ML17244A538
| ML17244A538 | |
| Person / Time | |
|---|---|
| Site: | Ginna  |
| Issue date: | 04/28/1979 |
| From: | White L ROCHESTER GAS & ELECTRIC CORP. |
| To: | Grier B NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| References | |
| NUDOCS 7906020217 | |
| Download: ML17244A538 (34) | |
Text
- .
I,'lpls~J~J~" I I!/'i2'7~5FJ ROCH ES TER GAS AND ELEC TRIC CORPORA TION o
89 EAST AVENUE, ROCHESTER, N.Y. 14649 LEON D. WHITE. JR.
VICE PRESIDENT TELEPHONE AREA COOK 7III 546-2700 April 28, 1979 Mr. Boyce H. Grier, Director U. S. Nuclear Regulatory Commission Office of Inspection and Enforcement Region I 631 Park Avenue King of Prussia, Pennsylvania 19406
Subject:
Response
to IE Bulletins79-06A and 79-06A, Revision I entitled "Review of Operational Errors and System Misalign-ments Identified During the Three Mile Island Incident"
Dear Mr. Grier:
Attached is the response of the Rochester Gas and Electric Corpo-ration to the subject bulletins; received on April 14 and 19 respectively and as applicable to the Robert E. Ginna Nuclear Power Plant, Unit No. 1.
Our responses have been prepared from a continuing task force review at the plant, with our vendor and the U. S. Nuclear Regulatory Commission.
Plant procedures have been and are being reviewed and
- updated, based on the available TMI experience, as well as the vendor's Emergency Operating Procedures and NSSS Reference Operating Instructions referenced to ensure incorporation of adequate procedure and equipment parameters to provide proper operator action.
Very truly yours, L. D. White, Jr.
..Att.
xc:
NRC Office of Inspection and Enforcement Division of Reactor Operations Inspection Washington, D. C.
20555
'7906080/.lg
~
J
April 27, 1979 R., E. Ginna Power Plant Unit No. 1 Rochester Gas a Electric Corporation
Response
to I.E. Bulletin No.79-06A and No.79-06A, Revision 1 Item Nl Review the description of circumstances described in Enclosure 1 of IE Bulletin 79-05 and the preliminary chronology of the GMI-2 March 28, 1979 accident included in Enclosure 1 to IE Bulletin 79-05A.
1 a.
This review should be directed toward understanding; (1) the extreme seriousness and consequences of the simultaneous blocking of both auxiliary feedwater 'trains at the Three Mile Island Unit 2 plant and other actions taken during the early phases of the accident; (2) the apparent operational errors Mich led to the eventual core damage; (3) that the potential exists under certain accident or transient conditions, to have a water level in the pressurizer simultaneously with the reactor vessel not full of water; and (4) the necessity to systematically analyze plant conditions ard parameters an3 take appropriate corrective action.
~Res nse:
An analysis of the incident at lNI has been made based upon the available information contained in published reports.
The initial events and subsequent actions have been reviewed to determine the plant conditions at various times throughout the accident.
A graphical representation of plant conditions has been developed using the following parameters:
hot leg temperatures, cold. leg temperature, pressurizer
- pressure, and pressurizer level.
Autcmatic actuations of emergency safety features and the manual manipulations of canponents by the operator have been included to explain the variations in the above parameters.
An analysis of each major phase of the accident was made in an attempt to understard the plant conditions, the reasoning behind the actions taken by the operator, and the consequences of these actions.
Speculations were made as to the alternate options available.-
Fran our review of the operators actions it appears that close attention may have been given to a single parameter rather than
-obtaining other additional information.
This situation occurred with pressurizer level indications which apparently led to the false assumption that the reactor vessel was full of water and the
= operators'ecision to secure the safety injection pumps.
The hot leg temperature and cold leg temperature indications (as ccmpared to the average loop temperature) could have given the operator a
better understanding of the accident with respect to saturation conditions within the loop.
