ML19207B694
| ML19207B694 | |
| Person / Time | |
|---|---|
| Site: | Millstone  |
| Issue date: | 08/07/1979 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML19207B691 | List: |
| References | |
| NUDOCS 7909050096 | |
| Download: ML19207B694 (13) | |
Text
.
SAFETY EVALUATION OF LICENSEE'S RESPONSES TO IE BULLETIN 79-08 NORTHE.;ST NUCLEAR ENERGY COMPANY MILLSTONE UUCLEAR POWER STATION, UNIT NO. 1 DOCKET NO. 50-245 Date: August 7, 1979 790905009b c.
, c. n
$,4 e W 9 g..
Introduction By letter dated April 14, 1979, we transmitted IE Bulletin No. 79-08 to Northeast Nuclear Energy Company (NNECO or the licensee).
This Bulletin specified actions to be taken by the licensee to avoid occurrence of an event similar to that which occurred at Three Mile Island, Unit 2 (TMI-2) on March 28, 1979.
By letter dated April 24, 1979, NNECO provided responses to action items one through 10 of IE Bulletin 79-08 for the Millstone Nuclear Power Station, Unit No.1 (Millstone-1).
NNECO supplemented this responde, by letters dated May 14, 1979 and June 15, 1979, to provide its response to action item 11 of IEB 79-08 and to clarify and elaborate on certain of the items as a result of discussions with the NRC staff.
The NNECO responses to IE Bulletin 79-08 provided the basis for our evaluation presented below.
Evaluation Each of the 11 action items requested by IE Bulletin 79-08 is repeated below followed by a summary of the licensee response and our evaluation of the response.
1.
Review the descaiption of circumstances described in Enclosure 1 of IE Bulletin 79-05 and the preliminary chronology of the TMI-2 3/28/79 accident included in to IE Bulletin 79-05A.
a.
This review should be directed toward understanding:
(1) the extreme seriousness and consequences of the simultaneous blocking of both trains of a safety system at the Three Mile Island Unit 2 plant and other actions taken during the early phases of the accident; (2) the apparent opera-tional errors which led to the eventual core damage; and (3) the necessity to systematically analyze plant conditions and parameters and take appropriate corrective action, b.
Operational personnel should be instructed to (1) not override automatic action of engineered safety features unless continued operation of engineered safety features will result in unsafe plant conditions (see Section 5a of this bulletin); and (2) not make operational decisions based solely on a single plant parameter indication when one or more confirma-tory indications are available.
c.
All licensed operators and plant management and suoervisors with operational responsibilities shall participate in this review and such participation shall be documented in plant records.
yp C6
.Ats ij s/
. The licensee has rep 3rted that a lesson plan responsive to items la and lb has been prepared and presented to all licensed and unlicensed operators as well as plant management and supersisors with operational responsibility.
On the basis of the fuECO response, we conclude that the intent of IE Bulletin 79-08 items la, b and c has been satisfied.
2.
Review the contai1 ment isolation initiation design and procedures, and prepare and implement all changes necessary to initiate containment isolation, whether manual or automatac, of all lines whose isolation does not degrade needed safety features or cooling capability, upon automatic initiation of safety injection.
The licensee in its Apr'l 24, 1979 letter reported that the primary containment isolation design has been reviewed and it has been confirmed by this review that the required containment isclation does occur in parallel with the automatic initiation of any of the safety injection systems.
This is because containment isolation and safety injection utilize the same water level sensors.
The response also stated that the boiling water reactor design provides containment and reactor coolant pressure boundary isolation (excluding emergency core cooling and make-up systems) and that the isolation occurs upon reactor vessel low water level or high drywell pressure prior to, or simultaneous with, initiation of the emergency core cooling and safety injection systems.
The licensee's response stated that the isolation valves will remain closed until operator action is taken, even if the initiating signal clears.
(A detailed description of the containment and system isolations can be found in the Millstone-1 Final Safety Analysis Report and they are summmarized in the Millstone-1 Technical Specifications.)
We have concluded that the review by the licensee which confirmed the adequacy of existing written procedures satisfies the intent of IE Bulletin 79-08 item 2.
3.
Describe the actions, both automatic and manual, necessary for proper func-tioning of the auxiliary heat removal systems (e.g., RCIC) that are used when the main feedwater system is not operable.
For any manual action necessary, describe in summary form the procedure by which this action is taken in a timely sense.
a,,
e n> A r s r,..
The licensee in its April 24, 1979 letter reported that Millstone-1 utilizes the isolation condenser system as an auxiliary heat removal device when the main feedwater system is not operable.
