ML022140006
| ML022140006 | |
| Person / Time | |
|---|---|
| Site: | Prairie Island  |
| Issue date: | 08/29/2002 |
| From: | Marsh L NRC/NRR/DLPM |
| To: | Grobe J Division of Reactor Safety III |
| References | |
| FOIA/PA-2005-0103, TAC MB1402, TAC MB1403, TAC MB1855, TAC MB1856, TIA 2001-002, TIA 2001-004 | |
| Download: ML022140006 (11) | |
Text
August 29, 2002 MEMORANDUM TO: John A. Grobe, Director Division of Reactor Safety Region III FROM: Ledyard B. Marsh, Deputy Director /RA/
Division of Licensing Project Management Office of Nuclear Reactor Regulation
SUBJECT:
RESPONSE TO TASK INTERFACE AGREEMENT (TIA 2001-02) AND TASK INTERFACE AGREEMENT (TIA 2001-04) REGARDING EVALUATION OF SERVICE WATER SYSTEM DESIGN BASIS REQUIREMENTS AT PRAIRIE ISLAND (TAC NOS. MB1402, MB1403, MB1855, AND MB1856)
By memoranda dated March 27, 2001 (TIA 2001-02), and April 26, 2001 (TIA 2001-04), you requested the Office of Nuclear Reactor Regulation (NRR) staffs assistance in resolving issues related to design- and licensing-basis assumptions for the cooling water system operations at the Prairie Island Nuclear Generating Plant, Units 1 and 2. The NRR staffs assessment of the issues identified in the subject TIAs is provided in the attachments.
In accordance with NRR Office Instruction COM-106, Control of Task Interface Agreements, dated November 26, 2001, we provided you with our draft responses to the subject TIAs on December 31, 2001, for your review and comment. We also forwarded the draft TIA responses to the licensee by letters dated January 16 and January 18, 2002, to solicit its comment. On April 12, 2002, the NRR staff, together with the cognizant Region III staff, met with the licensee at the licensees request. During this meeting, the licensee presented its comments on the draft TIA responses. Following the meeting, the licensee provided written comments on the draft TIA responses in a letter dated May 10, 2002.
The NRR staff has considered all available and relevant information, including the comments received from the licensee, in developing the attached responses to the subject TIAs.
Docket Nos. 50-282 and 50-306 Attachments: 1. NRR Response to TIA 2001-02
- 2. NRR Response to TIA 2001-04
ML022140006 *Previously Concurred OFFICE PDIII-1/PM PDIII-1/LA SPLB/SC* EMEB/SC* PDIII-1/SC PDIII/D DLPM/DD NAME TKim RBouling SWeerakkody KManoly LRaghavan SBajwa TMarsh DATE 08/28/02 08/27/02 07/25/02 07/25/02 08/28/02 08/28/02 08/29/02 OFFICE OF NUCLEAR REACTOR REGULATION STAFFS RESPONSE TO TASK INTERFACE AGREEMENT (TIA) 2001-02 "DESIGN BASIS ASSUMPTIONS FOR NON-SEISMIC PIPING FAILURES AT THE PRAIRIE ISLAND PLANT"
1.0 INTRODUCTION
By memorandum dated March 27, 2001, Region III requested the Office of Nuclear Reactor Regulation (NRR) staffs assistance to resolve an inspection-related finding concerning design assumptions for seismic qualification of non-safety-related piping at the Prairie Island Nuclear Generating Plant (PINGP), Units 1 and 2. The following two issues were identified in TIA 2001-02:
Issue (1)
From a design basis perspective for system functional capability, can non-seismically analyzed piping be assumed to only leak as specified in BTP MEB 3-1, or should non-seismic piping be assumed to fail completely?
Issue (2)
From a design basis perspective for system functional capability, can piping designed for a Uniform Building Code (UBC) Zone 1 earthquake loading of 0.05g be considered seismically qualified piping?
By letter dated September 17, 2001, the licensee provided its response to the issues identified in TIA 2001-02. Also, by a letter dated May 10, 2002, the licensee provided comments on the NRR staffs draft TIA response. The NRR staff has reviewed TIA 2001-02 and the licensees associated submittals. The NRR staffs safety assessment of TIA 2001-02 is below.
