ML19241B486
| ML19241B486 | |
| Person / Time | |
|---|---|
| Site: | Oyster Creek |
| Issue date: | 05/30/1979 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML19241B475 | List: |
| References | |
| SER-79053O, NUDOCS 7907180160 | |
| Download: ML19241B486 (44) | |
Text
.
i RESTART 3AFETY EVALUATION REPORT BY THE OFF'CE OF NUCLEAR REACTOR REGULATION U.S. NUCLEAR REGULATORY CCMMISSION IN THE MATTER OF JERSEY CENTRAL PCWER AND LIGHT CCMPANY OYSTER CREEK NULLEAR GENERATING STATION DOCKET NO. 50-219 e
t),,I
\\\\2 1
Dated: May 30, 1979 7 907180 /((d g
a.,s e
w
e OYSTER CREE.< RESTART SAFETY EVALUAIICN RiPCRI I.
INTRCOUCTICN II. EVALUATION II.A Oyster Creex Cor a Condition II.A.1 Minimum Water tevel Over the Core II.A.2 Primary Coolant and Off-Gas Analyses I;.S Licensing Basis Loss of Coolant Inventory Transient II.B.1 Low-Low-Law Water Level Saf ety Limi t II.B.2 Bouncing Event Description 11.3.3 Coces and Metnocs II.B.4 Assumptions II.B.5 Results II.B.6 Conclusions III TECHNICAL SPECIFICATIONS III.A Safety Limi ts III.B Limiting Safety System Settings I't. CPERATING ORCCECURES
!V.A Operator Acticns IV.B Revi sed Plant Ccerating Procecures V.
STARTUP SURVEILLANCE PC.CGRAM f) \\ !
4 O
. VI. OTHER CCNSIDERATIONS VI.A Water Level Indication VI.B Potential for Transients Due to Surveillance Tests VII. CONCLUSI::NS VIII. REFERENCES APPENDIX - Detailed Event Sequence
~
/
517 114
.p o
. I.,
INTRODUCTION On May 2,1979 the Oyster Creek Nuclear Generating Station experienced a sequence of events wnich caused the indicated reactor water level to fall below the "Icw-low-low" ( triple-low) al arm setpoint.
The triple-low level io sensed within the core shroud and corresponds to an elevation as low as 4'8" acove the too of the active fuel. This water level corres-ponds approximately to the lower limit for direct instrument indication.
Although the reactor had already scrammed when water level fell below the triple-low alarm setpoint, a question of acequacy of core cooling during the event was raised.
Region I of the Office of Inspection and Enforcement was notified by the licensee (Jersey Central Power & Light) on the day of the event.
Inspectors from Region I went to the site. The Office of Nuclear Reactor Regulation was also notified. A team from ONRR went to the site May 3,1979, to gain first-hand infonnation.
Investigations continued for several days thereaf ter by tne technical staff of the licensee, the reactor vendor, licensee consultants, and the NRC.
The investigations focused upon the contributing causes of the event and an assessment of the core condition.
On May 9,1979, licensee representatives and its consultants met with the NRC staff to discuss tne event, their analysis of the core condition, the corrective actions necessary to prevent reoccurrence and lessons forstaffreviewbyletter}tedareportpursuantto10CF}2g.3j(c)(1) learned. The licensee sucmi 5
dated May 12, 1979.
Letters from the licensee cated May 17, 1979 and May 19, 1979 fo rwarded additional information and requested authorization to restart the reactor.
This safety evaluation addresses the condition of the Oyster Creek core folicwing the event of May 2,1979 and tne changes to the plant design and operation necessary to prevent recurrence. The report describes our review of the core condition, the licensing-basis loss of coolant inventory transient, the ~ecnnical Scecification cnanges, the operating procecures, special startup tests, and other consicerations.
A summary of the May 2nd event follcws.
S17
!!5
, The Oyster Creek reactor was operating normally at approximately 98%
.J power, with one of its five reactor coolant system loops and one of its two startup transformers out-of-service, when a simultaneous reactor trip and ATWS recirculation pump trip occurred.
