ML17345B292

Low Temp Overpressure Events at Turkey Point Unit 4, Draft Case Study Rept

ML17345B292
Person / Time
Site:	Turkey Point
Issue date:	08/31/1983
From:	Lanning W NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
To:
Shared Package
ML17345B286	List: ML17345B285 ML17345B287 ML17345B288 ML17345B289 ML17345B290 ML17345B291 ML17345B292
References
NUDOCS 8310060199
Download: ML17345B292 (56)

Text

AEOD LOM TEMPERATURE OVERPRESSURE EVENTS AT TURKEY POINT UNIT 4 Draft Case Study Report Reactor Operations Analysis Branch, Office for Analysis and Evaluation of Operational'ata August 1983 Prepared by:

Mayne D. Lanning

~~

4 NOTE:

This report documents results of studies completed to date by the Office for Analysis and Evaluation of Operational Data with regard to a particular operating;event.

The findings and recommendations contained in this'eport are provided in support of other ongoing NRC activities concerning this event.

Since the studies are ongoing, the report is not necessarily final, and the findings and recommenda-'ions do not represent the position or requirements of the responsible program office of the Nuclear Regulatory Commission.

'8310060199 830Pgg PDR ADOCK 0500025i PDR ~i

EXECUTIVE

SUMMARY

A case study has been completed for two events at Turkey Point Unit 4 where

.the pressure-temperature limits of the reactor vessel were exceeded.

During the filling and venting process while restarting the reactor after a refueling

outage, two overpressure events occurred within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> which exceeded by a factor of two the technical specification limits.

Both trains of the over-pressure protection system were inoperable and operator actions were required s

to mitigate the pressure transients to prevent a more severe pressure ex-cursion.

The safety significance of the events is the possibility of the reactor vessel failure by.brittle fracture as a consequence of the over-pressure transients during low temperature operation.

The overpressurization transients at Turkey Point were the first events to occur, at an operating pressurized water reactor which exceeded the technical specification l.imits since the NRC staff resolved the gener ic issue of low temperature overpressure transients in 1979.

The events were identified to Congress as Abnormal Occurrences which indicate that the events involved a'ajor reduction in the degree of protection to the public health or safety.

The technical specifications for low temperature overpressure (LTOP) protection were reviewed and generally found to be inadequate to (1) prevent overpressure transients, and (2) ensure redundancy of the overpressure mitigating system during the short time interval that the system may be required to protect the vessel from brittle fracture.

These deficiencies are germane to the existing

. ~chnic@vmpeci4ications at"operating PWRs that have low temperature overpressure

,~xotecTtoo 're'Ruirements:and to tile 4t'andard Techno'cal SpeciTications; Some-operating plants do nest haMe any.<TOP -technieaR-'specifications.:

v The post-event analysis by Turkey Point management after the first event was found to be inadequate based on its failure to identify and correct the root cause for the event, to recognize that the technical specifications pressure temperature limits were. exceeded, and to verify that the reactor coolant system remained acceptable for continued operation after the pressure transients were exceeded.

The AEOD evaluation of solid. plant operations (e.g.,

no.gas bubble in the pressurizer) concluded that this was an undesirable mode of operation that posed the major risk for overpressure events and that it could be eliminated during the filling and venting process.

AEOD will propose to the Institute for Nuclear Power Operations that they consider developing a recommended operating practice for filling and venting PWRs which excludes water solid operation.

AEOD recommended that the Office of,Nuclear Reactor Regulation correct the identified deficiencies in the L'TOP technical specifications.

'I

~ w

~

~

PQ 11

EXECUTIVE

SUMMARY

LIST OF FIGURES LIST OF TABLES l.

INTRODUCTION 2.

SYSTEM DESCRIPTION 3.

EVENTS DESCRIPTIONS TABLE OF CONTENTS

~Pa e

3. 1 Conditions Prior to the Events 3.2 Overpressure Event on November 28, 1981 3.3 Overpressure Event on November 29, 1981 4.

EVENT ANALYSES 5.

OPERATING EXPERIENCE 6.'TOP TECHNICAL SPECIFICATIONS

6. 1 Pressure/Temperature Limits 6.2 Overpressure Protection System 6.3 Primary/Secondary Temperature Difference 6.4 Maximum Number of Charging and Safety Injection Pumps Operable 6.5 Summary of Technical Specification Deficiencies........

7.

REACTOR COOLANT SYSTEM MATER SOLID OPERATION

~

~

7. 1 Oxygen Control 7.2 Pressurizer Temperature Differential Limit.............

8.

FINDINGS AND CONCLUSIONS 9

10 11 12 18'2 23 26 27 28 29 30 31 34 35

~RECGBMENDA'TALONS

10. - REFERENCES

~

W

~

~

~

~

~

~

~

~

~ 'W ~

~

~

~

~

~

38

'PPENDICES Appendix A Turkey Point Unit 4 LTOP Technical Specifications Appendix B

Standard Technical Specification 3.4.9. 1 Pressure/

Temperature. Limits Appendix C

Standard Technical Specifications

2. 4. 9. 3-Overpressure Mitigating Systems 111

TABLE OF CONTENTS (Continued)

Appendix D

Standard Technical Specifications 3.4.1.4. 1-Starting a Reactor Coolant Pump Pacae Appendix:E Standard Technical Specification 3.8.3-Maximum Number of Charging and Safety Injection Pumps LIST OF FIGURES Number Title Turkey Point Unit 4 Pressure/Temperature Limits..

Single Train of Overpressure Mitigating System...

Schematic of Overpressure Mitigating System Logic

~

~

~

~

~

~

~

4

~

~

~

~

~

5

~

~ '

~

~

~

~

6 Letdown Configuration During Low Temperature Operation 8

LIST OF TABLES Challenges to the Overpressure Mitigating Systems.......

19 Frequency of Reported Pressure Transients in Operating PMRs 21

1.0

'INTRODUCTION Before 1979, 30 reported incidents occurred in PWRs where the pressure/tempera-ture limits on. the reactor coolant system exceeded the technical specifications.

Host of these events occurred during reactor startup or shutdown when the reactor coolant system was in a water sol'id condition, i.e.,

no steam space in the pressurizer.

Overpressure events primarily resulted from the loss of letdown flow with continued charging flow, inadvertent safety injection, or a heatup transient caused by starting a reactor coolant pump with the secondary

'oolant system temperature higher than the primary temperature.

These events were caused by either equipment malfunction or operator error.

e Low temperature overpressurization was designated a generic issue because of the possibility of a vessel failing by the. brittle fracture mechanism.

This failure mode is a consequence of a pressure transient after the vessel material toughness had been reduced due to irradiation effects (i.'., increase in nil-ductility transition temperature) while a critical size flaw existed on the vessel. wall.

NRC resolved the generic issue by recommending that PMR licensees to implement procedures to reduce the potential for overpressure events and install equipment modifications to mitigate such events in 1979."

Since that time, ten pressure transients have been reported.

The two events at Turkey Point Unit 4 on November 28 and 29, 1981 exceeded'he technical speclfj-cation:limit (415 psig below 355~F) by about 700 and 325 psi, respectively.

The two events were designated Abnormal Occurrences by the NRC (Ref. 1).

The other reported events were mitigated by the overpressure protection system.

These two

. ~emprmasure events and a s'ignificant number of events at other pivgs involving

~4

.inopetgtH'm. %ravens'f.-'the-:overpressure protection mystem prompted AEOD<o initi-ate-..an-evaluation of operational.events with-the-focus primarily on Tu@ey Po'int.

a v

~

The overpressure protection system and the overpressure events at Turkey Point Unit 4 are described in Sections 2 and 3.

Section 4 contains the analyses and "NUREG-0224 entitled, "Reactor Vessel Pressure Transient Protection for Pres-surized Mater Reactors,"

was published in September 1978 documenting the com-pletion of the generic. activity.

LTOP mitigating systems were installed in most plants beginning in 1979.

evaluation of the events including management's reaction to the events.

Sec-tion 5 reviews'he operational experience rel'ated to inoperable trains of the overpressure protection system at other PMRs.

Section 6 evaluates the adequacy of existing LTOP technical specifications followed by a section which discusses the need for operating in a water solid condition.

Section 8 lists the find-ings and conclusions, and Section 9 contains the AEOD recommendations based on this case study.

2. 0 SYSTEM DESCRIPTION Turkey Point, Unit 4 is a Mestinghouse designed three-loop pressurized water reactor located in Dade County, Florida and is operated by the Florida Power and Light Company.

The unit received'n operating license on April 10, 1973.

The low temperature overpressure protection function is, in general, provided by the power-operated relief valves (PORVs) on the pressurizer and associated PORV actuating circuitry.

The system is variously referred to as the over-pressure protection system (OPPS),

the low temperature overpressure protection system (LTOPS) or the overpressure mitigating system (ONS).

The latter designa-tion is used at Turkey Point.

The PDRV low pressure opening setpoint ensures that. the limits of 10 CFR 50, Appendix G, are not exceeded, particularly during water solid operation.

The pressure and temperature instrumentation, which provide the inputs to the circuitry for each PORV, are redundant and are located in the loops of the reactor coolant system (RCS):

The instrumentation is also use'd to isolate the residual heat removal system (RHRS) and to calculate the subcooling margin.

Operability and surveillance requirements for the OMS are

'sand.,inMhe technical 'speci.fications for most plants (see Section 6).

e A single...train of the OMS will prevent..the pressure from exceeding" Appeo'dix G'

limits at low temperatures wHen.the trans'i'ent H limited to esther (1) the-startup of an idle RCS loop with a maximum differential temperature (about.

50 F) between the primary and secondary coolant systems, or (2) the injection of'mergency core cooling system (ECCS) coolant into the primary coolant system from a single safety injection pump" when the RCS is water solid, i.e.,

no steam

• This criterion may not be part of the Mestinghouse design (see Section 6.4).

2

bubble in the pressurizer.

The OMS protects the reactor vessel from over-pressurizing due to any single equipment failure or single operator error.

However, a single failure or operator error can challenge the OMS.

