ML15014A469
| ML15014A469 | |
| Person / Time | |
|---|---|
| Issue date: | 07/08/2015 |
| From: | Michael Cheok, Kokajko L Generic Communications Projects Branch |
| To: | |
| Popova E | |
| References | |
| RIS-05-029, Rev 1 | |
| Download: ML15014A469 (10) | |
See also: RIS 2005-29
Text
UNITED STATES
NUCLEAR REGULATORY COMMISSION
OFFICE OF NUCLEAR REACTOR REGULATION
OFFICE OF NEW REACTORS
WASHINGTON, D.C. 20555-0001
MONTH DD, 2015
NRC REGULATORY ISSUE SUMMARY 2005-29, REVISION 1
ANTICIPATED TRANSIENTS THAT COULD DEVELOP INTO MORE
SERIOUS EVENTS
ADDRESSEES
All holders of an operating license or construction permit for a pressurized water reactor (PWR)
under Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Domestic Licensing of
Production and Utilization Facilities, except those who have permanently ceased operations
and have certified that fuel has been permanently removed from the reactor vessel.
All holders of and applicants for a PWR combined license, standard design approval, or
manufacturing license under 10 CFR Part 52, Licenses, Certifications, and Approvals for
Nuclear Power Reactors. All applicants for a PWR standard design certification, including such
applicants after initial issuance of a design certification rule.
INTENT
The U.S. Nuclear Regulatory Commission (NRC) is revising Regulatory Issue Summary (RIS)
2005-291 to inform addressees of concerns identified during recent license amendment reviews.
Specifically, licensing bases, as documented in final safety analysis reports (FSARs), updated
FSARs (UFSARs), or design control documents (DCDs), failed to demonstrate that anticipated
operational occurrences (AOOs, also Condition II events) would not progress to more serious
events (Condition III or IV events). Revision 1 to RIS 2005-29 supersedes in its entirety RIS 2005-29. Neither the original RIS nor this revision transmits any new requirements or requires
any specific action or written response.
BACKGROUND INFORMATION
Appendix A to 10 CFR Part 50, General Design Criteria for Nuclear Power Plants, establishes
minimum requirements for the principal design criteria for those water-cooled nuclear power
plants that were licensed to these general design criteria (GDC). Those plants that were
licensed before the GDCs may have similar plant-specific minimum requirements for the
principal design criteria. The GDC that are applicable to the AOOs discussed in this RIS are the
following:
1
Available in Agencywide Documents Access and Management Systems (ADAMS) under Accession
No. ML051890212.
RIS 2005-29, Rev. 1
Page 2 of 9
- GDC 15, Reactor Coolant System Design, requires that the reactor coolant system and
its associated auxiliary control and protection systems be designed with sufficient margin
to assure that the design conditions of the reactor coolant pressure boundary are not
exceeded during any condition of normal operations, including anticipated operational
occurrences (AOOs).
- GDC 21, Protection System Reliability and Testability, requires, in part, that the
protection system be designed to assure that no single failure results in loss of the
protection function.
- GDC 29, Protection Against Anticipated Operational Occurrences, requires that the
protection and reactivity control systems be designed to assure an extremely high
probability of accomplishing their safety functions in the event of AOOs.
Furthermore, 10 CFR 50.34(b), Final safety analysis report, requires an FSAR to include
among other things:
A description and analysis of the structures, systems, and components of the
facility, with emphasis upon performance requirements, the bases, with technical
justification therefore, upon which such requirements have been established, and
the evaluations required to show that safety functions will be accomplished. The
description shall be sufficient to permit understanding of the system designs and
their relationship to safety evaluations.
