NRC Generic Letter 1986-06

NRC Generic Letter 1986-006: Implementation of TMI Action Item II.K.3.5 Automatic Trip of Reactor Coolant Pumps

ML031150282
Person / Time
Issue date:	05/29/1986
From:	Miraglia F J Office of Nuclear Reactor Regulation
To:
References
GL-86-006, NUDOCS 8606020066
Download: ML031150282 (20)

i ,-. ' UNITED STATES-t< NUCLEAR REGULATORY COMMISSIONWASHINGTON, D. C. 20555TO ALL APPLICANTS AND LICENSEES WITH COMBUSTION ENGINEERING (CE) DESIGNEDNUCLEAR STEAM SUPPLY SYSTEMS (NSSSs) (EXCEPT MAINE YANKEE)SUBJECT: IMPLEMENTATION OF TMI ACTION ITEM II.K.3.5, "AUTOMATIC TRIP OFREACTOR COOLANT PUMPS" (GENERIC LETTER NO. 86-06)Gentlemen:The purpose of this letter is to inform you of (1) the staff's conclusionsregarding the CE Owners Group (CEOG) submittals on reactor coolant pump tripin response to Generic Letters 83-lOa and b, and -(2) provide guidanceconcerning implementation of the reactor coolant pump trip criterion. OurSafety Evaluation (SE) on this subject is enclosed for your use.With regard to the CEOG submittals referenced in Section V of the enclosedSE, we conclude that the methods employed by the CEOG to justify manualreactor coolant pump (RCP) trip are consistent with the guidelines andcriteria provided in Generic Letters 83-lOa and b. The approved CE SmallBreak LOCA Evaluation Model was used to demonstrate compliance with10 CFR 50.46 and Appendix K to 10 CFR Part 50.We have determined that the information provided by the CEOG in support ofthe trip-two/leave-two staggered reactor coolant pump trip criterion isacceptable. The generic information presented by the CEOG, however, does notaddress plant specific concerns about instrumentation uncertainties,potential reactor coolant pump problems and operator training and proceduresas requested in Generic Letter 83-10. This information, contained in SectionIV of the SE, is now being requested to assess implementation of the RCP tripcriterion.Accordingly, for those applicants and licensees who choose to endorse theCEOG methodology, we request that operating reactor licensees implement theRCP trip criterion based upon the CEOG methodology. Schedules for submittalof information requested in Section IV of the SE (refer to Appendix A forconsiderations associated with Generic Letters 83-lOa and b) should bedeveloped with your individual project managers within 45 days from receiptof this letter. The requested information does not constitute a newrequirement but only identifies information specified in Generic Letters83-lOa and b which has not been provided under the CEOG generic program. Inthe event that licensees decide not to trip the RCP (an option provided forin Generic Letters83-10a and b), they should respond to the questions inSection IV of the SE and refer to Appendix B of the SE. Applicants shouldprovide the appropriate response to the extent that this information is knownat this time.Those applicants and licensees who choose not to endorse the CEOG methodologyshould submit a schedule for submittal of plant specific RCP trip criteria orjustification for non-trip of RCPs within 45 days of receipt of this letter.8606020066

-2 -This request for information was approved by the Office of Management andBudget under clearance number 3150-0011 which expires September 30, 1986.Comments on burden and duplication may be directed to the Office ofManagement and Budget, Reports Management, Room 3208, New Executive OfficeBuilding, Washington, D.C. 20503.Our review of your submittal of information in response to this letter is notsubject to fees under the provisions of 10 CFR 170. However, should you, aspart of your response or in a subsequent submittal, include an applicationfor license amendment or other action requiring NRC approval, it is subjectto the fee requirements of 10 CFR 170 with remittal of an application fee of$150 per application (Sections 170.12(c) and 170.21) and subsequentsemiannual payments until the review is completed or the ceiling in Section170.21 is reached.If you believe further clarification regarding this issue is necessary ordesirable, please contact Mr. R. Lobel (301 492-9475.)Sincerely,Frank J ra DirectorDivision of PWR Licensing-BEnclosure:Safety Evaluationcc w/enclosure:Service Lists UNITED STATESNUCLEAR REGULATORY COMMISSIONWASHINGTON, D. C. 20555SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATIONCOMBUSTION ENGINEERING OWNERS GROUP SUBMITTALSREACTOR COOLANT PUMP TRIPI. INTRODUCTIONTMI Action Plan Item II.K.3.5 of NUREG-0737 required all licensees toconsider other solutions to the small-break loss-of-coolant-accident(LOCA) problems since tripping the reactor coolant pumps (RCPs) was notconsidered the ideal solution. Automatic trip of the RCPs in the case ofa small-break LOCA was recommended until a better solution was found. Asummary of both the industry programs and the NRC programs concerning RCPtrip is provided in Generic Letters 83-lOa through f, which areincluded in the NRC report, SECY-82-475, from W. J. Dircks to the NRCCommissioners, "Staff Resolution of the Reactor Coolant Trip Issue"(November 30, 1982). SECY-82-475 also provided the NRC guidelines andcriteria for the resolution of TMI Action Item II.K.3.5, "Automatic Tripof Reactor Coolant Pumps."In SECY-82-475 the NRC concluded "...that appropriate pump trip setpointscan be developed by the industry that would not require RCP trip forthose transients and accidents where forced convection circulation andpressurizer pressure control is a major aid to the operators, yet wouldalert the operators to trip the RCPs for those small LOCAs wherecontinued operation or delayed trip might result in core damage."SECY-82-475 also stated: "The resolution provided in the enclosures[Generic Letter 83-10] is intended to ensure that for whatever mode ofpump operation a licensee elects, a) a sound technical basis for thatdecision exists, b) the plant continues to meet the Commission's rulesand regulations, and c) as a minimum, the pumps will remain running forthose non-LOCA transients and accidents where forced convection coolingand pressurizer pressure control would enhance plant control. This wouldinclude steam generator tube ruptures up to approximately the designbasis event (one tube)."The Combustion Engineering Owners Group (CEOG) submitted a report to theNRC in response to the Combustion Engineering specific Generic Letter,83-lOa. The title of the report is Justification of Trip Two/Leave TwoPump Trip Strategy During Transients" (Reference 1). The CEOG alsoprovided additional information (Reference 2) in response to the NRCstaff request for this information, based on the staff's review of thegeneric submittal. The NRC staff also performed analyses of selectedevents to support the staff's review (Reference 3).Appendix A, herein summarizesSection I of the enclosure to GenericLetter 83-10 for "Pump-Operation Criteria that Can Result in RCPTrip During Transients and Accidents," and Appendix B summarizes SectionII, "Pump-Operation Criteria That Will Not Result in RCP Trip DuringTransients and Accidents."

