ML17299A444
| ML17299A444 | |
| Person / Time | |
|---|---|
| Site: | Palo Verde  |
| Issue date: | 07/03/1985 |
| From: | NRC |
| To: | |
| Shared Package | |
| ML17299A443 | List: |
| References | |
| GL-83-28, TAC-59163, TAC-59164, NUDOCS 8507170760 | |
| Download: ML17299A444 (25) | |
Text
SAFETY EVALUATION REPORT FOR GENERIC LE R -,
.1 -
-TRIP REVIEW PR GR M D R
I N
ND PR CE URE PALO VERDE NUCLE R ST TION, UNITS 1, 2 AND 3 D
C ET S.:
5 -5 8, 5
9 ND 530 Enclosure 1
I.
INTRODUCTION On February 25, 1983, both of the scram circuit breakers at Unit 1 of the Salem Nuclear Power Plant failed to open upon an automatic reactor trip signal from the reactor protection system.
This incident occurred during the plant start-up and the reactor was tripped manually by the operator about 30 seconds after the initiation of the automatic trip signal.
The failure of the circuit breakers has been determined to be related to the sticking of the under voltage trip attachment.
Prior to this incident, on February 22,
- 1983, at Unit 1 of the Salem Nuclear Power Plant, an automatic trip signal was generated based on steam generator low-low level during plant start-up.
In this case, the reactor was tripped manually by the operator almost coincidentally with the automatic trip.
Following these incidents, on February 28, 1983, the NRC Executive Director for Operations (EDO), directed the staff to investigate and report on the generic implications of these occurrences at Unit 1 of the Salem Nuclear Power Plant.
The results of the staff's inquiry into the generic implications of the Salem unit incidents are reported in NUREG-1000, "Generic Implications of ATWS Events at the Salem Nuclear Power Plant." 's a result of this investigation, the Commission (NRC) requested (by Generic Letter 83-28 dated July 8, 1983) all licensees of operating reactors, applicants for an operating license, and holders of construction permits to respond to certain generic concerns.
These concerns are categorized into four areas:
(1)
Post-Trip Review, (2)
Equipment Classification and Vendor Interface, (3)
Post-Maintenance
- Testing, and (4)
Reactor Trip System Reliability Improvements.
The first action item, Post-Trip Review, consists of Action Item 1. 1, "Program Description and Procedure" and Action Item 1.2.
"Data and Information Capability."
This safety evaluation report (SER) addresses Action Item 1.1 only.
8507170760 850703.
PDR ADOCK 05000MB P
- PDR-
II.
REVIEW GUIDELINES The following review guidelines were developed after initial evaluation of the various utility responses to Item 1.1 of Generic Letter 83-28 and incorporate the best features of these submittals.
As such, these review guidelines in effect represent a "good practices" approach to post-trip review.
We have reviewed the applicant's response to Item 1. 1 against these guidelines:
A.
The licensee or applicant should have systematic safety assessment procedures established that will ensure that the following restart criteria are met before restart is authorized.
The post-trip review team has determined the root cause and sequence of events resulting in the plant trip.
Near term corrective actions have been taken to remedy the cause of the trip.
The post-trip review team has performed an analysis and determined that the major safety systems responded to the event within specified limits of the primary system parameters.
The post-trip review has not resulted in the discovery of a potential safety concern (e.g.,
the root cause of the event occurs with a frequency significantly larger than expected).
If any of the above restart criteria are not met, then an independent assessment of the event is performed by the Plant Operations Review Committee (PORC), or another designated group with similar authority and experience.
B.
The responsibilities and authorities of the personnel who will perform the review and analysis should be well defined.
The post-trip review team leader should be a member of plant management at the shift supervisor level or above and should hold or should have held an SRO license on the plant.
The team leader should be charged with overall responsibility for directing the post-trip review, including data gathering and data assessment and
'e/she should have the necessary authority to obtain all personnel and data needed for the post-trip review.
A second person on the review team should be an STA or should hold a relevant engineering degree with special transient analysis training.
The team Teader and the STA (Engineer) should be responsible to concur on a decision/recommendation to restart the plant.
A nonconcurrence from either of these persons should be sufficient to prevent restart until the trip has been reviewed by the PORC or equivalent organization.
C.
The licensee or applicant should indicate that the plant response to the trip event will be evaluated and a determination made as to whether the plant response was within acceptable limits.
