ML20236K784
Text
, nanee
- g UNITED STATES NUCLEAR REGULATORY COMMISSION J $
t wasmworow,o. c.zossa
\...., March 24, 1992 NOTE T0: Tom Dunning FROM: Chris Grimes t$ uAA
SUBJECT:
CONTROL ROD OPERABILITY & TECH SPEC POLICIES After reviewing your concerns regarding my decision and comments on control rod operability, I continue to believe that my decision was appropriate, that the reasoning for that decision is consistent with technical specification improvement policies, and that the continued concerns regarding this issue are largely semantic. Moreover, I do not believe that my decision constitutes a misapplication of operability policies and practices, as you suggested. The reasoning behind my decision will be documented in minutes of the March 18, 1992, meeting with the Owners Groups. Nevertheless, because of the continued staff concerns regarding this decision and continuing questions regarding operability determinations, I believe that it would be useful to elaborate on the reasoning of that decision in response to your comments.
First, operability, both within and outside the context of technical specifications, is a complex matter that should be evaluated on a case-specific basis. The NRC would not have required 26 pages of manual guidance and logic chart if that were not true. The NRC was compelled to create and issue Generic Letter 91-18 (guidance on assessing degraded conditions and making operability determinations) in order to clearly distinguish that -
degraded conditions do not necessarily equate to an inability to perform the safety function. That guidance provides the means for plant operators and NRC inspectors to make such decisions.
A fundamental principle of the guidance issued in Generic Letter 91-18 is the premise that determinations of operability for technical specifications
. depends on whether the affected equipment can perform its intended safety function. This principle is an explicit provision in the administrative program approved for the new STS: the Safety Function Determination Program.
The safety function of the equipment is explained principally in the technical specification Bases,' further in the updated Final' Safety Analysis Report, and subsequently in other documents that constitute the Current Licensing Basis (as that term is defined in the operability guidance and Part 54). Further, this relationship between the limiting conditions, Bases, and licensing basis is completely consistent with 10 CFR 50.36.
Similarly, 50.36 provides that technical specifications will establish limiting conditions for plant operation which "are the lowest functional capability or performance levels of equipment required for safe operation of the facility." Technical specifications generally do not regulate defense-in-depth features of the design or " good practices." One of the improvements to the new STS has been a simplification of the LCO statements, and greater detail in the Bases to explain the lowest functional capabilities that constitute operability for the intended safety function. In most of these
~
9007100079 980624 PDR FOIA UNNE3tST98-155 PDR _
/s v / / 000 / /
e
- p. 2 cases, the equipment likely has broader capabilities which are not controlled by technical specifications.
Specifically with respect to control rods, the safety function that is controlled by the technical specification is its ability to scram the reactor, otherwise referred to by the ters-of-art "trippability." This was evident in the staff's original position (attached) which concluded that the required actions could distinguish trippability, so long as shutdown margins could be ensured. The extent to which control rods effect flux distribution and safe core configuration are controlled by limits on rod group alignment, axial flux tilt, and peaking factors; thus, NRR management concluded on February 5,1992, there is no need to establish additional requirements on the control rods because of immovability.
As a result, the focus of the safety requirements revolved around the extent ,
. to which there was a separate need to demonstrate movability, in addition to '
and apart from trippability. During the Executive meeting on February 5, ,
1992, Mr. Russell agreed that the safety function could be ensured by an i affirmative determination that the control rods are trippable. There was no '
indication at that time that any other aspect of immovable control rods constituted a functional capability or performance level required for safe operation; consequently, there was no basis to require an action or completion time for control rods that are imovable but otherwise determined to be trippable.
