ML20154S338

Comment on NUREG-1217 & NUREG-1218 Re Proposed Resolution of USI 1-47, Safety Implications of Control Sys

ML20154S338
Person / Time
Site:	Three Mile Island, Bellefonte, 05000000
Issue date:	09/02/1988
From:	Obrien H AFFILIATION NOT ASSIGNED
To:	Baer R NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
References
FRN-53FR19356, RTR-NUREG-1217, RTR-NUREG-1218, TASK-A-17, TASK-A-46, TASK-A-47, TASK-OR 53FR19356-00004, 53FR19356-4, GL-87-02, GL-87-2, IEIN-79-22, IEIN-86-106, NUDOCS 8810050045
Download: ML20154S338 (6)

Text

, - _ -- - - - - - -

.g . e .

\ )p,$o

?M: 9Ahm I;

DOCKETED USNRC Rl!LES& PROCEDURESBR 11 Blue Mountain Court DRR AGM Oak Ridge Tennesceo 37830

'88 SEP 14 P4 :19 SEP 0 21988 je g jgp 53 Fit /93Sc  :

@ l Mr. Robert Baer, Chief  ;

Engincoring Issues Branch Division of Engincoring l Office of Nuclear Regulatory Roccarch U. S. Nuclear Regulatory Commission Washington, DC 20555

Dear Hr. Baer:

COMMENTS ON PROPOSED RESOLUTION OF UNRESOLVED SAFETY ISSUE (USI) A SAFETY i IMPLICATIONS OF CONTROL SYSTEMS ,

I would like to offer my personal views and reconsnendations on the proposed I resolution of USI A-41, Safety Implications of Control Systems, for your  ;

consideration. The enclosed input is in response to the request in the Federal Rer_ister (53FR 19356) dated May 27, 1988.

1 have been involved with this rather controversial issue in varying degrees for the past sixteen years. I am a senior engineering specialist with the Tennessee Vaticy Authority (TVA) with responsibilities in the areas of design basis, safety evaluations, and plant integration of safety-related plant features. This input, however, represents my individual position. It does not represent a coordinated TVA position.

Yours truly, by b $N.A<E+1 Harry C. O'Brien Enclosure 99100000 e O00902 FR19356 p g DNS4 - 5484Q C

nn sA 9m/h

e. (

8-25-88 H. C. O'Brien COMMENTS ON THE PROPOSED RESOLUTION OF UNRESOLVED SAFETY ISSUE (USI) A-47 SAFETY IHpLICATIONS OF CONTROL SYSTEMS Scopo_of Review - The following comments, observations, and suggestions are based on a brief review of the April 1988 drafts of NUREG-1217 and NUREG-1218. The reports that form the bases for these NURECs have not been reviewed. These comments reflect the personal views and recommendations of the reviewer and not a coordinated TVA position.

General Impressions - Based on a brief review, I think that the evaluation and the proposed resolutions for USI A-47 are generally reasonable for operating plants. I think some further effort may be needed on an integrated approach for unintended (spurious) operations of nonsafety-related equipment.

plant-specific evaluations may be appropriate. A somewhat more conservative approach may be appropriate for future plants and perhaps for construction plants.

TVA Initiatives Related to USI A TVA has undertaken several initiatives for design improvements related to the USI A-47 area. The majority of these were made for our later Babcock and Wilcox (B&W) and Combustion Engineering (CE) pressurized water reactors (pWRs) - Bellefonte and Yellow Creek.

TVA was instrumental in identifying the potential problem with coatrol system failures that could cause a steam generator overfill transient in 1972 before it became an NRC concern. We noted that Westinghouse (W) had provided a safety-grade cutoff of main feedwater (HFW) on high steam generator level for core overcooling protection (which also provided steam generator overfill protection), while B&W and CE did not have any provisions for automatic MFW isolation. We also noted that B&W had transferred their integrated control system (ICS) design from their fossil to their nuclear plants; however, they had not transferred the separate overfill "protection" type system provided in their fossil plants. At TVA's direction, B&W and CE added provisions to isolate MFW to prevent overfill to the Engineered Safety Features Actuation Systems (ESFAS) for our Bellefonte and Yellow Creek plants.

