ML18262A377: Difference between revisions
StriderTol (talk | contribs) (Created page by program invented by StriderTol) |
StriderTol (talk | contribs) (Created page by program invented by StriderTol) |
||
(One intermediate revision by the same user not shown) | |||
Line 9: | Line 9: | ||
| docket = PROJ0753 | | docket = PROJ0753 | ||
| license number = | | license number = | ||
| contact person = Honcharik M | | contact person = Honcharik M | ||
| package number = ML18262A372 | | package number = ML18262A372 | ||
| document type = Report, Miscellaneous | | document type = Report, Miscellaneous | ||
Line 16: | Line 16: | ||
=Text= | =Text= | ||
{{#Wiki_filter: | {{#Wiki_filter:TECHNICAL SPECIFICATIONS TASK FORCE TSTF A JOINT OWNERS GROUP ACTIVITY October 8, 2015 Evaluation of Inclusion of Open Phase Condition Equipment Requirements in the Technical Specifications U Executive Summary An open phase condition (OPC) is defined as an open phase, with or without a ground, that is located on the high voltage side of a transformer connecting a general design criterion (GDC) 17 offsite power circuit to the transmission system. The term OPC refers to one or two open phases. | ||
The goal of addressing OPCs is to demonstrate that the existing plant design ensures important-to-safety functions remain available following an OPC, or to install plant modifications to detect and mitigate an OPC. Mitigation of an OPC is accomplished by transferring the power source for the affected engineered safety feature (ESF) electrical buses to an alternate source. | |||
In October 2014 the Nuclear Strategic Issues Advisory Committee (NSIAC) approved an industry initiative, revised in March 2015, establishing the intention for operating nuclear power plant licensees to demonstrate that important-to-safety 1 functions remain available following an P0F P OPC or to install plant modifications to detect and mitigate an OPC. | |||
The term OPC refers to one or two open phases | |||
Mitigation of an OPC is accomplished by transferring the power source for the affected engineered safety feature (ESF) electrical buses to an alternate source. | |||
In October 2014 the Nuclear Strategic Issues Advisory Committee (NSIAC) approved an industry initiative, revised in March 2015, establishing the intention for operating nuclear power plant licensees to demonstrate that important | |||
-to-safety | |||
Any modification to install detection and mitigation for an OPC is considered an enhancement to an existing acceptable design, reviewed and approved by the NRC by initial issuance of the operating license. Under 10 CFR 50.59, proposed changes to the facility require the determination of the need for a license amendment, in the form of either a change to the Technical Specifications (10 CFR 50.59(c)(1)), or approval of a licensing basis change (10 CFR 50.59(c)(2)). The purpose of this evaluation is to determine whether the equipment installed by licensees to detect and mitigate an OPC would require modification of Technical Specifications (TS) to meet any regulatory requirement. | Any modification to install detection and mitigation for an OPC is considered an enhancement to an existing acceptable design, reviewed and approved by the NRC by initial issuance of the operating license. Under 10 CFR 50.59, proposed changes to the facility require the determination of the need for a license amendment, in the form of either a change to the Technical Specifications (10 CFR 50.59(c)(1)), or approval of a licensing basis change (10 CFR 50.59(c)(2)). The purpose of this evaluation is to determine whether the equipment installed by licensees to detect and mitigate an OPC would require modification of Technical Specifications (TS) to meet any regulatory requirement. | ||
The offsite AC power sources meet Criterion 3 in 10 CFR 50.36(c)(2)(ii) and require a specific LCO per the regulations. | The offsite AC power sources meet Criterion 3 in 10 CFR 50.36(c)(2)(ii) and require a specific LCO per the regulations. LCO 3.8.1, "AC Sources - Operating," and LCO 3.8.2, "AC Sources - | ||
LCO 3.8.1, "AC Sources | Shutdown" are the only LCOs which discuss offsite power and require one (LCO 3.8.2) or two LCO 3.8.1) offsite power circuits to be operable. The OPC equipment is a support feature of the TS-required offsite AC power sources. Functionality of OPC detection and mitigation equipment is to be considered in determination of the capability of these systems to perform their specified safety function. Therefore, monitoring of the functions performed by the OPC equipment is consistent with, but not specifically required by, SR 3.8.1.1. | ||
- Operating," and LCO 3.8.2, "AC Sources | 1 Appendix A of 10 CFR 50 states that structures, systems, and components important to safety are those that provide reasonable assurance that the facility can be operated without undue risk to the health and safety of the public. | ||
11921 Rockville Pike, Suite 100, Rockville, MD 20852 Phone: 301-984-4400, Fax: 301-984-7600 Administration by EXCEL Services Corporation | |||
, SR 3.8.1.1. | |||
A new TS requirement providing requirements for the equipment used to detect and mitigate an OPC is not required under the regulations in order to ensure that the offsite power sources can perform their specified safety function. It is recommended that licensees clarify the TS Bases describing operability of offsite circuits to meet LCO 3.8.1, LCO 3.8.2, and SR 3.8.1.1 to describe the support function performed by the OPC equipment. | |||
: 1) Problem Statement U | |||
: 1) | The NSIAC Open Phase Condition Initiative states: | ||
Periodic tests, calibrations, setpoint verifications or inspections (as applicable) must be established for any new protective features. The surveillance requirements must be added to the plant Technical Specifications if necessary to meet the provisions of 10CFR50.36. | Periodic tests, calibrations, setpoint verifications or inspections (as applicable) must be established for any new protective features. The surveillance requirements must be added to the plant Technical Specifications if necessary to meet the provisions of 10CFR50.36. | ||
Further industry guidance will be provided for the development of Technical Specifications as the design features are identified. | Further industry guidance will be provided for the development of Technical Specifications as the design features are identified. | ||
This paper considers | This paper considers whether equipment installed by licensees to detect and mitigate an OPC requires changes to the TS to meet regulatory requirements. | ||
: 2) | : 2) Evaluation U | ||
-to-onsite power distribution system using generic equipment names: | a) Considered Equipment Designs U | ||
For the purpose of this evaluation, we will consider a simplified offsite-to-onsite power distribution system using generic equipment names: | |||
A B Transmission Preferred Power System and ESF Electrical Supply (Offsite ESF Equipment Switchyard Buses Transformer) | |||
(Origin of OPC) | |||
There are two principle equipment designs to detect and mitigate an OPC: | There are two principle equipment designs to detect and mitigate an OPC: | ||
: 1. Devices on the high side of the preferred power supply transformer (Location A), and | : 1. Devices on the high side of the preferred power supply transformer (Location A), and | ||
: 2. Devices on the ESF Buses (Location B). | : 2. Devices on the ESF Buses (Location B). | ||
Page 2 | |||
Both designs alert the operator in the control room to an OPC and separate the onsite power distribution system from the affected offsite source. This action initiates existing undervoltage detection systems on the ESF buses which start and load the emergency onsite power source. 2 P1F b) OPC equipment function U | |||
The offsite power sources ensure availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an anticipated operational occurrence (AOO) or a postulated Design Basis Accident (DBA). The function of the OPC equipment is to ensure that an OPC event is detected and to separate the affected offsite source from the associated ESF buses, allowing the alternative onsite power source to provide the necessary power for the ESF equipment. Thus, the function of the OPC equipment is to support the performance of the safety function of the offsite power sources. | |||
The function of the OPC equipment is to ensure that an OPC event is detected and to separate the affected offsite source from the associated ESF buses, allowing the alternative onsite power source to provide the necessary power for the ESF equipment. Thus, the function of the OPC equipment is to support the performance of the safety function of the offsite power sources. | The addition of OPC alarms in the control room would not result in TS changes, as all indication-only alarms have been previously removed from the TS 3 . P2F P c) Offsite power Operability U | ||
The addition of OPC alarms in the control room would not result in TS changes, as all indication | The definition of "operability" in the Standard TS states that a system is operable when it is capable of performing its specified safety function(s) and when, among other requirements, required normal or emergency electric power is available. Therefore, an inoperable offsite U U source may result in LCO 3.8.1 or LCO 3.8.2 not being met, but does not, absent other failures, make other components inoperable. | ||
-only alarms have been previously removed from the TS | d) Background on Technical Specifications Selection U | ||
d) | Inclusion of a new requirement into the TS should be carefully considered. The Nuclear Regulatory Commission stated in their "Final Policy Statement on Technical Specifications Improvements for Nuclear Power Reactors," 58 FRN 39132, July 22, 1993, (herein referred to as the "Final Policy Statement"): | ||