2.0 NRR STAFFS RESPONSE TO ISSUE (1)
In general, nonseismically qualified piping is assumed to rupture during a seismic event. This position stems from Position C.2 of Regulatory Guide (RG) 1.29, Seismic Design Classification, which states in part:
Those portions of structures, systems, or components whose continued function is not required but whose failure could reduce the functioning of any plant feature included in 1a through 1q above [structures, systems and components (SSCs) that are important to safety] to an unacceptable safety level or could result in incapacitating injury to occupants of the control room should be designed and constructed so that the SSE [Safe Shutdown Earthquake] would not cause such failure.
ATTACHMENT 1
The term failure as it applies to structures, systems, and components is not specifically defined in the RG and therefore, all potential failure modes should be considered. For piping, potential failures would include cracks as well as a complete rupture. As a point of clarification, Branch Technical Position (BTP) MEB 3-1 (as well as BTP ASB 3-1) provides guidance for postulating pipe failures (breaks and cracks) that occur as initiating events during normal plant operation, and this guidance does not apply to the situation where pipe failures are postulated as a consequence of a seismic event. It should be noted that paragraph B.3.d of BTP ASB 3-1 is intended to clarify that a complete failure (double-ended rupture) of any piping not designed to seismic Category I requirements should be assumed.
In any event, the licensing application for the PINGP, Units 1 and 2, was reviewed by the Atomic Energy Commission (AEC) before the Standard Review Plan (SRP) and RG 1.29 criteria were implemented, and therefore, these criteria (including BTPs ASB 3-1 and MEB 3-1) do not apply to PINGP. Regulations and regulatory guidance in effect at the time of the design and construction of the PINGP units did not provide clear guidance with respect to the effects an SSE has upon a non-seismically designed piping system.
In responding to this issue (letters dated September 17, 2001, and May 10, 2002), the licensee indicated that the non-seismically designed piping is expected to maintain its pressure boundary integrity during a seismic event based on industry experience and [seismic design]
qualifications of buildings through which the piping is routed. While the PINGP design- and licensing-basis information may not be clear in this regard, it has been the NRR staffs position, consistent with RG 1.29, that a complete pipe failure (rupture) should be assumed for nonseismically designed piping when evaluating functional capability of a given system (i.e., cooling water system). The NRR staff positions in RG 1.29 were developed based on the NRC staffs review practices in effect at that time.
In demonstrating functional capability of a system, it is acceptable to perform a system hydraulic analysis, assuming a complete failure of a single pipe (worst-case - i.e., the largest line connected to a header) at a time; the intent here is to bound possible cases where partial failures (cracks) may occur in multiple lines following a seismic event. However, credit cannot be given for any non-seismic piping remaining intact following a seismic event, unless the piping has been analyzed to specific criteria (proposed by the licensee and approved by the NRC staff) for demonstrating the seismic adequacy of that piping.
The licensees May 10, 2002, letter, states that the licensee has conducted an assessment of the non-seismically qualified portions of the cooling water system and identified locations of potential vulnerabilities. A hydraulic model was then used to address the significance of these potential vulnerabilities; the response of the system during a seismic event was modeled, including postulating complete pipe breaks, at these vulnerable locations. The licensee stated that the results from the hydraulic model show, with pipe breaks at these location, that the cooling water system would still be able to accomplish the required functions to support safe shutdown for both units.
The licensee also indicated that operator response, while not credited in the hydraulic model, would be effective in locating and isolating any failed piping. For example, there is a low header pressure alarm (set point of 75 psig) on the Control Board which would alert the operators if the pressure in the cooling water header is less than 75 psig. With the pressure in the cooling water header less than 75 psig (which the hydraulic model predicts it will be less
than 75 psig with the assumed pipe breaks), the operator is directed to reduce the cooling water system demand per the applicable operating procedures. These procedures direct the operators to inspect the cooling water system for leaks. The specific areas to inspect are identified, including the isolation valve (by number and location), for isolating any piping leaks.
We recommend that the licensees hydraulic evaluation and the operator response be reviewed during a future inspection.
3.0 NRR STAFFS RESPONSE TO ISSUE (2)
Issue (2)
From a design basis perspective for system functional capability, can piping designed for a Uniform Building Code (UBC) Zone 1 earthquake loading of 0.05g be considered seismically qualified piping?
Structures, systems, and components of a nuclear power plant that are important to safety are required to withstand the effects of earthquakes without a loss of the capability to perform their safety functions. The earthquake for which these plant features are designed is defined as an SSE and described in the licensing-basis documentation for the plant. Those plant features that are designed to remain functional if an SSE occurs are considered to be seismically functional.
The seismic design load at PINGP is 0.12g for an SSE. Therefore, the NRR staff concludes that a piping system designed based on the UBC Zone 1 earthquake loading of 0.05g can not be considered seismically qualified (i.e., Class I).