-2 -II. SUMMARYThe CEOG proposes using a trip-two/leave-two (T2/L2) strategy. The T2/L2trip strategy consists of tripping two RCPs, located in diametricallyopposed coolant loops, very early in a transient on a low reactorcoolant system (RCS) pressure signal independent of the nature of theevent. The remaining two RCPs are tripped subsequently after trip setpointsindicating a LOCA are reached.The goal of the T2/L2 RCP trip strategy is to trip all RCPs in the caseof a small-break LOCA, but to have two or more RCPs operating in the eventof a non-LOCA, e.g., steam line break (SLB), generator tube ruptureor an anticipated operational occurrence (AOO). The incentive for stoppingall RCPs during a small-break LOCA is to minimize coolant inventory lossfrom the RCS. The incentive for operating the RCPs during non-LOCAdepressurization events is to maintain the availability of the main sprayflow to the pressurizer for better RCS pressure control. The RCPoperation also minimizes voiding of the reactor vessel upper head/upperplenum regions by providing some forced coolant flow through this regionand provides for better mixing in the reactor vessel downcomer/lowerplenum region minimizing pressurized thermal shock (PTS) concerns.The T2/L2 RCP trip signals and setpoints were selected on a generic basisto provide a simple setpoint scheme with enough flexibility toaccommodate plant specific signal and numerical setpoint selection. Thegeneric RCP trip setpoints consist of two tiers. The first setpoint fortripping two RCPs in opposite loops occurs if the RCS pressure decreasesbelow a certain value (e.g., 1300 psia). The setpoint signals fortripping the second two RCPs are low RCS subcooling (e.g., less than20'F), containment radiation alarm and/or absence of radiation alarm inthe secondary cooling system. Each licensee or applicant using thisapproach would choose one of three sets of setpoint combinations (that is,low subcooling plus containment radiation alarm, or low subcooling plusabsence of secondary side radiation alarm, or low subcooling plus containmentradiation alarm plus absence of secondary side radiation alarm) for trippingthe second two RCPs based on plant specific considerations of signalavailability, signal reliability, instrument location, etc.The CEOG provided calculations for small-break LOCAs, a steam generatortube rupture (SGTR), a SLB, and an increased heat removal (IHR) transient.They also discuss letdown line breaks and "the PLCS (no charging flow andmaximum letdown) and PPCS (full main spray) malfunction events." Genericsetpoints were used for these analyses: the first two RCPs were trippedwhen the RCS pressure decreased below 1300 psia; the second two RCPs weretripped when the maximum hot-leg subcooling decreased below 20'F ifthere was a containment radiation alarm expected. If the containmentradiation alarm was not expected or if a radiation alarm was expected inthe secondary system (indicating a SGTR), then the second two RCPs were nottripped even if the maximum hot-leg subcooling decreased below 20'F.

