ML20236P820

Safety Evaluation Approving Request to Retain RHR Svc Water Process Radiation Monitors

ML20236P820
Person / Time
Site:	Limerick
Issue date:	08/07/1987
From:	Office of Nuclear Reactor Regulation
To:
Shared Package
ML20236P818	List: ML20236P815 ML20236P820
References
NUDOCS 8708130069
Download: ML20236P820 (7)

Text

_ _ _ _ _ _ _

, SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RESIDIVAL HEAT REMOVAL SERVICE WATER RADIATION MONITORS PHILADELPHIA ELECTRIC COMPANY LIMERICK GENERATING STATION, UNIT 1 DOCKET N0. 50-352

1.0 INTRODUCTION

By letter dated July 31, 1987, , Philadelphia Electric Company (PECo or the licensee) requested approval to revise a previous commitment to replace the process radiation monitors in the residual heat removal service water system with monitors that are seismically, dynamically and environmentally qualified. Prior to startup of Limerick Unit 1, an NRC Seismic Qualification Review Team (SQRT) had performed an audit and had concluded that documentation was adequate to demonstrate e qualification except for the process radiation monitors (PRMs)quipment in the residual heat removal service water (RHRSW) system. For the latter, PEco submitted by letter dated September 6,1984, justification for interim operation (JIO) pending confirmation of the seismic and dynamic qualification of the PRMs. The staff accepted the JI0s (Supplement 3 of NUREG-0991,Section3.10.1). During the current refueling outage, PECo installed a new line of General Electric Company (GE) PRMs that are documented to be fully seismically and environmentally qualified. Upon testing the new instrumentation, major operating programs were identified that the manufacturer estimates will take at least two to three months to resolve. In the meantime, PECo is reinstalling the PRMs that were used in Cycle 1 operation. The latter are fully qualified except for seismic qualification of the log count rate meters (LCRMs) which are located in the auxilliary control room. In the letter of July 31, 1987 PECo presented justification (JI0s) for operating with the orioinal PRMs for one more fuel cycle. PEco's plan of action is resolve the operating problems with GE in a test loop and - assuming the operating problems are resolved-reinstall the new line of PRMs during the next refueling outage.

Upon receiving the request, the NRC staff decided to step back and assess what is the broad effect of the subject PRMs on plant safety and public health and safety - and not for just one more fuel cycle. As will be discussed below, our conclusion is that from a public health and safety standpoint, there is no need to have the RHRSW PRMs seismically qualified. From the standpoint of plant safety, the automatic termination of shutdown cooling has both benefits and disadvantages; on balance, it would be worthwhile for the licensee to reassess this arrangement - which is unique for BWR-4's.

8708130069 870007 PDR ADOCK 0500035p P PDR

i 2.0 EVALUATION i The residual heat removal service water (RHRSW) system for Limerick Units 1 and 2 is designed to supply cooling water to the residual heat removal (RHR) heat exchangers of both units. If necessary; the system also provides water to flood the reactor core or to spray the primary containment after an accident. It can also be used in conjunction with i the RHR system suppression pool cooling mode to maintain the suppression pool below specified temperature limits.

. The RHRSW system is described in Section 9.2.3 of the FSAR and shown on the attached figure. The system is common to the two reactor units, and consists of two loops. Each loop services one RHR heat exchanger in each unit, and provides sufficient cooling for safe shutdown, cooling, and accident mitigation of both units. The two RHRSW system return loops are cross-connected for flexibility. Two valves in series are provided on the cross-connect, so failure in one loop cannot affect the operation of the other. Each loop has two pumps located in the spray pond pump structure. One pump supplies 100% flow to one RHR heat exchanger.

During two-unit operation, there are two heat exchangers (one per unit),

and therefore, two of the four pumps are required for safe shutdown and accident mitigation.

Ordinarily, the RHRSW does not operate during normal power generation.

It is normally used after the plant is shutdown (i.e., cooled down to about 212*F using the condenser as a heat sink and depressurized to about atmospheric pressure) to remove decay heat and thus maintain the plant in a cold shutdown condition.

As discussed above, and as shown on the drawing attached, the RHRSW pumps take suction from the spray pond, circulate it through the tube side of the RHR heat exchanges and return the water to the spray pond. Both loops of the Emergency Service Water (ESW) system discharge into the RHRSW lines to the spray pond (i.e., the RHRSW and the return from the corresponding ESW loop share a common return header to the spray pond).

Safety-related components (including supporting structures) of the RHRSW system are designed to seismic Category I requirements. The RHRSW system, with the exception of the buried piping and the piping in the spray pond, is housed within either the reactor enclosure or spray pond pump structure, both of which are designed to seismic Category I requirements.

