ML23114A067
| ML23114A067 | |
| Person / Time | |
|---|---|
| Site: | Harris  |
| Issue date: | 04/26/2023 |
| From: | Duke Energy |
| To: | Office of Nuclear Reactor Regulation |
| Mahoney M | |
| References | |
| EPID L-2023-LRM-0027 | |
| Download: ML23114A067 (1) | |
Text
Duke Energy Pre-submittal Meeting April 26, 2023
Pre-Submittal Meeting License Amendment Request Utilizing the Risk-Informed Process for Evaluations (RIPE) to Address Independence of Turbine Control System and Reactor Protection System Circuitry Shearon Harris Nuclear Power Plant (HNP) 2 2
Duke Energy Attendees Ryan Treadway (Manager, Nuclear Fleet Licensing)
Dennis Earp (Nuclear Fleet Licensing)
Heather Szews (Manager, Probabilistic Risk Assessment)
Andrew Lipetzky (Probabilistic Risk Assessment)
Brian Mayall (Manager, HNP Engineering)
Nick Martinelli (HNP Engineering) 3 3
Agenda Issue Description System Design and Operation Current Licensing Basis Application of the RIPE Process PRA Analysis PRA Results Precedent Schedule 4
Issue Description Received a green non-cited violation of 10 CFR 50 Appendix B, Criterion III, Design Control for Treatment of Class 1E Interfaces and Interlocks with the Turbine Trip System (TTS) Design.
Cited performance deficiency - The failure to ensure independence between Turbine Control System (TCS) circuits and the trains of Reactor Protection System (RPS) circuits in accordance with IEEE 279-1971, Section 4.6, Independence, and the UFSAR Section 7.0, Instrumentation and Controls.
Potential to impact the following functions:
The ability of the turbine to trip upon a reactor trip.
The ability of the reactor to trip upon a valid RPS signal.
The ability of the ESFAS to actuate upon a valid actuation.
Very low safety significance.
Configuration in question is related to original HNP design for TTS and RPS interface and is in accordance with the Westinghouse NSSS standard design.
Update HNP Licensing Basis to explicitly state that IEEE 279-1971 does not apply from the actuating device to the TCS.
5 5
System Design and Operation Protection Systems - include the electrical and mechanical devices and circuitry involved in generating the signals associated with the two protective functions of the Solid State Protection System (SSPS).
Reactor Protection System (RPS)
Function: generates signals that actuate reactor trip.
Part of the Reactor Trip System.
Automatic reactor trips based upon neutron flux, reactor coolant loop temperature, pressurizer pressure and level, and reactor coolant pump underfrequency and undervoltage, and a safety injection signal.
- The sets of signals are redundant, physically separated, and meet the requirements of IEEE Standard 279-1971, Criteria for Protection Systems for Nuclear Power Generating Stations.
Engineered Safety Features Actuation System (ESFAS)
Function: generates signals that actuate engineered safety features.
Part of the Engineered Safety Features System.
6 6
System Design and Operation Turbine Control System (TCS)
Non-safety related.
Non-seismically designed.
Controls valve position, speed, and/or load depending on reference parameter selected.
If turbine parameter is exceeded, protection system will trip the turbine by closing all steam admission valves.
RPS provides redundant signals of reactor trip to TCS.
Signals are treated as Class 1E from the SSPS to the turbine front standard interface cabinet (i.e., actuation device).
The signals beyond the actuation device are non-Class 1E.
Separation and qualification criteria of the signals per IEEE standards are no longer observed.
7 7
Current Licensing Basis HNP FSAR Section 8.3.1.2.30 Cables and conduits routed in non-Category I structures associated with safety related functions or anticipatory trips (i.e., turbine trip on reactor trip, reactor trip on turbine trip, loss of feedwater) are designed to meet IEEE-Standard 279-1971 including redundancy, separation, and single failure criteria (see detailed description in Section 7.2.1.1.2). These circuits are designated as safety related and identified similar to the reactor protection system channels as described in Section 8.3.1.3. Separation of these circuits is maintained from other reactor trip circuits by routing each of these circuits independently in a separate conduit from the actuating device to the Reactor Protection System cabinet.
HNP FSAR Section 7.2.1.1.2 - Reactor Trips Reactor Trip on Turbine Trip (anticipatory) - provides additional protection and conservatism beyond that required for the health and safety of the public.
No credit taken in any of the safety analyses for this trip.
