IR 05000311/1997011
| ML18102B327 | |
| Person / Time | |
|---|---|
| Site: | Salem  |
| Issue date: | 05/22/1997 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| To: | |
| Shared Package | |
| ML18102B326 | List: |
| References | |
| 50-311-97-11, NUDOCS 9705290237 | |
| Download: ML18102B327 (18) | |
Text
{{#Wiki_filter:*' * Docket No: License No: Report No: Licensee: Facility: Location: Dates: Inspectors: Approved by: U.S. NUCLEAR REGULATORY COMMISSION 50-311 DPR-75 50-311/97-11
REGION I
Public Service Electric & Gas Company Salem Nuclear Generating Station, Unit 2 Hancocks Bridge, New Jersey 08038 . March 24 - April 17, 1997 B. Smith, NRC Contract Engineer R. Lorson, Resident Inspector D. Dempsey, Reactor Engineer, DRS Eugene M. Kelly, Chief * Systems Engineering Branch Division of Reactor Safety 9705290237 970522 PDR ADOCK 05000311 G PDR
- EXECUTIVE SUMMARY Salem Nuclear Generating Station, Unit 2 *
NRC Special Inspection Report No. 50-311 /97-11 Valve 2RH26 in Hot Leg Recirculation PSE&G removed valve RH26 from the Salem Unit 2 design basis in July 1994 as a result of its evaluation of unwanted ECCS flow configurations in response to NRC Information Notice 87-63. (Section E1. 1. 1)
PSE&G failed to identify and take prompt remedial action for the untenable residual heat removal system (RHRS) runout flow condition's adverse effect on the long-term emergency core cooling function. (EEi 50-311 /97-11-01)
The extreme runout condition associated with the use of valve RH26 (prior to July 1994) in hot leg recirculation cooling, due to RHRS "loop-around" flow, also violated Technical Specification 3.5.2. (EEi 50-311/97-11-021' *
Unresolved items were identified concerning the adequacy of the abnormal operating procedure that governs the implementation 'of hot leg recirculation cooling following a loss of coolant accident in operating Mode 4 (URI 50-311/97-11-05) and proper extr.apolation of RHR pump flow requirements. (URI 50-311197-11-07) Unreviewed Safety Questions PSE&G attempted to resolve excessive RHRS and containment spray system flow problems in several ways, introducing three unreviewed safety question * Emergency operating procedures were revised to eliminate a redundant and diverse hot leg recirculation flow path. (Section E1.1.1)
RHR pump net positive suction head calculations were changed to utilize containment pressure in a manner inconsistent with the Unit 2 licensing basis, resulting in a reduction in NPSH margin. (Section E1.1.2).
- Relating to the semi-automatic transfer of the emergency core cooling system (ECCS) from the refueling water storage tank (RWST) to the containment sump, PSE&G addressed new single-failure considerations and design basis issues by reanalyzing RWST draw-down time. (Section E1.1.3)
The above examples of changes to procedures and the plant design basis resulted in the increased probability of occurrence of a malfunction of equipment important to safety and represented unreviewed safety questions for which prior NRC approval was not sought (EEi 50-311197-11-04).
ii
I i
Semi-Automatic Switchover In a March 16, 1996 change to emergency operating procedures, PSE&G approved an essentially new switchover design that predicted shorter operator response times and, in certain cases, interruption of flow to the core, because of a need to secure ECCS pumps before the transfer was complete * This change fundamentally diverged from the licensing basis approved in Unit 2 License Amendment No. 69, increasing trie probability of a malfunction of the charging and safety injection pumps that would need to be restarted to ensure adequate ECCS recirculation flow to the cor * The predicted shorter transfer times and flow interruption challenged the ability to accomplish risk-significant actions associated with the semi-automatic switchover - as designed and licensed - introducing an unreviewed safety question concerning the long-term emergency core cooling functio * The Updated Final Safety Analysis Report was not updated to the reflect the semi-automatic ECCS switchover to recirculation cooling approved by the NRC in Unit 2 License Amendment No. 69 on May 1, 1989. (EEi 50-311/97-11-08)
Unresolved items were identified regarding demonstration in the plant-specific simulator that operators can successfully accomplish the switchover within analyzed time constraints (URI 50-311/97-11-09), and use of a generic Westinghouse computer code for Salem-specific analyses. (URI 50-311197-11-10) Reportability
The excessive RHRS flow condition, the inability to implement ECCS technical specifications for hot leg recirculation, and the operation of Unit 2 in several unanalyzed conditions outside of the Salem design bases represented reportable conditions that, until April 18, 1997, were in violation of 10 CFR 50. 72 and 10 CFR 50.73. (EEi 50-311/97-11-03) Future Actions PSE&G was taking actions as of the end of this inspection to ( 1) re-institute the flow path through valve RH26 in Mode 4, (2) amend Mode 1-3 Technical Specification 3.5.2 for hot leg recirculation, (3) recalculate net positive suction head and RHRS flow requirements, and (4) revise emergency operating procedures to successfully accomplish the ECCS switchover within licensed times and without interruption of flow to the core or the need to secure ECCS pumps. iii