The evaluation should include:
A verification of the proper operation of plant systems and equipment by comparison of the pertinent data obtained during the post-trip review to the applicable data provided in the FSAR.
An analysis of the sequence of events to verify the proper functioning of safety related and other important equipment.
Where
- possible, comparisons with previous similar events should be made.
4 D.
The licensee or applicant should have procedures to ensure that all physical evidence necessary for an independent assessment is preserved.
E.
Each licensee or applicant should provide in its submittal, copies of the plant procedures which contain the information required in Items A
through D.
As a minimum, these should include the following:
The criteria for determining the acceptability of restart The qualifications, responsibilities and authorities of key personnel involved in the post-trip review process The methods and criteria for determining whether the plant variables and system responses were within the limits as described in the FSAR The criteria for determining the need for an independent review.
III.
EVALUATION AND CONCLUSION By letter dated April 19, 1985, the applicant of Palo Verde Nuclear Station, Units 1, 2 and 3, provided information regarding its post-trip review program and procedures.
We have evaluated the applicant's program and procedures against the review guidelines developed as described in Section II.
A brief description of the applicant's response and the staff's evaluation of the response against each of the review guidelines is provided below:
A.
The applicant has established the criteria for determining the acceptability of restart.
Based on our review, we find that the applicant's criteria conform to the guidelines as described in the above Section II.A, and, therefore, are acceptable.
B.
The qualifications, responsibilities and authorities of the personnel who will perform the review and analysis have been clearly described.
We have reviewed the applicant's chain of command for responsibility for post-trip review and evaluation and find it acceptable.
C.
The applicant has described the methods and criteria for comparing the event information with known or expected plant behavior.
Based on our
- review, we find them to be acceptable.
D.
The applicant has established criteria for determining the need for independent assessment of an event.
Based on our review, we find them acceptable.
In addition, the applicant has established procedures to ensure that all physical evidence necessary for an independent assessment is preserved.
We find that this action to be taken by the applicant conforms with the guidelines as described in the above Sections II.A and D.
E.
The applicant has provided for our review a systematic safety assessment program to assess unscheduled reactor trips.
Based on our review, we find that this program is acceptable.
Based on our review, we conclude that the applicant's Post-Trip Review Program and Procedures for Palo Verde Nuclear Station, Units I, 2 and 3, are acceptable.
ENCLOSURE 2
SAFETY EVALUATION REPORT FOR GENERIC LETTER 83-28, ITEM 1.2 - POST-TRIP REVIEW (DATA AND INFORMATION CAPABILITY)
PALO VERDE NUCLEAR GENERATING STATION DOCKET NOS.:
50-528, 50-529, 50-530 I.
INTRODUCTION On February 25, 1983, both of the scram circuit breakers at Unit 1 of the Salem Nuclear Power Plant failed to open upon an automatic reactor trip signal from the reactor protection system.
This incident occurred during the plant start-up and the reactor was tripped manually by the operator about 30 seconds after the initiation of the automatic trip signal.
The failure of the circuit breakers has been determined to be related to the sticking of the under voltage trip attachment.
Prior to this incident, on February 22, 1983, at Unit 1 of the Salem Nuclear Power Plant, an automatic trip signal was generated based on steam generator low-low level during plant start-up.
In this case, the reactor was tripped manually by the operator almost coincidentally with the automatic trip.
Following these incidents, on February 28, 1983, the NRC Executive Director for Operations (EDO), directed the staff to investigate and report on the generic implications of these occurrences at Unit 1 of the Salem Nuclear Power Plant.
The results of the staff's inquiry into the generic implications of the Salem unit incidents are reported in NUREG-1000, "Generic Implications of the ATWS Events at the Salem Nuclear Power Plant."
As a result of this investigation, the Commission (NRC) requested (by Generic Letter 83-28 dated July 8, 1983) all licensees of operating reactors, applicants for an operating license, and holders of
construction permits to respond to certain generic concerns.
These concerns are categorized into four areas:
(I) Post-Trip Review, (2) Equipment Classification and Vendor Interface, (3) Post-Maintenance
- Testing, and (4) Reactor Trip System Reliability Improvements.
The first action item, Post-Trip Review, consists of Action Item 1.1, "Program Description and Procedure" and Action Item 1.2, "Data and Information Capability."
This safety evaluation report (SER) addresses Action Item 1.2 only.
II.
