ML20132C677
| ML20132C677 | |
| Person / Time | |
|---|---|
| Issue date: | 01/28/1985 |
| From: | Sheron B Office of Nuclear Reactor Regulation |
| To: | Office of Nuclear Reactor Regulation |
| Shared Package | |
| ML20132C684 | List: |
| References | |
| NUDOCS 8502060559 | |
| Download: ML20132C677 (6) | |
Text
[
9/Cio.NRE*[
JAN 2 8 196 MEMORANDUM FOR:
RSB Members FROM:
Brian W. Sheron, Chief Reactor Systems Branch, DSI
SUBJECT:
AUTO CLOSURE INTERLOCKS FOR PWR RESIDUAL HEAT REMOVAL (RHR) SYSTEMS
- n w.
...,_3..
The purpose of this memo is to bring all RSB members up to date on recent decisions and issues regarding PWR RHR systems open permissive interlocks (OPI) cnd auto closure interlocks (ACI), and to set forth some preliminary guidelines for evaluating proposed changes.
Background
i The Standard Review Plan Chapter for PWR RHR systems, SRP 5.4.7, contains Branch Technical Position RSB 5-1 that sets forth acceptable means of providing RHR system isolation.
In particular, paragraphs B.I.b and B.'1.c' state, for the suction side isolation valves (i.e., valves between the RCS and the RHR pump
~
suction):
i The valves shall have independent diverse interlocks to prevent the valves from being opened unless the RCS pressure is below the RHR system design pressure.
Failure of a power supply shall not cause any valve to a
change position."
l l
"The 4alves sha11 have independent diverse interlocks to protect against one or both valves being open during an RCS increase above the design i
pressure of the RHR system."
\\
The positions have traditionally been met for plants under review or licensed l
since RSB BTP 5-1 became effective in 1978 by a set of circuits that prohibit suction valve opening until RCS pressure is below the RHR design pressure and l
initiate automatic suction valve closure when RCS pressure rises above the RHR design pressure.
The suction isolation valves are never commanded to automatically open."
I l
CONTACT:
W. Jensen, RSB X29406 Only the RHR suction valves to the RWST or to the containment sump must I
function during the injection (automatically) and recirculation (manually or automatically) phases of a design basis accident.
l (sysg55D s.g y -
.~,-----,-,c
~,..,
n.
- ,--r-
..m,--~m.
,-~-m,me-
i Jd.' 2 b 2-
{
RSB Members The purposes of the OPI and ACI are basically the same--to prevent a LOCA l
l cutside containment (even: Y Der WASH-1400).
The OPI is intended to ensure that while the RCS is a. f ly ressure, the RHR suction valves cannot be t
I opened.
Although safe.f ae'.igtf vaives are located on the suction piping, l'
' these valves would not ce caMble of preventing the RHR system from being pressurized beyond its oesigr crassure if the system were suddenly subjected to full RCS pressure."
The ACI is also intended to prevent Event V LOCA, but during a different scenario.
During a RCS startup from modes where the RHR system has been i
utilized, the operating procedures call for closure of the RHR suction valves l
b2 fore RCS pressure reaches the RHR safety relief valve (SRV) setpoint.** If the operator failed to close both suction isolation valves, then, absent ACIs, i
the SRVs would lift.
Startup could not proceed as the Si% is generally suffi-l ciently sized to prevent further pressurization.
With the ACIs, operator i
orror in failing to close both valves would not prevent startup since the ACI i
is generally, although not always, set at a pressure below :.he SRV setpoints.
l In the absence of the ACI, if the opera.or-closes enly ere suction isolation 1
o valve and thus is able to continue the startup, a sunset.nt failure of the single closed isolation valve would lead to an Even: V.
Tne purpose of the ACI is to close, or to provide a backup to the operator to close the second suction i
isolation valve...
With or without the ACI, there must be a valve mechanicr1 failure -(i.e. the l
gate failing in s'uch a way that the valve's isolation capability is lost) or a E
hot short, (i.e., that electrically actuates the valve to open) for the Event V I
to occur.