- Report Details E1 Conduct of E;ngineering E1.1 Background NRG Information Notice (IN) 87-63, Inadequate NPSH in Low Pressure Safety Systems, discussed the potential for excessive low-head emergency core cooling system (ECCS) pump flow. PSE&G (the licensee) worked actively with Westinghouse since 1990 to resolve several safety issues related !o post-accident ECCS operation, including: (1) potential inadequate RHR NPSH; (2) unintended RHR flow paths; (3) excessive RHR flow during cold leg and hot leg recirculation; (4)
excessive suction boost to the intermediate and high head safety injection (SI) pumps; and (5) changes to refueling water storage tank (RWST) drain-down tim During a review of the Salem inservice test (IST) program, the inspectors initially questioned the exclusion of motor-operated valve RH26 from the program based on i'ts classification as a "passive" valve. Valve RH26 is a normally closed containment isolation valve inside containment in the hot leg recirculation path of the residual heat removal system (RHRS). Per technical specifications, the valve's motive power is removed prior to entering operational Mode 4 due to single failure considerations that date back to original plant licensing. The inspectors found that the licensee * had eliminated the RHR hot leg recirculation flow path through valve RH26 to preclude excessive RHR pump flow. This change to the Salem Unit 2 licensing basi~ was implemented pursuant to a 10 CFR 50.59 safety evaluation dated July 1 0, 199 The inspectors subsequently identified regulatory concerns regarding compliance with the technical specification requirements for hot leg recirculation, the ability to implement the semi-automatic ECCS switchover from the injection to the recirculation phase, reduced RHRS pump net positive suction head (NPSH) margin, and the conclusions of the licensee's 10 CFR 50.59 evaluations. Refer to the attached simplified schematic of the Salem ECC E1. Hot Leg Recirculation
- Inspection Scope The inspectors reviewed a July 10, 1994 PSE&G safety evaluation, Salem technica specifications (TS) 3.5.2 and 3.5.3, Westinghouse project reports, and emergency operating procedures (EOP) 2-EOP-LOCA-3 and. 2-EOP-LOCA-4. The inspectors also reviewed engineering calculations and evaluations, memoranda, and condition reports pertaining to long-term recirculation cooling via the hot leg' flow path and the safety issues associated with IN 87-63.
- 2 Observations and Findings Excessive RHRS Flow IN 87-63 described various flow configurations that, due to certain singl~ failures, could redistribute RHRS flow in an undesirable manner: Both Salem units were susceptible to the undesirable flow distribution because the RHR discharge lines to the high and intermediate head ECCS pump suction lines do not contain check valves. Westinghouse evaluations PSE-92-186 and PSE-93-676, dated October 19, 1992 and August 24, 1993, respectively, predicted flow rates in excess of the RHR pump design maximum (4800 gpm) during the cold leg recirculation phase of a loss of coolant accident (LOCA). If a single failure of an RHR pump were postulated, "loop-around" flow from the operating RHR train to the non-operating train would occur. In this condition,. one RHR pump would provide flow to the following paths:
High head charging pump suctions
Intermediate head safety injection pump suctions
Two operating RHR pump cold legs
Two non-operating RHR pump cold legs via the "loop around" flow pat PSE-92-186 stated that this alignment would result in a high flow condition and that RHR pump operation in this condition was not recommended. Westinghouse reco.mmended that EOP and/or hardwa~e changes be made to reduce the flow rate below the pump design limit. On August 24, 1993, as part of a Salem RHRS EOP evaluation (PSE-93-676), Westinghouse identified failure modes during hot leg recirculation via the RH26 flow path that would result in an unacceptable RHR pump . flow condition higher than design, and well past the tested pump flow cur.v Westinghouse did not perform a hydraulic analysis to quantify the high flow condition at that time. In SECL-93-291, Revised Safety Evaluation for RHRS Operation During Recirculation, Revision 1, dated May 12, 1994, Westinghouse predicted maximum RHR pump flows of 5110 gallons per minute (gpm) at Unit 1 and 4910 gpm at Unit 2 (both cases in excess of design).
A!? originally designed and licensed, the RHR system included orifices in the discharge lines to maintain flow below 480.0 gpm. * However, ttie orifices are located downstream of the "loop around" flow path and will not prevent the excess flow condition. To address the excessive RHR pump flow considerations, Westinghouse recommended changes to the design basis and EOPs at both Salem units.- One recommendation deleted the hot leg recirculation path through valve RH26. The licensee implemented the recommendation on July 10, 1994 under the provisions of 10 CFR 50.59. The licensee concluded that the technical specifications did not require amendment to implement the changes.