The NRR staff notes, however, that Section 3.2, Classification of Structures, Components and Systems, of the AEC Safety Evaluation Report for Prairie Island, dated September 28, 1972, states in part the following:
The applicant has used two categories of seismic design. Class I (seismic) items are designed to withstand the design basis earthquake (horizontal ground acceleration of 0.12g) without loss of function. Class II (seismic) items are designed in accordance with earthquake loads specified by the Uniformed Building Code (UBC) for the Zone 1 area, although the code specifies the location of the site to be in a Zone 0 earthquake area (which would require less stringent design measures). The earthquake load for UBC Zone 1 is approximately equivalent to an operational basis earthquake load (horizontal ground [zero period] acceleration of 0.06g). The design assures that a failure of an adjacent lower class structure due to earthquake, tornado winds or missile will not cause a loss of function to a Class I (seismic) structure or Class I (seismic) equipment by direct or indirect failure of structural components.
As the licensee stated in its May 10, 2002, letter, it is consistent with the plants licensing basis to use UBC Zone 1 loadings to show that non-Class I SSCs will not adversely affect Class I SSCs during a design-basis event.
OFFICE OF NUCLEAR REACTOR REGULATION STAFFS RESPONSE TO TASK INTERFACE AGREEMENT (TIA) 2001-04 "DESIGN BASIS RELIANCE ON NON-SEISMIC AND NON-SAFETY RELATED EQUIPMENT AT THE PRAIRIE ISLAND PLANT"
1.0 INTRODUCTION
By memorandum dated April 26, 2001, Region III requested that the Office of Nuclear Reactor Regulation (NRR) resolve two issues related to design-basis service water system operations at the Prairie Island Nuclear Generating Plant (PINGP), Units 1 and 2. The specific issues involve the Nuclear Management Companys (PINGPs licensee) assumption that (1) only a single seismically qualified or adequate flow path is required to demonstrate ongoing operability of the cooling water system and (2) non-safety-related equipment (air-operated valve and associated air supply) may be relied upon to demonstrate operability of the cooling water system. The following two issues were identified in Task Interface Agreement (TIA) 2001-04:
Issue (1)
From a licensing basis perspective for system functional capability, is the Prairie Island Plant design required to include two independent, seismically adequate discharge flow pathways for the preferred service water system? Also, if the plant design is required to include two independent, seismically adequate discharge flow pathways, what criteria should the regional staff use to determine that the pathways are seismically adequate (e.g., SQUG, etc)?
Issue (2)
From a design and licensing basis perspective for system functional capability, may the licensee rely upon the post-accident, automatic closure of the spring-to-open, air-to-close non-safety related turbine building hydrogen cooler service water control valve to preclude the service water pumps from operating beyond the run-out region of the pump curve and to ensure adequate cooling of safety-related loads?
By letter dated September 17, 2001, the licensee provided its response to the issues identified in TIA 2001-04. Also, by a letter dated May 10, 2002, the licensee provided comments on the NRR staffs draft TIA response. The NRR staff has reviewed TIA 2001-04 and the licensees associated submittals. The NRR staffs safety assessment of TIA 2001-04 is below.
2.0 NRR STAFFS RESPONSE TO ISSUE (1)
From the initial licensing-basis perspective for system functional capability, PINGP is not required to include two independent, seismically adequate discharge flow pathways for the preferred service cooling water system. The current licensing basis for PINGP includes Generic Letter (GL) 87-02, Verification of Seismic Adequacy of Mechanical and Electrical Equipment in Operating Reactors, Unresolved Safety Issue (USI) A-46. GL 87-02 requested licensees, for the implementation of USI A-46, to ensure that each plant would be capable of being brought to a safe shutdown condition following a design-basis seismic event by verifying the seismic adequacy of a success path with the assumption of a failure of any single active component.
ATTACHMENT 2
However, it was considered acceptable to have only a single seismic Category I flow path that is vulnerable to a single active failure, provided it is demonstrated that ample time existed for operator action to overcome the single active failure. In this regard, it would not be necessary to assume complete blockage of the redundant non-seismic flow paths if they are located in a portion of the turbine building that is designed to withstand a design-basis earthquake as indicated in the PINGP Updated Safety Analysis Report and in the licensees submittals dated September 17, 2001, and May 10, 2002. However, a complete rupture of one of the non-seismic discharge pipes should be assumed when performing the analysis to determine the available time for operator action.
