ML17346A256

Low Temp Overpressure Events at Turkey Point 4

ML17346A256
Person / Time
Site:	Turkey Point
Issue date:	03/31/1984
From:	Lanning W NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
To:
Shared Package
ML17346A255	List: ML17346A254 ML17346A256
References
TASK-AE, TASK-C401 AEOD-C401, NUDOCS 8404050445
Download: ML17346A256 (74)

Text

AEOD/C401 LOW TEMPERATURE OVERPRESSURE EVENTS AT TURKEY POINT UNIT 4 Case Study Report Reactor Operations Analysis Branch Office for Analysis and Evaluation of Operational Data March 1984 Prepared by:

Wayne D. Lanning NOTE:

This report documents results of study completed to date by the Office for Analysis and Evaluation of Operational Data with regard to a particular operational situation.

The findings and recommendations do not necessarily represent the position or requirements of the responsible program office nor the Nuclear Regulatory Commission.

8404050445 84032i PDR ADQCK 0500025i S

PDR

l 5

h "I

EXECUTIVE

SUMMARY

A case study has been completed for two events at Turkey Point Unit 4 where the pressure-temperature limits of the reactor vessel were exceeded.

During the filling and venting process while restarting the reactor after a refueling

outage, two overpressure events occurred within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

The first one ex-ceeded by a factor of two the technical specification limits.

Both trains of the overpressure protection system were inoperable and operator actions were required to mitigate the pressure transients to prevent a more severe pressure excursion.

The generic safety significance of these events is the possibility of the reactor vessel failure by brittle fracture as a consequence of similar overpressure transients during low temperature operation.

The overpressurization transients at Turkey Point were the first events to exceed the technical specification limits at an operating pressurized water reactor (PMR) since the NRC staff resolved the generic issue of low temperature overpressure transients in 1979.

The events were identified to Congress as Abnormal Occurrences, which indicate that the events involved a major reduction in the degree of protection to the public health or safety.

The technical specifications for low temperature overpressure (LTOP) protection were reviewed and generally found to be inadequate to (1) prevent overpressure transients, and (2) ensure redundancy in the overpressure mitigating system during the short time interval that the system may be required to protect the vessel from brittle fracture.

These deficiencies are germane to the existing technical specifications at cooperating PMRs that have low temperature over-pressure protection requirements, and to the Standard Technical Specifications.

Some operating plants do not have LTOP technical specifications.

The post-event analysis by Turkey Point management after the first event was found to be inadequate based on its failure: to identify and correct the root cause for the event; to recognize that the technical specifications pressure temperature limits were exceeded; and to verify that the reactor coolant system remained acceptable for continued operation after the pressure transients were exceeded.

II The AEOD evaluation of solid plant operations (e.g.,

no steam or gas bubble in the pressurizer) concludes that this is an undesirable mode of operation that posed the major risk for overpressure events and that it could be minimized or eliminated during the filling and venting process.

AEOD proposes that the nuclear industry, such as the Institute for Nuclear Power Operations or the PMR Owners Groups, further evaluate the need for water solid operation and consider developing a recommended operating practice for filling and venting PMRs which excludes water solid operation.

AEOD recommends that the Office of Nuclear Reactor Regulation correct the identified deficiencies in the LTOP technical specifications.

1

I

~ J

TABLE OF CONTENTS EXECUTIVE

SUMMARY

~

LIST OF FIGURES LIST OF TABLES 1.

INTRODUCTION 2.

SYSTEM DESCRIPTION..

3.

EVENT DESCRIPTIONS

~

~

~

~

0

~

~

~

~

~

~acae

~

~

~

~

~

~

~

ill 3.1 Conditions Prior to the Events.......

3.2 Overpressure Event on Novembe~ 28, 1981.....

3.3 Overpressure Event on November 29, 1981 4.

EVENT ANALYSES 5.

OPERATING EXPERIENCE 6.

LTOP TECHNICAL SPECIFICATIONS 6.1 Pressure/Temperature Limits 6.2 Qverpressure Protection System....,.......

6.3 Primary/Secondary Temperature Difference 6.4 Maximum Number of Charging'and Safety Injection Pumps 0perable

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

6.5 Summary of Technical Specification Deficiencies.....

7:

REACTOR COOLANT SYSTEM MATER SOLID OPERATION

7. 1 Oxygen Control 7.2 Pressurizer Temperature Differential Limit 8.

FINDINGS AND CONCLUSIONS 9.

RECOMMENDATIONS..

10.

REFERENCES..

~

~

~

~

~

~

~ I

~

8 8

9 10 17 18 20 21 22 23 23 24 27 29 30 APPENDICES Appendix A

Turkey Point Unit 4 LTOP-.Technical Specifications..........

Appendix B

Standard Technical Specification 3.4.9. 1 - Pressure/

Temperature Limits..

~

~

Appendix C

Standard Technical Specifications

2. 4. 9 ~ 3-Overpressure Mitigating Systems.............................

32 35 37

TABLE OF CONTENTS (Continued)

Appendix D

Standard Technical Specification 3.4. 1.4. 1-Starting a Reactor Coolant Pump..

~Pa e

41 Appendix E

Standard Technical Specification 3.5.3-Maximum Number of Charging and Safety Injection Pumps.......

43 LIST OF FIGURES Number Title 1

2 3

Turkey Point Unit 4 Pressure/Temperature Limits Single Train of Overpressure Mitigating System.......

Schematic of Overpressure Mitigating System Logic..........

Letdown Configuration During Low Temperature Operation.....

3 6

7 LIST OF TABLES 1

2 Challenges to the Overpressure Mitigating Systems............

15 Frequency of Reported Pressure Transients in Operating PWRs...

16

l 4

1. 0 INTRODUCTION Before 1979, 30 reported incidents occurred in pressurized water reactors (PMRs) where the pressure/temperature limits contained in the technical specifications

'or the reactor coolant system were exceeded.

Most of these events occurred during reactor startup or shutdown when the reactor coolant system was in a water solid condition, i.e.,

no steam or gas space in the pressurizer.

Over-pressure events primarily resulted from the loss of letdown flow with continued charging flow, inadvertent safety injection, or a heatup transient caused by starting a reactor coolant pump with the secondary coolant system temperature higher than the primary temperature.

These events were caused by either equipment malfunction or operator error.

Low temperature overpressurization (LTOP} was designated a generic issue because of the possibility of a vessel failing by the brittle fracture mechanism.

This failure mode may be a consequence of a pressure transient after the vessel material toughness has been reduced due to irradiation effects (i.e., increase in nil-ductility transition temperature) while a critical size flaw exists in the vessel wall.

NRC resolved the generic issue in 1979* by recommending that PMR licensees implement procedures to reduce the potential for overpressure events and install equipment modifications to mitigate such events.

Since that time, ten pressure transients have been reported.

The two events at Turkey Point Unit 4 on November 28 and 29, 1981 exceeded the technical specification limit (415 psig below 355'F} by about 700 and 325 psi, respec-tively.

The two events were designated Abnormal Occurrences by the NRC (Ref.. 1).

The other eight reported events were mitigated by the overpressure protection system.

These two overpressure events and a significant number of events at

... other PMRs involving inoperable trains of the overpressure protection system prompted AEOD to initiate an evaluation of operational events with the focus primarily on Turkey Point.

The overpressure protection system and the overpressure events at Turkey Point Unit.4 are described in Sections 2 and 3.

Section 4 contains the analyses and evaluation of the two events, including utility management's reaction to the events.

Section 5 reviews the operational experience related to inoperable trains of the overpressure protection system at other PMRs.

Section 6 evaluates the "adequacy of existing LTOP technical specifications.

Section 7 discusses the need for operating in a water solid condition.

Section 8 lists the find-ings and conclusions, and Section 9 contains the AEOD recommendations based on this case study.

"-NUREG-0224 entitled, "Reactor Vessel Pressure Transient Protection for Pres-surized Mater Reactors,"

was published in September 1978 documenting the com-pletion of the generic activity.

LTOP mitigating systems were installed in most plants, beginning in 1979.

2. 0 SYSTEM DESCRIPTION Turkey Point, Unit 4 is a Westinghouse designed three-loop PWR located in Dade County, Florida and.is operated by the Florida Power and Light Company.

The unit received an operating license on April 10, 1973.

The low temperature overpressure protection function is, in general, provided by the power-operated relief valves (PORVs) on the pressurizer and associated PORV actuating ci,rcuitry.

The system is variously referred to as the over-pressure protection system (OPPS),

the low temperature overpressure protection system (LTOPS) or the overpressure mitigating system (OMS).

The latter designa-tion is used at Turkey Point.

The PORV low pressure opening setpoint ensures that the limits of 10 CFR 50, Appendix G, are not exceeded, particularly during water solid operation.

The pressure and temperature instrumentation, which provide the inputs to the circuitry for each PORV, are redundant and are located in the loops of the reactor coolant system (RCS).

The same instrumen-tation is also used to isolate the residual heat removal system (RHRS) from the RCS and to calculate the subcooling margin.

Operability and surveillance requirements for the OMS are contained in the technical specifications for most plants (see Section

6) ~

A single train of the OMS will prevent the pressure from exceeding Appendix G

limits at low temperatures when the transient is limited to either (1) the startup of an idle RCS loop with a solid RCS and a maximum differential tempera-ture (about 50'F) between the primary and secondary coolant systems, or (2) the injection of emergency core cooling system (ECCS) coolant into the primary coolant system from a single safety injection pump" when the RCS is water solid, 8

Operability and performance requirements for the OMS are based on the Appendix G

pressure/temperature limits.

These limits are calculated based on structural analysis methods and include neutron irradiation effects.

Since the limits change as the vessel becomes irradiated, these limits are usually calculated to be conservative for at least five years in the future.

At the end of this time period the pressure-temperature limits are revised and incorporated into the technical specifications.

Figure 1 shows the pressure-,temperature limits for Turkey Point Unit 4.

These limits are used to calculate the PORV setpoint including pressure overshoot considerations, e.g.,

valve stroke time, and mass and heat transfer effects to the RCS.

The OMS at'urkey Point includes two PORVs and separate instrumentation and activating circuitry.

Figure 2 shows a single train schematic of the two train system.

RCS pressure and temperature are inputs into the circuitry.

The pressure is input into a comparator which subtracts the RCS pressure and the computed pressure setpoint which is calculated by the summator based on the RCS temperature.

If the system pressure exceeds the setpoint, the output signal from the comparator causes the actuation relay to energize the PORV solenoid (air or nitrogen is required) which opens the PORV and sounds an alarm indicating that the OMS has activated.

~Th'is criterion may not be part of the Westinghouse design (see Section 6.4).

