ML24113A096
| ML24113A096 | |
| Person / Time | |
|---|---|
| Site: | Browns Ferry  |
| Issue date: | 04/22/2024 |
| From: | Kimberly Green Tennessee Valley Authority |
| To: | Jim Barstow Division of Operating Reactor Licensing |
| Green K | |
| References | |
| EPID L-2024-LRM-0059 | |
| Download: ML24113A096 (1) | |
Text
Modification of Browns Ferry Technical Specifications to Eliminate LCO 3.3.2.1 Actions C.2.1.1 and C.2.1.2 for Rod Worth Minimizer Inoperable During Reactor Startup April 22, 2024
History
- At the January 22, 2024, Nuclear Regulator Commission (NRC) Public Meeting on this topic:
Tennessee Valley Authoritys (TVA) presented a proposed license amendment request (LAR) to remove actions in the BFN technical specifications (TS) that require the rod worth minimizer (RWM) to be OPERABLE during reactor startup.
TVA presented its risk evaluation that demonstrated the proposed TS change has very low safety significance (VLSS).
TVA also presented its justification for this TS change to use the risk informed process for evaluation (RIPE).
- The NRC commented that TVAs risk evaluation did not use a technically acceptable probabilistic risk assessment (PRA) in the risk evaluation of the proposed TS changes, so RIPE could not be used.
- The NRC elaborated that the streamlined RIPE review is allowed because the TS change risk evaluation uses a PRA that the NRC has previously determined to be technically adequate (e.g.,
through adoption of TSTF-505).
2
Meeting Objectives
- Present TVAs revised risk evaluation of the proposed Browns Ferry Nuclear Plant (BFN) TS change that addresses NRC comments.
- Provide justification that the risk evaluation of the proposed TS change:
- Uses a technically acceptable PRA.
- The results from the BFN (full power) PRA are conservative for low power conditions (<10%) that RWM is required by technical specifications to be functional.
- Present revised proposed answers to the RIPE screening questions and the RIPE screening questions for minimal impact.
- Obtain feedback and identify concerns from the NRC on the revised proposed LAR.
3
Proposed Change
- LCO 3.3.2.1, Control Rod Block Instrumentation, requires RWM to be OPERABLE during reactor startup and shutdown.
- When RWM is inoperable during reactor startup:
If at least 12 control rods have been withdrawn, Action C.2.1.1 allows reactor startup to continue, provided control rod movements are independently verified to be in compliance with the banked position withdraw sequence (BPWS) requirements (LCO 3.1.6).
If <12 control rods have been withdrawn, Actions C.2.1.2 and C.2.2 allow one reactor startup a year, provided control rod movements are independently verified to be in compliance with the banked position withdraw sequence (BPWS) requirements (LCO 3.1.6).
4
Proposed Change (continued)
- TVA proposes to eliminate LCO 3.3.2.1 Actions C.2.1.1 and C.2.1.2 to allow an unrestricted number of reactor startups with RWM inoperable, regardless of the number of control rods withdrawn, provided control rod movements are independently verified to be in compliance with BPWS.
- Based on the previous 10 years of operating experience, there are on average less than two reactor startups per year. So this TS change will, on average, increase in the number of startups without RWM by less than two per year.
5
=
Background===
- Limiting Condition for Operation (LCO) 3.1.6, Rod Pattern Control, requires control rods to be in compliance with BPWS during reactor startup.
- The BPWS are control rod patterns that prevent high worth control rods. This limits the reactivity insertion in a control rod drop accident (CRDA). Limiting the worth of the dropped control rod limits the power excursion in a CRDA and, consequently, eliminates or limits fuel rod damage.
- RWM is an automatic system that uses error lights and rod movement blocks to enforce BPWS control rod patterns.
- RWM automatically blocks the continuous withdraw of an out of sequence control rod during reactor startup.
6
Background (continued)
- The rod position indication system (RPIS) provides control rod position information to RWM. It is typically the loss of control rod position information from RPIS that makes RWM not functional.
- The loss of RPI is typically due to degradation of containment electrical penetrations for which there is no remedy other than replacement.
- The RPI penetrations are scheduled to be replaced but there is a concern that a sufficient number of control rod RPI failures could occur and prevent reactor startup due to RWM inoperable.
7
Risk Analysis
- The CRDA deterministic analysis (UFSAR Section 14.6.2) demonstrates that when BPWS rod patterns are enforced, only a small fraction of control rods have the potential for damaging fuel when dropped.
- Even the drop of a high-worth control rod results in only a small fraction of the fuel rods in the core being damaged, and the damaged fuel rods remain in a coolable state.
- Even without BPWS compliance, the drop of a high-worth control rod does not damage enough fuel rods to meet the PRA definition of core damage.
8
Risk Analysis (continued)
- This limited fuel damage from the drop of a high-worth control rod is due to the loosely coupled characteristic of BWR cores where the reactivity from a control rod is spatially limited to fuel in the vicinity of the control rod. This is why the UFSAR analysis of a CRDA only examines a small, fixed number of fuel assemblies for fuel damage in the vicinity of the dropped rod, regardless of the reactivity of the dropped rod.
