ML20154E263
| ML20154E263 | |
| Person / Time | |
|---|---|
| Issue date: | 12/16/1987 |
| From: | Chiramal M NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD) |
| To: | Bernero R, Jordan E, Sniezek J Committee To Review Generic Requirements, NRC OFFICE OF NUCLEAR MATERIAL SAFETY & SAFEGUARDS (NMSS), Office of Nuclear Reactor Regulation |
| Shared Package | |
| ML20154D839 | List: |
| References | |
| REF-GTECI-A-47, REF-GTECI-SY, TASK-A-47, TASK-OR NUDOCS 8809160272 | |
| Download: ML20154E263 (6) | |
Text
. _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _
l Deccarber 16, 1937 HEMORANDUM FOR:
Edward L. Jordan, Chairman, CRGR t
l Robert M. Bernero, NHSS James H. Sniezek, NRR i
Denwood F. Ross, RES T. T. Martin, RI Joseph Scinto, OGC l
THRU:
C. J. Heltemes, Jr. Deputy Director, AE00 FROM:
Matthew Chiramal, ROAB, AE00 L
f SU81 JECT:
SUMARY AND ISSUE IDENTIFICATION -- CRGR AGENDA ITEM, MEETING NO. 127 Enclosed for your information and use is the CRGR staff summary for the l
following CRGR review ites*
t Proposed resolution of USI A-47 "Safety Implications of Control Systems j
in WR Nuclear Power Plants."
t This matter is scheduled for CRGR review at Meeting No.127 on Wednesday, December 23, 1987 in Room MNBB 6507 from 1:00 to 3:00 p.m.
l 1
1 4
L i
Matthew Chiramal I
ROAB, AE00 l
i I
Enclosure:
j As stated
(
i
?
1 Distribution:
j CRGR SF J. Heltemes 6
)
C. Sakenas f
'J.':Concen1 -
a i
j I
I i
j l
l 1
0FC : AE00:ROAB : AE00:CRGR :
AE00:00 l
l
..... m q..g 3.....,g g.............................:............:............:........::.
^
I NAME :MChiramaTieg: "JConran
- CJHeltemes :
l i
OATE : 12AL /87
- 12/ /t/87
- 12/ /87 l
I intA YM8809160272 p"ttt OFFICIAL REC 040 CQPY M5
Sumary and Issue Identification CRGR Agenda Item - Meeting No. 127 IDENTIFICATION Proposed resolution of USI A-47 "Safety Implications of Control Systems in LWR Nuclear Power Plants."
OBJECTIVE The staff has requested that CRGR review and approve the documented results of the staff evaluation and proposed implementation of USI A-47, "Safety Implications of Control Systems in LWR Nuclear Power Plants" prior to issue for public comment.
BACKGR0Vy0 (a) The package submitted for CRGR review was transmitted by memorandum dated November 9,1987 from E. S. Beckjord to E. L. Jordan.
The package included the following documents:
(1) Draf t NUREG-1218. "Regulatory Analysis for Proposed Resolution of USI A-47" (2) Draft Generic Letter (3) Background information for CRGR review of USI A-47 resolution (4) Summary of USI A-47 references (5) Draft NUREG-1217. "Evaluation of Safety Implications of Control Systems in LWR Nuclear Power Plants - Technical findings Related to USI A-47" (6) Sample Sholly Amendment (7) Revised STS for B&W and CE plants (b) CRGR has not reviewed any of the above documents previously.
(c) ACRS comments not r9ceived as yet.
(d) This package was reviewed and concurred upon by NRR, AE00 and OGC; the coments received from these offices were considered and included where appropriate.
(e) The RES staff contact on this subject is Andrew Szuktewicz, USI A 47 Task Manager, Office of Nuclear Regulatory Research.
DISCUSSION / ISSUES The safety issue in USI A-47 is the concern that there may be failures in LWR nuclear power plants initiated or aggravated by non-safety grade control systems that could lead to plant upsets or events that significantly impact the health and safety of the public.
To address this safety concern, the non-safety grade control systems at four different nuclear steam system (NSS) plants were evaluated.