2400 1800 1600 D

1400 IX 1200 Ol-o+

1000 OZ 800 MATERIALPROPERTY OASIS WELD METALCU=0.30%

INITIALRT~u~=0'F AT 10 EFFECTIVE FULL POWER YEARS RTrru~-AT '/~ THICKNESS = 342'F RTNDT AT 4 THICKNESS 230 F NORMAL RELIEF SET POINT 2336 NORMALOPERATING PRESSURE 2236 I

I I

I I<

I I

)1

~l

)

I I

(I) 600 400 COOLDOWN RATES

'FIHR 0

20 HEAT Et CQQLDOWN REGION I

(

I

(

I OMS LOW PRESSURE REGION 100'60 200 250 350 460 Tevg IN ICATED TEMPERATURE PFI Figure 1

Turkey Point Unit 4 PresaurolTomporoture Llmito

Root isolation Valve PT405 interlock to isolate MOVE-761 at 465 psig TE-423 Temperature Element Comparator PC-405C Summator TM423A PC-405CX Actuation Relay To PORV4466C High Pressure Controls OMS Control Actuated Alarm.

Redundant Train Figure 2 Single Train of Overpressure IVlitlgating System

I

~

I I

'i

In addition 'to the ONS activation alarm, other alarms are available to the operator regarding OMS status and alignment.

RCS pressure (P-402 in Figure 3) and the OMS status circuitry provide two alarms:

OMS, Low Pressure Operation and ONS High Pressure Alert.

The first alarm will'ound if the RCS pressure is below 390 psig and the OMS is not properly aligned for low temperature over-pressure protection.

The "OMS High Pressure Al.ert" alarm activates at a RCS pressure of 400 psig to warn the operator that the RCS pressure is approaching the,OMS setpoint and that action is necessary to correct the cause of the pressure

increase, particularly when water solid.

Ouring normal heatup and RCS pressurization, the alarm reminds the operator to deactivate the ONS after a steam bubble is drawn in the pressurizer.

The operator must, therefore, associate RCS conditions and operations underway in order to correctly respond to the alarm.

The OMS will activate the PORVs and prevent overpressurization only if the OMS is correctly aligned.

The OMS mode selector switch, the PORY mode switch, the PORV stop valve mode selector swit'ch and the valves'ontrol voltage are con-tinously monitored to indicate the status of the ONS.

The PORV mode switch is i,n the "alert" position and the PORV stop valve mode switch is in the "open" position for all modes of operations.

When the RCS temperature is below 355'F (see Figure 1), the operator must change the OMS mode selector switch from the "normal pressure" to the "low pressure" position in order to correctly align the OMS. If any of these switches are mispositioned, or the control voltage for the valves are not correct, the "OMS Low Pressure Operation" alarm will sound.

Since this status circuitry does not include a reflash capability, any time one train is inoperable the alarm will not 'reflash,or sound if the other train is misaligned or becomes inoperable.

Consequently, the operator may not know if the redundant train becomes inoperable.

In order for the status alarms to be useful to the operator, both trains of the ONS must be operable.

In cold shutdown,"

RCS letdown to the chemical and volume control system (CVCS) comes fro'm the RHRS (Figure 4).

Typically, the RHR pumps are taking suction from the hot leg of the

RCS, pumping the coolant through the RHR heat exchangers and returning the coolant to the cold legs of the RCS.

At low pressures, let-down flow is from the RHRS to the CVCS, because the orifices in the normal letdown line in the CVCS limit the flow.

The low pressure letdown piping begins at the discharge of the RHR heat exchangers and connects to the inlet of the CVCS non-regenerative heat exchanger.

A pressure control valve (PCV-4-145) in this piping controls the amount of letdown from the RHRS to the CVCS.

In an RCS water solid condition,.this valve would also control the RCS pressure based on an operator selected value.

One positive displacement charging pump is normally operating, providing makeu'p flow to the RCS and seal injection cooling to the reactor coolant pumps

.(RCPs).

Two isolation valves in the RHRS suction line from the hot leg automatically close at an RCS pressure setpoint (about 465 psig) "to prevent overpressurizing the RHRS should the RCS pressure exceed the design pressure of the RHRS.

Since these are slow closing valves, pressure relief valves ace available to mitigate a pressure excursion in the RHRS.

The opening setpoint for each of the two relief valves is 600 psig.

Since the RHRS is isolated automatically during a pressure excursion, these relief valves are not -intended for mitigating an RCS pressure transient (some plants do use these valves for LTOP protection).

MOV~

PORV4466 MOV~

PORV4465C P

4Q MOV~-760 BHRS MOVW761 Figure 6 Identlfloatlon of Inetnrmentathnal PORVa for the Overpreeaore Mldgatlng Syetem

P'03 405 Cold Lag Hot Leg MOVE.760 M0 V-4.761 Heat Exchangers CVCS Cross. Connect Piping HCV4-142 Normal Letdown Non Regenerative Heat Exchanger PCS-146 Volume Control Tan'k

~ Cold Leg Positive Displacement Pump (One of Threel RCP Seals Figure 4 Letdown Configuration I

I Ourlng Low Temperature Operation

0

The most susceptible RCS condition for pressure transients is when the RCS is water solid.

During this time a small mass addition to the RCS results in significant pressure increases.

A particularly sensitive condition is near the completion of the filling and venting process, when the combined volume of the remaining air is extremely small.

Since the reactor coolant is essentially incompressible, small increases in the reactor coolant volume due to either mass or heat additions compress small air volumes resulting in significant pressure increases.

Pressure increases are modulated by compressing the remaining air and, to a small extent, by elastic stretch of the piping.

Starting an RCP during the latter phases of filling and venting can also lead to a mild pressure transient and challenges to the OMS.

Prior to starting an RCP, the RCS pressure is increased to establish a required differential pressure across the RCP seal to a value near the PORV setpoint.

When the pump -is

started, the pressure increase by the pump head can lead to an increased pressure in the pressurizer, which can reach the PORV setpoint depending on ""

the initial system pressure.

This phenomena is further discussed in the technical specification section of this report.

3. 0 EVENT DESCRIPTIONS 3.1 Conditions Prior to the Events The reactor was shut down in a refueling outage on October 19, 1981 and pre-parations were underway for plant heatup on November 28, 1981.

The RCS had been filled solid with water at a temperature of about llO~F and a pressure of about 340 psig.

The operators were performing OP 0202. 1-Reactor Startup-Cold Condition to Hot Shutdown Conditions, and had progressed to the step for

. starting a reactor coolant pump.

The RHRS and CYCS were in operation at the time (Figure 4).

Both RHRs pumps were operating taking suction from the hot leg through valves 4-750 and 4-751 and discharging to the cold legs through valves 4-744 A and B.

Letdown flow was through valve HCY-4-142 which is in the cross-connect piping between the RHRS and the CVCS.

One train of the OMS was inoperable for maintenance--an important factor during the event.

One block valve (MOV-4-535) was closed while the work was being performed on the pressure controls for PORV (PCY-4-456).

The OMS circuitry was still available to provide the alarms discussed in Sec-tion 2.

The other OMS train was thought to be operable.

3.2 Over ressure Event on November 28 1981 Beginning at 9:20 p.m.

on November 28, 1981, the operators started the "B" RCP to increase RCS temperature.

The pump ran for about 30 minutes.

At 10:15 p.m.,

'he pump was run again for about 45 minutes.

The average RCS temperature increased from about 103 F to ill F.

Mhen the pump was started the third time at about 11:20 p.m., the operator observed that the RCS pressure was increasing above 500 psig.

He manually opened PCV-4-145 in an attempt to control pressure,

'(i.e., increase letdown flow), but then he noticed that the RHR suction valve 4-750 had closed and terminated all letdown flow.

The operator immediately tripped both the RCP and charging pump, deenergized the pressurizer

heaters, and opened PORY-4-455C.

The elapsed time was approximately two minutes for the. pressure to increase from about 310 psig to about 1100 psig.

At about 400 psi,g, an alarm based on P-402 should have alerted the operators of increasing RCS pressure to the OMS setpoi nt.

In addition, the alarm indicati ng OMS actuation from the "inoperable" train (alarm circuitry was available) should have also alerted the operators to increasing RCS pressure above 400 psig.

The operators indicated that neither alarm had functioned.

However, there was no known report concerning malfunction of the OMS high pressure'alert alarm.

Even without acknowledging these

alarms, operator response was quick and effective.

After the event,

however, operator analysis of the event was not thorough and effective, because the root cause of the pressure transient was not determined before the heatup efforts continued.

The event occurred at about ll:20 p.m.,

ten minutes before the end of the third shift.

Actions taken by the operators between ll:20 P.M.

and 12:28 a.m.

were not entered in either the operator's or plant supervisor's log books.

The off-going shift had stabilized RCS condi-tions before the shift change.

After the RCS pressure was reduced, system realignments were made to establish the normal RHRS mode of operation.

,The RHRS isolation valves were reopened and letdown flow through PCV-145 reestab-lished.

The NRC was not notified of the pressure transient.

The operators determined that the root valve to the pressure transmitter (PT-405) had been isolated during a previous hydrostatic test (see Figure 2).

When the RCS pressure exceeded the pressure interlock.(465 psig) for the RHR suction valves (4-750 and 4-751), valve 4-751 did not close.

This failure, together with the failure of the OMS train to function, led to the identification of the closed root valve since PT-405 provides input to both systems.

The closed root valve rendered the. available train of the OMS inoperable.

Conse-quently, both OMS trains (the other train was out of service for maintenance) were inoperable simultaneously and operator action was necessary to mitigate the overpressure transient.

The first event occurred at about the time for shift change.

The oncoming shift operators did not investigate the possible consequences of exceeding the pressure limits by a factor of two.

This is attributable to the off-going operators'ailure to identify that the te'chnical specification had been exceeded.

Although attempts were made to return the inoperable OMS train to service, determined operator efforts to continue plant heatup did not permit maintenance on the train to be completed before a second overpressure transient occurred.

3.3 Over ressure Event on November 29 1981 The operators resumed RCS heatup by starting the "B" RCP at 12:40 a.m.

from a temperature of about 102 F and pressure of 340 psig.

The "B" RHR pump was stopped at about 12:47 a.m.

About 8 minutes later, the alarm sounded indicating that an RHRS isolation valve had closed.

The RCS pressure peaked at about 750 psig before the operator opened PORY-4-455C, stopped the reactor coolant pump and the charging

pump, and deenergized the pressurizer heaters.

In order to re-establish RHRS operation, the RCS pressure had. to be reduced to about 300 psig in order to clear the pressure interlock to open the RHRS isola-tion valve (MOV-4-751).

The pressure instrument (PI-4-405) which provides the pressure input to the MOY-4-751 interlock logic indicated about 120 psi higher than the other two RCS p'ressure instruments (PI-4-402 and 403).

The system 9

pressure was about 340 psig, but PI-4-405 was indicating about 465 psig which corresponds to the RHRS isolation setpoint.

