ML19305A909

Final Deficiency Rept Re Protective Functions Performed by Safety Grade Equipment as Identified by Westinghouse.One Scenario Not Applicable to Facility.No Further Action Is Necessary for Design of Other Three Sys

ML19305A909
Person / Time
Site:	Marble Hill
Issue date:	03/10/1980
From:	Shields S PSI ENERGY, INC. A/K/A PUBLIC SERVICE CO. OF INDIANA
To:
References
IEIN-79-22, NUDOCS 8003180569
Download: ML19305A909 (7)

Text

'

g .

u. ..

i PUBLIC SERVICE INDIANA S. W. Shields vice Prescent Electru: Svstem Mr. James G. Keppler, Director U.S. Nuclear Regulatory Commission Docket Nos: STN 50-546 Region III STN 50-547 799 Roosevelt Road Construction Glen Ellyn, IL 60137 Permit Nos: CPPR-170 CPPR-171

Subject:

Marble Hill Nuclear Generating Station - Units 1 and 2

Dear Mr. Keppler:

On August 31, 1979, Mr. Paul Blasioli of Public Service Company of Indiana, Inc. (PSI), notified your office of a potentially reportable incident as required by 10 CFR 50.55(e). Westinghouse had identified raveral control grade systems which, if subjected to an adverse environ-ment, could impact the protective functions performed by safety grade equipment. These control grade systems include:

A. Steam Generator Power Operated Relief Valve Control System B. Pressurizer Power Operated Relief Valve Control System C. Main Feedwater Control System D. Automatic Rod Control System NRC had addressed this issue in IE Information Notice 79-22 dated

- September 14, 1979.

PSI has evaluated all four scenarios described by Westinghouse for its applicability to Marble Hill Units 1 and 2, taking into account plant layout, accident analysis assumptions used in current Final Safety Analysis Report (FSAR) and Westinghouce bounding analyses. The results of these Marble Hill specific evaluations are discussed in the attachment. We have concluded that one scenario is not applicable to Marble Hill, and for the other three, no further action is required for the Marble Hill design.

In addition to our analyses, the Nuclear Safety Analysis Center (NSAC), has independently evaluated all four Westinghouse scenarios t.o determine their impact on public risk throu.h probablistic studies based on the Reactor Safety Study (WASH-1400). This study was submitted

\

l l

1000 East Main Street, Plainfield. Indiana 46168 317. 839 .9611 80031805'(,y

t Mr. James G. Keppler, Director March 10, 1980 PUSUC ,

SERVICE INDIANA to the NRC by the Atomic Industrial Forur (AIF) on October 19, 1979.

NSAC has decemined that the probability of a core performance degrada-tion is less than 10-7 per reacte- year for all four postulated scenarios and hence, each of - . .antribute less than 1% of the over-all probability of core degradation. It should be noted that the Marble Hill design does not have steam driven Auxiliary Feedwater Pumps; hence, it has substantial advantage in these scenarios over other Westinghouse plants. Furthermore, as analyzed by NSAC, the breaks being postulated are more likely to be small cracks rather than abrupt frilures, so that the resulting adverse environment builds up over a period of time pro-viding the potential for detection prior to component failure.

In summary, our review has not identified any events that would constitute an undue risk to the health and safety of the public.

This letter is ntended to fulfill the requirements of a final report as defined P 10 CFR 50.55(e). If you have any further questions, please do not hest. ate to contact us.

Sincerel ,

S. W. Shields Vice President - Electric System CP/kr cc: Director of Inspection & Enforcement U.S. Nuclear Pegulatory Commission Washington, D.C. 20555 E. R. Schweibin.t, P.E.

J. J. Harrison 1

t -.

ATTACHMENT - EVALUATION OF APPLICABILITY OF PROTECTION .

SYSTEM - CONTROL SYSTEM POTENTIAL INTERACTION SCENARIOS FOR MARBLE HILL UNITS 1 AND 2 l

. )

A. Steam Generator PORV Control System:

1. Summary of Scenario Following a feedline rupture outside Containment, the Steam Generator Power-Operated Relief Valves (PORV) are assumed to exhibit a consequential failure due to an adverse environment. Failure of the PORV in the open position results in the depressurization of multiple steam generators, which are the source of steam supply for the steam turbine-driven Auxiliary Feedwater Pump. Eventually, the turbine-driven Auriliary Feedwater Pump will not be capable of delivering auxiliary feedwater to the intact steam generators. A potential exists that no auxiliary feedwater will be injected into the intact steam generators until the operator takes corrective

• action to isolate the auxiliary feedwater flow spilling out the rupture.