[S]ince 1969 there has been a trend towards including in technical specifications not only those requirements derived from the analyses and evaluation included in the plant's safety analysis report but also essentially all other NRC requirements governing the operation of nuclear power plants. | [S]ince 1969 there has been a trend towards including in technical specifications not only those requirements derived from the analyses and evaluation included in the plant's safety analysis report but also essentially all other NRC requirements governing the operation of nuclear power plants. | ||
2 The OPC designs considered in this evaluation act to separate the affected offsite source from the associated ESF bus and the existing ESF undervoltage function actuates to start the onsite power sources, sequence loads, etc. | |||
Therefore, the safety function of responding to a loss of offsite power is being performed by the existing TS undervoltage function which meets 10 CFR 50.36(c)(2)(ii), Criterion 3. Should an OPC design interface directly with the engineered safety features actuation logic, bypassing the existing undervoltage function, then the OPC function may also satisfy Criterion 3. | |||
3 TSTF-110-A, Revision 2, "Delete SR Frequencies Based on Inoperable Alarms," approved on October 3, 1997. | |||
Page 3 | |||
This is due in part to a lack of well-defined criteria for what should be included in technical specifications and has contributed to the volume of technical specifications and to the several-fold increase in the number of license amendment applications to effect changes in the technical specifications. | |||
In the Commission's view, this has diverted both NRC staff and licensee attention from the more important requirements in these documents to the extent that it has resulted in an adverse but unquantifiable impact on safety. | |||
To alleviate this adverse impact on safety, the NRC promulgated criteria in the Final Policy Statement that circumscribe the requirements that are to be included in the TS. These criteria were later incorporated into the regulations under 10 CFR 50.36(c)(2)(ii). It is worthwhile to note that the Statements of Consideration for this rule change stated, "The Commission has decided not to withdraw the final policy statement because it contains detailed discussions of the four criteria and guidance on how the NRC staff and licensees should apply the criteria." | |||
The NRC has provided requirements and guidance to the NRC staff and licensees on the appropriate content of TS. This guidance consists of: | |||
* The 1968 revision to 10 CFR 50.36, "Technical Specifications," to describe five categories of TS requirements; | |||
* The Atomic Energy Commission (AEC) 1968 "Guide to Content of Technical Specifications for Nuclear Reactors;" | |||
* The May 9, 1988 letter from Thomas E. Murley (NRC) to the Owners Group chairmen that documents the NRC staff's conclusions regarding the current standard Technical Specifications requirements that must be retained in plant Technical Specifications; | |||
* The 1993 Final Policy Statement; | |||
* The 1993 revision to 10 CFR 50.36 to include the four criteria for selecting limiting conditions for operation (LCOs); | |||
* The October 25, 1993 letter from William T. Russell (NRC) to the Owners Groups chairmen, "Content of the Standard Technical Specifications, Section 5.0, Administrative Controls," dated; and | |||
* The improved Standard Technical Specifications (STS) for nuclear power reactors (NUREG-1430 through NUREG-1434), originally published in 1993 and revised in 1995, 2001, 2004, 2005, and 2011. | |||
The addition of OPC equipment is evaluated against this guidance. | |||
e) 10 CFR 50.36(b) | |||
U 10 CFR 50.36 describes the contents of the TS. 10 CFR 50.36(b) states: | |||
"The technical specifications will be derived from the analyses and evaluation included in the safety analysis report, and amendments thereto, submitted pursuant to § 50.34. The Commission may include such additional technical specifications as the Commission finds appropriate." | |||
Page 4 | |||
Evaluation of an OPC is not currently included in the evaluation of a loss of offsite power in the safety analysis report (i.e., the Final Safety Analysis Report (FSAR)) of most plants. Inclusion of evaluations of an OPC-initiated LOOP was not required to be included in the FSAR by the NRC Standard Review Plan (NUREG-0800), Regulatory Guide 1.70, "Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants," or Regulatory Guide 1.181, "Content of the Updated Safety Analysis Report in Accordance with 10 CFR 50.71(e)." | |||
However, the NSIAC industry initiative established the intention that licensees will update the FSAR to include design features and analysis related to the effect of, and protection for, any OPC design vulnerability. Therefore, should it be determined that OPC equipment falls within a requirement for inclusion in the Technical Specifications, 10 CFR 50.36(b) will be satisfied. | |||
f) 10 CFR 50.36(c) Criteria U | |||
10 CFR 50.36(c) provides the categories of required TS. Each of these categories is evaluated to determine if the OPC equipment would require a specific TS to satisfy the requirement. | |||
i) Safety Limits and Limiting Safety System Settings U | |||
10 CFR 50.36(c)(1) states: | |||
Safety limits, limiting safety system settings, and limiting control settings. (i)(A) Safety limits for nuclear reactors are limits upon important process variables that are found to be necessary to reasonably protect the integrity of certain of the physical barriers that guard against the uncontrolled release of radioactivity. If any safety limit is exceeded, the reactor must be shut down. | |||
10 CFR 50.36(c)(1)(ii)(A) states: | |||
Limiting safety system settings for nuclear reactors are settings for automatic protective devices related to those variables having significant safety functions. Where a limiting safety system setting is specified for a variable on which a safety limit has been placed, the setting must be so chosen that automatic protective action will correct the abnormal situation before a safety limit is exceeded. | |||
-initiated LOOP was not required to be included in the FSAR by the NRC Standard Review Plan (NUREG | |||
-0800), Regulatory Guide 1.70, "Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants," or Regulatory Guide 1.181, "Content of the Updated Safety Analysis Report in Accordance with 10 CFR 50.71(e)." | |||
f) | |||
i) | |||
10 CFR 50.36(c)(1)(ii)(A) states: Limiting safety system settings for nuclear reactors are settings for automatic protective devices related to those variables having significant safety functions. Where a limiting safety system setting is specified for a variable on which a safety limit has been placed, the setting must be so chosen that automatic protective action will correct the abnormal situation before a safety limit is exceeded. | |||
Safety limits are directly related to the integrity of the primary fission product barriers (fuel heat removal and reactor coolant system pressure limits). The OPC equipment supports the offsite power sources. Neither the offsite power sources nor the supporting OPC equipment involve important process variables needed to reasonably protect the fuel cladding or the reactor coolant system integrity, and are not related to a variable having a significant safety function. Therefore, the OPC equipment is not designed to provide an automatic protective action that will correct an abnormal situation before a safety limit is exceeded. | Safety limits are directly related to the integrity of the primary fission product barriers (fuel heat removal and reactor coolant system pressure limits). The OPC equipment supports the offsite power sources. Neither the offsite power sources nor the supporting OPC equipment involve important process variables needed to reasonably protect the fuel cladding or the reactor coolant system integrity, and are not related to a variable having a significant safety function. Therefore, the OPC equipment is not designed to provide an automatic protective action that will correct an abnormal situation before a safety limit is exceeded. | ||
Therefore, the OPC equipment | Therefore, the OPC equipment does not require inclusion of a safety limit or a limiting safety system setting in accordance with the regulatory requirements of 10 CFR 50.36(c)(1). | ||
Page | Page 5 | ||
ii) Limiting Conditions for Operation (LCO) | |||
U 10 CFR 50.36(c)(2) states: | |||
(i) Limiting conditions for operation are the lowest functional capability or performance levels of equipment required for safe operation of the facility. ... | |||
(ii) A technical specification limiting condition for operation of a nuclear reactor must be established for each item meeting one or more of the following criteria: | |||
Criterion 1 10 CFR 50.36(c)(2)(ii)(A) states: | Criterion 1 10 CFR 50.36(c)(2)(ii)(A) states: | ||
Criterion 1. Installed instrumentation that is used to detect, and indicate in the control room, a significant abnormal degradation of the reactor coolant pressure boundary. | Criterion 1. Installed instrumentation that is used to detect, and indicate in the control room, a significant abnormal degradation of the reactor coolant pressure boundary. | ||
Line 84: | Line 94: | ||
The Final Policy Statement describes and provides discussion of each of the four criteria in 10 CFR 50.36. The discussion of Criterion 2 states: | The Final Policy Statement describes and provides discussion of each of the four criteria in 10 CFR 50.36. The discussion of Criterion 2 states: | ||
