ML19224C235
| ML19224C235 | |
| Person / Time | |
|---|---|
| Site: | Browns Ferry, Crane  |
| Issue date: | 04/24/1979 |
| From: | Gilleland J TENNESSEE VALLEY AUTHORITY |
| To: | James O'Reilly NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION II) |
| References | |
| NUDOCS 7906290503 | |
| Download: ML19224C235 (14) | |
Text
t
/f..-
TENNESSEE VALLEY AUTHCRITY cH A T"~ A *4 C M A. T E *. '4 C 3 5 C C 3 7.3 01 500C Chestnut Street Tc.er II A'c q e s.
n
.,.,9 c/
+
Mr. Ja:es P. O'Reilly, Director i
Office of Inspection and Enforcement I
l U.S. Nucicar Regulatory Cennission
[/
Region II - Suf.te 3100
,(; h s
101 Marietta Street 1
Atlanta, Georgia 33303 Ocar Mr. O'Reilly:
CF7 ICE OF INSPECTION AND p[cCRCEMENT 3ULLETIN 79-03 r.II:J?O 50-259, -260, -296 - 3RCCS TERRY NUCLEAR ?LANT C'i!TS 1, 2, AND 3 In response to yc" April 13, 1979, letter,which trans=1tted IE 3ulleti d ;3, qve.are enciesing the results of our investiga-s tions at drowns Ferry.)
Very truly yours, J. E. G111 eland Assistant Etnager of Pcwer Enclosure ec: Office of Inspection and Enforcenent (Enclo sure) './
Division of Reactor Operations Inspection U.S. Nuclear Regulatory Co==f 3sion
- 'ashingten, DC 20555 N
N e
0 0200,
y 264 05?
An Ecu. Ccocrtun.: Z :': m
.s
-.....:ea
- w, a -.,.S rs,..,,.C._...-..,.-,
- w..
... +
- .. a r v.. r 1.
Review the descriptien of circurstances described in Inclosure 1 of IE 3ulletin 79-05 and the preliminary chronolecy of the TM1-2 3/23/79 accident included in Er.clecure 1 to IE 3ulletin '?-03A.
a.
This review shcul d.b e direc *.ed t cwa rd und e r:tanding :
(1) the extreme sericusness and consequences of :he si uitanecus biccking cf both trains of a safety system at the Three Mile Island Unit 2 plant and other acticas taken during the earl:. phases of the accident; (2) the apparent cperational errors which led to che eventual core damage; and (3) the necessity to systecatically analyze plant condi-tiens and parameters and take appropriate corrective action.
b.
Operational perscnnel should be instructed to (1) not everride ai'*ccatic actica of engineered safety features taless cen:inued
.,eration of en;ineered safety features will rerul: in unsafe plan:
ccnditi:ns (see Section 3a of this bulletin), and (2) not make opera-tional decisions based celely en a single plant parameter indica:icn when ene or acre ccnfir atory indications are available.
c.
All licensed operators and plant management and supervisors with cperational responsibilities shall participate in this review and such participation saall be documented in plant records.
Eescense to cuestion 1 The plant superintendent (and former assistant operations supervisor at 3rowns Ferry) of I'.'A's Bellefonte Nuclear Plant, a 2-unit Sabcock and Wilcox type reactor plant, will present a review cf the TMI incident tu all nuclear plant managers and supervisors with operational respcasibilities.
This review tegan at 3rc'ns Ferry during the week of April 23, 1979.
In additica to studying NRC reports and analysis of the event, he was on site at the Three M4.le Island plant in an assistance role during the period of April 9-13, 1979, and is familiar with the circumstances of the TML
~
264 055 e
e e
incident. plant =aaagument will subsequently conduct a cc= parable review using the saae aterial and training aids ic.' all licensed operat:rs.
This program will be ccerlete by May 27, 1979.
This review will be dir acted toward (1) understanding the serious consequences of improper alignment of critical systens, (2) evaluating operational acticns which could pc entially lead to tore damage, (3) recognizing the pctential for erroneous conclusions based upon a single cbservatica of a given plant parameter, and (4) understanding the necessity to systenatically analyze plant conditicas and para:etcrs and take appropriate corrective action.