- Based on a CRDA not resulting in core damage, even when RWM does not enforce BPWS compliance, the outcome of a CRDA is likely that an automatic or manual scram will occur with subsequent probabilistic equipment failures and/or operator errors that result in a loss of core cooling and subsequent core damage.
- Because the outcome of a CRDA is not core damage and, at worst, results in a reactor scram, the BFN PRA can assess risk from a CRDA by adjusting the reactor scram initiating event frequency.
9
Risk Analysis (continued)
- In low power operation, the plant has the same equipment - important for preventing core damage as during full power operation.
- The lower power and stored energy in the core and reactor increase the time available to mitigate an event, identify and correct operator errors, or restore equipment before the onset of core damage.
- As a result, the BFN PRA, which models the plant at full power operation, can provide a bounding assessment of risk for low power operation.
- Under the current TS requirement, RWM is expected to be functional for most reactor startups, and only a select set of CRDAs result in fuel (but not core) damage. The CRDAs that result in fuel damage will likely result in in an automatic or manual reactor scram.
- Under the revised TS requirement, RWM is, worst-case, not going to be functional for most reactor startups, and there is an increase in the number of CRDAs that result in fuel (but not core) damage and increase the frequency of an automatic or manual reactor scram.
10
Risk Analysis (continued)
- The increase in the frequency of reactor scrams from RWM not enforcing BPWS compliance can be no more than the number of reactor startups per year and the probability that BPWS compliance is not enforced due to human error.
- An upper bound probability that control rods are misconfigured is 0.2, and the upper bound probability that the independent verifier does not identify/correct the misconfiguration is 0.1. Both are pessimistic human error probabilities. Operating experience supports much lower human error probabilities.
- BFN operating experience is there are less than two reactor startups per year.
- The increase in reactor scrams under the proposed TS change:
(average number of startups per year)(probability that control rods are not in compliance with BPWS) = (2)(0.2)(0.1)
= 0.04 scrams per year.
- The increase in reactor scrams for the proposed TS change is added to the scram initiating event frequency (IEF) in the BFN PRA.
11
Risk Analysis (continued)
- Limiting risk increase is for BFN Unit 1:
CDF = 1.09x10-8/year LERF = 3.95x10-9/year
- With the change to allow an unrestricted number of reactor startups without RWM able to perform its function, total CDF < 10-4/year and total LERF < 10-5/year for BFN.
12
Technical Specification Change Using RIPE
- RIPE is an acceptable approach for this TS change because:
The increase in CDF and LERF are bounding metrics for characterizing the impact of the TS change, as it could more reasonably be characterized by fuel damage.
The risk evaluation uses the full power BFN PRA, which is a conservative model for the low power conditions when TS require RWM to be OPERABLE.
Reactor scram frequency in the BFN PRA is used as a surrogate in the risk evaluation. The scram initiating event and associated event trees are completely within the scope of the BFN PRA and previously determined to be acceptable.
The PRA model used for the RIPE LAR is technically acceptable, as demonstrated by BFN adopting Technical Specification Task Force (TSTF) Traveler TSTF-505.
13
Technical Specification Change Using RIPE (continued)
- RIPE is an acceptable approach for this TS change because:
The integrated decision-making panel (IDP) reviewing and approving the safety impact of the change will be equivalent to the IDP used for implementation of the 10 CFR 50.69 amendment for BFN.
The change has no or minimal safety impact, as demonstrated by the answers to the five RIPE screening questions.
The change meets the following RIPE quantitative criteria:
CDF < 10-7/year and LERF < 10-8/year.
For BFN, total CDF < 10-4/year and Total LERF < 10-5/year.
14
RIPE Screening Question Responses The change being evaluated under RIPE:
RWM is an automatic system that uses error lights and rod movement blocks to enforce BPWS control rod patterns, and it prevents a continuous rod withdraw error during reactor startup.
RWM is currently allowed to be inoperable if at least 12 control rods have been withdrawn or for one reactor startup per year, provided an independent verifier confirms BPWS compliance and rod movements.
The proposed TS change will allow for an unrestricted number of reactor startups with RWM inoperable, regardless of the number of control rods withdrawn, provided an independent verifier confirms BPWS compliance and rod movements.
15
RIPE Screening Question Responses (continued) 1.
Result in any impact on the frequency of occurrence of an accident initiator or result in a new accident initiator?
Yes. RWM is more reliable in detecting a continuous rod withdraw and being able to react more quickly to stop a continuous rod withdraw than an independent verifier. Therefore, the frequency of a continuous rod withdraw event (UFSAR 14.5.4.2) is expected to increase when RWM is not functional.
The BPWS control rod patterns limit the reactivity insertion in a CRDA, which limits the power excursion and, consequently, the amount of fuel damage. RWM does not cause or prevent a CRDA. RWM does not position control rods and does not interact with any structure, system, or component (SSC) that could initiate an operational event or accident.
Not requiring RWM to be functional during reactor startup does not result in a new accident initiator because RWM does not position control rods - it only blocks their withdraw.