The necessity to consider several parameters before operational decisions are made has been discussed ard will be further reviewed, by our Training Department (see response,to Item lc).
1 b.
Operational personnel should be instructed to: (1) not override autanatic action of engineered safety features unless continued operation of engineered safety features will result in unsafe plant conditions (see Section 7a.);
and (2) not make operational decisions based solely on a single plant parameter indication Ken one or more confirmatory indications are available.
~Res nse:
"Available information on the Three Mile Island incident was distributed to the Operation and Training Departments.
Operational personnel were instructed in the Operating Plan April 5, 1979 to read the assessment of 'IHI and the Westinghouse-recanmendations for Westinghouse plants.
Operational personnel were also instructed on April 6, 1979 to manually initiate safety injection if pressurizer pressure dropped below the safety injection actuation setpoint.
This was sumarized through an inter-office camnunication dated April 18, 1979.
Operational personnel were instructed that in the event of a transient condition, no cgerational decisions should be based solely on one plant parameter but confirmatory irdications should be obtained where available.
Also, three licensed individuals will be required in the control roan during a transient condition, with one of the licensed persons overlooking the entire situation. If necessary, the additional licensed personne1 auld be called in.
Operational personnel have been reinstructed not to override the automatic actuation of emergency safeguard features unless their continued action would result in an unsafe plant condition.
Concurrence by two licensed individuals is required to override emergency safeguard features.
Related Operating and Emergency Procedures are in the process of review and changes will be instituted where applicable, to reflect the instructions given to operational personnel as noted above (see response to Item 17).
1 ce Re.~g nse:
All licensed operators and plant management and supervisors with operational responsibilities shall participate in this review ard such participation shall be documented in plant records.
All licensed operators have been instructed in the Operating Plan on April 5, 1979 to review the information on the TMI Incident.
A review of the TMI events ard a discussion of IE Bulletin 79-06A was conducted on April 18, 1979 by NRC representatives for all licensed operators a+3 management.
This review will also be documented in plant records.
The Training Department is holding reviews of the 9NI Incident circumstances and chronology for all licensed operators, plant management and supervisors with operational responsibilities.
This review will be ccmpleted by May 1, 1979 and documented in the official training records.
Item N2 Review the actions required by your operating procedures for coping with transients and accidents, with particular attention to:
2 ae Recognition of the possibility of forming voids in the primary coolant system large enough to ccmprcmise the core cooling capability, especially natural circulation capability.
Response
It is recognized by all cperating personnel that voids can occur in the reactor coolant system (RCS) large enough to ccmprcmise core cooling.
Information currently available in assuring RCS conditions include:
~ncn Tenn
- 1).. Correlation between RCS temperature and saturation pressure is currently available to the operators in the control rocm in the O-l.l procedure.
2).
Core exit thermocouple (three of Mich are, located under the reactor head) indications are available on a separate panel behind the control board or frcm the ccmputer.
- 1)..
We are investigating a means of providirg a T hot indication on the control. board.
(Spare RK)'s are available).
2).
We am developing an emergency procedure to recognize ard deal. with voids in the reactor coolant system.
3).'e are investigating the placement of core exit
~
thermocouple indications on the control board.
4).
We are investigating a dual scale for pressurizer temperature, T cold, T hot and core exit thermocouple temperature gauges for temperature ard saturation pressure correlation.
5).
We are developing a ccmputer output of core exit thermocouple temperatures which would be available to the operator in a transient condition.
2 b.
~Res nse:
Operator action required to prevent formation of such voids.
1).
We are reviewing, and will change as necessary, applicable emergency procedures to prevent an inadvertant void formation in the RCS.
- 2).
'lhe following immediate operator actions, prior to diagnosis of the specific accident classifications, will tend to prevent formation'f voids:
a). Verify that reactor trip and safety injection have occurred o
b). Verify that residual heat is being dissipated; that is, reactor coolant temperature is not increasing.
c). Verify that feedwater is being supplied to the steam generators.
d). Operator action should be taken to maintain a water level in the pressurizer by chargirg ard emergency makeup control, dissipate residual heat through the steam generators ard maintain an indicated water level in all steam generators not directly affected by the accident.