The system is designed to automatically initiate when reactor pressure reaches 1085 pounds per square inch gauge for 15 seconds.
This system relies upon the natural circulation of steam from the reactor vessel through the isolation condenser and returns condensate to the vessel.
Makeup for the shell side is automatic and is supplied from the station fire water or condensate transfer systems.
The isolation condenser system may also be manually initiated, by opening one valve either from the control room or locally.
Procedures exist for these evolutions.
For long term operati in in this cooling mode, the control rod drive pumps may be used to replenish the coolant lost by insignificant primary system boundary leakage.
If the isolation condenser system is not available for cooling, the plant has the abili+.y to maintain cooling using the low pressure coolant injection system af ter manually depressurizing with the automatic pressure relief system.
Procedures currently exist for these evolutions.
We agree that this capability exists and conclude that the licensee response satisfies the intent of IE Bulletin 79-08 item 3.
4.
Describe all uses and types of vessel level indication for both automatic and manual initiation of safety systems.
Describe other redundant instrumentation which the operator might have to give the same information regarding plant status.
Instruct operators to utilize other available information to initiate safety systems.
The licensee in its response has reported that reactor vessel water level in the boiling water reactor is continuously monitored by seven indicators or recorders for normal, transient and accident conditions.
Those monitors, used to provide auto-matic safety equipment initiation, are arranged in a redundant array with two instruments in each of two or more independent electronic divisions.
Thus, adequate information is provided to automatically initiate safety actions ana provide the operator with assurance of the vessel water level at all times.
In its letter dated 7
c.
=> t it.si>f
4-June 15, 1979 the licensee reported that the operating procedures reflect the requirements for the operators to also rely upon the information provided by the instrumentation discussed in the response to It Qulletin 79-08 item Sb.
These water level measurement davices have operated reliably in boiling water reactor plants for 20 years.
The range of reactor vessel water level from below the bottom of the active fuel area up to the top of the vessel is covered by a combination of narrow and wide-range instruments.
Level is indicated and recorded in the control room.
A separate set of narrow-range level instrumentation on separate condensing chambers provides reactor level control via. the reactor feedwater system.
This set also indicates and records in the control room.
The safety-related systems or functions served by safety-related reactor water level instrumentation are:
Reactor scram Feedwater coolant inject!on system Core spray system Low pressure coolant injection system Automatic pressure relief system Main steam isolation valve closure Primary containment isolation All systems automatically initiate cn low reactor water level.
The feedwater coolant injection system will control in level control mode if and when level is restored to the normal operating rance.
The core spray and low pressure coolant injection systems will continue to aparate until manually shut down.
The licensee in its letter dated April 24, 1979 stated that in the unlikely event that vessel level indication were in dcubt, the operators would continue to allow the feedwater coolant injection, core spray and low pressure coolant injection
,,-noo d,* _ k m.s i J 4., e systems to operate, overflowing the vessel to the torus via the automatic pressure relief system valves.
Existing procedures have been modified to clarify this operation.
On the basis of the information provided by NNEC0 we have concluded that the intent of IE Bulletin 79-08 item 4 has been satisfied.
5.
Review the action directed by the operating procedures and training instruc-tions to ensure that:
a.
Operators do not override automatic actions of engineered safety features, unless continued operation of engineered safety features will result in unsafe plant conditions (e.g., vessel integrity).
b.
Operatcrs are provided additional information and instructions to not rely upon vessel level indication alone for manual actions, but to also examine other plant parameter indications in evaluating plant conditions.
The licensee has eported the following:
a.
The Mil' stone-1 plant's procedures and training currently are in agree.nent with the NRC position on not overriding automatic safety functions.
b.
Over a dczen other types of instrumentation in the boiling water reactor provide t.1e operator with indirect indication of reactor vessel coolant inventory changes and could inform the operator of the need to take corrective actions.
The licensee reported that a review of operating and emergency procedures showed that various parameters are monitored for each type of acc" dent.
Operators are required to first confirm tnat automatic functions have occurred.
Operator actions, as required in the procedures, are based upen the monitoring of many redundant parameters, one of which is vessel wat?r level.
Some of the instrumentation which the operator can use to determine changes in reactor coolant inventory or other abnormal conditions are-r.
, < ~mn el.
L C/ L) (i Orywell high pressure Drywell high radioactivity levels Suppression pool high temperature Safety relief valve discharge high temperature High feedwater flow rates High main steam flow High containment and equipment area temperatures High differential flow, reactor water clean up system Abnormal reactor pressure High suppression pool water level High drywell and containment sump fill and pumpout rate The licensee provided the following three examples of the use of this additional information by the operator.
