ML20205H698
| ML20205H698 | |
| Person / Time | |
|---|---|
| Site: | Millstone  |
| Issue date: | 07/31/1986 |
| From: | NORTHEAST UTILITIES |
| To: | |
| Shared Package | |
| ML19292F793 | List: |
| References | |
| PROC-860731, NUDOCS 8608200135 | |
| Download: ML20205H698 (612) | |
Text
{{#Wiki_filter:_. . - . - _- .- 1 I l NORTHEAST UTILITIES SERVICE COMPANY AFFIDAVIT I
)
I, Richard T. Laudenat, being duly sworn, depose and state as follows: I
- 1. I am Manager, Generation Facilities Licensing Branch, Nuclear Engineering and Operations Group, Northeast Utilities Service Company, and as such I am responsible for the preparation and review of the proprietary information referenced herein sought to be withheld from public disclosure.
I am submitting this affidavit in conformance with the provisions of 10 CFR 2.790 of the Commission's regulations and in conjunction with the application of Northeast Nuclear Energy Company for withholding this information.
- 2. The information sought to be withheld represents a portion of Northeast i
Utilities Service Company's (NUSCO) extensive development efforts regarding a process by which NUSCO plans to evaluate proposed plant betterment projects. This information is contained in this submittal.
- 3. This is information of a type customarily held in confidence by Northeast Utilities Service Company and, other than its disclosure to the i Commission, is intended to be held in confidence and not disclosed to the
- public. Northeast Utilities Service Company has a rational basis for determining the types of information customarily held in confidence by it and evaluates each document or report which might contain proprietary information to determine whether the subject document should be accorded confidential treatment. This evaluation concludes that the subject
- document referenced herein does contain proprietary information which j justifies it being withheld from public disclosure.
ll ) 4. In determining whether information in a document or report is proprietary, the following criteria and standards are utilized by Northeast Utilities Service Company. A document or report is provided with confidential treatment if any one of the following criteria are mets (a) The information reveals the distinguishing aspects of a process, method, component, structure, equipment, or system where prevention of its use by any person or organization without license from Northeast Utilities Service ' Company might provide a competitive economic advantage over other companies. (b) It consists of suppcrting data, including test data, relative to a process, method, component, structure, equipment, or system, the app!! cation of which provides or could provide a competitive economic advantage to the Company. The availability of such information to any other person or organization would enable it to i modify its product or to pursue marketing or other actions which would improve its products positions or impair the position of the O product of Northeast Utilities Service Company and enable any such organization to avoid developing similar data and analyses in support of its process, method or apparatus. 8608200135 860731 PDR P ADOCK 05000245 PDR l
O (c) The development of the process, method, component structure, equipment, system or compilation of information required a significant expenditure of man hours of effort and dollars; a competitor would have to undergo similar expense to generate an equivalent formula, pattern, device, or compilation of information. (d) Obtaining licensing approvals necessary for the application of the process, method, component, structure, equipment, or system would require a significant effort and expense. Avoidance of this expense would decrease a potential competitor's cost in applying or marketing the process, method, component, structure, equipment, system or product to which the information is applicable.
- 5. The information is being transmitted to the Commission in confidence pursuant to the provisions of 10 CFR 2.790 with the understanding that it is to be received in confidence and withheld from public disclosure by the Commission.
- 6. The information, to the best of my knowledge and belief,is not available in public sources, and any disclosure to third parties has been and will be made pursuant only to regulatory requirements or proprietary agreements which provide for the maintenance of the information in confidence.
Richard T. Laudenat, being duly sworn, deposes and says that he has read the foregoing affidavit and that the matters stated herein are true and correct to the best of his knowledge, information, and belief. Executed in Berlin, Connecticut this31 day of Id .1986. 3.kebd Richard T. Laudena't State of Connecticut ss. Berlin County of Hartford Sworn and subscribed before me, a notary public, in said state and county, this f2],hy of .1dv .1986. J
/Ali Notary Public k 1(llt ]
My Commission Expires: foy Comrnistion Expires March 31, IS"'
MILLSTONE UNIT NO. l' , INTEGRATED SAFETY ASSESSMENT PROGRAM
, EXECUTIVE
SUMMARY
I
- In May 1985, the Nuclear Regulatory Commission approved a pilot Integrated
, Safety Assessment Program LISAP) for Northeast Nuclear Energy Company's L (NNECO) Millstone Unit No.1. ISAP represents a new approach to nuclear
- regulation and licensee decision making, and responds to long-standing NRC support for a systematic review of the safety of operating nuclear power plants.
Specifically, ISAP utilizes both deterministic and probabilistic techniques to evaluate proposed resolutions to all outstanding licensing issues, plant-specific resolutions to unresolved safety issues, and licensee-Initiated plant improvement projects. As such, the program substantially expands upon the earlier Systematic Evaluation Program and the Interim Reliability Evaluation Program conducted i for Millstone Unit No.1. -
; The current focus of the Millstone Unit No.1 ISAP is an evaluation, or prioritization process. For this phase of ISAP, NNECO has developed a detailed analytical ranking methodology. Each ISAP topic that has a well defined scope is evaluated, utilizing this methodology, for potential impacts on each of five i attributes: public safety, personnel safety, plant economic performance, i i personnel productivity, and external impacts. The remainder are evaluated
- deterministically.
! NNECO has developed models for assessing and scoring the various impacts in
!' each of these categories. In addition, the ISAP methodology applies conversion and weighting factors to integrate the five individual attribute scores for each i topic into one composite topic score. This score, in turn, serves as the basis for . a ranking, or prioritization, of all topics within the ISAP scope of review. l This final report summarizes the ISAP prioritization process for Millstone Unit
- No.1. For each topic, the report includes a description of the individual project i scope, a summary of the deterministic and probabilistic public safety impact i analyses, and the results of the evaluation with respect to the other impact i attributes. Composite scores are also provided, in tabular form, for all Millstone Unit No.1 ISAP topics.
I The evaluations, scores, and rankings from the ISAP prioritization will be used i along with othar pertinent parameters to determine the final resolution, and schedule, for each topic. ISAP is unique in that it includes a threshold concept i for eliminating proposed backfits which are not justified based on the evaluation j of benefits and costs. In addition, the project scores and rankings will be an important consideration in the development of an integrated implementation schedule. The integrated j schedule represents the next phase of the Millstone Unit No.1 ISAP. This
; approach to the backlog of pending plant modifications inherently assures that ! the projects with the greatest potential benefits - pub!!c safety and other i benefits - are assigned the highest priority. Issues with little or no benefit can ! be deferred or dropped, thereby conserving limited resources for allocation to the most important projects.
The ISAP topic list does not define the entire scope of this program. This report also identifies other plant-specific and regulatory policy issues, beyond the ISAP i
- - . _ - - ._ _ _ _m. _ _ _ . - - . _ _ _ . _ _ _ _ . _ _ _ _ _ _ _ . _ _ . _ _ _ _ _
l 1 O topic list, implicitly addressed by the ISAP evaluation process. The report also , summarizes major plant projects completed during the 1985 refueling outage, ; 4 and other projects which have either recently been accomplished or will be I accomplished shortly. These projects, representing a significant near-term ) demand on resources, were not included as ISAP topics but the resources expended will be relevant to the development of an integrated implementation schedule. Finally, the ISAP report is part of a pilot program. Recognizing that the i Millstone Unit No. I experience is important to further development of the ISAP methodology, the report includes a description of NNECO's efforts to validate the program and the results, and to independently critique the process. Future actions in this regard are described, along with future actions necessary to refine the Millstone Unit No.1 ISAP methodology and to develop an integrated implementation schedule for the pending Millstone Unit No. I plant modification projects. I 1 O l , l l O. l
Docket no. 50-245 l Integrated Safety Assessment Program
- MILLSTONE UNIT NO.1 i
lO I i l i FINAL REPORT l July 1986 i j
\ Prepared by NORTHEAST UTILITIES i
l , i__ _ _
i Table of Contents
's.j Section Title Page 1 INTEGRATED SAFETY ASSESSMENT PROGRAM 1-1 1.0 Introduction 1-1 1.1 History of ISAP l-4 1.2 ISAP and IIS 1-10 1.3 Backlog of Modifications 1-13 1.4 Millstone Unit No.1 Probabilistic Safety Study 1-14 2 ISAP PRIORITIZATION PROCESS 2-1 2.0 Introduction 2-1 2.1 Attribute Definition and Description 2-4 2.2 Analytical Ranking Methodology 2-8 2.3 Project Scoring and Evaluation 2-10 2.4 Development of Attribute Impact Models 2-15 2.5 Integrated Project Scoring 2-22 2.6 Finalized Ranking of Benefit / Cost Ratios 2-23 3 ISAP TOPIC REVIEWS - SUMMARIES 3-1 ISAP Topic No.1.01 - Gas Turbine Generator 3-1 Start I ogic Modifications ISAP Topic No.1.02 - Tornado Missile Protection 3-5 ISAP Topic No.1.03 - Containment Isolation - 3-10
- Appendix A Modifications ISAP Topic No.1.04 - RWCU System Pressure 3-14 Interlocks ISAP Topic No.1.05 - Ventilation System 3-17 Modifications ISAP Topic No.1.06 - Seismic Qualification of 3-22 Safety-Related Piping i
Section Title Pm ISAP Topic No.1.07 - Control Room Design Review 3-25 ISAP Topic No.1.08 - Safety Parameter Display 3-28 System ISAP Topic No.1.09 - Regulatory Guide 1.97 3-32 Instrumentation ISAP Topic No.1.10 - Emergency Response Facilities 3-44 Information ISAP Topic No.1.11 - Post-Accident Hydrogen 3-47 Monitor ISAP Topic No.1.12 - Control Room Habitability 3-30 ISAP Topic No.1.13 - BWR Vessel Water Level 3-55 Instrumentation ISAP Topic No.1.14 - Appendix 3 Modifications 3-59 ISAP Topic No.1.15 - FSAR Update 3-64 ISAP Topic No.1.16 - Appendix R 3-68 ISAP Topic No.1.16.1 - Appendix R, MPl/MP2 3-70 Backfeed ISAP Topic No.1.16.2 - Appendix R, Modify CRD 3-73 Pumps ISAP Topic No.1.16.3 - Appendix R, Alternative 3-76 Cooling for Shutdown Cooling ISAP Topic No.1.16.4 - Appendix R, Power Cold 3-79 Shutdown Equipment ISAP Topic No.1.16.5 - Appendix R, Curbs, Ramps 3-82 and Seals ISAP Topic No.1.16.6 - Appendix R, Water Curtains / 3-85 Steel Enclosures ISAP Topic No.1.16.7 - Appendix R, Cable Vault 3-88 Halon Suppression System ISAP Topic No.1.16.8 - Appendix R, Control Room 3-90 Halon Suppression System O 11 i
Section Title Page ISAP Topic No.1.16.9 - Appendix R, Fire Barriers 3-92 ISAP Topic 1.16.10 - Appendix R, MSIV/ ADS Circuit 3-94 Protection ISAP Topic No.1.16.11 - Appendix R, Hydrogen 3-97 System Modifications ISAP Topic No.1.16.12 - Appendix R, Emergency 3-99 Lighting Modifications ISAP Topic No.1.17 - Replacement of Motor- 3-101 Operated Yalves ISAP Topic 1.18 - Anticipated Transient Without 3-107 Scram (ATWS) ISAP Topic No.1.19 -Integrated Structural Analysis 3-112 ISAP Topic No.1.20 - MOV Interlocks 3-114 ISAP Topic No.1.21 - Fault Transfers 3-115 O V ISAP Topic No.1.22 - Electrical isolation 3-119 l ISAP Topic No.1.23 - Grid Separation Procedu.es 3-123 ISAP Topic No.1.25 - Degraded Grid Voltage 3-123 Procedures i ISAP Topic No.1.24 - Emergency Power 3-125 l l ISAP Topic No.1.26 - GL 83-28, Equipment 3-127 I Classification / Vendor interface ISAP Topic No.1.27 - GL 83-28, Post Maintenance 3-129 Testing ISAP Topic No.1.28 - GL 83-28, Post-Maintenance 3-130 Testing Technical Specification Changes ISAP Topic No.1.29 - Response to GL 81-34 3-132 ISAP Topic No.1.30 - GL 83-28, Post-Trip Review 3-134 Data and information , ISAP Topic No.1.31 - GL 83-28, Equipment 3-135 Classification / Vendor Interface O ill t
Section Title P_ag v ISAP Topic No.1.32 - GL 83-28, Post-Maintenance 3-137 Testing Procedures ISAP Topic No.1.33 - GL 83-28, Post-Maintenance 3-138 Testing Technical Specification Changes ISAP Topic No.1.34 - GL 83-28, Reactor Trip System 3-140 Testing ISAP Topic No.1.35 - GL 83-28, Reactor Trip System 3-141 Functional Testing ISAP Topic No.1.36 - Technical Specifications 3-142 Covered by GL 83-36 j ISAP Topic No.1.37 - Technical Specifications 3-143 to Address 10CFR50.72 and 10CFR50.73 ISAP Topic No.1.38 - Expand QA List 3-144 ISAP Topic No.1.39 - Radiation Protection Plans 3-147 ISAP Topic No.1.40 - Bolting Degradation or Failure 3-149 ISAP Topic No.1.41 - Flooding of Compartments 3-152 by Backflow
' SAP Topic No.1.42 - Main Steam Line Leakage 3-154 l Control System ISAP Topic No.1.43 - Water Hammer 3-156 1
j ISAP Topic No.1.44 - Asymmetric Blow-Down Loads 3-158 on Reactor Systems i ISAP Topic No.1.45 - Systems interactions 3-160 ISAP Topic No.1.46 - Determination of SRV Pool 3-162 Dynamic Loads ISAP Topic No.1.47 - Containment Emergency Sump 3-164 Performance ISAP Topic No.1.48 - Safety Factor for Penetration 3-166 X-10A ISAP Topic No.1.49 - Reactor Vessel Surveillance 3-168 Program O iv l L
Section Title g ISAP Topic No.1.50 -Isolation Condenser Start-Up/ 3-170 Make-up Failures ISAP Topic No.1.51 - Failure to Restore Main 3-172 Condenser ISAP Topic No.1.52 - SRV Failure - Setpoint Drif t 3-173 ISAP Topic No. 2.01 - LPCI Remotely Operated 3-174 Valves 1-LP-50A and B ISAP Topic No. 2.02 - Drywell Humidity 3-177 Instrumentation ISAP Topic No. 2.03 - Process Computer Replacement 3-180 ISAP Topic No. 2.04 - High Steam Flow Setpoint 3-183 Increase ISAP Topic No. 2.05 - Hydrogen Water Chemistry 3-185 Study ISAP Topic No. 2.06 - Condenser Retube 3-159 ISAP Topic No. 2.07 - Sodium Hypochlorite System 3-192 ISAP Topic No. 2.08 - Extraction Steam Piping 3-195 ISAP Topic No. 2.09 - Upgrading of P&lDs 3-198 ISAP Topic No. 2.10 - Drywell Ventilation System 3-201 ISAP Topic No. 2.!! - Stud Tensioners 3-204 ISAP Topic No. 2.12 - Reactor Vessel-Head Stand 3-207 Relocation ISAP Topic No. 2.13 - Turbine Water Induction 3-210 Modifications ISAP Topic No. 2.19 - DC System Review 3-210 ISAP Topic No. 2.14 - Evaluation and implementation 3-211 ' of NUREG-0577 ISAP Topic No.2.15 - Torque Switch Evaluations for 3-212 MOVs O v
p Section Title Page ISAP Topic No. 2.16 - Reactor Protection Trip System 3-214 ISAP Topic No. 2.17 - 4.16kV,480 V and 125 VDC 3-217 Plant Distribution Protection ISAP Topic No. 2.18 - Spent Fuel Poo! Storage 3-219 Racks / Transportation Cask ISAP Topic 2.20 - RWCU System Isolation Setpoint 3-221 Reduction ISAP Topic No. 2.21 - 480 V Load Center 3-225 Replacement of Oil-Filled Breakers ISAP Topic No. 2.22 - Control Rod Drive System 3-228 Water Hammer Analysis ISAP Topic No. 2.23 -Instrument, Service and 3-231 Breathing Air Improvements ISAP Topic No. 2.24 - Of f-Site Power Systems 3-236 ISAP Topic No. 2.25 - Drywell Temperature 3-240 Monitoring System Upgrade
'd ISAP Topic No. 2.26 - Reliability Equipment 3-243 ISAP Topic No. 2.27 - Spare Recirculation Pump 3-244 Motor ISAP Topic No. 2.28 - Long-Term Cooling Study 3-245 a
ISAP Topic No.2.29 - FWCl Assessment Study 3-248 ISAP Topic No. 2.30 - MSIV Closure Test Frequency 3-250 ISAP Topic No. 2.31 - LPCI Lube Oil Cooler Test 3-253 Frequency ISAP Topic No. 2.32 - Primary Containment Pump- 3-255 Back System ISAP Topic No. 2.33 - RBCCW Leak Rate Testing 3-258 4 PLANT-SPECIFIC ISSUES 4-1 4.0 introduction 4-1 4.1 Station Blackout 4-1 O v1
Section Title Page ! 4.2 A/SRO Issues 4-23 4.3 IE Bulletin 85-03, MOV Common Mode Failures 4-26 4.4 Gas Turbine Generator Reliability 4-28 4.5 Stretch Power 4-31 4.6 POL to FTOL Conversion 4-32 4.7 Change to 22 - 24 Month Fuel Cycle 4-35 4.8 Unresolved Safety Issues 4-38 4.9 Containment Purge and Vent issues 4-55 4.10 Review of Operating Experience 4-64 5 REGULATORY POLICY ISSUES 5-1 5.0 Introduction 5-1 5.1 Severe Accident Policy Statement 5-1 5.2 Treatment of External Events 5-5 5.3 Safety Goals 5-6 5.4 ACRS Ten-Year Review 5-9 5.5 Technical Specification Im,)rovement Initiatives 5-10 5.6 Life Extension 5-13 6 MAJOR REFUELING OUTAGE PROJECTS AND 6-1 ACTIVITIES 6.0 1985 Refueling Outage 6-1 7 PROJECTS NOT SPECIFICALLY EVALUATED IN ISAP 7-1 8 RESULTS OF ISAP TOPIC SCORING 8-1 9 YALIDATION OF RESULTS 9-1 9.0 Introduction 9-1 9.1 Sensitivity Studies 9-1 9.2 Independent Review 9-4 9.3 Conclusions 9-6 vil
Section Title Page 10 FUTURE ACTIONS 10-1 10.0 Introduction 10-1 10.1 Development of an Integrated Implementation 10-2 Schedule 10.2 Completion of the Millstone Unit No.1 ISAP 10-8 10.3 Action Plan for Improvements to the ISAP 10-9 Methodology APPENDIX A REFERENCES A-1 APPENDIX B 15AP CHRONOLOGY AND MAJOR MILESTONES B-1 APPENDIX C PROBABILISTIC RISK-OPIENTED PROJECT C-1 ANALYSES
\
f APPENDIX D ISAP ATTRIBUTE IMPACT MODELS D-1 O l l vill
)
\
l l
l-1 SECTION 1 -INTEGRATED SAFETY ASSESSMENT PROGRAM 1.0 Inte oduction The Millstone Unit No.1 Integrated Safety Assessment Program (ISAP) has been developed by Northeast Nuclear Energy Company (NNECO) and the NRC Staff. It is being used successfully by NNECO for the integrated evaluation and prioritization of plant-specific licensing issues, regulatory policy issues, and plant improvement projects. This report summarizes the activities and results of the Millstone Unit No.1 ISAP. This report, in this introductory section, first covers the history and goals of ISAP. The program has evolved from several precursor programs which were oriented towards reviewing the current status of the plant, utilizing both deterministic and probabilistic analyses. The current licensee-initiated pilot ISAP for Millstone Unit No. I expands substantially on these earlier programs both in project scope and depth of analysis. Generally, the program has been developed to foster effective corporate assessment and decision making and to facilitate an integrated implementation Schedule (IIS) with respect to implementation of the existing backlog of plant improvement projects. NNECO continues to move in the direction of utilizing the methodology being developed as part of ISAP to help make more and more decisions with respect to resource managament. Section 2 of this report specifically describes the ISAP prioritization process. For this effort NNECO has developed an Analytical Ranking Model (ARM) which includes individual models for scoring projects with
1-2 respect to five attributes which were judged to represent NNECO's goals and objectives for Millstone Unit No.1. The ARM includes a project scoring methodology, attribute weighting factors, and a final integrated , scoring and ranking process. These models and metbodologies form the nucleus of the ISAP analysis and have been applied to many of the topics within the scope of the program. The result is a prioritized ranking of proposed plant projects which is being factored into an 115. Section 3 of this report includes summaries of the scope of the Millstona Unit No.1 ISAP topics and the deterministic and probabilistic reviews performed for each topic. These reviews form a substantial portion of the bases for the rankings of the ISAP topics. Sections 4 and 5 provide a discussion of significant plant-specific and regulatory policy issues not specifically evaluated as ISAP topics. These issues, although not subjected to the formal ISAP prioritization process,
- have been less directly factored into ISAP. Many of these issues, in i
NNECO's view, are resolved by related ISAP projects. If some of these ! Issues that are not resolved mature into specific proposed plant j modifications, they will be evaluated using the ISAP methodology at that ! time and will be considered in the 115. I i I[ Section 6 of this report is an update on NNECO's 1985 refueling outage i activities and subsequent accomplishments at Millstone Unit No.1. These 1985 activities were not included within the scope of ISAP. O
1-3 Section 7 of this report discusses recent and on-going NNECO plant improvement projects not explicitly factored into the ISAP process. These projects have previously been scheduled by NNECO for Millstone Unit No. I and will not be rescheduled through the IIS. However, the resources needed to implement these projects will be factored into the development of the IIS. Section 8 of this report tabulates the ISAP topic scores and rankings. Section 9 summarizes NNECO's efforts toward validation of the ISAP program methodology and results. This section includes a description of the sensitivity studies performed by NNECO to refine the program methodologies, and the independent review that has been conducted on the O Q ISAP ranking methodology. Section 10 identifies future actions under ISAP, focusing on development of the IIS and future refinements to the attribute models and prioritization process. The refinements largely result from experience with the process to date and the independent review of ISAP. These refinements are being considered for incorporation into future NNECO applications of ISAP. The final disposition of individual topics within the scope of the Millstone Unit No.1 ISAP will be addressed by NNECO at the time it submits the IIS to the NRC Staff. In addition, this report contains several appendices wh,ch provide further information relevant to the Millstone Unit No. 1 ISAP. Appendix A O. contains a listing of the pertinent docketed correspondence that has been
1-4 []
%J exchanged between NNECO and the NRC throughout the course of the Millstone Unit No.1 ISAP.
Appendix B provides a chronology of events and major milestones in the development and implementation of the Millstone Unit No.1 ISAP. Appendix C contains summaries of the probabilistic risk-oriented analyses of the ISAP topics which lent themselves to probabilistic evaluation. Many of these analyses have previously been sent to the NRC during the course of the ISAP. Appendix D provides the NRC with details of the attribute impact models developed and utilized by NNECO in the conduct of the ISAP. As outlined in the affidavit included with the transmittal letter for this report, NNECO considers these models to be of a sensitive nature and is requesting that, pursuant to 10CFR2.790, the NRC keep Appendix D proprietary and withhold it from public disclosure. 1.1 History of ISAP ISAP is a new approach to overall plant assessment, responding to long-standing support within the NRC for a systematic review of the safety of operating nuclear power plants. The program is a logical successor to several earlier NRC programs. First, in 1977, the NRC initiated the Systematic Evaluation Program (SEP) to review a specific set of safety issues for eleven of the oldest domestic operating reactors, including Millstone Unit No.1. The SEP was intended a
.- _ _ . - _ . _ . . _ _ _ _ _ _ _ _ _ _ _ . _ _ _ . _ _ _ _ . _ . . . _ _ _ _ _ _ _ _ _ . . . . . . . _ _ . _ . . _ - . _ ~ _ _
1-5 O V to evaluate these licensed plants against then current NRC criteria and to develop a framework for backfitting decision making. The SEP provided significant information relative to the safety of operating plants and provided important experience in the development of evaluation techniques for operating plants. Subsequently, following the Three Mlle Island Unit No. 2 (TMI-2) accident, the NRC developed the TMI Action Plan. The TM! Action Plan identified a large number of corrective actions to be implemented by operating plants. In addition, the NRC initiated the Interim Reliability Evaluation Program (IREP). Under IREP, plant-specific probabilistic safety assessment (PSA) studies were performed by the Staff for several operating reactors in order to supplement the reliability experience from the Reactor Safety Study (WASH-1400). The experience from IREP indicated that there are plant-specific strengths and weaknesses, from a reliability point of view, that warrant further consideration beyond the deterministically based issues of the TMI Action Plan. One of the most significant conclusions drawn from SEP, the TMI Action Plan, and IREP is that issues related to the safety of operating nuclear power plants can be more effectively and efficiently evaluated in an integrated plant-specific review. Such an integrated plant-specific review would evaluate all proposed projects for safety significance in light of all other on-going projects, and would attempt to assess all potential impacts of the projects (i.e., those impacts in addition to public safety). Such a review would also provide an ideal framework for backfitting decision making and the scheduling of justified backfits. Finally, experience from I _ . - - - .-..____.,_..z.-.-- . . . _ . _ . . -. - . -
.... . _ . _-_ _ - . . - . ~ . . - _.
1-6 IREP served to define methods for conducting a plant-specific probabilistic safety analysis so that consistent, comparable results can be obtained. Probabilistic safety analysis would clearly enhance an integrated plant safety assessment. In fact, NNECO has initiated a living probabilistic risk assessment (PRA) program for Millstone Unit No.1, details of which are provided in Section 1.4. Millstone Unit No. I was directly involved in SEP and IREP with the NRC Staff (Reference 1). Given the positive experience of the SEP effort, NNECO requested, and in a number of letters in 1983 (References 2 through 6), the NRC and NNECO discussed NNECO's proposal that the i NRC Staff expand the SEP integrated assessment for Millstone Unit No,1. Specifically, NNECO proposed expanded integrated assessments to address all outstanding regulatory requirements and plant improvements that were not originally within the scope of the SEP. NNECO further proposed that the results of this evaluation would serve as the principal basis for an integrate'd implementation schedule for Millstone Unit No. I backfits. As discussed below, Millstone Unit No. I was by this time facing a serious backlog of post-TMI regulatory backfits. NNECO's proposal constituted the beginning of ISAP for Millstone Unit No.1. The NRC Staff considered NNECO's proposal and concluded that an overall integrated assessment, which included all of the pending licensing requirements, would indeed lead to an effective and efficient backfit implementation program. At that time, however, there were policy and O programmatic issues related to the implementation of ISAP which had to V be resolved before undertaking such an evaluation program. These issues were resolved when the Commission unanimously approved SECY-84-133 on
1-7 March 23, 1984 (Reference 7). Subsequently, on April 5, 1984 (Reference 7a), the NRC granted NNECO schedular relief on selected I
- issues and deferred programmatic issues to the ISAP forum. On
l November 9,1984, the Commission issued a Policy Statement (49 Fed. l Reg. 45112) on the implementation of ISAP, endorsing the concept. The 4 NRC provided the go-ahead for a pilot ISAP program involving plants , selected by the Staff from industry volunteers. Subsequently, the Commission approved SECY-85-160 (Reference 8), an implementation plan for the Millstone Unit No. I and Haddam Neck Plant pilot ISAP programs. ) In Reference 9, dated December 4,1984, the NRC Staff Initiated the pilot ISAP program for Millstone Unit No. I and Haddam Neck. This began a series of meetings to discuss the scope and schedule for ISAP. In Reference 10, a letter dated May 17, 1985, NNECO formally outlined its 4 proposal for the Millstone Unit No.1 ISAP. NNECO's proposal generally described the procedures and issues for this effort. In Reference 10 NNECO specifically identified for Millstone Unit No.1: t o Licensing issues and NNECO plant improvement projects which would be evaluated in the integrated assessment; and o Those projects which would be conducted independent of ISAP, including plant modifications to be implemented during the 1985 refueling outage and on-going engineering studies, j NNECO's proposal described the criteria to be used to evaluate each of the topics included in the integrated assessment and the criteria to be used to
1-8 subsequently prioritize the corrective actions resulting from the integrated assessment. The Staff reviewed the principle elements of the Millstone Unit No.1 , proposal and provided further direction. In Reference 11, dated July 31, 1985, the NRC Staff documented completion of their screening review process, thereby identifying the scope of projects to be addressed in the pilot ISAP. The projects to be evaluated under ISAP for Millstone Unit No.1, as approved by the Staff, includes o All current and pending licensing actions and requirements; ano o NNECO initiatives and plant improvement projects. O Finally, the Staff added the following to the ISAP projects proposed originally by NNECO: , o Pending licensing actions from NUREG-0748 for which the I Staff's review was not yet complete; o NNECO's on-going engineering studies; and o Those unresolved safety issues and generic issues, derived from the high-priority issues in NUREG-0933, that the Staff believed could be substantially addressed on a plant-specific basis in i
; ISAP using deterministic and probabilistic safety assessment 1
i methodology. 5
I-9
,e in sum, all of these projects comprise the " topics" for evaluation under ISAP. The Staff concluded that the scope of review represented by these topics, and the probabilistic safety assessments and updated operating experience evaluations to be performed, are sufficiently comprehensive such that the results of the integrated assessment will result in an effective integrated schedule and an adequate basis for future regulatory actions.
Since the completion of the screening review, NNECO has provided the Staff with individual deterministic safety evaluations for all topics and submitted a probabilistic evaluation of a selected number of topics. There a have been numerous meetings and telephone discussions between NNECO and the NRC Staff. Milestones in this process were documented by ( NNECO in Reference 12 and are further listed in Appendix B to this report. In addition, in February 1986, NNECO issued a draf t Millstone Unit No. 1 ISAP report to the NRC, describing the project scopes, deterministic reviews, and probabilistic evaluations available as of that date. The NRC Staff provided comments in a safety evaluation report dated March 3,1986 l (Reference 13). NNECO has now completed its probabilistic and deterministic evaluations of the ISAP topics and is providing the results in r this ISAP final report. l lt ISAP, however, is by definition an on-going, dynamic process. As discussed below, further work remains to be accomplished. Additional topics have already been identified by the NRC Staff and will be addressed, and future ! Issues are likely to develop. Further, a final proposed resolution for each topic addressed in this report needs to be identified along with an
1 - 10
; implementation schedule. The ISAP mechanisms for this on-going process are described in this report. NNECO will provide additional information to the Staff in supplements or follow-up reports on appropriate future dates.
1.2 ISAP and IIS The Millstone Unit No. 1 ISAP involves two phases: the integrated assessment and the integrated implementation schedule. The concepts of the integrated assessment and the 115, while similar in many respects, are fundamentally different. The integrated assessment is the process by which individual projects are 1 i evaluated relative to each other to establish a relative ranking, and in some cases, to determine whether or not a proposed plant modification should be dropped. This evaluation is based on factors such as: o Impact on safety (reduction or increase in risk); o Effect on plant output; o Effect on personnel; o Radiological considerations; o Cost; and i
- O.
f 1 - 11 [] V o Alternative means of addressing the specific concern (e.g., procedure or technical specification changes). The output of the integrated assessment, or prioritization process, is a ranking of all outstanding projects. The integrated assessment does not attempt to define any implementation schedules. A second purpose of the integrated assessment is to assess, prior to the development of implementation schedules, whether a project, on a " cost-benefit" basis, is justified to be implemented. Those backfits that do not pass this " cost-benefit" evaluation threshold would be dropped.(I) Those backfits that are justified, are ranked and factored into the integrated implementation schedule. This highlights one of the most significant d differences between NNECO's program and the living schedule approach that has been used by other utilities. One form of the integrated implementation schedule concept used by others has as one of its starting assumptions the understanding that all pending backfits and plant improvements are justified and will ultimately be implemented. Implementation dates are then based on an assessment of the particular project's safety significance. This approach to the living schedule concept does not attempt to define an acceptance criterion below which a plant (1) The concept and details of a threshold below which a project would not be implemented is currently being developed by NNECO personnel. By its nature, the threshold will be comprised of several factors including a " cost-benefit" evaluation and consideration of potential occupational radiation exposures. The threshold will be applied as part of the specific resolutlun O of each ISAP topic, to be determined at a later date. For the interim, individual Eo/no-go decisions are being made on a case-by-case basis without a pre-determined generically defined threshold.
1 - 12 modification will never be implemented. Although some schedu'es may be far in the future, it is implied in the living schedule concept for other
- utilities that everything has to get done sometime. The most significant
! benefit of the integrated assessment used in ISAP is that it establishes a benchmark against which all future requirements are evaluated. Thus, rather than assuming every future requirement is' desirable with respect to plant safety, an integrated assessment methodology is used as a basis for . assessing the overall significance of a requirement and making reasoned, prioritized plant improvement decisions. 1 l Following completion of the threshold evaluation and the ranking process, the second phase of ISAP is the 115. This application of the integrated f i schedule at Millstone Unit No. I is conceptually no different than has been j applied at other utilities, with the exception discussed above that the number of projects to be scheduled is potentially reduced due to the i ! integrated assessment. The IIS is a long-term schedule for implementation of required plant improvements that makes the most efficient use of NRC l and utility resources without compromising safety. The integrated schedule recognizes the importance of public safety impacts, as the public safety model plays a key role in the ISAP methodology. Concurrently,
- other relevant resource limitations such as budget considerations, j manpower availability, schedule, and duration of outages are accounted l for. Additionally, the integrated schedule accommodates changes in 1
priorities and project scope in a cost-effective manner. 1O L - - - .. - . - __. - - - -
_ _ . ~. 1 - 13 1.3 Backlog of Modifications Given the large backlog of proposed modifications still pending for Millstone Unit No.1, and the fact that new NRC requirements and NNECO initiatives for plant improvements are inevitable, the need for an integrated assessment and IIS has become acute. The total number of pending modifications has grown so large that several major implementation problems have developed. These include: o The number of backfits has grown to the point where Northeast Utilities (NU) engineering, design, and construction groups cannot support all committed dates; o The number of backfits makes it difficult to meet industry j goals of reducing total occupational radiation exposure; o Physical limitations such as space available and the maximum 1 number of people that can be accommodated onsite are controlling factors in some cases; and o Backfits were not being prioritized with respect to impact on safety because previously all backfits were treated as if each one was the most important from a safety perspective. l The ISAP program is intended to address these problems. Recognizing that
! the resources available for backfitting on nuclear units are finite, ISAP cvaluates each outstanding backfit to determine whether it is justified for
1 - 14 implementation. The IIS will assure that the issues with the greatest potential impact on public safety will be assigned their proper priority for resolution. Issues with little or no impact will be deferred or dropped, I thereby conserving resources for allocation to the most important matters. The integrated assessments and living schedules of ISAP thus accomplish the objective of facilitating implementation of the backlog of plant modifications (and implementation of future projects) with a logical, reasonable, and consistent methodology. Importantly, the process recognizes the potential for issues requiring prompt resolution to emerge; i these projects are given top priority until resolution is complete. 1.4 Millstone Unit No.1 Probabilistic Safety Study G An important component of the ISAP is the Millstone Unit No. 1 Probabilistic Safety Study (PSS), and the PSS satellite models and studies. Following the NRC IREP, NNECO began to develop and implement a Living PRA program for all of its nuclear plants. The objective of this program is
. the development, maintenance, 'and use of PRA models for assistance in evaluating potential plant backfits and operating procedure medifications.
The Living PRA program provides flexibility to quickly and accurately analyze the impact on plant safety of changes to the plant design and significant changes to operating procedures. With the development of the Millstone Unit No. 1 ISAP, the Living PRA program objectives have dovetailed with the objectives of ISAP. As a short-term application, the Living PRA therefore provides important support for the public safety
- tribute evaluations and the resulting ISAP backfitting decision making.
9
-.m. , _ _ . . , ._ .. . _ . _ . _ , _ _ . . -
1 - 15 NNECO completed the Millstone Unit No. I plant-specific PSS in 1985. NNECO submitted the results and a summary report on July 10, 1985 (Reference 14). Previously, a summary of the dominant initiating events and accident sequences modeled, had been provided to the Staff (Reference 15). The summary report is a comprehensive summary of the core melt frequencies calculated and the methodologies 'and techniques utilized. The summary report describes: o Determination of Initiating Events
- system investigations
- initiator frequency calculations o Accident Sequence Analysis
- classification of event sequence outcomes
- plant systems event tree models
- plant support system event tree models o Plant Systems Reliability Analysis
- plant component reliability data collection and analysis
- plant systems reliability modeling o Human Reliability Analysis
- introduction and methodology
- screening analysis
- summary of results O
1 - 16 i i o Accident Sequence Quantification matrix qualification methodology core melt accident sequence quantification results
. As part of the Living PRA program, NNECO plans to periodically update the PRA and summary report. In this way the PRA will remain viable as an aid to corporate decision making. NNECO has also exchanged views with the NRC Staff regarding the calculated core melt frequency and potential projects to improve Millstone Unit No. I's long-term cooling capability (References 16 and 17). Several actions highlighted in the references have already been completed. This provides an example of how the Living PRA program can lead to cost-effective plant improvements. Completed and/or future improvements will also be credited in future PSS quantifications of the core melt frequency.(2)
As part of the Millstone Unit No.1 PSS, NNECO has also prepared several satellite models and studies. For example, the PSS submitted in July 1985 considered only internally initiated events. In Reference 18, dated March 26,1986, NNECO submitted an analysis of fire-initiated events. In Ajay 1986, NNECO completed an additional analysis of loss of 120V Vital AC events and an appendix to the PSS documenting the analysis which formed the thermal hydraulic bases for the success criteria used in the study. These were submitted to the Staff in Reference 19. p (2) NNECO is currently in the midst of requantifying the Millstone Unit No. I V PSS. This requantification is incorporating changes to the plant design and procedures which have been implemented since the conduct of the PSS. Upon completion of this effort, NNECO p'ans to submit an update of the study to the NRC.
1 - 17 Finally, the NRC Staff has reviewed and provided comments on the Millstone Unit No.1 PSS in the context of ISAP. In Reference 20, the Staff provided the draft report of its contractor on the risk-based evaluations of ISAP issues which were submitted by NNECO. NNECO, in turn, reviewed and provided comments on the contractor's draft report in Reference 21. The Staff provided a final report in Reference 22, dated January 3, 1986. NNECO provided no further comments on the contractor's final report (Reference 23). However, NNECO has factored this experience into the ISAP evaluations and rankings documented in this ISAP final report. The experience will also help to further refine the PSS as it is further developed through the Living PRA program. O v
2-1 SECTION 2 -ISAP PRIORITIZATION PROCESS 2.0 Introduction The ISAP assessment or evaluation phase precedes the development of an IIS, and is the primary topic of this report. The assessment phase of ISAP, , also referred to as the ISAP prioritization process, generally focuses data collection and evaluation efforts to determine relative priorities for implementation of the proposed modifications or projects. The prioritization process considers safety first, but not as the only consideration in evaluating projects. One major goal of the program is to achieve the largest safety benefit for the resources expended. In addition, inherent in NNECO's approach is the belief that any x prioritization methodology must recognize the importance of utility-initiated improvements as well as NRC-required modifications. l The first objective of the prioritization process is the relative ranking of proposed plant projects. The expected post-implementation impacts of each project considered under ISAP, relative to the previous plant condition, are treated as " benefits." These " benefits" can be positive or negative. The implementation impacts, including costs (dollars) and other considerations such as radiation exposure and schedular impacts, are treated as " costs." An evaluation of the " benefits" vs. " costs" is utilized as the principal determinant of each project's priority. A secondary, but also important objective of the prioritization process is to take advantage of the multi-disciplined and organizationally diverse
2-2 perspectives of the individuals involved in the process. Throughout the project scoring process, participants interact in the assessments to identify beneficial changes in project scope and to identify alternative approaches to address the underlying concern or problem which motivated the issue. These diverse perspectives contribute to the independent assessment of each ISAP issue in such a manner as to assure consistency, completeness and accuracy in the evaluation of each project. The ISAP prioritization process is implemented in four steps which are summarized below. More detailed discussion is provided in subsequent portions of this section of the report.
- 1. Define " Attributes" - These are the separate " benefit" dimensions which are considered during project evaluation. They are selected to reflect overall corporate objectives for the nuclear program and are approved by senior management.
- 2. Score and Evaluate Projects - Independent teams comprised of experienced personnel score all projects for each attribute (one team per attribute). The ISAP Working Group, a group which consists of personnel from the various disciplines within the Northeast Utilities organization (i.e., Engineering, Plant, Project Management, etc.), then meets as a task force to evaluate each project and review the scoring basis for each attribute. Both the project scope and the individual scores are evaluated by the Working Group to assure the expected benefit-to-cost ratios are based upon a consistently applied understanding of each project. Interchanges
2-3 among the scoring teams at the Working Group meetings serve to develop broad organizational perspectives and consensus on each project's value.
- 3. Consolidate Scores and Rank Projects - Separate scores for each attribute are converted to common units and summed (or integrated) to obtain a meaningful overall benefit score for each project. As part of the summation methodology, weighting factors were developed and are applied to reflect management's judgement on the appropriate relative emphasis for each attribute, consistent with their direction for NU's nuclear program. The implementation cost is determined for each project and an overall benefit-to-cost ranking is produced.
O
- 4. Finalize Rankings - Sensitivity and verification tests are performed to ensure that the rankings are logical and consistent with NU's corporate values. Adjustments to scores are permitted based on objective reevaluation of selected projects. The final priorities are approved by NU's senior management.
Improvements to the ISAP prioritization process are anticipated, with the need for change identified from experience with the process. Process improvements are defined and implemented on an on-going basis, provided that each improvement contributes sufficiently to either the project approach or to the validity of the priorities, so as to warrant the effort involved in the change. Some changes are incorporated during the ISAP prioritization effort. Other potential improvements are noted during
2-4 prioritization but are deferred, based on a judgement that their explicit inclusion would not substantially affect the current ISAP prioritization. t 2.1 Attribute Definition and Description In order to determine the "value" of a proposed plant modification, NU has developed a set of attributes against which projects are evaluated. These attributes were chosen in order to provide a broad perspective on , the merits of potential plant improvement projects. The five attribute impact models that are utilized in the ranking methodology for the Millstone Unit No.1 ISAP topics are: Public Safety O Personnel Safety Economic Performance Personnel Productivity External Impacts 4 Each of the attributes encompasses - multiple characteristics or components. The personnel safety attribute, for example, includes both ! industrial safety and radiation safety components; the economic J performance attribute includes separate components for availability, reliability and maintainability impacts.
2-5 As the first step in the development of these attribute definitions, a tentative set of attributes was defined considering approaches used by various other utilities for their IIS programs. The proposed attribute set was reviewed for consistency with NU corporate policies, goals and objectives. Later, the attributes were reviewed by the ISAP Working Group. Finally, the five selected attributes were also presented to NU management for review and were approved for the ISAP program. The five selected attributes for the ISAP prioritization process are described as follows: Public Safety - This attribute captures the NU commitment to safe operation of its nuclear facilities by limiting the incremental risk to O Q the public to an acceptably low level. The public safety attribute
- includes the characteristics of
o radioactive material release from the plant; o hazardous material (non-radioactive) releases from plant; and o hazards from transportation accidents offsite. o The impacts of this attribute are determined utilizing PRA results where applicable in conjunction with subjective judgement.
!O
,-- --- - , , . - -.--n, - - . , ,- , . - - . , , -. - - - , - - - - - - - - - - , - , - . , - - , - - . . . . , - - - , - - . - - -
2-6
/ Personnel Safety - This attribute captures the NU commitment to ensuring the safety of on-site personnel. The personnel safety attribute includes the characteristics of:
o occupational radiation exposure; and o industrial safety. The impacts of this attribute are determined using a combination of quantitative and qualitative factors, including dollar value per Man-Rem, cost per lost workday, and potential company liabilities. Economic Performance - This attribute captures the NU objective of furnishing reliable and economical power to their customers. The economic performance attribute includes the characteristics of:
- 1. effects on plant availability;
- 2. effects on plant efficiency;
- 3. effects on electrical output; and f
- 4. effects on core power rating.
The impacts of this attribute are determiled utilizing plant-specific reliability / availability / maintainability (RAM) models where I applicable, combined with subjective judgement and assessment of future risks or benefits. i
2-7 Personnel Productivity - This attribute captures the NU commitment to maintain an organizational culture conducive to high quality work with good productivity. The personnel productivity attribute includes the characteristics of:
- 1) effects on people;
- 2) effects on equipment; and
- 3) effects on work environment.
The impacts of this attribute are determined by subjective
, judgement supplemented by qualitative data where available, and include effects of changes in equipment or procedures on personnel efficiency, effects of training on productivity, and effects of physical stress and work environment on productivity.
External Impacts - This attribute captures the NU commitment to operate its power plants within regulations and with due consideration of external influences. The external impacts attribute includes the characteristics of:
- 1) NRC actions;
- 2) actions of state / local governments and agencies; O 3) actions of other federal regulatory agencies; and
2-8 V
- 4) actions of industry organizations.
The impacts of this attribute are determined by subjective assessment of the risks associated with not performing a project and the potential for forced shutdown. The specific scoring approach and weighting factor methodologies for each attribute are discussed in the following sections. 2.2 Analytical Ranking Methodology For the ISAP prioritization process, NU has developed the Analytical Ranking Methodology (ARM). The ARM includes models for evaluating the impacts of a proposed project for each separate attribute, and a methodology for combining those impacts to achieve an overall ranking. Development and application of the ARM is the most signift: ant activity related to the ISAP prioritization process. The NU ISAP program defines multiple ranking criteria for use in assessing and ranking a spectrum of , backfitting issues. The ARM also includes the concept of establishing a
" threshold" below which a given plant modification would not be impicmented.
i The ranking model has received an intense amount of scrutiny within NU. The ARM is sound, logical, objective, and recognizes that safety considerations are of primary importance. However, in order to ensure the methodology would be useful, it was first necessary to define its limitations and the pre-established factors that would be considered in
2-9 its development. The discussion below defines those conditions and J constraints. 2.2.1 Public Safety. The most important factor considered in the ranking model is the effect on public safety associated with each specific backfit. However, while reduction in risk is an essential input, it is not an absolute indicator that a specific backfit is warranted as there will be some cases where the cost associated with a backfit is extremely large, or where a significant radiological exposure will occur during implementation. 2.2.2 Applicability to all Backfits O Another important consideration for the prioritization methodology is general applicability. The ranking model must have the capability to evaluate and rank all outstanding backfits, whether NRC-required or NU-initiated, a proposed project or an engineering study. This requires the l ranking model to be flexible and multi-faceted. As a further example, PRA analysis is a significant part of the ranking methodology. Ilowever, there are many issues that have been included in the program that are not readily amenable to direct PRA evaluation. Therefore, the ranking model was developed to be equally sound and meaningful when the PRA or reliability input for an issue is either nonexistent or subject to large uncertainties. This, by definition, necessitates some amount of qualitative input. t s - .
2 - 10
,m J 2.3 Project Scoring and Evaluation The ARM allows each potential plant improvement project to be sc'ored and evaluated. The first phase of this process is scoring of the project's impact with respect to each individual attribute. The second phase, evaluation, follows scoring and involves a review of all attribute scores for the project and overall project results to assure consistency between attribute scoring teams. -
We turn first to scoring. Individual impact scoring models for each attribute make the attribute definitions operational by establishing compatible analytical frameworks for evaluation and comparison. These frameworks are designed to efficiently define a score proportional to the b determined benefit of the project for each of the attribute characteristics. For each attribute, the scores for all projects imply a
- relative ranking of projects with respect to that particular benefit '
dimension. The scores are assigned on a dimensionless scoring scale (+10 to -10 points), sized by the scoring teams to cover the range of impacts expected. To calibrate the scale, the upper bound (10 point) score is associated with physical units appropriate to either the entire attribute or its major characteristic. The " attribute impacts" are the difference between the pre-project implementation condition and the expected post-implementation condition; conditions associated with implementation only are treated separately through the cost function. O
..,m , _ . . - , , . __ . . - . . - . - , . , . _ . . . . . _ , , - . . _ _
2 - 11 s
] The impact scoring models range from verp simple to relatively complex.
For example, a "model" may consist of: l o a one-dimensional scale with benchmarks for calibration; 1 o a simple evaluation algorithm (e.g., checklist format); o a calculational guideline or procedure (e.g., ALARA); o a complex calculation (e.g., PRA or reliability model); or o a combination of the above. O Several teams were appointed to develop and implement the scoring models for each attribute. These people were selected based on their
, relevant functional responsibility and their appropriate experience and expertise. A workshop was conducted in which the teams first learned the process and then assumed responsib;.lity for their assigned models.
The approach for each attribute impact scoring model was selected by the assigned expert teams. During selection, model implementation effort was balanced against the anticipated scoring advantage from incremental model complexity. Complexity was added to the models only when it was expected to provide significantly better insight into actual project value for the assigned attribute. The final scoring models have been designed to address the entire range of projects which are considered for ISAP. The rnethodology is repeatable, documented and practical. i
f 2 - 12 Models were finalized and used to score a demonstration project set'(a representative sample of ISAP projects). While scoring was underway, the models were presented to the ISAP Working Group to ensure common understanding of the scoring basis and to provide an opportunity for constructive suggestion. For the more complex models, the scoring teams delegated some scoring responsibility but continued to supervise the scoring effort. I The scoring models' developed for each of the approved attributes for the ISAP are summarized as follows: l Public Safety - This attribute scoring model estimates changes in public risk (in terms of Man-Rem) utilizing either quantitative calculations or engineering judgement; non-radiological public risk impacts are separately calculated, when applicable, on an equivalent hazards basis. The quantitative submodel is preferred when practical. This submodel calculates the change in public exposure risk proportional to the incremental change in core melt frequency multiplied by an effective public dose consistent with the type of core melt considered. Changes in core melt frequency are calculated via sensitivity studies using the models contained in the Millstone Unit No.1 PSS or satellite models. . Economic Performance - This attribute scoring model estimates changes in equivalent unavailability (expected gain or loss of plant output in rated power days per year), considering changes in availability, plant efficiency, electrical output (e.g., derating) and
2 - 13 [J w 1 core power rating. The scoring analysis begins with a thorough review of possible plant states and of modification " impact states" to ensure complete consideration of project impacts. Pertinent plant operating experience is then reviewed. Where applicable, the + computerized reliability model (RAM) is used to calculate the equivalent unavailability change; otherwise, j0dgement is used to estimate the impact relative to other projects previously evaluated. Personnel Safety - This attribute scoring model separately estimates changes in radiation exposure and in industrial safety risk, comparing conditions before and after the proposed modification.
- The installation impacts are separately estimated for inclusion in 4
the cost function. The radiation impact (Man-Rem) is calculated r using conventional ALARA-type calculations or estimates, as necessary. The industrial safety impact (lost man-days) is estimated following an analysis for potential hazards based on tables of frequency and consequences for representative hazards. The two subscores are combined into an overall personnel safety score. Personnel Productivity - This attribute scoring model estimates the
~
l change in effective man-days of work produced, considering the proposed project's effect on people, their equipment and their work environment. The impacts are estimated based upon both ' quantitative and qualitative judgements. Impact on workload and J training, for example, can be estimated in man-days, while those on maintainability, environment, communications or participative j management require more qualitative evaluation., A checklist is 4 7 r a s--~--- , v-.,v,- - -- , - - - -- - - , ,- en-- - , - , , , - - - , , , - - - , - - - ~ - , - , - - - ,na- --,--een---w,_w, -w------,w ,-a-,w-r------~
2 - 14 i used to ensure complete consideration of impacts. Separate (J_) subscores are summed to obtain the overall man-day impact. External Impacts - This attribute scoring model estimates the value to NU of being responsive to various external influences, including regulators, industry groups (e.g., INPO), and the public. Positive values are assigned to projects favored by external organizations in proportion to the degree in which NU has committed to be responsive to the applicable external concerns. Provision is made for possible negative values should an adverse external reaction be expected for a project motivated by some other attribute. Further details of each of the five attribute impact models are provided V in Appendix D. Following project scoring, the next step is evaluation. The ISAP prioritization process is a formal " project evaluation" process. Meetings are held to review the scores and evaluate the proposed projects. The bases for all scores for each project are discussed at one time by the ISAP Working Group to ensure a consistent project definition among the five scoring teams with diverse perspectives. The individual attribute scorers participate in these formal discussions. This formal evaluation also ensures consideration of: 1) the potential impacts of one project on either the benefits of or need for another project; 2) the potential for redefining a project to retain positive V attribute impacts (benefits) while eliminating negative ones (i.e., define
" - nA .,
2 - 15 an alternative); and 3) any other creative suggestions which may be stimulated by the evaluation process. Action items on project scope or specific scores often resulted from the discussion. Disposition of the action items resulted in a consistent set of scores and an approach for each project as responsive as practical to each of the attributes. 2.4 Development of Attribute Impact Models 2.4.1 Attribute Model Scoring Scales The relative magnitudes of the five separate attribute scoring scales are , illustrated below. It is clear that scoring " points" have very different values for each of the attributes. O o Public Safety
- linear scale
- range -10 to +10
- maximum value (10 points) - 4,000 Man-Rem
- maximum value (dollars) - $4,000,000
- time scale - remaining life of plant o Personnel Safety logarithmic scale
- range -10 to +10
- maximum value (10 points) - 11,800 Man-Rem 30,000 lost workdays
- maximum value (dollars) - $11,800,000
- time scale - one fuel cycle
2 - 16 o Economic Performance
- linear scale range -10 to +10 maximum value (10 points)- 5 effective full-power days maximum value (dollars) - $2,000,000 time scale - one year o Personnel Productivity -
logarithmic scale range -10 to +10 maximum value (10 points) - 87.5 man-years maximum value (dollars) - $5,500,000 time scale - one fuel cycle 0 o External Impacts (highly subjective) linear scale range -10 to +10 l 2.4.2 Conversion Factors The variation in attribute scales was allowed because all projects are consistently scored for each attribute. It was desirable to develop individual scales that would prevent scores for virtually all projects to be lumped into a very narrow span of the -10 to +10 range. Consequently, due to the variations, the five attribute scores cannot simply be added up to produce an overall score. Consolidation of the five separate attribute , scores into one ranking requires the conversion of the various scales used
i 2 - 17
.f g
for scoring each attribute into equivalent units on a defined objective basis. This is achieved through objective weighting factors. Only through l l the use of an objective scale will the five individual attribute scores be correctly weighted in the summation of scores. l I First, the equivalent units of " dollars" was chosen for the objective scale l to capture overall utility benefit. Care was taken to differentiate the use of " dollars" in measuring benefit from the normal commercial use of the term. Next, an overall conversion factor for each attribute was defined considering:
- a. the physical units assigned to the scale far each attribute (e.g., potential public exposure in Man-Rem, industrial hazards in lost man-days, equivalent availability in rated-power-days) and the resulting calibration of the scoring " points" assigned;
- b. a reasonable factor to convert the physical units to benefit dollars;
- c. the scoring scale definition (logarithmic or linear);
- d. the fraction of the remaining useful plant life which was considered by the scorers (one 20-month average fuel cycle was selected as the reference time period);
1 i
- . . - . , - _ _ - . _ . . - - - - - . - . - - _ . _ . _ ~
2 - 18
- e. a suitable discount factor to permit integration of benefits over the remaining plant life (25 years or fifteen 20-month fuel cycles).
2.4.3 Objective Weighting Factors Objective weighting factors were developed to equate the different time scales (one year - one fuel cycle - life of plant) and value scales (equivalent dollars per point) for each of the models. In addition, a discount factor is included in the objective weighting to account for the time value of money over the life of the plant. Time Scale Weightirg One fuel cycle (20 months) was chosen as the time period over which the benefits of each project are calculated. Time-scale multipliers were developed for each of 'the attribute models to " expand" or " dilate" the scales to a 20-month cycle. Discount Factors Discount factors were utilized in order to quantify the time value of money over the remainder of the life of the plant. "True" economic interest rates were used in the personnel safety, personnel productivity, and economic performence attribute models calculations, and a "real" current interest rate was used in the public safety attribute model calculations.
2 - 19 The basis for using these different interest rates is to differentiate between real economic costs / benefits (i.e., MW-d, ALARA programs, lost workdays, etc.) and perceived or estimated costs (i.e, injury to a member of the public). In addition, it was judged that a "true" economic interest rate would unjustifiably reduce the relative value of the public safety attribute. Combined Objective Weighting The overall objective weighting factors for each of the attribute models (equivalent dollar per point)is calculated as the product of the time scale conversion factor times the discount factor times the dollar value per point. O Table 2-1 summarizes the equivalent dollar value scales for each of the attribute models. Note the logarithmic behavior of the personnel safety and personnel productivity attribute scales. 2.4.4 Subjective Weighting Factors Weighting factors must also be applied to assign each attribute a relative influence on the overall project score. These subjective weighting factors enable management to exercise judgment regarding the relative importance of the various benefit criteria. Restated from a different perspective, these factors enable management to control the allocation of residual risk from the utility's nuclear program. 1
2 - 20 4 Table 2-1 Equivalent Dollar Value Scales (Thousands of Dollars) Attribute Public Economic Personnel Personnel Score Safety Performance Safety Productivity 0 0 0 0 0 1 277 1,367 7 0.19 2 554 2,734 14 0.53 3 830 4,101 28 1.50 4 1,107 5,468 59 4.27 5 1,384 6,835 123 12 6 1,661 8,203 256 35 7 1,938 9,570 534 98 8 2,214 10,937 1,114 279 9 2,491 12,304 2,322 794 10 2,768 13,671 4,840 2,256 For the public safety attribute, the objective weighting factor is a constant $277K/ point. O For the economic performance attribute, the objective weighting is a ! constant $1,367K/ point. For the personnel safety and personnel productivity attributes, the l objective weighting factors vary due to the logarithmic scales. l l l 1 lO I _ _ . . _ . - _ _ . . _ _ _ _ . _ _ . , _ _ - _ _ _ _ _ . _ _ _ _ _ _ . . _ _ - ~ . . - _ _ _ . - - . _ _ _ _ _ . . . . . __ _ ._ . _ _ . __ _ - _
2 - 21 The subjective weighting factors used in the ARM were established via a survey of NU management with various responsibilities pertinent to the NU nuclear program. The survey utilized pair-wise comparisons among tha five attributes (an analytical hierarchy approach). For example, had one attribute been ranked clearly more important than each of the other four, a relative weighting factor of 9:1 could have resulted. In fact, however, the largest actual relative weighting is 2.4:1 (Public Safety over Personne! Productivity). These factors are candidates for change and/or confirmation on a periodic basis, recognizing that corporate priorities may vary with time. Subjective weighting factors provide the judgement of the relative importance of each of the five attributes. The following weighting factors have been developed. Public Safety - 1.41 Personnel Safety - 1.34 Economic Performance - 0.70 Personnel Productivity - 0.55 i At this point it should be noted that the external impacts attribute is not weighted and combined with the other four attributes. Rather the external impacts attribute is utilized as an indicator of potentially sensitive issues, primarily with regulators. This decision is based upon sensitivity studies demonstra ting that the very subjective external impacts attribute would otherwise be an unjustifiably dominant driving force in the rankings.
J 2 - 22 2.5 Integrated' Project Scoring Following scoring of the projects by the individual attribute teams and evaluation by the ISAP Working Group, ISAP personnel processed the scores. The processing applied the derived conversion factors and the management weighting factors to calculate net benefit. Cost data (implementation dollars and Man-Rems) were then added so that benefit-to-cost ratios could be computed, leading to a first-cut ranking of the projects. Numerous sensitivity and " sanity" screening cases were also calculated and the results were summarized in a form to facilitate working group and management review. .i The total score for a particular project under consideration is determined by combining the sum of the products of the attribute scores times their respective weighting factors. The integrated score for a project (i.e., the summation) is thus represented as follows: TPV = { Sj K1 Vi Where TPV = Total Project Value Si = Subjective Weighting Factor for Attribute i Ki = Conversion Factor (Equivalent Dollar Value) for Attribute i i Vi = Project Score for Attribute i I lO f
2 - 23
/O 2.6 Finalized Ranking of Benefit / Cost Ratios U
The overall ISAP evaluation process is designed to provide an objective basis for the ranking of candidate plant improvement projects. The final ISAP evaluation process step finalizes and " validates" the project rankings through an integrated score review process, validation analysis, and sensitivity analysis. In part, this separate finalization step emphasizes the importance of process integrity. First, the. score review process is designed to provoke critical review and to permit justified changes in project scores, while also including safeguards to prevent manipulation by individuals that would undercut the process objectivity. Process features, such as the involvement of independent technical personnel in the assessment of each benefit dimension, contribute objectivity. The process relies on experienced judgment to improve both the project evaluation and the ranking where possible. The ISAP Working Group also reviewed the final ranking and sensitivity
- and screening study results. They discussed the results as a group for understanding and then performed detailed reviews within their own organizations. The screening studies included
- 1) rank by benefit only vs.
benefit / cost; 2) rank by each attribute individually (e.g., check how the i most important projects with respect to the public safety attribute fared in the overall ranking); 3) ranking with each attribute omitted to test its significance; and 4) ranking without subjective weighting factors to test l r
2 - 24 their impact. These and other sensitivity studies are discussed in detailin Section 9.1 of this report. The bases for any changes from the ranking orders were documented for review by management and scoring team personnel. The revised scores and rankings were then submitted to senior management for final review and approval. As a further validation step, an independent review of the program methodology was conducted. The ISAP Working Group evaluated the feedback from this review. This review is discussed in Section 9.2 of this report. Further feedback from completed projects is also planned as a future validation activity to ensure that the prioritization process O, improves with experience. In sum, the individual scores for each of the attribute impacts have been consolidated into an overall benefit score for each project. The information on project implementation costs has been combined with the overall benefit score'for each project to produce a prioritized ranking of all of the projects based on a benefit-to-cost value. This prioritized ranking will be important input into the IIS - a future step in the on-going ISAP process. O
L 3-1 3 p SECTION 3 -ISAP TOPIC REVIEWS - SUMMARIES
\,j 1 s
P ISAP Topic No.1.01 - Gas Turbine Generator Start Logic Modifications s. (I' .. References 24,25 s roposed Action ISAP Topic No.1.01 concerns the protective trips utilized on the emergency gas turbine generator (GTG). The topic resulted from Topic Vill-2 of the Millstone Unit No. I Systematic Evaluation Program (SEP). As part of that review the b G GTG was evaluated against General Design Criterion (GDC) 17 with regard to trips under accident conditions and with regard to maintenance programs. The SEP reviev concluded that there are several t ips associated with start-up and steady-state-operation of the GTG which do not use coincident logic or are not bypassed in emergency conditions. Thus, they do not meet current licensing criteria. i NNECO's evaluation of this ISAP topic focused on a project for bypassing the
.GTG protective trips that are not presently bypassed during emergency operation. Specifically, the proposed project is to modify certain trips and provide the Staff with, justifications for retaining other trips. As documented in the Integrated Plant Safety Assessment Report (IPSAR) Supplement, all of the issues raised in the SEP review have been resolved except for bypass under accident conditions of a) the light-off speed and generator excitation trips;
3-2 b) the high lube oil temperature trip; and c) five GTG output breaker protective = trips. = Evaluation J o Public Safety: NNECO provided the NRC Staff with its evaluation of this topic in Reference 25. Proposed modifications to the trip logic schemes E were found to provide only a small reduction in core melt frequency and thus would provide minimal benefit to public safety. Any further L
=
consideration of improvements to the gas turbine generator should be in K-conjunction with efforts on Unresolved Safety Issue (USI) A-44, Station Blackout. First, NNECO analyzed a bypass of the start-up trip. Based on a review of
=
the Millstone Unit No. I component reliability data base developed as part of the plant-specific Probabilistic Safety Study (PSS), NNECO determined that the proposal to bypass the gas turbine light-off speed and generator 7 excitation speed trips would only affect speed control / switch induced start failures. In looking at the five recorded failures in this category, only two were of a type that could possibly be prevented if the proposed start-up trip bypass is implemented. The other three were related to failures of the speed controller switch which would ultimately cause a gas turbine generator trip for other reasons. 3.x In addition, because the speed trips would only be bypassed under accident conditions, it would still be possible to have a gas turbine start failure O during a normal test start. The valid starts or start attempts used to m
- - . . ,,,,,M
3-3 calculate the original GTG start failure rate were mostly normal test starts. Consequently, the two observed failures are of a type that may not always be preventable through the proposed speed trip bypass. In sum, NNECO's analyses show approximately a 3.5% reduction in gas turbine anavailability dee to speed trip bypass and a total core melt frequency reduction by 2 x 10-6/ year. Second, NNECO considered the proposed operational trip. This, however, is a moot point. The high lube oil temperature trip is already bypassed under accident conditions. No further evaluation was performed. Third, NNECO analyzed the proposed bypass of five GTG output breaker protective trips. NNECO found that over the 12%-year period of recorded data for the gas turbine, there have been three start failures related to output breaker closure failure. However, none of these failures were due to trips that this proposed bypass is intended to prevent. In order to calculate an effect on gas turbine unavailability, it was therefore conservatively assumed that the proposed bypass of 5 out of 7 trips would prevent the occurrence of one trip over the remaining life of the plant. This assumption results in the same public risk reduction that was calculated for the start-up trip bypass (which also prevents one trip). Collectively, all three gas turbine modifications would result in a small reduction of public risk. o Personnel Safety: The proposed action would have no impact in this category. The proposed changes would not alter any work activities and
3-4 therefore would have no effect on occupational exposure or industrial safety. I I o Economic Performance: All three proposed changes to the trip logic would have no significant impact on the economic performance of the plant. The only measurable economic performance benefit with respect to the GTG would result from implementation of the improvements in gas turbine preventative maintenance program (ISAP Topic No.1.24). Specifically, it is estimated that approximately one-half of all governor-induced gas turbine start failures could be prevented by implementing a more frequent and/or more comprehensive preventative maintenance program on the GTG circuit-board. GTG failures have in the past forced the plant into a shutdown based upon technical specification limiting conditions. Therefore, this change would result in a small positive impact on plant availability and performance, o Personnel Productivity: The proposed modifications would require that circuitry be changed, particularly to bypass the gas turbine light-off speed an,d excitation speed trips under accident conditions. These modifications would increase the complexity of the equipment. However, because the changes would be mainly in the circuitry, there would be little impact on j personnel productivity. l
p 3-5 ISAP Topic No.1.02 - Tornado Missile Protection References 4 1 26, 27, 28 I Proposed Action Under Topic III-4.A of the SEP review, Millstone Unit No. I was reviewed against i GDC 2 with regard to the ability to withstand the effects of tornado-generated , missiles. In the IPSAR the NRC Staff identified structures and components i vulnerable to tornado missiles. The NRC Staff's position was that NNECO should provide sufficient protection to assure that the plant can be brought to hot shutdown. in December 1983, NNECO addressed the Staff's position. To resolve this open i issue, NNECO proposed to rely on the isolation condenser (IC) as the primary means for reaching hot shutdown. Also, NNECO committed to provide a tornado , missile protected source of make-up water to the Millstone Unit No.1 IC in i l order to ensure that tornado-generated missiles do not inhibit the ability to achieve and maintain a safe shutdown condition. In a safety evaluation dated November 25,1985, and as documented in the IPSAR Supplement, the Staff concluded that NNECO's proposal will provide adequate protection against tornado missiles. However, because of the importance of the i Condensate storage tank (CST) and fire water tanks as cooling water sources, the I
3-7 E O A water sup;,1y to the RPV may be nee.ded to restore the RPV water level during depressurization as the vessel level drops due to shrinkage or possible leaks (i.e., leaks less than technical specification limits). A review to assure that the RPV make-up water requirements can reasonably be satisfied will be made. The design for make-up to the RPV has not yet been finalized. Providing flow via existing control rod drive piping or by the dedicated engine-driven pump are two options being considered. L f Evaluation 7 o Public Safety: The proposed project would provide public safety benefits in two areas: a) improved capability to achieve and maintain safe shutdown
, following severe tornado events and b) reliability of IC makeup following internal events. These benefits were assessed separately.
First, the PSS did not include a specific evaluation of the effects of t tornado missiles. The types of system failure sequences resulting from _ tornado missiles, however, are very similar to those evaluated for LNP 'f events. In a tornado with sufficiently high wind speed, the following failures can be postulated:
- a. Loss of normal power due to grid failure.
7 b. Loss of power from the diesel generator and the gas turbine due to E missile penetration of the turbine building (through which the power cables for the diesel generator and gas turbine are routed) or the diesel / gas turbine enclosures.
3-8
- c. Loss of IC makeup due to missile penetration of the fire water tanks and the condensate storage tanks.
NNECO calculated the frequency of a tornado which could result in any of these sequences, and mitigated the sequence by crediting the availability of city water supply. The calculations yield a revised core melt frequency due to tornado missiles of 7.8 x 10-6/ year, representing a small reduction. Second, and more significantly, for internal events, availability of city water supply would be beneficial in mitigating station AC blackout sequences in which IC is initiated but the makeup to IC fails due to failure of the site fire water supply. The change in predicted core melt frequency was calculated to be roughly 3.28 x 10-5/ year. Therefore, in total, if the proposed action is implemented, the core melt frequency decreases by 4.1 x 10-5/ year, a drop of 5% About 80% of the benefit in core melt frequency is from internal events. The ability to utilize the IC to depressurize the RPV and remove decay heat following an LNP event is a major contributor to the overall safety of Millstone Unit No.1. o Personnel Safety: There would be no impact in this category. This project would not increase or decrease radiation level or stay time associated with occupational exposure because the radiation backgrounds are not significant. In addition, work activities would not be significantly altered. Therefore, the change would not increase or decrease frequency or change any consequences associated with industrial risk. O
3-9 o Economic Performance: Based on NNECO's analysis, this modification O V would have a negilgible impact on plant performance. The only significant concern for plant performance identified is that power generation is conditional to operability of the IC as governed by plant technical ( specifications. However, plant downtime due to a technical specification i violation relating to the new equipment is not expected to occur. o Personnel Productivity: This project would involve installation of new pumps, hoses, and fittings to connect the city water system to the condensate makeup system that supplies the IC. The addition of this equipment would require testing, maintenance, and surveillance by appropriate personnel. Some of the equipment is located out of doors, thus also requiring potential repairs during the winter or inciement weather. Therefore, the project would result in a negative impact on personnel productivity. s I I g
- O
l 3-10 I ISAP Topic No.1.03 - Containment Isolation - Appendix A Modifications O , Reference 29 ' Proposed Action GDC 54 through 57 require isolation provisions for the lines penetrating the primary reactor containment to maintain an essentially leak-tight barrier against the uncontrolled release of radioactivity to the environment. GDC 34 establishes design and test requirements for leak detection provisions, the isolation function, and the containment capability of the isolation barriers in lines penetrating the primary reactor containment. GDC 55, 56, and 57 establish explicit requirements for isolation valving in lines penetrating the containment. Specifically, they address the number and location of isolation valves (e.g., redundant valving with one located inside containment and the other located outside containment), valve actuation provisions (e.g., automatic or remote manual isolation valves), valve position (e.g., locked closed, or the position of greater safety in the event of an accident or power failure), and valve type (e.g., a simple check valve is not a permissible automatic isolation valve outside containment). i ISAP Topic No.1.03 concerns containment isolation modifications as discussed in Reference 29. Under Topic VI-4 of the Millstone Unit No.1 SEP review, the isolation provisions for lines penetrating the primary containment were reviewed against the current licensing criteria implementing GDC 54 though 57. As i
.._.___.-...-.._--,-_-------------------'------- - ' ' ' ~ - ' - ' ' ~ ' ~ ~ ~ " ~ " ~ ~ ~ ~ ' ~ ~ ~ ' ~ ~ ~ ' ~ ' ' ~ ~ ~ ' ~ ~ ~ ~
~
3-11 documented in the IPSAR Supplement and Reference 29, all of the issues raised f in SEP Topic VI-4 have been resolved, with the exception of the adequacy of the isolation provisions for penetration X-204 - the cooling water return lines that 4 } branch off between takeoffs to the containment spray pumps. In Reference 29, I NNECO stated that potential modifications to penetration X-204 are being addressed as part of ISAP Topic No.1.14. Therefore, ISAP Topic No.1.03 is effectively resolved. ! Nevertheless, under this ISAP topic, NNECO has evaluated a proposed project to relocate the cooling return line tie-in to the low pressure coolant injection (LPCI) suction line from upstream to downstream of pump suction valves 1-LP-l 2A and 28. ; Under the existing arrangement, if the cooling line breaks, it can be l Isolated only by closing manual valve 1-LP-IA(B). In the unlikely event of an accident with significant f' uel damage compounded by the failure of this piping connection, the area would become inaccessible due to high radiation levels. In I such a scenario, the break would remain unisolable. The torus water would slowly drain outside the containment and would thus constitute a release I pathway for radioactive material to the environment. By closing the motor-l operated valves 1-LP-2A and 2B, the proposed change would allow isolation of a break in the LPCI cooling return line af ter fuel damage has occurred. I ! Evaluation 1 l l o Public Safety NNECO assessed the public safety impact of the proposed modification and concluded that moving the LPCI lube oil cooling return line from upstream to do ?nstream of the LPCI suction valve 1-LP-2A and 2B would have no impact on core melt frequency. l i
3-12 The release of radioactive material due to rupture of the cooling return line is a concern only following those accidents involving significant fuel damage. In such cases, the radioactivity level of torus water would be high. Subsequent rupture of the cooling return line would allow spillage of torus water outside of the containment. As calculated in the Millstone Unit No.1 PSS, the frequency of accidents resulting in any limited fuel damage is 3 x 10-3/ year. However, the combination of such an accident (resulting in fuel damage) and concurrent rupture of LPCIlube oil cooling return line'is a rare event with a frequency of 7 x 10-9/ year, based on WASH-1400 small diameter pipe failure rates. Even in these rare event scenarios, no significant radioactive material is expected to be released due to the small size of the cooling return line (size 3/4"). The effect of cooling water return line rupture on radiological releases from core melt sequer.ces does not need further investigation. This is because in all core melt sequences, the containment is assumed to ultimately fall due either to high pressure or temperature. Radioactivity ! released from a broken 3/4" line would be insignificant compared to the 4 total release from the failed containment. o Personnel Safety: The proposed modification would have no effect on i occupational exposure, because radiation levels would not be significantly altered by the change. The increased activities associated with the change l i would also be insignificant. Therefore, this modification would not ! i l l
3-13 increase or decrease stay time associated with exposure, or change the frequency or consequences associated with industrial risk. o Economic Performance: This project basically involves a movement of an existing line in order to comply with NRC requirements. The impact of this change on plant performance was evaluated to be positive, due to a reduction in the likelihood of an outage based on invoking a containment isolation technical. specification. However, this impact was determined to be negligibly small because the exposure of the line to a technical specification outage is already negligibly small. o Personnel Productivity: Because this modification involves piping changes only, there would be no significant change in surveillance or maintenance activities. Therefore, there would be no impact in this category. s O
3-14 ISAP Topic No.1.04 - RWCU System Pressure Interlock O References 22,24,30 Proposed Action Under Topic V-II.A of the Millstone Unit No. I SEP review, the redundancy and diversity of pressure interlocks for motor-operated valves which isolate the high pressure systems from low pressure systems were evaluated against the criteria of 10CFR50.44. The SEP review identified a concern that failure of the pressure control valve in the reactor water clean-up system (RWCU), followed by a single failure of one pressure interlock in the system, would result In a LOCA which bypasses the containment. The Staff recommended that NNECO either demonstrate the adequacy of the RWCU relief valve or install an independent pressure interlock for actuation of RWCU system isolation on high pressure. ISAP Topic No.1.04 addresses the Staff's concern. The proposed project being evaluated involves installation of a second, independent pressure interlock for the in-board suction isolation valve. This interlock is intended to ensure system isolation in the event that the pressure regulating valve falls in the wide open position. The NRC contractor's review of this issue (Reference 22) concluded that the addition of a redundant pressure interlock would not alter the probability of a failure to isolate the RWCU line in the case of a failure of the pressure regulating valve.
3-16 frequency due to these modifications is also very low, resulting in a change b) V in core melt frequency of 3.2 x 1,0-8/ year. o Personnel Safety: Personnel safety would show a small negative increase as a result of the proposed action. An independent pressure interlock for actuation of RWCU system isolation on high pressure would be installed in a radiation area inside containment. As a result of new activities related to the modification, a new stay time, although small, would be created for the effected persons. Occupational exposures would therefore increase. Due to the nature of the activities performed, there would be no significant effect on the ladustrial safety risk. o Economic Performance: The installation of a redundant RWCU pressure switch represents a negligibly small positive impact on plant performance. This impact would result from the fact that the proposed modification would have no significant effect on daily operations, while slightly decreasing the likelihood of an extended outage due to a reactor coolant system to RWCU leak. The assessment also considered potential operating days lost due to a spurious actuation of the new sensor circuit during a refueling outage. This potential was considered to be neg!!gibly small and offset by the negligible positive impact, o Personnel Productivity: Although this modification would add a second pressure switch, requiring additional surveillance and calibrations by Instrument and control personnel, the amount of effort involved is ennsidered inconsequential. Therefore, there would be no impact in this category.
4 - 3-17 ISAP Topic No.1.05 - Ventilation System Modifications t ( References 22,24,31 Proposed Action GDC 4,60, and 61 require ventilation systems to have the capability to provide a safe environment for plant personnel and for engineered safety features. The review of the ventilation system as part of the SEP by the NRC Staff, however, identified two areas where further engineering evaluation was required to substantiate a conclusion that there are not any safety systems where ventilation was a concerns feedwater coolant injection (FWCI) and intake structure. NNECO performed an engineering evaluation in response to the above Staff
; request, concluding that the existing ventilation system heat removal capability of FWCI and intake structure are not sufficient to prevent temperature in these areas from exceeding the design temperature (1040F) during an LNP event.
Therefore, NNECO proposed to provide emergency power to all the FWCl area space coolers and intake structure exhaust fans. ISAP Topic No.1.05 addresses these physical modifications. The proposed design change specifically consists of two parts: j a. Modification of the electrical supplies for the feedwater/FWCl area i coolers so that all six area coolers are automatically sequenced onto a I gas turbine-powered bus following an LNP. I
- , - , - - , - - - - - , - - - , - , - _ , , , - - - - . . - , , - . - , , , - - - - - - - - - - - - . - - - - --.-- - , - - -- - - , , - - , -.-,----,-n
3-19 their motor control centers are load shed. The loss of cooling causes the
- '. area temperature near these two pumps to exceed the 1040F threshold at
, which the pump motor windings experience accelerated aging. Information -
on how long the windings can withstand this temperature before the motors catastrophically fall is not readily available. Consequently, it was conservatively assumed that failure of the condensate and condensate booster pumps occurs whenever the area temperature exceeds 1040F. Failure of either pump causes total failure of the feedwater/FWCI system, implying that system unavailability is 1.0 for the loss of normal power events.
/
I Based on this conservative assumption, NNECO calculated a significant 4 reduction in core melt frequency (approximately 35%), and hence the public risk, associated with the first proposed change. It is emphasized, however, that because of the conservative assumption, the calculation is , 1 artificially high. , t j NNECO's evaluation of the latter design change focused on the ventilation j requirements of the intake structure. NNECO's analyses showed that I during an LNP event with no ventilation in the intake structure and with ! two service water pumps operating, the heat buildup in the intake structure
- i i would not affect the performance of the service water pumps.
Additionally, it was determined that the emergency service water pumps would not be needed unless feedwater failed and manual depressurization l f was required. Even in this scenarlo, the operator would have several hours I i j to manually connect power to the exhaust fans before activating the As a result, NNECO's evaluation emergency service water pumps. i _ _ _ _ _ _ _ _ _ _ . . _ . . - _ _ . _ . ~ . . _ . _ . _ _ _ . _ _ _ _ _ _ . _ _ _ _ . _ _ _ _ . - _ _ _ _ _
+ . - .
= . . - .- . . . ~ . - . . . - . -. . - . .-.
t - 4 3-20 , determined that an LNP load shed of the intake structure exhaust fans would not affect operation of emergency service water should it be 4 required. The exhaust fan electrical modifications would not have any s effect on core melt frequency. The NRC contractor's review of this issue , i - similarly concluded, in Reference 22, that the issue has no impact on the Millstone Unit No. i core melt frequency or public risk and therefore should be dropped. o Personnel Safety: Personnel safety would not be affected by the proposed i modifications to provide emergency power to the FWCl cooler and to the intake structure ventilation system. These changes would require that j some existing cables and controls be replaced and some conduit supports upgraded. These changes in circuitry and supports are in background radiation areas. However, the radiation levels and stay times are i negligible and the work activities would not be significantly altered. This j 1 modification ~also would not increase or decrease any frequency or change l any consequences associated with industrial risk. 1
. o Economic Performance: The above modifications and upgradings of the l area space coolers and the exhaust fans would improve the operability of i
this equipment. However, these improvements would not affect plant availability because the space coolers and ventilation systems are normally operating on an as-needed basis during normal plant operation. It is only , during an LNP that these modifications seem to become important. In ; those cases, the plant is already unavailable. l l i !O 1: I 4
3-21 o Personnel Productivity: Because the proposed actions involve a reassignment of existing electrical loads to different load centers, the workload for testing and maintenance should remain essentially unchanged. Therefore, the modifications would have no impact in this category. , h 6 i l r I i 1 ( f f k i i l.
-p*-- g tw-v -m g tw ' y-e w*-ww- gw-m y y- y-,-ay gpg---g---yewgwm--r.m g- - - - , _r- - -w-wy-Tn-v>p-we-e- wee-me
3-22 ISAP Topic No.1.06 - Seismic Qualification of Safety-Related Piping O References 22,30,32 Proposed Action i ISAP Topic No.1.06 addresses concerns related to tLe ability of plant structures l and equipment to function following an earthquake. The topic evolved from NNECO's response to IE Bulletin 79-14. IE Bulletin 79-14 required field verification of as-built safety-related piping to compare the pipe configuration and support with the design assumed in the analysis performed to show seismic qualification of the plant. IE Bulletin 79-02 had previously required licensees to similarly verify the adequacy of pipe support base plates and expansion anchor bolts utilized in supporting safety-related piping. In response to IE Bulletins 79-02 and 79-14, NNECO initiated an extensive reanalysis and modification effort to qualify safety-related piping for safe shutdown earthquake loadings. NNECO's review of Millstone Unit No.1, provided to the NRC Staff in Reference 32, determined that several piping supports were in need of modification. NNECO divided the modifications into two categories:
- a. Priority modifications which were needed to qualify the piping for the operating basis earthquake. These modifications have all been completed.
3-23
- b. Upgrading modifications which are needed to qualify the piping for the J safe shutdown earthquake. Many of these modifications remain to be Completed.
d This ISAP topic addresses the remaining modii! cations necessary to qualify the piping for a safe shutdown earthquake. Of the approximately 1,100 modifications originally identified, approximately 300 remain. Evaluation o Public Safety: In Reference 30, NNECO provided the NRC Staff with its evaluation of this issue. NNECO's evaluation of the remaining modifications concluded that no overall significant improvement in public
, safety would be gained through their implementation. The piping identified for support modification is expected to function following a safe shutdown level earthquake.
l NNECO's analysis was based, in part, on seismic experience data collected by the Seismic Qualification Utility Group, of which NNECO is a member. The data showed that r! ping is not susceptible to failure due to seismic inertia loads. Additionally, recent seismic probabilistic risk assessment (PRA) analyses of Millstone Unit No. I vintage and newer plants have also shown that above ground piping is generally not the dominant contributor to seismic risk. The NRC contractor's review of this issue (Reference 22) also concluded that further modification of p! ping supports is not warranted and is unlikely
3-24
, to have any impact on plant safety. The contractor's review did recommend that a cursory review of the remaining modifications be performed to determine if any of the modifications were included due to potential displacement failure modes, particularly due to differential motions of buildings, o Personnel Safety: The proposed modifications would result in a small negative impact on personnel safety. The modifications involve the installation and removal of piping supports in many areas of the plant.
l Many of the supports are located in radiation areas. As a result, there would be an increase in surveillances, inspections, and stay times in radiation areas. Also, industrial risk frequency would be increased slightly. o Economic Performance: These modifications would not significantly j change equipment maintainability and would not impact plant availability, i o Personnel Productivity: These modifications would add additional supports, snubbers, and t,ase-plates to the plant. Some will be in radiation areas. { The additional snubbers and bolting wit! require periodic inspections and l maintenance.13ecause of the additional interferences, these supports may also restrict personnel movement in the plant or increase the time to i perform malr.tenance on equipment. In sum, the modifications would result 4 in a decrease in personnel productivity. i i O
)
l
3-26 p evaluation of the CRDR issue which concluded that improvements to control G room layout are not expected to provide any significant improvement in human reliability of an operator during an emergency. Upon completion of the CRDR 3 1 study NNECO will evaluate any specific proposed modifications and disposition them accordingly. Evaluation i o Public Safety: In Reference 30, NNECO provided the NRC Staff with its evaluation of this topic. NNECO evaluated the public safety impact of the project using engineering judgement based on the insights obtained from , the Millstone Unit No.1 PSS. Potential sources of safety benefits considered were a) benefits from avoiding human error caused transients; b) benefits from avoiding human error caused system unavailability; and c) benefits from avoiding cognitive errors due to instrument deficiencies. NNECO concluded that implementation of further improvements to control room layout would result in only an insignificant benefit in risk reduction due to avoiding human caused plant trips and transients. In addition, over the last 15 years of plant operation, a number of control room layouts have been improved. The current design therefore provides clear and unambiguous information to the operator. The issues and cognitive errors which dominate public risk at Millstone Unit No. I are not resolvable by further improvements to the control board layout. In sum, further improvements to c itrol room layout are not expected to provide any significant improvement in human reliability of the operator during an O emergency.
1 3-27 o Personnel Safety: Any modifications resulting from the CRDR would have no effect on personnel safety. The project may require modifications to the control room to improve the ability of operators to prevent accidents. If such modifications were made, however, they would have no effect on occupational exposure or industrial safety. o Economic Performance: The implementation of the CRDR could enhance the operator's reliability in day-to-day operations of the plant. NNECO i therefore subjectively estimated that this topic would provide a small direct benefit to plant performance. o Personnel Productivity: No modifications to control room layout have yet ! been identified. However, it is anticipated that any modifications would involve rearrangement of controls on the main control board in the control room, and therefore would not significantly impact the time necessary to perform surveillance or maintenance. Therefore, there would be no impact ] on personnel productivity. O
3-28 ISAP Topic No.1.08 - Safety Parameter Display System O/ Reference 33 Proposed Action One of the generic recommendations of the TMI Action Plan, identified in NUREG-0737 Supplement 1 (Item I.D.2) and GL 82-33, was that all licensees provide a safety parameter display system (SPDS). The SPDS console must display to operators a minimum set of parameters defining the safety status of the plant, be capable of displaying a full rant,e of important plant parameters and data trends on demand, and be capable of indicating when process limits are being approached or exceeded. ISAP Topic No. 1.08 encompasses implementation of this proposed action. 1 In Reference 33, NNECO provided the NRC with a review of the status of NNECO's activities on SPDS for Millstone Unit No.1. In this letter NNECO noted its intent to provide by Aprl! 9,1987 a safety analysis and a plan and schedule for operator training and implementation of a fully operational SPDS. NNECO also noted that the expected safety impact, need and priority for implementation of an SPDS should be determined in the integrated assessment. I Following completion of this study, an overall assessment of the value of an i SPDS will be conducted to determine the implementation plan and schedule. l l
4 3-29 q Evaluation N./ o- Public Safety: NNECO's assessment of this topic indicated that the SPDS does not provide any new information to the operator. It is only a repackaging of the control board information. Moreover, all operator actions that are taken when a parameter reaches a specific value will still be taken based on control board instrumentation, which is Class IE. Therefore, the SPDS provides only marginal benefit for most transients. The SI$ DS could potentially be beneficial only in rare events such as an anticipated transient without scram (ATWS) or a large break LOCA. More specifically, NNECO analyzed the impact of SPDS on two categories of transients: first, most transients; and second, ATWS and large break LOCA. The basic characteristics of the transients in the first group is that the plant parameters change slowly. In these transients, the most important immediate operator action is to recover and maintain the RPV water level. The existing Instrumentation provides a clear indication of level. Therefore, addition of the SPDS for this parameter will provide no benefit. All other parameters (e.g., RPV pressure, torus water temperature, drywell pressure) which need to be monitored change slowly and the operator has long times (at least I hour) to bring them under control. Because of the long time available for the operator to take corrective actions for these remaining parameters, addition of the SPDS will not appreciably improve the operator's action. O
3-30 ATWS and large break LOCA are rare and hypothetical events in which the b plant conditions change rapidly. To mitigate such an event, the operator needs to monitor many parameters at the same time (e.g., RPV water j level, torus water temperature, etc.). In these instances, the SPDS could i provide a useful function by monitoring, for example, containment limits, and reminding the operators of various cautions in the emergency operating procedures. The frequency of ATWS and large LOCA events, however, is estimated to be very low. Thus the net benefit is limited to mitigating highly unlikely scenarios, i ! o Personnel Safety: Installation of an SPDS would have no effect on I personnel safety. There would be an insignificant increase in calibration j and maintenance. However, because the system would be installed in a low background radiation area, these activities would not increase or decrease i radiation level or stay time. Likewise, the modification does not affect industrial risk. I i o Economic Performance: As part of the SPDS Implementation, it would be necessary to replace the present process ccmputer. As discussed under l ISAP Topic No. 2.03, the new process computer will reduce process t l computer failures and outages, and therefore will improve performance. However, the implementation of the SPDS console display alone does not affect the power generation process, and potentially confers only a small
- indirect economic benefit in terms of any change in averted core damage 1
i probability due to better diagnosis of an accident. t !O 1 i
i- , 3-31 o Personnel Productivity: The additional equipment added by SPDS would J require more training of personnel, additional mamtenance and testing, ar.d would increase the complexity of existing plant systems. The equipment, 4 however, may aid in analysis of plant problems, thus rninimizing the amount of time required for repairs or investigations of problems. It is estimated that overall the advantages would balance the disadvantages,,
- resulting in no net effect in this category.