For some ZDCA cases, no operator action will prevent the formation of voids in the primary coolant system.
The emergency safeguards system was designed to recover and cool the core following various degrees of primary coolant system voiding, depending on the break size ard location.
Under a steam generator tube leak, Bnergency Procedures describe that if the leak rate is low enough, chargirg flow will maintain the system pressure above saturation; if not, the system will start to void.
The operator should identify ard isolate the faulty stean generator as quickly as possible to prevent or minimize voiding.
2 c~
Operator action required to enhance core cooling in the event such voids are formed. (e.g.,
remote venting)
Re.yonse:
1).
The emergency procedure referenced in the response to subparagraph (a) of this item will cover operator actions in this event.
2).
We are investigating the provision for use of spray valve and PORV operation (to vent the RCS) with a containment isolation signal.
3).
We are investigating the need for charging flow during an accident condition to increase system pressure.
4).
We are considering the necessity and feasibility of installing remote operated valves on the reactor vessel head vent line.
5).
We are investigating certain transients to better understand the effects of a saturated cordition in the RCS loops and/or reactor vessel.
Item N3 Resecinse:
- 1).
Short Term:
For your facilities that use pressurizer water level coincident with pressurizer pressure for autanatic initiation of safety injection into the reactor coolant system, trip the low pressurizer level bistables such that, when the pressurizer reaches the low pressure
- setpoint, safety injection auld be initiated regardless of the pressurizer level.
The pressurizer level bistable may be returned to their normal cperating positions during the pressurizer pressure channel functional surveillance tests.
In addition, instruct operators to manually initiate safety injection Men the pressurizer pressure indication reaches the actuation setpoint whether or not the level indication has dropped to the actuation setpoint.
For plants employing coincident low pressurizer pressure and low pressurizer level, the NRC has directed that the low pressurizer level setpoint bistables be placed in the tripped condition.
All three level bistables for,low pressurizer safety injection actuation setpoint were tripped on April 18, 1979.
With this configuration, we are in a 1/3 pressurizer pressure safety injection logic. If we lose one pressurizer pressure
- channel, we will automatically actuate a safety injection signal Mich initiates (1) a reactor trip, (2) feedwater isolation, (3) contairxnent isolation, (4) containment ventilation isolation.
2).
Operation personnel were instructed of this condition and have been further instructed to manually initiate safety injection Ken pressurizer pressure indication reaches the low pressure safety injection actuation setpoint regardless of pressurizer level, and also to initiate containment isolation.
(Refer to response to Item lb).
A directive was issued fran the Plant Superintendent to reset the pressurizer level bistables whenever periodic testing or maintenance is to be performed in any of the protection channels.
Lon Term:
We are investigating the ~ssibility of the removal of pressurizer low level safety injection signal and changing the logic to 2 out of 3 (2/3) pressurizer pressure low safety injection only.
Item 44 Review the containment isolation initiation design and procedures, and prepare and implement all changes necessary to permit containment isolation whether manual or autcmatic, of all lines whose isolation does not degrade needed safety features or cooling capability, upon autcmatic initiation of safety injection.
~Res nse:
The safeguard logic schemes, Bnergency Procedures and Refueling Shutdown Surveillance Procedures are being reviewed and changes will be made, as necessary, to provide additional assurance that all the conditions as stated above are met.
Response
Containment isolation is initiated by auto safety injection and manually by one out of two push buttons on the main control board.
Both of these actions will also give contairment ventilation isolation.
Contairment isolation:
l).
Trips the containment sump pumps.
2).
Closes all containment isolation valves that are not required to be open during an accident condition. For
- example, contairxnent sump pump discharge isolation
- valves, steam generator blowdown isolation valves, and reactor coolant drain tank vent header ard pump s'uction isolation valves are isolated to assure that undesired pumping or venting of liquid or gases will'not occur inadvertently fran containment.