At'the Executive meeting, the Owners Groups committed that, even if trippability could be demonstrated for a control rod that is immovable during quarterly surveillance testing, the utility would restore movability. This comitment raised the apparent dichotomy between a required action for trippability when control rods are " inoperable" and the comitted action for a failed surveillance to restore movability. The staff concluded that, based on the corrective action for surveillance, immovable control rods would always have to be corrected by application of SR 3.0.1, which states:
" Failure to meet a Surveillance, whether such failure is experienced during performance of the Surveillance or between performances of the l surveillance, shall be failure to meet the LCO."
l This provision is a means to require that licensees enter the applicable LCOs when degraded equipment is identified. However, even this provision is not ;
I inclusive, since many surveillance practices cannot test the full range of equipment performance. The Owners Groups noted that entry into the control rod LCO would compel a determination of whether the control rod is trippable, in order to take the required action, while an imovable control rod would have to be otherwise corrected in order to complete the surveillance within the required surveillance interval. The Owners explanation of this distinction between the required action for the LCO and the required action for an incomplete surveillance seems appropriate and consistent to me.
In your comments on the control rod operability issue, you note several ways to modify staff positions on operability and technical specification policies L - - - - - - - - - - _ _ _ - . ---- _ _ _ - - - - - - - _ - _ _
6 I* Failures in the rod control system can result in more than one control rod being imovable without affecting the capability to insert the control rods on a reactor trip. However, current technical specifications require the licensee to shut down the plant if more than one control rod becomes inoperable. The actions that permit continued operation when one rod becomes inoperable specify that the cause must not result in the rod being untripp-able; however, the current technical specifications do not provide a time limit to does notallow resultthe in licensee to confirm the rod being that cause of an imovable control rod untrippable.
l Consequently, the staff has concluded that, in view of the principal safety function of the control rods, the current technical specification requirements may impose unnecessary shutdown requirements if:
1.
One or more control rods are imovable and the safety significance of this condition can be minimized by confirming that adequate shutdown margin exists and by moving control rods to satisfy the alignment requirements.
2.
The licensee does not know the cause for control rods being imovable and can not immediately demonstrate that the affected control rods are still trippable.
Therefore, to address these problems with the current requirements, the staff is developing a proposed generic action which would include appropriate char <ges in action requirements to address the condition when more than one control rod becomes imovable or misaligned, and the rods can not be restored to operable status within the alignment requirements within I hour. The contemplated changes to the action requirements have been derived from recent license amendment applications that the staff found acceptable, and include
, the following provisions:
1.
Add an action requirement, as a condition for continued operation with imovable control rods, to verify within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> that the rods are imovable because of a problem with the rod control system or rod drive mechanism excluding the control rod holding mechanism, which must function to insert control rods on a reactor trip.
2.
Add an action requirement to restore at least all but one control rod to operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.
The NRC staff has concluded that the licensee should assume at least one of the imovable control rods to be untrippable until the licensee has returned all* control rods to an operable status and verified that they are free to move.
The staff modified the action requirements to exclude the reactivity worth of the imovable rod with the highest worth during this time when verifying that the shutdown margin requirement is met. Problems with the rod control system may render more than one rod imovable, and operating experience has demonstrated that even one stuck rod is a rare occurrence.
Thus, the staff has concluded that only one imovable rod needs to be excluded from consideration when verifying that the shutdown margin is met and it should be that imovable rod which has the highest reactivity worth. However, excluding the imovable rod with the highest worth does not negate the
q- .
7, Enclosure CONTROL ROD OPERABILITY The NRC staff considers operability of a control rod to consist of the following three conditions: (1) the freedom of the rod to move, (2) the ability to release the rod by de-energizing its holding coil on a reactor trip, and (3) the ability to move the rod in either direction one step at a time by the rod control system. The first two conditions are essential to the capability to insert all control rods on a reactor trip to promptly shut down the reactor. The first and last are essential to the capability to position the rods to control reactor power and satisfy the alignment requirements during startup, shutdown, and steady state operation. Accordingly, the staff considers a control rod is inoperable when it does not have 'any one of these capabilities and it is untrippable, immovable, or both.