This led the operators to diagnose the cause of the second pressure transient as the inadvertent isolation of the RHRS due to the failure of PI-4-405.

The first plant work order to troubleshoot PI-4-405 and the OMS was initiated at 1:00 a.m.--immediately after the second event.

The technician calibrated PI-4-405 and also found that the summator (TM-4-423A) had failed high, providing an output pressure of about 2335 psig.

The failure of the summator rendered the "operable" OMS train inoperable.

The OMS train was also inoperable due to the presure instrument indicating about 120 psi high.

This value exceeds the allowable uncertainty

(+30 psi) assumed for the technical specifications and in the LTOP calculation for opening and closing setpoints for the PORV.

Although the indicated high value would result in actuation of the OMS at a lower (conservative)

RCS pressure, premature actuation at low pressures when the 'RCP is operating could cause damage to the RCP seals.

Consequently, Turkey Point Unit 4 had been in a water solid condition without over-pressure protection for at least 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and had experienced two overpressure transients.

One OMS train was returned to service at 7:00 a.m.

on November 29, 1981.

The cause of the first overpressure event and possible stress damage from the overpressurization were still unknown.

The operators continued with RCS heatup until the plant manager notified the NRC Regional Office at 3:30 p.m.

The Region requested that operation be suspended until the analyses were made to confirm that no structural damage to the vessel was probable and that there w'ere adequate margins for continued operation.

4. 0 EVENT ANALYSES

'f either OMS train had been operable while the RCS was water solid on Novem-ber 28-29, 1981, neither overpressure transient would have occurr'ed.

The lack of a technical specification requirement or good operating practice requiring both trains of OMS to be operable before entering a water solid condition were direct contributors to both events.

Inadequate surveillance procedures for determining OMS operability were also important factors'.

Prompt and correct operator actions to mitigate the pressure excursions prevented a higher pres-sure peak, which could have challenged the safety valves at 2485 psig.

After"the second event and as a result of NRC Region II intervention, Florida Power and Light Company requested Westinghouse to evaluate the effect of the pressure transients on the structural integrity of the reactor vessel.

The evaluation concluded that neither event affected the fatigue life of the vessel.

A second evaluation was performed by Teledyne Engineering Services which further verified that no structural damage should have occurred to the

" reactor vessel.

Although the technical specifications pressure-temperature limits were exceeded by a factor of two during the first event, the conserva-tisms incorporated into the curves minimize the potential adverse effects of exceeding the limits by this amount.

The pressure-temperature

curves, based

.on Appendix G to 10 CFR Part 50, are not part of the safety limits prescribed in the technical specifications.

The curves provide for safety margins to protect against non-ductile failure and some of these conservatisms include:

(1) a safety factor of 2.0 on the pressure stress intensity factor, (2) the use of the crack arrest toughness instead of'he crack initiation toughness which is a more realistic value, and (3) the assumption of the presence of a quarter 10

thickness flaw instead of. the very small flaws which might be present.

In addition, the technical specification curves are based on 10 effective full power years (EFPY) ot operation rather than the actual time in life of 5.66 EFPY.

The analyses performed by Westinghouse and Teledyne show that the structural integrity was not impaired, even under the assumption of a quarter thickness flaw which is about 2 inches deep.

Westinghouse computed a more realistic but still conservative allowable pressure by relaxing some of the conservatisms previously mentioned;

namely, (1) use of a safety factor of 1.0 on the pressure stress intensity factor, and (2) use of a reference nil-ductility temperature RTNDT. of 175'F based on 5.66 EFPY (RTNDT of 342'F was used to obtain the technical specification limits).

Use of 'these parameters while maintaining all the other Appendix G conservatisms yield an allowable pressure of 1232 psig; therefore, the structural integrity was not impaired by the peak pressure estimated to be 1100 psig.

Based on discussions with the plant staff, the operators may not have recognized that the technical specifications pressure-temperature limits were exceeded.

This may help to explain why the. operators continued with plant heatup without confirming that the structural integrity of the reactor vessel was not impaired.

The technical specification

3. 1.2 requires that the RCS remain acceptable for continued operation after exceeding the pressure-temperature limits.

The analyses necessary to show that the structural integrity of the vessel was not

)eopardized were not initiated until after the second event.

The procedures did not provide any guidance to the operators defining what actions were required to determine that the RCS remained acceptable for continued operation.

The Shift Technical Advisor was not requested to perform any engineering analyses of the RCS integrity.

Neither event prompted the plant manager or the operations staff to determine the effect for the overpressure events before continuing with plant heatup.

The operations staff focused primarily on the reasons that the OMS train failed to operate, which were believed to be corrected before heatup continued.

The instrumentation and control technician was still troubleshooting the cause of the inadvertent isolation of the RHRS after the first event when the second isolation occurred.

Since the RHRS isolation valves were being checked out under operator cognizance, the operator immediately saw the valves close du'ring the second event and was able to respond more quickly than during the first event.

During the investigation of the events, operations personnel indicated that the pressure control valve (PCV-4-145), which controls RCS pressure in a water solid condition, was operating improperly before the events.

The plant records show that the plant work order (PWO) for the pressure control valve was, not initiated until December 3,

1981 -- four days after the first event.

The reasons were not apparent for the operator's delay in submitting the PWO to troubleshoot the erratic behavior of the valve.

This delayed action further suggests that the root cause of the first event was not determined in a timely manner.

As a result of the PWO, the'pressure control valve controller.was found to have a power 'supply failure and the valve positioner was out of calibration.

The combination of these two problems probably accounts for the erratic behavior of the pressure control valve (valve cycling in the automatic mode),

and was the most likely cause for the first event.

The plant procedure for fi 1 1 i ng and venting the reactor cool ant system (OP 1001.1 dated 6/14/80) required only one OMS train to be operable prior to the RCS being water solid and delineated the steps to test and align the OMS.

Although these requirements complied with the technical specifications, they were indirect contributors to the overpressure events.

.Mith only one train of the OMS operable, a single failure precludes automatic overpressure mitigation capability, as exemplified by the Turkey Point events.

The OMS meets the single failure criteria only when both trains are operable.

These events demonstrate that for defense-in-depth

safety, prudent operating practice should require both trains operable during a water solid condition--the only time that the OMS is clearly needed to mitigate an overpressure event.

Avail-ability of both OMS trains prior to operating in a water solid condition is a generic concern and is discussed in Section 6.

Although the OMS was functionally tested prior to the RCS being water solid pursuant to technical specifications and procedures, the test was inadequate because all the OMS components were not included in the test.

The functional test involved the input of a simulated overpressure signal to verify that the PORV opened.

The input signal was applied at a location in the OMS circuitry that bypassed the RCS pressure transmitter and the summator.

After the first

event, the operators found that the instrumentation root valve to the pressure transmitter in the OMS was closed.

After the second

event, the summator was found to have failed.

Hence, the OMS train h'ad two unrelated component 'faults; either one would make the OMS train inoperable.

The failures of both components to perform their intended functions could have been detected by adequate testing.

The NRC Region II (Ref. 2). cited the licensee for inadequate procedures.

The RCS pressure was not recorded during the events.

The peak pressures were observed by the operators, but the peak pressure during the first event was not entered into the log book.

The narrow range RCS pressure (PI-402) is not permanently recorded and is.used by the operators only for control purposes below 1700 psig (the pressurizer pressure is used for plant control above 1700 psig and is recorded by a strip chart).

The lack of pressure data severely limited the capability to analyze the events during this study, particularly the root causes and the peak pressures experienced.

The only relevant trend

'ata available were the RCS and the RHRS temperatures.

The underlying cause for the first pressure excursion occurring when the RCP was started the third time could not be determined with certainty.

Considera-tion was given to the possibility of a heatup transient causing the pressure excursion.

For a heatup transient to occur when the RCP was started, the secondary coolant system temperature had to be sufficiently higher than the primary system such that the primary coolant temperature increased as it passed through the steam generator.

But since the RCP had already been operated for two intervals for about 75 minutes prior to the event, this scenario is not likely.

The licensee analyzed the RHRS temperature recorder traces to show that the initial pressure excursion was not caused by a thermal transient, e.g.,

heat input into the RCS from the steam generators.

The probable cause of the first event was the closure of the letdown control valve PCV-145.

After the second event the operators initiated a plant work order (PMO) dated November 29, 1981, indicating the automatic controller was 12

~

~

I l

going open and closed when in automatic control.

The hand-auto controller was replaced on November 30, 1981.

On December 3, 1981, another PRO requested all PCV-145 loop components to be checked.

On December 5, 1981, the bench test of the controller revealed a faulty power supply which was repaired and the letdown control valve performed acceptably.

4 The most probable cause of the second event was the.inadvertent, premature isolation of the RHRS due to pressure transmitter PI-4-405 indicating about 120 psi higher than the actual RCS pressure.

As a result of the overpressure events and in response to the IE Notice of Violation (Ref. 2), Florida Power and Light Company (Ref.

3) made changes in the following operating procedures:

Operating Procedure 100. 1, "Filling and Venting the Reactor Coolant System,"

has been changed to include verification that instrument root valves are correctly aligned... The procedure was updated to include testing of both OMS trains at two different steps in the procedure, and

~ the addition of transmitter and summator checks to the tests.

(2)

Operating Procedure 1004.4, "Overpressurq Mitigating System Functional Test of Nitrogen Back-up System,"

was changed to include checks on applicable pressure transmitters, summator output, and recording of actual test data.

(3)

Operating Procedure 0205.2, "Reactor Shutdown, Hot,Shutdown to Cold Shutdown Conditions,"

was revised to include additional checks on OMS summators.

(4)

Operating Procedure 0202. 1, "Reactor Startup, Cold Conditions to Hot Shutdo'wn Conditions,"

was changed to include root valve alignment checks on instruments affecting alarm functions, automatic action, and transient

- control.

Changes were also made to ensure that the, steam generators are not hotter than the RCS when an RCP is started.

A temperature check of the metal temperature of the steam generator using a hand-held pyrometer is now required.

Turkey Point initiated additional efforts to evaluate other precautions and possible modifications to prevent LTOP events.

These studies included:

(1)

Redesigning the OMS to reduce the number and the possibility of component fai lures.

(2)

Improved RCS pressure instrumentation and indication in the low RCS pressure range.

(3)

Performing a thermal fatigue analysis of the pressurizer surge line to evaluate the necessity'or the 200'F temperature differential between the RCS and pressurizer liquid.

A reduction in this limit would permit a late collapse and early formation of the pressurizer

bubble, or possible elimina-tion of water solid op'eration.

(4)

Maintaining the normal letdown line open during low temperature operation and utilizing the CVCS relief valve if required.

13

(5)

Adding an automatic high pressure trip to the CVCS charging pump, thereby eliminating a major contributor to pressure excursions during low temperature operation.

