ML20214X154
| ML20214X154 | |
| Person / Time | |
|---|---|
| Site: | Salem  |
| Issue date: | 11/20/1986 |
| From: | Corbin McNeil Public Service Enterprise Group |
| To: | Murley T NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| References | |
| IEB-86-003, IEB-86-3, NLR-N86171, NUDOCS 8612100571 | |
| Download: ML20214X154 (8) | |
Text
_ - - - - _ _ _ - _ _ _ _ _ _ - _ _ _ _ - _ _ _ _ _ _ _ _ _. - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
e.
Pubhc Service Electric and Gas Company Coriin A. McNel!I, Jr.
Public Service Electhc and Gas Company P.O. Box 236,Hancocks Bridge,NJ 08038 609 339-4800 Vice President -
Nuclear November 20, 1986 NLR-N86171 Dr. Thomas E. Murley, Regional Administrator United States Nuclear Regulatory Commission Region I 631 Park Avenue King of Prussia, PA 19406
Dear Dr. Murley:
l RESPONSE TO IE COMPLIANCE BULLETIN NO. 86-03 l
SALEM GENERATING STATION DOCKET NOS. 50-272 AND 50-311 This submittal provides the Public Service Electric and Gas Company (PSE&G) response to IE Compliance Bulletin No. 86-03,
" Potential Failure of Multiple ECCS Pumps Due to Single Failure of Air-Operated Valve in Minimum Flow Recirculation Line" dated October 8, 1986.
PSE&G received this bulletin on Octobec 14, 1986; however, the 30 day response requirement from the date of receipt was extended 7 days by Mr.
L.
Norrholm of NRC Region I on November 13, 1986.
Pursuant to statements made in the section entitled Action Required, the response for the Hope Creek Generating Station was provided in a letter from C. A. McNeill, Jr. (PSE&G) to T. E. Murley (NRC) dated June 11, 1986 (Response to IE Compliance Bulletin No. 86-01) and will not be repeated in this submittal. summarizes the response for Salem Generating Station (SGS) and concludes that the requirements of 10 CFR 50, Appendix A, General Design Criterion 35, are satisfied for the Safety Injection and Residual Heat Removal pumps.
Suitable redundancy in components and features is provided to assure that the system's safety function can be accomplished assuming a single f ailure as delineated in IEEE Standard 279-1971 and interpreted by IEEE 379-1972.
Although two issues were raised during the i
review for the Charging / Safety Injection pumps, a detailed justification for continued operation is provided and the short-term corrective action is identified as discusned in.
As a result of the information provided, it can be concluded that the current design of SGS's minimum flow recirculation lines is acceptable and poses no risk to plant safety.
PSE&G will provide long-term corrective actions to resolve this issue by January 12, 1987 in accordance with the requirements of IE Compliance Bulletin 86-03.
gll 8612100571 861120 PDR ADOCK 05000272 I
l l
IL PDR
o.
Dr. Thomas E. Murley 2
11-20-86
! contains an affidavit which affirms the conclusions reached and information contained within this transmittal.
Should you have any. questions regarding this information, please feel free to contact us.
Sincerely, 9
Attachments C
U.
S.
Nuclear Regulatory Commission Document Control Desk Washington, DC 20555 Mr. T.
J.
Kenny Senior Resident Inspector Mr.
D.
C.
Fischer Licensing Project Manager 4
i 1
l
. ~. _
.4 ATTACHMENT 1
. Re f :
IE Compliance Bulletin 86-03 Docket Nos. 50-272 and 50-311 STATE OF NEW JERSEY
)
)
SS.