1 l i i i l 4 t I f f
3-32 ISAP Topic No.1.09 - Regulatory Guide 1.97 Instrumentation OF Reference 34 Proposed Action GDC 13, " Instrumentation and Control," requires instrumentation to monitor variables and systems over their anticipated ranges for normal operation, for anticipated operational occurrences, and for accident conditions, as appropriate, to assure safety. The requirements of GDC 13 are supplemented by GDC 19 and GDC 64. GDC 19, " Control Room," includes a requirement that a control room be provided from which actions can be taken to maintain a plant in a safe condition under accident conditions and that equipment, including necessary instrumentation, be provided at locations outside the control room with the capability to effect prompt hot shutdown. GDC 64, " Monitoring Radioactivity Releases," requires that means be provided for monitoring radioactivity which may be released as a result of a postulated accident. Regulatory Guide (RG) 1.97, Revision 2, " Instrumentation for Light Water-Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During or Following an Accident," was issued in December 1980 to provide guidance concerning implementation of the above requirements. RG 1.97, Revision 2, identifies parameters to be monitored and ranks these parameters, and their corresponding equipment qualification levels, according to the importance of their function. Fuither, RG 1.97, Revision 2, recommends ranges for these parameters.
3,33 f) In an interim report dated March 11, 1985, the NRC Staff issued the interim o results of their review of NNECO's submittals on Regulatory Guide 1.97 for Millstone Unit No.1. In that report, the Staff found the submittals acceptable with the exception of 16 items which required additional justification. In Reference 3fs, NNECO provided the NRC Staff with the status of conformance I with RG 1.97, Revision 2, and addressed the Staff's interim report conclusions. NNECO identified the following nine modifications, within the scope of this ISAP
~
topic, that would be necessary in order to bring Millstone Unit No.1 into , conformance:
- a. RPV Pressure Provide redundant instrumentation (3) for the pressure range 0 - 2,500 psig.
- b. RPV Water Level Provide redundant instrumentation (3) for the level range from +60" to the centerline of the main steam line.
\
- c. Neutron Flux Provide environmentally qualified ,
I instruments with redundant power sources. l l l
- d. Drywell Temperature Provide environmentally qualified i
instruments.
.?
O D)With separate power sources.
3-34 g e. Drywell Spray Flow Provide drywell spray flow measuring i instruments which are environmentally qualified and redundant.
- f. IC Shell-Side Water Level Provide environmentally qualified instruments.
- g. IC System Valve Position Provide environmentally qualified position indication.(4)
- h. Ventilation Damper Position Provide environmentally qualified and redundant position indication.
- 1. Primary Containment ' Provide redundant power sources for Isolation Valve Position valve position Indication.
ISAP Topic, 1.09 addresses the above modifications to conform to the recommendations of RG 1.97, Revision 2. NNECO has performed a probabilistic risk-oriented evaluation of implementing these modifications. NNECO's evaluation is summarized below. The evaluation has shown that most of the modifications provide little or no public safety benefit, while some might provide , a significant benefit. NNECO continues to believe that further effort on this ISAP topic is necessary to definitively determine which modifications provide significant benefits and thus merit implementation. J (4) Redundant power source is addressed in Item 9.
3-35 Reference 34 also listed two additional open items with respect to Regulatory V Guide 1.97, Revision 2. These issues are:
- a. Main feedwater flow
- b. Cooling water flow to ESF system components These two issues are still being evaluated within the scope of this ISAP topic.
Additional information will be submitted at a later date. The only other open items with respect to Regulatory Guide 1.97, Revision 2, relate to containment hydrogen and oxygen concentration. These issues are not discussed here, but are addressed under ISAP Topic No.1.11. Evaluation o Public Safety: NNECO performed a probabilistic risk-oriented evaluation 4 of the potential benefits of the nine proposed modifications to the instruments listed above. The analysis suggested that the proposed modification to the drywell temperature indication would provide i t significant benefit for LOCA sequences. The modifications proposed to all other instruments would provide either no or an insignificant decrease in public risk. Each of the proposed modifications is discussed separately below. RPV Pressure: In the current design, there are redundant instruments (with separate power sources) for the range of 0 to 1,200 psig. Although there (
S 3-36 3: i are two wide range (0 - 2,500 psig) pressure instruments available, both are powered by instrument AC. This proposal involves redundant instruments (with separate power sources) for indications of pressure above 1,200 psig. In all transients, except an ATWS with MSIV closure, the RPV pressure . remains below 1,200 psig because the turbine bypass valves and safety relief valves control pressure well below 1,200 psig. In an ATWS with MSIV closure, the RPV pressure momentarily increases above 1,200 psig. As the core power decreases, the pressure falls below 1,200 psig within 30 seconds. While the pressure is above 1,200 psig, possible loss of indication (due to instrument failure) would not inhibit any transient mitigation efforts. No operator decisions require a pressure reading above 1,200 psig, and none of the mitigating systems are automatically initiated at 1,200 psig. i Therefore, providing redundant power sources for the wide range pressure instrumentation would result in no reduction in core melt frequency or l public risk.
- RPV Water Level: This proposed project involves redundant instruments to measure RPV water level in the range of +60" to centerline of steam line (at +122"). In the current design, there are redundant instruments (with
- separate power sources) available for water level between +60" and the bottom of core support plate. There is a concern that due to a single failure all indications of water level above +60" could be lost. It should be
! noted that normal water level (while at power) is +30". Therefore, loss of 3 indication will affect only those scenarios in which the water level is considerably above the normal value.
3-37 p Following a transient, the emergency operating procedures (EOPs) direct the operator to recover and maintain water level to the normal value. , Also, automatic initiation of all mitigating system occurs when the water level is below 60". Redundant instruments which are available to measure level below 60" provide safeguards against a single failure causing loss of level indication for operator action or for automatic initiation of mitigating systems.
- Only in alternate shutdown cooling (SDC) mode of long-term heat removal operation, will the operator increase the water level above +30" to establish a flow path through the open safety / relief valve back to the torus. However, in alternate SDC, the operator does not need to know 1 water level. Success of alternate SDC is inferred from the cool-down rate, A
g number of safety relief valves (SRVs) open and RPV pressure. Therefore, providing redundant level instrumentation for water level above
+60" would provide no reduction in core melt frequency or public risk.
Neutron Flux: This proposed project involves environmentally qualified instruments with redundant channels and separate power sources for neutron flux measurement. in the current design, the instruments to measure neutron flux are not environmentally qualified. There is a concern that the operator may lose ability to determine core power following a transient. This could happen due to the harsh environment caused by a l LOCA in the drywell or reactor building, or due to loss of power for the i ! instrumentation.
3-38
,g In the Millstone Unit No. I design, each of the control rods has position indications and full-in and full-out lights. Following a reactor trip, the operator can infer subcriticality of the reactor by reviewing the rod position. If all control rods are inserted, subcriticality is ensured and none of the subsequent operator actions require knowledge of core power level.
If at least two adjacent rods stick out, an instrument reading is needed to ensure core subcriticality. With failure of neutron flux measurement, the operator will not be able to determine the core power and therefore will classify the event as an ATWS. None of the subsequent operator actions described in ATWS mitigating procedures, however, require knowledge of core power level. For this low probability scenario, loss of neutron flux monitoring will be only an inconvenience. The loss will not prevent the p) operator from bringing the plant down to cold shutdown. This proposed modification would provide an insignificant reduction in public risk. Drywell Temperature: This project involves environmentally qualified temperature indicators. In the current design, these temperature indicators may not be qualified for harsh environment. There is a concern that following a LOCA or steam line break in the drywell which creates a 1 harsh environment, the drywell temperature indication may fail. ' 1 The existing emergency operating procedure cautions the operator that RPV water level indications may fail when the drywell temperature i reaches the RPV saturation temperature. This failure of level indication is due to reference leg flashing. The failure mode is such that the operator s Q will see an increase in RPV water level, even if the actual level is not i l
, . _ _ _ . - - - - -- - --' ~ -'----'' ~
3-39 varying. With potential failure of, the drywell temperature indicators due
- to harsh environment, the operator will not know when the level indications have failed. If the operator controls the RPV water level based on the i erroneous indicated level, the core may uncover leading to fuel damage.
The EOP also requires the operator to depressurize the RPV if the drywell 4 temperature exceeds 2810F. Due to failure of the drywell temperature, the operator may not carry out this action in time (i.e., before the SRVs fait due to high temperature). Thus, the capability of depressurizing RPV i using the SRVs may be lost. Such a depressurization may be needed for small breaks to allow injection with low pressure pumps. i Considering the effect of loss of drywell tempetsture indication on RPV level instrumentation and equipment operability, and therefore its ! importance to mitigate a LOCA, this project will have a small public l safety benefit. This project is discussed in Section 4.9 of this report. Drywell Spray Flow: The proposed project involves providing redundant and environmentally qualified instruments to measure drywell spray flow rate. In the current Millstone Unit No. I design, drywell spray flow rate cannot be measured. In accordance with the existing EOPs, very restrictive conditions exist for which the drywell sprays can be utilized post-accident. In addition, no current design basis analysis credits the use of drywell sprays. As such, providing redundant and environmentally qualified instruments will result in no reduction in core melt frequency or I public risk. O . 1
3-40 Addition of drywell spray flow measuring instruments could ease the l. restrictive conditions to initiate the spray flow, provided adequate capability to control drywell spray flow existed. The benefit of adding drywell spray flow measuring instruments was calculated assuming the flow measurement will allow the operator to initiate drywell spray when needed (i.e., adequate capability to control spray flow did exist and EOP restrictions would not prohibit use of spray). In the current design (without flow measurements), it is assumed that the operator would not be able to initiate spray flow for all scenarios. Addition of drywell spray measuring instruments was calculated to decrease the core melt frequency by 2.5 x 10-7/ year, which results in a slight decrease in public risk. O Isolation Condenser Shell Side Water Level: This project proposes replac'ing the presently installed IC shell side water level instrument, which is not proven to be qualified for harsh environment, with a qualified instrument. The water level instrumentation provides level indication to the operator. Also, make-up to the shell side is automatically initiated on low level based on this instrumentation. There is a concern that with failure of level Instrumentation, make-up to the IC shell side may not , i automatically start and indication to the operator may be incorrect. An incorrect level indication may mislead the operator with respect to the j need for manually initiating the make-up flow. In the worst case scenario, the IC could lose its function due to a loss of shell side inventory. NNECO evaluated this worst case scenario.
3-41 f- - The water level instrumentation for IC shell side is located in the reactor
.( building. A break in the reactor building which can create a harsh environment, and thus potential instrumentation failure, is a low frequency event (less than 1 x 10-5/ year). The IC can mitigate the event if the break can be isolated. For an unisolable break in the reactor building, the IC does not provide any benefit. This is because ultimately all inventory will be lost through the break, resulting in severe core damage. An isolable break in the reactor building can be mitigated by many systems other than the IC.
The public safety benefit of qualifying IC shell side water level
; instrumentation was estimated by assuming that without such modification, the IC cannot be used to mitigate a break in the reactor building. NNECO concluded t .at providing a qualified IC shell side water level instrumentation results in an insignificant improvement in core melt frequency (8.0 x 10-9/ year) and therefore a negligible reduction in public risk.
Ventilation Damper Position: The public safety benefit of providing environmentally qualified redundant position indications was included in the evaluation of ISAP Topic No.1.12 Control Room Habitability. Primary Containment Isolation Valve Position Indications: NNECO .f addressed in its evaluation both the proposed IC system valve position indication and the proposed containment isolation valve position indications. In the current design, the valve position indications are either not environmentally qualified or do not have redundant power sources. The
3-42 proposal is to correc: these perceived deficiencies. NNECO's analysis, however, concluded that loss of these valve position indications is not critical in limiting off-site dose. First, closing of the valves is important to reduce release only in the sequences leading to significant fuel damage. The frequency of such sequences is low. Second, the stack monitoring and alarm system provides indication of any appreciable release in the reactor building and turbine building. Loss of valve position indication does not imply that the valve will not function (i.e., close automatically or manually). If the stack monitoring indicates that a release is occurring and the operator is not certain that all containment isolation valves are closed (due to loss of position indication), the operator will assume that the valves are open and will close them from the control room. Therefore, loss of indication does not inhibit the operator from minimizing the offsite dose. o Personnel Safety: This project would have a very small negative effect on personnel safety. The proposed instrumentation changes would probably result in a small increase in calibration and surveillance. While the radiation and activities associated with the project are not significant, the modifications would result in a small increase in stay time. The project would not otherwise impact industrial risk. o Economic Performance: The proposed instrumentation modifications would i not impact plant availability. All of the concerns addressed by these proposed actions are important only af ter an accident, when the plant is l already shutdown. Existing instrumentation will continue to perform their l L l _ - . ~ _ _ . _ - _ _ _ . _ _ _ _ _ _ _ . . _ _ _ _ _ _ _ _ . . . _ _ , _ . _ _ _ _ . _ _ _ _ _ _ . _ . _ _ _ _ _ _ _ _ _ _ _ _ _
3-43 functions during normal and transient operations not leading to degraded core accidents, o Personnel Productivity: If additional instrumentation is added, the j workload for instrumentation and control personnel will be increased. Training requirements may also increase. However, the procedures and the ability to communicate information correctly during an accident may be - enhanced with better instrumentation. In sum, it appears the advantages would balance the disadvantages, producing a neutral rating.
+
i 4 1 1
3-44 !~( ISAP Topic No.1.10 - Emergency Response Facilities Information Reference l 35 Proposed Action i One of the generic recommendations of the TMI Action Plan, identified in NUREG-0737 Supplement 1, Generic Letter 82-33, and Regulatory Guide 1.97, Revision 2, is that all licensees and applicants for operating licenses provide Emergency Response Facilities (ERFs) with appropriate information. i ISAP Topic No.1.10 addresses conformance of Millstone Unit No. I to the criteria of GL 82-33 related to ERF information. The relevant guidance concerns the types of information appropriate to the ERFs and the types of plant status information that should be provided to ERFs following an accident event. In Reference 35, NNECO stated that the final list of variables to be displayed is currently being developed. ISAP Topic No.1.10 encompasses this project. 4 Fellowing a major plant accident, personnel would be assembled to monitor the i events occurring at the plant. These personnel will require data from the control room in order to analyze the incident and assess changes in the plant situation. Specifically, a full complement of operations shift personnel would be called on-site to man the ERFs: the Technical Support Center (TSC) and the Emergency Operations Facility (EOF). The TSC and EOF serve as emergency operations "zer!: creas providing support to the control room. At present, the information
-----.,.--,n,, , , . . , . , - - , - . . . - - - . , -..m.,m n-. - -
,..-------,.,_.m,,_,m, -. --.. -,
3-45
/]' required by personnel within the TSC and EOF would be available through existing instrumentation and communications channels. However, additional information in the TSC might help operators to mitigate events that lead to degraded long-term cooling scenarios.
Final ERF information capabilities will be considered along with the final RG 1.97 instrumentation (see ISAP Topic No.1.09). Evaluation o Public Safety: NNECO evaluated this topic and concludes that some type of plant monitoring capability would be suited for the TSC. The TSC serves as an emergency operations work area with personnel assigned to provide support to the control room by evaluating post-accident events as they occur. Evaluation is a real-time process which closely couples operators in the control room with personnel who are called in to man the TSC. During the time that emergency plans are in effect, control room operators and TSC personnel are essentially working on the same problems. If the TSC personnel had rapid access to the same information as their counterparts in the control room, it is likely that they would be able to devise the solution to a problem which is not addressed by procedures (e.g., multiple equipment failures that lead to loss of the long-term cooling function). Similar information needs do not exist for the EOF. The persons assigned to these facilities are expected to be more involved with broad range concerns, such as radiation dose rate estimates and evacuation, than they c
-- - - - - - - , , - w- + , , , - - , - , - , - - - - , - - - - - - - - - --, - ,
3-46 would be with minute-to-minute plant operations and specific control board manipulations. Consequently, the EOF personnel will not require the same information during the same prompt time frame as would the TSC personnel. As such, existing EOF information gathering capabilities are adequate. o Personnel Safety: Personnel safety would not be affected by availability of additionalinformation at either the TSC or the EOF. The changes are in a non-radiation area, so there would be no effect on exposure. Although there would be some additional surveillance activities, the increase in plant activities would be insignificant. Therefore, there would be no effect on Industrial risk. o Economic Performance: This proposed project would not have any impact on plant availability or performance. By definition, the additional information capability would only be useful when the plant is unavailable, o Personnel Productivity: Additional information at the emergency response facilities would require minimal additional maintenance. Therefore, there would be minimal impact on personnel productivity. 4 7 O
3-47 ISAP Topic No.1.11 - Post-Accident Hydrogen Monitor a
' Reference ,
1 36,37 - Proposed Action Following a postulated design basis accident (DBA), limited quantities of hydrogen gas are generated by the reaction of steam with the zircaloy fuel cladding in the core. If adequate quantities of oxygen and hydrogen exist in the containment, there is the potential for combustion or deflagration. To reduce or eliminate the potential for combustion or deflagration,10CFR50.44 requires Mark I Boiling Water Reactors (BWRs) to have inerted containments. Inerting reduces the potential for combustion or deflagration by reducing the oxygen content in the containment atmosphere to the level that is not capable of reacting with hydrogen produced by an accident. A combustible gas control evaluation (CGCE) was performed for Millstone Unit No. I and has shown that if the initial oxygen concentration in the containment is 4% or less (the technical specification limit), there is no potential for combustion or deflagration during or following a DBA. Nevertheless, follow-up actions resulting from the TMI Action Plan, identified in NUREG-0737 (Item II.F.1.6), request licensees to monitor containment hydrogen concentrations. ISAP Topic No.1.11 addresses this issue for Millstone Unit No.1. In response to the post-accident monitor criteria of the TMI Action Plan, NNECO installed a single channel hydrogen monitoring system. In addition, the
3-48 existing Post-Accident Sampling System (PASS) can provide information on V(3 containment atmosphere hydrogen concentration. As noted in Reference 36, because a combustible gas mixture will not exist following a postulated design basis accident at Millstone Unit No.1, and because NNECO relles on the control of oxygen rather than hydrogen to prevent a combustible mixture, no operator actions are currently predicated on the ability to monitor the containment hydrogen concentration while the drywell is inerted. 1 By letter dated July 30, 1984, the NRC Staff issued a safety evaluation ; concluding that the Millstone Unit No. I monitoring system meets the TMI Action Plan " requirements" in all respects except for redundancy. The Staff interprets the criteria to request a two-channel containment hydrogen I monitoring system. Moreover, the Staff noted that the PASS provides only grab ^ samples. The Staff indicated that NNECO should demonstrate that the sampling and analysis frequency of the PASS is sufficient to respond to any rapid changes in hydrogen or oxygen concentration, before the single channel analyzer can be considered acceptable. In Reference 36, NNECO committed to provide the Staff with additional information regarding the capabilities of the PASS. NNECO submitted this information in Reference 37. The project analyzed under this ISAP topic is a redundant hydrogen and oxygen monitor system. The same instrumentation was also evaluated in conjunction with ISAP Topic No.1.09. Evaluation O o Public Safety: Adoption of a redundant hydrogen monitoring system would not impact public safety. The Millstone Unit No. I drywell is inerted
3-49 during normal operation to less than 4% oxygen concentration, in V accordance with technical specifications. Analysis has shown that with less than 4% oxygen concentration, formation of a flammable gas mixture is precluded for an indefinite period of time following a design basis LOCA. Flammable concentrations of hydrogen post-accident are a concern only when the containment is deinerted. This time is limited by technical specifications to the 24-hour period prior to a plant shutdown and 24 hours following a return to power; a total of 48 hours. However, the frequency of a LOCA event occurring in this time period accompanied by failure of the two existing hydrogen monite.-ing methods (the hydrogen / oxygen analyzer and the PASS system)is extremely small. Addition of a redundant hydrogen monitoring system therefore would have a negligible impact on public safety. O o Personnel Safety: This change would have a small negative impact on personnel safety. First, the redundant hydrogen and oxygen monitor system would be installed inside containment in a radiation area. The system would require a small increase in surveillance and maintenance activities, adding to stay time inside containment and thereby increasing occupational exposure. Secos d, this proposed modification also represents a small increase in frequency associated with industrial risk. l o Economic Performance: Implementation of this issue would not impact l l plant availability, i i o Personnel Performance: A redundant hydrogen monitor would increase the
]
amount of maintenance and surveillance testing required by instrumentation and control, and chemistry personnel.
3-50 ISAP Topic No.1.12 - Control Room Habitability 0 References 22,38,39 Proposed Action TMI Action Plan item Ill.D.3.4, " Control Room Habitability Requirements," was issued to assure that licensees adequately protect control room operators against the effects of an accidental release of toxic (e.g., chlorine) or radioactive gases, and that nuclear power plants can be safely shutdown under DBA conditions. ISAP Topic No. 1.12 evaluates an upgraded heating, ventilation and air conditioning (HVAC) system for Millstone Unit No.1. The upgraded HVAC would ensure protection of the control room operators. The upgraded HVAC would - provide complete, redundant air handling units, leak-tight dampers, HEPA [ I filtration, and radiation and chlorine detection for automatic isolation of air Intake. During a radiation or chlorine release, the system would provide 100% recirculated air with the capability for post-accident purge to reduce carbon dioxide and radiation content. The proposed system would use charcoal filters capable of removing iodine. l In Reference 38, NNECO provided the Staff with an assessment of ISAP Topic No.1.12 for Millstone Unit No.1. NNECO proposed to evaluate an alternative method of protecting the control room operators because of the very high cost of i control room HVAC design modifications. Specifically, dose assessments have
1 3-51 shown that control room operators only need additional radiation protection from l Cs\ d thyroid doses. A self-contained breathing apparatus could protect control room I operators from airborne lodine and chlorine gas and provide approximately the l same benefit as the proposed Hv'AC modifications at a significantly lower cost. , l Additionally, any reductions in the radioactive source term, as are currently .j being evaluated by the NRC Staff, would result in lower thyroid doses. Finally, ! l NNECO has removed the two chlorine tank cars (utilized in marine biofouling ! control) which were formerly stored on-site and represent a significant toxic gas ! safety concern. (See ISAP Topic No. 2.07.) l
. As noted in Reference 39, NNECO has performed a probabilistic risk-oriented evaluation of this issue and concluded that implementation of an upgraded HVAC system at Millstone Unit No. I would provide minimal benefit in reducing the calculated core melt frequency at Millstone Unit No. 1. In addition, in Reference 22, the NRC contractor concluded that the benefits of this topic were insignificant and recommended that this issue be dropped.
Based on the above, NNECO concludes that further evaluation of alternatives to the proposed HVAC modifications should be performed to identify the
~ appropriate scope of modifications which will provide an approximately equivalent level of protection for control room operators in order to satisfy the i
intent of TMI Action Plan Item III.D.3.4. We currently believe that the
; appropriate scope of work to be implemented will be significantly less than that 1
j originally identified in response to Item III.D.3.4. I i i
3-52
, Evaluation o Public Safety: As calculated in NNECO's analysis under ISAP Topic No. 2.07, " Sodium Hypochlorite System," the frequency of a core melt
. accident initiated by chlorine release is 9.2 x 10-7/yem. The effect of chlorine gas release on Millstone Unit No. I control room personnel, and the risk of indirectly causing a core melt accident, is discussed under ISAP Topic No. 2.07. The proposed project under that ISAP Topic also addresses the potential public safety benefit from modifications related to this scenario.
- As discussed in Reference 39, design basis calculations indicate the need to protect the operators during design basis accidents where subsequent operator actions are still assumed. However, such design basis calculations j utilize grossly conservative estimates of the iodine source term.
Realistically, severe core damage and significant containment failure or bypass is necessary in order to reach a situation in which control room operators would require protection. If the source of such releases is Millstone Unit No.1, subsequent Unit No. I operator actions (and the upgraded HVAC) would have no significant impact on public risk. However, l if the source of the release is Millstone Unit No. 2, protecting the Unit No. I operators from high radiation could improve the probability of a safe I shutdown of Unit No.1. The frequency of core melt accident at Unit No.1 initiated by high radiation level due to release from Unit No. 2 was 1 estimated at 2.5 x 10-7/ year. The proposed modification would provide a l small benefit in this area. O i 1
3-53 Finally, NNECO considered loss of control room HVAC during normal operations. The effect of loss of HVAC during normal operations, and the subsequent higher control room air temperature, would be additional environmental stresses on the operators and additional potential for operator errors. The proposed upgrade to the system would have two, 100% air filtration units and air conditioning units. Therefore, the upgraded system would be more reliable, Presumably, this would tend to 2 reduce the likelihood of future losses of control room HVAC, and hence the probability of operator errors. However, the decreased probability of the i operator making an error and initiating a transient due to' environmental ' stresses cannot be easily quantified and the upgraded system would not completely eliminate this risk. o Personnel Safety: This modification would have a small negative impact on personnel safety. The proposed modification includes installation of coolers, dampers, charcoal cannisters, and prefilters. The modification
)
would therefore increase surveillance and maintenance activities beyond that which is 'now required, and would require special maintenance and i l testing of the charcoal. NNECO considers this increase in activities significant enough to slightly increase occupational exposure. NNECO also concludes, based on industrial history, that working with this type of equipment would increase industrial risk. o Economic Performance: This proposed modification represents a small increase in economic performance. The proposed system would improve ! the reliability of the control room HVAC system. The environment of the control room has a direct impact on the operator's ability to control the i i ! i L.---_ -. - ._ -.--. . . - - - - - . .- - -- - - - - -- A
3-54 (q operation of the plant during an accidental release of radiation or toxic 'V gas. The present control room HVAC system does not meet the single failure criterion and therefore has the small potential of causing a plant transient with resulting loss of plant availability. o Personnel Productivity: This proposed modification involves a major redesign of the control room HVAC system. The additional equipment involved would require more space than the existing unit occupies. Furthermore, the additional equipment would impact the workload of maintenance, instrumentation and control, operations, and chemistry personnel. The modification therefore represents a decrease in personnel productivity. l O 4 !O A
--,.---..r-- ,, ,w ,-._---.m-- - ~ - - . - - - - - - - - - , - - . - - - , , - - . . ..---..--.,_e, - - . . - , . . - , . , , . - , -. - - - - - - , -
3-55 ISAP Topic No.1.13 - BWR Vessel Water Level Instrumentation Referencas 32,40,41,42 Proposed Action The water level instrumentation in a BWR is relied upon for controlling feedwater, actuating emergency systems, and for providing the operators with information which is used as a basis for actions to assure adequate core cooling. Many of the actions in the emergency procedures guidelines are keyed to reactor water level. TMI Action Plan Item II.F.2 and GL 84-23 request that licensees modify or supplement existing equipment to assure accurate indication of vessel water level. The RPV water level indication which is used to mitigate accidents is based on a number of level gauges which utilize one of two reference legs located within the drywell. Unusually high drywell temperature in conjunction with RPY depressurization can affect reactor water level instrumentation by causing water ; j in the reference legs to flash when the drywell temperature reaches RPY saturation condition. This flashing results in erroneous readings that indicate a higher reactor water level than the actual level present in the vessel. If the I operator places undue reliance on the indicated water level, the potential exists that makeup could be throttled to the extent that the core is uncovered. Such scenarios are explicitly considered in the Millstone Unit No. 1 emergency Operating procedures. l
3-56 3 (J In References 32 and 40, NNECO provided the Staff with assessments of this issue for Millstone Unit No.1. NNECO's probabilistic risk-oriented evaluation, described in Reference 40, concluded that eliminating the potential for reference leg flashing at Ministone Unit No I would yield a significant decrease in risk to the pub!!c. NNECO is currently investigating several approaches to resolve the reference leg flashing issue for Mulstone Unit No.1. ISAP Topic No.1.13 evaluates the impact of resolution of this issue. i More recently, the NRC published IE Information Notice 86-47, " Erratic Behavior of Static "O" Ring Differential Pressure Switches" which advised
- licensees of erratic behavior of certain differential pressure switches which caused the failure of the LaSalle 2 reactor to scram when it underwent a transient with the reactor water level below the low-level scram setpoint.
In response to this Information Notice, NNECO undertook an extensive investigation of the differential pressure switches being utilized at Millstone Unit No.1. The investigation concluded that the Static "O" Ring differential pressure switch issue did not apply to Millstone Unit No.1. This information was provided to the NRC in a meeting on June 12, 1986 and in a subsequent letter dated July 3,1986 (Reference 41). Subsequently, on July 18, 1986, the NRC Staff issued IE Bulletin No. 86-02,
" Static 'O' Ring Differential Pressure Switches." The Staff requested licensees to determine if they have Series 102 or 103 differential pressure switches supplied by SOR, Inc., installed as electrical equipment important to safety and, if so, to take certain actions to assure that system operation is reliable. NNECO
3-57 l responded to the IE Bulletin in Reference 42, and concluded that this recent issue does not represent a safety concern for Millstone Unit No.1.
)
l l Evaluation o Public Safety: Reference leg flashing can occur af ter a LOCA, if the l drywell heats up to the saturation temperature in the reactor vessel. In the Millstone Unit No.1 PSS, this phenomenon was assumed to occur. Subsequent failure of the operator to follow emergency operating procedures regarding erroneous water level was then considered. The frequency of core melt due to reference leg flashing and cognitive errors in interpreting level indications was calculated by multiplying the frequency associated with each LOCA size by the appropriate operator error frequency taken from the PSS. Adding the resulting core melt frequencies for each LOCA size yields a total value due to reference leg flashing of 1.6 x 10-5/ year. In conclusion, if it is assumed that reference leg flashing is a problem for Millstone Unit No. I and a fix can be identified to entirely eliminate the problem, this project would lower public risk. o Personnel Safety: Personnel safety would not be affected by this proposed action. Installation of new water level instrumentation, or modifications to existing equipment, would not alter routine plant activities. Therefore, these modifications do not change any radiation level or stay time, or any frequency or consequences associated with industrial risk. O
3-58 o Economic Performance: NNECO concluded that the NRC-recommended improvements would not significantly enhance plant reliability or availability. For reference leg flashing to become a problem during normal operation, the drywell would have to heat up to temperatures in excess of 4000F prior to level instrumentation failure. The only cause of such an unlikely temperature excursion would be a total loss of drywell cooling due to common cause failure of all eight drywell coolers. Based on an analysis of such an event, it is concluded that the current reliability of level instrumentatloa is sufficient for normal operation. l o Personnel Productivity: This proposal would have no effect on personnel productivity. Assuming the modifications are basically to piping, little impact on plant workload is anticipated. O O -
3-59 ISAP Topic No.1.14 - Appendix 3 Modifications O Reference 29,43 Proposed Action Appendix 3 to 10CFR50, " Primary Reactor Containment Leakage Testing for Water-Cooled Reactors," was published on February 14, 1973. Many nuclear plants had either received an operating license (such as Millstone Unit No.1) or their containments had reached advanced stages of design or construction as of that date. The NRC expressed concern that these plants might not be in full compliance with the requirements of the regulation. In an August 7,1975 letter, the NRC requested NNECO to determine if containment leakage testing at Millstone Unit No. I was in full compliance with Appendix 3. Specifically, NNECO was requested to identify a) any design features that do not , permit conformance with Appendix 3, or b) existing technical specifications which are in conflict with Appendix 3. NNECO was requested to provide a summary of planned remedial actions (i .e., design changes, technical l specification modifications or exemption requests), as well as schedules for such actions. In Reference 43, NNECO responded to the Staff, noting the areas where Millstone Unit No. I did not conform to 10CFR50, Appendix 3 requirements. As noted in Reference 29, NNECO is currently evaluating the overall status of Millstone Unit No. I compliance with the requirements of 10CFR50, Appendix 3.
3-60 ps Pending the results of this evaluation, NNECO will identify modifications b necessary to bring the plant into compliance with Appendix 3 and/or submit exemption requests where necessary. ISAP Topic No.1.14 encompasses this project to identify any remaining areas of noncompliance and the proposed modifications to resolve such open issues. Specifically, NNECO has idendfied several containment penetrations that do not meet regulatory guidance and pror.osed the following modifications:
- a. Installing a support hanger for a 3/8" test line which comes off the standby liquid control (SLC) piping near penetration X-42.
- b. Installing ladders and platforms to reach test valves at penetrations X-43, X-45 (LPCI supply line), X-16A, X-16B (core spray supply line),
- c. Installing test lines to permit leak rate testing of containment isolation valves at penetrations X-204A through C (torus ring header suction),
and X-210A and B. These three projects define the present scope of this ISAP topic. It should be noted, however, that item (b) was proposed only for plant convenience - not in order to meet Appendix 3. Evaluation o Public Safety: NNECO evaluated each of the 3 Appendix 3 modifications separately, as discussed below.
3-61
- a. The installation of a pipe hanger on the SLC test line would provide
%/
additional protection for the test line isolation valves by reducing the chance of vibration-related failures. However, because vibration is not a significant contributor to valve failure, the modification would have a negligible effect on containment isolation and no effect on public risk. i ,
- b. .The installation of ladders and platforms would only provide increased accessibility for valve leak rate testing. As a result, this modification 4
~
would have no impact on valve leak tightness and public risk. I
- c. Most of the valves associated with this modification are required to either open or remain open for success of LPCI and core spray, following a LOCA. The remaining valves are normally closed valves which are in series and may not be required to open. The modification involves installation of test lines so that all of these valves can be leak tested to ensure leak tightness, f
1 'If a core melt were to occur as the result of a LOCA event, then the open valves would be closed to " isolate" containment. However, failure of these valves to close would not result in an unisolated containment. l All of the valves are on closed loops which exit and return to the - 5 containment. Because leak testing the valves would not reduce their , failure to close, this modification offers no risk reduction. l l l o Personnel Safety: This modification would have a small positive impact on personnel safety. The proposed modification to add ladders and platforms to rccch test valves on the LPCI supply line and the core spray supply line
3-62 (item b) would improve accessibility, for example, for a valve that is 20 feet in the air. This modification would not alter any previous plant activities or surveillance and maintenance requirements, and therefore has no effect on occupational exposure. Improved accessibility, however, would reduce preparation requirements (such as staging) to reach some locations and would reduce industrial risk.
- o Economic Performance
- In total, the design modifications proposed to ,
facilitate containment leak rate testing represent a negligible impact on plant performance. NNECO's analysis of the individual impacts is summarized below,
- a. The impact of installation of a support hanger associated with penetration X-42 has two aspects. One, the installation of additional material inside the reactor building would make valve maintenance more time consuming. Two, the support would provide additional protection for the valves by reducing the exposure of the valves to structural integrity failures and vibration-related failures. The balancing of these two aspects results in a negligibly small positive impact on plant performance because the reduction for the valve failure frequency results in less plant exposure to an unavailability event.
- b. The impact of installation of ladders and platforms associated with l-penetrations X-43, X-45, X-16A, and X-16B has two aspects. One, the 1
, installation of additional equipment inside the reactor building
\ represents a small detrimental effect on the maintainability of I surrounding equipment. Two, the equipment would provide increased
)
3-63 accessibility to the valves which will aid in reducing the time it takes j to maintain and access the associated valves. Reduction in repair time
- of the valves impacts plant performance by reducing the associated plant outage time should the valves cause a failure of the ILRT test, i ,
and hence, impact refueling outage critical path. The balancing of these two aspects results in a negligibly small positive impact.
- c. Installation of test valves end branches associated with penetrations X-204A through C and X-210A and B would result in a small detrimental effect on maintainability due to: (1) increasing the volume of equipment inside the reactor building, and thus, affecting the maintainability of surrounding equipment; (2) increasing the volume of equipment requiring surveillance and maintenance; and (3) increasing the likelihood of a valve failing the penetration leak rate test.
o Personnel Productivity: These proposed modifications were determined to have no effect on personnel productivity. Maintenance and surveillance of the new valves would be similar to existing valves. dl O . I i
l 3-64 Q ISAP Topic No.1.15 - FSAR Update O References 13,24,44,45 Proposed Action Section 50.71(e)(3Xii) of 10CFR Part 50 requires that those plants previously subject to the NRC's SEP review file a complete updated final safety analysis report (FSAR) within 24 months after receipt of notification that the SEP has been completed. By letter dated March 16, 1983, the NRC Staff informed NNECO that the SEP had been completed for Millstone Unit No. I and that, pursuant to 10CFR50.71(e)(3), NNECO was required to file an updated FSAR. ISAP Topic No.1.15 encompasses this project. In Reference 44, the NRC Staff granted NNECO an exemption until March 31, 1987 for submittal of an updated FSAR for Millstone Unit No.1. This exemption was granted in response to NNECO's October 11, 1985 letter (Reference 45) providing the NRC with schedular milestones for component parts of NNECO's FSARi date effort and a completion schedule for the entire FSAR update. In Reference 45, NNECO also stated that the FSAR update would be based largely l on the format of RG 1.70, Revision 3, which would result in a more comprehensive document than would result from minimal compliance with 10CFR50.71. O
l 3-65 According to the strict terms of the exemption, the schedule for the submittal of O the FSAR update has been established. The work necessary to complete the update will be carried on independent of ISAP. Therefore, as stated by the NRC Staff in Reference 13, ISAP Topic No.1.15 is resolved. NNECO does not plan any further evaluation of the " benefits" of this topic within the framework of the ISAP. However, NNECO will consider the manpower and resource burden , associated with the FSAR update as part of the resource management and integrated schedule aspect of the ISAP. . Evaluation o Public Safety: The FSAR is mainly used as a reference document to gather plant-specific information. It is also used in performing safety evaluations , of plant design and operational changes and in operator training. The
- Millstone Unit No. I design has been substantially modified and significant additional safety analyses have been performed since the FSAR was originally published. Because the FSAR does not reflect the as-built plant or the most current analyses performed, there is concern that erroneous decisions (e.g., with respect to a design, technical specification, or procedure change) could be made based on an obsolete version. Similarly, the operator training could be affected. The system descriptions, design bases, and results of transient analyses for many lesson plans could be
- invalid due to an obsolete FSAR being one of the primary sources of information.
NNECO specifically analyzed this concern. The updated FSAR will reflect the as-built plant and updated safety analyses. However, based on
3-66
- e NNECO's analysis of the public safety impact, the proposed project will
( have a negligible positive impact. First, it is conceivable that based on some information in the FSAR which is no longer valid, a safety evaluation may endorse a design, technical specification, or procedure change which is inappropriate. However, because the FSAR is rarely, if ever, the only source of information, the probability of an error not being detected during the safety evaluation is extremely small. ! Second, information for the lesson plans used in operator training is I obtained from the FSAR and other design documents. However, any , significant deviation in a lesson plan from the as-built plan would not be likely to go undetected and uncorrected. This is because the same lesson plans are also used to requalify the experienced operational staff who are intimately familiar with the as-built plant (i.e., original design and subsequent modifications). Therefore, upgrading of the FSAR is not expected to have any significant influence on lesson plans or the outcome of future safety evaluations. i o Personnel Safety: This project has no effect on personnel safety. The project will not alter any plant activities or change occupational exposures or industrial risk. I ? o Economic Performance: The FSAR update is not expected to have any significant impact on plant performance. The update will reflect existing plant operation and, as such, will not impact the existing power generation process.
3-67 o Personnel Productivity: This project will increase personnel productivity. The FSAR update, by reflecting current design and safety analyses, will reduce the time spent by personnel researching design basis information. l i i I I i 1 i I i 1 4 4 J 1 i 1 I -
3-68 l ISAP Topic No.1.16 - Appendix R l References 46,47
Background
Appendix R to 10CFR50," Fire Protection Program for Nuclear Power Facilities i Operating Prior to January 1,1979," requires that licensees establish a fire protection program at their nuclear power plants. The program must establish the fire protection capability for structures, systems, and components important to safety, and must include development of the procedures, equipment, and personnel required to implement the program. ! NNECO, as a result of the review of proposed exemption requests submitted for Millstone Unit No. I for compliance with 10CFR50.48 and Appendix R, identified four plant modifications to bring the plant into compliance with fire protection l requirements. By letter dated November 6,1985, the NRC Staff issued an exemption to certain requirements of Appendix R in response to the request by NNECO. The exemption was based, in part, upon NNECO's commitment to ! implement the four proposed modifications. As discussed in Reference 46, the initial proposed scope of this ISAP topic included these four Appendix R modifications, i.
. Subsequently, NNECO performed a revalidation and verification of the i
completeness and accuracy of the previous Appendix R submittals. NNECO i
3-69 concluded that new fire areas were estab!!shed and identified the corresponding fire boundaries. The new fire analysis resulted in a request by NNECO, in Reference 47, dated November 21, 1985, for new exemptions from the requirements of Appendix R. NNECO stated that approval of the previous exemptions did not affect their new submittal, insofar as the previously proposed modifications and exemptions were replaced by the proposed modifications and exemptions requested in the current submittal. Based upon Reference 47, ISAP Topic No.1.16 now encompasses 12 proposed modifications to achieve compliance with Appendix R. Each of the I modifications is discussed individually below, under ISAP Topic Nos.1.16.1 through 1.16.12. O I O
l l 3-70 ISAP Topic No.1.16.1 - Appendix R. MPl/MP2 Backfeed ;
~/
References 22,27,46 Proposed Action This topic resulted from the review of proposed exemption requests and modifications submitted for Millstone Unit No. I to comply with 10CFR50.48 and Appendix R. This topic addresses modifications which would enable the Millstone Unit No. 2 diesel generator to supply emergency power to Millstone Unit No. I during a control room, reactor building, or turbine building fire. Similarly, the proposed backfeed capability would allow Millstone Unit No. I to supply Millstone Unit No. 2 with shutdown power for a Millstone Unit No. 2 control room, reactor building, or turbine building fire. Evaluation o Public Safety: In Reference 46, NNECO provided the NRC Staff with a review of this proposed modification and its applicability towards bringing the plant into compliance with 10CFR50.48 and Appendix R. In i Reference 27, NNECO provided the Staff with a probabilistic risk-oriented evaluation of the proposed modification. As a result of these analyses, i l t l
3-71 e NNECO concluded that implementation of this project would yield a
' significant decrease in risk to the public.(5)
First, the proposed action would significantly mitigate switchgear room fires. A previous probabilistic analysis of fire events has indicated that the switchgear room fire is a dominant fire induced core melt accident sequence. Therefore, the proposed backfeed could significantly reduce the frequency of fire induced core melt sequences. Moreover, the changes will result in the capability to provide power to the Unit i emergency buses following a Station AC Blackout caused by any inte-nal event. Quantitatively, if the backfeed is implemented, the core melt frequency decreases from 8.07 x 10-4/ year to 7.52 x 10-4/ year, or about 7% O V The NRC Staff contractor's review of this proposed modification also concluded that the public safety benefits of implementing this project are significant. o Personnel Safety: This proposed modification would have no impact on occupational exposure or industrial safety. o Economic Performance: The proposed backfeed capability is not expected to impact plant availability or economic performance. (5) This is based on the assumption that ISAP Topic No.1.16.2 is implemented O concurrently. For more information on this linkage, please refer to ISAP Topic No.1.16.2. (_/
. = - . _ -. . . .. - _- - . _. .. - -- - .-. _ .. - ___ __.
3-72 o Personnel Productivity: This proposed modification was determined to result in a very slight negative impact on personnel productivity. The addition of new breakers and related equipment would require additional maintenance, testing, and surveillance by plant and production test personnel. 1 4 0 I [ i i i i i ]
}
4 i h l
-..-r-. - - -- ~.-,-,--emy.--- --
3-73 p ISAP Topic No.1.16.2 - Appendix R. Modify CRD Pumps
't References 25, %
f Proposed Action This topic resulted from the review of proposed exemption requests and modifications submitted for Millstone Unit No. I to comply with 10CFR50.48 and Appendix R. This topic addresses a proposed project to modify the control rod drive (CRD) pumps to operate without an external source of cooling water during a control room or turbine building / intake structure fire. The modification would allow manual realignment of the CRD motor cooling piping to the pump discharge flow to permit self-cooling. The CRD pump will be used to compensate for any decrease in reactor vessel water level due to leakage and shrinkage during cool-down. Evaluation o Public Safety: Following an AC blackout event or serious fire that incapacitates both emergency AC buses, the IC is the only available system that is capable of preventing core melt. The IC and its associated make-up system function to remove core decay heat independent of AC power. Make-up to the IC is provided by the diesel-driven fire pump which can also be used to meet long-term vessel make-up requirements that are caused by l primary system shrinkage and/or rninor leakage out of system. Lining up
, - . . - - - - _ - . , , - - , , . - . . - - - - - _ - . - . . _ . - - - - - - . . - . , - . . - . ~ _ . - _ . - . -
~
3-74 the diesel pump for vessel make-up requires operators to connect a fire hose in the turbine building to the feedwater heater drain. However, if a serious fire occurred in this building, the feedwater heater drains may not be accessible for some time. In such an event, the proposed modification would allow a CRD pump to be used for make-up in place of the diesel pump.(6) In Reference 46, NNECO provided the NRC Staff with a review of the , proposed project to modify CRD pump cooling and its applicability towards bringing the plant into compliance with 10CFR50.48 and Appendix R. In Reference 25, NNECO provided the Staff with a probabilistic risk-oriented evaluation of the proposed modification. As a result of these analyses, NNECO concluded that by itself the proposed CRD pump modification would provide insignificant benefit to Millstone Unit No.1. Conversely, the backfeed project (ISAP Topic No.1.16.1) will not accomplish its intended purpose without implementation of the CRD pump self-cooling project. However, the two topics are implicitly linked. Together they provide a significant decrease in public risk. See the evaluation of ISAP Topic No.1.16.1, for NNECO's quantified assessment of this joint benefit. o Personnel Safetyr The proposal to medify the CRD pump to permit self-cooling would have no impact on personnel safety. The proposal would not af fect either occupational exposure or Industrial safety. (6) The power cables to the CRD pumps, however, have to pass through the turbine building and may be damaged as a result of the same fire. ISAP Topic O- No.1.16.1 addresses the issue of being able to power a CRD pump from Unit 2 through connections that do not have to pass through the turbine building. In the analysis of the above project, it was assumed that a design modification for CRD pump self-cooling would already be implemented. I
3-75 o Economic Performance: Initially, NNECO thought that this project would have a positive impact on CRD availability in the event that the normal CRD pump cooling source was failed. However, the normal cooling source for the CRD pumps 0.e., service water)is also used to cool the feedwater pumps via turbine secondary closed cooling water. Consequently, a loss of the normal cooling source implies that feedwater will be unavailable. CRD self-cooling would not help the feedwater pumps. Thus, no positive gain would be made in this category. o Personnel Productivity: This proposed action would have no effect on personnel productivity. The change to the CRD pumps would n. !nly involve piping and therefore would not significantly change the workload of the plant staff. 4 c .I 1
3-76 ISAP Topic No.1.16.3 - Appendix R. Alternative Cooling for Shutdown Coolin O Reference 46 Proposed Action ' This topic resulted from the review of proposed exemption requests and modifications submitted for Millstone Unit No. I to comply with 10CFR50.48 and Appendix R. This topic addresses a proposed project to modify portions of the shutdown cooling (SDC) system to allow the plant to be cooled to cold shutdown conditions without the use of normal service water. This would entall modifying the reactor building closed cooling water (RBCCW) connections on the SDC pumps and heat exchangers to accept fire hoses. The fire protection system would provide an alternate means of supplying cooling water. Evaluation o Public Safety: In Reference 46, NNECO provided the NRC with a review of the proposed modification and its applicability towards bringing the plant into compliance with 10CFR50.48 and Appendix R. Within the framework of the ISAP, NNECO further analyzed the public safety impact of this modification by performing a sensitivity study on the Mllistone Unit No.1 PSS fire analysis. NNECO concluded that this topic would provide only minimal public safety benefit.
3-77 Following the station blackout condition assumed by Appendix R, only the IC is initially available to remove decay heat. If the IC or its make-up system were to fail, then a core melt would occur regardless of SDC cooling restoration at some later time. With the IC and its make-up system operating, there is no need for SDC. The plant can remain on the IC indefinitely without the need for additional cooling systems. In the fire analysis, there is one scenario where the IC and the cooling source for SDC both fail due to a reactor building zone R-19 fire. The proposed modification would allow restoration of SDC by using the fire protec, tion system. Although feedwater and the main condenser are both available, SDC restoration offers some additional credit for long-term cooling concerns. Therefore, providing SDC with an alternate cooling source provides a very slight benefit in this scenario. In conclusion, NNECO calculated that providing SDC with an alternate cooling source reduces the core melt frequency due to reactor building fire , by 1.87 x 10-8/ year. o Personnel Safety: This project would have no effect on occupational exposure or industrial safety. Therefore, there is no personnel safety
- impact.
o Economic Performance: SDC modifications are designed to a!!ow the operation of the system af ter a loss of service water due to fire. The modifications have no potential impact on plant availability because the SDC system is used only during refueling or prolonged outages.
3-78 o Personnel Productivity: This modification would not impact personnel ) productivity. The addition of several manual valves would not significantly increase maintenance on a per-cycle basis, because the valves should
; seldom be operated.
i 3 i r e ) i 1 I !~ l l l 1 l 1 1 I
i 1 3-79 '
./ ISAP Topic No.1.16.4 - Appendix R. Power Cold Shutdown Eaulpment ,
l Reference 46 i Proposed Action This topic resulted from the review of proposed exemption requests and modifications submitted for Millstone Unit No. I to comply with 10CFR50.48 and 4 Appendix R. This topic encompasses proposed modifications to protect the j three drywell penetrations in the SDC pump cubicle that contain power and control cables to: a) the SDC isolation valve (1-SD-1),(7) and b) the primary containment inner isolation condenser steam valve (1-IC-1) and the primary containment inner isolation condenser condensate return valve (1-IC-4). Repair
- procedures would also be developed to provide a source of emergency power to
, SDC equipment and the IC valves af ter a reactor building fire. It should be noted that these proposed modifications are no longer necessary because the SDC pump cubicle is a separate fire zone from the remainder of the i
- reactor building. Repair materials and procedures are still required to provide a i
i source of emergency power from the turbine building to the SDC equipment and l
- IC valves in the SDC pump cubicle af ter a reactor building fire, i
l (7)This modification (item a)is related to ISAP Topic No.1.16.3. !O ll 'i!
I 3-80 Evaluation 4 o Public Safety: In Reference 46, NNECO provided the NRC with a review of the proposed modifications and their applicability towards bringing the plant into compliance with 10CFR50.48 and Appendix R. Within the framework of ISAP, NNECO has further analyzed these modifications based on sensitivity studies using the fire analysis from the MlIlstone Unit No.1 PSS. The proposed modification for SDC (item a) is related to ISAP Topic No.1.16.3 and was assessed in that context. Specifically, providing power to SDC components completes the modifications that are required to i restore SDC for Appendix R concerns. All SDC modifications address the f same safety issue. ( NNECO concluded that the proposed modification for IC (item b) would independently provide no public safety benefit. The modification for the IC is being proposed so that IC operability can be estored, following a serious reactor building fire. Because a fire in the reactor building does not affect feedwater operability, this system will be used to initially remove decay heat until the IC can be restored. Feedwater would be unaffected by the fire and could continue to run for approximately 6 hours until the hotwell inventory is depleted. No hotwell make-up is assumed because the emergency condensate transfer pump is failed by the fire. If the IC could be restored within 6 hours, as a result of the proposed modifications, core melt could be ' averted. Assuming the modifications allow IC restoration within 6 hours, there would thus be a very small
. _ _ _ . ~ _
4 3-81 ( ( reduction in public risk (8.29 x 10-8/ year). If the modifications do not allow IC restoration in 6 hours, there would be no impact on public risk. o Personnel Safety: These modifications would have no effect on occupational exposure or industrial safety. Therefore, there would be no personnel safety impact. o Economic Performance: This project has no poteatlal impact on plant availability. The SDC is not required during normal plant operation and the , power cables do not have to be permanently in place. The modifications 4 can be completed during non-outage-related activities. Similarly, fire protection of the power cables for the IC is passive in nature. The work can be accomplished outside of the outage and the IC would not have to be taken out of service to perform the work. o Personnel Productivity: These modifications would not impact personnel productivity. The proposal involves changes in the power source for shutdown equipment among existing power sources. Thus, there would be little effect on the workload of plant personnel. O
3-82 n ISAP Topic No. l.16.5 - Appendix R. Curbs. Ramos and Seals () Reference 46,47 Proposed Action 15AP Top.c No.1.16.5 resulted from NNECO's revalidation of modifications necessary to comply with 10CFR50.48 and Appendix R. This project specifically addresses three modifications to bring the plant into compilance with Appendix R. These are
- a. C' lose openings in a 4' x 4' floor hatch to prevent the spread of fire betweea the switchgear area and a resin room located on the floor below,
- b. Install IM hour. rated fire doors between the turbine building and personnel access routes.
- c. Shield and protect the gas turbine generator power / control cables from a postulated auxillary boiler fire.
The first and third items involve the protection of safety-related equipment against a spreading fire. The second item protects a personnel access route from an adjacent turbine building and does not concern safety-related equipment.
~
3-83 l Evaluation o Public Safety: The first modification would have no impact on public risk because it is not credible for fires to spread from the resin room to the switchgear area. No combustibles are present in the resin room and the area is enclosed. As a result, sealing the openings on the hatch between the switchgear area and the resin room would afford no additional risk reduction. The second modification is strictly related to the safety of plant personnel during evacuation from fire. Consequently, there would be no impact on public risk. The third modification, shielding the gas turbine generator cables, has the potential to reduce public risk by preventing the loss of gas turbine generator power / control cables, following an auxillary boiler fire. The calculated reduction in public risk, however, is very slight (9.6 x 10-9/ year). In addition, this modification is no longer required because emergency power will be available through the backfeed power cables from Millstone Unit No. 2 (see 15AP Topic No.1.16.1). o Personnel Safety: Installation of curbs, ramps and fire door seals would reduce the spread of a fire if one were to occur. These additions would increase the overall fire protection to the employee and therefore have a positive effect on personnel safety. O
'I 3-84 .
i o Economic Performance: The only one of the three proposed modifications i with potential to impact plant availability is the third item, shielding the gas turbine generator cabling from the effects of an auxillary boiler fire. 1 To assess this potential impact, NNECO first determined that the Unit
! i ; No. I auxiliary boller is only required to operate when Mllistone Unit No. 2 I is off-line. The frequency of an unlikely auxillary boiler fire during the i portion of time that Unit No. 2 is off-line would be small. In addition, the fire must cause the loss of turbine power cables and also require restoration time in excess of technical specification limits to impact plant availability. Because of the total low probability of this sequence of 4 ; events, the potential impact of the proposed modifications on economic 1
- performance is considered to be negligible.
4 o Personnel Productivity: These three modifications are passive in nature ] and thus would not impact personnel productivity. 4 k i j f
----.m-n----,-,--,---,,,-,,------=----,--n --
,..,n-,,,_,,,-,,,,-,wn,,._,,,a-- - - - - - - - ,
3-85 () Q ISAP Topic No. l.16.6 - Appendix R. Water Curtains / Steel Enclosures Reference 46,47 Proposed Action ISAP Topic No.1.16.6 resulted from NNECO's revalidation of modifications necessary to comply with 10CFR50.48 and Appendix R. This project specifically addresses eight plant modifications to bring the plant into compliance with Appendix R. These modifications include installation of a water curtain to prevent a turbine building oil fire from spreading to the switchgear area, the ( Q sealing of certain openings, certification of the battery room fire door, protecting the turbine building steel floor supports from fire, protecting structural steel in the mezzanine area by spraying fire rated coatings, and installation of Scott air packs near the reactor building air-lock and in the area near certain instrument racks.(8) Evaluation o Public Safety: Except for one, all of the proposed modifications involve controlling the spread of fire into safety-related areas or preventing (8) Since the scope of this ISAP topic was defined, several aspects of this O U project have been deleted as unnecessary to meet the Appendix R scenarios. These modifications are the water curtain, protecting the turbine building floor supports, and protecting the structural steel in the mezzanine area.
1 3-86 l structural damage in safety-related areas. Installation of the Scott air packs is the exception. It would provide breathing air for plant personnel during fire conditions. installation of a water curtain was assessed to represent no reduction in public risk due to a turbine building oil fire spreading to the switchgear area. This is because the switchgear area is adequately separated from the turbine building by a reinforced concrete wall. Protection of the turbine building steel floor support and structural steel in the mezzanine also would produce no public safety benefit. The fire analysis in the Millstone Unit No.1 PSS assumes that a fire of sufficient j magnitude to cause structural damage will result in a core melt. O The proposed modifications that involve sealing of openings and the certification of a fire door also would not reduce core melt frequency due to fire. The probability of an unmitigated fire breaching into one fire zone
- from another adjacent zone is several orders of magnitude less than the initiating frequency of fire in the zone itself.
The addition of Scott air packs outside certain fire areas was assessed to i have a positive effect on operator error. Consequently, this modification has the potential to reduce core melt. However, NNECO subjectively determined the reduction to be small. o Personnel Safety: These proposed modifications would potentially reduce the spread of fire. Therefore, they would increase the fire protection to , the employee and have a positive effect on personnel safety.
-m m- - -,-- - - -wa--- . - e. yn- - , .-- p---- -- y , - -- -- --- - , , . -------..wy4- -a----- -,i-----e..
3-87 o Economic Performance: The only proposed modification with a potential impact on plant availability is the installation of the water curtain. The water curtain is to be installed in close proximity to the feedwater regulating valve (FRV), and inadvertent actuation of the water spray could cause problems with the FRV and trip the plant. However, upon analysis, NNECO determined that the water curtain would have no effect on plant operations. The FRV controls are enclosed in a water-tight heavy steel enclosure, originally intended to protect employees from an FRV rupture. o Personnel Productivity: These modifications would decrease personnel productivity. New fire systems such as the water curtain would require additional maintenance, testing, and surveillance. O O
3-88 ISAP Topic No.1.16.7 - Appendix R. Cable Vault Halon Suppression System
)
i Reference 46,47 Proposed Action ISAP Topic No.1.16.7 resulted from NNECO's revalidation of modifications necessary to comply with I'0CFR50.48 and Appendix R. Specifically, under this topic, in order to bring the plant into compliance with Appendix R requirements, an automatic fire suppression system will be installed in the cable vault. T he system will automatically discharge Halon gas upon indications of fire from installed smoke detectors. A serious cable vault fire could induce plant transients and cause a loss of Emergency Core Cooling System (ECCS) equipment control. Evaluation I o Public Safety: NNECO analyzed the public safety benefit of this modification by performing sensitivity studies on the fire analysis of the Millstone Unit No.1 PSS. NNECO concluded that this action would have a positive public safety benefit. Currently, the cable vault has no automatic fire suppression system. Installation of a Halon discharge system means that a fire can be suppressed early without requiring personnel to enter the area. The system l f
3-89 will be designed so that remote manual actuation is also possible. This will significantly reduce public risk. NNECO calculated a reduction in core j melt frequency due to cable vault fires of 1.42 x 10-5/ year. o Personnel Safety: Addition of an automatic Halon suppression system will reduce the spread of fire, if a fire were to occur. Therefore, it will increase protection to the employee and have a positive effect on i personnel safety. o Economic Performance: This project is considered to have no impact on plant availability. o Personnel Prodectivity: This modification will decrease personnel
; productivity. A Halon suppression system will require periodic maintenance, testing and surveillance, thereby increasing the workload of operations, instrumentation and control, and maintenance personnel.
1 i i O
3-90 ISAP Topic No.1.16.8 - Appendix R, Control Room Halon Suppression System Reference 46,47 Proposed Action ISAP Topic No.1.16.8 resulted from NNECO's revalidation of modifications necessary to comply with 10CFR50.48 and Appendix R. This project involves the installation of an automatic Halon suppression system in the main control room. The system will automatically discharge Halon gas upon indications of fire from installed smoke detectors. Smoke detection will consist of both lonization and photo-electric type smoke detectors. The proposed modification will replace the existing fire protection devices and will lower the chance of a spreading / damaging control room fire. Evaluation o Public Safety: NNECO analyzed the public safety benefit of this proposed action by performing sensitivity studies on the fire analysis of the Millstone Unit No.1 PSS. NNECO concluded that this action would have a positive public safety benefit. Because the Halon system can be actuated both automatically and manually, credit was given to both means in the event tree for control room fires. The Halon system is most effective for early suppression of fires that result in minimal damage. This will result in a reduction in
3-91 public risk. NNECO calculated a reduction in core melt frequency due to control room fire of 7.38 x 10-6/ year. o Personnel Safety: Addition of this automatic Halon suppression system would slightly reduce the spread of fire,if a fire were to occur. T!.erefore, it would increase protection to the employee and have a positive effect on personnel safety. Halon concentrations must be maintained at appropriate levels to prevent danger to control room personnel, o Economic Performance: This project is considered to have no impact on economic performance, o Personnel Productivity: This modification will decrease personnel productivity. A Halon suppression system will require periodic maintenance, testing and surveillance, thereby increasing the workload of operations, instrumentation and control, and maintenance personnel. O
3-92 ISAP Topic No.1.16.9 - Appendix R, Fire Barriers Reference l l 46,47 ! l Proposed Action
~
ISAP Topic No.1.16.9 r2sulted from NNECO's reassessment of modifications necessary to bring the plant into compliance with Appendix R. This project involves installation of certified fire-rated dampers between cable vault and computer room areas, between the switchgear area and other adjacent areas, between the turbine building and office spaces, and between the battery rooms. The proposed project will involve either providing certification for existing dampers or replacing them with dampers that are certified. All dampers are related to preventing the spread of fire into areas that contain safety-related equipment. Evaluation o Public Safety: None of the proposed modifications would result in a significant reduction in public risk as the result of a fire. In order for a fire to spread from one area (A) into another area containing safety-related equipment (B), four events must occur in sequence. First, a fire must occur in Area A. Second, fire protection devices must fail in Area A. Third, the fire must propagate to dampers between Areas A and B. Fourth, the fire must breach the existing dampers and spread to Area B. The
3-93 probability of these four events occurring is at least several orders of magnitude less than the probability that the fire occurs in Area B originally. Therefore, certifying or replacing the existing dampers would not significantly reduce the probability of core melt due to fire. I o Personnel Safety: Certified dampers would conceivably reduce slightly the spread of fire, if a fire were to occur. Therefore, this project would slightly increase protection to the employee and have a positive effect on personnel safety. o Economic Performance: Fire barriers are passive in nature. These modifications therefore would have no impact on plant operations or plant availability. o Personnel Productivity: Fire dampers installed at various locations throughout the plant would require some periodic inspections and testing. However, the effort is considered to be inconsequential. O O
3-94 ISAP Topic 1.16.10 - Appendix R MSIV/ ADS Circuit Protection l ' Reference f 46,47 Proposed Action ISAP Topic No. 1.16.10 resulted from NNECO's rereview of modifications necessary to ccmply with 10CFR50.48 and Appendix R. This project is designed to protect main steam isolation valve (MSIV) and safety / relief valve (SRV) circuits from control room fire as part of Appendix R compliance. Both circuits will be protected against hot shorts which could cause spurious valve opening. Both modifications will prevent a loss of reactor vessel inventory, following a postulated control room fire that causes a loss of all equipment control. For a control room fire, Appendix R assumes that the safest plant configuration is to have the reactor vessel totally isolated with the IC in service. This project has recently been refined to add a modification to protect the circuit for the pressure control valve (1-CU-10) for the reactor water clean-up system. This modification has not yet been evaluated under this ISAP topic. Evaluation l l o Public Safety: Based on the Millstone Unit No. I fire analysis, NNECO concludes that protecting the MSIVs from opening would have no impact on O core melt frequency. The probability of the combination of MSIV hot l l
3-95 l A shorts necessary to unisolate the reactor vessel (i.e., both the inboard and
-U outboard MSIVs would have to short open)is low. In addition, MSIV opening would allow the main condenser to be used for decay heat removal. The fire analysis showed that catastrophic failure of the MSIVs and loss of
- feedwater/ main condenser is not likely. Hence, this modification would i
have no impact on public risk. i NNECO concludes that protecting the SRV circuits would provide a small
- reduction in core melt frequency. The fire analysis considered stuck open SRVs due to fire-induced hot shorts as contributing to core melt. However, credit was given for operator recovery to de-energize the shorts when time permitted. Consequently, the proposed modification for hot short
, protection in the SRVs offers only a small improvement in public risk. A sensitivity study using the fire analysis showed a core melt reduction of 3.9 x 10-8/ year. A more likely contributor to core melt is failure of the SRV remote I opening function due to fire. There are scenarios where such failures cause a total loss of ECCS equipment, even though low pressure pumps are available. If the project scope were redefined to provide an isolable SRV remote opening panel, this project would provide a significantly greater benefit than the proposed SRV modification. NNECO's analysis showed that core melt frequency would be reduced by 8.0 x 10-6/ year. This I alternative project, however, is not required by Appendix R. I o Personnel Safety: Protection of MSIV and SRV circuits would have no impact on occupational exposure or industrial safety.
3-96 m o Economic Performance: NNECO examined this' modification to determine whether installation of the contemplated quick disconnect device to provide protection of.the circuits could cause inadvertent SRV operation. Inadvertent SRV operation would force the plant to shut down. NNECO concluded that the disconnect device will prevent operation of the circuits that control valve opening. Thus, spurious SRV operation could not occur due to installation of the device. The modification therefore would have no effect on economic performance. o Personnel Productivity: The proposed changes are mainly electrical in nature and therefore do not affect the workload of station personnel. There would be no impact in this category.
. O lO t
i l
3-97 ISAP Topic No.1.16.11 - Appendix R. Hydrogen System Modifications O Reference 46,47 l Proposed Action ISAP Topic No. 1.16.11 resulted from NNECO's rereview of modifications i necessary to bring the plant into compliance with Appendix R. This project involves modifying the main generator hydrogen cooling system by installing an excess flow check valve. The excess flow check valve is designed to limit the release of hydrogen to the turbine building in the event of a line break. Without such a device, there is a concern that a hydrogen release could cause a turbine building fire, possibly inducing an accident. Evaluation o Public Safety: This project would provide very little public safety benefit. First, an excess flow check valve on the hydrogen supply line will not prevent the release of hydrogen from the skid unit, which is downstream. Given the quantity of hydrogen gas in the skid unit (3,125 cubic feet), a break anywhere in that unit poses the same risk as a line break without the excess flow check valve. Second, while a small leak might occur, the probability of a hydrogen line break is extremely low. O
3-98 o Personnel Safety: This change would have only an extremely small positive J impact on personnel safety. The excess flow check valve would lower the industrial risk in the unlikely event of hydrogen leaks in the turbine building. Exposure to gases has been a problem throtwhout the industry and several significant injuries have occurred from exposures in Connecticut. o Economic Performance: Installation of the excess flow check valve has a potential negative effect on economic performance. Spurious closing of , this valve would cut off the flow of hydrogen to the generator, resulting in a possible loss of generator cooling. However, this effect should be noticed by plant operators because main generator heat-up would occur generally over a period of several days. Operator action within a reasonable period (approximately 24 hours) could mitigate the potential negative effect of the excess flow valve. o Personnel Productivity: This project would involve some piping modifications but would not appreciably change the work scope of plant maintenante personnel. O
3-99 m ISAP Topic No.1.16.12 - Appendix R. Emergency Lighting Modif! cations v
)
Reference l 46,47 Proposed Action ISAP Topic No.1.16.12 results from NNECO's review of modifications necessary to bring the plant into compliance with Appendix R. This project involves the installation of additional emergency lighting in all fire areas to meet requirements for levels of illumination and length of time that lighting must remain operable. The project would specifically provide eight-hour battery pack lighting in all fire areas with appropriate levels of illumination. Evaluation o Public Safety: If the present emergency lighting were to be upgraded, there is a potential that human errors due to poor lighting could be l reduced. The project could have this type of positive effect not only for l post-fire operations (following a fire that fails normal lighting), but those following a station blackout as well. NNECO evaluated this potential. One area where operator error would be reduced is the manual control station for opening valve IC-3 on the IC. At present, there is no emergency lighting in this area and an operator would have to climb the access ladder while holding a portable light. The calculated reduction in
= 3-100 f core melt frequency for fire and station blackout events was 1.08 x 10-6/ year. Other areas that might benefit from improved lighting are the switchgear area, control room, and parts of the reactor building. NNECO subjectively [ L concluded that these modifications would have a small positive impact on public safety. o Personnel Safety: Improved emergency lighting would have no effect on L occupational exposure. This modification, however, would result in surveillance and maintenance associated with the upkeep of the battery - packs. This results in a slight increase in industrial risk. e-o Economic Performance: NNECO determined that this modification would have no impact on plant operations or plant availability. o Personnel Productivity: This modification would result in a slight negative _ impact in this category. The project would add emergency lighting equipment throughout the plant. This equipment requires routine ? maintenance and surveillance testing, and thus would increase the work load of maintenance and operations personnel. = I , O 1 m
3-101 ISAP Topic No.1.17 - Replacement of Motor-Operated Valves
%)
References 48, 49, 50,~ 51 Proposed Action 10CFR50.49 requires that the environmental qualification prografn at M111stcae Unit No. I be completed at the end of the second refueling autage following March 31,1983. The NRC Staff granted an extension of the completion date to November 30,1985 for 28 valve motor cperators. These cperators were the only components yet to be qualified to achieve total compliance with 10CFR50.49. Of these 28 valve motor operators,11 vernain to be formally qualified or to be the subject of permanent exemptions from 10CFR50.?9.(9) ISAP Topic No.1.17 encompasses the qualification / exemption of these remaining 11 operators. In References 48, 49, and 50, NNECO provided its evaluation of this topic. In Reference 5,1, NNECO formally requested a permanent exemption for the 11 operators. NNECO considers this topic resolved pending NRC Staff issuance of the permanent exemption requested. (9) On November 20, 1985, the Commission issued a memorandum and order regarding the deadlines for environmental qualification of electric equipment , at Millstone Unit No.1. The memorandum and order addressed the remaining 11 valve motor operators for which NNECO requested a schedular exemption. The Commission approved an extension of the schedule to the next outage of sufficient duration after the Staff has made a determination to whether an O' exemption to 10CFR50.49 can be granted, or to the next refueling outage, but in no case later than August 30,1987. The Staff determination has not 4 yet been provided to NNECO. i l
\
1
3-102 Evaluation o Public Safety: NNECO's assessment of the public safety benefit of the proposed actions necessary to qualify the 'l remaining valves is provided in i Reference 51. There, NNECO concluded that there is minimal safety benefit and that no further qualification effort is warranted. NNECO also provided a public s~a fety assessment of the ISAP topic in Reference 50. NNECO's analyses are further summarized below. Valves RR-2A and RR-2B are recirculation pump discharge isolation valves. The purpose of these valves is to prevent spillage of the LPCI flow following a break in the recirculation piping. This is achieved by closing the valve in the intact loop as a part of LPCI loop selection logic. If the n valve in the loop selected for LPCI injection fails to close, LPCI flow could flow through the recirculation pump and out through the break, thus bypassing the core. It is estimated that flow bypass of the core is a concern only for breaks greater than 0.01 ft.2 in area. For sma'ler breaks, however, the water level can be recovered even in presence of spillage of LPCI flow through the break. The qualification effort for valves 1-RR-2A, 2B requires replacement of the motor operators, which would ensure that the valves are capable of closing in the harsh environment following a break in the recirculation i piping. The benefit in core melt frequency can be calculated by assuming that without the valve qualification, they will not close, causing LPCI flow to spill. This calculation results in only a slight reduction in core melt frequency,1.5 x 10-6/ year.
3-103 Valve 1-IC-2 is located in the reactor building on the inlet side piping of the IC system. This valve is normally opened and will close in case high steam flow is detected. If the break occurs in the drywell, closum.of 1-IC-2 does not isolate the break. If the break occurs in the reactor building,1-IC-1, which is inside the drywell, will close and thus isolate the break. For this sce.1ario,1-IC-1 will not be exposed to a harsh environment because the valve is located in the drywell and the break is in the reactor building. The only benefit of environmentally qualifying 1-IC-2 is in the scenario where 1-IC-1 also randomly falls. In that case, operation of 1-IC-2 will allow isolation of the break. However, this is an extremely low probability scenario. Replacement of the motor operator to environmentally qualify 1-IC-2 will not significantly reduce risk to the public. The reduction in core melt frequency is calculated to be 2.0 x 10-9/ year. O Vaive 1-IC-4 is located inside the drywell. This valve is normally open and will close if a high steam flow in IC piping caused by a break is detected. For a break in the IC piping inside the drywell, closure of 1-IC-4 will not isolate the break. If the break occurs outside the drywell,1-IC-3 is normally closed and will remain closed; the closure of 1-IC-4 is not needed to isolate the break on the return side of IC piping. Therefore, replacement of the valve 1-IC-4 operator would provide no benefit in terms of the core melt frequency or public risk. Valves 1-LP-15A, B and 1-LP-16A, B are normally closed containment spray valves in the reactor building. For a break in the reactor building, these valves may be exposed to a harsh environment. However, because the break is outside of the primary containment, there is no reason for
l l 3-104
- p. operation of drywell sprays to depressurize the primary containment.
These valves would not be used. i l For a break inside the drywell, the motor operators for the above valves would generally not be exposed to a harsh environment because they are located outside containment. The valve operators could only be exposed to high radiation if gross fuel failure occurs. However, if the LPCI system is operating,'such fuel failure can not occur. If the LPCI pumps have failed, operation of drywell spray valves becomes irrelevant since the LPCI pumps also supply the drywell spray flow. Therefore, qualifying valves 1-LP-15A, B and 1-LP-16A, B would result in no reduction in core melt frequency or public risk. Valves CU-2 and CU-3 are isolation valves for the reactor water clean-up (RWCU) system. These valves are normally open and located in series in the RWCU piping. These valves get a signal to close upon high flow in the RWCU piping or upon low reactor water level. The principal cause of high flow would be due to a break in the RWCU piping. Thus, the only potential benefit in qualifying these valves would be to isolate a break in the RWCU piping outside of the drywell. If a break occurs inside the drywell, closing of CU-2 or CU-3 will have no impact on break isolation. Additionally, CU-3 is located outside the drywell and would not be exposed to a harsh environment, and would be able to provide the containment isolation function. If the break occurs outside the drywell, CU-2 will not be exposed to the harsh environment and will isolate the break. The only benefit in environmentally qualifying CU-3
3-105
, is in' the scenario with a break in the RWCU piping outside of containment and a random failure of CU-2 to close. In that case, closure of CU-3 would
, allow for Isolation of the break. In Reference 50, the Staff was provided with the results of a probabilistic evaluation of this scenario. This is a low probability scenario and the calculated change in core melt frequency due to qualification of CU-3 was determined to be small (2.5 x 10-7/ year). i There is no projected change in core melt frequency due to qualification of C U-2. ' Valve 1-MW-96A is located on the discharge side of the emergency condensate transfer pump, which allows transfer of inventory from the condensate storage tank to the hotwell following initiation of the FWCI system. Valve MW-96A lacks qualification documentation for aging and for n ' , radiation exposure. MW-96A is located in the vicinity of the reactor building equipment drain tank (RBEDT) which could become radioactive only in the very unlikely event of an accident which results in fuel damage. f Since this valve would not be located in a harsh steam or temperature environment, the qualification effort consists of adding shielding between the valve and the RBEDT. Aging concerns are addressed through routine mamtenance and testing. ; For any transient or LOCA at Millstone Unit No.1, no fuel damage is expected to occur if either feedwater or FWCI operates successfully; fuel l damage can occur only if this system has failed or is ineffective. Thus, the RBEDT could become radioactive only if the FWCI system has failed or is
'neffective. The additional shielding would ensure operability of MW-96A 1
i only for scenarios in which it is not required (i.e., FWCI has failed). 1 l a ) ! l 4 l
3-106 (7 MW-96A has no other safety function. Therefore, adding a radiation shield for MW-96A to meet radiation qualification requirements would result in no safety benefit. o Personnel Safety: Personnel safety would not be impacted by this modification. The proposed action would require that operators be replaced to meet environmental qualification requirements. Replacement of these operators would not alter any plant activities, change any occupational exposures, or otherwise impact industrial risk. However, there would be an exposure of approximately 165 Man-Rem in order to qualify all of these valves. o Economic Performance: Implementation of the proposed modifications to ( qualify the 11 remaining valve meter operators would not impact plant ( availability or economic performance. o Personnel Productivity: The proposed project would replace existing valve operators with environmentally qualified operators. The maintenance of I the new valves would be similar to that of existing valves. Therefore, there would be no effect on personnel productivity. 1 O 'l
- .m., -.-
3-107 ISAP Topic No.1.18 - ATWS References 22,24,30,52,53,54 Proposed Action 10CFR50.62 was promulgated to require additional protection against an anticipated transier)t without scram (ATWS). 10CFR50.62 specified 3 separate requirements that are applicable to BWRs such as Millstone Unit No. I. Each BWR must have:
- a. an alternate rod insertion system which is diverse from the reactor protection system to provide an alternate path for actuating the scram pilot valves; 1
l b. a recirculation pump trip to automatically trip the recirculation pumps; and i l i
- c. a standby liquid control system (SLCS) with a minimum flow capacity and boron content equivalent to 86 gpm of 13 weight percent sodium
- pentaborate solution.
As noted in Reference 24, Millstone Unit No.1 is currently in compliance with the requirements of 10CFR50.62 concerning alternate rod insertion and
\
recirculation pump trip systems. Millstone Unit No.1 is equipped with an SLCS, but its capacity does not meet the requirements of 50.62. ISAP Topic No.1.18 i l _. .m . _ . . . . _ - - _ . _
3-108 7 therefore considers the impact of utilizing an equivalent 86 gpm flow rate and (O 13 weight percent sodium pentaborate solution in the Millstone Unit No. I SLCS. In Reference 30, NNECO provided the NRC Staff with a probabilistic risk-oriented evaluation of the proposed modification. In this evaluation NNECO conclude'd th'at upgrading the SLCS to an 86 gpm and 13 weight percent sodium pentaborate solution equivalent SLCS would yield only a slight decrease in core melt frequency at Millstone Unit No.1. In addition, in Reference 22, the NRC contractor also concluded that the benefit of -upgrading the SLCS system is minimal and that the topic is a candidate to be dropped. In Reference 52, the NRC requested NNECO to: [ a. provide a date when Millstone Unit No. I would be brought into compliance with 10CFR50.62, or;
- b. provide a request for an exemption from the schedular requirements of 10CFR 50.62, or;
- c. provide the date by which a request for a permanent exemption to 10CFR50.62 will be submitted to the NRC.
In Reference 53, NNECO notified the Staff of its intention to request a permanent exemption from 10CFR50.62 for Millstone Unit No.1. NNECO's evaluation of this issue is currently ongoing. The current status of this evaluation was provided in Reference 5fs.
3-109 (] NNECO continues to believe that the existing SLCS, in conjunction with V emergency operating procedures and other plant features, are adequate to ensure
- public health and safety in the event of an ATWS. However, NNECO's analysis is not yet complete and NNECO is therefore not prepared to formalize an exemption request. In addition, the high cost of a plant-specific ATWS analysis for Millstone Unit No. I has resulted in NNECO reevaluating all available options
^ to resolve this issue, including upgrading the SLCS to conform with the rule. As noted in Reference 54, NNECO will be providing the Staff with additional information in conjunction with this topic by the end of August 1986. This will include either a scope and schedule for any necessary modifications to upgrade the SLCS or a permanent exemption request. Evaluation O o Public Safety: NNECO's preliminary probabilistic risk evaluation of this issue, Reference 30, concluded that the proposed modification to achieve regulatory compliance would yield a small public safety benefit. A further deterministic evaluation is provided in Reference 54. NNECO concluded i that an SLCS upgrade would represent an improvement in safety and additional assurance that Millstone Unit No. I can adequately respond to an ATWS event. The options for achieving compliance considered by NNECO were:
- a. Increase the flow rate to 86 gpm by providing the capability for
. two SLC pump operation. 'O
3-110 f b. Increase the concentration of sodium pentaborate to achieve the equivalent of 86 gpm at 13 weight percent.
- c. Use enriched boron (B10) in the sodium pentaborate solution to achieve the equivalent of 86 gpm at 13 weight percent.
l l l All three options would reduce by 50% the time it takes to inject the required amount of sodium pentaborate and achieve hot shutdown. The j proposed system,like the current one, would be manually initiated. In the probabilistic review, Reference 30, the public safety benefit of these options was evaluated in two areas. First, if the operator follows emergency procedures, the peak torus temperature will be lower with an 86 gpm equivalent SLCS. Analyses performed for the Browns Ferry Nuclear Plant show that increasing the SLCS flow rate from 50 to 86 gpm reduces peak torus temperature from 1950F to 1730F. If analyzed, Millstone Unit No. I would show a similar reduction in the peak torus temperature. The public safety benefits of this effect, however, cannot be quantified using probabilistic techniques. !l Second, with an 86 gpm SLCS, an ATWS event would possibly be more manageable through operator actions. With the increased time available, not all operator errors would result in severe core damage. Existing emergency procedures direct the operator to lower the RPV level when the torus heats up to 1100F to reduce the core power and thus heat load to the , torus. With the existing system (43 gpm SLCS), this step is necessary to O prevent containment over-pressure (and possible failure) caused by torus i boiling. With an 86 gpm SLCS, because the time needed to inject the l
3-111 required amount of boron is reduced by one half, such an operator action, although highly desirable, may not be required to ensure containment integrity. Therefore, the benefit of 86 gpm SLCS can be determined by eliminating those core melt sequences associated with this operator action. NNECO calculated a decrease in core melt frequency (6 x 10-6/ year, a 0.75% decrease) and the consequent public safety benefit. o Personnel Safety: The proposed action would have no effect on personnel safety. Addition of a second SLCS pump would require some electrical and mechanical changes. However, these changes would not significantly alter plant activities. o Economic Performance: NNECO evaluated the impact in this category of all three design alternatives. Among the three alternatives considered, the increased boron enrichment is the only one that would have no quantifiable impact on economic performance parameters. This alternative would maintain the current one pump operation and existing boron solution concentration. Two pump operation of SLCS and increased boron concentration would ne'gligibly decrease economic performance. These alternatives would likely result in more stringent technical specifications, increasing the probability of limiting conditions on operation forcing a plant shutdown.(10) o Personnel Productivity: The proposed modification would have minimal or no impact on personnel productivity. l (10) For ranking purposes, NNECO selected the option of increasing boron enrichment to satisfy the equivalency criterion. Therefore, implementation impact on plant availability is zero.
3-112 (3 ISAP Topic No.1.19 - Integrated Structural Analysis b-References 13,26,28,55 Proposed Action In February 1983, the NRC issued the IPSAR documenting the Millstone Unit No.1 SEP review. The IPSAR identified a number of open issues resulting from reviews of the following SEP topics, including:
- a. SEP Topic II-3.B, Flooding Potential and Protection Requirements O
- b. SEP Topic II-4.F, Settlement of Foundations and Buried Equipment
- c. SEP Topic III-2, Wind and Tornado Loadings
- d. SEP Topic III-3.A, Effects of High Water Level on Structures
- e. SEP Topic III-6, Seismic Design Considerations
- f. SEP Topic III-7.B, Design Codes, Design Criteria and Load
- Combinatior.,
, NNECO addressed these structural topics in an Integrated Structural Analysis Program and provided the results to the- NRC Staff. Subsequently, all open
3-113 issues related to these topics were identified to be within the scope of ISAP Topic No.1.19. In References 26,28, and 55, NNECO provided the NRC Staff with the status of j the remaining structural issues identified as open, and additional information to l l resolve those issues. As stated by the Staff in Reference 13, this information is l currently under Staff review. Based on the information provided in Reference 26 and the additional information provided in References 55 and 28, and in several telephone conversations, NNECO believes that the pending NRC resolution of the remaining structural issues identified in the IPSAR concludes the Integrated Structural Analysis Program for Millstone Unit No.1. Because this issue will be resolved, there are no further significant resources or plant modifications proposed. This ISAP topic presents no potential public , safety, personnel safety, economic performance, or personnel productivity impacts. l O
3-114 ISAP Topic No.1.20 - MOV Interlocks O References 13,24,56 . l l Proposed Action ISAP Topic No.1.20 concerns thermal overload protection for motors of motor-operated valves. The topic results from Topic III-10.A of the Millstone Unit No. I SEP review. The thermal overload devices for motor-operated valves were reviewed against the criteria of GDC 13, 21, 22, 23, and 29, as implemented by IEEE Standard 279-l971, with regard to their trip settings and size. O l In Reference 24, NNECO transmitted to the NRC Staff its evaluation of this topic. In Reference 56, the NRC Staff issued a final safety evaluation of NNECO's resolution of this topic and concluded that the issue was satisfactorily i resolved. The Staff reiterated that conclusion in Reference 13, ' resolving this l ISAP topic. l Based on the above, NNECO concludes that no further effort on this topic is warranted. i O
3-115 ISAP Topic No.1.21 - Fault Transfers References 13,22,49,57,58 i Proposed Action I i SEP Topic VI-7.C.1, " Independence of Redundant On-31te Power Systems," included a review of the AC and DC power systems at Millstone Unit No.1. The safety objective of this SEP topic was to ensure that the on-site electrical power supplies and the on-site distribution systems have sufficient independence to t perform their safety functions assuming a single failure. As documented in the IPSAR Supplement, all issues raised in the SEP review were resolved by NNECO and the Staff, except for the design of seven automatic bus transfer (ABT) devices and the possible need for interlocks on three load centers that are manually transferred between redundant sources. ISAP Topic No. 1.21 l encompasses the review of these remaining issues. i In References 57 and 58, NNECO provided the NRC Staff with an evaluation of this issue. The evaluation is summarized below. NNECO concluded that the remaining proposed modifications would result in either no significant impact on i public risk or an actual slight increase in pub!!c risk. The NRC contractor's review of this issue (Reference 22) also noted that while the removal of the ABTs would result in the elimination of any possibility of transferring faults from one electrical power source to another, the benefit would be offset by a reduction in the reliability of the LPCI system in both the injection and long-term cooling mode.
3-116 A In Reference 13, the NRC Staff concluded that it is currently reviewing ! NNECO's submittals on this issue. Pending completion of the Staff's review, NNECO considers the proposed modiilcations unwarranted and the ISAP topic resolved. Evaluation o Public Safety: The current Millstone Unit No. I design utilizes ABT switches to assure that certain vital electrical loads receive power from redundant sources. Because of this design, concerns have been raised that the parallel operation of redundant power sources could result in their common mode failure under faulted modes of operation. If a fault were
- present on any of the loads which are connected to one source of power and this results in a l'ow voltage condition, the ABT could potentially transfer the same fault to the redundant power source. Such a transfer could cause the failure of both sources due to the subsequent protective breaker '
isolation function. A worst case could occur when each of the redundant supply buses is powered separately by one of the two sources of site emergency power (e.g., gas turbine or diesel generator). At Millstone Unit No. I there are 7 ABTs which fall into this category. The proposed modification would disarm those ABTs. 1 Of the 7 ABTs at issue, one is presently disarmed and is not available to i automatically transfer the loads of one load group to the power source of another. Therefore, this ABT is no longer at issue. DC Motor Control Centers DC-IIA-1, 2 and 3 are each provided with manual transfer i switches which are administratively controlled. The feeder breaker from
3-117 the alternate DC source to the transfer switch is kept open (de-energized). N Therefore, the need for interlocks on these three load centers is no longer an issue. The 6 remaining ABTs were also evaluated. NNECO concluded that disarming or removal of these 6 ABTs was not practical due to the safety function of the devices. Reference 58 provided the NRC Staff with a probabilistic risk-oriented evaluation which showed either no significant impact on public risk or an actual slight increase in public risk if the 6 ABTs were disarmed. Specifically, if the ABTs on the Vital and Instrument AC switchboards are disarmed, there is a minor reduction in reliability and no significant improvement toward avoiding the loss of multiple electrical buses. If the ABTs on the LPCI motor-operated valve power supplies are disarmed, without providing some equivalent means of assuring LPCI injection, public risk slightly increases (core melt frequency is increased by 0.4%). o Personnel Safety: This project would have no effect on personnel safety. Any changes made as a result of the SEP-Identified concerns would be
- electrical changes and wot4 it.t impact plant activities. Thus, neither occupational exposure cio ;.'du > ial risk would be changed.
i o Economic Performance: NNECO quantitatively estimated the impact of the fault transfer issue on plant performance by comparing the current
, plant configuration (i.e., the six ABTs armed) against a plant configuration with the six ABTs disarmed. Based on this analysis, NNECO concluded that there would be only a negligible averted plant downtime resulting from the change.
- . o
N 3-118 o Personnel Productivity: The proposed change would not affect personnel productivity. The changes are electrical and thus should not significantly change physical equipment, or maintenance and testing of that equipment I by plant personnel. l l 1 [ l !O l t-e'p w m --yw w --v-er- erpm-,we--- , ww,,, .c m,-c-.w-ye------------w--w,--m-vm-e,--+-m-we--w -w--,,--evr--wvr- --.mr- - w w e-*--- - - - --------
3-119 ISAP Topic No.1.22 - Electrical Isolation 9 References 13,59 Proposed Action SEP Topic Vll-1.A " Isolation of Reactor Protection System from Nonsafety Systems, Including Qualification of Isolation Devices," and Topic VII-2, "ESF System Control Logic and Design," included a review of electrical isolation provisions at Millstone Unit No. I against the criteria of 10CFR50.55a(h) and IEEE Std. 279-1971. These criteria ensure that safety signals are isolated from nonsafety signals and that no credible failure at the output of an isolation device can prevent the associated protection system channel from meeting the minimum performance requirements. As documented in the IPSAR Supplement, the SEP reviews concluded that the existing plant design met the current licensing criteria, with the following four exceptions:
- a. There are no isolation devices between the nuclear flux monitoring systems and the process recorders and indicating instruments.
