ML17056C049
| ML17056C049 | |
| Person / Time | |
|---|---|
| Site: | Nine Mile Point  |
| Issue date: | 09/30/1992 |
| From: | Gundrum L NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD) |
| To: | |
| Shared Package | |
| ML17056C048 | List: |
| References | |
| TASK-AE, TASK-T92-07, TASK-T92-7 AEOD-T92-07, AEOD-T92-7, NUDOCS 9210080112 | |
| Download: ML17056C049 (18) | |
Text
AEOD TECHNICALREVIEW REPORT UNIT:
Nine Mile Point Unit 2 TR REPORT NO.: AEOD/T92-07 DOCKET NO.: 50-410 DATE:
September 30, 1992 LICENSEE:
Niagara Mohawk Power Corporation CONTACT:
L. Gundrum
SUBJECT:
Inoperability of the Standby Liquid Control System During Surveillance Testing at Nine Mle Point Unit 2
SUMMARY
The standby liquid control system (SLCS) would not have been capable of performing its safety function ifan automatic initiation signal were received during surveillance testing.
Receipt of an initiation signal during testing without manual actions could have resulted in either injection of demineralized water in lieu of sodium pentaborate solution or possibly result in draining of the standby liquid tank onto the floor. The surveillance test procedure did not specify adequate guidance to enter the correct technical specification (TS) action statement or to alert operations to the potential impact of receiving an automatic initiation signal during testing.
DISCUSSION LER 91-015-00 reported the failure to comply with TS requirements for the SLCS operability during the performance of surveillance testing at Nine Mile Point Unit 2 on February 20, 1992.
The purpose of this technical review is to discuss the bases for reporting; the requirements for the automatic initiation of SLCS; pertinent design features of the system; the testing arrangement; the safety implications of the test procedure; the corrective actions; and the generic implications for other facilities.
i f rRe in During a review of the quarterly Surveillance Testing procedure, a reviewer determined that the testing procedure could render the SLCS inoperable.
The intent of the procedure was to test only one of the two pumps or one of the two pump discharge check valves.
The surveillance test required entry into TS 3.1.4, ACTION a.l.
This Action statement allows 7 days to restore an inoperable pump and/or explosive valve.
The reviewer determined that the valve alignment during portions of the test would prohibit flow of sodium pentaborate to the reactor coolant system ifan automatic signal was received while the system was aligned in the test configuration.
The test procedure could be performed in accordance with TS if the proper action statement was entered.
The appropriate TS is 3.1.5, ACTION a.2 which 9210080ii2 920930 PDR ADOCK 05000410'
,, P PDR+l
allows 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> to restore the SLCS ifit is inoperable.
However, the test configuration did not ensure that inadvertent actuation of the system would not result in degrading the SLCS.
The TSs discuss operability in terms of one pump and/or one explosive valve which is assumed for this discussion to define one train of the SLCS.
R uirements for Aut matic Initiati n f L The SLCS is required by 10 CFR 50.62 for Boiling Water Reactors (BWRs) to allow mitigation of anticipated transients without scram.
This regulation.was issued in June 1984.
Prior to issuance of the regulation, the need for automatic initiation was the subject of much industry discussion.
Four units that were close to receiving their operating license decided to include automatic initiation of the SLCS in their designs.
These units are Nine Mile Point 2 (NMP-2), Limerick Units 1 and 2, and Hope Creek Station.
When issued, the regulation did not require automatic initiation of the SLCS for any unit unless the unit had already been designed and built to include this feature or ifthe construction permit was granted after July 26, 1984.
No BWR units have been built that received construction permits after July 26, 1984.
Therefore, only the four units that incorporated the automatic initiation into their design prior to issuance of the regulation are required to retain this feature.
Allother BWRs were required to install SLCS but the system is manually actuated by control room operators.
D inF r
fth L
The SLCS consists of a single storage tank of sodium pentaborate solution whose volume and concentration are defined in the TS.
The single tank discharge line is split into two separate trains.
The piping diagram is shown on Figure 1.
Each train has positive displacement pumps (P1A, P1B), explosive valves (VEX 3A, VEX 3B), motor-operated valves (MOV 1A, 1B), and control circuits for the SLCS that constitute all of the active equipment required for injection of the sodium pentaborate solution.
Additionally, the redundant components of the SLCS are physically and electrically separated.
The pumps and tanks are located on the 289-foot elevation of the reactor building outside the shield wall. The isolation check valve, and a maintenance valve that is normally locked open are the only equipment inside the drywell. The injection portions of the SLCS have been designed electrically as a Class 1E redundant system.
The SLCS is not designed for use as.a safety system since adequate control rod redundancy is available.