The four NSS plants were:
(1) a GE BWR--Browns Ferry 1; (2) a 3-loop Westinghouse PWR--H.B. Robinson; (3) a B&W PWR--Oconee 1;
2-and (4) CE PWR--Calvert Cliffs 1.
The control systems at these four plants were reviewed to identify control systems whose failures could (1) cause transients or accidents to be potentially more severe than previously analyzed, (2) adversely af fect any assumed or anticipated operator action during the course of transients or accidents, (3) cause technical specification safety limits to be exceeded, or (4) cause transients or accidents to occur at a frequency in excess of those established for abnormal operational transients and design basis accidents.
Based on the results of these specific plant analyses, a study to determine the generic applicability of the results was also conducted.
These efforts are documented in draft NUREG-1217, "Evaluation of Safety implications of Control Systems in LWR Nuclear Power Plants" and its references, A set of limitations and assumptions was developed by the staff to confine the i
USI A-47 review to a manageable scope and to focus attention on the more significant potential control system failures.
These limitations and assumptions are:
(1) A minimum number of safety grade protection systems would be available to trip the reactor and initiate overpressure protection systems or emergency core cooling systems, if needed, during transients initiated by failures in the control systems.
(2) Control system failures resulting from comon cause events such as
)
earthquakes, floods, tires, and sabotage, or operator errors of omission or comission are not addressed in this review.
A study i
of selected multiple control system f ailures in non-safety grade equipment was, however, performed to evaluate some effects of i
j comon mode failures.
(3) Transients resulting from control systes failures during limiting conditions of operation (LCO) or anticipated transients without scram (ArWS) events are not addressed in this review.
(4) The plant-specific designs were assumed to have been appropriately j
modified to comply with the requirements of IE Bulletin 79-27 and r
i NUREG 0737.
Within the scope of review governed by the above limitations and assumptiens, i
control system fai M e scenarios were identified that could potentially lead to reactor vessel or steam generator overfill events, core overheat events,
)
and overpressure events.
The review also found that (1) BWR plant designs with comercial overfill protection systems are considered to adequately 1
preclude water ingress into the main steamlines; (2) PWR plant designs having i
redundant comercial grade overfill protection systems that satisfy the single i
failure criterion are considered to adequately preclude water ingress into the main steamlines; and (3) PWR plant designs that provide automatic initiation j
of the auxiliary feedwater flow on low steam generator level are considered to adequately preclude core overheating.
Based on the technical findings of the review, the staff evaluated a number of alternatives for possible regulatory action.
Based on the safety benefits of these alternatives in terms of risk reduction and cost of implementation, the proposed resolution was selected.
This regulatory analysis is presented in 4
i
-3o draf t NUREG-1218, "Regulatory Analysis for Proposed Resolution of USI A-47."
In this analysis the staff has concluded that certain LWR plants should upgrade their control systems to preclude reactor vessel / steam generator overfill events and to prevent steam generator dryout, modify their technical specifications to verify operability of such systems, and modify selected emergency procedures to assure plant safe shutdown following a small break loss of coolant accident.
For resolution of USI A-47, the following actions are being proposed for the various opereting LWR designs:
(a) For Boiling Water Reactors o
Upgrade plant designs with no automatic reactor vessel overfill protection to a 1-out-of-1 (or better) reactor vessel high level feedwater trip system (except Big Rock Point and Lacrosse plants).
Since most BWRs already have such a feature, the staff has concluded that this applies to only one plant--Oyster Creek, o
Modify technical specifications for all BWRs to include provisions to periodically verify the operability of such a feature, and assure that automatic overfill protectior, is provided during power operation.
Most BWR plants with the Standard Technical Specifica-tions (STS) already comply with these requirement..
4 Issue an information letter to all licensees to informing them of o
the evaluation results of the overfill analysis.
(b) For Westinghouse PWRs Existing steam generator overfill protection systems are consider ~4d l
o sufficient.
Modify technical specification to include provisions to periodically o
verify the operability of the overfill protection system and assure that it is provided during power operation. Most Westinghouse plants' i
technical specifications already have these requirements.
Existing overpressure protection systems are adequate, o
i o
Issue an information letter to disseminate the evaluation results of the overfill analysis.
(c) For B&V PWRs o
Upgrade overfill protection on the three Oconee units.