In other areas. TVA directed B&W in the early 1970s to add a safety-grade system for Bellefonte to initiate and control auxiliary feedwater (APW). This was expanded after THI-2 to provide better control. In the mid-1970s. TVA upgraded the primary and secondary side power-operated relief valves (pORV) to be safety grade for both the opening and closing modes for our B&W and CE plants. (Our CE plants did not have p0RVs on the primary side.) These valves serve the safety functions of cooldown, depressurization, isolation, and prevention of unintended operations. TVA has also provided safety-grade pressurizer sprays to serve the safety function of deprescurization (in conjunction with the pORVs). In the early 1970s TVA also provided safety-grado control air systems to power the pORVs, AFW control valves, etc.,

for our W. B&W, and CE plants.

DNSA - 4853Q

(2)

Treatment of Specific Events and Spatial Effects - Section 2.2(2) and Appendix A of NUREG-1217 and section 2.1(2) of NUREC-1218 - The draft NUREGs indicate that "external" events such as carthquakes, floods, fires, and sabotagn have not been considered. It appears that the evaluations did not consider the s_patial aspects of potential hazards (e.g., fires, floods, etc.) or the locations of the control systems. However, a limited number of multiple unintended (spurious) operations were assumed. These assumptions may be f airly representativo and give good "coverage" of the f ailures that might be caused by those types of events. I think further work is needed to develop an

, integrated treatment of those types of events as well as the f ailures within the current scope of USI A-47. This integrated treatment should include (1) the various hazardous events, such as pipe breaks, "internal" flooding, "internal" fires, other events that produce harsh environments, earthquakes, etc., and (2) consideration of the spatial aspects of the hazards and their effects on the control systems located within the zono of their influence.

Dif ferent assumptions may be appropriate for dif ferent hazards.

NRC Generic Letter 87-02 implies that USI A-46 may not cover unintended (spurious) operations of nonseismic (nonsafety grado) control systems in errthquakes (see pages 4 and 12, etc.). The seismic experience data base does not seem to cover unintended (spurious) operations during an earthquake. If my understanding is correct, the discussions in section 2.2(2) and Appendix A(2) of NUREG-1217 may need some expansion.

Sections III.C and III.L of 10 CFR 50, Appendix R, require that spurious actuations be addressed for fires. However, NRC Generic Letter 86-10 does not appear to require that more than one spurious actuation be assumed. This does not appear to be adequate ccverage since cultiple unintended operations have

,i occurred in several actual fires.

The environmental qualification requirements in 10 CFR 50.49 require that nonsafety-related electrical equipment must be environmentally qualified if J its failure under iarsh environments can prevent safety-related equipment from j accomplishing its safety function. USI A-47 needs to be expanded to cover unintended operation of control systers caused by environmental conditions caused by pipe breaks and other events that could produce a harsh l

environment. For example, NRC Information Notices 79-22,86-106, etc., should

' be factored into the evaluation. USI A-47 also should be expanded to cover l flooding from moderate energy line breaks, flow diversions, etc., that are j outside of the scope of 10 CFR 50,49.

i Need and Criteria for plant Specific Evaluations - The analysis to support the l

2 USI A-47 conclusions seems to have examined control system failures that could I

have the most adverse impact on the primary and secondary side systems.

Although the spatial effects of specific hazards such as fire, flooding, harsh environments, earthquakes, etc., were not specifically addressed, this approach may give a reasonable "coverage" of these effects. Evaluations were made of the generic applicability of the analyses of the representative plants. This approach has a great deal of merit for both a generic assessment and for plant-specific assessments.