However, the staff also recognizes that a number of conditions can cause a control rod to become imovable:
- The most probable cause for an imovable control rod is a failure in the rod control drive system. The likelihood of a control system failure as a cause for imovable control rods increases with the number of imovable control rods that are encountered. Failures in the rod control system that are not alarmed are usually found when changing reactor power or surveillance testing control rods to verify that they are free to move and are trippable.
- Immovable control rods could be a consequence of excessive friction or mechanical interference. Operating experience has shown that excessive friction or mechanical interference is not very comon. During plant operation, however, this cause must be deduced because it is impossible to confirm that this is the cause for an imovable control rod.
Current standard technical specifications include a provision that allows continued operation with one control rod inoperable or misaligned. The draft new standard technical specifications similarly include required actions with "one or more CEAs inoperable but aligned and trippable." Continued operation is justified if the control rod did not become immovable because of excessive friction or mechanical interference or the rod is not otherwise known to be untrippable. This determination is currently derived from a conclusion that the control rod is inoperable because of a failure in the control rod drive systes. The minimum conditions that currently must be met for continued operation are: (1) the alignment requirement, that is met by moving the remaining rods in the group, and (2) the control rod is declared inoperable and the shutdown margin requirement is determined to be met. The control rod is declared inoperable to exclude its reactivity worth from the shutdown I margin determination since an imovable rod would also be inoperable. The I action requirement also specifies that the licensee shall verify that the shutdown margin is met, at least once every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, and move the remaining rods so that the alignment requirement is met so as to maintain the control rod sequence, insertion, and overlap limits.
l l
1
e Failures in the rod control system can result in more than one control rod being imovable without affecting the capability to insert the control rods on a reactor trip. However, current technical specifications require the licensee to shut down the plant if more than one control rod becomes inoperable. The actions that permit continued operation when one rod becomes inoperable specify that the cause must not result in the rod being untripp-able; however, the current technical specifications do not provide a time limit to allow the licensee to confirm that cause of an immovable control rod does not result in the rod being untrippable.
i Consequently, the staff has concluded that, in view of the principal safety function of the control rods, the current technical specification requirements may impm unnecessary shutdown requirements if:
- 1. One or more control rods are imovable and the safety significance of this condition can be minimized by confirming that adequate shutdown margin exists and by moving control rods to satisfy the alignment requirements.
- 2. The licensee does not know the cause for control rods being immovable and can not immediately demonstrate that the affected control rods are still trippable.
Therefore, to address these problems with the current requirements, the staff is developing a proposed generic action which would include appropriate changes in action requirements to address the condition when more than one control rod becomes immovable or misaligned, and the rods can not be restored to operable status within the alignment requirements within I hour. The conternplated changes to the action requirements have been derived from recent license amendment applications that the staff found acceptable, and include the following provisions:
- 1. Add an action requirement, as a condition for continued operation with immovable control rods, to verify within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> that the rods are imovable because of a problem with the rod control system or rod drive mechanism excluding the control rod holding mechanism, which must function to insert control rods on a reactor trip.
- 2. Add an action requirement to restore at least all but one control rod to operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.
The NRC staff has concluded that the licensee shou'ld assume at least one of the immovable control rods to be untrippable until the licensee has returned all control rods to an operable status and verified that they are free to move. The staff modified the action requirements to exclude the reactivity worth of the immovable rod with the highest worth during this time when verifying that the shutdown margin requirement is met. Problems with the rod control system may render more than one rod immovable, and operating experience has demonstrated that even one stuck rod is a rare occurrence.
Thus, the staff has concluded that only one immovable rod needs to be excluded from consideration when verifying that the shutdown margin is met and it should be that immovable rod which has the highest reactivity worth. However, excluding the immovable rod with the highest worth does not negate the I IP' ' '
- - -w , , _
, separate requirement to exclude the control rod of highest reactivity worth that is assumed to be fully withdrawn as stated in the technical specification definition of shutdown margin.