-3 -The analyses were performed for the 2700 MWt class plants because they !have the most restrictive combination of safety injection tank pressure,which affects the worst break size, and high pressure safety injection(HPSI) pump flow, which affects the core cooling capability. A comparativeanalysis was conducted for the 3410 MWt class plants to demonstrate thatthe results from the Reference plant bound the core cooling performanceof the 3410 MWt System 80 class plants.The CEOG followed the guidelines provided in Generic Letter 83-lOa tojustify manual RCP trip for small-break LOCAs. (See Appendix A, SectionD). The CEOG studies have shown that:1. Every Combustion Engineering plant's FSAR emergency core coolingsystem (ECCS) analysis demonstrates compliance with 10 CFR 50.46 ifoperator action to trip the RCPs is taken within 2 minutes afterthe RCP trip criterion is reached.2. Most probable best estimate analyses indicate that for all CombustionEngineering plants, if the RCPs are tripped within 10 minutes duringa small-break LOCA event, the peak cladding temperatures willnot exceed the 10 CFR 50.46 limit of 2200*F.The CEOG concluded that automatic reactor coolant pump trip is notrequired since adequate time for manually tripping the RCPs isdemonstrated using 10 CFR Part 50, Appendix K assumptions as well as mostprobable best estimate analyses results. It was also shown that, usingbest estimate analyses for small-break LOCAs, tripping the RCPs atminimum inventory would not result in peak cladding temperatures greaterthan 2200'F. Therefore, the time available to the operator to trip theRCP for a small-break LOCA is unlimited. However, the CEOG does notpropose operation of the RCPs during a small-break LOCA and RCP trip isrequired. A positive indication for RCP trip occurs within 1 minutefor the limiting small-break LOCA, requiring that all four RPCs be tripped.An analysis of an inadvertently stuck open power operated relief valve(PORV) demonstrated that positive indicators to trip all four RCPs wouldoccur within 200 seconds.The CEOG has thus demonstrated that all four RCPs will be tripped forbreaks from 0.0075 ft2 to 0.1 ft2, which bounds their previously shownregion of 0.02 ft2 to 0.1 ft2 where RCP trip is necessary to preventexceeding 10 CFR 50.46 limits. They have also demonstrated that peak cladtemperatures will not be excessive using their RCP-trip strategy forconservative best-estimate analyses.The CEOG analyzed a design-basis double-ended guillotine SGTR event.For this event, the RCS pressure decreases below the proposed setpointvalue and the hot leg subcooling margin decreases to about 4VF. Therewould be a steam generator secondary radiation alarm but no containmentradiation alarm for the SGTR (under normal circumstances); therefore, twoRCPs would be tripped on low pressure but the remaining two pumps will beallowed to continue to run. The CEOG has thus demonstrated that the secondset of RCPs will not be tripped for SGTRs up to the design-basis SGTR.

-4 -The CEOG analyzed a double-ended-guillotine SLB at the steam-generatoroutlet nozzle to determine how well the RCP trip setpoints worked forthis type of IHR accident. Best-estimate assumptions were used exceptthat no moisture carryover was assumed during the steam generator blowdownto give faster depressurization and cooldown. The 1300 psia setpoint wasreached, and the first two RCPs were tripped after a 30 second delay.Hot leg subcoollng never decreased below the 20F setpoint so the secondtwo RCPs continued operating throughout the transient.For the SLB event, there would be no secondary side radiation alarm and mostprobably no containment radiation alarm. The first of these indicationswould signal a trip of the second two pumps if it were not for thesubcooling criterion. The lack of a containment radiation alarm wouldhave resulted in the second two pumps not being tripped even if thesubcooling criterion had been met. Thus the RCP trip strategy wouldresult in manual tripping of the first two RCPs on low pressurizerpressure, and no manual tripping of the second two RCPs due to the lossof indicated subcooling in at least one hot leg. The T2/L2 strategy thustrips only the first two RCPs for the SLB and leaves the other tworunning throughout the transient.An inadvertent increase in turbine power from no load to full power wasanalyzed to evaluate the effectiveness of the generic RCP trip setpointsfor an IHR AOO. This event causes the greatest rate of cooldown anddepressurization of any IHA AOO, thereby presenting the greatest challengeto the RCP trip criteria.A best-estimate calculation was performed in which the RCS pressure onlyreached a minimum of 1700 psia so none of the RCPs were tripped. Thehot leg subcoollng never decreased below about 110'F so even if the RCSpressure had indicated that the first two RCPs should be tripped, thesecond two would have kept running. The CEOG guideline for keeping atlast two RCPs running is thus met for this type of transient.Other transients for which the reactor might automatically trip on lowpressurizer pressure followed by high pressure safety injection actuationinclude the letdown line break events and the PLCS (no charging flow andmaximum letdown) and PPCS (full main spray) malfunction events. However,timely operator action would prevent an automatic reactor trip, and theplant could then be manually shut down using appropriate plant procedureswithout actuating safety injection.For these events, an automatic reactor trip on low pressurizer pressureresulting in subsequent RCP trip is not expected to occur for a longperiod of time (probably more than 30 minutes). According to theAmerican National Standards Institute criteria for safety related operatoractions documented in draft ANSI-N660, operator actions can be assumedwithin 20 minutes after the start of the above transients. Therefore anautomatic reactor trip for these events would be highly unlikely.Assuming no manual operator actions to correct the cause of the PPCSmalfunction event, an automatic reactor trip on low pressurizer pressurewill eventually occur. The first two RCPs would then be maually tripped