Another basic concept in the adequate protection of the public health and safety is that the plant shall be operated within the bounds of the initial conditions assumed in the existing Design Basis Accident and Transient analyses and that the plant will be operated to preclude unanalyzed transients and accidents. These analyses consist of postulated events, analyzed in the FSAR, for which a structure, system, or component must meet specified functional goals. | Another basic concept in the adequate protection of the public health and safety is that the plant shall be operated within the bounds of the initial conditions assumed in the existing Design Basis Accident and Transient analyses and that the plant will be operated to preclude unanalyzed transients and accidents. These analyses consist of postulated events, analyzed in the FSAR, for which a structure, system, or component must meet specified functional goals. | ||
These analyses are contained in Chapters 6 and 15 of the FSAR (or equivalent chapters) and are identified as Condition II, III, or IV events (ANSI N18.2) (or equivalent) that either assume the failure of or present a challenge to the integrity of a fission product barrier. As used in Criterion 2, process variables are only those parameters for which specific values or ranges of values have been chosen as reference bounds in the Design Basis Accident or Transient analyses and which are monitored and controlled during power operation such that process values remain within the analysis bounds. Process variables Page | These analyses are contained in Chapters 6 and 15 of the FSAR (or equivalent chapters) and are identified as Condition II, III, or IV events (ANSI N18.2) (or equivalent) that either assume the failure of or present a challenge to the integrity of a fission product barrier. | ||
As used in Criterion 2, process variables are only those parameters for which specific values or ranges of values have been chosen as reference bounds in the Design Basis Accident or Transient analyses and which are monitored and controlled during power operation such that process values remain within the analysis bounds. Process variables Page 6 | |||
captured by Criterion 2 are not, however, limited to only those directly monitored and controlled from the control room. These could also include other features or characteristics that are specifically assumed in Design Basis Accident and Transient analyses even if they cannot be directly observed in the control room (e.g., moderator temperature coefficient and hot channel factors). | |||
The purpose of this criterion is to capture those process variables that have initial values assumed in the Design Basis Accident and Transient analyses, and which are monitored and controlled during power operation. As long as these variables are maintained within the established values, risk to the public safety is presumed to be acceptably low. This criterion also includes active design features (e.g., high pressure/low pressure system valves and interlocks) and operating restrictions (pressure/temperature limits) needed to preclude unanalyzed accidents and transients. | The purpose of this criterion is to capture those process variables that have initial values assumed in the Design Basis Accident and Transient analyses, and which are monitored and controlled during power operation. As long as these variables are maintained within the established values, risk to the public safety is presumed to be acceptably low. This criterion also includes active design features (e.g., high pressure/low pressure system valves and interlocks) and operating restrictions (pressure/temperature limits) needed to preclude unanalyzed accidents and transients. | ||
Offsite power, and therefore the supporting OPC equipment, is not a process variable that has initial values assumed in the DBA or transient analysis. Offsite power is not a design feature or operating restriction that is an initial condition of a DBA or transient analysis needed to preclude unanalyzed accidents and transients. Therefore, offsite sources and the supporting OPC equipment do not require a specific LCO in accordance with 10 CFR 50.36(c)(2)(ii)(B). | Offsite power, and therefore the supporting OPC equipment, is not a process variable that has initial values assumed in the DBA or transient analysis. Offsite power is not a design feature or operating restriction that is an initial condition of a DBA or transient analysis needed to preclude unanalyzed accidents and transients. Therefore, offsite sources and the supporting OPC equipment do not require a specific LCO in accordance with 10 CFR 50.36(c)(2)(ii)(B). | ||
Criterion 3 10 CFR 50.36(c)(2)(ii)(C) states: | Criterion 3 10 CFR 50.36(c)(2)(ii)(C) states: | ||
Criterion 3. A structure, system, or component that is part of the primary success path and which functions or actuates to mitigate a design basis accident or transient that either assumes the failure of or presents a challenge to the integrity of a fission product barrier. The Final Policy Statement discussion of Criterion 3 states: | Criterion 3. A structure, system, or component that is part of the primary success path and which functions or actuates to mitigate a design basis accident or transient that either assumes the failure of or presents a challenge to the integrity of a fission product barrier. | ||
The Final Policy Statement discussion of Criterion 3 states: | |||
A third concept in the adequate protection of the public health and safety is that in the event that a postulated Design Basis Accident or Transient should occur, structures, systems, and components are available to function or to actuate in order to mitigate the consequence of the Design Basis Accident or Transient. Safety sequence analyses or their equivalent have been performed in recent years and provide a method of presenting the plant response to an accident. These can be used to define the primary success paths. | A third concept in the adequate protection of the public health and safety is that in the event that a postulated Design Basis Accident or Transient should occur, structures, systems, and components are available to function or to actuate in order to mitigate the consequence of the Design Basis Accident or Transient. Safety sequence analyses or their equivalent have been performed in recent years and provide a method of presenting the plant response to an accident. These can be used to define the primary success paths. | ||
A safety sequence analysis is a systematic examination of the actions required to mitigate | A safety sequence analysis is a systematic examination of the actions required to mitigate the consequences of events considered in the plant's Design Basis Accident and Transient analyses, as presented in Chapters 6 and 15 of the plant's FSAR (or equivalent chapters.) | ||
Such a safety sequence analysis considers all applicable events, whether explicitly or implicitly presented. The primary success path of a safety sequence analysis consists of the combination and sequences of equipment needed to operate (including consideration of the single failure criteria), so that the plant response to Design Basis Accidents and Transients limits the consequences of these events to within the appropriate acceptance criteria. | |||
Page 7 | |||
It is the intent of this criterion to capture into Technical Specifications only those structures, systems, and components that are part of the primary success path of a safety sequence analysis. Also captured by this criterion are those support and actuation systems that are necessary for items in the primary success path to successfully function. | |||
The primary success path for a particular mode of operation does not include backup and diverse equipment (e.g., rod withdrawal block which is a backup to the average power range monitor high flux trip in the startup mode, safety valves which are backup to low* | |||
temperature overpressure relief valves during cold shutdown). | |||
Chapter 6 of the NRC Standard Review Plan (which follows the recommended structure of the FSAR) describes Engineered Safety Features. Chapter 15 of the NRC Standard Review Plan describes transient and accident analysis. Section 15.0 states that a Loss of Offsite Power is an Anticipated Operational Occurrence (AOO), which is an ANSI N18.2 Condition II or III event. | |||
The offsite AC power sources meet Criterion 3. This is documented in the May 9, 1988 letter from Thomas E. Murley (NRC) to the Owners Group chairmen that documents the NRC staff's conclusions regarding the current standard Technical Specifications requirements that must be retained in plant Technical Specifications. | |||
LCO 3.8.1 and LCO 3.8.2 are the only LCOs which discuss offsite power and requires one (LCO 3.8.2) or two (LCO 3.8.1) qualified circuits between the offsite transmission network and the onsite electrical power distribution system to be operable. The operability of power sources is part of the primary success path of the accident. The LCO Bases state that an operable offsite source must be capable of maintaining rated frequency and voltage, and accepting required loads during an accident, while connected to the ESF buses. | |||
The OPC equipment functions to ensure the offsite sources are capable of maintaining rated frequency and voltage after accepting required loads during an accident. Therefore, it is a support system for the offsite sources. There are many such support systems for offsite power sources, such as transformer pressure trip devices, breaker monitoring and trip devices, and devices on the transmission network. These support systems are not included in the TS. | |||
However, the effect of degraded or non-conforming support systems on the operability of the offsite sources should be addressed under the stations operability determination process. | |||
The proposed designs that install the OPC sensing devices on the ESF buses also perform the function of supporting the offsite source. The existing LCO 3.8.1 and LCO 3.8.2 requirements for the offsite sources to be operable encompasses the OPC support function, as the definition of "operability" includes necessary instrumentation and controls. The location of the sensor does not change the nature of the support function. | |||