Procedures exist to minimize the challenges and prevent overpressurization transients; e.g., disabling the high pressure injection systems during cooldown, limiting a reactor coolant pump start based on primary/secondary temperature differences, and administratively controlling the filling and venting of the RCS.

Operability,and performance requirements for the OMS are based on the Appendix G

pressure/temperature limits.

These limits are calculated based on structural material methods and include neutron irradiation effects.

Since the limits change as the vessel'becomes irradiated, these limits are usually calculated to-be conservative for at least five years in the future.

At the end of this time period the pressure-temperature limits are revised'nd'ncorporated into the technical specifications.

Figure 1 shows the pressure-temperature limits for Turkey Point Unit 4.

These limits are used to calculate the PORV setpoint including pressure overshoot considerations, e.g.,

valve stroke time, and mass and heat transfer effects to the RCS.

The OMS at Turkey Point includes two PORVs and.separate instrumentation and activating circuitry.

Figure 2 (Ref. 1) shows a single train schematic of the two train system.

RCS pressure and temper'ature are inputs into the circuitry.

The pressure is input into a comparator which subtracts the RCS pressure and the computed pressure setpoint (shown in Figure 2) calculated-by the summator based on the RCS temperature.

If the system pressure exceeds the

setpoint, the output signal from the comparator causes the actuation relay to energize the PORV solenoid (air or nitrogen is required) which opens the PORY

.-==.=.-=.a~n=Soincg-wn.=a).arm. iedica0i~g-terat the. OMS.has activated..=...

5n addition-to'he OMS activationml'a~-,other~1'arms.

are available-to the operator regarding OMS status and alignment.

RCS pressure (P-402 in Figure 3) and the OMS status circuitry provide two alarms:

OMS Low Pr'essure Operation and OMS High Pressure Alert.

The first alarm will sound if the RCS pressure is below 390 psig and the OMS is not properly aligned for low temperature over-pressure protection.

The "OMS High Pressure Alert" alarm activates at a RCS pressure of 400 psig to warn the operator that the RCS pressure is approaching

2600 2400 2200 2000 1800 1600 D

1400 UJ

~

rr.

1200 O

I-+o1 000 O

800 MATERIALPROPERTY OASIS WELD METALCU=0.30%

INITIALRTrr()~

0 F AT 10 EFFECTIVE FULL POWER YEARS RTrroy AT /i THICKNESS 342 F RTrroy AT /i THICKNESS 230 F NORMALRELIEF SET POINT 2335 NORMALOPERATING PRESSURE 2235 I

I I

II<.

I I

~l 200 0

COOLDOWN RATES oFIHR 0

20 60 100 OMS LOW PRESSURE REGION 3554 HEAT Et COOLDOWN REGION I

I I

~

I I

I

-I I

517~

~525~

50

100, 150 200 250 300 350 Tavg INDICATEDTEMPERATURE VR 400 450 Figure 1 Turkey Point Unit 4 Pressure/Temperature Limits

Root Isolation Valve PT-405 Interlock to Isolate MOV-4-751 at 465 psig TE-423 Temperature Element Comparator PC-405C Summator TM-423A PC405CX Actuation Relay To P0RVC-455C High Pressure Controls OMS Control Actuated Alarm Redundant Train Figure 2 Single Train of Overpressure Mitigating System

MOVE.535 PORV4456 Pressurizer M0 V-4.536 P

OR V-4455C T

430 T

423 A

P 405 P

402 RHR Figure 3 Identification of Instrumentationai PORVs for the Ovorprossuro Mitigating System

the OMS setpoint '.and that action is necessary to correct the cause of the pres-sure increase; particularly when water solid; During normal heatup and steam pressurization, the alarm reminds the operator to deactivate the OMS after a steam bubble is drawn in the pressurizer.

The operator must, therefore, asso-ciate RCS conditions and operations underway in order to. correctly respond to the alarm.

The OMS will activate the PORVs and prevent overpressurization only if the OMS is correctly aligned.

The OMS mode selector switch, the PORV mode switch, the PORV stop valve mode selector switch and the valves control voltage are con-

,tinously monitored to indicate the status of the OMS.

The PORV relief mode switch is in the "alert" position and the stop valve mode switch is in the "open" position for all modes. of operations.

When the RCS temperature is below 355 F (see Figure 1), the operator must change the OMS mode selector switch from the "normal pressure" to the "low pressure" position in order to correctly align the OMS. If any of these switches is mispositioned or the.control voltage for the valves are not correct, the "OMS Low Pressure Operation" alarm will sound.

Since the status ci rcui'try does not include a reflash'capability, any time one train is inoperable the alarm will not reflash or sound if the other train is misaligned or becomes inoperable.

.Consequently.,

the operator may not know if the redundant train becomes inoperable.

In cold shutdown, the RHRS and the chemical and volume control system (CVCS) are cross-connected (Figure 4).

Typically, the.RHR pumps are taking suction from the hot leg of the

RCS, pumping the coolant through'he RHR heat exchangers and returning the coolant to the cold legs of the RCS.

At low pressures, let-down-flow is from the RHRS. to the CVCS, because the orifices in the normal let-down 'line in the CVCS limit the flow.

The cross-connection piping begins at the discharge of the RHR heat exchangers and connects to the inlet of the non-regenerative heat exchanger in the CVCS.

A pressure control valve (PCV-145) in this piping controls the amount of letdown from the RHRS to the CVOS.

In. an RCS water solid condition, this valve would also control the RCS pressure based on an operator selected value.

One positive displacement charging 'pump is normally operating, providing makeup flow to the RCS and seal cooling to the reactor coolant pumps (RCPs)...

7

P 403 405 Cold Leg Hot Leg MOVE-750 MOV-4-751 RHR Heat Exchangers CVCS Cross. Connect Piping HCV4-142 Normal Letdown Non Regenerative Heat Exchanger PCS-145 Volume Control Tank Cold Leg Positive Displacement Pump (One of Three)

RCP Seals Figure 4 Letdown Configuration During Low Temperature Operation

Two isolation valves on 'the RHR suction line automatically close at an RCS pressure setpoint (about 465 psig) to prevent overpressurizing the RHRS should the RCS pressure exceed the design pressure of the RHRS.

Since these are slow closing valves, pressure relief valves are available to mitigate a pressure excursion in the RHRS.

The opening setpoint for each of the two relief valves is 600 psig.

Since the RHRS is isolated automatically during a pressure excursion, these relief valves are not intended for mitigating an RCS pressure transient.

The most susceptible RCS condition for pressure transients is when the RCS i@---

water solid.

During this time a small positive mass addition to the RCS results in significant pressure increases.

A particularly sensitive condition is near the completion of the filling and venting process when the volume of the remaining air is extremely small.

Since the reactor coolant is incompres-sible,.net increases in the reactor coolant volume due to either mass or heat additions compress the air volume resulting in significant pressure increases.

Starting an,RCP during the latter phases of filling and venting can also lead to a mild pressure transient and challenges to the OMS.

Prior to starting an

RCP, the RCS pressure is increased to establish a required differential pressure across the RCP seal to a value near the PORV setpoint.

Mhen the pump is started, the pressure increase by the pump head can lead to an increased pressure in the pressurizer, which can reach the PORV setpoint depending on the initial system pressure.

This phenomena is further discussed in the technical specification section of this report.

3. 0 EVENT DESCRIPTIONS 3.1 Conditions Prior to the Events The reactor was shutdown in a refueling outage until October 19, 1981 and pre-parations were underway for plant heatup on November 28, 1981.

The RCS had been filled solid with water at a temperature of about llO~F and pressure was about 340 psig.

The operators were performing OP 0202. 1-Reactor Startup-Cold Condition to Hot Shutdown Conditions, and had progressed to the step for starting a reactor coolant pump."

The residual heat removal and'hemical and'olume control systems were in operation at the time (Figure 4).

Both RHR p'umps were operating taking suction from the hot leg through valves 4-750 and 4-751 and discharging to the cold legs through valves. 4-744 A and B.

Letdown flow was through valve HCV-142 which is in the cross-connect piping between the RHRS and the 'CVCS.

One train of the OMS was inoperable for maintenance--an important factor during the event.

One block valve (PCV-536) was closed while the work was being performed on the pressure controls for the PORV (PCV-456).

The OMS circuitry was still available to provide the alarms discussed in Section 2.

The other OMS train was thought to,be operable.

3..2 Over ressure Event on November 28 1981 Beginning at 9:20 p.m.

on November 28, 1981, the operators started the "B" RCP to increase RCS temperature.

The pump ran for about 30 minutes.

At 10: 15 p.m.', the pump was run again for about 45 minutes.

The average RCS tempera-ture increased from about 103 F to ill'F.

Mhen the pump was started the third time at about ll:20 p.m., the operator observed that the RCS pressure was increasing above 500 psig.

He manually opened PCV-145 in an attempt to control

pressure, (i.e., increase letdown flow), but then he noticed that the RHR suc-tion valve 4-750 had closed and terminated all letdown flow.

The operator immediately tripped both the RCP and charging pump, deenergized the pressurizer

heaters, and opened,PORV-4-755C.

The elapsed time was approximately two minutes for the pressure to increase from about 310 psig to 1100 psig:

At about 400 psig, an alarm based on P-402 should have alerted the operators of increasing RCS pressure to the OMS setpoint.

In addition, the alarm indicating OMS actuation from the "inoperable" train should have also alerted the operators to increasing RCS pressure above 415 psig.

The.operators indi-cated that neither alarm had functioned.

If these alarms had sounded, the operators could have responded sooner and reduced the peak pressure experienced.

Even without the benefit of these

alarms, operator response was.quick and effective.

10

After the event,

however, operator analysis of the event was not thorough and effective, since the root cause of the pressure transient was not determined before the heatup efforts continued.

The event occurred at about 11:20 p.m.,

ten minutes before the end of the third'hift.

Actions taken by the operators between ll:20 P.M.

and 12:28 a.m.

were not entered in either the operator's or plant supervisor's log books.

The off-going shift had stabilized RCS condi-tions before the shift change.

After the RCS pressure was reduced, system realignments were made to establish the normal RHRS mode of operation.

The RHRS isolation valves were reopened and letdown flow through PCV-145 reestab-lished.