Regulatory Guide (RG) 1.70, Standard Format and Content of Safety Analysis Reports for
Nuclear Power Plants (LWR Edition),2 provides guidance to applicants of or holders of all
specific licenses or permits issued by the NRC. Chapter 15, Accident Analyses, to RG 1.70
offers guidance as to which AOOs should be included in the safety analysis reports. The NRC
issued similar guidance for combined licenses under 10 CFR Part 52 in RG 1.206, Combined
License Applications for Nuclear Power Plants (LWR Edition).2
NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear
Power Plants: LWR Edition, referred to as the SRP3, is intended to be a comprehensive and
integrated document that provides the NRC staff with guidance that describes methods or
approaches that the NRC staff has found acceptable for meeting NRC requirements. The NRC
staff uses the categorization of accidents and transients as described in Chapter 15.0,
Introduction - Transient and Accident Analyses of the SRP to review FSAR, or UFSAR,
Chapter 15 safety analyses. Chapter 15.0,Section I.1.A of the SRP states, Incidents of
moderate frequency and infrequent events are also known as Condition II and Condition III
events, respectively, in the commonly used, often cited but unofficial American Nuclear Society
(ANS) standards. In other words, Condition II events (AOOs) are more frequent than
Condition III events. Additionally, Condition II events should produce less severe consequences
than Condition III events, as noted in Chapter 15.0 to the SRP:
2
Publically available for download at http://www.nrc.gov/reading-rm/doc-collections/reg-guides/power-reactors/rg/.
3
Publically available for download at http://www.nrc.gov/reading-rm/doc-collections/nuregs/staff/sr0800/.
RIS 2005-29, Rev. 1
Page 3 of 9
If the risk of an event is defined as the product of the events frequency of
occurrence and its consequences, then the design of the plant should be such
that all the AOOs and postulated accidents produce about the same level of risk
(i.e., the risk is approximately constant across the spectrum of AOOs and
postulated accidents). This is reflected in the general design criteria (GDC),
which generally prohibit relatively frequent events (AOOs) from resulting in
serious consequences, but allow the relatively rare events (postulated accidents)
to produce more severe consequences.
Lastly, Chapter 15.0 to the SRP identifies acceptance criteria for the various categories of
events. Of interest in this RIS is the following criterion applicable to Condition II events:
By itself, a Condition II incident cannot generate a more serious incident of the
Condition III or IV category without other incidents occurring independently or result in
a consequential loss of function of the RCS or reactor containment barriers.
For purposes of this RIS, this criterion will be referred to as the non-escalation criterion. The
discussion in this RIS applies to those licensees who have incorporated the non-escalation
criterion into the licensing bases (as documented in the plants FSARs, UFSARs, or DCDs),
either directly or by reference to an ANS standard4. The purpose of the non-escalation criterion
is to prohibit the progression of the relatively high frequency Condition II events to more
significant Condition III or Condition IV events. There have been several instances where the
non-escalation criterion was not met, and a Condition II event generated a Condition III event.
Specifically, inadvertent operation of the emergency core cooling system (ECCS) resulted in
filling the pressurizer, and, in at least one case5, relieved water through the power operated
relief valves (PORVs). If water relief through the PORVs continues long enough, there is
potential for the rupture disc on the pressurizer relief tank to rupture and RCS water to be spilled
directly into containment, leaving the plant in a condition that will require significant clean-up
efforts and potentially cause dose concerns.
During recent NRC review activities, the NRC staff discovered that several licensees had
encountered difficulties in meeting the non-escalation criterion for several UFSAR Chapter 15
mass addition events6. Some of these difficulties were identified as the result of relying on
4
Typically ANS 18.2-1973, "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants,
August 6, 1973 or ANSI/ANS 51.1-1983, Nuclear Safety Criteria for the Design of Stationary Pressurized Water
Reactor Plants, April 29, 1983.
5
Available in ADAMS under Accession No. ML051860338.
6
Mass addition events can increase reactor coolant system (RCS) inventory. Mass addition events do not contribute
to fuel clad damage since they do not produce conditions (e.g., RCS depressurization at a high power level) that
would tend to reduce core thermal margin (i.e., departure from nucleate boiling ratio (DNBR)).
RIS 2005-29, Rev. 1
Page 4 of 9
guidance provided by Westinghouse, contained in Nuclear Safety Advisory Letter,
NSAL 93-0137, and its supplement. NSAL 93-013, a third-party guidance document, has not
been approved for use8 nor endorsed by the NRC.
SUMMARY OF ISSUE
The NRC staff observed that certain safety analyses, specifically in Chapter 15 of UFSARs,
failed to meet the non-escalation criterion for three mass addition Condition II events (AOOs).