It is recommended that the Bases for LCO 3.8.1 and LCO 3.8.2 be clarified to explicitly describe the OPC equipment and its offsite source support function to the offsite sources. | |||
The offsite power sources are part of the primary success path in a Chapter 15 safety sequence analysis and meet the requirement to have a TS LCO in accordance with 10 CFR 50.36(c)(2)(ii)(C). The OPC equipment is a support system to the offsite power sources, to be considered in the determination of operability of the offsite power sources in accordance Page 8 | |||
with LCO 3.8.1 and LCO 3.8.2. The OPC equipment itself does not meet the criteria requiring a specific TS LCO in accordance with 10 CFR 50.36(c)(2)(ii)(C). | |||
Criterion 4 10 CFR 50.36(c)(2)(ii)(D) states: | |||
Criterion 4. A structure, system, or component which operating experience or probabilistic risk assessment has shown to be significant to public health and safety. | Criterion 4. A structure, system, or component which operating experience or probabilistic risk assessment has shown to be significant to public health and safety. | ||
The Final Policy discussion of Criterion 4 states: It is the Commission policy that licensees retain in their Technical Specifications, LCOs, action statements, and Surveillance Requirements for the following systems (as applicable), which operating experience and PSA have generally shown to be significant to public health and safety and any other structures, systems, or components that meet this criterion: | The Final Policy discussion of Criterion 4 states: | ||
Reactor Core Isolation Cooling/Isolation Condenser, | It is the Commission policy that licensees retain in their Technical Specifications, LCOs, action statements, and Surveillance Requirements for the following systems (as applicable), which operating experience and PSA have generally shown to be significant to public health and safety and any other structures, systems, or components that meet this criterion: | ||
The Commission recognizes that other structures, systems, or components may meet this criterion. Plant | * Reactor Core Isolation Cooling/Isolation Condenser, | ||
- and design | * Residual Heat Removal, | ||
-specific PSAs have yielded valuable insight to unique plant vulnerabilities not fully recognized in the safety analysis report Design Basis Accident or Transient analyses. It is the intent of this criterion that those requirements that PSA or operating experience exposes as significant to public health and safety, consistent with the Commission's Safety Goal and Severe Accident Policies, be retained or included in Technical Specifications. | * Standby Liquid Control, and | ||
The Commission expects that licensees, in preparing their Technical Specification related submittals, will utilize any plant | * Recirculation Pump Trip. | ||
-specific PSA or risk survey and any available literature on risk insights and PSAs. This material should be employed to strengthen the technical bases for those requirements that remain in Technical Specifications, when applicable, and to verify that none of the requirements to be relocated contain constraints of prime importance in limiting the likelihood or severity of the accident sequences that are commonly found to dominate risk. Similarly, the NRC staff will also employ risk insights and PSAs in evaluating Technical Specifications related submittals. Further, as a part of the Commission's ongoing program of improving Technical Specifications, it will continue to consider methods to make better use of risk and reliability information for defining future generic Technical Specification requirements. | The Commission recognizes that other structures, systems, or components may meet this criterion. Plant- and design-specific PSAs have yielded valuable insight to unique plant vulnerabilities not fully recognized in the safety analysis report Design Basis Accident or Transient analyses. It is the intent of this criterion that those requirements that PSA or operating experience exposes as significant to public health and safety, consistent with the Commission's Safety Goal and Severe Accident Policies, be retained or included in Technical Specifications. | ||
The OPC equipment is not one of the systems specified in the Final Policy Statement discussion of Criteria | The Commission expects that licensees, in preparing their Technical Specification related submittals, will utilize any plant-specific PSA or risk survey and any available literature on risk insights and PSAs. This material should be employed to strengthen the technical bases for those requirements that remain in Technical Specifications, when applicable, and to verify that none of the requirements to be relocated contain constraints of prime importance in limiting the likelihood or severity of the accident sequences that are commonly found to dominate risk. Similarly, the NRC staff will also employ risk insights and PSAs in evaluating Technical Specifications related submittals. Further, as a part of the Commission's ongoing program of improving Technical Specifications, it will continue to consider methods to make better use of risk and reliability information for defining future generic Technical Specification requirements. | ||
The OPC equipment is not one of the systems specified in the Final Policy Statement discussion of Criteria 4. | |||
-7. Installation of the OPC equipment is estimated to reduce this risk impact by 80%. | Evaluations of the plant risk associated with an OPC determined it is an insignificant risk contributor (Letter from Gordon Clefton, Nuclear Energy Institute, to Jacob I. Zimmerman, Page 9 | ||
It's up to each licensee to determine if this risk evaluation is applicable to their sites. | |||
The NRC Reactor Safety Goal Policy Statement (51 FR 30028) contains two quantitative goals regarding the risk of prompt fatalities and cancer fatalities to the population in the area of a nuclear power plant. | NRC, "Review of the Regulatory Requirements for Open Phase Condition Detection and Isolation," dated March 21, 2014.) An evaluation of the Byron OPC event determined the risk impact was approximately 6E-7. Installation of the OPC equipment is estimated to reduce this risk impact by 80%. It's up to each licensee to determine if this risk evaluation is applicable to their sites. | ||
It states the safety goals and subsidiary numerical objectives are to be used in making regulatory judgments on need for proposing and backfitting new generic requirements on nuclear power plant licensees. Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk | The NRC Reactor Safety Goal Policy Statement (51 FR 30028) contains two quantitative goals regarding the risk of prompt fatalities and cancer fatalities to the population in the area of a nuclear power plant. It states the safety goals and subsidiary numerical objectives are to be used in making regulatory judgments on need for proposing and backfitting new generic requirements on nuclear power plant licensees. Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 2, May 2011, provides numerical criteria corresponding to the Commission's Safety Goal Policy Statement. It states that using Core Damage Frequency (CDF) and Large Early Release Frequency is an acceptable approach to meeting the Safety Goals and that proposed changes to the licensing basis should be evaluated to ensure proposed increases in CDF are small. The Regulatory Guide goes on to classify CDF changes less than 1E-6 (Region III) as "very small changes." Therefore, given that the OPC CDF has been determined to be less than 1E-6, the NRC's guidance indicates that the probabilistic risk associated with an OPC is not significant to public health and safety. | ||
-Informed Decisions on Plant | Therefore, the OPC equipment does not require a specific LCO in accordance with 10 CFR 50.36(c)(2)(ii)(D). | ||
-Specific Changes to the Licensing Basis," Revision 2, May 2011, provides numerical criteria corresponding to the Commission's Safety Goal Policy Statement. It states that using Core Damage Frequency (CDF) and Large Early Release Frequency is an acceptable approach to meeting the Safety Goals and that proposed changes to the licensing basis should be evaluated to ensure proposed increases in CDF are small. The Regulatory Guide goes on to classify CDF changes less than 1E | iii) Surveillance Requirements U | ||
-6 (Region III) as "very small changes." | 10 CFR 50.36(c)(3) states: | ||
iii) | Surveillance requirements are requirements relating to test, calibration, or inspection to assure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions for operation will be met. | ||
Surveillance requirements are requirements relating to test, calibration, or inspection to assure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions for operation will be met. There is one Surveillance Requirement in the TS regarding the offsite circuits. SR 3.8.1.1 states: | There is one Surveillance Requirement in the TS regarding the offsite circuits. SR 3.8.1.1 states: | ||
Verify correct breaker alignment and indicated power availability for each [required] | Verify correct breaker alignment and indicated power availability for each [required] | ||
offsite circuit. | offsite circuit. 4P3F The SR 3.8.1.1 Bases state: | ||
This SR ensures proper circuit continuity for the offsite AC electrical power supply to the onsite distribution network and availability of offsite AC electrical power. The breaker alignment verifies that each breaker is in its correct position to ensure that distribution 4 | |||
This SR ensures proper circuit continuity for the offsite AC electrical power supply to the onsite distribution network and availability of offsite AC electrical power. The breaker alignment verifies that each breaker is in its correct position to ensure that distribution | The bracketed (optional) term "[required]" is included for those plant designs that only require a subset of the available offsite sources to be operable. | ||