- b. Isolation devices are not provided to isolate the average power range monitor (APRM) system from the process computer.
3-120
~) c. The power supplies for the reactor protection system (RPS) channels do (V not qualify as Class IE equipment. Isolation between each RPS channel and its respective power supply is inadequate.
- d. Isolation devices are not provided to isolate the main steam line radiation monitors from nonsafety-related indicators and recorders.
Subsequently, NNECO closed the concerns of RPS power supply isolation and
~
main steam line radiation monitors isolation (items c and d). The scope of ISAP Topic No. ,1.22 now principally covers the first two items. Below, NNECO summarizes its evaluation of modifications necessary to provide the required isolation. In Reference 59, NNECO provided the NRC Staff with the status of all 4 items. NNECO noted that resolution of items c and d was previously provided to and accepted by the NRC, and that NNECO had also previously provided to the Staff a resolution for items a and b. As noted in References 59 and 13, the additional information regarding the two remaining issues (items a and b)is currently under review by the Staff. NNECO concludes that all areas of this topic have been addressed, and pending the NRC's final acceptance of the resolution of items a and b, no further modifications or actions on this ISAP topic are warranted. Evaluation o Public Safety: In response to items a and b, NNECO provided an evaluation in a submittal dated January 31, 1985. This submittal was summarized in Reference 59. NNECO first concluded that the current design is adequate. In addition, NNECO concluded that attempts to provide further isolation
3-121 could potentially be counterproductive because wiring changes would w greatly increase system complexity, and a greater number of connections and terminations could increase the potential for hot shorts. NNECO performed a probabilistic analysis to quantify the increase in core melt frequency associated with hot shorts, if no isolation devices are placed between the safety-related and nonsafety-related equipment. First, this analysis demonstrated that the change in core melt frequency due to hot shorts in the positive direction is slight (1.06 x 10-8/ year) for both the i nuclear flux monitoring system and the main steam line radiation monitoring system. Second, a hot short in the negative direction inhibits a signal such as high nuclear flux or high radiation. If a hot short in the I negative direction occurred between the nuclear flux monitoring system and the process recorders and indicating instruments, the reactor would still be able to trip on low-low reactor water level. A hot short in the negative direction in the main steam line radiation monitoring system causes a failure of the MSIVs to close on high radiation on a steam line break outside containment. This, however, would have negligible effect , because of the diversity in automatic signals that will cause the MSIVs to l close (low-low reactor water level, main steam line high flow, main steam line tunnel high temperature, and main steam line low pressure). Thus, l public risk due to hot shorts is insignificant. Isolation between the APRM system and the process computer also does . not impact public safety. Computer failures will not compromise the 1 safety-related inputs because these inputs are isolated by flying capacitors. f Isolation of the RPS is determined to have zero impact because the failure l
, 3-122 of the RPS is totally dominated by common mode mechanical failures. Electrical failures due to inadequate isolation do not contribute significantly to the overall RPS failure probability. o Personnel Safety: Modifications to provide electrical isolation between the nuclear flux monitoring system, process recorders, APRM, and process computer would have no effect on personnel safety. The changes,if made, would be electrical in nature and therefore would have no significant impact on plant activities. Occupational exposures and industrial risks would be unchanged. o Economic Performance: NNECO estimated the impact of modifications to address concerns a and b based on comparison of the current system against a system with no possibility of isolation failure (this assumes a design configuration of perfect isolation devices in the RPS). NNECO determined that the modifications would have a negligibly small impact. This was largely due to the fact that a hot-short event (which the modification would prevent)is already a rare event, o Personnel Productivity: The proposed modifications would not impact personnel productivity. The addition of isolation devices involves electrical changes that do not significantly change any surveillance or maintenance requirements. O
3-123 p ISAP Topic No.1.23 - Grid Separation Procedures ISAP Topic No.1.25 - Degraded Grid Voltage Procedures References
! 60,61,62 Proposed Action ISAP Topic Nos.1.23 and 1.25 address concerns identified under Topics VII-3 and VIII-1.A of the Millstone Unit No.1 SEP review. The SEP review included an evaluation of the plant power supply system against the criteria of GDC 17 with regard to the ability of the plant to cope with a degraded grid voltage condition.
The specific safety concern is the potential for equipment damage to occur II the grid voltage were to degrade and become low enough so that the voltage at the Class IE equipment is less than the qualified operating voltage. 2 In Reference 60, NNECO provided the NRC Staff with interim degraded grid voltage procedures which define operator actions during such conditions. These procedures are to be used pending completion of the Millstone Unit No. I degraded grid voltage design modifications. The interim degraded grid voltage procedures were approved by the NRC Staff in a letter dated May 20, 1986 (Reference 62). I Degraded grid voltage design modifications were to have been implemented i during the 1985 Millstone Unit No. I refueling outage, but were delayed to the next refueling outage (currently scheduled for the summer of 1987). The delay l l was justified based on a study derived from the Millstone Unit No.1 PSS that i i
3-124 i' concluded that the probability of a station blackout would increase by approximately a factor of 2.4 if the planned modifications were completed. This probabilistic analysis led NNECO to the conclusion that the design changes should not be implemented until further refined. By letter dated December 12, 1985, the NRC Staff agreed with NNECO's conclusion and accepted the change in schedule. In Reference 61, NNECO provided the Staff with further details of the probabilistic evaluation of the proposed degraded grid modifications, f The present scope of these ISAP topics include the redesign of the degraded grid voltage protection system and possible conforming modifications to the degraded grid voltage procedures to be developed and implemented af ter the design changes are completed. In the interim, the interim degraded grid procedures provide technically acceptable means for defining operator actions during degraded grid voltage conditions without concurr nt LOCA conditions. As a result, NNECO believes any additional effort on this subject, except for revising and implementing the degraded grid design modification and procedures, is not warranted. O
3-125 ISAP Topic No.1.24 - Emergency Power References 13,24 Proposed Action ISAP Topic No.1.24 resulted from Topic Vill-2 of the SEP review of Millstone Unit No.1. Specifically, during the SEP, the emergency power sources were reviewed against the criteria of GDC 17, with regard to preventative maintenance for the gas turbine generator. As documented in the IPSAR, the NRC Staff concluded that failure of the gas turbine generator appeared in approximately one-quarter of the dominant accident sequences. Based on a review of 31 reported failures of the gas turbine generator over a 12-year period, the Staff also concluded that some of these failures could have been prevented by a more effective preventative maintenance program. NNECO was required to review its preventative maintenance program for the gas turbine generator for j potential improvements. The scope of ISAP Topic No.1.24 is a review of the aden,mcy of this maintenance program. . NNECO originally responded to the Staff's concern by letters dated May 10,1983 and June 20, 1983. In these responses, NNECO proposed changes in the preventative mainter.ance program regarding the engine mounted fuel pump, fuel shut-off valve, air start regulating valve, air receiver, and control circuit timers. Subsequently, by letter dated June 12,1984, NNECO stated that both the engine mounted fuel pump and fuel shut-off valve had been replaced in 1976. Upon
3-126 advice of the engine manufacturer, NNECO committed to inspect these components to the frequency recommended by the manufacturer. By letter l l dated August 16, 1984, the Staff concluded that the revised preventative maintenance program resolved this issue. l In Reference 24, NNECO detailed the thorough review of the preventative ' maintenance program that has been conducted, and the improvements and l corrective actions that have been identified and implemented. Based on the l above, and the fact that recent experience with gas turbine generator surveillance indicates that the problems which have arisen in the past have been alleviated to the point where overall reliability is high, NNECO concluded that this issue is resolved and that no further effort on this topic is warranted. In the NRC Staff's safety evaluation on the scope of this ISAP topic, Reference 13, the - Staff agreed that the issue is acceptably resolved. Any further consideration of the adequacy of the gas turbine generator preventative maintenance program will be in conjunction with efforts on USI A-44, Station Blackout. l [
3-127 ISAP Topic No.1.26 - GL 83-28, Equipment Classification / Vendor Interface ( References 13,63 Proposed Action I I NUREG-1000," Generic Implication of ATWS Events at the Salem Nuclear Power Plant," was implemented on July 8,1983, when the NRC Staff issued Generic Letter 83-28, " Required Actions Based on Generic Implications of Salem ATWS Events." GL 83-28 required licensees to address issues related to trip system reliability and general management capability. Item 2.1 required licensees to: (1) confirm that all components necessary to trip the reactor are identified as l safety-related equipment in documents, procedures and information handling l systems used in the plant for controlling safety-related activities, including maintenance, work orders and parts replacement; and (2) estab!!sh, implement l and maintain a continuing program to ensure that vendor information is complete, current and controlled throughout the life of the plant, and appropriately referenced or incorporated in plant instructions and procedures. ISAP Topic No.1.26 encompasses these GL 83-28, Item 2.1, requirements. As noted in Reference 63, NNECO believes that the responses to GL 83-28 for Millstone Unit No. I are complete. NNECO provided information to the NRC Staff in submittals dated November 8,1983 and May 9,1985. In Reference 63, NNECO stated that at Millstone Unit No.1, all components required for reactor trip are identified as safety-related equipment in documents, procedures and
3-128 O information handling systems used in the plant to control safety-related U activities. These components are currently identified on the Category 1 Material, Equipment and Parts List (MEPL) and will be identified on the 1 Production Maintenance Management System (PMMS) data base, which will replace the document form of the MEPL. At this time there are no outstanding NRC Staff requests for additional information on this topic. In Reference 13, the Staff noted that NNECO's submittals are currently under Staff review. NNECO concludes that further action is not warranted on the topic, pending a final SER. O 1 O
3-129 O ISAP Topic No.1.27 - GL 83-28. Post-Maintenance Testing References 13,63 Proposed Action GL 83-28, items 3.1.1 and 3.1.2, required licensees to sul:mit the results of their review of test and maintenance procedures and technical specifications to assure that post-maintenance operability testing of safety-related components in the reactor trip system is required to be conducted, and that the testing demonstrates that the equipment is capable of performing its safety functions before being returned to service. Also, it required licensees to submit the results of their check of vendor and engineerlag recommendations to ensure that any appropriate test guidance is included in the test maintenance procedures and technical specifications, where required. ISAP Topic No.1.27 encompasses these GL 83-28, items 3.1.1 and 3.1.2, requirements. NNECO responsed to GL 83-28 for Millstone Unit No. I on November 8,1983. In Reference 63, NNECO stated that the responses are complete. A review of the Millstone Unit No. I test and maintenance procedures and technical specifications indicated that post-rpintenance operability testing is required in all cases. Also, all known applicable vendor and engineering recommendations regarding testing have been included in test and maintenance procedures. By letter dated February 21, 1986, the NRC Staff concluded that NNECO complied with items 3.1.1 and 3.1.2 of GL 83-28. In Reference 13, the NRC Staff therefore concluded that this issue is resolved and no further action is necessary.
i z 1 3-130 ' [) V ISAP Topic No. 1.28 - GL 83-28. Post-Maintenance Testing Technical Specification Changes References 13,63 Proposed Action GL 83-28, item 3.1.3, required licensees to identify, if applicable, any post-maintenance test requirements in existing technical specifications whlch can be demonstrated to degrade rather than enhance safety. ISAP Topic No.1.28 encompasses that requirement and any necessary changes to the pos t-O V maintenance testing technical specifications. As stated in Reference 63, NNECO responded to Item 3.1.3 of GL 83-28 on November 8,1983. NNECO concluded that no existing technical specification requirements for post-maintenance testing will result in degraded safety of the reactor trip system or other safety-related components. NNECO also committed to continuously review incoming vendor information and engineering recommendations with respect to impact on component reliability. Should the potential for degradation of safety due to post-maintenance test requirements be identified, NNECO will submit appropriate technical specification changes and justification to the NRC for approval. By letter dated September 3,1985, the NRC Staff issued a safety evaluation for , this topic concluding that NNECO's response to item 3.1.3 was acceptable. In Reference 13, the Staff concluded that this ISAP topic is resolved.
. - _ .- - . . _ _ . .= . _ _ . .. . .-
l l 3-131 : l Based on the above, NNECO concludes that this item is resolved and no further action is warranted. a 6 1 i f i i t i
,,-,-,,-,__,.--.._-,.,n,____. , - - - - - , _ , . , _ _ . , _ - . - - - - - - -
, 3-132 ( ISAP Topic No.1.29 - Response to GL 81-34 References 13,64,65 Proposed Action The NRC Staff sent GL 81-34 to BWR licensees on August 31, 1981. The GL required plant-specific responses conforming to the guidance contained in NUREG-0803, " Generic SER Regarding Integrity of BWR Scram System Piping." NUREG-0803 provides guidelines for a plant-specific review to ascertain whether the scram discharge volume (SDV) design is acceptable to assure that safety concerns associated with a postulated SDV piping failure do not represent a dominant contributor to core melt risk. The required review addresses the need for improvement in procedures, periodic in-service inspection and surveillance for the SDV, and environmental qualification for essential
- equipment needed for mitigation of the consequences of postulated pipe failures in the scram system piping. The NUREG-0803 guidelines were developed to address the consequences of a postulated crack in the system piping resulting in
large leakage downstream of the isolation valves. ISAP Topic 1.29 encompasses - NNECO's response to the requirements of GL 81-34. In Reference 64, NNECO provided the NRC Staff with an evaluation of the Millstone Unit No.1 SDV design against the guidelines of NUREG-0803. NNECO 4 reported that the SDV system was modified in 1982 to replace all piping downstream of the hydraulle control unit header and the single scram discharge
-- - - - - - . - - - - - . - - , , , , ,,--,-m,--,-n,._, .,,,n._,_,,,--_..,--.a-_n,-w,e _,-,.,,,,,,,._--,,-n, -_r, , , , - - - - - - - , , - - . - . - - - - , - , . , , , , , ,
l l 3-133 volume was replaced by two larger volumes. The new piping meets the design, fabrication, installation, testing, and quality assurance requirements of ASME Code, Section III, Class 2 components. The piping and supports were designed to seismic Category I criteria. In summary, NNECO concluded that for .Mllistone 1 Unit No.1, an SDV break accident is not a major core uncovery or risk concern. l Additionally, NNECO cuncluded that the concerns enumerated in NUREG-0803 have been completely addressed for Millstone Unit No.1. In Reference 65, the NRC Staff issued GL 86-01 satisfactorily resolving this
; issue for all BWRs. Based on the GL 86-01 findings, NNECO's SDV system modifications, plant-specific features at Millstone Unit No.1, and NNECO's participation in the BWR Owners' Group efforts on this issue, NNECO concludes that no further action on this ISAP topic is necessary. In Reference 13, the NRC Staff agreed that this topic is resolved.
i i l O
,--,.,,----,--,.,,.------,,---,-------.,.--.._--_,n-,--,.-------, , - - - - , - . - - - , , - n..,
3-134 . ISAP Topic No.1.30 - GL 83-28, Post-Trip Review Data and Information References 13,63,66 Proposed Action GL 83-28, Item 1.2, required licensees to prepare a report which describes and justifies the adequacy of equipment for diagnosing an unscheduled reactor shutdown. The report was to describe: a) the capability for assessing sequence of events; b) the capability to determine the cause of functioning of safety-related equipment; c) other data and information provided to assess the cause of O b the shutdown; and d) the schedule for any planned changes to existing data and information capability. ISAP Topic No.1.30 encompasses this GL 83-28 item. As summarized in Reference 63, NNECO responded to item 1.2 on November 8, 1983, stating that the plant process computer is currently scheduled for replacement (see ISAP Topic No. 2.03). In Reference 66,in response to a request for additional information, NNECO submitted further information on this issue. At this time there are no outstanding NRC requests for additional information. In Reference 13, the Staff noted that NNECO's submittats are currently under review. NNECO concludes that further action on this ISAP topic is not warranted pending a final NRC SER. O
1 3-135 15AP Topic No. l.31 - GL 83-28. Equipment Classification / Vendor Interface References 13,63 Proposed Action s GL 83-28, Item 2.2, required licensees to describe their program for ensuring that all components of safety-related systems necessary for accomplishing required safety functions are identified as safety-related on documents, procedures and information handling systems used in the plant to control safety-related activities. Also, licensees were required to establish, implement and maintain a continuing program to ensure that vendor information is complete, current and appropriately referenced or incorporated in plant instructions and procedures. ISAP Topic No.1.31 encompasses NNECO's response to this GL 83-28 Item (see also ISAP Topic No.1.26). NNECO submitted information on this issue in submittals dated November 8, 1983 and May 9,1985. In Reference 63, NNECO summarized its response, stating that at Millstone Unit No.1 it has established criteria to identify systems, structures and components which are safety-related. This information , is currently identified in document form on the Category 1 MEPL. The Information will eventually be identified on the PMMS data base, which will replace the dc:ument form of the MEPL. As noted in Reference 13, NNECO's responses to this issue are currently under NRC Staff review. At this time there are no outstanding requests for additional information and NNECO concludes
3-136 3 that further action on this ISAP topic is not warranted at the present time, pending a final NRC SER. i I i p f I I i 1 i t
)
3-137 p) ISAP Topic No. l.32 - GL 83-28. Post-Maintenance Testing Procedures G l References 13,63 Proposed Action GL 83-28, Item 3.2.1, required licensees to submit the results of a review of maintenance procedures and technical specifications to assure that post-maintenance operability testing of safety-related components in the reactor trip system is required to be conducted and that the testing demonstrates that the equipment is capable of performing its safety functions before being returned to service. Also, item 3.2.1 required licensees to submit the results of their check of vendor and engineering recommendations to ensure that any appropriate test guidance is included in the test and maintenance procedures or technical j specifications, where required. ISAP Topic No.1.32 encompasses NNECO's response to this GL 83-28 Item. i In Reference 63, NNECO summarized its response to this issue. NNECO stated ( that for Millstone Unit No. I post-maintenance operability testing is required in all cases. All known applicable vendor and engineering recommendations regarding testing have been included in test and maintenance procedures. No recommendations were applicable to the technical specifications. In a safety evaluation dated February 21, 1986, and in Reference 13, the NRC Staff concluded that this issue is resolved. Therefore, NNECO concludes that no Nrt%r act!cn on this ISAP topic is necessary.
3-138 O ISAP Topic No. 1.33 - CL 83-28. Post-Maintenance Testing Technical b Specification Changes iteferences 13,63 Pronosed Action . GL 83-28, item 3.2.3, required licensees to identify, if applicable, any post-maintenance test requirements in existing technical specifications which can be demonstrated to degrade rather than enhance safety. ISAP Topic No.1.33 encompasses NNECO's response to this GL 83-28 item (see also ISAP Topic O) i No.1.28). On November 8,1983, NNECO provided a response to this issue. As summarized in Reference 63, NNECO identified no technical specification requirements for post-maintenance testing which will result in degraded safety of the reactor trip system or other safety-related components. NNECO also committed to continuously review incoming vendor information and engineering recommendations with respect to impact on component reliability. Should the 1 potential for degradation of safety due to post-maintenance test requirements be identified, NNECO will submit appropriate technical specification changes and justifications to the NRC for approval. On September 3,1985, the NRC Staff issued a safety evaluation for this topic O concluding that NNECO's response to GL 83-28, Item 3.2.3, was acceptable. In Reference 13, the NRC Staff concluded that this ISAP topic is resolved.
3-139 Based on tie above, NNECO concludes that this item is resolved and no further act. ion is warranted. i i O
3-140 ISAP Topic No.1.34 - GL 83-28 Reactor Trip System Testing O) ( References 13,63 Proposed Action GL 83-28, Items 4.5.2 and 4.5.3, required licensees to justify not making modifications to permit on-line testing of the trip system, if the plant is not currently designed to permit such testing. Also, items 4.5.2 and 4.5.3 required licensees to review existing intervals for on-line functional testing required by technical specifications to determine whether the intervals are consistent with O Q achieving high reactor trip system availability. ISAP Topic No. 1.34 encompasses NNECO's response to these GL 83-28 Items. NNNCO has responded to this issue in submittals dated November 8,1983, March 16,1984, and May 9,1985. In Reference 63, NNECO summarized its responses. NNECO stated that because on-line testing is performed at Mllistone Unit No.1, Item 4.5.2 is not applicable. Also, NNECO intends to endorse the BWR Owners' Group response to item 4.5.3. As noted in Reference 13, this information and the BWR Owners' Group response is currently under review by the Staff. There are no outstanding requests for additionalinformation. NNECO believes that its response to this item is complete and concludes that further action on the ISAP topic is not warranted, pending a final NRC SER. O
w 3-141 ISAP Topic No.1.35 - CL 83-28. Reactor Trip System Functional Testing References 13,63 Proposed Action i GL 83-28, item 4.5.1, required licensees to perform on-line functional testing of i the reactor trip system, including independent testing of diverse trip features. ; ISAP Topic No.1.33 encompasses NNECO's response to this GL 83-28 item. 1 in submittals dated November 8,1983 and March 16, 1984, NNECO provided a response to this issue. As summarized in Reference 63, NNECO stated that on-line functional testing of the Millstone Unit No. I reactor trip system is performed at frequencies defined by the technical specifications. In addition, NNECO is implementing a procedure to fully test the normal and ATTS back-up scram valves in response to this item. In a letter dated February 21,19% and in Reference 13, the NRC Staff concluded that NNECC's response to this issue was t acceptable and that the ISAP topic is resolved. NNECO concludes that no further action is warranted. O
3-142 ISAP Topic No.1.36 - Technical Specifications Covered by GL 83-36 Reference 67 Proposed Action GL 83-36 required BWR licensees to propose changes in plant technical specifications to address each of the TMI Action Plan items identified in Enclosure I to the GL applicable to' their facilities. As part of the implementation of the TMI Action Plan, thh requirement was intended to assure that facility operation is maintained within acceptable limits. ISAP Topic No.1.36 encompasses NNECO's response to GL 83-36. In Reference 67, NNECO responded to GL 83-36. NNECO provided the NRC Staff with a list and status of proposed technical specifications for the TMI Action Plan items which are applicable to Millstone Unit No.1. NNECO plans to submit proposed technical specifications, using GL 83-36 as guidance, for the l ltems identified in Reference 67. NNECO concludes that these actions constitute the appropriate approach to resolve this issue. O
3-143 (Q ISAP Topic No.1.37 - Technical Specification Changes to Address 10CFR50.72
'GI and 10CFR50.73 References 13,68 Pronosed Action 4
The NRC's revised reporting regulations, 10CFR50.72 and 50.73, became effective on January 1,1984. GL 83-43 subsequently required licensees to propose revisions to their technical specifications to address the revised reporting requirements. ISAP Topic No.1.37 encompasses NNECO's response to GL 83-43. On July 9,1985, NNECO submitted proposed revisions to the Millstone Unit No. I technical specifications which address 10CFR50.72 ~and 50.73 and which meet the guidance of GL 83-43. As noted in Reference 68, this submittal is currently under NRC Staff review. NNECO concludes that any further NNECO action on this topic is not warranted, and that issuance of the proposed changes d by the Staff will fully resolve the matter for Millstone Unit No. 1. In Reference 13, the NRC Staff agreed that this topic need not be considered in the integrated assessment. O
3-144 ISAP Topic No.1.38 - Expand QA List References 13,69 Proposed Action ISAP Topic No.1.38 is derived from TMI Action Plan item I.F.1 and the high-priority issues identified in NUREG-0933. It encompasses the NRC Staff's proposal for licensees to expand the Quality Assurance (QA) list. Specifically, in TMI Action Plan item I.F.1, the NRC Identified systems "important to safety"(ll) at TMI Unit 2 that were not designed, fabricated, and maintained at a level equivalent to their safety importance. The NRC proposed to develop guidance for licensees to expand their QA lists to cover equipment "important to safety" and rank the equipment in order of its importance to safety. The results of the Interim Reliability Evaluation Program and the Staff's systems interaction (USI A-17) tasks would be used to establish the importance of equipment as it relates to safety. Experience in use of the revised NRR review procedure for developing QA lists for individual operating license applicants would also be factored into the generic guidance. i (11) A definition of the term "important to safety" in NRC regulations, which I properly reflects historical NRC Staff and industry practices, has not yet been developed.
3-145 /~'s in Reference 69, NNECO provided the NRC with information regarding the classification of structures, systems and components in the Millstone Unit No.1 QA program, and provided an assessment of the Staff's proposal on QA. NNECO stated 8. hat str w:tures, systems and components at Millstone Unit No. I are categorized into two groups: safety-related equipment and non-safety-related equipment and, as such, its QA program is a two-tier program. NNECO emphasized that, nctwithstanding the definitional dispute between the NRC Staff and the industry in general, NNECO's position is that the terms "important to safety" and " safety related" are in fact synonymous. Nevertheless, NNECO concluded that further expansion of the QA program or redefinition of QA program categories is unnecessary for Millstone Unit No.1. In Reference 69, NNECO observed that more than adequate management controls and measures are in place for equipment beyond the traditional safety-
> relatsd set of systems and components utilized to adequately maintain the equipment and to adequately protect the public health and safety. For example, NNECO routinely evaluates non-safety-related structures, systems and components for their impact upon safety-related equipment. Several recent licensing issues (e.g., environmental qualification) substantiate NNECO's point.
In those cases where the GDC are applicable, NNECO interprets the regulations to require that any non-safety-related structure, system or component that could impact safety-related structures, systems or components from performing the function necessary to comply with the particular GDC would need to be designed to preclude that impact. In Reference 69, NNECO also stated that management routinely applies accepted codes and standards to plant backfit projects involving non-safety-
3-146 related equipment. Design, installation and maintenance activities are subject to measures to ensure the quality of that equipment Further, the Millstone Unit No. I maintenance program addresses all plant equipment, not just safety-related equipment. Based on the degree of attention given to non-safety-related equipment at Millstone Unit No.1, NNECO does not believe that a measurable L increase in safety would be obtained by expansion of the QA safety-related list to include any additional non-safety-related equipment. In Reference 13, the NRC Staff agreed that the QA program as implemented by NNECO at Millstone Unit No.1 is an appropriate and effective program and I would benefit very little from any change in QA list requirements. The Staff concluded that NNECO satisfies tim intent of ISAP Topic No.1.38 and, therefore, this topic is adequately resolved. O L m
l 3-147 ISAP Topic No.1.39 - Radiation Protection Planj References 13,70 Proposed Action ISAP Topic No.1.39 is derived from TMI Action Plan Item III-D.3.1 and the high-priority issues identified in NUREG-0933. It encompasses the NRC Staff's proposal for licensees to develop a radiation protection plan. Specifically, detailed appraisals of health physics programs at all operating facilities concluded that certain generic deficiencies existed at many plants, due in part to lack of specific performance criteria and/or assigned responsibility. In TMI Action Plan Item II-D.3.1, the NRC Staff therefore proposed a project to improve nuclear power plant worker radiation protection programs by better defining the criteria and responsibility for such programs. The Staff proposed that licensees establish a radiation protection plan as a guidance document for implementing procedures. Proposed guidance and acceptance criteria for radiation protection plans were published in draf t NUREG-0761. In Reference 70, NNECO provided the Staff with a comparison of the radiation protection program at Millstone Unit No. I and the guidance of draft NUREG-0761. NNECO noted that although some differences do exist, all of the basic guidance of draf t NUREG-0761 is currently addressed in the Millstone radiation protection program. In addition, NNECO noted that the Millstone Radiation
3-148 Protection Plan, applicable to the three operating Millstone units, was reviewed by the Staff as part of the licensing review of Millstone Unit No. 3. The Staff found the plan to be satisfactory. In sum, NNECO considers that the Radiation Protection Plan in place at the Millstone station meets, and in many instances exceeds the licensing criteria set forth by the NRC. Based upon the above, NNECO concludes that additional action on this topic is not warranted. In Reference 13, the NRC Staff agreed that NNECO has met the intent of ISAP Topic No.1.39 and, as such, this topic is adequately resolved. O O
3-149 ISAP Topic No.1.40 - Bolting Degradation or Failure References 13,71,72,73 Proposed Action ISAP Topic No.1.40 is derived from the high-priority issues of NUREG-0933 and encompasses the plant-specific resolution of Generic Issue 29 for Millstone Unit No.1. Specifically, there are numerous bolting applications in nuclear power plants. NRC Generic Issue 29 addresses a concern that degradation of the most crucial applications might go unnoticed, threatening the integrity of the primary pressure boundary and the reliability of component support structures. In NUREG-0933 the NRC recognized that there was no simple solution to this issue, but recommended potential improvements in design, materials, fabrication, installation, and in-service inspection. In NUREG-0933, however, the Staff limited its consideration to improvements in in-service inspection. In-service inspection for bolting degradation is thus the focus of Generic Issue 29 and this ISAP topic. In Reference 71, NNECO provided the NRC with a review of the applicability and status of Generic Issue 29 for Millstone Unit No.1. In the referenced letter, NNECO addressed the recommendations contained in INPO SOER 84-5, " Bolt Degradation or Failure in Nuclear Plants." NNECO noted that the
l l l 3-150 i l recommendations in the INPO SOER have been addressed for Millstone Unit No. I by corporate, plant, or individual departmental procedures. NNECO also concluded that based on the response of Millstone Unit No. I to the recommendations outlined in the INPO SOER, Generic Issue 29 was resolved for Millstone Unit No.1. In Reference 72, NNECO reported to the NRC Staff that during a plant walk-down, NNECO discovered severed botting on main steam line support base plates. In a letter dated January 2,1986, the NRC Staff concluded that NNECO's ! corrective actions for this incident are adequate. The Staff, however, requested t additional information to identify the cause of the bolting failure. In Reference 13, in light of the incident, the Staff also requested that NNECO evaluate the need for more frequent visual examinations of the plate bolting. O In Reference 13, the NRC Staff concluded that because NNECO observes V industry codes and standards and NRC regulations in the design of, materials for, fabrication of, installation of, and inspection of bolting, NNECO's present bolting program is adequate. The Staff stated that NNECO meets the intent of ISAP Topic No.1.40. The Staff also concluded that with the exception of the P two outstanding requests for additional information, no further action on this topic is necessary. l NNECO provided a response to the Staff's first request for additional information (re: the cause of the botting failure) in Reference 73, dated February 6,1986. With respect to the second Staff request, NNECO plant personnel have been alerted to the need for more frequent visual examinations of the plate bolting. During the 1987 refueling outage, NNECO will visually inspect
3-15i 100% of the Class 2 and Class 3 anchors. Unless circumstances warrant
' -( otherwise, NNECO will resume ASME Code Section XI inspections in subsequent outages. NNECO concludes that this topic is resolved, pending final NRC Staff review. No further modifications of any kind are contemplated, and thus no further benefits in any category will result.
O i I O
3-152 g ' ISAP Topic No.1.41 - Flooding of Compartments by Backflow References 13,74 Proposed Action ISAP Topic No.1.41 is derived from the high-priority issues of NUREG-0933 and encompasses the plant-specific resolution of Generic Issue 77 for Millstone Unit No.1. Specifically, on July 1,1983, the NRC issued I&E Information Notice 83-44,
" Potential Damage to Redundant Safety Equipment as a Result of Backflow through the Equipment and Floor Design System," to address the concern that improperly designed drain systems could contribute to equipment damage as a result of backflow. In Reference 74, NNECO provided the NRC Staff with a review of the applicability of Generic Issue 77 to Millstone Unit No. 1.
Reference 74 provided the results of NNECO reviews of the equipment and floor drain systems as well as the plant drainage system designs for Millstone Unit No.1. The reviews wer e conducted in response to IE Circular 78-06," Potential Common Mode Flooding of ECCS Equipment Rooms at BWR Facilities," and Information Notice 83-44. In the course of its reviews, NNECO identified the possibility of backflow through drains which empty into catch basins and oil separator pits located outside the recombiner, turbine and gas turbine buildings. Drains in these buildings for which back-flooding could be postulated were identified. Following
)
i 3-153 ; l n l Q the review, Millstone Unit No. 1 Off-Normal Procedure 514A, " Natural l Occurrences," was revised to provide guidance to operators as to which plant drains are to be temporarily plugged in the event of site flooding. The plugs, which are located in Millstone Unit No. I control room, will be used to prevent i the possibility of backflow through plant drains that empty into catch basins and ! oil separator pits outside of Unit No. I buildings. No plant design modifications were required. 1 NNECO's reviews reported in Reference 74 also showed that flooding in one ECCS equipment room would not result in flooding of the redundant equipment room, because each ECCS room has a separate floor drain sump with no cross connections. In addition, the emergency diesel generator, stand-by gas treatment, FWCI, IC, and SLCS are not capable of being flooded because of the elevation of these components relative to the equipment and floor drain systems. Finally, systems such as the gas turbine generator, emergency service water or service water systems are not affected by the equipment or floor drain system, because they can drain directly to Long Island Sound. Based upon the above, NNECO concludes that Generic Issue 77 has no safety significance for Millstone Unit No.1. However, NNECO has committed to performing an internal flooding risk assessment currently scheduled for completion later this year. In Reference 13, the NRC Staff concluded that Millstone Unit No. I meets the intent of ISAP Topic No.1.41 and that the topic is adequately resolved. O
3-154 ISAP Topic No.1.42 - Main Steam Line Leakage Control System References 13,75 Proposed Action ISAP Topic No.1.42 is derived from the high-priority issues of NUREG-0933 and specifically addresses a plant-specific resolution of Task Action Plan item C-8 for Millstone Unit No.1. GDC 54 requires, in part, that piping systems penetrating primary containment be provided with leak detection, isolation, and containment capability having redundancy, reliability and performance capabilities that reflect the importance of isolating these piping systems. The NRC Staff issued RG 1.96, " Design of Main Steam Isolation Valve Leakage Control Systems for Boiling Water Reactor Nuclear Power Plants," to describe an acceptable method for meeting the ! i
- requirements of GDC 54. However, the Staff conducted a survey in 1982 which indicated a high frequency of measured MSIV leakage at some plants, which may ,
be significantly in excess of the standard technical specification limit of I
- 11.5 SCFH. The Staff proposed the need for improved MSIV maintenance, more frequent testing, or installation of a MSIV leakage control system. NRC Task I Action Plan item C-8 was initiated to investigate
- a) whether the leakage control system recommended in Regulatory Guide 1.96 was acceptable; and
- b) whether leakage control systems should be backfit to all BWRs that do not have such systems.
3-155 In Reference 75, NNECO addressed the applicability of NRC Task Action Plan G 1 Item C-8 to Millstone Unit No.1. NNECO stated that Millstone Unit No. I does not employ a MSlY leakage control system. However, a plant technical specification limits MSIV leakage to 11.5 SCFH. In addition, a review of performance of the MSIVs from 1970 to 1985 indicated a maximum leakage rate less than 40 SCFH. This is in sharp contrast to other BWRs, where leakage rates on the order of 3,400 SCFH have been experienced. NNECO concluded that because Millstone Unit No. I does not employ a MSIV leakage control system, concerns regarding adverse impact of the system's operation on dose consequences in the event of a postulated DBA are not applicable. Further, because Millstone Unit No. I has not experienced the excessive leakage rates experienced at some nuclear power plants, NNECO concluded that existing maintenance practices are adequate to ensure valve operability and limit MSIV leakage. Based on the above, NNECO believes that the addition of a MSIV leakage control system would not result in an improvement in safety and that no further action is warranted on this ISAP topic. In Reference 13, the NRC Staff agreed, concluding that the matter is adequately resolved. O i 1
. , e--.-,.. . . . - - , - - - -- - - - - , - , -
3-156 ISAP Topic No.1.43 - Water Hammer References i 13,76 l Proposed Action i
~
l ISAP Topic No.1.43 is derived from the high-priority issues of NUREG-0933. It specifically addresses, for Millstone Unit No. 1, the NRC's water hammer concerns identified in USI A-1. t On August 30, 1982, the NRC Staff issued a safety evaluation concluding that J NNECO's short-term and long-term corrective actions for water hammer events j assure that Millstone Unit No. I can continue to operate without endangering the I l health and safety of the public. The actions being contemplated l'y NNECO to address water hammer concerns were:
- a. Implement a feedwater pump trip on high reactor level.
l l
- b. Lower the RWCU system isolation setpu!ra to provide system availability for reactor vessel fill and address associated post-accident radiological concer ns.
- c. Evaluate lowering the programmed reactor water level setpoint following reactor trip to avoid vessel overfill.
- ~ _ .-- ,- . - - . - . . - - - - - - , , - . , . - _ . - - - , - - - - ~ . . - - - - - - - - - - - - - - - - - - - - , - - . - - , _ - . . -
3-157
- d. Implement low flow feedwater controller improvements to allow remote system actuation from the control room and maintain constant reactor vessel water level automatically.
In Reference 76, NNECO provided the NRC Staff with an update of the status of USI A-1 for Millstone Unit No.1. In the referenced letter, NNECO noted that items a and d have been implemented and that item b is being evaluated as ISAP Topic No. 2.20. Item c was evaluated and found to be of minimal benefit. In Reference 76, NNECO also noted the NRC Staff's conclusion that NNECO's corrective actions assure that Millstone Unit No. I can continue to operate without undue risk. Based upon the above, NNECO believes that further action (with the exception of ISAP Topic No. 2.20) is not warranted to resolve this topic. In Reference 13, the Staff concluded that to completely resolve this issue, NNECO should provide its evaluation of the potential public safety benefit of item c. All other items were considered resolved. NNECO will provide an evaluation of item c at a later l date. l
3-138 m. ISAP Topic No. f.44 - Asymmetric Blow-Down Loads on Reactor Systems References 13,76 Proposed Action ISAP Topic No.1.44 is derived from the high-priority issues of NUREG-0933 and addresses, for Millstone Unit No.1, the resolution of USI A-2, " Asymmetric Blow-Down Loads on Reactor Systems." i Basically, in the event of a postulated RCS piping rupture at the vessel nozzle, asymmetric LOCA loading could result from forces induced on the reactor vessel internals by transient differential pressures across the core barrel and by forces in the vessel due to transient differential pressures in the reactor cavity. This Issue, USI A-2, was resolved for all PWRs upon issuance of NUREG-0609,
" Asymmetric Blow-Down Loads on PWR Primary Systems," in January 1981.
4 Af ter evaluating the effects of asymmetric blow-down levels using a fracture mechanics analysis, the NRC Staff found, on a generic basis, that PWRs are adequately designed for the event. BWRs are currently being generically evaluated under the GESSAR review using the same analysis method as was used for PWRs. Although USl A-2 was never considered to be directly applicable to BWRs, the NRC requested all licensees to confirm the applicability of the Staff's PWR i position to their facilities. In Reference 76, NNECO reported on the status of i
?
I 3-159 USI A-2 and NNECO concluded that, based on Section 1 of NUREG-0609, USI A-2 has no safety implications and is not applicable to Millstone Unit No.1. ; i NUREG-0609 states: ) Although similar loads associated with a postulated rupture of piping in primary systems in BWRs are expected to occur, the overall safety significance is considered to be much less because of lower operating pressures in primary systems in BWRs. Based upon this information, the NRC Staff concluded in Reference 13 that this ISAP topic is adequately resolved, pending any future requirements resulting from the generic BWR asymmetric blow-down load review. NNECO concludes that no further action is warranted on this topic at this time. O
3-160 ISAP Topic No.1.45 - Systems Interactions d References , 13,77 Proposed Action ISAP Topic No.1.45 is derived frorb the hign-priority issues of NUREG-0933 and specifically addresses, for Millstone Unit No.1, the resolution of USl A-17,
" Systems Interaction in Nuclear Pow (r Plants."
USI A-17 involves the development of a systematic process to review plant systems to determine potential impacts on other plant systems. The purpose of the task is to identify where present design, analysis and review procedures may not acceptably account for potentially adverse systems interactions. On February 16,1984, the scope of the issue was redefined to limit it to functionally coupled, spatially coupled and induced human coupled interactions which could degrade a safety function. In Reference 77, NNECO provided the NRC Staff with an update of the status of 1 USI A-17 for Millstone Unit No.1. NNECO concluded that there is clearly no compelling need for NNECO to take action uniq'm to this issue at this time. NNECO's conclusion was consistent with the NRC Staff's own findings in draft NUREG-il43, " Safety Evaluation Report Related to the Full-Term Operating
. License for Millstone Nuclear Power Station, Unit No.1," dated July 24, 1985.
There the NRC Staff found that: the corrective actions resulting from the SEP 1
a . 3-161 review will help preclude adverse system interactions; the continuing generic review and reaction to operating experience will contribute to prevention of adverse systems interactions in operating plants; and there is reasonable assurance that Millstone Unit No. I can be operated pending final resolution of USI A-17 without undue risk. In addition, NNECO's conclusion was based on the { fact that a search for potential adverse interactions was conducted through the Millstone Unit No.1 PSS. L In Reference 13, the NRC Staff concluded that there is presently reasonable I r assurance that Millstone Unit No. I can be safely operated pending the ultimate E resolution of the generic issue. The Staff noted, however, that the resolution of w USI A-17 is imminent and that potential means to resolve this topic for Millstone Unit No. I should be considered under ISAP Topic No.1.45. O At the present time, it appears that the Staff's generic resolution of USI A-17 will require no plant modifications. In addition, NNECO believes that through participation in IREP, SEP, and ISAP, and through the plant-specific PSS, the f potential for adverse systems interactions has been adequately explored and addressed for Millstone Unit No.1. m E-O T u y ____-__ _ _-- - - - - - - - - - - - - - - _ - - - - - - - - - - -
3-162 ) q ISAP Topic No. l.46 - Determination of SRV Pool Dynamic Loads ! References 13,78 Proposed Action ISAP Topic No.1.46 is derived from the high-priority issues of NUREG-0933, and specifically encompasses the resolution, for Millstone Unit No.1, of the dynamic loading issues of USI A-39. I USI A-39 evolved from the conduct of a large scale testing program for an O V advanced design BWR pressure suppression containment system (Mark III). During the program, new suppression pool hydrodynamic loads associated with a j postulated LOCA were identified which had not been explicitly included in the original design of the Mark I containment systems. Specifically, operation of BWR primary system pressure relief valves can result in hydrodynamic loads on the suppression pool retaining structures or those structures located within the 4 pool. This dynamic loading issue was prioritized as USI A-39 and was resolved
- for BWR Mark I containments with the isstrance la 1981 of NUREG-0793,
" Guidelines for Confirmatory In-Plant Tests of Safety Relief Valve Discharges j for BWR Plants."
In Reference 78, NNECO provided the NRC Staff with an update of the status of resolution of USI A-39 at Millstone Unit No.1. NNECO stated that it had
- submitted a plant-specific report on pool dynamic loads for Millstone Unit No.1 l
-,----.,..---,,-__.,,._.,_,---s_. --
,v.-- ..,r m., _,._.. . - . - . _ _ , _ . - _ _ . _ _ . . _ - -_ _ . . - -
l 3-163 in 1982 and 1983. The report provided a description of the application of the generic Mark I pool dynamic loads and methods, as well as an evaluation of the containment and components to accommodate pool dynamic loads. No technical specification or containment modifications were necessary for Millstone Unit No.1. This report has been reviewed and approved in a safety evaluation report by the NRC Staff. In Reference 78, NNECO concluded that based upon the NNECO and NRC reviews of the issue, USI A-39 is resolved for Millstone Unit No. 1. In Reference 13, the Staff agreed that this issue, and ISAP Topic No.1.46, are adequately resolved. No further action on this topic is necessary. r~h Q 1 l O
3-164 m i ISAP Topic No.1.47 - Containment Emergency Sump Performance (Q References 4 1 79 Proposed Action ISAP Topic No.1.47 is derived from the issues of NUREG-0933 and addresses the plant-specific resolution of USI A-43, " Containment Emergency Sump Performance." USI A-43 involves post-LOCA conditions that can degrade long-term recirculation capability. The safety concern is potential loss of pump net positive suction head (NPSH) margin due to air ingestion to the pump or suction strainer blockage resulting from LOCA generated debris. In Reference 79, NNECO provided the NRC Staff with an update of the status of resolution of USI A-43 at Millstone Unit No.1. NNECO stated that full scale experiments on BWR-type suction strainers have demonstrated that for typical submergences and flow rates, the strainers act as effective vortex suppressors such that air ingestion is very small. Thus, the likelihood of loss of NPSH margin due to air ingestion is remote. Further, in Reference 79, NNECO concluded that blow-down and transport of insulation debris to the torus region will be impeded by the Millstone Unit No. I plant design and layout. Furthermore, the insulation employed at the plant is a mix of reflective metallic and blanket types. Metallic insulation that is drawn to the torus will not likely be drawn to the intakes due to the low bulk fluid flow
f l
' 3-165 and the elevation of the intakes relative to the torus bottom. Thus, NNECO concluded that this issue has no safety significance for Millstone Unit No.1.
In Reference 13, the NRC Staff concluded that Millstone Unit No. I meets the intent of ISAP Topic No.1.47 with the exceptions of the possibility of blanket-type insulation causing reduced flow, and the possibility of procedural improvements. The Staff recommended that NNECO evaluate these two remaining issues under this topic. NNECO will provide further information on these issues at a later date. O I 1
3-166
' ISAP Topic No.1.48 - Safety Factor for Penetration X-10A Reference 76 Proposed Action Following a water hammer incident at Millstone Unit No.1 in December 1979, the IC system was declared inoperable due to concerns regarding presumed degradation of the IC supply line anchor at containment penetration X-10A.
NNECO has been evaluating the presumed degradation under ISAP Topic No.1.48. O As part of the review of the Millstone Unit No.1 IC for water hammer loads (see ISAP Topic 1.43), the NRC Staff found that the design of the IC was acceptable except that NNECO should demonstrate that the factor of safety for containment penetration X-10A is at least four. The NRC Staff also has stated that in order to comply with I&E Bulletin 79-02, NNECO must consider normal operating loads, high energy pipe break loads, and design basis earthquake loads l for expansion anchor bolts. In Reference 76, NNECO provided the NRC Staff with an update of the status of this evaluation. Specifically, under this topic, NNECO has been evaluating the safety factors for the anchor bolts of the support, the potential for degradation of the original design bases, and anchor improvements that would meet the required safety f actors. It is NNECO's determination that I&E Bulletin 79-02
3-167 requirements only apply to original design bases. The original design basis of containment penetration X-10A did not consider the concurrent load condition of normal operating loads, high energy pipe break loads, and design basis earthquake loads. NNECO further stated that the analytical evaluation of the factor of safety associated with the design of containment penetration anchor X-10A is on-going and will be submitted to the NRC upon completion. NNECO has informed the Staff that the anchor bolts meet a minimum factor of safety of two for high energy pipe break loads coupled with normal operating loads. NNECO believes this issue does not represent a significant safety concern and concludes that completion of the rigorous analytical evaluation of the factor of safety associated with the design of penetration X-10A is the only activity necessary on this topic at the present time. NNECO recognizes that this issue is still open. NNECO will supply additional information as soon as it is available. Currently, NNECO's approach to this issue is to provide a new,less conservative, load analysis drawing from the NRC's recent revisions to GDC 4 to redefine the event considered. O
3-168 Il ISAP Topic No.1.49 - Reactor Vessel Surveillance Program V References l 13,71,80 l l Proposed Action l Appendix H to 10CFR50 requires a reactor vessel material surveillance program to monitor changes in the fracture toughness properties of ferritic materials in the reactor vessel belt-line region resulting from exposure to neutron irradiation and the thermal environment. ISAP Topic No. 1.49 was originally defined to address this subject. References 71 and 80 updated the status of NNECO's reactor vessel surveillance program. Reference 80 specifically indicated that the pressure-temperature (PT) curves now in effect for Millstone Unit No. I are valid for another 1.62 effective full-power years. It was also noted that NNECO plans to evaluate the PT curves prepared by the General Electric Company and propose an amendment to the operating license for Millstone Unit No. I on or before July 1,1986. The ! NRC Staff has been informally notified that this date has been changed to October 31,1986. In Reference 13, the NRC Staff concluded that ISAP Topic 1.49 deals with a routine licensing matter and should, therefore, be evaluated outside of ISAP. The amount of resources needed to complete this issue and all other routine licensing issues in a timely manner will be factored into the development of the
3-169 integrated schedule by NNECO. However, Topic 1.49 will no longer be considered in ISAP. 4 , t I e i 4 I I 1 l
3-170 ( ISAP Topic No.1.50 -Isolation Condenser Start-Up/Make-up Failures Reference 13 Proposed Action Based upon the NRC Staff's review of the Millstone Unit No.1 PSS and operating experience through 1984,. the Staff concluded in Reference 13 that three additional topics should be evaluated in the integrated assessment. The Staff suggests that these topics be evaluated by refined PRA methods or deterministic means to determine whether cost-beneficial solutions to reduce plant risk can be achieved. The first of these topics, ISAP Topic No.1.50, concerns IC failure to start-up and make-up failure. Specifically, according to the Staff, the Millstone Unit No.1 PSS demonstrated that IC start-up and make-up failures are significant contributors to core melt frequency. These two failures appear in 11 of the 18 dominant sequences. The PSS further indicates that the make-up failures are dominated by failure of a MOV to open and by failure of the two diverse fire water supply pumps. The initiation / restoration failures are dominated by a contact pair failure and a failure of MOV IC-3 to open. Millstone Unit No. I has l l experienced 12 failures of IC valves from 1970 through 1984. The proposed project is a probabilistic or mechanistic analysis of potential
- &' irnprovements to the IC to improve its availability and reliability. The project
1 ,i 3-171 would also address operating experience concerning improper functioning of the IC valves ~ NNECO will provide information on this additional ISAP topic at a later date. ! l 4 4
- I f
f 4 i 1 4 I 1 4 i l l 4 1 1 i t l
~~----w--n-~,w,-w-,me~s w--,a -vm,w,m-.-m, --m.,w,wena_-mmaw-,,--w--m wm m me r- w a --,e,,
3-172 (N ISAP Topic No.1.51 - Failure to Restore Main Condenser Reference 13 Proposed Action Based upon the NRC Staff's review of the Millstone Unit No.1 PSS and operating experience through 1984, the Staff concluded in Reference 13 that three additional topics should be evaluated in the integrated assessment. The second of these topics, ISAP Topic No.1.51, concerns potential failures to restore the main condenser. The Millstone Unit No.1 PSS, according to the Staff, determined that such a failure contributes to event sequences estimated to result in a core melt frequency of approximately 1 x 10-4/ year. The proposed project is a probabilistic or mechanistic analysis of potential methods whereby the capability to restore the main condenser could be improved. NNECO will provide information on this additional ISAP topic at a later date. i O O i
. i 3-173 ISAP Topic No.1.52 - SRV Failure - Setpoint Drift Reference i
13 Proposed Action l Based upon the NRC Staff's review of the Mi!Istone Unit No.1 PSS and operating experience through 1984, the Staff concluded in Reference 13 that three additional topics should be evaluated in the integrated assessment. The third of these topics, ISAP Topic No.1.52, concerns failures of SRVs to close, b V Specifically, according to the Staff, the Millstone Unit No.1 PSS identified that failure of SRVs to close contribute to event sequences estimated to result in a core melt frequency of about 1x 10-4/ year. In addition, the operating experience review identified a problem of SRV setpoint drift. Three events involving SRVs were identified and two were due to setpoint drift. This experience is ' consistent with generic experience for BWRs. The BWR Owners Group is currcatly evaluating this generic problem.
'fhe proposed project under this ISAP topic is a probabilistic or deterministic study of potential methods for improving SRV reliability. NNECO will provide information to address this additional topic at a later date.
O
ISAP Topic No. 2.01 - LPCI Remotely Operated Valves 1-LP-50A and B References 22,30,81 Proposed Action Millstone Unit No. I technical specification Section 4.7.A.1 requires that the suppression chamber water level be checked once every shift to assure that the water level in the torus is within acceptable limits. If the water level exceeds the maximum allowable level, water is drained to the radwaste system by opening a series of two normally closed 3-inch manual gate valves (1-LP-50A and B). During certain accident conditions, these valves will become inaccessible. As a result, in Reference 81, NNECO proposed to provide the capability of remote operation for these valves. NNECO initiated a feasibility study to evaluate:
- a. Adding motor operators to the valves; or
- b. Adding reach rods to the valves to manually operate them from remote focations.
ISAP Topic No. 2.01 encompasses these proposed actions. O
3-175 b
]/ Evaluation o Public Safety: In Reference 30, NNECO provided the NRC Staff with the results of its evaluation of this proposal. NNECO concluded that addition of remote operation capability to valves 1-LP-50A and 50B does not affect the course of a transient, and therefore would have negligib!e impact on l core melt or radiation sequences. The valves and their associated down-stream piping are too small to be considered for a potential torus bleed-and-feed long-term decay heat removal scheme.
NNECO also assessed the potential negative safety impact of the proposed action, due to an increase in the probability of an operator inadvertently opening the valves during an accident. This potential impact, however, was C\ () also determined to be negligible. The NRC contractor's review of this issue (Reference 22) also concluded that the public safety benefit of this project was negligible. r o Personnel Safety: Addition of remote capability to these valves would have no significant impact on plant activities, and thus no significant impact on personnel safety. No occupational radiation levels, stay times or industrial risks would be affected. o Economic Performance: This proposed action would have no effect on 1 economic performance. Adding motor operators to the valves would j require changes in existing surveillance testing and procedures to ensure the operability of the installed motor operators and to prevent the valves
3-176 from opening inadvertently. However, this additional surveillance testing would not likely impact plant availability. Installing reach rods would not have any impact on existing surveillance testing or procedures. o Personnel Productivity: This proposal would have a negative impact on personnel productivity to the extent that additional Appendix 3 testing, additional maintenance and additional instrumentation and control surveillances would be required. O 1 i O
. , . -- - . - - . . - - - - . . - - - - - - - . , ~ . , , , . - - - , - . , , , , , - , - - - - - --,- e--,,. -,. . , ,,-n.a-w- ..- --n- --- - - ,
3-177 l C\ ISAP Topic No. 2.02 - Drywell Humidity Instrumentation V References i l 82,83 l Proposed Action Presently, Millstone Unit No, i employs 2 methods for detecting primary system leakage in the drywell. They are:
- a. Calculation of an average leak flow rate through the reactor coolant pressure boundary based on the amount of liquid that is pumped to radwaste via the drywell equipment and drywell floor drain sumps; and
- b. Analysis of air samples obtained during venting of the drywell for increased contaminant activity.
Neither of the 2 methods for leak detection presently being utilized at Millstone Unit No. i provides for continuous leak detection monitoring. Due to the lack of l l a continuous monitoring system, there is a possibility that piping cracks might propagate to a greater degree before detection, as compared to the leakage detection sensitivity associated with a continuous monitoring system. Thus, implementation of continuous leak detection could result in a decrease in the probability of a LOCA, yielding a decrease in risk to the public. O
3-178 h; V In Reference 82, NNECO proposed to perform an engineering evaluation to determine the potential benefits of, and the best method for, continuous monitoring of humidity and airborne, gaseous, and particulate contamination in the drywell. Monitoring of these parameters would provide the capability for detecting a leak or an increase in leakage almost instantaneously. ISAP Topic No. 2.02 encompasses the evaluation of this proposal. ! Evaluation o Public Safety: Almost all reactor coolant pressure boundary (RCPB) piping in the drywell is made of stainless steel except for the main steam and feedwater lines. The main steam and feedwater lines are fabricated from carbon steel. Both main steam and feedwater lines are high energy lines which are maintained at elevated temperature during normal operation. As discussed in Reference 83, stress corrosion cracks in stainless steel piping propagate at a very slow speed (about 10 mills / month). Such cracks in carbon steel piping also propagate at similarly slow speed when the piping is at an elevated temperature. Therefore, a pipe in the Millstone Unit No. I drywell will either rupture instantaneously due to some heavy load dropping on it, or it will develop a crack that propagates over many months, ultimately leading to a rupture. No method of leak detection can provide ample warning in scenarios in which a LOCA develops instantaneously. The current practice of draining i drywell sumps every 4 hours provides adequate warning of slowly
- developing cracks. The proposed project to add humidity and
3-179 contamination monitoring would only provide a back-up to t:ee existing practice. Therefore, NNECO concluded that the proposed project would 1 yield only a very small public safety benefit.
]
o Personnel Safety: The proposed system to provide a monitoring system for humidity and airborne,' gaseous and particulate contamination would be installed in a radiation area in containment. There would be a small increase in. s. veillance and maintenance. Therefore, the proposal would cause a small negative impact on occupational exposure. The proposal would not impact industrial risk. o Economic Performance: The proposed leak detection system would not prevent leakage in the drywell. It would only provide a diverse means for early detection of small leaks. The current method of detecting leaks has proven reasonable, and therefore NNECO concludes that this project would not :Jfect plant reliability or availability. o Personnel Productivity: The proposed project would increase maintenance, surveillance and instrumentation and control activities. It would thus have
- a small negative impact in this category.
i
. - - . _ _ . . . - - ~ c - _ , . . , , - . _ - . .- - - _ y . . . . ,,_.,.-,-.__r
4 3-180 l
, ISAP Topic No. 2.03 - Process Computer Replacement Reference 84 ;
Proposed Action The present Millstone Unit No. I process computer is more than 15 years old and is considered to be nearing the end of its usefullife. (Typically the useful life of a computer is 10 to 15 years.) At present, the Millstone Unit No. I process computer is necessary during start-up (for rod worth minimizer system operation) and for monitoring and performing NSSS calculations during power ramp-up and power ramp-down conditions. During normal operation (above 25% power) the process computer is utilized for daily fuel surveillance; however, its failure does not affect the power generation of the plant. In Reference 84, NNECO stated that it is replacing its process computer. As noted in Reference 84, replacement of the process computer is a one-for-one plant hardware exchange. The new process computer will have a completely redundant processor with built-in diagnostics capability which could automatically switch over to the redundant processor if the operating processor 1 should fail, and at the same time inform the operator of the failed processor. The new process computer will also have a larger storage capacity and will be capable of meeting the interaction requirements of the SPDS. ; i
3-181 Replacement of the process computer is currently on-going. ISAP Topic No. 2.03 encompasses this project. Evaluation o Public Safety: This project will have a small positive impact on public safety. The present process computer does not directly interface with other plant systems and is therefore not capable of either inducing or mitigating transient events. However, NNECO believes that it may be desirable to use the enhanced trending capability of the new computer in an anticipatory role. This could help operators to prevent certain transients before they occur. This ability to anticipate transients will help to slightly reduce core melt frequency and, consequently, public risk. o Personnel Safety: The replacement of the old computer with a new computer will have no significant impact on plant activities associated j with occupational exposure or industrial risk. Therefore, this modification has no impact on personnel safety. o Economic Performance: Replacement of the process computer will have a direct, positive benefit on plant performance. The present process computer is more than 15 years old,is considered to be obsolete, and is not completely reliable. Process computer failures have contributed to capacity factor losses and increasing maintenance costs. In addition, the new processor, with a redundant processor and built-in diagnostic capability, will reduce process computer failures and outages. Finally, implementation of the SPDS, although not directly affecting the power
3-182 i generation process, will have an indirect positive effect in terms of any change in core melt frequency due to better diagnosis of an accident resulting from the information made available to operators in the control room (see ISAP Topic No.1.08). o Personnel Productivity: This action will have a positive effect on personnel productivity. Considerable time is currently being spent to repair and maintain the existing process computer. Although the new computer will require additional training, it will significantly reduce required repairs and maintenance. Also, the new computer's increased capabilities to perform plant diagnostics could reduce plant maintenance and repair time. Finally, the new process computer will improve the data
- acquisition process. '
O - 4 j O
3-183 ISAP Topic No. 2.04 - High Steam Flow Setpoint Increase lm() References 22,85,86 Proposed Action J ISAP Topic No. 2.04 addresses weekly surveillance testing of the turbine-stop valves. In order to perform weekly turbine-stop valve testing, reactor power must be reduced to approximately 90% for the duration of the test (several hours). This reduction of core power is necessary to prevent main steam isolation valve (MSIV) closure due to high steam flows in the non-affected steam lines. At Millstone Unit No.1, the current high steam flow setpoint for automatic isolation valve closure (and a reactor trip)is 120% of rated flow. In Reference 85, NNECO proposed to evaluate the feasibility of an increase in the MSIV closure setpoint from 120% to 140%. The proposed project would eliminate the need to reduce power for the weekly turbine-stop valve testing. l As presently proposed, the increase in setpoint would be accomplished by a calibration change in existing hardware. Evaluation i I o Public Safety: NNECO provided the NRC Staff with the results of its probabilistic safety evaluation of this proposed action in Reference 86. As
3-184 O discussed in the reference, the proposed project would have a small adverse
- V impact.
The primary function of MSIV closure on high steam flow is to detect and isolate a break in the steam lines downstream of the MSIVs. If the proposed change is implemented, the MSIVs will no longer automatically close for steam line breaks that result in a flow rate between 120% and 100% in the main steam lines. Manual closure of the MSIVs will be necessary. NNECO calculated that such a change would result in a total increase in the core melt frequency of 1.4 x 10-7/ year (less than a 0.02% increase). The NRC contractor's review of this issue (Reference 22) also concluded that the project would result in a slight increase to public risk. o Personnel Safety: This proposed modification entails a setpoint adjustment rather than any hardware changes. As such, there would be no impact on plant activities or personnel safety. i o Economic Performance: Implementation of this project would contribute to an overall higher capacity factor for Millstone Unit No. I by eliminating the need to reduce reactor power 10% on a weekly basis, o Personnel Productivity: This proposal involves only a setpoint 4, recalibration. As such, there would be no impact on surveillance and generally no impact on personnel productivity. O
e 3-185 ISAP Topic No. 2.05 '- Hydrogen Water Chemistry Study Reference 81 Proposed Action ! BWRs have exhibited cracking in austenitic stainless steel due to intergranular stress corrosion cracking (IGSCC). In Reference 81, NNECO proposed to study the feasibility of altering the primary water chemistry at Millstone Unit i by injecting hydrogen into feedwater. Addition of hydrogen into the primary coolant systems of BWRs has been found to be an effective method of reducing I IGSCC in BWR primary piping systems. ISAP Topic No. 2.05 encompasses this NNECO proposal. 4 The specific proposed NNECO project consists of two phases: a pre-implementation test to determine the plant's response to operation on hydrogen ! water chemistry, and pending the outcome of the pre-implementation test, evaluation of a permanent hydrogen injection system. , The pre-implementation test will provide the necessary plant-specific data needed for NNECO to implement a properly functioning, permanent hydrogen ) water chemistry system at Millstone Unit No.1. Without the information provided by a pre-implementation test, hydrogen injection could be ineffective in ), the prevention of IGSCC. a i
3-186 ( A preliminary ISAP evaluation of the proposed project is provided below. Evaluation o Public Safety: The presence of free oxygen in the primary coolant has been related to IGSCC. Hydrogen water chemistry involves adding hydro 6en gas to the feedwater system to suppress oxygen formation in the core. To ensure the removal of excessive hydrogen and to control the concentration of non-condensible gases, oxygen gas is added at the recombiners. Implementation of hydrogen water chemistry would therefore require two new process gas subsystems for the plant: a hydrogen injection system and an oxygen injection system. NNECO's preliminary analysis shows that implementation of hydrogen water chemistry would result in a significant increase of radioactive Nitrogen-16 (N-16) concentration in the steam lines. The main steam line high-high radiation trip setpoints would have to be adjusted whenever hydrogen water chemistry is initiated to account for the increased background. Failure to correctly adjust the setpoint is assumed to result in reactor trip on high-high radiation in the main steam line. This results in . an increase in the frequency in reactor transient with the main condenser unavailable initiating event and a corresponding increase in core melt frequency of approximately 5.0 x 10-6/ year. The hydrogen injection and oxygen injection subsystems would also increase the potential risk due to fires and explosions at the plant. However, implementation of a hydrogen water chemistry program is assumed to be i
, ,. - .-.,-----, -....-- ..-. - . - , - , - - , . ~ . - - . - - - - . - - - - - _ . . . _ _ , - - . - - ~ - . , . - . - _ . - . . _ . .
_- - = . - - - - - 3-187 O Q accompanied by installation of appropriate safeguards to minimize the fire !~ and explosion risks (such as hydrogen monitors, excess flow safety valves, I ~ e tc.). Therefore, the change in fire and explosion risk would be negligible compared to the present fire induced core melt frequency. Finally, Millstone Unit No. I currently employs an extensive primary system inspection and repair program to monitor and limit IGSCC. This > laspection and repair program is sufficient to assure that IGSCC does not represent an immediate safety concern. o Personnel Safety: In order to utilize the proposed system, hydrogen would t be trucked to the plant in large quantitles, increasing industrial risk. In addition, the increase in hydrogen associated with the proposed project would increase the concentration of N-16 in the steam, causing an increase l In personnel exposure. However, negating the need for one pipe ) replacement job through the use of hydrogen water chemistry would
- compensate for the higher personnel exposure due to the increased N-16.
- o Economic Performance
- The proposed action would completely inhibit l
l IGSCC growth if the target water chemistry goal is met. Therefore, implementation would prevent future outages or extended refueling outages associated with IGSCC in the RCS and ECCS piping. Based upon this experience, NNECO calculated that the proposed action would result 4 ( in a small positive impact on economic performance. ) I t o Personnel Productivity: The extensive new equipment associated with the hydrogen water chemistry proposal would require additional maintenance, I l
3-188
/ testing, training, calibration, and surveillance.
V] NNECO therefore calculated a decrease in personnel productivity. The avoidance of future replacement of reactor vessel internals or piping was not evaluated. Such avoidance could conceivably contribute to a positive impact in this category. Note: At the present time, NNECO is preparing to carry out a pre-implementation test. As such, the analyses noted above are based on engineering judgment. Upon completion of the pre-implementation test and acquisition of plant-specific data, a comprehensive evaluation of this issue will be undertaken. This evaluation will be performed to weigh the costs of installing a permanent j hydrogen water chemistry system with the associated shic! ding against the savings resulting from reduced in-service inspection requirements and IGSCC repairs. 6 i i j j-l
3-189 ISAP Topic No. 2.06 - Condenser Retube J References 27,81 i i Proposed Action ISAP Topic No. 2.06 addresses the possibility of completely retubing the Millstone Unit No. I main condenser. A major aspect of the retubing effort would be to change the condenser tube material from the 70/30 copper / nickel alloy presently in use to titanium tubing. Tubing made of a 70/30 copper / nickel alloy is susceptible to erosion and corrosion problems caused by seawater. This degradation necessitates periodic tube repairs. Continued degradation could cause a decrease in plant reliability and availability. Titanium tubing is not susceptible to the erosion and corrosion mechanisms. However, it is substantially more expensive and has a lower heat transfer coefficient requiring approximately 10 % more tubing to achieve equal l condensing capability. In Reference 81, NNECO proposed to evaluate the proposed project. Evaluation o Public Safety: In Reference 27, NNECO provided the NRC Staff with the Q results of its probabilistic analysis of this proposed project. NNECO O utilized the PSS to determine the sensitivity of the core melt frequency to
3-190
-[ condenser unavailability due to seawater intrusion. NNECO concluded that the proposed action would result in a 0.74% decrease in core melt frequency (from 3.07 x 10-4/ year to 8.13 x 10-4/ year).
Condenser tube failures of significant magnitude can pose a safety concern due to the fact that they result in high feedwater conductivity. The above public safety benefit from retubing the main condenser results because beawater intrusion from tube leakage can lead to a situation in which the feedwater and main condenser must be isolated by manually closing the MSIVs after high conductivity is alarmed. The PSS showed that the main condenser is an important long-term decay heat removal system, and that unavailability of long-term decay heat removal systems accounted for 64% of the predicted core melt frequency. At the present time the Millstone Unit No.1 PSS core melt frequency is being requantified. For further details, see Section 1.4 of this report. 1 } The major concern is that if the main condenser has been isolated due to i j high conductivity, and back-up decay heat removal systems become l unavailable, it may not be possible to reopen the MSIVs and go back to the [ main condenser. o Personnel Safety: This project would replace the 70/30 copper / nickel alloy 1
- tube that is susceptible to erosion and corrosion problems caused by sea water. In the past, many manhours and man-rem were associated with repair of existing condenser tubes. Replacing these tubes with titanium l tubes would reduce manhours and man-rems on these activities. Therefore, i
f F
. - . - - --. - _ - - - - - - ...--- _ -~ _ .-. -- - . _ _ . - - - - - - - ~ - --
3-191
& 1 this project would have a medium positive effect on occupational exposure and industrial risk.
o Economic Performance: This proposed action would have a positive effect on economic performance. Titanium replacement tubes would eliminate condenser tube failures and, therefore, increase the equivalent availability of full power operation. In addition, the titanium replacement tubes would result in a reduction in maintenance and testing costs, personnel radiation exposures during maintenance and cleaning, and improved water chemistry l and less intrusion of foreign material in the RCS. Finally, titanium tubes have a longer life expectancy than other tubes. Use of any material except titanium will require another retubing befor; the end of the remaining useful life of Millstone Unit No.1, thereby negatively impacting plant availability. 1 o Personnel Productivity: This modification would have a significant positive 4 effect on plant productivity. The modification would result in decreased condenser maintenance and fewer repairs of tube leaks during operation. In addition, titanium tubes would result in fewer radwaste shipments of resin. f O V
3-192 O ISAP Topic No. 2.07 - Sodium Hypochlorite System b References 1 22,27,81 Proposed Action ISAP Topic No. 2.07 addresses concerns surrounding the use and on-site storage of liquid chlorine. Previously, liquid chlorine was used as the means of marine biofouling control at Millstone Unit No.1. Liquid chlorine was stored on-site in 55-ton rail tank cars and transported via an underground double pipe to the plant's intake structure where it is vaporized for injection into individual cooling b) (, water systems. The potential existed for a catastrophic failure of a tank car and subsequent chlorine release, significantly impacting both plant personnel and the public surrounding the plant. To prevent such an accident, NNECO proposed, in Reference 81, to replace the then existing chlorine system with an on-site bulk storage and distribution system of sodium hypochlorite. Sodium hypochlorite represents a minimal safety hazard. In Reference 27, NNECO provided the NRC Staff with its evaluation of this proposal. In addition, the NRC contractor, in Reference 22, identified this issue as a significant safety matter, The removal of the chlorine tank car has been completed. NNECO is presently Installing the sodium hypochlorite system. O
3-193 Evaluation o Public Safety: In Reference 27, NNECO cencluded that this modification will result in a large decrease in risk to the general public living around the plant by:
- a. Eliminating the risk of a chlorine-leak accident which could injure or disable plant personnel and thereby prevent the plant from being operated in a safe manner; and
- b. Eliminating the risk of direct exposure of the public to poisonous gas during a chlorine-leak accident.
Of these two potential benefits, NNECO calculated the latter to be the more significant. There is a large public benefit of the modification due to eliminating the direct impact of catastrophic or continuous intermediate releases of chlorine gas. The dominant source of risk is the intermediate continuous release of chlorine from the tank car caused by premature opening of the tank car over-pressure relief valve. NNECO calculated an equivalent exposure for both the catastrophic chlorine release and the intermediate continuous release. With respect to a chlorine induced core melt accident, NNECO found the potential benefit of the modification to be insignificant. The calculated probability of core mcit due to chlorine release is 9.22 x 10-7/ year. O
3-194 o Personnel Safety: This project would have a large positive impact on personnel safety. Storage on-site of liquid chlorine in 55-ton rail tank cars represents a significant industrial risk. In the past, as a result of a small L.akase (less than one gallon), this system sent over 15 people to the hospital. Industrial history has also shown that tank failures can injure many people. The failure of the 55-ton rail tank car at Millstone could potentially affect everyone on-site. o Economic Performance: Eliminating liquid chlorine from the Millstone site would slightly increase calculated economic performance. A sudden , release of liquid chlorine would result in costly lost power and public liability. In addition, the modification would allow maintenance and operation personnel to perform required systems repair and surveillance without the extensive precautions presently needed to work with chlorine gas. Finally, the modification would eliminate the need for costly modifications required to isolate and protect the control room from a chlorine release (see ISAP Topic No.1.12). o Personnel Productivity: This proposal would have a positive impact on personnel productivity. The present chlorinators and feed system require extensive maintenance. The proposed sodium hypochlorite system is simpler and would require less maintenance and chemistry personnel time. O
3-195 A I ISAP Topic No. 2.08 - Extraction Steam Piping References l 22,85,86 Proposed Action ISAP Topic No. 2.08 addresses the on-going replacement of extraction steam piping at Millstone Unit No.1. This project has its origins in the fact that the nuclear industry has noted a number of cases of severe erosion and failures of extraction steam piping. Additionally, NNECO undertook extensive inspections of Millstone Unit No. I to determine if steam piping erosion was occurring. As a result, NNECO found that the eighth, ninth and eleventh stages of extraction steam piping (from the low pressure turbine) had noticeable degradation and needed to be replaced. Also, the high pressure heaters extraction steam piping (from the high pressure turbine) needed to be replaced. As reported in Reference 85, NNECO initiated a project at Millstone Unit No. I to replace this extraction steam piping to prevent further erosion. Evaluation o Public Safety: NNECO provided the NRC Staff with an analysis of the public safety implications of this project in Reference 86. NNECO concluded that the extraction steam pipe replacement would s!!ghtly decrease public risk.
3-196 Based on industry experience, severe erosion of extraction steam piping can result in pipe ruptures as well as steam leaks. In the event of a pipe rupture, the MSIV would automatically isolate the main steam lines from the down-stream pipe rupture. In so doing, the main condenser is lost as a decay heat removal system. This increases the initiating event frequency for MSIV closures and pipe break outside of containment. Thus, NNECO concluded that this project provides two potential safety benefits:
- a. reduction in the likelihood of a steam pipe rupture outside of containment; and
- b. reduction in the likelihood of a MSIV closure event.
NNECO evaluated each of the potential benefits separately. Based upon i its sensitivity analyses, NNECO concluded that the former potential benefit is neg!!gible given the available options and the time available for the operator to take manual actions from the control room. However, in I the case of the latter potential benefit, NNECO calculated a 2.7% reduction in core melt frequency, from 8.29 x 10-4/ year to 8.07 x 10-4/ year. The NRC contractor's review of this issue (Reference 22) also noted that implementation of the project would result in a positive benefit to public safety. o Personnel Safety: This project will have a medium positive effect on industrial safety. Replacement of eroded extraction steam piping is considered by NNECO to be necessary to preclude injury to plant personnel
3-197 rm which could result from steam leakage. Industrial experience shows that (] failure of this piping can happen without warning and can cause serious steam burns. o Economic Performance: This project will have a positive impact on plant availability. The project insures that the plant does not have to be removed from service to repair or replace degraded piping, or following a break in the piping. Although there will be a negative one-time impact attributable to the replacement project, NNECO calculated that this negative impact will be more than offset by the positive impact of outage averted. Moreover, the replacement project can be performed during refueling outages. If the piping is not replaced, a failure cannot be expected to coincide with a refueling outage. o Personnel Productivity: Completion of this project will have a small positive impact on personnel productivity. With large portions of piping already replaced, maintenance activities have already decreased. However, at the present time the impact is minimal. As the remaining piping continues to erode and degrade, maintenance activities will correspondingly increase. The impact of the project will be proportionately greater. O
3-198 ISAP Topic No. 2.09 - ilparading of P&lDs Reference 87 Proposed Action ISAP Topic No. 2.09 addresses NNECO's on-going project to upgrade the piping and instrumentation diagrams (P&lDs) for M111 stone Unit No.1. The planned effort, described in Reference 87, represents a complete upgrading of current plant information to make it consistent and more legible and retrievable. The effort is expected to be a long-term project (4 - 5 years). This project is being done concurrently with the FSAR update (see ISAP Topic No.1.15). The P&lDs are used by the technical staff in the design process or by operational and maintenance personnelin the conduct of their respective duties. As a result of such widespread usage, NNECO has recognized that some of the Millstone Unit No. 1 P&lDs contain errors. For example, some of the system configurations, valve line-ups and high and low pressure piping boundaries are incorrectly shown. As a result, the concern evaluated under this ISAP topic is that an inappropriate decision could be made or endorsed based on incorrect information obtained from the P&lDs. For instance, hypothetically, maintenance personnel could isolate a piping system at an inappropriate location based on an incorrectly shown low to high pressure piping boundary and create the potential for a leak or pipe rupture. Also, because operational personnel may use P&lDs during an accident to devise recovery of a system, a procedure for ad-hoc i
3-199 recovery could be incorrect if the inforrnation presented in a P&lD is not Correct. Evaluation o Public Safety: NNECO subjectively assessed this project and concluded that it has negligible public safety impact.' The potential public safety effect of using inaccurate information from the P&lDs to make design modifications is insignificant. The P&lDs are most frequently used to make preliminary design changes only. Before the design is finalized, a walk-down is usually performed. Therefore, any design change error, based on incorrect information from the P&lDs, will be detected and corrected at that time. The potential public safety impact of this project on operational and maintenance personnel is also small. Operational and maintenance personnel are intimately familiar with the as-built configuration of the plant. Any error in the system configuration as shown by the current P&lDs will generally be apparent to them. Although highly unlikely, it is conceivable that an incorrectly shown configuration could result in a maintenance error or unsuccessful recovery of a system during an accident. s in these cases the project may provide some slight benefit. o Personnel Safety: This project will have an Indirect positive impact on personnel safety. Currently, in many cases, systems must be walked down to verify as-built conditions. Some of the systems are in radiation areas;
3-200 others are not readily accessible. As a result, potential occupational J exposures and industrial risks have been increased. The project will eliminate that factor. o Economic Performance: Based upon a subjective analysis, NNECO concluded that this project may have an impact on power generation maintenance and therefore power generation availability. For example, upgrading the P&lDs could improve the engineering of a plant change, such
- that during an outage the mean time to restore a system is decreased.
4
- However, NNECO estimated that the impact of this project on power 1
generation availability is m*nimal. 1 , o Personnel Productivity: This project provides a small benefit in this category. For example, a specific component may currently be identified by three different numbers, depending on whether the drawing originated with the NSSS vendor, the architect-engineer, or within NU. The benefit of upgrading the P&lDs is that existing information will be consolidated j into a single accessible base of information. Such a change will increase the efficiency in what may be broadly termed the backfit design and day-to-day engineering of the plant (i.e., plant design changes, maintenance and troubleshooting), by cutting down the time needed to chase down/ confirm l Information. O
m f a 3-201 r ISAP Topic No. 2.10 - Drywell Ventilation System Reference F - 81 = Proposed Action { During the 1982 refueling outage, cleaning and maintenance was performed on na the eight drywell ventilation units and associated duct-work in an attempt to reverse a trend of increasing drywell air temperature. Following the cleaning and maintenance activities, testing was performed to compare the actual _ capacity and design capacity for each unit. This testing Indicated that a majority of the coolers were still operating significantly below their design capacity. The resultant elevated drywell temperatures could result in premature k equipment degradation and could adversely impact many of the avisting evaluations related to equipment qualification. Equipment aging calculations would be most directly affected. ISAP Topic No. 2.10 addresses NNECO's engineering evaluation of drywell air circulation patterns, ventilation duct-work and coil cooling water systems to determine the most cost-effective methods for minimizing temperature " hot { spots" and for improving ai circulation. It is expected that modifications to the drywell ventilation system will result in an increase in plant reliability by slowing the rate of degradation of equipment located in the drywell and will have ~ _ a positive effect on environmental qualification of equipment located in the drywell. r
3-202 O Evaluation o Public Safety: NNECO concludes that this project, if implemented, would have a negligible positive impact on core melt frequency. 4 The Millstone Unit No.1 PSS addressed the availability of drywell coolers both while the plant is at power and post-trip. Based on operating experience, it was determined that a loss of drywell coolers resulted in a gradual increase in drywell temperature (less than 10F/ minute). The heat-up of the drywell therefore requires many hours before the drywell temperature exceeds the drywell equipment environmental qualification, and before manual depressurization is required. The short-term effect of I loss of drywell space coolers on plant transients was found to be negligible. The proposed review, if specific projects are identified and implemented, could improve drywell bulk temperature during operation and post-trip, but would have negligible impact on core melt frequency and public safety. o Personnel Safety: This project would have a positive impact on personnel safety only to the extent that modifications reduce premature equipment , degradation and thereby reduce equipment failures. A reduction in equipment failures would reduce stay time in radiation areas and would reduce the frequency of industrial injury. o Economic Performance: NNECO concluded that improvements resulting in cooler drywell temperature would have a small positive impact on plant
.~
3-203 o d economic performance. This impact would predominantly result from reducing containment ventilation and coeling failures that result in a plant shutdown for repairs. Other qualitative benefits from cooler drywell atmosphere would be in terms of preventing premature equipment degradation which could adversely impact many existing equipment qualification evaluations. o Persor.r.el Productivity: This project would have a small positive impact in this category. To the extent the modifications result in more efficient and more easily cleaned coolers, and to the extent the modifications result in reducing premature aging of equipment, there would be a small decrease in the amount of maintenance required in a hot, radiological area. O
3-204 p) g ISAP Topic No. 2.11 - Stud Tensioners O Reference 85 Proposed Action ISAP Topic No. 2.11 addresses replacement of the manual vessel-head stud tensioners with an automated system. NNECO proposed this project in Reference 85 as a means to decrease the duration of refueling outages and reduce radiation exposure. O The stud tensioner is used to remove and install the reactor vessel head during refueling outages. With the existing system at Millstone Unit No.1, the studs that connect the heaa to the vessel are manually threaded onto the studs and stressed by a mechanical tensioning device. This is a slow process. The proposed project will make use of a quick disconnect tensioner which can simply be clamped on the studs. The new quick disconnect tensioners will center automatically on the individual studs and will utilize a hydraulic system to tension the studs. l Evaluation l l o Public Safety: This modification would have no impact on pub!!c safety. ) l O Like the existing mechanical tensioner, the proposed hydraulic tensioner (_ l would be capable of over or under stressing the studs, thereby creating the )
3-205 potential for a leak. However, the hydraulic tensioner will not alter the existing probability of a leak due to over or under stressing the studs. Embedded in each stud is an elongation measuring rod, which can measure stud elongation up to a 0.1 mill. The elongation measuring rod will be used in conjunction with either the mechanical tensioner (existing system) or the hydraulic tensioner (proposed system) to determine stud elongation during tensioning. Moreover, if a leak did occur, it would be detected during drywell inspection conducted when the primary system is pressurized to 1,000 psig. o Personnel Safety: This proposal would have a medium positive impact on personnel safety. The project would reduce manpower necessary to perform the relevant work. A reduction in manpower results in a decrease in stay time and therefore the occupational exposure. The project would also result in a slight decrease in industrial risk. o Economic Performance: New stud tensioners would impact the duration of refueling outages and any unplanned outages that require reactor vessel-head removal. According to NNECO estimates, the proposed stud tensioners would result in a large economic benefit by resulting in an approximate 12-hour decrease in the duration of a refueling outage. NNECO's further quantitative analysis of this topic also demonstrated an increase in plant availability due to the increased efficiency in head movement during a refueling outage. O
l 1 l 3-206 .i o Personnel Productivity: This modification would increase personnel productivity by decreasing the time necessary for maintenance personnel to tension /detension the reactor head studs. This work is done in a harsh I 1 environment. t O ( O
3-207 /' ISAP Topic No. 2.12 - Reactor Vessel-Head Stand Relocation Reference 85 Proposed Action In 1975, the Millstone Unit No. I reactor building crane was modified to provide redundant lift capability. This modification included the installation of a new trolley, with a redundant crane hook, which limited the travel of the crane with respect to the refueling area floor. As a result of this modification, the centerline of the reactor vessel-head stand cannot be lined up with the O Q centerline of the crane. The present method of replacing the reactor vessel head utilizes a chain-fall and a lift pad bolted to the south wall of the reactor building, allowing personnel to drift the vessel head into position on the vessel-head stand. Utilizing this method to locate the vessel head could result in damage to the vessel head or personnel injury if either the chain-fall or lift pad fails. As a result, as proposed in Reference 35, NNECO is evaluating the feasibility of relocating the centerline of the reactor vessel-head stand to line up the centerlines of the crane and vessel-head stand. ISAP Topic No. 2.12 encompasses this proposed action by NNECO. The proposed modifications, as 1 designed, address the provisions of NUREG-0612," Control of Heavy Loads." l O
3-208 Evaluation o Public Safety: The only time the reactor head is removed from the vessel and placed on the stand is during a refueling outage. Relocation of the head stand would not alter the present load handling operation except for. eliminating the need to drift the reactor head onto the stand. Because of this, and the fact that the reactor is in cold shutdown during refueling, NNECO concluded that the proposed project cannot affect core melt frequency. Accordingly, there would be no change in public risk due to implementation of this project. o Personnel Safetyt This project would have a medium positive effect on personnel safety. By eliminating the current practice of manually drifting the reactor head onto the stand, the potential for a major injury is decreased. The proposal would also decrease the time necessary to locate the vessel head, thereby further reducing industrial risk. The project would not significantly alter occupational exposure. o Economic Performance: Based on an analysis of the impact of head stand relocation on plant performance, this project represents a small positive impact in this category. This impact would be primarily due to the time saved in reactor-head movement during a refueling outage. An additional negligible positive impact would result from averting an extended outage due to vessel-head damage resulting from chain-fall or lift pad failure. This latter scenario, however, is not significant. NNECO utilized an h) assumption that the likelihood of vessel-head damage from the reactor head striking the reactor-head stand is less the.n 10-3
3-209 j o Personnel Productivity: This proposed modification would reduce the time necessary for maintenance personnel to lift and land the vessel during the refueling outage. Therefore, there would be a slight positive impact in this category. I i i I f
i 3-210 ISAP Topic No. 2.13 - Turbine Water Induction Modifications ISAP Topic No. 2.19 - DC System Review I Reference l l 88 Proposed Action i As noted in Reference 88, NNECO-initiated ISAP Topics 2.13 and 2.19 have been cancelled. Thus, these topics are not being evaluated within the framework of l ISAP. s/ Topic No. 2.13 was to address changes to the low pressure heater drain lines. The analysis indicated that no modifications were necessary. Topic No. 2.19 was incorporated into an evaluation of NUSOER 84-04 which was to evaluate the DC system. As a result of this study, DC system procedures were revised. Training on the new procedures will be conducted upon formalization of the revised procedures. J O
* - , y. . ,.,-----.#- - . , - - - - , . . - - - ,--,,m ,. - .- -. -.-- --, - - - , ,, - . - . --m- - - - . - --.- - - - , - . - - - - - - . - . - - - , - - --- - , - , - , - . --
3-211 ISAP Topic No. 2.14 - Evaluation and Implementation of NUREG-0577 References 13,89 Proposed Action ISAP Topic No. 2.14 originally addressed the action plan of NUREG-0577,
" Potential for Low Fracture Toughness and Lamellar Tearing in PWR Steam Generators and Reactor Coolant Pump Supports," issued for comment by the NRC Staff in November 1979. However, as noted in Reference 89, the Staff published NUREG-0577, Revision 1, in October 1983. In Revision 1 the scope of O the action plan was no longer applicable to BWRs. Therefore, operating BWRs such as Millstone Unit No. I are not subject to the provisions of NUREG-0577.
Based upon this information, this topic is no longer being evaluated within the context of ISAP. J
3-212 [] U ISAP Topic No. 2.15 - Torque Switch Evaluations for MOVs Reference 89,90 Proposed Action On February 21, 1984, the NRC issued I&E Information Notice 84-10, " Motor-Operated Valve Torque Switches Set Below the Manufacturer's Recommended i Value" to notify all licensees of a recent related experience of GPU Nuclear Corporation. Specifically, GPU Nuclear determined that a number of torque switches had been improperly set. Based on the Information Notice, as described in Reference 89, NNECO initiated ISAP Topic No. 2.15 to investigate all Millstone Unit No. I safety-related MOVs to determine if their existing torque switch setpoints are within the manufacturer's recommended setpoint range. NNECO also intends to develop an inspection procedure for use in monitoring MOV torque switch setpoints during refueling outages. Subsequently, the scope of this issue has shifted slightly to encompass NNECO's response to IE Bulletin 85-03 for Millstone Unit No. 1. The response (Reference 90) is described in detail in Section 4.3 of this report. To summarize, the proposed project for Millstone Unit No. I now specifically includes a program to achieve the following:
, f s o Proper switch settings for each safety-related motor-operated valve
(' will be defined;
3-2i3 O o As a result of the above, individual switch settings on each MOV shall be changed as appropriate and each valve will be demonstrated operable; o Inspection procedures will be prepared or revised to ensure that correct switch settings are determined and maintained throughout the life of the plant. ., The review conducted as part of this project is expected to result in increased assurance of proper operation of safety-related motor-operated valves during postulated accident conditions. Further, the development of an inspection procedure for use during future refueling outages will provide additional assurance that torque switch setpoints are maintained at appropriate values. 4 O
l 3-214 ISAP Topic No. 2.16 - Reactor Protection Trip System 4 L Reference 82 j , Proposed Action Historically, at Millstone Unit No.1, the reactor protection system (RPS) has demonstrated setpoint drift problems which have led to difficulties in maintaining setpoint calibration and accuracy. As described in Reference 82, NNECO initiated ISAP Topic No. 2.16 to: O V a. Investigate possible replacement of the 120-second automatic depressurization system (ADS) timer with a current state-of-the-art timer circuit, to alleviate the RPS setpoint drift problem; and
- b. Remove two low reactor pressure permissive switches (PS 54A and B) from the ECCS pump start logic to allow ECCS pump start on either high drywell pressure or low-low water level, and automatic ADS actuation when required.