COUNTY OF SALEM
)
l Corbin A. McNeill, Jr.,
'being duly sworn according to law deposes and says:
}
I am Vice President of Public Service Electric and Gas Company, and as such, I find the matters set forth in our letter 4
i
~
~ dated November 20, 1986, concerning our response to IE Compliance Bulletin 86-03, Docket Nos. 50-272 and 50-311, are true to the best of my knowledge, information and belief.
l 1
C
\\
M Subscribed and Swor to efore me this Ja
- day of' 1986 1
LARAINE Y. BEARD Notary Put}jltic of New Jersey
%ry Public of New Jef**Y My Commission Espires May 1, IM My Commission expires on I
i 1
i i
~
ATTACHMENT 2 The purpose of this review is to address the safety concerns relating to potential failures of multiple Emergency Core Cooling System (ECCS) pumps due to a s'.ngle failure of an isolation valve in the minimum flow recirculation line as identified in IE Compliance Bulletin No. 86-03.
This review applies to medium-head Safety Injection (SI) pumps, high-head Charging / Safety Injection (C/SI) pumps and low-head Residual Heat Removal (RHR) pumps in the ECCS of Salem Generating Station Unit Nos. 1 and 2.
Although Bulletin 86-03 specifically addressed air-operated valves in ECCS minimum recirculation flow lines, PSE&G's review encompassed any type of valve in the minimum recirculation flow lines for the ECCS pumps and applies single failure mechanisms defined in IEEE Standard 279-1971 and 379-1972.
1.
SAFETY INJECTION PUMPS There are two motor-operated globe valves, SJ67 and SJ68, provided in series in the 2-inch, common minimum flow recirculation line from the Safety Injection (SI) pumps to the Refueling Water Storage Tank (RWST).
These valves are nonnally open and fail "as-is" on loss of power to their control circuits.
However, the design and operation of the minimum flow recirculation line was further reviewed to determine if the single failure criterion is satisfied for the Safety Injection trains.
During normal plant operation, valves SJ67 and SJ68 are open with their controls locked out at the ECCS power lock-out switch in the control room (Panel RP4).
The valves can be operated manually from the control room only after removing the lock-out on panel RP4.
The open or close position of tne valves is indicated on the pushbutton station in the control room.
The status of the valves is continuously monitored through a stem-mounted limit switch which is used to indicate the valve position.
Valve OFF-NORMAL position is alarmed at the overhead annunciator and the auxiliary annunciator system.
Loss of 28VDC control voltage is also alarmed to the auxiliary annunciator system.
During switchover to the recirculation phase following a LOCA, valves SJ67 and SJ68 will be manually closed from the control room by first removing the lock-out (i.e., by selecting VALVE OPERABLE mode at the power lock-out switch) in accordance with the Emergency Operating Procedure EOP-LOCA-3.
In addition, the operation of valves SJ67 and SJ68 is interlocked with Safety Injection valves ll(21)SJ45 (Recirculation Isolation Valve to SI Pumps) and 12(22)SJ45 (Chnrging Pumps Suction Isolation Valve).
Either valve SJ67 or SJ68 has to be in fully closed position before the SJ45 valves can be opened to establish flow to the suction of SI pumps and C/SI pumps during switchover.
Thus, an inadvertent transfer of contaminated containment sump water to the RWST is precluded.
Since valves SJ67 and SJ68 are not closed until the switchover to the recirculation phase, any accident
will have stabilized and therefore, it is not postulated that the Reactor Coolant System (RCS) pressure will rise requiring valve reopening.
Transfer to cold leg recirculation with RCS pressure above shutoff head of the SI pumps is not anticipated.
The control circuit design for these two minimum flow recirculation line isolation valves was also reviewed to determine if a single failure could inadvertently close either valve during the injection mode when the RCS pressure is greater than the shut-off head of the SI pumps.
The results of this review indicate that a malfunction of any one set of the contacts (i.e., a short circuit) would not cause the associated valve to close because of the lock-out feature in the control logic des ig n.
Only a double failure of the push-button contacts on the control console or the auxiliary relay contacts AND the power lock-out switch on panel RP4 would generate a spurious signal causing either valve to close.
Power to valves SJ67 and SJ68 is supplied from separate vital buses.
Additionally, there is physical separation and electrical independence between the control circuits for these valves.
The re fore, the single failure criterion identified in General Design Criterion (GDC) 35 is satisfied for the SI pumps.