The proposed actions would require that the unit be placed in hot standby when the licensee can not verify, within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, that one or more controls are I immovable because of a problem in the rod control system or rod drive mechanism excluding the rod holding mechanism. In this instance, the licensee might attribute the cause to be excessive friction or mechanical interference.
However, the licensee does not have a means to confirm that this is the cause for a rod becoming immovable during plant operation. Therefore, the staff has proposed to remove the excessive friction and mechanical interference as a limiting condition for untrippable control rods; unless the licensee could
- ' identify this condition, for example, by determining that a control rod remained withdrawn when its holding coil was de-energized.
If a rod is immovable, the licensee would be unable to move it to demonstrate that it is free to move,, Thus, failing to perform this surveillance would nermally constitute a failure to satisfy the operability requiremen.ts of the.
LCO and invoke the action requirement to place the unit in hot standby within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. However, specification 4.0.3 specifies that the licensee need not perform surveillance requirements on inoperable equipment. To avoid any misunderstanding, the staff would modify the action requirement that permits continued operation with one immovable rod to clarify that the sur-veillance requirement for verifying that the rod is frd to move does not apply.
O e
l l
i OPERABLE - Don't afsapply it!
OPERABLE - A term used to specify a requirement for an item (system, train, channel, component, or device) in a Limiting Conditions for Operation or in a Surveillance Requirement.
The term is defined such an item is OPERABLE when it is capable of performing its specified function (s) and when all necessary supporting systems or compon-ents required for that item to perform its function (s)-are also capable of perfo ming their related support functions (s).
Exam; 'e: An LCO specifies that System X shall be OPERABLE.
Thus, the LCO is met when System X is ca;,able of performing its specified function (s).
The NRC documented the staff's position as to what defines the "specified function (s)" of an item that is specified to be OPERABLE in a Technical Specification in the enclosure to Generic Letter 91-18: NRC Inspection Manual, Part 9900: Technical Guidance, " Operable / operability: Ensuring the Functional Capability of a System or Component." Section 3.3, "Specified Function (s),"
of that guidance includes the following statement:
The definition of operability refers to capability to perform the "specified functions." The specified function (s) of the system, subsystem, train, component, or device (hereafter referred to as system) is that specified safety function (s) in the current licensing basis for the facility.
In addition to providing the specified safety function, a system is expected to perform as designed, tested and maintained. When system capability is degraded to a point where it cannot perform with reasonable assurance or reliability, the system should be judged inoperable, even if at this instantaneous point in time the system could provide the specified safety function.
9 Another section, 2.1, " Current Licensing Basis," addresses this topic in the following statenant:
Current licensing basis (CLB) is the set of NRC requirements applicable to a specific plant, and a licensee's written commitments for assuring compliance with and operation within applicable NRC requirements and the plant-specific design basis (including all modifications and additions to such commitments over the life of the license) that are docketed and in effect. It also includes the plant-specific design basis information defined in 10 CFR 50.2 as documented in the most recent Final Safety Analysis Report (FSAR) as required by 10 CFR 50.71 and the licensee's commitments remaining in effect that were made in docketed licensing correspondence such as licensee responses to NRC bulletins, generic letters, and enforcement actions, as well as licensee commitments documented in NRC safety evaluations or licensee event reports.
For existing plant TS requirements, the use of the term " safety" to describe those functions specified in the current licensing basis in Section 3.3 of the noted guidance should be taken in a broad context of having an affect on safety rather than in the context of specific functions that are described as safety function. For example, plant TS include requirements for fire protection systems which are not classified as safety-related systems nor are y
these systems described a performing safety functions, never the less these the capability of fire protection systems to perform their described functions do have an affect on plant safety.
For the new STS, the Commission Policy Statement established specific criteria j that narrows the focus for requirements that should be included in TS. If it I is desired to likewise limit the scope of "specified functions" for which systems and components must be capable of performing to satisfy the definition of OPERABILITY as stated in the new STS, then it should be changed to reflect that limited scope. For example, the following statement could be appended to the existing statement of this definition:
The specified function (s) of a system, train, component, or device are those safety functions which are defined by the current licensing basis that are necessary to satisfy the purpose of the Criterion upon which an OPERABILITY requirement exists, as defined in the Commission's Policy Statement on Technical Specification Improvements, see FR , or that are necessary to perform a function that is retained in the STS on the basis of risk, as stated in that Policy Statement.