Instruction and caution will be given to licensed operating personnel in (1) not everriding autcratic acticn of engineered safety features and (2) not making operational decisions on a single observation of a given plant par eter when ene or nore confirmatory indicatione are available.
The centents of and participation in this review will be documented.
2.
Review the con ainment isolation initiatio-dasign and procedures, and prepare and $2plenent all changes necessary ;o initiate centainment isolation, whether manual or autc=atic, of all lines whose isolation does not degrade needed safety features or cooli g capability, upon autcmatic initiation of safety injection.
Resconse to cuestica 2
'n'e have reviewed t: e coataincent isolation design and procedures to ensure that proper isolation of the primary containment occurs upon initiation of Emergency Core Cooling Systems (ECCS).
All containment is.iation valves except those needed for ECCS operation will automatically close en receipt of a primary ccatainmen* isolatica signal (PCIS).
The PCIS is generated by high drywell pressure or by re-or icw level.
The PCIS setpoints are chosen such that isolation will occur prior to or at the same time that ECCS initiates.
The logic design is diverse and reb ndant, ensuring high probability of ce=pleting its intended function.
. h /k O Jb
There are several other isolation modes in acc;ti:r to the scia PCIS logic.
For example, mair steam line isolation valves will 21so close as a result of high steam line radiation, high steam fiev, or hi;S staa line tunnel temperature.
The primary centaincent ventilation system isolates en reactor building high radiation.
The HPCI and RCIC systems have instru=entatica to detect pipe breaks within their own flow paths, and to subsequently isolate the system.
Part 5 of the Browns Ferry FSAR gives further details regarding the primary containment isolation system design objectives and operation.
Since boiling water reactors.re direct cyc'.e and pass pri:ary reactor
.ter out of the primary containment during normal operation, rigorous design features have been incorporatJgd to isolate the containment durin; abnormal conditions.
3.
Describe the acticns, both automati: and manual, necessary for preper functioning f the auxiliary heat removal syste=s (e.g., RCIC) that are used when tr cain feedwater system is not operable.
For any manual action necer ary, describe in summary form the procedure by wnich this action is taken in a timely sense.
Response to cuestion 3 On a loss of feedwater flow the following event sequence is initiated auto-
=atically; no operator action is required other than to verify auto atic system operation as described below.
If auto =atic functions do not occur, procedures require that systems be manually initiated.
Core recirculation flow reduces to minimun, reactor scrams en low water level, main steam isolation valves close, reacte.
ore isolation cooling (RCIC) and high pressure coolant injection (HPC1) syste=s go into operation.
As a result of reactor isolation, pressure increases caising the relief valves (RV's) to lift and discharge the pressure suppression 2001, a 985,000-gallon passive heat sink.
r, T
W
=
Either system, RCIC or HPCI, is capable of =aintaining adequate reacter water level as reactor pressure is centrolled thrcugh the RV's.
If ne or rcre RV's fail to close, the HPCI and RCIC systems will continue to raintain adequate reactor water level as primary s: stem pressure decreases.
Continued depressuri-
- ation will enable automatic cperatica of the icw pressure core spray (LPCS) and low pressure coolant injection (LPCI) systems, either of which is capable of =aintaining reactor water level.
In addition, other high and low pressure systems are available to maintain reacter water level and can be initiated manually.
These include the residual heat re=t tral service water syste=, the stardby liquid control systen, and the control rod drive system.
All emergency operating instructicns have been reviewed to ensure that specitic instructions and requirements for =anual initiatica of each safety system is provided. This =anual initiation is 12:ediate folicwing the failure of an automatic initiation.
4.
Describe all uses and types of vessel level indication for both autecatic and canual initiation of safety systems. Describe other redundant instru-centat _sn which the operator might have to give the same information regarding plant status.
Instrue: cperators to utili:e other available information to initiate safety systems.
Res:ense to cuestion 4 The range of reactor water level frca 100 inches below the top of the active fuel up to the tcp of the reactor vessel is covered by a ceabination of narrow and wide range instruments.