The minimum RHRS functional requirements for cold and hot leg recirculation cooling are prescribed in TS 3.5.2 and 3.5.3. The inspectors found that between October 19, 1992 and July 10, 1994, the licensee had information that called into question the ability of the RHRS to perform the prescribed safety functio However, the licensee did not at that time initiate action under its quality assurance program corrective action process, and did not formally evaluate and document a basis for RHRS operability. Failure to do so was an apparent violation of 10 CFR 50, Appendix B, Criterion XVI, which requires significant conditions adverse to quality to be identified and corrected promptly. (EEi 50-311/97-11-01) The inspectors also found that prior to changing the EOPs on July 14, 1994, the functionality of long-term ECCS cooling was indeterminate due to predicted RHR pump runout and loss of NPSH, and that the RHRS therefore was inoperable. This was an apparent violation of TS 3.5.2. (EEi 50-311/97-11-02) 10 CFR 50. 72 and 10 CFR 50. 73 require notification and a written report, respectively, to the NRC of any condition that alone could have prevented the fulfillment of a safety function that is needed to mitigate the consequences of an accident, or of a condition that resulted in the plant being in a condition outside the design basis. The licensee's failure to report the degraded condition of the RHRS was the first of two examples of an apparent violation of NRC reporting requirements. (EEi 50-311197-11-03) Operation in Modes 1-3 , Technical Specification 3.5.2.c.2, applicable to Modes 1-3, requires separate SI and ECCS pump flow paths capable, upon manual initiation, of discharging into the RCS hot legs. The inspectors found that the ECCS design and licensing basis described in the Salem UFSAR prior to the *changes discussed above, required the RHR hot leg recirculation flow path to be via the RH 26 hot leg injection lines. Specifically, Section 6.3.2.11.4 stated that "... one RHR pump will be providing flow directly to two hot legs. The capability of long term recirculation flow to the RCS hot legs is provided from both the RHR and the safety injection pumps." Table 6.3-6 provided the instructions for the operational sequence for change-over from the cold leg recirculation phase to the hot leg recirculation phase. Upon completion of this operational sequence, the RHR pumps were aligned such that flow was provided to the hot legs via two separate flow paths - one directly from an RHR pump through valve RH26 and the other via the remaining RHR pump "piggy-backed" to the suction of the SI pumps and into the SI hot leg injection headers. In this alignment, failure of either RHR pump would not interrupt flow to the hot legs. By the licensee's elimination of the RH26 flow path, failure of the RHR pump aligned to the suction of the SI pumps would cause an interruption of hot leg flo On July 14, 1994, the licensee revised procedure 2-EOP-LOCA-4, Transfer to Hot Leg Recirculation, Revision 9, to remove the RH26 flow path under its 50.59 change process. The inspectors found that by eliminating the redundant and diverse RH26 flow path, the licensee decreased the reliability of the ECCS, therebyincreasing the susceptibility to single failure of the hot leg recirculation
- *
safety function. 10 CFR 50.59 permits licensees to change procedures described in the safety analysis report without prior NRC approval unless the change involves an unreviewed safety question. An unreviewed safety question is deemed to exist if the probability of occurrence of a malfunction of equipment important to safety as previously analyzed in the safety analysis report may be increased. The inspectors considered that the revision of procedure 2-EOP-LOCA-4 that eliminated the RHR hot leg recirculation flow path described in Section 6.3 of the Updated Final Safety Analysis Report (UFSAR) was an unreviewe.d safety question. This is the first of three examples of an apparent violation of 10 CFR 50.59. (EEi 50-311197-11-04) Operation in Mode 4 TS 3.5.3.b.2, applicable to Mode 4, requires an RHR pump flow path capable, upon manual initiation, of discharging into two RCS hot legs. The licensee informed the inspector that the TS requirement could be satisfied without the flow path through valve RH26 by aligning an RHR pump to the intermediate head SI system, discharging into the RCS through the intermediate/high head tiot leg injection header. However, the inspectors noted that intermediate head SI system is not. required by the TS to be operable in Mode 4, and thus may not be available for hot leg recirculation cooling; nor were the inspectors aware of any tests or analyses demonstrating the viability of that flow path through an idle safety injection pum Finally, the inspectors found that procedure S2.0P-AB.LOCA-0001 (Q), Shutdown LOCA, Revision 1, does not articulate specific steps for establishing hot leg recirculation through any flow path. Rather, the procedure relegates the responsibility for developing specific guidance to :the Technical Support Center engineering