Page 10 | |||
buses and loads are connected to their preferred power source, and that appropriate independence of offsite circuits is maintained. | |||
An OPC is created when there is not proper circuit continuity or breaker alignment for one or more phases of an offsite source. The existing SR 3.8.1.1, when understood to include all three phases of each offsite circuit, verifies the offsite power function can be performed. | An OPC is created when there is not proper circuit continuity or breaker alignment for one or more phases of an offsite source. The existing SR 3.8.1.1, when understood to include all three phases of each offsite circuit, verifies the offsite power function can be performed. | ||
The switchyard circuit breakers contain protection features to address faults in the transmission network, switchyard, or buses, such as three | The switchyard circuit breakers contain protection features to address faults in the transmission network, switchyard, or buses, such as three-phase faults, improper relay operation, or failure of a circuit breaker to open. This equipment is not constrained by the TS except by the requirement for required offsite sources to be operable to meet LCO 3.8.1 or LCO 3.8.2 and the SR 3.8.1.1 requirement to verify proper circuit continuity and breaker alignment. Consequently, including the OPC equipment under LCO 3.8.1, LCO 3.8.2, and SR 3.8.1.1 is consistent with the current TS requirements. | ||
-phase faults, improper relay operation, or failure of a circuit breaker to open. This equipment is not constrained by the TS except by the requirement for required offsite sources to be operable to meet LCO 3.8.1 or LCO 3.8.2 and the SR 3.8.1.1 requirement to verify proper circuit continuity and breaker alignment. Consequently, including the OPC equipment under LCO 3.8.1, LCO 3.8.2, and SR 3.8.1.1 is consistent with the current TS requirements. | |||
In the format of the STS, Surveillance Requirements confirm that a function is available and do not typically specify the equipment to be used to verify the function. If the OPC equipment is nonfunctional, it must be considered in determination of the capability of the offsite circuits to perform their specified safety function and whether SR 3.8.1.1 is met. It is important to note that SR 3.0.1 requires Surveillance Requirements to be met at all times. | In the format of the STS, Surveillance Requirements confirm that a function is available and do not typically specify the equipment to be used to verify the function. If the OPC equipment is nonfunctional, it must be considered in determination of the capability of the offsite circuits to perform their specified safety function and whether SR 3.8.1.1 is met. It is important to note that SR 3.0.1 requires Surveillance Requirements to be met at all times. | ||
iv) | iv) Design Features U | ||
10 CFR 50.36(c)(4) states: | |||
Design features to be included are those features of the facility such as materials of construction and geometric arrangements, which, if altered or modified, would have a significant effect on safety and are not covered in categories described in paragraphs (c) | Design features to be included are those features of the facility such as materials of construction and geometric arrangements, which, if altered or modified, would have a significant effect on safety and are not covered in categories described in paragraphs (c) | ||
(1), (2), and (3) of this section. | (1), (2), and (3) of this section. | ||
Paragraphs (c)(1), (2), and (3) involve the Safety Limits and Limiting Safety System Settings, LCOs, and Surveillance Requirements, respectively, which have been discussed previously. | Paragraphs (c)(1), (2), and (3) involve the Safety Limits and Limiting Safety System Settings, LCOs, and Surveillance Requirements, respectively, which have been discussed previously. | ||
Design requirements for offsite sources, including OPC equipment, are not materials of construction or geometric arrangements. Additionally, as concluded above, OPC equipment is part of the offsite AC source design for which LCO 3.8.1 and LCO 3.8.2 | Design requirements for offsite sources, including OPC equipment, are not materials of construction or geometric arrangements. Additionally, as concluded above, OPC equipment is part of the offsite AC source design for which LCO 3.8.1 and LCO 3.8.2 satisfy the requirements of 10 CFR 50.36(c)(2). Therefore, OPC equipment and function are not subject to inclusion in TS Design Features in accordance with 10 CFR 50.36(c)(4). | ||
v) | v) Administrative Controls U | ||
Administrative controls are the provisions relating to organization and management, procedures, recordkeeping, review and audit, and reporting necessary to assure operation of the facility in a safe manner. Each licensee shall submit any reports to the Commission pursuant to approved technical specifications as specified in | 10 CFR 50.36(c)(5) states: | ||
§ 50.4. | Administrative controls are the provisions relating to organization and management, procedures, recordkeeping, review and audit, and reporting necessary to assure operation of the facility in a safe manner. Each licensee shall submit any reports to the Commission pursuant to approved technical specifications as specified in § 50.4. | ||
Page | Page 11 | ||
- Operating," and LCO 3.8.2, "AC Sources | OPC equipment is not related to organization and management, procedures, recordkeeping, review and audit, or reporting. | ||
Therefore, OPC equipment does not require TS Administrative Controls in accordance with 10 CFR 50.36(c)(5). | |||
SR 3.8.1.1 requires verification of correct breaker alignment and indicated power availability for each offsite circuit. An OPC is created when there is not proper circuit continuity or breaker alignment for one or more phases of an offsite source. Therefore, the OPC function is consistent with the existing SR 3.8.1.1. This evaluation determined that a new TS requirement providing requirements for the equipment used to detect and mitigate an OPC is not required under the regulations in order to ensure | : 3) Conclusion U | ||
The offsite AC power sources meet Criterion 3 in 10 CFR 50.36(c)(2)(ii) and require a specific LCO per the regulations. LCO 3.8.1, "AC Sources - Operating," and LCO 3.8.2, "AC Sources - | |||
Shutdown," are the only LCOs which discuss offsite power and require one (LCO 3.8.2) or two (LCO 3.8.1) qualified circuits between the offsite transmission network and the onsite electrical power distribution system to be operable. The OPC equipment functions as a support system to the offsite power sources, similar to other support systems not addressed in the TS. | |||
SR 3.8.1.1 requires verification of correct breaker alignment and indicated power availability for each offsite circuit. An OPC is created when there is not proper circuit continuity or breaker alignment for one or more phases of an offsite source. Therefore, the OPC function is consistent with the existing SR 3.8.1.1. | |||
This evaluation determined that a new TS requirement providing requirements for the equipment used to detect and mitigate an OPC is not required under the regulations in order to ensure that the offsite power sources can perform their specified safety function. It is recommended that licensees clarify the TS Bases for LCO 3.8.1, LCO 3.8.2, and SR 3.8.1.1 to describe the support function performed by the OPC equipment and to clarify that indicated power availability includes all three phases as assumed in the analyses. | |||
Page 12}} |
Latest revision as of 14:29, 20 October 2019
ML18262A377 | |
Person / Time | |
---|---|
Site: | Technical Specifications Task Force |
Issue date: | 10/08/2015 |
From: | Technical Specifications Task Force |
To: | Office of Nuclear Reactor Regulation |
Honcharik M | |
Shared Package | |
ML18262A372 | List: |
References | |
Download: ML18262A377 (12) | |
Text
TECHNICAL SPECIFICATIONS TASK FORCE TSTF A JOINT OWNERS GROUP ACTIVITY October 8, 2015 Evaluation of Inclusion of Open Phase Condition Equipment Requirements in the Technical Specifications U Executive Summary An open phase condition (OPC) is defined as an open phase, with or without a ground, that is located on the high voltage side of a transformer connecting a general design criterion (GDC) 17 offsite power circuit to the transmission system. The term OPC refers to one or two open phases.
The goal of addressing OPCs is to demonstrate that the existing plant design ensures important-to-safety functions remain available following an OPC, or to install plant modifications to detect and mitigate an OPC. Mitigation of an OPC is accomplished by transferring the power source for the affected engineered safety feature (ESF) electrical buses to an alternate source.
In October 2014 the Nuclear Strategic Issues Advisory Committee (NSIAC) approved an industry initiative, revised in March 2015, establishing the intention for operating nuclear power plant licensees to demonstrate that important-to-safety 1 functions remain available following an P0F P OPC or to install plant modifications to detect and mitigate an OPC.
Any modification to install detection and mitigation for an OPC is considered an enhancement to an existing acceptable design, reviewed and approved by the NRC by initial issuance of the operating license. Under 10 CFR 50.59, proposed changes to the facility require the determination of the need for a license amendment, in the form of either a change to the Technical Specifications (10 CFR 50.59(c)(1)), or approval of a licensing basis change (10 CFR 50.59(c)(2)). The purpose of this evaluation is to determine whether the equipment installed by licensees to detect and mitigate an OPC would require modification of Technical Specifications (TS) to meet any regulatory requirement.