DNS4 - 4853Q

(3) llowever, it is not clear that this approach gives sufficient coverage of this very broad area. I think that pl3_nt-specific evaluations are needed to f actor in (a) the various hazards and their spatial effectc on the control systems (soo previous comment) and (b) plant-specific control and support systems. I think that the tudustry needs to develop criteria and practical methcdology for use in plant-specific evaluations (sco details in the following comment).

The evaluations for operating plants can be based on risk reduction and value/ impact for operating plants; however, the evaluations for futuro plants i and perhaps construction plants need to also f actor in the traditional design basin event (DBE) type of safety limits and safety analysos (see details in a following comment).

povelopment of Methods of Treatinn Multiple rattures in control systems - The assumptions for unintended (spurious) failures has been a controversial topic and a cource of confusion for many years. The assumptions for nonsafoty. grade equipment are much more uncertain than are the assumptions for safety-grado equipment.

I think that the industry needs to develop a practical methodo1,ogy for designers to use to evaluate and provido protection from a limited number of multiple unintended operations of nonsafety-related equipment. As discussed above, this needs to be an intenrated approach for the various types of hazards. The spurious operations need to be addressed for nonsafety-grado components that are (a) in the zone of influence of the event and (b) not qualified (or designed to function) in the environment. The methodology whould build on the approaches being developed for (a) the resolution of USI A-47 and USI A-17, and (b) the approaches being developed for various individual hazards.

The methods development needs to include an evaluation of the (a) need. (b),

merits, and (c) practicality of addressing a limited number of multiple unintended operations. This involvos an evaluation of whether or not the increased complexity of the analysis of, and protection from, a limited number of multiple unintended operations would give a worthwhile and cost-effectivo increase in safety over the assumption of one spurious action. There is a need to develop practical methods of limitinn the number of multiple unintended operations to those that are more likely and that are also more significant.

The previous treatments for unintended (spurious) operations that have boon either proposed or used by industry have involved a full range of assumptions. They are generally limited to equipment in the zone of influence that is not designed to work in the environment produced by the event. These include:

(1) j to unintended (spurious) operations.

(2) One unintended operation.

(3) A limited number of multiple unintended operations.

(4) Multiple unintended operation of all nonqualified equipment in zone of influence.

DNS4 - 4853Q

(4)

I do not think it is reasonable to assumo either (a) no unintended operations or (b) multiple unintended operations of all nonqualified equipment in the zone of influence. The most likely. results of DBEs with hazards, such as fires, harsh environment, flooding, vibration from an earthquako, etc., are a [

limited number of multiple unintended operations. It is difficult to defend the assumption of one unintended operation from likelihood and past experience. However, the assumption of ono unintended operation "covers" a significant amount of the safety concern in this area. This would provido a good interim position until (a) a more detailed evaluation of the issue, (b) positions, and (c) practical methods of addressing multiple uninten/ed operations can be developed.

Although only one spurious action is assumed, it could occur at any location in the zone of influence; thus, all spurious actions would need to be evaluated individually. In general, the likollhood of multiplo unintended operations decreases as the number is increased. (There are a few exceptions such as containment isolation and other actions of the ESFAS, the solid stato control systems, etc.) Also, the assumption of one failure may be commensurate with the importance to safety. If the equipment is not safety related, its function is not directly related to the mitigation of the DBEs.

If it is assumed that it does not work, a class of failuro modes is already analyzed. If one spurious failuro is assumed, an additional class of events is eliminated. The failures not analyzed would be cultiple f ailures of nonsafety equipment that somehow combine to affect multiple trains of safety equipment, or in combination with a random failure, affect the remaining specific train. The effort invulved in eliminating this threat may not be I commensurato with the risk. ,

Initiatinr. Event Failures vs Consequential Failures - The USI A-47 evaluation considers some control system failures that are the consequences of DBEs; however, most of the emphasis is placed on initiating event control system failures. I think additional attention needs to be given to consequential control system failures. For example, the unintended opening of the secondary ,

side PORVs upstream of the main ste7m isolation valves (MSIV) can create '

safety problems of (a) a loss of containment isolation in a LOCA (assuming a small pre-existing steam generator tube leak), (b) excessivo cooldown rates  !

and loss of pressurized steam generators for a heat sink in a steam line l break, (c) loss of capability to terminate the radiation release in a steam generator tube rupture (SGTR), etc.