Therefore, the SLCS with one tank, one injection point, and nonredundant and nonclass 1E heaters is considered adequate.
SLCS equipment controls located in the control room include pump pushbutton switch (run, normal, stop); storage tank outlet valve position (open or closed); mixing heater (on or off);
and operating heater (on or off).
The following SLCS alarms and indicators are available on the reactor core cooling benchboard in the control room: standby liquid tank temperature alarm (high/low); standby liquid tank level alarm (high/low); indication of maintenance valve position (fullyclosed);
indication of test tank outlet valve position (fully open/closed); indication of test tank inlet valve position (fullyopen/closed);
indication of loss of continuity or power loss to the squib
valves; indication of overload trip or power loss for the motor operated valves in the lines from standby liquid tank to the pumps; and indication of pump overload trip or power loss.
Additional indication of reactor vessel water level, reactor coolant pressure, neutron flux level, control rod position and scram valve status are available for the operator to determine ifSLCS should be terminated prior to injection.
Each train has the following components downstream of the storage tank: a manual isolation valve (normally open); a motor operated isolation valve (MOV 1A, MOV 1B, are normally closed, but receive a safety signal to open); a manual isolation valve (normally open); two pressure taps with normally closed isolation valves; a positive displacement pump; a test connection with redundant isolation valves (166 and 167 for Train A, and valves 168 and 169 for Train B); a relief valve; a discharge check valve (12 on Train A and 14 on Train B); a manual isolation valve (normally open); and an explosive (squib) valve.
The two trains can be cross connected on either the suction or discharge side of the pumps.
Both cross-connect lines have double isolation valves.
Valves 28 and 29 provide isolation for the suction cross-connect, and valves 52 and 53 provide isolation for the discharge cross-connect.
The test tank suction line is located between the double isolation valves on the discharge cross-connect line. The discharge from the test tank is connected to the piping between the isolation valves on the suction cross-connect line. The trains come together into a common injection line that is routed through containment isolation valves to the reactor vessel.
This common line has flow instrumentation installed.
The TS requirements for the volume of boron solution in the storage tank is a minimum 4418 gallons and a maximum of 4815 gallons.
The minimum average concentration of natural boron required in the reactor core to ensure adequate shutdown margin after operation of the SLCS is 660 ppm.
Calculation of the minimum quantity of sodium pentaborate to be injected into the reactor is based on the required 660 ppm average concentration in the reactor coolant, including recirculation loops, at 68 F and reactor water level at level 8.
The result is increased by 20 percent to allow for imperfect mixing and leakage.
Additional sodium pentaborate is supplied to accommodate dilution by the residual heat removal system in the shutdown cooling mode.
With two pumps operating at 82.4 gpm, it will take 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to inject sufficient boron to achieve the minimum required boron concentration.
Only one pump is needed for backup shutdown system operation.
The SLCS at NMP-2 can be initiated either manually or. by receipt of the Redundant Reactivity Control System (RRCS) initiation signal.
A description of the parameters initiating SLCS and sequence of events following initiation are discussed.
The RRCS is designed in conjunction with other systems to mitigate the potential consequences of an unanticipated transient without scram event.
The RRCS logic monitors reactor dome pressure and water level.
High dome pressure or low water level (Level 2) or RRCS manual initiation willcause the alternate rod insertion (ARI) valves to scram the reactor independently of the reactor protection system.
Low water level alone will, in addition to an ARI scram, cause an immediate recirculation pump trip (RPT).
After 98 seconds of continued low water level, and ifthe average power range monitors (APRM) channels are not downscale or are inoperative, the RRCS initiates SLCS and isolates the.>
reactor water cleanup system (RWCU).
High reactor dome pressure alone will, in addition to an ARI scram, immediately trip circuit breakers and initiate transfer of the recirculation pumps to low frequency motor generator (low speed) operation.
After 25 seconds of continued high pressure, and ifthe APRM channels are not downscale or are inoperable, the RRCS trips circuit breakers to complete the RPT.
In addition, feedwater runback is initiated ifthe feedwater runback disable switch is in the OFF position.
After an additional 73 seconds of continued high pressure and with the APRM channels still not downscale or inoperable, the RRCS initiates SLCS and isolates RWCU.
Manual initiation alone causes an immediate ARI scram.
After 98 seconds, ifthe APRM channels are not downscale or are inoperable, the RRCS initiates SLCS and isolates RWCU.
Manual initiation does not cause an RPT or feedwater runback.
The SLCS is separated both physically and electrically from the control rod drive system.
The SLCS once initiated can be stopped either by manual action or automatically when the storage tank level falls to the low level setpoint.
T tin A
n emen The permanently installed equipment used to test the SLCS pumps and their discharge check valves include a 210 gallon test tank with inlet and outlet isolation valves (HCV-116 and HCV-111) for the tank.
