ML24019A151

From kanterella
Jump to navigation Jump to search
Slides - Modification of Browns Ferry Technical Specifications to Eliminate LCO 3.3.2.1 Actions C.2.1.1 and C.2.1.2 for Rod Worth
ML24019A151
Person / Time
Site: Browns Ferry, Palo Verde, 05000560  Tennessee Valley Authority icon.png
Issue date: 01/22/2024
From:
Tennessee Valley Authority
To:
Office of Nuclear Reactor Regulation
Green K, NRR/DORL/LPL2-2
Shared Package
ML24019A097 List:
References
Download: ML24019A151 (1)
v • d • e


Text

Modification of Browns Ferry Technical Specifications to Eliminate LCO 3.3.2.1 Actions C.2.1.1 and C.2.1.2 for Rod Worth Minimizer Inoperable During Reactor Startup January 22, 2024

Meeting Objectives

  • Demonstrate that the proposed TS changes have very low safety significance so the risk informed process for evaluation (RIPE) can be used for the license amendment request (LAR).
  • Obtain feedback from the Nuclear Regulatory Commission (NRC) on the proposed LAR, specifically,
  • Proposed changes to the RWM TS
  • The risk analysis
  • The answers to RIPE questions 2

=

Background===

  • Limiting Condition for Operation (LCO) 3.1.6, Rod Pattern Control, requires control rods to be in compliance with banked position withdraw sequence (BPWS).
  • The BPWS are control rod patterns that prevent high worth control rods. This limits the reactivity insertion in a control rod drop accident (CRDA). Limiting the worth of the dropped control rod limits the power excursion in a CRDA and consequently, eliminates or limits fuel rod damage.
  • RWM is an automatic system that uses error lights and rod movement blocks to enforce BPWS control rod patterns. RWM automatically blocks the continuous withdraw of an out of sequence control rod during reactor startup.

This prevents more than one control rod from being withdrawn past its withdraw limit.

3

Background (continued)

  • The rod position indication system (RPIS) provides control rod position information to RWM. It is typically loss of control rod position information from RPIS that makes RWM not functional.
  • Inability or failure to provide control rod position indications (RPI) is a condition monitoring event under maintenance rule (10 CFR 50.65).
  • Under maintenance rule, RWM is a non-risk significant function of the integrated computer system (ICS). Control rod position information is an input to RWM, and loss of this control rod position information is not counted as a failure of the RWM.
  • The performance criteria for RWM is no more than two condition monitoring failures per unit in 24 months. A condition monitoring failure occurs when the RWM system is inoperable when required to be available for control rod movement.

4

Background (continued)

  • RWM is a legacy design feature that prevents a mispositioned control rod. Intended to be the automatic check to prevent a mispositioned control rod when a single control room operator is withdrawing control rods during reactor start up.
  • Current BFN operating practices have three control room staff overseeing control rod movements
  • One operator determines rod to be withdrawn and the rods withdraw position from the rod movement sheet. This operator withdraws the rod.
  • A second operator also reads the rod move sheet and verifies the correct rod has been moved to the correct position.
  • A third operator (a supervisor) provides oversight. This oversight is not required by the rod movement procedure, while the two operators are required by the rod movement procedure.

5

Background (continued)

  • Operators train to and predominantly use the normal startup control rod patterns. However, there are reactor startups where modifications to these rod patterns are made to minimize high notch worths.

These modifications require making up specific rod movement sheets to implement them that are different than the normal startup rod move sheets.

  • The misposition of a control rod during startup is a rare event - only one instance of a control rod being misposition has occurred at BFN in the last 10 years or in the last 49 reactor startups.
  • BFN operating experience is that procedure use and adherence is sufficient to prevent control rods from being mispositioned.
  • TVA proposes to eliminate the requirement that RWM be functional during reactor startup.

6

Proposed Change

Action C.2.1.1 allows reactor startup to continue if at least 12 control rods have been withdrawn.

Action C.2.1.2 allows one reactor startup a year, if <12 control rods have been withdrawn, Action C.2.2 requires control rod movements to be independently verified to be in compliance with BPWS requirements when RWM is INOPERABLE.

  • Having 12 rods withdrawn does not eliminate or reduce fuel damage from a CRDA.
  • LCO 3.1.6 requires control rod patterns to be in compliance with BPWS. Any non-compliance with this TS results in a licensee event report so NRCs ability to regulate is not impaired by this change to LCO 3.3.2.1.