There are two basic types of level instrumen-tation:
(1) level transmitters which require excitation voltage to function and (2) level indicating switches which do not require power for switch operation.
264 050
The saf ety-related systess or functicas served by reactor water level' instrumentatica are listed belev.
Sumber of Instruments _
Function or Svstem 4 3arten level indicating switches Kaactor protection system - trips reactor 4 Yarway 1cvel indicating swi:ches and reactor building Primary ccatainment isolation Core and containment cooling initation 4 Yarway level indicating switches HPCI, RCIC, CSS, LFCI, and ADS 2 Yarway level indicating switches ADS 2 Yarway level indicating switches Containment ; pray In all cases redundancy is provided to ensure the logic can perform its intended This includes alternate and redundant pcuer sources for initiation function.
Separatica of logic trains is maintained by separation of instru:ent logic.
roc: panels. The panels, cabia trays, and instrument sensing lines, instru=ent Tes ts of 3'JR water level instru-entire installation is seismically qualified.
=entation under simulated steam and water line breaks have been :cnduc showing satisf actory perfor=ance.
there are three GEMAC level transmitters In addition to the above functicas, signals to the feedwater centrol system and trip the main which provide input and feedpump trubines on high water level in the reactor.
- turbine, additional level indicators (two Yarway indicators and one There are three GEMAC transmitter) which perf orm no centrol or protection functicas; hcwever,
~-
these level indications are available to the operator.
There are a total of 22 instruments for measuring reactor vessel water level.
indicators 'nd/or recorders in the main centrol Eight of these instruments have information in truments assure adequate The diversity and redundancy of these roon.
9'A
[] f' O LD-
)i is provided to automatically initiate safety actions and provide the operator with assurance of the vessel water level at all tires.
Operator instruction on the use of other information to initiate safety systems is discussed in the response to question Sb.
~
5.
Review the action directed by the operating procedures and training instructions to ensure that:
a.
Operators do not override autceatic actions of engineered safety features, unless continued cperation of engineered safety features will result in unsafe plant ccnditions (e.g.,
cessel integrity).
b.
Operators are provided additional informatica and instructions to not rely upon vessel level indicatien alene for nanual acticns, but to also examine other plant parameter indications in evaluating pimnt conditions.
Rescense to cuestion 5 The operating procedures and training instructions are being reviewed to ensure that operators are instructed not to override autceatic operations of the engineered safety features, unless continued cperation of the engineered safety systen vill result in unsafe plant conditions, or until the plant is clearly under centrol and the engineered safeguards are no longer required.
Their review will be completed by May 25, 1979.
TVA's training program e=phasizes the interpretation of all available information in order that the operator can diagnese the basic cause of any
=alfunction or abnormal occurrence.
The plant normal and emergency operating instructions list specific confirmatory indications and expected system para:eter changes associated with equipment calfunctions or postulated accidents.
The prescribed operator respense to the abnornal situaticas also 2bk a
O
-7_
lists the confirmatory indications to verify appropriate corrective action is being taken.
In addition to the multiple level indicaticas described in the response to item 4, there are over a do:ca other types of instrumentation in the 3'JR to provide the operator with indirect indication of reactor vessel coolant inventory changes and could inform the operator of the need to take corrective actions.
Examples are listed below.
Dry ell High Pressure Dryvell High Radicactivity Levels Suppression Pool High Temperature Relief Valve (RV) Discharge High Tempe rature High Feedwater Flow Rates High "ain Steam Flow High Containment and Equip =ent Area Temperatures High Dif f erential Flow - Reactor 'Jater Cleanup Syste Abnormal Reactor Pressure High Suppression Pool L'ater Level High Dryvell and Centainment Su=p Fill and Pu= pout Ra t e Valve Stem Leakoff High Te=perature High Process "onitor Radiation Levels e
Abnormal Reactor Recirculation Flow High Electrical Current (A= peres) to Puce Motors 6.
Review all safety-related valve positions, positiening recuirements and positive ccatrols to assure that valves remain positiened (cpen or closed) in a manner to ensure the proper operaticn of engineered safety features. Also review related procedures, such as those for maintenance, testing, plant and system startup, and supervisory periodic (e.g., daily / shift checks) surveillance to ensure that such valves are returned to their 3
r L D' f b'.
r u
e G
- - -.. ~ _. -
.=
correct positicas fcilowing necessary manipulations sad are maintained in their proper positions during all operational modes.