staff. The licensee stated that this general gu1uance is consistent with the generic Westinghouse abnormal operating procedure guideline TS 6.8: 1.a requires written procedures to be established and implemented covering the applicable procedures recommended in Appendix A of NRC Regulatory Guide (RG) 1.33, Quality Assurance Program Requirements (Operation). Section 6.a of RG 1.33, Appendix A, requires procedures for combating emergencies and other significant events such as LOCAs. The adequacy of the licensee Shutdown LOCA procedure guidelines for establishing hot leg recirculation cooling is unresolve (URI 50-311/97-11-05) Conclusions An apparent violation of the corrective action requirements of 10 CFR 50, Appendix B was identified concerning the licensee's failure, as of July 1994, to establish a basis for RHRS operability after receiving from Westinghouse information regarding potentially excessive RHR pump flow during cold and hot leg recirculation cooling. This condition compromised the ability of the. RHR pumps to perform their intended safety function and was an apparent violation of the Salem Unif 2 technical specifications. After July 14, 1994, when the licensee removed the RH26 flow path from the Unit 2 design and licensing basis, apparent violations of NRC requirements occurred pertaining to 10 CFR 50.59, and the notification and reporting requirements of 10 CFR 50. 72 and 10 CFR 50. 7 *
As recently as September 1996, the licensee issued a condition report (CR #96926098) identifying that the AHR hot leg flow path had been deleted in apparent conflict with the technical specifications. Licensee engineering concluded that the reference to the RHRS hot leg injection path should be deleted from TS 3.5.2.c.2 and 3.5.3.b.2; however, the licensee continued to consider the changes implemented in 1994 to be valid and had not scheduled a TS amendment for submittal to the NRC until June 30, 1 997. The NRC considers resolution of this matter a plant restart (entry into Mode 4) issue. (IFI 50-311197-11-06) E1. Residual Heat Removal Pump NPSH Margin Inspection Scope Westinghouse letter PSl-94-595, Revised Safety Analysis for RHRS Operation During Recirculation, dated May 1 2, 1994, credited containment air pressure at. the start of a postulated LOCA to compensate for the reduction in available RHR pump NPSH caused by the higher pump flows predicted during the cold leg recirculation mode. In 1994, the licensee approved this change under the July 10, 1994 safety evaluation discussed in Section E1.1.1. The inspector compared the Salem design and licensing basis as described in Section 6.3 and Appendix 3A of the UFSAR wit the following licensee and Westinghouse documents concerning RHR pump NPSH margin:
Calculation FSE/SS-PSE/PNJ-2017, Salem Unit 1 /2 ECCS Pump RHRS Recirculation
Westinghouse Letter PSE-97-527, Margin Recovery Program RHR Pump NPSH Recirculation Mode of Operation
Westinghouse Letter PSE-92-186, Transmittal of Salem Bulletin 87-63 Evaluation Report Observations and Findings As a consequence of "loop around" flow, the margin between required and available RHR pump NPSH, as originally licensed by the NRC, was decreased by a factor of four (from 2.4 feet to 0.6 feet). Notwithstanding, the licensee concluded in its July 10, 1994 safety evaluation that no unreviewed safety question (USQ) existe Emergency operating procedures 2-EOP-LOCA-3 and 2-EOP-LOCA-4 subsequently were revised (on July 14, 1994) and Section 6.3 of the UFSAR was changed to reflect the higher RHRS flows and their effect upon NPS The original Salem licensing basis described in an NRC Safety Evaluation Report (Supplement 4), dated April 1980, and more recently in the safety evaluation for License Amendment 69, dated May 1, 1989, racognized no credit for containment pressure in calculating available NPSH. However, licensee calculation FSE/SS-PSE/PNJ-2017, Salem Unit 1 /2 ECCS Pump RHRS Recirculation, dated December 6, 1 993, took credit for the containment pressure assumed to exist at the onset of a LOCA. The calculation was inconsistent with the Salem licensing basis as described in Section 6. 1 and Appendix 3A of the UFSAR, and NRC Regulatory Guide 1.1 as clarified in the NRC's Standard Review Plan dated July 1981.Westinghouse Letter PSE-97-527, Margin Recovery Program AHR Pump NPSH
. ' '
Recirculation Mode of Operation, dated February 21, 1 997, indicated that the need to credit containment overpressure for NPSH considerations may only apply to Unit 1. However, the inspector noted that the RHR pump curves provided by the manufacturer (Ingersoll-Rand Pump Curve for RHR, dated June 22, 1971) show that NPSH data do not exist beyond approximately 4800 gpm. Therefore, the required NPSH of 24 feet assumed by the licensee in its calculations is an extrapolated value that has not been validated by testing. Further, the pump head-versus-flow characteristics used in Westinghouse calculations are a "composite" of the four Salem RHR pumps (both units) used for bounding considerations. Ingersoll-Rand at the time had informed the Westinghouse engineers that the