Furthermore, the containment ventilation isolation system consists of the four containment purge valves, two contaianent depressurization valves, contairment air test supply valve, two containment air test vent valves, and two radiation monitors.
Once again, if open, these valves will autanatically close on a safety injection signal, or by manual containment isolation, manual containment spray or on high containment activity.
The containment ventilation signal also trips the purge supply ard exhaust fans.
Item 45 For facilities for Mich the auxiliary feedwater system is not autcmatically initiated, prepare arxl implement inmediately procedures Mich require the stationing of an individual (with no other assigned concurrent duties ard in direct and continuous camnunication with the control vxxn) to pranptly initiate adequate auxiliary feedwater to the steam generator(s) for those transients or accidents the consequences of Mich can be limited by such action.
~Res nse:
This facility has automatic initiation of the auxiliary feedwater system.
The system consists of two (2) motor driven ard one (l) steam driven pumps.
A lo-lo level in either steam generator will start both motor driven pumps.
A lo-lo level in both steam generators will start three (3) pumps.
A loss of both 4l60V busses will start the steam driven pump. Both main feedwater pump breakers open or safety injection signal will start both rmtor driven pumps.
These pumps are tested monthly to ensure operability and valve lineup by delivering water fran the condensate storage tanks directly into the steam generators.
The startup alignment procedure and the periodic test procedures are being updated to reflect verification of system lineup.
New procedures are being incorporated to provide additional assurance of proper aligrinent followirg any testing and/or maintenance.
A stand-by auxiliary feedwater system has been incorporated for emergency back-up purposes.
This system takes a suction fran existing service water header, the source of which is Lake Ontario.
This system consists of two (2) motor driven pumps which are manually started.
Ibis stand-by auxiliary feedwater system was installed previously to provide further back-up protection in the event of high energy piping break.
This system is located in a separate
- building, and is separate ard remote frcm the original auxiliary feedwater system
~
This system is described in RGSE letters to the NRC dated May 20, 1977 to Mr. A. Schwencer, and July 28, 1978 to Mr. D.L. Ziemann.
Item I6 For your facilities, prepare and implement immediately procedures which:
- a. Identify those plant indications (such as valve discharge piping temperature,. valve position indication, or valve discharge relief tank temperature or pressure indication) which plant operators may utilize to determine that pressurizer power operated relief valve(s) are open.
~Res nse:
Bnergency Procedure E-15.1, Malfunction of Pressurizer Power Relief or Safety Valves, lists the indications Mich plant operators may utilize to determine that the pressurizer power cperated relief valve(s) are open, (All instrumeritation is located on front of main control board):
1).
Pressurizer power operated relief or safety valves discharge line high temperature (TIA-436, TIA-437, and TIA-438) annunciators F-18 (safety valve) and F-19 (PORV) on the main control board.
2).
Pressurizer low pressure of 2185 psig (PA-429),
annunciator F-10.
3).
Pressurizer relief tank high pressure of 5 psig (PA-440), high temperature of 220'F (TA-439), and high level of 84.5%
(LA-442), annunciators P-19, F-l, and F-17 respectively.
4).
Pressurizer heaters power consumption greater than normal.
- 5).
Increased
'charging flow.
6).
Fluctuation in pressurizer water level.
7).
Reactor make-up control auto start.
8).
Valve position indication for both PORV a block (isolation) valves.
9).
Pressurizer Hi Pressure, annunciator F-2.
This existing procedure fulfills the requirements under Item 6a, and no further action is envisioned.
6 b.
Direct the plant operators to manually close the gower operated relief block valve(s) when reactor coolant system pressure is reduced tu below the setpoint for normal autcmatic closure of the power operated relief valve(s) and the valve(s) remain stuck open.
~Res nse:
Two gower operated relief valves limit system pressure to about 2335 psig for large load reductions.