-5 -for the PPCS malfunction event due to the RCS pressure decreasing belowthe pressure setpoint of 1300 psia. However, the second two RCPs wouldnot be tripped since the hot leg subcooling will remain well above the20'F setpoint. For the letdown line break and the PLCS malfunctionevents, if no operator actions are assumed and should a reactor trip onlow pressurizer pressure occur, the first two RCPs would be manuallytripped upon reaching the low pressure setpoint. Additionally, as thehot leg subcooling decreases to the 20'F setpoint, the second two RCPswould be manually tripped if the loss-of-subcooling with no steam plantradiation alarm criteria is used. Use of the other two combinations ((a)loss-of-subcooling with no containment radiation alarm or (b)loss-of-subcooling with no steam plant radiation alarm and no containmentradiation alarm) will not lead to tripping of the seconWT-wo RCPs due tothe absence of containment radiation alarms for these events.The manual tripping of any of the RCPs for the above transients isconsidered very low since there is adequate time for the operator tocorrectly diagnose the events and take appropriate actions without RCPtrip. However, even if the first two RCPs were tripped, it is verylikely that the second two RCPs would remain operating.This approach for these other transients is satisfactory because theoperator has so much time to diagnose the event and take appropriateaction without tripping any RCPs and the probability of tripping all fourRCPs is very low.The CEOG strategy presented does differentiate between LOCAs and othertransients. The decision to trip the second two RCPs requires that aLOCA be distinguished from the other two types of accidents which havesimilar depressurization characteristics: SGTR and SLB. The presence ofa containment radiation alarm or the lack of a steam plant radiationalarm indicates that the event is a LOCA rather than a SGTR. A SLB mayinvolve low level radiation releases, thus activating a radiation alarm,particularly the containment alarm for an inside containment SLB. Thus, aradiation alarm cannot be used to differentiate between a LOCA and aSLB. However, a LOCA results in loss of subcooling in the RCS, while aSLB will actually cause an increase in subcooling, particularly in theRCS loop with the affected steam generator. Therefore, RCS subcoolingcan be used to clearly distinguish between a LOCA and a SLB. However, aSGTR will also cause a loss of RCS subcooling. Thus, it was shown that nosingle criterion can be used to determine whether or not to trip thesecond two RCPs. Therefore, the combination of low RCS subcooling and nosteam plant radiation alarm and a containment radiation alarm clearlyindicates if the second two RCPs should be tripped. However, plantspecific requirements may dictate selection of either of thetwo-parameter combinations: (a) low RCS subcooling and a containmentradiation alarm or (b) low RCS subcooling and no steam plant radiationalarm. Combination (a) indicates a LOCA directly while combination (b)indicates a LOCA by eliminating non-LOCA depressurization events.

-6 -An AOO would not normally cause a depressurization severe enough to trip'the first two RCPs, but if it did, it is expected that there would not bea loss of RCS subcooling.A LOCA outside containment (letdown or charging line break) may result ina secondary side radiation alarm. Operator judgement is necessary todiagnose this type of event, which can be isolated. For breaks less than0.02 ft2 in the Reference 2700 MWt plant, RCP operation does not affectcore uncovery. A double-ended rupture of a letdown or charging line hasa break size of 0.016 ft2.A SGTR would result in actuation of thisalarm since there is direct leakage from the primary to the secondaryside. Thus, the absence of this alarm provides an indication of a LOCA.The basis for the setpoints selection was described in the CEOGsubmittal. The methodology used is based on the fact that following asmall-break LOCA, the RCS pressure stabilizes at a pressure sufficientlyhigh above the steam generator (SG) secondary side pressure to remove thecore fission product decay heat.Based on the results of the analyses, the nominal setpoint for trippingthe first two RCPs is 1210 psia for the 2700 MWt class, and 1320 psia forArkansas Nuclear One, Unit 2. A separate calculation determined thenominal RCS pressure setpoint to be 1361 psia for the 3410 MWt classplants. The setpoint for the System 80 plants is 1400 psia, which wasderived from a comparison of SG safety relief valve setpoints.The actual RCS pressure used for the setpoint to trip the first two RCPsshould include an allowance for instrument error. For example, assumingthe normal operating pressurizer pressure uncertainty is about +/- 45 psifor the Reference 2700 MWt plant, then the resulting RCS pressuresetpoint would be 1210 psia plus 45 psia which equals 1255 psia. Theexact setpoint value must be determined on an individual plant specificbasis, including an assessment of instrument inaccuracy for abnormaloperating conditions.The loss of RCS subcoollng in both coolant loops is symptomatic of aLOCA. Thus, the nominal RCS subcooling setpoint is 00F. As with the RCSpressure setpoint, an estimate of the instrument error must be factoredinto the actual subcooling setpoint. The actual setpoint value usedshould include an assessment of the plant specific RCP operating limits.Each licensee or applicant must evaluate the plant conditions required tomaintain RCP operating equipment integrity.In general, we believe the radiation monitors required for RCP trip canperform as expected, and can be used for this purpose. However, we notethat NUREG-0737 Item II.F.1(3), "In-Containment High Radiation Monitor"was intended to detect core damage (approximately 10,000 R/hr). Thesensitivity to detect one R/hr needs to be addressed by each licensee(see Implementation, below).