The test tank fillline is supplied by the demineralized water system.
The test tank suction line is piped from the discharge cross-connect line between isolation valves 52 and 53.
The test tank return line is connected to the suction cross-connect line between isolation valves 28 and 29.
The only additional equipment used in the test are pressure indicators installed at taps on the suction and discharge sides of the SLCS pump.
During performance of the test, only demineralized water is circulated through the piping system.
afet Im licati n fthe Test Pr ure Two separate problems were found with the existing procedure.
The first problem can occur during pump testing.
The second problem can occur during the reverse flow testing of the pump discharge check valve.
During pump testing the procedure relied upon the squib valve staying closed and did not require closing the isolation valve (50 on Train A or 51 on Train B) between the squib valve (VEX 3A, VEX 3B) and the reactor vessel injection point. Ifan RRCS signal was generated during testing, the squib valves would fire and the pumps would receive a start signal.
This would allow the contents of the test tank to be injected by the pump on the train being tested.
This would dilute the concentrated. boric acid solution being injected by the other train.
For the reverse flow testing of the check valve (12 on Train A or 14 on Train B), the discharge cross-connect line was opened.
As the opposite train's pump circulated the contents of the test tank, the discharge check valve would see reverse flow at system
operating pressure.
To verify ifthe check valve was leaking, both normally closed valves (166 and 167 on Train A or valves 168 and 169 on Train B) on a test connection between the check valve and the nonoperating pump were opened. Ifno flow was observed through the test connection, the acceptance criterion was satisfied. Ifan RRCS signal occurred, the train considered operable would start to pump the contents of the SLCS storage tank.
- However, the boric acid solution would be pumped through the open test connection onto the floor.
The pump on the other train would pump the contents of the test tank into the reactor vessel.
iti ati n Alternaive Ifthe RRCS initiated during the performance of pump testing or check valve testing, the local operator would have to manually realign the system within 98 seconds.
Based on the number of valves that would need to be repositioned, it would not be likely that the realignment could be accomplished.
The specific manipulations required are given in.
Taking no action to realign the system during the pump test could result in degradation of the pump being tested as well as dilution of the initially injected sodium pentaborate by the contents of the test tank.
Taking no action to realign the system during check valve testing could result in adding the contents of the test tank (demineralized water) to the reactor vessel and depleting the supply of borated water in the SLCS storage tank onto the floor. Alternatively, the control room operator could stop the actuation of the system by placing the pumps in the stop position until the system was realigned.
However, since the SLCS is only actuated ifthe rod control system fails to operate, deliberately bypassing a safety signal would not be advisable.
FINDINGS NMP-2 revised Operations Surveillance Procedure N2-OSP-SLS-Q-001, "Standby Liquid Control Pump, Check Valve, and Relief Valve Test" to require entry into the correct TS limiting condition for operation for check valve testing which states that both divisions of the SLCS can be out of service for up to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.
A caution has been incorporated into the procedure to isolate the cross-connect valves (52, 53) in case of automatic initiation to prevent pumping the storage tank to the test tank.
Procedure. revisions 4o not prevent the possibility of dumping the tank contents to the floor. However, an operator is stationed at the leak detection point (valve 166 or 168) during the check valve testing.
The procedure change included the requirement that the discharge manual isolation valve (2SLS*V50 or 2SLS~V51) located downstream of the squib explosive valve be closed prior to testing of the pump on each train to prevent the'injection of demineralized water.
NMP-2 is one of four power plants that have automatic initiation capability of the SLCS.
The others are Hope Creek Generating Station and Limerick Units 1 and 2. After notification of the NMP-2 finding, Hope Creek Generating Station personnel modified similar inservice testing procedures.
No changes were required at Limerick. The requirement to close the maintenance valve downstream of the explosive valve is discussed in Section 9.3.5.4 of Limerick's Updated Final Safety Analysis Report.
CONCLUSIONS There are no generic implications concerning the surveillance testing of the SLCS at BWRs.
No additional actions are required.
Valve 5
IICV III Tlsr ThIYK tlo Bhl CWhCYTY TAWN 2SLS Test tank Throttle Valve HCV II~
Va4 (5<
Valse ((Y7
~raU2.
Ya ve So I
HOV Ih MoIYla
~vive Valve 168~
Volvo 1G9
~Ya ~v~I 2StS~P)8 flII~
~a Sqnlb Valve Ya+~ 0 VEZ> f'Laavl~
JL (DlsclIarge to Reactor Yesseli O
F>
2SLS Test Tank Throltle Valve II I
I HCV III TESI IAHK tI0 0 AL CADAcirv T'ARKX Hcv IIA I
I I
I I
I I
Valve 45 Valve 12 I
I I
2SLSiP IA Valve 52 vcI ah Valve 5O
.O.