These studies are ongoing and the results are not available for this report.

This study evaluated methods in Section 6 to minimize challenges to the

OMS, which includes some of the areas being considered by Turkey Point.

A significant and prudent change was made to administrative procedures that now includes notifying the technical department, in addition to the plant manager, when operational occurrences happen.

This will ensure that the events are sub-ject to a technical evaluation and a proper understanding before plant operation continues, and that operating experience will be fed back to plant staff. This practice is exemplary of good safety management and should be a part of standard operating procedures at all plants.

In summary, the pressure excursions were caused by an inadvertent loss of let-down with continued charging flow while the RCS was water solid.

Both trains of the OMS were inoperable.

Operator actions were required to mitigate the pressure transients, and prompt response prevented a more serious threat to reactor vessel integrity.

The second event could have been prevented, provided the plant staff had performed an adequate test of the OMS tr ain to verify that it was operable after opening the root valve to the pressure transmitter'.

Neither event would have occurred if the OMS had been operable.

One train was inoperable for maintenance and the second train experienced two independent undetected failures which were not identified due to an inadequate surveillance procedure.

The actions taken or that are underway by Florida Power and Light Company properly reflect the lessons learned from the events.

The analyses of the Turkey Point overpressure events reveal that although the technical specifications pressure limits were exceeded, the structural integrity of the vessel was not damaged.

5.0 OPERATING EXPERIENCE Prior to the Turkey Point events,,

AEOD had been trending events involving failures or inoperable trains of OMS.

Since 1979 (approximately the time that overpressure protection systems were installed),

numerous events had occurred where either one or both trains of the system were inoperable.

The Turkey Point events were the only events involving a pressure transient with both trains of the OMS inoperable, which led to exceeding the technical specifi-cation limits. The significance of the events were communicated to other operating plants in two IE Information Notices (Refs.

6 and 7) and by the Nuclear Safety Analysis Center (Ref. 8).

Ten events (excluding the two events at Turkey Point Unit 4) were reported which challenged and were mitigated by the OMS.

Table 1 lists the events and identifies the causes for the pressure transients.

Six of the eight events resulted from excessive makeup flow to the RCS either from the safety injection or charging pumps.

This was also the predominant cause for overpressure events before the LTOP generic issue was resolved in 1978.

The two events at North Anna Unit 2 involved thermal transients resulting either (1) after the RCS loop isolation valve was opened after the reactor coolant pump had been running, or (2).after an RCP was started with the secondary side 35'F higher than the RCS.

14

Table 1

Challenges to the Overpressure Mitigating Systems Plant 1.

North Anna-1 2.

Surry 1 3.

San Onofre 4.

Palisades 5.

North Anna-2 6.

North Anna-2 7.

Ginna 8.

North Anna-1 9.

Salem-2 LER Event Date)81-018 (3/29/81)81-018 (7/02/82)

Sp.

Rpt (5/7/82) 82-04 (12/4/82)82-024 (5/18/82)82-024 (5/24/82)

Sp.

Rpt (6/9/83)83-033(5/23/83)83-029 (6/17/83)

Descri tion Inadvertent safety injection with system solid.

Both PORVs opened.

Inadvertent charging flow with system solid.

One PORV opened.

Inadvertent letdown decreased with increased charging flow with system solid.

Relief valve in SDCS lifted.

Inadvertent safety injection while water solid.

PORV opened Started RCP after opening RCS loop isolation valve with system solid.

PORV opened twice.

Started RCP during filling and venting RCS with system solid.

PORY opened twice.

Personnel error during safety injec-tion train test.

Charging pump was not tripped.

PORV actuated.

Inadequate calibration procedures resulted in inadvertent safety injection.

PORV opened three times.

Personnel error during safety injec-tion train test actuated safety injection while water solid.

Both PORVs actuated.

10.

Calvert Cliffs-1 83-019 (4/26/83)

Operator error increased RCS pres-sure above PORY setpoint.

Block valve was closed because valve operation believed spurious.

Second train mode inoperable by techni-cians.

No LTOP protection for about 17 minutes.

I I

I

The first North Anna event was a pressure increase due to a thermal transient after the loop isolation valve was opened and the water heated by the operating RCP was mixed with and expanded the col'der RCS as it flowed through the hot piping of the isolated loop.

The RCS volume increase caused the pressure to increase from 364 psig to the PORV setpoint of 385 psig.

Prior to the event, the isolated loop temperature was 190 F and the remainder of the RCS was at a temperature of 104'F.

The second North Anna event

=is believed to have resulted from starting the RCP when the secondary temperature was about 35'F higher than the RCS.

The thermal expansion of the RCS due to the energy addition from the steam generators, together with the RCS pressure increase due to the pump start, resulted in a pressure increase of about 35 psi within minutes, which activated the PORV.

Depending on the initial system pressure when the reactor coolant pump is started, it appears that 35'F differential temperature between the RCS and secondary coolant system is too large to prevent challenge to the OMS.

The technical specifications permit a 50 F differential temperature.

The adequacy of this and other technical specification requirements are discussed in the next section.

Table 2 shows the frequency of reported pressure transients in operating PMRs before and after the resolution of the low temperature overpressure generic issue.

The data show that the frequency of pressure transients for the three years before and after 1979-80 is about the

same, but the trend has increased since 1982.

If the present rate of pressure transients continues for the remainder of 1983, the frequency will exceed the level reported prior to the identification of the safety concerns associated with l,ow temperature Table 2

Frequency of Reported Pressure Transients in Operating'PMRs Year Number of Events Number of PMRs Licensed Average No. Events Per Unit/Year

'973 1974 1975 1976 1977 1978 23 30 32 37 40 41

. 217

.267

. 125

. 216

.025

.049 1979-80 Resolution and implementation of Generic Issue 1981 1

1982 5

1983(June) 6 48 51 51

.021

.098

.235 NOTE:

The data for the years 1973-78 are extracted from NUREG-0224.

16

I

overpressure events.

The significant difference is, however, that the magni-tudes of the peak pressures are significantly less, except for the Turkey Point events.

The data suggest that the implemented administrative controls have not effectively prevented pressure transients, but that the overpressure protection systems have effectively mitigated them.

Since 1980, 37 events were reported in which at least one train of the OMS was inoperable.

Twelve of the LERs reported both trains inoperable.

An Informa-tion Notice (Ref.

7) was issued informing licensees of operational events in-volving degraded or inoperable OMS.

These events indicate that during the time the OMS may be required to operate, the system did not meet the single failure criteria or that no overpressure protection was available.

Salem Units j. and 2, North Anna Units 1 and 2, and Surry 1 have reported recurring events in-volving both single failures and complete OMS system failures.

The eleven events involving complete loss of the OMS are more significant, although there were no pressure transients during the time the system was inoperable.

The system failures at Salem were primarily caused by leaking pressurizer

PORVs, which were isolated.

At North Anna, recurring problems with leaks in the nit-rogen supply system, which is required to operate the

PORVs, have resulted in numerous LERs and a pending design change to the nitrogen system.

.Personnel error leading to the pressure instrumentation inoperability for the OMS resulted in both trains of the OMS being inoperable at Surry.

In almost every event, a single train of the OMS was inoperable or out of service before the second channel failed.

In addition, the low temperature condition involving water solid conditions was entered when a channel of the OMS was inoperable.

Consequently, in the event of a pressure transient and a single failure of the operable train, the event would have required operator action to mitigate the event.

In general, the time available is not sufficient to prevent exceeding the pressure limits set by the technical specifications when water solid.'he technical specifications permit entering the low temperature and pressure region with one train of the OMS inoperable and even require entering a water solid condition in order to depressurize to vent the RCS when both trains are inoperable.

A change to the operability requirements for the OMS when entering this vulnerable mode could reduce the risk of an overpressure event.

This is further discussed in the next section.

6. 0 LTOP TECHNICAL SPECIFICATIONS The technical specifications (Appendix A) at Turkey Point for LTOP protection are non-standard technical specifications, but representative of the require-ments resulting from resolution of the LTOP generic issue.

A review of the Turkey Point and other technical specifications was prompted by the lack of a requirement to have both OMS trains operable before operating in a low tempera-ture condition a contributor to the lack of mitigation capability during the Turkey Point events.

For the purposes of this study and as a result of the variability found during the review of the LTOP technical specifications, the Westinghouse Standard Technical Specifications (Ref. 4) were used as the standard for evaluating the adequacy of LTOP technical specifications.

17

I

)

The standard technical specifications governing reactor operation to prevent overpressurization which could cause brittle fracture of the reactor vessel during low temperature operation include the following:

(1)

Reactor Coolant System 3.4.9.1 Appendix G pressure/temperature limits.

(2)

Reactor Coolant System 3.4.9.3 - Overpressure protection systems.

(3)

Reactor Coolant System 3.4. 1.4. 1 Starting a reactor coolant pump (primary/secondary temperature difference).

(4)

Emergency Core Cooling Systems 3.5.3 - Maximum number of charging and safety injection pumps operable.

The objectives of these technical specifications are to minimize the potential for a pressure transient during low temperature operation and ensure that miti-gation capability exists to prevent exceeding the pressure/temperature limits should a pressure transient occur.

Those plants which have overpressure protection, technical specifications (some do not),

and which do not have standard technical specifications, have require-ments similar to the standard technical specifications.

After the Turkey Point events, the Division of Systems Integration (NRR) sur-veyed all operating PWR LTOP technical specifications for adequacy and com-pleteness with respect to the original LTOP safety evaluations (Ref. 5).

The survey found that only about 25%%u'f the operating PWRs, which should have LTOP technical specifications, had adequate technical specifications.

In addition, there were nine operating PWRs for which the staff had not reviewed and approved LTOP systems and the corresponding technical specifications.

Reference 5

indicates that staff actions would be initiated to correct the technical specifications deficiencies and to complete the technical review for the nine plants.

This study also reviews the adequacy of the LTOP technical specifications.

This section discusses the results of the evaluation which focus on existing requirements to prevent and mitigate overpressure

events, considering the Turkey Point and other events which led to challenges to the OMS systems.

6, 1 Pressure/Tem erature Limits The technical specifications pressure/temperature limits (Appendix 8) and the pressurizer PORV characteristics determine the PORV opening setpoint.

Instru-mentation errors for pressure and temperature are included in the technical specification limits.

After the PORV opening and closing setpoints are calcu-lated they are compared to the required differential pressure for the reactor coolant pump seal requirements to ensure that the PORV opening does not adversely affect the seal.

The pressure margin available before reaching the PORV setpoint was evaluated to determine if this margin could be increased consid-ering all operating constraints.

Operating experience shows that most of the low temperature PORV challenges result during water solid conditions from either RCP startup, letdown flow isolation, or inadvertent safety injection.