Circuit analyses have shown that the functional performance of the protection system would not be degraded by credible faults in circuits associated with reactor trip from turbine trip.
8 8
Application of the RIPE Process Applicable Guidance Documents:
Guidelines for Characterizing the Safety Impact of Issues, Revision 2, May 2022 (ADAMS Accession No. ML22088A135)
TSG-DORL-2021-01, Revision 2 - NRR Temporary Staff Guidance, Risk-Informed Process for Evaluations, May 2022 (ADAMS Accession No. ML22088A136)
NEI 21-01, Revision 1, Industry Guidance to Support Implementation of NRCs Risk-Informed Process for Evaluations, June 2022 HNP meets the criteria to utilize the RIPE Process Technically acceptable PRA TSTF-505, Provide Risk Informed Extended Completion Times - RITSTF Initiative 4b
- Approved per License Amendment 184 (ADAMS Accession No. ML21047A314)
Robust Integrated Decision-Making Panel (IDP)
- Implementation of 10 CFR 50.69 (ADAMS Accession Nos. ML19192A012 and ML21316A248) 9 9
Application of the RIPE Process In order to characterize as minimal safety impact:
Contribute less than 1 x 10-7/year to core damage frequency (CDF)
Contribute less than 1 x 10-8/year to large early release frequency (LERF)
Cumulative risk is acceptable If baseline risk remains less than 1 x 10-4/year for CDF and less than 1 x 10-5/year for LERF once the impact of the proposed change is incorporated into baseline risk.
10 10
PRA Analysis HNP PRA Model Consistent with that utilized for the RICT Program.
Assesses internal events, internal flooding, and fire hazards.
Includes high winds hazard for consistency with HNP working PRA model.
Supports incorporation and evaluation of the change to reflect the as-built plant in future assessments.
Inclusion is conservative as the RIPE criteria are not based on relative measures.
Does not quantitatively assess seismic or external flooding hazards based on meeting screening criteria.
No specific concerns related to these for this submittal.
11 11
PRA Analysis Strategy Quantitative Risk Assessment to calculate change in CDF and LERF.
Utilize a single basic event to reflect a potential common cause event for the functions susceptible to impacts of the current circuitry configuration.
A bounding approach due to large degree of conservatism present in the HNP PRA model.
A hot short within the portion of the RPS and SSPS circuitry in proximity to the TCS circuitry is the surrogate failure mode from which the probability of plant impacts and associated quantitative risk is assessed.
The targets of interest from which to assess potential impacts to the associated cables are selected to be the 48 VDC SSPS power supplies utilized for the SSPS cabinets.
These components are a surrogate that allows the evaluation to leverage the impacts already captured in the HNP Fire PRA to identify fire events that could potentially impact the subject cable locations.
12 12
PRA Analysis Assumptions Primary analysis assumes lack of sufficient independence between TCS and RPS circuits.
Could result in plant impacts.
Could occur concurrently with any plant initiating event modeled in the HNP PRA.
Developed point estimate for probability of plant impact and captured as basic event.
Informed using industry data on the occurrence of cable hot shorts during fire events.
Conditional probability applied to summation of frequencies for conservative selection of fires.
Maximum exposure time of one year utilized to convert frequency to probability.
Event is applied globally in primary analysis to assess impact from any plant initiator.
Sensitivity developed to consider quantitative result of the impact of the event occurring as a direct result of (dependent on) the occurrence of fire initiating events impacting both trains of SSPS in the fire zones where the subject TCS cables are routed.
13 13
PRA Results Quantitative Risk Characterization Current configuration assessed is the compromised requirements for single failure and interactions between control and protection systems affecting reliability of the RPS that are present by not meeting RPS independence.
Metric Working With Assessed NRC RIPE Quantitative Model Base Adjustment Criteria for Risk Assessed Minimal Safety to Current Impact Configuration CDF 4.1459E-5 4.1475E-5 < 1.0E-7 1.6E-8 LERF 3.5142E-6 3.5142E-6 < 1.0E-8 < 1.0E-10
Conclusion:
Not risk-significant and has minimal impact on safety.
14 14
Precedent No 10 CFR 50.90 submittals utilizing the RIPE Process to date.
Palo Verde submitted 10 CFR 50.12 Exemption utilizing RIPE Process.
Approved per letter dated March 23, 2022 (ADAMS Accession No. ML22054A005) 15 15
Schedule IDP targeted for mid to late May 2023.
Submit LAR in June 2023.
Implementation within 120 days of receipt of safety evaluation.
16 16
17