Evaluation o Public Safety: The 120-second ADS timer would provide a delay in automatic opening of the four safety relief valves upon a high drywell pressure and low-low water level signal. The time delay is intended to
- - - , -,,y-- - - - - ~ - - , _ , . -
- ~ . - . . - - - - _ _ . _ _ _ _
3-215 allow FWCI to restore reactor vessel water level in the event of a small LOCA. NNECO's probabilistic assessment of the issue involved determining whether the current ADS timer's accuracy of 110% impacts public safety. NNECO determined that if the setpoint drifts in the positive ! direction, the reactor vessel temperature would increase, but not to the point of core melt before ECCS injection occurs. If the set point drifts in the negative direction, ECCS injection would start earlier, lessening the severity of the accident. There would also still be enough time for FWCI to restore reactor vessel level, if possible. Thus, replacement of the 120-4 second ADS timer would not affect core melt frequency. Replacement of
- the present 120-second ADS time with a more accurate state-of-the-art timer circuit, however, would deterministically reduce the risk of operation of the ADS outside of operating setpoint guidelines.
Removal of the two low reactor pressure permissive switches would alleviate potential safety impact problems due to their 120 psig drift. i NNECO calculated, however, that the modifications would result in no significant change in core melt frequency. These switches allow ECCS l pump start on either high drywell pressure or low-low water level. An upwards drif t allows the ECCS pumps to start sooner. A maximum downward drift delays ECCS cooling, but does not result in an increase in l drywell temperature large enough to cause a core melt. NNECO additionally concludes that removal of these switches would make manual depressurization of the reactor (per the EOPs) easier in that the ECCS pumps would already be running when the EOPs direct the operator to manually depressurize the RCS. r ~ w---- - - - ,w- ,,--w,-
3-216 o Personnel Safety: These modifications involve circuitry changes. As such, they would not alter plant activities and therefore would not affect-occupationa! exposure or industrial risk. o Econo.aic Performance: Based upon NNECO's evaluation of this topic, the proposed modifications are not expected to impact plant performance. . First, the equipment involved has historically not been significant to plant performance. Second, the existing equipment is already of comparably high reliability from a plant performance point of view. i o Personnel Productivity: The proposed modifications to eliminate setpoint drift would decrease time spent for maintenance and calibration. However, the overall time involved is considered to be minimal. O l l l l l l l l l O
3-217 fj ISAP Topic No. 2.17 - 4.16 kV,480 V and 125 VDC Plant Distribution Protection G Reference 91 Proposed Action As part of NNECO's Appendix R re-review completed in early 1985, NNECO updated the Breaker Coordination Study to ensure that the power supplies for components required for safe shutdown in the event of an Appendix R-type fire would be available, despite the failure of circuits not required for safe shutdown. Based on the results of the Breaker Coordination Study, NNECO initiated ISAP ( Topic No. 2.17 as described in Reference 91. Specifically, in Reference 91, NNECO provided the NRC Staff with the scope of an extensive review of the 4.16 kV, 480 V and 125 VDC plant distribution systems. This review exceeds the scope of work associated with the Breaker Coordination Study performed as part of the Appendix R review. The review being conducted is expected to verify the existing design adequacy of the l ! 4.16 kV, 480 V and 125 VDC plant protection systems. An additional benefit l l provided by the evaluation will be an expected increase in the overall reliability t of these protective systems. This project (the review) is currently on-going and is scheduled to be completed during the 1987 refueling outage. The implementation date of any modification identified will be in accordance with 10CFR50.48.
3-218 (m Evaluation a p@lic Safety: Based on a comparison with other Appendix R projects, this project (the review being conducted) was subjectively scored to have a small positive impact on reducing public risk. Similar studies for other electrical system devices have resulted in valuable engineering insights relative to increased reliability of protective devices and to risk reduction. o Personnel Safety: Any changes resulting from the review will not alter the plant activities that affect occupational exposure or industrial risk. Therefore, personnel safety is not affected by this topic, s o Economic Performance: This project is a verification study for which the results cannot be predicted. No hardware changes or deficiencies have yet been identified. Until changes and/or deficiencies are identified, the plant is assumed to be adequately designed. The current upgrading of existing plant documentation is not expected to have any significant impact on plant performance. o Personnel Productivity: No specific changes have been identified. Thus, no impact on productivity is expected. However, if reliability is increased, then maintenance would be correspondingly decreased. O
3-219 1 l O V ISAP Topic No. 2.18 - Spent Fuel Pool Storage Racks / Transportation Cask i I Reference 1 88 Proposed Action Under the Nuclear Waste Policy Act of 1982, it is the responsibility of industry to provide interim storage for its spent fuel until long-term spent fuel storage becomes available. At Millstone Unit No.1, if the spent fuel storage capacity is not increased, full-core reserve capacity will be lost in 1987 and reload discharge capability will be lost in 1991. O 'd Loss of full-core reserve could reduce the options available for fuel storage and possibly impact maintenance operations during a scheduled or unscheduled shutdown. Reload discharge capability is necessary to provide the unit with enough spent fuel storage to discharge the spent fuel from each cycle. Loss of this capability could prevent the unit from returning to service. As indicated in Reference 88, NNECO is currently evaluating several options to enable Millstone Unit No. I to maintain su'ficient spent fuel storage capacity to safely discharge spent fuel through the end of its design lifetime. ISAP Topic No. 2.18 encompasses this NNECO effort.
~ - _ . .- -. -.
3-220 Evaluation o Public Safety: NNECO estimates this topic to have no impact on public risk. Until the specific method for extending the spent fuel capacity at Millstone Unit No.1 is selected, potential change in risk to the public cannot be determined. The core melt frequency as determined by the PSS w'ould be unaffected. o Personnel Safety: The ongoing study has no effect on personnel safety. Likewise, the ultimate addition of storage space would have no significant
; effect on existing plant activities. Thus, there will be no change in occupational exposure or industrial risk.
o Economic Performance: Ultimately, in order to operate Millstone Unit No. I to the end of the current operating license, NNECO must resolve the issue of providing additional spent fuel storage capacity. It is readily obvious, therefore, that this topic significantly affects the power generation process and plant performance. For ranking purposes, NNECO has quantified the impact of the issue for both the short- and long-term phases of the project. o Personnel Productivity: This topic is currently not expected to impact personnel productivity. The impact may be reevaluated if an alternative other than a rerack of the existing spent fuel pool (such as transoortation to Unit 3)is chosen. A rerack would not change the workload at the plant, i and therefore would not affect productivity.
3-221 7 'N1 ISAP Topic 2.20 - RWCU System Isolation Setpoint Reduction
>\ }
Re ference, 84 Proposed Action The RWCU system is important in minimizing the amount of radioactivity released to the environment in the unlikely event of an accident, and in keeping occupational doses low during normal operation by purifying the reactor coolant. (. Presently, the RWCU system is set to isolate on a low reactor vessel water level signal to prevent draining the reactor and uncovering fuel during a LOCA cent.
/^T tj A low reactor vessel water level will also result in a eactor scram.
In Reference 84, NNECO provided the NRC Staff with a description of a proposed project to lower the RWCU isolation setpoint to the low-low water level, in order to have the RWCU system available for decay-heat removal and reactor water clean-up following a reactor scram. Lowering the RWCU system isolation setpoint is also addressed in ISAP Topic No.1.43 (Water Hammer) as a means of providing system availability for reactor vessel fill. The proposed project under ISAP Topic No. 2.20 consists of two parts. First, it involves an evaluation of the feasibility of lowering the isolation setpoint. All potential radiological consequences and adverse equipment qualification impacts following a break in the RWCU piping with the reduced isolation setpoint would ! I be evaluated. Second, NNECO would evaluate alternative methods for detecting leakage from the RWCU system.
3-222 o i The proposed project is presently in the study phase. Therefore, the benefits or risks associated with reducing the RWCU system isolation setpoint must still be evaluated to determine the feasibility of such change. Further activity on this topic is warranted. Evaluation o Public Safety: NNECO has performed a probabilistic risk assessment of the public safety impact of the proposed reduction in the RWCU system isolation setpoint. NNECO's analysis shows that the proposed project would have a small benefit in terms of redundant leak detection in the RWCU, but an added safety risk from spurious isolation of the RWCU. No O, significant change in core melt frequency was determined in either U direction. The net impact on public safety would therefore be zero. Specifically, the Millstone Unit No.1 PSS addressed an interfacing systems LOCA in the RWCU low pressure piping. This analysis was reexamined to include the improved RWCU leak detection system. Hcwever, the existing core melt frequency due to an RWCU interfacing system LOCA is low (1.39 x 10-8/ year) and is dominated by the ability to isolate using the existing valves. Therefore, the addition of the leak detection system has negligible impact on RWCU interfacing system LOCA core melt frequency. Similarly, NNECO reexamined the core melt frequency due to breaks in the high pressure piping of the RWCU. The change in core melt frequency O from adding the leak detection system and changing to the low-low water V level setpoint was negligible (less than 5 x 10-9/yr). J
3-223 Finally, NNECO examined the isolation of the RWCU system due to a spurious signal from the leak detection system during power operation. Isolation of the RWCU in itself does not result in a reactor trip. However, an operator error in returning the system to service could result in a plant trip. Such a trip would most likely occur on low level and proceed the same as a reactor transient with main condenser available event. The estimated addition to the event frequency is small (1.3 x 104/ year) winpared to the base initiating event frequency (3.ll/ year). Therefore, the spurious isolation of the RWCU by the leak detection system would add a negligible risk to the plant. o Personnel Safety: Currently, the RWCU system is set to isolate on a low reactor water level signal. The low setpoint could result in a water hammer, causing the pipe to fail. I,owering the setpoint will help to prevent the reactor from overfilling and therefore reduce the risk of subsequent water hammer. This change would reduce both the occupational exposare and industrial risk associated with a failed pipe. L Therefore, the project would have a small positive impact on personnel safety. o Economic Performance: The lowering of the RWCU isolation setpoint and the installation of a RWCU pipe leak detection system, taken together, represent a small positive impact on plant performance. i First, isolation of the RWCU system is basically a safety-related function.
.I Therefore a change of isolation setpoint would not affect plant power generation. However, lowering the isolation setpoint would keep the 1
MNim EI l
3-224 q i,g RWCU more available during different modes of plant operation. This is very important in maintaining water purity and clarity. This result represents a small positive impact. Second, installation of an RWCU system pipe leak detection system is required to accompany the isolation setpoint reduction in order to minimize the radiological consequences of a RWCU pipe break and to minimize ponible damage to equipment in the reactor building by automatic isolation of the RWCU system prior to reactor low-low level. The impact of the installation of the leak detection system on plant performance would have two aspects. First, the addition would increase the likelihood of spurious actuation of the RWCU isolation. This would result in a small negative effect on plant performance. Second, the b detection of small leaks would eliminate the potential for the leak to become large, which in turn would cause power loss. Therefore, the total impact on plant performance of installation of a leak detection system would be a small positive gain. o Personnel Productivity: This project would provide a small positive impact on personnel productivity. Reducing the challenges for isolation of the system would reduce the maintenance on the system that often results i when the system isolates and/or is returned to service. This maintenance is generally in radiological areas which are also physically hot. I O
3-225 . [~') ISAP Topic No. 2.21 - 430 V Load Center Replacement of Oil-Filled Breakers LJ Reference 91 Proposed Action The over-current trip device is an integral part of the 480 V power circuit breakers. The function of the over-current trip device is to sense an over-current condition and initiate the breaker trip, if warranted, with a predetermined time delay. ISAP Topic No. 2.21 addresses a proposed project,
, which includes the engineering, design, procurement, and qualification of solid-state devices to replace the existing over-current trip device.
in Reference 91, NNECO provided the NRC Staff with a description of the condition and design of the existing over-current trip device at Millstone Unit No.1. At the time NNECO noted that the existing devices have worn with age and are of less than desirable reliability. In order to rectify this situation, NNECO proposed to replace the existing electro-mechanical devices with solid-state design devices which perform the same function as the old design with greater reliability and accuracy. NNECO expects replacement of the existing breaker trip devices to result in an improved level of confidence in the reliability of the safety-related systems served by these breakers. A side benefit resulting from the replacement of the electro-mechanical devices will be a decrease in the maintenance and repairs required on the over-current trip devices. O,
3-226 _ Evaluation o Public Safety: Removing the present oil filled trip devices and replacing them with new solid-state devices is expected to improve the reliability of safety-related . systems. A solid-state device will perform the same function as the old trip device but with greater accuracy. Thus, the current 480V power system design will be improved. 4 i NNECO performed a probabilistic assessment of the proposed project. The
- modification was determined to have no measurable impact on public safety. If the present electro-mechanical trip devices are replaced, the number of false breaker trips could be reduced. This would increase the reliability of the 480V electrical system to provide an uninterrupted supply i
of power to safety-related loads. However, the Millstone Unit No.1 PSS Identified breaker opening / closing failures as the dominant contributor to 480V power supply unavailability. The probability of false breaker trip is 4 approximately 5% or less of the probability for breakers failing to close. I Even if a breaker were to trip, it could subsequently be restored by the operator. Consequently, the probability that a breaker would remain open following false trip is negligible when compared to breaker closing faults. o Personnel Safety: This project will have a small positive effect on personnel safety. Replacement of the present oil-filled breakers with 1 solid-state devices will decrease the existing small possibility that the l breakers could cause a fire, thereby slightly reducing industrial risk. f I
. _ ~ . . . _ _ _-. . . - _ _ . . . , _ _ _ . . . . . - . - - - - . . . - _ _ _ - - - - _ . _ . _ . _ _ . _ - . _ _ _ - . _ _ . . _ . . . _ _ _ - , - . - _ . . _ . - . - .
3-227 O o Economic Performance: This project will prevent possible false breaker trips, and therefore will improve the reliability of the safety-related systems served by the breakers. However, review of plant outage reports indicates no power losses due to these breakers. Degradations generally are gradual, are detected during surveillance testing, and are repaired before causing any poter.tlal power loss. The replacement of the current trip devices will therefnre have no effect on plant availability. o Personnel Productivity: This project will have a positive impact on equipment maintainability due to a) ' increased breaker reliability and b) reduced time required for maintenance and repair. i
~ _ _ . _ . _ . .-- _ _____ _ _ _ . , _ _ _ _ _ . _ . . _ . - _ _ _ _ _ . _ _ .
3-228 (3 y v) ISAP Topic No. 2.22 - Control Rod Drive System Water Hammer Analysis References 13,85 Proposed Action ISAP Topic No. 2.22 addresses concerns related to the potential for water hammers occurring in the scram inlet lines of control rod drive (CRD) systems at BWRs. These concerns were disseminated to the licensees of BWRs through an unissued draft NRC I&E Bulletin. The draft bulletin would have required all operating BWR units to address CRD system hydraulic loads resulting from fast actuation of scram inlet valves under the worst case loading condition. As a result of the draft bulletin, the BWR Owners' Group (BWROG) formed a CRD Scram Valve Water Hammer Analysis Committee to address concerns on this matter. In Reference 85, NNECO stated that, based on the recommendations of the BWROG, it was evaluating water hammer loads in the CRD piping due to scram events. As noted in Reference 85, NNECO does not consider this issue to be a i safety concern at Millstone Unit No.1, because many scrams have occurred over the years with no evidence of CRD pipe motion or support damage. However, based on the recommendations of the BWROG Committee, NNECO is currently in the final phase of evaluating water hammer loads in the CRD piping N (generated due to scram events) to assure closure of this issue. (b
1 3-229 > m In Reference 13, the NRC Staff identified this issue as closed based on conclusions presented in GL 86-01, issued January 3,1986. In GL 86-01 the NRC Staff concluded that " water hammer is not considered a contributing factor in potential SDV pipe breaks." Nevertheless, because NNECO's analysis of this issue was in its final phase, NNECO considered the ongoing study under ISAP
)
Topic No. 2.22. Evaluation i o Public Safety: NNECO evaluated the public safety benefit of the ongoing project for Millstone Unit No. I to assess the water hammer loads in the CRD system resulting from scram events. NNECO concluded that this topic represents an analytical concern which is nog substantiated by - operating experience, either at Millstone Unit No. I or in the industry as a - whole. NNECO assigned a negligible subjective benefit to the project, related only to the fact that the project addresses the analytical concern. o Personnel Safety: This project does not affect personnel safety. Any modifications that would result from the project would be structural in nature and would not alter plant activities or increase surveillance. = o Economic Performance: The project is a study of the potential water hammer loads in the CRD system piping generated during scram. The study ensures that the water hammer loading is well within the design basis Ioadings a.nd will not cause any damage to the CRD piping. Damage could result in pipe break and contamination of the reactor building. - m- --s mai-
3-230 Not knowing the outcome of the study, NNECO assumed for the ISAP analysis the possibility of loads higher than the original design load. In that case, the project would have a significant impact on potential plant availability. On the other hand, assuming the lines are currently adequately supported, the impact of the project would be zero. In sum, NNECO calculated an overall positive impact, with a wide range in potential impact depending on whether the outcome of the analysis shows that water h2mmer is or is not a problem. o Personnel Productivity: Any modifications that would result from this study / evaluation should be structural in nature and should not increase workload such as inspections and surveillances. Therefore there is no impact in this category. O
3-231 ISAP Topic No. 2.23 -Instrument, Service and Breathing Air Improvements Reference 81 Proposed Action ISAP Topic No. 2.23 addresses the station air systems for Millstone Unit No.1. The station air systems provide clean dry air for pneumatic controls. The air systems also provide utility air for pneumatic tools, filter systems, tanks, and emergency breathing air systems. As noted in Reference 81, this topic was initiated when NNECO proposed to perform an engineering review of the Millstone Unit No.1 instrument, service and breathing air systems to improve system reliability and integrity. NNECO's study has resulted in a series of recommendations for modifications to the air systems. These include:
- a. Replace existing instrument air dryers, instrument air prefilters and after filters.
- b. Install new 780 CFM oil-free compressor.
- c. Install new air receiver.
O V
- d. Install new back-up air dryer and filters on outlet of new receiver.
3-232 O e. Install 50 sin),le in-line filters at each branch off of the main header,
- f. Install pressure gauges upstream and downstream of each filter,
- g. Repipe air supply from the Sullair compressor to supply the service air receiver.
- h. Install coalescing filter on outlet of station air receiver.
- i. Run piping from instrument air header to new breathing air system.
- j. Install new dew-point monitor at the outlet of each dryer.
O k. Install flow meters in instrumentation and service air headers. Improvements to the station air systems will increase the reliability of air-operated equipment needed during both normal and emergency operating conditions. As a result, implementation of this project is expected to have a positive effect on plant reliability and safety. NNECO has evaluated the project for purposes of assigning a priority under ISAP Topic No. 2.23. Evaluation ' o Public Safety: The proposed air system modifications would provide a positive public safety benefit. O
3-233 Public safety concerns with the existing system involve the moisture content in instrument air and possible contamination of the air by desiccant particles or rust. This contamination could affect the operability of the MSIVs outside containment, the feedwater regulating valves, and the scram valves by causing them to stick. A potential common cause failure problem also exists. NNECO's evaluation of this topic involved reviewing the existing instrument air system. Problems with the air dryer system and the Sullair compressor have caused rust and desiccant contamination in the instrument air system. The air dryer system is inadequate in removing moisture in the air due to high maintenance unavailability. Moisture in the air causes the carbon steel piping to rust. In the past, instrument air demand has exceeded the dryer design flow, causing desiccant carry-over. The Sullair compressor's two filter stages are inadequately sized allowing moisture carry-over and oil vapor carry-over. The oil vapor coats the desiccant in the air dryer, decreasing the ability of the desiccant to absorb water vapor. NNECO also reviewed past valve problems due to particle contamination. There have been two known cases in the past 15 years of MSIV failure to close due to sticking. In another case, desiccant contamination was found in the feedwater controller during repair work following a failure of a feedwater valve. Similar problems have occurred involving the gas turbine and diesel generator air-operated valves. These problems increase over time, as rust and desiccant particles accumulate in the valves. O
3-234
- To assess the public risk of valve contamination due to rust and desiccant, NNECO performed a probabilistic assessment. NNECO evaluated a case in which the MSIVs are closed due to a low reactor pressure signal. The operator would try to restore the main condenser if the low reactor pressure is not the result of a steam line break. The restoration involves opening the MSIVs. A common cause failure of 4 out of 4 outboard MSIVs to open due to sticking is possible. (NNECO assumed a common cause failure rate of I x 10-3.) The change in the core melt frequency due to this common cause failure was quantified and converted into a potential public i
risk. The proposed project represents a significant public safety benefit, o Personnel Safety: The instrument and service air systems have historically required substantial maintenance. The increased activities increase the probability of personnel injuries. In addition, contaminants (including rust and desiccant) could degrade the air below OSHA Grade D breathing air specifications. This could cause equipment to fall causing injury. It also increases the probability of personnel contamination by breathing radioactivity or hydrocarbons. The proposed project therefore would have i a positive effect on personnel safety. 4 o Economic Performance: The proposed modifications would have a smali positive impact on plant availability, due to potential reduction in lost capacity caused by problems associated with the instrument air system. This positive impact would result principally from replacement of the present IR compressors with more reliable ones, and from replacement of air dryers, pre- and after-filters, and installation of additional in-line filters. The modification for breathing air would not affect plant availability.
3-235 o Personnel Productivity: The proposed modifications would decrease maintenance on the system. They would also improve the quality of air in the system. This in turn should decrease the maintenance on other components which use air. In sum, there would be a small positive impact on productivity of instrumentation and control and maintenance personnel. . l O f 9 O t _ .,__...,.,___.__._,,_,_-.,.._,..-.,..~.,.__,._._--...,_,.,___,,__.,..__.,,_._-,.-m.,,,.m.,,._._ ___,-.-,,--.... ., _.,,,.. _,._ , . .
3-236 ISAP Topic No. 2.24 - Off-Site Power Systems Reference 91
)
Proposed Action As part of a NNECO review of the designs of the off-site power systems for Millstone Unit Nos. I and 2, NNECO identified several areas of potential weakness. NNECO therefore identified means for improving off-site power system reliability, capacity and availability for Millstone Unit No.1. As noted in Reference 91, the remaining items applicable to Millstone Unit No. I are:
- a. Installation of a slow speed bus transfer scheme to afford plant personnel bcth an immediate and a delayed chance of reconnecting to the switchyard.
- b. Installation of a generator disconnect device (circuit breaker) for the Millstone Unit No. I main generator.
- ISAP Topic No. 2.24 encompasses these two proposed modifications.
Implementation of the first item could be useful on buses supplying pump motors by affording the plant a second opportunity to reconnect to the switchyard before transferring over to emergency power sources. In addition, the i moastication would improve plant reliability by allowing time for the pump i
g 3-237 motors to slow down to a point where a second attempt could be made to restart , the pump motor from the off-site supply. Implementation of the second item would enable plant personnel to keep the NSST transformer in service by backfeeding through the generator step-up transformer. In addition, the modification would further increase the plant's . reliability, because it would keep NSST in service for the majority of faults experienced by the main generator. Evaluation o Public Safety: This proposed project would significantly improve public safety. First, implementation of a slow speed bus transfer scheme would afford operators the second opportunity to reconnect to off-site power, following a reactor trip and before transferring over to emergency power sources. Currently, only the fast transfer is available to reconnect off-site power. A fast transfer will occur on a reactor / main generator trip that chaFgnges the breaker's that connect the 4,160V buses to both the NSST and RSST. The Milistone Unit No.1 PSS showed that there is some l probability for fast transfer failure to occur every time such a plant trip is experienced. Given a partial or complete failure of the fast transfer, there would be an accompanying loss of safety-related equipment which reduces i the chance of successful transient mitigation. l l Second, as discussed above, installation of a generator breaker would enable plant personnel to keep the NSST-1 transformer in-service by backfeeding through the GSU. Installation of a generator breaker
3-238 combined with a transfer scheme would lower the probability of losing safety-related equipment following a plant trip. NNECO has quantified the combined effect of the two modifications as a 4.62 x 10-5/ year reduction in core melt frequency, or a reduction of 5.7% in the total core melt frequency.
; o Personnel Safety: This project is intended to improve off-site power system reliability and would have no impact on plant personnel safety.
i o Economic Performance: NNECO evaluated three separate impacts on economic performance. First, the proposed modifications would improve the availability of off-site power to the plant electrical equipment. NNECO calculated, however, that the impact on plant equivalent availability is negligibly small. The slow-speed transfer scheme and the main generator circuit breaker only affect the means that the off-site i power can be used when the main generator is down. During such time the reactor may stay critical, but no power is generated. l Second, implementation of these modifications would reduce the potential for loss of power to m'itigating systems needed after turbine / reactor trip. This would indirectly impact plant availability through the potential impact on core damage probability. i
)
Third, installation of the generator breaker is an additidn to the plant ' hardware. Therefore it would have a negative impact on plant availability if the breaker sticks or spuriously falls. The spurious failure probability , and the effect of a stuck breaker are both estimated to be very small. i
/
1 3-239 Nevertheless, in total, NNECO concluded that this topic represents a small negative impact on plant availability. . \ o Personnel Productivity: The generator disconnect device proposed under this project would require periodic maintenance and testing by plant and production test personnel. Installation of a slow speed transfer scheme would also increase the workload associated with the relays and transfer equipment. Therefore, this topic represents a small negative Impact in this category. O U A E i s , O e o - , - - - . ,,,,,--,.a-n...---_--.-..-,.c -,--,.e---, ~,,- ~ , , , . - - , , , - . , , , , . - - - , ---,,--,---,,,-r--- - - - , - - , - , - - - - - . - --r,,
l 4 3-240 l ISAP Topic No. 2.25 - Drywell Temperature Monitoring System Upgrade l Reference l 84,92,93,94,95,96,97,98,99,100,101,102 . Proposed Action ISAP Topic No. 2.25 addresses a NNECO-initiated project to upgrade the existing drywell temperature monitoring system. Drywell bulk air temperature is an input into various containment response analyses (including environmental qualification and design basis calculations) which must be verified on a periodic basis. Specifically,'the scope of this topic includes two proposed modifications:
- a. Upgrade of the existing drywell temperature monitoring system for a more accurate determination of drywell bulk air temperature. This involves instal!ation of temperature sensors and a data logger on a personal computer.
- b. Installation of a new system to continuously monitor the primary containment integrity (e.g., leak rate). This modification is being addressed in conjunction with ISAP Topic No. 2.02.
- This topic is further discussed in Section 4.9 of this report.
3-241 As noted in Reference 84, NNECO anticipated that implementation of the first item will have a positive effect on public safety as well as plant performance by aiding in the monitoring of safety-related equipment in 'the drywell. NNECO expects implementation of this project (item a) to facilitate verification of compliance with idCFR50.49. Implementation may also allow NNECO to eliminate some unnecessary conservatisms in aging calculations. This could possibly lengthen the service life of the affected 50.49 equipment. Further details of this topic are provided in Section 4.9 of this report and in References 92 through 102. Evaluation 4 o Public Safety: Based on a probabilistic assessment and subjective engineering judgement, this topic was determined to have no significant impact on public safety. l l The accuracy of the temperature sensors involved in the upgrade (item a) would not change as a result of the proposed modification. The accuracy i of the drywell temperature monitoring system would increase because a computer would be used to calculate drywell bulk temperature instead of calculation by hand. This will increase the operator's level of confidence when following emergency operating procedures. However, it will result in no significant impact on public safety. The installation of the processor to continuously monitor primary containment integrity is contingent on the installation of the primary i I _ . . . . - - , . _ _ . . _ - - . . . _ , . . . . . - , . . , . - . , . - . - - --- ,- ----- -.-.. ..--~. ... ..--- -.. ~ ~~ - - - - - - - - - - - - - - ~ - - - - -
. ~. . __
3-242 3 containment pump-back system (see ISAP Topic No. 2.32). The processor is being installed to comply with technical specifications and does not impact public safety. o Personnel Safety: The proposed project to upgrade the drywell temperature monitoring system would have a small positive effect on personnel safety. The project would increase the lifetime of the system and reduce maintenance activities and exposure. t o Economic Performance: In a single analysis, NNECO calculated the impact on plant performance of a) upgrading drywell temperature monitoring equipment, b) installing a new continuous containment leak rate monitoring system (see ISAP Topic No. 2.02); and c) installing a new primary O containment pump-back system (see ISAP Topic No. 2.32.) NNECO calculated the combined impact to be negligible. The three proposed plant improvements address equipment which are safety systems and are not directly part of the power generation hardware. All three proposed plant improvements address two plant concerns: a) monitoring and responding to containment leak rate for maintaining a 1 psi torus to drywell differential (in accordance with technical specifications), and b) monitoring and responding to drywell temperature. Neither of these concerns is significant to plant performance.
- o Personriel Productivity
- The proposed modification to upgrade the existing monitoring system would add additional sensors to monitor temperature.
These devices would require additional calibration and maintenance. Thus, there would be a slight negative impaci in this category.
3-243 ( ISAP Topic No. 2.26 - Reliability Eautoment Reference 87 Proposed Action 4 As acted in Reference 87, NNECO proposed a project to aid in the effort to reduce corrective maintenance and increase preventative maintenance to ^ improve plant safety and reliability. ISAP Topic No. 2.26 consists of the procurement of computerized UT instrumentation, vibration monitoring and diagnostic equipment, closed circuit TV cameras for visual inspections, and misc-Ilaneous accessories for this equipment. The equipment is to be utilized for performing localized nondestructive field tests on components and i equipment. The ability to perform localized tests is expected to aid NNECO/NUSCO's j Reliability Engineering Group in assessing the performance of and determining methods for improvement of Millstone Unit No. 1. Equipment has been purchased and NNECO believes that no further action on this project is warranted. 1 O 1
3-244 I O ig ISAP Topic No. 2.27 - Spare Recirculation Pump Motor Reference ' 84 Proposed Action As stated in Reference 84, NNECO is presently performing engineering services to repair and rebuild a damaged recirculation pump motor stator. This project will provide a spare rotor for the recirculation pump motors for Millstone Unit No.1. ISAP Topic No. 2.27 encompasses this project. O Implementation of this project will enable NNECO/NUSCO to expedite any future replacement of a recirculation pump motor, as well as give the personnel involved in these efforts experience in working with recirculation pump motors. NNECO will continue its efforts on this project. l O l
3-245 O Q ISAP Topic No. 2.28 - Long-Term Cooling Study References 86,87 Proposed Action f The Millstone Unit No.1 PSS determined that approximately 64% of the total calculated core melt frequency at Millstone Unit No.1 is due to a failure to maintain adequate long-term decay-heat removal capability. By reviewing the dominant core melt sequences, it can be seen that failures of shutdown cooling and alternate shutdown cooling are the major contributors to core melt 0', frequency. t As a result, NNECO proposed to perform a study of the long-term cooling capability of Millstone Unit No.1. In References 86 and 87, NNECO provided the Staff with the scope of the planned long-term cooling study. The scope includes: o A review of all potential decay-heat removal schemes (including those not directly considered in the Millstone Unit No.1 PSS). o Plant-specific thermal hydraulics analyses of long-term core cooling and containment cooling utilizing systems and containment codes. o identification of potential operator actions to improve on the existing decay-heat removal capability (such as torus flooding from external
3-246 sources to prolong injection) until permanent bardware improvements are incorporated. o identification of decay-heat removal systems requiring hardware modifications. The desired results will includes o A refinement of system success criteria. o Recommendations on possible emergency operating procedure changes. O o identification of weaknesses of existing long-term decay-heat removal systems and recommendations for possible hardware modifications. ISAP Topic No. 2.28 encompasses NNECO's program in this regard. Evaluation o Public Safety The proposed study is intended to identify the best way to improve the plant's long-term decay heat removal capability. Because failure of long-term decay heat removal contributes to 64% of the total core melt frequency for Millstone Unit No.1, this issue has considerable potential public safety benefit. l l l
t
.3-247 o Personnel Safety: The proposed project to perform a study will not impact personnel safety. A proposed modification to replace the existing heat exchanger, one for one, with a heat exchanger of greater cooling capacity, also would not alter any plant activities. Therefore, occupational exposures and industrial rist<s will not be changed.
o Economic Performance: The long-term cooling study is intended to investigate ways to reduce potential core melt frequency due to loss of long-term cooling. Long-term cooling is required when the reactor / power generation is unavailable. Therefore, implementation of this issue will not have any direct impact on plant availability. 4 i o Personnel Productivity: This project (to conduct a long-term cooling study) will not impact personnel productivity. In addition, replacement of the i I heat exchangers with larger capacity exchangers (a possible result of the i , study) would have little impact on the workload of plant personnel. New i heat exchangers presumably would be selected such that their maintenance is similar to the existing ones. , Note: At the present time, NNECO is requantifying the Millstone Unit No.1 PSS j based upon improvements made to the plant since the study was initially performed. As a result, the long-term cooling study analysis is being reviewed and refined, with the expectation being that the contribution to the core melt frequency upon completion of this effort, at Millstone Unit No. I from a lack of adequate long-term cooling will decrease. Upon completion of this effort, NNECO will forward the results of this requantification to the NRC (see Section 1.4 of this report).
3-248 ISAP Topic No. 2.29 - FWCI Assessment Study Reference 103 Proposed Action ISAP Topic No. 2.29 addresses concerns related to the feedwater control system and the FWCI system. During the past few years, several changes have been made to the feedwater system at Millstone Unit No.1. Two recent changes have pointed out the need r for a review of the feedwater control system and the FWCI. First, as described in Reference 103, a concern surfaced regarding the consistency between system drawings and the as-wired logic. Field changes made during installation may have degraded system performance. Second, unexpected conditions indicated a need to review the system description of the feedwater control system to clearly identify limitations on operations. At the present time, ISAP Topic No. 2.29 is a study and involves no proposed hardware modifications. As described in Reference 103, the study is intended to compare the system drawings with the as-wired system; revise drawings as necessary; compare system descriptions with the verified wiring drawing; identify the limits of operation on the control system; and review the assumptions and impact of the feedwater control system on the design basis transients.
3-249 Implementation of this project will provide: confirmation of the wiring drawings as correct, or identification of the modifications required to the current drawings; confirmation of the system descriptions as correct, or identification of the modifications required; identification of the feedwater control system /FWCI assumptions utilized in the Millstone Unit No. i design basis; assessment of the impact on different modes of feedwater control system operation on the current design basis; and recommendations for improvements or additional documentation for the feedwater control system. , Because this project is in the study phase at the present time, the exact benefits cannot be quantified. However, it is expected that completion of this study will provide NNECO either with assurances of the adequacy of the feedwater control /FWCI system, or with the modifications that are required to increase the utility of these systems.
.v
- y. , _ _, , , _ ._.,_,c.7--__,_,_._,,_.____,-.___-,.-_-,_--....._..e_..,__,.....,r..____ _ - - - _ _ , _ _ . _ - , . _ , . .
3-250 O) L.) ISAP Topic No. 2.30 - MSIV Closure Test Frequency References 22,86,103 Proposed Action As noted in Reference 103, the Millstone Unit No.1 RPS incorporates an MSIV closure-trip function which initiates reactor trip when one out of two taken twice coincidence logic senses closure greater than 10%, based on valve travel limit switches. This trip function is an anticipatory trip, providing for reactor trip before the reactor pressure and neutron flux respond to the collapse in i (./ reactor coolant voids that accompanies MSIV closure. At present, Technical Specification 4.1.A requires monthly surveillance testing of this trip function. The actual test performed requires 10% closure of the valve to ensure that a reactor trip signal is generated. On several occasions wh!!e performing a 10% MSIV closure test at 100% power, the individual valve being tested over travelled and closed causing high steam flow in the remaining three steam lines. This results in the generation of a main steam line isolation signal and the closure of the remaining MSIVs. As noted in Reference 86, the Millstone Unit No.1 PSS evaluated MSIV closure events and concluded that they contributed to 93% of the causes of reactor O transient events with the main condenser unavailable, which account for 2.44% b of the predicted core melt frequency. Therefore, by reducing the frequency of J
( 3-251 10% MSIV closure testing, the frequency of such MSIV closure events could be J reduced. This, in turn, would reduce the core melt frequency. Under ISAP Topic No. 2.30, NNECO proposed to reduce the frequency of 10% MSIV closure testing from monthly testing to quarterly testing in conjunction with the quarterly MSIV closure stroke test required by Technical Specification 4.7.D.I.C. In performing the MSIV closure stroke test, reactor power is reduced to approximately 60% to avoid high steam flows in the steam lines not be tested. In Reference 86, NNECO provided the NRC Staff with the results of a probabilistic analysis of this proposed change. As noted in Reference 86, NNECO concluded that implementation of this procedural change would result in a net decrease in risk to the public. In addition, implementation of a change to the frequency of performing MSIV closure testing requires a
) technical specification change, rather than a hardware modification.
Evaluation o Pub!!c Safety: As documented in Reference 86, NNECO performed a probabilistic analysis of the public safety impact of this proposed change. NNECO recognized that increasing the testing interval may slightly reduce the reliability of the RPS signal generated by MSIV position. However, NNECO concluded that this slight reduction in the reliability of the RPS signal generated by MSIV position is more than offset by a reduction in the frequency and potential safety hazards of inadvertent MSIV closures during testing.
/ '
In the 12 years of plant operation considered in the initiating event data base of the Millstone Unit 1 PSS, there have been 5 events initiated by l _______ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ - - - - _ . ~
3-252 MSIV closure. Two of these five events were due to failures occurring during the 10 % MSIV closure surveillance testing. The her.efit of performing the 10% MSIV closure test in conjunction with quarterly closure time test was estimated by requantifying the frequency of MSIV closure events and excluding the two testing-related events. The core melt frequency was then recalculated with the modified MSIV closure frequency. NNECO concluded that as a result of the proposed change in test frequency, the core melt frequency decreases from 8.07 x 104 / year to 7.99 x 104/ year, a drop of 3.0 x 104/ year (or about 1%). In Reference 22, the NRC contractor also concluded that this rnodification
- would result in a reduction in large-scale core melt frequency, and that the '
,s
- topic should be ranked as having a medium positive impact in this category. i
) :
s r a 9 Y 4 v fi 3
3-253 ISAP Tupic No. 2.31 - LPCI Lube Oil Cooler Test Frequency Refegr nces 13,25,103 Proposed Action The Millstone Unit No.1 PSS determined that one of the major contributors to
- LPCI systern unavailability is failure of the solenoid valve controlling the LPCI pump rnotor bearing tube oil cooling. The LPCI pumps are started on a monthly basis for surveillance testing. However, in the tests, the pumps are run only for a short time. This is insufficient to confirm that the solenoid valves have opened to allow cooling flow to the tube oil.
As described in References 25 and 103, NNECO proposed under ISAP Topic No. 2.31 te change 'Se monthly surveillance testing procedure of the LPCI system in order to enable personnel to confirm opening of the solenoid valve. Specifically, the proposed change in the procedure calls for the operator to confirrn opening of the valve by checking pressure of water for tube oil cooling. As noted in Reference 25, NNECO has calculated that this change will decrease unavailability of alternate shutdown cooling, and will consequently decrease the core rnett frequency from 3.07 x 104/ year to 6.86 x 104/ year, a significant drop of 1.1 x 104/ year (or about 13%). As noted in Reference 103, NNECO has completed the proposed change to the LPCI pump operability procedares. This assures that the solenoid valves will 4
- - *r,% ---ym..-. ,r ,. .~7,------%.m.m-- - - ---. - - - - - - - ,, ._,-_.c4- -.--, - -----
4 3-254 i
; operate as intended and LPCI cooling will remain available. This ISAP topic is resolved and no further action is warranted. The NRC Staff, in Reference 13, e
l agreed with this conclusion. 4 i' J } 1 I 9 , 9 4 t 1 i l l 1 ) l l l t 1
"-9wwig--We==tewuwmw ww ww m-ew_ - --e-w---s* '
--e -'-_- -- -- . ---- --*---
3-255 ISAP Topic No. 2.32 - Primary Containment Pump-Back System References - 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102 Proposed Action Millstore Unit No I utilizes an open system of pressurization and venting to maintain a minimum containment pressure differential of 1 psi between the torus and the drywell. ISAP Topic No. 2.32 encompasses a proposed project involving installation of a pump-back system to take suction from the torus and discharge I to the drywell. The system would utilize the existing drywell pneumatics system equipment and would require the addition of a suction line off the existing torus line AC-8 and a discharge line to the drywell using containment penetration X-
- 36. The proposed pump-back system would maintain the 1 psi differential pressure and provide for continuous monitoring., This topic is inextricably related to ISAP Topic No. 2.25. -
Further details of this topic are provided in Section 4.9 of this report and References 92 through 102. Evaluation o Public Safety: First,' the proposed project would provide a potential benefit in improved ability to maintain containment pressure requirements and monitor containment leakage. The current system of venting and
3-2% 1 providing make-up requires local manual operator actions. With the addition of the pump-back system, the containment pressure can be maintained from the control room. The impact from reduced operator error due to installation of the pump-back system would be a small, l positive value. Second, the containment pump-back system requires the addition of two lines into containment the suction line from the torus and the e discharge line into the drywell. Two motor-operated isolation valves in I series are planned for each line. These valves are normally closed (opened only when adding nitrogen gas to containment) and will automatically isolate the pump-back system to prevent bypass of the containment during an accident event. Failure to isolate the pump-back system therefore would have a negligible negative impact on public s.tfety. m In summary, installation of the primary containment pump-back system would have no significant net impact on public safety. o Personnel Safety: The proposed modification would use the existing compressor system and add new piping and valves in order to pump from
- the drywell to the torus. Some of the additional valves would be located on
= top of the torus. These additions would therefore increase maintenance D activities in a radiation area. In addition, because the valves are located on top of the torus, the additions would increase the probability of industrial injuries due to falls. In conclusion, this project would have a small negative effect on personnel safety. v
m 3-257 o Economic Performance: The impact of this proposed action on economic
~
performance was assessed in conjunction with ISAP Topic No. 2.25. NNECO concluded that installation of a new containment pump-back system and a new continuous containment leak rate monitoring system would not significantly impact plant performance. The only relationship of the pump-back system to power generation is that it can be used to meet technical specifications requiring the i psi torus to drywell differential. o Personnei Productivity: This project would involve additional primary containment isolation valves and Group 11 isolation signals and associated circuitry. These additions would increase the testing, maintenance and calibration activities of maintenance, operations, and instrument and L control personnel. Therefore, the project would have a small negative L impact in this category. M M-W h M b = 0 1 mm
I l 3-258 ISAP Topic No. 2.33 - RBCCW Leak Rate Testi - J i ! l References l l l None. .
~
Proposed 5ction The reactor building closed cooling water (RBCCW) system is responsible for cooling the drywell equipment sump cooler, the drywell blower cooling coils, and 1 the recirculation pump motors. Supply of the RBCCW must pass through I containment penetration X-23 which only has a simple check valve inside containment. The return of the RBCCW passes through penetration X-24 which has a remote manual isolation valve outside containment. If the RBCCW piping line breaks inside containment, it can be isolated by closing the remote manual isolation valve,1-RC-15 and check valve,1-RC-6. Containment penetrations X-23 and X-24 are not in compliance with GDCs 54 and 57 and the leak rate testing requirements of 10CFR Part 30, Appendix 3, ISAP Topic No. 2.33 addresses these regulatory requirements. The proposed project involves installation outside of containment penetration X-23 two manual gate valves, a containment isolation valve 1-RC-16, and leak rate test connections. Modifications to penetration X-24 involve replacement of the containment isolation valve 1-RC-15, and installation of two manual gate valves and the test connections to allow leak rate tests to be performed. 1 O , l e
3-259 Evaluation V o Public Safety: NNECO performed a probabilistic assessment of the public safety impact of this proposed project. The specific safety concern addressed involves one of the containment isolation valves on the manual gate valves being left closed after testing. This concern was dismissed for the following reasons. After leak rate testing, test procedures require the operator to reopen the manual gate valves. The containment isolation valves would be remotely operated by open/ closure switches with indicating lights located in the control room. If a valve was left closed after testing, it would prevent RBCCW system cooling of the drywell space coolers during operation. This would result in increasing drywell temperature, thus alerting the operator to check these valves. NNECO concluded that this project would have no impact on public safety, o Personnel Safety: This project requires that two valves,1-RC-6 and 1-RC-15, be modified to test with air. At present these valves cannot be tested. The modification of these valves would implicitly increase surveillance and maintenance activities in a radiation area. Therefore, this project would have a small negative impact on personnel safety. o Economic Performance: These modifications would be undertaken to bring the plant into compliance with the GDC and the leak rate testing requirements of Appendix 3. This compliance was calculated by NNECO to result in only a negligible positive impact on plant availability. On the
, other hand, NNECO assessed the impact the additional valves would have !
\ on reducing reliable operation of the RBCCW. The RBCCW is an essential
3-260 1 .
< part of the power generation process. NNECO calculated that an ,
estimated reliability change would propagate to a negligible reduction in plant availability. o Personnel Productivity: This modification would add new primary containment isolation valves in the RBCCW system. These valves would require additional testing, surveillance and maintenance. Therefore this project involves a small negative impact in this category. O I f I l l l O
O Docket no. 50-245 Integrated Safety Assessment Program , MILLSTONE UNIT NO.1 4 O . I I l FINAL REPORT July 1986 Prepared by NORTHEAST UTILITIES
4-1 O SECTION 4 - PLANT-SPECIFIC ISSUES U 4.0 Introduction This section provides a discussion of significant plant-specific issues not specifically scored as ISAP topics. The issues discussed in this section include potential future regulatory requirements, completion of pending licensing actions, and significant licensee issues. ISAP has been or will be instrumental in the plant-specific resolution of these matters. In addition, Section 4.10 provides a discussion of the Millstone Unit No.1 operating experience review performed by the NRC. This review, when finalized by the NRC, will be used to identify significant areas for improvement in the operation and maintenance of the plant. 4.1 Station Blackout 4.1.1 Introduction The station blackout issue concerns a postulated complete loss of offsite AC power to the essential and non-essential electrical buses, concurrent with turbine trip and the unavailability of the redundant onsite emergency AC power systems. The concern is that if a station blackout persists for some period of time, core damage could result. The station blackout issue is currently characterized by the NRC as USI A-44. This topical discussion summarizes the current status of Millstone Unit No. I plant-O specific issues which are related to the proposed resolution of USI A-44 presently before the Commission.
4-2 P The NRC Staff recently proposed to resolve USI A-44 by promulgating a new rule that would make a station blackout a design basis event. Existing regulations contain requirements for the design and testing of onsite and offsite electric power systems that are intended to reduce to an acceptable level the probability of losing all AC power. However, there are no explicit design requirements that the core be cooled and the reactor coolant pressure boundary be maintained for any specified period of time in the event of the loss of all AC power. Under the proposed rule, the regulations would be amended to require that light-water cooled nuclear power plants be capable of withstanding a totalloss of AC power for a specified duration and maintain reactor core cooling during that period. The Staff's concerns are derived from a perception developed from operating experience that the reliability of both offsite and onsite AC power systems is less than originally anticipated. Of particular concern to the Staff is the threat posed by severe weather (e.g., tornado, hurricane, etc.) which could conceivably lead to an extended loss of offsite power. Should onsite power be lost coincidentally with loss of offsite power, core cooling would have to be provided by systems whose operation is independent of AC power. The proposed rule responds to these concerns and attempts to reduce the risk of severe accidents resulting from station blackout by maintaining highly reliable AC electric power systems and, as additional defense-in-depth, assuring that plants can cope with a station blackout for some period of time. The Staff believes that the expected frequency of core damage resulting from O V
, . , - --- - - - p
4-3 station blackout can be maintained near or below 10-5 per reactor-year for plants equipped with such protective features. The principal contributors to station blackout risk are defined in NUREG-1032, " Evaluation of Station Blackout Accidents at Nuclear Power Plants," (June 1985) as the redundancy, diversity, and availability of the emergency AC power system, the likelihood and duration of a loss of offsite power event, and the ability to provide core cooling with AC-independent equipment. 4.1.2 Criteria General Design Criterion 17, Appendix A to 10 CFR Part 50. O V General Design Criterion 18, Appendix A to 10 CFR Part 50.
" Station Blackout," Notice of Proposed Rulemaking, 31 Fed. Reg. 9829-9835 (March 21,1986).
l l 4.1.3 Related ISAP Topics / Interfaces l i ISAP Topic No.1.01," Gas Turbine Generator Start Logic Modifications" ! ISAP Topic No.1.02," Tornado Missile Protection" ISAP Topic No. 1.16.1, " Millstone Unit No. 1/ Millstone Unit No. 2 Backfeed"
4-4 ISAP Topic No.1.16.2," Modify CRD Pumps" ISAP Topic No.1.24, " Emergency Power" ISAP Topic No. 2.17, "4.16KV, 480 VAC, and 125 VDC Plant Distribution Protection" ISAP Topic No. 2.24,"Offsite Power Systems" ,, 1 These topics are discussed in detailin Section 3 of this report. l 4.1.4 Issue Evaluation O In 1975, the Reactor Safety Study, WASH-1400, showed that station blackout could be an important contributor to the total risk from nuclear power plant accidents. The Millstone Unit No.1 Probabilistic Safety Study (PSS), dated July 10,1986 (Reference 14), also identified station blackout accident sequences, and those involving the postulated unavailability of AC power sources, as important contributors to the overall likelihood of core damage and core melt. Accidents initiated by the loss of normal AC power represent the largest fraction of core melt sequences analyzed for Millstoce Unit No.1 (i.e., approximately 30%). About 1/3 of this risk is from station blackout accident sequences. The Staff discusses the importance of offsite power and emergency AC power system availability in its analysis of station blackout risk. (See P. W. Baranowsky, " Evaluation of Station Blackout Accidents at Nuclear
4-5 Power Plants," U.S. Nuclear Regulatory Commission, May 1985.) The . factors which the Staff believes have the greatest impact on offsite power availability are switchyard configuration and the potential for severe weather (e.g., tornado, snowfall, and storms). The applicable measure for emergency diesel generator (EDG) reliability is its ability to r start on demand and provide sufficient capacity to operate hot shutdown equipment. These factors affect the likelihood and duration of anticipated station blackout eveats. In addition, the Staff believes that r plants should have the capability to cope with station blackout events for E. some period of time using onsite decay heat removal equipment which are independent of AC power. The equipment needs to be operable in the _ anticipated environment of a stat. ion blackout and provide sufficient core cooling to maintain hot shutdown conditions for at least 4 hours. For some plants, the coping requirement could be 8 hours if less desirable offsite power system or site features are present together with certair. t EDG configurations and reliabilities. In response to these concerns, NNECO performed a preliminary evaluation of the status of Millstone Unit No. I relative to the proposed rule and draf t regulatory guide. The conclusion of this review is that the unique characteristics and features of Millstone Unit No. I are such that the I overall risk of station blackout is acceptably small, will be further reduced by plant modifications planned for the near term, and that the plant compares favorably with the proposed requirements currently before the Commission. O
4-6 4.1.5 Station Blackout Risk and Related ISAP Topics As was previously noted, accidents initiated by the loss of riormal AC power represent the largest fraction of core melt sequences analyzed for Millstone Unit No.1. This fact illustrates the relative importance of the gas turbine and its ability to power larger and a greater number of loads than the EDG alone. In particular, the gas turbine may be used to operate the feedwater train and necessary condensate and condensate booster
~
pumps to provide make-up from the main condenser hotwell to the emergency feedwater coolant injection system (FWCI). This system offers several hours of condensate make-up from the hotwell before suction must be shif ted to the condensate storage tank (CST). Thus, having the gas turbine available ensures adequate water to cope with an extended loss of offsite power. While make-up capability exists to a large measure with the gas turbine, it should also be noted that Millstone Unit No. I is equipped with a 100% turbine bypass capability. This feature allows for a complete load rejection to occur while still maintaining the main condenser as a viable heat sink. The practical impact of a 100% load rejection capability is to allow the unit to continue to operate and to provide power to core cooling systems for transients involving load rejection by the main generator. Even if power is ultimately lost, a substantial amount of the plant's decay heat may be transferred to the ultimate heat sink and reactor power reduced before the EDG and gas turbine are challenged. , O
4-7 NNECO recognized the relative importance of the gas turbine in station blackout accident sequences and has taken actions directed towards improving the availability of redundant and diverse AC power sources. The associated ISAP projects (committed or contemplated) include: (1) Preventive maintenance program for the gas turbine; (2) Start logic modifications to the gas turbine; (3) Backfeed of emergency AC power from Millstone Unit No. 2; (4) A review of the design adequacy of the electrical distribution system; (5) Improvements to the offsite power system; (6) Tornado protection; and, (7) Enhanced availability of other sources of high-pressure make-up. As was previously noted, an important contributor to the likelihood of core damage at Millstone Unit No. I are accident sequences involving the unavailability of AC power to essential switchgear. In a letter to the Staff, dated August 26,1985 (Reference 25), NNECO discussed potential areas for improving the availability of the gas turbine, concentrating on 2 areas of special importance: bypassing turbine equipment protective trips
4-8 (ISAP Topic No.1.01), and evaluating the effectiveness of the existing gas turbine preventive maintenance program (ISAP Topic No.1.24). The initial analysis of public safety impact indicated that a more comprehensive turbine governor preventive maintenance program offered significant benefits. Bypassing 2 start-up trips and 5 generator trips also provided some additional value. The implementation of this program was deferred, however, pending final resolution of the station blackout issue, as is discussed in the Integrated Plant Safety Assessment Report (IPSAR) (NUREG-0824). Later, it was determined that certain improvements and corrective actions could be identified and resolved. The current status of gas turbine generator reliability programs is presented in Section 4.4. J The proposal to modify the start-up and generator trips reflect the concern over the gas turbine's earlier operating experience. The IPSAR noted a sizeable number of failures since Millstone Unit No. I entered service. However, a substantial fraction of these failures appear to be associated with the speed switch and governor, which was replaced in 1979. Since that time, failures appear to be related to random component failure and not due to spurious signals. NNECO has also examined the Millstone Unit No. I component reliability database as part of the PSS and determined that the proposal to bypass the light-off and excitation speed trips would only affect the speed control / switch-Induced start failures. Only 2 of these trips would have been prevented by such a modification. The safety benefit of this modification would reduce the core damage frequency by only about 2 x 10-6 per reactor-year. Further, eliminating the operational trip on high lubricating oil temperature would be moot since this trip is hypassed under accident conditions. There are also
4-9 A Q diminishingly small benefits associated with bypassing the output breaker protective trips. In sum, while some safety benefits are offered by modifying the trips, they appear to be marginal, at best. NNECO's PSS determined that improvements to the gas turbine can be important to reducing the risk of station blackout at Millstone Unit No.1. However, NNECO also concluded that the improvements to this single component could be complemented by additional diversity and redundancy in other areas. For example, with regard to Appendix R criteria, NNECO proposed modifications which would permit transferring emergency AC power to Millstone Unit No. I from a Millstone Unit No. 2 EDG. While this proposal to backfeed emergency AC power from Unit No. 2 was made to provide safe shutdown capability in the event of a fire in the Unit No. I control room or turbine building, there are also clear benefits from a station blackout perspectives. NNECO described this evaluation in Reference 46, a letter to the Staff, dated October 16, 1985, under ISAP Topic No. 1.16.1. The results of this reanalysis of the PSS were previously reported in Reference 27, dated August 7,1985. These results indicate that this modification offers a reduction in the core damage frequency of approximately 5 x 10-5 per reactor-year from all causes. This modification is expected to be implemented during 1987, at the : I completion of the Millstone Unit No. I 1987 refueling outage. ' In addition to the emergency power supply system modifications, NNECO j determined that other improvements to the electrical power distribution system may also offer some benefits. To this end, a review was initiated oi 2 distinct ISAP topics: the setpoints, ratings, and overall performance
4-10 of the 4.16 KY, 480 VAC, and .25 VDC plant distribution system (ISAP Topic No. 2.17), and the adequacy of the offsite power distribution system (ISAP Topic No. 2.24). This review was reported to the Staff in Reference 91, dated October 1,1985. However, based on a comparison with other Appendix R projects, Topic 2.17 has since been determined to have a small impact in reducing public risk. No changes have been identified to date. With respect to Topic 2.24, two other modifications have been considered: , (1) Installation of a slow speed bus transfer scheme to afford plant personnel both an immediate and a delayed opportunity for reconnecting to the switchyard on loss of offsite power; and O (2) Installation of a generator disconnect device (circuit breaker) for the Millstone Unit No. I main generator. The first item allows time for the plant to reconnect to the switchyard before transferring over to emergency power sources. The second item enables plant personnel to keep the NSST transformer in service by backfeeding through the generator step-up transformer. It would also improve the plant's reliability by retaining the NSST in service for the majority of faults experienced by the main generator. The combined effect of the 2 modifications would reduce the core damage frequency by about 4.6 x 10-5per reactor-year from all causes. O
4-11 . An area of some importance to offsite power reliability and the station blackout issue is the potential for a tornado. As was discussed in Reference 27, NNECO determined that a major tornado arising quickly , i could lead to a loss of offsite power and, possibly, damage electrical cables needed for the shutdown cooling system or alternate shutdown ) cooling to function. In response to this concern, NNECO initiated a review of a proposed design change to provide a portable engine-driven pump and a tornado missile-protected water supply for the isolation condenser and reactor pressure vessel in the event of a weather-initiated loss of offsite power (ISAP Topic No.1.02). Because the source of water is approximately 7 miles from the site, it is unlikely that it would be affected by a tornado at the same time as the Millstone site. Should primary power to the city water system be lost, back-up power is provided by a diesel generator. The PSS determined that the proposed improvement would offer a reduction in the core damage frequency of about 3.3 x 10-5 per reactor-year. The ability to use the isolation condenser to depressurize the reactor pressure vessel and remove decay heat following a loss of offsite power is a major contributor to the overall safety of Millstone Unit No.1. t ! Control rod drive (CRD) pump modifications were discussed in letters to ! the Staff, dated August 26,1985 (Reference 25) and October 16, 1985
; (Reference 46). With the availability of power backfeed from the adjacent unit, the CRD pumps would be available to provide high pressure i make-up. However, the pumps' operability could be limited by the lack of cooling. The modification would allow manual realignment of the CRD I
pump motor cooling piping to the pump discharge to permit self-cooling. l _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ - - . - - . , _ , , _ _ - . . , _ , , , , . _ - . _ . _ ..-.,m-- . _ , _ - - . . . _ _ . - . _ _ _ . , . . . , _ , . . c .- . _ __ . . , , _
4-12 i Although the marginal safety benefit of this modification is insignificant, a the backfeed project would not accomplish its intended purpose without implementing the CRD pump self-cooling project. l I In summary, the modifications currently committed or conteenplated by i NNECO offer significant benefits in reduced core damage frequency, as l illustrated below: Topic Benefit Gas Turbine Preventive Maintenance Not estimated Gas Turbine Generator Start Logic 2.0 x 10-6per reactor-year Modifications Millstone Unit No.1/ Millstone Unit 5.0 x 10-5per reactor-year No. 2 Backfeed 4.16 KV,480 VAC and 125 VDC Plant Not estimated Distribution Protection Offsite Power Systems 4.6 x 10-5per reactor-year Severe Weather 3.3 x 10-5 per reactor-year CRD Pumps Not estimated
i 4-13 These benefits are realized in all accident scenarios involving the partial and totalloss of AC power and extend beyond the traditional definition of station blackout. Important contributors to the overall benefit are enhancements to those plant features that further support the availability of the isolation condenser and gas turbine. The ISAP topics previously outlined embrace this strategy and work to the plant's strength in order to obtain the types of safety improvements reported. 1 4.1.6 Relationship to Proposed Station Blackout Rule Through ISAP, NNECO has made significant progress in recent years, on a plant-specific basis, towards reducing the risk of core damage due to station blackout and power-related accident sequences. Presently, though, the Staff is proposing to resolve the station blackout issue on a generic basis through a new rule. This section compares the Millstone Unit No. I plant and site fea^.ures with the requirements of the Staff's proposed rule and draft regulatory guide. The Staff's concerns, which form the basis for the rulemaking, are also discussed as an introduction to this comparison. There are three elements to the Staff's concerns regarding station blackout: (1) The likelihood and duration of a loss of offsite power event; O _ _ _ - _ _ _ _ - _ _ _ , , _ . - , . _ _ . . . _ . . _ _ _ , . . . . - - - - _ . _ _ _ - _ _ - . . - , - _ _ _ - - - , . . _ . . . - . - - - . . - _ _ ~ _ - . . . _ - - . .
4-14 O b (2) -The redundancy and reliability of the EDGs and other emergency AC power sources used to operate equipment f necessary for hot shutdown; and (3) The ability to provide core cooling in a station blackout using only AC-independent equipment. The Staff believes that the likelihood and duration of a loss of offsite power event is determined by the redundancy and independence of offsite power sources, the potential for extremely severe weather, and the severity of severe weather. In this case, the distinction between severe weather and extremely severe weather lies in the definition: extremely severe weather consists of storms with winds in excess of 125 mph; severe weather is a linear combination of snowfall, tornado, and storms with winds ranging between 75 and 124 mph. Another distinction between the two is that the effects of severe weather may be mitigated by emergency procedures for promptly restoring offsite power lost due to a storm. The practical impact of these concerns leads to two classes of plants: 1) those l with especially reliable offsite power systems due to design features or weather patterns (classified as "Pl" sites); and 2) plants viewed as having a greater potential for loss of offsite power events of some duration ("P2" sites). A classification scheme is also used in considering emergency AC power system configurations. In this instance, three grouos of emergency AC power systems are defined: 1) high level of redundancy (Group A); l
- 2) normal level of redundancy (Group B); and 3) more limited redundancy I i
- 1 l
4-15 (Group C). Group B sites typically have two independent AC power sources and require at least one for operating a train of hot shutdown l 1 equipment. Most plants are classified in Group B. The Staff proposallinks the grouping of the emergency AC power system to the reliability of the individual onsite emergency sources to determine the minimum duration for which AC-independent equipment must be operable to prevent core damage. All P1 sites must provide sufficient , core cooling to prevent core damage for 4 hours, regardless of EDG grouping. In contrast, P2 sites have a 4- or 8-hour coping requirement, depending on the EDG grouping and component reliability. If the current proposal is promulgated or a final rule, licensees will be required to do the following: (1) Determine the maximum duration for which the plant as currently designed is able to maintain core cooling and containment integrity in the event of a station blackout; (2) Identify the factors that limit the plant's capability to cope with events of longer duration; (3) Describe the procedures established for station blackout events of the duration specified and subsequent recovery; and
- (4) Propose a coping duration of 4 or 8 hours (or some other duration) based on the redundancy and reliability of emergency
4-16 AC power sources, the expected frequency of a loss of offsite power, the probable time needed to restore offsite power, and the factors, if . any, which limit the ability to meet the requirements of General Design Criterion 17. NNECO has yet to perform a detailed analysis of the factors which would classify Millstone Unit No. I as a 4- or 8-hour plant, nor has a coping analysis been performed. However, a preliminary assessment has been . made of the plant's . current status relative to the propcsed station blackout rule. These factors are summari ed according to the Staff's classification scheme. There are three tests which establish a site as PI: O (1) Sites that have one of the fo!!owing offsite power design: 1
- a. All offsite power sources connected to the plant through two or more switchyards or separate incoming transmission lines, with at least one of the AC sources electrically independent of the others; or
- b. All offsite power sources connected and, if the r.ormal AC power source is lost, an automatic transfer to an alternative offsite power source. If this source fails, also there is one O o- more
l l l l 4-17 l . m automatic or manual transfers of power to another source of offsite power; l l (2) Sites with frequency of loss of offsite power due to extremely severe weather less than 1 per 350 site-years; and (3) Sites that have one or both of the following characteristics: l
- a. The capability and procedures to recover offsite (non-emergency) AC power to sne site within 2 hours following a loss of offsite power due to severe weather; or O b. An estimated frequency of loss of offsite power due to severe weather less than 1 per 100 site-years.
The Staff has previously reviewed the Millstone site and found that the independence and redundancy of the offsite power system satisfies Items 1.a and 1.b, above. (See Table 2.lb, R. E. Battle, " Collection and Evaluation of Complete and Partial Losses of Offsite Power at Nuclear Power Plants," NUREG/CR-3992 (February 1985)). The likelihood of extremely severe weather is less than 1 per 350 years based on an extrapolation of weather data for the State of Connecticut (based on data provided by M. 3. Changery, " Historic Extreme Winds for the United States Atlantic and Gulf of Mexico Coastlines," NUREG/CR-2639, NOAA, Asheville, North Carolina, May 1982). (With respect to the weather effects of Hurricane Belle and Gloria, the winds associated with these
4-18 (" storms were less than the 125 mph threshold associated with " extremely severe weather.") In addition, the capability and procedures already exist to recover offsite (non-emergency) AC power to the site following a loss of offsite power due to severe weather. Consequently, for these and other reasons, Millstone Unit No. I appears to be a P1 site and does not require more than 4 hours of coping capability. Since there are two independent sources of emergency AC power for Unit No.1, and either source is capable of supplying sufficient power to achieve and maintain hot shutdown conditions, the plant falls into Group B. Combined with the P1 classification, the maximum EDG/ gas turbine failure rate before corrective action is necessary is 0.05 per valid demand. Data provided by NNECO in response to Generic Letter 84-15 demonstrates a high reliability where compared to other sites (Reference 104). The emergency diesel generator failure to start on demand was reported at 6.7 x 10-3 while the gas turbine was reported at a lower reliability of 4.8 x 10-2 failures per demand. The reliability of a two-component system in which only one component is needed can be calculated assuming some average component reliability and considering a common-cause contribution. Assuming the common-cause contribution to 1 be 1% and discounting maintenance unavailability for purposes of tMs simplified analysis, the calculated unavailability for such a one-out-of-two system is approximately 3x 10-4 per demand. Adding the contributions of maintenance, testing, and repair to component unavailability does not erode Millstone Unit No. I's superior performance. For example, in NUREG/CR-2989, " Reliability of Emergency AC Power Systems at Nuclear Power Plants," (July 1983), Oak Ridge National
4-19 Laboratory evaluated the unavailability of 18 emergency AC power systems. Of the 18 systems analyzed, only 4 plants demonstrated better median system unavailability than Millstone Unit No.1. The implications of this brief analysis is that Millstone Unit No. I does , not represent a significant potential for extended station blackout events, particularly in light of our near-te m plans for implementation of the cross-connect between Millstone Unit Nos. I and 2 on-site emergency power sources. According to NUREG-1109, the magnitude of this benefit is a reduction in the core damage frequency on the order of 10-5 per reactor-year. In this area, however, the desired improvements have already been achieved, as was previously discussed in the context of ISAP improvements. O A detailed accounting of Millstone Unit No. I off-site power system performance also supports the conclusion that station blackout does not pose significant risk. The Millstone site has experienced two loss of , offsite power events through December 1982. Both occurred within about one month of each other in the summer of 1976. The events do not appear as statistical outliers from the rest of the industry's experience. This experience yields a mean Millstone site loss of offsite power event frequency of 0.124 per year. This estimate is based on regional experience obtained from Northeast Power Coordinating Council (NPCC) data, updated with 14 years of experience. Another event occurred in September 1983 while the plant was in anticipation of a shutdown condition. Adding the Hurricane Gloria event in 1983 increases the frequency only slightly to 0.145 per year. I
l 4-20 p) i V One special feature of the Staff's concern over offsite power availability l involves the importance of severe weather. This ' concern emanates ) l primarily from the Staff's analysis of the history of loss of power events ! and the treatment of weather hazards, particularly high winds and precipitation. The Stafi's concern for severe weather is reflected in the l NUREG-1032 analysis. Severe weather is the principal contributor to longer duration loss of offsite power events. NNECO does not share the l Staff's concern to the same extent. According to Table 3.1 of NUREG- l 1032, these events are expected to occur at a frequency of 0.011 per site-year and have a median duration of 2.6 hours. Of these events, special concern is reserved for the extreme cases in which transmission and switchyard components could possibly be damaged, thereby inhibiting timely restoration of power. The Millstone site lost offsite power on two occasions ar a result of hurricanes: Hurricane Belle in 1976 (see H. Wyckoff, " Losses of Offsite Power at U.S. Nuclear Power Plants - All Years Through 1983," NSAC-20, Nuclear Safety Analysis Center (July 1984)) and Hurricane Gloria in 1935, In both cases,345 KV power was available to the site but was not restored due to concerns over potential flashover. Further, upon completion of switchyard spray-down procedures to remove salt, this power was restor.ed in a controlled manner. In the case of Hurricane Gloria, NNECO , implemented the hurricane action plan almost 24 hours prior to the arrival of the storm, coincidental with the National Weather Service's declaration of a hurricane watch (Reference 103). Forty-five minutes before the bl v Governor declared a state of emergency in Connecticut, NNECO decided to bring Millstone Unit No. I to a shutdown condition. The unit was off-l
- ._ - 1.--.---
4-21 O v line approximately two hours before offsite power was lost. This' period was more than sufficient to adequately staff the site with additional emergency personnel, secure power to non-essential areas, and confirm the availability of emergency power. NNECO's handling of Hurricane Gloria conformed with normal procedures and demonstrates that, while hurricanes can pose a risk to offsite power availability, such risk can be recognized far enough in advance to prevent the hazard from becoming a substantial threat to nuclear safety. NNECO does not believe that the potential for severe weather poses unique risks of station blackout that warrant immediate remedies. The Staff's development of the technical basis for a station blackout rule has drawn NNECO's attention to those issues of concern to the Staff. For (q/ this reason, and in recognition of maintaining a prudent position relative to risk management, NNECO notes that certain concepts are currently undergoing prellrr3inary study. These initiatives include enclosing the switchyard to protect the eqaipment froin weather-related events, upgrading the underground 23 KV line from Flanders Substation to provide an additional source of reliable power to important cocling equipment, and several other options related to ent:ancing power availabliity. These , concepts are somewhat embryonic and are not Jikely to be brought forward for some time, and then only if there are clearly defined safety and economic benefits. NNECO will keep the Staff informed of any - developments in this area. ; The final element of this plant-specific evaluation concerns Millstone , I! nit No. i's 4-hour coping capability. As was previously discussed, the ;
4-22 expected benefits of this feature have been exceeded by an order of magnitude in the benefits offered by the ISAP topics. However, a coping study has not been performed in accordance with the proposed regulatory guide. Consequently,it is not possible to determine the extent of current conformance with the proposed rule in this one area. NNECO's position is that the benefits of coping for 4 hours may be overstated and that the funds expended in making such a determination may be better spent in other areas. For example, improving the availability of the isolation - condenser has already proven to be an extremely cost-beneficial approach to safety. Similar concepts may offer comparable benefits. It is not likely that the final form of the station blackout rule will be i decided by the Commission for several months. NNECO is actively following developments in - this area, both as a licensee and through NUMARC, and will respond to new Commission policies as they become , known. d in the short term, NNECO has endorsed and is implementing the NUMARC initiatives (3. Miller letter to Chairman Palladino, dated June 17,1986) for enhancing AC power reliability. These initiatives are designed to provide consistency in the industry's efforts to resolve the Staff's concerns over potential risk outliers and the overall standard of I station blackout safety. Most of the NUMARC program is already in place at Millstone, while the new elements will be implemented in the i near future. O
4-23 Ch V 4.2 STA/SRO Issues NNECO responded to Generic Letter 86-04, " Policy Statement on Engineering Expertise on Shift" (February 13, 1986), on June 13, 1986 (Reference 106). In this response, NNECO provided a detailed description of the current educational program which is intended to provide the on-shift operating crew with adequate engineering and accident assessment expertise. The submittal included a discussion of the interim shift technical advisor (STA) program, which was implemented in response to the recommendations of the TM1 Lessons Learned Task Force, and the evolution of the current dual role (SRO/STA) program, which was developed in response to NUREG-0737, Item I.A.I.l. NNECO stated that the individuals presently serving in the dual role capacity are qualified to
' provide the engineering expertise and accident assessment function, and that no changes to the STA program are necessary.
Millstone Unit No. I currently has 13 on-shift operators who are dual-role qualified (hold senior operator licenses and are STA-qualified). Six of these are shift supervisors (SS), six are senior control room operators (SCO), and one is a control room operator (CO). Four of the six SCOs are 1 SS qualified, and the CO is SCO qualified. At least two operators with dual-role qualifications are on shif t most of the time. Although NNECO has not committed to provide this additional expertise to the NRC, NNECO intends to continue to exceed the minimum requirements. The extensive experience of the senior operators at Millstone Unit No. I and the noteworthy performance of the entire Operations Department
- 4-24 (exemplified by the recent 374 day continuous run) are examples of the expertise existing on shift. On numerous occasions, senior operators have demonstrated their thorough knowledge of the plant and their ability to instantly assess incidents as they are occurring and quickly take remedial action. Two incidents at Millstone Unit No. I are described below which demonstrate that the operators can analyze and respond to transients much faster than the 10-minute response time that safety analyses typically give credit for.
On April 21,1981, while operating at 31% reactor power, the main turbine was tripped due to high vibration. The reactor remained at power until approximately six minutes later when a high conductivity alarm was received. At this time, the reactor was manually scrammed and the following actions were taken: o All LPCI and core spray (CS) pumps (six total) were started; o The "A" safety / relief valve was opened; o Feedwater was secured and all MSIVs were closed; o The mode switch was placed in " REFUEL;" o The main condenser vacuum was broken and all circulating water pumps were secured; and O o The CST was isolated from the hotwell.
4-25 The above actions all took place within three minutes. Throughout this event, the IC was unavailable for service because the shell side was being refilled with demineralized water. Approximately 30 minutes after the event, emergency service water pumps were turned on to cool the torus. On August 13, 1985, a reactor scram occurred due to a hi-hi main steam line radiation signal which also caused MSIV closure (i.e., Group I isolation). A reactor operator put the IC into service manually before any of the safety / relief valves lifted. It should be noted that reactor pressure is normally at approximately 1,030 psig. Auto-actuation of the IC occurs after 15 seconds 'of sustained reactor pressure greater ti;an 1,085 psig. The safety / relief valves are designed to start opening at 1,095 psig. Consequently, the reactor operator was able to make the decision to open the 1-IC-3 valve (i.e., put the IC into ;ervice) prior to auto-actuation and safety / relief valves lifting. The cause of the scram and MSIV closure was attributed to corrosion i product release in the feedwater system. This occurred after a demineralizer was returned to service after a routine cleaning process. The point of the above examples is that the current complement of shift i personnel at Millstone Unit No.1 are not only thoroughly trained and qualified to perform their duties, but their considerable experience and i familiarity with the unit represents a key element of the safety of the plant which would be difficult to replace with paper credentials. NNECO
~
remains unconvinced that the current commission init atives in this area represent a " net plus" from a safety standpoint. 4 e-,
4-26 NNECO considers the advanced notice of proposed rulemaking (ANPR),
" Degree Requirement for Senior Operators at Nuclear Power Plants,"
which was printed in the Federal Register on May 30, 1986, unjustified. Requiring senior operator license applicants to hold an engineering degree has the potential to cause many non-degreed shif t personnel to leave the Operations Department due to the limited career path, and will negatively impact the morale of the non-degreed operators who remain. The resulting insertion of recent college graduates, with senior operator licenses and comparatively little operating experience, into senior positions on the operating crews would lower the overall experience and expertise of the operating shif t. Our current judgment is that having inexperienced, degreed senior operators in lead positions on shift is inferior to the current arrangement. NNECO will be providing additional views in response to the ANPR on or before September 29,1986. 4.3 IE Bulletin 85-03, MOV Common Mode Failures In Reference 90, dated June 11, 1986, NNECO provided detailed information summarizing its response to IE Bulletin 85-03 for Millstone Unit No.1. First, in responding to the bulletin, NNECO evaluated those MOVs that are considered to be within "high pressure" safety systems to determine the maximum differential pressure expected during both normal and abnormal events. This value was then compared to the design rating of the valve to ensure that the valve was properly sized for the application. Ih or Millstone Unit No.1 it was determined that all of the valves in service in the FWCI system and the IC system (those systems determined to be "high pressure" safety systems) are adequately sized. I
4-27 O O The NRC Staff, in IE Bulletin 85-03, requested that once that this initial evaluation was completed, a program be developed and implemented to ensure that switch settings on these safety-related MOVs are selected,
- , and maintained correctly to accommodate the maximum differential pressures expected on these valves during both normal and abnormal events within the design basis. In Reference 90, NNECO summarized a program and schedule consisting of the following:
o Using the results of the valve design evaluations, proper switch settings (i.e, torque, torque bypass, position limit, overload) for each valve operation (opening and closing) will be defined; as part of this effort, the methods for selecting and setting all switches will be reviewed and revised as necessary. o As a reault of the above, Individual switch settings on each MOV will be changed as appropriate; each valve will be demonstrated operable by testing at the maximum differential pressure projected or by a justifiable alternative; each valve will be at least stroke tested. o Procedures will be prepared or revised to ensure that correct swhch settings are determined and maintained throughout the life of the plant. l l NNECO informed the NRC Staff of its intention to complete all of the above outlined work by November 1987. The resources required for this l l
4-28 O V effort will be factored into the integrated schedule under ISAP Topic No. 2.15, which is being redefined to encompass this project. 4.4 Gas Turbine Generator Reliability Over the last several years, gas turbine generator reliability has become ! l an important consideration for both NNECO and the NRC. Several j failures of the Millstone Unit No. I gas turbine were attributed to general - l aging of the piping systems and equipment. An effort was therefore ; started to address the immediate concern of the degradation, as well as to establish a more comprehensive program to monitor the performance of the gas turbine. NNECO developed this program in order to involve several groups with differing areas of expertise to cover both the entire \-' range of components and all aspects of the operation of the gas turbine. The departments involved in this program include Operations,
- Instrumentation and Controls (I&C), Maintenance, Production Test, and Engineering.
NNECO management has committed these resources in order to maintain and increase the reliability of the gas turbine. NNECO's basic objective for this effort is divided into two aspects: a) to correct the immediate problem areas; and b) to establish a t onsistent program to detect potential problem areas, note the degradation of components so that timely corrective actions can be taken to correct the;n before a failure occurs, and to provide a means to diagnose any actual problems or failures to minimize the down time of the gas turbine.
4-29 NNECO has already undertaken major efforts to correct immediate problems. These efforts are documented in earlier correspondence and include: o Replacement of carbon steel piping with stainless steel piping in the air start system to reduce corrosion problems in the air i start valves; o Periodic inspections of the air start accumulator tank; repainting as necessary; l o Installation of air conditioning unit to minimize salt air corrosion of electrical components; removal of damaged or
- degraded components as necessary; and i
o Replacement of the generator rotor due to suspected i degradation of the end turn insulation. l The program to monitor the performance of the gas turbine generator j
\
l contains several elements. The first is the use of the automated i preventative maintenance system. This system is used by the Maintenance, I&C, and Production Test personnel to perform routine { recurring maintenance and calibration of the equipment and the controls l i for the equipment. Secondly, the original start-up data for the unit have l been consolidated to serve as a more accessible tool to use as the baseline information for comparison with new data. Thirdly, a more extensive ; program has been established to monitor critical gas turbine parameters.
i 4-30 The existing dry-test simulator has been enhanced to record those data on every scheduled run. There is also a recorder which monitors and records various relay operations. These data are trended and analyzed after each ; , run to identify and confirm proper operation of the monitored 5 components. This information has been used to identify degradation in components and has allowed corrective maintenance or recalibration to be s completed prior to failures or out of specification conditions developing. All scheduled runs of the gas turbine generator are monitored by multiple disciplines, each checking various parameters for proper operation. This enhanced involvement has lead to a more qualified group of individuals who are knowledgeable and proficient in the operation of the gas turbine. This expertise is thus available if problems do develop, and is being used to minimize unavailability. In addition to the above, engineering efforts have been undertaken to explore the feasibility of replacement of the existing air start valves. These valves would be replaced with a less complicated and more reliable design. The feasibility of replacement of the existing control system with a newer system is also being investigated. The entire program, therefore, not only responds to failures as they may randomly occur, but also is designed to provide preventative maintenance and predictive analysis. Through this program, NNECO intends to predict possible problem areas so that corrective measures can be taken before problems occur. In total, these measures increase the overall reliability of the gas turbine.
4-31 4 4.5 Stretch Power In 1985 and 1986, NNECO evaluated the potential for a Millstone Unit No. I stretch power plan. A stretch power plan would specifically consider the feasibility of various options for increasing the electrical output of the plant. Increasing electrical output was viewed by NNECO as a potentially prudent measure to be implemented in the mid-1990s to
; offset a projected need for increased electric capacity.
The stretch power plan evaluated by NNECO would include a detailed plant capacity feasibility study and the associated licensing effort. First, the feasibility study would be conducted to evaluate both NSSS and BOP areas of the plant to identify and quantify the benefits and risks of the proposed project. This study would also be necessary to develop a 1 detailed plan of what modifications and analyses would be required to support an uprating of the pir.nt. Second, the stretch power plan would require a licensee safety analysis and approval from the NRC. NNECO considered a coordinated licensing effort with other BWR owners to satisfy this element of the plan. It was envisioned that ISAP would provide the optimum framework to address the safety and regulatory l Issues involved in a stretch power effort in an integrated effort to ! determine the most feasible and cost-effective method for increasing the Millstone Unit No. I power rating. Based on its evaluation of the proposed stretch power plan, NNECO has decided not to pursue this effort for Millstone Unit No. I at this time. I Although a plan to achieve stretch power preliminarily appears to be l l
t 4-32 feasible, NNECO's decision was influenced by the potential that such an effort could reduce plant safety margins at a time when the plant is being upgraded to meet internal safety goals and objectives. Moreover, there i currently is excess capacity in the NU system. In conclusion, NNECO has deferred the project, subject to possible revival in two or three years. The status of safety improvement initiatives and electric supply and demand circumstances would be among the more important decision-making parameters. If revived, NNECO plans to apply ISAP methodology to evaluate and prioritize necessary studies and plant modifications. 4.6 POL to FTOL Conversion An application for conversion of the Millstone Unit No.1 Provisional Operating License (POL) to a Full-Term Operating License (FTOL) is currently pending before the Commission. The review of this application is substantially complete, and NNECO believes no further actions are currently warranted on its part. The FTOL should be issued by the Staff shorti". The conversion therefore has not been explicitly included within the scope of ISAP topics. However, individual ISAP topics address those matters for which the Staff required technical input to support conversion. For completeness, a summary of events related to the POL /FTOL conversion is provided. The summary demonstrates the substantial efforts completed to date. In October 1970, the Atomic Energy Commission issued POL DPR-21 for Millstone Unit No.1, authorizing power operation on October 26, 1970. POL DPR-21 was originally issued for a period of 18 months. This interim
4-32 feasible, NNECO's decision was influenced by the potential that such an effort could reduce plar.t safety margins at a time when the plant is being upgraded to meet internal safety goals and objectlyes. Moreover, there currently is excess capacity in the NU system. In conclusion, NNECO has deferred the project, subject to possible revival in two or three years. The status of safety improvement initiatives and electric supply and demand circumstances would be among the more important decision-making parameters. If revived, NNECO plans to apply ISAP methodology to evaluate and prioritize necessary studies and plant modifications. 4.6 POL to FTOL Conversion An application for conversion of the Millstone Unit No.1 Provisional Operating License (POL) to a Full-Term Operating License (FTOL) is currently pending before the Commission. The review of this application is substantially complete, and NNECO believes no further actions are currently warranted on its part. The FTOL should be issued by the Staff shortly. The conversion therefore has not been explicitly included within the scope of ISAP topics. However, individual ISAP topics address those matters for which the Staff required technical input to support conversion. For completeness, a summary of events related to the POL /FTOL conversion is provided. The summary demonstrates the substantial efforts completed to date. In October 1970, the Atomic Energy Commission issued POL DPR-21 for Millstone Unit No.1, authorizing power operation on October 26, 1970. POL DPR-21 was originally issued for a period of 18 months. This interim a i
._. .- ~-
t 4-33
- period of routine operation was intended to allow the regulators and the licensee time to assess the plant's operating characteristics and resolve 4
i generic concerns related to reactor operations. In April 1971, the Millstone Point Company (MPC) requested that the POL be extended to December 1973. The POL was extended for the requested period on i June 5,1972 after the AEC had advised that it was ". . . currently determining the specific information that should be provided. . .for a full-term operating license (for Millstone Unit No.1)." i On September 1,1972, the MPC filed a timely request for conversion of the license to a full-term operating license. This application allowed Millstone Unit No. I to continue to operate with a POL under the provisions of 10CFR2.109 as a ". . . license will not be deemed to have expired until the application has been finally determined." In 1975, because of a backlog of unresolved generic issues relevant to the operation of POL plants, the NRC Staff halted review of POL conversions in order to establish the appropriate scope of review necessary to support a full-term conversion. This study resulted in a decision in 1977 to include POL facilities in Phase II of the Systematic Evaluation Program (SEP). As discussed elsewhere in the report, NNECO actively participated in the SEP for Millstone Unit No.1. In 1982, the NRC documented the results of the SEP, with the issue of draf t NUREG-0824 (the IPSAR). i NUREG-0824 was issued, in final form, following Commission review, in l February 1983.
- O
~ . . - . - - - - . - .--. - -- - - .- - - -. . - _ - - - - . . _ _ - . .__ _ _ _ __ ______ - _.
4-34 O) ( Concurrent with completion of the SEP review, the NRC established a policy as outlined in SECY-83-19 (January 17, 1983) that POL /FTOL conversions will be supported by a combination of documentation that will include: 1) the SEP assessment, 2) a Safety Evaluation Report (SER) 4 supporting conversion, and 3) an Environmental Appraisal or supplement to the Environmental Impact Statement as necessary. The major component of the Staff's conversion SER would be technical impact from the licensee addressing conversion issues not covered by the SEP and open - Issues from the IPSAR. In June 1983, NNECO proposed the expanded integrated assessment for Millstone Unit No. I which would address, among other issues, outstanding SEP issues and all pending licensing actions. Following the publication of the ISAP policy statement in November 1984, Millstone Unit No. I was selected to participate in the ISAP pilot program. IndividualISAP topics and numerous other routine licensing actions therefore have provided the Commission with the necessary technical input to support POL /FTOL conversion. ISAP and the other licensing actions lead to the issue by the ! NRC of NUREG-il43, " Safety Evaluation Report Related to the Full-Term Operating License for Millstone Nuclear Power Station, Unit No.1," in October 1985. 4 The Advisory Committee on Reactor Safeguards (ACRS) has also completed a review of the application for conversion of the POL to FTOL for Millstone Unit No.1. During its 308th meeting, December 5 - 7,1985, ACRS concluded that Millstone Unit No. I "can continue to be operated . . .under a full-term operating license without undue risk to the
4-35 health and safety of the public." The ACRS, in part, based this decision on NNECO's successful use of ISAP for identifying and scheduling the resolution of regulatory items. Following the ACRS decision, the NRO Staff prepared, in draf t form, Supp.ement No. I to NUREG-il43 (the conversion SER). This SER 1 supplement, in NNECO's view, resolved all remaining technical issues necessary to support the conversion. The draft supplement, a draft of the i revised FTOL, and " cleaned up" technical specifications were made available to NNECO in May 1986. Comments on these documents were forwarded by NNECO to the Staff on July 31,1986 (Reference 107). In summary, the last steps in the POL /FTOL conversion process have been completed. The FTOL should be issued for Millstone Unit No.1, a!!owing , operation until an expiration date of May 19, 2006, consistent with the Federal Register notice published on this matter on November 28,1972. 4.7 Change to 22 - 24 Month Fuel Cycle NNECO is currently investigating the impacts of increasing the projected Millstone Unit No. I cycle length to 22 - 24 months. This change would be made due to the replacement of the GE-7B fuel with the newer GE-8B fuel. Summarized below are those areas in which potential impacts have been or will be assessed. O
4-36 Core Component Lifetimes l 1 Increasing the nominal cycle length to 24 months is not expected to have ! an impact on control blade or LPRM expected illetimes. Enough margin exists in the lifetime predictions to allow operation for the same number : of cycles with 22 - 24 month fuel cycles. 1 Electrical Equipment Qualification (EEQ) EEQ issues will be analyzed to determine if they will be impacted by an increased cycle length. In general, EEQ issues are a function of temperature, pressure, and radiation variables that depend on plant physical configuration, system operation, and accident scenarios. Accident scenarios assume infinite power operation at rated capacity prior to the accident, to maximize decay heat, radiation fields, etc. Turbine Maintenance / Inspection Turbine maintenance and inspection is not expected to be affected by the ! increased cycle length. The recent short turbine inspection interval requirements are based on the 1.4 inch long crack above the keyway on the number 4 generator end wheel of the "B" low pressure turbine rotor. This crack was identified during the 1985 refueling outage, and was reinspected during the May 1986 turbine inspection. The inspection revealed that the crack had not grown. With the replacement of the "B" low pressure turbine rotor during the 1987 refueling outage, the recommended inspection interval is expected to be substantially longer.