For most 18

of the events, the initial RCS pressure was less than 50 psi below the PORV setpoint.

This prompted an evaluation to ascertain the reasons for the small pressure margin.

Evaluation of the operating limitations for the RCP and the isolation setpoint for the RHRS revealed that the pressure differences between these limitations and the pressure/temperature limits were small.

The margin was further reduced when calculating the PORY setpoint when the response characteristics of the valve were included.

This means that any small pressure perturbations resulting from either starting an RCP or inadvertently isolating the RHRS with continuing charging flow will likely result in challenges to the PORVs.

For example, the Turkey Point procedures for starting an RCP require a system pressure of approx-imately 375 psig to ensure proper delta pressure across the No.

1 pump seal.

Mith the PORV setpoint at 415 psig, the pressure difference of 40 psi is less than the 50 psi pressure increase when the pump is started.

Hence, during the latter phase of filling and venting the RCS when there is but a small volume of air remaining, starting the RCP can result in opening the PORYs.

Lowering the operating pressure for the RCP was not considered feasible by Turkey Point since their experience showed that lower pressures across the seal produced wear and eventual seal damage.

Challenges to the PORVs should be minimized to every extent possible.

During low temperature operation, challenges to the PORVs result in subcooled water passing through the valve - a condition for which the valve was not designed.

As a result the valve may leak, requiring the valve to be isolated during power operation.

In addition, a fai lure of the valve to seat properly during low temperature/pressure operation may result in decreases in the RCS pressure below that required to maintain adequate pressure differential across the RCP

seal, and may result in damage to the seal.

The second situation considered was the pressure difference between the PORV setpoint and the pressure at which the RHR (letdown) is automatically isolated.

Isolation of the RHRS exacerbates the pressure transient since letdown is iso-lated and charging flow continues.

In general the PORY setpoint is below the pressure for isolating the RHRS.

For example, at Turkey Point the RHRS isola-tion pressure is approximately 465 psig or 50 psi higher than the PORV setpoint.

Ideally, the PORY actuation during a pressure excursion should maintain the RCS pressure below the RHRS isolation pressure, thereby preventing automatic isola-tion of the RHRS and letdown during a gradual or small pressure excursion.

Although the PORV setpoint is below the isolation pressure for the RHRS, the stroke time for the PORV, which is included in calculating the setpoint, results in a pressure overshoot above the-setpoint.

For example, the technical specification pressure limit at Turkey Point is 480 psig, and the PORV setpoint is 415 psig.

The difference is due to the expected pressure overshoot because of the valve stroke characteristics.

As the result of the overshoot, the pres-sure interlock at 465 psig isolates the RHRS.

Since the design pressure for the RHRS is about 600 psig, it appears that the RHRS suction valve pressure interlock can be increased to appreciably increase the pressure margin.

This would require that the relief valve in the RHRS have sufficient relieving capa-city to protect the RHRS from overpressurization.

This feature is used in some operating plants.

In addition, the need for the pressure interlock to prevent overpressurizing the RHRS may not be required since the PORYs in the LTOP mode would protect the system as long as the OMS is operable.

19

It does not appear practical to change the pressure/temperature limits or the operating pressure for the RCP in order to achieve an increase of the pressure differential to accommodate RCS pressure changes and yet not challenge the PORVs.

With continuing neutron fluence to the reactor vessel, the PORV setpoint will be decreased with time to further reduce the margin.

This may necessitate a change in the current method of operating in a water solid condition, parti-cularly for Westinghouse and Combustion Engineering designed plants.

The Babcock and Wilcox designed plants do not operate in a water solid condition because a nitrogen cover gas is maintained in the pressurizer during low temperature conditions.

The Arkansas Nuclear One plants are notable excep-tions and do not operate either water solid or use a nitrogen cover gas.

(Their method of operation is discussed in Section

7. )

After considering several options to minimize pressure excursion during low temperature operation, increasing the letdown flow capability appeared to be easily achieved, marginally effective, but beneficial.

This could be achieved by maintaining the normal letdown path to the CVCS and by opening the excess letdown path to the CVCS during the final phases of filling and venting the RCS.

In addition, the relief valve in the CYCS could provide some pressure relieving capability.,

Calculations showed that the relief valve could provide an additional letdown flow equal to about the charging pump capacity.

Maintain-ing the normal letdown path during filling and venting is a recommended prac-tice.

An alternate option is to employ a pressure interlock for the charging valve or charging pump, which would terminate makeup flow when the RCS pressure increased to a predetermined value during solid RCS operation.

This option was dismissed since this feature could adversely affect the safety functions of those components during safety injection.

In conclusion, the only practical method of increasing the pressure margin to the PORV setpoint (which could reduce the challenges to the PORVs) would be to increase or eliminate the pressure interlock for the RHRS.

This feature would have to be evaluated, considering the possible risk of overpressurizing the RHRS and loss of shutdown cooling or residual heat removal capability.

Westinghouse is currently evaluating the risk associated with modifying this pressure interlock design feature.

6.2 Over ressure Protection S stem n

Turkey Point entered a solid RCS operating condition with one train of the OMS inoperable.

This degraded mode of overpressure mitigation capability is per-mitted by both Turkey Point procedures and the standard technical specifications.

For other safety-related

systems, the Limiting Condition for Operation must be met without reliance on provisions contained in the Action statements.

The LTOP technical specification explicitly excludes this Applicability technical specification requirement (See Appendix C).

The purpose of exempting the Applicability requirement was to permit depressurization under extenuating circumstances.

However, during heatup, when operations can be suspended to comply with the Limiting Condition for Operation, the Applicability statement should apply.

When entering a solid RCS condition with one train of the OMS inoperable, the system cannot meet the single failure criteria during the small time interval that may be required to mitigate an overpressure transient.

Maintaining two 20

operable trains during solid RCS conditions is consistent with the design basis of the OMS and is certainly a prudent operating practice to ensure a

reliable mitigating system.

As part of ensuring a reliable mitigating capability, the Action Statement with one PORV inoperable requires that the PORV be restored to operable status with-in seven days.

This is an excessive time period since during normal condi-tions, the plant can progress through the low temperature condition during the seven days without restoring PORV operability.

Operating experience shows that most pressure transients occur during the filling and venting process or during heatup of the RCS.

This is also the period of time when the heatup operations can be suspended to permit maintenance on the PORV without affecting the safety of the plant.

In order to reduce the likelihood of a pressure transient when in a degraded condition during heatup, ongoing heatup, cooldown or boron dilution operations should be suspended until both trains of the OMS are operable.

This philosophy is consistent with the Action Statement for an inoperable RHR pump during Mode 5; i.e., immediately return the inoperable loop to operation or with no RHR loop in operation, suspend all operations involving a reduction in boron concentration and immediately initiate corrective action to return the RHR pump to operation.

The Action Statement requires that the plant progress through the low temper-ature regime and water solid conditions in order to depressurize and vent the RCS when both PORVs are inoperable.

This action is nonconservative with respect to providing overpressure protection in the low temperature regime during shutdown operation, unless there are clearly extenuating circumstances requiring depressurization and venting of the RCS.

6.3 Primar /Secondar Tem erature Difference The technical specification (Appendix D) regarding the operability of the RHR pump prohibits starting an RCP pump when the secondary temperature exceeds the primary temperature by 50 F.

This limit assures that the pressure increase resulting from the thermal transient caused by heat transfer from the steam generator when starting the RCP can be relieved by one PORV.

Without suffi-cient letdown during water solid operation to compensate for the increasd RCS volume due to small heat addition to the RCS from the secondary side,.the pressure wi 11 increase and challenge the PORVs.

In practice, the secondary side bulk temperature is not measured precisely.

As a result of the uncertainty in measuring the secondary temperature, and in order to minimize the potential for a thermal transient due to secondary heat

addition, some plants reduce the maximum temperature differential before starting an RCP to a value well below the technical specification limit of 50'F, or require equalizing the temperatures.

This can be accomplished by increasing the RCS temperature by increasing the bypass flow around the RHR heat exchangers.

Many operators, experienced in solid plant operations, reduce the temperature differential to the lowest value possible before starting the RCP.

In addition, some plants measure the steam generator metal temperature locally using a pyrometer to obtain an accurate indication of the secondary temperature.

21

The challenges to the PORVs on May 24, 1982 at North Anna Unit 2 occurred when there was about a 35 F temperature differential.'he filling and venting pro-cedure required that the RCS pressure be between 325 and 375 psig to start the pump.

The RCS pressure was 350 psig and the heat addition from the steam gen-erators increased the RCS pressure to the PORV setpoint of 385 psig.

Changes to the plant procedures wi 11 be made to further reduce the allowable tempera-ture differential before starting the RCP or opening the loop isolation valve.

Reducing the magnitude of the differential temperature may not prevent pressure transients entirely when the RCP is started.

However, the smaller the differ-ential temperature, the smaller the heat transfer to the RCS," resulting in a less severe pressure transient.

6.4 Maximum Number of Char in and Safet In ection Pum s 0 erable In order to minimize the potential for an overpressure transient due to mass addition while water solid, the technical specifications limit the number of operable charging and safety injection pumps.

The Limiting Condition for Operation for ECCSs (see Appendix E) stipulates a maximum of one centrifugal charging pump and one safety injection pump be operable in the low temperature regime.

This number of pumps does not eliminate the potential for inadvertent increased charging flow or safety injection while water solid.

At some plants where a positive displacement pump provides normal makeup, this added mass compounds the pressure transient during an inadvertent safety injection.

The basis for requiring any safety injection pump to be operable during low temper-ature conditions is not clear.

The safety injection train should be in standby.

The small likelihood of a LOCA and the time available to the operators to restore a standby safety injection pump to operation during low temperature conditions appear sufficient to permit the safety injection pump to be in-operable.

In addition, it is not clear that the PORV setpoint calculation includes the charging pump mass addition for the inadvertent safety injection transient.

Informal discussions with Westinghouse representatives revealed that inadvertant safety injection during low temperature operations is not generally included in the design basis for the OMS for some plants since the safety injection system is disabled by administrative controls.

Disabling the safety injection system was included in the staff's resolution of the LTOP generic issue, yet technical specifications permit the system to be operable during low temperature operations.

There were five Licensee Event Reports involving inadvertent safety injection which challenged the OMS.

Most of these events occurred during surveillance testing of the safety injection system while water solid.

Good operating practice should minimize or eliminate activities while water solid that could lead to overpressure events.

Similarly, conflicting technical specification requirements should be eliminated when possible,

e. g., testing of safety injection system'hen water solid.

At Turkey Point the safety injection valves are required to be closed during low temperature operation.

However, if any of the valves are found open, eight hours are allotted to close the valve or otherwise block the flow path.

The basis for such a long time interval for corrective action to minimize the potential for an inadvertent safety injection could not be determined.