2. Assumptions Required:

- Break occurs outside Containment between the penetration and feedline check valve.

- Adverse environment resulting from the rupture impacts the Steam Generator PORY Control Systems associated with the ruptured loop and the intact loops.

- A single active failure occurs in the motor driven Auxiliary ,

Feedwater Pump.

3. Marble Hill Units 1 and 2 Specific Accident Consequences The Marble Hill Units 1 and 2 Auxiliary Feedwater System design includes motor driven and diesel driven pumps. Tt Sine driven pumps are not utilized and hence, loss of steam supply is inconsequential to auxiliary feedwater system operation. Hence, this scenario is not applicable to Marble Hill Units 1 and 2.

B. Main Feedwater Control System:

1. Sunusary of Scenario Following a small feedline rupture, the main feedwater control system malfunctions in such a manner that the liquid mass in the intact steam generators is less than for the worst case presented in the Safety Analysis Report. The reduced secondary liquid mass at the time of automatic reactor trip results in a more severe Reactor Coolant System heatup following reactor trip.

l

= \

i 1

i

2. Assumptions Required:

. - Br .2 occurs between steam generator nozzle and feedwater line c.eck valve -

- Small Breaks less than 0.2 ft2

- Adverse environment resulting from the break impacts the main feedwater control systems associated with both the broken loop and the intact loop

- Due to the adverse environment, the main feedwater control systams initiate spurious signals to close the feedwater control valves in the intact loops.

3. Marble Hill Units 1 and 2 Specific Accident Consequences Section 15.2.7 of the Marble Hill Units 1 and 2 FSAR addresses th'e loss of normal feedwater accident and demonstrates that the Auxiliary Feedwater System (AFWS) is capable of removing stored and residual heat, thus preventing overpressurization of the Reactor Coolant System (RCS) or loss of water from the reactor core, returning the plant to a safe conditions. The reactor trip is assumed on a low-low water level in any steam generator. The results of the analysis presented in the FSAR conclude that loss of normal feedvater does not adversely affect the core, reactor coolant system or the steam systems, since the auxiliary feedwater capacity is such that reactor coolant water is not relieved from the pressurizer relief or safety valves, and the water level in all steam generators is maintained above the tube sheet. Assumptions used in the analysis minimize energy removal and maximize the possibility for loss of water from the RCS by maximizing coolant expansion. Also, the AFWS delivers a minimum flow rate of 459 gpm, (assuming a single failure of one pump) to those intact steam generators within one minute of low-low level with allowance for spillage through the main feedwater line break.

Main feedwater flow is not required. A small feedline rupture would yield a higher flow rate to the intact steam generators and hence the i FSAR analysis bounds the small feedwater line break of this i scenario. Furthermore, turbine drives are not utilized on the Marble Hill Auxiliary Feedwater pumps and loss of feedwater resulting in reduced steam supply will not affect the performance of AFWS

( Additionally, the feedwater flow control devices under question are the feedvater flow elements and associated transmitters, the stesa generator level transmitters and the steam flow transmitters. The feedwater flow elements and transmitters are located outside the contairment in ti.e steam tunnel as it opens to the turbine building, at least 60 feet from the nearest break location. The steam generator level and steam flow transmitters are located inside j r containment, but outside the missile barrier and are physically l l

1 l  !

l l

I separated for each loop. Because of the small size of the postolated break, and the physical separation of each device from the proximity of the break, it is unlikely that the environment around the devices would cause failure; particularly simultaneous failure in '

all four loops at once.

For these reasons we do not believe that this scenario represents a significant safety question that requires further action.

C. Pressurizer PORV Control System:

l. Summary of Scenario Following a feedline rupture inside Containment, the pressurizer PORV control system malfunctions in such a manner that the PORV fails in the open position. Thus, in addition to a feedline rupture between the steam generator nozzle and the containment penetration, a breach of the Reactor Coolant System boundary has occurred in the pressurizer vapor space due to failure of PORV.

2. Assumptions Required:

- Break occurs in the feedwater piping inside the containment between the stema generator nozzle and the containment penetration

- Double-ended break leads to limiting consequences. Smaller breaks ,

permit longer operator action times

- Adverse environment resulting from the break impacts the pressurizer power-operated relief valve control system

- Due to the adverse environment, the pressurizer PORV control system initiates a spurious signal to open the PORVs.