The RHRSW system is a relatively low pressure system. The four pumps are each rated for a 9000 gpm flow at 240 foot total dynamic head. Thus, there is a positive differential pressure between the primary coolant on the shell si d of the RHR heat exchanges and the service water in the tubes, such that if there were a leaking tube, leakage would be into the service water. The spray pond is essentially a closed system, with

. 4 minimum blowdown. It is chemically treated with various inhibitors and biocides to minimize general corrosion and biological growths in the RHRSW and ESW systems. The positive differential pressure in the RHR heat exchangers reduces the potential for introducing these chemicals into the primary coolant if there is a leaking tube. On the other hand, if there is a leaking tube, radioactivity in the coolant will be introduced into '

the RHRSW system. To detect possible leakage, a small sidestream of RHRSW from downstream of each RHR heat exchanger is piped to a sampling station (located in the diesel generators building). The continuously flowing sample is monitored by an inline radiation monitor.

Periodically, samples of the RHRSW are withdrawn for chemical and radiochemical analyses. There is a similar sampling station on each of the return lines to the spray pond, taking a continuous sample of the combined RHRSW and ESW. The latter also includes an in-line process radiation monitor.

In most operating BWR-4s (such as the Browns Ferry and Peach Bottom units which do not have natural draft cooling towers as at Limerick), the RHR$W is pumped from the river through the RHR heat exchangers and back to the river. There is a process radiation monitor on the discharge line from the RHR heat exchargers which alarms in the control room when radioactivity is detected in the effluent. The control room operator can manually shut off one train of RHR heat exchangers and switch to the alternate train (if available) while the magnitude of the leak is being verified. This arrangement has worked very well. While there have been a number of leaks in RHR heat exchangers, there have been no significant releases of radioactivity to the environment.

In contrast to the above, at Limerick, the RHRSW discharges to a closed system, so that any radioactivity entering the system would not be directly discharged to the environment. Even if the RHRSW discharge is routed to the cooling tower basin - which is an alternative to using the spray pond - the discharge is to an essentially closed system and not directiy to the environment. Limerick is unique in that the RHRSW process radiation monitors (PRMs) not only alarm in the control room but automatically shut-off flow. Upon detection of radioactivity in the line, the PRMs downstream of each heat exchanger automatically initiate closing of the inlet valve to the heat exchanger and within 15 seconds after the inlet valve is fully closed, initiates closure of the discharge valve. The PRM on the RHRSW/ESW return line to the spray pond automatically stops the RHRSW pumps in that loop upon detection of significant radioactivity. This arrangement minimizes potential contamination of the spray pond (or cooling tower basin) but it can also shutoff shutdown cooling. As discussed in the FSAR (Table 9.2-6), a failure of a PRM can also shutoff shutdown cooling, since the valves are designed to fail-safe in a closed position. Prolonged loss of shutdown cooling could cause a safety problem - particularly for the first few hours after shutdown. If the shutdown and isolation of one, or both, RHRSW systems results from false high radiation level PRM trip signals,

. the operator can manually bypass the signals and reopen the RHRSW isoittion valves and restart the RHRSW supply pump (s). With the number and location of the PRMs the operator should be able to evaluate whether there actually is a leak in an RHR heat exchanger without waiting for confirmatory sample analysis.

While the probable action (if radioactivity is detected in one loop) would be to switch to the alternate train, this might not be available due to required surveillance tests or maintenance. For example, the ASME Code and the TSs require quarterly surveillance tests of all pumps and valves in a system. During outages, redundant trains are alternately taken out of service for preventative maintenance. In any case, it was a licensee decision, and not an NRC requirement, to have the PRMs initiate automatic shutdown of the RHRSW system.

i As noted above, the RHRSW system is designed to seismic Category I requirements. The licensee apparently interpreted Appendix 11.5-A of the Standard Review Plan (" Design Guidance for Radiological Effluent Monitors Providing Signals For Initiating Termination of Flow Or Other Modification of Effluent Stream Properties") as indicating that the PRMs on the RHRSW system should be designed and qualified to criteria consistent with those of the actuated system. Section 9.2.3.2 of the FSAR discusses the functions of the RHRSW process radiation monitors but does not state whether or not they would be seismically qualified. However, the automatic termination of RHRSW flow on the basis of radioactivity is not necessary to mitigate the consequences of a design basis accident since the RHRSW system does not come into operation until after the plant is shutdown. Automatic termination of flow is also not necessary to maintain offsite doses within prescribed limits since the flow is within an essentially closed system.

Other BWRs, with RHRSW systems that discharge directly to the environment and without automatic termination of flow, have had leaks in the RHR heat exchangers and have maintained radioactive releases well within prescribed limits.