Resoonse to cuestica 6 Plant ad=inistrative procedures require that (a) all critical safety system and conponent (CSSC) alignment is verified prior to unit startup, (b) changes in the alignment of any CSSC is recorded en a systen status sheet, (c) shift personnel being relieved cereunicate infor=ation on any abnormal plant condition including temporary conditions.
Plant cperating instructions require cc=pletion of a prestartup checklist prior to unit startup.
This checklist is used to verify correct alignment of all safety syste=s.
On a weekly basis systen alignment is reviewed.
Anytime a ccaponent is changed fre= its normal positica or condition, a system status sheet is completed and placed in a syste= status folder.
In additica panel checklists are reviewed weekly to verify that ficw paths exist for all safety systems.
A safety syste= status display panel is Iccated in the main control roca.
The purpose of this. status panel is to communicate information on abnormal plant conditions based on the displayed operability status of specific plant safety systes compenents.
Return of a system or system cc=ponent to its nor=al code or position folicwing
=aintenance or testing is addressed in the response to question 8.
7.
Review your operating medes and precedures for all systems designed to transfer potentially radioactive gases and liquids cut of the primary containment to assure that undesired punping, venting or other relcase of radicactive liquids and gases will not occur inadvertently.
In particular, ensure that such an occurrence would not be caused by the resetting of engineered safety features instrumentation.
List all such systems and indicate:
-),
(
Y L-
--n-w
a.
Whether interlocks exist to prevent transfer when high radiation I
indication exists, and b.
Whether such vst2=s are isolated by the centain=ent isciation signal.
The ba, sis en which centinued operability of the abcve features c.
is assured.
Resocnse to cuestion 7 We have reviewed the operating ecdes and procedures for all systems designed to transfer potentially radicactive liquids and gases free the primary contain-cent.
As explained belcw, we have concluded that the likelihced of inadvertent transfer of highly radicactive raterial is very Icw.
However, we will further review the syste: design to determine if additional high radiation interlocks are required.
LICUID SYSTEMS The primary function of the drywell drain. sump and drywell equipment drain su=p is to collect and ceasure nuclear syste= leakage from both identified and unidentified scurces.
Two pumps associated with each sump operate auto-
=atically to =aintain the su=p level within a desired range.
These pumps discharge to the radwaste system.
Two isclation valves in each discharge line are present.
These valves fail in the closed position on loss of pcuer or control air.
While there are no high radiation interlocks associated with the centrol logic on these valves, they will isolate en receipt of a pri=ary containment isolation signal (PCIS).
?CIS is initiated by either low reactor water level or high drywell pressure.
We have not identified any conditions that sculd involve a significant breach of the primary system and at the same ti=e not initiate the PCIS.
Furthermore, once the PCIS is initiated, manual operator action is required to perrit reopening of these. discharge valves.
~'
7 / '1 U U' J A
L.D r o
S e
w-The unit operator may canually secure the drain sunps if high radiation is suspected. The pri=ary containr2nt has area radiation eenitors that would alert the unit cperator of high containment activity.
The radwaste building has similar monitors with annunciators local to the radwaste area and also in the main control room.
Annunciators will also alarm if either transfer purp operates for an excessive ti e (about 10 minutes).
The radwaste facility is centinuously canned and these operators can isolate high activity in-flow from their control station as well.
VENTILATICS SYSTEMS The primary containment purge (PCP) syste= is used during reactor startup to nitrogen inert the containeens, or during reactor shutdewns to provide a breathable etnosphere.
During routine power operation, the small sents on this system are infrequently used to add makeup nitrogen or to adjust drywell pressure. The ventilatica valves are maintained closed unless the system is actually in service.
The PCP normally processes the exhaust streams through HEPA filters and charcoal filters into the reactor building ventilation systen.
Align =ent to standby gas treatment is also possible.
The exhaust gases from the reactor and turbine building are continuously monitored for radioactivity, and annunciators would alert the unit operator well before any technical specification release rates are approached.