AIOV lA Valve 20 JIA n
Valve 53 Squib Valves 01scharge to Reactor Vessel)
Valve 29 Valve Ih vq&B Valve 51 MuV Ie Ind1cates Test Flow Path (Oemln. Mater)
Indicates Sodium Pentaborate Flow Path Our lng SLS ln1tiatlon (throttling down sequence of IICVllG not yet at a pressure of >1000 pslg Indicates Valve Open Ourlng Test tndIcates Valve Closed Ourlng Test (IIoto: HOYIB and both Squib valves open during system In1tla1.1on)
lJ
II I
I HCV III Tasr 1~HI t/o oAI, CAphc<<v ThttK X 2SLS Test Tank Thro&le Valve a
Hcv.r IA
~OV IA~
Yalvc 20 r
Valve 45' valve, t6
"" IS Valve 29 1IA Val ve 12 f I
Valve I
2SI.S*P IA l
A Valve 53 4
~Valve 14 52
" "a" Va 1 ve 50
/
~0 Squib Yalves vgps Yalvc 51 Discharge to Reactor Vessel)
Indicates Test Flow Path (Ocmin. Mater)
Indicates Sodium Pcntaboratc Flow Path Ourlng SLS Initiation
( throttling down sequence of IICV116 not yet at a prcssure of )1000 psig Indicates Valve Open Ouring Test Indicates Valve Closed Ouring Test (Hotn: IIIOYIA and both Squib valves open during systcn initiation)
Valve 5
2SLS les t tank c,
fonna IIcv III vast
'rhHK tlo Bht
<<IN'bc<A'hasa ThroMIe Valve HCV I la MOV Ih I
1 alve q<lvc )I Valve. lL7 Valve 168~
Valve 16&
Mo1'
~
I II'
~ve&2.
~t
~25 i~a
~Ya ~v 2SI~S* ~JJ PIS ~
VEXED
~Ya v 50 I
4 a '~p. ~,
~
Squib Valve fag~
vs~> 'f'Leave~
/4 (Discltarge to Reactor Vessel)
+ - Tndtcates Test Flow Path (DcmIn. II,O)
M - Indicates Yalve Open During Testing H
lndtcatos Yal ve Closed Our 1ng Tes<<1ng-
~- Indicates Ycssel Inde<<<<Ion Flow Path (Oemtn.
Ila0 and Sodtum Pentaborate) during SLS ln1tlatlon [MY1A, Squib valves open, Pl& starts) ca
Ij
Ya'Ivc 5 2SLS Test tank c,
ea a a a a IIcv Ill vcsr
'fhfIIe ilo Bhl CJIIPCIQ TAIIK5 lbrottlc Valve HCV II~
HO~ fh goy(8 Valve. l6C 4>4c lQ
~ai v~e Valve 168 Valve IG9
~Ya
~v
~raU2.
~2S S~
~Ya va 50 I
~a~K 9 Squib Valve YalYMR li VS~38:f~av'~
(DlsclIarge to RcactoI Ycsscl)
-'-~ - Indicates Test FloII Path (DcrIIn. II,O)
M - indicates Yalve Open During Testing W - tndlcatas Yalve Closed During Testing"
~ - indicates Ycsscl Injection Flower Path iDcIIIIn. Ilco and sodium Pcntaborate) during SLS Initiation (MY10, Squib valves open, P18 starts)
~
O0
~
~
~ ~
~
~
I Actions Required To Restore Train/System urveillance Test of P m A
i re 2 To ensure Train B is not diluted, valve 50 must be closed.
To restore Train A, the system must be drained, valve 45 must be opened, and valves 28 and 52 must be closed.
urveillance T t f P m B
i ure To ensure Train A is not diluted, valve 51 must be closed.'o restore Train B, the system must be drained, valve 46 must be opened, and valves 29 and 53 must be closed; urveillance Test of Pum A Dischar e heck Valve i ure 4 Valves 166 and 167 must be closed to prevent dumping sodium pentaborate solution to the floor. Ifno other actions are taken the sodium pentaborate would be diluted by the demineralized water contained in the piping and the test tank.
Closing valve 52 in the discharge cross-connect line and valve 51 the train B isolation valve would prevent some of the dilution.
urveillance T t f P m B Dischar e heck V Ive Fi re Valves 168 and 169 must be closed to prevent dumping sodium pentaborate solution to the floor. Ifno other actions are taken the sodium pentaborate would be diluted by the demineralized water contained in the piping and the test tank.
Closing valve 53 in the discharge cross-connect line and valve 50 the train A isolation valve would prevent some of the dilution.
12
4,