3.0 EVALUATION The licensee requested relief from a commitment made in a September 6, 1984 letter to seismically qualify the RHRSW PRMs during the first refueling outage of Limerick Unit 1. The specific request was to extend the time to accomplish this until the second refueling outage. We have evaluated this request and concluded:

1. The purpose of the PRM's is to detect possible radioactive leakage into the RHRSW system through the RHR heat exchangers or the ESW pump seal cooler.

2. As stated by the licensee, the PRMs are not required to mitigate the consequences of a Design Bases Accident.

I

=

3. Automatic termination of flow in the RHRSW system by the PRMs is not l necessary to maintain offsite doses within prescribed limits either during normal operation or following a postulated accident. Sufficient time is available for operator action to manually stop flows.

4. The RHR heat exchangers and RHR pump seal coolers are seismically qualified; therefore, it is unlikely that a safe shutdown earthquake (SSE) would result in tube failure.

5. The major cause of leakage in RHR heat exchangers in other BWRs has been due to corrosion, particularly bacterial and biological induced corrosion from the mud, slime and silt in the river water. Our review of water chemistry results at Limerick disclosed that PEC0 has been maintaining rersonably good pH and inhibitor control, which significantly reduces the corrosion potential.

6. In 1986 and up to shutdown for refueling on May 15, 1087, Limerick Unit 1 operated for over 300 days with only one 3 day shutdown to repair a steam leak (84.7% availability). When a unit is at power, the RHRSW system is not in use and the seismic qualification of the RHRSW PRMs is not important to safe operation. The RHRSW system is critical to plant safety when the unit is shutdown. With the automatic termination of flow provision - which is a Limerick unique design - a failure (fails high) of a PRM in a seismic event would result in closure of the associated valve or stoppage of the associated pump. If the seismic event caused leakage in an RHR heat exchanger - which we consider unlikely - the automatic termination would prevent possible contamination of water in the cooling tower basins or spray pond. On the other hand, the automatic termination of RHRSW would cause loss of shutdown cooling. The operator can manually bypass the signals and restore shutdown cooling. However, it takes more personnel and time to reopen valves, restart pumps and align a system for operation than for an operator to remotely close a valve and shut down a system. If there was an unusual event (e.g., seismic event), there would likely be other plant systems affected other than the RHRSW PRMs and thus competition for operator attention. From the standpoint of plant safety, the automatic termination of shutdown cooling has both benefits and disadvantages.

7. There is no NRC requirement that the RHRSW PRMs be seismically qualified, although it is a desirable feature to preclude possible failure of the electronic circuity if there were a SSE because of the resultant loss of shutdown cooling capability. It is more important that the monitors accurately and reliability measure radioactivity in the RHRSW, since failures in the instruments result in " fail-safe" termination of shutdown cooling. The monitors in place during Cycle 1 performed their primary function reliably.

However, since the electronics package apparently could not be seismically qualified, GE is discontinuing manufacture of this a

monitor (which could pose a problem with space parts in the future) and replacing the line with the new "NUMAC" (Nuclear Measurement Analysis and Control) line of instruments. The installatier of the monitors at timerick during t;#e current outage was the first inservice test of the new product line. While the new instruments ,

were seismically qualified, multiple hardware and software problems turned up in the inplace checkout of the equipment (3 circuit board failures, wiring errors, design errors, recorder of rset, inadequate voltage to the solenoid which opens the check source window, four returns for major rework and modifications, mounting mechanism palls not engaging sufficiently, ordinary plant noise generatirg false trips, input parameters not consistent with output parameters, (etc.,

etc.). In view of the problems, we concur with the licensee's decision to not use the new PRMs until reliability has been demonstrated.

3

8. We have reviewed the justifications for interim operation (JI0s) presented by the licensee and find them valid and acceptable. The only item of equipment for which documentation is not available (to support seismic qualification) is the LCRMs in the PRM circuitry.

The staff believes that the probability of a system failure associated with the LCRM is low enough to justify the safe interim operation of Limerick Unit I through another fuel cycle.

4.0 CONCLUSION

The licensee has presented acceptable justification for safe operation of Limerick Unit 1 in Cycle 2, even though there is not documentation available to certify that the Log Count Rate Meters in the RHRSW process radiation monitor circuits are seismically qualified. The licensee's request to modify a prior commitment should be approved.

Principal Contributor: R. Clark Dated:

E  ::

>: A E .

- l .-E ar ll

• E v <e w k If

!!l 10l8lilj!IjI,II:iN,e;jp,

,g. 8 ...s i

,p!

g. 'lli',

in.. i ljibk ,I9'

$.5,<5E..g

$E !!

E8 W -

h

!' <; 3,-l h h. iiq  !  ! .i 4 e  !! I " '

O< bl.+ i[4 i".. . .i. 9 e -.--

a, .;  :

c-t ....4.,io..

