ML20029C370

Forwards Safety Evaluation Re Plant Design Features & Procedures for Reactor Vessel Overfill Protection,Per 900504 Response to Generic Ltr 89-19 & Jan 1991 Loss of Automatic Feedwater Trip Capability Event

ML20029C370
Person / Time
Site:	Perry
Issue date:	03/20/1991
From:	Lyster M CENTERIOR ENERGY
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
GL-89-19, PY-CEI-NRR-1338, NUDOCS 9103270232
Download: ML20029C370 (6)

Text

..- V,

'i fCENTER00R ENM94Y PERRY NUCLEAR POWc c 4 glMorejs: Michael D. Lyster C E OA PERRY, OHto 44081 VICE PRESIDENT NUCLEAR

=(216) 259 3737 March 20, 1991 PY-CEI/NRR-1338 L U.S.; Nuclear Regulatory Com 41ssion Document Control Desk Washington,.D. C. 20555 Perry Nuclear Power Plant Docket No. 50-440 Reactor Vessel Overfill Protection Ceneric Letter 89-19 Centlement Our response?to Ceneric Letter 89-19 was provided by letter PY-CEI/NRR-ll71L, dated May'4,.1990. In January 1991 we experienced a loss of automatic feedwater trip capability relevant to the. concerns expressed in *.he Generic Letter. Also, in reviewing our May 4, 1990 evaluation, the need for changes to tha' design description was identified (side bars in the attachment indicate changes). These changes-include descriptions of the power supplies for-the relay trip; circuits for.the feedpump and main turbine trips, and a brief description of a related design change implemented as a result of the January 1991-event.

The attached evaluation continues to support our findings that (1) PNPP susceptibility to high vater level trip failure compares favorably-to the i

, reference BWR analyzed by'the'NRC in NUREG/OR-4387, (2) PNPP susceptibility to ,

main steam.line break also compares. favorably,-and (3) offsite dose- l consequences, 4f main steam line failure and fuel damage were to occur, are

~

reduced'from the reference case. Consistent with conclusions reached for the L;

referenceJBWR in:the;NRC evaluations, and the.BWR Owners Group in their generic evaluation of-BWR overfill protection, ve=still conclude'that

, ' additional PNPP modifications are not cost-justified.

1 Lif 1you'have any~ questions, pler.se feel free'to call. .;

1 Sincer y I

Michael D. Lyster >

'MDLtWJEinjc

'AttachmentL -!

cc NRC Project Manager hRC--Res! dent' Inspector Office NRC' Region III- I

' Opemt ng Comoomes Cle#aN Sectre !!Nwntna {

. - Mmtn Few "

..p#

9103270232 910320 1

PDR ADOCK-05000440 i l

l l1j P- =PDR l 6 J

'4 Attechunt 1

'S- PY-CEI/NRR- 1338 L (PY-CEI/NRR-ll71 L Rev.1)  ;

Page 1 of 5 PNPP Design Features and Procedures I for Reactor Vessel Overfill Protection I

Safety Evaluation The Perry Nuclear Power Plant (PNPP) has automatic reactor vessel overfill protection to mitigate main feedvater overfeed events, initiated on a high reactor vessel vater level (Level 8) signal based on 2-out-of 3 logic to trip  ;

the 2 turbine and 1 motor driven feedvater pumps. System design and setpoints  !

have been selected to minimize inadvertent trips of the main feedvater rystem i duringlstartup, normal operation and surveillance testing. The design employs  !

signals from three water luel legs which are monitored for level in excess of

. Level 8 by' separate alarm urits. The alarm units are connected in two out of three trip configuration to provide main turbine trip, feedvater: pump trip and control room annunciation. The alarm units have independent power sources and fail in the. tripped condition on loss of pover. These alarm units feed  !

-two-out-of-three relay trip circuits which share a common 125 VDC pover l' source. A concern related to these relay trip circuits having fuse protection common to other cirucits off of this DC power source was recently identified

during routine _foedpump turbine stop valve testing. As reported in LER .91-004, a-design change vas implemented to-prevent a loss of trip function for  !

'the main and feedpump. turbines--caused by a malfunction of unrelated indication-  !

and control-circuits.- _;

The PNPP design conforms to " Group I" as defined in Enclosure 2 of the Generic Letter,-except.that centrol circuits are.not physically separated from trip circuits and-other requirements including EQ are not met. Most importantly, the PNPP design is-less vulnerable to -feed pump trip failures than the BVR j analyzed (Reference-1). The dominant failure _ mechanism, feedvater' control  ;

failure initiated by instrument failures on a-common sensing line,-or failure  ;

of this sensfng line, are not' applicable to PNPP since three independent  !