All other B&W plants have modified their designs or have committed to modify their designs to have an udequate overfill protection feature, Provide Class IE instrumentation to automatically initiate auxiliary o
feedwater to minimize the potential loss of steam generator cooling 1
(including during a loss-of-control power event).
This too applies to the Oconee units only.
1
-4 o
Modify technical specifications to include provisions relevant to the overf tll protection feature.
o Issue an information letter on the evMuation results of the overfill analysis.
Modify all plants to provide additional instrumentation to terminate
(
main feedwater flow on steam generator high level.
l o
Modify technical specifications on all plants to include provisions to periodically verify the operability of the overfill protection system and assure that it is provided during power operation.
)
o Re-evahate CE plant designs similar to the reference plant reviewed i
to mooify if necessary their emergency procedures and operator I
training program to assure that the operators can safely shut down j
the plant during any small break LOCA.
This applies to Calvert Cliffs
(
l 1 and 2 Palisades, St. Lucie 1 and 2, Fort Calhoun, and Hillstone 2.
1 o
Issue an informatien letter on the evaluation results of the overfill
- analysis, t
j It should be noted that as a result of the Rancho Seco event of December 26 j
1986, which involved problems with the plant's Integrated Control System, l
i reassessment of all B&W plants is currently underway.
This reassessment I
effort, conducted by B&W Owners Group and reviewed by NRR staff, is closely i
coupled with the proposed resolution of USI A-47.
NRR in concurring with this
)
USI A-47 resolution package being submitted for CRGR review, and has requested l
that the proposed resolution be withhelci from public comment until this reassessment effort is completed (currantly scheduled for February 1388).
J It should also be noted that a number of ongoing NRC and industry programs are related to USI A 47.
These include USI A-46 on seismic qualifi. cation of l
i equipment, USI A-17 on systems interaction, the above mentioned B&WOG effort and staff actions resulting from the June 6, 1985 event at Davis-Besse (Generic
]
Issues 122 and 125).
E t
In its review of the proposed resolution packsge the Committee may wish to consider the following issues:
i (1) The USI A-47 review and resolution was governed by the four limitations i
and assumptions listed above.
This was done to narrow the scope of the j
investigation to a more manageable size, i
(2) One of the assumptions is that plant-specific designs have been appropriately modified to comply with the requirements of IE Bulletin 79-27. However, the Rancho Seco event of December 26, 1985 demonstrater' that Rancho Seco's conformance to the requirements of Bulletin 79-27 l
1 was inadequate.
Consequently in the B&WOG reassessment of all B&W plants, conformance to and implementation of Bulletin 79-27 requirements are j
included. The validity of this assumption for other NSSS operating
[
plants is not known.
4 j
l
e o
l (3) On the basis of consideration of safety benefits derived in terms of risk reduction and the cost of implementation, the proposed resolutten imposes requirements dealing primarily with reactor vessel or steam generator overfill protection.
The objective of these actions is to minimize the l
potential for water ingress into the steamlines thereby decreasing the potential damage to the main steamlines or the equipment associated with the steamline.
The existing commercial grade protection nr control at most operating ple,1ts provide the required protection for the equipment connected to the steamlines.
The extent of overfill that een lead to po'.ential steamline damage has not been established.
(4) Among GE BWR units, Oyster Creek is the only plant that will require the 4
1 addition of an automatic reactor vessel overfill protection scheme.
It should be noted that at Oyster Creek the main feedwater system is the one of the two system that provide high pressure reactor water supply--the other being the control rod drive system (the unit does not have an HPCI or RCIC system).
Addition of a high level trip could lead to unneeded I
loss of feedwater events.
(5) CE plants do not have an automatic high steam generator level trip signal j
for terminating fe2dwater flow.
In the event of a high steam generator l
j level, the main Steam turoine is tripped.
Thir in tuen will trip the i
reactor, shut the main feedwater valve, and open the startup feedwater i
valve to 5 percent flow.
The existing system can limit the frequency of i
steam generator overfill events.
l l
)
(6) In all these cases requiring overfill termination protection, it should
[
be noted that the final prote: tion system actuation device is the non-safety grade feedwater pump trip device.
^
l i
i j
i
[
i i
l i
i f
I f
l r
l
[
I
)
I l
i I
l,
-