3. Marble Hill Units 1 and 2 Specific Accident Consequences As part of the follow up ef forts of the TMI-2 accident, Westinghouse has analyzed this class of accidents (for the Westinghouse TMI Owners Group) and reported the results in WCAP-9600. Specifically, the analyses of Section 4.2 of this report assumes a total loss of main and auxiliary feedwater (no pipe rupture) concurrant with various small primary pipe breaks.

In the WCAP-9600 analyses the worst-case situation was determined to be the optimum size break that just precludes delivery of safety injection fluid to the RCS. This break size was determined to be approximately 0.2 inches in diameter which is considerably smaller than one full open pressurizer PORV. The scenario postulated in 1 above is similar to that presented in Section 4.2 of WCAP-9600 if the following additional assumptions are made:

. I I

a. A feedline rupture is assumed to occur between the steam generator nozzle and the containment penetration.

b. Auxiliary feedwater is injected into the intact steam generators following the feedline rupture.

Conservatively assuming that all liquid inventory in the steam generator associated with the ruptured feedline is lost via the rupture without removing any heat (i.e. , liquid blowdown), the loss of heat sink due to the liquid inventory blowdown of the ruptured steam generator is more than counterbalanced by the auxiliary feedwater being injected into the intact steam generators following reactor trip. Therefore, the results of the analyses presented in WCAP-9600, Section 4.2 also apply to this scenario with operator action not required for at least 2500 seconds The Marble Hill Units 1 and 2 Auxiliary Feedwater System is provided with restricting flow orifices in each line to each steam generator such that one pump (single failure) can deliver at least 160 gpm to each of the three unfaulted steam generators within one minute following an accident . Operator action is assumed not to be required for at least 30 minutes following the accident.

The Marble Hill feedvater syst em pipe break analysis (Section 15.2.8 of the FSAR) concludes that the Auxiliary Feedwater System capacity is adequate to remove decay heat, to prevent overpressurization of the Reactor Coolant System and to prevent uncovering of the core.

The consequences of feedline rupture with the consequential failure of the PORV control system are bounded by the analyses in Section 4.2 of WCAP-9600 and the feedline break analysis in the FSAR. Therefore, we do not believe that this scenario represents a significant safety question that requires further action.

D. ROD CONTROL SYSTEM:

1

1. Summary of Scenario '

Following an intermediate steam line rupture inside Containment, the l Automatic Rod Control System exhibits a consequential failure due to j an adverse environment which causes the control rods to begin j stepping out prior to receipt of a reactor trip signal on overpower '

Delta T. This scenario results in a lower DNB ratio than presently presented in the Safety Analysis Report.

2. Assumptions Required:

- Break occurs inside the containment between the steam generator nozzle and the containment pene tration.

l l

l 1

. 1 1

t l

- Intermediate steam line breaks (0.1 to 0.25 ft2 per loop) at power levels from 70 to 100 percent

- Adverse environment from the break impacts the .

Nuclear Instrumentation System (NIC) equipment (i.e.,

excore neutron detectors, cabling connectors, etc.) prior to reactor trip (i.e., within 2 minutes)

- Due to the adverse environment, the NIS system initiates a spurious low power signal without causing a reactor trip on l

negative flux rate.

3. Marble Hill Units 1 and 2 Specific Accidents Consequences Several factors tend to decrease the possibility of a significant consequential malfunction of the automatic rod control system due to an intermediate steam line break inside Containment. First, the physical location of the excore detectors relative to the postulated break location does not provide direct access for steam to travel to the excore detectors. The detectors are located in an annulus.around the reactor vessel separated by a concrete barrier from the other primary components and piping. Furthermore, the reactor protection system includes features that protect against inappropriate rod withdrawal. A rapid decrease in any two out of four detector signals generates a negative rate trip which could result from environmentally induced failure of the detectors or cables. Also, as stated in Section 7.2.2.3.1 of the FSAR, an isolated auctioneered high signal is derived by auctioneering of the four channels for automatic rod control. That is, rod withdrawal is based on the highest of the four excore detectors. Theref;re, rod withdrawal will occur only if all four excore detectors fail low. For these reasons, we believe it is unlikely that rod withdrawal will result from environmental failure of the excore detectors prior to reactor trip.

Westinghouse has also performed a bounding analysis of the intermediate steam line rupture to calculate the extent of fuel damage due to rod control system withdrawal prior to reactor trip.

Based upon the reduction in radial peaking factor with burn-up and conservative end of life physics parameters, no fuel damage was calculated to occur following the intermediate steam line rupture with a consequential rod control system failure.

Based on the low probability of the occurrence of a consequential j malfunction of the rod control system and the Westinghouse bounding l

analysis, we do not believe this scenario represents a significant safety question that requires further action.

t 3m v wr