A single failure associated with either of the two isolation valves, SJ67 and SJ68, will not affect the operation of the minimum flow recirculation line for the SI pumps.
2.
RESIDUAL HEAT REMOVAL PUMPS A separate minimum flow recirculation line (3-inch) containing a 2-inch motor-operated globe valve is provided for each of the two Residual Heat Removal (RHR) pumps.
Part of the pump discharge flow is recirculated from downstream of the RHR heat exchanger to the pump suction.
Power to the minimum flow recirculation line isolation valve, RH29, associated with each RHR pump is supplied from a separate vital bus.
During normal operation, the minimum flow recirculation line isolation valves are closed and their position is indicated in the control room.
Each valve has a MANUAL and AUTO mode of operation.
In the AUTO mode, valve RH29 is controlled by a flow controller in the discharge line from the associated pump.
The valve opens automatically when flow in the discharge line is less than 500 gpm and closes when the flow exceeds 1000 gpm.
In the MANUAL mode, the valve can be positioned from the OPEN - CLOSE pushbutton station in the control room.
Valve OFF - NORMAL position as well as loss of control voltage is alarmed in the auxiliary annunciator system.
At the time of switchover to the cold leg recirculation phase, RH29 controllers are placed in the MANUAL modo and closed by the operators in accordance with Emergency Operating Procedure EOP-LOCA-3.
Since there is no common minimum flow recirculation line for the RHR pumps and since there is physical separation and electrical independence between the power supplies to the two valves, a
a.
single failure resulting in a loss of minimum flow for one RHR pump will not affect the operation of the other RHR pump.
Tnerefore, at least one RHR train will be available to mitigate the consequences of a design basis accident following a single failure in the minimum flow recirculation line.
Hence, GDC 35 is satisfied for the RHR pumps.
3.
CHARGING / SAFETY INJECTION PUMPS The Charging / Safety Injection (C/SI) pumps have a common minimum flow recirculation line with two motor-operated valves installed in series (CV-139 and CV-140).
The recirculation flow is directed to the Volume Control Tank.
Valves CV-139 and CV-140 are normally open and operator action is required to close them during post-LOCA cooldown and depressurization in accordance with applicable emergency operating procedures.
The operating philosophy for the minimum flow recirculation line for these pumps was revised as a result of IE Compliance Bulletin No. 80-18.
Prior to Bulletin 80-18, valves CV-139 and CV-140 were closed automatically by the Safety Injection signal.
The concern identified in Bulletin 80-18 was a potential deadheading of the C/SI pumps due to isolation of minimum flow recirculation line on an SI signal resulting from a main steam line break with PORVs unavailable.
In response to Bulletin 80-18, the SI signal was removed from valves CV-139 and CV-140 and the operators were instructed to terminate recirculation flow through the line at an RCS pressure below 1500 psig and re-establish flow if the RCS pressure rose again to 2000 psig.
Emergency operating procedures were also revised for a small-break LOCA with no rapid RCS depressurization to require operator intervention to isolate the flow.
The effect of a diversion of some flow from core cooling on an SI signal was evaluated by Westinghouse and found to be well within acceptable peak cladding temperature limitations.
Since valves CV-139 and CV-140 are normally open during the injection mode and will fail "as-is" on loss of power, isolation of the minimum flow recirculation line will not occur as a result of loss of electrical or control power to either of these two valves.
However, since the control logic design for each valve is such that a contact failure in the control circuit causing a short circuit could generate a signal resulting in valve closure, this failure potential was reviewed.
At the start of an accident transient, valves CV-139 and CV-140 neither ree31ve an automatic control signal nor are they actuated by the operator until they are required to be closed, i.e. at a decreasing RCS pressure of 1500 psig.
As a first concern, the accident transient in which a Safety Injection occurs and is coupled with an increasing RCS pressure and the unavailability of both power-operated relief valves (PORVs) would result in the
~ o need for the minimum recirculation flow for the C/SI pumps.