The primary containment ventilation valves will autctatically isolate (if open) on receipt of the PCIS signal (high drywell pressure or icw vessel level).
Additionally, the valves will isolate on high radiation in the reactor building ventilaticn ducts.
Limited PCIS override controls exist that provide
')L b' 'i lq., ' c 4
- r.
r 8
= ~ - -..
_11-leasing g2s f r:a ei:her
~
.crsonnel --ith a preplanned method or re operationc
- ystem or pressure suppression pool to the standby gas trea
- :en:
the dryvel2 for long-term post-LCCA atmospheric control.
procedures to Review and modify as nececsary ycur caintenance and test 8.
ensure that they require:
d d t
Verification, by test or inspection, of the operability of re un an any safety-related cafety-related systenq prior to the renoval ot a.
system from service, hn Verification of the operability of all safety-related'syste=s w e or testing.
they are returned to service f ollowing naintenance b.
l Explicit notification of involved reactor operational persenneand returned to whenever a safety-related system is recoved frc:
c.
Resoonse to cuestien 8_
ferification of the (a) require specific ad=inistrative prededures:
plant h equip =ent is operabili:y of re dundant safety-related equipment bef ore suc operability requirements are based on plant removed.rca service (equipment technics specifications); (b) require that system operability is proven by the shift systen is returned to service; and (c) require approval before a f any activity on ar or his representative prior to the performance o supervi In addition, plant equip =ent or any activity that =sy affect plant equipment.
is notified when an activity the shift supervisor or his representative is completed or a change occurs equip =ent authoriz2d to be performed on plant in the scope of the activity.
procedures have been reviewed, and those Detailed plant maintenance and test are being mcdified and codificaticas the above requirements
~
that do not meet ccmpleted by May 25, 1979.
.O w..
O
ies are centrolled i
In addition to prewritten instructions, naintenance activ t identifies specific maintena ce thrcugh a trouble-reporting system which Bef ore maintenance is performed, (TR).
requirements on each trouble report supervisor er his d by the shift the work requirements of the TR are reviewe i
re Approval to perform maintenance is indicated by s gnatu r epr es enta tiv e.
After ccmpletion of work, the shift of the shift supervisor on each TR.
the maintenance activity d that supervisor or his representative is notifie requirements are specified Return to normal instructions and test is comp ete.
ion or on the initiating TR.
l in a referenced maintenance or surveillance instruct re reporting procedures for NRC notification to assu in a f the time the reactor is not Review your prompt time an 9.
that NRC is notified within one hour o Further, at that ion controlled or expected condition of operatll be established and maintained cpen ccatinuous communication channel sha with NRC.
Response to question 9 Nuclear Plant will be incorporated in our 3rowns Ferry This requirement Operating Procedures.
ancunts of i h significant Review operating modes and procedures to deal w tmay be gen her accident 10.
hydrogen gas thatwould either remain inside the primary sy that containment.
Resconse to cuestion 10 d hydrogen and cxygen are During nor=al operation, radiolytically produce l
ombined to the condensor and are subsequent y rec from the primary coolant dcwn, minimal hydrogen is vent-When the reactor is shut in the catalytic beds.
evolved.
d procedures to deal with We have further reviewed the operating modes an or be generatcd during a transient
' might significant amcunts of hydrogen that d disposal eatures are available for safe handling an r
other accident.
of the hydrogen.
06-o G
WM
To remove h drogen from an isolated reactor vessel, the main steam relief valves f
may be remotely operated to vent the hydrogen te the suporession pool.
In addition, the reactor vassel has a head vent line with valves remotely operated from the control room.
The primary containment is normally inerted with nitrogen to maintain low oxygen concentration. Redundant instrumentation is available to continuously monitor both the oxygen and hydrogen concentrations in the torus and dryvell.
Nitroten stored in tanks as part of the containment atnospheric dilution (CAD) systen is available for controlling hydrogen and oxygen concentration.
Existing operating crocedures adequately prescribe the operation of the CAD system to prevent buildupofdetonatabledasesintheprimarycontainment.
[
"W e
264 067 e
e