extrapolation was justified provided that the pumps were equipped with specially filed impeller vane The inspectors considered the extrapolation to be questionable, requiring more rigorous test data, and pending verification that the RHR pumps have the special impeller vanes specified by the manufacturer. (URI 50'."311 /97-11..:07) The inspectors questioned the licensee's NPSH calculations in several respects: (1) Consideration of containment "overpressure" (above sump water vapor pressure) for NPSH margin in the cold leg recirculation case is inconsistent with Unit 2's licensing basis. The licensee's calculations bounded both units with an analysis that assumed the TS minimum for containment pressure (-1.72 psig or 13.0 psia) as an initial condition. Based on Westinghouse Letter PSE-97-527, the licensee is in the process of revising the NPSH calculation to adjust against the sump water vapor pressure existing under the most adverse post-LOCA containment temperature conditions (2) The NPSH margin calculated by the licensee for the hot leg recirculation * configuration was less than that originally licensed by the NRC (3) Required NPSH was estimated from the pump curve in an untested flow region (4) Different containment sump water levels are described iri licensee design documents. A "full" sump originally was considered to be at an elevation of 78 feet 8 inches. Calculations of record indicate that the containment sump water level assumed for NPSH considerations is 80 ft, the level present at the onset of cold leg recirculation. However, the original licensing basis was * determined at an elevation of 81 feet 7 inche Conclusions Increased ECCS recirculation flow conditions resulted in a reduction in NPSH margin, as analyzed and documented by Westinghouse in SECL-93-291, and a * revisron of the licensee's NPSH calculation methodology to credit containment overpressure. The licensee approved changes to emergency operating procedures 2-EOP-LOCA-3 and 4, and revisions to UFSAR Section 6.3 in its July 10, 1994 safety evaluation. The changes increased the probability of occurrence. of a malfunction of equipment important to safety and thus introduced unreviewed
safety questions. The licensee's implementation of the changes associated with its July 10, 1994 safety evaluation without prior NRC review and approval is the * second of three examples of an apparent violation of 10 CFR 50.59 requirement (EEi 50-311/97-11-04) E1.1.3 Semi-Automatic ECCS Switchover Inspection Scope b. In the course of questioning NPSH requirements for the RHRS in the hot leg recirculation configuration (while already drawing on the containment sump), the inspectors were led to the related issues associated with drain down of the refueling water storage tank (RWST) and the switchover of ECCS from the injection mode to long term recirculation cooling. The inspectors examined Amendment 69 to the Salem Unit 2 operating license, emergency procedure 2-EOP-LOCA-3, UFSAR Section 6.3.2 and Table 6.3-8, a March 16, 1996 PSE&G safety evaluation, and related Westinghouse analyses and calculations, including Westinghouse letters PSE-96-533, PSE-95-800; and SECL-95-191. The inspectors also reviewed the licensee's response to Westinghouse Nuclear Services Advisory Letter (NSAL) 95-001; Minimum Cold Leg Recirculation Flow, dated January 12, 199 Observations and Findings Design Basis A semi-automatic switchover of ECCS pump suction originally was proposed for Salem Unit 2 in a July 1 7, 1980 PSE&G letter in response to original NRC licensing requirements. The design was founded upon ensuring "... continued ECCS pump flow to the reactor coolant system while protecting the ECCS pumps from damage as their suction source is being transferred from the RWST to the containment sump." An amendment request was re-submitted by PSE&G letter (LCR82-16) dated January 27, 1983, wherein the switchover sequence was described as being "... automated to the maximum feasible extent such that operator actions are minimized... and flow* is uninterrupted to all ECCS pumps during switchover." The automation of certain steps in the switchover procedure eliminated remote manual manipulation of six ECCS valves, and the stopping and restarting of the RHR pumps (which previous procedures required). The intent of the design, as described in PSE&G' s safety evaluation (in LCR82-16), was to eliminate the possibility of operator error for those steps being automated. Questions regarding the licensee's initial conceptual design were resolved between 1986-1989, and the NRC-approved the conversion from full manual procedures to a semi-automatic engineered safeguards feature design in Unit 2 License Amendment 6 PSE&G's Individual Plant Examination concluded that manual switchover of ECCS from the RWST to the containment sump is one of the most risk-significant operator actions at Salem. The NRC's Technical Evaluation Report on Salem Human Reliability Analysis issued in August 1995 (Table 2-1) identifies the transfer from injection to recirculation cooling as the most important human* action as ranked by
'
, ..