These Condition II events are: the chemical and volume control system (CVCS) malfunction, the
inadvertent operation of the ECCS during normal operation, and the inadvertent opening of a
PORV or a pressurizer safety valve (PSV). The NRC staff is concerned that these Condition II
events (AOOs) could escalate to a small break loss of coolant accident (SBLOCA), a Condition
III event, in turn violating the non-escalation criterion. Several of these licensing basis safety
analyses that failed to meet the non-escalation criterion were identified as having relied upon
information from the third-party guidance provided in NSAL 93-013 and its supplement. One of
the failures resulted in NRC follow-up actions to correct the issue. The below sections describe
the NRC staff concerns in regard to meeting the non-escalation criterion for the following three
licensing basis analyses: CVCS malfunction that increases reactor coolant inventory,
inadvertent operating of the ECCS (IOECCS), and inadvertent opening of a PORV or PSV.
A. CVCS Malfunction That Increases Reactor Coolant Inventory
The licensing basis analysis postulates the CVCS to malfunction due to a component fault (e.g.,
a water level sensor failing low) or an operator error. The result is high-rate charging flow
injection into the RCS, which could result in the pressurizer going water-solid and the PORVs
passing water. Without operator action to terminate the event, the CVCS malfunction, a
Condition II event, could become a more serious Condition III SBLOCA event. The NRC staff
has observed two different licensing basis analyses for the CVCS malfunction event that failed
to meet the non-escalation criterion.
A.1 Evaluation of the CVCS malfunction is not required, since it is already analyzed in the
licensing basis (i.e., as a reactivity anomaly)
The CVCS malfunction is listed in RG 1.70 as a mass addition event and also as a reactivity
anomaly. However, these cases are not equivalent and not interchangeable.
The licensing basis analysis of a CVCS malfunction as a reactivity anomaly (i.e., boron dilution)
event relies on the protection of various neutron flux-based trips and operator actions to end the
that the operators have more than 15 minutes to end the boron dilution prior to returning to
criticality.
7
The supplement to NSAL 93-013 can be found as Enclosure 2 under Accession No. ML050320117.
8
With respect to third-party documents, approved for use means that the NRC has determined that the matters
addressed in the document are technically acceptable and consistent with NRC regulatory requirements, guidance
and policy, but the NRC neither supports nor discourages entities from using the positions set forth in the document.
Endorse, by contrast means that in addition to the NRC determination above, the NRC encourages entities to follow
the positions in the document.
RIS 2005-29, Rev. 1
Page 5 of 9
However, the licensing basis analysis of a CVCS malfunction as a mass addition event does not
assume minimum RCS volume, a neutron flux-based trip, or focus on reactivity concerns.
Rather, the focus is on the integrity of the RCS. The charging pumps add water to the RCS, and
power generation continues until a reactor trip signal is produced by the automatic reactor
protection system (e.g., a high pressurizer water level trip signal). However, the charging flow
continues to fill the pressurizer and can only be stopped by operator action.
Because the mass addition licensing basis analysis and the reactivity anomaly licensing basis
analysis of the Condition II CVCS malfunction event have different initial conditions and goals,
only performing the reactivity anomaly licensing basis analysis does not meet the non-
escalation criterion.
A.2 Evaluation of the CVCS malfunction is not required, since it is not as severe as the
IOECCS
A reactor trip signal is generated during the CVCS malfunction, and the event is terminated
when the operator shuts off charging flow. The CVCS malfunction could be less limiting (i.e.,
the pressurizer is predicted to fill at a slower rate) than the IOECCS. The time to fill the
pressurizer could be longer, since the coolant shrinks when the reactor is tripped, and the
charging flow rate is lower than when the charging pumps are operating as part of the ECCS.
However, the IOECCS is a mass addition event that begins with a reactor trip, whereas the
CVCS malfunction involves the addition of both mass and heat to the RCS, making a direct
comparison between the two events impossible. Therefore, a statement in the licensing basis
(usually FSAR or UFSAR) that the CVCS malfunction is not as severe as the inadvertent ECCS
evaluation does not meet the non-escalation criterion. The licensing basis analysis of the
Condition II CVCS malfunction event is necessary in order to demonstrate that the non-
escalation criterion has been met.