The cause of these trips was a mcmentary spurious high RCS pressure signal caused by routine surveil-lance testing of the isolation condenser ir.itiation pressure switches.
As a result of the reactor scram and recirculaLion pump trip, reactor power, steam ficw, pressure, water level, recirculation ficw and turbine generator cutput began decreasing. At about 13 seconds into the transient the turbine-generator tripoed at the low load trip point.
This subse-quently causec all three reactor feed cump motors to trip, because the backup electric power source supplied by the one available startup trans-former was not capable of provioing power to condensate and feedwater pumps sufficient to retain even partial feedwater supply to the reactor vessel. The reactor coerator attempted at this time to restart a feedwater pump but was unsuccessful.
Reactor water level continued to drop since the steam flow exiting the reactor was only being replaced by makeup from a single control rod drive pumo. Recognizing the continued inventory loss from the reactor, the operator started a second control rod drive pump at 31 seconds into the event and initiated manual reactor isolation at 43 seconds. With the reactor fully isolated frca the main condenser the acerator manually closed the discharge valves of recirculation loops "A" and "E" wnich take return condensate frca the two isolation concensers. The operator manually placed into service one of the isolation condensers at this time.
It is believed that the operator also initiated closure of the "B"
and "C" loop discharge valves about this time as a first step in starting one or both the associatec reactor coolant pumps which had tripped at the start of the event. Additionally, as indicated previously, one loop (1000 D) was already isolated and out-of-service, with its discharge valve closed prior to the event. All of the discharge valve bypass lines were open prior to and throughout the event however. As the discnarge valves moved to the full-closea position :ne reactor vessel water inventory d.istribution continued to shi f t away frca the core region toward tne acwncceer'(annulus). At 172 seconds, the reactor icw-lcw-Icw water level instrument trip point was reacned.
All discharge valves were fully cicsea at 186 seconds. Heat was removed from the system sucsequently Dy alternately manually actuating ar.c stopping 51/
116
e the isolation condenser. Reactor pressure and annulus water level increases and decreases were noted during this period and were caused by the intermittent isolation concenser operation. At approximately 32 minutes the operator started the C recircul ation loop pump. The pump was shutdown and the discharged valve reclosed, however, when the operator observed water level in the annulus quickly dropping. At about 37 minutes one feedwater pumo was restartea causing water level in the annulus to rapidly rise to 13'8" above the top of the core. At 39 minutes a recircu-lation pump was placed in service and the tripla-low water level in the core region was observed to be cleared. At thi time steps were initiated a
to bring the plant to a colc shutdown condition.
II.
EVALUATION II.A.
Oyster Creek Core Condition As part of our evaluation, we have reviewed calculations provided by the licensee of the minimum water level which could have existed over the Oyster Creek core on May 2,1979. Additionally, we have reviewed the radioactivity and chemistry analyses of the plant provided by tne licensee.
II.A.1 Minimum Water Level Over the Core a) Reason for Level Calculations Water level in tne annulus was recorded during the event. However, due to partial isolation of the annulus from the core (discussed in Section I and in the attached Appendix), the minimum recorded level in the annulus did not correspond to the minimum level reached in the core region during the event.
The instrumentation that monitors water level in the core region is not recorced as a function of time. Rather, the core region level instrument arovices visible and audiole signal s in the control rocm when core water level cecreases celcw the alarm setooint low-1cw-Icw level.
The lcwest alarm setting possible for the core region level instrument is 4 ft-a in (56 in.) aoove the care, whicn is tne elevation above the ccre of tnat instrument's pressure tao. Cn May 2, tne setting for the low-low-low level alarm was 10" accve tnat minimum or 5 f t-6 in (66 in) acove the core.
The time when :nat icw-low-lcw level signal was 3 receivec curing tne May 2 event was recorded (172 seconcs af ter scram)'-'
and this single point (level and time) reoresents tne only direct core region water level measurement recorceo curing the incicent.
