation at cold conditions.

In addition, it should not degrade the reliability of the plant while operating at power at a time when it is not required for protection.))

6. The protection system does not have to meet Seismic Category I requirements if it can be shown that an earthquake would not initiate an overpressure transient. The postulated earthovaks should be of magnitude equivalent to the SSE. If the earthquake can initiate an overpressure transient, then it should be assumed that loss of offsite power is an expected consequence of the event and the protection system should be designed to Seismic Category I requirements and not require the availability of offsite power to perform its function.

((BASIS: If an earthquake durina cold shutdown could cause an overpressure event, the pressure relief function of the protection system should remain operable. The definition of SSE included in Appendix A of 10 CFR Part 100 supports this position.))

90017169

6-

7. The loss of offsite should be considered as an anticipated transient which could occur while in a shutdown condition. If this event can' initiate an overpressure transient, overpressure protection systems must therefore be independent of offsite power in addition to performing its function assuming any single active failure.

((BASIS: Appendix A of 10 CFR Part 50 defines loss of all offsite power as an anticipated operational occurrence. Appendix A of BTp ApCSB 3-1 defines normal plant conditions to include cooldown to a cold shutdown condition. On this basis it is appropriate to include loss of offsite power as an anticipated transient while in the cold shutdowncondition.))

8. Plant designs which take credit for an active component (s) to mitigate l

the consequences of an overpressurization event must include additional )

analyses considering inadvertent initiation or show that existing analyses bound such an event.

((BASIS: The inadvertent operation of an active component due to equipment malfunction or operator error must be analyzed as an event i

of moderate frequency in accordance with the appropriate Chapter 15 l Standard Review Plan. The acceptar.ce criteria for moderate frequency events would be applied to such an event (i.e., no fuel I

damage.))

9. All potential overpressurization events should be considered when estab- - ,

11shing the worst case event. Some events may be prevented by protective interlocks or by locking out power. These events 90017170 i

,--_ ~ - - - - , - - - - - - - . , - , . . - - - - - - - ~ - - - - - -

4 If the interlock / power should be reviewed on an individual basis.

lockout is acceptable, it can be excluded from the analyses provided the controls to prevent the event are in the plant Technical Specifications.

((BASIS: The worst case event will determine the required relief capacity of the protection system. It may be feasible to eliminate a potential source of an overpressurization event through designed interlocks or controls rather than increase capacity of the protection system.))

C. Implementation The Branch Position in paragraph B is to apply to all CP and OL applications. For those applicants expected to receive an operating license this year, installation of all equipment is to occur no later than the first refueling outage. For any plant receiving an operating license in 1978 or later, installation of equipment should be made prior to plant startup.

. References

1. NUREG-0138, Staff Discussion of Fif teen Technical Issues listed in Attachment to November 3, 1976 memorandum from Director, NRR to NRR staff.

90017171 .

I