B. IOECCS
The licensing basis postulates IOECCS to occur as the result of a spurious safety injection
signal. ECCS is assumed to operate the ECCS pumps at their peak performance level (i.e., no
failures are assumed). The shutoff head of most ECCS is greater than the nominal RCS
pressure and could lift the PORVS or PSVs. If one or more PORVs open while the pressurizer
is water-solid, then the PORV(s) are generally assumed to fail open, since valves that are not
qualified to relieve water are conservatively assumed to remain in the fully open position. In this
case, a stuck-open PORV could cause a Condition III SBLOCA event and fail to meet the non-
escalation criterion. Five of the several alternative approaches suggested by NSAL 93-013, in
regards to the IOECCS, failed to meet the non-escalation criterion and are discussed in detail
below.
B.1 Closing a block valve to isolate a stuck-open PORV
Licensing basis analyses that predict that the pressurizer fills and water is relieved through the
PORVs often cite the following from NSAL 93-013 in their UFSARs, Water relief through the
PORVs is not a concern, because the PORV block valves can be used to isolate the PORVs if
RIS 2005-29, Rev. 1
Page 6 of 9
they fail to close. The NRC staff noted in the original version of RIS 2005-29 that closing a
block valve to isolate a stuck-open PORV is an action that would be taken to respond to a
Condition III loss of coolant accident, not to a Condition II IOECCS. This demonstrates that the
Condition II IOECCS does in fact become a Condition III event because a stuck open PORV is
expected as the result of the event and not as an independent failure. Therefore, this approach
does not demonstrate that the Condition II IOECCS meets the non-escalation criterion.
B.2 Application of the PSVs as a protection system
Licensing basis analyses that are based upon the application of water-qualified PSVs to mitigate
IOECCS require the PSVs to open, relieve water, and reseat. The rationale relies upon the
premise that none of the PORVs will open, or if they open and stay open, then they can be
closed or isolated citing the same flawed logic as approach B.1 above. The rationale for this
licensing basis analysis may also assume that the PORVs are not operable, which the NRC
staff has identified as a non-conservative assumption9. It is conservative to maximize the rate at
which the pressurizer fills during an IOECCS. This is done by assuming that the pressurizer
PORVs and sprays are operable since they tend to limit the rate of RCS pressurization, which
would permit a relatively higher rate of ECCS delivery. Thus, the pressurizer fills more rapidly
as steam is relieved through the PORVs.
In general, the NRC staff considers the substitution of PSVs for PORVs to be inappropriate for
Condition II events10. The PORVs, which are part of the automatic pressure control system,
along with the pressurizer heaters and spray, are used to maintain the plant within its
acceptable operating range. They limit RCS pressurization to levels below the high pressure
reactor trip setpoint and prevent unnecessary operation of the PSVs. Condition II events are
normally handled by the automatic pressure control system (e.g., during load rejections). If the
plant conditions exceed the capabilities of the automatic pressure control system during a
Condition II event, then the event should be ended with, at most, a reactor shutdown, as
specified in the design requirements for Condition II events (AOOs)11. In contrast, PSVs will not
open until after the reactor has been tripped, since the opening setpressure for the PSVs is
higher than the high pressure reactor trip setpressure. In other words, PSVs are not expected
to open during Condition II events. Furthermore, mass addition events cannot pressurize the
RCS to challenge the RCS pressure safety limit. The delivery of ECCS water effectively ends
when the RCS pressure reaches the ECCS pump shutoff head (about 2600 psia, which is well
9
Chapter 15.5.1-15.5.2, Inadvertent Operation of ECCS and Chemical and Volume Control System Malfunction That
Increases Reactor Coolant Inventory.
10
Note 8 of Matrix 8 of Section 2.1 to Review Standard (RS) 001, Review Standard for Extended Power Uprates,
states:
For the inadvertent operation of emergency core cooling system and chemical and volume control system
malfunctions that increase reactor coolant inventory events: (a) non-safety grade
pressure-operated relief valves should not be credited for event mitigation and (b) pressurizer level should not be
allowed to reach a pressurizer water-solid condition.
RS-001 is publically available for download at http://www.nrc.gov/reactors/operating/licensing/power-uprates/related-
reg-guides/guides-pu.html.
11
Most FSARs, or UFSARs, state, directly or by reference to ANS Standards, Condition II events shall be
accommodated with, at most, a shutdown of the reactor with the plant capable of returning to operation after
corrective action.