4-37 Surveillance Testing Daily, weekly, monthly, quarterly, and annual surveillances will not be affected by an increased cycle length. However, NNECO is evaluating the impacts of delaying refueling outage surveillances two months. Although many 18 month surveillances could be performed during mid-cycle shutdowns, the Millstone Unit No.1 PSS currently assumes a 22 month testing interval for refueling outage surveillances. The increased cycle length is expected to result in a slight increase in the calculated core melt frequency. Three integrated primary containment leak rate tests must be performed in each 10 year service period. Since they must be conducted at 40 110 month intervals, they can be rescheduled to accommodate longer cycles. Safety-related hydraulic end mechanical snubbers are required to be demonstrated operable by peiforming visual inspections and functional tests. The current 18 month interval for performing these inspections and tests will need to be increased, since many of the snubbers are inaccessible during reactor operation. In-Service Inspection (ISI) The ISI program is divided into 10-year intervals with further subdivisions of 40 month time periods within the 10 year intervals. Increasing the cycle length to 22 - 24 months could shif t the performance of certain
4-38 G (V : inspections to a different refueling outage to meet the 40 month interval requirements. The total amount of work will not change. Actual cycle lengths are frequently greater than two months different than projected, causing ISI schedules to be subject to change for reasons indenndent of this initiative. Pipe Cracking Crack propagation calculations will need to be modified with longer cycles. It is expected that the crack depth acceptance criteria will be s!!ghtly reduced. Summary Millstone Unit No.1 is currently projected to operate the current cycle for longer than 18 months (December,1985 to July,1987). With the continuing replacement of the GE-7B fuel with GE-3B fuel, the period of time that the plant could continuously operate will gradually increase over the next several cycles. There are no identified obstacles to the increased cycle length. 4.8 Unresolved Safety Issues l l l In SECY-85-160, (Reference 8) Enclosure 1 (May 6,1985), the NRC Staff described the scope for the Millstone Unit No.1 ISAP as follows: i O The scope of review for this effort will be derived from all of the l pending !! censing actions, applicable USIs, high priority generic
4-39
^
issues, and utility plant improvements, as described in the Commission's policy statement. . . .However, the review effort will concentrate on those " topics" with a well defined scope and an apparent safety significance to assure efficiency and timely completion. Any other issues identified will be addressed in the integrated assessments, albeit superficially, for completeness. j With respect to the USIs, the Millstone Unit No.1 ISAP list of topics specifically includes many of those issues for which a plant-specific resolution has been identified by NNECO. Other USIs are indirectly impacted by on-going plant-spt eific projects also included within ISAP. These and all other USIs are briefly discussed below for completeness. A list of currently identified NRC USIs and applicable NRC tasks is provided in Appendix C to the " Safety Evaluation Report Related to the Full-Term Operating License for Millstone Nuclear Power Station Unit No.1," NUREG-Il43 (October 1985). The USIs and tasks are as follows: USIs (Applicable Task Numbers) (1) Waterhammer (A-1) l (2) Asymmetric Blowdown Loads on the Reactor Coolant System (A-2) (3) Pressurized Water Reactor Steam Generator Tube Integrity
- (A-3, A-4, A-5)
4-40 (4) BWR Mark I and Mark 11 Pressure Suppression Containments L (A-6, A-7, A-8, A-39) (5) Anticipated Transients Without Scram (A-9) (6) BWR Nozzle Cracking (A-10) (7) Reactor Vessel Materials Toughness (A-11) , (8) Fracture Toughness of Steam Generator and Reactor Coolant Pump Supports (A-12) (9) Systems interaction in Nuclear Power Plants (A-17) I (10) Environmental Qualification of Safety-Related Electrical Equipment (A-24) (11) Reactor Vessel Pressure Transient Protection (A-26) (12) Residual Heat Removal Requirements (A-31) f (13) Control of Heavy Loads Near Spent Fuel (A-36) (14) Seismic Design Criteria (A-40) (15) Pipe Cracks at Bolling Water Reactors (A-42) ] 1
I 441 (16) Containment Emergency Sump Reliability (A43) (17) Station Blackout (A44) (18) Shutdown Decay Heat Removal Requirements (A-45) l (19) Seismic Qualification of Equipment in Operating Plants (A46) (20) Safety Implications of Control Systems (A47) (21) Hydrogen Control Measures and Effects of Hydrogen Burns on Safety Equipment (A48) (22) Pressurized Thermal Shock (A49) The issues and, tasks fall into three groups: first, those which are not applicable to a BWR with a Mark I containment such as Millstone Unit No.1; second, those for which the NRC Staff has issued a NUREG report providing a proposed resolution; and third, those for which a generic resolution has not been identified by the Staff. The discussion and tables , provided below will provide cross-references between the task numbers, any Staff NUREG resolving the issue generically, NNECO implementation .l of any identified plant-specific resolution, and any applicable ISAP topic number. Based on this information, NNECO concludes that all applicable USIs and NRC tasks have been or are being appropriately addressed for Millstone Unit No.1. l t
4-42 4.8.1 Tasks Not Applicable to Millstone Unit No.1 The tasks that do not apply to Millstone Unit No. I are:
%-2 A-3, A-4, A-5 A-8 A-12 A-26 A-49 These tasks, except A-8, relate only to PWRs. Task A-8 applies only to BWRs with Mark 11 containments.
In the case of USI A-2, ISAP Topic No.1.44 addresses a confirmatory review of NUREG-0609 to assure that the issue has no safety implications for BWRs. In the case of USI A-12, ISAP Topic No. 2.14 expressly concluded that NUREG-0577, Revision 1, was no longer applicable to BWRs. 4.8.2 Issues Resolved Generically The issues for which the Staff has issued a proposed resolution are I discussed below. The issues, generic resolutions, and ISAP plant-specific l projects are as follows: O
4-43 Task Number Staff NUREfG ISAP Topic / Status A-1 , NUREG-0927 No.1.43; see also No.1.48, No. 2.22, No. 2.20
- A-6, A-7 NUREG-0661 Resolved A-9 NUREG-0460 No.1.18; see also (10CFR50.62) No.1.09, No.1.10 A-10 NUREG-0619 Resolved A-11 NUREG-0744 Resolved A-24 NUREG-0588 No.1,17 (10CFR50.49)
A-31 SRP 5.4.7 and BTP 5-1 Resolved incorporate requirements for A-31 A-36 NUREG-0612 Resolved A-39 NUREG-0793 No.1.46 A-42 NUREG-0313 Resolved; see also No. 2.05 For the above USIs included within the scope of ISAP, any open issue or proposed project is discussed elsewhere in this report under the l appropriate ISAP topic listed above. For all other issues (the " resolved" Issues), a brief summary of the plant-specific resolution is provided below l for completeness. USl A-6. A-7 l In NUREG-0661, " Safety Evaluation Report - Mark I Containment - Long-Term Program"(July 1980), the NRC Staff evaluated the gcncric criteria and analysis techniques proposed by the Mark I Owners Group to resolve this issue for plants with a Mark I containment. Based on its review, the l
4-44 Staff concluded that the proposed generic suppression pool hydrodynamic 4 load definition techniques, as modified by the Staff's requirements, provide conservative estimates of the dynamic loading conditions resulting from LOCA and SRV discharge events. Subsequently, by letter dated September 12, 1984, the Staff determined , that all necessary modifications to the Millstone Unit No. I primary containment have been made in accordance with the criteria of NUREG-0661. In NUREG-il43, paragraph 6.6.2, the Staff concluded that "the licensee's analysis verifies that the modifications have strengthened the containment sufficiently to meet the originally intended design safety i margins for the Millstone Unit No.1 Mark I containment." ' 'v) USI A-10 a i NUREG-0619, "BWR Feedwater Nozzle and Control Rod Drive Return Line Nozzle Cracking" provides the Staff's resolution of USI A-10. NNECO provided its response to the criteria of NUREG-0619 in letters of 3anuary 22,1981 and October 5,1981. Most significantly, to address this issue NNECO: a) installed an improved interference fit thermal sleeve and sparger hardware, and b) repaired feedwater nozzles by clad removal. The issue is resolved for Millstone Unit No.1, as discussed in NUREG-1143, paragraph 5.7. USIA-Il NUREG-0744, " Resolution of the Task A-11 Reactor Vesse! Material Toughness Safety Issue" (September 1981) describes the NRC's
4-45 rn requirements necessary to resolve this issue and to comply with 10CFR (v) Part 50, Appendix G, Section V.C. In NUREG-il43, paragraph 5.4.1, the NRC Staff concluded that this issue is resolved for Millstone Unit No.1. The Staff stated that:
. . .the combination of in-service inspections, conservative pressure-temperature operating limits and the use of material having acceptable fracture toughness provides assurance that the vessel integrity will be maintained at an acceptable level throughout
' service life. The generic safety items applicable to Millstone 1 (Iow upper shelf toughness, sensitized stainless steel safe ends, and CRD return line and feedwater nozzle cracking) have been succesafully i
resolved and will not adversely affect the integrity of the reactor O O vessel. USI A-31 This issue was included in Millstone Unit No.1 SEP review as Topic V-10B. This issue involves the equipment necessary to ensure reliable plant ! cooldown capability. Under SEP Topic V-10B, the Millstone Unit No.1 l equipment was reviewed against the criteria of SRP 5.4.7 and BTP RSB 5-
- 1. The Staff, in NUREG-1143, paragraph 5.6.2, concluded that the equipment was adequate to meet the topic safety objective. Thus, the issue is resolved.
4-46 o USI A-36 i NUREG-0612, " Control of Heavy Loads at Nuclear Power Plants" represents the NRC Staff's resolution of USI A-36. By letter from D. G. Eisenhut, dated December 22, 1980, the Staff requested NNECO to review existing controls for the handling of heavy loads against the guidelines of NUREG-0612. Subsequently, NNECO implemented interim measures at Millstone Unit No. I and provided the NRC Staff with several - submittals addressing compliance with NUREG-0612, most recently on July 15,1986 (Reference 108). In NUREG-ll43, paragraph 9.5, the NRC Staff concluded that load handling operations at Millstone Unit No. I will be conducted "in a highly V reliable manner" consistent with the Staff's objectives as expressed in the guidelines of NUREG-0612. In addition, in Generic Letter 85-11 (June 28, 1985), the Staff concluded that at Millstone Unit No. I the risk associated with potential heavy load drops is acceptably small and that the objective of NUREG-0612 for providing " maximum practical defense in depth" is satisfied. This issue therefore has been resolved for Millstone Unit No.1. USI A-42 USI A-42 was generically resolved with the issuance of NUREG-0313, Revision 1, " Technical Report on Material Selection and Processing Guidelines for BWR Coolant Pressure Boundary Piping" (July 1980). This j report set out the Staff's revised requirements for reducing the susceptibility of ASME Code Class 1, 2, and 3 pressure boundary piping and safe ends to intergranular stress corrosion cracking (IGSCC).
4-47 In its effort to comply with NUREG-0313, NNECO originally replaced all furnace sensitized safe ends, iso-condenser tubes, the RPV head spray spool piece, most of the Class 1 portions of the core spray and the iso-condenser supply, and the clean-up return spool piece. NNECO also removed the recirculation bypass, rerouted the CRD hydraulic line, and supplied the CRD from a deoxygenated source. Subsequently, during the Millstone Unit No. I 1984 refueling outage, NNECO ultrasonically examined a total of 215 intergranular stress corrosion cracking susceptible piping welds. These welds were located in the shutdown cooling system, LPCI, core spray, RWCU, and IC. The examinations revealed that 21 welds showed linear crack indications. Of these,7 were weld overlay repaired,13 were replaced, and I was not repaired as justified by fracture mechanics analysis. O In NUREG-ll43, paragraph 5.3, the NRC Staff approved NNECO's measures with respect to IGSCC. The Staff recognized the generic nature of the problem for all operating BWRs. NNECO believes that based upon the completed measures and the existing in-service inspection of ASME Code Class 1,2, and 3 welds at Millstone Unit No.1, this generic issue is resolved. Any changes to the inspection plans or any proposed piping modifications / repairs will be submitted to the Staff for review. In addition, under ISAP Topic No. 2.05, NNECO has evaluated a proposed project for further reducing the susceptibility of stainless steel to IGSCC. O
448 4.8.3 Issues Not Yet Resolved Generically 4 The issues for which no generic resolution has been issued by the Staff are discussed below. In NUREG-1143, Appendix C.3, the NRC concluded for each of these issues that there is reasonable assurance that Millstone Unit No. I can be operated pending resolution of the issue without endangering the health and safety of the public. In addition, NNECO has proposed plant-specific resolutions for several of the issues and included the issues in the ISAP review. The USIs, and, where appropriate, the ISAP cross-references, are as follows: Task Number ISAP Topic (s) A-17 No.1.45 A40 No.1.19 A43 No.1.47 A44 Nos.1.01,1.02,1.16.1,1.16.2,1.24, 2.17, 2.24 A45 Nos. 2.28, 2.29 A46 No.1.19 A47 N/A A48 No.1.11 A brief discussion of each of these USIs is provided below or under the relevant ISAP topics elsewhere in this final report. USI A-17 l O See the discussion under ISAP Topic No.1.45, Section 3 of this report. i
--m
449 USI A40 NRC regulations require that nuclear power plant structures, systems, and components important to safety (i.e., safety related) be designed to withstand the effects of carthquakes. USI A40 addresses the seismic design criteria for older plants such as Millstone Unit No. I which received construction permits and operating licenses before the NRC issued detailed requirements and regulatory guides regarding seismic J design. l This issue was addressed for Millstone Unit No. I as part of the SEP
\
review. Specifically, under SEP Topic 1114, NNECO and the Staff l conducted a confirmatory seismic review using the spectra specified in Regulatory Guide 1.60 with a peak ground acceleration of 0.2g. The results of the SEP review were reported in the IPSAR, NUREG-0824. The Staff identified a number of open issues with respect to Topic III4. 1 1 NNECO addressed the open issues in an Integrated Structural Assessment : Program and submitted the results on February 2 and March 16,1984. All open issues related to SEP Topic III4 (specifically, IPSAR Sections 4.2.1, l 4.2.2, 4.2.3, and 4.11.1) were subsequently identified to be within the scope of ISAP Topic No. 1.19. NNECO has submitted additional i information to the Staff on these open issues, as discussed under ISAP Topic No.1.19. Pending Staff review of NNECO's submittals, NNECO l considers SEP Topic III4, ISAP Topic No.1.19, and USI A40 to be resolved for Millstone Unit No.1. I u _, w ., .
4-50 USI A43
/ See the discussion under ISAP Topic No.1.47, Section 3 of this report.
USI A44 See the separate discussion of the station blackout issue in Section 4.1 of this final report. In addition, ISAP Topic Nos. 1.01, 1.02, 1.16.1, 1.16.2, 1.24, 2.17, and 2.24 address proposed projects relevant to the plant-specific resolution of this generic issue. 4 USI A45 i This generic issue involves an evaluation of possible requirements for , improved or alternative decay heat removal systems. Millstone Unit No. I already has various methods for removal of decay heat, which, as discussed in NUREG-Il43, provide reasonable assurance that the plant - can be operated safely. However, NNECO is further addressing this generic issue for Millstone Unit No. I under ISAP Topic Nos. 2.28 and 2.29. See the discussion under those topics. l 1 ) USI A46 This generic issue addresses the seismic qualification of equipment in operating plants. The concern addressed is that the design criteria and methods for seismic qualification of mechanical and electrical equipment have undergone significant changes in the time since licensing of Millstone Unit No.1. 1
4-51 Although the Staff has not generically resolved this issue, the specific safety concern has been addressed for Millstone Unit No.1. As part of 1 the SEP Topic III-6, the Senior Seismic Review Team performed an audit of Millstone Unit No. I safety-related structures, systems, and components. Most equipment was found to be adequate to withstand seismic loads. Open items from the SEP review are being addressed under ISAP Topic No.1.19. Meanwhile, Task A-46 now principally concerns
- efforts by the Staff to develop explicit guidelines to judge the adequacy of seismic qualification at all operating plants.
1 in addition, NNECO has participated in the Seismic Qualification Utility 1 Group pilot program for seismically qualifying selected nuclear plant components based on non-nuclear experience. Further, NNECO has upgraded the anchorages of a number of safety-related electrical components to reduce the risk of seismically induced equipment failures. These actions were taken in response to a January 1, 1980 letter (Reference 109) from the NRC and were approved by the Staff in a Reference 110. Adequacy of equipment anchorage has been determined to be an important element of the resolution of USI A-46. In addition, as a member of the SEP Owners Group, NNECO participated in a comprehensive testing and analysis program to demonstrate the seismic j adequacy of electrical cable trays and conduit raceways of the types used } } in SEP plants. In summary, the results of the SEP cable tray and i evaluation program indicated it is highly unlikely that any of the cable ! tray systems used in SEP plants will suffer structural collapse during a .I safe shutdown earthquake (SSE) of the magnitude specified for eastern O i
! SEP plants (Reference 111).
1 I i
4-52 ( In conclusion, NNECO believes that this generic issue has been adequately addressed on a plant-specific basis for Millstone Unit No. 1. We anticipate that the Staff's ultimate resolution of Task A-46 will reveal that this issue has been resolved at Millstone Unit No.1. USI A-47 This generic issue concerns the potential safety implications of control system failures during transients or accidents. The Staff's objective for Task A-47 is to either verify the adequacy of existing regulatory criteria for control systems or to develop additional generic criteria to be used for plant-specific reviews. However, as acknowledged in the discussion of this issue in NUREG-1143, strictly generic resolution of this issue is not O possible. The potential for an accident that would affect a control system, and potential effects of control system failures, differ from plant to plant. This generic concern has been addressed for Millstone Unit No.1. The Millstone Unit No. I safety systems have been designed with the goal of ensuring that the plant may be placed in a safe shutdown condition following any anticipated operational occurrence or accident. Control systems are designed such that control system failures will not prevent automatic or manual initiation of any safety equipment required to trip
- the plant or necessary to maintain the plant in a safe shutdown condition following the anticipated operational occurrence or accident. This is accomplished by providing independence or isolating devices between i safety and non-safety-grade systems.
1
4-53 The Millstone Unit No.1 PSS explicitly examined potential control system failures which could disrupt or possibly defeat safety system action. This was done by: b o Identifying all interfaces between safety, control systems, and support systems; o Developing event tree models which investigated possible outcomes of control and support system failures; and l o Developing fault tree models which investigated possible i dependencies and interfaces between various plant systems. The results of the PSS indicated no significant potential for adverse control systems interactions with safety systems. In addition, NNECO has performed systematic reviews.of safety systems with the goal of ensuring that control system failures will not defeat i j safety system action. For example, studies of the interaction of safety ! and non-safety systems were performed during the fire protection reviews in response to 10CFR50, Appendix R. These reviews also include NNECO's responses to IE Bulletin 79-27, " Loss of Non-Class IE Instrumentation and Control Power System Bus During Operation," and IE Information Notice 79-22," Qualification of Controi Systems." On the basis of these completed efforts, NNECO believes that it has I adequately addressed the safety concern of USI A-47 for Millstone Unit
- No. l.
l 1 4-54
/7 USI A-48 Following a postulated design basis accident (DBA), limited quantities of hydrogen gas are generated by the reaction of steam with the zircaloy fuel cladding in the core. If adequate quantities of oxygen and hydrogen exist in the containment, there is the potential for combustion or deflagration. To reduce or eliminate the potential for combustion or deflagration, 10CFR50.44 requires systems to control hydrogen concentrations in the containment atmosphere following a postulated i accident to ensure that containment integrity is maintained.
The accident at Three Mlle Island resulted in hydrogen generation well in excess of the amounts specified in the then-current 10CFR50.44. The j NRC determined that specific design measures are needed for handling larger hydrogen releases, particularly for small, low-pressure containments. Therefore, Mark I BWRs were required to have inerted containments. Inerting reduces the potential for combustion or deflagration by reducing the oxygen content in the containment atmosphere to the level that is not capable of reacting with hydrogen produced by an accident. NNECO has addressed this issue for Millstone t Unit No.1. The Millstone Unit No.1 Mark I containment is pre-inerted with nitrogen gas during power operation in order to preclude hydrogen burn. A combustible gas control evaluation (CGCE) was also performed and has shown that if the initial oxygen concentration in the containment is 4% or less (the technical specification !!mit), there is no potential for combustion or deflagration during or following a DBA. In addition, NUREG-0737 (Item !!.F.1.6) requests licensees to monitor containment l
I 4-55 hydrogen concentratlens. This discrete issue is addressed under ISAP Topic No.1.11. Based upon the above measures, NNECO believes that it had adequately addressed the safety concern of USI A-48 for Millstene Unit No.1.
- Summary NNECO concludes that all applicable unresolved safety issues and NRC i
tasks are being appropriately addressed for Millstone Unit No.1. In particular, through the integrated assessment aspect of the ISAP and the Millstone Unit No.1 PSS, plant-specific concerns are being identified which are related to several USIs. As these concerns are identified, NNECO initiates prompt action to review and resolve the issues in an expeditious manner. i 4.9 Containment Purge and Vent issues A number of issues related to the purging and venting of the primary containment at Millstone Unit No. I have been evaluated and assessed together, to determine the most optimal course of action. Some of these issues have been under review for several years. Our integrated evaluation has revealed that it is prudent and appropriate to cancel some modifications previously planned for implementation. i O
4-56 Issues included in the evaluation: o ISAP Topic No. 2.25 - Monitoring of Primary Containment i Leak Rate and Drywell Temperature o ISAP Topic No. 2.32 - Primary Containment Pump-Back System o Purge / Vent Line Debris Screens o Auto-Closure of the Purge / Vent Valves on High Drywell Radiation Signal O The current status of these issues is as follows: i o The ability to continuously monitor gross leakage from the primary containment, as required by Technical Specification 4.7.A.3.g, is currently under review. o The requirement to maintain at least a 1.0 ps! differential
- pressure between the drywell and the suppression chamber, as
, stated in Technical Specification 3.7.A.2, is accomplished by purging / venting of containment.
f o NNECO has committed to install a continuous primary l containment leak rate monitoring system and a torus to drywell pump-back system during the 1987 refueling outage.
4-37 o Previously, NNECO had committed to installing debris screens for the drywell purge and vent valves. o The NRC Staff has recommended that the containment purge / vent valves must close automatically on a high drywell radiation signal. The following discussion provides a brief history of the evolution of these purge and vent issues. On March 20, 1978, NNECO submitted a proposal to delete the Technic;l Specification surveillance requirement for primary containment continuous leak rate monitoring (Reference 92). The basis for this change was that the surveillance was impractical. The method of continuous monitoring was originally intended to be to monitor the amount of nitrogen added to the drywell to compensate for drywell leakage. Obtaining accurate results was compromised by the need to add additional nitrogen to maintain the differential pressure between the drywell and the torus and to re-Inert in order to control oxygen bulld-up during operation. In a letter dated October 31,1979 (Reference 93), NNECO Informed the NRC that plant changes were being assessed which would make the existing monitoring method more accurate. It was requested that the I Staff postpone its review of the proposed license amendment request. i l in an April 16,1980 letter (Reference 94), NNECO Informed the NRC that evalu?tions concluded that the existing Technical Specification for 1
4-38 continuous leak rate monitoring via nitrogen make-up could not be accomplished with either existing equipment or by utilizing other instrumentation. The large volumes of make-up nitrogen needed to repressurize the drywell to maintain the ! psid between the drywell and the torus masked the relatively small volume of nitrogen required to compensate for drywell leakage. NNECO stated that in order to accurately verify containment integrity, extremely accurate monitoring of all thermodynamic parameters in the drywell and torus, which , continuously vary with time, would be required. The installation of a gas flow-meter in the atmospheric control system piping was also considered, I which would provide data on the volume of gas vented. NNECO concluded that the Technical Specification requiring continuous leak rate monitoring via nitrogen make-up was nonviable, and should be deleted. O After many telephone conversations and letters between NNECO and the Staff, in which detailed information concerning purging and venting was transmitted, the Staff issued a Safety Evaluation Report (SER) on June 7, 1984, concerning NNECO's proposed revision to the Technical Specifications for continuous leak rate monitoring (Reference 95). The Staff concluded that it would be acceptable to delete Technical Specification 4.7.A.3.g, concerning continuous leak rate monitoring, if NNECO submitted an alternate Technical Specification surveillance that meets the intent of Technical 5pecification 4.7.A.3.g. The SER stated that "a review of pressure trends before and af ter initiating a nitrogen purge and vent and the trending of time periods between venting and purging can be ut!!! zed to indicate pressure response anomalies indicative of gross containment leakage." Because purge and vent data are logged
4-59
\
routinely, a timely indication of leakage would be available. The Staff noted that Millstone Unit No. I's method of maintaining the 1 psi ) i differential pressure between the drywell and the torus provided a means i to assess gross containment leakages via trending. On February 25,1985, the Staff issued an SER (Reference 96) concerning containment purging / venting which concluded: o Debris screens must be provided for the purge / vent valves to ensure that valve closure would not be prevented by debris which could become entrained in escaping air and steam. o All purge / vent valves must close automatically nn high drywell radiation signal. in a letter dated March 19,1985 (Reference 97), NNECO stated that a containment pump-back system, which would be able to take suction from the torus and discharge to the drywell, eliminating the need for purging or venting to control the differential pressure between the drywell and the torus, would be installed, beginning during the 1985 refueling outage. In addition, NNECO committed to install the instrumentation necessary to continuously monitor containment leak rate. NNECO requested that Technical Specification 4.7.A.3.g be retained, since full compliance with it would be achieved upon the completion of the noted modifications. In a June 28,1985 submittal (Reference 98), NNECO committed to install f debris screens to protect the containment purge / vent valves, and to
4-60 A (j attempt to reduce the amount of containment purging / venting, which would reduce the amount of time that the purge / vent valves are open during operation. NNECO stated that either the 1.0 psi differential pressure between the drywell and the torus would be eliminated, or a torus to drywell pump-back system would ba installed. Each of these measures would significantly reduce the amount of purging / venting of Millstone Unit No.1. On November 20,1985 (Reference 99), NNECO informed the Staff that a continuous leak rate monitoring system would be installed during the 1987 refueling outage. The containment pump-back system, unless cancelled due to the possible elimination of the drywell to torus differential pressure, was to be installed during the 1987 refueling outage also. in a letter da'ted December 3,1985 (Reference 100), the Staff accepted NNECO's proposal to delay the above modifications until the 1987 refueling outage. In the interim, the maintenance of the drywell to torus differential pressure and the containment inerting required by the Technical Specifications would " provide a gross measure of containment leakage integrity over and above the testing requirements in 10CFR50 Appendix 3." On May 2,1986, the Staff issued an SER concerning containment purging and venting (Reference 101). The SER restated NNECO's commitment to install debris screens in the purge / vent lines. The Staff also accepted NNECO's commitment to reduce the amount of purging / venting by
- installing a pump-back system, or demonstrate that the drywell to torus
i 4-61 differential pressure was not necessary. NNECO was requested to either commit to modify the purge / vent valves to close automatically on high drywell radiation signal, or else justify our contention that other monitored parameters would isolate the valves before a high radiation signal would be generated. All of these modifications were to be completed during the 1987 refueling outage. 4
! NNECO's July 3,1986 submittal (Reference 102) provided the requested l additionalinformation to justify that automatic closure of the purge / vent
] valves on high drywell radiation signal is unnecessary. NNECO showed that an undetected small break 1.OCA occurring during drywell i inerting/deinerting which is small enough to prevent containment pressure i from reaching the Group 11 Isolation setpoint of 2 psig, would not exceed 10% of the guideline values of 10CFR Part 100. The radiological i consequences of such a small reactor coolant system leak would be well f below the levels of regulatory concern, and the probal.llity of such a leak 3 occurring during the short period of time that the purge / vent valves are open with the reactor in the operating mode is exceedingly low. Although the necessary engineering analyses and design for the continuous leak rate monitoring system, the purge / vent line debris screens, and the torus to drywell pump-back system have all progressed to support our ; commitments for their implementation during the 1987 refueling outage, the integrated evaluation of purge and vent-related issues has revealed 4 that some of the modifications should not be implemented. A consensus
; was developed af ter evaluating probabilistic risk assessment insights, radiological implications, operational / plant needs, and other related i ; factors.
l l.._. - _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _
4-62 O Q The resulting plan is to make modifications to improve containment temperature monitoring, and to implement the torus to drywell pump-back system. Gross containment leakage will be monitored by trending drywell purge frequency and duration. The purge / vent line debris screens will not be installed, and automatic closure of the purge / vent valves on high drywell radiation signal has been determined to be unnecessary. Originally, NNECO considered installing a sophisticated system which would continuously monitor both primary containment leak rate and temperature. It was determined that a continuous leak rate monitoring system would be very expensive (over a million dollars), would be technically very complicated, and, in fact, might not work. However, Investigations resulted in the recommendation that some of the existing temperature sensors in the drywell should be replaced during the 1987 refueling outage. Data obtained from the temperature sensors will provide direct input to the plant process computer to calculate containment bulk temperature, and will provide more accurate temperature indication for use with the Emergency Operating Procedures. NNECO will propose an alternate Technical Specification surveillance that meets the intent of Techalcal Specification 4.7.A.3.g, as was suggested by the Staff in their June 7,1984 SER. Pressure trends before and alter purging with nitrogen will be monitored and the tims periods between successive purgings /ventings will be used to detect gross containment leakage. Plant procedures will be developed to provide the O V trending methodology to be employed, and the appropriate operator ac,tions to be taken to prevent gross leakage of the primary containment atmosphere.
4-63 Even though NNECO committed to install debris screens to protect the v purge / vent valves as recommended by the Staff, NNECO continues to contend that this modification will have an extremely small safety benefit, and will not provide any benefit to the operation of the plant. The probability of a LOCA occurring while the purge / vent valves are open is minimal. Inerting or deinerting of the drywell is limited to 24 hours each by Technical Specification 3.7.A.6.b. The installation of the torus to drywell pump-back system will greatly reduce the amount of purging / venting currently needed to maintain the I pst differential pressure between the drywell and the torus. Therefore, the amount of time purge / vent valves are open, providing a flow-path for entrained debris, will be reduced significantly. A study to determine if the 1 psi differential pressure between the drywell and the suppression chamber was necessary, concluded that the requirement should be retained. The implementation of the torus to drywell pump-back system, scheduled to be completed during the 1987 refueling outage, will provide several benefits. By taking a suction from the torus and discharging to the drywell via the drywell compressor system, the pump-back system will enable the maintenance of the 1 psl differential pressure between the drywell and the torus, as required by Technical Specification 3.7.A.2, without purging and venting. Nitrogen usage will be reduced, trending of containment leak rates will be simplified, and the reduced venting will
- significantly reduce the amount of time that the standby gas treatment system is in operation. The benefits of automatic closure of the 2-Inch
4-64 O purge / vent valves on high drywell radiation signal and the purge / vent line V debris screens will be reduced due to the reduced amount of purging / venting. In summary, NNECO has chosen to pursue the implemt.ntation of modifications to Millstone Unit No. I that will have the greatest benefit to plant operations and will most effectively and efficiently address the Staff's concerns on purge and vent issues. Modifications determined to , have the least benefit to the operation of the plant and the safety of the public are proposed to be eliminated. NNECO requests written Staff I concurrence with this approach via its review of this finalISAP report for Millstone Unit No.1. O V 4.10 Review of Operating Experience Allied to the Millstone Unit No.1 ISAP is a review of the plant's operating experience through 1984. Succinctly stated, the evaluation of plant operating experience and reliabl!!ty data, including !!censee performance (i.e., SALP evaluations), supplements the deterministic review and plant-specific PRA of the ISAP toples. This step in the ISAP evaluation process was intended to identify significant areas for plant improvements, whether or not presently included within the list of ISAP topics. In addition, operating experience data will provide a benchmark for assessing the importance of currently proposed projects. Specifically, the NRC Staff contracted with the Oak Ridge National l.aboratory's Nuclear Operations Analysis Center (NOAC) to perform the i
4-65 p operating history review for Millstone Unit No.1. The review included U collection and evaluation of data on availability and capacity factors, forced shutdowns, forced power reductions, reportable events, environmental events, and radiological release events. These data were analyzed to identify any trends and symptoms of potentialimportance to resolution of regulatory actions applicable to the plant. The objective of the contractor's review was to provide insights into the actual strengths and weaknesses of the design, operation, and j maintenance of Millstone Unit No.1. The review also updated an earlier operating experience review of the plant conducted for the SEP. ! The NRC Staff provided NNECO with a draft report on the operating experience review, prepared by its contractor, in Reference 112. The Staff invited NNECO's comments, which in fact were provided in Reference 1.13, dated October 3,1985. The review identified no major challenges to plant . safety and concluded, based on above-average i 4 availability and capacity factors and a relatively small number of significant reportable events, that Millstone Unit No. I has had a "better than average" operational record. In fact, Millstone Unit No. I accomplished a run of, 374 days which ended on August 13,1985. This run
- 1s indicative of and reflects highly on the quality operation of Mllistone j Unit No.1. However, based in part on the operating experience, the Staff i identified at least two additional topics to be considered under ISAP. See ISAP Topic Nos.1.50 and 1.52. These will be addressed at a later date.
l 4-66 The operating experience review findings also provide NNECO and the NRC Staff with an indicator of the importance of various ISAP proposed projects. For example, the Staff's contractor made findings with respect i
, to experience related to concerns addressed in five regulatory topics.
l l These review findings will be used in Identifying specific resolutions to : ISAP topics related to those regulatory topics, and in prioritizing proposed projects for implementation. The operating experience review thus j provides an independent consideration for evaluating and ranking ISAP ! projects. i } Another yardstick for measuring the performance of a plant is the NRC's I Systematic Assessment of Licensee Performance (SALP) program. SALP j i
- is an integrated NRC Staff effort to collect information periodically and l
evaluate licensee performance. The most recent report for Millstone Unit I No. I covered the eighteen-month period ending February 28,1985. Of the nine categories evaluated for Millstone Unit No.1 (Plant Operations, l f f Radiological Controls, Maintenance, Surveillance, Fire Protection / Housekeeping, Emergency Preparedness, Security & i
- Safeguards, Refueling & Outage Management, and Licensing activities),
i seven were rated Category 1 (decreased NRC attention may be appropriate) and two were rated Category 2 (normal NRC attention should , i i be maintained). In addition, all categories were judged to be either ; consistent or improving . Overall, the NRC noted the " licensee l performance was good during this SALP period." NNECO believes that i SALP data may be a useful source of Information for decision-making regarding the more subjective ISAP issues. i !O I I lI
*~---n-q rs ~w-s s w w -wo - wow m-e we s m wn- w m , m, v r e m m e m ,- w w- wo v= -, - w s-m ow em,e- m
l 5-1 SECTION 5 - REGULATORY POLICY ISSUES l 5.0 Introduction This section includes a discussion of significant regulatory policy issues not specifically evaluated as ISAP topics. NNECO believes that these significant regulatory policy issues are indirectly impacted by the Millstone Unit No.1 ISAP. ISAP methodology and plant projects being specifically . evaluated under ISAP are relevant to resolution of these policy matters. 5.1 Severe Accident Policy Statement In August 1985, the NRC published a Severe Accident Policy Statement O (50 Fed. Reg. 32138) describing the Commission's intention to resolve safety issues related to reactor accidents more severe than design basis accidents. The NRC concluded that existing plants pose "no undue risk" to l public health and safety and that no further regulatory action is required to deal with severe accident issues unless significant new safety information becomes available to question whether there is adequate assurance of no i undue risk. Should such information become available, NRC would assess whether the issues presented were generic or plant specific and then determine the most cost-effective option for improvement. As a result of this Policy Statement, the Commission withdrew its advance notice of proposed rulemaking on Severe Accident Design Criteria. Nevertheless, the Commission stated its intent to require a " limited scope , accident safety analysis" from each licensee of an operating reactor. I l
,--.-.,.____.,_,_..-._,n_,
5-2 These plant-specific analyses will be " designed to discover instances (i.e., outliers) of particular vulnerability to core melt or to unusually poor containment perfosmance given core melt accidents." The plant-speelfic studies are intended by the NRC to verify that conclusions developed from intensive severe accident safety analyses of reference or surrogate plants can be applied to each of the individual operating plants. NNCCO believes that the Living PRA Program and ISAP, developed for Millstone Unit No.1, in large measure address the intent of the Severe Accident Policy Statement. This can be seen by examining the following facets of the two related programs: 4 o identification of Risk Outliers - The Millstone Unit No.1 Level 1 PRA models were explicitly developed to identify and I probabilistically rank scenarios leading to severe accident sequences. These models were responsible for identifying the possible vulnerabilities to weguences such as those related to inadequate long-term decay heat removal. The Level 1 PRA models are currently being expanded with passing time to address the risk of external event accident initiators. As a milestone in this process, the models were supplemented with a fire risk assessment Jn March 1986. In addition, an internal flooding risk assessment is scheduled for completion in late i 1986. The scope of these Millstone Unit No.1 PRA models constitutes a significantly greater level of detail than the simplified systematic approach advocated in the Commission's Policy Statement.
5-3 o Identification of Cost-Effective Options for Improvement - In our view, the ISAP process constitutes an acceptable methodology to define and prioritize options for addressing outliers found through the PRA model development efforts. Thus, NNECO believes the intent of the Policy Statement is further met via a combination of the Living PRA Program and ISAP. 4 o Prevention of the Introduction of New Risk Outtlers - An
- internal application, which has less visibility to the NRC but l which constitutes a major use of and one of the original reasons i
for developing the Living PRA Program, is the screening of proposed plant design change requests using the PRA models. By doing this, NNECO goes beyond the intent of the Policy i, i Statement (which only addresses identifying existing outilers) to { the point where NNECO is actively using the PRA models to pinpoint proposed changes which could increase risk. As an
- example, the PRA models identified proposed modifications to i
the Millstone Unit No. I undervoltage protection logic which, while complying with NRC requirements and applicable industry standards, would have notably increased the frequency of station blackout. The proposed changes were not approved by ] NNECO and a redesign effort was subsequently initiated. l NNECO believes this process of preventing new potential risk outtlers far exceeds the intent of the Policy Statement. { O i i
5-4 o Evaluation of Containment Performance Given Core Melt - NNECO has been focusing its current activities on identifying potential core melt risk outilers on all of its operating nuclear power plants. Thus, NNECO's current focus can be characterized as a concentration of " severe accident f prevention" by early identification of outliers and by initiating improvements. NNECO currently has at least Level 1 PRA models on Millstone Unit No. I and Millstone Unit No. 3 (currently a Level 3 PRA). (In addition, Connecticut Yankee Atomic Power Company currently has a Level 1 PRA on the Haddam Neck Plant.) Following completion of the Millstone Unit No. 2 Level 1 Probabilistic Safety Study, NNECO plans to evaluate Millstone Unit No. I containment performance either by expanding the scope of the current PRA models to Level 3, or by using the forthcoming guidance from NRC for performing
- a systematic evaluation. We believe that this effort will address, specifically for Mllistone Unit No.1, recent NRC Staff concerns regarding the integrity of Mark I containment given a severe ' accident has occurred. We have not yet embarked upon the development of detailed procedures, since these containment performance / severe accident mitigation issues are second priority when compared to Level 1 PSS and design change control activities. Ultimately, we believe the intent of the Commission's Policy Statement will be satisfied or surpassed.
O r
5-5 NNECO believes that its existing and planned programs for Millstone Unit No. I fully satisfy the Commission's policy that each licensee perform a
" limited scope accident analysis." The above discussion summarizes our current plans to respond to the Severe Accident Policy Statement.
i 5.2 Treatment of External Events The Living PRA which supports the ISAP public safety attribute evaluation a considers internal events and fires. External events such as high winds and l earthquakes have not been evaluated in detail in the plant-specific PSS. Both the independent review of the ISAP (performed for NU - see Section 9.2) and the NRC Staff have noted that external events could be dominant risk contributors, and thus may warrant consideration. This is
, especially true in light of the considerable backfits already planned or accomplished to address significant internal event sequences.
i Nevertheless, NNECO strongly believes that the present limitation on the i i PRA and the ISAP public safety evaluation is amply justified. The Millstone Unit No.1 SEP review included an exhaustive review of earthquakes, winds, tornados, flooding, and other external phenomena (e.g., Topics II-3.B, III-2, III-3.A, III-4.A, III-6). In addition, NNECO has expended significant resources on evaluations and upgrades at Millstone Unit No. I during the 1980s to address external phenomenon. Some of these projects address open items from the SEP, and some of the projects are specifically included within the Millstone Unit No.1 ISAP topic list i (e.g., Topic Nos. 1.02, 1.06, 1.19, 1.41). External events are also being addressed in conjunction with NNECO's plant-specific review of the station 1
I 5-6 blackout issue (see Section 4.1). The Millstone Unit No.1 PSS already includes probabilistic fire analyses. This Appendix R effort is currently in the implementation phase (see ISAP Topic No.1.16). Thus, there is ample justification to conclude that external events are not being entirely excluded from backfitting decision-making and that immediate inclusion in the NNECO PRA and ISAP efforts is not warranted. This is particularly true given the comparatively large uncertainties surrounding probabilistic treatment of external phenomena. Notwithstanding the above conclusion, NNECO acknowledges that the ISAP can be improved in regard to treatment of external events. ISAP is intended to be a coherent systematic tool for evaluating potential backfits based upon all ascertalnable considerations. Therefore, NNECO intends to consider the need inr improvements in this regard after completion of the Millstone Unit No. I and Haddam Neck pilot ISAP efforts. An important aspect of our decision will be an assessment of the benefits which could be derived given the resource intensive nature of the problem. I l j 5.3 Safety Goals i On June 19, 1986, the NRC approved a Policy Statement on Safety Goals for the Operation of Nuclear Power Plants. In the policy statement, the Commission approved two qualitative safety goals and two quantitative health effect objectives to be used in the regulatory decision-making process. As a result of the policy statement, the Commission also I explicitly recognizes potential uses of the safety goals as follows:
, 5-7 "The Commission recognizes that the safety goal can provide a useful tool by which the adequacy of regulations or regulatory decisions regarding changes to the regulations can be judged. Likewise, the
~ safety goals could be of benefit in the much more difficult task of f assessing whether existing plants, designed, constructed and operated I to comply with past and current regulations, conform adequately with ] the intent of the safety goal policy." l
~
Implicitly, through this policy statement on safety goals, the Commission recognizes the utility of probabilistic techniques to demonstrate the
- adequacy of operating nuclear plants. NNECO believes that ISAP, I combining probabilistic, deterministic, and subjective analyses, is i
completely consistent with the policy statement. l O Similarly, as a result of the Commission's policy statement, the NRC Staff has been directed to develop specific guidelines to be used as a basis to l determine whether proposed regulatory actions are consistent with the safety goal policy and quantitative objectives. Unlike earlier draft i versions of the policy statement, the Commission's final policy statement I did not include quantitative guidance on core melt frequency or cost-l ber efit evaluations. Instead, the Commission proposes for study a general
- performance guideline to tne effect that the probability of a large release of radioactive material to the environment should be less than 1 x 10 4 per l reactor-year. NNECO's ISAP evaluation process (specifically the ARM) includes a methodology to score all pending proposed backfits and to define a threshold for deciding whether a specific proposed project should be
, undertaken. NNECO utilizes core melt frequencies and cost-benefit l
5-8 evaluations. NNECO believes that the development of guidelines by the NRC Staff to implement the Commission's guidance should reflect NNECO's substantial experience gained in ISAP from the development of the ARM. At a minimum, NNECO believes its goals, methodologies, and thresholds defined for ISAP should be viewed as generally consistent with the Commission's quantitative safety goal objectives. Finally, in this regard it should be noted that in 1981, NNECO formulated internal safety goals which were signed by senior management and published as Policy Statement #19 of the Nuclear Engineering and Operations Group. These goals were patterned after those originally suggested by the Atomic Industrial Forum, and pre-date the Commission's policy statement. A key effect of having such corporate safety goals is the formal identification to all employees of the levels of safety for which the company is formally striving. Equally important is the identification of risk levels which senior management considers to be unacceptable over the short term and long term. The existence of officially defined safety / risk level objectives provides working level personnel with a clearly defined charter, sanctioned by senior management, to continue to seek out cost-effective opportunities to improve the safety of NU's nuclear power plants until the goals are achieved. The NNECO Safety Goal Policy Statement is implemented by the Living PRA Program and by ISAP. For example, as a result of the PRA, Millstone Unit No. I has been determined to currently exceed our corporate goal for predicted core melt frequency. Because of this, a number of hardware and i procedural improvements are currently being considered within the ISAP
N 3-9 prioritization process. These improvements have been prioritized and ranked as discussed above, and will be included, as appropriate, in the integrated implementation schedule. This example demonstrates that ISAP specifically supports the concept of safety goals and provides an important methodology for achieving those goals and overall excellence in power plarit operations. j 5.4 ACRS Ten-Year Review The NRC's Advisory Committee on Reactor Safeguards (ACRS) has never routinely requested or performed ten-year reviews of operating nuclear power plants. However, the ACRS has frequently recommended such
""'''' """ "*''"""'^""*"'"'"'^"
' CJ objectives for such a review. The ACRS has often noted the need for a routine systematic review of operating facilities in light of current knowledge and developments in the licensing process. This recommendation was an important element of the motivation for the SEP. Following the TMI-2 accident, the need has become even more acute due to the backlog of plant backfits. Regulatory developments include the substantial requirements of the TMI Action Plan as well as significant new requirements, for example, in the areas of electrical equipment qualification, fire protection, and onsite emergency I response capabilities. ISAP effectively encompasses a review of all incomplete regulatory backfits and licensee projects for Millstone Unit No. 1. ISAP also 3
- -w c- - , r...., - --
5 - 10 encompasses potential plant-specific resolutions of various unresolved safety issues for which the NRC Staff has yet to publish a generic resolution. As such, ISAP embodies a thorough review of the status of Millstone Unit No. I relative to the current regulatory scheme and the current state of knowledge. NNECO concludes that ISAP, if not in name, then at least in intention and spirit, satisfies the traditional ACRS recommendation for a ten-year review. i 5.5 Technical Specification Improvement Initiatives In 1982, the NRC issued a proposed rule addressing technical specifications for nuclear power plants (47 Fed. Reg. 13369 (1982)). This was the beginning of an initiative on the part of the NRC and the industry to reduce the administrative and operational work load associated with technical specification compliance. At that time, the NRC proposed two new categories of specifications. The first, Technical Specifications, r would cover only system settings and limiting conditions of operation of immediate significance to safety. The second, Supplemental Specifications, would address routine monitoring, surveillance, and administrative matters. Only the former category would be incorporated as part of the operating license. This change would substantially reduce the number of technical specifications, which currently are overly complicated and cumbersome to use. The change would also improve the current process for amending specifications of relatively low safety significance.
5 - 11 On December 31, 1984, the NRC established the NRC Technical Specification Improvement Project (TSIP). The TSIP issued its final report on September 30, 1985, recommending a program for improving technical specifications. The TSIP, however, concluded that its proposed changes could be implemented by policy rather than rulemaking. Similar industry initiatives were undertaken by the AIF Subcommittee on Technical Specifications. In October 1985, the AIF reported its own recommendations for technical specification improvements. To ensure future regulatory stability, the AIF recommended rulemaking rather than the policy prepared by the TSIP. NNECO believes that technical specification improvements are clearly warranted; both from the perspective of the substance of the specifications and the associated administrative / licensing process. NNECO has specifically endorsed the AIF initiative in this regard. That effort has provided criteria for determining the appropriate content of technical specifications, reducing many of the current problems. Application of the AIF criteria should also proceed in parallel with the other specific short-term recommendations identified by the TSIP and the AIF. These short-term measures can produce additional significant immediate improvements. NNECO also believes plant-specific initiatives to improve technical specifications are necessary regardless of the ultimate fate of the NRC's rulemaking effort. Probabilistic methodology such as that developed in conjunction with the Millstone Unit No. 1 PSS and the ISAP can significantly contribute, on a plant-specific basis, to the effort to " clean-
. _ . _ ~ _.
5 - 12 up" and " rationalize" technical specifications. Moreover, a thorough plant review and assessment such as ISAP has and will enable NNECO to identify potential technical specification and hardware changes. These changes will be identified and evaluated in light of impact upon public safety as well as economic plant performance, personnel safety, and personnel productivity. NNECO will pursue improvements to the Millstone Unit No. I technical
, specifications as a complement to the ongoing AIF/TSIP effort. However, it should be noted that there are practical limits to this initiative. There is already a backlog of proposed technical specification changes which NNECO would like to pursue. NNECO has not yet been able to identify the resources and priorities for these proposed changes. For the near term, we plan to work with the Staff to finalize the reissuance of Appendix A to the
> O FTOL, which would reflect various improvements in format and clarity. We also plan to continue pressing several other amendment requests which t refine discrete aspects of existing Technical Specifications. 1
- Longer term considerations include the following. In theory, ISAP I
methodology would lend itself to an initiative to address all proposed technical specification improvements. An ISAP-type prioritization process i
- would enable both NNECO and the NRC to focus on the most important i
i (i.e., most cost-effective) technical specification changes. This would ease the backlog of proposed changes requiring either feasibility analysis or j licensing action, and would expedite implementation of the most important l changes. However, it must be cautioned that the ISAP mechanism must be l O further refined in order to make this application practical on a broad scale 1 0 l with respect to previously identified proposed changes. As presently
5 - 13 defined, the amount of effort involved in an ISAP evaluation of one given proposal for a technical specification change may far outweigh- the potential benefit from implementation of that change. The large number of issues to be evaluated and relatively low potential performance benefits also must be considered. Further development of the ISAP mechanism is required in order to minimize the effort involved in performing threshold ISAP evaluations of each proposed change. Ultimately, we envision that l NNECO will consider generic TSIP developments, as they relate to utility- -l l specific ISAP initiatives, to arrive at the optimum method of implementing ' Technical Specification improvements. i 5.6 Life Extension U) Both the industry and the NRC are beginning actively to examine the issues surrounding life extension of nuclear power plants. The Atomic Industrial Forum (AIF) has established a National Environmental Studies Project (NESP) on plant life extension. Similarly, the NRC has formed the Technical Integration Review Group for Aging / Life Extension. NNECO is actively engaged in examining the studies being conducted. NNECO recognizes that decisions on life extension, decisions that ultimately will be based on important regulatory and economic considerations, are currently premature. However, it is our intent to factor ISAP into the life extension work currently being undertaken. F Specifically, NNECO believes that it is important to assure that SEP plants i such as Millstone Unit No.1 (licensed before the advent of 10CFR50, Appendix A) have an equivalent level of safety as those licensed under the 1
5 - 14 current regulatory regime. The ISAP will help to assure that equivalent safety is maintained throughout any extended life of the plant via an on-going integrated assessment of the plant. Therefore, NNECO believes, that the ISAP will help to determine whether any special considerations will be warranted for Millstone Unit No. I life extension. Should life extension ever be considered for Millstone Unit No.1, application of ISAP methodology would assure that any relevant safety and regulatory issues would be evaluated in an integrated effort to determine the most feasible, safe, and cost-effective method for extending the life of the plant. Given that the Haddam Neck Plant is the oldest nuclear unit:in the NU system, we anticipate that our initial detailed review of the life extension f issue will be completed at that unit. The technology and lessons learned will then be reflected in any life extension effort unique to Millstone Unit No.1. l O
6-I m SECTION 6 - MAJOR REFUELING OUTAGE PROJECTS AND ACTIVITIES 6.0 1985 Refueling Outage Projects completed during the 1985 Millstone Unit No. I refueling outage were not specifically included within the list of ISAP topics. These projects are briefly discussed below. Seismic Hanger Modifications Modifications were completed on 77 supports out of a total of 130 supports available to be worked. In addition, modifications were completed on 44 supports prior to the outage. O Replacement of Motor Operator Valves This project consisted of the replacement of the motor operators and some work on valve internals on a total of seven motor operated valves (MOVs). The valves worked were 1-IC-3,1-LP-7A and 7B,1-LP-10A and 10B, and 1-CS-5A and 5B. A torque switch for valve motor operator on SW-9 was also replaced for environmental qualification purposes. Drywell Ventilation The goal of this project was to replace as many units as possible without impacting the outage critical path schedule. Replacement of five coils was ! targeted as the minimum desired number, with replacement of all eight to l
6-2 ; ( l
\
( be accomplished only if outage duration allowed. During the outage, a ' total of five were in fact installed. Coils were replaced in HVH-18,19, 20, 21, and 22. Replacement of the coils in HVH-26,27 and 28 is being planned for the 1987 outage. IGSCC Contingency Plan This contingency plan required personnel and equipment on site to support potential pipe replacement or weld overlay activities identified as a result of the in-service inspection (ISI) program. As a result of the ISI inspections, six welds were in fact weld overlayed. Five of these welds were on the jet pump instrumentation nozzles and one was on the isolation condenser. Electrical System Oscillograph This project included the installation and start-up of a digital fault recorder system consisting of two data acquisition units and two dot matrix printers. The unit continuously monitors various systems and will collect data during a fault or system perturbation from 32 voltage and current inputs and 64 event channels. These include the main generator and transformer, diesel and gas turbine generators, reactor protection system, vital and instrument AC, normal and reserve station service transformers, and 4160 and 480 volt buses. O
6-3 ( Voltage Regulators for the Instrument Vital and Reactor Protection Buses This project included the installation and testing of two 45 kVa single phase regulating transformers and two protection packages consisting of shunt trip circuit breakers and ground fault relays that replaced the existing 50 kVa, IRP-1 and IV-1 dry-type transformers. Computer Replacement , Activities under this project were limited to the testing and installation of
- a 600 amp D.C. breaker that will be the supply breaker for the computer
, uninterruptible power supply. O Main Generator Neutral Ground Transformer Replacement This project included the installation and testing of a 167 kVa dry-type i transformer to replace the original PCB filled unit and the installation of a more sensitive stator ground detection scheme. Gas Turbine Vibration Monitoring System i This project encompassed the installation of a new Indicating unit in the gas turbine control house and the installation of new sensors and j monitoring units at the gas turbine. o
6-4 Station Battery Replacement Station Battery A was replaced with a new IEEE qualified battery. Battery B was replaced during the 1984 outage. Gas Turbine Battery Replacement The existing gas turbine battery was replaced with a new 125 VDC power supply. Replacement of the Switchyard Supervisory and Events Recorder System i During the outage, the remaining Unit No. I switchyard breaker and transformer motor operated disconnect controls were transferred to the 1 new vendor (RFL) unit. The old GE console was disconnected and removed. Control Rod Drive Mechanism Change Out Fifteen control rod drives (CRD) were rebuilt and replaced. ATWS Power Supply input circuitry for the 9N59 ATWS control system was modified to prevent spurious shutdown of the system DC/AC inverters. This modification was made because during a full load reject, the trans'.ent overvoltage that would occur on both station batteries would trigger a protective shutdown of the system DC/AC inverters.
- - . _ .-- - .~ . _ . . - _ _ - - - . - _ _ _ _ . -
6-5 Diesel Air Start System Modification Package I The solenoid operating main air start (MAS) valves on the emergency diesel generator were replaced with improved units. The change was made to enhance the reliability of the emergency diesel generator unit by minimizing the effect of corrosion products in the air start program, l MSRVDL Vacuum Breaker Upgrade ; l Each of the twelve main steam relief valve drain line (MSRVDL) vacuum [ breaker valves were modified by replacing several parts of the hinge assembly with parts of a higher strength material. Also the disk link was modified such that the point of impact when the disk swings fully open i against the valve body is closer to the centroid of the disk assembly. l ! This change was made to increase safety margins and reliability of the ! vacuum breakers without changing the time or differential pressure for the l valve to open. I i Cavity Seal Evaluation / Modifications i Isolation valves were added to the drain lines exiting the drywell. Seismic supports were added to the drain lines exiting the drywell, spent fuel pool l gate drain line, and dryer separator drain line. Leak detection hstrumentation was added to the inner and outer refueling bellows leak detection lines and a new fuel pool level transmitter was installed with O alarms in the control room.
- _ __ _ _ _ _ . . , _ . _ _ - _ _ _ _ _ , . - _ . . . . . , _ . . . . . - . , , . _ , _ . _ _ _ _ _ -. _._mm ..7,___-.__ m_, . . _ . , . _ . . -__, ___,__ ,
6-6 These changes were implemented to satisfy a commitment made to the NRC in response to IE Bulletin 84-03. NNECO committed to make the modifications necessary to prevent the inadvertent draining of the refueling cavity. Isolation Valve (Line #CUW-143) for Hydrogen Water Chemistry Mini-Test This project involved adding a back-up isolation valve on the clean-up system return line to the main condenser. This change was made to allow installation of hydrogen water chemistry mini-test piping without a shutdown. Summary O These projects, along with routine refueling outage activities, resulted in an exposure to personnel (NNECO and contractors) of 455 Man-Rem. The
; chemical decontamination of the recirculation system performed in the 1984 refueling outage continued to be a benefit for drywell work during
- this outage. Based on a recontamination survey done by ALARA personnel, 1 the estimated savings was 165 Man-Rem. As described in Section 10.1.6 reducing occupational exposure is an on-going commitment at Northeast Utilities.
Costs for the 1985 outage, representing capital projects, expense projects, . and plant operating and maintenance costs amounted to approximately 20 million dollars. I
7-1
~
SECTION 7 - PROJECTS NOT SPECIFICALLY EVALUATED IN ISAP i This section addresses Millstone Unit No. I projects that have not been specifically evaluated in the integrated assessment. These projects have been previously scheduled based on their importance and resources have already been committed. These projects will not be rescheduled through the ISAP integrated schedule. The resources required for these efforts, however, will be factored into the Millstone Unit No.1115. Main Turbine LP "B" Rotor
- The main +urbine low pressure "B" rotor is scheduled to be replaced during I
the 1987 outage. The present rotor contains cracks which are anticipated to continue to grow at a rate that would make further operation of the j rotor beyond the 1987 refueling outage questionable. Jet Pump Instrumentation Nozzle The two jet pump instrumentation nozzles (A & B assembly) are scheduled
- to be replaced during the 1987 outage. During the 1985 outage, five welds i'
on the nozzles (two on A assembly and three on B assembly) had to be weld overlayed due to indications of IGSCC cracks. Because of the stresses already in the nozzles, no additional overlays can be performed. Due to the possibility of finding additional problems in 1987, it was decided to replace the old nozzles with new nozzles. O
7-2 Reactor Vessel Nozzle Plug NNECO will procure four main steam line nozzle plugs to be used during
- he 1987 outage. The existing plugs will be replaced with seismically qualified plugs which do not rely solely on a pneumaticali, energized retaining force after installation.
Main Generator Surge Protection Capacitors This project involves replacement of the main generator surge protective capacitors to comply with an internal program to eliminate highly concentrated PCB fluids from the NU system. O Gas Turbine Neutral Grounding Transformer This project involves replacement of the askarel-filled gas turbine neutral grounding transformer with a non-PCB type transformer. This project will eliminate highly concentrated PCB fluids from the NU system. Fuel Channels NNECO will procure and install 200 fuel channels and fasteners for Cycle 12. c O
7-3 D MOV Common Mode Failures 4 In response to IE Bulletin 85-03, all appropriate switch settings on specific motor-operated valves will be evaluated in 1987. In addition, a program I will be developed to ensure settings are set and maintained correctly to accommodate the maximum differential pressures these valves are subjected to during both normal and abnormal events within the design basis. This project is covered under ISAP Topic No. 2.15 and is addressed - in Section 4.3 of this report. l Control Rod Blades i NNECO will procure and install 22 control blades for Cycle 12. j IGSCC and Recirculation /RWCU Decontamination During the upcoming outage, over 150 welds will be inspected for IGSCC. l 4 In order to keep radiation exposure as low as possible, the recirculation system and clean-up piping systems may be decontaminated. Contract services will be on standby to either weld overlay or replace sections of pipe if IGSCC cracks are detected. ] i I 1 I IO f l 1
8-1 SECTION 8 - RESULTS OF ISAP TOPIC SCORING This section contains the results of the scoring of the ISAP topics. Scoring was carried out utilizing the Analytical Ranking Model (ARM). The scoring methodology and philosophy is discussed in further detail in Section 2 and Appendix D of this report. The ISAP topics were divided into three categories as follows: I a) Topics which are associated with a specific hardware or procedural modification (Projects); b) Topics which are engineering studies (Studies). These studies are usually the precursor to the identification of a hardware or procedural modification; and c) Topics which do not have a well defined scope. These topics include unresolved safety issues, generic issues and other open-ended regulatory issues. l l The first two categories (a and b) of ISAP topics were evaluated utilizing the ARM. The topics in the latter category (c) were not explicitly evaluated utilizing the ARM but were assessed deterministically. I Table 8-1 presents the prioritized ranking of the Millstone Unit No.1 ISAP l projects. The table lists the project scores for the public safety, personnel .1 ll safety, economic performance, and personnel productivity attributes. In l 'l
8-2 addition, the integrated value, remaining cost for implementation of the project, overall benefit (value/ cost), and the estimated Man-Rem exposures for implementation of the modifications is presented. Chapter l'0 details the mechanism via which this data will be utilized in the development of the integrated implementation schedule for Millstone Unit No.1. These topics are discussed in detail in Section 3 of this report. Table 8-2 presents the scoring and integrated value for the engineering studies currently under consideration by NNECO for Millstone Unit No.1. In a manner similar to the methodology to be utilized on the above-mentioned specific plant hardware projects, this data will be utilized in the development of the IIS for Millstone Unit No.1. These topics are discussed in detailin Section 3 of this report. O Table 8-3 is a listing of the ISAP topics which were not explicitly evaluated j utilizing the ARM. These topics are currently under review by NNECO and any modifications which may result from this review will be assessed in a future integrated assessment. These topics are discussed in detail in Section 3 of this report. In presenting the attached data, we are compelled to r :fer the following comments. Our enthusiasm for the ISAP methodology notwithstanding, we emphasize that decision-making is more complex than our methodology is sophisticated. Implementation will not be precisely in keeping with ISAP rankings. Uncertainties, intangibles, synergistic effects resulting from ( several projects, and management decisions remain an integral part of our resource allocation process. Improvements are planned, but the need for informed judgment in using the results will never be eliminated.
v 4 l Rankirm of ISAP Pro _1ects ISAP j Topio Public Economio Personnel Personnel Integrat.ed Installation
- Rank Number Project Memo Safety Performance Safety Productivity Valun _ Cost ($K)e Jalue/ Cost Dose (Man-Ree) f i 1 2.07 Sodium Hypochlorite System 10 19 to 2.5 12222 $289 42.29 0 2 1.01 Des Turbine Generator Start Legio 1 1.2 0 0 1543 $71 21 73 0 i Modifications 3 2.24 Offsite Power Systems 6.2 0.01 0 -1 2404 $300 8.01 0 i
4 1.05 Ventilation System Modifications to 0 0 0 3892 $508 7.66 to l 5 2.23 Instrument, Service and 34 1 3 2 2333 4514 4.52 5 j Breathing Air Improvements i l 6 2.12 Reactor 1essel Reed Stand 0 0.08 5.1 0.5 255 $81 3 15 1 i Relocation 7 1.02 Tornado Missile Protection 3 75 0 0 -1 1460 4576 2.53 2 8 1.16.7 Cable Vault Ralon Suppression 2.6 0 0.2 -1 1017 4404 2.52 0
- Systes 9 2.11 Stud Tensioners 0 1 3.3 1 1009 $786 1.28 30 10 1.16.1/ W1/ W 2 Backfood; CRD Pump 5.25 0 0 -0.5 2043 41.764 1.16 4 1.16.2 Modifications 11 1.16.8 Main Control Room Ralon System . 13 0 0 -1 506 4441 1.15 0 12 2.18 Spent Puol Fool Storage 0 to 0 0 9612 $8,757 1.10 34 Raoks/ Transfer Cask
- 13 1.18 ATUS 1 0 0 0 389 $430 0 91 0 4
Table 8-1
- 8-3 4
O .v) ISAP Topio Public Eccoomio Personnel Personnel Integrated Installation Bank Number Pro.1eot Name Safety Performance Safetr ProdJotivity Talue Cost ($K)9 Talue/ Cost Dose (Man-Rom) 14 2.28 Long-Term Cooling Study ?0 0 0 C 3892 46,183 0.63 (a) 15 1.16.11 Hydrogen Systee Modificatione 0 0 3 0 38 $65 0.59 0 16 1.10 Emergency ' ;_ :^ Paci11 ties 1 0 0 0 389 $750 0.52 0 17 2.08 Extraction Steam Piping 1 75 5.6 4.4 1 6171 414.057 0.44 535 Replacement i 18 2.06 Condeneer Retube 1.25 35 35 5 3912 $16,852 0.23 100 19 2.10 Drywell Ventilation Systes 0.05 0.5 1 0.5 509 $2.419 0.21 45 20 2.01 LPCI Remotely Operated Yalve 0.1 0 0 -1 39 $200 0.19 3 1-LP-50A&B 21 1.16.6 Fire Protection Mater Curtain / 0.1 0 05 -1 45 $262 0.17 0 Steel Enclosure 22 1.16.12 Emergency Lighting Modificatione 0.14 0 0.2 -0.5 59 4670 0.09 3 23 1.17 Repisoement of Motoe-operated 0.15 0 0 0 58 $702 0.08 165 Talvee 24 2.03/ Process computer Replacement /SPDS 1 0.5 0 2 870 $14.457 0.06 0 1.08 25 1.16.4 Power Cold Shutdoun Equipment 0.01 0 0 -1 4 $68 0.06 0 26 1.12 Control Roce Habitability 0.5 0.1 -2.6 -2 262 $4,960 0.05 2 27 2.09 Opgrading of P& ids 0.1 0 1.2 2 49 $1,075 0.05 0 (a) Installation dose is ocratingent upon the modification implemented. I i i Table 8-1 8-4
,J
T l 1 ISAP Integrated Installation Topio Public E3onomic Personnel Personnel Safety Performance Safety Productivity value Coot ($K)e Value/ Cost Dose (Man-Rem) Rank Number Pro _ lect Name 0 0 0.5 1 6 $141 0.04 0 28 2.21 Replace Oil-Filled Breaker (4807 Load Center) 0 0 2 0 18 .$550 0.03 greater than 500 29 1.14 Appendiz J Modifications 0 0 2 98 $3,500 0.03 0 1.15 F5AR Update 0.25 30 0.05 0 1.5 -0.5 32 $1.311 0.02 25 31 2.25/ Monitor Primary containment Leak 2.02 Rate and Drywell Tempersture 0 0 0.5 0 6 $260 0.02 0 32 1.16.5 Install Curbs, Rampe, Seele 0 0 0 4 $365 0.01 0 33 1.16.10 M5IT/AD5 Circuit Protection 0.01 0 -1.7 -2 24 $16,250 0.00 100 34 1.06 Soissio Qualification of Safety- 0.1 Related Piping 0 0 0 0 0 $300 0.00 (included in 1.14) 35 1.03 Containment Isolation - l Appendix A Modificatione 0 0 0 0 $338 0.00 0.1 1.16.3 Alternate for Shutdown Cooling 0 f 36 0 0 0 0 $75 0.00 0 ! 37 2.16 Reactor Protection Trip Systes 0 0 0 0 -0.5 0 $311 0.00 0 38 1.16.9 Install Fire Barriere 0 0 -0.4 -1.5 -6 $1,000 -0.01 300 ! 39 1.11 Post-Accident Hydrogert Monitor 1 0 0 -0.5 -1 -6 $830 -0.01 20 I 40 2 32 Primary Containment Pumpbeek Systen 0.01 0 -0.1 0 -f $75 -0.01 2 41 1.04 RWCU System Pressure Interlock RBCCW Leak Rate Testing (1-RC-6, 0 0 -0.5 -1 -6 $642 -0.01 5 42 2 33 15) I j
# Cost data as of June 1,1986.
Table 8-1 ! 8-5 i
m
\
.J Rankina of ISAF Stindies l
ISAF Publio Economic Forsonnel Feroonnel Integrated Topio Safety Performance Safetr _ Productivig Value M Bumber Study Roma 0 1 0 0 961 1 2.22 CRD Systen lister Hammer Analysis 1.5 0 0 0 584 2 1.13 BWR Tessel theter Level Instrumentation 0 0 288 ' 2.04 High Steam Flow Setpoint Increase -0.05 0 32 3 0.1 0.1 0 0 135 4 1.07 Control Room Design Review 0.1 0 0 0 39 I $. 2.17 Plant Distribution Protection (125YDC/4807/4.16KY) ! 0 0 1 1 9 l 6 2.20 RUC0 System Isolation Setpoint Reduction ! 0.01 0 -0.05 0 0 7 1.09 2 RPT Neutron Monitoring System I 0 0 0 0 0 6 1.22 Electrical Isolation 0 0 -0.05 0 -4 9 1.09.1 RPT Pm esure and IC Level Instrumentation
-0.25 0 0 0 -97 10 1.21 Fault Transfers
) l f Table 8-2 8-6
ISAP Topics Not Evaluated By The Analytical Ranking Methodology ISAP Topic No. Title 1.19 Integrated Structural Analysis 1.20 Motor-Operated Valves Interlocks 1.23 Grid Separation Procedures 1.24 Emergency Power 1.25 Degraded Grid Voltage Procedures 1.26 Item 2.1 - Equipment Classification / Vendor Interface 1.27 Item 3.1.1 and 3.1.2 - Post-Maintenance Testing 1.28 Item 3.1.3 - Post-Maintenance Testing Technical Specification Changes 1.29 Response to Generic Letter 81-34
- 1.30 Item 1.2 - Post-Trip Review Data and Information 1.31 Item 2.2 - Equipment Classification / Vendor Interface 1.32 Item 3.2.1 and 3.2.2 - Post-Maintenance Testing Procedures !
1.33 Item 3.2.3 - Post-Maintenance Testing Technical Specification Changes i 1.34 Item 4.5.2 and 4.5.3 - Reactor Trip System Testing 1.35 Item 4.5.1 - Reactor Trip System Functional Testing 1.36 Technical Specifications Covered by Generic Letter 83-36 1.37 Technical Specifications Affected by 50.72 and 50.73 l (Generic Letter 83-43)
)
1.38 Expand QA List 1.39 Radiation Protection Plans 1.40 Bolting Degradation or Failure 1.41 Flooding of Compartments by Backflow Table 8-3 l 8-7
ISAP Topic No. Title 1.42 MSL Leakage Control Systems 1.43 Water Hammer : 1.44 Asymmetric Blowdown Loads on Reactor Systems 1.45 Systems Interaction 1.46 Determination of SRV Pool Dynamic Loads 1.47 Containment Emergency Sump Performance 1.48 Safety Factor for Penetration X-10A 1.49 Reactor Vessel Surveillance Program 1.50 Isolation Condenser Start-Up/Make-Up Failures 1.51 Failure to Restore Main Condenser 1.52 SRV Failure - Setpoint Drif t I 2.05 Hydrogen Water Chemistry Study (Risk Assessment Only) 2.13 Turbine Water Induction Modifications 2.14 Evaluation and Implementation of NUREG-0577 2.15 Torque Switch Evaluation for MOVs 2.19 DC System Review 2.26 Reliability Equipment 2.27 Spare Recirculation Pump Motor 2.29 FWCI Assessment Study 2.30 MSI Closure Test Frequency (Risk Assessment Only) 2.31 LPCI Lube Oil Cooler Test Frequency (Risk Assessment Only) t i O Table 3-3 j 8-8
i 1 9-1 O h SECTION 9 - VALIDATION OF RESULTS 9.0 Introduction A final step in the ISAP methodology requires validation of the ISAP 4 project rankings and the analyses leading to those rankings. As part of this validation step, NNECO performed sensitivity studies on the analytical ranking model (ARM) and used feedback from these studies to refine the process. In addition, NNECO contracted for an independent review of ISAP. 9.1 Sensitivity Studies O Following the ISAP prioritization process and rankings, the ISAP Working Group performed sensitivity studies on the rankings. These sensitivity studies were intended to assure that public safety asserted appropriate influence on the rankings and that cost, individual attributes, or the attribute weighting methodology did not unrealistically bias the finalISAP rankings. The sensitivity studies therefore evaluated the followir.g: o Effect of cost on project rankings; o Effect of individual attributes on project rankings; and l o Effect of weighting on project rankings. O l
l 9-2 1 The specific sensitivity studies performed were: l l a) Project ranked by value/ cost - external impacts attribute excluded; b) Projects ranked by value - external impacts attribute excluded; c) Projects ranked by public safety benefit / cost; d) Projects ranked by value/ cost - five attributes included; e) Projects ranked by value/ cost - public safety attribute excluded; f) Projects ranked by value/ cost - personnel safety attribute excluded; g) Projects ranked by value/ cost - economic performance attribute excluded; h) Projects ranked by value/ cost - personnel productivity attribute excluded;
- 1) Projects ranked by value - 5 attributes; j) Projects ranked by installation doses; i
k) Projects ranked by cost; and l
9-3
- 1) Projects ranked by value/ cost - subjective weighting factors set equal to 1.0.
In performing the sensitivity studies, project assignments which are in fact
" studies" were removed from the prioritization process because no implementation costs were available and the low cost of performing a study tends to artificially drive them to the top of the rankings.
The results of studies A and B were similar in that 18 projects appeared in the top 20 rankings of both sensitivity studies. Thus, NNECO concludes that cost, correctly, is not a dominant driving factor in the ranking
- process. Similarly, the results of studies A, B and C were similar in that 13 projects appeared in the top 20 rankings of all 3 sensitivity studies.
Public safety is therefore being captured as a major (but not the only) input to the prioritization process. Review of these sensitivity studies also demonstrated that with regard to the public safety, personnel safety, economic performance, and personnel productivity attributes, no individual attribute dominated the ranking of the ISAP topics. Removal of each of these attributes from the ranking process (one at a time - studies E through H) was found to have an insignificant effect on the prioritization results. However, with regard tc the very subjective, qualitative external impacts attribute, a high degree of sensitivity was found. The external impacts attribute was found to be a dominant driving force in the ranking process. This finding led NNECO to eliminate the external impacts attribute from this stage of the final ranking process, to be used as a "tiebreaker" or to flag highly sensitive topics.
i l 9-4
-s Finally, the sensitivity studies demonstrated that the subjective weighting factors used in the ISAP prioritization methodology were not a driving
~
force. With the weighting factors set equal to 1.0 (in study L),19 of 20 projects originally witnin the top 20 ranked projects remained within the top 20 rankings. These sensitivity studies have provided some measure of confidence that the ARM is logical and reasonable. 9.2 Independent Review As part of the validation of the ISAP methodology, NNECO provided for an independent review. Specifically, over a three-day period in February 1986, an independent review team assessed the ISAP ARM and outlined various recommendations and observations. The independent review team consisted of Dr. Alvin Drake of the Massachusetts Institute of Technology, Mr. Charles Jackson of Consolidated Edison Company, and Dr. Joseph Turnage of Delian Corporation. In general, the report of the independent review team concluded that ISAP is a positive program - one which deserves continued support and one in which considerable progress has been made. The team highlighted that ISAP is a strong tool for fostering communication across corporate departments, as well as an effective methodology for project ranking and decision making. The team recognized, however, that the ARM is still evolving and therefore made several specific findings and suggestions. O
= _ _ ._ .-
9-5 The recommendations of the review team included the following: o Some attention should be given to whether or not the attributes, as presently defined, capture all important costs and benefits associated with proposed plant changes; o Mechanisms should be developed to reduce the time required to evaluate projects. This will prevent the process from bogging down when a large number of projects need to be evaluated; 4 o Once initiated, frequent changes should not be made to 'the i l ISAP process; O o The concept of a threshold for modifications to be implemented should be further defined; o The ISAP prioritization process is only one input upon which decisions on the implementation of projects should be based. Considerations such as ALARA goals, cost / benefit payback periods, and schedular restraints must be evaluated in the integrated implementation schedule; o " Sanity checks" should be incorporated into the project scoring and evaluation process; i o NNECO should consider ranking studies and projects separately; and
l l 9-6 ,. o The public safety impact raodel requires refinement. Currently the model treats all core melt sequences as resulting in public exposure. In addition, the model considers only internal events. , l The ISAP Working Group reviewed these and other observations of the
- independent review team. The ISAP Working Group responded to each comment individually. Several of the independent review team observations were directly incorporated into the Millstone Unit No.1 ISAP. ,
.m See Section 9.3 below.
Where room for, refinement in ,the ARM is acknowledged, the ISAP Working Group is committed to further improvements following completion of the ISAP pilot program. See the discussion of these future actions ih O Section 10.0 of this report. Generally, NNECO plans to further develop, formalize, and indeed institutionalize ISAP within the entire NU system of nuclear power plants. The independent review is one important step in moving towards this corporate objective. 9.3 Conclusions Based on the sensitivity studies and independent review, NNECO reached . the following conclusions for refining the Millstone Unit No. 1 ISAP - evaluation /prioritization process: . o The prioritization process was implemented utilizing a four attribute process (pubic safety, personnel safety, economic performance, and personnel productivity);
;n 3
9-7 gp o External impacts was used as a tie breaker or warning flag to ,
+
7'Qw indicate projects with significant regulatory or other external interest; o Projects and studies were evaluated separately because studies do not have implementation costs and are unduly influenced by 7 their relatively low cost which tends to drive them to the top of the ranking; i M o The actual order of the prioritized list of Millstone Unit No.1 4. projects s'hould not be construed as an absolute indication of the order of importance of each project. At this state of the development of the ISAP methodology, the rankings should be (Oj utilized in a manner to indicate the relative importance (i.e., high, medium, low) or value of each project. This should be reflected in the integrated implementation schedule;
, c o The prioritized list of Millstone Unit No. I projects can not be
. used as the sole source of input into the decision-making h
'. s process for development of an integrated implementation
-.s Other considerations such as insights from l schedule.
l, knowledgeable Northeast Utilities personnel, ALARA constraints, manpower and resource constraints, cost / benefit payback analyses, and other schedular constraints will therefore be evaluated in conjunction with the development of the integrated implementation schedule (see Section 10.1 of this report); I ( i s i f._ (
,.-,w,-.---b--.,--w. . - . . . - - - - - - - - _ , , . . - , - . - - . - . - , - - - - - - . - . . _ . - - - . - - - , - . , . _ , - - - -- - - - - - . . - . -_ _. -
9-8 o Identification and implementation of refinements to the ISAP process are necessary (e.g., the independent review group's report on the ISAP ranking methodology should be incorporated into ISAP) (see Section 10.3 of this report); and o Development of a " threshold" below which projects will not be implemented has not been fully developed, but is a concept which NNECO continues to develop. t l O O
1 l 4 10 - 1 SECTION 10 - FUTURE ACTIONS 10.0 Introduction r As discussed in Section 1.2 of this report, the pilot ISAP program is in actuality a two-phase project. The first phase is the integrated assessment, or ISAP prioritization process, documented in this report. The second phase, which remains to be completed, is the development of the IIS for implementation of backfits. The second phase is discussed briefly below. It is NNECO's objective with respect to the IIS to develop a scheduling mechanism which can be 4 applied through ISAP to both present and future regulatory and licensee backfits. The scheduling mechanism must provide for consideration of both ISAP project priorities and "real-world" constraints, and must be capable of being updated to reflect changes in project scope and considerations of internal and external impacts. h I Completion of the Millstone Unit No.1 ISAP is also discussed below. Following development of the IIS, NNECO will provide the NRC Staff { with information on the ultimate disposition of the Millstone Unit No.1 ISAP topics. A final area for future activity on ISAP is also discussed in this section. j Specifically, NNECO proposes, following completion of the pilot program, to continue to develop and refine the ISAP prioritization w_,, , . . , . , _ , , __,,--,--m_,e.-
-- , , - - , - - - .--y,n,,_,
- - - - e .. . - , - -, . - , - - - , ,.,,,n-.---- 7,.._,
10 - 2 process. In this way ISAP can be applied by NNECO throughout its nuclear program. 10.1 Development of an Integrated Implementation Schedule The end product of the ISAP integrated assessment will be a priority listing of projects which have been ranked using NNECO's ARM. The next phase of ISAP will require the integration of each project schedule - to develop the IIS. The IIS will recognize the priority rankings as well as other limiting conditions discussed below. Both the independent review of the ISAP and the ISAP Working Group have identified that the ISAP prioritization process is only one input O upon which decisions on the implementation of projects are based. Considerations of ALARA goals, cost / benefit payback periods, schedular restraints, etc., need to be considered in the development of the IIS. Thus, in order to accomplish a meaningful integration, a series of limiting conditions must first be defined and addressed. For example, noted below is a brief IIsting of limiting conditions which must be considered in developing an implementation schedule: o Outage duration; o Resource availability: l - Budgets / dollar expenditures
- Manpower;
10 - 3 O o Availability of qualified equipment; ! V o Availability of experienced craf t; o Sits restrictions:
- Physical area restrictions
- Site / containment evacuation limits; and o Radiation exposure.
Because the 115 is indeed a "living" schedule, these factors must be routinely incorporated into the 115 mechanism to reflect "real world" status. Continuing recognition of these factors will assure that the 115
! identifies realistic in-service dates for scheduled plant modifications.
l l 10.1.1 Outage Duration l The outage durations at NU's nuclear plants are scheduled in advance with the New England Power Exchange (NEPEX). NEPEX procedures consider a standard maintenance refueling nuclear outage to be six weeks. During this period, sufficient time is available for internal Inspections of a low pressure or high pressure turbine section and for routine inspections of other major components / equipment. However, i nuclear regulations also require a Class A containment leak rate test O every 3M years. The time required for this test, approximately one week, is not included in the six week period.
i 10 - 4
; NEPEX also uses a four-year limit for nuclear plants for standard outages not to exceed 35 weeks. Any unit requiring an outage i.n excess , of the above standards must get permission from the NEPEX Operations ! Committee.
i
; Based on these guidelines and regulations, the base outage schedule for Millstone Unit No. I should be established well in advance of shutdown.
The schedule should include all maintenance activities, refueling sequence, and.any "must do" projects. Any project which increases the length of the standard outage should be evaluated for its justification and need prior to implementation. ISAP prioritization will be an input in this latter evaluation. O 10.1.2 Resource Availability Both the financial capability of the company to support potential backfit projects and the availability of internal manpower resources to support the projects need to be prime considerations when scheduling activities. Backfit modifications in NU's nuclear plants are very capital intensive. ! For example, the capital construction program for Millstone Unit No. I has averaged over 26 million dollars per year for the last six years. This large number is basically a result of the 1980-81 outage which was 197 days in duration. In contrast, the construction program for the last i four years, 1982-1985, averaged 16 million dollars per year. In i ! scheduling backfit projects, NNECO will aim toward capital expenditures which will provide for the maximum benefit to the plant.
l 10 - 5 : The internal engineering staff which supports the day-to-day operations of the plant are also those involved with backfit modifications. To properly support four operating nuclear plants, a very large enF ineering l staff is required. However, this staff must still be prudently allocated between projects at all four nuclear plants. It is very important that only the most important projects be allocated limited manpower resources. This consideration will be factored into the IIS mechanism. To compensate for resource unavailability, NU has selectively contracted with outside engineering consultants for additional manpower. However, experience has proven that outside consultants are not the most efficient way to achieve results. Outside consultants need
- time to learn the NNECO system, and in many cases are less productive than internal staff. NNECO's objective, therefore, will be to use external resources to supplement in-house staff only when absolutely necessary.
10.1.3 Availability of Qualified Material Many backfit modifications require materials and equipment that are not readily available from the vendors. For example, in some cases, necessary parts need to be QA Category I, seismically approved, and EEQ qualified. These requirements often require long lead times and i sometimes necessitate new qualifying programs. A good example of this cont,traint was the problem NNECO had in obtaining EEQ quallfled motor l operators for the Millstone Unit No. I valves. The availability of
~
qualified material therefore must be considered in development of the i !!S.
10 - 6 O) ( 10.1.4 Site Restrictions i During each outage there will be a base loading of management, craf t, maintenance, health physics, and other personnel, which can be expected in containment based upon previous experience. This base man-loading must be identified in the determination of what project work can be reasonably achieved during a given outage. Consideration is given to critical path activities, ALARA routine maintenance, in-service inspection, equipment required to be operable to comply with limiting conditions of operation in the technical specifications, etc., in relation to outage duration. For each operating unit and outage there is also a maximum number of people who can safely be evacuated from the containment in a reasonable time frame in the event of an accident. This could be a limiting condition in the development of an outage schedule. Also, the physical working location within the plant for a proposed project also needs to be considered in the schedule integration. For example, at Millstone Unit No.1, the drywell work usually is the most critical because of the small working area involved and the vast amount of work' required in the area during an outage. A major backfit project in the drywell will probably dictate the critical path and the length of the outage. Such a critical project might negate the possibility of doing other jobs in the same area. O
10 - 7 ' 10.1.5 Availability of Experienced Craf t Even though experienced craft availability in the area in general is adequate for most major refueling outages, availability of craft to support a proposed project still should be factored into the integrated schedule. If, for example, a major pipe replacement project were undertaken which required many qualified pipefitters/ welders, this project might limit the number of qualified welders available for other backfit projects. 4 10.1.6 Radiation Exposure NU has a corporate policy to ensure that occupational radiation V exposures are kept "as low as reasonably achievable (ALARA)." In addition, NNECO has implemented ALARA exposure goals which are designed to reduce total exposure to levels less than the industry average. Projects are given a benefit / comparative cost evaluation to provide a decision basis for determining the need for changes in equipment, system design, manpower, operating procedures, etc., in order to keep exposures ALARA. Efforts in this area should be made to ensure that corporate goals are achieved and to ensure that the total plant colle ctive exposures are reasonably comparable to like plants in the industry. Towards this end Northeast Utilities has recently amended its guidelines for performing benefit / cost evaluations with respect to occupational exposures and is now utilizing a value of 20,000 dollars per Man-Rem in performing ALARA calculations. This change will be reflacted in the development of the 115. l
10 - 8 10.1.7 The IIS Decision-Making Process Based on the above constraints, it is easily understandable why there is no " cookbook" approach in determining what projects should be done I during a given outage. Instead, the IIS decision-making process must be iterative in nature, must include the input of many knowledgeable people
- within the company, and must consider input from more than the ISAP prioritization and ranking process. These considerations will be tailored -
into each outage schedule based on the IIS, and more importantly, will be built into the mechanism developed for maintaining the IIS throughout the life of the plant. i 10.2 Completion of the Millstone Unit No.1 ISAP i Two steps are required for completion of the Millstone Unit No.1 ISAP. i First, NNECO must complete the open items in the ISAP prioritization j process. These open items are summarized below. (This list is intended , to include only open items in the ISAP assessment identified by the NRC
- in Reference 13. It is not intended to include all items necessary for resolution of individual ISAP topics.)
Topic Description No.1.18 Evaluate proposed project for upgrade of SLCS or subrnit permanent exemption request to NRC. i
. . _ . . . , . . , . - . - .-,n _.,,__.,__,,__n _,, _ , , , _ , . _ , _,,__.., - n.,. . ,_ _ __,.m_,.
10 - 9 No.1.43 Provide public safety evaluation of proposed project to lower reactor water level setpoint to avoid vessel overfill. No.1.47 Provide public safety evaluation with respect to remaining Staff questions. Nos.1.50,1.51,1.52 Address NRC Staff concerns detailed in these new ISAP topics. 1 In addition, in this context it should be noted that ISAP is an on-going, living process. As new issues and topics are identified, and as the scope of projects considered under existing topics are refined, the ISAP prioritization mechanism will be applied. In this manner ISAP will remain a viable tool for backfit decision-making. Second, following completion of the ISAP prioritization process and the development of IIS methodology, NNECO will determine and schedule the ultimate dispositions of the Millstone Unit No. 1 ISAP topics. NNCCO will at that time provide the necessary information to the NRC Staff. This information will include implementation schedules (where l l implementation is necessary) and resource allocations. i 10.3 Action Plan for Improvements to the ISAP Methodology The ISAP Working Group has identified several areas of the ISAP process which warrant further review and/or improvement activities. These
. - - - . . - - , ---_-,-n , . - _ . . - - - . - - - - , _ _ - - , - . - - - , _ . , . _ . - . - - - , , . . . - - - . _ , , . - - _ . . . , - - - - . - - - . __,n n... . - - - , ,,,n-- ,, -
10 - 10 activities and significant findings are in part a result of the external review of the ISAP ARM. The proposed activities will be undertaken following completion of the on-going ISAP pilot program. These activities are detailed below,
- a. Financial Risk The ISAP Working Group recognizes that averted onsite costs are not explicitly considered in any of the five ISAP attribute models.
In*sion of financial risk in the ISAP process was discussed during severalISAP Working Group meetings during the spring of 1985. At that time the ISAP Working Group was unable to conclude whether it was necessary to consider financial risk in the ISAP process, and if considered, what the best way to do so would be. Financial risk is a subject which the ISAP Working Group plans to address following the Millstone Unit No. I and Haddam Neck Plant pilot ISAP efforts. As a policy-oriented issue, its resolution will reflect executive NU management judgments and will likely be linked to other global issues such as safety goal implementation.
- b. Attribute Model improvements The scoring of the Millstone Unit No.1 ISAP topics identified a weakness in the attribute models in that the attribute models developed do not capture all elements (costs and benefits) of all projects. This is an issue which needs to be addressed following the i completion of the pilot ISAP effort.
l \
10 - 11
- c. Corporate Goals v
Following the Millstone Unit No. I and Haddam Neck Plant ISAP efforts, it will be necessary to review the process developed to determine how accurately (or closely) the ISAP methodology reflects NU's corporate goals and objectives.
- d. Public Safety Impact Model Refinements Currently the Millstone Unit No. I public safety impact model treats'all core melt sequences as resulting in public exposure. This item needs to be addressed as part of the first update to the Millstone Unit No. 1 ISAP rankings, and as part of future development of the ISAP ARM.
Also, the public safety attribute evaluation model currently considers only internal and fire-initiated events. The issue of possible inclusion of external events such as high winds and earthquakes in the probabilistic analysis also needs to be addressed.
- e. Standardization of the Attribute Impact Models A long-term activity should be an effort to standardize the five attribute impact models to common scale types (linear or log),
time frames (one cycle, life of plant, etc.), maximum values, and equivalent dollars per point. This would eliminate the need to objectively weight the attribute models.
10 - 12
- f. Formalization of the ISAP Process within the NU System Another long-term activity follows from the objective of incorporating the ISAP process more directly into NU's daily routine for conducting business. This activity would include increased formalization of the ISAP process and the development of the internal mechanisme via which information on projects is obtained and fed back through the process. A refined and formalized ISAP process could be applied by NU to its entire nuclear program, if judged to be successful.
l t O O
Docket No. 50-245 Appendix A References i i j l l July 1986
-" o----
,4 g w.mmw.,-,_.g--,y, pmy
A-1
- 1. W. G. Counsil letter to D. M. Crutchfield, " Comments on Systematic Evaluation Program," A02644, dated July 30,1982.