risk increase. The inspectors discussed the implications of not accomplishing the transfer under any accident conditions with licensee engineers, who estimated that the complete failure to implement the evolution successfully could increase the calculated core damage frequency by as much as two orders of magnitud Licensing Basis The Unit 2 ECCS switchover scheme was licensed by the NRC to ensure continued suction to the high head (charging) and intermediate head SI pumps and to provide uninterrupted flow of ECCS water to the core. The semi-automatic evolution involves automatic valve positioning and over ten manual operator actions, beginning when the RWST low level alarm is reached. The RWST low level alarm setpoints were established such that a certain amount of time was available (after receiving the low level alarm) for operators to *complete. the switchover. Assuming that all of the actions are successfully perfo;me_d, the Unit 2 switchover is
completed when the charging and SI pump suctions are aligned "piggy-backed" to the RHR pump discharge through the two ope.ned RH45 valve The available time reported in Amendment 69 (18 minutes), was considered by the NRC to be conservative since the automatic features (opening of the containment sump suction SJ44 valves, and closing of the RWST suction RH4 valves) served to extend the available time due to reduced outfall from the RWST. A containment spray pump is also tripped by the operators to reduce the RWST drain-down rate further, and to allow more time to complete the switchover. Subsequent to this inspection, the licensee provided information which indicated that the 18 minutes discussed in Amendment 69 applies to Mode 4 only, while the minimum time derived from the calculations reviewed as part of Amendment 69 was approximately 8.5 minutes. This time is documented on page 3 of the July 17, 1 980 PSE&G letter to the NRC as the minimum available time "... for the operator to perform the necessary switchover manual actions to ensure a continued suction source to the charging and safety injection pumps." In a phone conversation with the NRC associated with Amendment 69 (later docketed in a January 5, 1987 PSE&G letter), the licensee clarified Mode 4 operator actions and procedures for the switchover..The licensee reported an approximate 18.5 minute drain down (i.e., the time from RWST low level alarm until the unusable low-low level is reached), and a conservative estimate of 13 minutes as the time it would take an operator to "complete" the switchover (fully manually) in Mode Further complicating a more precise understanding of the time required to complete the switchover was the fact that, prior to March 1996, UFSAR Se.ction described only the Unit 1 switchover. UFSAR Section 6.3.2.6 and Tables 6.3-6 and 6.3-8 address the Unit 1 design, stating that "... the entire switchover process involves nine steps and will take approximately 13 minutes." Even after approval of Amendment 69 on May 1, 1989, the Unit 2 switchover was not reflected
accurately, representing an apparent violation of 10 CFR 50. 71 (e) for failure to update the UFSAR. (EEi 50-311/97-1 1 -08!
.* I'
Emergency Operating Procedures Emergency operating procedure (EOP) 2-EOP-LOCA-3, Transfer to Cold Leg Recirculation, Revision 20, requires all ECCS pumps taking suction from the RWST to be tripped for vortexing considerations if the RWST low-low level alarr(l is reached. This level therefore defines the limit of the total time available to the operators for switchover prior to additional action to protect the ECCS pumps. The licensee's revisions of the EOP required a re-evaluation of the licensing basis for cold leg switchover in 1995.. The re-evaluation also considered L!:icertainties in specific operator action times (which may take longer than originally assumed), including the introduction of "three-point" communications, and the identification of more limiting single failure scenarios. The licensee found that. under certain * accident conditions and single failure scenarios involving higher than previously-assumed containment spray pump flows, the operators may not be able to complete the switchover prior to reaching the low-low level alarm poin March 1 996 Safety Evaluation On November 1, 1995, Westinghouse summarized its re-evaluation of the RWST drain-down and its effect upon EOPs, LOCA analyses, and the switchover design in letter PSE-95-800, Salem Cold Leg Flows and Time Requirements. The letter referred to several meetings held with PSE&G over the past year as part of a Salem Systems/EDP Interface Task Team which addressed possible means of meeting the requirements for the switchover. The letter stated that under certain accident and single failure scenarios, the operators may not complete the switchover prior to reaching the RWST low-low alarm, and identified that tripping the charging and SI pumps was not consistent with NSAL 95-001 analyses which assumed continuous pumped flow. The final safety evaluation (SECL-95-191) was provided to PSE&G by Westinghouse letter PSE-96-538, dated February 7, 199 The licensee completed its formal evaluation of the drain-down analysis (Westinghouse SECL-95-191) and *uFSAR change 96-04, Salem RWST Drain Down . and Cold Leg Recirculation Evaluation, on March 16, 1996. The licensee's safety evaluation resulted in a reduction in the time available to complete the switchover prior to reaching a low-low level alarm, as well as a decrease in or brief interruption (of up to five minutes) of pumped cold leg recirculation flow, depending on specific accident scenarios. The latter concern prompted a re-analysis of 10 CFR 50.46, Appendix. K calculations for long-term emergency core coolin The recalculated times (in minutes) for operator action to ensure long-term core cooling consistent with 10 CFR 50.46 were summarized in SECL 95-191 for various LOCA scenarios as follows:
Low level until RH 1 9 is closed Remaining actions to 10':1-low alarm Allowable flow interruption Total operator action time
Large Break.8 Accumulator Small Break Line Break.0.9.0 1.9 The times approved by the licensee in the March 16, 1 996 safety evaluation were based on modelling three significant operator action "milestones" in RWST drain-down calculations: (1) The first milestone (or time segment) consists of isolating the RHR headers within four minutes by closing cross-tie valve RH 19, thereby eliminating certain single failure effects that otherwise increase the rate of RWST drain down. The semi-automatic features of the Unit 2 switchover re-align the RHR pump suction early in the sequence during this first time segmen (2) The second discrete time segment analyzed is the remaining time until the RWST level drops to the low-low alarrri. Examining this point, the design basis large break LOCA is now predicted to result in 7.8 minutes between low and low-low tank level, which is a shorter time than licensed in Amendment 6 (3) The third time segment modelled was never considered as part of Amendment 69 and, for the small break and accumulator line break cases, represents the time during which no pumped flow is present but gravity drain from the cold legs is sufficient to maintain the core quenched (or covered).