REVIEW GUIDELINES The following review guidelines were developed after initial evaluation of the various utility responses to Item 1.2 of Generic Letter 83-28 and incorporate the best features of these submittals.
As such, these review guidelines in effect represent a "good practices" approach to post-trip review.
We have reviewed the licensee's response to Item 1.2 against these guidelines:
A.
The equipment that provides the digital sequence of events (SOE) record and the analog time history records of an unscheduled shutdown should provide a reliable source of the necessary information to be used in the post-trip review.
Each plant variable which is necessary to determine the cause and progression of the events following a plant trip should be monitored by at least one recorder (such as a sequence-of-events recorder or a plant process computer) for digital parameters; and strip
charts, a plant process computer or analog recorder for analog (time history) variables.
Performance characteristics guidelines for SOE and time history recorders are as follows:
Each sequence of events recorder should be capable of detecting and recording the sequence of events with a sufficient time discrimination capability to ensure that the time responses associated with each monitored safety-related system can be ascertained, and that a determination can be made as to whether the time response is within acceptable limits based on FSAR Chapter 15 Accident Analyses.
The recormended guidelines for the SOE time discrimination is approximately 100 milliseconds.
If current SOE recorders do not have this time discrimination capability the licensee should show that the current time discrimination capability is sufficient for an adequate reconstruction of the course of the reactor trip and post-trip events.
As a minimum this should include the ability to adequately reconstruct the transient and accident scenarios presented in Chapter 15 of the plant FSAR.
Each analog time history data recorder should have a sample interval small enough so that the incident can be accurately reconstructed following a reactor trip.
As a minimum, the licensee should be able to reconstruct the course of the transient and accident sequences evaluated in the accident analysis of
Chapter 15 of the plant FSAR.
The recommended guideline for the sample interval is 10 seconds.
If the time history equipment does not meet this guideline, the licensee should show that the time history capability is sufficient to accurately reconstruct the transient and accident sequences presented in Chapter 15 of the FSAR.
To support the post-trip analysis of the cause of the trip and the proper functioning of involved safety related equipment, each analog time history data recorder should be capable of updating and retaining information from approximately five minutes prior to the trip until at least ten minutes after the trip.
All equipment used to record sequence of events and time history information should be powered from a reliable and non-interruptible power source.
The power source used need not be safety related.
B.
The sequence of events and time history recording equipment should monitor sufficient digital and analog parameters, respectively, to assure that the course of the reactor trip and post-trip events can be reconstructed.
The parameters monitored should provide sufficient information to determine the root cause of the unscheduled
- shutdown, the progression of the reactor trip, and the response of the plant parameters and protection and safety systems to the unscheduled shutdowns.
Specifically, all input parameters associated with reactor trips, safety injections and other safety-related systems as well as output parameters sufficient to record the proper functioning of these systems should be recorded for use in the post-trip review.
The parameters deemed necessary, as a minimum, to perform a post-trip review that would determine if the plant remained within its safety limit design envelope are presented in Table 1.
They were selected on the basis of staff engineering judgment following a complete evaluation of utility submittals.
If the licensee's SOE recorders and time history recorders do not monitor all of the parameters suggested in these tables the licensee should show that the existing set of monitored parameters are sufficient to establish that the plant remained within the design envelope for the accident conditions analyzed in Chapter 15 of the plant FSAR.
C.
The information gathered by the sequence of events and time history recorders should be stored in a manner that will allow for data retrieval and analysis.
The data may be retained in either hardcopy, (e.g.,
computer printout, strip chart record), or in an accessible memory (e.g., magnetic disc or tape).
This information should be presented in a readable and meaningful format, taking into consideration good human factors practices such as those outlined in NUREG-0700.
D.
Retention of data from all unscheduled shutdowns provides a valuable reference source for the determination of the acceptability of the plant vital parameter and equipment response to subsequent unscheduled shutdowns.
Information gathered during the post-trip review is to be
retained for the life of the plant for post-trip review comparisons of subsequent events.
III.
EVALUATION AND CONCLUSION By letter dated November 3, 1983, Arizona Public Service Company (APS) provided information regarding its post-trip review program data and information capabilities for Palo Verde Nuclear Generating Station Units 1, 2, and 3.
We have evaluated the licensee's submittal against the review guidelines described in Section II.
Licensee deviations from the guidelines of Section II were reviewed with the licensee by telephone on h1ay 20, and 24, 1985.