Alternatively, the licensee could demonstrate the seismic adequacy of one or both of the cooling water system normal discharge paths. To date, the licensee has not demonstrated the seismic adequacy of these discharge lines in a manner which is acceptable to the NRR staff.
3.0 NRR STAFFS RESPONSE TO ISSUE (2)
This issue pertains to the crediting of non-safety-related equipment to function in a loss of offsite power (LOOP) event. The specific component is the cooling water control valve for the turbine generator hydrogen coolers. On a turbine trip, this valve will automatically close and reduce the demand on the cooling water system. Based on testing in 1974, the valve will close in approximately 9.5 minutes following a LOOP.
The cooling water control valve for the turbine generator hydrogen coolers is a non-safety related valve, the position of which is automatically controlled by a valve positioner that receives a signal from a temperature sensor. The valve requires an air supply to close and fails to the open position on loss of air. The air supply comes from the instrument air system which is supplied by non-safety-related air compressors. However, the air compressors are automatically loaded onto the diesel generators and would be available during a LOOP. The electrical supply for the control valve actuator is from an electrical panel that is backed from a safeguards (safety-related) battery with no redundancy. The temperature sensor is powered from a safeguards instrument panel that would also receive power from a safeguards battery.
Therefore, although the valve is non-safety-related, there is reasonable assurance that it would be available to close and reduce the demand on the cooling water system. However, such closure was not relied upon (in the original design basis) to assure adequate cooling water flow to safety-related equipment and protect the cooling water pumps from damage due to run-out if one of the pumps failed to start.
In a licensee submittal dated October 7, 1974, the licensee provided the results of cooling water system tests. These tests and associated analyses were performed to demonstrate that the cooling water system flow automatically provided by one of the diesel-driven cooling water pumps following a LOOP is adequate, assuming one of the two diesel-driven pumps fail to start.
In that submittal, the licensee stated the following:
A conservative analysis has shown that immediately after the two unit trip, sufficient pressure is available at the inlet to the diesel coolers to provide adequate cooling at the maximum expected cooling water supply temperature with conservative factors applied to account for diesel-driven pump wear and system aging. In addition, tests have demonstrated that in less than 10 minutes cooling water is automatically isolated to the main generator hydrogen coolers.
This provides additional cooling water which can be made available to the diesels.
In the NRC staffs safety evaluation dated October 30, 1974, related to the licensees October 7, 1974, submittal, the NRC staff stated the following:
The results of diesel generator tests showed that for the present conditions of the cooler, 10 psig [pounds per square inch gauge] cooling water system header pressure is required to provide adequate cooling of the diesel generators. For aged coolers,...., the required header pressure is 13.3 psig. The results of cooling water system analysis and water flow reduction tests showed that for, the present system, a minimum header water pressure of 45 psig would exist immediately after loss of power and that it would increase to 73 psig when the hydrogen cooler valve closed 9.5 minutes following plant trip. For an aged system, ...., the minimum calculated header pressure immediately after loss of power is 24 psig and the calculated pressure after 9.5 minutes is 43 psig.
The licensees test results also showed that following a plant trip, the flow from one pump would be approximately 20,000 gallons per minute (gpm). While this is above the manufacturers recommended flow of 17,500 gpm for continuous operation, it is below pump runout conditions of 22,500 gpm and per the manufacturers recommendations, pump operation could be continued for 1-2 hours0.0833 days <br />0.0119 weeks <br />0.00274 months <br /> at approximately 20,000 gpm. This provides plenty of time for operator actions to close the safety-related motor-operated isolation valves reducing flow to below the 17,500 gpm continuous operation point.
Based on the above, it appears that the NRC staff accepted the system design because the tests and analysis showed that adequate flow was provided to the diesel generator coolers even without credit for the hydrogen cooler control valves. Since the NRC staff would give credit for isolation of the non-safety-related portions of the cooling water system after 10 minutes, via safety-related motor-operated isolation valves from the control room, there would be no need to assure (rely on) the hydrogen cooler control valves closed within 9.5 minutes. Because adequate flow existed without reliance on hydrogen cooler control valve closure and without reaching pump runout, the failure of the valve to close became inconsequential.
However, even though the NRC staff has concluded that it did not rely on closure of the non-safety-related hydrogen cooler control valve for the acceptance of the cooling water system design, this conclusion cannot be applied across the board for all systems under all conditions and events. The NRC staff has accepted reliance on non-safety-related equipment under specific circumstances for different events and such instances must be examined on a case-by-case basis.