- 2. W. G. Counsil letter to W. 3. Dircks, " Integrated Assessment of Regulatory Requirements," B10804, dated June 13,1983.
- 3. H. R. Denton letter to W. G. Counsil, " Integrated Assessment of Regulatory Requirements /' dated July 5,1983.
- 4. W. G. Counsil letter to D. G. Eisenhut, " Integrated Safety Assessment l Program," B10869, dated September 14,1983.
- 5. D. G. Eisenhut letter to W. G. Counsil, " Expanded Integrated Assessments for Haddam Neck and Millstone Unit No. 1," dated October 5,1983.
- 6. W. G. Counsit letter to D. G. Eisenhut, " Integrated Assessment of Regulatory Requirements," B10986, dated December 28,1983.
- 7. W. 3. Dircks letter to NRC Commissioners, " Integrated Safety Assessment Program," SECY-84-133, dated March 23,1984.
7a. D. G. Eisenhut letter to W. G. Counsit, " Expanded Integrated Assessments for Haddam Neck and Millstone Unit No.1," dated April 5, 1984.
- 8. W. 3. Dircks letter to NRC Commissioners, " Integrated Safety Assessment Program -
Implementation Plan," SECY-85-160, dated May 6,1985.
- 9. H. R. Denton letter to W. G. Counsil, " Integrated Assessment Program -
Haddam Neck Plant and Millstone Nuclear Power Station, Unit No.1," dated December 4,1984. j 10. 3. F. Opeka letter to C. I. Grimes, " Integrated Safety Assessment Program," Bil537, dated May 17,1985.
- 11. H. L. Thomp:,on letter to 3. F. Opeka, " Integrated Safety Assessment Program," dated July 31,1985.
- 12. 3. F. Opeka letter to C.1. Grimes, " Integrated Safety Assessment Program - Program Milestones," B11797, dated January 10,1986.
- 13. C. I. Grimes letter to 3. F. Opeka, " Safety Evaluation of the Detailed Scope of Issues for the Integrated Assessment," dated March 3,1986.
. 14. 3. F. Opeka letter to 3. A. Zwolinski, "Probabilistic Safety Study - Results and Summary Report," Bil601, dated July 10,1985.
- 15. 3. F. Opeka letter to C. I. Grimes,"Probabilistic Safety Study -Initiating Events and Accident Sequences," Bil582, dated June 20,1985.
- 16. 3. F. Opeka letter to C. I. Grimes,"Probabilistic Safety Study," B11931, l dated December 23,1985. I
A-2
- OO 17. 3. F. Opeka letter to C. I. Grimes, "Probabilistic Safety Study," B12035, dated April 30,1986.
- 18. 3. F. Opeka letter to C. I. Grimes, "Probabilistic Safety Study - Fire Analysis," B12002, dated March 26,1986.
- 19. 3. F. Opeka letter to C. I. Grimes, "Probabilistic Safety Study - Loss of i
120V Vital AC, Thermal Hydraulic Bases for Success Criteria," B12092, j dated May 22,1986.
- 20. C. I. Grimes letter to R. M. Kacich, " Request for Comments on PRA Review of ISAP Issues," dated September 23,1985.
- 21. 3. F. Opeka letter to C. I. Grimes, " Comments on NRC Review of
", Millstone Unit No. 1 Probabilistic Safety Study and ISAP Topics," ! A05255, dated October 21,1985. i
- 22. C. I. Grimes letter to R. M. Kacich, "NRC Final Report on PRA Review of ISAP issues," dated January 3,1986.
- 23. 3. F. Opeka letter to C. I. Grimes,"NRC Final Report on PRA Review of ISAP Issues," A05512, dated March 26,1986.
f 24. 3. F. Opeka letter to C. I. Grimes, " Integrated Safety Assessment Program," Bil638, dated August 13,1985.
- 25. 3. F. Opeka letter to C.1. Grimes, " Summaries of Public Safety Impact
- Model Project Analyses," Bil666, dated August 26,1985.
I 26. 3. F. Opek, letter to C. I. Grimes, " Integrated Safety Assessment j Program," Bll801, dated October 16,1985.
- 27. 3. F. Opeka letter to C. I. Grimes, " Summaries of Public Safety impact i Model Project Analyses," Bil633, dated August 7,1985.
i l 28. 3. F. Opeka letter to C. I. Grimes, "lSAP Topic No.1.19 - Integrated l Structural Analysis," A05395, dated February 4,1986.
- 29. 3. F. Opeka letter to C. I. Grimes, " Integrated Safety Assessment l Program," Bil818, dated October 16,1985.
I
- 30. 3. F. Opeka letter to C. I. Grimes, " Summaries of Public Safety Impact
{ Model Project Analyses," B11662, dated August 23,1985.
- 31. 3. F. Opeka letter to C.1. Grimes, " Summaries of Public Safety Impact Model Project Analyses," B11699, dated September 12,1985.
i 32. 3. F. Opeka letter to C. I. Grimes, " Integrated Safety Assessment Program," Bil795, dated October 11,1985.
- 33. 3. F. Opeka letter to C. I. Grimes, " Integrated Safety Assessment j Program," Bil806, dated October 16,1985.
i
A-3
- 34. 3. F. Opeka letter to C. I. Grimes, " Integrated Safety Assessment 0 Program," B11838, dated October 25,1985.
- 35. 3. F. Opeka letter to C.1. Grimes, " Integrated Safety Assessment Program," Bil696, dated October 24,1985.
- 36. J. F. Opeka letter to C. I. Grimes, " Integrated Safety Assessment Program," Bil766, dated November 25,1985.
- 37. 3. F. Opeka letter to C. I. Grimes, "ISAP Topic No.1.11 - Post-Accident Hydragen Monitor," B12097, dated July 31,1986.
- 38. 3. F. Opeka letter to C. I. Grimes, " Integrated Safety Assessment Program," Bil828, dated October 24,1985.
- 39. J. F. Opeka letter to C. I. Grimes, " Summaries of Public Safety Impact Model Project Analyses," Bil684, dated September 6,1985.
i
- 40. 3. F. Opeka letter to C. I. Grimes, " Summaries of Public Safety Impact Model Project Analyses," Bil683, dated September 6,1985.
- 41. 3. F. Opeka letter to E. L. Jordan, "IE Information Notice No. 86 i Erratic Behavoir of Static 'O' Ring Differential Pressure Switches,"
A05836, dated July 3,1986.
- 42. 3. F. Opeka letter to T. E. Murley, "lE Bulletin No. 86-02 Static 'O' Ring Differential Pressure Switches," B12182, dated July 25,1986.
- 43. D. C. Switzer letter to K. R. Goller, " Millstone Unit No.1 Compliance with Appendix 3," dated November 14,1975.
- 44. H. L. Thompson letter to 3. F. Opeka, " Exemption from Submittal Date j for an Updated Final Safety Analysis Report (FSAR)," dated November 22,1985.
! 45. 3. F. Opeka letter to H. L. Thompson, " Exemptions from 10CFR50.71(e), FSAR Updates," A05282, dated October 11,1985.
- 46. 3. F. Opeka letter to C. I. Grimes, " Integrated Safety Assessment Program," Bil794, dated October 16,1985.
- 47. 3. F. Opeka letter to H. L. Thompson, " Fire Protection," Bil678, dated November 21,1985.
- 48. J. F. Opeka letter to C. I. Grimes, " Integrated Safety Assessment i
Program," Bil808, dated October 16,1985. i 49. 3. F. Opeka letter to C. I. Grimes, " Integrated Safety Assessment ] Program," Bil856, dated November 8,1985. i
- 50. 3. F. Opeka letter to C. I. Grimes, " Summaries of Public Safety Impact Model Project Analyses," Bil681, dated October 17,1985.
5!. 3. F. Opel:a letter to C. I. Grimes, " Environmental Qualification of Electrical Equipment - Request for Exemption," Bil951, dated January 17,1986.
d A-4 -
- 52. F. 3. Miraglia letter to 3. F. Opeka, "ATWS Rule Schedule Required by 10CFR50.62," dated December 13,1985.
- 53. 3. F. Opeka letter to C. I. Grimes, "ATWS Rule Schedule Required by 10CFR50.62," A05442, dated February 18,1986.
- 54. 3. F. Opeka letter to C. I. Grimes, " Anticipated Transients Without a Scram," B12123, dated July 21,1986.
- 55. J. F. Opeka letter to C. I. Grimes, "lSAP Topic No.1.19, Integrated Structural Analysis," B11939, dated January 6,1986.
- 56. 3. A. Zwolinski letter to 3. F. Opeka, "NRC Staff's Evaluation of NNECO's Resolution of ISAP Issue 1.20 - MOV Interlocks," dated September 16,1985. ,
- 57. 3. F. Opeka letter to C. I. Grimes, " Integrated Safety Assessment Program," Bil799, dated October 16,1985.
- 58. 3. F. Opeka letter to C. I. Grimes, " Summaries of Public Safety Impact Model Project Analyses," B11682, dated September 6,1985.
- 59. 3. F. Opeka letter to C. I. Grimes, " Integrated Safety Assessment Program," B11807, dated October 16,1985.
O 60. 3. F. Opeka letter to C. I. Grimes, " Integrated Safety Assessment Program," B11747, dated October 9,1985.
- 61. 3. F. Opeka letter to C. I. Grimes, " Supplement to ISAP Topic No.1.25,"
A05437, dated January 13,1986.
- 62. C. I. Grimes letter to 3. F. Opeka, " Degraded Grid Voltage Procedures,"
A05797, dated May 20,1986.
- 63. 3. F. Opeka letter to C.1. Grimes, " Integrated Safety Assessment Program," B11676, dated September 9,1985.
- 64. 3. F. Opeka letter to C. I. Grimes, " Integrated Safety Assessment Program," Bil695, dated Septcmber 13,1985. '
- 65. R. M. Bernero letter to BWR Licensees, " Safety Concerns Associated with Pipe Breaks in the BWR Scram System," dated January 3,1986.
- 66. 3. F. Opeka letter to C. I. Grimes /A. C. Thadani," Request for Additional Information - Generic Letter 83-28, Item 1.2," A05364, dated January 10,1986.
- 67. 3. F. Opeka letter to C. I. Grimes, " Integrated Safety Assessment Program," Bil800, dated October 15,1985.
- 3. F. Opeka letter to C. I. Grimes, "TS Changes to Address 10CFR50.72 O 68.
and 10CFR50.73, Bil688, dated August 20,1985.
A-5
- 69. 3. F. Opeka letter to C.1. Grimes, " Integrated Safety Assessment Program," B11819, dated October 16,1985.
- 70. 3. F. Opeka letter to C.1. Grimes, '" Integrated Safety Assessment Program," Bil809, dated October 22,1985.
- 71. 3. F. Opeka letter 'to C.1. Grimes, " Integrated Safety Assessment Program," Bil820, dated October 16,1985.
- 72. 3. F. Opeka letter to C.1. Grimes, " Main Steam Line Support Failures,"
Bil938, dated December 23,1985.
- 73. 3. F. Opeka letter to C.1. Grimes, " Main Steam Line Support Failures,"
B11983, dated February 6,1986.
- 74. 3. F. Opeka letter to C.1. Grimes, " Integrated Safety Assessment Program," B11821, dated October 16,1985.
- 75. 3. F. Opeka letter to C.1. Grimes, " Integrated Safety Assessment Program," B11822, dated October 16,1985.
- 76. 3. F. Opeka letter to C. I. Grimes, " Integrated Safety Assessment Program," Ell 805, dated October 23,1985.
- 77. 3. F. Opeka letter to C. I. Grimes, " Integrated Safety Assessment
( Program," B11804, dated October 22,1985.
- 78. 3. F. Opeka letter to C. I. Grimes, " Integrated Safety Assessment Program," Bil316, dated October 16,1985.
- 79. 3. F. Opeka letter to C. I. Grimes, " Integrated Safety Assessment Program," B11823, dated October 16,1985.
- 80. 3. F. Opeka letter to C.1. Grimes, " Pressure-Temperature Operating Limits Curves," B11923, dated December 17,1985.
- 81. 3. F. Opeka letter to C. I. Grimes, " Integrated Safety Assessment Program /' Bil641, August 13,1985.
- 82. 3. F. Opeka letter to C.1. Grimes, " Integrated Safety Assessment Program," Bil715, dated September 26,1985.
- 83. W. G. Counsil letter to D. M. Crutchficid, " Millstone Unit i IGSCC Program," Bil236, dated June 15,1984.
- 84. 3. F. Opeka letter to C. I. Grimes, " Integrated Safety Assessment Program," Bil665, dated September 6,1985.
- 85. 3. F. Opeka letter to C.1. Grimes, " Integrated Safety Assessment Program," Bil642, dated August 13,1985.
- 86. 3. F. Opeka letter to C.1. Grimes, " Summaries of Public Safety Impact Model Project Analyses," Bil650, dated August 15,1985.
A-6
- 87. 3. F. Opeka letter to C. I. Grimes, " Integrated Safety Assessment Program," BlI664, dated August 26,1985.
- 88. 3. F. Opeka letter to C.1. Grimes, " Integrated Safety Assessment Program," Bil776, dated October 9,1985.
- 89. 3. F. Opeka letter to C. I. Grimes, " Integrated Safety Assessment Program," Bil717, dated October 2,1985.
, 90. 3. F. Opeka letter to T. E. Murley, "lE Bulletin 85-03, MOV Common Mode Failures," B12091, dated June II,1986.
- 91. 3. F. Opeka letter to C. I. Grimes, " Integrated Safety Assessment Program," Bil716, dated October 1,1985.
- 92. D. C. Switzer letter to D. L. Ziemann, " Proposed Technical Specification Change," dated March 20,1978.
- 93. W. G. Counsit letter to D. L. Ziemann, " Containment Monitoring," dated October 31,1979.
- 94. W. G. Counsil letter to D. L. Ziemann," Primary Containment Continuous Leak Rate Monitoring," dated April 16,1980.
! 95. D. M. Crutchfield letter to W. G. Counsil, " Proposed Revisions to Technical Specifications for Continuous Containment Leak Rate Monitoring," A04099, dated June 7,1984.
- 96. 3. A. Zwolinski letter to W. G. Counsil, " Containment Isolation Dependability and Long-Term Review of Containment," A04692, dated February 25,1985.
- 97. W. G. Counsil letter to 3. A. Zwolinski, " Continuous Containment Leak Rate Monitoring," A04099, dated March 19,1985.
- 98. 3. F. Opeka letter to 3. A. Zwolinski, " Containment Purge and Vent,"
! A04692, dated June 28,1985. 1
- 99. 3. F. Opeka letter to 3. A. Zwolinski, " Continuous Containment Leak i Rate Monitoring," Bil793, dated November 20,1985.
100. C. I. Grimes letter to 3. F. Opeka," Continuous Containment Leak Rate Monitoring," A05423, dated December 3,1985. 101. C.1. Grimes letter to 3. F. Opeka, " Containment Purge and Vent," A05743, dated May 2,1986. 102. 3. F. Opeka letter to C. I. Grimes, " Containment Purge and Vent," l B12139, dated July 3,1986. j Q U 103. 3. F. Opeka letter to C. I. Grimes, " Integrated Safety Assessment Program," Bil714, dated September 30,1985. l }
A-7 (~ 104. W. G. Counsil letter to D. G. Eisenhut, "Information Requested by
\ Generic Letter 84-15," A04190, dated February 4,1985.
105. 3. F. Opeka letter to H. R. Denton, " Effects of Hurricane ,' Gloria'," Bil930, dated December 31,1985. i 106. 3. F. Opeka letter to C. I. Grimes, " Policy Statement on Engineering Expertise Onshif t (Generic Letter 86-04)," B12125, dated June 13,1986. 107,
- 3. F. Opeka letter to C. I. Grimes," Conversion of Provisional Operating License to Full-Term Operating License -
Comments on Draft Documents," B12183, dated July 31, 1986. t 108. 3. F. Opeka letter to C. I. Grimes, " Control of Heavy Loads," B12098, dated July 15,1986. 109. D. G. Eisenhut letter to W. G. Counsil, " Anchorage and Support of Safety-Related Electrical Equipment," dated January 1,1980. 110. 3. A. Zwolinski letter to 3. F. Opeka, "NRC Evaluation for Anchorage and Support of Safety-Related Electrical Equipment at Millstone Unit No.1," A05335, dated October 24,1985. ! 111. R. M. Kacich letter to C. I. Grimes, "SEP Topic 111-6, Seismic Design !' Considerations - SEP Owners Group Cable Tray / Conduit Test Program," dated October 15,1984. - 112. C. I. Grimes letter to R. M. Kacich," Millstone Unit No.1 -ISAP Review of Operating Experience," dated August 19,1985. : 113. 3. F. Opeka letter to C. I. Grimes, " Comments on ISAP Review of ' Operating Experience," A05178, dated October 3,1985. l ' I I } i I I lo ; 1 i ( l 1
l Docket No. 50-245 I i l l Appendix B l l ISAP Chronology and Major Milestones i t I i i I 1 I ) i l l .l .i July 1986 l
-.. . - - - - _ _ _ , . - - - _ - - - . - - . _ - . - _ _ . . _ _ . . _ . _ _ . - . - - ~ . - - . . - - _ - . . - _ _ _ _ - _ - - - . _ _ . -
__ .- _ = _ . _ - - _ _ - . .. 4 ISAP Chronology and Major Milestones O June 13,1983 Northeast Utilities proposes to the NRC to conduct an integrated evaluation of all regulatory i requirements. July 5,1983 NRC agrees to meet and discuss Northeast Utilities proposal for an integrated assessment. July 7,1983 NRC Staff briefs ACRS on the proposed Integrated Safety Assessment Program (ISAP). July 12,1983 ACRS letter endorses the ISAP concept.
- l September 14,1983 Detailed Northeast Utilities proposal on ISAP sent to the NRC. Specific issues to be included are
- identified.
October 5,1983 NRC responds to Northeast Utilities September 14, 4 1983 proposal. NRC indicates support for concept. 1 l December 28,1983 Formal Northeast Utilities proposal on expanded j integrated assessments. Deferrals on specific ! actions requested and justification for continued l operation provided. Commitment to perform a ! Haddam Neck plant-specific probabilistic risk ' assessment formalized. ] i February 28,1984 Meetings between Northeast Utilities and NRC j management to discuss Northeast Utilities proposal. NRC management expresses support for concept. March 23,1984 SECY 84-133 describes a four plant pilot ISAP j program to be conducted in lieu of SEP Phase ill and i NREP. I l April 4,1984 Memorandum from NRC Office of Policy Evaluation to the NRC Commissioners recommends approval of ISAP. I j April 5,1984 Commission briefing on ISAP. J j April 5,1984 NRC grants Northeast Utilities schedular relief on selected issues. Defers programmatic issues to the l ISAP program forum. May 10,1984 ACRS meeting indicates the ISAP concept is moving forward. 1 November 15,1984 NRC policy statement on ISAP published in Federal Register (49 FR 45112). December 4,1984 NRC letter Invites Northeast Utilities participation i in ISAP for Millstone Unit No. I and the Haddam '
- Neck Plant.
i - . _ . - - - _ . - - _ _ - - . - - . _ - - - - -
( 3anuary 8,1985 Northeast Utilities meets with the NRC to determine general interaction strategy for the conduct of the integrated assessment. January 29 - 30, 1985 Scheduled screening review meeting between Northeast Utilities and the NRC canceled. Status of the NRC involvement in ISAP uncertain. I February 13,1985 Northeast Utilities meets with NRC Commissioners and Staff to discuss restoration of ISAP. April 2,1985 Screening review meeting held between Northeast Utilities and the NRC to discuss the scope of topics to be addressed in the integrated assessment. May 6,1985 NRC SECY 85-160 describes a revised ISAP pilot program for two plants; Millstone Unit No. I and
, Haddam Neck.
May 17,1985 Northeast Utilities submits a revised scope of the topics to be evaluated in the ISAP. May 23,1985 Northeast Utilities meeting with NRC to review
]v June 3,1985 Northeast Utilities' May 17,1985 proposal.
Northeast Utilities meeting with the NRC discussing probabilistic risk assessment applications at Northeast Utilities, specifically the Millstone Unit No.1 Probabilistic Safety Study (PSS). June 4,1985 Northeast Utilities meeting with the NRC to discuss scope of topics, pending licensing actions, generic issues, and plant improvement projects to be evaluated in the integrated assessment. July 10,1985 Millstone Unit No.1 PSS submitted to the NRC. Immediate corrective actions (long-term cooling) and topic-related issues defined in the forwarding letter. July 16 - 18,1985 Northeast Utilities and the NRC meet to review the Millstone Unit No.1 PSS. July 31,1985 NRC Staff evaluation issued defining 80 topics for Millstone Unit No. I and 70 topics for the Haddam Neck Plant, as well as the projects that would be completed independent of ISAP; documentation requirements defined for deterministic analyses, probabilistic analyses (topic specific) and plant O improvement summarics.
1 O August - November 1985 Deterministic reviews of all 80 ISAP topics submitted to the NRC. Public safety risk-oriented analyses for 22 topics also submitted. August 6,1985 Operating Experience Review of Millstone Unit No. I performed by NRC. August 19,1985 Draf t NRC Operating Experience Review Report for , Millstone Unit No. I provided to Northeast Utilities
- for comment.
August 27 - 28, 1985 Northeast Utilities and the NRC meeting to review 4 the Millstone Unit No.1 PSS. 4 : September 23,1985 Draft NRC Probabilistic Safety Analysis (PSA) evaluation report for Millstone Unit No. I provided i to Northeast Utilities for comments. October 3,1985 Northeast Utilities submits comments on the NRC's Operating Experience Review of Millstone Unit No.1. ) October 21,1985 Northeast Utilities submits comments on the NRC's
- Millstone Unit No.1 PSA evaluation report.
. November 18 - 19, 1985 Northeast Utilities meeting with the ACRS Subcommittee on Millstone regarding the Millstone , Unit No. I full-term operating license conversion. ISAP discussed from a global perspective. November 20,1985 Commission memorandum and order issued granting a schedular extension to 10CFR50.49 for the environmental qualification of eleven valve operators to be resolved under ISAP for Millstone Unit No. I but no later than August 30,1987. December 4,1985 Northeast Utilities meeting with the combined ACRS Subcommittee on Safety Philosophy, i Technology and Criteria, and Reliabl!!ty and i Probabilistic Assessment to review the Millstone Unit No.1 PSS.
! December 5,1985 Meeting with fuit ACRS on Millstone Unit No. I full-term operating license conversion including i
discussions of the Mllistone Unit No.1 PSS and l ISAP. January 3,1986 Final NRC Probabilistic Safety Analysis evaluation report for Millstone Unit No. I issued to Northeast Utilities. January 10,1986 Schedule for completion of the Millstone Unit No.1 ISAP submitted to the NRC.
B r February 19,1986 NRC Commissioners briefed by NRC Staff on the status of ISAP. . February 25 - 26,1986 Northeast Utilities sponsors an independent review of the ISAP analytical ranking methodology. March 3,1986 NRC Staff evaluation issued describing the results of the topic reviews including: (1) specific issues to be addressed in the integrated assessment, j (2) resolved topics, and (3) new topics and related issues resulting from the PSS and operating experience review. March 12 - 14,1956 Northeast Utilities and NRC meeting to review NRC safety evaluation of the Millstone Unit No.1 ISAP topics. March 26,1986 Millstone Unit No. I probabilistic fire analysis l submitted to the NRC. May 15 - 16,1986 Northeast Utilities meeting with the NRC to discuss the completion of the Millstone Unit No.1 ISAP. July 31,1986 Northeast Utilities submits the final report on the I O Millstone Unit No.1 ISAP. 4
1 Dxket No. 50-245 l i 3 Appendix C > > > 4 t s (- i I
' l
, Probabilistic Risk-Oriented 4 1 l Project Analyses ,
l , e l t i - e. F 1 July 1986 l
s9 , ISAP #1.01, Sas Turbine Start Imgic Modifications
#1.24 Emergency Power (O ; Safety Issue 3 . --
The Millstone Unit 1 PSS model ideritified the fact that 30% of the predicted core melt frequency was due to loss of normal (LNP) events, with over half of the resulting sthuences dominated by failure of gas turbine bus 14E. Further resiew shows that failure of the gas turbine generator constitutes over 11% of the total C.H.F.' by itself di.e. approximately 74% of bus 14E unavailability). Gas, t'urbine fLilure is due to either start or run faults which are equally divided in term.: of their contribution importance as shown in section 3.2.2 of the P.S.S. * ' ' Pecause the gas turbine. generator is one of the single most dominant contributors to core melt frequency, possible modifications to improve gas turbine reliability warrant consideration. Proposed areas for investigation have focused on two principal areas: The potential for bypassing additional gas turbine equipment
~
protective trips that are not presently bypassed during emergency operation.' '
~
- Evaltiation of the existing gas turbine preventive maintenance (P.M.) ,
program to determine its effectiveness. Due to the close interrelationship between Topics 1.01 & 1.24, we have chosen I to evaluate these topics concurrently. Proposed. Project ' The proposed project addresses modifications or improvements in 4 areas as discussed below:
- 1. Startup Trips -
Four of the. gas turbine protective trips are - c associated with a series of expected' conditions during the starting MILLSTONE UNIT .1 IhTEGRATED SAFETY ASSESSMEfff PROGRAM I 1
sequence (i.e. turbine light-off). Two of these startup trips indicate a major problem with unit start and cannot be bypassed without compromising the safety of site personnel. The protective tiips that were proposed to be bypassed during emergency start conditions are: , start speed not reached in 20 sec. (expected in 13 to 16 sec.) generator excitation speed not reached in 60 sec. (expected 35
,,sec. after start speed achieved)
- 2. Operational Trips - There are 6 protective trips which are associated with steady state operation of gas turbine while it is running. All '
but one of these trips is required to prevent severe mechanical damage of the gas turbine and associated hazardous conditions for site-personnel. Accordingly, only the high lube oil temperature trip is proposed to be bypassed during emergency operations, while all other protective trips are retained.
- 3. Preventive Maintenance Program -
Potential areas for additional preventative maintenance will be determined based on inspections, performed'during refuel outages. JI . Generator Trips - The output' breaker of the generator has 7 protective trips that are not presently bypassed. Two of the trips will be retained for generator protection and the remaining 5 trips will be bypassed under accident conditions, as is currently done on the Millstone Unit 1 emergency diesel generator'. The trips proposed to be bypassed are: loss of excitation opening of the exciter breaker
. negative sequence MILLSTONE UNIT 1 n m., . . .,.m o. - .--~. .-. ----...
O reverse power
=
generator underspeed Analysis of Public Safety Impact .
- *~
Each of the 4 issues was looked at separately in order to learn whether or not it produced an impact on public risk and safety. The corresponding analysis was performed in several steps using Method A. The first step was to determine what effect, if any, the recomendations of a particular issue has on gas turbine performance. If any recomendation produced such an effect, a new gas turbine unavailability number was calculated. The calculation was based on the , , estimated change in gas turbine failure rate caused by implementation of the recomendation. The last step was to requantify the Millstone Unit 1 PSS model using the new unavailability to determine the change in core melt frequency associated with the particular issue. The analyses for each issue are described below.
- 1. Startup Trips Based on a. review of the Millstone Unit 1 component reliability data base developed as a part of the Millstone Unit 1 P.S.S., the 28 recorded start failures for the gas turbine generator may be broken down into the following categories according to the number of failur's in each:
governor problems 7 causes unknown 6 speed co6 trol / switches 5 air start regulating valve 4 i output breaker failure 3 Operator error 1 MILLSTONE UNIT 1 TWMD ATm C AN A c e ""* * * " * * * * * * *
- I- _ _ _ _ - - _ _ _ _ . .. ... - _ - - , - - - - - - - - -
e . spurious vibration trip 1 inverter failure 1 The proposal to bypass the gas turbine light-off speed and generator exitation sposJ tiips will only affect the category for speed control / switch induced failures. In looking at the 5 recorded failures for this category, only 2 of them could possibly be prevented if the proposed startup trip bypass is implemented.. The other 3 ar'e r. elated to failures of the speed controller which ultimately causes gas turbine trip for other reasons. Since the speed trips will only be bypassed under accident conditions, it will still be possible to have a gas turbine failure during a normal test start. The 8321 valid starts or start attempts that were used to calculate the original gas turbine start failure rate, consist of mostly nonnal test starts. Consequently, the 2 observed failures could have occurred either during nonnal start or sinulated accident start and may not always be preventable. Conservatively asstaning that there is a 50% chance the failures occurred during a simulated accident start,, then 1 of them could be prevented through speed
~
trip bypass. This lowers the total number of gas turbine start failures from 2B to 27 and reduces gas turbine unavailability by approximate 11y 3.55. After re-quantifying the P.S.S. model to reflect the change in gas turbine ! unavail' ability, the total core melt frequency was reduced by 2 x 10-6/ year. ' Nearly all of the reduction is due to changes'in plant damage states that '
' result in early and intennediate core melt times (e.g. TE1 and TI1).
, Accordingly, a multiplier of 0.5 was used to calculate the Man-Rem equivalent dose reduction as follows:
6 R = (2 x 10-6/yr.) (0.5) (3 x 10 Man-Rem) (25 yr.)
= 75 Man-Rem
- 2. Operational Trips.
O MILLSTONE m ,, . UNIT 1
l
. 1 Tha high lube oil temper::ture trip is bypassed undtr cccidsnt conditions and thus no further evaluation has been perfonned.
- 3. cas Turbine Preventive Maintenance Fi ,-o A review of the gas turbine reliability data base failures led to the preliminary conclusion that a better preventive maintenance program could have precluded scxne of the governor start failures and all of the air start regulating valve failures. However, in light of recent modifications that were perfonned on the gas turb'ine air start system, these latter failures are not expected to recur. Also, scheduled preventative maintenance of .the air start system has been added to the existing program so that any further progsam "
improvement will not affect these types of start failures. Governor related start failures could potentially be eliminated for 3 of the 7 recorded failure events in this category. The present gas turbine preventative maintenance program requires a monthly check on the governor oil level with all other preventative maintenance scheduled to be performed during refueling outages. Optimistically, the gas turbine failures could be reduced from 28 to 25 if an effective preventative maintenance program could be implemented for the governor. With such failures eliminated altogether the gas turbine
~
l unavailability could be reduced by as much as 11%. ~ Re-quantification of the PSS model results in a potential C.M.F. reduction of 6 x 10 6/yr. due to more frequent governor p.m.. Since the plant damage states are identical to those mentioned earlier (i.e. TE1 and TI1), a 0.5 multiplier is used to calculate public risk as shown below: 2 6 R = (6 x 10-6/yr.)(0.5)(3 x 10 Man-Rem)(25 yr.)
= 225 Han-Rems .
- 4. Generator Trips Over the 12-1/2 year period of recorded data for the gas turbine, there have been 3 start failures related to output breaker closure failure. However, none of these faiures were due to trips that the bypass proposed is intending to
\ l
, MILLSTONE UNIT 1 INTEGRATED SAFETY ASSESSMEhT PROGRAM
prevsnt. In crdtr to calculate en sffset on gas turbine unavailability, it is conservatively assumed that the proposed bypass of 5 out of 7 trips will O prevent the occurrence of one such trip over the remaining life of the plant. This assumption results in the same public risk reduction of 75 PersorrRem that was e,alculated for the startup trip bypass which prevents one trip as well. Pesults The results of the above analysis can be best summarized as shown in the following table: Man-Rem Score (out Snecific Change Reduction
- of 10)
Bypass of 2 startup trips 75 Man-Rem 0.2 Implementation of more comprehensive governor P.M. program 225 Man-Rem 0.6 Bypass of 5 generator 75 Man-Rem 0.2 trips Collectively, the scores of all 3 gas turbine modifications / improvements result in totrl score of 1.0 for 'the project. d MILLSTONE UNIT 1 IhTEGRATED SAFETY ASSESSMENT PRrr. RAM
ISAP #1.02 Tornado Missile Protection Safety Issue There are four basic ways to remove core decay heat at Hillstone Unit 1 and taese are: o Feedwater and Main Condenser o Isolation Condenser o- Shutdown Cooling System o Alternate Shutdown Cooling In the event of a major tornado at the Millstone site, it is likely that a loss of offsite power would occur and result in unavailability of the Feedwater and Main Condenser systems. The potential for damage from tornado cissiles to the other three decay heat removal schemes led to fbrther evaluations under the Systematic Evaluation Program (S.E.P.). These evaluations identified that a tornado with sufficient wind speed could produce missiles which could penetrate the turbine building switchgear room, through which power cables from the diesel and gas turbine pass. This would eliminate the capability of using the Shutdown Cooling System or going on Alternate Shutdown Cooling. The only remaining deca l hat removal system, the Isolation Condenser, was also assessed to be vulnerab. t.o tornado missile induced failure due to the potential for missiles to penetrate the fire water and condensate storage tanks. In the final O Safety Evaluation Report for Topic III-4.A (Tornado Missile Protection), the NRC concluded (Reference 1) that components inside the reactor building, including the reactor coolant pressure boundary and the Isolation Condenser (IC) system are adequately protected from the effects of tornado missiles. To resolve this issue it is necessary to develop a means of providing makeup water l to both the Isolation Condenser and Reactor Pressure Vessel from tornado missile protected sources. L vyc.;d Proje=t The project under consideration proposes a design change to provide for a portable engine driven puup and a tornado missile protected water supply to
. provide makeup to the IC and the Reactor Pressure Vessel (RPV). The water supply to the latter" may be needed to restore th'e RPY water level during MIL 1SIONE UNIT 1 .
TNTEGRATE SAFETY ASSESSMENT PROGRAM
achieve and maintain safe shutdown following severe tornado events and improved reliability of Isclation Condenser makeup following internal events. Each of O these benefits are addressed separately. A. Benefits Fru Mitigating the Effects of Tornado Missiles The Millstone Unit 1 PSS did not include a specific evaluation of the effects of Tornado Missiles. The types of system failure sequences result'ing frort tornado missiles, however; are very similar to those evaluated for loss of normal power events. In a tornado with sufficiently high wind speed, the following failures can be postulated: Loss of normal power due to grid failure Loss of power from the Diesel Generator (DG) and the Gas Turbine (GT) when the' missiles begin to penetrate the turbine building through which the power cables'for the DG and GT are routed or the diesel / gas turbine enclosures through metal access openings, the structures themselves, or the intake / exhaust ducts. Loss of IC make-up due to missiles penetration of the fire water and the condensate storage tanks. As discussed in section 2.4.2 of the Millstone Unit 1 PSS, this sequence leads to an early core melt with containment initially intact (TE1). The method of analysis was to determine the frequency of the tornado which could result in the sequence discussed above. This sequence was then mitigated by crediting the availability of city water supply estimated from a sinplified fault tree. The following asstunptions were made in this analysis: o It is assumed that city water supply will remain available following the tornado. The city water is supplied by Konomoc Lake. Konemoc Lake is located about seven miles from the Millstone site. It is very unlikely that Konomoc Iake will also be hit by the tornado at the same time as the Millstone site. A backup diesel ptunp is available in the event city power
~
is lost. O
~ '
MILLSTONE UNIT 1 . T W Ff:DATrn 44erTV aRRCR9 DCMP DR(Y: RAM
S:. ate and hence the risk reduction would be roughly 300 Man-Rems. B. Benefits From Mitigating Loss of Normal Power Events For internal events, availability of city water supply will ~ be beneficial in ' mitigating those station AC blackout sequences where IC is initiated but the make-up to the IC fails due to failure of the site fire water supply. The frequency of such a scenario is estimated by the followinE equation.
^ *\NP NAC. Rest (P334 + P337) QFPS The failure probabilities are obtained from the Millstone 1. PSS as shown below:
l 1 A typ = 0.124/ year, (Section 1.2) Restoration of AC: If IC is available, the restoration of AC can be delayed until 90 minutes. Probability of failing to recover offsite l g power in 90 minutes is 0.26 (Section 2.4.2 and Appendix 2A) V l Split Fractions: For Support State 4 (14E'SW): P334= 1.22 x 10-2 For Support State 7 (14E*14F): P g = 5.52 x 10-3
,, (Section 5.2)
Millstone Site Fire Water Supply Fails. Auto initiation and restoration fails C FPS = (8.54 x 10-2)(B.49 x 10-1) (Section 3.2.15) 4
= 7.25 x 10 Toe resultant core melt frequency would be:
A= 0.124/yr x 0.26 x (1.22 x 10-2 + 5.53 x 10-3) x 7.25 x 10-2
= 4.1 x 10-5/mr The revised core melt frequency with iglementation of city water supply hook-up is' calculated by the following equation: ~
O - MILLS {ONE UNIT 1 INTEGRATED SAFDT AR9F.R9&Mr PRmRAM
o CITY WATER SUPPLY NOT AVAIL ASLE
+
I T I I i .I ClfT WATER PLY MISCELL ANEOUS PORTASLE PtMP OPERAt0R ERROR mW T O WM M mRM M ODE TO GASS Of' gagggg ygtygg PUIGP ANO PRIMARY POWER AND AND F AILS TO RUN
- F AIL T O OPEN IAttisRE OP 0010 SilPPLV FOR E4 HOURS CONNECTING HOSES S ACIt-UP POWER ,,
l
. /
0.9 8OE-4 S.7E-E SOE-E (ESitMATED VALUtl ASSUMING F T S** S E-E lWASH l4000 RULE-SASED SEHWlOR S %qhtvES F T R e 34 s 3 og.4 SEE SEC. 4 00' MPt PSS
- So I.O E - 4 (DfESEL ENGetet ONLY- Is0DIFIEO FOR STRESS WA SII -14005 0* SsIt E TOTALS 97E-E FIG U R E I. CITY WATER SUPPLY TO IC FAULT TREE '.
f i ISAP Tepic No.1.03 Containment Isolation - Appendix A Modifications Scope of Project
- The proposed project is to relocate the tie-in to the LPCI suction line from upstream to downstream of pump suction valves 1-LP-2A and 2B (see Figure 2).
By closing the motor operated valves 1-LP-2A and 2B, this change will allow isolation of a break in the LPCI cooling return line after fuel damage has occurred. Safety Issue The Low Pressure Coolant Injection (LPCI) pump bearing cooling return line tie-in (a 3/4" pipe connection), is located upstream of pump suction valves: 1-LP-2A
- and 2B, which form the containment boundary as defined by General Design Criteria (10CFR50, Appendix A). If the cooling return line breaks, it can be isolated only by closing manual valve 1-LP-1A(B) as shown in Figure 1. In the
, unlikely event of an accident with significant fuel damage compounded by the failure of this piping connection, the area will become inaccessible due to high l radiation levels. In such a scenario, the break will remain unisolable. The torus water will slowly drain outside the containment and would thus constitute a release pathway for radioactive material to the ennonment. j PRA Assessment The public safety impact of this proposed change was assessed using method B. The release of radioactive material due to rupture of the cooling return line is a 4 s concern only following those accidents involving significant fuel damage. In such cases, the radioactivity level of torus water would be high subsequent to rupture of the cooling return line and will allow spillage to torus water outside of the i containment. i i As calculated in Millstone Unit 1 Probabilistic Safety Study (Section 5.3), the i frequency of accidents resulting in any limited fuel damage is 3 x 10-3/ year, j However, the combination of such an accident (resulting in fuel damage) and i concurrent rupture of LPCI lube oil cooling return line is a rare event with a frequency of 7 x 10-9/ year, based on WASH-1400 small diameter pipe failure rates. Even in these rare event scenarios, no significant radioactive material is
! expected to be released due to small size of the cooling return line (size 3/4").
As an additional item, the effect of cooling water return line rupture on radiological releases from core melt sequences does not need further investigation. This is because in all core melt sequerces, the containment is assumed to ultimately fait due either to high pressure or temperature. 1 Radioactively release from a broken 3/4"line would be insignificant compared to the total release from the failed containment. Results i Moving the LPCI lube oil cooling return line upstream of the LPCI suction valve 1-LP-2A and B will have no impact on core melt frequency and an
- Immeasureable impact on public radiation exposure. The project is thus assigned -
i a score of 0 out of 10. O Score 1 0/10 l
\
~
O O O
- MEEP FULL kl-kl N M CST
@-t-@-3 m
-g 324 LG WA "" ISA
~
.3 b
LO IIEAT EXCHANGER
\ /
U AO g ga gy .. 3 REC RC g- 13A' 1 , , LOOP son J
. stA CMOSS-Tit DEADER . . . .
14A f@t
* /43A h M, -- gPIC l 44A hT '(, , , , , ,,
, l
, _i SPR AY m. g L -
ORVwfLL , , g Y EC M LPC-4
,,,,n, f t.l - @ , Di s 'd .
,, _@_ _f' _ _ _ _~_ _,
) RlNG HE ADER
.:y IA
'% L O.
q O @PS~~~~~~~7 0 LP-ISA 3/4" AC HIGH PRE s9UNE / LOW PfeESSURE LP-ITA INSEALOCK IN T ERF ACE VULNER A0LE TO y;p IN T E R FACING SYSIEM LOCA A e FIGURE I CURRENT LOW PRESSURE C00L' ANT INJECTION SYSTEM
O O - O as MEEP FULL v
'/
N. CST
- . F a eueE
--+ g 32A LG N
Q a gj,,w s,o,,,,. A,
% 5! J .
'- '=
-ArE - -R s ,.
} p, 4v .
. Ansi
+
REC C zggA. , 13A'(h J 1'.... .
~
Loor CROSS-flE LEADER ,._. . . ~. . 14 AJf@T V 43A k@ g ---le Pic l 44At Ig , ==- ---- : i ^ ^ ~~ *^~+' - " ' ~ " g l ( 'reA ~ 'A -8 l
- I t -
; SPR AY.. .. g
- 8 DRv* ELL g
-LPC-44
, ,7 L .O. , e g--- ---- ,
^ . f a
RING IIEADER 14 L0 PS 1 I
#4 LP-tea f.
A .C. Hlelt PRES 90nE/ LOW l'RESSURE 7 (p.,74 gMTERLOCK I INTERFACE VULMERABLE 70 (Mg INTERFActNG SYSTEM LOCA O; , i e' e FIGURE 2 PROPOSED CHANGES TO THE LOW PRESSURE . SAFETY INJECTION SYSTEM
ISAP #1.04 INCU 5 tem Pressure Interlock Safety Issue Millstone Unit 1 Probabilistic Safety As described in Section 1.1.4 of the the Reactor Water Cleanup (R.W.C.U.) System is primarily Study (P.S.S.), designed to remove corrosion products from the reactor coolant primaryduring a of plant operation. The system is also used to let down water from the system by diverting it directly to the Main Condenser hotwell. When the R.W.C.U. system is operating, reactor water flows from the R.P.V. regenerative and non-regenerative through two sets of heat exchangers (e.g., heat exchangers) to a pressure regulating valve, where the water pressure is is reduced from over 1000 psig down to 140 psig. The pressure regulating val air operated and will fail closed if the air supply issystem lost. Inisthe event that isolated the pressure regulating valve fails open, the R.W.C.U. are located in the high automatically via two motor operated valves that These pressure piping between the R.P.V. and the first set of heat exchangers. a close signal from a high pressure interlock which is located g valves receive M5h downstream of the pressure regulating valve, at the interface between the U and low pressure piping. Because of the fact Millstone Unit 1 has only one pressure interlock, there is of the R.W.C.U. a concern that its failure could cause the low pressure side Assuming an additional failure of the system to become overpressurized. lead to downstream relief valve, system overpressurization could subsequently pipe failure, causing a LOCA outside of containment. Fe-;-:=A Project involves installation of a second, independent pressure
' - The proposed project regulating interlock to ensure sys' tem isolation in the event that the pressure valve fails wide open.
O V MILLSTONE UNIT 1 INTEGRATED SAFETY ASSESSME!C PROGR
Analy;is of Public Safety Impact
, The public safety impact of this proposed project was evaluated using Method A.
Overpressurization of the low pressure piping on the R.W.C.U. without system isolation could lead 'to a small break LOCA either inside or cutside of containment, depending on whether or not the protective relief valve lifted. Although the low pressure piping is 8" stainless steel, the equivalent break area is only 0.018 ft.2 due to pressure drops caused by: o the heat exchangers o a 3" diameter regulating valve o a 3" diameter restricting orifice all of which are located in series just upstream of the low pressure interface. In addition to the high pressure interlock, the R.W.C.U. system is presently designed to isolate on indications of: o low reactor water level o high non-regenerative heat exchanger temperature (140 F) The Millstone Unit 1 P.S.S. model was used to determine the sensitivity of the R.W.C.U. system isolation function to the addition of a second pressure interlock. Although the P.S.S. looked at all the ways in which an interfacing system LOCA could initiate, this analysis focuses only on those initiators which could be mitigated by the additional pressure interlock. For example, i the P.S.S. examined a LOCA that could occur on the outlet side of R.W.C.U. due to failure of valves on the clean-up pump bypass line. This particular break would not be mitigated by the pressure interlock since the regulating valve would still be controlling pressure on the inlet side of the system. Unless the pressure regulating valve failed coincident with the valves on the bypass line, th'e pressure interlock would not be challenged by this incident. Accordingly, failure of the pressure regulating valve as an initiating event with subsequent failure of the pressure interlock was examined. If the pressure regulating valve (CU-10 in Figure #1) fails open while the R.W.C.U. system is operating, there will be an increase of flow in the low pressure piping along with an accompanying pressure rise. At 140 psig the single existing pressure interlock should isolate the high to low pressure MILLSTONE UNIT 1 INTEGRATED SAFETY ASSESSMENT PROGRAM
interftc2 by closing th2 moter operated icoletien valvsa, i.e. oither MOV CU-2 or CU-3. In the event that this fails, a second means of isolation is e available via the high temperature interlock. The open regulating valve causes an increase in non-regenerative heat exchanger outlet temperature due to increased system flow. When the outlet temperature increases to 140 F (normally 120 F), the isolation setpoint is reached and the interlock comands both isolation valves to close. Should this fail, a relief valve which discharges to the torus would.open to protect the low pressure piping. The result of successful relief valve opening after both interlocks failed would be an isolable SB LOCA with a flow path to the torus. This particular LOCA is roughly 500 times more likely to occur than an interfacing system LOCA.where the relief failed to open and the break bypasses containment as discussed belcu. The frequency of an unisolable interfacing systems LOCA is calculated using the fault tree model shown in Figure #2 as follows: A*AA0V0 PENS
- EIOPRFAIL) * (OTEMPFAIL} +
(OMOV2FIC)
- IOMOV3FTC)3
- ORV68FTO O -where A A0V0 PENS is the frequency per year of the pressure regulating valve fails wide open.
1 Substituting values from the fault tree in Figure 2 gives: = 3.3 x 10-9/yr The frequency of an isolable SB LOCA with flow return to the torus is: l ASBLOCA
- AA0V0 PENS
- E(OPRFAIL) # IOTEMPFAIL)
- IOMOV2FTC)
- IOMOV3FTC)3
- Il - ORV68FTO)
Substituting values from the fault tree in Figure 3 gives: = 1.6 x 10-6/yr Based on the higher likelihood of the SB LOCA, a sensitivity study was performed to determine the effect of adding a second pressure interlock in the R.W.C.U. The "new" frequency is calculated by using the fault tree model in Figure 4 as follows: O MILLSTONE UNIT 1 INTEGRATED SAFETY ASSESSMENT PROGRAM l
ASBLOCA
- AA070 PENS
- PR1 FAIL) * (OPR2 FAIL)*(kEMPFAIL)+
IOMOV2FTC)
- IOMOV3FTC)3
- Il - ORV68FTO}
k Again, substituting in values from the faul't tree in Figure 4 yields:
, x yr ASBLOCA = ,
Adding the second pressure interlock results in lowering the SB LOCA frequency by 2 x 10-I/yr. Even if the reactor low water level isolation signal had been considered, the frequency would not be reduced since failure of both isolation valves begins to dominate at the point where 3 isolation interlocks are used. Given the 2 x 10"I/yr. change in SB LOCA frequency, the associated change-in core melt frequency is calculated by: A* ASBLOCA
- OAltSDC Substituting: A NCA = 2 x 10-I/yr. as calculated earlier and Qgg= .16 from the Millstone Unit 1 P.S.S. yields:
= (2 x 10-I/yr.) x (.16) !
= 3.2 x 10-8/yr.
This corresponds to a public risk of: 6 R= 3.2 x 10-8/yr. (1.5)(3. x 10 Man-Rems)(25 yr.) = 4 Man-Rem Where a multiplier of 1.5 is used since a SB LOCA with Alternate Shutdown Cooling failure is a late core melt. Results - The frequency of an R.W.C.U. interfacing system LOCA is already low (i.e. 3.3 x 10-9/yr.) and was not considered in calculating public risk since the frequency of SB LOCA for the RWCU is 500 times higher. Based on a maximum 4 Man-Rem reduction for implementing the project, a score of KO.1 out of 10 was assigned. O MILLSTONE UNIT 1 INTEGRATED SAFETY ASSESSMENT PROGRAM
O O O -
, , .,. l.g. n
[,,t.',,e-a's a g y Nost.Rf GENf pATIVE
- 1 itE 4 f ( M CH A N GE RS g,g, g m ' - -- ..... .. .
4 - CU -IO l-CU 3
&,I-CU.,
-p-T- I IIEst8stRAfivt SEAi E NCH49 IGE 99
.." '* -,WWW .####." ^#. . I "J. ^ ^ . 1:ANW M pgg g ggggg REGUEATisee
( T U O A_ _ _ =- , ,
"I l-CU-SS d >
f I Cu ta
+ X N- - c , ,/-
_,f" z ...".E., I
~
=
X 1.
==
FITTERS
- y (w at) X TO MAW l ConoEnsEn ;>4-FIGURE I INTERFACING SYSTEM LOCA INVOLVING THE 7
- :
REACTOR WATER CLEANUP SYSTEM E a-t -- X 'L'auT i 1-CU-2C" . , G9 + x p x HIGH PRESSURE /EOW PRESSURE 7 . y g
##TEnraCE vvLpEnAstE 10 2
g s ... oEMIN r OE MIN Detest 1 ' sNIERFACING SYSTEM LOCA "C" " ar* "A- d L g^ 4 k) k/ ) i I-CU se I- U- 21 1r ,r To MA n ConoENsEd ,_ co:3, TO RADWASTE M i 1
_ _ ~ FREOUENCY OF OSL , IN RWCU STSf tM , 10W PRESSURE RPGs0 OUTSuCE CONTAIMMENT
, b TT I I i wSouRE preULAtweg RWOU SYSTEM nEteEF vntvf CU-oS VALVE A0v CU-so FAILS 70 ISOLATE F AIL S TO OPEpl FA8L,8 OPEN DURING AF1ER REeULAlpee RWCU CPE RAfl0N ON DEMM l v4LVE FAILS OPEN ,
3 FFe 80* 8/yr, t 03:50-3
- AOv0 PENS RVGSF70 l l ISOL Ail 0N SO f fl ISOL Af t0N IN T ERLDCNS MOV 'S Fall TO 4 FAE CLOSE ON DEMANO
[ ) F l ) I I i I l P RES SUstE TEMP ER ATURE Mov CU-2 Nov CU-3 ! IN TE RLOCIC ' INTERLM ragLS TO CLOSE FAILS TO CLOSE FAILS TO Fall TO ISOLATE INSIDE DRYWELL OUTSIDE ORYWELL i ISOLAIE 2.78 sl0*I 2 78a10'3 8 Of al0'I E Of a103 PRFAR 1E MPFAIL Mov2FTC MOV3FTC l FIGURE' 2' ONE PRESSURE INTERLOCK
(O 3 O a . ,5 rflEOUENCY W $ 5 LOCA DN R9CU SYSTEM . ' Low PRESSL5IE PIPING WITH RETUfeN TO TORUS i . _ i
- TT i i o NESSURE fEstLAgesse RwCU SYSTEM RELIEF vnLvt CU-ee f . VALVE A0V CU so FAOLS 70 ISOLATE FA4LS OPEN (1supsee F AIL S TO OPE N AFTER RESUL Af tMS RWCU CPERATION
, ,g, l VALVg F AgLS OPEst i
3 FFv10-8 2.03sto*3 A0VOPE NS l l Rve9F f0 ISOL Af tom ' 30Til ISOL Afe0N IN TERLOCKS MOV 'fl FAel TO
~
F A ft. CLOSE ON DEMANO l f
~
1 I I l PRESSupeE TEMPE R ATURE MOV CU-2 Nov CU-3 INTERLOCK INTERLOCK
' ' F AIL S T O CLOSE FAILS TO CLOSE ISO ATE O ATE NSIDE DRYWELL OUISIDE ORVWEtt t
I - 2.TSe90-3 f.75:00 -3 5 Of a 10'3 g Os e so-3 PR TEMPFAst
- MOVIFTC MOV3F TC l .
i ! FIGURE 3' ONE PRESSURE INTERLOCK I
l F11FOUENCY OF St LOCA IN PurCU SYSTEM LOW PftESSURE PIPtNG 1 . WifM MTUstet TO TORUS TT I o i rmESSUstE fEOULAfeNo RWOU SYSTEM REteEF MELVE CU-SS VALVE AOV CU-80 FAILS TO 'tSOL ATE FAILS TO OPEN Fasts OPEN D M me AF TER RESULAf tNe ON DEMA8ep j RWCU CPERATION yatyg FAgLS OPEN i 3 F Fe 90' 4ye. 2.0 5:90- 3 AOv0 PENS RVSSFTO l l ISOLA? TON SOTH ISOL ATION
. INTERLoCets MOV'S FAIL 10 .
FAIL CLOSE ON DEMANO () () I -. l . I l PRESSURE PRESSUtt TEMPERATURE MOV CU-2 MOV CU-S INTERLOCK I INTERLDCK 2 INTERLOCK FAILS 70 Clost FAILS TO CLOSE l FAILS TO FAILS TO F AILS TO esotAir eSotATE ISOLATE INSIDE DRYWELL OUTSIDE OftyWELL l i 27SsIO-3 2.75:00 -3 2.7 5s10 - 5 g os, fo-S 608:10-3 PRtFAsl PRfFAll T EMPFAIL ' MOVEF TC MOVSFTC FIGURE 4' TWO PRESSURE INTERLOCKS l l I l
ISAP #1.05 Ventilttion System Modifications Safety Issue O Running electric motors require cooling or ventilation to prevent heat buildup in the windings which can lead to eventual motor failure. Mill' stone Unit 1 has several safety systems that depend on motor driven pumps in order to perform their intended function. When offsite power is available, area coolers and fans operate to remove the heat that is generated by these electric motors. However, following a loss of normal (LNP) power many of the cooling units are I stripped from their power sources and are not automatically restored. The Millstone Unit 1 systems that are affected by such a loss of cooling are:
- 1. The FeedwaterN .W.C.I. system which is used to provide the reactor vessel with a high pressure source of makeup water.
- 2. The service water system which supplies a cooling function for other systems such as FeedwaterN.W.C.I. and Shutdown Cooling.
1
- 3. The Emergency Service Water System which supplies cooling water to L.P.C.I. during the Alternate Shutdown Cooling mode of operation.
Only 2 of the 6 FeedwaterN.W.C.I. system area coolers are powered by the emergency gas turbine generator via MCC C-2. The remaining 4 coolers are powered by MCC's that receive power from bus 14D which is automatically load shed and locked out under LNP conditions (see Table #1). A conservative engineering evaluation of the heat rejection in the vicinity of FeedwaterN.W.C.I. components was perfonned, assuming an ambient air temperature of 95 F. The evaluation indicates that at least 5 of the 6 area coolers nust be available to maintain room temperatures below 104 F when feedwater is nonnally running during full power operation of the plant. At 104 F, motor windings on the FeedwaterN .W.C.I. pumps begin to undergo accelerated aging which can lead to premature motor failure. Following a LNP, the pianp line-up for FeedwaterE.W.C.I., consists of one condensate pump, one condensate booster pump and one feedwater pump. Since all three motor driven O MILLS 1DNE UNIT 1
' pump 2 tra required fcr system cperaticn, cny cne motor failure will cau;2 a loss of the Feedwater/F.W.C.I. system which is the preferred source of inventory makeup to the vessel.
The intake structure ventilation system does not automatically receive AC power from an emergency source following a LNP. The MCC that . feeds the two ventilation exhaust fans is normally powered by an emergency gas turbine bus but the MCC is load shed from this bus during LNP conditions. Shedding of the fans creates a concern that heat could build up in the intake structure due to operation of the service water pumps and emergency service water pumps when they are providing cooling water to certain safety systems. An engineering evaluation shows that with AC power available the startup of either exhaust fan would provide a complete air change in 4 minutes, alleviating any heatup concerns. Proposed Project The proposed project consists of two separate items, each of which addresses one of the two safety issues as described below: 'O 1. The electrical supplies for the Feedwater/F.W.C.I. area coolers will be' modified so that all 6 coolers are automatically sequenced onto a
- gas turbine powered bus, following a LNP. Currently, 2 of the 6 area coolers for the feedwater system will automatically restart.
- 2. The power supply for the intake structure exhaust fans will be changed to allow automatic sequencing of one fan onto a gas turbine bus and the other fan onto a diesel generator bus.
! Analysis of the Public Safety Impact The public safety impact of this proposed project was evaluated using Method A. The project provides benefits in two areas as described below. A. Benefits From Improving Cooling For the Feedwater/F.W.C.I. Systaa O - MILLSTONE UNIT 1
- - , - - - - - - - - . , ~ - - - - - - - - - - - - - - - -
Area cooling fer the Fcedwattr/F.W.C.I. System was cnalyzed by looking ct both the normal system cooling requirements and those requirenents under LNP conditions. When the plant is operating at full power, the Feedwater System V runs with the following configuration of pumps: 3 condensate, 3 condensate booster and 2 feedwater pumps. Area cooling for the 2 feedwater pumps is provided by 4 cooling units, while cooling for the condensate and condensate booster pumps is provided by the 2 remaining units, which cool one set of pumps each, respectively. After a loss of normal power event, the Feedwater/F.W.C.I. heat loads are substantially reduced because only 1 condensate, 1 condensate booster and 1 feedwater pump are required for vessel makeup. These 3 motor driven pumps are either manually or automatically loaded onto the appropriate 4160V AC buses folicwing successful start of the gas turbine generator. With the gas turbine running, 2 of the 4 area coolers for the Feedwater pumps will automatically restart since they are not shed during loss of normal power conditions. It was determined that these 2 cooler units would provide adequate cooling for the single running feedwater pump because 4 coolers are sufficient to cool 2 feedwater pumps during normal plant operation. However, the cooler units that p provide area cooling for the condensate and condensate booster pumps will not be available because their MCC's are load shed. The loss of cooling causes the area temperature near these two pumps to exceed the 104 F threshold at which the pump motor windings experience accelerated aging. Information on how long the windings can withstand this temperature before the motors catastrophically fail is not available. Consequently, it was conservatively assumed that failure of the condensate and condensate booster pumps occurs whenever the area i temperature exceeds 104 F. Failure of either pump causes total failure of the Feedwater/F.W.C.I. system, implying that system unavailability is 1.0 for loss i of normal power events. - i The Millstone Unit 1 P.S.S. model was requantified by assuming a Feedwater/F.W.C.I. system unavailability of 1.0 for all LNP initiating event sequences. Results of quantification shown in Table 2 indicate a 355 increase in core melt frequency (C.M.F.) with the entire contribution coming from plant ! damage states that are associated!with early and intermediate core melt times (e.g. TE1 and TI1). In fact,' late core melt (TL2) contribution is actually l i MILLSTONE UNIT 1 l - . - - - - . - - - . - - . . - - - . . - . - . . . . . .
a reduced because the low pr:ssura injection systems nust now be us;d more oftIn due to the unavailability of Feedwater/F.W.C.I. The public risk associated with the change was calculated to be 10,610 Man-Rem. It is emphasized that this calculation is artificially high due to the conservative assumption noted previously. B. Benefits from Improving Area Cooling in the Intake Structure The intake structure ventilation requirements were analyzed using the following rationale. When the plant is at full power during the hottest summer months, there are 4 running circulating water ptanps and 3 running service water pumps that contribute heat to the intake structure. Plant experience shows that the screenhouse will not heat up to 104 F for some period of time even with no forced ventilation (i.e. no exhaust fans running). Following a LNP event, the 4 circulating water and 3 service water pumps are tripped but then 2 service water pumps are imediately restarted after successful start of both the gas i turbine and diesel generator (1 service water pump is loaded onto each emergency power source). With just the 2 service water pumps running, the heat rejection to the intake structure is less than 1/3 of what it was prior to the loss of normal power. The intake structure (including walls, floors, and v' gratings) will now begin to heat up very slowly over a long period of time with no exhaust fans running. Although the MCC that feeds the 2 fans is load shed on LNP, it receives its power from an emergency bus which can be manually re-energized from the control room. Millstone operations personnel have indicated that, even with this option available, they would not have to start the fans for temperature concerns. In order to calculate a worst case for intake structure heat buildup, a computer code was used to model the temperature response for 2 service water pumps running at least 24 hours without forced ventilation. Assuming an outside average air temperature of 88 F over 24 hours, the code predicts that temperatures inside the intake structure will not exceed 119 F. An engineering evaluation of the service water pump motors shows that they will not fail even if the temperature went to 119 F imediately and remained there for the entire 24 hour period. The emergency service water pumps do not automatically start under any l conditions. Following a loss of normal power, these pumps would not be O MILLSTONE UNIT 1 l
required unicas ft.edwatt.r wero unavciltblo tnd operatora had to d;pr:ssurize the vessel in order to use the low pressure core cooling systems. Under such conditions, emergency service water would not be required until at least several hours later and operators would re-power the ventilation fans prior to manually starting the pumps. Consequently, the LNP load shed of the intake structure exhaust fans will not affect operation of emergency service water should it be required. . Results Based on a conservative 10,610 Person-Rem exposure reduction for the first part of the project, the Feedwater/F.W.C.I. air cooler electrical modifications are given a score of 10 out of 10. It should be noted that the core melt frequency was computed by assuming that Feedwater/F.W.C.I. fails with a probability of 1.0 if the 2 air cooler units near the condensate and condensate booster pumps are not restarted following loss of nortnal power. This assumption was made because information on time to motor failure vs. temperature is not currently available. Using the 104 F value for the onset of accelerated aging in the motor windings, it was conservatively assumed that the condensate and l condensate booster pump would fail at temperatures above this value. Analyses O to define actual heatup rates and time to failure could substantially change the risk significance of this proposed project. The second part of the project is given a score of 0 out of 10 because the exhaust fan electrical modifications will not have any effect on core melt i frequency. l l O MILLSTONE UNIT 1
Table 1 O A. Feedwater/FWCI System Area Coolers Feedwater Pump Coolers HVW3 is powered by 480V MCC C-2 HVW3A is powered by 480V MCC D-1" HVW4 is powered by 480V MCC C-2 HVN4A is pcwered by 460V MCC D-1" Condensate Booster Pump Cooler HVS5 is powered by 480V MCC D-2" Condensate Pump Cooler HVW25 is powered by 480V HCC D-2" B. Intake Structure Exhaust Fans
- HV h8 is powered by 480V MCC CD-5' (load shed on LNP)
HVb 9 is powered by 480V MCC CD-5' (load shed on LNP) These MCC's are fed by 480V bus 12C which receives power irom emergency gas turbine bus 14C ee These MCC's are fed by 480V bus 12D which receives power from non-emergency bus 14D. O MILLSTONE UNIT 1
I / k 4 Table 2 Potential Impact of Feedwater System Ventilation Issue at Millstone Unit 1 5 Base Case - Asstaning Ventilation ., (As-Is) Failure Results in , 4 Feedwater Failure F.W.C.I. Unavailability Given LNP l 0 1.625 x 10-1 1.0 x 10 Plant Damage State Frequencies (yr-l) TE1 2.57 x 10-4 3.30 x 10-4 TE2 1.41 x 10-5 1.41 x 10-5 TI1 2.26 x 10-4 4.46 x 104 T12 8.25 x 10-0 7 78 x 10-5 SE1 1.54 x 10-5 1.54 x 10-5 , SE2 2.54 x 10-I 2.54 x 10-7 ; 4 SI1 1.85 x 10-" 1.85 x 10 i S12 8.59 x 10-6 8.59 x.10-6 , s, : AE1 1.37 x 10-6 1.37 x 10-6 ,.
~
AE2 2.30 x 10-9 2.30 x 10-9 , AI1 1.60 x 10-5 1.60 x 10-5
<r -
O-Mill. STONE UNIT 1
. .. , l ISAP #1.05 Seismic Qualification of Safety R21sted Piping Sefety Issue Q. '
In a severe seismic event, it is likely that a reactor trip will occur due to loss of normal power. This disrupts norr.a1 operation and places reliance on - ' decay heat removal systems for plant cooldown and long term decay heat removal.
'An earthquake of sufficient magnitude could fail the decay heat removal systems ,
as well. Failure of all decay heat removal systems will lead to a core melt
'^
accident. All part Seismic PRA analyses have shown that the following components and i structures are the most vulnerable to seismic induced failures: o Large Water Tanks o Structures such as Block Walls and Roof Slabs o Anchorage devices for mechanical components such as heat exchangers and ptanps o Anchorage devices for Instrument Racks and Control Panels o, Buried piping near buildings o Misoperation of Electrical Relays Although utr.erous modifications and upgrades have been implemented at Millstone 6 Unit 1 to improve the seismic capacity of the above components, it is expected that the!most likely cause of decay. heat removal system failure will be similar components and structures. Although unlikely, it is possible that the above
. ground piping could fail at low ground accelerations when other critical components iand structures survive, thus disabling the decay heat removal systems. Further analysis has been suggested to address the risk associated I
with such an unlikely scenario. t' I&E Bulletin 79-14 required field verification of As-Built safety related
, piping to compare the pipe configuration and support with the design assumed in the analysis performed to show seismic qualification of the plant. The Bulletin also requested any discrepencies found between As-Built and the analysis be reconciled either by reanalysis or by design modifications. The Bulletin applies to all above ground piping with 2-1/2" or larger diameter and O
MILLSTONE UNIT 1 INTEGRATED SAFETY ASSESSMINT PROGRAM
c11 smallcr lines which wera cnalyzed for d: sign of supports ctc. For the remaining smaller pipes, only the analysis method used needed to be reviewed to ensure that the method was conservative. I&E Bulletin 79-02 had previously required that the base plates and anchors for pipe supports for the piping which were subsequently covered by I&E Bulletin 79-14 be similarly field verified and analysis methods be reviewed to assure conservatism. For Millstone Unit 1, all pipes covered by I&E Bulletin 79-14 have been field verified. The differences found between As-Built and the design assumed in the analysis were analyzed with the static method utilizing standard FSAR criteria of acceptable stress level. Because of low acceptable stress level, the FSAR method provided conservative results and showed that several of the piping supports needed modifications. These modifications were grouped in two categories, as discussed below: O Priority Hodifications These modifications which were needed to qualify the piping for the Operating Basis Earthquake or 0.B.E. (ground acceleration 1 0.07g) were classified as priority modifications. All these modifications have been completed. O Upgrading Modifications Those modifications which are needed to qualify the piping for the Safe Shutdown Earthquake or S.S.E. (ground acceleration 1 0.17g) were classified as the upgrading modification. Many of these modifications have been completed. The analysis presented here estimates a reduction in public risk if the remaining modifications are implemented. P mpa M Project As discussed above, an appreciable number of pipe supports have already been modified to qualify the piping for an S.S.E. The proposed project is to modify supports for the remaining safety related piping to qualify them for the S.S.E. O MILLSTONE UNIT 1 INTEGRATED SAFETY ASSESSMENT PROGRAM
i Analyzia cf Publi2 Safety Impact n The public safety impact of this proposed project was evaluated using Method B. U The piping supports are identified for modifications as a result of the piping analysis which may'show that piping stresses exceeded the acceptable values of the FSAR. However, exceeding this conservative value of stress level does not necessarily imply that the pressure boundary will be breached or that the I piping will lose its operability following the earthquake. Although not I demenstrated by a Millstone Unit 1 plant specific analysis, the piping identified for support modification is expected to serve its function following a safe shutdown level earthquake. Seismic experience data collected by the Seismic Qualification Utility Group (S.Q.U.G.) and others, and high level seismic tests on piping conducted in foreign countries and in the United States show that piping is not susceptible to failure due to seismic inertia loads (See Enclosure 1 of Reference 1). The data was collected as a part of the analysis performed for USI A-46, " Seismic Qualification of Equipment in Operating Plants." Recent Seismic PRA Analysis of Millstone Unit 1 vintage and newer plants have also consistently shown that above ground piping is generally not the dominant contributor to the seismic risk (Reference 2). All past analyses have shown that usually the failures of large tanks, structures, mechanical and electrical equipment, and buried piping contribute most to the seismic risks. Therefore, an improvement in the seismic capacity of the remaining above ground piping is not expected to increase the overall seismic capacity of Millstone Unit 1. Based on data collected by S.Q.U.G. and reviewed by the Senior Seismic Review Advisory Panel (SSRAP), the N.R.C. in Reference 1 has also concluded that mechanical and el ctrical equipment of types conmonly used in nuclear power plants are unlikely to fail at earthquake levels typical of the S.S.E. for U.S. nuclear power plants on the East Coast. Reference 1 also states that there is strong evidence that accident mitigating systems would function as designed in the unlikely event they are required following an S.S.E. The analyses performed by the N.R.C. for Millstone Unit 1 under S.E.P. Topics # III-6 and III-11 came to similar conclusions (Reference 3). Considering the fact that the past PRAs O , HILLSTONE UNIT 1 7NTEGRATED SAFETY ASSESSMENT PROGRAM
hava shown piping to' typicelly h;va high:r frcgilities than the rtst of tha systems, no significant improvement in public risk (incremental improvement) is expected if the piping supports are modified. Based on engineering judgerent the project was thus assigned a score of 0.1 out of 10. References , 4
- 1. latter from Harold Denton (N.R.C.) to Victor Stello,Jr. (N.R.C./C.R.G.R.),
" Proposed Requirements Resulting From Resolution of USI A-46, Seismic Qualification of Equipment in Operating Plants," June 7,1985.
- 2. " Seismic Risk: Sensitivities and Contributors", by M. K. Ravindra, R. P.
Kennedy and D. H. Worledge. Presented at the 8th International Conference of Structural Mechanics in Reactor Technology, Brussels, Belgium, August, , 19-23, 1985.
/
- 3. Letter from Dennis M. Crutchfield (N.R.C.) to W. G. Counsil (N.U.), "S.E.P.
Safety Topics III-6, Seismic Design Considerations and III-11, Component Integrity - Millstone Nuclear Power Station Unit 1", July 6,1982. O i l 0 e O MILLSTONE UNIT 1 INTEGRATED SAFETY ASSESSMENT PROGRAM
I
.. l ISAP #1.trf Control Room Design Review Safety Issue The safety issue which led to the desire to perform systematic control room design reviews was the recognition that the control rooms in many nuclear power plants contain significant human engineering deficiencies. Such human engineering deficiencies have been identified as the root cause behind:
o unintentional plant shutdowns and transients caused by operation of the w ong device by a control room operator o unintentional disabling of decay heat removal and engineered safeguards systems due to operator errors while manipulating controls o premature termination of engineered safeguards systems due to cognitive errors arising from incorrect interpretation of control board instruments. Each of these types of problems is discussed below. Inadvertant transients and plant shutdowns have occurred in some plants where control switches which nost be periodically manipulated are located adjacent to switches (or similar size, shape, or color) whose change of state will result in a plant transient necessitating reactor trip. Identifying such switches and making improvements will eliminate both a safety and a plant reliability problem. By eliminating a potential source of a future transient, a potential initiating event which could possibly be the first system failure of a core melt accident sequence is eliminated, and public risk is reduced. Human engineering deficiencies in some nuclear power plants have led to the unintentional disabling of decay heat removal and engineered safeguards systems during transient events. In many cases problems related to control board layout resulted in operators s' electing and manipulating the wrong switches. This problem is exacerbated during periods of increased stress (during response to a transient), when multiple manual actions are required in a relatively short period of time, or when the operating crew is relatively inexperienced. Another type of htrnan engineering deficiency is the violation of a populational stereotype in rotary switches or thumbwheel controllers. MIILSTONE UNIT 1 INTEGRATED SAFETY ASSESSMENT PROGRAM
~
The final category of control board haan engineering deficiencies are those design features (indicating devices in particular) which could result in the O siisdiagnosis of plant status by an operator. A gc,od example is a valve position indicator light which is based on actuator status and not actual valve position.
- To identify such potential human engineerite deficiencies a study of the Millstone Unit 1 control room design including review of the panel layouts has been proposed. The study will be performed in accordance with the recomendations of NUREG-0578 and NUREG-0737, Supl. 1. The outcome of the study will be the identification of any human engineering deficiencies and potential modifications of control room configuration that would help the operator in preventing accidents or in coping with accidents if they occur.
Pr W Project The proposed project involves a systematic review of control room design. The outcome of the review will be the identification ,of recommendations for possible control room design changes. The scope of the project evaluated does not include implementation of these recomendations. The review will include the following items: Identification of control room operator tasks, and information and control requirements during emersency operations. This will be achieved by walking through the emergency and off-normal operating procedures. A comparison of the display and control requirements with a control room inventory to identify missing displays and controls. A control room survey to identify deviations from accepted human factors principles. O MILLSTONE UNIT 1 INTEGRATED SAFETY ASSESSMENT PROGRAM
Analysis of Publin Safety Impact p The public safety impact of this project was evaluated using engineering
- k. Judgement (Method B) based on the engineering insights obtained from the Millstone Unit 1 Probabilistic Safety Study. Three potentia'l sources of benefits were each considered, and these are:
o Benefits from avoiding human error caused transients o Benefits from avoiding human error caused system unavailability o Benefits from avoiding cognitive errors due to instrument deficiencies. A. Benefits From Avoiding Transients Caused By HL: nan Error Millstone Unit 1 has operated since October 1970 and the experience data base from all operating events was systematically considered when the Millstone Unit 1 P.S.S. was performed. A review of this operating experience indicated that in most cases where transients were caused by human error (attributable to a human engineering deficiency) the errors occurred outside of the control room. A good example are plant trips initiated during instrument surveillance testing. Such trips have resulted in revisions to procedures, improvements in operator and I&C personnel training, and in some cases modifications to the control board mimic's, displays, color coding, and control switches. Throughout the process, operations and I&C personnel have provided inputs and suggestions. These types of improvements were driven by the need to assure high plant reliability. While not a part of a full scope control room design review effort, they have already accomplished the equivalent desired result by concentrating on areas where actual experience (from Millstone Unit 1) indicated deficiencies existed. As a measure of the effectiveness of this long term approach it should be noted that the frequency of plant trips caused by human error has dropped substantially over the past fifteen years of operation along with all other sources of reactor trips. In terms of public risk perspective, the Hillstone Unit 1 P.S.S. assumed an ! average of ~5.5 plant transients per year due to all causes. This value is dominated by the statistics from the earlier years of plant operation. The likelihood that a full scale control room design review could identify an MILLSTONE UNIT 1 INTEGRATED SAFETY ASSESSMENT PROGRAM
l improvement that could rc~ ult in o sub:;tantial reduction in tha frequency cf transient initiators is judged to be highly unlikely. Hence there is an p insignificant benefit in risk reduction due to avoiding human caused plant V trips and transients. B. Benefits From Avoiding Ibaan Error Caused System Unavailability The second area considered for possible benefits was in avoiding human errors which could result in the unavailability of systems needed to remove decay heat following any plant trip or mitigate an accident. As a part of the hinan reliability analysis documented in Section 4.0 of the Millstone Unit 1 P.S.S., ) the control board panel layouts, instrumentation, and annunciators available to the operator were systematically reviewed. A screening criterion was established to identify potential risk sensitive areas which should be examined for potential human engineering deficiencies. This criterion involves the identification of those potential accident sequences in which multiple operator actions must be taken in less than ten minutes in order to prevent the onset of severe core damage. Having identified those sequences and quantified their likelihood, the potential benefits of the control room design review could then be assessed. The following accident sequences were considered: o Reactor Trip / Failure to Fast Transfer 4160V Buses to the R.S.S.T. The 'perator o actions necessary to recover A.C. power would require multiple manipulations of breaker switches on the control board' The layout of such breaker switches is mimicked und color coded, however, the breakers are located in close proximity to each other and this could possibly result in an operator error. The onset of severe core damage would take longer than ten minutes and would additionally require the failure of the Isolation Condenser (both automatically and due to local initiation). The likelihood of such a scenario would be exceedingly small due to the unlikelihood of being in Support State 7 (Station AC Blackout) following a non-LNP event. Because of this there is only minimal benefit to be obtained from additional improvements. o Loss of Feedwater/ Failure of Isolation Condenser or S/R Valve Open. The operator actions necessary for recovery from this event MILLSTONE UNIT 1 INTEGRATED SAFETY ASSESSMENT PROGRAM
inv 1v;s starting cny two low pr:ssura pumps tnd initiating Emergency Vessel Depressurization (EOP 577). The frequency of a similar sequence was quantified (See Table 5.3-5, Millstone Unit 1 P.S.S.) and found to be important. (This sequence, however, was dominated by cognitive error in failing to recognize the need to control level.) The controls necessary to perform this action were then reviewed in detail. The control board layout for the switches involved was found to involve no human engineering deficiencies which could be improved. o Small LOCA/ Failure of Automatic E.C.C.S. Actuation The operator action necessary for recovery from this event involves maintaining water level using any available ptznp. Failure to take action within ten minutes will result in the onset of severe fuel damage. The likelihood of this sequence is exceedingly small; hence there is minimal benefit to be obtained from improvements to the control boards as a result of a control room design review. o Transient with Main Condenser Unavailable / Failure to Scram l The operator actions necessary to mitigate such a scenario involve the manipulation of the feedwater control system in order to reduce RPV water level. The key control board area involved in this action is the feedwater regulating GEMAC controllers. This was reviewed for possible human error deficiencies and it was concluded that no significant problems exist which could be corrected as a result of a control room design review. In general' the issues which dominate public risk at Millstone Unit 1 are related to equipment capacity (long tenn cooling), specific hardware design configurations and single failures (Shutdown Cooling, Isolation Condenser, and Alternate Shutdown Cooling), and cognitive errors in recognizing the need to take manual control of water level. These types of issues are r.ot resolvable by improvements to the control board layout. C. Benefits From Avoiding Cognitive Errors Due to Instrument Deficiencies ) The final area considered in which a comprehensive control room design review lO MILLSTONE UNIT 1 INTEGRATED SAFETY ASSESSMENT PROGRAM
~
cight provide benefits was: the cristence of instrument deficiencies which could result in cognitive errors. The new sympton-based emergency operating procedures (EDPs) were thoroughly walked through prior to their implementation in June 1983. The instraents available in the control room are sufficient to carry out all actions listed in the EDPs. A review of the Millstone Unit 1 P.S.S. indicates that the most dominant cognitive errors are: o Failure to ignore indicated water level and flood the RPV when containment temperatures are likely to cause reference leg flashing. t o Failure to recognize the need to manually control water level. The first issue is related to the location of the reference leg in the drywell and can not be improved upon by anything done in the control board layout. The i second issue is a pure cognitive error which occurs despite the availability of eight different water level indicators. Again for this error there is no remedy which can be provided for by control board layouts.
- Redu Over the last 15 years of plant operation, a number of control room layouts
- have been improved. The current design (re-layout) provides clear and unambigious infonnation to the operator. Any further improvements to control room layout is not expected to provide any significant improvement in haan reliability of the operator during an emergency. Based on engineering judgment a score of 0.1 out of 10 is assigned to this project.
i lO MILLSTONE UNIT 1 I!EEGRATED SAFETY ASSESSMEfC PROGRAM
I ISAP Topic No.1.08 Safety Parameter Display System Scope of Project . This project involves the design and installation of a Safety Parameter Display System (SPDS). The SPDS is intended to provide the control room operator with essential plant status information in a concise and timely manner. Although the design is not yet finalized, the plant parameters required for the emergency operating procedures are expected to be included in the SPDS. Safety Issue During an abnormal or transient condition, the control room operators are required to take meny mitigating actions in a short time as well as keep track of . , several plant parameters to ensure all the safety functions are being satisfied. The operator actions are based on the plant status which is deduced from the information obtained from various indicators. These indicators in many nuclear
; power plants are scattered over the control boards. Lack of concise and central
- location of the plant status information may have the following effects on the j operator actions
4 I o The operator incorrectly diagnosing the status of the plant and taking
; inappropriate mitigating actions.
1 l o The operator not being able to make decisions about the status of the l plant in a timely manner. o The operator may overlook a safety function or a plant parameter. j PRA Assessment S
- The public safety impact of the proposed project was assessed using method B.
l The benefits of the SPDS to the operator in mitigating the transient depends i upon the severity of the event. For this analysis, the transients are classified in two categories: 1 Most Transients !c l 4 All transients expect ATWS and large break LOCA are included in this category. The basic characteristics of the transients in this group is that
- the plant parameters change slowly. In these transients, the most
, important immediate operator action is to recover and maintain the RPV
! water level. The existing instrumentation provides a clear indication of i level. Therefore, addition of the SPDS for this parameter will provide no
- benefit. All other parameters (e.g., RPV pressure, torus water
! temperature, drywell pressure) which need to be monitored change slowly i ' '
and the operator has a long time (greater than I hour) to bring them under control. Because of long time available for the operator to take corrective actions for these remaining parameters, addition of the SPDS will not ,
, appreciably improve the operator's action. ! i i
1L l l l 1
1 l ATWS and Large Break LOCA For these rare and hypothetical events, the plant conditions change rapidly. To mitigate such an event, the operator needs to monitor many parameters at the same time (e.g., RPV water level, torus water temperature, etc.). In ' these instances, the SPDS could provide a useful function by monitoring containment limits etc., and reminding the operators of various cautions in the emergency operating procedures. l l Results l 1 The SPDS does not provide any new information to the operator. It is only a repackaging of the control board information. If the control board information is not available due to say failure of the supporting system (e.g., vital AC power), the same information will also be unavailable on the SPDS. Also, all operator actions which are taken when a parameter reaches a specific value, will still be based on control board instrumentation which are the Class IE equipment. The benefits of the SPDS are only marginal for all transients except rare events like ATWS and large break LOCA. Therefore, implementation of the SPDS is assigned a score of 0.5 out of 10. Score 0.5/10 0 l lO
A ISAP Topic No.1.09 Regulatory Guide 1.97 Instrumentation i u.) Scope of Project
! The modifications proposed are as shown in Table 1. The project proposes environmentally qualified instrumentation or redundant instrumentation with separate power sources. This analysis addresses nine of the modifications, as listed in Table 1. Two additional items are still being evaluated within the scope of this ISAP topic. The only other open items in Regulatory Guide 1.97, Revision 2 relate to containment hydrogen and oxygen concentration. These items are not discussed here but are addressed under ISAP Topic No.1.11, Section 3 of this report.
Safety Issue Indications of plant variables are required by the operators during accident situations for the following purposes: o To provide information required to allow the operator to take mitigating actions, o To verify that automatic and manual mitigating systems are 1 functioning properly, and o To assess the plant status and to anticipate the breach of the barriers O of radioactively release. There are two main safety concerns regarding the instruments which provide vital plant status information to the operator. These are: (a) The design of instruments measuring a given parameter may not be redundant. All indications regarding the parameter under question may be lost due to a single failure. (b) Environmental qualification nf electrical instruments gives reasonable assurance that these instruments will function in the harsh ! environment caused by the accidents. An unquallfled instrument may fall due to harsh environment providing incorrect information or no information at all to the opera tor. The lack of information regarding plant status would make the accident mitigation efforts by the operator difficult which would increase chances of an operator error and thus could increase probability of severe core damage. I The instrumentation which monitors the variables listed in Table 1 are either not qualified for harsh environment or lack redundancy in design. The analysis presented here provided an estimate of the public risk reduction which might be obtained if design of the instruments for the variables listed in Table 1 is l modified to ensure both environmental qualification and redundancy. - I PRA Assessment The public safety impact of this project was assessed using Method B. Each of the proposed modifications is separately evaluated.
,.-,--v, . - , - , , - - - - - = - - . . - - -
.,,r-n,+-,- -.wme,a_,-w- - - ~ - - - - - - - - - - - , - ,
A. RPV Pressure '
- The project proposes redundant instrumentation for the pressure range of i 0-2500 psig. In the correct design, there are redundant instruments (with separate power sources) for the range of 0 to 1200 psig. There are two wide range (0-2500 psig) pressure instruments available. However, both instruments are powered by instrument AC (IAC). There is a concern that with loss of instrument AC, all indications of pressure above 1200 psig will be lost.
in all transients, except ATWS with MSIV closure, the RPV pressure remains below 1200 psig. This is because the turbine bypass valves and l safety relief (S/R) valves control pressure well below 1200 psig. For l- example, all S/R valves open at pressures less than 1125 psig. Therefore the reactor tripped, the RPV pressure cannot be above 1125 psig unless all S/R valves failed to open, which is an extremely unlike event (probability less than 10-10), In an ATWS with MSIV closure event, the RPV pressure momentarily increases above 1200 psig within 30 seconds. While the pressure is above i 1200 psig, possible loss of indication (due to a failure) does not inhibit any ; transient mitigation efforts. None of the operator decisions require pressure reading above 1200 psig. Similarly, none of the mitigating
- systems are automatically initiated at pressures near or above 1200 psig.
l Therefore, providing redundant power sources for the wide range pressure instrumentation (0-2500 psig) will result in no reduction in core melt l frequency or public risk. l 1 B. RPV Water Level ! The project proposes redundant instruments to measure RPV water levelin the range of +60" to centerline of steam line (at +122"). In the current , design, there are redundant instruments (with separate power sources) available for water level between +60" and the bottom of core support plate. There is a concern that due to a single failure all indications of water level above 60" could be lost. It should be noted that normal water i level (while at power) is +30". Therefore, loss of indications will affect
. only those scenario where the water level is considerably above the normal j value.
4 Following a transient, the emergency operating procedures (EOP) direct the operator to recover and maintain water level to the normal value (see
- Appendix 2B of Millstone Unit No.1 Probabilistic Safety Study (PSS)).
Also, automatic initiation of all mitigating system occurs when the water level is below 60". Redundant instruments which are available to measure ! level below 60" provide safeguards against a single failure causing loss of level indication for operator action or for automatic initiation of mitigating systems. i Only in alternate SDC mode of long-term heat removal operation, the O operator will increase the water level above +30" to establish a flow path through the open S/R valve back to the torus (see EOP 579, Appendix 2B of Millstone Unit No.1 PSS). However, in the Alternate SDC procedure, the j
+ i 3 operator does not need to know water level. Success of alternate SDC is Os inferred from the cool-down rate, number of 5/R valves open, and RPV pressure. Therefore, providing redundant level instrumentation for water level above { +60" provide no benefit, i.e., no reductier: In core melt frequency or public )
)
risk. t C. Neutron Flux 1 ! The project proposes environmentally qualified and redundant channels l l with separate power sources for neutron flux measurement. In the current ' i design, the instruments to measure neutron flux are not environmentally quallfled. Also, the APRM gets power source from RPS MG set and the IRM an SRM from a DC battery. There is a concern that the operator may lose ability to determine core power following a transient. This could 1 happen due to the harsh environment caused by a LOCA in the drywell or ' reactor building or due to a loss of power for the instrumentation. j in the Millstone Unit No. I design, each of the control rods has position , Indications and full-in and full-out lights. Following a reactor trip, the operator can infer subcriticality of the reactor by reviewing the rod position. If all control rods are inserted, subcriticality is ensured and none of the subsequent operator actions require knowledge of core power level (see EOPs in Appendix 2B of Millstone Unit No.1 PSS). , if some of the control rods (at least two adjacent rods) stick out, reading from LPRM or IRM is needed to ensure core subcriticality. With failure of neutron flux measurement, the operator will not be able to determine the core power and therefore will classify the event as an ATWS. , None of the subsequent operator actions described in ATWS mitigating procedures (EOPs 572 and 575) require knowledge of core power level. For this low probability scenario, loss of neutron flux monitoring will only be an inconvenience. The loss will not prevent the operator for bringing the
, plant down to cold shutdown. Therefore, qualifying APRM, IRM and SRM i
for harsh environment and providing redundant power will provide an insignificant reduction in core melt frequency or public risk. The proposed l modification is assigned a score of 0.01 out of 10. ! D. Drywell Temperature 1 The project proposes environmentally quallfled drywell temperature Indicators. In the current design, these temperature Indicators may not be quallfled for harsh environment. There is a concern that following a LOCA or steam line break in the drywell which creates a harsh environment, the ,
; drywell temperature indication may f all.