The NRC was not notified of the pressure transients.

The operators determined that the root valve to the pressure transmitter (PT-405) was closed (see Figure 2).

When the RCS pressure exceeded the pres-sure interlock (465 psig) for the RHR suction valves (4-750 and 4-751), valve 4-751 did not close.

This failure, together with the failure of the OMS train to function, led to the identification of the closed root valve since.PT-405 provides input to both systems.

The closed root valve rendered the available train of the OMS inoperable.

Consequently, both OMS trains (the other train was out of service for maintenance) were inoperable simultaneously and operator action was necessary to mitigate the overpressure transient.

The oncoming shift operators did not know the reasons for the pressure transient, nor did they investigate the possible consequences of exceeding the pressure limits by a factor of two.

This is attributable to the off-going operators'ailure to identify that the technical specification had been exceeded.

Although attempts were made to return the inoperable OMS train to service, determined operator efforts to continue plant heatup did not permit maintenance on the train to be completed before a second overpressure transient occurred.

3.3 Over ressure Event on November 29 1981 The operators resumed RCS heatup by starting the "B" RCP at 12:40 a.m.

from a temperature of about 102'F and pressure of 340 psig.

The "B",RHR pump was stopped at about 12:47 a.m.

About 8 minutes lat'er, the alarm sounded

indicating that both RHRS isolation valves had closed.

The RCS pressure peaked at about 750 psig before the operator opened PORV-4-455C, stopped the reactor coolant pump and the charging

pump, and deenergized the ~pressure heaters.

In order to re-establish RHRS operation, the RCS pressure had to be reduced to about 300 psig in order to clear the pressure interlock to open RHRS. isolation valve (MOV-4-751).

The pressure instrument (PI-4-405) which provides the pressure input into the interlock logic indicated about 120 psi higher than the other two RCS pressure instruments (PI-4-402 and 403).

The system pressure was about 340 psig, but PI-4-405 was indicating about 465 psig which corresponds. -

to the RHRS isolation setpoint.

This led the operators to diagnose the cause of the second pressure transient as the inadvertent isolation of the RHRS due to the failure of PI-4-405.

The first plant work order initiated to troubleshoot PI-4-405 and the OMS was at 1:00 a.m.--immediately after the second event.

The technician calibrated PI-4-405 and found that the summator (TM-4-423A) had fai'led high, providing an output, pressure of about 2335 psig.

These two unrelated failures (pressure instrument and summator) rendered the "operable" OMS train inoperable.

Conse-quently, Turkey Point Unit 4 had been in a water solid condition without over-pressure protection for about 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and had experienced two overpressure transients.

The OMS train was returned to service at 7:00 a.m.

on November 29, 1981.

The cause of the first overpressure event and possible stress

damage, from the overpressurization were still unknown.

The operators continued with RCS heatup until the plant manager notified the NRC Regional Office at 3:30 p.m.

The Region requested that operation be suspended until the analyses were made to confirm that no structural damage to the vessel was probable and that there were adequate margins for continued operation.

4. 0 EVENT ANALYSES If either OMS train had been operable while the RCS was wate'r solid on Novem-

'er 28-29, 1981, neither overpressure transient should have occurred.

The lack of a technical specification requirement or good operating practice requir-ing. both trains of OMS to be operable before entering a water solid condition were indirect contributors to the events.

Inadequate surveillance procedures 12

for determing OMS'perability were also important factors.

Prompt and correct operator actions to mitigate the pressure excursions prevented a higher pres-sure peak, which could have challenged the safety valves at 2485 psig.

After the second event and as a result of NRC Region II intervention, Florida Power and Light Company requested Mestinghouse to evaluate the effect of the pressure transients on the structural integrity of the reactor vessel.

The evaluation concluded that neither event affected the fatigue life of the vessel.

A second evaluation was performed by Teledyne Engineering Services which further verified that no structural damage could have occurred to the.

reactor vessel.

Although the technical specifications pressure-temperature limits were exceeded by a factor of two during the first event, the conserva-tisms incorporated into the curves minimize the potential adverse effects of exceeding the limits.

The pressure-temperature

curves, based on Appendix G to 10 CFR Part 50, are not part of the safety limits prescribed in the technical specifications.

The curves provide for safety margins to protect against non-ductile failure.

The analyses performed by Mestinghouse and Teledyne show that the safety margins were not exceeded, even under the assumption of large defect sizes.

Based on the actual neutron. exposure, the pressure-temperature limits were not actually'xceeded.

The pressure limits were calcu-lated pursuant to Appendix G assumptions based on fluence for 5.65 effective full power years (EFPY) rather than 10 EFPY assumed for calculating the pres-sure-temperature limits in the technical speci'fications.

The corresponding reference nil ductility temperature was 175 F as. compared to 345 F used for the technical specification limits.

For an assumed flaw of about 2 inches

deep, the calculated allowable pressure was 1235 psig; therefore, the Appendix G limits actually were not exceeded based on a peak pressure of 1100 psig.

Based on discussions with the plant staff, the operators may not have recognized that the technical specifications pressure-temperature limits were exceeded.

Thi.s may help to explain why the operators continued with plant heatup without identifying and correcting the root cause of the first event.

In addition, technical specification 3.1,2 requires that the RCS remain acceptable for con-tinued operation after exceeding the pressure-temperature limits.

The analyses necessary'o show that the structural integrity of the vessel was not jeopar-dized were not initiated unti 1 after the second event.

The procedures did not 13

provide any guidance to the operators defining what actions were required to determine that the RCS remained acceptable for continued operation.

The Shift Technical Advisor was not requested to perform any engineering analyses of the RCS integrity.

Neither event prompted the plant manager or the operations staff to determine the cause for the overpressure events before continuing with plant heatup.

The operations staff focused primarily on the reasons that the OMS train failed to

operate, which were believed to be corrected before heatup continued.

The instrumentation and control technician was still troubleshooting the cause oi--

the inadvertent isolation of the RHRS after the first event when the second isolation occurred.

Since the RHRS isolation valves were being checked out under operator cognizance, the operator immediately saw the valves close during the second event and was able to respond more quickly than during the first.

event.

During the investigation of the events, operations personnel indicated that the pressure control valve (PCV-,4-145), which controls RCS pressure in a water solid condition, was operating improperly before the events.

The reasons were not apparent for the operator's delay in submitting a Plant Work Order (PWO) to troubleshoot the erratic behavior of the valve.

The plant records show that the PWO for the pressure control valve was not initiated until December 3, 1981

--'our days after the first event.

This delayed action further suggests that the root cause of the events was not determined in a timely manner after the initial event.

As a result of the PWO, the pressure control valve controller was found to have a power supply failure and the valve positioner was out of calibration.

The combination of these two problems probably accounts for the errati'c behavior, of the pressure control valve (valve cycling in the automatic mode),

and was the most likely cause for the first event.

The plant procedure for filling and venting the reactor coolant system (OP 1001.1 dated 6/14/80) required only one OMS train to be operable prior to the. RCS being water solid and delineated the steps to test and align the OMS.

Although these actions compiled with the technical specifications both were

indirect contributors to the overpressure events.

With only one train of the OMS operable,

'a single failure precludes any 'overpressure mitigation capabi-lity, as exemplified by the Turkey Point events.

The OMS meets the single failure criteria when both trains are operable.

These events demonstrate that for defense-in-depth

safety, prudent operating practice should have both trains operable during a water solid condition--the only time that the OMS is needed to mitigate an overpressure event.

Availability of both OMS trains prior to operating in a water solid condition is a generic concern and is discussed in Section 6.

Although the OMS was functionally tested prior to the RCS being water solid pursuant to technical specifications and procedures, the test was inadequate because all the OMS components were not included in the test.

After the first

event, the operators found that the instrumentation root valve to the pressure transmitter in the OMS was closed.

After the second

event, the summator was found to have failed.

These failures were unrelated, but either one would make the OMS train inoperable or could have been detected by adequate testing.

The IE Region II (Ref. 2) cited the licensee for inadequate procedures.

The RCS,pressure was not recorded during the events.

The peak pressures were observed by the operators, but the peak pressure during the first event was not entered into the log book.

The narrow range RCS pressure (PI-402) is not per-manently recorded and is used by the operators for control purposes below 1700 psig (the pressurizer pressure is used above 1700 psig and is recorded by a strip chart).

The lack of pressure data severely limited the capability to analyze the events during this study, particularly the root causes.

The only relevant trend data available were the RCS and the RHRS temperatures.

The underlying cause for the pressure excursion occurring at the time the RCP was started could not be determined.

Consideration was given to the possibi-lity of a heatup tr ansient causing the pressur e excursion.

For a heatup tran-sient to occur when the RCP was started, the secondary coolant system tempera-ture had to be sufficiently. higher than the primary system such that the pri-mary coolant temperature increased as it passed through the steam generator.,

But since the RCP had been operated for two intervals for about 45 minutes prior to the event,. this scenario is not likely.

The licensee analyzed the 15

RHRS temperature recorder traces to show that the initial pressure excursion was not caused by a thermal transient, e.g.,

heat input into the RCS from the steam generators.

The probable cause of the event was the closure of the letdown control valve PCV-145.

After the second event the operators initiated a plant work order (PWO) dated November 29, 1981, indicating the automatic controller was failing open and closed when in automatic control.

The hand-auto controller was re-placed on November 30, 1981.

On December 3, 1981, another PWO requested all PCV-145 loop components to be checked.

On December 5, 1981, the bench test af.-

the controller revealed a faulty power supply which was repaired and the let-down control valve performed acceptably.

As a result of the overpressure events and in response to the IE Notice of Violation (Ref. 2), Florida Power and Light Company (Ref. 3) made changes in the following operating procedures:

(1)

Operating Procedure 100. 1, Filling and Venting the Reactor Coolant System, has been changed to include verification that instrument root valves are correctly aligned.

The procedure was updated to include testing of OMS at two different steps in the procedure, and the addition of transmitter and summator checks to the tests.

(2)

Operating Procedure 1004.4, Overpressure Mitigating System Functional Test of Nitrogen Back-up System, was changed to include checks on applicable pressure transmitters, summator output, and recording of actual test data.