-7 -In addition to the establishment and justification of a RCP tripcriterion, Generic Letter 83-10 also requested that licensees andapplicants establish guidelines and procedures for cases where RCP tripcan lead to hot, stagnant fluid regions at RCS high points and todescribe symptoms of RCS voiding caused by flashing of hot, stagnantfluid regions, including the effects on the pressurizer, and to specifyguidance for detecting, managing and removing the voids.The non-LOCA depressurization and overcooling transients evaluated by theCEOG have a potential for causing void formation in the upper head regionof the reactor vessel with single phase liquid conditions In the rest ofthe RCS. This void formation is maximized for the case with no RCPsoperating due to the nearly complete thermal decoupling of the upper headof the reactor vessel from the rest of the RCS. Analyses of this scenariofor the non-LOCA transients were completed and documented in Reference 5.These analyses indicate that upper head voiding is not extensiveenough to uncover the reactor vessel hot legs. The main impact of thereactor vessel upper head void is a slower pressure response, since onlythis relatively stagnant region reaches saturation and it acts like apressurizer. The slower pressure response can hold up the pressure forSGTR and SLB events. This will increase the primary to secondary leakageduring a SGTR event and reduce the safety injection flow during a mainSLB event. However, the impact of these effects does not result in aviolation of the criteria specified by the Standard Review Plan guidelineseven though upper head voiding has an impact upon transient values ofplant parameters.C-E Emergency Procedure Guidelines (EPGs) (Reference 5) address the controlof RCS voids. For void formation in the upper head region to occur, thepressurizer does not have to drain. Depressurization of the system tosaturation conditions is sufficient for voids to be generated (e.g.,after a SLB, the rate of depressurization is such that this situationexists). Although natural circulation will not be impeded since theupper head voids do not expand beyond the top of the hot legs, an asymmetriccooldown, as discussed in Reference 4, will exist. Precautions as detailedin Reference 4 to prevent voids from forming In the affected steamgenerator loop need to be considered and are contained in Reference 5.The use of the T2/L2 strategy keeps two RCPs running except forsmall-break LOCAs so the continued flow minimizes voiding in theRCS high points by providing forced coolant flow through theseregions to prevent hot stagnant regions from occurring.Item I.1.e of the enclosure to Generic Letter No. 83-10 expresses the concernthat "Transients and Accidents which produce the same initial symptoms asa LOCA (i.e., depressurization of the reactor and actuation of engineeredsafety features) and result in containment isolation may result in thetermination of systems essential for continued operation of the reactorcoolant pumps (i.e., component cooling water and/or seal injection water)."It is further stated that, "In particular, if a facility design terminateswater services essential for RCP operation, then it should be assuredthat these water services can be restored in a timely manner once anon-LOCA situation is confirmed, and prevent seal damage or failure."

-8 -The generic CEOG submittal did not address this concern, therefore werequested that each licensee address the Issue. The responses are providedin References 6 through 14.(Note: Responses from Palo Verde-i and Waterford-3, are not availableat this time; these responses will be addressed at the time theplant-specific Implementation SE is issued).In general, essential RCP service water may be lost due to a safetyinjection actuation signal (SIAS), on low RCS pressure. SIAS isexpected to occur during a SGTR event. Once the non-LOCA situation isconfirmed per the EPGs, the operator is instructed to reestablishcomponent cooling water (CCW) to the RCP seals and pump coolers byoverriding the isolation signal(s). If timely reestablishment of the CCWcannot be accomplished, the remaining two RCPs are tripped. Seal coolingmay be needed to prevent seal damage. The EPGs (Reference 5) developedby Combustion Engineering for the CEOG provide guidance with respect tomaintenance of auxiliary systems which support RCP operation. The EPGshave been approved by the NRC.The CE licensees emphasized that, although the T2/L2 strategy provides foreffective plant cooldown, plant operations are bounded by FSAR analyseswhich do not credit RCP operation. Therefore, if RCP cooling servicesare not restored and RCP operations are terminated, the plant can beshut down safely.At Calvert Cliffs 1 and 2 and at San Onofre 2 and 3, a containmentisolation actuation signal (CIAS) results in an interruption of CCW. TheEPGs are relied on to restore CCW for continued RCP operation.With proper seal injection and seal return, integrity of the seals can bemaintained indefinitely'on loss of component cooling water to a runningRCP. However, the RCP motors cannot be run indefinitely on a loss ofcooling water. If it is desired to continue RCP operation, cooling watermust be reestablished within a given time frame as indicated in EPGs topreclude damage.The generic nature of the CEOG submittal, concerning the RCP trip setpointselection, by nature does not include any actual plant specific information.We have therefore included a section (Implementation), herein,which describes those plant specific items we require to be addressedwhen incorporating the RCP trip criterion into the plant procedures.III. CONCLUSIONSWe have determined that the information provided by the CEOG for thejustification of manual RCP trip is acceptable. The methods employed bythe CEOG to justify manual RCP trip are consistent with the guidelinesand criteria provided in Generic Letter 83-lOa and 83-lOb. The approvedCombustion Engineering Small Break LOCA Evaluation Model was used todemonstrate compliance with 10 CFR 50.46 and Appendix K to 10 CFR Part 50.