The offsite AC power sources meet Criterion 3 in 10 CFR 50.36(c)(2)(ii) and require a specific LCO per the regulations. LCO 3.8.1, "AC Sources - Operating," and LCO 3.8.2, "AC Sources -
Shutdown" are the only LCOs which discuss offsite power and require one (LCO 3.8.2) or two LCO 3.8.1) offsite power circuits to be operable. The OPC equipment is a support feature of the TS-required offsite AC power sources. Functionality of OPC detection and mitigation equipment is to be considered in determination of the capability of these systems to perform their specified safety function. Therefore, monitoring of the functions performed by the OPC equipment is consistent with, but not specifically required by, SR 3.8.1.1.
1 Appendix A of 10 CFR 50 states that structures, systems, and components important to safety are those that provide reasonable assurance that the facility can be operated without undue risk to the health and safety of the public.
11921 Rockville Pike, Suite 100, Rockville, MD 20852 Phone: 301-984-4400, Fax: 301-984-7600 Administration by EXCEL Services Corporation
A new TS requirement providing requirements for the equipment used to detect and mitigate an OPC is not required under the regulations in order to ensure that the offsite power sources can perform their specified safety function. It is recommended that licensees clarify the TS Bases describing operability of offsite circuits to meet LCO 3.8.1, LCO 3.8.2, and SR 3.8.1.1 to describe the support function performed by the OPC equipment.
- 1) Problem Statement U
The NSIAC Open Phase Condition Initiative states:
Periodic tests, calibrations, setpoint verifications or inspections (as applicable) must be established for any new protective features. The surveillance requirements must be added to the plant Technical Specifications if necessary to meet the provisions of 10CFR50.36.
Further industry guidance will be provided for the development of Technical Specifications as the design features are identified.
This paper considers whether equipment installed by licensees to detect and mitigate an OPC requires changes to the TS to meet regulatory requirements.
- 2) Evaluation U
a) Considered Equipment Designs U
For the purpose of this evaluation, we will consider a simplified offsite-to-onsite power distribution system using generic equipment names:
A B Transmission Preferred Power System and ESF Electrical Supply (Offsite ESF Equipment Switchyard Buses Transformer)
(Origin of OPC)
There are two principle equipment designs to detect and mitigate an OPC:
- 1. Devices on the high side of the preferred power supply transformer (Location A), and
- 2. Devices on the ESF Buses (Location B).
Page 2
Both designs alert the operator in the control room to an OPC and separate the onsite power distribution system from the affected offsite source. This action initiates existing undervoltage detection systems on the ESF buses which start and load the emergency onsite power source. 2 P1F b) OPC equipment function U
The offsite power sources ensure availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an anticipated operational occurrence (AOO) or a postulated Design Basis Accident (DBA). The function of the OPC equipment is to ensure that an OPC event is detected and to separate the affected offsite source from the associated ESF buses, allowing the alternative onsite power source to provide the necessary power for the ESF equipment. Thus, the function of the OPC equipment is to support the performance of the safety function of the offsite power sources.
The addition of OPC alarms in the control room would not result in TS changes, as all indication-only alarms have been previously removed from the TS 3 . P2F P c) Offsite power Operability U
The definition of "operability" in the Standard TS states that a system is operable when it is capable of performing its specified safety function(s) and when, among other requirements, required normal or emergency electric power is available. Therefore, an inoperable offsite U U source may result in LCO 3.8.1 or LCO 3.8.2 not being met, but does not, absent other failures, make other components inoperable.
d) Background on Technical Specifications Selection U
Inclusion of a new requirement into the TS should be carefully considered. The Nuclear Regulatory Commission stated in their "Final Policy Statement on Technical Specifications Improvements for Nuclear Power Reactors," 58 FRN 39132, July 22, 1993, (herein referred to as the "Final Policy Statement"):
[S]ince 1969 there has been a trend towards including in technical specifications not only those requirements derived from the analyses and evaluation included in the plant's safety analysis report but also essentially all other NRC requirements governing the operation of nuclear power plants.
2 The OPC designs considered in this evaluation act to separate the affected offsite source from the associated ESF bus and the existing ESF undervoltage function actuates to start the onsite power sources, sequence loads, etc.
Therefore, the safety function of responding to a loss of offsite power is being performed by the existing TS undervoltage function which meets 10 CFR 50.36(c)(2)(ii), Criterion 3. Should an OPC design interface directly with the engineered safety features actuation logic, bypassing the existing undervoltage function, then the OPC function may also satisfy Criterion 3.
3 TSTF-110-A, Revision 2, "Delete SR Frequencies Based on Inoperable Alarms," approved on October 3, 1997.
Page 3
This is due in part to a lack of well-defined criteria for what should be included in technical specifications and has contributed to the volume of technical specifications and to the several-fold increase in the number of license amendment applications to effect changes in the technical specifications.
In the Commission's view, this has diverted both NRC staff and licensee attention from the more important requirements in these documents to the extent that it has resulted in an adverse but unquantifiable impact on safety.
To alleviate this adverse impact on safety, the NRC promulgated criteria in the Final Policy Statement that circumscribe the requirements that are to be included in the TS. These criteria were later incorporated into the regulations under 10 CFR 50.36(c)(2)(ii). It is worthwhile to note that the Statements of Consideration for this rule change stated, "The Commission has decided not to withdraw the final policy statement because it contains detailed discussions of the four criteria and guidance on how the NRC staff and licensees should apply the criteria."
The NRC has provided requirements and guidance to the NRC staff and licensees on the appropriate content of TS. This guidance consists of:
- The 1968 revision to 10 CFR 50.36, "Technical Specifications," to describe five categories of TS requirements;
- The Atomic Energy Commission (AEC) 1968 "Guide to Content of Technical Specifications for Nuclear Reactors;"
- The May 9, 1988 letter from Thomas E. Murley (NRC) to the Owners Group chairmen that documents the NRC staff's conclusions regarding the current standard Technical Specifications requirements that must be retained in plant Technical Specifications;
- The 1993 Final Policy Statement;
- The 1993 revision to 10 CFR 50.36 to include the four criteria for selecting limiting conditions for operation (LCOs);
- The October 25, 1993 letter from William T. Russell (NRC) to the Owners Groups chairmen, "Content of the Standard Technical Specifications, Section 5.0, Administrative Controls," dated; and
- The improved Standard Technical Specifications (STS) for nuclear power reactors (NUREG-1430 through NUREG-1434), originally published in 1993 and revised in 1995, 2001, 2004, 2005, and 2011.
The addition of OPC equipment is evaluated against this guidance.
U 10 CFR 50.36 describes the contents of the TS. 10 CFR 50.36(b) states:
"The technical specifications will be derived from the analyses and evaluation included in the safety analysis report, and amendments thereto, submitted pursuant to § 50.34. The Commission may include such additional technical specifications as the Commission finds appropriate."
Page 4
Evaluation of an OPC is not currently included in the evaluation of a loss of offsite power in the safety analysis report (i.e., the Final Safety Analysis Report (FSAR)) of most plants. Inclusion of evaluations of an OPC-initiated LOOP was not required to be included in the FSAR by the NRC Standard Review Plan (NUREG-0800), Regulatory Guide 1.70, "Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants," or Regulatory Guide 1.181, "Content of the Updated Safety Analysis Report in Accordance with 10 CFR 50.71(e)."
However, the NSIAC industry initiative established the intention that licensees will update the FSAR to include design features and analysis related to the effect of, and protection for, any OPC design vulnerability. Therefore, should it be determined that OPC equipment falls within a requirement for inclusion in the Technical Specifications, 10 CFR 50.36(b) will be satisfied.
f) 10 CFR 50.36(c) Criteria U
10 CFR 50.36(c) provides the categories of required TS. Each of these categories is evaluated to determine if the OPC equipment would require a specific TS to satisfy the requirement.
i) Safety Limits and Limiting Safety System Settings U
10 CFR 50.36(c)(1) states:
Safety limits, limiting safety system settings, and limiting control settings. (i)(A) Safety limits for nuclear reactors are limits upon important process variables that are found to be necessary to reasonably protect the integrity of certain of the physical barriers that guard against the uncontrolled release of radioactivity. If any safety limit is exceeded, the reactor must be shut down.