22

b

'4

6.5 Summar of Technical S ecification Deficiencies In summary, review of the technical specifications pertaining to LTOP preven-tion and mitigation reveals generic deficiencies which result in ineffective protection against low temperature overpressure events.

These include the following:

(1)

Some operating plants do not presently have LTOP technical specifications.

For those plants which do have LTOP technical specifications, only about 25K were judged adequate.

(2)

Considerable variability and inconsistency exist in the technical specifi-cations among operating plants and between current technical specifica-tions and the staff requirements developed during the resolution of the LTOP generic issue.

(3)

The pressure-temperature limits will be decreased with accumulated neutron exposure to reactor vessels which will require reducing the PORV setpoints.

The requirements for revising the pressure/temperature limits should explicitly require revising the PORV setpoint.

(4)

The maximum temperature differential permitted by the technical specifica-tions between the primary and secondary coolant systems may be too large to prevent pressure transients without operator actions to accommodate the RCS volume increase due to the thermal transient when an RCP is started.

(5)

The standard technical specification permits an operable safety injection pump during low temperature operation.

This provides a potential for a pressure transient due to mass addition in a water solid condition because

,of an inadvertant safety injection,

e. g., during surveillance testing.

Administrative controls are necessary to ensure the safety injection system is disabled in a standby position and not tested during low temperature operation.

(6)

The technical specifications permit operation in a water solid condition with either OMS train inoperable and requires solid plant operation in order to establish the required vent when the OMS is inoperable.

The OMS does not meet single failure criterion when one train is inoperable during the period it may be required to mitigate an LTOP event.

7.0 REACTOR COOLANT SYSTEM WATER SOLID OPERATION The previous section evaluating the LTOP technical specifications shows that the Limiting Conditions for Operation do not preclude pressure transients while in the low-temperature water solid conditions.,

The prudent and effective method to prevent most pressure transients during low temperature operation is to reduce or eliminate water solid operation.

Based on the fact that B8W plants and one CE plant do not operate water solid and have not reported any pressure transients during low temperature operations, the need for Westinghouse and Combustion Engineering plants to operate water solid was evaluated.

This sub-ject was discussed in detail with several operational and training supervisors at operating Westinghouse plants and with representatives of Westinghouse and and Combustion Engineering.

The discussions did not provide any consensus for 23

the reasons that the plant must operate water solid.

Moreover, there had not been any incentive to change current practices and not operate water solid.

Historically, solid plant operation has been the recommended mode at Mestinghouse plants for many years.

The two reasons for water solid operation were identified as:

(1)

Oxygen Control - The time required to vent oxygen from the RCS is believed minimized by filling the RCS water solid.

In addition, vent-ing all the free gases from the primary coolant system is considered necessary to meet the oxygen chemistry limit before heating above 250'F; and (2)

Pressurizer Temperature Differential - The thermal fatigue analysis for the pressurizer surge piping was performed in the Turkey Point FSAR for a temperature differential of 200 F between the RCS and the pressurizer.

This limit minimizes the number of significant thermal cycles to the surge line and pressurizer.

The limitations on RCS chemistry reduce the potential for corrosion of the reactor coolant system pressure boundary.

Haintaining the chemistry limits provides adequate corrosion protection to ensure the structural integrity of the RCS.

At low temperatures, excess oxygen in combination with chlorides and fluorides contributes to stress corrosion and plate out of corrosion products or crud on heat transfer surfaces.

The technical specifications define the oxygen, chloride and fluoride limits for both steady state and transient condi-tions for all modes of operation.

An order of magnitude difference exists in the chemistry limits between steady state and transient conditions.

The Action Statement provides 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to restore the chemistry to its steady state value as long as it does not exceed the transient limit.

Exceeding the transient limit requires cold shutdown within 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

The oxygen limit is not applicable when the RCS average temperature is less than or equal to 250 F.

This is relevant concerning the need for water solid operation during the filling and venting process because existing Mestinghouse guidelines require venting free oxygen from the RCS in order to meet the oxygen limit before establishing a steam bubble in the pres-surizer.

In practice, the oxygen limits may be exceeded for a short time in the pressurizer during heatup, and generally there is no sampling requirement for the liquid contents of the pressurizer at low RCS pressures.

Filling the RCS water solid supposedly expedites the venting of air/oxygen from the system.

Operating personnel could not quantify the time reduction realized during the filling and venting process since none of the Mestinghouse plants use an alternative to water solid operation.

Operating Mestinghouse plants generally minimize the time the plant is water solid for the purposes of mini-mizing an overpressure event.

Typically, the plant is water solid for about 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> which includes 3-4 hours to heat the pressurizer to saturated condi-tions to establish a bubble using the pressurizer heaters.

This compares to about 18-20 hours for Arkansas Nuclear One, Units l(B8M) and 2(CE) to establish a pressurizer bubble at 50 psig.

Therefore, it appears that water solid operations does not provide any time advantage during filling and venting to 24

achieve hot shutdown to justify the risk of an overpressurization event.

The time to establish a bubble using the water solid mode of operation appears to be about 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> longer.

The filling and venting time varies widely among the Westinghouse and other PMRs depending on their perception of the need to purge all free air or gas from the RCS before startup.

Limitations on time between RCP starts and time to vent the system contribute to the time duration when the pressurizer is water solid.

The Westinghouse recommendation is to heat the entire RCS by pump heat until the water chemistry, particularly oxygen, is within specification.

Operators of Westinghouse-designed plants follow the vendor's recommendation and always operate water solid.

This is also true for Combustion Engineering designs except for Arkansas Unit 2.

Consequently, the time advantages or dis-advantages for non-solid operation cannot be precisely determined because the plants have not operated in both modes for comparison.

We would expect that when the industry representive undertakes the task to further evaluate the feasibility of eliminating solid plant operations, the time advantage will be part of the economic consideration.

Recognizing the risk of water solid operation and further acknowledging that the risk, though small, is unnecessary, Arkansas Units, 1 and 2 never operate water solid in low temperature regime during filling and venting.and never have challenged the ONS.

They have developed an innovative, unique filling and venting procedure which precludes water solid operation.

This method of opera-tion also provides a more positive method of pressure control than when water sol id.

The Arkansas filling and venting method ensures (1) strict control of chlorides and fluorides in the RCS and makeup water supplies, (2) at least a 40 psi hydro-gen overpressure in the volume control tank, and (3) venting of free gases from the RCS, except the pressurizer, before the bubble is established.

The RCS is filled and vented with the vessel head vent (and the hot leg vents in the B8W design) open and the pressurizer vent closed with an air volume in the pressurizer.

The pressurizer heaters are then energized to establish a bubble in the pressurizer.

Level is controlled by venting the gas.

RCS pressure is maintained at about 50 psig by venting the pressurizer which also vents air and noncondensibles from the pressurizer.

After the steam bubble is established, the RCS pressure and temperature are increased to permit RCP operation by controlling RCS inventory and the RHRS.

The RHRS pumps continue to operate adding pump heat to the RCS and to circulate the reactor coolant to maintain a uniform temperature.

The RHRS heat exchangers are bypassed to promote RCS heatup by decay heat and pump heat.

At this time, the RCS pressure is about 225 psig and the temperature is about 150 F.

The pressurizer temperature is about 390'F and most of the air has been vented from the pressurizer.

A RCP is started to sweep air from the high points which is vented from the RCS.

The RCPs are then run continuously to uniformly heat the RCS to operating conditions.

The combination of the hydrogen overpressure in the volume control tank and the gamma radiation act to radiolytically recombine the dissolved oxygen to satisfy the chemistry limit.

25

Hydrazine is not normally required to scavenge oxygen from the RCS; only for extended outages (6 months) has Arkansas needed to add hydrazine to the RCS.

Chemistry samples are taken from either the RHR loop or the CVCS during the filling and venting operation.

The pressurizer liquid is sampled for boron

analysis, but a chemical analysis for oxygen could also be performed.

The estimated time that the pressurizer temperature is above 250 F (the technical specification limit) with free oxygen in the steam space is about an hour.

Although the oxygen limit may be exceeded in the pressurizer, the 'potential for stress corrosion is considered inconsequential since the chloride and fluoride concentrations are maintained low (less than.02 ppm) and the time duration is small.

Inspections of the pressurizers at Arkansas Units 1 and 2

have not revealed any signs of corrosion or oxidation.

By using this method in Unit 1 (the B8W design),

nitrogen gas is not used, as recommended by BLW, thereby eliminating the large volume of waste gas to be processed.

Both B8W and CE concurred in this filling and venting method of operation.

Arkansas performed the engineering analyses and a working demon-stration that solid plant operation during filling and venting is not neces-sary and can be avoided.

In a meeting with Westinghouse representatives, they indicated that the tech-nical basis for recommending that their plant operate water solid was to ensure that the RCS chemistry was within the prescribed limits.

In order to meet the oxygen limits of 0. 1 ppm before heating the RCS above 180'F", the Westinghouse chemistry representative believed it necessary to vent all free oxygen from the RCS in order for the dissolved oxygen to be within the limit without sign-ificant quantities of hydrazine added to the RCS.

Filling the RCS water solid was believed to be the only practical method to vent all free oxygen and meet

'the chemistry limit since hydrazine was not effective for scavenging oxygen above 200'F.

The Mestinghouse recommendations for the chemistry limits state that the oxygen and chloride limits not be exceeded at any location in the RCS.

This is a more restrictive requirement than the existing technical specification limits or other vendors'equirements which are based on RCS average conditions, e.g.,

the technical specifications would permit exceeding the chemistry limits locally provided the average chemistry limits were met.

Mestinghouse was aware of the inconsistency, but was not prepared to quantify the safety implications of exceeding the chemistry limits locally for short periods of time.

Although there were differences of opinion concerning the safety implication of exceeding the chemistry limits locally, there was agreement that as long as the chlorides and fluorides were maintained below the limits, excess oxygen is not a concern for stress corrosion for the low temperatures and small time intervals being considered.

~The temperature limit was reduced by Westinghouse from 250'F to 180 F based on data showing that stress corrosion cracking would not occur for about a

year with continuous excess oxygen and choride concentration of about 10 ppm.

This temperature reduction was extremely conservative and oxygen can be effectively scavenged with hydrazine at this temperature to achieve the oxygen limit.

26

7.2 Pressurizer Tem erature Differential Limit Turkey Point believed in the necessity of solid plant operation because of the assumed temperature differential limit used in the thermal fatigue analyses of the pressurizer surge line.

The FSAR analyses limits the temperature differ-ence to 200~F between the RCS and pressurizer.

This is not a technical speci-fication requirement.

The operating procedure for reactor startup requires that the temperature differential between the pressurizer liquid and the RCS not exceed 190'F.

Westinghouse has recently informed Turkey Point that they have no basis for the 200'F differential temperature.