(3)

Operating Procedure 0205.2, Reactor

Shutdown, Hot Shutdown to Cold Shutdown Conditions, was revised to include additional checks on OMS summators.

(4)

Operating Procedure 0202. 1, Reactor Startup, Cold Conditions to Hot Shutdown Conditions, was changed to inlcude root valve alignment checks on instruments affecting alarm functions, automatic aetio'n, and transient control.

Changes wer e also made to ensure that the steam generators are 16

not hotter than the, RCS when an RCP. is started.

A temperature check of the metal. temperature of the steam generator using a hand-held pyrometer is now required.

Turkey Point initiated additional efforts to evaluate other precautions and possible modifications to prevent LTOP events.

These studies included:

(1)

Redesigning the OMS to reduce the number and the possibility of component failures.

(2)

Improved RCS pressure instrumentation and indication in the low RCS pressure range.

(3)

Performing a thermal fatigue analysis of the pressurizer surge line to evaluate the necessity for the 200 F temperature differential between the RCS and pressurizer liquid.

A reduction in this level would permit a late collapse and early formation of the pressurizer

bubble, or e1imination of water solid operation.

(4)

Maintaining the normal letdown line open during low temperature operation and utilizing the CYCS relief valve if requi red.

(5)

Adding an automatic high pressure. trip to the CYCS charging pump, thereby eliminating a major contributor to,pressure excursions during low temperature operation.

These studies are ongoing and the results are not avai.lable for this report.

A significant and prudent change was made to administrative procedures that now includes notifying the technical department, in addition to the plant manager, when operational occurrences happen.

This will ensure that the events are subject to a technical evaluat'ion and a proper understanding before plant operation continues, that operating experience will be fed back to plant staff.

This practice is exemplary of.good safety management and'ishould be a part 'of, the standard operating procedures at all plants.

17

In summary, the analyses of the Turkey Point overpressure events reveals that although the technical specifications pressure limits were exceeded, the struc-tural integrity of the vessel was not damaged.

The pressure excursions were caused by an inadvertent loss of letdown with continued charging flow while the RCS was water solid.

Both trains of the OMS were inoperable.

Operator actions were required to mitigate the pressure transients, and prevented a more serious threat to the reactor vessel integrity.

The second event could have been pre-

vented, provided the plant management had performed a detailed evaluation of the first event and its causes.

Neither event would have occurred if the OMS

'ad been operable.

One train was inoperable for maintenance and the second.

train experienced an undetected failure which was not identified due to an inadequate surveillance procedure.

The actions taken or that are underway by Florida Power and Light Company properly reflect the lessons learned from the events.

5. 0 OPERATING EXPERIENCE Prior go the Turkey Point events, AEOD had been trending, events involving fail" ures or inoperable trains of OMS.

Since 1979 (approximately the time that'over-pressure protection systems were installed),

numerous events had occurred where either one or both trains of the system were inoperable.

The Turkey Point events were the only events involving a pressure transient with both trains of the OMS inoperable, which led to exceeding the technical specification limi'ts.

The significance of the events were communicated to other operating plants in two IE Information Notices (Refs.

6 and 7).

Ten events (excluding the two events at Turkey Point Unit 4) were reported which challenged and were-mitigated by the OMS.

Table 5. 1 lists the events and identifies the causes for the pressure transients.

Six of the eight events resulted from excessive makeup flow to the RCS either by the safety injection or charging pumps.

This was also the predominant cause for overpressure events before the LTOP generic issue was resolved in 1978.

The two events at North Anna Unit 2 involved thermal transients resulting either (1) after the RCS loop isolation valve was opened after the reactor coolant pump had been running, or (2). after an RCP was started with the secondary side 35 F higher than the RCS.

18

Table 1

'Challenges to the Overpressure Mitigating Systems Plant LER Event Date Descri tion 1.

North Anna-1 2.

Surry 1 81-018 (3/29/81)

Inadvertent SI with System Solid.

Both PORVs opened.81-018 (7/02/82)

Inadvertent charging flow with system solid.

One PORV opened.

3.

San Onofre Sp.

Rpt (5/?/82)

Inadvertent letdown decreased with increased charging flow wi.th-system solid.

Relief valve in SDCS lifted.

4.

Palisades 5.

North Anna-2 6.

North Anna-2 7.

Ginna 8.

North Anna-1 9.

Sal em-2 82-04 (12/4/82)

Inadvertent SI while water solid.

PORV opened 82-024 (5/18/82)

Started RCP after opening RCS loop isolation valve with system solid.

PORV opened twice.82-024.(5/24/82)

Started RCP during filling and venting RCS with system. solid.

PORV opened twice.

Sp.

Rpt (6/9/83)

Personnel error during SI train, test..

Charging pump was not tripped.

PORV actuated.83-033(5/23/83)

Inadequate calibration procedures resulted in inadvertent safety injection.

PORV opened three times.83-029 (6/17/83)

. Personnel error during SI train test actuated SI while water solid.

Both PORVs actuated.

10.. Calvert Cl iffs-1 83-019'4/26/83)

Operator error increased RES pres-sure above PORV setpoint.

Block valve was closed because valve.

operation believed spurious.

Second train mode inoperable by techni-cians. 'o LTOP protection for about 17 minutes.

19

The first North Anna event was a pressure increase due to a thermal transient after the loop isolation valve was opened and the water heated by the operating RCP was mixed with and expanded the colder RCS.

The RCS volume increase caused the pressure to increase from 364 psig to the PORV setpoint of 385 psig.

Prior to the event, the isolated loop temperature was 190 F and the remainder of the RCS was at a temperature of 104 F.

The second North Anna event is believed to have resulted from starting the RCP when the secondary temperature was about 35~F higher than the RCS.

The thermal expansion of the RCS due to the energy addition from the steam generators, together with the RCS pressure increase due to the pump, resulted in a pressure increase of about 35 psi within minutes, which activated the PORY.

Depending on.the initial system pressure when the reactor coolant pump is started, it, appears that 35~F differential temperature between the RCS and secondary cool-ant system is too large to prevent challenge to the OMS.

The technical speci-fications permit a 50 F differential temperature.

The adequacy of this and other technical specification requirements are discussed in the next section.

Table 5. 2 shows the frequency of reported pressure transients in operating PMRs before and after the resolution of the low temperature overpressure generic issue.

The data show that the frequency of pressure transients for the three years before and after 1979-80 is about the

same, but the trend has increased since 1982.

If the present rate of pressure transients continues'or the remainder of 1983, the frequency will exceed the level reported prior to the identification of the safety concerns associated with low temperature overpressure events.

The significant difference is,

however, the magnitudes of the peak pressures are significantly less, except for the Turkey Point events.

The data suggest that the implemented administrative controls have not effectively prevented pressure transients, but that the overpressure protection systems have effectively mitigated them.

Since 1980, 37 events were reported in which at least one train of the OMS was.

inoperable.

Twelve of the LERs reported both trains inoperable.

An Informa-tion Notice (Ref. 7) was issued informing licensees of operati'onal events in-volving degraded or inoperable OMS.

These events indicate that during the time the OMS may be required to. operate, the system did not meet the single failure 20

Table 2

Frequency of Reported Pressure Transients in Operating PWRs Yea@

Number of Events Number of PWRs Licensed Average No. Events Per Unit/Year 1973'974 1975 1976 1977 1978

'5 8

8 1

2 23 30 32 37 40 41

. 217

. 267

. 125

. 216

. 025

. 049 1979-80 Resolution and'mpl ementati on of Gener ic Issue 1981 1

1982 5

1983( J une) 6 48 51 51

.021

. 098

. 235 NOTE:

The data for the years 1973-78 is extracted from NUREG-0224.

cri,teria or that no overpressure protection was available.

Salem Units 1 and 2, North Anna Units 1 and 2, and Surry 1 have reported recurring events in-volving both single failures and complete OMS system failures.

The eleven events involving complete loss of the OMS are more significant, although there were no pressure transients during the time the system was inoperable.

The system failures at Salem were primarily caused by leaking pressurizer

PORVs, which were isolated.

At North Anna, recur ring problems with leaks in the nit-rogen supply system, which is required. to operate the

PORVs, have resulted in

numerous LERs and a pending design change to the nitrogen system.

Personnel error, leading to the pressure instrumentation inoperability for the OMS resulted in both trains of the OMS being inoperable at Surry.

In almost every event, a

singl'e train of the OMS was inoperable or out of service before the second channel failed.

In addition, the low temperature condition was entered when a

channel of the OMS was inoperable.

Consequently, in the event -of a pressure transient and a single failure of the operable train, the event would have required, operator action to mitigate the event.

In general,.the time available is not sufficient to prevent exceeding the pressure limits set by the technical specifications when water solid.

The technical specifications.permit-entering the low temperature and pressure 21

region with one train of 'the OMS inoperable and even requires entering a water solid condition indirectly and depressurizing to vent the RCS when both trains are inoperable.

A change to the operability requirements for the OMS when entering this vulnerable mode could reduce the risk of an overpressure event.

This is further discussed in the next section.

6. 0 LTOP TECHNICAL SPECIFICATIONS The technical specifications (Appendix A) at Turkey Point for LTOP protection

're non-standard technical specifications, but representative of the requir e.= --

ments resulting from resolution of the LTOP generic issue.

A review of the Turkey Point and other technical specifications was prompted by the lack of a requirement to have both OMS trains operable before operating in a low tempera-ture condition a contributor to the lack of mitigation capability during the Turkey Point events.

For the purposes of this study and as a result of the variability found during the review of the LTOP technical specifications, the Westinghouse Standard Technical Specifications (Ref. 4) were used as the standard for evaluating'the adequacy of LTOP technical specifications.

The standard technical specifications governing reactor operation to prevent overpressurization which could cause brittle fracture of the reactor vessel during low temperature operation include -the following:

(1)

Reactor Coolant System 3.4.9. 1 Appendix G pressure/temperature limits.

(2)

Reactor Coolant System 3.4.9.3 - Overpressure protection systems.