RIS 2005-29, Rev. 1
Page 7 of 9
below the RCS pressure safety limit of 110 percent of RCS design pressure). Therefore, as
stated before in RIS 2005-29, this approach does not adequately demonstrate that IOECCS will
meet the non-escalation criterion.
B.3 A stuck-open PORV or PSV resulting from an IOECCS is already addressed as an
inadvertent opening of a PORV or PSV
Some licensing basis analyses claim that an IOECCS that results in a stuck-open PORV need
not be considered as an escalation to the Condition III category because an inadvertent opening
of a PORV or PSV is already analyzed as a Condition II event in most licensing bases.
However, the inadvertent opening of a PORV or PSV is often analyzed in the licensing basis to
show that adequate, timely protection is provided by an automatic reactor trip, a different
Condition II design requirement12. The licensing basis analysis typically predicts the reactor trip
to occur in a few seconds, which is before the ECCS starts injecting into the RCS.
Consequently, the Condition II inadvertent opening of a PORV or PSV licensing basis analysis
does not model ECCS injection, which is an initial condition for IOECCS. Therefore, inadvertent
opening of a PORV or PSV cannot be used to bound IOECCS and does not meet the non-
escalation criterion for a stuck open PORV or PSV resulting from an IOECCS.
B.4 A stuck-open PORV or PSV is not as severe as a SBLOCA
Licensing basis analyses that consider a stuck-open PORV or PSV to be less severe than a
SBLOCA do not fit into the classic scheme of event classification, upon which nuclear safety
analyses are based, and effectively create a new category of high-frequency,
severe-consequence events. Comparing or bounding the licensing basis IOECCS to or with
any of the SBLOCA licensing basis analyses does not meet the non-escalation criterion since
the IOECCS is a Condition II event and a SBLOCA is a Condition III event.
B.5 RCS inventory that exits through the PORV(s) is made up by ECCS flow
Some licensees have included the following statements from NSAL 93-013 about Condition II
events into the licensing basis:
1. ... a Condition II event as a minor reactor coolant system leak which would not prevent
orderly reactor shutdown and cooldown assuming makeup is provided by normal
makeup systems only, and
2. Since the cause of the water relief is the ECCS flow, the magnitude of the leak will be
less than or equivalent to that of the ECCS (i.e., operation of the ECCS maintains RCS
inventory during the postulated event and establishes the magnitude of the subject
leak).
12
Regarding the acceptance criteria necessary to meet the requirements of GDCs 10, 15, 20, and 26 for incidents of
moderate frequency, the SRP states in Chapter 15.0, Fuel cladding integrity shall be maintained by ensuring that the
minimum departure from nucleate boiling ratio (DNBR) remains above the 95/95 DNBR limit for PWRs
RIS 2005-29, Rev. 1
Page 8 of 9
The NRC staff identified two issues with how these two statements were applied in IOECCS
licensing basis analyses. First, the charging system, when operated as a part of the ECCS,
cannot be considered to be a normal makeup system. Charging flow operated as a part of the
ECCS is not controlled by a pressurizer level program or by letdown flow rates. It operates at
maximum capacity, and it does not shut down until an operator shuts it down. When the
charging system is operated as a part of the ECCS, its purpose is to supply emergency core
cooling, not to maintain a programmed pressurizer level.
Second, the water relief rate through the PORVs will be critical flow, which is determined by the
pressure difference between the pressurizer and the pressurizer relief tank (e.g., about 2300
psi), and ultimately, the containment. In the short term, the water flowing out of the RCS,
through the failed PORV(s) or PSV(s), far exceeds the rate of water flowing into the RCS from
the ECCS, depleting the RCS inventory. As the open PORVs depressurize the RCS, more
ECCS flow will be delivered by the ECCS pumps. Eventually, the RCS pressure drops down to
a few hundred pounds and the flow leaving the RCS through the PORVs will be equal to the
flow entering the RCS from the ECCS. Application of these two statements to the Condition II
IOECCS licensing basis analysis does not meet the non-escalation criterion.