Westinghouse,

however, recommends that delib-erate spr ay or surge operations not be performed with differential temperatures in excess of 3.00~F since repeated stress cycles are undesirable.

(Note that the pressurizer may be at temperatures greater than the RCS temperature plus 100'F under some plant conditions but deliberate operator initiated transients should be avoided.

Inadvertent surges to the pressurizer during heatup has not occurred at Arkansas during heatup.)

The differential temperature limitations for the pressurizer surge line must be resolved by each plant as part of their procedure to eliminate solid water operations.

However, Turkey Point is the only known plant to have had a limit on pressurizer surge line differential temperature.

For Westinghouse RCPs the minimum operational pressure limit is 375 psig.

This corresponds to saturation temperature of 437~F in the pressurizer after the bubble is established.

The reactor coolant temperature is about 140'F at this time.

This results in about 300~F differential temperature between the pressurizer and the RCS.

It is possible to heat the RCS to reduce the differential temperature to 200'F, but the time using decay heat would be prohibitive. If this or other operational restrictions cannot be resolved, then solid plant or nitrogen bubble startups may still be necessary at Westinghouse plants.

Westinghouse has indicated their willingness to evaluate the feasibility of relaxing the recommended differential temperature limit.

In summary, eliminating water solid operation provides both safety and, possibly, economic benefits.

The severity of a pressure transient occurring during low temperature operation is minimized. Although a bubble in the pressurizer cannot compensate for inadvertent safety injections, the time available for operator intervention is increased to mitigate the event.

The bubble will slow down the transient, but with sustained mass input, the pressurizer will eventually become water solid and the pressure transient will undergo a step pressure change.

In addition, the economic penalty resulting from continued plant shutdown after a pressure event can be eliminated.

For example, after the overpressure events at Turkey Point, plant startup was delayed for about 10 days..

The time could have been longer if the reactor vessel had to be defueled for inspection.

8. 0 FINDINGS AND CONCLUSIONS The evaluation of the two overpressure events at Turkey Point Unit 4 found that neither event would have occurred if either train of the overpressure mitigat-ing system had been operable.

The major contributors to the lack of mitigative 27

.I

capability were (1) the lack of a technical specification requiring both trains of the OMS to be operable prior to entering low temperature conditions (RCS water solid),

and (2) inadequate surveillance procedures to demonstrate opera-bility of the OMS.

This study concludes that operator actions to mitigate the events were timely and correct.

However, the second event could have been pre-vented if the operators and plant management had delayed plant operation until both trains of the OMS were available or had verified that the OMS train was operable after the root valve was opened.

The evaluation of Florida Power and Light Company remedial actions after the events concludes that actions have been completed to minimize similar causes for overpressure events in the future.

There are still the generic deficiencies in the LTOP technical specifications which need correcting.

Changes were made to the surveillance and operating procedures to correct deficiencies in admin-istrative procedures and to ensure that a detail'ed evaluation and understanding of operational events are achieved before continuing plant operations.

No further NRC actions are considered necessary based on the licensee actions.

The evaluation of the low temperature overpressure technical specifications identified numerous improvements which could reduce the potential and increase the mitigating availability for overpressure events.

Inconsistencies were identified between existing technical specifications and the NRC staff require-ments resulting from the resolution of the low temperature overpressure generic issue.

NRR has identified the need to correct deficiencies in the LTOP tech-nical specifications and expedite the review of LTOP requirements for operating plants which lack LTOP technical specifications.

Since only 25Ã.of operating plants had adequate LTOP technical specifications, NRR is preparing a generic letter to licensees to correct some of the deficiencies to the technical specifications identified in Section 6.

Operating with the RCS water solid has been recognized for a long time to be the most susceptible and critical time for overpressure events leading to potentially serious safety consequences.

The recent operating experiences discussed in Section 5 confirm that most challenges to the OMS occur when the RCS is water solid during filling and venting.

The evaluation of the need to operate water solid (Section 7) shows that this mode of operation may be eliminated, and that an alternate method of filling and venting the RCS has been shown to be both practical and prudent at Arkansas Nuclear One.

This study concludes that there are safety and possibly economic advantages for eliminating water solid operation.

The negative aspects of water solid operation include sudden pressure increases due to net mass and heat additions to the RCS which challenge the PORVs or threaten the reactor vessel integrity.

Elimination of water solid operation would reduce challenges to the PORVs and, in particular, minimize the discharge of water through the valves'he establishment of a steam bubble in the pressurizer can act as a surge volume which can accommodate some RCS volume changes and provide the operators the opportunity to correct the cause for the pressure transient before water is relieved through the PORVs.

The most positive aspect of eliminating water solid operation is that it removes the most vulnerable condition for a low temperature overpressure event in operating PMRs which would reduce risks of overpressure events in the future.

28

I

Based on the Arkansas experience, it appears that the time for heatup after an outage is reduced, compared to other operating PMRs, which offers a potential economic incentive to other plants to change their filling and venting procedure.

In addition, future reductions in the pressure/temperature limits wi 11 adversely affect the operating flexibilitywhen other oper ating constraints are consid-ered, e.g.,

the pressure margins to PORY setpoint is reduced which will require the operators to be more sensitized to system parameters before starting a

reacto~ coolant pump.

AEOD proposes that an industry representative or group, such as INPO or the PMR Owners Groups, further evaluate the necessity for water solid operation and consider developing a recommended operating practice for filling and venting which excludes water solid conditions.

AEOD believes that the existing regula-tory requirements for overpressure protection systems are adequate to ensure reactor vessel integrity, but improvements in safety and operation can be achieved by eliminating water solid operation.

Should an industry representative pursue this task, we anticipate that the economic benefits will be better defined while developing the bases for the recommended operating practices.

In addition, they should confirm that there are no adverse consequences, i.e., corrosion or other operating limits which would preclude the elimination of water solid operation and that the recommended procedure would include other provisions, e.g., maintaining the normal letdown path open to minimize the potential for low temperature overpressure

events, and strengthening plant controls and monitoring the contributors to stress corrosion (chloride concentration,

stress, exposure time and corrosion) to ensure that there are no adverse effects in the long term.

Arkansas has indicated their willingness to provide details of their filling and venting procedure and the engineering bases leading to the development of the procedure such that other plants can benefit from their experience.

They are reasonably certain that their engineering analyses have considered all known consequences of eliminating water solid operation.

In the event that the industry evaluation of their method identifies any adverse metallurgical or other concerns associated with their method, they want to understand the concern and make appropriate changes as necessary.

9.0 RECOMMENDATIONS (1)

AEOD recommends that the Office of Nuclear Reactor Re ulation correct the LTOP technical s ecification deficiencies identified in Section 6 of this re ort as art of its on oin efforts to issue and revise LTOP technical The results of the analysis and evaluation of the Turkey Point overpressuriza-tion events and their implications identified inadequacies in the Turkey Point and the Standard Technical Specifications which should be corrected to minimize the potential and to increase the mitigatory capability for overpressure events.

Operating experience shows that eleven events have occurred since 1982 which challenged the overpressure protection mitigating systems, but only the Turkey Point events exceeded the technical specification pressure/temperature limits.

The installation of mitigating systems has effectively reduced the peak pressures occurring during the pressure events.

However, the administrative 29

controls have not been as effective in reducing the number of pressure trans-ients during low temperature operations since the number of events per unit per year for the period 1973 to 1978 is about the same as the period from 1982 to mid-year 1983.

This frequency of potential overpressure events coupled with the 37 events reporting inoperable OMS trains or systems further support the need for additional regulatory actions to strengthen administrative controls and mitigatory capability to reduce the likelihood of overpressure events.

The following areas should be evaluated for the purpose of revising the LTOP technical specifications:

(a)

The acceptability of increasing the pressure setpoint for automatic isola-tion of the decay heat removal system to increase the margin above the PORV opening setpoint.

This will ensure that the PORV will mitigate pres-sure excursions before the RHRS isolates which exacerbates the pressure transient, i.e., isolates letdown.

(b)

The requirements in the technical specifications for updating the pressure/

temperature limits based on accumulated radiation exposure should also include a requirement to revise the low pressure PORV setpoint.

(c)

The Action Statement for the overpressure protection systems should be revised to require both trains of the system operable when water solid or when entering water solid conditions.

If a single train is inoperable and no extenuating conditions exist which necessitate continued operations,

heatup, cooldown or boron dilution operations should be suspended until both trains are operable.

(d)

The primary/secondary temperature differential limit should be reduced from 50'F to a value which minimizes the potential for a thermal transient before starting a reactor coolant pump.

(e)

The acceptability of disabling the safety injection system during low tem-perature operation to prevent overpressure transients should be evaluated.

In addition, the testing of the safety injection system or other surveil-lance testing during low temperature operation that can cause the LTOP.

system to be challenged should be eliminated.

Reducing the possibility of safety injection would also eliminate the need for this cause of over-pressure events to be included in the design bases for the overpressure protection system.

Otherwise, the Westinghouse design may require modification.

10.

REFERENCES 1.

U.S. Nuclear Regulatory Commission, Re ort to Can ress on Abnormal Occurrences, NUREG-0090, Vol. 5, No. 1, dated January-March 1982.

2.

Letter from J.

P. O'Reilly, NRC, to Florida Power and Light Company, ATTN:

R, E. Uhrig,

Subject:

Report Nos.

50-250181-31 and 50-251/81-31,>>

dated February 2, 1982. "

~Available in NRC Public Document

Room, 1717 H Street, NN, Naehington, DC 20555, for inspection and copying for a fee.

30

3.

Letter from R.

E. Uhrig, Florida Power and Light Company, to J.

P. O'Reilly, NRC,

Subject:

IE Inspection Report 81-31, dated March 4, 1982.*

4.

U.S.

Nuclear Regulatory Commission, "Standard Technical Specifications for Westinghouse Pressurized Mater Reactors,"

NUREG-0452, Revision 4, dated Fal l 1981."

5.

Memorandum from R. Mattson to D. Ei senhut, NRC,

Subject:

PWR Low Temperature Overpressure Protection, dated August 10, 1982."

6.

U.S. Nuclear Regulatory Commission, Inspection and Enforcement Information Notice No. 82-17, "Overpressurization of Reactor Coolant System,"

June ll, 1982.*

7.

U.S.

Nuclear Regulatory Commission, Inspection and Enforcement Information Notice No. 82-45, "PMR Low Temperature Overpressure Protection,"

November 19, 1982.*

8.

Nuclear Safety Analysis Center, "Residual Heat Removal Experience Review and Safety Analysis for Pressurized Mater Reactors,"

NSAC-52, dated January 1983.

~Available in NRC Public Document

Room, 1717 H Street, NW, Mashington, DC 20555, for inspection and copying for a fee.