(3)

Reactor Coolant System 3.4. 1.4. 1 - Starting a reactor coolant pump (primary/secondary temperature difference).

(4)

Emergency Core Cooling Systems 3.5.3 - Maximum number of charging and safety injection pumps operable.

22

The objectives of.these'technical specifications are to minimize the potential for a pressure transient during low temperature operation and ensure that miti-gation capability exists to prevent exceeding the pressure/temperature limits should a pressure transient occur.

Those plants which have overpressure protection technical specifications (some do not),

and which do not have standard technical specifications, have require-ments similar to the standard technical specifications.

After the Turkey Point events, the Division of Systems Integration (NRR) sur.= --

veyed all operating PMR LTOP technical specifications for adequacy and com-pleteness with respect to the original LTOP safety evaluations (Ref. 5).

The survey found that only about 25%%uo'f the operating PMRs, which should have LTOP technical specifications, had adequate technical specifications.

In addition, there were nine operating PMRs which the staff had not reviewed and approved LTOP systems and the corresponding technical specifications.

Reference 5 indi-.

cates that staff actions would be initiated to correct the technical specifica-tions deficiencies and to. complete the technical review for the nine plants.

This study also reviews the adequacy'f the LTOP technical specifications.

This section discusses the results of the evaluati'on which focus on existing requirements to prevent and mitigate: overpressure

events, considering the Turkey Point and other events which led to challenges to>the OMS: systems.

6. 1 Pressure/Tem erature Limits The technical specifications 'pressure/temperature limits (Appendix B) and the pressurizer PORV characteristics determine the PORV setpoint.

Since the set-point is independent of other operating constraints, consideration was given to the pressure margin available before reaching the PORV setpoint.

Operating experience shows that most of the PORV challenges result from either RCP start-up, letdown.flow isolation, or inadvertent safety'njection.

for most of these

events, the initial RCS pressure was less. than 50 psi below the PORV setpoint.

This prompted an evaluation to ascertain the reasons for the small pressure margin.

23

Evaluation of the operating limitations for the RCP and the isolation setpoint for the RHRS revealed that the pressure differences between these limitations and the pressure/temperature limits were small.

The margin was further reduced when calculating the PORV setpoint when the response characteristics of the valve were included.

This means that any small pressure perturbations resulting from either starting an RCP or inadvertently isolating the RHRS with continuing charging flow will likely result in challenges to the PORVs.

For example, the Turkey Point procedures for starting an RCP require a system pressure of appro-ximately 375 psig to ensure proper delta pressure across the No.

1 pump seal.

Mith the PORV setpoint at 415 psig, the pressure difference of 40 psi is less.-

than the 50 psi pressure increase when the pump is started.

Hence, during the latter phase of filling and venting. the RCS when there is but a small volume of air remaining, starting the RCP can result in opening the PORVs.

Lowering the operating pressure for the RCP was not considered feasible by Turkey Point.

since their experience showed that lower pressures across the seal produced wear, and eventual seal damage.

Challenges to the PORVs should be minimized to every extent possible.

During low temperature operation, challenges to the PORVs result in subcooled water passing through the valve - a condition for which the valve was not designed.

As a result the valve may leak, requiring the valve to be isolated during power operation.

In addition, a failure of the valve to seat properly during low temperature/pressure operation may result in decreases in the RCS pressure'elow that required to maintain adequate pressure differential across. the RCP

seal, and may result in damage to the seal.

The second situation considered was the pressure difference between the PORV setpoint and the pressure at which the RHR (letdown) is automatically isolated.

Isolation of the RHRS exacerbates the pressure transient since letdown is iso-lated and charging flow continues.

In general the PORV setpoint is below the pressure for isolating the RHR.

for example, at Turkey Point the RHR isolation pressure is approximately 465 psig or 50 psi higher than the PORV setpoint.

Ideally, the PORV actuation during a pressure excursion should maintain the RCS pressure below the RHR isolation pressure, thereby preventing automatic isola-tion of the RHR and letdown during a gradual or small pressure excursion.

24

Although the PORV setpoint is below the isolation pressure for the RHRS, the stroke time for the PORV, which is included in calculating the setpoint, results in a pressure overshoot above the setpoint.

For example, the technical specification pressure limit at Turkey Point is 480 psig, and the PORV setpoint is 415 psig.

The difference is due to the expected pressure overshoot because of the valve stroke characteristics.

As the result of the overshoot, the pres-sure interlock at 465 psig isolates the RHRS.

Since the design pressure for the RHRs is about 600 psig, it appears that the pressure interlock can be in-creased to appreciably increase the pressure margin.

This would require that the relief valve in the RHR have sufficient relieving capacity to protect the---

RHR from overpressurization.

This feature is used in some operating plants.

In addition, the need for the pressure interlock to prevent overpressurizing the RHRS may not be required since the PORVs in the LTOP mode would protect the system as long as the OMS is operable.

It does not appear practical to change the pressure/temperature limits or the operating pressure for the RCP in order to achieve an increase of the pressure differential to accommodate RCS pressure changes and yet not challenge the PORVs.

With continuing neutron fluence to the reactor vessel, the PORV setpoint will be decreased with time to further reduce the margin.

This may necessitate a change in the current method of operating in a water solid condition, partic-ularly for Westinghouse and Combustion Engineering designed plants.

The Babcock and Wilcox designed plants do not operate in a water solid condition because a

nitrogen cover gas is maintained in the pressurizer during low temperature conditions.

The Arkansas Nuclear One plants are notable exceptions and do not operate either water solid or use a nitrogen cover gas.

(Their method of operation is discussed in Section 7.)

After considering several options to minimize pressure excursion during low temperature operation, increasing the letdown flow capabi,lity appeared to be easily achieved, marginally effective, but beneficial.

This could be achieved by maintaining the normal letdown path to the CVCS and by opening the exces-sive letdown path to the'CVCS during the final phases of filling and venting the RCS.

In addition, the relief valve in the CVCS could'rovide some pressure relieving capability.

Calculations showed that the relief valve could provide 25

an additional letdown flow equal to about the charging pump capacity.

Maintain-ing the normal letdown path during fil.ling and venting is a recommended prac-tice.

An alternate option was to employ a pressure interlock for the charging valve or charging pump, which would terminate makeup flow when the RCS pressure increased to a predetermined value during solid RCS operation.

This option was dismissed since this feature could adversely.affect the safety functions of those components during safety injection.

In conclusion, the only. practical method of increasing the pressure margin to

'he PORV setpoint (which could reduce the challenges to the PORVs) would be.to increase or eliminate the pressure interlock for the RHRS.

This feature would have to be evaluated considering the, possible risk of overpressurizing the RHRS and loss of shutdown cooling or resi'dual heat removal capability.

Westinghouse is currently evaluating the risk associated with modifying this pressure inter-lock design feature.

6.2 Over ressure Protection S stem Turkey Point entered a solid RCS operating condition with one train of the'OMS inoperable.

This degraded mode of overpressure mitigation capability is per-mitted by both Turkey Point and the standard technical specifications.

For s'afety-related

systems, the L'imiting Condition for Operation must be met without reliance on provisions contained in the Action statements.

The LTOP technica) specification explicitly excludes this Applicability technical specification (See Appendix C).

The purpose of exempting the Applicability requirement was to permit depressurization under extenuating circumstances.

However, during

heatup, when oper'ations can be suspended to comply with the Limiting Condition for Operation, the Applicability statement should apply.

When entering a solid RCS condition with one train of the OMS,inoperable, the system cannot meet the single failure criter ia during the small time interval that may be required to mitigate an overpressure transient.

Maintaining two operable trains during solid RCS conditions is consistent. with the design basis of the OMS and certainly prudent operating practice to ensure a reliable mitigating system.

26

As part of ensuring a reliable, mitigating capability, the Action Statement with one PORV inoperable requires that the PORV be restored to operable status with-in seven days.

This is an excessive time period since during normal condi-tions, the plant can progress through the low temperature condition during the seven days without restoring PORV operability.

Operating experience shows that most pressure transients occur during the filling and venting process or during heatup of the RCS.

This is also the period of time when the heatup operations can be suspended to permit maintenance on the PORV without affecting the safety of the plant.

The Action Statement requires that the plant progress through the low tempera-ture regime to'epressurize and vent the RCS if both PORVs are inoperable.

This action is nonconservative with respect to providing overpressure pro'tection in the low temperature regime during shutdown operation and without extenuating circumstances requiring depressurization and venting of the RCS.

In order to reduce the likelihood of a pressure transient when in a degraded condition during heatup, ongoing operations should be suspended until both trains of the OMS are operable.

This philosophy is consistent with the Action Statement for an inoperable RHR pump during Mode 5; i.e., immediately return the inoperable loop to operation or with no RHR loo'p in operation, suspend all operations involving a reduction in boron concentration and immediately initiate corrective action to return the RHR pump to operation.

6.3 Primar /Secondar Tem erature Difference The technical specification (Appendix 0) regarding the operability of the RHR pump prohibits starting an RCP pump when the secondary temperature exceeds the primary temperature by 50 F.

This limit assures that the pressure increase'esulting from the thermal transient caused by heat transfer from the steam generator when starting the RCP can be relieved by one PORV.

Without suffi-cient letdown during water solid operation to compensate for the increasd RCS volume due to small heat addition to the RCS from the secondary

side, the pres-sure will increase and challenge the PORVs.

In practice, the secondary side bulk temperature is not measured precisely.-

As a result of the uncertainty in measuring the secondary temperature, and in 27

order to minimize the potential for a thermal transient due to secondary heat

addition, some plants reduce the maximum temperature differential before starting an RCP to a value well below the technical specification limit of 50~F, or require equalizing the temperatures.

This can "be accomplished by increasing the RCS temperature by increasing the bypass flow around the RHR heat exchangers.

Experienced operators in solid plant operations reduce the temperature differential to the lowest value possible before starting.the RCP.

In addition, the steam generator metal temperature is measured locally using a pyrometer to obtai.n an accurate indication of the secondary temperature.

The challenges to the PORVs on May 24, 1982 at North Anna Unit 2 occurred when there was about a 35 F temperature different,ial.