One relief valve is operated on the pressurizer pressure controller signal (PCV 431 C), the other one is operated on the actual pressure signal (PCV 430).
A redundant pressure channel provides a closure signal tu the gower operated relief valve at 2185 psig.
Our Emergency Procedure E-15.1, did not sgecifically require the operators to manually close the power operated relief block valve(s) when reactor coolant system pressure is reduced to below the setpoint for normal autanatic closure of the gower operated relief if it remains stuck open ard will require a change in procedure.
Ginna Station Change in Procedure Request (P.C.N.No.79-901) was initiated on April 18, 1979 to implement closure of block valves.
'Ihis procedure has been PORC approved as of April 23, 1979.
.Item 47 Review the action directed by the ogerating procedures and training instructions to.ensure that:
7 a-Operators do not override automatic actions of engineered safety
.features, unless continued operation of engineered safety features will result in unsafe plant conditions.
For example; if continued operation of engineered safety features would threaten reactor vessel integrity then the HPI should be secured (as noted in b(2) below).
ResEonse:
Operating (0) and Emergency (E) Procedures are being updated to instruct operating personnel not to reset the safety feature signals unless their continued action would result in an unsafe plant condition.
Operational personnel have been instructed in an inter office ccemunication dated April 18, 1979 not to override the autcmatic actuation of emergency safeguard features unless their continued action would result in an unsafe plant condition.
Concurrence by two licensed irdividuals will be required to override emergency safeguard features.
7 b.
Operating ~ocedures currently, or are revved top specify that if the high ~sure injection (HPI) system tgpbeen autanatically actuated because of low pressure condition, it must remain in
'peration until either:
- 1. Both low pressure injection (LPI) pumps are in operation and flowing for 20 minutes or longer, at a rate which would assure stable plant behavior, or
- 2. The HPI systan has been.in operation for 20 minutes, and all hot and cold leg temperatures are at least 50 degrees be1ow the saturation temperature for the existing RCS pressure.
If 50 degrees subcooling cannot be maintained after HPI cutoff, the HPI shall be reactivated.
The degree of subcooling beyond 50 degrees F and the length of time HPI is in operation shall be limited by the pressure/temperature considerations for the vessel integrity.
y injection is automatically started and auld be operating on recirculation until RCS pressure is low enough for this system to inject water to the vessel.
(2)
Operating (0) and Emergency (E)
Procedures are being updated to reflect the proposed new operating phi1osophies.
For
- example, following a small break LOCA, the criteria for terminating high head safety injection flow will be:
- 1. Wide range RCS pressure
> 2000 psi, ard
- 2. Wide range RCS pressure increasing, and
- 3. Narrow range leve1 indication in at least one steam generator, and
- 4. Pressurizer level > 50%.
These provide for a subcooled primary side, stable primary side conditions and a heat sink via the steam generator.
All operating personnel will be instructed of these changes.
7 CQ
~Res nse:
Short Term:
Operating procedures currently, or are revised to, specify that in the event of HPI initiation with reactor coolant pumps (RCP) operating, at least one RCP shall remain operating for two loop plants ard at least two RCP's shall remain operatic for 3 or 4 loop plants as long as the pump(s) is providing forced flow.
Our NSSS supplier, Westinghouse, is evaluating cases enccmpassed by the above NRC recorrmendation, ard reccamerds that at the present time the plant energency instruction upon LOCA and steam break accident remain as they are and that all RC pumps be tripped.
Lon Term:
We are reviewing Emergency Procedures to clarify conditions under which the RC pumps should be manually tripped.
These include verification that SIS pumps are operational and that the pressure is decreasing and is below a specified setpoint Mich is less than the SI actuation.
Additionally, we will provide notations to alert the operator of actions that should be taken to trip the pumps because of certain contairment isolation or ECCS sequencing actions (i.e.,
isolation of ccmponent cooling).
4
7 d.
Operators are-provided with additional information and instructions not rely upon pressurizer le~ indication alone, but to also examine pressurizer pressure and other plant parameter indications in evaluating plant conditions, e.g.
water inventory in the primary system.