"I

sensing'line.s are_used in our' design.

If automatic feed pump trip'is lost,_a coincident'feedvater. control system malfunction resulting in a feed flov > steam flow-mismatch would have-to occur _ l g before reactor vessel overfill was possible. In that event, adequate  ;

procedures and training are in place for the cocrator to assume manualifeed~

< pump control and maintain acceptable reactor vessel level, as-further discussed-below. j IfJautomatic: feed pump trip is' lost, coincident with the controller

~

'l

'mslfunction described above, and. operator actions do not prcrent-vessel '

ourfill,= potential main steam -line: break (HSLB) susceptibility / consequences are less severe than: reported in referenced NRC evaluations for?the following reas ons ,

q L

1 Attachmznt 1

. PY-CEl/NRR- 1338 L (PY-CEI/NRR-1171 L Rev. 1)

Page 2 of 5

1. MSLB susceptibility is reduced by scram prior to vater entering the steam lines. Reactor scram occurs on level 8 (about 4 feet belov md a steam nozzles) from Class 1E, 1-out-of-2 taken twice logic circuits. As noted in reference 1 (Section 5.0), cooldovn and collapse of steam is the major driving force for water hammer.

Reduced steaming rates after scram therefore also reduces the potential severity of water hammer. HSLB susceptibility is also reduced in comparison to the reference case as described belov regarding main steam line dead loads.

2. Before any PNPP damage could occur in the overfill scenario, the core would be suberitical and cooled for periods estimated greater than 20 seconds into the event (Reference 2).

3. Use of VASH-1400 release categories, to represent overfill damage consequences, overestimates risk. PNPP has a containment spray system to reduce iodine and particulate source terms. VASH 1400 did not include such a-reduction for BVRs.

Generic Letter 89-19 raises the following BVR-relevant concerns regarding consequences of water-filled steam lines:

" Reactor vessel ... overfill can affect the safety of the plant in several ways. The more severe scent.rios could potentially lead to a '

steamline break ... The basis for this concern is the following (1) the increased dead weight and potential seismic loads placed on the main steam 11ne end:its supports should the main steamline he flooded; (2) the loads placed on the main steamlines as a result of the potential for rapid collapse of steam voids resulting-in water hammers (3) the potential fo secondary safety valves-sticking open following discharge of water or two-phase flow; (4)-the potential inoperability of.the main steamline isolation valves (MSIVs), main turbine stop c,e bypass valves, feedvater turbine valves... from the effects of *;ater or two-phase flov The PNPP response to these concerns follovst (1) Dead loads have been analyzed with acceptable results,* but main steam lines filled with vater were not analyzed for seismic loads.

-The cost of reanalysis, and redesign / support modifications if needed, is not justified- by the incremental safety benefits derived (cost considerations are further d!stussed belov). Ve concur.vith the conclusion in Reference 1 (p. 8.6) that long-term core cooling is not impacted by MSLB and conclude that PNPP is even less vulnerable to that event than represented in Reference 1.

• Perry Safety Evaluation Report Section 5.4.2 describes the alternate shutdown cooling trode which fills main steam lines solid to the SRV's which are opened to establish a recirculating coolant path between ,

suppression pool and vessel.

to Attachmnt 1

• i PY-CEI/NRR '1338'L' e (PY-CEI/NRR-1171.L Rev. 1)

Page 3 of 5

.(2) _ Damage consequences are bounded by discussions above. Long term

_ core cooling is not affected.

(3) This is not a PNPP concern because SRV's are opened intentionally for. alternate shutdown cooling.

(4) . MSIVs vould remain open (without damage) unless an'MSLB-related signal was initiated, i.e. following vater hammer damage (MSIV's-voubt also close in-RUN mode if steam line pressure drops to 807-psig). Reference ~l (Page 11.2) concludes that MSIV reliability l vould not be affected, and that MSIV's may seat better if closed followingl pipe _ break due to hydraulic forces. Other valve damage consequences described by this concern are bounded by discussions above.

Ve-conclude that (1). the vorst consequences of an overfill-event described in the Generic Letter: and 'its references _ does not degrade shutdown cooling capability previously described, analyzed and licensed for PNPP, and (2) PNPP

-dose consequences from overfill are less than reported in the Generic Letter references.- Because of overriding cost / benefit arguments (below)'that conclude plant changes are not cost justified,- reduced dose consequences at Perry have not been quantified.