The filling and venting pro-cedure required that the RCS pressure be between 325 and 375 psig to start the pump.

The RCS pressure was 350 psig and the heat addition from the steam gen-erators increased the RCS pressure to the PORV setpoint 'of 385 psig.

Changes to the plant, procedures will be made to further reduce the allowable tempera-ture differential before starting the RCP or opening the loop isolation valve.

6.4 Maximum Number of Char in and Safet In ection Pum s 0 erable In order to minimize the potential for an overpressure transient due to mass addition while water solid, the technical specifications limit the number of operable charging and safety injection pumps.

The Limiting Condition for Operation for ECCSs (see Appendix E) stipulates a maximum of one centrifugal charging pump and one safety injection pump be operable in the low temperature regime.

This number of pumps does not eliminate the potential for inadvertent increased charging flow or safety injection while water solid.

At some plants where a positive displacement pump provides normal makeup, this added mass com-pounds the pressure transient during an inadvertent safety injection.

The basis.for requiring any safety injection pump to be operable during low temper-ature conditions is not clear.

The small likelihood of a LOCA and the time available to the operators to restore a standby safety injection pump to opera-tion during low temperature conditions appear sufficient to permit the safety injection pump to be inoperable.

In addition, it is not clear that the PORV setpoint calculation includes the charging pump mass addition for the inadvertent 28

safety injection transient.

Informal discussions with Mestinghouse representa-tives revealed that inadvertant safety injection during low temperature opera-tions is not generally included in the design basis for the 'OMS for some, plants since the safety injection system is disabled by administrative controls.

Disabling the safety injection system was included in the staff's resolution of the LTOP generic issue, yet technical specifications permit the system to be operable during low temperature operations.

There were five event reports involving inadvertent safety injection which challenged the OMS.

Most of these events occurred during surveillance testigg.-

of the safety injection system while water solid.

Good operating practice should minimize or eliminate activities while water solid that could lead to overpr essure events.

Similarly, conflicting technical specification require-ments should be eliminated when possible, e.g., testing of safety injection system when water solid.

At Turkey Point the safety injection valves are required to be closed during low temperature operation.

However, if any of the valves are 'found open, eight hours are allotted to close the valve or otherwise block the flow path.

The basis for such a long time interval for corrective action to minimize the potential.for an inadvertent safety injection could not be determined.

6.5 Summar of Technical S ecification Deficiencies In summary, review of the technical specifications pertaining to LTOP preven-tion and mitigation reveals general deficiencies which result in ineffective protection against low temperature overpressure events.

These include the foll.owing:

(1)

Some operating plants do, not presently have LTOP technical specification.

'For those plants which do have LTOP technical specifications, about 25K were judged adequate.

(2)

Considerable variability and inconsistency exist in the technical specifi-cations between operating plants and between the staff requirements deye-loped during the resolution of the LTOP generic issue.

29

(3)

The pressure-temperature limits will be decreased with accumulated neutron exposure to the reactor vessel which will require reducing the PORV setpoint.

The instructions for revising the pressure/temperature limits should also require revising the PORV setpoint.

(4)

The maximum temperature differential permitted by the technical specifica-tions between the primary and secondary coolant systems may be too large to prevent pressure transients without operator actions to accommodate the RCS volume increase due to the thermal transient when an RCP is started.

'5)

The standard technical specification permits an operable safety injection pump during low temperature operation.

This provides a potential for a pressure transient due to mass addition in a water solid condition because of an inadvertant safety injection, e.g.,

during surveillance testing.

Administrative controls are necessary to ensure the safety injection system is disabled and not tested during low temperature operation.

(6)

Tge technical specifications permit operation in a water solid condition with either train inoperable and requires solid plant operation indirectly in order to establish the required vent when the OMS is inoperable.

7.0 REACTOR COOLANT SYSTEM MATER SOLID OPERATION The previous section evaluating the LTOP technical specifications shows that the Limiting Conditions for Operation do.not preclude pressure transients while in the low-temperature water solid conditions.

The prudent and effective method to prevent most pressure transients during low temperature operation is not to operate water solid.

Based on the fact that B5M plants and one CE plant do not operate water solid and have not reported any pressure transients during low temperature operations, this study evaluates the need for Mestinghouse and Combustion Engineering plants to operate water solid.

This subject was dis-cussed in detail with several operational and training supervisors at operating Mestinghouse plants 'and with representatives of Mestinghouse and Combustion Engineering.

The discussions did not provide any consensus for the reasons that the. plant must operate water solid.

Moreover, there had not been any incentive to change current practices and not operate water'solid.

Historically, solid 30

plant operation has always been a standard operating mode at Mestinghouse plants.

The two reasons for water solid operation were identified as:

(1)

Oxygen Control The time required to vent oxygen from the RCS is believed minimized by filling the RCS water solid.

In addition, vent-ing all the free gases from the primary coolant system is considered necessary to meet the oxygen chemistry limit before heating above 250 F; and (2)

Pressurizer Temperature Differential The thermal fatigue analysis for the pressurizer surge piping was performed, in the Turkey Point FSAR for a temperature differential of 200 F between the RCS and the pressurizer.

This limit minimizes the number of significant thermal cycles to the surge line and pressurizer.

The limitations on RCS chemistry reduce the potential for corrosion of the reactor coolant-system pressure boundary.

Maintaining the chemistry limits provides adequate corrosion protecti,on to ensure the structural integrity of the RCS.

Excess oxygen in combination with chlorides and fluorides contributes to stress corrosion and plate out of corrosion products or crud on heat transfer surfaces.

The technical specifications define the oxygen, chloride and fluoride limits for both steady state

-and transient conditions for all modes of operation.

An order of magnitude difference exists in the chemistry limits between steady state and transient conditions.

The Action Statement provides 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to

'restore the chemistry parameters to its steady state value as long as it does not exceed the transient limit.

Exceeding the transient limit requires cold shutdown within 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

" The oxygen limit is not applicable when the RCS average temperature is less than or equal to 250 F.

This is relevant concern-ing the need for water solid operation during the filling and venting process because existing Mestinghouse guidelines require venting free oxygen from the RCS in order to meet the oxygen l,imit before establishing a stress bubble in

the pressurizer.

In practice the oxygen limits may be exceeded in the pres-surizer during heatup and generally there is no sampling requirement for the liquid contents of the pressurizer at low RCS pressures.

Filling the RCS water solid supposedly expedites the venting of air/oxygen from the system.

Operating personnel could not quantify the time reduction realized during the filling and venting process since none of the Westinghouse plants use an alternative to water solid operation.

Operating Westinghouse plants generally minimize the time the plant is water solid for the purposes of mini-mizing an overpressure event.

Typically, the plant is water solid for about 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> with an additional 3-4 hours to heat the pressurizer to saturated conditions to establish a bubble.

This compares to about 18-20 hours for Arkansas Nuclear One, Units 1(B&W) and 2(CE) to establish a pressurizer bubble at 50 ps,ig.

Therefore, it appears that water solid operations does not provide any operational convenience during filling and venting to justify the risR of an overpressurization event.

Conversely, the time to establish a bubble using the water solid mode of operation appears to be about 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> longer.

Recognizing the risk of water solid operation and further acknowledging that the risk, though small, is unnecessary, Arkansas Units l,and 2 never operate water solid in low temperature regime during filling and venting and never have challenged the OMS.

They have developed an innovative, unique filling and venting procedure which precludes water solid operation.

This method of opera-ti.on also provides a more positive method of pressure control than when water sol id.

The Arkansas fill'ing and venting method ensures (1) strict control'f chlorides and fluorides in the RCS and makeup water supplies, (2) at least a 40 psi hydro-gen overpressure in the volume control tank, and (3) venting of free gases from the RCS, except the pressurizer, before the bubble is established.

The RCS is filled and vented with the vessel head vent (and the hot leg vents in the B&W design), open and the pressurizer vent closed.

The pressurizer heaters are then energized to establish a bubble in the pressurizer.

RCS pressure is maintained at about 50 psig by venting the pressurizer which also vents air and non-condensibles from the pressurizer.

After the steam bubble is established, the RCPs are run briefly to sweep air from the high points and vented from the RCS.

32

The combination of the hydrogen overpressure in the volume control tank and the gamma radiation act to radiolytically recombine the dissolved oxygen to satisfy the chemistry limit.

Hydrazine is not normally required to scavenge oxygen from the RCS; only for extended outages (6 months) has Arkansas needed to add hydrazine to the RCS.

Chemistry samples are taken from either the RHR loop or the CVCS during the filling and venting operation.

The pressurizer liquid is sampled for boron

analysis, but a chemical analysis for oxygen could also be performed.

The estimated time that the pressurizer temperature is above 250~F (the technical specification limit) with free oxygen in the steam space is about an hour.

Although the oxygen limit may be exceeded in the pressurizer, the potential for stress corrosion is considered inconsequential since the chloride and fluoride concentrations are low (less than.02 ppm) and the time duration is'mall.

Inspections of the pressurizer have not revealed any signs of corrosion or oxidation.

By using this method in Unit 1 (the B&W design),

nitrogen gas is not used, as recommended by B8W, thereby eliminating the large volume of waste gas to be processed.

Both B8W and CE concurred in this filling,and venting; method of operation.

Arkansas performed the engineering analyses and a working demon-stration that solid plant operation during filling and venting is not neces-sary and can be avoided.

In a meeting with Mestinghouse representatives, they indicated that the tech-nical'asis for recommending that their plant operate water solid was to ensure that the RCS chemistry was within the prescribed limits.

In order to meet the oxygen limits of.0. 1 ppm before heating the RCS above 180'F", the Mestinghouse chemistry representative.

believed it necessary to vent all free oxygen from

• The temperature limit was reduced by Mestinghouse from 250 F to 180'F based on data showing that stress corrosion cracking would not occur for about a

year with continuous excess oxygen and choride concentration of about 10 ppm.

In other words, the temperature reduction was extremely conservative and oxygen can be effectively scavenged wi.th hydrazine at this temperature to achieve the oxygen limit..

33

'I the RCS in order 'for the dissolved oxygen to be within the limit. Filling the RCS water solid was believed to be the only practical method to vent all free oxygen and meet the chemistry limit since hydrazine was not effective for scavenging oxygen below 200 F.