7

CRDA Analysis Results and Insights

  • The CRDA analysis is performed each cycle to verify damaged fuel rods can be cooled and the source term from damaged fuel rods is bounded by that assumed in the radiological analysis for a CRDA.
  • The dropped rod used in the CRDA analysis is the highest worth control rod determined using:
  • A xenon free core during startup
  • Eight fully inserted control rods chosen to increase the worth of the dropped rod
  • [

].

  • The equilibrium ATRIUM 11 core CRDA analysis, using the AURORA-B CRDA methodology, predicts:

a maximum total fuel enthalpy of [

].

  • [

]

  • These results demonstrate that unless the rod drop occurs in the highest worth control rod that there is margin in the CRDA analysis to absorb a misposition that would increase the worth of a dropped rod.

AURORA-B and ATRIUM, are trademarks or registered trademarks of Framatome or its affiliates, in the USA or other countries 8

Risk Analysis

  • A bounding calculation of the increase in core damage frequency (CDF) when RWM is not functional and control rod movements are independently verified is to assume core damage occurs if the control rod(s) misposition is not detected by the independent verification.
  • Bounding Calculation of the increase in CDF:

CDF = (fCRDA)(FLP)(PE1)(PE2)(PHW) fCRDA - is the frequency of a CRDA FLP - fraction of year reactor is at low power (<10%) during startup PE1 - is the probability of a control rod misposition PE2 - probability of independent verifier not identifying a control rod misposition PHW - probability the rod drop occurs in a high worth control rod 9

Risk Analysis (continued)

Event Tree 10 CRDA (fCRDA)

>10% REACTOR POWER

<10% REACTOR POWER (FLP)

RODS IN COMPLIANCE WITH BPWS RODS NOT IN COMPLIANCE WITH BPWS (PE1)(PE2)

CRDA DOES NOT OCCUR IN HIGH WORTH ROD CRDA OCCURS IN HIGH WORTH ROD (PHW)

CORE DAMAGE

Risk Analysis (continued)

  • Using Jeffreys non-informative prior the frequency of a CRDA is approximately 3.89x10-4/year. The number or boiling water reactor (BWR) startups are approximately 1286. This is based on the number of reactor scrams and startups due to outages since 1988.
  • Time that the reactor is at <10% power and control rods being moved is roughly 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> per startup with on average less than two startups per year. This is based on recent BFN operating history.

However, if reactor power is <10% for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, then SR 3.1.6.1 requires verification that control rods are compliant with BPWS requirements. This puts an upper limit on the exposure time that rods could be mispositioned, and result in core damage is much less than (2 startups) x (24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for 3rd check on control rod position) = 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />.

  • An upper bound probability that control rods are misconfigured is 0.2, and then upper bound probability that the independent verifier does not identify/correct the misconfiguration is 0.1. Both are pessimistic human error probabilities. Operating experience supports much lower human error probabilities.

11

Risk Analysis (continued)

  • The probability that the dropped control rod has high worth is based on insights from the deterministic analyses in ANP-3874P:
  • This puts an upper bound of 50/185 =0.27 of the rods in the core could have high worth when control rod configuration is in compliance with BPWS.
  • When a control rod position is not in compliance with BPWS (E1 & E2 occur), the set of potentially high worth control rods could be different, but the number of rods in this set will remain near 50. This is due to the loosely coupled neutronics in a BWR core that limits the reactivity zone of influence to control rods near the mispositioned rod.
  • Based on these insights, a bounding probability for PHW is 1/2.
  • The increase in CDF from no longer crediting RWM is:

CDF = (3.89x10-4)(48/(365*24))(2/10)(1/10)(1/2) = 2.13x10-8/year (<10-7/year for a RIPE submittal) 12

Risk Analysis (continued)

LERF = (2.13x10-8/year)(0.27) = 5.75 x10-9/year (<10-8/year for a RIPE submittal)

  • The release from the fuel is not large. The insight from ANP-3874P is that no more than [

] are potentially subject to damage from the rod drop power excursion when rods are positioned in compliance with BPWS.

  • When a control rod position is not in compliance with BPWS, the reactivity insertion from the dropped rod could be greater than determined in ANP-3874P and additional fuel assemblies damaged.