Response
Short tean:
Lon Term:
A review of the occurrence at LMI has been ard will be presented to all licensed personnel and the importance of believing instrunentation has been and continues to be stressed.
It is our understanding, at this time, that pressurizer level was reading correctly during this occurrence, however, pressurizer level was not indicative of RCS water inventory due to voids in the system.
At Ginna the operator has available these indications for RCS water inventory:
Wide range RCS temperature and pressure Steam pressure Steam generator water level Containment pressure HWST water level Condensate storage tank level Pressurizer water level Boric acid storage tank level 1).As described in response to Item 2a, additional information frcm hot leg temperatures, cold leg temperatures and corresponding saturation curves are being investigated.
- 2).We wi11 investigate placement of additional parameters on recorders.
Item N8
Response
Short Term: 1).
2).
3).
- 4) ~
Review all safety-related valve positions, positioning requirements and positive controls to assure that valves remain positioned (open or closed) in a manner to ensure the proper operation of engineered safety features.
Also review related procedures, such as those for maintenance, testing, plant and system start-up, and supervisory periodic (e.g. daily/shift checks) surveillance to ensure that such valves are retur'ned to their correct positions following necessary manipulations and are maintained in their proper positions during all cperational mx3es.
An additional alignment verification of safety related systems was performed and documented on an interoffice memo dated April 5, 1979, and all valves mre found properly aligned.
Periodic Test(PT) Procedures are being updated to reflect the requirements necessary for additional control of.safety related valve positioning, ard the return of these valves to proper positions.
New procedures are being developed to provide additional assurance that safety systems are properly aligned for operation imnediately after test and/or maintenance.
Procedure 0-6.2 (Main Control Board System Status Verification) is performed twice per shift versus the prior once per shift upon a directive fran the Operations Engineer on April 4, 1979.
Procedure 0-6.2 describes the method for verification of the required at power and hot shutdown status of selected systems via control board verification.
We are investigating the possibility of additional locks on manual safety related valves.
Lon Term:
administrative (A), Operating (0) a Maintenance (M) procedures will be reviewed and changes made as necessary to ensure that such valves are returned to their positions following necessary manipulations.
Iten 5 9 Review your operating modes and procedures for all systems designed to transfer potentially radioactive gases atxl liquids out of the primary containment to,assure that undesired pumping, venting, or other releases of radioactive liquids and gases will not occur inadvertently.
9 a.
In particular, ensure that such an occurrence would not be caused by the resetting of engineered safety features instrunentation.
List all such systems and indicate:
Whether interlocks exist to prevent transfer when high radiation indication exists.
Resp)nse:
Station Emergency Procedure E-l.l (Safety Injection System Actuation) states that automatic containment isolation and containment ventilation isolation will occur upon initiation of the safety injection systen, and that the immediate operator action is to verify the autanatic action has occurred or that he perform the necessary action manually.
9 b.
Whether such systems are isolated by the contairment isolation signal.
Response
Containment isolation is initiated by auto safety injection and manually by one out of two push buttons on the main control board.
Both of these actions will also give containment ventilation isolation.
Containment isolation:
-l).
Trips the containment sump pumps.
2).
Closes all containment isolation valves that are not required to be open during an accident condition. For
- example, containment sump pump discharge isolation valves,'team generator blowdown isolation valves, and reactor ccolant drain tank vent header and pump suction isolation valves are isolated to assure that undesired pumping or venting of liquid or gases will not occur inadvertently fran contairlnent.
Furthermore, the containment ventilation isolation system consists of the four contairlnent purge valves, t~
containtnent depressurization valves, containment air test supply valve, two containment air test vent valves, ard two radiation rmnitors.
Once again, if open, these valves will autanatically close on a safety injection signal, or by manual containment isolation, manual containment spray or on high containtnent activity.
The contairment ventilation signal also trips the purge supply and exhaust fans.