The Westinghouse recommendations for the chemi,stry limits state that the limits not be exceeded, at any location in the RCS.

This is a more restrictive requirement than the existing technical specification limits or other vendors'equirements which are based on RCS average conditions,

e. g., the technical specifications would permit exceeding the chemistry limits locally provided.ghe-average chemistry limits were met.

Westinghouse was aware of the inconsis-tency, but was not prepared to quantify the safety impli'cations of exceeding the chemistry limits locally for short periods of time.

Although there were differences of opinion concerning the safety implication of exceeding the chemistry limits locally, there was agreement that as long as the chlorides and fluorides were maintained below the limits, excess.

oxygen is.not a concern for

=

stress corrosion.

7.2 Pressurizer Tem erature Differential Limit Turkey Point believed in the necessity of solid plant operation because of the assumed temperature differential limit u'sed in the thermal fatigue analyses of the pressurizer surge line.

The FSAR analyses limits the temperature differ-ence to 200'F between the RCS and pressurizer.

This is not a technical. speci-fication requirement.

The operating procedure for reactor startup requires

.that the temperature differential between the pressu'rizer liquid and the RCS not exceed 190 F.

This limit does not appear to preclude eliminating solid'lant operation.

For

example, the RCS pressure is sl-ightly above atmospheric pressure; the tempera-ture is about 90 F after the reactor vessel head is. replaced and the system is partially filled, but depressurized.

Using, the pressurizer

heaters, a bubble can be established in the pressurizer at this time at saturated conditions of about 260 F -at 21 psig.

The.200 F limit is not exceeded',

a.bubble has been

~

establ i shed in the pressuri zer, and the RCS i s Vented and never water sol id.

,h 34

The system can be vented and heatup begun using the RCPs with reduced risk of a pressure transient because the steam bubble in the pressurizer can control pressure.

In the event that the PORVs actuate to mitigate a pressure

spike, steam rather than subcooled water is relieved by the PORVs a condition for which they are designed.

This analysis shows simply that the thermal-hydraulics support establishing a

,steam bubble in the pressurizer without exceeding the temperature di.fferential limit.

Some operating plants do not have a temperature differential limit on

'he pressurizer surge piping.

The piping has been designed to accommodate the number of anticipated thermal cycles during the life of the plant.

The details of the procedure to accomplish this method of operation must obviously be carefully evaluated consi'dering other operting restraints, e.g.,

chemistry limitations and system response.

~

In summary, eliminating water solid operation provides both safety and economi-cal benefits.

The risk of a pressure transient occurring during low temperature operation is minimized, and the time for plant heatup is reduced.

Although a bubble in the pressurizer cannot compensate for inadvertent safety injections, the time available for operator int'ervention. is increased to mitigate the event.

In addition, the economical penalty.resulting from continued plant shutdown after a pressure.

event can be eliminated.

For example, after the overpressure

-events at Turkey Point, plant startup was delayed for about 30 days.

The time could have been longer if the reactor vessel had to be defueled for inspection.

8. 0 FINDINGS AND CONCLUSIONS The evaluation of the two overpressure events at Turkey Point Unit 4 found that neither event would have occurred if either train of the overpressure mitigat-ing system. had been operable.

The major contributors to the lack of mitigative capability were (1) the lack of a technical specification requiring both trains "Turkey Point has since.determined that there is no technical bases for the 200 F temperature differential limit on the pressurizer surge line.

35

of the OMS to be operabl,e prior to entering low temperature conditions (RCS water soli'd),.and (2) inadequate surveillance procedures to demonstrate opera-bility of the ONS.

This study concludes that operator actions to mitigate the events were timely and correct.

However, the second event could have been pre-vented if the operators and plant management had performed a detailed, system-atic post-event analysis to ascertain the cause for the first event, and had initiated corrective actions.

The evaluation of Florida Power and Light Company remedial actions after the events concludes that actions have been completed to minimize similar causes for overpressure events in the future.

There are still the generic deficiencies in the LTOP technical specifications which need correcting.

Changes were made to.the surveillance and operating procedures to correct deficiencies in admin-istrative procedures and to ensure that a detailed evaluation and understanding of operational events are achieved before continuing plant operations.

No further.NRC actions are considered necessary based on the licensee actions.

The evaluation of the low temperature overpressure technical'pecifications identified numerous improvements which could reduce the potential and increase the mitigating availability for overpressure events.

Inconsistencies were

- identified between existing technical specifications and the NRC staff require-ments resulting, from the resolution of the low temperature overpressure generic issue.

NRR has identified the need to correct deficiencies in the LTOP tech-nical specifications and expedite the review of LTOP requirements for operating plants which lack LTOP technical specifications.

Since only 25K of operating plants had adequate LTOP technical specifications, NRR is preparing a generic letter to li.censees,to correct some of the deficiencies to the technical specifications identified in Section 6.

Operating wi.th the RCS water solid has been recognized for a long, time to be the most susceptible and critical time for overpressure events to occur lead-ing to potentially serious safety consequences.

The recent operating experi-ences discussed in Section 5 confirm that most challenges to the OHS occur when the RCS is water solid during filling and venting.

The evaluation of the need to operate water solid (Section 7) shows that this'ode of operation can 36

be eliminated, and that an alternate method of filling and venting the RCS has been shown to be both practical and prudent at Arkansas Nuclear One.

This study concludes that there are both safety and economical advantages for elimi-nating water solid operation.

The negative aspects of water solid operation include sudden pressure increases due to net mass and heat additions to the RCS which challenge the PORVs or threaten the reactor vessel integrity.

Elimination of water solid operation would reduce challenges to the PORVs and, in particular, minimize the discharge of water through the valves.

The establishment of a steam bubble in the pressurizer can act as a surge volume which can accommodate some RCS volume changes and provide the operators the opportunity to correct the cause for the pressure transient before water is relieved through the PORVs.

The most positive aspect of eliminating water solid operation is that it removes the most vulnerable condition for a low temperature overpressure event in operating PMRs.which would reduce risks of overpressure events in the future.

Me believe that the risk reduction is cost effective since only procedural changes and operator training are necessary.

Based on the Arkansas experience, it appears that the time for heatup after an outage's

reduced, compared to other operating PMRs, which offers an economical incentive to other plants to change their filling and venting procedure.

Although the time advantage could not be quantified, there was no reason to expect the heatup time to be longer without solid plant operation.

In addi-tion, future reductions in the pressure/temperature limits will adversely affect the operating flexibilitywhen other operating constraints are con-

sidered, e.g.,

the pressure margins to PORV setpoint is reduced which will require the operators to be more sensitized to system parameters before start-ing a reactor coolant pump.

AEOD will propose to INPO that it further evaluate the necessity for water solid operation and consider developing a.Recommended Operating Practice for filling and venting which excludes water solid conditions.

AEOD believes that the existing regulatory requirements for overpressure protection systems are adequate to ensure reactor vessel integrity, but improvements in safety and operation can be achieved by eliminating water solid operation.

37

Should INPO's Events Analysis Group agree to pursue this task as part of its

program, we anticipate that the economical benefits will be better defined whi-le developing the bases for the recommended operating, practices.

In addi-tion, our conversations with INPO representatives identified that as part of their evaluation, they.would confirm that there are no adverse consequences, i.e., corrosion or other operating limits which would preclude the elimination of water solid operation and that the recommended procedure would include other provisions, e.g.,

maintaining the normal letdown path open, to minimize the potential for low temperature overpressure events.

Arkansas has indicated their willingness to provide details of their filling and venting procedure and the engineering bases leading to the development of the procedure such that other plants can benefit from their experience.

As the industry representative, INPO was selected to transfer the technology to other operating plants, thereby minimizing the impact on the Arkansas personnel.

9. 0 RECOMMENDATIONS (1)

AEOD recommends that the Office'f Nuclear Reactor Re ulation correct the

.LTOP technical s ecification deficiencies identified in Section 6 of this re ort as art of its on oin efforts to issue and revise LTOP technical s ecifications.

The results of the analysis and evaluation of the Turkey Point overpressuriza-tion events and their implications identified inadequacies in the Turkey Point and the Standard Technical Specifications which should be corrected to minimize the potential and to increase the mitigatory capability for overpressure events.

Operating experience shows that eleven events have occurred since 1982 which challenged the overpressure protection mitigating systems, but only the Turkey Point events exceeded the technical specification pressure/temperature limits.

The installation of mitigating systems has effectively reduced the peak pres-sures occurring during the pressure events.

However, the administrative con-trols have not been as effective in reducing the number of pressure transients during low temperature operations since the number of events per unit per year 38

for the period 1973 to 1978 is about the same:as the period from 1982 to mid-year 1983, but increasing.

This frequency of potential'verpressure events c'oupled with the 37 events reporting inoperable OMS trains or systems. further support the need for addi,tional regulatory actions to strengthen administrative controls and mitigatory capability to reduce the likelihood of overpressure events.

The following areas should be evaluated for the purpose of revising the LTOP technical specifications:

(a)

The acceptability of increasing the pressure setpoint for automatic isola-tion of the decay heat removal system to increase the margin to the PORV opening setpoint.

This will ensure that the PORV will mitigate pressure excursions before the RHRS isolates which exacerbates the pressure tran-'ient, i.e., isolates letdown.

(b)

The requirements in the technical specifications for updating the pressure/

temperature limits based on accumulated radiation exposure should also include a requirement to revise the low pressure PORV setpoint.

(c)

The Action Statement for the overpressure protection systems should be revised to require both trains of the system operable during the low temperature regime.

If a single train is inoperable and no extenuatin'g conditions exist which necessitate immediate depressurization, operations should be suspended until both trains 'are operable.

(d)

The primary/secondary temperature differential limit should be reduced from 50~F to as low as is reasonably achievable before starting a reactor coolant pump.

(e)

The acceptability of disabling the safety injection, system during low temperature operation to prevent overpressure transients should be evaluated.

In addition, the testing of the safety i'njection system during low temperature operation should be eliminated.