We have determined that the information provided by the CEOG in supportof the trip-two/leave-two staggered RCP trip criterion is acceptable.We believe the analyses methods employed by the CEOG are capable ofqualitatively providing the appropriate information to evaluate theloss-of-subcooling RCP trip criterion.We have concluded that the CEOG has developed acceptable criteria fortripping the RCPs during small-break LOCAs and to minimize RCP trip forSGTR and non-LOCA events.IV. IMPLEMENTATIONThe generic information presented by the CEOG does not address plantspecific concerns about instrumentation selection and uncertainties, andoperator training and procedures as requested In Generic Letter 83-10.Appendix A contains a summary related to these issues and may be used asa guideline to assure that these issues are adequately addressed.In order to complete the response to Generic Letter 83-lOa, each CEapplicant and licensee is required to submit the following information tothe NRC for plant specific reviews:1. Identify the instrumentation to be used to determine the RCP tripsetpoints, including the degree of redundancy of each parametersignal needed for the criteria chosen.2. Identify the instrumentation uncertainties for both normal andadverse containment conditions. Describe the basis for theselection of the adverse containment parameters. Address, asappropriate, local conditions such as fluid jets or pipe whip whichmight influence the instrumentation reliability.3. In addressing the selection of the criterion, consideration ofuncertainties associated with the CEOG supplied analyses values mustbe provided. These uncertainties include both uncertainties in thecomputer program results and uncertainties resulting from plantspecific features not representative of the CEOG generic data group.4. Identify all plant procedures (except for those concerning normaloperations such as normal cooldown) which require RCP trip guidelines.Reference to the CEOG EPGs is acceptable if endorsed by the licensee.Include training and procedures which provide direction for use ofindividual steam generators with and without operating RCPs.

REFERENCES1. Combustion Engineering Nuclear Power Systems Division, "Justification of,Trip-Two/Leave-Two Reactor Coolant Pump Trip Strategy During Transients,"(Prepared for the C-E Owners Group) Combustion Engineering report CEN-268(March 1984).2. Combustion Engineering Nuclear Power Systems Division, "Response to NRCRequest for Additional Information on CEN-268," (Prepared for the C-EOwners Group) Combustion Engineering report CEN-268 Supplement 1-NP(November 1984).3. LA-UR-85-3501, "Technical Evaluation Report for the TRAC Analyses ofSmall-Break Loss-of-Coolant Accident to Evaluate Combustion EngineeringModels Used to Establish Reactor-Coolant-Pump Trip Setpoint Criteria,"G. J. E. Willcutt, Jr., LANL, August 1985.4. Combustion Engineering, Inc., "Effects of Vessel Head Voiding DuringTransients and Accidents in C-E NSSSs," Combustion Engineering reportCEN-199 (March 1982).5. Combustion Engineering, Inc., "Combustion Engineering Emergency ProcedureGuidelines," Combustion Engineering report CEN-152, Revision 01 (November1982).6. Arkansas Nuclear One -Unit 2, letter 2CAN058507, dated May 23, 1985,J. Ted Enos to James R. Miller (NRC).7. Calvert Cliffs Unit 1 and Unit 2, letter dated June 4, 1985,A. E. Lundvall, Jr., to J. R. Miller (NRC).8. Fort Calhoun 1, letter LIC-85-215, dated May 23, 1985, R. L. Andrews toJ. R. Miller (NRC).9. Millstone 2, letter B11555, dated May 30, 1985, J. F. Opeka to J. R. Miller (NRC).10. Palisades, letter dated July 2, 1985, J. L. Kuemin to Director, NRC.11. Palo Verde Unit 1 -(not available)12. San Onofre Unit 2 and Unit 3, letter dated June 5, 1985, M. 0. Medford toG. W. Knighton (NRC).13. St. Lucie Unit 1 letter L-85-209, dated June 3, 1985, J. W. Williams, Jr.,to J. R. Miller (NRC).14. St. Lucie Unit 2, letter L-85-280, dated July 22, 1985, J. W. Williams, Jr.,to J. R. Miller (NRC).