9 c.
The basis on Mich continued operability of the features is assured.
~Re nnse:
Short Term:
Prior to the 'IMI Incident, there were several letters exchanged between R.G.&E. and the NR: where review of safety actuation circuits with overrides were the subject of discussion and they are as follows:
1). a. Dates:
February 16, and March 30, 1979
- b. ~Sub'ect:
Review of Safety Actuation Circuite with Overrides, R.E. Ginna Nuclear Power Plant, Docket No. 50-244
- c. Attention:
Mr. Dennis L. Ziemann, Chief Operating Reactor Branch No.
2 2). a. Date:
January 2, 1979
- b. ~Sub'ect:
Containment Purging During Normal plant Operations, R.
E. Ginna Nuclear Power Plant, Docket No. 50-244
- c. Attention: as in (l.c) above Relative to Ginna contairment ventilation isolation, the above referenced letters concluded that the isolation circuitry and procedures regardirg its use are adequate.
This was based on the detailed procedural controls Mich have been implemented, the physical control of the reset key switch which involves at least two cperators to use, and the isolation circuitry that is installed.
We feel no further action is required here at this time.
Relative to the Ginna containment isolation system, this circuit has a reset switch which gives the operator the means to reset containment isolation.
This reset is necessary because it permits the operator to place the valves affected by the contairment isolation signal in the'esired position.
This capability is necessary so that the operator has flexibilityin dealirg with post accident corditions within contairment.
Once the containment isolation'reset switch has been actuated, some equignent would return autanatically to the position selected prior to the isolation signal, unless means are taken to individually position this equipnent.
Present procedures require that the operator place all containment isolation valve switches in the "closed" position, prior to resetting contairmentisolation.
Furthermore, these procedures have been modified to instruct the operator to place the containment sump "A" pumps in the pull-stop position prior to resettirg the contairment isolation signal.
It should be noted that resetting of the SI signal does not reset contairxnent isolation.
Lo Term:
Items 9 a,b,and c above will continue to be investigated for further release control.
Item 410 Review and mxlify as necessary your maintenance and test procedures to ensure that they require:
10 a.
Verification, by test or inspection, of the operability of redundant safety-related systems prior to the removal of any safety-related systems fran service.
ResEonse Periodic surveillance and testing provides a sufficient level of confidence that the system will function as designed &en necessary, without requiring additional testing.
Testing intervals are selected in recognition of the fact that certain equignent may be unavailable on a temporary basis due to maintenance, and restrictions by Technical Specification are imposed on the length of time such equignent can be removed fran service.
The Technical Specifications for Ginna Station state that safety related pumps are to be tested to verify operability when one (1) is out of service for a prescribed time.
10 b.
Verification of the operability of all safety-related systems when they are returned to service following maintenance or testing.
~Res nse Maintenance (M) procedures are being revised and updated as necessary to ensure that the Results and Test Department is notified of maintenance of safety-related systems to verify operability of systems after maintenance.
Explicit notification of involved reactor operational personnel whenever a safety-related system is ranoved frcm and returned to service.
~Res nse A procedure change request (PCN 79-904) was subnitted on April 19, 1979 ard is to be presented to PORC on April 30, 1979 which will insure that the Head Control Operator, in edition to Shift Poreman, is informed of all systen holds before they are placed on the system and after they are removed frcm the system.
Lo Term:
Investigate the necessity for better identification of the safety-related systems that have been removed fran service and when the system has been restored.
S
Item Oil Review your pranpt reporting procedures for NRC notification to assure that NRC xs notified within one hour of the time the reactor is not in a controlled or expected condition of operation.
Further, at that time an open continous canmunication channel shall be established and maintained with NRC.
Response
Changes to written procedures have been initiated to notify NRC within one hour in the event the reactor is not in a controlled or expected condition of operation such as that which would cause a valid safety injection actuation signal, or the necessity for site evacuation.
A telephone line located in the control rocm which is not used during normal
'peration has been designated for ogen continuous camnunications after the initial notification to the NRC has been made.