Reducing the possibility of safety injection would"also eliminate the need for this cause of overpressure.

events to be included in the design bases for the 39

overpressure protection system.

Otherwise, the Mestinghouse design may require modification.

10.

REFERENCES l.

U.S.,Nuclear Regulatory Commission, Re ort to Con ress on Abnormal Occurrences, NUREG-0090, Vol. 5,. No. 1, dated January-March 1982."

2.

Letter from J.

P. O'Reil,ly, NRC,-to Florida Power and'ight

Company, ATTN:

R.

E. Uhrig,

Subject:

Report Nos.

50-250181-31 and 50-251/81-31-,.

dated February 2, 1982."

3.

Letter from R.

E. Uhrig, Florida Power and Light Company, to J.

P. O'Reilly, NRC,

Subject:

IE Inspection Report 81-31, dated March 4, 1982."

4.

'U.S. Nuclear Regulatory Commission, "Standard Technical Specifications for Westinghouse Pressurized Mater Reactors,"

NUREG-0452, Revision 4, dated Fal l 1981."

5.

Memorandum from R. Hattson to D. Eisenhut, NRC,

Subject:

PWR Low

.Temperature Overpressure Protection,. dated August 10, 1982. ~

6.

U.S.

Nuclear Regulatory Commission, Inspection and Enforcement Information Notice No. 82-17, "Overpressurization of Reactor Coolant System,"

June 11, 1982.~

7..

U.S.

Nuclear Regulatory Commission, Inspection and Enforcement Information Notice No. 82-45, "PMR Low'emperature Overpressure Protection,"

November 19, 1982."

~Available in NRC Public Document

Room, 1717 H Street, NM, Mashington, DC 20555, for inspection and copying for.a fee.

40

Appendix A

Turkey Point Unit 4 LTOP Technical Specifications

3. 15 OVERPRESSURE MITIGATING SYSTEM Establishes operating limitations to assure that the limits of 10 CFR 50, Appendix G, are not exceeded.'o minimize the possibility of an overpressure transient which could exceed the limits of 10 CFR 50, Appendix G.

l.

,At RCS temperature less than or equal to 380 F, valves MOV-"-843 A, MOV-"-843 B, MOV-"-866 A, and MOV-"-866 B shall be closed.

2. If any of the valves in 3. 15. 1 are found to be open while RCS temperature is less than or equal to 380 F, perform at least one of the following within the next 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />s:

a.

b.

d.

block the corresponding flow path to the reactor

vessel, close the valve, or depressurize and vent the RCS through an opening with an area of at least 2.20 square

inches, or verify at least one pressurizer power operated relief valve is maintained open.

3.

At RCS tern erature less than.or e ual to 275 F

two ressurizer ower o crated relief valves shall be o erable at the low set oint ran e.

RCS temperature less than 'or equal to 275 F, perform at least one of the following within

~7 da s:

(1) restore operabil ity of the power operated relief valve, or (2) depressurize and vent the RCS through an opening with an area of at least 2.20 square

inches, or (3) verify at least one pressurizer power operated relief valve is maintained open.

b. If both power operated relief valves are ino erable with RCS temperature less than or equal to 275 F, p'er-form at,least one of the following within the next 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />s:

(1) restore. operability of at least one power operated relief valve,. or (2) depressurize and vent the RCS through an opening with an area of at least 2.20 square

inches, or 42

(3) verify at least one pressurizer power operated relief valve is maintained open.

43

Appendix 8

Standard Technical Specification 3.4. 9.1 -.Pressure/Temperature Limits 44

REACTOR COOLANT SYSTEM 3/4. 4. 9 PRESSURE/TEMPERATURE LIMITS REACTOR COOLANT SYSTEM LIMITING CONDITION FOR OPERATION 3.4.9. 1 The Reactor Coolant System (except the pressurizer) temperature and pressure shall be limited in accordance with the limit lines shown on Figures 3.4-2 and 3.4-3 during heatup, cooldown, criticality, and inservice leak and hydrostatic testing with:

a.

A maximum heatup of (100)~F in any 1-hour period.

b.

A. maximum cooldown of (100)

F in any 1-hour period.

c.

A maximum temperature change of less than or equal to (10)

F in any 1-hour period during -inservice hydrostatic and leak testing operations above the heatup and cooldown limit curves.

APPLICABILITY: At all times.

ACTION:

With any of the above limits. exceeded, restore the temperature and/or pressure to within the limit within 30 minutes; perform-an engineering evaluation ta determine the effects of the out-,of-limit condition on the structural integrity of the Reactor.

Coolant 'System; determine that the Reactor, Coolant System remains acceptable for continued operation or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and reduce the RCS T

and pressure to less than 200~F and 500 psig, avg respectively, within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

SURVEILLANCE RE UIREMENTS 4.4.9. 1. 1 The Reactor Coolant System temperature and pressure shall be deter-mined to be within the limits at least once per 30 minutes during system heatup,

cooldown, and inservice leak and hydrostatic testing operations.

4.4.9. 1.2 The reactor vessel material irradiation surveillance specimens shall be removed and examined, to determine changes in material properties, as, required by 10 CFR 50,. Appendix H in accordance with the schedule in Table 4.4-5.

The results of these examinations shall be used to update Figures 3.4-2 and 3.4-3.

45

Appendix C

t Standard Technical Specifications

3. 4. 9. 3 Overpressure Mitigating Systems

REACTOR COOLANT SYSTEM OVERPRESSURE PROTECTION SYSTEMS LIMITING CONDITION FOR OPERATION 3.4.9.3 At least one of.the following overpressure protection systems shall be'PERABLE:

a.

Two power operated relief valves (PORVs) with a lift setting of less than or equal to (450) psig, or b.

The Reactor Coolant System (RCS) depressurized with an RCS vent of greater than or equal to (

) square inches.

APPLICABILITY:

MODE 4 when the temperature of any RCS cold leg is less than or equal to (275) F, MODE 5 and MODE 6 with the reactor vessel head on.

ACTION:

a.

With one PORV inoperable, restore the inoperable PORV to OPERABLE status within 7 days or depressurize and vent the RCS through a

(

) square inch vent(s) within the next 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

b.

Mith both PORVs inoperable, depressurize and vent the RCS through a

(

) square inch vent(s) within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

C.

In the event. either the PORVs or the RCS vent(s) are used to mitigate an RCS,pressure transient, a Special.Report shall be prepared and submitted to the Commission pursuant to Specification 6.9.2 within 30 days.

The report shall describe the circumstances initiating the.

transi'ent, the effect of the PORVs oi vent(s) on the transient, and any. corrective action necessary

'to prevent recurrence.

d.

The provisions of Specification 3.0.4 are not applicable.

47

REACTOR COOLANT SYSTEM SURVEILLANCE RE UIREMENTS 4.4.9.3. 1 Each PORV shall be demonstrated OPERABLE 'by:

a ~

Performance of a ANALOG CHANNEL OPERATIONAL TEST on the PORV actua-tion channel, but excluding valve operation, within 31 days prior to entering a condition in which the PORV is required OPERABLE and at least once per 31 days thereafter when the PORV is required OPERABLE.

b.

C.

Performance of a CHANNEL CALIBRATION on the PORV actuation channel at least once per 18 months.

Verifying the 'PORV isolation valve is open at least once per 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> when the PORV is being used for overpressure protection.

d.

Testing pursuant to Specification 4.0.5 4.4.9.3.2 The RCS vent(s) shall be verified to be open at least once per 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />s~

when the vent(s),is being used for overpressure protection.

~Except, when the vent pathway is provided with a valve which is locked, sealed, or otherwise secured in the open position, then verify these valves open at least once per 31 days.

48

3/4 LIMITING CONDITIONS FOR OPERATION, AND SURVEILLANCE RE UIREMENTS 3/4. 0 APPLICABILITY 3.0.4 Entry into an OPERATIONAL MODE or other. specified condition shall not be made unless the conditions for the Limiting Condition for Operation are met without reliance on provisions contained in the ACTION requirements.

This 'pro-vision shal.l not prevent passage through or to OPERATIONAL MODES as required to comply with ACTION requirements.

Exceptions to these requirements are stated in the individual Specifications.

Appendix D

Standard Technical Specifications 3.4. 1.4. 1'- Starting a Reactor Coolant 'Pump 50

REACTOR COOLANT SYSTEM COLD SHUTDOWN -

LOOPS FILLED LIMITING CONDITION FOR OPERATION 3.4.1.4.1 At least one residual heat removal (RHR) loop shall be OPERABLE and in operation",

and either:

a.

One additional RHR loop shall be OPERABLE¹, or b.

The secondary side water level of at least two steam generators shall be greater than (17)%.

APPLICABILITY:

MODE 5 with Reactor Coolant loops filled"¹¹ v

ACTION:

,b.

With less than the above required loops OPERABLE or with less than the required steam, generator level,, immediately initiate corrective action to return the required loops to OPERABLE status or to restore the required level as soon as possible.

With no RHR loop in operation, suspend all operations involving a reduction in boron concentration of the Reactor Coolant System and immediately initiate correcti,ve action to return -the required RHR loop to operation.

SURVEILLANCE RE UIREMENTS 4.4.1.'4. 1. 1 The required RHR loop shall be demonstrated OPERABLE pursuant to Specification 4.0.5.

4. 4. 1. 4. l. 2 The secondary side water level of at least two steam generators when required shall.be determined to be. within limits at least once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

4.4. 1.4.1.3 At least one RHR loop shall'be determined to be in operation and circulating reactor coolant at least once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

a

¹ One RHR loop may be inoperable for up to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> for surveillance testing provided the other RHR loop is OPERABLE and i'n operation.

A Reactor Coolant pump shall not be-started with one or. more of the Reactor Coolant System cold leg temperatures less than or equal to. (275)

F unless

1) the pressurizer water volume is less than cubic 1eet or 2) the secondary water temperature of each steam generator is less than oF above each of the Reactor Coolant System cold leg temperatures.

~~The RHR pump may be de-energized for up. to '1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> provided 1) no operations are permitted that would cause dilution of the Reactor Coolant System boron concentration, and 2) core outlet temperature is maintained at least 10 F

below saturation temperature.

51