The EOP 580 (see Appendix B of Millstone Unit No.1 PSS) cautions the operator that RPV water level Indications may fall when the drywell temperature reaches the RPV saturation temperature. This failure of level j indication is due to the reference leg flashing. The failure mode is such l that the operator will see an increase in RPY water level, even if the
; actual level is not varying. With potential failure of the drywell l l - - ~ , - . - _ _ _ _ , _ . _ _ _ _ - _ _.- - - - -
4 temperature indicators due to harsh environment, the operator will not v know when the level indications have failed. If the operator contro's the RPV water level based on the erroneous indicated level, the core may uncover leading to fuel damage. The EOP 580 also requires the operator to depressurize the RPY is the drywell temperature exceeds 2810F. Due to failure of the drywell temperature, the operator may not carry out this action in time (i.e., before S/R valves fail due to high temperature). Thus, the capability of depressurizing the RPV using S/R valves may be lost. Such a depressurization may be needed for small breaks to allow injection with low pressure pumps. Considering the effect of loss of drywell temperature indication on RPV level instrumentation and equipment operability and therefore its importance to mitigate a LOCA, this project is assigned a score of I out of 10. E. Drywell Spray Flow The project proposes providing redundant and environmentally qualified instruments to measure drywell spray flow rate. In the current Millstone Unit No. I design, drywell spray flow rate cannot be measured. In accordance with the existing EOPs, very restrictive conditions exist for which the drywell sprays can be utilized post-accident. In addition, no current design basis analysis credits the use of drywell sprays. As such, I, providing redundant and environmentally quallfled instruments will result in no reduction in core melt frequency or public risk. Addition of drywell spray flow measuring instruments could ease the restrictive conditions to initiate the spray flow, provided adequate capacity to control drywell spray flow existed. Benefit of adding drywell spray flow measuring instruments is calculated assuming that flow measurement will allow the operator to initiate drywell spray when needed (i.e., adequate capability to control spray flow did exist and EOP restrictions would not prohibit use of spray). In the current design (without flow measurement), it is assumed that the operator will not be able to initiate spray flow for all scenarios. Following a LOCA, if steam condenses in the torus, spray is not required to lower drywell pressure. This is because, without the spray, the maximum , pressure is maintained below 43 psig which is well below the ultimate i containment pressure limit estimated to be 138 psig (median value). The drywell spray may be able to maintain the containment pressure below the ultimate value if the steam from a small break LOCA falls to condense into the torus. One such scenario to bypass condensation into the torus could be that at the time of LOCA,if one of the vacuum breakers between the torus and drywellis open. This will pressurize torus air space to almost the same pressure as the drywell, thus preventing blowdown to the torus. n initiation of drywell spray by the operator may condense steam coming out l through the break to maintain drywell pressure below its ultimate limit and [] thus may prevent a containment failure and subsequent core melt. However, this is a low frequency scenario and is beyond the design basis of l the plant as calculated below. _ , - - - - - - <-.-,____.,_.,,,._.r--- .r. _.,---_.___.____..--_.,__,~r-
,,,_,_,r _ ,- - , _ _ _ , _ _ _ _ . . . , _ . . _ _ _ - - _ . - . _.
i
; p A cm = hSB
- Qvs V
ASB = 11 x 10-2 Frequency of Small or Small Break LOCA (< 0.2 ft2) 1 . (
References:
Section 1.2.3 of Millstone Unit No.1 PSS). Qvs = 2.3 x 10-5, Probability of Bypassing Steam Condensation in Torus (Reference 3.2.10 of Millstone Unit No.1 PSS) A cm = 2.5 x 10-7/ year It should be noted that in case of a large break LOCA, due to rapid 4 increase in pressure, initiation of drywell spray may not be able to maintain the drywell pressure below its ultimate limit. Addition of drywell spray measuring instruments will decrease the core melt frequency by 2.5 x 10-7/ year, which results in a decrease in public
- risk of about 20 person-rem. This project is assigned a score of 0.05 out of 10.
i F. Isolation Condenser Shell Side Water Level I The project proposed replacing installed IC shell side water level '
- Instrument, which is not proven to be quallfled for harsh environment with a qualified instrument. The water level instrumentation provides level j indication to the operator. Also, make-up to the shell side is automatically initiated on low-level based on this instrumentation. There is a concern
, that with failure of level Instrumentation, make-up to the IC shell side may not automatically start and also indication to the operator may be Incorrect. An incorrect level Indication may mislead the operator about the need of manually initiating the make-up flow. In the worst case scenario, the IC could lose its function due to loss of shell side inventory. l The following evaluation is performed for the worst case scenario. 4
- The water level Instrumentation for IC shell side is located in reactor building. A break in the reactor building which can create a harsh j environment and thus potential of instrumentation failure is a low
- frequency event (less than ! x 10-5/ year). The IC can mitigate the event if j the break can be isolated. For an unisolable break in the reactor building, i the IC does not provide any benefit. This is because ultimately all
{ inventory will eventually be lost through the break, resulting in severe core i damage. An isolable break in the reactor building can be mitigated by i many other systems. For example, the RPY water level can be recovered by FW/FWCI, LPCI or CS systems and long-term decay heat can be provided by main condenser, SDC and alternate SDC. i ! Benefit, as shown below, of qualifying IC shell side water level instrumentation can easily be estimated by assuring that without such modification, the IC cannot be used to mitigate a break in the reactor
- building.
! Acm = h LOCA-RB+ Qpy
- QCS
- QLPCI + QMC
- QSDC
- QALT, SDC i
where
l 1 1 l A l LOCA-RB = 1 x 10-5, Frequency of Isolable Breaks in Reactor Building QFw = 6.65 E-2, Unavailabl!!ty of FW QLS = 6.09 E-4, Unavailability of Core Spray
= 9.19 E-4, Unavailability of Core Spray
'QLPCI
- QMC = 3.96 E-2, Unavailability of Main Condenser QSDC = 1.61 E-1, Unavailability of Alternate SDC QIC = 3.34 E-2, Unavailability of IC and IC Make-Up (Assuming level instrumentation is qualified, otherwise unavailability
{ of IC is assumed 1.0.) I A cm
= 8.E.9/ year 1
Clearly, providing a quallfled IC shell side water level instrumentation results in an insignificant improvement in core melt frequency (8.E-9/ year) , and a negligible reduction in pub!!c risk (0.6 person-rem). This project is assigned a score of zero. G. Primary Containment Isolation Valve Position Indications ! This section addresses both the IC system (Item #7 in Table 1) and other i containment isolation valve position (Item #9) indications. In the current i design, the containment isolation valve position indications are either not
- environmentally quallfled or do not have redundant power sources. The project proposes to correct these perceived deficiencies. As discussed
- below, loss of containment isolation valves indications is not critical in i
- limiting off-site dose.
- o Closing of the valves is important to reduce releases only in the
, sequences leading to significant fuel damage. Frequency of such sequences is low (less than 10-3/ year). j o The stack monitoring and alarm system provides indication of any [ l appreciable release in the reactor building and turbine building. Loss
- of valve position indication does not imply that the valve will not ;
- function (i.e, close automatically or manually). If the stack !
monitoring Indicates that a release is occurring and the operator is . 1 ' not certain that all containment isolation valves are closed (due to loss of position Indication), the operator will assume that the valves , are open and will close them from the control room. Therefore, loss , 1 of indication does not inhibit the operator from minimizing the off- !
- site dose.
The proposed modification is assigned a score of 0.01 out of 10. i H. Ventilation Damper Position Benefit of providing environmentally qualified redundant position i indications is included in the evaluation of ISAP Topic No.1.12 - Control j Room Habitability. f _ -__ _ . _ _ - _ _ _ _ _ . _ __ __~ _ _ , _ . , - __
I Results Table 2 summarizes the benefit of proposed modification to various , instruments. The analysis suggests that the proposed modification to the drywell temperature indication will provide significant benefit for LOCA sequences. Therefore, this modification is assigned a score of 1.0. The i modification proposed to all other instruments provides no or insignificant benefit (i.e., decrease in public risk). The overall project is assigned a
, score of 1.0 out of 10.
4 4 O f a l l 1 1
i O Table i V List of Variables for Proposed Instrument Modifications Variable Proposed Instrument Modifications
- 1. RPV Pressure Provide redundant instrumentation *
- for the pressure range 0-2500 psig.
- 2. RPV Water Level Provide redundant instrumentation *
- for the level range - 340" to 316".
- 3. Neutron Flux Provide environmentally qualified instruments with redundant power sources.
- 4. Drywell Temperature Provide environmentally quallfled instruments.
- 5. Drywell Spray Flow Provide drywell spray flow measuring instruments which are environmentally quallfled and redundant.
- 6. IC Shell Side Water Level Provide environmentally quallfled
, instr uments.
- 7. IC System Valve Position Provide environmentally quallfled position indication.*
- 8. Ventilation Damper Position Provide environmentally quallfled and redundant position indication.
- 9. Primary Containment isolation Provide redundant power source for
, Yalve Position valve position indication. l l Note: Two additional variables remain to be evaluated. These are:
- 1. Main Feedwater Flow
- 2. Cooling Water Flow to ESF System Components 2
d
- Redundant power source issue is addressed in item #9.
** With separate power sources.
) Table 2 Summary of Results ! Decrease in Core Decrease in i Variable Melt Frequency Public Risk Score RPV Pressure 0 0 person-rem 0 RPV Water Level 0 0 0 Neutron Flux - - 0.01 Drywell Temperature - - 1.0 Drywell Spray Flow 2.5 E-7/ year 20 person-rem 0.05 IC Shell Side Water 8.0 E-9/ year 1 person-rem 0 Level IC System Valve - - 0.01 I Position .i
; Ventilation Damper included in ISAP Topic No.1.12 l Position ! Primary Containment - - 0.01 Isolation Valve Position Total 1.08/10 i
1 1 l i 1 i i O , l i
, 15AP Topic No.1.10
- Emeraency Response Facilities Information t
t Scope of Project i The project is concerned with evaluating the types of plant status information ! that should be provided to emergency response facilities following an accident
- event. '
i Safety issue l l Following a major plant incident, emergency response personnel will require data ; 4 from the control room in order to analyze the incident and assess changes in the I plant situation. The safety issue is that a lack of timely data could prevent ! personnel from making the right decisions which could potentially worsen the i consequences of the original incident. PRA Assessment The project was analyzed using Method B. As can be noted from the Mllistone , l Unit 1 P55, no credit was given for the use of instrumentation outside of the i control room. This is because core uncovery would not !!kely occur prior to the j onsite arrival of call-in personnel, in the event that emergency core cooling l l systems and the control room operators both failed to properly respond to the ! ! accident. As a result, the P55 assumed that the ability to mitigate accidents ( l during the early phases was solely in the hands of those people who were present i' 2 In the control room when the event first took place. However, credit for recovery was given to call-in personnel at approximately 2 to 4 hours into the accident event but the types of recovery allowed were strictly limited to the i cross-tie of AC buses. Although not addressed in the Emergency Operating . j Procedures (EOPs), the concept of cross-tying is based on the followings t l o Operators well understand the importance of restoring AC power in
! order to recover "falled" systems.
o There are written procedures, other than the EOPs, which address ; cross connections between AC buses. When the P55 model was ' developed, one of the accepted ground rules was to l
- Ignore any recovery outside of the established written procedures. However, in '
j light of the P55 results which originally showed that approximately 64% of the j total core melt frequency is caused by failure to maintain adequate long-term
- decay heat removal, it was decided that it would be prudent to reconsider such a ,
} ground rule. - 1 l Following an accident, personnel would be called onsite to man the Technical - t Support Center lTSC). The TSC serves as an emergency operations work area j with personnel assigned to provide support to the control room by evaluating ' post-accident events as they occur. Evaluation is a real time process which I closely couples operators in the control room with those personnel called in to 1 man the T5C. During the time that emergency plans are in effect, both control { room and T5C personnel are essentially working on the same problems. If the i TSC personnel had rapid access to the same Information as their counterparts in th: c r. trol room, it !s likely that they would be able to devise the solution to a j problem which is not addressed by procedures, e.g., multiple equipment failures l
2 O V that lead to loss of the long-term cooling function. Because a serious accident event has never occurred at Millstone Unit 1, it is difficult to quantitatively assess the effects of having a rapid flow of information to TSC personnel outside of the control room. Despite the lack of quantitative information, the following points are advanced to show why such information is importants o Personnel manning the TSC need to have uncontrolled access to the same information as control room operators in order to adequately assess changing plant conditions and recommend corrective actions. o The means of obtaining information on critical plant parameters af ter an accident should be independent of second parties. Information outside the control room would eliminate the confusion caused by l extra people in the control room, who are gathered expressly for the g,urposes of gathering data and information. Such information would ' also allow personnel in the TSC to receive information on a more timely basis than is currently the case. ! o Because the TSC personnel do not have to operate the plant, they can
- verify that control room operators are taking appropriate actions and 1 they can also concentrate on nontraditional forms of recovery.
In addition to supporting the control room, the TSC personnel must currently ensure that the Control Room Data Coordinator position is staffed and data is being transmitted to the Emergency Operations Facility (EOF), which is located outside the plant protected area. Following an accident, the Millstone EOF is activated so that personnel there can direct the station emergency operations. The persons assigned to this facility are expected to be more involved with broad range concerns, such as radiation dose rate estimates and evacuation, than they would be with minute- , to-minute plant operations. In fact, the TSC is already assigned the t responsibility of analyzing the cause of the accident and recommending corrective actions. Consequently, the EOF personnel will not require Information on the same prompt scale as the TSC. As such, existing information gathering capabilities in the EOF are sufficient. Results
- It is concluded that some type of information or plant monitoring capability would be best suited for the TSC. Existing information gathering capabilities in the EOF are sufficient. Accordingly, the portion of the project that is related to evaluating information in the EOF is given a score of 0 on a scale of 10.
However, it is estimated that information in the TSC would help to mitigate events that lead to degraded long-term core cooling. Because there is a j relatively high core melt frequency associated with such events, this portion of i the project is given a score of 1.0 on a scale of 10. I Score 0/10 (EOF, EOC) 1/10 (TSC)
_~ _ _ _ _ _ - . _ _ _ _ _ _ _ _ _ _ -__ ._ _ _ _ _ .- n i
- 15AP Topic No.1.11 j s Post-Accident Hydromen Monitor Scope of Project -
The proposed project is to install a redundant containment hydrogen monitoring system. i Safety issue A single channel containment hydrogen / oxygen monitoring system is currently employed to provide continuous monitoring of hydrogen concentr: tion during ! normal and post-accident operation. In addition, should the monitoring system be unavailable, the system can be aligned to the Post-Accident Sampling System j (PASS) and a manual sample obtained. However, this arrangement does not ! conform with the NRC Staff's position stated in NUREG-0737 and Regulatory { Guide 1.97 that a redundant hydrogen monitor is needed. I l PRA Astessment ] The proposed project was evaluated using Method A by assuming the addition of j the redundant H2 monitoring system. 4 Millstone Unit No. I drywell is inerted during normal operation to less than j; 4% oxygen concentration per technical specification. Analysis has shown that { with less than 4% oxygen concentration, formation of a flammable gas mixture is j precluded for an indefinite period of time following a DBA LOCA. 1
- Flammable concentrations of hydrogen post-accident are a concern only when 1 the containment is de-inerted. This time is limited by technical specifications to ,
i the 24-hour period prior to a plant shutdown and the 24 hours following a return i to powar, a total of 48 hours. The frequency of a LOCA event occurring in this j time period accompanied by failure of the two existing hydrogen monitoring ! methods, the hydrogen / oxygen analyzer and the PASS system, is small (less than i 10-6 events per year). Addition of a redundant hydrogen monitoring system l therefore has a negligible impact on public safety. Results Addition of a redundant hydrogen monitoring system has no impact on public safety. l Score 0/10
ISAP #1.12 Control Room Habitability (~'s Safety Issue O There are three areas in which control room habitability can have an it pact on safety, and these are: o Assuring the ability of control room operators to function during the course of an accident which results in a radioactivity release. o Assuring the ability of control room operators to function following a chlorine gas release. o Providing a working environment which is not likely to induce operator errors due to high temperature, humidity, or lack of sufficient fresh air. Each of these is further discussed below. The Millstone Unit 1 control room Heating, Ventilating and Air Conditionin6 , I (HVAC) system automatically isolates the control room if high airborne radioactive contamination is detected. Following such an isolation, the i control room operators may have to use Scott air-packs for breathing should air l samples indicate such a need. This requires wearing a full face mask which impedes the operator's sensory inputs (both visual and auditory) and hampers I conmunication with other operators. This would tend to result in an increased chance of an operator error uhile shutting the reactor down or in mitigating an l accident. Millstone Unit 1 currently uses a chlorine gas injection system to control i biofouling growth in certain plant cooling water systems that use seawater for cooling. At present, the source of the chlorine is a railroad tank car which holds 55 tons of chlorine gas in liquid form under pressure. The current HVAC system does. not automatically isolate following chlorine gas release. Tne Millstone Unit 2 control room, which is adjacent to the Unit 1 control room, has a high chlorine level alarm. Following the unlikely event of a major
' chlorine gas release, the Unit 2 control room operators would infonn the Unit 1 operators to take protective actions (isolating of the control room and/or wearing of Scott air-Packs). In the hypothetical worst case scenario, the concern is that if the release is large enough and the wind direction is within O
1.0-1 MILLSTONE UNIT 1 f/ ROB 0FORL2272rd Ws57 STUDY
certain limita, the c:ntral room cper: tors may became incapacitated befera the protective actions are completed. If the operators are incapacitated, a transient occurs (e.g. reactor trip), and the automatic systems (e.g. V reedwater, Isolation Condenser) fail, the transient will not be mitigated leading to a severe core damage. Loss of the control room WAC during normal operation causes the room temperature to increase. In the past 13 years of operation, the control room WAC has failed 3 times. Less of WAC has not initiated any transient (due to possible equipment malfunction at high temperature). However, with high temperature and the control room environment being uncomfortable, there is an I increased chance of operator error while performing routine duty which could result in initiating a transient. Proposed Project The W' A C for the control room is proposed to be upgraded to provide the following capabilities: 0 Under normal operation - provides air conditioning to the control room, utilizing recirculation and outside air make-up. Upon detection of high radiation or high chlorine gas levels initiate automatic isolation of air intake. l Filtration without makeup - during a radiation or chlorine gas release, provide 100's recirculated air (3,000 cfin is filtered) to the l control room ensuring a habitable environment. O Filtration with makeup - post accident purge made to reduce the p0 / radiation content of the control room. 2 The proposed system will use charcoal filters capable of removing iodine. Analysis of Public Safety Impact i The public safety impact of this proposed changed was assessed using Methods A 1.0-2 l MILLSTOE UN_'T 1 l .- _._, _ - - . _ _ _ _ _ _ ___ = =^= t=_rt 2 m s= '_Sr?_ _ _ _ __ _
cnd B. Method A was utilizrd to cnalyze the conditiens following r21ces2 of high radiation and chlorine gas. Method B was utilized in assessing loss of O the control room HVAC during normal operation with its effect on operator Q actions. The effect of chlorine gas release on Millstone Unit 1 control room personel and indirectly causing a core melt accident is also discussed in ISAP Topic #2.07, " Sodium Hypochlorite System" (Reference 1). Design basis calculations . indicate the need to protect the operators durinf design basis accidents where subsequent operator actions are still assumed. However, such design basis calculations use grossly conservative estimates of the iodine source term. Realistically, severe core damage and significant containment failure or bypass is required to reach a situation where the control room operators would require protection. If the source of such releases is Millstone Unit 1, subsequent Unit 1 operator actions will have no significant impact on public risk. However, if the source of the release is Millstone Unit 2, protecting the Unit 1 operators from high radiation could improve the probability of a safe shutdown of Unit 1. The presence of a high radiation alarm in the Millstone Unit 1 control room may lead to donning of protective breathing apparatus (Scott air-Packs) and further investigation of the situation. A decision would be made to either continue cperation or initiate a manual shutdown. If a decision to continue operation is made it would require an additional transient event occurring in addition to the radiation release frcm Millstone Unit 2 to initiate core melt. (This represents a highly unlikely coincidence.) An alternate path investigated using bounding type analysis involves the following: operators initiate a controlled manual shutdown using the recirculation flow control system and eventually trip the reactor from low power levels (this prevents the closure of M.S.I.V.s). shortly after this, the operators are forced to evacuate due to the radiation 0 feedwater fails to continue to run after reactor trip 1 O e i 1,0-3 MILLSTONE UNIT 1 DDSD A D Tt P f"* M ,
O fcilur2 of oither the Isolction Condinser er IC makeup system w Such a sequence would result in a TE1 Plant Damage State as defined in the Millstone Unit 1 Probabilistic Safety Study. The overall frequency of this sequence is calculated as: A=A g gQ Qg/ g (QIC + OICMUP}
-wnere: g is the frequency of major radiation release from the Unit 2 l
Qg = 1.0, given manual scram Qg g = 1.031 x 10-2, unavailability of feedwater given reactor trip (Table 2A-8 Millstone Unit 1 PSS) QIC = 2.19 x 10-2, unavailability of automatic isolation condenser (Table 2A-5 Millstone Unit 1 PSS) QICMUP = 2 78 x 10-2, unavailability of automatic isolation condenser makeup (Table 2A-6 Millstone Unit 1 PSS) In truth, the probability is much less in that the above does not consider , items such as the probability of the plume blowing towards the control room or the probability that iodine will be limited. Combining the above values yields the frequency of Hillstone Unit 2 radiological releases resulting in core melt events at Millstone Unit 1. A= A72 (5.124 x 10- ) Although not calculated, the frequency of a severe core damage event which , results in a significant release at Millstone Unit 2 ( A O'2) is expected to be less than 5 x 10-4/ year. Thus, the resultant frequency of a core melt event at Millstone Unit 1 resulting from a radiological release from Millstone Unit 2 is. about 2.5 x 10-7/ year. O V 1.0-4 MILLSTONE UNIT 1 PRO *427.TiTTTE 4ArrTV m mv
In addressing the final rirr.o,'the currInt control room WAC is e single train sys'nn. The proposed upgrade to the system will have two 100% air filteration units and air conditioning units. Therefore, the upgraded system is expected to be more reliable. This would tend to reduce the likelihood of future losses of control room WAC, and hence the probability of operator errors. Results As calculated in ISAP Topic #2.07, " Sodium Hypochlorite System", the frequency of core melt accident initiated by chlorine release is 9 2 x 10~I/ year. This sequence results in TE1 Plant Damage State as defined in the Millstone Unit 1 P.S.S. The equivaler.t public risk is 34.5 Man-Rems (excluding the direct effect of chlorine on offsite population). The frequency of core melt accident at the Unit 1 initiated by high radiat' ion level due to a release from the Unit 2 is 2.5 x 10-7/ year. This sequence also results in TE1 Plant Damage State. The equivalent public risk is 10 Man-Rems. The effect of loss of HVAC and subsequent higher control room air temperature nv will place additional environmental stresses on the operators. increased probability of the operator making an error and initiating a However, the transient due to environmental stresses cannot be easily quantified. The upgraded system will not completely eliminate this risk. Since the' proposed-system is expected to be more reliable, this risk will be somewhat reduced. The total benefit of the proposed HVAC upgrading is about 45 Man-Rems for the cases of chlorine gas and radiation release. Based on reduction of 45 Man-Rems and engineering judgment (for lower probability of loss of HVAC during normal operation), this project is assigned a score of 0.5 out of 10. References J.F. Opeka letter to C.I. Grimes dated August 7,1985. n 1.0-5 MILLSTONE UNIT 1 PROBABILISTIC SAFEIY STUDY
- ISAP #1.13 BWR Vassel Water Im:1 Instrumentation
,y Safety Issue The R.P.V. water level indication which is used to mitigate accidents is based on a number of level gauges which utilize one of two reference legs located within the drywell. Unusually high .drywell temperature in conjunction with reactor pressure vessel (R.P.V.) depressurization can affect reactor water level instrumentation by causing water in the reference legs to flash when the drywell temperature reaches RPV saturation condition. This results in erroneous readings that indicate a higher reactor water level than the actual level which is present in the vessel. If the operator places undue reliance on the indicated water level the potential exists that makeup could be throttled to the extent that the core is uncovered. Such scenarios are explicitly considered in the Millstone Unit 1 emergency procedures (See EOP 580, Part 3.4,
'in Appendix 2-B of the P.S.S.).
The outcome of reference leg flashing is explicitly addressed in the Millstone Unit 1 Probabilistic Safety Study (P.S.S.) in the treatment of cognitive errors O involving failure to control water level. Of particular interest are the LOCA b scenarios which cause a release of high temperature steam to the drywell at the same time that the R.P.V. is depressurizing and thus provide the conditions for reference leg flashing. In non-LOCA transients, prolonged loss of drywell cooling also heats up the reference legs. However, in these scenarios, the reference les temperature is maintained below RPV saturation condition and therefore no flashing occurs. At a higher reference leg temperature, the indicated water level is slightly highcr than the actual water level due to the decrease in water density in the reference leg. The difference between indicated and actual water level is only a few inches and is therefore negligible compared to the margin that exists before core uncovery takes place (the nonnal water level is about 15 feet above the top of the core). Consequently, operator decisions based on indicated level do not jeopardize the core cooling. I N
)
MILLSTONE UNIT 1 INTEGRATED SAFETY ASSESSMEhT PROGRAM
Proposed Project g lA!SCO is currently investigating several proposed consultant approaches to h resolve the reference leg flashing issue for Millstone 1 and expects to initiate detailed investigations in the next few months, completing the review by mid-1986. Analysis of Public Safety Impact The public safety impact of this proposed project was evaluated using Method A. Reference leg flashing can occur after a LOCA if the drywell heats up to the saturation temperature of water in the reactor vessel. In the Millstone Unit 1 P.S.S. this phenomenon was asstaned to occur. Subsequent failure of the operator to follow emergency procedures (regarding erroneous water level) was then considered. Section 1.0 of the P.S.S. assumes the following initiator frequencies for LOCAs: A SSB
= 1 x 10-2/yr.
A SB
= 1 x 10-3/yr.
A g = 1 x 10 /yr. The frequency of core melt due to reference leg flashing and cognitive errors in interpreting level indications was calculated by multiplying the frequency associated with each LOCA size times the appropriate operator error which was j taken from Section 2.0 of the Millstone Unit 1 P.S.S. A CNSSB *A SSBNHEP I
=(1x10fSSB /yr)(1.3 x 10 ')
= 1.3 x 10-5/yr.
ACNSB *A S50HEP /SB
= (1.0 x 10-3/yr)(1.3 x 10-3)
= 1 3 x 10-6/yr.
O MILLSTONE UNIT 1 IhTEGRATED SAFETY ASSESSMEhT PROGRAM
ACM-LB
*A LBOHEP /
=(1x10~p/yr.)(1.3x10-2) 4
= 1.3 x 10 /yr.
Adding these core melt frequencies yields a totsi value of 1.6 x ,10-5/yr. due to reference leg flashing. The risk to the public can be calculating by using a multiplier of 0.5 since all core E lts of this nature are intermediate with containment intact. 6 R = (1.6 x 10-5/yr.)(0.5)(3 x 10 Man-Rem)(25 yr.)
= 588 Man-Rem If it is asstaned that reference leg flashing is a problem for Millstone Unit 1 and a fix can be made to entirely eliminate the problem, then public risk can be lowered by approximately 590 Man-Rem over the remaining plant life. It should be noted that the 590 Man-Rem estimate is an upper bound on public risk since the operator error numbers were conservatively calculated as screening values for the P.S.S.
Results l Based on a 590 Man-Rem reduction if the potential for reference leg flashing is eliminated at Millstone Unit 1, a project which would totally eliminate reference leg flashing would be ranked at 1.5 out of a total possible score of 10. l I l 't i I 1 MILLSTONE UNIT 1 INTEGRATED SAFETY ASSESSMEhT PROGRAM
ISAP Topic No.1.14 Appendix 3 Modifications Scope of Project Several containment penetrations do not meet acceptable regulatory guidelines as specified in 10CFR50 Appendix 3. The present scope of the project consists of:
- 1) Installing a support hanger for a 3/8" test line which comes off the standby liquid control (SLC) piping near penetration X-42.
- 2) Installing ladders and platforms to reach test valves at penetrations X-43, X-45 (LPCI injection lines), X-16A, and X-16B (core spray injection line).
- 3) Installing test lines to permit leak rate testing of containment isolation valves at penetrations X-204A though C (torus ring header suction), X-210A and X-210B.
Safety Issue Following an accident, it may be necessary to isolate containment in order to prevent the uncontrolled release of radioactivity to the environment. Appendix 3 requires containment isolation valves to be leak rate tested on a O periodic basis, to ensure the leak tightness capability of each containment penetration. Consequently, Appendix 3 modifications are concerned with any items that could relate to containment isolation. These items can include such things as valve structural integrity and access to test lines, in addition to the required leak rate tests. PRA Assessment The public safety impact of the proposed project was assessed by Method B (e.g., engineering judgement). Each of the 3 Appendix 3 modifications is evaluated separately as discussed below.
- 1) The installation of a hanger on the 3/8" test line, which comes off the SLC piping, will provide additional protection for the test line isolation valves by reducing the chance of vibration related failures.
However, because vibration is not a significant contributor to valve failure, the modification will have a negligible effect. I 2) The installation of ladders and platforms will only provide increased accessibility for valve leak rate testing. As a result, this modification has no impact on valve leak tightness. I
- 3) Most of the valves associated with this modification are required to either open or remain open for success of LPCI and core spray, following a LOCA. The remaining valves are normally closed valves which are in series and may not be required to open. The modification involves installation of test lines so that all of these valves can be leak tested to ensure leak tightness.
. --,._.,. +.,=. , _
. - _ _ _ . . ,_m . _ _ . . . . . . - - . - . . , . , . - . _ . . . - , - _ - . - - - - . ~ . . _ - . . . ..
)
O If a core melt were to occur as the result of a LOCA event, then the open valves would be closed to " isolate" containment. However, failure of these valves to close would not result in an unisolated containment. All of the valves are on closed loops which ' exit and return to the containment. Since leak testing the valves will not reduce their failure to close, this modification offers no risk reduction. Results The following results were obtained for each of the proposed modifications.
- 1) Installing a pipe hanger on the SLC test line does not improve containment isolation. Thus, the impact on public risk is zero.
- 2) Installing ladders and platforms to improve accessibility for valve testing has no impact on public risk.
- 3) Installing test lines to leak test valves on a closed system has no impact on public risk.
Score 0/10 0 1
m ISAP Topic No.1.15
) FSAR Update Scope of Project The proposed project is to update the FSAR to incorporate:
o hardware modifications made in the plant o results of new safety analyses performed The updated FSAR will reflect as-built plant. Safety Issue The Millstone Unit 1 Final Safety Analysis Report (FSAR) is mainly used as a ., reference document to gather plant-specific information. It is also used to perform safety evaluations of plant design and operational changes and in operator training. The Millstone Unit I design has been substantially modified and significant additional safety analyses have been performed since the FSAR was originally published. Since the FSAR does not reflect the as-built plant or the most current analyses performed to date there is concern that erroneous decisions could be made based on an obsolete version. For example, based on information from the FSAR, a safety evaluation may endorse a design, technical specification or procedure change which is inappropriate. Similarly, the operator training could also be affected as well. The system descriptions, design bases and results of transient analyses for many lesson plans which are used in operator D training in the lesson plans could be invalid due to a obsolete FSAR being one of [V the primary sources of information. PRA Assessment The public safety impact of the proposed project was assessed using method B. It is conceivable that based on some information in the FSAR which is no longer valid, a safety evaluation may endorse a design, technical specification or procedure change which is inappropriate. Since, the FSAR is rarely, if ever, the only source of information, the probability of an error not being detected by the safety evaluation is extremely small. The information for the lesson plans used in operator training is obtained from the FSAR and other design documents. However, any significant deviation in the lesson plan from the as-built plant can not go undetected and not be corrected. This is because the same lesson plans are also used to requalify the experienced operational staff who are intimately familiar with the as-built plant (i.e., original design and modification). Results Upgrading of the FSAR is not expected to have any significant influence on lesson plans or the outcome of future safety evaluations. Based on engineering judgement, and considering the arguments provided above, this project is assigned a score of 0.25 out of 10. Score 0.25/10
ISAP #1.16.1 Millstone Unit 1/M111 stone Unit 2 Backfeed V Safety Issue As currently designed, a number of Millstone Unit 1 core cooling and cold shutdown systems have pumps which are powered by the 4160V buses. The complete loss of these buses is a Station AC Blackout event which places total reliance on the Isolation Condenser in order to avoid core damage. In some cases this may not be sufficient if minor reactor cooltit system leakage exists. The Millstone Unit 1 P.S.S. evaluated such sequences originating from internal events and concluoed that loss of these buses is dominated by loss of nomal power followed by failures of the diesel and gas turbine. 'Ihe failure of the redundant AC buses due to random failures was assessed to be an insignificant contributor to Station AC Blackout. When external events, such as fires, are considered it is noted that a hypothetical worst case switchgear roca fire could result in failure of the redundant buses needed to power core cooling and cold shutdown systems. This proposed ISAP project addresses the issue of being able to provide AC power from Millstone Unit 2 sources to the Control Rod Drive m (C.R.D.) pump indefinitely through connections which do not pass through the s switchgear room. Implementing this project would thus address mitigation of the hypothetical worst case switchgear room fires as well as events in which there is a failure of both Millstone Unit 1 onsite emergency generators. Proposed Project The conceptual design shown in Figure 1 calls for supplying power from Millstone Unit 2 emergency buses to 4160V bus 2F. A circuit breaker, controllable fra the Millstone Unit 1 control rom, will be added between the bus 2F and the Reserve Station Service Transfomer (R.S.S.T.) to isolate the bus 2F from the offsite power source. The C.R.D. pump can be powered directly by bus 2F (tbus bypassing the a-itchgea rocc) by installing a cable betweer. bus 2F and the C.R.D. ptz::p. Note that tus 2F is loca'ad outside 'h turbine building which houses the a-itchgear room. l The Isolation Condenser and IC Makeup, both of which can ibnction independent l p of Station AC, can remove the core decay. heat. However, the C.R.D. pump V . l l MILLSTONE UNIT 1 _ _ ._____2""t"""'N?*****""'*"""^~"____
. buses (Station AC Blackout). When this value is compared to the frequency of -m the equivalent internal event considered in the P.S.S., namely: loss of normal '
power in conjunction with either Support State 4 (14E'SW) or Support State 7 (14E'14?), the following frequency is obtained: ; I i A= Ag (P334+Pg)
= (.124/yr.)*(1.22x10-2 + 5.52x10~3) -
)
= 2.2x10-3/yr.
Even if offsite power recovery is credited, this value would remain significantly greater than fire induced events with similar consequences on l l equipment. Because of this, the benefit of the proposed project is more 1 important to mitigation of internally initiated events than to fire initiated events. B. Benefits from Mitigating a' Station AC Blackout i As discussed in Section 2.4.2 of the Millstone Unit 1 P.S.S., following a O Station AC Blackout and failure of the Isolation Condenser (an additional random failure), the core begins to uncover at 25_ minutes due to cycling S/R. valves. Core melt can be avoided if AC power is restored within 45 minutes. Therefore, the backfeed needs to be achieved within 45 minutes (to avoid core melt) and preferably within 25 minutes, t The method of analysis was to perform a sensitivity study using the Millstone Unit 1 P.S.S. as the base case. The split fractions of the support states which result in a Station AC Blackout (See Section 2.3 of the P.S.S.) were revised to include probability of being able to obtain power fr a the Millstone Unit 2 diesel generator. The core melt sequences were requantified with the revised support state split fractions. The following assumptions were made: o Altbough, the loss of power on 4160V buses 14E and 14F is possible following a reactor trip (e.g. due to failure of fast transfea), it is more likely following a loss of normal power. In the analysis it is assumed that at the time of backfeed, Millstone Unit 2 has also e
- MIL 1SIONE UNIT 1
_ _. _ - -_ - - - _ _ - _ _ - - - - . . __. _ _ . _ _ S*""****"'"'"""'"'"?'"_
o It is assumed that design modification for C.R.D. pump self-cooling has been implacented. Thi.s espability will be needed following the switchgear room fire, as only the C.R.D. pumps will be powered by the bus 24F and not T.B.S.C.C.W. and Service Water pumps which normally supply cooling flow to the C.R.D. Resulta . Figure 2 provides the fault tree for failure to provide power from the Millstone Unit 2 diesel to the Millstone Unit 1 emergency buses. The top event unavailability is Q= 0.2. Table 1 provides the split fractions for both LNP and non-LNP cases of the support states which are affected by the backfeeding. Both the base case values (obtained from the Millstone Uni,t 1 P.S.S., Section 5.2) and the revised values used in this analysis are provided. The following sample calculation depicts the method used in calculating the revised split fractions. The base case values are: P = 1.22x10-2 P - for LNP Table 5.2-1 SS3 = 1.265x10-1 The revised values incorporating the benefits of the proposed project are: Pssa = 1.22x10-2,9 P SS3 = 1.265x10-1 + 1.22x10-2 c3,q)
- where Q = failure probability of backfeed including HEP's (Human Error Probability)
If the Millstone Unit 1/ Millstone Unit 2 backfeed is implemented, the core melt frequency decreases from 8.07x10# yr / to 7.52x10# / yr (or about 75). Almost all of the decrease in core melt frequency is in the TE1 plant damage state (See , O Millstone Unit 1 P.S.S. Section 2.2). This results in a decrease of MILLSIONE UNIT 1 .
i o mes L . s e.see. mies e . . P.4M MOeg i vet 8.t efselt steste t 091 le8 e sHe s ee I wet s rs,t mt
, gg m gg _ _ _
Ses av A eue
~ see et a 1 1f see es ri li _ _._.
gtoUwet9 see.es . 13y ese st.a IfI 34e etv e Due
. . . . . . - ~ .
ess es sg 333 "a m .u att e,r,,e t e,e ,ne nt _re egv a N SSt ) ,,masSwam 10 et Atilst0 ' w l sa, 04AI80
*" "'" Mf cm t of MtM AIOR to esso comes 4.sou.v eer su.s.
l ress t.ri l. IX11 sess t a
' ~ " ~ '
sou see al ICx y, a.r g g g I - ser sus 1l1 ,, _ 7 sess see-r (fix t V l fi 1 IICT I lt flCf 3157 llCT e g l Cf riff ll ll I R I i pop __.., e is =v i e n. , 0
-- a 4 so wv re -
e4_g leep _ . t og ry a to .. t!r w p _.. ego qq dJe my ....!! A .Po.. 11e av .ile_ s,u,,i u
.' " ~ ~ u 1 1 II 1X I l lill. Il II II t1CX (IICX V
. ~ A' ' oneset @ h'n' tut er.L ure rowen sorrt.ite 4 Le.gv, !gr sus .gu ny .,!1r we . DG =
?{l llitt b CXlll
- I I i
gl a a 4 9
"
- e4tiset a Hrrest , '/ '/.seoriro
~
ecierc l 4 FIGURE 1. CONCEPTUAL DESIGN FOR MP1/MP2 BACKFEED
O o o_ MPl / MP2 BACMFEED Fall.S i e
! I
' -w g i E. . l I MISC. OREAMERS Ol'LII Alllit El410H ! POWER SilPI't.Y IN D ACMI'EElHHG fl10M llNif 2 F All. TO Cf.OSE 8 l Fall. TO OPEN PROCEIMMIE N01 AVAll. AhlE l t t-
. i.. w I I _ E _
l MP2 DG A MP2 DG B - Oe'EltAtull OPERA 10R FAlt.S TO START a Epp0H (* 3 Ellfl0H Alg j FAILS TO START a lAll.S TO RtfN FOR 8 Hic I AR.S TO RUN FOR 8 IIRS. DNlT I , llNIT 2 j [ \ ! es o.oet es s et -e ossee s e so os4 l 0 s or ts 4 0,,a for Oke. RW- booed Ielusvsor
'i 15ee Sea. 4 of MPI PS6)
.s 3 0E-2 & e n 3 0E -3 Modified foe Street j s0.054 .
Qu5M-2 . (WASIl-1400 DATA) . . FIGURE 2. MPl/MP2 BACKFEED FAULT TREE
j
\
1 O Table 1 ; Support State Split Fractions I Support State Failed LNP Case non-LNP Case i Systems Base (1) Revised Base'(2) Revised 3 14E 1.265E-1 1.407E-1 2.029E-4 4.911E-4 4 14E*5W (2) 1.222E-2 2.444E-3 (4) - 7 14E*14F 5.521E-3 1.104E-3 1.076E-4 2.152E-5 9 101B*SW (3) 1.9BTE-5 3.974E-6 (4) 10 101B814F 8.445E-6 1.689E-6 2.597E-7 5.194E-S 13 101A*14E 3.369E-5 6.738E-6 9.732E-8 1.946E-B Notes: (1) From Section 5.2 of the Millstone Unit 1 P.S.S. (2) In the case of a loss of normal power, loss of Service Water also implies loss of AC bus 14F (diesel bus). (3) Loss of a Dc bus implies the loss of the corresponding AC bus. (4) Not a Station AC Blackout Sequence and therefore not modified.
~
O .
- MILLSTONE UNIT 1 __,,,.
4
~
i .
'tSAP #1.16.2 Modify CRD Pumps ~
Safety Issue Following an AC blackout event or serious fire that incapacitates both-emergency AC buses, the Isolation Condenser (IC) is the only available system that is capable of preventing core melt. The IC and its associated makeup system ibnction to remove core decay heat independent of AC power. Makeup to the IC is provided by the diesel driven fire pump which can also be used to meet long term vessel ma'keup requirements that are caused by primary system shr'inkage and/or' minor leakage out of system. Lining up the diesel pump for i vessel makeup requires operators to connect a fire hose in the Turbine. Building i to the Feedwater heater drain. However, if a serious fire occurred in this ' building the Feedwater heater drains may not be accessible for some time. The occurrence of such an event would require a Control Rod Drive (C.R.D.) pump to be used for makeup in place of the diesel pump. The power cables to the C.R.D. pumps, however, have to pass through the Turbine Building and may be damaged as a result of the same fire. The Millstone Unit 1/ Unit 2 Backfeed project (ISAP #1.16.1) addresses the issue of being able to power a C.R.D. pump from Unit i,2 through connections that do not have to pass thiough the Turbine Building. In the analysis of - the above project, it was assumed that a design modification for C.R.D. pump self-cooling would already be implemented. Such cooling is required after a Turbine Building Fire since the backfeed project does not include powering T.B.S.C.C.W. or Service Water, both of which are necessary for C.R.D. pump cooling. The proposed project to modify C.R.D. pump cooling is strongly linked to the
- backfeed project- Without the concurrent implementation of both projects, the backfeed alone'will not provide the benefits that are described in the backfeed -
project"writeup (ISAP Topic No.1.16.1). i Proposed Project
- The proposed project involves modification of the C.R.D. pumps to permit relf-cooling in the event that all service water is lost, following a -
-,r- . - - + - - - - - , , , - . . , - , - - - - - , . , , . _ , - , - , . , - - - - - - - . . - , , , - - - - --.-,--.-e--,a--u.,---- . - - - - - - . - - , , . - - , . - -
screenhouse fire. During normal plant operation, the C.R.D. pump bearing and
- gear box are cooled by T.B.S.C.C.W. which relies on service water to provide the ultimate heat sink. The proposed modification would allow manual realignment of the C.R.D. motor cooling piping to the pump discharge flow to permit self-cooling. ,,
i Analysis of Public Safety Impact i The analysis for the backfeed project assumes that C.R.D. pump self-cooling ' will be available. Consequently, the public risk reduction associated with implementation of the backfeed project is dependant on implementing the C.R.D. I pump modifications first. No separate analysis was performed for this latter project since it is implicitly part of the backfeed project and should receive ! the same score. Results By itself, the proposed C.R.D. pump modification would have a score of zero. Conversely, the backfeed project will not accomplish its intended purpose without implementation of C.R.D. pump self-cooling along with the project. The results for CRD pump modification are the same as those for the backfeed project, if both pro ~ jects are implemented together. O e l l M MILLSTONE UNIT 1
ISAP Topic No.1.16.3 g Alternative Cooling for Shutdown Cooling Scope of Project
- In order to comply with Appendix R, portions of the shutdown cooling (SDC) system will be modified. The changes will allow the plant to be cooled to cold shutdown without having to use the normal service water supply. An alternative
. supply of water will be provided to SDC by the fire protection system.
Safety Issue A serious fire in the turbine building or intake structure could result in a loss of all AC power or service water, respectively. Appendix R conservatively assumes that a station blackout (SBO) condition exists and that all cooling water systems fail. The proposed modifications will allow the SDC system to be cooled by fire water so that the plant can be brought to cold shutdown within 72 hours after the fire. PRA Assessment The public safety impact of this modification was assessed by performing a sensitivity study on the Millstone Unit No.1 PSS Fire Analysis (i.e., Method A). O Following the SBO condition assumed by Appendix R, only the isolation condenser (IC)is initially available to remove decay heat. If the IC or its make-up system were to fail, then a core melt would occur regardless of SDC cooling restoration at some later time. With the IC and its make-up system operating, there is no need for SDC. The plant can remain on the IC indefinitely without the need for additional cooling systems. In the fire analysis, there is one scenario where the IC and the cooling source for SDC both fail due to a reactor building zone R-19 fire. The proposed modification would allow restoration of SDC by using the fire protection system. Although feedwater and the main condenser are both available, SDC restoration offers some additional credit for long-term cooling concerns. Results ! Providing SDC with an alternate cooling source, reduces the core melt frequency from reactor building fire by 1.87 x 10-8/yr. This corresponds to a 2.1 person-rem reduction in public risk. Score 0.01/10 l l I
^
ISAP Topic No.1.16.4 ,
. Power Cold Shutdown Equipment Scope of Project l This project consists of two parts which are being done to comply with Appendix R are as follows:
I
- 1) Protect power / control cables for shutdown cooling (SDC) isolation 1
, valve 1-SD-1 at the drywell penetration. Also provide a method of l powering SDC equipment from Millstone Unit No. 2.
- 2) Protect power / control cables for isolation condenser (IC) valves 1-IC-1 and 4 at the drywell penetrations. Also provide a method to power the l IC valves from Millstone Unit No. 2.
The first part is related to ISAP Topic No.1.16.3. i Safety Issue 4 As noted above, the proposed modification for~ SDC is related to ISAP Topic l No. 1.16.3. Providing power to SDC components completes the modifications that are required to restore SDC for Appendix R concerns. The modification for the IC is being proposed so that IC operability can be O restored, following a serious reactor building fire. Since a fire in the reactor building does not affect feedwater operability, this system will be used to initially remove decay heat until the IC can be restored. PRA Assessment , The impact on public safety for these modifications was evaluated using Method A. Sensitivity studies were performed by using the fire analysis from the Millstone Unit No.1 PSS. The SDC modification was previously assessed for ISAP Topic No. 1.16.3 (score 0.01/10). Consequently, no further assessment of SDC modifications is
- performed here since all modifications address the same safety issue.
1 The fire analysis for the reactor building shows that a serious fire in Zones R-2A, 2B and 2C would cause the following: o MSIV closure (falls main condenser) , i o Loss of safety / relief valve remote opening functica ; o Loss of AC and DC power to the area 1
- o Possible IC failure due to hot shorts in the IC valve circuits. l However, feedwater will be unaffected and could continue to run for ppproximately 6 hours until the hotwell inventory was depleted. No hotwell l make-up is assumed since the emergency condensate transfer pump is failed by l
the fire. If the IC could be restored within 6 hours, as a result of the proposed I modifications, core melt could be averted. 1 s I i 4
----,,r.n-,-- ---,a,, _,.,n,,_-----..n-~,-a-----,----, ----.n
.--- , ------,r-~- . - n. - - - - - - - - - -
4 Results if the modifications will not allow IC restoration in 6 hours, then the score of this project is zero. Assuming the modifications allow IC restoration within 6 hours, there would be a reduction in core melt frequency of 8.29 x'10-8/yr. This equates to a 3.1 person-rem reduction in public risk. S-are I 0/10* 1
- Score changes to 0.01/10 if IC operability can be restored in 6 hours as result of the project, i
f i I E i : i f I i i 4 5 3 1
)
l I
, N ISAP Topic No.1.16.5 d Install Curbs, Ramps and Seals Scope of Project This project consists of three Appendix R modifications:
- 1) Close openings in a 4' x 4' floor hatch to prevent the spread of fire between the switchgear area and a resin room which is located on the floor below.
- 2) Install IM hour rated fire doors between the turbine building and personnel access routes.
- 3) Shield and protect gas turbine generator power / control cables from a postulated auxiliary boiler fire. .
Safety Issue All of the above items are required to bring the plant into compliance with Appendix R. Items 1 and 3 involve the protection of safety-related equipment against a spreading fire. Item 2 protects a personnel access route from an adjacent turbine building and is not related to safety equipment. PR A Assessment The impact on public risk for items 1 and 2 was evaluated by using Method B. Item 3 was evaluated by using Method A. The first modification, item 1, has zero impact on public risk because fires are not assumed to spread from the resin room to the switchgear area. No combustibles are present in the resin room and the area is enclosed. As a result, sealing the openings on the hatch between the switchgear area and the resin room affords no risk reduction from fire. Item 2 is strictly related to the safety of plant personnel during evacuation from fire. Consequently, there is no impact on public risk. The third modification has the potential to reduce public risk by preventing the loss of gas turbine generator power / control cables, following an auxiliary boiler fire. Results i Items 1 and 2 of the proposed modifications are given a score of zero based on no reduction in public risk. Shielding the gas turbine generatcr cables reduces the core melt frequency due to fires by 9.6 x 10-9/yr. This results in a slight reduction of public risk (i.e.,0.36 person-rem) which essentially yields a score of zero. Score 0/10*
- Actual score is 0.001.
I t
O ISAP Topic No.1.16.6 Fire Protection Water Curtain / Steel Enclosure Scope of Project This project consists of eight plant modifications that are required for Anpendix R compliance:
- 1) Install a water curtain to prevent a turbine building oil fire from spreading to the switchgear area.
- 2) Provide certification that the battery room door is fire rated for 3 hours.
- 3) Protect turbine building steel floor supports from fire.
- 4) Protect structural steel in the mezzanine area by spraying on a 3 hour fire rated coatings.
- 5) Seal all openings between the switchgear area and other zones.
- 6) Seal all openings between the diesel generator area and other zones.
- 7) Seal all openings between office areas and the turbine building.
- 8) Install Scott air packs near the reactor building air lock and in the area near instrument racks 2205 and 2206.
Safety Issue Except for one, all of the above modifications are involved with controlling the spread of fire into safety-related areas or preventing structural damage in safety-related areas. Modification number eight, which is the exception, will provide breathing air for plant personnel during fire conditions. PRA Assessment The public safety impact of these eight modifications was evaluated by using Method B. Modification number I was assessed to have no reduction on core melt due to a turbine building oil fire spreading to the switchgear. This is because the switchgear is adequately separated from the turbine building by a reinforced concrete wall. l Modifications 3 and 4 produce no reduction in core melt frequency since a fire of sufficient magnitude to cause structural damage was assumed to result in core melt anyway (i.e., fire analysis for Millstone Unit No.1 PSS makes this assumption). All other modifications that involve the sealing of openings or the
- certification of a fire door do not reduce core melt due to fire. The probability of an unmitigated fire breaching into one fire zone from another adjacent zone is several orders of magnitude less than the initiating frequency of fire in the zone itself.
2-The modification that involves adding Scott air packs outside certain fire areas (i.e., item 8) was assessed to have a positive effect on operator error. i Consequently, this modification has the potential to reduce core melt frequency. Results Modifications I through 7 were given scores of zero based on the assessment that they will not reduce core melt frequency and, hence, public risk. Modification 8 was subjectively given a score of 0.1. Score 0.1/10 4 e i i 1 l l l l i l I
. - . - - - - . _ _ - . y.-, . . . . - , _ , _ . _ _ . . , , _ _ . _ , - , _ . - - . - _ _
. _ ._o- - _ _ _ , _ _ _ . - ._.r..._ _- -- - _ - . _ - - - . _ _ . - - . _ . -. __ _ _ _ . _ _
( v) ISAP Topic No.1.16.7 Cable Vault Halon Suppression System Scope of Project In order to comply with Appendix R requirements, an automatic fire suppression system will be installed in the cable vault. The system will automatically discharge Halon gas upon indications of fire from installed smoke detectors. Safety Issue The proposed modification will improve the existing fire protection features by adding an automatic suppression system. A serious cable vault fire could induce plant transients and cause a loss of ECCS equipment control. PRA Assessment Method A was used to evaluate the impact on public risk by performing sensitivity studies on the fire analysis for the Millstone Unit No.1 PSS. Currently, the cable vault has no automatic fire suppression system. Installation of a Halon discharge system means that a fire can be suppressed early without requiring personnel to enter the area. The system will be designed so that remote manual actuation is also possible. O 'd Results The proposed modification will reduce the core melt frequency due to cable vault fires by 1.42 x 10-5/yr. This results in a 1036 person-rem reduction in public risk. Score 2.6/10 (O. v
_ _ . . - _ _ . - =_ _ ~- ISAP Topic No.1.16.8 Main Control Room Halon System Scope of Project This project involves the installation of an automatic Halon suppression system in the main control board to comply with Appendix R. Detection will consist of ionization and photo-electric type smoke detectors. Safety Issue The proposed modification will augment the existing fire protection devices and willlower the chance of a spreading / damaging control room fire. ! PRA Assessment The impact on public safety was assessed by Method A. Sensitivity studies were performed on the fire analysis for the Millstone Unit No.1 PSS. Since the Halon system can be actuated both automatically and manually, credit was given to both means in the event tree for control room fires. The Halon system is most effective for early suppression of fires that result in minimal damage. Results The installation of the Halon system in the main control board will lower the core melt frequency, due to control room fire, by 7.38 x 10-6/yr. This corresponds to a public risk reduction of 519 person-rem. Score 1.3/10 f 9 O
ISAP Topic No.1.16.9 m Install Fire Barriers ) l Scope of Project This project involves the in tallation/ certification of fire rated dampers between:
- 1) Cable vault and computer room areas
- 2) Switchgear area and other adjacent areas
- 3) Turbine building and office spaces ,
- 4) Battery rooms l Safety Is_ sue These modifications are being proposed to bring the plant into compliance with Appendix R. Under the proposed project, NNECO will either provide certification for existing dampers or replace them with dampers that are i certified. All dampers are related to preventing the spread of fire into areas that contain safety-related equipment.
PRA Assessment The impact on public risk due to implementing the above modifications was [V evaluated by using Method B. None of the modifications will result in a significant reduction in core melt frequency as the result of fire. This can be seen by the following augment which was used to assess all modifications. In order for a fire to spread from one area ! (A) into another area (B), containing safety-related equipment, certain events must occur in sequence:
- 1) A fire must occur in area A.
- 2) Fire protection devices must fallin area A.
- 3) The fire must propagate to dampers between areas A and B.
- 4) The fire must breach the existing dampers and spread to area B.
The probability of events 1 through 4 occurring is at least several orders of magnitude less than the probability that a fire occurs in B anyway. Therefore, , certifying or replacing the existing dampers does not significantly reduce core melt frequency due to fire.
- Results .
From the above assessment, which uses the Unit I fire analysis as its basis, it was concluded that none of the modifications impact public safety. Score o/10 m-- ,-- . - - - - - - - , - - - -
ISAP Topic No.1.16.10
, MSIV/ ADS Circuit Protection Scope of Project This project is designed to protect MSIV and safety / relief valve circuits from control room fire as part of Appendix R compliance. Both circuits will be protected against hot shorts which could cause valve opening.
Safety issue Both modifications will prevent a loss of reactor vessel inventory, following a postulated control room fire that causes a loss of all equipment control. For a control room fire, Appendix R assumes that the safest plant configuration is to ' have the reactor vessel bottled up (totally isolated) with the isolation condenser in service. PRA Assessment The proposed project was evaluated using Method A. i The fire analysis for the Millstone Unit No.1 PSS did not consider MSIV opening due to hot shorts because: O o The probability of a particular combination of MSIV hot shorts is low; i.e., both the inboard and outboard MSIVs would have to short open to unisolate the reactor vessel. o MSIV opening would a!!ow the main condenser to be used for decay heat removal and the analysis does not credit failures. The fire analysis showed that catastrophic failure of all equipment control was not likely (i.e., failure of MSIVs and loss of feedwater/ main condenser). The fire analysis did consider stuck open safety / relief valves (S/RV), due to fire induced hot shorts, as contributing to core melt. Moreover, credit was given for operator recovery to de-energize the shorts where time permitted. Consequently, the proposed modification for hot short protection in the S/RVs offers only a smallimprovement in core melt reduction. A more likely contribution to core melt was failure of the S/RV remote opening function due to fire. There were scenarios where such failures caused a total loss of ECCS equipment, even though low pressure pumps were available. If the project scope were redefined to provide an isolable S/RV remote opening panel, this suggested modification would provide a greater benefit than the original proposed S/RV modification. Results Based on the Millstone Unit No.1 Fire Analysis, protecting the MSIVs from O opening has no impact on core melt frequency (CMF). Hence this modification has zero impact on public risk.
Protecting the S/RV circuits produces a small reduction in CMF. A sensitivity study using the fire analysis shows a CMF reduction of 3.91 x 10-8/yr. which results in a public risk reduction of 1.5 person-rem. If the scope of the project were redefined to preserve S/RV opening capability, the CMF would lower by 8.0 x 10-6/yr. This results in a 900 person-rem reduction in public risk. Score J 0.01/10 *
*1f project scope were redefined as suggested above, the score would be 2.3/10.
O , i O
i ISAP Topic No.1.16.11 Hydrogen System Modifications Scope of Project To comply with Appendix R concerns, this project proposes to provide an excess flow check valve on the hydrogen supply to the main generator. Safety Issue The excess flow check valve is designed to limit the release of hydrogen to the turbine building in the event of a line break. Without such a device, there is concern that a hydrogen release could cause a turbine building fire, possibly inducing an accident. PRA Assessment The public safety impact of this project was assessed using Method B. Installing , an excess flow check valve on the hydrogen supply line would not prevent the ' release of hydrogen from the skid unit which is downstream. Since the skid unit contains 3125 f t.> of hydrogen gas, a break anywhere in the unit would pose the same threat as a line break without the excess flow check valve. A Results b Because the modification will not address skid unit hydrogen release and the l probability of a line break is extremely low, this project is scored a zero public I safety impact. ; Score ,
)
0/10 f i l l. d
/
O
ISAP Topic No.1.16.12
,m Emergency Lighting Modifications Scope of Project This project involves installation of additional emergency lighting in. all fire areas. Modifications are being proposed to comply with Appendix R requirements on levels of illumination and length of time that lighting remains operable. The project would provide 8 hour battery pack lighting in all fire areas with the following levels of illumination:
- 1) Control Stations - 20 foot candles
- 2) Orientation - 5 foot candles
- 3) Access / Egress Routes - 2 foot candles Safety Issue Improved emergency lighting would provide operators with a clearer view of their surroundings, following a serious fire that failed the normal lighting. This could potentially improve the operators' ability to perform and would alleviate much of the need for portable lighting.
PRA Assessment The public safety impact of this project was evaluated using a combination of Methods A and B. If the present emergency lighting were upgraded, there is a possibility that human errors due to poor lighting could be reduced. The project could have this type of positive effect not only for post-fire operations but for those following station blackout as well. One area where operator error would definitely be reduced is the manual control , station for opening valve IC-3 on the isolation condenser. At present, there is no l emergency lighting in this area and an operator would have to climb the access 1 ladder while holding a portable light. The impact on public safety for this area was evaluated by Method A. Other areas that might benefit from impt ived lighting are the switchgear area, control room, and parts of the NUr.x t - Iding. The public safety impact for these areas was assessed by Metior d. Results Improved lighting near the manual station for IC-3 reduces the core melt frequency for fire and station blackout events by 1.08 x 10-6/yr. This l corresponds to a 55 person-rem reduction in pubic risk for a score of 0.14. ' The remaining areas were subjectively assessed to have a score that brings the total to 0.20. ! Score O.2/10
1 I ISAP #1.17 Replacement of Motor Operated Valves Safety Issue i
?
, The Millstone Unit 1 Probabilistic Safety Study considered pipe breaks both within and outside. of the drywell. To mitigate a pipe break in the drywell, none of the motor operated valves (M'.0.V.s) in the drywell exposed to the harsh steam environment have:to change state. To mitigate such an accident, M.O.V.s located in the environment of the reactor or turbine building have to I function. As an additional concern, if the break resulted in severe core damage, the M.O.V.s will be exposed to high radiation and may fail due to high radiation, disabling the mitigating systems and leading to severe core damage.
The Millstone Unit 1 P.S.S. (Section 1.2.4 of the P.S.S.) has shown that the frequency of a break outside the drywell (i.e., in the reactor or turbine building)~ is small. The P.S.S. also as ;umed that an unisolable break outside the drywell will lead to severe core damage as all coolant inventory will be ultimately lost through the break. Operation of the M.O.V.s in the reactor or O turbine building is needed to mitigate an isolable break outside the drywell. In such sequences, some of the M.O.V.s in the reactor and turbine buildings, depending on location, may experience a harsh environment (high temperature and humidity). The concern exists that these M.O.V.s could fail due to harsh environment, failing the critical decay heat removal systems and leading to severe core damage. Environmental qualification of electrical equipment ensures that the mitigating systems will function in the environment they will be exposed to due to the transient or accident being mitigated. The 28 M.O.V.s, listed in Table 1, represent the only items for which full environmental qualification has not been demonstrated. The analysis presented here provides an estimate of the public risk reduction which might be obtained if the remaining 28 valves are qualified to the degree required. ())
,s.
- MILLSTONE UNIT 1
~"---- ~ n - _-
Proposed Project The following modifications to the valve operators or their control systems are proposed to complete the envirornental qualification of remaining electrical equipment. The valve modifications can be grouped into 3 categories, as discused below. - A. Installation of Close-Arm Control Switches for M.O.V.s The following six valves will be modified by installation of close-arm switches to ensure no inadvertent operation from the control room following a LOCA. 1-CS-2A & 2B (Normally open Core Spray Suction Valves from the Torus) 1-CS.-4A & 4B (Normally open Core Spray Injection Valves) 1-LP-9A & 98 (Testable L.P.C.I. Globe Stop Check Valves) Valves 1-CS-2A,B and 1-CS-4A,B are normally open M.O.V.s and are not required to change state during a LOCA. Valves 1-LP-9A,B are globe stop check valves and s do not require control action for their operation during L.P.C.I. injection.
\, By adding close-arm switches, the chance of inadvertent valve closure with the s
subsequent need to reopen it in a harsh environment is eliminated. This will be done by requiring the operator to " arm" each switch before it will close the valve. There will be one close-arm arming switch for each train (A and B) of CS-2; CS-4; and LP-9 valves. This switch will have two positions, " normal" and "close permissive". In the "close permissive" mode, the valves can be stroked and an annunciator will sound during the testing. At the end of the test the switch will be set to " normal" and if any of the 4 valves are 12cproperly lined up, the annunciator will not be able to be cleared. B. Replacement of Motor Operators The following valves are proposed to be fitted with environmentally qualified ' motor operators: 1-LP-10A & 10B (Normally Closed L.P.C.I. Injection Valves) 1-LP-7A & 7B (Normally Open L.P.C.I. Heat Exchanger MILLSTONE UNIT 1 INTEGRATED SAFETY ASSESSMEMT PROGRAM
Bypass Valves)
'g 1-LP-15A & 15B (Normally Closed Drywell Spray Valves) 1-LP-16A & 16B (Nonr. ally Closed Drywell Spray Valves) 1-CS-5A & SB (Normally Closed Core Spray Injection Valves) 1-IC-2 (Normally Open Isolation Condenser Outboard Steam Isolation Valve) 1-IC-3 (Normally Closed Isolation Condenser Condensate Return Valve) 1-IC-4 (Normally Open Isolation Condenser Inboard Condensate Isolation Valve) 1-CU-2 & 3 (Normally Open Inboard / Outboard R.W.C.U. -
Isolation Valves) 1-RR-2A & 2B (Normally Open Recire. Pump Isolation Valves) C. Miscellaneous Hodifications
.To achieve ibl1 environmental qualification for valve 1-SW-9 requires replacement of a torque switch. The valve is already fitted with a qualified motor operator.
For valve 1-MR-96A, addition of a lead ' shielding is proposed. The lead shielding will be placed between the valve and the Reactor Building Equipment Drain Tank (R.B.E.D.T.) to reduce the postulated radiation field. This will result in the motor operator being in a mild environment, and it will no longer be governed by the requirements of 10CFR50.49. Valves 1-CU-28, 1-LP-13A,B have been detennined to be in a mild rather than harsh environment, which is beyond the scope of 10CFR50.49, and therefore no modifications are proposed. -- Analysis of Public Safety Impact The modifications proposed for valves in group A and for valves 1-CS-SA & 5B, 1-IC-3, 1-LP-7A & 7B, 1-LP-10A & 10B, and 1.-SW-9 are planned during the Fall 1985 refueling outage. For all but the valves in Group A and 1-SW-9, the 1 MILLSTONE UNIT 1 IhTEGRATED .9AFFTY ARRFRRWP.*r DD/Y:DW
following analysis estimates the reduction in core melt frequency and public (3 risk if the changes proposed to the valves are implemented. An assessment of potential risk reduction from modification of the valves in Group A was provided in a letter from J.F. Opeka to H.R. Denton dated Sept. 30, 1985. For some of the valves, the public safety impact is evaluated by perfonning sensitivity studies on the Millstone 1 Probabilistic Safety Study Interfacing System LOCA analysis (Method A). The remaining valves are not amenable to direct numerical calculations and therefore engineering judgment based on insights from the P.S.S. is utilized in assessing their benefit (Method B). A. Valves 1-LP-7A,B and 1-LP-10A,B These four M.O.V.s are located in the reactor building. As discussed in Section 3.2.24 of the Millstone Unit 1 P.S.S., the operation of all four valves is needed to ensure success of Alternate Shutdown Cooling. M.O.V.s 1-LP-10A,B are also needed for the purpose of L.P.C.I. injection into the Reactor Pressure Vessel (R.P.V.) to recover and maintain the water level. For a break in the drywell, these valves are not exposed to high temperature or humidity. These valves would be exposed to high radiation if gross fuel failure occurs. However, if the L.P.C.I. system is operating, gross fuel failure would not occur (See Success Criteria in Section 2.1 of the Millstone Unit 1 P.S.S.). If the L.P.C.I. pumps have failed, operation of M.O.V.s 1-LP-10A,B is irrelevent as the L.P.C.I. pumps supply the flow through these valves. Similar arguments apply for a break in the turbine building. For an unisolable break in the reactor building, qualification of these valves (or any valves) does not provide any benefit. This is because ultimately all inventory will eventually be lost through the break, thus resulting in severe core damage. For an isolable break in the reactor building, these valves can be used in the Alternate Shutdown Cooling procedure for long term decay heat removal. M.O.V.s 1-LP-10A,B are also needed for L.P.C.I. injection into the R.P.V. However, other reliable systems are available to recover and maintain , the R.P.V. level following the break isolation (e.g.: Feedwater, Isolation v Condenser with C.R.D. flow) . Therefore, the effect of potential loss of MILLSTONE UNIT 1
L.P.C.I. injection capability following the isolable break in the reactor /3 building is neglected. V To calculate the effect of loss of Alternate Shutdown Cooling.for isolable breaks in the reactor building, it is assumed that without environmental qualification, at least one of these four M.O.V.s will fail, rendering the Alternate Shutdown Cooling inadequate for long term decay heat removal. Frequency of isolable breaks in reactor building is estimated to be 1 x 10-5/ year. The estimation considered interfacing system LOCAs in the Core Spray, and Reactor Water Clean-Up (R.W.C.U.) systems, and breaks in Feedwater, steamlines and Isolation Condenser systems piping. For an isolable break in the reactor building, the Feedwater and Main Condenser remain viable long term decay heat removal systems. This is because the pumps and the valves which have to change state are located outside the reactor building. It was assumed that modifications needed to qualify these four valves are required for operation of Alternate SDC following a break in the reactor building. The change in core melt frequency if these four L.P.C.I. system valves are qualified is calculated by the following equation:
- A Isolable-LOCA IOW+OMC) (l~0 ALT SDC)
Where: A lsolable-LOCA = Frequency of Isolable breaks, 1 x 10-5/ year Qg = Unavailability of FW, 6.65 x 10-2 Ogg = Unavailability of Main Condenser, 3.96 x 10-2 QET.SDC = Unavailability of Alternate SDC procedure, 1.61 x 10~ . This value assumes normal operation of valve following a break. If the four L.P.C.I. system valves are qualified, the core melt frequency will decrease by 9.0 x 10~I, about 0.1% drop. This will reduce the public risk by x 100 Man-Rem over tne remaining life of the plant. MT1
l B. Valves 1-LP-15A,B and 1-LP-16A,B 4 ( , As discussed in Section 3.2.20 of the Millstone Unit 1 P.S.S., these are j nonnally closed containment spray valves in the reactor building. For a break i in the reactor building, when these Valves may be exposed to high temperature and humidity, there is no conceivable reason for operation of drywell sprays to depressurize the primary containment. This is because the break is outside of the primary containment. For a break in the drywell, these valves could be exposed to high radiation if gross fuel failure occurs. However, if the L.P.C.I. system is operating, such fuel failure can not occur (see Success Criteria in Section 2.1 of the Millstone Unit 1 P.S.S.). If the L.P.C.I. pumps have failed, operation of drywell spray valves become.s irrelevent since the L.P.C.I. pumps also supply the drywell spray flow. Therefore, qualifying valves 1-LP-15A,B and 1-LP-16A,B will result in no reduction in core melt frequency or public risk. C. Valves 1-CS-51,B As shown in Figure 1, 1-C L5A and 5B are normally closed core spray injection valves located in the reactor building. The major benefit of qualifying these two valves will be in isolating an interfacing system LOCA caused by an operator error during surveillance testing. These valves are tested quarterly. The ter. ting procedure requires the operator to close 1-C b4A (or 4B) before opening 1-CS-5A (or 5B). This step ensures that the low pressure piping-(upstream of 1-CS-4A or 4B) is not exposed to full system pressure in case of leakage or failure of the check valve 1-CS-7A (or 7B). There are safeguards built into the system which prevent simultaneous opening of both valves (1-CS-5 and 1-CS-4) while the reactor is at full pressure. This interlock is in parallel with the Low Pressure Permissive (LPP) , signal described in Section 3.2.17 of the Millstone Unit 1 P.S.S. Failure of either the interlock or a false signal from the LPP will allow the operator to MILLSTONE UNIT 1 INTERATm garr n esqresven onev-nau
open valve 1-C L 5 (A or B) before closing 1-CS-4(A or B). If such an operator error occurred and the check valve 1-CS-7A (or B) failed, the low pressure piping could fail initiating an interfacing system LOCA in the reactor building.- Environmentally qualifying valves 1-CS-5A (or 5B) will allow the operator to isolate such a break. Without such environmental qualification, valve 1-CS-5A (or 5B) may fail *due to the harsh environment caused by the LOCA. . In that case, the LOCA will remain unisolable, leading to a core melt. t The frequency of scenarios leading to the interfacing system LOCA described above is conservatively estimated to be 5 x 10-6/ year. Therefore, qualifying valves 1-CESA (and 5B) will reduce the core melt frequency by 5 x 10-6/ year (neglecting the probability of a qualified valve failing to close). For breaks at other locations, environmentally qualifying 1-CS-SA (or SB) has an insignificant benefit on core melt frequency or public risk. , For isolable breaks at other locations in the reactor building, other reliable systems (e.g. Feedwater, Isolation Condenser with C.R.D. flow) are available to recover the R.P.V. water level. Therefore, the effect of failure of M.O.V.s t 1-CL 5A or SB will have an insignificant impact on the core melt frequency or L public risk. For a break in the drywell or turbine building, M.O.V.s 1-CS-5A and 5B are not 4 exposed to high temperature or humidity. The valves would be exposed to high radiation if gross fuel failure occurs. However, if the Core Spray system or L.P.C.I. system is operating there would be no fuel failure (See Success criteria in Section 2.1 of the Millstone Unit 1 P.S.S.). If the Core Spray system fails, operation of 1-CS-5A or 53 becomes irrelevent as the Core Spray pumps supply the flow. Total reduction in public risk over the reclaining life of the plant by qualifying 1-CS-SA and 5B is estimated to be 375 Man-Rem. D. Valves 1-IC-2, 1-IC-3, and 1-IC-4 Figure 2 provides the valve line-up for the Isolation Condenser (IC).1-IC-3, a nonnally closed valve, is the only valve which has to open to place the IC in MILLSTONE UNIT 1 nTenuten carew accecc -i ,----
~
service. M.O.V.s l'-IC-2 and 1-IC-3 are located in the reactor building. 1-IC-4 is located in the drywell. These three valves and 1-IC-1 (also located in the drywell) get a close signal on high flow in case of a break in the IC piping. The qualification effort for 1-IC-3 requires replacing the motor operator. Replacement of the motor operator is expected to increase the reliability of t.he valve not only in the harsh envirorrcent but also in the normal / mild i environment (Valve 1-IC-3 has exhibited a high failure rate, i.e. 7 failures in l last 15 years of plant operation). Any improvement in the valve reliability is expected to have an insignificant impact on core melt frequency for the accident producing harsh environment in the reactor building (i.e. a break in thc rcs:.tcr buildir.g) . However, for all other transients any improvement in reliability of 1-IC-3 will improve the overall reliability of IC system and will reduce the core melt frequency and public risk. The exact magnitude of benefit in core melt frequency cannot be calculated as the anticipated improvement in the valve reliability at present is an unknown. , Valve 1-IC-4 is located inside the drywell. This valve is normally open and n V will close if a high steam flow in IC piping caused by a break is detected. For a break in the IC piping inside the drywell, closure of 1-IC-4 will not isolate the break. If the break occurs outside the drywell,1-IC-3 is norir. ally closed and will remain closed; the closure of 1-IC-4 is not needed to isolate the break on the return side of IC piping. Therefore, replacement of the valve 1-IC-4 operator will provide no benefit on the core melt frequency or public risk. Valve 1-IC-2 is located in the reactor building on the inlet side piping of the IC system (see Figure 2). This valve is normally opened and will close in case high steam flow is detected. If the break occurs in the drywell, closure of 1-IC-2 does not isolate the break. If the break occurs in the reactor building,1-IC-1, which is inside the drywell, will close and thus isolate the break. Note, for this scenario, 1-IC-1 will not be exposed to a harsh environment since the valve is located in the drywell and the break is in reactor building. The only benefit of environmentally qualifying 1-IC-2 is in the scenario where 1-IC-1 also randomly fails. In that case, operation of , 1-IC-2 will allow isolation of the break. However, this is an extremely low MILLSTONE UNIT 1 INTEGRATED SArETY ASSr.SM LT PRmRm
probability scenario and as shown below, the decrease in core melt frequency is insignificant. AA: A LOCA OIC-1 (I ~ EIC-2) Where: Frequency of a break in the reactor building in A LOCA = Isolation Condenser piping, 4.0 x 10-I/ year (this value is based on WASH-1400 data of 2.0 x 10~I/ year /section). Q IC-1 Probability of 1-IC-1 failing to close, 4.9 x 10-3 O Probability of 1-IC-2 failing to close, 3.0 4 - IC-2 10-3 Assuming the valve is environmentally qualified, otherwise the probability is assumed to be 1. Replacement of the motor operator to environmentally qualify 1-IC-2 will decrease the core melt by 2.0 x 10-9/yr, which will reduce risk to the public by 0.1 Man-Rem. E. M.O.V.s 1-CU-2 and 1-CG-3 Reactor Water Cleat >-Up (R.W.C.U.) system valves 1-CU-2 and 1-CU-3 are normally open valves (see Figure 3). M.O.V.1-CU-2 is located in the drywell and M.O.V. 1-CU-3 is located in the reactor building. These valves get a close signal if high flow in the R.W.C.U. System is detected. The principal reason for high flow is a break in the R.W.C.U. piping. The only benefit of qualifying valves 1-CU-2 and 1-CU-3 is the ability to isolate a break in the R.W.C.U. piping. If the break occurs insice the drywell, closing of 1-CU-2 or 1-CU-3 will have no impact on the break isolation. If the break occurs outside the drywell, valve 1-CU-2 can isolate the break. Note, since 1-CU-2 is located inside the drywell, it will not be exposed to harsh environment due to a break in the reactor building. The only benefit of environmentally qualifying the valve 1-CU-3 is in the scenario where 1-CU-2 also randomly fails. In that case, operation of 1-CU-3 will allow isolation of the break. However, this is a low MILLSTONE UNIT 1 INTEGRATED SAFETY ASSESSMEhT PROGRAM
frequency scenarjo and provides only a smal] improvament in core mel t. frequency: ID LU M* LOCA CU--2 O (I - OCU-3} c Where: A = Frequency of a LOCA in the R.W.C.U. piping in the reactor LOCA building, 2.4 x 10-I/ year. There are 12 sections of R.W.C.U. piping in the reactor building with failure rate of 2.0 x 10-I/ year /section, based on WASH-1400 Data. Q = Probability of 1-CU-2 failing to close, 0.11 (The test CU-2 interval for the valve is 22 months). Q = Probability of 1-CU-3 failing to close, 6.6 x 10-2 (the test CU-3 interval for the valve is 22 months). Assuming the valve is environmentally qualified, otherwise the probability is i assumed to be 1.0. I Replacement of the motor operator to environmentally qualify 1-CU-3 will i decrease the core melt frequency by 2.5 x 10-I/ year, which results in a reduction of 18 Man-Rem in public risk. Qualifying 1-CU-2 will have no benefit in core melt frequency. F. M.O.V.s 1-RR-2A,B The purpose of the recirculation pump piping valves 1-RR-2A,B is to prevent spillage of L.P.C.I. flow following a break in the recirculation piping. This is schieved by closing the valve in the intact loop as a part of L.P.C.I. loop selection logic (see Section 3.2.20 of the Millstone Unit 1 P.S.S.). If the valve in the loop, selected for L.P.C.I. injection fails to close, L.P.C.I. ! flow could flow through the recirculation pump and out through the break, thus bypassing the core. It is estimated that flow bypass of the core is a concern
- only for breaks > 0.01 ft.2 in area 1.e. s=all and large break categories (see
! Section 2.4.8 of the Millstone Unit 1 P.S.S. for break size c.lassification). For smaller breaks, the R.P.V. water level can be recovered even in presence of spillage of L.P.C.I. flow through the break. i i MILLSTONE UNIT 1 IhTEGRATED SAFETY ASSESSMEh7 PROGRAM
fq The qualification effort for valves 1-RR-2A,B requires replacement of the motor C operators, which would ensure that the valves are capable of closing in the harsh environment, following a break in the recirculation piping.. The benefit in core melt frequency can be calculated by assuming that without the valve qualification, they will not c3 o'se, causing L.P.C.I. flow to spill (i.e. L.P.C.I. System becomes ineffective). Decrease in core melt frequency, can be calculated by the following equation: AA = (Ag+ASB) OCS (I ~ OLPCI) Where: A SB = Frequency of a small break in recirculation piping, 1 x 10-3/yr. A g= Frequency of a large break in recirculation piping, 1 x 10-4/yr. unavailability of core spray system, 1.39 x 10-3 QCS = QLPCI = Unavailability of L.P.C.I. System, 4.45 x 10-2 O Replacement of valve operators for 1-RR-2A,B will decrease core melt frequency by 1.5 x 10-6/ year, which results in a reduction of 60 Man-Rem in public risk. G. M.O.V. 1-MW-%A Valve 1-K4-96A is locatrd on the discharge side of the emergency condensate transfer pump, which allows transfer of inventory from the condensate storage tank to the hotwell following initiation of F.W.C.I. or feedwater (See Section 3 2.11 of the Millstone Unit 1 P.S.S. for details). The qualification effort for 1-KJ-96A requires adding radiation shielding between the valve and the Reactor Building Equipment Drain Tank (R.E.E.D.T.). For any transient or LOCAs, no fuel damage is expected if WCI or Feedwater runs successfully. If fuel damage were to occur due to some failure in WCL reedwater, then guaranteeing the operability of 1-KJ-96A is irrelevent. Therefore, adding a radiation shield for valve 1-KJ-96A offers no improvement in core melt frequency or public risk. MILLSTONE UNIT 1 _ _1""* Y" *!f"" M *"*?_?_'? "P?i"_-- ._ --, -- -
m Results l Table 2 summarizes the reduction in core melt frequency and public risk which can be achieved, if the changes necessary to environmentally qualify the valves are implemented. The benefits of all valves, except 1-Ic-3, can be numerically quantified. For 1-IC-3, almost all benefit is from the sequences which do not result in a harsh environment in the reactor building. For sequences which do result in a harsh environment in the reactor building, any modifications to 1-Ic-3 has an insignificant inpact on core melt frequency or public risk. If all valves listed in Table 2 are qualified, the total reduction in core melt frequency is 7.7 E-6 (1.0% reduction) which results in a reduction of 553 4 Man-Rem in public risk. This provides a score of 1.5 for the overall project.
. O e
i i l O
TABLE 1 O List of Valves PrapaM for Qualification Valve Proposed Change ! 1 I 1-LP-9A,B Close-Arm Switches on Control Board 1-CS-2A,B n 1-CS-4A,B n t
- 1-LP-10A,B Motor operators to be replaced n
1-LP-7A,B . 1-LP-15A,B n 1-LP-16A,B n n 1-CS-5A,B n 1-RR-2A,B a 1-IC-2, 1-IC-3, 1-IC-4 , O 1-CU-2, 1-CU-3 n i 1-SW-9 Torque switch to be replaced 1-MW-96A Radiation shielding to be added 4 d i 1-CU-28 No change is needed n j 1-LP-13A,B 4 i i O MILLSTONE UNIT 1 INTEGRATED SAFETY ASSESSMENT PROGRAM
(S TAIEE 2 S maary of Resulta Valve Decrease in Core Decrease in Melt Frequency Public Risk 1-LP-7A,B (1) 9.0 x 10-I/yr. 100 Man-Rem. 1-LP-10A,B i-D-i5A,B 0.0 0.0 Man-Rem. 1-LP-16A,B 1-CS-SA,B 5.0 x 10 /yr. 375 Man-Rem. 1-IC-3 (2) 1-IC-2 2.0 x 10-9/yr. 0.1 Man-Rem. 1-IC-4 0.0 0.0 Man-Rem. 0.0 1-CU-2 0.0 Man-Rem. j 1-CU-3 2.5 x 10~I/yr. 18 Man-Rem. 1-RR-2A,B 1.5 x 10 /yr. 60 Man-Rem. I 1-MW-%A 0.0 0.0 Man-Rem. 7.65 x 10 /yr ( 1.05) 553 Man-Rem. Notes: 1. All four valves are needed for Alternate Shutdown Cooling and Containment Cooling. 4
- 2. Excluding effects of the valve environmental qualification on sequences not resulting in harsh environment.
- , u C
3 o t - a
. t t
x r .
. g, ut P M
U r F r g
~ -
r g o- f 4 3 r A R r S M E _ .- E R T x_ , O C S Y
- gA S I
S Y N A
, j R
i. l
- I , , P,!
- -A S I 8
d1 , !,
! E L H R 4'
1 F~ S D O 1 F t e s C , r D e10 AC f 1 R S t O I t M aE E rt t t O - e E 4 T 4 wRA t ot f R
> > t 8 s f S
T U
- El WS T s' tAS ewt S
i sE WC 0 8 I G F l i O E t C
. L L T r wA Af E F S t t
. l l I C nR ,'
0 T S i t C e eB E
.E
'5 E L f P u wt e1 1
8
- T T lM L o s N i S M
n t E I r r A- _OM A T C 0 P n : l 4 W L I
- O .
5 r O S L F
-- "6 e
MOM A I 2 gM l l i 1 H Dl f ] C t IS S t i o . M _u A 5 . E A t 6 i rC 1 / e ri S W n t n 4 a 6 , n e I b\- - 5 0 x r o s j _ i c 3
. o S
R L m O i LE L r S u C S w n A S v o E Ev i i l f r n
% S C
C t h
___ _ _ _ _ ._. _ _ _ . .. .. .. __m._ _ _ . _ _ _ . _ _ _ _ . _ _ _ . _ _ _ . . . _ _ . . . _ . . _ _. _ _ . . s %
~
t l i i i . { 10 Alp. cost 1sti:E It[ AC10ft Illitt.littlG prtywt t t. j \
. \ TO
..,.illt11- 0;y-e.ec.a a :
e - sc- e F) , e-ec-r eec.e a l i . h- - rrtO8A DEACTOR VE SSEt. ! vent 4 Ml lXI-- g '- e.sc .s e ese.ss l e , t i . j s sc-se l l '
't><3 l
- I
- i I
{ t )f .-{'- . - 4 \ ~~ 9 9C e F 9.sc es i , , ,e . , M im ! ; TO
> FIE Ac t ort h.[ A.
i .,c .,o t . ,c . .. y
-sc 3 s .ec.4 VESSEt.
j e rene.e
' cofiptNSalE .
8 rsne-4 HU LM"8 _ j e rene -4si ren cc,, 4 - t><! N - " e n==sr a *n enos retsstene rirene l C JIS@E OF ratose rent r'ne ne an Con t taement se t _ } Wa t t se l
- i l FIGURE 2 ISOLATION CONDENSER SYSTEM 0
8 ;
/\
() O n U
. - .. m .
, c,, ._
,ec
, 7i
.->,4 _ - a 1'
.iCM- .(P.f
= Ni f..l .w=E, ca===
[g .c,,. , n n._i d < _ w.v.vww -.f- -< _
' - r '
-(-l
. . c.. ,
qi T i1 iit N -
.,,,, .e
..c.
^-
....c.,
. c....ci s-- - *.~w- - = ' - = e
. i -t . -.
(U ) t_1 g, I I t <1 we aw.- - u
, . e,1,, c co-se a
( { ,h .. J q[ e
<_ .....o,
= X 1
==
A.i .. ..., l P ( -) X __ _ _ _ _ v o ... l 8 concensta ., ><! - i /g-x FIGURE 3 REACTOR WATER CLEANUP SYSTEM y n X ' c"*' 1
- Ua_
_j. ; =I= hM-3 S
....,,.,,,o.,,.....
. ...cc v..t.. .. . io
-.......,,,....c.
' et* e
,l]:.
vi r-L rN J (s-. N o n y ~c- e- c
, Q -) .\ Y Q) j'
, L a b
' 'a a'a
- c. .. ., e pq] _g ,t _ 4. 4 l l'I
' - jr"j " ] l l- >I4
.. ....... - ,i< a[e h
A.T.W.S,: Upgrading of the Standby Liquid Control System
- ISAP #1.18 p Safety Issue V
To mitigate Anticipated Transients Without Scram (A.T.W.S.), each boiling water reactor uses the three following systems: o Alternate Rod Insertion (A.R.I.), diverse from the Reactor Protection System to provide an alternate path for actuating the scram pilot valves, o Recirculation Pump Trip (R.P.T.), to automatically trip the Recirculation Ptanps. o Standby Liquid Control System (S.L.C.S.), capable of injecting sodium pentaborate solution into the core. - The Millstone Unit 1 design currently incorporates all of these features. Because of the severe nature of A.T.W.S. transients, prompt operator actions are taken to address two basic concerns: o Reduce heat input to the torus while the S.L.C.S. is being
, injected.
o To maintain stable steam condensation loads on the torus to maintain torus (containment) integrity. The operator is required to initiate S.L.C.S. promptly and to lower the R.P.V. water level. Lowering R.P.V. water level reduces the core power and thus heat load on the torus. Following this, the operator needs to depressurize the R.P.V. when the torus heats up to the heat capacity ' temperature limit (H.C.T.L.). Lower R.P.V. pressure eliminates unstable steam condensaion as the
, torus heats up. With the current 43 g.p.m. S.L.C.S., any error in operator judge:cnt or even a significant delay in action will lead to severe core damage.
The current S.L.C.S. design provides a flow rate of 43 g.p.m. at 13 weight
- percent sodium pentaborate solution. Upgrading the S.L.C.S. by increasing the q flow rate to 86 g.p.m. (or boron equivalent in shutdown worth) will reduce the time it takes to inject the necessary amount of boron required to achieve hot
; shutdown. Upgrading of the S.L.C.S. to 86 g.p.m. injection rate is thus O
MILLSTONE UNIT 1 INTEGRATED SAFETY ASSESSMENT PROGRAM
.. - - . x ---_ _ - - - - - _ _ _ -
'cupected to improv3 the cbility cf M111gtone' Unit 1 to cope with A.T.W.S.
sequences of the types already considered in the Millstone Unit 1 Probabilistic Safety Study. Proposed Pro. ject . The current S.L.C.S. at Millstone Unit 1 (discussed in Section 3.2.22 of the Mill::tene Unit 1 P.S.S.) provides a now rate of 43 g.p.m. At this rate it takes about 35 minutes to inject the amount of boron necessary (270 lbs.) to achieve hot shutdown. The proposed project is to obtain a now rate of approximately 86 g.p.m. of 13 weight percent of sodium pentaborate or the equivalent. (The actual n ow rate will be calculated for Millstone Unit 1 based on R.P.V. diameter, core" power, etc.) The options to lichieve this being considered are: o Increase the n ow rate to 86 g.p.m. via providing the capability for 2 S.L.C. pump operation. o Increase the concentration of sodium pentaborate to achieve the equivalent of 86 g.p.m. at 13 weight percent Use enriched boron (B10) in the sodium pentaborate solution to O o achieve the equivalent of 86 g.p.m. at 13 weight percent. Analysis of Public Safety 3mpact The public safety impact of this proposed project was assessed using Method A. All three options reduce the time it takes to inject the required amount of sodium pentaborate and achieve hot shutdown by 50%. The proposed system, like
, the current one, will be manually initiated. The purpose of the analysis presented here is to evaluate the relative merit of 86 g.p.m. capability and not which is the best way to achieve it.
'All A.T.W.S. events can be classified into one of two categories:
- 1. A.T.W.S. events where the Main Condenser remains available for heat removal.