C. Inadvertent Opening of a PORV or PSV
The primary objective of the licensing basis analysis regarding inadvertent opening of a PORV
or PSV is to show that the event would not lead to fuel clad damage. The licensing basis
analysis typically demonstrates that the automatic reactor trip is demanded by the portion of the
reactor protection system that is designed to protect against fuel clad damage (e.g.,
overtemperature T trip or low pressure trip). Since the reactor trip ends the degradation of
thermal margin, licensing basis analyses of this event tend to not extend past the time of reactor
trip to show that there would be no fuel clad damage. Although the reactor shutdown protects
against fuel clad damage, it does not end the RCS depressurization. Manual action must be
taken to close the inadvertently opened PSV, PORV or its block valve before actuation of ECCS
could begin. An actuation of the ECCS could lead to a water-solid pressurizer, followed by
water relief through the PORVs, and ultimately to a Condition III SBLOCA event. Most licensing
basis analyses choose to show closure of the PSV, PORV, or its block valve prior to ECCS
actuation, in order to avoid the pressurizer filling shortly after ECCS delivery begins. One
approach within NSAL 93-013 failed to meet the non-escalation criterion and is described
below.
C.1 Closure of the PSV, PORV, or block valve after ECCS actuation
Failure to close the opened PSV, PORV, or its block valve before the ECCS actuation setpoint
is reached could result in a scenario where the ECCS introduces a large quantity of water into a
depressurizing RCS, causing the pressurizer to fill rapidly. The spuriously opened PSV or
PORV could relieve water and stick open if it is not water qualified. Once the ECCS is in
operation, it could be expected to remain in operation for several minutes since the operators
need time to follow the procedures governing the shut off of ECCS. After the ECCS flow is
terminated, operators could begin closing the PSV, PORV, or its block valve. If the PSV,
PORV, or its block valve do not close, then the inadvertent opening of a PSV or PORV could
continue as a Condition III SBLOCA and fail to meet the non-escalation criterion for Condition II
events.
RIS 2005-29, Rev. 1
Page 9 of 9
BACKFITTING AND ISSUE FINALITY
This RIS revision does not present a new or changed NRC staff position or guidance with
respect to progression of anticipated operational occurrences, nor does it require any action or
written response from any addressee. Therefore, issuance of this revised RIS is not a backfit
under 10 CFR 50.109, Backfitting, nor does it constitute a violation of any issue finality
provision in 10 CFR Part 52.
FEDERAL REGISTER NOTIFICATION
[Discussion to be provided in final RIS]
CONGRESSIONAL REVIEW ACT
[Discussion to be provided in final RIS]
PAPERWORK REDUCTION ACT STATEMENT
This RIS does not contain new or amended information collection requirements that are subject
to the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.). Existing requirements
were approved by the Office of Management and Budget (OMB), approval number 3150-0011
and 3150-0151.
Public Protection Notification
The NRC may not conduct or sponsor, and a person is not required to respond to, a request for
information or an information collection requirement unless the requesting document displays a
currently valid OMB control number.
CONTACT
Please direct any questions about this matter to the technical contact listed below.
/RA/ /RA/
Michael C. Cheok, Director Lawrence E. Kokajko, Director
Division of Construction Inspection Division of Policy and Rulemaking
and Operational Programs Office of Nuclear Reactor Regulation
Office of New Reactors
Technical Contact: Jennifer M. Whitman, NRR/DSS/SRXB
301-415-3253
E-mail: Jennifer.whitman@nrc.gov
ML15014A469 TAC MF3949 * via email
OFFICE NRR/DSS/SRXB* QTE* NRR/DSS/SRXB* RES/DE/RGGIB* NRR/DORL* NRR/DSS*
NAME JWhitman CHsu CJackson TBoyce GWilson RTaylor
DATE 03/16/2015 02/18/2015 03/21/2015 03/27/2015 04/08/2015 04/02/2015
OFFICE NRO/DCIP OE/EB* NRR/PMDA* OIS* NRR/DPR/PGCB OGC
NAME MCheok RCarpenter LHilll TDonnell ELee GMizuno
DATE 04/20/2015 04/03/2015 03/26/2015 04/09/2015 04/27/2015 06/12/2015
OFFICE NRR/DPR/PGCB* NRR//DPRPGCB*
NAME APopova SStuchell
DATE 07/08/2015 07/08/2015