APPENDIX APUMP-OPERATION CRITERIA THAT CAN RESULT IN RCP TRIPDURING TRANSIENTS AND ACCIDENTSA. The NRC staff has concluded that if sufficient time exists, then manualaction is acceptable for tripping the RCPs following a LOCA providedcertain conditions are satisfied.B. Potential problem areas should be considered in developing RCP-tripsetpoints and methods.1. Tripping RCPs causes loss of pressurizer sprays.a. This produces a need to use PORVs in some plants to controlprimary pressure.b. PORVs have frequently failed to close.c. Despite testing, PORV operational reliability has not improvedsignificantly.2. Tripping RCPs tends to produce a stagnant region of hot coolant inthe reactor-vessel upper elevations.a. Hot stagnant coolant has flashed and partially voided the uppervessel region during depressurization or cooldown operationevents.b. Operators are not completely familiar with the significance ofan upper-head steam bubble.c. Operators have difficulty controlling coolant conditions toavoid or control flashing.d. Operators may take precipitous actions when a steam bubbleexists.3. After tripping the RCPs, decay-heat removal by natural circulationis required. This procedure is used less frequently thancontrolling with the RCPs and it places more demand on the operatorsto control the primary-system conditions.C. Consider the following guidelines in developing RCP-trip setpoints.1. Demonstrate and Justify that proposed RCP-trip setpoints areadequate for small-break LOCAs but will not cause RCP trip for othernon-LOCA transients and accidents such as SGTRs.a. Assure that RCP trip will occur for all primary-coolant lossesin which RCP trip is considered necessary.b. Assure that RCP trip will not occur for SGTRs up to andincluding the design-basis SGTR.

-2 -c. Assure that RCP trip will not occur for other non-LOCAtransients where it is not considered necessary.d. Perform safety analyses to prove that a, b, and c above areachieved.e. Consider using partial or staggered RCP-trip schemes.f. Assure that training and procedures provide direction for useof individual steam generators with and without operating RCPs.g. Assure that symptoms and signals differentiate between LOCAsand other transients.2. Exclude extended RCP operation in a voided system where pump head ismore than 10% degraded unless analyses or tests can justify pump andpump-seal integrity when operating in voided systems.3. Avoid challenges to the PORVs where possible.a. If setpoints lead to RCP trip even though it is neitherrequired nor desirable for transients or accidents with offsitepower available, assure that challenges to the PORVs areavoided that would normally be handled by using pressurizersprays.b. Challenges to PORVs could be eliminated by using heatedauxiliary pressurizer sprays from a source other than the RCPdischarge.c. If submittal recommends use of PORYs to depressurize, thenlicensees need to develop a program for upgrading the PORVs'operational reliability.4. Establish guidelines and procedures for cases where RCP trip canlead to hot, stagnant fluid regions at primary-system high points.a. Describe symptoms of primary-system voiding caused by flashingof hot, stagnant fluid regions including effects on thepressurizer.b. Specify guidance for detecting, managing and removing the voids.c. Train operators concerning the significance of primary-systemvoids for both non-LOCA and LOCA conditions.5. Assure that containment isolation will not cause problems if itoccurs for non-LOCA transients and accidents.

-3 -a. Demonstrate that, if water services needed for RCP operationare terminated, they can be restored fast enough once anon-LOCA situation is confirmed to prevent seal damage orfailure.b. Confirm that containment isolation with continued pumpoperation will not lead to seal or pump damage or failure.6. RCP-trip decision parameters should provide unambiguous indicatorsthat a LOCA has occurred and the NRC-required inadequate-core-coolinginstrumentation should be used where useful in indicating the needfor a RCP trip.7. NRC recommends that the licensee use event trees to systematicallyevaluate their setpoints to minimize the potential for undesirableconsequences because of a misdiagnosed event.a. Evaluate setpoints for events with RCP trip when It ispreferable the RCPs remain operational.b. Evaluate setpoints for events where early RCP trip does notoccur and a delayed trip may lead to undesirable consequences.D. NRC's guidance for justification of manual RCP trip In the licenseesubmittals is summarized in this section. This guidance had twopurposes. It was intended to assist plants that can and should rely onmanual trip to justify it, and it was also intended to help identifythose few plants that may not be able to rely on manual trip.1. Analyses should demonstrate that the limits set forth in 10 CFR50.46 are not exceeded for the limiting small-break size andlocation using the RCP-trip setpoints developed with the guidance ofpart C above.a. Assume manual RCP trip does not occur earlier than 2 minutesafter the RCP-trip setpoint is reached.b. Include allowance for instrument error.c. Generic analyses are acceptable if they are shown to bound theplant-specific evaluations.2. Determine the time available to the operator to trip the RCPs forthe limiting cases if manual RCP trip is proposed.a. Perform the analysis for the limiting small-break size andlocation identified in D.1 above.b. Use the most probable best-estimate analysis to determine thetime available to trip the RCPs following the time when theRCP-trip signal occurs.

-4 -c. Most probable plant conditions should be identified andjustified by each licensee.d. NRC will accept conservative estimates in the absence ofjustifiable most probable plant conditions.e. Justify that the time available to trip the RCPs is acceptableif it is less than the Draft ANSI Standard N660.(1) Include an evaluation of operating experience data.(2) Address the consequences if RCP trip is delayed beyondthis time.(3) Develop contingency procedures and make them available forthe operator to use in case the RCPs are not tripped inthe preferred time frame.(4) No justification is required if the time available to tripthe RCPs exceeds the Draft ANSI Standard N660.E. Assure that good engineering practices have been used for the followingareas.1. Establish the quality level for the instrumentation that will signalthe need for RCP trip.a. Identify the basis for selection of the sensing-instruments'design features.b. Identify the basis for the sensing-instruments' degree ofredundancy.c. Licensees can take credit for all equipment available to theoperators if they have sufficient confidence in itsoperability during the expected conditions.2. Ensure that emergency operating procedures exist for the timelyrestart of the RCPs when conditions warrant.3. Instruct operators in their responsibility for tripping RCPs forsmall-break LOCAs including priorities for actions after theengineered safety features actuation occurs.