The ACI is intended to reduce the probability of an. Event.V by i
backing up the operator in closing both isolation valves..
j The ASME code (Section NB 3412.4) requires the open permissive interlocks but l
l does not require the auto closure interlocks.
t i
l It is not known if the suction valves could even be opened in this scenario, given the high differential pressure acting against the gate l
valve, and the relatively low motor torque.
i J-l j
The intent is to prevent the SRV from lifting causing loss of coolant into the containment sump and the possibility that the SRV will not
[
reset.
l i
e i
4 c
.n-,
,-n
,,.,,,--..m
-..-,--v,---,.
~a-
-,, - -,, -,, - -,. -.. -, - - - - ~ -,,, - -, - -, - -
U 28 Jgg i
RSB Members -
I 1
I Fire Protection Reviews In the course of performing the fire protection reviews in accordance with 10 CFR 50.48 and Appendix R, the Auxiliary Systems Branch became concerned that a i
fire located in the control room or other plant areas could cause fire damage which results in hot shorts.
These shortsacould then' result in the RHR suction valves opening and causing an Event V.
To remedy this concern, ASB has allowed PWR applicants and licensees to open at least one RHR isolation valve motor power supply breaker when in Modes 1, 2 and 3.
Although this alleviates the fire protection concern, it has created two other potential non conformances with BTP RSB 5-1: (1) the plant is no longer capable of bein cold shutdown condition from inside the control room and (2)g brought to the the failure to j
meet the position regarding the ACI, as described above.
The first issue has been addressed for only a few NTOL plants and has been resolved on a case-by-case basis by granting exceptions to BTP RSB 5-1 posi-tion.
Two PWR applicants have shown that there is reasonable time for opera ~
tors to go to the motor control center (MCC), rack in the RHR suction valve cotor power supply breakers and change the valve's position.
Also, these cpplicants have shown that there would be.no severe environments through which the operators would have to pass to get to the MCC and return to the control i
room.
The second issue..is just now coming to light. -By allowing power to be removed from the s0ction valve motors when the reactor is in Modes 1, 2, and 3, the functiona1' capability of the ACI may be defeated.
That is,' if the operator in l
the course of starting up the plant, shuts only one suction valve while pres-sure is below the ACI setpoint, then removes power from both valves to meet the fire protection requirements, the ACI would not be capable of initiating valve motion to close the open valve when pressure reached the ACI setpoint.
RHR Pump Damage and LTOPS There are other issues related to the RHR system ACI.
The industry in general seems to believe that the ACI is detrimental to safety.
This belief arises from operational experience..There have been at least 26 events where RHR systems have been inadvertently isolated." A large fraction of thesit events t
have been caused by.the ACI shutting the suction valves due to an equipment malfunction or improper testing.
The inadvertent closure of the RHR suction valve (s) can have adverse conse-i quences.
First, it is the system used for removing decay heat when cold i
shutdown is initiated.
Although the expected RCS heatup rate would be low due I
to the low decay heat levels when the RHR system is in use, if the suction EPRI, NSAC-52, Residual Heat Removal Experience Review and Safety Analysis.
h
-.-,--.w,
.-.---,.,y..
.. ~,.
..-e-,
.. - ~.
f i
}
t hll 2* 1985
?
I RSB Members '
valve can not be reopenec, o:ner means of decay heat removal would have to be established (e.g., steam generators).
Depending on the plant condition, these other methods may be'difficuM.o achieve.
i 4
5 l
Second, the RHR pumps may beMestroyed without prompt operator actions.
Events l
at Calvert Cliffs and Diabic Canyor. have resulted in destruction of at least one of the RHR pumps due t: cavita-ion and loss of bearing cooling.
l
~
Third, if the RCS is in a water solid condition, loss of RHR flow will result 4
l-in a pressure transient since tne charging pumps would be injecting into the l
RCS without any letdown flow.
Although there are systems currently provided on j
all PWRs to mitigate this event (i.e. Low Temperature Overpressure Protection l
Systems-LTOPS), there have been a number of transien s initiated by inadvertent
}
l closure of the RHR isolation valves.
i l
Kcwaunee and Diablo Canyon Two plants have recently requested alterations in their PP. suction valve centrol circuitry that have forced the staff te consicer et overall benefits y
cnd detriments of the ACI in light of tne fire protectie, aviews and industry experience.
Kewaunee is a two loop W PWR with two Re.R c-:o lines.
In December,1983, the licensee requested complete removal of their ACIs.
The utility believes that the ACI presents a high po.ential for inadvertent RHR l
isolation and, for Kewaunee, a loss of the LTOP system.