Exr' for the first few seconds following scram, a sufficient condition t
.tonstrate lack of core camage is that the water level remained above the too of the core.
Since the minimum incore water level was not measurea, the calculations were performec to cetermine wnether or not the core uncovered curing the May 2 event.
5i/
117
..J b) Calculations for the First Few Seconds Af ter Scram Reactor scram caused a rapid power decrease for the first few seconds folicwing the May 2 reactor trip. However, the recirculat' ion pumps had also tripped simultanecusly with tne scram, so reactor ficw was also decreasing. Transient Minimum Critical Power Ratio (MCFR) cal-culations were performed oy) Exxon Nuclear Cccoany using neir Plant Transient Simulator Coce.(5
- Results of tnose calculations indi-cated that MCPR values increasec f rca the steacy state MC?R that existed prior to scram. Thus, acceptacle ccoling was maintained in the core during ne initial rapid pcwer anc ficw cecrease perioc.(2)
Physically, tnis means that ne heat being transferreo to tne reactor coolant (a ccmoination of stored neat and pcwer ceing procuced) ce-creased more rapidly than the coolant's acility to remove that heat was decreasing.
c) Minimum Level Calculations Following tne rapid pcwer anc ficw decrease transient discussed aoove, a sufficient, but not necessary, condition to cemonstrate lack of core damage is that the water level remained accve tne tcp of the core.
Since the minimum water level above tne core was not measured and/or recorded calculations were performed to conservatively cetermine the minimum level reacned curing the May 2 event.
Minimum water level calculations were indepencently performed by the General Electric Ccmaany (GE),(1) and tne Exxon Nuclear Company (ENC).(2) The Nuclear Regulatory Commission (NRC) staf f performec preliminary calculations in preparaticn for evaluating,tne otner cal-culations. All of the calculations indicated that tne core cia not uncover.
'The ?T3 mocel has previcusly teen applied to Cyc_ter Creek plant to ceter-mine MCPR values curing transients.
a bi/
!!8
. Each of the above groups independently performed the same basic type of "boiloff" calculation.
In addition, ENC performed a " mass inventory" calculation. All calculations were initiated oy modeling the system that existed at Oyster Creek 172 seconds into tho May 2 event. The initialized conditions are that the Main Steam Line Isolation Valves were closed, and all steam produced in the core went to the Isolation Condenser where it was condensed and returned to the annulus. Flow passed between the annulus and the core only through the five taall (2" diameter) Dypass pipes described below.
The only change to the system inventory came from mass addition into the core region frca the control rod drive (CRD) pumps. Other methods and conditions common to all of the water level calculations are des-cribed below.
- 1) The single measured water level inside the shroud, lcw-low-low level (66 inches above the core) at 172 seconds follcwing scram, was used in calculating the " initial" (i.e.,
t=172 seconds) water inventnry. The " initial" in-shroud water inventory was in turn used in the calculations of inventory at times later thar 172 seconds. The calculated in-shroud inventories were then used to infer water levels above core at later times, the final result desired.
Errors in calculating changes in the void content or distribution in the various regions inside the shroua af ter the 172 second cal-culation-ir.itiation time would affect the final calculated water levels above the core. However, any bias in void content would tend to propagate through the calculations in such a manner as to
" cancel", i.e., not af fect the water level v,5 time calculations.
This is because the initial inventory included effects of a cal-culated voia content and distribution; tne ' total amount of wa ter that must be present in the core and upper plenum in order to hol d 10" of water above the l ow-l cw-l cw level measurement tao (i.e., the low-Icw-low l evel al arn coint) is decenaent on tne void content of the varicus regions below tnat tap.