Operating Procedures 1 The Generic Lettet has requer.ted.that plant procedures and technical specifications include provisions to verify pt.iodically the operability of themverfill protu ;'.on system and toinssure that automatir overfill p~cotection is avaiable'to mitigate main feedvater overfeed events during reactor pover operation. -In addition the-letter requested-that'all BVR's-reassess and modify, if needed, operating procedures and operator training to .

assure that'the operators can mitigate reactor vessel-overfill events that may occur via tne condensate' booster pumps at reduced pressure.'

Regarding surveillance testing to verify werability of_ automatic overfill ,'

protection, previously: approved PNPP Technical Specification 4.3.9.2 and Table

- 4.3.9.1-1.2(a) ' require periodle. channel check, channel _ calibration, and channel functional testing.- Corresponding surveillance instructions include-setpoint verification. The Limiting-condition for Operation'is 3' channels

= operable lin Mode 1.

1:

L

. Attachm:nt 1 PY-CEI/NRR- 1338 L (PY-CEI/NRR-:171 L Rev. 1)

Page 4 of 5 Regarding operator mitigation of overfill events while running condensate booster pumps at reduced pressure, PNPP operating insttuctions utilized at lov pressure (discharge pressure of the booster pumps is approximately 350 psig) establish a reactor vessel level band. Instructions that utilize booster pumps also direct use of the Lov Flov Controller to automatically or manually control level during plant startup or shutdown operations at power levels below 2 to 3%. Licensed operators are trained to these procedures on a plant specific simulator. In automatic, the controller utilizes a level error signal derited from feedvater flov and a tape set value determined by the operator. In manual the operator directly manipulates the control valve position using OPEN-CLOSE pushbuttons mounted on the controller face, and booster pumps are controlled separately to maintain flow to the reactor vessel. Vith the controller in manual there is adequate time to responi to undesired increases in reactor vessel level.

Cost / Benefit NUREG 1218 (Reference 3) evaluates the cost and safety benefit of design upgrades for automatic overfill protection. The only upgrade identified as cost-justified was installation of a single channel feedvater pump trip system at a pisnt with n_o existing automatic trip. Table 10.3, Reference 3 shows that other evaluated design changes for the reference BVR are not cost-justified at the $1000/ averted man-rem level.

NUREG 1218 further concludes that "although some safety benefit could be gained by providing additional reacte vessel vater-level redundancy and independence to the existing designs for BVR overfill protection systems that are less reliable than the reference plant design, the benefits are not considered significant for plants that have some sort of automatic reactor vessel high-vater-level feedvater trip system." The companion document to this report, NUREG 1217, further notes that "the estimated reduction in frequency of overfill e':ents between plants that have some sort of automatic reactor vessel high-J:ter-level feedvater trip system was not significant."

A GE topical report (Reference 4) vas recently commissioned by the BVR_0wners Group to verify NUREG 1217 and 1218 assumptions on BVR design, and to review estimates of licensee costs to install the trip logic meeting GL 89-19 requirements for separation and independent power supplies. This report also concludes that plant modifications are not cost beneficial in the estimated range of $192,0^0 to $1,074,000.. PNPP cost estimates for an upgrade to independent / separate trip circuits are at the high end of that range.

CEI therefore concludes that PNPP modifications are not cost-justified.

l l

I

I; =

j

. , ~,

1 M*, (,' H .~* Attach:ent 1 PY-CEI/NRR-1338 L-

~

~

(PY-CEI/NRR-1171 L Rev. 1)

Page 5 of 5 References for Generic Letter 89-19 Evaluation

1. NUREG/CR-4387, " Effects of Control Syatem Failures on Transients, Accidents and Core-Helt Frequencies at a General Electric Boiling Vater Reactor," 12/85.

2. -NUREG 1217i " Evaluation of Safety-Implications of Control Systems in LVR-Nuclear Power Plant - Technical Findings related to USI A-47," 6/89.

13.> NUREG 1218,." Regulatory analysis-for Resolution of USI A-47," 11/89.

4.. EDE-07-0390, "BVROG Response to NRC GL89-19, Enclosure 2, Hardware Change -

Recommendations," submitted by letter BVROG-9048 (Floyd to Partlov),

4/2/90.

'NJC/ CODED /4482=

r

., ,. __. ,_ _ _