Traditional DBE Safety Limits vs Risk Basis - The proposed resolutions of USI  !

A-47 are generally based on risk reduction and value/ impact analyses. This is  ;

appropriate for potential backfits for operating plants. However, for future plants and perhaps for construction plants. I think that traditional DBE type ,

of safety limits and safety analyses need to also be considered. For newer [

plants, the control system failures need to factored into the traditional [

conservative safety analyses to some degree. Examples include: Item (1) l Overfill Events - If an overfill event can cause the failure of steam lines or f relief valves on a PWR, then the traditional safety limits associated with r steam line breaks need to considered as well the risk basis concerns of a j steam line break causing steam generator tube ruptures and core molt. See also the safety concerns in item (3) of Appendix A of NUREG-1217. Item (2) L i

DNS4 - 4853Q

(5)

SGTR Events - The affects of control system failures need to be evaluated in terms of the traditional SGTR dose limits - even though it does not lead to a core melt considered in the risk basis. See also the safety concerns in item (3) of Appendix A of NUREG-1217.

, Commercial Grade vs Safety-Grade overfill Protection Systems - Items (6) and (7) of section 5 of UUREG-1217, and items (6) and (7) and Appendix C of

. NUREG-1218 - The conclusions for US1 A-47 indicate that commercial-grade overfill protection systems that meet certain design requirements are considered to be adequate. This is reasonable for backfits for operating i plants; however, I think future plants and perhaps construction plants need to .

I provide safety-grade overfill protection systems.

Overfill Events - One of the more rapid and significant overfill events for a PWR seems to be a reactor trip followed by a failure of the control systems to rapidly runback the HFW. This type of event seems to only be addressed in two cases in Section 3 of NUREG 1217: (1) Overfill event #1 in Table 3.4 and (2)

Overheat event #1 in Table 3.3. I think that this type overfill event needs to be treated in more detail for all of the representative plants. ,

, }MW Overfill Protection Systems - Section 4.3 of NUREG-1217 and section (3) of j Appendix C of NUREG-1218 - Our 205 fuel element B&W plant, Bellofonto, does '

not have a measurement of steam generator water level. This resulted in the need for a much more complex overfill protection system that used neutron flux, MFW flow, steam generator dif ferential pressure, etc. , to develop trip signals. The NURECs should reflect this different protection system used on a few B&W construction plants.

Steam Generator Tube Rupture Events _ - Section 3 of NUKEG-1217, and scetions 3.2.4 and 4.2(9) of NUREG-1218 - These sections address the affects of control I system f ailures on SGTR events for W plants (sco SGTR event #1 and #2 in Table  :

3.2). It appears to me that these types of failures should present similar l concerns for the B&W and CE plants. If valid, these failures and events should be addressed in the NUREGs.

1 Atmospheric and Condenser Dump Valve controller Loric - Section 4.2(6) of NUREG-1218 - TVA modified the atmospheric and condenser dump valve controller logic in the ICS for our B&W plant so that a single f ailure in the logic could

]

only open a few dump valves. This was done to prevent a relatively likely initiating event single f ailure from causing the fuel safety limits for a frequent event (ANS Condition 11 event) to be exceuded. Although this is not i directly related to frequency of core melt, I think it is an improvement worth  ;

considering for other PWRs - particularly for future plants and perhaps for consttvetion plants, l I

i

'. l 1

i l DNS4 - 4853Q 1

j

- _ _ _ _ - _ _ _ _ _ .