Hence, any contact / cable f ailure in the control circuit of the minimum flow recirculation line valves which causes a short circuit and generates a valve closure signal would deadhead the C/SI pumps.
A second concern, following an intentional closure of the C/SI minimum flow recirculation line isolation valves on decreasing RCS pressure (1500 psig),
is a failure of one of these valves to subsequently reopen, as required, should the RCS be repressurized during the same accident (the operating procedures requires the valves to be reopened at 2000 psig).
However, this concern would only arise if the RCS pressure continued to rise above the PORV setpoint.
Theco two concerns are sufficiently mitigated as discussed in the justification for continued operation detailed below.
In justification for the continued operation of SGS, the following arguments are provided:
3 1.
A review of the operating history at SG6 identifies over 14 million valve-hours of operation for safety related motor operaced valves with no known failure in the control circuit of a valve which caused a spurious closure signal.
Hence the probability of this type of failure is considered extremely remote.
2.
The accident sequence under which the C/SI minimum flow recirculation line is needed requires an RCS pressure above the PORV setpoint and a failure of the PORV's themselves following safety injection initiation.
3.
Although the PORVs ara not environmentally qualified and hence credit cannot be taken for their operation, there is reasonable assurance that the PORV's can be expected to perform their relief f unction thereby reducing the concern over deadheading the C/SI pumps.
This is a justified expectation since the PORVs have Class lE control logic, are redundant and electrically independent and are provided with separate air accumulators to ensure high reliability.
Additionally, sufficient operator attention is already directed towards the PORVs (existing procedures require the PORV block valves to be opened on increasing RCS pressure at 2315 psig).that any abnormal situation would be recognized and corrected.
4.
The duration of any pressure transient above the PORV setpoint, assuming the PORVs are inoperable, is estimated at less than one hour, as shown in UFSAR Figure 15.4-60 (feedline break), after which the pressure would decrease to the point the C/SI pumps can discharge to the RCS.
5.
Valves CV-339 and CV-140 were reviewed as part of IE Bulletin No. 85-03.
The existing torque switch setpoints wore verified using MOVATs equipment for adequacy with 2670 psid differential pressure, corresponding to the C/SI pump shutoff head.
...6 6.
Should the RCS be restored normal pressure, the emergency operating procedures would instruct the operators to terminate Safety Injection.
By procedure and logic, the high-head C/SI pumps would be the first pumps returned to normal operation.
7.
Currently, Emergency Operating Procedures contain a continuous action requirement to open C/SI minimum recirculation valves at pressures above 2000 psig.
PSE&G is continuing to evaluate the corrective actions necessary to resolve this issue and will provide the results, recommendations and schedule for completion of any changes, if required, to the NRC by January 12, 1987 in accordance with the actions required by IE Compliance Bulletin 86-03.
CONCLUSION The minimum flow recirculation lines for RHR and SI oumps satisfy the single failure criterion.
Two concerns on the minimum flow recirculation line for the C/SI pumps were identified.
One concern is a failure of the controls for these valves which could cause a short circuit and initiate i
an inadvertent close signal (loss of control or electrical power to these motor-operated valves would not result in loss of recirculation).
Closure of these valves would only be a concern if the C/SI pumps are operating and the RCS pressure is above the PORV setpoint.
Since these valves do not receive an automatic closure signal nor are they required to be closed, a short circuit in the control logic causing one of the valves to close when the C/SI pumps are operating above PORV setpoint is considered so remote (see the 7 points discussed above) as not to pose a risk to plant safety.
A second concern involved a failure of one of these valves to re-open if the RCS pressure recovered and then exceeded the PORV setpoint.
This concern is addressed by procedures in place to limit the repressurization by opening PORV block valves that may have been closed and by requiring opening of the minimum recirculation valves, either action would prevent C/SI pump damage.
Therefore, the above items are sufficient to justify continued operation.
Long-term corrective actions will be provided to the NRC by January 12, 1987 to completely resolve the concerns raised above.
e..__-,-
g
-.,,...v.-.
---.---n-n