However, due to the loose neutronic coupling in a BWR core, the number of fuel rods damaged is still a small fraction of the core and the activity released from containment would not be classified as large.

  • With the change to allow an unrestricted number of reactor startups without RWM able to perform its function, total CDF < 10-4/year and total LERF < 10-5/year for BFN.

13

Technical Specification Change Using RIPE

  • The LAR to change LCO 3.3.2.1 to allow unlimited reactor startups without RWM able to perform its function will use the RIPE process.
  • RIPE is an acceptable approach for this TS change because:

The safety impact can be quantified using a bounding PRA analysis, as a low power PRA model is not available The PRA model used for the RIPE LAR is technically acceptable as demonstrated by BFN adopting Technical Specification Task Force (TSTF) traveler TSTF-505 The integrated decision-making panel (IDP) reviewing and approving the safety impact of the change will be equivalent to the IDP used for implementation of the 10 CFR 50.69 amendment for BFN The change has no or minimal safety impact as demonstrated by the answers to the five RIPE screening questions The change meets the following RIPE quantitative criteria:

CDF < 10-7/year and LERF < 10-8/year For BFN, total CDF < 10-4/year and Total LERF < 10-5/year 14

RIPE Screening Question Responses Does the issue:

1.

Result in any impact on the frequency of occurrence of an accident initiator or result in a new accident initiator?

Yes. RWM is an automatic system that uses error lights and rod movement blocks to enforce BPWS control rod patterns. The BPWS control rod patterns limit the reactivity insertion in a CRDA, which limits the power excursion and consequently the amount of fuel damage. RWM does not cause or prevent a CRDA. RWM does not position control rods and does not interact with any structure, system, or component (SSC) that could initiate an operational event or accident. RWM also prevents a control rod from being continuously withdrawn during reactor startup.

Not requiring RWM to be functional during reactor startup does not impact the frequency of occurrence of any accident initiator, except the continuous rod withdraw during startup (UFSAR 14.5.4.2). Nor does it result in a new accident initiator.

Requiring an independent verification that control rods are in compliance with BPWS rod patterns when RWM is not functional is not a change. Independent verification of BPWS control rod position is currently required when RWM is not functional.

15

RIPE Screening Question Responses (continued)

Does the issue:

2.

Result in any impact on the availability, reliability, or capability of SSCs or personnel relied upon to mitigate a transient, accident, or natural hazard?

Yes. RWM is an automatic system that enforces compliance with BPWS rod patterns and prevents a continuous rod withdraw during reactor startup. When RWM is not functional, an independent verifier is used to ensure compliance with BPWS rod patterns. Substituting human oversight for the electronic oversight provided by RWM impacts the reliability of ensuring control rods positions are in compliance with BPWS. When RWM is not functional there is not an automatic rod block to prevent a continuous rod withdraw during reactor startup.

3.

Result in any impact on the consequences of an accident sequence?

No. When RWM is not capable of performing its function, independent verification that control rod patterns meet BPWS requirements ensures that fuel damage is less than in the UFSAR CRDA. So the consequences of a CRDA are not impacted by RWM not being able to perform its function. Regardless of the method used to enforce BPWS rod patterns (electronic or manual), there is always an accident sequence where electronic or manual verification fails and a CRDA results in core damage greater than the UFSAR CRDA. Failure of electronic or manual oversight does not impact the consequence - only the probability of that accident sequence. RWM prevents a continuous rod withdraw during reactor startup, but this event has no consequences (i.e., no fuel or cladding damage).

16

RIPE Screening Question Responses (continued)

Does the issue:

4.

Result in any impact on the capability of a fission product barrier?

No. RWM performs no function in maintaining or supporting the integrity or capability of the fuel rod cladding, reactor boundary, or containment boundary as barriers to the release of fission products. The capability of the fuel rod cladding (e.g., resistance to perforation during a CRDA or continuous rod withdraw during reactor startup) is not changed by RWM not being functional.

5.

Result in any impact on defense-in-depth capability or impact in safety margin?

Yes. Currently, reactor startup without RWM is limited to once per year. With the proposed TS changes, the number of reactor startup without RWM will be unrestricted. So there is an impact on defense-in-depth. There is no impact in safety margin without RWM. The UFSAR CRDA analysis and continuous rod withdraw during reactor startup analysis are unaffected by a reactor startup without RWM.