S ta ted differently, less voids below tne measurement tap woulc allcw water that was creviously 30cve the tap (ana :nerefore mcasured) to drco to levels Delcw tne tac and no lenger ce measured. Thus, the void content in regions Delew tne tap is important in deter-mining the time at wnich the core level droos Delcw the les 'ow-Icw level point. However, that time was taken frcm the actual Icw-low-low level measurement, thus automatically taking into account the correct, actual vola content and distrioution witneut regard to whether or not that void content and distribution was ccrrectly predicted. As long as no major errors are made in predicting changes in void content due to cnanges in the parameters wnich affect voic formation (af ter calculation-initiation time) then no significant errors in minimum calcul ated water level will te introduced. Since valves aere opened or closec in the recircula-31/
119
. tion flow path, no large recirculation flow temperature changes occurred, no large core pcwer changes occurred, etc., large changes from the initial void content and cistribution would not be expectec, and were in fact not predicted by the calculations. Therefore, what-ever voias were " holding the level up" when the initial (low-Icw-low) level measurement was made, would continue to " hold the level up" rougniy tne same amount during later calculated times. Thus, small errors in calculating changes in the void content would slightly affect later water level calculations, but errors in the under-standing of absolute values of void congt and distribution would " cancel out" of the calculations In addition to the above, we believe no significant errors are present in the absolute values of void centent and distribution.
GE has compared the calculated void fractions with values frcm proprietary data which was taken over a mass flux and void fraction range which covers the values of mass flux and voigraction pre-dicted by these calculations, with good agreement.
- Also, ENC has provided a " maximum uncertainty in void fraction" sensi-tivity study showing that effects on minimum calculated water decrease.g9 errors in void fraction would be only 5 inches level level due t Due to the acceptable agreement of calculated vs measured absolute void content, plus the lack of ;ensitivity of the calculated water level results to absolute values of void content and distribution, we find the treatment of void content in the level calculations to be acceptaole.
- 2) Annulus-level-versus-time data were used to determine tne initial
( t=172 sec) inventory in the annulus and the pressure differential (head) aveilable to drive water frcm the annulus region into the core region througn tne five 2" diameter recirculation-pumo-discharge-valve Dyodss-valves and associated Diping.
Temcera-tures in the annular region were measured tnrcugncut tne transient and remained succooled; therefore, the void consicerations dis-cussed acove for tne care region are of no concern for the annular region.
- 3) Plant data were used to calcul ate ficw resistance in the acove men-tioned 2" lines, i.e., the calculations assumed actual pire size, thickness, material, roughness, length, numoer and type of Dends, entrance and exit shape, and valve size and type in calculating flow resistance.
DlI l}
. 4) Recirculation flow (ficw from the annulus to the core) was cal-culatea using the driving head and flow resi stances determined as descriDed in 2) Jnd 3) above. All main recirculation pump discharge valves were assumed to be closed at the 172 second initial time.
- 5) Recirculation flow temperature was taken from measurements.
Mixing of the cooler recirculation flow with warmer water in the lower plenum was not assumed. The cooler recirculation ficw was assumed to stratify in the bottom of the lower plenum.
If mixing in the lower plenum had been assumed, it wculd not have resulted in contraction and lowered level due to void collapse in the lowre plenum (the lower plenum remained sub-cooled - i.e., the.re were no voids there to be collaosed. The stratification sssumption therefore does not result in non-conservatism in the water level calculation. The stratification assumption does conservatively maximize the time before the cooler recirculation ficw reaches the core (maximizes time before intentory losses from the core due to steaming would be reduced due to the cooler recirculated liquid reaching the hotter core region).
- 6) Steaming to the isolation condenser was assumed as that required to remove all heat produced by the following heat sources: a) best estimate decay heat as a function of time; and b) a c;nservative value of stored heat due to temperatures above saturation in the fuel, core internals, and cool nt inventory. These values are functions of the decreasing sa' iration temperature (determined by the measured and recorded core aturation pressure as a function of time).
The isolation condenser capability was evident frca the measurec pressure decreases when the isolation condensers were cperating (pressure would increase if all steam were not condensed).
- 7) The assumed flow into the core region :nrough tne Control Rod Dri"e (CRD) pumps varica among tne several groucs' calcul ations fren 40 g;m to 130 gpm. NRC staff calculations were performeo for 130 gcm and 100 gcm (55 and 50 gpm each). versey Central Pcwer and Lignt celieves tnat the two-pump total CR0 flow cirectly to the core region is at least ou gpa, and their best estimate is over 100 gpm.
c3I/.