The time without ECCS injection is not explicitly reported for a large break, since the RHRS already is aligned to the sump and providing flow to a reactor coolant system de-pressurized below RHR pump shutoff head. The inspectors further found that the increased RWST drain down time resulted in receipt of the RWST low level alarm, and therefore the termination of the injection phase and beginning of recirculation--90 seconds sooner (at 12.5 minutes) than originally calculated and license. '.
The inspectors were concerned regarding the implications of this third (new) modelled segment, in that not only would slow operator response times invalidate the functionality of the switchover (an engineered safeguards feature), but also risk violating 10 CFR 50.46(b)(5) in small break LOCA (SBLOCA) scenarios wherein total operator response time exceeded 13 minute The operator response times were found to be more restrictive than originally assumed and licensed, and critical task times currently trained on in the simulator were incorrect. For the most limiting large break LOCA case, the switchover (during the time frame between the RWST low and low-low level alarms) must be accomplished within 7.8 minutes; faster than originally licensed. Licensee training personnel indicated that operators are judged on completing the* transfer in 11.8 minutes; and, they typically require approximately 9.5 minutes to complete all of the switchover steps. The inspectors considered the 11.8 minute acceptance criterion to be invalid, since it included the additional 1.8 minutes where forced recirculation flow to the core is stopped in a SBLOCA. Additionally, it is unclear whether operators can successfully perform the switchover even in the initial 10 minute period of a SBLOCA, particularly considering modelling uncertainties (e.g., containment spray pump flow rates, single failure of valve RH2, etc.) with th Unit 1 simulator and allowance for operator errors. The ability of operators to complete the switchover successfully within an appropriate, licensed, time remains in question and is therefore unresolved. (URI 50-311/97-11-09) Westinghouse NSAL 95-001 NSAL 95-001 addressed reduced cold leg recirculation flow for plants like Saiem that use ECCS pumps to supply containment spray. The conditions discussed in NSAL 95-001 became relevant to Salem Unit 2 upon discovery that ECCS flow may need to be interrupted during switchover of ECCS pump suctions from the RWST to the containment sump. New information about extended boiling periods in reactor vessel plenum and downcomer regions due to metal heat challenged the design requirement that long-term recirculation flow should be equivalent to one ( 1.0) times the decay heat boil-off rate at switchover, calling into question compliance with 10 CFR 50.46(b)(5), Long-Term Coolin Westinghouse established a new criterion (1.2 times decay heat boil-off rate) both to assure adequate core cooling and to prevent the core from unquenching (core uncovering). However, Salem was one of several plants that did not satisfy the new criterion. While generic analyses using a code ("NOSI") developed to study the effects of short periods of no ECCS flow during switchover predicted core unquenching at some plants, fuel cladding temperatures still were projected to remain below 1 200 degrees Fahrenhei Further evaluations specific to Salem were completed by Westinghouse in early 1996. The analyses indicated 1.8 and 5 minute periods of flow interruption (for limiting small break and accumulator line LOCAs, respectively) during which the remaining switchover actions needed to be completed and the high and intermediate head SI pumps restarted. For the design basis (large break) LOCA, the inability to complete all switchover actions within 7.8 minutes was not considered by the licensee in their March 16, 1996 safety evaluation to be a concern with respect to
,..