{
9 A study conducted by Westinghouse to support the. proposed change shows that removal of the ACI, for Kewaunee, would be a safety improveaent in that the j
scenarios that result in low temperature overpressure transients would not be accompanied by RHR isolation, nor would the RHR system be overpressurized.
The l
licensee has proposed three means of preventing Event V:
(1) alarms to indicate if a RHR isolation valve is not closed, (2) rewiring the motor control switches to close, but not open, both valves when one button is depressed, and l
l (3) operating procedures that ensure all RHR MOVs are closed during reactor i
startups.
The staff's review of the Kewaunee proposal is complete and has l
i concluded that the Kewaunee proposal is acceptable.-
L Diablo Canyon is a four loop W PWR with only a single RHR drop line.
As a result 'of allegations made during the licensing process, the staff reviewed the l
RHR isolation valve operating procedures and found that the licensee should retain power available to the MOVs when the RHR system is in operation.
i i
Previously, the licensee removed power from these valves when the RHR system was in use since a spurious RHR ACI actuation resulted in a loss of RHR suction and damage to the RHR pumps.
i
)
I i
l l
1 2-
l.
i
\\
0% g8 1285 1
RSB Members.
The licensee has modified its procedures to require power to be available to the RHR valves, but has subsequently requested that the staff permit power to be removed 'from the valves.
The staff is now requesting the licensee to cddress the possibility of removal of the ACI, since this is, in fact, the root cause of inadvertent closures, not the availability of power to the isolation valves.
If the ACIs were removed and an alarm installed to warn the operators should either of the two MOVs be in the incorrect position, pro-tection from Event V could be provided and inadvertent closure would be prevented.
The review of the Diablo Canyon proposal has led to another
~
concern--if power is removed from the RHR MOVs to remove the possibility of an inadvertent closure, then no ready means would be available to isolate the RHR system should it rupture or develop a leak outside containment.
The removal of power from the RHR MOVs for Diablo Canyon is, in essence, proposed caused by j
the various problems cited by Kewaunee and the industry as a whole regarding j
the ACI.
RSB Position 4
The issue of RHR ACI reliability is being prioritized by SPEB.
In the mean-time, proposals to change the RHR system isolation valve controls should be carefully considered, especially in light of the many overlapping concerns.
J There is no reason, as yet, to' allow or even encourage whole scale removal of the ACI.
The request by each plant should be reviewed on a case-by-case basis.
As a minimum, however, any proposal to remove the ACI should be substantiated
)-
by proof that the change is a net improvement in safety.
For example, requests for removal of power or the ACI should assess as a minimum, the following:
1.
The means available to minimize Event V concerns.
2.
The alarms to alert the operator of an improperly positioned RHR MOV.
3.
The RHR relief valve capacity must be adequate.
4.
Means other than the ACI to ensure both MOVs are closed (e.g., single switch actuating both valves).
1 l
I e
{
l U'...h_,
- a.
RSB Members
- 5.
Assurance that :ne function of the open permissive circuitry is not affected by the proposed change.
6.
AssurancethafOf)es4:icnindicationwillremain available in tne sor. trol room, regardless of the proposed change.
7.
An assessment of :ne p opesed change's effect on RHR reliability, as weil as on LTOPs concerns.
We are conducting our own probabilistic assessment as an adjunct to work being conducted by the industry.
This work should be complete within the next few months.
Mdd M M Man W. Shlit3 Brian W. Sheren, Sief Reac or Sys. ems E anch, DSI cc:
R. Bernero...
DIS RIEUTION T. Speis Centrai file D. Eisenhut RSB R/F.
W. Minners k S S/F:! Branch Mis::.
H. Vandermolen WJensen R/F
- 0. Parr NLauben J. Wermiel BSheron J. Wilson WJensen LMarsh OParr AD/RS Rdg..
"0FFICIAL RECORD COPY"
" PREVIOUS CONCURRENCE SHEET ON FILE W/RSB.
r DSI:RSB*
DSI:RSB*
DSI:RSB*
DSI 5
DSI: RSB*
D hu. U$RS WJensen:gd LMarsh NLauben OParr BSheron ston 01/16/85 01/16/85 01/22/85 01/2$/85 01/24/85 01
/85 L
Q
,, _