Thus, if the FSAR addresses multiple capabilities of systems, the TS OPERABIL-ITY requirements would only include the capability to perform those specified safety functions that are aecessary to satisfy the purpose of the criteria that captured that TS requirement or retained that TS requirement on the basis of risk. (The criteria did not capture TS requirements for systems for normal shutdown decay heat removal, however requirements for residual heat removal were retained on the basis of risk.) However, it is not recommended that this
, addition to the definition of operability be made, although licensees would probably like to have it. This narrows the focus of the new STS not only from the standpoint of what systems are included but also what functions performed by those syste:as are included. If such were done, it is expected that there may be a number of system functions that contribute to the principle of
" Defense in Depth" and that are covered by current TS which might not be captured by a narrower focus on specified functions as provided by noted modification of the definition of operability.
With respect to control rods, if the new STS specifies that the control rods shall be OPERABLE and aligned, one is still faced with the use of the current licensing basis to determine what functions the rods must be capable of performing. While FSARs probably would not address the movement of control rods during startup, power operation to adjust power level, or shutdown as a
" safety" function, it probably addresses the fact that the design of the rod control system assures that the rods will be moved in a manner that assures that there is overlap between different rod banks and maintains their alignment. (Features which have an affect on safe operationi) Because there is an alignment requirement associated with the rod operability requirement, there is a rational basis to conclude that the latter includes the capability to move rods and, hence, comply with the former, not withstanding the fact i
r'
,, that the current licensing basis probably does not explicitly state whether moving rods by the rod control system is or is not a safety function. Thus, it is not unreasonable to conclude that the intent of the rod operability requirement is to assure the capability to align the rods. Clearly, this is the intent of current STS when one examines the actions that are specified to be met when the rods are inoperable.
However, the new STS can avoid this problem with control rod operability if the LC0 simply states that the control rods shall be "trippable" instead of OPERABLE. To say that this problem is merely a matter of semantics is a gross over simplification and contrary to existing guidance on the staff's position on the proper application of the definition of operability. If this is simply a matter of semantics that only needs to be clarified in the Bases Section of the STS, then the following should be added to the existing statement of the definition of OPERABLE:
...when it is capable of performing its specified functions unless defined otherwise in the Bases Section of any specification. and....
However, this is contrary to the intent of 10 CFR 50.36 that the Bases "shall not become a part of the technical specifications" and is not a practical solution.
Because the intent of change in the control rod specification in the new STS is to remove the rod control system and associated movability of the rods from the LCO, it make sense to change the LCO to simply state that the rod shall be trippable (period). Put the alignment requirement in the spec that includes the insertion limits. The new STS should include a control rod TS that anyone can understand and apply without being a contortionist. But if one takes the approach that it doesn't matter what the words say because you can always define them any way you wish, the question remains as to why one does not say what one means in the first place. If the term OPERABILITY does not convey the requirement that one wishes to make, don't use it, and certainly don't abuse it.
Finally, if there is any existing problem with the current definition of operability and it being misapplied to impose requirements on features of .
systems that are only used to test a system, as implied by the owners group, )
that problem should be fixed now rather than put it off as something the new 1 STS will fix. However, it is not clear that such problem exists. 1 What the discussions with the owners group do not reveal is the hidden agenda i of other TS for.which they apparently feel would also have to be fixed, if one admitts to the fact that the current proposed control rod TS should be fixed to make it clearly state what is required, rather than having the luxury of being.able to apply an operability requirement as they see fit and not as established by NRC policy noted above.
_ _ - . . _ _ _ _ - _ _ - - _ _ _ _ _ _ _ _ -