17

RIPE Screening for Minimal Impact Does the issue:

1.

Result in more than a minimal increase in frequency of occurrence of a risk significant accident initiator or result in a new risk significant accident initiator?

No. Not requiring RWM to be functional during reactor startup does not impact the frequency of occurrence of a CRDA or any other accident initiator, except the continuous rod withdraw during reactor startup. A continuous rod withdraw during reactor startup is not a risk significant accident initiator because it does not result in fuel damage.

Not requiring RWM to be functional during reactor startup does not create a new failure that results in a new risk significant accident initiator or any accident initiator.

2.

Result in more than a minimal decrease in the availability, reliability, or capability of SSCs or personnel relied upon to mitigate a risk significant transient, accident, or natural hazard?

No. RWM is not used to mitigate a CRDA or a continuous rod withdraw during reactor startup. Both of these reactivity insertion events are mitigated by the negative reactivity from the heat up of the fuel and the reactor scram.

RWM is not used to mitigate a natural hazard.

18

RIPE Screening for Minimal Impact (continued)

Does the issue:

5.

Result in more than a minimal decrease in defense-in-depth capability or safety margin?

No. Currently, reactor startup without RWM is limited to once per year. With the proposed TS changes, the number of reactor startup without RWM will be unrestricted. When RWM is not able to perform its function, BPWS control rod patterns are enforced by procedure and independent verification. There is decrease in defense-in-depth with this change due to worst-case never having RWM functional for BPWS rod pattern control. However, relying solely on an independent verifier only minimally decreases defense-in-depth, as independent verification of BPWS compliance is still required when RWM is not functional.

The insight from the CRDA analysis is that the reactivity insertion from all but the highest worth control rods is small enough that there is significant margin to core damage. Therefore, there is only a minimal decrease in safety margin as most control rod drops will not result in core damage, and this margin to core damage is maintained by the core designs and cycle specific CRDA analyses.

Similarly, for a continuous rod withdraw during startup there is decrease in defense-in-depth with this change due to worst-case never having RWM functional to prevent a rod withdraw during reactor startup. However, the negative reactivity resulting from the fuel heat up and scram prevents fuel damage. So there is only a minimal decrease in defense-in-depth.

19

Defense-in-Depth Considerations 1.

Preserve a reasonable balance among the layers of defense - RWM is a backup to procedural use and adherence that prevents high worth control rods or a continuous rod withdraw.

2.

Preserve adequate capability of design features without an overreliance on programmatic activities as compensatory measures - Without RWM function and a control rod mispositioned or being continuously withdrawn, the design of the fuel and the core provide layers of defense in protecting against core damage. The loosely coupled neutronics in a BWR core limits the extent of fuel damage.

3.

Preserve system redundancy, independence, and diversity commensurate with the expected frequency and consequences of challenges to the system, including consideration of uncertainty - The misposition of a control rod or continuous withdraw of a control rod is what RWM is intended to prevent. Operating experience supports that control rods are rarely mispositioned, and insights from the CRDA and continuous rod withdraw analyses support low consequences from these events (even with RWM not functional and control rods mispositioned or a control rod continuously withdrawn).

20

Defense-in-Depth Considerations (continued) 4.

Preserve adequate defense against potential common cause failures (CCFs) - Not requiring RWM to be functional during reactor startup does not create or affect any CCFs.

5.

Maintain multiple fission product barriers - Not requiring RWM to be functional during reactor startup does reduce the number or effectiveness of fission product barriers.

6.

Preserve sufficient defense against human errors - Sufficient defense against human errors in positioning control rods is maintained by procedure controls and compliance.

7.

Continue to meet the intent of the plants design criteria - The intent of the design criteria is to ensure control rods are positioned correctly. Not requiring RWM to be functional during reactor startup does not affect this requirement.

21

Summary

  • Putting RWM in-service is a difficult process and delays reactor startup.
  • TVA proposes to modify the LCO to allow an unrestricted number of reactor startups with RWM not functional.
  • RWM is subject to condition monitoring under 10 CFR 50.65 (maintenance rule).
  • The requested TS change has very low safety significance.
  • The license amendment request to change TS will be made using RIPE.

22

Open Items and Hurdles 23

Retrieved from "https://kanterella.com/w/index.php?title=ML24019A151&oldid=3763885"