16
RIPE Screening Question Responses (continued) 2.
Result in any impact on the availability, reliability, or capability of SSCs or personnel relied upon to mitigate a transient, accident, or natural hazard?
Yes. This change is expected to reduce the availability of RWM for ensuring BPWS compliance and preventing a continuous rod withdraw during reactor startup, as RWM can be not functional more often than currently allowed by TS.
When RWM is functional, there is no impact on its capability or reliability due to this TS change as no changes to the RWM equipment is being made. When RWM is not functional, there is no impact to personnel relied upon for BPWS compliance and rod movement, as this TS change does not affect their duties.
RWM only blocks control rod movement, so it has no role in the mitigation of a natural hazard (e.g., earthquake).
17
RIPE Screening Question Responses (continued) 3.
Result in any impact on the consequences of an accident sequence?
No. When RWM is not capable of performing its function, independent verification that control rod patterns meet BPWS requirements ensures that fuel damage is less than in the UFSAR CRDA. So the consequences of a CRDA are not impacted by RWM not being able to perform its function.
Regardless of the method used to enforce BPWS rod patterns (electronic or manual), there is always an accident sequence where electronic or manual verification fails and a CRDA results in fuel damage greater than the UFSAR CRDA. Failure of electronic or manual oversight does not impact the consequence - only the probability of that accident sequence. RWM prevents a continuous rod withdraw during reactor startup, but this event has no consequences (i.e., no fuel or cladding damage).
4.
Result in any impact on the capability of a fission product barrier?
No. RWM performs no function in maintaining or supporting the integrity or capability of the fuel rod cladding, reactor boundary, or containment boundary as barriers to the release of fission products. The capability of the fuel rod cladding (e.g., resistance to perforation during a CRDA or continuous rod withdraw during reactor startup) is not changed by RWM not being functional during reactor startup.
18
RIPE Screening Question Responses (continued) 5.
Result in any impact on defense-in-depth capability or impact in safety margin?
No. The same defense-in-depth capability exists with the proposed TS change as with the current TS. RWM must be functional, or an independent verifier is required to be used to confirm BPWS compliance and rod movements.
All that changes is the expected increase in frequency in using an independent verifier. A change in the frequency of which method of BPWS compliance and rod movement control is utilized does not reduce the defense-in-depth capability of either method.
The UFSAR CRDA analysis and continuous rod withdraw during reactor startup analysis are unaffected by a reactor startup with RWM not functional, as BPWS rod patterns and rod withdraw errors continue to be prevented by procedural compliance and RWM or independent verification. So there is no impact to safety margin.
19
RIPE Screening for Minimal Impact 1.
Result in more than a minimal increase in frequency of occurrence of a risk significant accident initiator or result in a new risk significant accident initiator?
No. RWM is more reliable in detecting a continuous rod withdraw and being able to react more quickly to stop a continuous rod withdraw than an independent verifier. Therefore, the frequency of a continuous rod withdraw event (UFSAR 14.5.4.2) is expected to increase when RWM is not functional. However, a continuous rod withdraw during reactor startup is not a risk significant accident initiator because it does not result in fuel damage.
RWM is currently allowed to be not functional for one reactor startup per year. The change allows more than one reactor startup per year with RWM not functional, so the change only affects the frequency of reactor startups without RWM. Changing the frequency of reactor startups without RWM does not introduce a change to any plant equipment or operator actions. So this change cannot result in a new risk significant accident initiator.
20
RIPE Screening for Minimal Impact (continued) 2.
Result in more than a minimal decrease in the availability, reliability, or capability of SSCs or personnel relied upon to mitigate a risk significant transient, accident, or natural hazard?
No. This change is expected to reduce the availability of RWM for ensuring BPWS compliance and preventing a continuous rod withdraw during reactor startup, as RWM can be not functional more often than currently allowed by TS. RWM will continue to be condition monitored under 10 CFR 50.65, limiting the decrease in its availability.
RWM is not used to mitigate a CRDA or a continuous rod withdraw during reactor startup. Both of these non-risk significant reactivity insertion events are mitigated by the negative reactivity from the heat up of the fuel and reactor scram.
The change to allow more than one reactor startup with RWM not functional decreases the availability of RWM to ensure BPWS compliance, and it prevents a continuous rod withdraw during reactor startup. The average number of reactor startups is less than two per year, so this change will result on average to less than one additional startup per year with RWM not functional. Therefore, there is only a minimal decrease in the availability of RWM to perform its non-risk significant function of BPWS compliance and rod withdraw error control.
21
Summary
- Putting RWM in service is a difficult process and delays reactor startup.
- TVA proposes to modify the LCO to allow an unrestricted number of reactor startups with RWM not functional.
- RWM is subject to condition monitoring under 10 CFR 50.65 (maintenance rule).
- The requested TS change has very low safety significance.
- LCO 3.1.6 requiring control rods to be in compliance with BPWS ensures that BFN complies with the safety analyses (CRDA analysis).
- The license amendment request to change TS will be made using RIPE.
22
Open Items and Hurdles with the revised LAR 23