APPENDIX BPUMP-OPERATION CRITERIA THAT WILL NOT RESULT IN RCP TRIPDURING TRANSIENTS AND ACCIDENTSConsider the following guidelines if the submittal concludes that keeping theRCPs running is both the preferred and safest method of pump operation forsmall-break LOCAs and other transients and accidents.A. Evaluate inventory loss.1. Complete evaluation of LOFT Test L3-6 through the ECCS recoveryphase.2. Evaluate all modeling differences expected between LOFT and aPWR analysis.B. Evaluate pump integrity.1. Justify how pump-seal and pump structural integrity will beassured during extended two-phase flow performance.2. Include the consequences of pump and/or pump-seal failure inthe analyses if their integrity cannot be assured.3. Include one of the following if continuous RCP operation isexpected even with a containment isolation signal.a. Evaluate the capability to continue RCP operation withoutessential water services.b. Evaluate the capability to rapidly restore essentialwater services.4. Evaluate the RCPs' capability to operate in the accidentenvironment.5. Evaluate the consequences of RCP failure at any time during theaccident if continuous operation in the accident environmentcannot be assured.C. Ensure acceptability of results.1. Analyses should demonstrate that the 10 CFR 50.46 ECCSacceptance criteria are met with a model in compliance withAppendix K to 10 CFR Part 50.2. Assume continuous pump operation and also RCP trip at varioustimes if continuous pump operation cannot be assured.

-2 -3. NRC will consider a request for an exemption to 10 CFR 50.46 ,requirements if analyses indicate compliance cannot be achieved.a. Submittal concludes that compliance with 10 CFR 50.46would require operating the plant in a less safecondition. This needs to be supported with a risk/benefitanalysis that can take credit for all equipment expectedto remain operational during the accident.b. Submittal concludes the design modifications would not becost-effective to implement from a safety standpoint.

List of Recently Issued Generic LettersGenericLetter No.Date ofSubject IssuanceIssued To86-1086-0986-0886-0786-0686-0586-0486-0386-0286-01Implementation of FireProtection RequirementsTechnical Resolution ofGeneric Issue No. B-59-(N-1)Loop Operation in BWRs andPWRsAvailability of Supplement 4to NUREG-0933"A Prioritization of GenericSafety Issues"Transmittal of NUREG-1190Regarding the San OnofreUnit 1 Loss of Power andWater Hammer EventImplementation of TMI ActionItem II.K.3.5 "AutomaticTrip of Reactor CoolantPumps"Implementation of TMI ActionItem II.K.3.5, "AutomaticTrip of Reactor CoolantPumpsPolicy Statementon EngineeringExpertise on ShiftApplications forLicense AmendmentsTechnical Resolution ofGeneric Issue B-19Thermal HydraulicStabilitySafety Concerns Associatedwith Pipe Breaks in theBWR Scram System04/24/8603/31/8603/25/8603/20/8605/29/8605/29/8602/13/8602/10/8601/23/8601/03/86All Power ReactorLicensees andApplicants f/PowerReactor LicensesAll Licensees ofOperating BWRs andPWRs and LicenseApplicantsAll Licensees ofOperating ReactorsApplicants for OLsand Holders of CPsAll ReactorLicensees andApplicantsAll Applicant andLicensees with CEdesigned NuclearSteam Supply SystemsAll Applicants andLicensees with B&WDesigned NuclearSteam Supply SystemsAll Power ReactorLicensees andApplicants for PowerReactor LicensesAll Power ReactorLicensees andOL ApplicantsAll Licensees ofOperating BWRsAll BWR Applicantsand Licensees/ 1 I-2 -This request for information was approved by the Office of Management andBudget under clearance number 3150-0011 which expires September 30, 1986.Comments on burden and duplication may be directed to the Office ofManagement and Budget, Reports Management, Room 3208, New Executive OfficeBuilding, Washington, D.C. 20503.Our review of your submittal of information in response to this letter is notsubject to fees under the provisions of 10 CFR 170. However, should you, aspart of your response or in a subsequent submittal, include an applicationfor license amendment or other action requiring NRC approval, it is subjectto the fee requirements of 10 CFR 170 with remittal of an application fee of$150 per application (Sections 170.12(c) and 170.21) and subsequentsemiannual payments until the review is completed or the ceiling in Section170.21 is reached.If you believe further clarification regarding this issue is necessary ordesirable, please contact Mr. R. Lobel (301 492-9475.)Sincerely,Frank J. Miraglia, DirectorDivision of PWR Licensing-BEnclosure:Safety Evaluationcc w/enclosure:Service ListsDistribution:All CE pEsMemo FilePKreutzerAThadaniPP \ze D a eft/1-l85 \ 1% /86VC -/RSle, //ty/PWR#8AwAThadani FMA /lo /86 a