Item 112 Reviewing operating mxles and procedures to deal with significant amounts of hydrogen gas that may be generated during a transient or other accident that would either remain inside the primary system or be released.
Response
Short Term:
Modes for removing hydrogen fran the reactor ccolant system are:
1.
Hydrogen can be stripped fran the reactor coolant to the pressurizer vapor space by pressurizer spray operation if the reactor coolant pump is operating.
2.
Hydrogen in the pressurizer vapor sgace can be vented by gower operated relief valves to the pressurizer relief tank.
3.
Hydrogen can be removed fran the reactor coolant system by the letdown line ard stripped in the volume control tank where it enters the waste gas system.
Ginna's waste gas system
-storage systan is cangosed of 4 tanks of 470 SCF each.
4.
In the event of a LOCA, hydrogen auld vent with the steam to the contairment.
If a non-condensible gas bubble becanes situated somewhere in the primary coolant systems, there are many options for continued core cooling and removing the bubble.
With a gas bubble located in the upper head several methods of core coolie are unaffected.
The steam generator can be used to remove decay heat using reactor coolant pump forced flow or natural circulation.
The Safety Injection system can be used to cool the core Mile venting through the pressurizer gower operated relief valve.
Core'coolie by any of these methcds can proceed indefinitely if the primary coolant pressure is held constant. If a lower system pressure is desired, controlled depressurization will allow the bubble to grow slowly until it uncovers the top of the hot legs ~
This controlled depressurization can be performed in two ways:
l.
If the reactor coolant pumps can be operated, depressurization can be performed with a steam bubble in the pressurizer.
Depressurization would be through the pressurizer power operated relief valve.
Extra control is achieved with the pressurizer heaters arxl sprays if available.
As the bubble grows to the top of the lmt leg,, small bubbles are carried through the system.
Degassirg is done with the spray line and/or the Chemical and Volume Control System.
The steam generators will carry away decay heat.
2.
If the reactor coolant pumps cannot be operated or their operation is undesirable, the pressurizer can be made water solid with the safety injection pumps running and the power operated relief valve and/or vent valve open.
Depressurization is controlled by judiciolm use of the various valves, lines and pumps available in the safety injection system ard by adjusting the pressurizer relief valve and /or vent valve.
As the bubble grows to the top of the hot leg, it slides across the hot leg ard up into the steam generators.
As depressurization continues the gas bubbles grow in the steam generators and upper head but the core remains covered and cooled by safety injection, water. If there is enough gas, the pressurizer surge line would eventually be "uncovered".
Sane of the gas would burp into the pressurizer and out.the valve.
This burping process would continue until the system was at the desired pressure.
At that time the current cooling mode could be continued or the system could be placed in a RHR mode (special care is needed for operation).
Note that a gas bubble cannot be located in the steam generator with the reactor coolant pumps running. If a gas bubble forms in the steam generator during natural circulation, the reactor ccolant pumps could be initiated with the power operated relief valve open.
Ginna Station has Hydrogen Reccmbiners, and the applicable procedures S-21.1 and S-21.2, (lA & 1B Hydrogen Reccmbiner Purgirg and Operation, respectively) were reviewed.
These procedures basically describe the steps necessary to operate the Hydrogen Recanbiners to maintain the hydrogen concentration in containment at a safe level.
1).
We are considerirg the necessity ard feasability of installing remote operated valves on the reactor vessel head vent line which cou1d be used to remove hydrogen gas that may be generated during a transient or accident.
2).
We are developirg new procedures to incorporate the above recaamendations.
Item 413 4
Propose
- changes, as required, to those technical specifications
'hich must be modified as a result of your implenenting the above items and identify design changes necessary in order to effect lory term resolutions of these items.
~Res nse:
A response to this item will be suhnitted by May 19, 1979, i.e.
within the thirty (30) days of receipt of IE Bulletin 79-06A, Revision 1.
4 Et' 0