10 CFR 50.36(c)(1)(ii)(A) states:
Limiting safety system settings for nuclear reactors are settings for automatic protective devices related to those variables having significant safety functions. Where a limiting safety system setting is specified for a variable on which a safety limit has been placed, the setting must be so chosen that automatic protective action will correct the abnormal situation before a safety limit is exceeded.
Safety limits are directly related to the integrity of the primary fission product barriers (fuel heat removal and reactor coolant system pressure limits). The OPC equipment supports the offsite power sources. Neither the offsite power sources nor the supporting OPC equipment involve important process variables needed to reasonably protect the fuel cladding or the reactor coolant system integrity, and are not related to a variable having a significant safety function. Therefore, the OPC equipment is not designed to provide an automatic protective action that will correct an abnormal situation before a safety limit is exceeded.
Therefore, the OPC equipment does not require inclusion of a safety limit or a limiting safety system setting in accordance with the regulatory requirements of 10 CFR 50.36(c)(1).
Page 5
ii) Limiting Conditions for Operation (LCO)
U 10 CFR 50.36(c)(2) states:
(i) Limiting conditions for operation are the lowest functional capability or performance levels of equipment required for safe operation of the facility. ...
(ii) A technical specification limiting condition for operation of a nuclear reactor must be established for each item meeting one or more of the following criteria:
Criterion 1 10 CFR 50.36(c)(2)(ii)(A) states:
Criterion 1. Installed instrumentation that is used to detect, and indicate in the control room, a significant abnormal degradation of the reactor coolant pressure boundary.
The OPC equipment is not installed instrumentation that is used to detect, and indicate in the control room, a significant abnormal degradation of the reactor coolant pressure boundary and, therefore, does not require inclusion of an LCO in accordance with Criterion 1.
Criterion 2 10 CFR 50.36(c)(2)(ii)(B) states:
Criterion 2. A process variable, design feature, or operating restriction that is an initial condition of a design basis accident or transient analysis that either assumes the failure of or presents a challenge to the integrity of a fission product barrier.
The Final Policy Statement describes and provides discussion of each of the four criteria in 10 CFR 50.36. The discussion of Criterion 2 states:
Another basic concept in the adequate protection of the public health and safety is that the plant shall be operated within the bounds of the initial conditions assumed in the existing Design Basis Accident and Transient analyses and that the plant will be operated to preclude unanalyzed transients and accidents. These analyses consist of postulated events, analyzed in the FSAR, for which a structure, system, or component must meet specified functional goals.
These analyses are contained in Chapters 6 and 15 of the FSAR (or equivalent chapters) and are identified as Condition II, III, or IV events (ANSI N18.2) (or equivalent) that either assume the failure of or present a challenge to the integrity of a fission product barrier.
As used in Criterion 2, process variables are only those parameters for which specific values or ranges of values have been chosen as reference bounds in the Design Basis Accident or Transient analyses and which are monitored and controlled during power operation such that process values remain within the analysis bounds. Process variables Page 6
captured by Criterion 2 are not, however, limited to only those directly monitored and controlled from the control room. These could also include other features or characteristics that are specifically assumed in Design Basis Accident and Transient analyses even if they cannot be directly observed in the control room (e.g., moderator temperature coefficient and hot channel factors).
The purpose of this criterion is to capture those process variables that have initial values assumed in the Design Basis Accident and Transient analyses, and which are monitored and controlled during power operation. As long as these variables are maintained within the established values, risk to the public safety is presumed to be acceptably low. This criterion also includes active design features (e.g., high pressure/low pressure system valves and interlocks) and operating restrictions (pressure/temperature limits) needed to preclude unanalyzed accidents and transients.
Offsite power, and therefore the supporting OPC equipment, is not a process variable that has initial values assumed in the DBA or transient analysis. Offsite power is not a design feature or operating restriction that is an initial condition of a DBA or transient analysis needed to preclude unanalyzed accidents and transients. Therefore, offsite sources and the supporting OPC equipment do not require a specific LCO in accordance with 10 CFR 50.36(c)(2)(ii)(B).
Criterion 3 10 CFR 50.36(c)(2)(ii)(C) states:
Criterion 3. A structure, system, or component that is part of the primary success path and which functions or actuates to mitigate a design basis accident or transient that either assumes the failure of or presents a challenge to the integrity of a fission product barrier.
The Final Policy Statement discussion of Criterion 3 states:
A third concept in the adequate protection of the public health and safety is that in the event that a postulated Design Basis Accident or Transient should occur, structures, systems, and components are available to function or to actuate in order to mitigate the consequence of the Design Basis Accident or Transient. Safety sequence analyses or their equivalent have been performed in recent years and provide a method of presenting the plant response to an accident. These can be used to define the primary success paths.
A safety sequence analysis is a systematic examination of the actions required to mitigate the consequences of events considered in the plant's Design Basis Accident and Transient analyses, as presented in Chapters 6 and 15 of the plant's FSAR (or equivalent chapters.)
Such a safety sequence analysis considers all applicable events, whether explicitly or implicitly presented. The primary success path of a safety sequence analysis consists of the combination and sequences of equipment needed to operate (including consideration of the single failure criteria), so that the plant response to Design Basis Accidents and Transients limits the consequences of these events to within the appropriate acceptance criteria.
Page 7
It is the intent of this criterion to capture into Technical Specifications only those structures, systems, and components that are part of the primary success path of a safety sequence analysis. Also captured by this criterion are those support and actuation systems that are necessary for items in the primary success path to successfully function.
The primary success path for a particular mode of operation does not include backup and diverse equipment (e.g., rod withdrawal block which is a backup to the average power range monitor high flux trip in the startup mode, safety valves which are backup to low*
temperature overpressure relief valves during cold shutdown).
Chapter 6 of the NRC Standard Review Plan (which follows the recommended structure of the FSAR) describes Engineered Safety Features. Chapter 15 of the NRC Standard Review Plan describes transient and accident analysis. Section 15.0 states that a Loss of Offsite Power is an Anticipated Operational Occurrence (AOO), which is an ANSI N18.2 Condition II or III event.
The offsite AC power sources meet Criterion 3. This is documented in the May 9, 1988 letter from Thomas E. Murley (NRC) to the Owners Group chairmen that documents the NRC staff's conclusions regarding the current standard Technical Specifications requirements that must be retained in plant Technical Specifications.
LCO 3.8.1 and LCO 3.8.2 are the only LCOs which discuss offsite power and requires one (LCO 3.8.2) or two (LCO 3.8.1) qualified circuits between the offsite transmission network and the onsite electrical power distribution system to be operable. The operability of power sources is part of the primary success path of the accident. The LCO Bases state that an operable offsite source must be capable of maintaining rated frequency and voltage, and accepting required loads during an accident, while connected to the ESF buses.
The OPC equipment functions to ensure the offsite sources are capable of maintaining rated frequency and voltage after accepting required loads during an accident. Therefore, it is a support system for the offsite sources. There are many such support systems for offsite power sources, such as transformer pressure trip devices, breaker monitoring and trip devices, and devices on the transmission network. These support systems are not included in the TS.
However, the effect of degraded or non-conforming support systems on the operability of the offsite sources should be addressed under the stations operability determination process.
The proposed designs that install the OPC sensing devices on the ESF buses also perform the function of supporting the offsite source. The existing LCO 3.8.1 and LCO 3.8.2 requirements for the offsite sources to be operable encompasses the OPC support function, as the definition of "operability" includes necessary instrumentation and controls. The location of the sensor does not change the nature of the support function.
It is recommended that the Bases for LCO 3.8.1 and LCO 3.8.2 be clarified to explicitly describe the OPC equipment and its offsite source support function to the offsite sources.