121
. i 40 gpm, CRD flow) probably contain conservatism resulting from assuming 20 to 60 gpm less CR0 flow than actually existed.
Results of all calculations performed utilizing the above methods indi-cated a minimum two phase mixture water level above the core between 1.0 and 3.5 feet above the top of the active fuel (
i.e., individual calculations from the groups were within that range).
Time-of-occurrence of the minimum level varied frca 7.5 to 32 minutes after scram.
The NRC staff calculation indicated the most margin (3.2 feet) and the earliest n 'nimum level time (7.5 minutes af ter scram). The other groups' calculations conservatively included lowering of core water level due to lower plenum contraction caused by recirculation ficw, which the NRC calculations had neglected. Condensate from the isolation condenser flowing from the annulus through the five 2" lines into the hotter lower plenum (i.e., the recirculation flow) would cause the lower level due to volume shrinkage in the lower plenum.
The other groups' calculations also conservatively included a larger amount of core-intervals and fuel-stored-heat being removed (cy steaming) from the cor? than did the NRC staf f calCu.Jtions. Approximate correC-tion of the NRC staff calculations for these effects results in reason-able agreement with the other calculations (i.e., within the range of the other resul ts). The staff's calculations were preliminary in prepar-ation for evaluating the licensee's calculations.
To further alleviate any potential concerns regarding the role of void calculations and assumptions on the minimum calculated water level, GE performed a calculation which removed the " credit" for voids at times after t=172 seconds out kept the penalty for voids at t=172 sec. Tnat is, in calculating initial core water inventory, the measured level at t=172 seconds was corrected (reduced) for c lculated, void content present at that time. The calculation :nen started with this artificially re-duced inventory; reducea (collapsed) water level vs ' time was calculated assuming no swelling in the core or upoer plenum (residence time of voids in the core of zero, or all steaning occurs at tne uoper surface are equivalent conservative assumotions).
This calculation, even wi tn these conservative assurptions, precicted a minimun collapsed level of 1.67 feet aoove tne core.
L:
hf
_g.
Also, additional calculations performed by Exxon Nuclear Company s'
utilized a different basic method (a mass inventory allocation process) to distribute the available mass througn the system depending upon known volumes along with measured levels and measured thermo-dynamic conditions. These calculations shared dependence with the otner cal-culations on void distribution and initial inventory di stribution.
However, they did not share dependence on heat transfer and steam pro-duction calculations since inventory in the core region was inferred by tracking all other regions (with available, recorded measurements taken during the May 2 incident) and subtracting the sum of the masses in the other regions frca the initial total system mass (which was constant except for an assumed 40 gpm CRD flow). Results of those calculations were in agreement with the first set of calculations described, predictinc a minimum two chase level of 1.02 f t. aDove the core at 12 to 32 minutes a'ter scram.
d) Conclusions On the basis of the acceptable MCPR calculations reported above in Section (b) and on the basis of agreement of all (independent) calculations reported in Section (c) that the water level remained above the core, and the conservatisms described that are present in the methods used, we conclude that the two phase mixture water level did not drop below the top of the core curing the May 2 event and no fuel damage occurred.
II.A.2 Primary Coolant and Off-Gas Analyses The licensee and the staff have examined the radiochemical records for empirical evidence of core damage. The primary coolant sample analyses, frca before and for several days af ter the transient, showed no unusual increase in the concentrations of ra'dionuclides.
The Iodine-131 concentration went up by a factor of two at shutacwn but iodine spikes of that magnituce at shutccwn are normal due to reactor system depressurization.
The readings frcm the stack and steam air ejector radioactivity monitors are continuou3'y recorcec on a strip chart.
The strip chart arounc tne time of t.*e incident snowed no unusual increase in the release of aircorne r24 i c ac ti v i ty. There were spikes in tne stack reading at snutccwn and wner the mecnanical vacuum cumos uere started. But again, off-gas increases are normal at snutacwn and when mechanical vacuum pumos are started.