Drywell high pressure is an indirect indication of coolant loss.
Coincident high suppression pool temperature further verifies a loss of reactor coolant.
High safety relief valve discharge temperature would pinpoint loss of coolant via an open valve.
Other instrumentation that can signal abnormal plant status, but may not neces-sarily be indicative of loss of coolant are:
High neutron flux High process monitor radiation levels Main turbine status instrumentation Abnormal reactor recirculation flow High electrical current to pump motors We have concluded on the basis of the information submitted by the licensee that the intent of IE Bulletin 79-08 item 5 has been satisfied.
6.
Review all safety-related valve positions, positioning requirements and positive controls to assure that valves remain positioned (open or closed) in a manner to ensure the proper operation of engineered safety features.
Also review related procedures, such as those for maintenance, testing, plant and system startup, and supervisory periodic (e.g., daily /shif t checks), surveillance
':)1:,u l
w to ensure that such valves are returned to their correct positions following necessary manipulations and are maintained in their proper positions during all operational modes.
The licensee confirmed by telephone on July 11, 1979 that all safety-related valve positions, positioning requirements and procedural controls which ensure that the valves have been properly positioned for operation of engineered safety features in accordance with the system design requirements have been reviewed. Where necessary, procedures have been revised to make them more inclusive. Also the administrative procedures governing surveillance testing, maintenance and system / plant startup relative to safety-related valve position verification have been reviewed.
The existing procedures for surveillance testing are considered by the licensee to be adequate.
The procedures for control of maintenance on safety-related equipment have been revised to specifically assure correct positioning of valves which were worked on or were used for isolation purposes.
We have also confirmed with the licensee that positions of all safety-related valves, except for locked valves, are visually checked monthly.
The positions of locked valves are visually checked prior to each startup and after any system manipulation that require their repositioning.
The NRC-approved Technical Specifications require that valve lineup lists be reviewed by the Plant Operations Review Committee to ensure proper valve positioning prior to operation, any time modifications are niade that could affect valve lineups.
Simulated or actual automatic actuation and functional system testing is also required by Technical Specifications each refueling cycle on emergency core cooling systems; core spray, low pressure coolant injection, feedwater coolant injection, isolation condenser, and automatic pressure relief.
The licensee has also identified a need to develop a system to ensure that the control room drawings, including system process and instrumentation drawings are kept updated to reflect all drawing change requests, including those roquests being processed.
On the basis of the information provided by the licensee, we have concluded that the intent of IE Bulletin 79-08 item 6 has been satisfied.
5.
a a.
.O v l 7.
Review yo'/
operating modes and procedures for all systems designed to transfer potentially radioactive gases and liquids cut of the primary containment to assure that undesired pumping, venting or other release of radioactive liquids and gases will not occur inadvertently.
In particular, ensure that such an occurrence would not be caused by the resetting of engineered safety features instrumentation.
List all such systems and indicate:
a.
Whether interlocks exist to prevent transfer when high radiation indica-tion exists, and b.
Whether such systems are isolated by the containment isolation signal.
c.
The basis on which continued operability of the above features is assured.
The licensea responded that systems designed to transfer potentially contam-inated radioactive gases and liquids out of the primary containment include the main steam system, cleanup system, drywell equipment and floor drain systems, recirculating loop sample line, and the drywell and suppression chamber vent systems.
These systems are designed to isolate on either low reactor water level or high drywell pressure.
Procedurally, a sample is taken for airborne activity in the primary containment before venting.
The drywell sumps are procedurally operated in manual and thus the possibility of inadvertent pumping is minimal.
While no installed radiation monitoring exists for these sump systems, their discharge lines could be monitored with portable instrumentation if the potential for punping highly contaminated water was present.
The main steam system and clean up systems are equipped with process or area radiation monitors to protect against inadvertent high level releases by these paths.
The licensee reported that each of these protective features is routinely calibrated and/or tested.
We have concluded that the licensee response satisfies the intent of IE Bulletin 79-08 item 7.
8.
Review and modify as necessary your maintenance and test procedures to ensure that they require:
o va -<
Verification, by test or inspection, of the operability of redundant a.
safety-related systems prior to the removal of any r,afety-related system from service.
b.
Verification of the operability of all safety-related systemr when they are returned to service following maintenance or testing.
Explicit notification of involved reactor operational personnel whenever a c.
safety-related system is removed from and returned to service.
The licensee reported that:
The administrative procedures have been revised to specify that prior to a.
removal of safety-related systems from service *.he redundant systems will be verified operable.