The offsite power sources are part of the primary success path in a Chapter 15 safety sequence analysis and meet the requirement to have a TS LCO in accordance with 10 CFR 50.36(c)(2)(ii)(C). The OPC equipment is a support system to the offsite power sources, to be considered in the determination of operability of the offsite power sources in accordance Page 8
with LCO 3.8.1 and LCO 3.8.2. The OPC equipment itself does not meet the criteria requiring a specific TS LCO in accordance with 10 CFR 50.36(c)(2)(ii)(C).
Criterion 4 10 CFR 50.36(c)(2)(ii)(D) states:
Criterion 4. A structure, system, or component which operating experience or probabilistic risk assessment has shown to be significant to public health and safety.
The Final Policy discussion of Criterion 4 states:
It is the Commission policy that licensees retain in their Technical Specifications, LCOs, action statements, and Surveillance Requirements for the following systems (as applicable), which operating experience and PSA have generally shown to be significant to public health and safety and any other structures, systems, or components that meet this criterion:
- Reactor Core Isolation Cooling/Isolation Condenser,
- Recirculation Pump Trip.
The Commission recognizes that other structures, systems, or components may meet this criterion. Plant- and design-specific PSAs have yielded valuable insight to unique plant vulnerabilities not fully recognized in the safety analysis report Design Basis Accident or Transient analyses. It is the intent of this criterion that those requirements that PSA or operating experience exposes as significant to public health and safety, consistent with the Commission's Safety Goal and Severe Accident Policies, be retained or included in Technical Specifications.
The Commission expects that licensees, in preparing their Technical Specification related submittals, will utilize any plant-specific PSA or risk survey and any available literature on risk insights and PSAs. This material should be employed to strengthen the technical bases for those requirements that remain in Technical Specifications, when applicable, and to verify that none of the requirements to be relocated contain constraints of prime importance in limiting the likelihood or severity of the accident sequences that are commonly found to dominate risk. Similarly, the NRC staff will also employ risk insights and PSAs in evaluating Technical Specifications related submittals. Further, as a part of the Commission's ongoing program of improving Technical Specifications, it will continue to consider methods to make better use of risk and reliability information for defining future generic Technical Specification requirements.
The OPC equipment is not one of the systems specified in the Final Policy Statement discussion of Criteria 4.
Evaluations of the plant risk associated with an OPC determined it is an insignificant risk contributor (Letter from Gordon Clefton, Nuclear Energy Institute, to Jacob I. Zimmerman, Page 9
NRC, "Review of the Regulatory Requirements for Open Phase Condition Detection and Isolation," dated March 21, 2014.) An evaluation of the Byron OPC event determined the risk impact was approximately 6E-7. Installation of the OPC equipment is estimated to reduce this risk impact by 80%. It's up to each licensee to determine if this risk evaluation is applicable to their sites.
The NRC Reactor Safety Goal Policy Statement (51 FR 30028) contains two quantitative goals regarding the risk of prompt fatalities and cancer fatalities to the population in the area of a nuclear power plant. It states the safety goals and subsidiary numerical objectives are to be used in making regulatory judgments on need for proposing and backfitting new generic requirements on nuclear power plant licensees. Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 2, May 2011, provides numerical criteria corresponding to the Commission's Safety Goal Policy Statement. It states that using Core Damage Frequency (CDF) and Large Early Release Frequency is an acceptable approach to meeting the Safety Goals and that proposed changes to the licensing basis should be evaluated to ensure proposed increases in CDF are small. The Regulatory Guide goes on to classify CDF changes less than 1E-6 (Region III) as "very small changes." Therefore, given that the OPC CDF has been determined to be less than 1E-6, the NRC's guidance indicates that the probabilistic risk associated with an OPC is not significant to public health and safety.
Therefore, the OPC equipment does not require a specific LCO in accordance with 10 CFR 50.36(c)(2)(ii)(D).
iii) Surveillance Requirements U
10 CFR 50.36(c)(3) states:
Surveillance requirements are requirements relating to test, calibration, or inspection to assure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions for operation will be met.
There is one Surveillance Requirement in the TS regarding the offsite circuits. SR 3.8.1.1 states:
Verify correct breaker alignment and indicated power availability for each [required]
offsite circuit. 4P3F The SR 3.8.1.1 Bases state:
This SR ensures proper circuit continuity for the offsite AC electrical power supply to the onsite distribution network and availability of offsite AC electrical power. The breaker alignment verifies that each breaker is in its correct position to ensure that distribution 4
The bracketed (optional) term "[required]" is included for those plant designs that only require a subset of the available offsite sources to be operable.
Page 10
buses and loads are connected to their preferred power source, and that appropriate independence of offsite circuits is maintained.
An OPC is created when there is not proper circuit continuity or breaker alignment for one or more phases of an offsite source. The existing SR 3.8.1.1, when understood to include all three phases of each offsite circuit, verifies the offsite power function can be performed.
The switchyard circuit breakers contain protection features to address faults in the transmission network, switchyard, or buses, such as three-phase faults, improper relay operation, or failure of a circuit breaker to open. This equipment is not constrained by the TS except by the requirement for required offsite sources to be operable to meet LCO 3.8.1 or LCO 3.8.2 and the SR 3.8.1.1 requirement to verify proper circuit continuity and breaker alignment. Consequently, including the OPC equipment under LCO 3.8.1, LCO 3.8.2, and SR 3.8.1.1 is consistent with the current TS requirements.
In the format of the STS, Surveillance Requirements confirm that a function is available and do not typically specify the equipment to be used to verify the function. If the OPC equipment is nonfunctional, it must be considered in determination of the capability of the offsite circuits to perform their specified safety function and whether SR 3.8.1.1 is met. It is important to note that SR 3.0.1 requires Surveillance Requirements to be met at all times.
iv) Design Features U
10 CFR 50.36(c)(4) states:
Design features to be included are those features of the facility such as materials of construction and geometric arrangements, which, if altered or modified, would have a significant effect on safety and are not covered in categories described in paragraphs (c)
(1), (2), and (3) of this section.
Paragraphs (c)(1), (2), and (3) involve the Safety Limits and Limiting Safety System Settings, LCOs, and Surveillance Requirements, respectively, which have been discussed previously.
Design requirements for offsite sources, including OPC equipment, are not materials of construction or geometric arrangements. Additionally, as concluded above, OPC equipment is part of the offsite AC source design for which LCO 3.8.1 and LCO 3.8.2 satisfy the requirements of 10 CFR 50.36(c)(2). Therefore, OPC equipment and function are not subject to inclusion in TS Design Features in accordance with 10 CFR 50.36(c)(4).
v) Administrative Controls U
10 CFR 50.36(c)(5) states:
Administrative controls are the provisions relating to organization and management, procedures, recordkeeping, review and audit, and reporting necessary to assure operation of the facility in a safe manner. Each licensee shall submit any reports to the Commission pursuant to approved technical specifications as specified in § 50.4.
Page 11
OPC equipment is not related to organization and management, procedures, recordkeeping, review and audit, or reporting.
Therefore, OPC equipment does not require TS Administrative Controls in accordance with 10 CFR 50.36(c)(5).
- 3) Conclusion U
The offsite AC power sources meet Criterion 3 in 10 CFR 50.36(c)(2)(ii) and require a specific LCO per the regulations. LCO 3.8.1, "AC Sources - Operating," and LCO 3.8.2, "AC Sources -
Shutdown," are the only LCOs which discuss offsite power and require one (LCO 3.8.2) or two (LCO 3.8.1) qualified circuits between the offsite transmission network and the onsite electrical power distribution system to be operable. The OPC equipment functions as a support system to the offsite power sources, similar to other support systems not addressed in the TS.
SR 3.8.1.1 requires verification of correct breaker alignment and indicated power availability for each offsite circuit. An OPC is created when there is not proper circuit continuity or breaker alignment for one or more phases of an offsite source. Therefore, the OPC function is consistent with the existing SR 3.8.1.1.
This evaluation determined that a new TS requirement providing requirements for the equipment used to detect and mitigate an OPC is not required under the regulations in order to ensure that the offsite power sources can perform their specified safety function. It is recommended that licensees clarify the TS Bases for LCO 3.8.1, LCO 3.8.2, and SR 3.8.1.1 to describe the support function performed by the OPC equipment and to clarify that indicated power availability includes all three phases as assumed in the analyses.
Page 12