I yn. .;,

, i.u

. i,i g.

. . ,g6,, .

-n i

.r  : ; .

- l gI .i ,ji ti,3,ltrlQ$ . . i.P'dg . ..

i

fM1,4 T t--- -- -j. 5 I i -" E

n I l :n. ~ **411. iui 'dWi. u rh,

.-;n ['i:, li -

li.!fli * *,

t Eag i

4,l ,, f[ , el

.; ,q. -

I

.r. f f Il i, QSc. o r

l W:

l , .

j m,.j : -

.p.,, . . e,7 , , ,. I

(--f;;t c't; p n  :. 4 -

.,m . .

'j

./ ;4 ',' s gl l1ll l '

Es  : s fM

! r~d l. l lp [ -

fd > -e ! [ Q g ~'5l' ,U lf $N,.. ,M'A  ! '

~

T,T!!i m, . , gNj,,rt y' r,t@j.m '

j s *

!. iI ' ~*"-"o t'--_ --'

n %e5 d

'i- . - ..g. . .g[

l,:

h, . it*;--- 8, ,t'fCi; 6 . . s ,i , o; I p .

4:.,

l :+ & 4' g t : ----- . ,.i

)ll

l i ,'

t e s ,. , . , , =* 3.l . .: 1 'q  %

j"*",b,+,I~

l l ! I t' I, $  ; b, ~

g'yp m-

["'

i y

, a -

i . , .l;ll '*; ; * ~ ! 3

. ., ,  !!; w!

,- - ~ f ;ll-! : D ; { , j j L.. 07  ;} j f f't ,.:q --

p..

g  ; ,;., .. n, t,:-"p.-K e_ , -

g..: .g. 4 i4 _

-- g!..j;j@! ! ; 1 - -

.:is  :

M ca6 Fap ..i g.)j I / h e

j [ , 1

.In, !s!! , .

--- 4 f l 80J~ l.g,sJ..g4lj'&

GO., u. lbN. Fhy 4

lE ..

g ";e :!,g; a s.s.IM. I:

J,. .

n- r""*'.-

e<

. r . .. r . ' ' * *-

t s' 4@ s mm ja ] g i

l l ll .f s ,

i, 7h k {

g....p- d ' # % %. 4 8[ ,1 6 i ... d r.! 8 W i.i llI ,.: q

.dg,::

l :.

.* : .q y. '

s:

r4 .u s s :Ii l pJ _tg lA--

,rm g, .g',. L,#,, go y:rw:: , , .

. . . p, .. ,:: t@  : :. , , a. -

<r  ;

~ ~

.... ) ,' !I [ ,,

. .! i;

' Q- .

llr;. C -- .,:. ,1,.l

.i . . ,h.98 + H3._ _$

@ r. u{.<...' .. TE...

,,  : y ~

l E ' +

• kb[b #

6 I -  !

f ' J_ . h g

,I  ; d I' p' b ; ~ - - ; g t.:,5 >!.!i! .) jif.4 "M ~" %. )

HH {i N i- .

• !, 3r E': 4g.  !,

D 3.: :.: .

.%,.% ,. l i- :, ......a.

!!a. 3t 4

,i ll .. - ,

~jg ._ h 1 '

%,.::, u :y. (*g. j g g,a4 ll ---

--- e

... d. d,.ar '

t...:,:.lStjNiijj N -

.l ll l:ln_: -- o. ;-[$ e

,t,y diI h ,ll 9ik. .n

..;.  : e a . l . .  %

• r 4 ...... .%y ; l i

-- j.y '

3 ,. Ti':i. -ll s. d }p>g. ,

i '

i ll.y.-..

Lc D o

. .. sa;' , '

(J.g, ;>*JA .. ..

r ,, ll 'g gO ,i gj

!jNA,i _ , T r h,l _.N n } e;'4,* 4-a: M ; - . ti!!!e: ,.lh: 7'4...p*dJ

! i h,.. -

, p .

vt l

, ., . .. . ; , , . y1 g,. [,: . g.

• gA*(l "f gi T ,t; g g r. . .

' ' ' . . . . . . . . . . . p8

'g y...lh l l 61 J . . g.-

m , u; "F'- g _,,1. l; $..16g,.

i.e..[' .; ,3 q .;;;

. c. g. c.~_ s,;.

g _

l  : 214

• d a; lh; I ,,

/ y.I

-;*f-(,p 5.G #

4-- ~~m 91. i kr $ i .;Q ag;',

l

' 3 3 Il 33 3.11 lI ilH lg 2 k Ji

== ,='c;' , l Ni  !! l l[y**=* *

- i . i 3 = I e I

• I =

y ,,, o I .

n..

k $ h b b ab d 5 "E t*'is A

$ ?- ***R s  ::8 h ii d;; * . .