For equipment which the Technical Specifications require specific surveillance, that testing will be completed orior to removing the system fro:n service.
b.
Procedures for mair.tenance and testing of shfety-related systems have been reviewed and changes have been made to strengthen the requirement to verify operability of safety-related systems prior to taking credit for the system (s) to satisfy Technical Specification requirements.
A licensed operator is recuired to authorize all maintenance, tests, or c.
surveillance which affect plant systems.
Prior to releasing the controlling document, the operator ensures
'u is aware of the effect of the activity on the system or equipment.
Upon completion of the item, the document is returned to the operator for acceptance or for the purpose of returning the system to service.
The administrative procedures which control these evolutions provide the required explicit notification of ooerational personnel whenever a safety-related system is remcved from and returned to service.
The control room procedures assure that during snift Cnanges, the oncoming shift is fully informed of any abnormalities in the plant, the equipment running, and other pertinent facts about the plant status.
n
- U) d3. 2.~ss ~)
We have concluded that the licensee responses satisfy the intent of IE Bulletin 79-09 item 8.
9.
Review your prompt reporting procedures for NRC notification to assure that NRC is notified within one hour of the time the reactor is not in a controlled or expected ccndition of cperation.
Further, at that time an open continuous communication channel shall be established and n=intained with NRC.
The l' ensee reported that a revision to the administrative procedure on
" ions and cutside assistance has been approved.
This revision cr m incorpore'es the required notifications and establishment of communication channels requestGd in the Bulletin.
The licensee noted that the wording of the reason for immediate notification
("The reactor is not in a controlled or expected condition of operation") is general in that many different circumstances may or may not fit the definition, depending on who is interpreting the situation.
Because of this the licensee requested more specific guidance on this point in order to provide more explicit instructions to the operators and duty of ficers.
We agree that the Bulletin statement is, of necessity, a general statement and was prepared in light of our knowledge of the early sequence of events at TMI-2 prior to NRC notification.
We leave it to the licensee to likewise review the TMI-2 events and, using that as guidance together with his experience in routine operations and the recognition of non-routine events, promulgate his own interpretation of prompt NRC notification, keeping in mind NRC's role in these matters.
- However, we conclude that should a question arise in regard to NRC notification, the licensee should plan to err on the side of providing prompt notification.
We have concluded that the licensee response satisfies the intent of IE Bulletin 79-08 item 9.
10.
Review operating modes and procedures ta deal with significant amounts of hydrogen gas that may be generated during a transient or other accident that would either remain inside the primary system or be released to the containment.
.,.c
] /,. yd i al
11 -
The licensee has reported that hydrogen gas generation is not a problem for Millstone-l.
During normal operation, the reactor pressure vessel dome is filled with steam, which flows to the turbine.
During reactor isolation, the dome may be automatically vented through the safety relief valves to the suppression pool.
In addition, the reactor pr(ssure vessel head has a vent line with a valve remotely operated from the control room.
The licensee response stated tnat the primary containment is nitrogen inerted per Technical Specification reouirements and thus, hydrogen flammability is precluded.
We have concluded that the licensee response to IE Sulletin 79-08 item 10 is acceptable.
11.
Propose changes, as required, to those technical specifications which must be modified as a result of your implementing the items above.
The licensee has reported in its letter dated May 14, 1979 that the Bulletin responses forwarded to NRC on April 24, 1979, and the various administrative and technical methods of implementing those responses have been carefully evaluated.
The licensee concluded tha', no Tecnnical Soecifications changes are required at this ti=e.
We have concluded that the licensee response to II 3ulletin 73-03 item 11 is acceptable.
Conclusion Based on our eview of the information provided by the licensee to date, we conclude that tne licensee has correctly intercreted IE Sulletin 79-08.
The actions taken demonstrate tne licensee's uncerstanding of tne concerns arising from tne TMI-2 accident in reviewing their implications on Millstone-1 coerations, and provice added assurance for the protection of the public nealth and safety during the operation of Millstone-1.
rg.
. 7 v,t
. t a - I LJ
. References 1.
IE Bulletin 79-05, dated April 1, 1979.
2.
IE Bulletin 79-05A, dated April 5, 1979.
3.
IE Bulletin 79-08, dated April 14, 1979.
4.
,44ECO letter, W. Counsil to B. Grier, dated April 24, 1979.
5.
NNEC0 letter, W. Counsil to B. Grier, dated May 14, 1979.
6.'
NNECO letter, W. Counsil to B. Grier, dated June 15, 1979.
o, n
3 Ue*
..s. %
- g,
'