A brief description of the licensee's responses and the staff's evaluation of the response against each of the review guidelines is provided below:
A.
The licensee has described the performance characteristics of the equipment used to record the sequence of events and time history data needed for post-trip review.
Based on our review of the November 3, 1983 submittal we find that the sequence of events recorder characteristics conform to the guidelines described in Section II A, and are acceptable.
The time history recorder characteristics conform to these guidelines, except for post-trip record duration which was not made clear by the licensee.
By phone calls on May 20 and 24, 1985 the licensee indicated that all the prescribed information is stored for 5 minutes before and at least 10 minutes after a trip.
Based on the information
'I I
obtained during the telephone calls, we find that the sequence of events and time history recorder characteristics conform to the guidelines described in Section II A and are acceptable.
B.
The licensee has established and identified the parameters to be monitored and recorded for post-trip review.
Based on our review of the licensee's November 3, 1983 submittal, we found that the parameters selected by the licensee did not include all of those identified in Table 1 and, therefore, did not conform to the guidelines described in Section II B.
- However, based on telephone conversations on May 20 and 24,
- 1985, we found that the licensee was recording all the suggested parameters in the manner suggested by the review criteria except for the four (4) discussed below:
1.
Containment Isolation The initiation signal to isolate is recorded on the SOE.
A summary recording that all isolation devices have actuated is not recorded on the SOE.
However, if all isolation devices do not activate as required, this condition is alarmed by the overhead alarm system and printed on the alarm printer.
2.
Control Rod Position - A summary rod bottom condition is not recorded on the SOE, although, an undervoltage condition on the
-'8-switch gear, which is an initiating condition, is monitored and printed on the SOE.
However, the control element assembly calculator (CEAC) does monitor control rod misalignment and when sensed, initiates an overhead annunciator and records the condition on the alarm printer.
3.
Containment Radiation - This condition is not recorded on the SOE.
However, Palo Verde has a separate radiation monitoring system with
- computer, alarms, and printer, which annunciate and record containment Radiation levels.
Summary information is provided by an overhead alarm and recorded on the alarm printer.
4.
Primar S stem Tem erature - This information is not provided on the SOE.
- However, T hot and cold leg temperatures are recorded on strip chart recorders.
In addition, primary system information including temperature is monitored and recorded by the emergency response facility data acquisition system (ERFDAS).
Based on our review of the November 3, 1983 submittal, and phone calls with the licensee on May 20 and 24,
- 1985, we find that the parameters selected by the licensee include all of those identified in Table I and conform to the guidelines described in Section IIB and are, therefore, acceptable.
C.
The licensee has described the means for storage and retrieval of the information gathered by the sequence of events and time history recorders, and for the presentation of this information for post-trip review and analysis.
Based on our review, of the November 3, 1983
submittal and as supplemented by telephone calls on May 20 and 24,
- 1985, we find that this information will be presented in a readable and meaningful format, and that the storage, retrieval and presentation conform to the guidelines of Section II C.
D.
The licensee's submittal did not indicate that the data and information used during post-trip reviews will be retained in an accessible manner for the life of the plant.
During phone conversations on May 20 and 24, the licensee indicated that it will retain this information for the life of the plant.
Based on our review, we find that the licensee's program for data retention conforms to the guidelines of Section II D, and is acceptable.
Based on our review, we conclude that the licensee's post-trip review data and information capabilities for Palo Verde Nuclear Generating Station Units I, 2, and 3 are acceptable.
TABLE 1
PWR PARAMETER LIST SOE Recorder (1) x (1) x x
(1) x x
(1) x x
(2)
(1) x (1) x (1) x (1) x (1) x (3) x x
(1) x (1) x (1) x Time History Recorder x
Parameter/Si nal Reactor Trip Safety Injection Containment Isolation Turbine Trip Control Rod Position Neutron Flux, Power Containment Pressure Containment Radiation Containment Sump Level Primary System Pressure Primary System Temperature Pressurizer Level Reactor Coolant Pump Status Primary System Flow Safety Inj.; Flow, Pump/Valve Status MSIV Position Steam Generator Pressure Steam Generator Level Feedwater Flow Steam Flow (1)
Trip parameters (2)
Parameter may be monitored by either an SOE or time history recorder.
(3)
Acceptable recorder options are; (a) system flow recorded on an SOE
- recorder, (b) system flow recorded on a time history recorder, or (c) equipment status recorded on an SOE recorder.