- 2. A.T.W.S. events where the Main Condenser is isolated and the core heat is discharged into the torus. The most severe transient in O
MILLSTONE UNIT 1 IEEGRATED SAFETY ASSESSMENT PROGRAM
this c tsgory io initisted by the M.S.I.V.s ciscing. Ther: fora, this category is discussed assuming the initiator is the M.S.I.V. closure. O During A.T.W.S. events where the Main Condenser is available, core power begins to increase as the feedwater subcooling increases following turbine trip. The i operator is instructed to run back and then trip the recirculation pisnps (See EDP 572, Appendix 2B of the Millstone Unit 1 P.S.S.). The recirculation pumps need to be tripped before the M.S.I.V.s close on high steam flow or Turbine Bypass Valves (T.B.V.s) close on low condenser vacuum. In such an A.T.W.S. event, the core power increases above 105%, which is the capacity of the Millstone Unit 1 Main Condenser. Therefore, the Main Condenser will slowly begin to loose vacuum, which eventually causes the T.B.V.s to close. Following recirculation pump trip, core power drops to about 50 - 555. At this point, the operator can initiate the S.L.C.S. However, the plant is in a_ quasi-steady state where the feedwater system and Main Condenser maintain the R.P.V. water level and pressure. In this scenario, the rate at which the boron is injected is not significant. Hence, increasing flow rate of S.L.C.S. from 43 s.p.m. to 86 g.p.m. does not offer any advantage. If the operator fails to trip the recirculation pumps before isolation of the R.P.V. occurs (due to either M.S.I.V.s or T.B.V.s closing), it becomes an A.T.W.S. event with the Main Condenser isolated, which is discussed next. In an A.T.W.S. event initiated by M.S.I.V. closure, the recirculation pumps trip automatically on high dome pressure. As shown in Figure 1, the core power decreases to 30 - 355, but slowly returns to 50 - 555 as the feedwater
, maintains the R.P.V. level. The results presented in Figure 1 represent a generic plant response, obtained from Reference 1. A similar response would be
- expected for Millstone Unit 1. Millstone Unit 1 emergency procedure EOP 575 l (See Appendix 2B, Millstone Unit 1 P.S.S.) directs the operator to lower the j R.P.V. water level to reduce heat input to the torus. As shown in Figure 2, i when the torus heats up to 164 cF, EDP 580 also requires the operator to depressurize the R.P.V. to maintain the heat capacity temperature limit i (H.C.T.L.) of the torus.
l O MILLSTONE UNIT 1 IEEGRATED SAFETY ASSESSMER PROGRAM i
_. - _. . .~. - . - . _-_ . _ _- . . .
- With the prssent cyctem, 270 lbs cf boron needs to be injected to achieve hot shutdown.
It takes about 34 minutes to inject the boron. During injection, the boron stratifies in the lower plenum. After the required amount of boron is injected, the operator raises the R.P.V. water level to its nomal value. The resulting natural circulation flow set up .in the core readily mix.es the boron 2 (Fipre 3, Reference 1). i The public safety benefit of 86 g.p.m. can be evaluated in two ways. If the 1 operator follows the emergency procedures, the peak torus temperature will be lower. With 86 g.p.m. S.L.C.S., the A.T.W.S. event becomes more manageable via operator actions. With increased time available not all operator errors result in severe core damage. These two points are separately considered. Analysis performed for the Browns Ferry Nuclear Plant (Reference 2) shows that increasing the S.L.C.S. flow rate from 50 to 86 g.p.m. reduces the peak torus
! temperature from 195 F to 173"F (See Figure 4). If analyzed, Millstone Unit 1
) would show a similar reduction in the peak torus temperature. The benefits of 1 this effect, however, cannot be quantified using PRA techniques. Emergency procedure E0P 575 (See Appendix 2B, M111 sone Unit 1 P.S.S.) directs i the operator to lower the R.P.V. level when the torus heats up to 110 F to j reduce the core power and thus heat load to the torus. With the existing system (43 g.p.m. S.L.C.S.), this step is necessary to prevent containment overpressure (and possible failure) caused by torus boiling. With 86 g.p.m. j S.L.C.S., since the time needed to inject the required amount of boron is l reduced by one half, such an operator action, although highly desirable, is not l required to ensure containment integrity. Therefore, the benefit of 86 g.p.m. ] , S.L.C.S. can be deterinined by eliminating those core melt sequences associated i with this operator action. } To determine the torus temperature, if the operator fails to lower the R.P.V. j water level, a simplified torus heat-up calculation was perfomed. At a rate of i 86 i g.p.m. and 13 weight percent, the time needed to inject 270 lbs of boron is about 17.5 minutes. Since the operator has not lowered the water level, the natural circulation flow in the core will readily mix the boron and the core ' power will begin to drop. A core power transient shown in Figure 5 was assumed ; i i ! MILLSTONE UNIT 1 ! I INTEGRATED SAFETY ASSESSMEfff PROGRAM l 1_ . _ _ . . _ _ _ _ _ _ _ - _ _ _ _ _ . _ . _ _ _ _ _ _ . _ _ _ . _ _
,in the t:ru3 he:t-up criculttion. This power tran',1cnt 19 based Cn the following assumptions:
m o Initial core power, at the time of S.L.C.S. initiation is 555 ()) o A one minute time delay exists between the time boron is injected and it becomes fully active in the core. o Core power drops linearly as boron concentration in the core increases (linearly).* o Core power drops to 75 when hot shutdown is achieved (core decay heat) o Operator initiates S.L.C.S. at a torus temperature of 110 F. Making these asstanptions, the torus begins to boil at about 17 minutes. The containment pressure by the tfac hot shutdown is achieved is expected to be less than il psig. In other words, with 86 g.p.m. S.L.C.S., failure of the operator to lower R.P.V. water level does not result in a containment failure. In the Hillstone Unit 1 P.S.S., it was assumed that a core melt is inevitable following containment failure. The reduction in core melt frequency can be calculated as shown below. With the O current S.L.C.S., the frequency of A.T.W.S. core melt sequences are:
'-] A= A $ Qgp3 HEPQ 1 OHEP2 +
O CA2+A)ORPS 3 HEP 3 With the upgraded S.L.C.S. system (86 g.p.m. or equivalent), the frequency of these core melt sequences becomes: O O O A*A 1 RPS HEP 1 HEP 2 OSLCS + O U (A2+A)ORPS 3 HEP 3 SLCS The reduction in core melt frequency can then be computed as: A= A 'Q O
$ RPS HEP 1 OHEP2 (l'OSLCS)
- O (A2+A)ORPS 3 HEP 3 I14SLCS)
These expressions are evaluated using the following values: A$ = frequency of reactor transients with Main Condenser available, 3.109/yr. A = frequency of reactor transients with Hain Condenser unavailable, HILLSTONE UNIT 1 INTEGRATED SAFETY ASSESSHENT PROGRAM
0.435/yr.
, A3= frequen y f loss of normal power, 0.124/yr.
QRPS: unavailability of the Reactor Protection System, 5.4 x 10-5
'd QHEP1= human error probability for failing to trip the recirculation pumps before Main Condenser is isolated due to M.S.I.V. closure or T.B.V. closure, 1 3 x 10-2 -
QHEP2= c i nal n error prow 1Ry for failing to lower R.P.V. water level given an error in failing to trip recirculation pianps, 1.0 QEP3= human err r probability for the operator failing to lower R.P.V. water level,1.3 x 10-1 . Results Upgrading the S.L.C.S. to 86 g.p.m. (or the equivalent) will result in a drop of 6 x 10'0/yr in predicted core melt frequency (0.75% decrease).'All of this reduction comes from plant damage state TE2 (See Section 2.2 of the Millstone Unit 1 P.S.S. for the definition of the plant damage states). The resulting risk reduction is about 450 Man-Rems over the remaining life of the plant. A score of 1 out of 10 is thus assessed for this project.
- Refersoons
- 1. " Power Suppression and Boron Remixing Mechanism for General Electric Boiling Water Reactor Emergency Procedures Guidelines," NEDC-22166, August 1983
, 2. " Severe Accident Sequence Analysis Program Anticipated Transients Without Scram Simulations for Browns Ferry Nuclear Plant Unit 1,"
NUREG/cR-4155, EGG-2379, February 1985. i MILLSTONE UNIT 1 , IhTEGRATED SAFETY ASSESSMENT PROGRAM
O . O .O
~
12 O. - 5 5 1 NEUTRON FLUXtv.) 2 AVE. SURFACE HEAT FLUX (%) 3 CORE INLET FLOW (%) 2 4 INLET SU9 COOLING (BTUIL9) 8 O. 5 CORE AVE. VOID (%) 2 2 1 7 ' I 1 4
.. 3 3 3
, .. 4 j o. -....I ..il _l i I ,,,_ i O. 4 O. 00. 120. 16 0. l FIGURE 1: CORE POWER FOLLOWING RECIRCULATION l PUMP TRIP (Ref.1) , i f *
.. . - , . . - . . . . . . ~ - . . - - . - . . . . . . . - _ . . . . . - - - - - - _ _ - - - -
/ ///
DO NOT OPERATE IN THIS AREA a a 18 0
;- ~a2 160 =
150 0 10 0 200 300 400 500 600 700 M)O 900 1000 110 0
- RPV PRESSURE (PSIG) i i
l FIGURE 2: MILLSTONE UNIT 1 TORUS HEAT l CAPACITY TEMPERATURE LIMIT
- CURVE l
O O O. .
- l .
t i .
~
1 l 100 - g 50 *f.
- g MIXING I Id I c '
Z m
- z O
.' u ! T - ! F ,
- o 50 -
- z -
I R I i ! n' Z l O E 1 0 1, m 1 ) 1 l l 0 l I , j O. 5 10 15 i CORE FLOW (*/. RATED) i FIGURE 3. NATURAL CIRCULATION BORON REMIXING TIME 1 i CONSTANT vs CORE FLOW NOTE: BORON REMIXING TIME CONSTANT IS DEFINED AS THE TIME REQUIRED TO RAISE IN-CORE NERAGE BORON CONCENTRATION TO 50% OF TOTAL VESSEL NERAGE BORON f CONCEN TRATION
O
. j FIGURE 4: TORUS WATER TEMPERATURE SENSITIVITY STUDY FOR BROWNS FERRY, REF. 2 300 , , ,
i i
$ 200 -
3 .-. --- - -- g i e
- 3 c:
N 100 - N s 8
*" SLCS FLOW RATE 50 GPM l
t
--- SLCS FLOW RATE 86 GPM t t t 500 1000 1500 2000 -
j 0 TIME, SECONOS l l O !. - - - ~ - - _ . _ _ . . . _ _ _ _ _ _ _ _ _ , _ _ _ _ _ _ _ , _ , _
FIGURE 5. CORE POWER TRANSIENT ASSUMED IN MILLSTONE 1 TORUS HEAT-UP CALCULATION l I E w TIME BORON { n. BECOMES EFFECTIVE IN THE CORE O q 0.55 l b i z l 9 i G i s i b i E I d W y 1 2 I w HOT SHUTDCMN ACHIEVED E I CORE POWER DROPS TO 8 l DECAY HEAT LEVEL
- I
- O.07- l ,%, ;
l l '% ! O 1 MIN. 18.5 MINS. TIME % a i 86 GPM SLCS i ! STARTS I. _ , , . . - _ . , . . - . . _ . . . . - . _ . . . . - . . . . . , , . ..._,..._.._,,-____m. . _ _ ,. _. . . _ .
13AP #1.21 Fault Transfers j-( Safety Issue The current Millstone Unit 1 design utilizes Automatic Bus Transfer switches (ABT's) to assure that certain vital electrical loads receive power from redundant sources. Because of this design, concerns have been expressed that
, the parallel operation of redundant power sources could result in their comon mode failure under faulted modes of operation. In particular, if a fault wer::
present on any of the loads which are connected to one source of power and this resulted in a low voltage condition, the ABT could potentially transfer the I same fault to the second power source. Such a transfer would cause the failure of both sources due to the subsequent protective breaker isolation ibnction. i 4 The worst case that could occur is when each of the redundant supply buses was powered separately by one of the two sources of site emergency power, i.e. the gas turbine and diesel generators. For Millstone Unit 1, there are 7 ABT's that fall into this category: 0 480 VAC MCC EF-7, Diesel generator motor control center (Powers 1-SW-9, the non-vital cooling loop isolation valve in the Service Water System.) 0 120/240 VAC VAC-1, Vital AC switchboard (Provides 120V AC power to the Feedwater/F.W.C.I., and a number of control board instruments including level Andicators.) 0 120/240 VAC IAC-1, Instrument AC switchboard 0 480 VAC MCC EF-3, LPCI MOV's 1-LP-10B & 9B (Powers the L.P.C.I. injection MOV and no.mally open globe stop check valve.) 0 480 VAC MCC FE-3, LPC1 MOV's 1-LP-10A, 9A and 8A (Powert. the L.P.C.I. injection MOV, normally open globe stop check valve, and normally open L.P.C.I. loop cross-tie MOV.) 125VDC MCC EF-3, MCC control power 125VDC MCC FE-3, MCC control power HILLSTONE UNIT 1 INTEGRATED SAFETY ASSESSMEhT PROGRAM
Pmposed Project At the present time, there is no formal project to further investigate the fault transfer issue, or to modify the present AC power system to eliminate the ABT's. Analysis of Public Safety Impact Currently, 1 of the 7 ABT's is disanned and is not available to automatically transfer the loads of one load group to the power source of another. The emergency feeder breaker has been racked out so that the ABT cannot auto-transfer to the second source of power, following failure of the normal , source. This was modeled in the Millstone Unit 1 P.S.S. by not taking credit for automatic functioning of the ABT, although operator manual recovery of MCC E-7 was considered at 1/2 hour and 2 hour time intervals for loss of normal power events. Emergency procedures allow the operator to recover the MCC by first opening the breaker to the normal source and then racking in and subsequently closing the breaker to the emergency source. This action ensures that the two redundant sources are not tied together. The ABT on 480VAC MCC O EF-7 is the only one that is disamed from automatic operation. The 6 remaining ABT's that are presently not disarmed were analyzed using Method A, as described below. 120/240 VAC Instrtunent A.C. (IAC-1) and Vital A.C. (VAC-1) Switchboards The transformers that provide normal and emergency power feeds to the IAC-1 and VAC-1 switchboards are being replaced with regulating transromers during the upcoming outage. The transformers will provide isolation between the redundant , feeds by limiting the fault current to 150% of normal full load. The transformer load side feeder breakers will be fitted with ground detection that will trip long before the 480 VAC breaker is tripped themally. This eliminates the concern of a fault being transmitted between the redundant power , sources, tripping the redundant MCC feeder breakers. The frequency of challenge to these MCC breaxers due to a bus fault and combined failure of the ground detection trip is calculated by: O HILLSTONE UNIT 1 INTEGRATED SAFETY ASSESSMENT PROGRAM
l A(breek::r chal3cnge) = A(bus fcult) x Q(trip fails) where: A(bus fault) = 8.8 x 10~"/yr. and, Q(trip fails) = 6.14 x 10-N/D (- . Substituting these values: A(breaker challenge) = (B.81 x 10-N/yr.) x (6.14 x 10'N/D)
= 5.4 x 10-7/yr.
due to each bus having a transfer.ed fault. Since there are two buses (i.e. , j IAC-1 and VAC-1 as shown in Figure 1), the total frequency of breaker challenge is 1.1 x 10-6 . It should be noted that this frequency is only related to the challenge imposed on the redundant MCC breakers and is not the frequency of station blackout (SBO) where all AC is lost. Using the split fractions for loss of onsite AC and the frequency of loss of normal offsite power (LNP) from the Millstone Unit 1 P.S.S. model, the frequency of 5B0 is calculated as: ASB0
- ALNP x Q(1 ss of onsite)
Substituting ALNP = 0.12/yr. and Q(loss of onsite) = 1.*l7 x 10-2 A SB0 = 2.1 x 10-3/yr. The frequency of challenge to the MCC breakers due to transferred bus faults is more than 3 orders of magnitude less than the frequency of having a station blackout. Accordingly, it is judged that the use of ABT's in conjunction with the regulating transformer trip protection, will not significantly impact the probability of losing both redundant sources of power. O MILLSTONE UNIT 1 IhTEGRATED SAFEIT ASSESSMElE PROGRAM
. 480VAC MCC's IF-3 and FE-3 The ABT's that are presently installed on MCC's EF-3 and FE-3 provide redundant motive and control power nourcen for the motor operated injection valves on each L.P.C.I. loop. These ABT's are as follows:
0 480 VAC MCC EF-3 provides motive power for the 'B' LPCI injection valves 125 VDC EF-3 provides control power for the 480 VAC MCC 480 VAC MCC FE-3 provides motive power for the 'A' LPCI injection valves and the cross-tie valve 125 VDC FE-3 provides control power for the 480 VAC MCC If the ABT's were disarmed, then some other method for providing redundant power to the valves would have to be developed. One way to accomplish this and avoid electrical fault transfers would be to provide redundant injection pathways on each L.P.C.I. loop. Redundancy would consist of parallel piping for injection, with independent valves powered from separate electrical sources on each of the parallel pipe sections. As noted earlier there are no formal plans for a project, so that an equivalent substitute for the ABT's is unknown at this time. However, in order to show the importance of the present ABT's, the Millstone Unit 1 P.S.S. model was requantified with the assumption that they would be removed and not replaced. The Millstone Unit 1 P.S.S. L.P.C.I. fault tree model in Section 3.2.20 was requantified for those support states where ABT's had to function by assuming an ABT unavailability of 1.0. The results of quantification, using a '*new" unavailability for L.P.C.I., show a 0.4% increase in core melt frequency. Almost all of the change is due to plant damage states that have early melt times associated with them. The corresponding increase in public risk is calculated, using a multiplier of 0.5, as follows: O MILLSTONE UNIT 1 INTEGRATED SAFETY ASSESSMENT PROGRAM
6
. R = (3 x 10-6/yr.)(0.5)(3 x 10 Man-Rem)(25 yr.)
= 113 Man-Rem .
Results If the ABT's on the Vital and Instrument AC Switchboards are disarned there is ) a minor reduction in reliability and no significant improvement in avoiding the I loss of multiple electrical buses. Accordingly this would result in a score of l 0 out of 10. If the ABT's on the L.P.C.I. motor operated valve power supplies are disarmed without providing some equivalent means of assuring L.P.C.I. l injection, risk increases by 113 Man-Rem. This particular change is given a l score or -0.25 on a scale or -10 to 10. { O O i . MILLSTOE UNIT 1 INTEGRATED SAFETY ASSESS!EE PROGRAM
~
O O O-
~
MCC F5 MCC E4 101 AB3 DIE SEL W REGUI. ATit1G WW IR P-1 G/T IV-l 1H A NSF ORMER T%
-}~--- A. B. T.
F LV wilEE t, l 15 CD a) < M c N. AC MOT ilMER MOT l Gell ' bbb] MCC ES MCC FS ' GEN GEN MECH ANIC AL
- - - - -.- - I/-~~h~
~ ~~ -
ABT - - - - - - - ------ -ABT ~ ~~' f -.-
- -- - ' INTERLOCKS VIT A L A C. I N S T. A.C. RPS-A RPS-B FIGURE l VITAL AC -lNSTRUMENT AC RE ACTOR PROTECTION BUSES
, l.A. COMP M5-4
- TBSCCW PUMP IA TBSCCW PUMP IB .
I SOCS l' UMP IA SDCS PUMP IB I, l i ( 14E 4I60V I4F 4160V NOTESr . ' i . T - TRIP ON LNP TIE BKit 12 E /12 F T X- 1 RIP ON LMP a RECLOsED w Q '*0- @- NOT TRIPPED .
# @' El ri 8 G '.* ':$
r2 'A ;{ .!. ; ' A I- Ez, ,
l
_O~ .. _
, A8T -
A ll I . $ - 1 FE3 o Er3 p , ,4 + LPCI A Og Lf'CI ,D "V' " V r4 gA s )} E e4 F5 b ES r6
- E6 ABT (DISARMED) @
h' _ w..n.a a ur f'. .
*" Eri . D/0 nOOM ,
,l s s y MOV SW-9 ,
s -,
/ / ,
/ Er9 ----/ ,
- l. - -
MEY IN T EftLOCK . I'lGURE 2 400 VOLT DISTRIBUTION 12E - 12F BUS , l
*f I C Ali TOPIC 1.2I .. . ,
p ISAP Topic No.1.22
. () Electrical Isolation Scope of Project At the present time, there is no specific project associated with this issue.
Safety Issue There is a concern about the adequacy of electrical isolation between safety-related equipment and nonsafety-related e guipment. Currently, no isolation devices exist between: 1) the nuclear flux monitoring system and the process recorders and indicating instruments, 2) the APRM system and the process computer, 3) the RPS channels and their respective power supplies, and 4) the . main steam line radiation monitors and the nonsafety-related indicators and
- reco-ders. If isolation devices are not placed between the equipment, there is a possibility of hot shorts occurring.
PRA Assessment Methods A and B were used to assess this issue. Method A involves quantifying the increase in core melt frequency due to hot shorts if no isolation devices are placed between the safety-related and the nonsafety-related equipment. Results The change in core melt frequency due to hot shorts in the positive direction,
+125V, for the nuclear flux monitoring system is 4.19E-9/yr. (.32 person-rems).
For the main steam line radiation monitoring system it is 1.06E-8/yr. (.8 person-rems). A hot short in the negative direction,-125V, inhibits a signal such as high nuclear flux or high radiation. If a hot short of -125V occurred between the nuclear flux monitoring system and the process recorders and indicating instruments, the reactor would still be able to trip on low-low reactor water level. A hot short of -125V in the main steam line radiation monitoring system causes a failure of the MSIVs to close on a steam line break outside containment on high radiation. This is negligible since there is a redundancy on automatic signals that will cause the MSIVs to close: 1) low-low recctor water level, 2) main steam line high flow, 3) main steam line tunnel high temperature, and 4) main steam line low pressure. Thus, the public risk is insignificant when concerning hot shorts. Isolation between the APRM system and the process computer dces not impact public safety. Computer failures will not compromise the safety-related inputs i because these inputs are isolated by flying capacitors. Isolation of the RPS is determined to have zero impact since the failure of the RPS is totally dominated by common mode mechanical failures. Electrical failures due to inadequate isolation do not contribute significantly to the overall RPS failure probability. O Score 0/10 l
", ISAP #2.01 LPCI Remotely Operated Yalves 1-LP-50A-8B Safety Issue ./Ni V The Millstone Unit 1 Technical Specification Section 3.7 (Reference 1) requires that torus water level be maintained within allowable limits. Therefore, the operator needs to periodically drain.the torus as its water inventory increases due to normal leakage. The torus is deained by manually opening two normally f closed valves 1-LP-50A and 50B. Following an accident, the operator may also need to drain the torus. Such an operation may be needed for example to cool the torus by removing hot water from it and replenshing it with cool water (feed & bleed operation) or during clean up. If the accident resulted in significant fuel damage, the area where these valves are located may become inaccessible due to high radiation level. The project proposes a remote operation capability of these valves, which will ensure capability of draining torus water even when high radiation levels are present.
Proposed Project As shown in Figure 1, the valves 1-LP-50A & B are located on the "B" side of the L.P.C.I. system cross-tie. Flow from these lines is discharged to the Radwaste system. Two options for the remote operation capability of valves 1-LP-50A and B are being investigated, which are: 0 Add motor operators to the valves l 0 Add reach rods to the valves to allow manual operation from remote location (about 40 ft. above the valves). Analysis of Public Safety Impact and Results l The public safety impect of this proposed project was evaluated using Method B. Addition of remote operation capability to the valves 1-LP-50A and 50B does not affect the course of a transient. However, following a severe accident with l significant fuel damage, this capability will be helpful in clean-up operation , and this may limit any fbrther release to the public. O MILLSTONE UNIT 1 IhTEGRATED SAFEIT ASSESSMENT PROGRAM i
It was Envisioned that the remote operation capability of the velves 1-LP-50A and B may allow the operator to perfom a feed and bleed operation on the torus. Such an operation could provide a method of removing long term decay heat. The sequence envisioned was as follows: ) 0 Discharge core decay heat into the torus via opened a safety / relief (S/R) valve. O Remove hot water from the torus via the valves 1-LP-50A & B C Replenish the torus water with cold water from feedwater system (via the opened S/R valve. However, success of feed and bleed operation required a torus draining rate of , about 1000 gpm. The actual draining rate of the torus (which can be achieved through a 3" line) and the capacity of the liquid rad waste system are too small to provide any appreciable cooling to the torus. 1 The negative impact of this proposed modification has also been found to be insignificant as discussed next. Addition of remote operation capability of valves 1-LP-50A and B may slightly increase the probability of inadvertently opening the valves during an accident. Even if the valves are left open, its effect on the transient is negligible. The only concern will be diversion of the LPCI pump flow to the rad waste system. The amount of flow diversion will be small (few hundered gpm) and will not change the success criteria for the LPCI system. In any case, the operator error of inadvertently opening the valves is restorable by closing the valves. Based on above considerations and the engineering judgment, a score of 0.1 out of 10 is assigned to this project. Reference !
- 1. " Millstone Unit 1 Technical Specifications", Docket No. 50-245
- O MILLSTONE UNIT 1 INTEGRATED SAFEIY ASSESSMENT PROGRAM
O . O O -
=
is. ... ' * * . '# co r....E , .. R., tines A_g , , _ S_M eco"'a'""e"' 5eaat t'"' isao]: *ao$ p.. 7.q ;ja,. : [o 's=
< sao;[
' 'D8 &1 8U' ' : [oue f&a' ,
,U , ...
.. o: ::[oi . . . i .o)::( o...
conNu"u"En TORUS TORUS SPftAY LINE rSPRAY LINE TORUS TEST LINED { l 4" $P HEADE l TORUS TEST LINE II) n \\ c a.. _ Ol*a l'* *aT! = c A ..av, ia ,
.=
# , % .o.. pg .....ay to- e , ....
I z
.. 3.
DO comraswmEnf coutswo S.
;a_I
$ Q sora h ta
_h isoas p N o..o-se so contasuuEng cootiu, W ][]( ao) ( @ Ql[HEAL ENGHANGER HEAT EXCHANGER ][ EPE ROF98CT E ME R GENCY se RvicE sE RvicE WAIER WATER FRoM CST M-NOTE. ALL VALVE NUMBERS DIAGRAM ARE PRECEEDED BY LP FIGURE I LPCI SYSTEM
ISAP Topic No. 2.02 O Drywell Humidity Instrumentation Scope of Project The proposed project is_ concerned with performing an engineering evaluation to determine the best method for monitoring humidity, airborne, gaseous, and particulate contamination in the drywell. Monitoring these parameters will provide the capability of detecting a leak or increase in RCPB leakage altnost instantaneously. The scope of the project does not include implementation of the study recommendations. Safety Issue Millstone ' Unit I currently employs the following two methods for detecting primary system leakage in the drywells o Draining of Identified and Unidentified Leakage Sumps The inventory of both sumps is pumped out once every 4. hours. Based on the amount of liquid that is pumped to radwaste, an average leak flow rate from the reactor coolant pressure boundary (RCPB) can be calculated. i o Drywell Air Sampling , Whenever the drywell is vented, an air sample is also analyzed to determine the degree of airborne contamination. An increase in RCPB i leakage over the normal value is detected by a correspondingly higher activity level of contaminants in the air sample. The drywell is vented and the air is sampled on an average of once every 2 days. i l Neither of these two methods provides a continuous leak detection monitoring scheme. There is a concern that the lack of such a system, would allow piping cracks to propogate unnoticed to the point that the { leak flow rate becomes significant. By adding the capability of continuous Jeak detection, the probability of having a LOCA can be reduced. PAA As:essment I The public safety impact oI the preposed project was assessed using method B. ( Almost all RCPB piping in the drywell is made of stainless steel except for the main steam and feedwater lines, which are fabricated from carbon steel. However, both main steam and feedwater lines are high energy lines which are maintained at elevated temperature during normal operation. Stress corrosion J cracks in stainless steel piping propogate at a very slow speed (about 10 mills / month). Such cracks in carbon steel piping also propogate at similarly low speed when the piping is at a elevated temperature. Therefore, a pipe in the drywell will either rupture instantaneously due to some heavy load dropping on it l or it will develop a crack that propogates over many months, ultimately leading to a rupture. I i l i l
> \
3 (V Results
' Any method of leak detection cannot provide ample warning in those scenarios where the IOCA develops instantaneously. The current practice of' draining drywell sumps every 4 hour 0 provides adequate warning of slowly developing cracks. The proposed project to add humidity and contamination monitoring will only provide a back-up to the existing practice. Therefore, this project is assigned a score of 0.05 out of 10.
Score 0.05/10 O , i I l l l l O l t l
P
~ ISAP Topic No. 2.03 Process Computer Scope of Project '
The project consists of engineering, design and construction nanagement services for the replacement of the process computer. Safety Issue There is no significant safety issue associated with this project. Because the Millstone Unit I process computer is nearing the end of its useful life, it will have to be replaced in the near future. At the present time, the process computer is only required to be operable in a rod worth minimizer function while moving control rods below 20% rated power. The computer does not exercise control over any of the plant systems so that its failure does not affect steady , state operation of the plant. PRA Assessment The project was analyzed using method B. As stated earlier, the present process l computer does not directly interface with other plant systems and is therefore i not capable of either inducing or mitigating transient events. However,it might I be desirable to use the enhanced trending capability of a new computer in an anticipatory role which could help operators to prevent certain transients before they occurred. For example, main condenser vacuum could be trended and alarmed on the computer such that the alarm setpoint is well below that required m for turbine trip. Having an alarm setpoint that is based on vacuum trend could alert operators to take corrective action and restore condenser vacuum by starting the hogging pump. l Results The ability to anticipate transier)ts before they occurred would help to rbduce I the frequency of core melt and, consequently, public risk. Based on engineering judgement, it was concluded that this project should be given a score of 0.5 on a scale of 10. Score 0.5/10 l l l l l
- l l
l i .i lO i i l l
ISAP #2.04 High Steam Flow Setpoint Increase Safety Issue i At present the existing warranty for the Main Steam Turbine at Millst requires weekly surveillance testing of the Turbine Stop Valves. This weekly surveillance testing requires reducing the core pow 6r from 100% to 90% to prevent Main Steam Isolation Valve (M.S.I.V.) closure on the resultant high steam flows in the non-affected steam lines (which occurs at 120% of rated steam flow). Any time in which the plant is maneuvered in increased power there is an chance of a plant transient resulting in reactor' trip. The freque of such events was evaluated in Study. It is the Millstone Unit 1 Probabil'istic Safety proposed to increase the M.S.I.V. closure setpo;Lnt from 120% to 140% of rated steam flow. This will allow turbine stop valve at full power closure testing and will eliminate one of the more frequent causes for a power reduction (the other predominant causes being backflushing , the condenser and ' on-line condenser tube plugging). ' In raising the high steam flow setpoints for M.S.I.V. closure it must also be recognized that the potential exists for certain steam line breaks (outside containment) not being automatically detected and mitigating actions take increase in the M.S.I.V. closure setpoint would thus have the effect of replacing an automatic action (for a certain size break) with a manual ac . Proposed Project t No hardwcre modifications are required. The setpoint for H.S.I V be . . closure will increased from 120% to 140% of rated steam flow and ths weekly power reduction for turbine stop valve testing will be eliminated. Analysis of Public Safety Impact i The public safety inipact of this proposed project was assessedA.using M As discussed in the Bases Section.3.2 of tne Millstone Unit,1 Technical
\ Specifications, the primary function of M.S.I.V. closure on high steam is flow to detset and isolate a break in the steam lines downstream of the M ,
1 l l
-_. _ __. - - __ __ _ _ . - . _____._.__._._..__E'E~ _ . . _ . _ , . -
l
~
(e.g.: outside prima y containment). Tne only adverse effect of increasing the setpoint was found to be for those steam line breaks which result in a flow . rate between 120% and 140% in the main steam lines. If the proposed change is implemented, these specific breaks instead of isolating automatically will require the operator to manually close the M.S.I.V.s. 1' The meth'od of analysis was to detennine the frequency of breaks downstream of the M.S.I.V.s with specific break areas corresponding to steam flows between
~
120% and 1405. These breaks can be mitigated by the operator isolating them . (by closing the M.S.I.V.s). The following assumptions were made: 9 The frequency of a break which results in a flow rate between 120% and 140% in the steam lines is 1/Sth of frequency of break with any flow ~ area. The main steam lines are provided with Venturi's which limit the flow rate to 2005 in case of a double ended break of a steam line. In other words,' the spectrum of break sizes in the steam lines will result in ' flow rates between .100 and 200%. The specific break i sizes of interest represent 20% of the entire range. O It is conservatively assumed that due to blowdown of steam in the react'or building, all mitigating systems in the reactor building do not operate. The feedwater system which is located in the turbine building will remain operable. A break in the turbine building is not iO as severe since all mitigating systems locatedi'n the reactor building will remain operable. Therefore, all breaks in the turbine building
, are treated like breaks in the reactor building.
There are 40 se:tions of the steam lines downstream cf the MSIVs (10 sections per steam line). Frequency of a pipe (>3" diameter) break per section is 1 x l 10-10/ hour (based on WASH-1400 data). The frequency of a break in any one of 4 l - steam lines with a flow area resulting in a flow rate between 120 and 1405 , ~
;. would be 7 x 10 / year. .
h If the operator fails to isolate the break but the feedwater system continues x to run, the " unmitigated blowdown outside the drywell will result in a late core melt with containment by-passed. (This would be a Plant Damage State SL2', see - l . i . l
Section 2.2 of the Millstone Unit 1 P.S.S.). As discussed in the second assumption, .the feedwater (W) may be the only r.itigating system available. Tnerefore, failure of the W will result in an~ early core melt with the containment bypassed (i.e. the PDS SE2).
\
i l The i increase in plant damage state frequencies, if the project is implemented,
' was calculated by the following equations:
A 3g : A LOCA HEP ( ~OW ASE2
- LOCAOW Where: A = frequency of a LOCA, 7 x 10-0/ year. ~
LOCA Q HEP = Human error probability of the operator failing to isolate the break, 1 x 10-2 Qg = Unavailability of W system post trip,1.031 x 10-2 1 i Results If the M.S.I.V. closure setpoint is increased from 120% to 140%, the frequencies of the plant damage states SE2 and SR are expected to increase by 7 x 10~0/ year, each. All other Plant Damage States would be unaffected. This results in a total increase in the core melt frequency of 1.4 x 10-7/ year (less than 0.02% increase) and in public risk of 15 Man-Rem assumptions (e.g. even when conservative that environmentally qualified equipment in the reactor building would fail due to a harsh environment) are utilized. This project has > l been assigned a score of -0.05. The negative score indicates an actual increase in the public risk. e e o t
i s i ISAP Topic No. 2.05 Hydrogen Water Chemistry , Scope of Project The scope of this project is to study the feasibility of initiating a hydrogen water chemistry program at Millstone Unit No.1. 4 Safety Issue The presence of free oxygen in the primary coolant has been related to the phenomenon of intergranular stress corrosion cracking (IGSCC). Hydrogen water chemistry involves adding hydrogen gas to the feedwater system to suppress oxygen formation in the core. To ensure removal of excessive hydrogen and to control the concentration of non-condensible gases, oxygen gas is added at the recombiners. Implementation of hydrogen water chemistry therefore, requires twa new process gas subsystems for the plant; a hydrogen injection system and an oxygen injection system. PRA Assessment
- The project was analyzed assuming implementation of a hydrogen water 4
chemistry program at Millstone Unit No.1. Methods A and B were employed to address the benefits and the risks of such a program. Millstone Unit No. I currently employs an extensive primary system inspection and repair program to monitor and limit the IGSCC phenomenon. This inspection ] and repair program is sufficient to assure that IGSCC does not represent an
- immediate safety concern. Although introduction of hydrogen water chemistry may eventually lead to a reduced scope in the inspection program, the combined programs will be conducted such that a comparable safety level concerning IGSCC is maintained. Therefore, no reduction in core melt frequency due to the j effects of hydrogen water chemistry on the IGSCC phenomenon was determined.
Implementation of hydrogen water chemistry results in a significant increase of
! radioactive Nitrogen-16 concentration in the steam lines. The main steam line i high high radiation trip setpoints will have to be adjusted whenever hydrogen water chemistry is initiated to account for the increased oackgrot.nc'. hilure to i
correctly adjust the setpoint is assumed to result in reactor trip on high-high radiation in the main s: cam line. This results in an increase in the frequency in
, reactor transients with main condenser unavailable initiatiag event and a corresponding increase in core melt frequency of approximately DCM =
i 5.0E6/ year. (Based on assuming a rule based operator errc,r of 1.3E-t per demand and 9 setpoints adjustments per year, 6 due to trip events and 3 due ta maintenance activities.) l The hydrogen injection and oxygen injection subsystems also increase the j potential risk due to fires and explosion at the plant. However, implementation of a hydrogen water chemistry program is assumed to be accompanied by j installation of appropriate safeguards to minimize the fire and explosion risks (such as hydrogen monitors, excess flow safety valves, etc.). Therefore, the i change in fire and explosion risk is negligible compared to the present fire j induced core melt frequency. 4
J Results Implementation of a hydrogen water chemistry program at Millstone Unit No. I results in an increase in core melt frequency of 5.0E-6/yr. due to an increase in reactor transients with main condenser unavailable events. This corresponds to an increase in exposure of approximately 375 person-rems. 5cof_e_
-1.0/10 O
ISAP #2.06 Retubing the Millstone Unit 1 Main Condenser
/~N Q Safety Issue There are four basic ways to remove core decay heat at Millstone Unit 1; these are: ,
o Feedwater and the Main Condenser o Isolation Condenser o Shutdown Cooling System o Alternate Shutdown Cooling From an operational point of view use of the Feedwater and Main Condenser is the preferred option because these systems match decay heat immediately and'use systems the operators are very familiar with. Should the Feedwater and Main Condenser systems become unavailable, the operator would use one of'the other available decay heat removal systems. The condition of the present condenser tubing in the Millstone Unit 1 condenser is degrading with passing time as a result of erosion and corrosion. This necessitates periodic tube plugging and on-line sawdusting in the water boxes. The principle concern with allowing continued tube degradation is that condenser tube failures cause a decrease in plant reliability and availability. Condenser tube failures of significant magnitude can also pose a safety concern due to the fact that they result in high feedwater conductivity. Such a condition is slanned and is procedurally responded to by isolating Main Feedwater and carrying out an emergency plant shutdown. Such events are Reactor Transients with the Main Condenser Unavailable and were evaluated in detail in the Millstone Unit 1 Probabilistic Safe y Study (P.S.S.). 71 W Project i The pmpond pmject is to completely replace the existing condenser tubing with titanilan tubes which are not subject to the same failure mechanisms which exist with the current tubing. No-thsast Utilities is currently evaluating the retubing of the cor. denser mainly due to operationL1 and emnomic , 3 considerations. ..
~ ~ ' - - ~ - - - . - - , , , _ _ . _ . . _ _ . _ . . _ _ . . , _ _ _ _
~
the 0."M increase ir. predicted core melt frequency. Results . Table 1 stznmarizes the results of'the sensitivity study used to determine the ir.Gact of this proposed project. Approximately half of the change in the predicted core melt frequency is due to plant damage states that result in late core melt with the remaining half coming from plant damage states that produce early and interinediate core melt' times. Computing the change in public risk as a result of retubing the Main Condenser results in avoiding an increase of 506.25 Man-Rems over the life of the plant. This equaty ,to an impact score of approximately 1.25 on a scale of 10.0. 6 O l i
)
l I l l l O - O S M . N S WG teem e
--- - , . - - - , - - - . . - , , , - . , , . - . - - - - - . . , - - . , - - - . - - , , - - . , - ~ . , . . - - - - - . - , - - - - - -
Table 1 Impact of Not Retubing the Millstone Unit 1 Condenser Base Case Without Retubing (As-Is) M.S.I.V. Closure Frequency 0.435/yr 0.568/yr Plant Damage State Frequencies TE1 2.57 x 10 2.59 x 10 TE2 1.41 x 10-5 3,g4 , jo-5
# 2.27 x 10 TI1 2.26'x 10 TL2 8.25 x 10-5 8.58 x 10-5 SE1 1.54 x 10-5 1.54 x 10-5 SE2 2.54 x 10-7 2.54 x 10-7 SI1 - 1.85 x 10 1.85 x 10 4
SL2 8.59 x 10-6 8.59 x 10 4 4 AE1 1.37 x 10 1.37'x 10 AE2 2.30 x 10-9 2.30 x 10-9 AI1 1.60 x 10-5 1.60 x 10-5 l r b 1 l O O .
~
')
ISAP #2.07 Soditan Hypochlorite System Safety Issue Millstone Unit 1 currently uses a' chlorine gas injection system to control { biofouling growth in certain plant cooling water systems that use seawater for l cooling (Service Water cooling for the diesel is a good example). At. present, j l the source of the chlorine is a. railroad tank car which holds 55 tons of chlorine gas in liquid form under pressure. In the unlikely event that this gas was released in large quantities and the wind direction and speed are within certain limits, the consequences to plant personnel and the public living in residential areas close to'the site boundary could be significant. Replacement of this gasecus chlorination system is being considered because of the potential risk of a major chlorine gas release that would expose both plant personnel and the publ,1c to a non-radiological safety hazard. Proposed Project The proposed project addresses concerns raised by the chlorine gas storage issue through the development of an alternative system using liquid sodium hypochlorite. This project was initially proposed to address concerns for the safety of plant personnel. A. Analysis of Public Safety Impact The public safety inpact of this proposed change was assessed using Method C. Public safety could be impacted in one of the following two ways: o tbe release of chlorine gas could incapacitate plant operations personnel and indirectly result in a core melt accident. o the release of the chlo-ine gas under ce.* air weather conditions could directly cause offsite fatalities due to its toxicity. Eliminating the inventory of chlorine gas would tins result in two sources of benefits which are evaluated separately. MILLSTOE UNPI 1 __ _ _ . _ _ _ _ _ _ "P " * %'
- N' * *~ * *"' """* " " '
A*A O CR RT OW/RT (OIC + OICMUP) O -where:ACR is 'he t frequency of chlorine' releases [ QRT = 1.0, given :nanual scram . QW/RT = 1.031 x 10-2, unavailability of feedwater given reactor trip (Table 2A-8 Millstone Unit 1 PSS) QIC = 2.19 X 10-2, unavailability of automatic , isolation condenser (Table 2A-5 Millstone Unit 1 PSS) QICMUP= 2.78 x 10-2, unavailability of automatic isolation condenser maxeup (Table 2A-6 Millstone Unit 1 , PSS) Combining these values yields the frequency of chlorine relaase initiated core melt events. , A=A CR(5.124 x 10-4) The value of A CR is developed in the following section. , B. Benefits From Avoiding Public Exposure to Chlorine Gas Chlorine gas in sufficient quantities.can produce adverse health effects and death in humans. An additional analysis was performed to determine the public risk inpact from exposure to a chlorine gas release. As a first step in the 3 analysis, all potential release pathways to the environment were identified for the present chlorine gas system. A satellite PRA model was then developed to screen out those paths that did not lead to a significant release of gas. (Most , of these pathways were of greater concern to the plant personnel safety inpact model.) Results from the model led to the subsequent formation of two release categories based on the amount of chlorine that would escape to the environment. The release categories and their associated pathways are oescribed below. A catastrophic release of chlorine caasM ty gross failure of the , 0
*4
- railroad tank car is estimated to occur with a frequency of roughly '
1.9 x 10-5/yr. Such a catastrophic failure can result from any of the f o Spontaneous tank car rupture (considering two tank cars
~
MILLSTONE UNIT 1 INTEGRATED SAFETY ASSESHENT PROGRAM
1 release which is caused by f Using the nodel for the intermediate continuous premature relief valve opening, the site boundary concentrations are predicted l 3 to be 1,100 mg/m . This value is still over 24 times the chlorine toxicity limit and 855 of the lowest lethal, concentration for humans. In order to calculate the number of individuals that would be exposed to the two types of releases, the effective offsite population within 2km was ! estimated. The calculation was based on site specific data for the. probability < of wind direction and the number of people living offsite. Results of the - calculation yield an effective offsite population of 100 persons. The following assumptions were made in calculating the number of persons i affected by the two type os releases and in converting the resultant effects to Man-Rems equivalent exposure. Following a catastrophic release from the chlorine tank car, it o was assumed that persons living at the site boundary would be exposed to chlorine concentrations in excess of 100 times the toxicity limit (i.e. four times lethal dose). Persons living at theedgeofthe2kmradiuswereassumedtobeexposedtof\ times the toxicity limit (i.e. lethal dose). Thus, it was cluded i that all 100 persons would suffer severe long term healtt. affects l or possibly death. g l , o The intennediate continuous release produces approximately 1/4 the concentration of chlorine that the catastrophic release does. A::cordingly, it was assumed that only 25 individuals wculd suffer I I severe long term health effects due to chlorine exposure. o It was asstaned that each severe health effect, experienced by a member of the offsite population, is the equivalent of a l radiation induced latent cancer. Accordingly, a value. of 10" d Man-Rems was assigned to each severe health effect. O MILLSTONE UNIT 1 I INTEGRATED SAFETY ARTRMENT PROGRAM i _ _ _ . - _ _ _ _ _ . _ . _ _ __ _ _ _._ _ _ - - - _ _ . _ _ _ _ . _ . -
1 l i ISAP #2.08 Extraction Steam Piping Replacement i Safety Issue ,
~
A number of operating nuclear power plants have experienced severe erosion and
, failures in thejr extraction steam piping. Such failures are a potentially severe risk to operations personnel should an extraction steam line fail while they are in close proximity. Within the last five years there have been a number of fatalities in the industry which have occurred due to these types of failures.
As the industry problem with extraction steam piping erosion became evident an
' extensive inspection of extraction steam piping at Millstone Unit 1 was .
undertaken. Results from the inspections conducted at the last Millstone Unit 1 outage showed that the 8th, 9th and 11th stage extraction steam piping from the low pressure turbine had significant erosion degradation. In terms of plant response to such an event, an extraction steam pipe failure ,- will most likely lead to an M.S.I.V. closure event of the type already analyzed in the i Millstone Unit 1 Probabilistic Safety Study. Such events result in the l isolation of the Main Condenser as a decay heat removal system. ! Proposed Project l1 t The proposed project is to replace the affected extraction steam piping to prevent further erosion which could lead to subsequent piping failure. Replacement will consist of installing new pipe and associated hardware that has been upgraded to better resist erosion than the present carbon steel piping. Analysis of Public Safety Impact h
- Tne public safety impact of this ;eoposed project was evaluated using Method A.
Based on industry experience, severe erosion of
~
result extraction steam piping can ' not only in steam leaks but pipe rupture as well. In the event of such a rupture, the M.S.I.V.'s would autorratically respond by isolating lhe main
+ - - - - ., . . - - - , - - , -.-
steam fines from the downstream pipe rupt'ure. In doing so, trie Main Condenser is lost as a decay heat removal system. This increases the initiating event frequency for M.S.I.V. . closure and pipe break outside of containment. Implementation of this project thus provides two benefits: o the likelihood of a future steam pipe rupture outsi'de of containment is reduced c the likelihood of a future M.S.I.V. closure event is reduced.
.Each of these potential benefits was evaluated separately.
- 1. Benefits Frcan Avoiding a Future Pipe Rupture Outside Contairunent Implementation of the proposed project avoids the potential of an increase in public risk due to unisolated steam line breaks outside of the containment resulting in core melt. The potential increase in public risk due to this type of scenario was determined to be wholely insignificant due to the availability i
of redundant and diverse ways to isolate an extraction steam pipe rupture. The mechanisms considered include: O o M.S.I.V.s, located both inside and outside of containment which can be closed automatically on high steam flow or manually by the operator in the unlikely event that automatic detection fails. o two sets of turbine stop valves which can be closed by tripping the turbine. In view of these available options and the long time periods available for the !j operator to take manual action from the control room, the benefits from avoiding a potential M.S.I.V. closure are found to be much more significant. B. Benefits Frcan Preventing a Future M.S.I.Y. Closure Event Implementation of the proposed project also avoids an increase in the M.S.I.V. closure frequency. Tne publ'ic safety impact of this benefit was evaluated using the Millstone Unit i P.S.S. model as a base case. The sensitivity of increased M.S.I.V. closure , frequency (due to extract:Lon steam piping rupture) on the core j melt frequency was then calculated. Tne estimated increase in M.S.I.V. closure frequency is 0.5/yr. based on the actual piping wall thickness at Millstone Unit 1 and the erosion thinning rates for extraction lines as experienced by the indastry.
. Calculations show that 90% of the extraction steam piping weld e
9 lh joint will be at the 30; minimum threshold for wall thickness (the industry standard for initiating such pipe replacement) towards the epd of Millstone Unit l's current fuel cycle. If the piping is not replaced during the refueling outage, it is assumed that field repairs will be made to areas of the piping where leaks have been observed. DurinC the following cycle, which is assumed to last 24 calendar months, most of the unrepaired welds will be close to 0% wall thickness near the end of cycle. Again, if the piping is not replaced, it is assumed that repairs will be made during refueling. The above implies that the _ extraction steam piping will have degraded to a point where failure would be expected to occur at any time during an operating cycle. If it is conservatively assumed that one failure could occur during each operating cycle that the pipe is not replaced, then the frequency of such an event is 0.5/yr. (i.e.1 failure in each 24 month operating cycle). The Millstone Unit 1 P.S.S. model was requantified after the MSIV closure frequency was increased by 0.5/yr. failure. to account for extraction steam pipe (~~s
\~- Results of this sensitivity study r.re shown in Table 1, and indicate that the core melt frequency increases by ~2.7% 1.e., from 8.07 x 10-N/yr..to 8.29'x 10~N/yr.
Results O i The results of the sensitivity study indicate that the frequency of plant da= age states TE1, TE2, TI1, and TL2 will increase slightly as a result .of not replacing the existing extraction steam piping. The Man-Rem impact of this , proposed project was evaluated assuming that the extraction steam piping will in any case be replaced within 10 years. Thus the exposure time T = 10 years is used instead of the 25 years of remaining plant life. It is concluded that the extraction steam pipe replacement would cor. serv'atively result in the savings of j 709 Man-Rem to the public. -Accordingly the project was given a score' of 1.75 i out of a possible 10. - ' e ("'h R/ l 1 O O e
Table 1 Impact of Not Replacing the Ertraction Steam Piping at Millstone Unit 1 1 Base Case Without Extraction Steam (As-Is) Piping Replacement M.S.I.V. Closure Frequency . 0.835/yr ! 0 935/yr
, /
Plant Damage State Frequencies TE1 2.57 x 10-" TE2 2.62 x 10-4 1.41 x 10-5
- 1.53 x 10-5 TI1 2.26 x 10-4 2.30 x 10-"
TL2 8.25 x 10-5 9.49 x 10-5 SE1 1.54 x 10-5 _ 1.54 x 10-5 SE2 2.54 x 10-I 2.54 x 10-7 SI1 1.85 x 10-4 : SL2 1.85'x 10-4 8.59 x 10-6 AE1 8.59 x 10-6 1.37 x 10-6 1 37 x 10-6 AE2 2.30 x 10-9 AI1 2.30 x 10-9 1.60 x 10-5 1.60 x 10-5 -) l l l 8, O - i
' i l
l I
. i
ISAP Topic No. 2.09 i O Upgrading P&lDs Scope of Project The proposed project involves upgrading the P&lDs to correct any inaccurate information so that the as-built and as-configured systems are properly 1 reflected. Safety Issue The piping and instrumentation diagrams (P&lD) are used by technical staff in
. the design process or by operational and maintenance personnel in the conduct of their respective duties. As a result of such widespread usage, it has been recognized that some of the Millstone Unit 1 P&lDs contain errors. For example, some of the system configurations, valve line-ups and high to low pressure piping boundaries are incorrectly shown. As a result, there is a concern that an inappropriate decision could be made or endorsed based on incorrect information obtained from the P&lDs. As an example, maintenance personnel could isolate a piping system at an inappropriate location based on incorrectly
, shown low to high pressure piping boundary and create the potential for a leak or pipe rupture. Also, because operational personnel may use P&lDs during an accident to devise recovery of a system, the procedure for ad-hoc recovery may be incorrect if the information presented in the P&lD is not correct. l PRA Assessment , The public safety impact of the proposed project was assessed using method B. The effect of using inaccurate information from the P&lDs to make design modifications is insignificant, because the P&lDs are most frequently used to make preliminary design changes only. Before the design is finalized, a walkdown is usually performed. Therefore, any design changes error, based on incorrect information from the P&lDs will be detected and corrected at that time. The operational and maintenance personnel are intimately familiar with the as-built configuration of the plant and any error in the system configuration as shown by the P&lDs will be apparent to them. Although highly unlikely it is conceivable that an incorrectly shown configuration could result in a maintenance error or unsuccessfully recovery of a system during an accident. 4 Note, the system P&lDs are not used to determine value line-up, instead system operating procedures are used for that purpose. Therefore, any error in valve j line-ups as shown in P&lDs will no influence on safety. j Results l Based on the arguments presented above and engineering judgement, this project is assigned a score of 0.1 out of 10. Score 0.1/10 t i
0 ISAP Topic No. 2.10 Drywell Ventilation System Scope of Project - The scope of the project is to perform an engineering evaluation of the following oroposed modifications to the drywell/ ventilation system: o Installation of refrigeration equipment to reduce cooling coil inlet water temperature and drywell bulk air temperature. o Removal of the inlet plenum on AVH-26 to improve air flow and temperature patterns in the drywell.
% faty issue A trend of increasing drywell air temperature has prompted recent cleaning and maintenance on the 8 drywell ventilation units and associated duct work.
Elevated drywell temperatures could result in premature equipment degradation and adversely impact equipment qualification evaluations. The additional evaluations are aimed at achieving further reductions in the drywell air temperature. PR A Assessment The public safety impact of the proposed projects were assessed using Method B. The Millstone Unit No.1 PSS addresses the availability of drywell coolers while the plant is at power and post-trip. Based on operating experience, it was determined that a loss of drywell coolers resulted in a gradual increase in drywell temperature, less than 10F/ minute. The heat up of the drywell requires many hours before the drywell temperature exceeds the drywell equipment environmental qualification and manual depressurization is required. The short-term ef fect of loss of drywe!! space coolers on plant transients was found to be negligible. The proposed projects, if implemented, could improve drywell bulk temperature during operation and post-trip but *;ould have negligible impact on core melt frequency and public safety. Results The proposed projects, if implemented, have a negligible, but positive, impact on core melt frequency. Score 0.05/10
] ISAP Topic No. 2.11 Stud Tensioner Scope of Project The stud tensioner is used to remove and install the reactor vessel head during refueling outages. With the existing system, the studs that connect the head to the vessel are stressed by a mechanical tensioning device which is threaded onto the studs. Because this is a slow process, the proposed project will make use of a quick disconnect hydraulic tensioner which can simply be clamped on the studs.
Safety issue The tensioner is used to stress each stud so that it will achieve 47 mills of elongation. Like the mechanical tensioner, the hydraulic tensioner is capable of over of under stressing the studs, thereby creating the potential for a leak. , However, it should be noted that if a leak did occur, it would be detected during 3 drywell inspection which is conducted when the primary system is pressurized to j 1,000 psig. PR A Assessment The public safety impact of the proposed project was assessed using method B. Embedded in each stud is an elongation measuring rod, which can measure stud elongation up to a 0.1 mill. The elongation measuring rod will be used in
- conjunction with both the mechanical tensioner (existing system) and the hydraulic tensioner (proposed system) to determine stud elongation during i
tensioning. Results Since the hydraulic tensioner will not alter the possibility of a leak due to over or under stressing the studs, the public safety impact of this project is assigned a score of zero. Score 0/10 i I
, ISAP Topic No. 2.12 5
Reactor Vessel Head Stand Relocation Scope of Project ,
; The proposed project will relocate the centerline of the reactor vessel head
+' stand 10 inches north to eliminate the load handling problem. By moving the head stand away from the south wall, the reactor head can be vertically lifted on 1-and off of the stand without requiring any horizontal adjustment. Safety issue The reactor head stand at Millstone Unit 1 is used during refueling to hold the vessel head in place after it is removed from the vessel and transferred over to the lay-down area. The present head stand is located too close to a south wall to dIlOw d st(alght vertical lowering of the head onto its stand. Consequently, the head must be moved in a horizontal direction while it is being lowered so that it will properly align with the stand. Horizontal movement of the head is accomplished by using a chainfall and a lift pad, which is bolted to the south wall, to drift the head into position.
, There is a concern that the vessel head could be damaged if the chainfall or lift pad failed during load handling operations.
PRA Assessment . The public safety impact of the proposed project was analyzed using method B. The only t:me that the reactor head is removed from the vessel and placed on the stand is during a refuel outage. Relocation of the head stand will not alter the present load handling operation except for eliminating the need to drift the , reactor head onto the stand. Because of this and the fact that the reactor is in cold shutdown during refuel, it is concluded that the proposed project can not i affect core melt frequency. Accordingly, there is not change in public risk due to implementation of the project. Results The proposed project can have no impact on initiating event frequencies or the j likelihood of mitigating systems falling. Score 0/10 l O
1 ISAP Topic No. 2.16 Ci Reactor Protection System Scope of Project o Replacement of the 120 second automatic depressurization system (ADS) timers with current state-of-the-art timer circuits to alleviate the reactor pressure system (RPS) setpoint drift problems. o Removal of two pressure switches, PS 54A and B from the emergency core cooling system (ECCS) pump start logic to allow ECCS pump start on either high drywell pressure or low-low reactor water level.
- Safety issue The reactor protection trip system has demonstrated setpoint drif t problems which have led to difficulties in maintaining setpoint calibration and accuracy.
Two areas of concern related to RPS are: 1) 120 second ADS timer's accuracy of
. +10% and 2) the low pressure permissives, PS 54A and B setpoint drift of
~
120 psig. The- safety concern with setpoint drift problems was approached by evaluating the effacts of an upwards drift and a downwards drift on public safety. PRA Assessment O The public safety impact of replacing the 120 second ADS timer was evaluated using Method B. The timer provides a delay in automatically opening the four safety relief valves upon receiving a high drywell pressure and low @w water level signal. The time delay is intended to allow feedwater coolant injection (FWCI) to restore reactor vessel level in the event of a small LOCA. The PRA assessment involved determining whether the ADS timer's current accuracy of 110% would impact public safety. If the setpoint drifted in the positive direction (T approximately 142 sec.), the reactor vessel temperature would increase but not to the point of core melt before ECCS injection occurred. If the setpoint drif ted in the negative direction (T approximately 108 sec.), ECCS injection would start sooner, lessening the severity of the accident. This would still be enough time to allow FWCl to restore the reactor vessel level, if possible. P The public safety impact of removing the pressure switches, 54A and B, was
- assessed using Methods A and B. A satellite model was developed to determine the sensitivity of the ECCS pump actuation logic (5ection 3.2.16 Millstone Unit No.1 PSS) to the removal of the pressure switches. Removal of these switches will allow ECCS pump start on either high drywell pressure or low-low water ,
level. The pressure switches' setpoint drift is not a problem. An upwards drift allows the ECCS pumps to start sooner. A downwards drift of -20 psig delays ECCS cooling but does not increase drywell temperature enough to cause a core melt. i
, ~ . . - , , . - - , - ,n. _ - - ,-,-,-,,--,,--,-,,-.n ._-n-,,-,,-,.-,..
,,_,,--,,,-,--,-.--,,.-,,,.,-,,--,--,,,,,.wn-,n- - - - , - - --,, - - - - , - - , , --- - - - ,--
2-O Results The public safety impact concerning setpoint drift of the ADS timers was determined to be zero. The removal of PS 54A and B causes no significant change in core melt frequency. The remova' of these switches does not make manual depressurization of the reactor easier in that the ECCS pumps will already be running when the emergency operating procedures direct the operator to manually depressurize the reactor coolant system. Score 0/10 O lO
p ISAP Topic No. 2.17 4.16 KV,480V and 125 VDC Plant Distribution Protection Scope of Project The proposed project will provide an extensive review of the plant electrical distribution systems. Originally intended to be part of the Appendix R review, the project scope was later expanded to produce a more inclusive study. Safety Issue The proposed project will verify the existing design adequacy of the 4.16 KV, 480V and 125 VDC plant protection systems. Although the project is being done primarily to understand what happens to circuits during a fire, additionalinsights should be gained. The overall benefit of the project is an expected increase in reliability of electrical system protective devices. PRA Assessment The impact of the proposed project on public risk was assessed using Method B. Based on a comparison with other Appendix R projects, this project should I produce some positive reduction in public risk. In addition, similar studies for j other electrical system have resulted in valuable engineering insights relative to risk reduction. 5 Results This project was subjectively scored to have a slight positive impact on public risk. Score 0.1/10 I 5 ___ - _ _ _ _ _ _ _ _ _ . _ _ _ _ . _ _ _ _ . _ _ _ _ _ _ _ _ _ ~ _ _ . _ _ _ _ . _ _ . . -
O ISAP Topic No. 2.18
-U Spent Fuel Pool Storage Racks / Transportation Cask Scope of Project Evaluate methods to increase the spent fuel capacity at Millstone Unit No. I by rerac!:ing and consolidation of the Millstone Unit No. I spent fuel pool and/or transshipment of spent fuel to Millstone Unit No. 3.
Safety Issue Unless Millstone Unit No.1 increases its spent fuel storage capacity, it willlose full core reserve in 1987 and reload discharge capability in 1991. I'RA Assessment Loss of reload discharge capability would ultimately lead to plant shutdown. j However, it was assumed that reload discharge capability would be retained and the plant would continue to operate for the remainder of its licensed life. (Until the specific method for extending the spent fuel capacity at Millstone Unit No.1 is selected, the potential associated risk to the public cannot be determined.) The core melt frequency as determined by the PSS is retained as the base core melt frequency. Results The impact on public risk at the present time is zero. Score 0/10 l l
~ ISAP Topic No. 2.20 Reactor Water Clean-Up System Isolation Setpoint Reduction Scope of Project
- The proposed project involves lowering the isolation setpoint for the Reactor Water Clean-Up System (RWCU) from the low water level setpoint to the low-
! low water level and the addition of a leak detection system to the RWCU.
l t Safety Issue Plant operations personnel have expressed the desire to lower the RWCU j isolation setpoint to the low-low water level in order to improve the availability of the RWCU system following a reactor scram. In addition, to protect against
- breaks in the RWCU system, a leak detection system will be added to the RWCU .
system. The leak detection system is required to isolate the break before exceeding the environmental qualifications of nearby equipment. PRA Assessment . The public safety impact of the proposed project was addressed using Method A.
- The proposed project will provide a benefit in improved ability to detect breaks in the RWCU during power operations. The project also introduces the potential risk of spurious isolation of the RWCU system. The benefits and added risks are addressed separately.
< The Millstone Unit 1 PSS addressed interfacing systems LOCA in the RWCU low pressure piping. This analysis was re-examined to include the leak detection system. However, the existing core melt frequency due to RWCU interfacing system LOCA is low (1.39E-8/yr.) and is dominated by the ability to isolate using the existing valves. Therefore, the addition of the leak detection system has negligible impact on RWCU interfacing system LOCA core melt frequency. l, The core mel; frequency due to breaks in the high pressure piping of the RWCU was also re-examined. For breaks isolated on the present low water level setpoint or on the proposed leak detection, equipment in the environs was i assumed potentially available for mitigation. For breaks not isolated until low-low level, equipment in the environs was assumed unavailable, but main feedwater and the main condenser were assumed potentially available for ,l mitigation. The resulting change in core melt frequency from adding the leak i detection system and changing to the low-low water level setpoint was negligible (less than 5E-9/yr.). The isolation of the RWCU system due to a spurious signal from the leak detection system during power operation was also examined. (The leak detection system is bypassed during non "run" modes of operation.) Isolation of the RWCU in itself does not result in a reactor trip. However, an operator error in j returning the system to service could result in a plant trip. Such a trip would I most likely occur on low level and proceed the same as a reactor transient with main condenser available event. The estimated addition to the event frequency I is small (1.3E-4/yr.) compared to the base initiating event frequency (3.ll/yr.). Therefore, the spurious isolation of the RWCU by the leak detection system adds l a negligible risk to the plant. i
2-l Results The proposed project has a small benefit in terms of redundant leak detection in i the RWCU but an added risk from spurious isolation of the RWCU. However, no significant change in core melt frequency was determined. The net impact on public safety is zero. 4 Score 0/10 1 4 i I i i t t ! I
i O ISAP Topic No. 2.21 V 480V Load Center Replacement Scope of Project This project proposes to replace the existing electro-mechanical trip devices on all of the 480V circuit breakers. The function of the trip device is to sense an over-current condition and initiate breaker trip. Replacement of the trip devices is being considered because the present devices are worn and have caused false breaker trips. Safety issue Removing the present oil filled trip devices and replacing them with new solid state devices is expected to improve the reliability of safety-related systems. A solid state device will perform the same function as the old trip device but with greater accuracy. Thus, the current 480V power system design will be improved. PRA Assessment The public safety impact of this modification was evaluated by a combination of Methods A and B. If the present electro-mechanical trip devices were replaced, the number of false breaker trips could be reduced. This would increase the reliability of the 480V electrical system to provide an uninterrupted supply of power to safety-related loads. However, the Millstone Unit No.1 PSS identified pd breaker opening / closing failures as the dominant contributor to 480V power supply unavailability. The probability of a false breaker trip is approximately 5% or less of the probability for breakers falling to close. Even if a breaker were to trip, it could subsequently be restored by the operator. Consequently, the probability that a breaker would remain open following false trip is negligible when compared to breaker closing faults. Results The proposed modification will not measurably increase the availability of safety-related equipment and thus, produces no impact on public safety. i Score 0/10 l i O 1
ISAP Topic No. 2.22 CRD Water Hammer Analysis ( Scope of Project . The scope of this project is to evaluate the water hammer loads in the control rod drive (CRD) system piping generated on scram events. Safety issue It has been analytically postulated that there are hydrodynamic loads in the CRD system which could lead to a water hammer across the scram inlet valves due to low pressure fast scrams. For low pressure scrams or start-up scrams, a large pressure differential exists across the scram inlet valve. The resulting loads i have been analyzed as part of a generic effort by the BWROG. A plant-specific analysis is proposed to evaluate the loads for the CRD system at Millstone Unit No.1. - PRA Assessment The proposed project was evaluated using Method B. The CRD system at > Millstone Unit No. I has operated successfully with no evidence of CRD water , hammer under a variety of reactor pressures. A review of the Millstone Unit No. I scram logs from January 1974 through December 1984 was conducted. ] During this period, the reactor was scrammed at pressures ranging from 0 psig to
- 1,033 psig, with approximately 25% of the scrams occurring at pressures below
- 600 psig and 12% occurring at 0 psig. No evidence of pipe motion or support j damage has been identified. Loads of severity significant enough to constitute a
- water hammer and lead to a CRD pipe break have not been experienced in the
- industry as a whole. Therefore, the potential for a CRD water hammer due to i
low pressure fast scrams appears to be an analytical question and not an operational concern. Results i The proposed project represents an analytical concern which is not substantiated
- by operating experience. A subjective benefit is assigned to the project to i address the analytical concern.
j Score [ 0.01/10 3 O 't
.,-_--.___._..m.m. _ _ , , _ - . . . , _ _ ~ . , _ . , . - - - . , , , _ , . . . - . - _ -_ _ _ . .-... _ ---~_--_.- ~____ _ _ _ _
D ISAP Topic No. 2.23 h Instrument, Service and Breathing Air Improvements Scope of the Project This project involves a review of the existing instrument, service and breathing air systems to evaluate changes required to improve their reliability and integrity. Safety Issue Pub!!c safety concerns relate to the moisture content in instrument air and possible contamination of the air by desiccant particles or rust. This contamination could effect the operability of the MSIVs outside containment, the feedwater regulating valves and the scram valves by causing them to stick. A i potential common cause failure problem may exist. PRA Assessment The PRA assessment involved reviewing the existing instrument air system. Problems with the air dryer system and the Sullair compressor have caused rust and desiccant contamination in the instrument air system. The air dryer system is inadequate in removing moisture in the air due to high maintenance unavailability. Moisture in the air causes the carbon steel piping to rust. In the past, instrument air demand has exceeded the dryer design flow causing ( desiccant carryover. The Sullair compressor's two filter states are inadequately sized allowing moisture carryover and oil vapor carryover. The oil vapor coats the desiccant in the air dryer decreasing the ability of the desiccant to absorb water vapor. The past valve problems due to particle contamination were reviewed. There have been two known cases in the past 15 years of MSIV failure to close due to sticking. In another case, desiccant accumulation was found in the feedwater controller during repair work following a failure of a feedwater regulating valve. Before the safety relief valves' air supply was switched to N 2, an incident occurred in which one of the SRVs failed to actuate initially during testing. During a shutdown, the solenoid was removed and inspected. It revealed rust and/or desiccant deposits inside the solenoid chamber. Similar problems have occurred involving the gas turbine and diesel generator air operated valves. Over an increase in time, the rust problem got worse causing the valves to stick. The air systems for these valves do not produce the quality of air that the instrument air system does, but there is no worry over desiccant contaminants. I Method A was used to assess the public risk of valve contamination due to rust and desiccant contaminants. A case was evaluated where the MSIVs are closed due to a low reactor pressure signal. The operator will try to restore the main condenser if the low reactor pressure is not the result of a steam line break. The restoration involves opening the MSIVs. A common cause failure of 4 out of 4 outboard MSIVs to open due to sticking is possible. The common cause failure k rate assumed is 1.0E-3 (upper bound). The change in the core melt frequency due to this common cause failure is quantified. l
l i Results A potential risk of 1,350 person-rems exists if these air system modifiestions are not implemented. Rust / desiccant-related valve failures are estimated to be larger than the actual data shows. This problem is time dependent, resulting in rmt and desiccant accumulation in valves. Score
- 3.4/10 i
4 4 h i l l r P I i i l f j
i ISAP Topic No. 2.24 . % - Offsite Power Systems Scope of Project The present scope of this project is concerned with an examination of the following topics: l 1. Installation of slow speed bus transfer schemes on selected 4,160V buses. f 2. Installation of a main generator disconnect device (i.e., circuit breaker). Safety Issue . A slow speed transfer scheme would allow plant operators a second chance to ! reconnect to offsite power, following a reactor trip. Currently, only the fast i transfer scheme is available to reconnect offsite power. l Installation of a generator breaker will keep the NSST in service as a source of i offsite power af ter a generator fault. PRA Assessment The public safety impact o.f modifications proposed by this project was evaluated by using Method A. At the present time, a fast transfer will occur on reactor / main generator trip which challenges the breakers that connect the 4,160V buses to both the NSST
- and RSST. The Millstone Unit No.1 PSS showed that there is some prcbability for fast transfer failure to occur every time such a plant trip is experienced.
Given a partial or complete failure of the fast transfer, there will be an
- accompanying loss of safety-related equipment which reduces the chance of i successful transient mitigation.
l The installation of a generator breaker combined with a transfer scheme would lower the probability of losing safety-related equipment following a plant trip. In order to quantify the effect of such an improvement, sensitivity studies were i made on the existing Millstone Unit No. I PSS using the following set of ! assumptions: l 1. Following plant trip, the generator breaker will be commanded to l open, thus, preserving the RSST offsite power supply, i 2. In the event of generator breaker failure to open, an automatic transfer ' scheme will allow reconnection to the RSST offsite power supply (i.e., similar to existing scheme except for timing). l 3. Should both the generator breaker and transfer scheme fall,
- restoration of power via the onsite supplies is credited. It should be noted that onsite power was also credited in the PSS study.
i i
, Results The installation of a generator trip breaker combined with a modified transfer scheme (e.g., slow automatic transfer) will result in a 4.62 x 10-5/yr. reduction in core melt frequency (CMF) or 5.7% of the total CMF. This corresponds to a ; risk reduction of 1,825 person-rem.
Score l 4.6/10*
' NOTE: If the long-term cooling problem were resolved, the score could possibly be reduced to 2.0/10.
1 i 4 i I i l l '1 i i I I ] l l 4 l
ISAP Topic No. 2.25 Monitoring of Primary Containment Leak Rate and Drywell Temperature Scope of Project This proposed project involves the installation of a processor to continuously monitor primary containment integrity and an equipment upgrade of the existing drywell temperature monitoring system to allow a more accurate determination of drywell bulk air temperature. The equipment upgrade involves installing temperature sensors and a data logger on a personal computer. PRA Assessment The PRA assessment of this project was based on subjective engineering judgement (Method B). The installation of the processor to continuously monitor primary containment integrity is contingent on the installation of the primary containment pumpback system (ISAP Topic No. 2.32). The processor would not impact public safety. The accuracy of the temperature sensors inr:Jved in the upgrade will not change. But the drywell temperature monitoring system accuracy will increase since a computer will be used to calculate drywell bulk temperature instead of calculating it by hand. This willincrease the operator's level of confidence when O following EOPs. Results No significant impact on public safety. Score 0/10 Interdependency o ISAP Topic No. 2.32, " Primary Containment Pumpback System" - The system i proposed in Topic No. 2.32 must be installed before the proposed processor will be able to continuously monitor containment leak rate. l o ISAP Topic No. 1.09, " Regulatory Guide 1.97 Instrumentation" - Topic No.1.09 proposes environmentally quallfled drywell temperature indications. If the temperature sensors involved in this upgrade (Topic No. 2.25) were environmentally qualified, the score would increase to 1.0 for reasons given
- in the evaluation of ISAP Topic No.1.09.
i l l.
'e ISAP #2.28 Long Tcm Cooling Study t
Safety Study *
,)
L The Millstone Unit 1 Probabilistic Safety Study (P.S.S.) modeled four long term decay heat removal systems: o Feedwater and Main Condenser o Isolation Condenser o Shutdown Cooling System ~ o Alternate Shutdown Cooling The results of Millstone Unit 1 Probabilistic Safety Study show that about 64 of total core melt frequency from the internal events is due to a failure to maintain adequate long term decay heat removal. In all of these sequences, RPV - water level is initially recovered to its normal value either by the Feedwater system or the low pressure pumps (L.P.C.I. or Core Spray) and core decay heat is rejected into the torus. If sufficient long ters d,ecay heat removal is not available, the torus will continue to heat up. This will result in a loss of injection pump N.P.S.H.
, and will lead to loss of all injection and thus core melt.
O The P.S.S. analysis shows that failures of Shutdown Cooling (SDC) and Alternate Shutdown Cooling are the major contributors to core melt frequency. Unavailability of the Main Condenser and Isolation Condenser systems also contribute to core melt risk, however, their calculated unavailabilities are an order of magnitude lower than those of the Shutdown Cooling System and Alternate Shutdown Cooling. By improving the plant's long term decay heat re= oval capability, the public risk impact of Millstone Unit 1 can be greatly reduced. Proposed Project
- i i
Tne proposed project is an integrated study of the long term cooling capability at Hillstone Unit 1. The study will incluca: o A review of all potential decay heat removal schemes (including those not directly ' considered in the Millstone Unit 1 P.S.S.) o Plant specific thermal hydraulic analyses, of long term core O ~ ! MILLSTONE UNIT 1 1 i I}CEGRATED SAFETY ASSESSMENT PROGRAM '
~ _ . . . _ . - . . - ..- . _ _ _ - _ _ - - - , _ - _ _ . _ _ - . _ . . - - . - __.-. - -, -
cooling and cor.tcinment cooling utilizing systems cnd containment codes
- o Identification of potential operator actions to ' improve on the existing decay heat V removal' capability (such as torus flooding from external sources to prolong injection) until permanent hardware improvements are incorporated o Identification of decay heat removal systems requiring hardware modifications.
foe study will consider all existing systems which can be used fof long term cooling (examples include but are not limited to: Reactor Water Clean-Up System non-regenerative heat exchangers, torus makeup and letdown, and containment venting). The desired results will include: 0 A refinement of system success criteria . O 0 Recomendations on possible emergency operating procedure changes Identification of weaknesses of existing long ' erm decay heat . removal systems and recomendation of possible hardware modifications. Analysis of Public Safety Impact The public safety impact of this proposed study was evaluated using Method A. This proposed study is intended to identify the best way to improve the plant's long ter:: decay heat removal capability. Since failure of long term decay heat removal contributes to 6% of the total core melt frequency, the importance of this issue is self evident. To reduce public risk, it is necessary to address this issue. Therefore, the long term cooling study has been assigned a score of 10 out of 10. V MILLSTONE UNIT 1
. INTEGRATED SAFETY ASSESSMEllf PROGRAM
ISAP #2.30 MSIV closuro Tc::t Frequency e Safety Issue . d The Millstone Unit 1 Reactor Protection M.S.I.V. System (R.P.S.) design an incorpo Closure trip function which twice coincidence logic senses M.S.I.V. closureinitiates reactor trip wh valve travel greater than 10%, based on limit switches. This trip function is an anticipatory trip which provides for reactor trip before the reactor pressure and neutron - u fl'r respond
'to the collapse in reactor coolant voids ~that accompanies M S I V failure . . . . closure. The of this trip function is backed up by the High-High Average Power R Monitor (A.P.R.M.) and High Reactor Pressure trip functions .
At present, Technical Specification 4.1. A requires monthly surveillance esting t of this trip function. The actual test performed requires 10% valve closure of the to ensure that a reactor trip signal is generated. test (perforned quarterly at 60% power) determines Another surveillance M.S.I.V.s. the closure time of ttle On two occasions, while performing the 10% M.S.I.V. closure surveillance at 100% power the individual valve , causing high steam being tested over travelled and closed flow in the re=aining three steam lines. This resulted in automatic main steam line isolation and the cicsure of the remaining ... M.S.I V Tnere is scme potential for this type of event to occur any time performed the test is , wnile at 100% power. The Millstone Unit 1 Probabilistic Safety Stu evaluated such events and concluded that they contributed to 93% causes of the of Reactor Transient Events with the Main Condenser Unavailable. Such account for 2.u4% of the predicted core melt frequency. Therefore, reducingby the free,oancy reduced. of 10% M.S.I.V. closure test, the frequency of such e event Proposed Project . No hardware modifications are required. The proposed project calls for only a chanEe in the surveillance test procedures by requiring that the surveillance test for 10% M.S.I.V. closure be conducted in conjunction with the quarterly l
\ .
{ MILLSTONE UNIT 1 t t Ih7EGRATED SAFETY ASSESSMENT PROGRAM
M.S.I.V. closura stroke tGst required by.Tcchniccl Specification u.7.D.1.c. In performing this surveillance reactor power is reduced to roughly 60% to avoid the high steam flows in the unaffected steam lines.
- O V Analysis of Public Safety Impact d
The public safety impact of this proposed change was assessed using Method A. In the 12 years of plant operation considered in the initiating event data base of the Millstone Unit 1 P.S.S., there have been 5 events' initiated by M.S.I.V. closure. Two of these five events were due to failures occurring during the 10% M.S.I.V. closure surveillance testing. The benefit of performing the 10% M.S.I.V. closure/test in conjunction with quarterly closure-time test, was estimated by requantifying the frequency of H.S.I.V. closure events and
- excluding the two testing related events. The core melt frequency was then recalculated with the modified M.S.I.V. closure frequency.
The main purpose of'10% closure testing is the verification of generation of the R.P.S. trip signal on M.S.I.V. closure. Increasing the testing . interval may slightly reduce the reliability of R.P.S. signal generated by the M.S.I.V. position. For almost all the dominant core melt sequences provided in Section 5 of the Millstone Unit 1 Probabilistic Safety Study, it was found that the R.P.S. signal is generated either on , low RPV water level or high drywell pressure. Therefore, a slight reduction in the reliability of the R.P.S. signal being generated by the M.S.I.V. position will have an insignificant impact on core melt frequency or public risk. This effect was not considered further. As discussed in Sections 1.1 and 1.2 of the Millstone Unit 1 P.S.S., the events initiated by M.S.I.V. closure are included in the event category of Reactor j Trip with the Main Condenser System unavailable. If the 105 M.S.I.V. closure testing had never been perforined, 2 of the M.S.I.V. category would not have closure events in this occurred. Excludint these'2 M.S.I.V. closure events , from Millstone Unit 1 experience and updating the industry experience results 1 in a drop in the Reactor Transient with Main Condenser System unavailable frequency from 0.435/ year to,0.27/ year. (Note, as discussed in Section 1.2, of
. the Millstone Unit 1 P.S.S., M.S.I.V. closure contributes more than 93' % to this MILLSTONE UNIT 1 IEEGPATED SAFr~.IY ASSESSMENT PROGRAM --- -- --.,-.--,-.,-----.--.,----,,.-c.-----..----.-.--.,,e, , , . _- - , - - , , , - - - , , , , - - -
cattgcry). th2 sequsncas. Decrcas? in ccro melt frequ:ncy is calculated by requsntifying cli t
.m Results If the 105 M.S.I.V.
closure test is performed quarterly along with M.S.I.V. cicsure-time test, the core melt frequency is expected to decrease from.8.07 x 10~ / year to 7.99 x 10 / year, or a drop of 8.0 x 10~0/ year (or ~15).About
$0*. of this drop is in plant damage states TE1 and TI1.
7ne remaining reduction is in plant damage state T.2 (see Section 2.2 of the Millstone Unit 1
~
P.S.S. for the definitior) of the plant damage states). The change in the test frequency proposed here will decrease the public risk by 600 fperson-rem over the remaining life of the plant. This results in a score of 1.5 out of 10. . 4 P 9 1 HILLSTONE UNIT 1 INTEGRATED SAFETY ASSESSMENT PROGRNi
.. - - . _ - . - - =__- - ---_ -. --
ISAP 82.31 1.PCI imbe Oil Cooler Test Frequency Safety Issue cI (G Millstone Unit 1 Probabilistic Safety Study has identified that one of the major contributors to Low Pressure Coolant Injection (L.P.C.I.) system unavailability is the failure of the solenoid valve controlling L.P.C.I. pump motor bearing lube oil cooling. The L.P.C.I. pumps are used both for injection into the R.P.V. (to maintain or restore water level) and for long term cooling in the Alternate Shutdown Cooling mode (See Sections 3.2.20 and 3.2.23 of Millstone Unit 1 P.S.S.). The L.P.C.I. system unavailability especially in the Alternate Shutdown Cooling mode is a dominant contributor to the core melt frequency. Therefore, any improvement in the L.P.C.I. system reliability will ' ~ offer a significant reduction in public risk. As shown in Figure 1, now from L.P.C.I. discharge is used in cooling lube oil for the pump motor bearings. The n ow is admitted to the oil reservoir cooling coil through the solenoid valve 1-LP-52A(B). The valve is normally closed and automatically opens on the pump start signal. One valve in each L.P.C.I. train allows cooling now for both L.P.C.I. pumps in the train. O The L.P.C.I. pumps are started on a monthly basis for a surveillance test.
~
However, in these' tests the pumps are run only for a short time (5-10 minutes), , which does not confirm that the solenoid valves 1-LP-52A(B) have opened to allow cooling now to the lube oil. Note, the L.P.C.I. pumps can function for
~
a limited time without cooling to the motor bearing lube oil. The operation of the solenoid valve is indirectly inferred during refuelling when the L.P.C.I. pu~ps are run for extended periods of time. Due to infrequ'ent confirmed testing of the solenoid valves, the Millstone Unit ~ 1 P.S.S. calculated a high probability of the valve failing to open. This high failu,re probability reflects the fact any failure of the valve since last refueling outage would go undetected until the next outage. The high unavailability of the valve is a dominant contributor to the L.P.C.I. system unavailability (especially in the Alternate Shutdown Cooling mode), which in turn is a major contributor to the core melt fr'equency and therefore to the O -
)
U MILLSTONE -UNIT 1 nmpm e p- ,p . e n a -. .- --..--
. . @ ic risk.
p Proposed Project The proposed project calls for only a change in the surveil' lance testing . procedure of the L.P.C.I. system. Tne proposed change is for the operator to confim opening of the solenoid valve 1-LP-52A(B) during monthly testing of the L.P.C.I. pump. The opening of the valve can be confimed by checking pressure of water for lube oil cooling. Analysis of Public Safety Impact The public safety impact of this proposed project was evaluated using Method A. ' ~ Confimation of the solenoid valve 1-LP-52A(B) operation during monthly testing (as opposed to at refueling) decreases the unavailability of the valve from 2.75 x 10-2 to 1.25 x 10-3 on demand (based on WASH-1400 failure data fo solenoid valves). The effect of this on L.P.C.I. system unavailability in the injection mode is not significant. This is because for injection purpose, only one of two L.P.C.I. system trains is needed for success. Therefore, failure of the L.P.C.I. system requires failure of either valves in both trains (1-LP-52A b ~ and B) or failure of one valve in a train in conjunction with some other ' failure in the second train. Due to multiple failures (two component cutsets), effect of a change .in valve failure probability on L.P.C.I. system unavailability is small and therefore not quantified. As discussed in Section 3.2.24 of Millstone Unit 1 PSS, operation of both L.P.C.I. trains in Alternate Shutdown Cooling mode is required for success. Therefore, failure of either of two solenoid valves 1-LP-52A or B will fail successful operation of Alternate Shutdown Cooling. Results Reducing the failure probability of the valve 1-LP-52A(B) from 2 75 x 10-2 to , 1.25 x 10-3 on demand decreases the unavailability of Alternate Shutdow.1 ) Cooling from 0.'148 to 9.55 x 10-2 . The lower unavailability of Alternate i Shutdown Cooling decreases the core melt frequency from 8.07 x 10~N to 6.85 x o U MILLSTONE UNIT 1 INTEGRATED SAFETY ASseAwmr opmW
10~" per year; a drop of 1.1 x 10~" per year (13% decrease). About 80% of the s improvement in core melt frequency is in plant damage states SI1 and TI1 (see Section 2.2 of Millstone Unit 1 PSS for definition of plant damage states) and l the remaining is in plant damage states Al2, S12 and T12. By increasing surveillance testing of the valve 1-LI-52A(B), public risk decreases by 5500 person-rem over the remaining life of the plant. A score of 10 out of 10 is assigned for this project. J
\
l 2 i i . i i MILLSTONE UNIT 1 wrenons en e are,v . - ~ . ~ . - - - - - - - - i
l.: . - 4 i. 1 I .
~ ,
~
- W == 1 M--W @_ . -N-4Pc,'
ir. ,m, . ..a d-Cy< 3._ - N ,- C><3_-M 3. j ) t, - u. , t ,- n-. u.. . .. ff. i ".3 i r-.m., ir-,, . t. r ,ty,c l IP80 Mtvi PE-6,e . 1 l o j -
-C><J- t> <J-C><3- f*'O, g- - [><3 -
1 - t r.. , tr-,4 tr- ,
. i ,- .m.,
FIGURE I LPCI SYSTEM DIAGRAM i LPCI PUMP COOLING 1 i i . i l i I . 1 I I I 1 -
-i i
i ISAP Topic No. 2.32 ! Primary Containment Pumpback System O Scope of Project 1 i l The proposed project involves installation of a pumpback system to take suction from the torus and discharge to the drywell. The system will utilize the existing drywell pneumatic system equipment and will require the addition of a suction line off the existing torus line AC-8 and a discharge line to the drywell using containment penetration X-36. Safety Issue ', y Technical specifications (3.7.A-3.g.1) require continuous monitoring of primary containment for gross leakage by review of the inerting system's make-up requirements. Currently, Millstone Unit No. I utilizes an open system of ' pressurization and venting to maintain containment pressure differential of one (1) psi between the torus and the drywell, thereby not complying with ,. technical specifications. The proposed pumpback system will maintain the one (1) psi differential pressure and provide for continuous monitoring. PRA Assessment The public safety impact of the proposed project was assessed using Method B. The proposed project wl!! provide a potential benefit in improved ability to maintain containment pressure requirements and monitor containment leakage. The current system of venting and providing make-up requires local manual O operator actions. With the addition of the pumpback system, the containment pressure can be maintained from the control room. The benefit from reduced operator error due to installation of the pumpback system is represented by a small, positive value. The containment pumpback system requires the addition of two lines into containment, the suction line from the torus and the discharge line into the drywell. Two motor-operated isolation valves in series are planned for each line. These valves are normally closed (opened only when adding nitrogen gas to containment) and will automatically isolate the pumpback system to prevent , bypass of the containment during an accident event. Failure to isolate the
- pumpback system therefore has a negligible impact on public safety.
Results Installation of the primary containment pumpback system has no significant net j= impact on public safety. Score l 0/10 t k
,,e ,
;/
4 ISAP Topic No. 2.33 A RBCCW Leak Rate Testing (v! Scope of Project This project involves installing outside of containment penetration X-23 two manual gate valves, a containment. isolation valve 1-RC-16 and leak rate test connections. Modifications to penetration X-24 involve replacing the containment isolation valve 1-RC-15, and installing two manual gate valves and the test connections to allow leak rate tests to be performed. (See Figure 1.) saf ety Issue The RBCCW system is responsible for cooling the drywell equipment sump cooler, the drywell blower cooling coils and the recirculation pump motors. Supply of the RBCCW must pass through penetration X-23 which only has a simple check valve inside containment. The return of the RBCCW passes through penetration X-24 which does have a remote manual isolation valve outside containment. If the RBCCW piping line breaks inside containment, it can be isolated by closing the remote manual isolation valve,1-RC-15, and by check valve,1-RC-6. PRA Assessment . The public safety impact of the proposed changes was assessed using subjective engineering judgement (Method B). The safety concern involved one of the containment isolation valves or the manual gate valves being left closed after testing. This concern is dismissed for the following reasons. Af ter leak rate testing, the iest procedures would require the operator to reopen the manual gate valves. The containment isolation valves will be remotely operated by open/ closure switches with indicating lights located on panel #906 in the control room. If a valve was left closed af ter testing, it would prevent RBCCW system
/' cooling of the drywell space coolers during operation. This would result in increasing drywell temperature, thus alerting the operator to check these valves. ,
J Results The impact on public safety is zero. These modifications are being done to comply to the General Design Criteria 54 and 57 of 10CFR50, Appendix A and I ' the leak rate testing requirements of 10CFR50, Appendix 3. Score 0/10
'e
.}}