31

Appendix A Turkey Point Unit 4 LTOP 'Technical Specifications 32

3.15 OYERPRESSURE MITIGATING SYSTEM E

i h

10 CFR 50, Appendix G, are not exceeded.

To minimize the possibility of an overpressure transient which could exceed the limits of 10 CFR 50, Appendix G.

At RCS temperature less than or equal to 380~F and with RCS pressure boundary integrity,,valves MOV-"-

843A, MOY-~-8438 and MOV-~-869 shall be closed and their breakers racked out.

2.

If any of the valves listed in 3. 15.1 are found to be open when required to be closed by 3. 15.1, perform at least one of the 'following within the next 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />s:

a ~

b.

C.

block the corresponding flow path to the reactor

vessel, close the valve, or depressurize and vent the RCS through an opening with an area of at least 2.20 square

inches, or verify at least one pressurizer power operated relief valve is maintained open.

3.

At RCS temperature less than or equal to 275~F with RCS pressure boundary integrity established, two pressurizer power operated relief valves shall be operable with a.

setpoint of415 psig

+ 15 psi.

a.

If one power operated relief valve required by 3.15.3 is inoperable, perform at least one of the following within

~7 da a:

(1) restore operability of the power operated relief valve, or I

(2) depressurize and vent the RCS through an opening with an area of at least 2.20 square

inches, or (3) verify at least one pressurizer power operated relief valve is maintained open.

If both power operated relief valves required by

3. 15.3 are inoperable, perform at least one of the following within the next 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />s:

(1) restore operability of at least one power operated relief valve, or (2) depressurize and vent the RCS through an opening with an area of at least

2. 20 square

inches, or 33

(3) verify at least one pressurizer power operated relief valve is maintained open.

Amendment Hos.

73 and 79 34

I

~

~

Appendix B

Standard Technica1 Specification 3.4.9.1 - Pressure/Temperature Limits 35

REACTOR COOLANT SYSTEM 3/4.4.9 PRESSURE/TEMPERATURE LIMITS REACTOR COOLANT SYSTEM LIMITING CONDITION fOR OPERATION 3.4.9. 1 The Reactor Coolant System (except the pressurizer) temperature and pressure shall be limited in accordance with the limit lines shown on Figures 3.4-2 and 3.4-3 during heatup, cooldown, criticality, and inservice leak and hydrostatic testing with:

a.

A maximum heatup of (100)

F in any 1-hour period.

b.

A maximum cooldown of (100)'F in any 1-hour period.

c.

A maximum temperature change of less than or equal to (10)'F in any 1-hour period during inservice hydrostatic and leak testing operations above the heatup and cooldown limit curves.

APPLICABILITY: At all times.

ACTION:

With any of the above limits exceeded, restore the temperature and/or pressure to within the limit within 30 minutes; perform an engineering evaluation to determine the effects of the out-of-limit condition on the structural integrity of the Reactor Coolant System; determine that the Reactor Coolant System remains acceptable for continued operation or be in at least HOT STANDBY within the next

. 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and reduce the RCS T and pressure to less than 200'F and 500 psig, avg respectively, within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

SURVEILLANCE RE UIREMENTS 4.4.9. 1. 1 The Reactor Coolant System temperature and pressure shall be deter-mined to be within the limits at least once per 30 minutes during system heatup,

cooldown, and inservice leak and hydrostatic testing operations.

4.4.9. 1.2 The reactor vessel material irradiation surveillance specimens shall be removed and examined, to determine changes in material properties, as required by 10 CFR 50, Appendix H in accordance with the schedule in Table 4.4-5.

The results of these examinations shall be used to update Figures 3.4-2 and 3.4-3.

36

/

Appendix C

Standard Technical Specifications 3.4.9.3 - Overpressure Mitigating Systems 37

REACTOR COOLANT SYSTEM OVERPRESSURE PROTECTION SYSTEMS LIMITING CONDITION FOR OPERATION 3.4.9.3 At least one of the following overpressure protection systems shall be OPERABLE:

a.

b.

Two power operated relief valves (PORVs) with a lift setting of less than or equal to (450) psig, or The Reactor Coolant System (RCS) depressurized with an RCS vent of greater than or equal to (

) square inches.

APPLICABILITY:

MODE 4 when the temperature of any RCS cold leg is less than or equal to (275) F, MODE 5 and MODE 6 with the reactor vessel head on.

ACTION:

a.

With one PORV inoperable, restore the inoperable PORV to OPERABLE status within 7 days or depr essurize and vent the RCS through a

(

) square inch vent(s) within'he next 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

b.

With both PORVs inoperable, depressuri.ze and vent the RCS through a

(

) square inch vent(s) within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

C.

In the event either the PORVs or the RCS vent(s) are used to mitigate an RCS pressure transient, a Special Report shall be prepared and submitted to the Commission pursuant to Specif'ication 6.9.2 within

. 30 days.

The report shall describe the circumstances initiating the transient,,

the effect of the PORVs or vent(s) on the transient, and any corrective action necessary to prevent recurrence.

d.

The provisions of Specificati'on 3.0.4 are not applicable.

38

REACTOR COOLANT SYSTEM SURVEILLANCE RE UIREMENTS 4.4.9.3. 1 Each PORV shall be demonstrated OPERABLE by:

a.

Performance of a ANALOG CHANNEL OPERATIONAL TEST on the PORV actua-tion channel, but excluding valve operation, within 31 days prior to entering a condition in which the PORV is required OPERABLE and at least once per 31 days thereafter when the PORV is required OPERABLE.

b.

Performance of a CHANNEL CALIBRATION on the PORV actuation channel at least once per 18,months.

C.

Verifying the PORV isolation valve is open at least once per 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> when the PORV is. being used for overpressure protection.

Testing pursuant to Specification 4.0.5 4.4.9.3.2 The RCS vent(s) shall be verified to be open at least once per 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />s* when the vent(s) is being used for overpressure protection.

~Except when the vent pathway is provided with a valve which is locked, sealed, or otherwise secured in the open position, then verify these valves open at

'least once per 31 days.

39

3/4 LIMITING CONDITIONS FOR OPERATION AND SURYEILLANCE RE UIREMENTS 3/4. 0 APPLICABILITY 3;0.4 Entry into an OPERATIONAL MODE or other specified condition shall not be made unless the conditions for the Limiting Condition for Operation are met without reliance on provisions contained in the ACTION requirements.

This pro-vision shall not prevent passage through or to OPERATIONAL MODES as required to comply with ACTION requirements.

Exceptions to these requirements are stated in the individual Specifications.

40

Appendix D.

Standard Technical Specifications 3.4. 1.4. 1 Starting a Reactor Coolant Pump 41

~

~

4 C

I

a

~

REACTOR COOLANT SYSTEM COLD SHUTDOWN -

LOOPS FILLED LIMITING CONDITION FOR OPERATION 3.4.1.4.1 At least one residual heat removal (RHR) loop shall be OPERABLE.and in operation~,

and either:

a.

One additional RHR loop shall be OPERABLE¹, or b.

The secondary side water level of at least two steam generators shall be greater than (17)X.

APPLICABILITY:

MODE 5 with Reactor Coolant loops filled¹¹ ACTION:

a.

b.

With less than the above required loops OPERABLE or with less than the required steam generator level, immediately initiate corrective action to return the required loops to OPERABLE status or to restore the required level as soon as possible.

With no RHR loop in operation, suspend all operations involving a reduction in boron concentration of the Reactor Coolant System hnd immediately initiate corrective action to return the required RHR loop to operation.

SURVEILLANCE RE UIREMENTS 4.4. 1.4. 1. 1 The required RHR loop shall be demonstrated OPERABLE pursuant to Specification 4.0.5.

4'.4. 1.4. 1.2 The secondary side water level of at least two steam generators when required shall be determined to be within limits at least once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

4.4. 1.4. 1.3 At least one RHR loop shall be determined to be in operation and circulating reactor coolant at least once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

¹ One RHR loop may be inoperable for up to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> for surveillance testing provided the other RHR loop is OPERABLE and in operation.

A Reactor Coolant pump shall not be started with one or more of the Reactor Coolant System cold leg temperatures less than or equal to (275)~F unless

1) the pressurizer water volume is less than cubic feet or 2) the secondary water temperature of each steam generator is less than F

above each of the Reactor Coolant System cold leg temperatures.

1

~*The RHR pump may be de-energized for up to 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> provided 1) no operations are permitted that would cause dilution of the Reactor Coolant System boron concentration, and 2) core outlet temperature is maintained at least 10'F, below saturation temperature.

~

~

~

)

Appendix E

Standard Technical Specification 3.5.3 Maximum Number of Charging and Safety Injection Pumps 43

~

~

EMERGENCY CORE COOLING SYSTEMS 3II'4.5.3 ECCS SUBSYSTEMS - T

< 350~F avg LI M IT ING CONDITION FOR OPERATION 3.5

~ 3 As a minimum, one ECCS subsystem comprised of the following shall be OPERABLE:

a.

One OPERABLE centrifugal charging pump,¹ b.

One OPERABLE RHR heat exchanger, c.

One OPERABLE RHR pump, and d.

An OPERABLE flow path capable of taking suction from the refueling water storage tank upon being manually realigned and transferring suction to the containment sump during the recirculation phase of operation.

APPLICABILITY:

MODE 4.

ACTION:

a.

With no ECCS subsystem OPERABLE because of the inoperability of either the centrifugal charging pump or the flow path from the refueling water storage tank, restore at least one ECCS subsystem to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> or be in COLD SHUTDOWN within the next 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />.

b.

With no ECCS subsystem OPERABLE because of the inoperability of either the residual heat removal heat exchanger or RHR pump, restore at least one ECCS subsystem to OPERABLE status or maintain the Reac-tor Coolant System T

less than 350 F by use of alternate heat removal methods.

In the event the ECCS is actuated and injects water into the Reactor Coolant System, a Special Report shall be, prepared and submitted to the Commission pursuant to Specification 6.9.2 within 90 d'ays describ-ing the circumstances of the actuation and the total accumulated actuation cycles to date.

The current value of the usage factor for each affected Safety Injection nozzle shall be provided in this Special Report whenever its value exceeds 0.70.

¹ A maximum of one centrifugal charging pump and one Safety Injection pump shall be OPERABLE whenever'the temperature of one or more of the RCS cold legs is less than or equal to (275)'F.

l

~

1

%J V

~

EMERGENCY CORE COOLING SYSTEMS SURVEILLANCE RE UIREMENTS 4.5.3.1 The ECCS subsystem shall be demonstrated OPERABLE per the applicable requirements of Specification 4.5.2.

4.5.3.2 All charging pumps and Safety Injection pumps, except the above required OPERABLE pumps, shall be demonstrated inoperable by verifying that the motor circuit breakers are secured in the open position at least once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> whenever the temperature of one or more of the RCS cold legs is less

'han or equal to (275)

F.

fx