core cooling because the RHR pumps alone would be able to provide injection flow above reactor coolant system pressure in excess of the new requirement (1.2 times decay heat boil-off rate). The inspectors noted that in terms of long-term cooling, the licensee's March 1996 safety evaluation stated that "... the 10 CFR 50.46 analysis of record for Salem is based on limiting plant performance characteristics documented in Westinghouse letter NSAL-95-001." The inspectors were concerned further that the licensee was incorporating generic analyses into the Salem Unit 2 design basis using the undocumented (and unlicensed) "NOSI" code as the basis for the 1.8 minute SBLOCA period of no pumped flow to the core. The use of the "NOSI" code for Salem-specific LOCA analyses was therefore left unresolve (URI 50-311/97-11-10) Conclusions The reduced time to complete the switchover and the predicted ECCS flow interruption, as analyzed and documented by Westinghouse in SECL-95-191, represent a USQ in that the necessity to restart certain pumps increases the probability of a malfunction of equipment important to safety previously evaluated in the NRC's safety evaluation report associated with Unit 2 License Amendment No. 69, and therefore is the third example of an apparent violation of 10 CFR 50.59 requirements. (EEi 50-311/97-11-04) The inspectors also.considered that the reduced switchover time and interruption of ECCS flow were a fundamental divergence from the* plant licensing basis described in License Amendment 69 that placed the plant.outside of its design basis. The licensee's failure to report the condition to the NRC was Lne second example of an apparent violation of 10 CFR 50.72 and 10 CFR 50.73. (EEi 50-311/97-11-03) V. Management Meeting X1 Exit Meeting Summary The inspector discussed the findings with the licensee staff and management at an exit meeting on April 17, 1997. The licensee acknowledged the findings presented. No proprietary materials were knowingly retained by the team or disclosed in this inspection report.*
.., ~ \\ ...
PARTIAL LIST OF PERSONS CONTACTED Public Service Electric and Gas B. Simpson D. Powell S. Mannon M. Danek M. Reddemann H. Berrick B. Thomas Senior Vice-President, Nuclear Engineering Licensing Manager Principal Engineer Senior Project Engineer Director of Engineering Senior Project Engineer Licensing Engineer Nuclear Regulatory Commission E. Kelly DRS Systems Branch L. Nicholson J. Linville Acting Deputy Director, DRP Branch Chief, DRP SRI C. Marschall M. Shuaibi C. Liang B. Smith NRR Reactor Systems NRR Reactor Systems Contractor INSPECTION PROCEDURES USED IP 93902 Followup - Engineering ITEMS OPENED, CLOSED, AND DISCUSSED Opened 50-311/97-11-01 EEi 50-311/97-11-02 EEi 50-311 /97-11-03 EEi 50-311 /97-11-04 EEi 50-311/97-11-05 URI 50-311/97-11-06 IFI 50-311/97-11-07 URI 50-311/97-11-08 EEi 50-311 /93-11-09 URI 50-311/97-11-10 URI Corrective Action for RHR Pump Runout Implementation of TS 3.5.2 Prior to July 1994 Failure to report a condition outside design basis Violation of 10 CFR 50.59-ECCS switchover Adequacy of Mode 4 LOCA procedure TS amendment to remove hot leg recirculation Verify filed RHR pump impeller vanes Failure to update FSAR Verify operator ability to perform timely ECCS switchover Use of "NOSI" code for Salem-specific analysis
-- ...,
- ~* '
.. CFR CR ECCS EEi EOP(s) FSAR gpm IHSI LOCA(s) NPSH NSAL PSE&G psi a psig RCS RHR(S) RWST SER SI TS(s) UFSAR URI USQ
LIST OF ACRONYMS USED Code of Federal Regulations Condition Report Emergency core cooling.system Escalated enforcement item Emergency operating procedure(s) Final Safety Analysis. Report gallons per minute Intermediate head safety injection Loss of coolant accident(s) Net positive suction head Nuclear Services Advisory Letter Public Service Electric and Gas Company pounds per square inch absolute. pounds per square inch gage Reactor coolant system Residual heat removal (system) Refueling water storage tank Safety Evaluation Report Safety injection Technical Specification(s) Updated Final Safety Analysis Report Unresolved Item Unreviewed safety question
ATTACHMENT EMERGENCY CORE COOLING SYSTEM ONE-LINE DIAGRAM Fj'.sT (400<) G.\\~LON 21T~ CONTA!NMENT ~~ fl>li HX'S
SJH'S 21~4
AHIS F!HZO I RHIS
22RH4 ~:J SJ 1~* 5.J:SO SJ 2ZSJ40 s~* SJI SJZ \\ICl --f>lo::J--{)A;j.-1 cs PlW'5 ,,...... ~~-----~-c:1~...... _.~"'""4~~"'-l--D<l--4 SPRAY ADOlTJVC: T.fH< CS2 CS I ti I I l 21CSJ6 _ I l I I r I 21CSti 215J4S 2'25J~ z1rc 2Zrc z:sy.<; Z4f c Jl:;liG84,aa
- l>J54 ZI Tc Z3 Tc
' /"'
}}