Thus, tnere is no indi-cation frca eitr.er the primary coolant analyses or tne off-gas rates Si7 123
t that there was any abnormal release of fission products frcm the fuel due to the transient. Therefore, we agree witn the licensee's con-clusion that the radiochemical records provide evidence that the core was not damaged as a result of the event.
II.B Licensinc Basis Loss of Coolant Inventory Transient The licensee has sucmitted an analysis of the most severe postulated loss of reactor coolant inventory transient at the Oyster Creek Nuclear Generating Station. The purpose of the analysis is to snow that with the revised Technical Specifications water will not fall below the icw-low-low level. Our evaluation of the licensee's Dcunding analysis is proviced in the following sections.
118.1 Low-Low-Low Water Level Safety Limit At the time of the May 2,1979 esent, paragraph 2.1.0 of the Oyster " reek Technical Speci!.' cations defined a water level of 4'-8" aoove the top of the normal active fuel zone to ce a fuel cladding integrity safety limit.
Technical Specification 2.1.2 states:
"Whenever the Reactor is in tne shutdown condition with irradiated fuel in the reactor vessel, the water level shall not be less than 4' 8" above the top of the normal active fuel zone." The purpose of this limit was to assure acecuate margin for decay heat cooling of the fuel curing periods when the reactor is shutdown and corresponds to the lowest reactor vessel water level that can be moni-tored. As a result of the event of May 2,19b, however, it was recognized by both the licensee and us that the low-lcw-low water level safety limit is applicable to all operating modes. We and the licensee agree that a water level above the core tnat can ce monitored is an appropriate basis for con-cluding that significant fuel failure does not occur.
Accordingly, the licensee has proposed, that tne subfect Technical Specification definition be changed i.c make clear that ".he low-low-low water level (4' - 8" above the top of the active fuel zone) i s a sa fe ty limit applicaole to all Todes of oceration including transient conditions.
Low-low-low water level ceccmes the safety limit acplicacle to One licensing oasis loss of s
. ant inventory transient.
This is acceptable.
517 124
. II.B.2 Boundina Event Description In order to assure that Oyster Creek will not violate the triple-low water icvel safety limit during any anticipated operational occurence, the licensee has analyzed the postulated transient event which results in the largest loss For Cyster Creek, the licensee states (g{ reactor coolant system inventory.
that a total loss of feedwater (LCFW) starting from hot full power, results in tne most severe reduction in reactor vessel water levels.
For the LOFW event, feedwater flow to the reactor vessel rapidly falls to zero. Thus, with full power reactor heat generation continuing, steam flowing from the reactor to the t'Jroine causes reactor water level to decrease rapidly. For Oyster Creek, a reactor scram occurs when water level in the annulus reaches the " low" water level set point which corresponds to a height of 11'-5" aDove the top of the active fuel rtgion. The roactor scram causes a further rapid drop in water level in the annulus as the reduction in heat generation rate results in a marked decrease in the core void content. Steam generation continues causea by core decay heat and stored heat effects. This steam continues to exit the reactor thereDy causing a continuing water level cecrease in the vessel.
When water level in the annulus reaches the " low-low" water level setpoi,it, corresponding to 7 '-2" aDove the top of the active fuel region, main e ceam line isolation valve closure will automatically initiate to terminate in-ventory loss from the reactor vessel.
Inventory loss is ccmpletel' te rmi n-ated when the MSIVs are fully closea. For Oyster Creek, the low '.cw water level also initiates an ATWS pump trip. A small water level swe'.1 occurred in the vessel annulus due to the reauced core flow and the increased core voicing. Additionally, low-low water level in the annulus corresponds to the isolation condenser initiation set point. Thus, af ter a short time delay the drain valves of the isolation condenser would start to open to remove core decay heat and stored heat frcm the isolated reactor 5;;:el.
Since the isolation condenser piping system normally is filled with liquid water, some inventory makeup can also be suppliea to the reactor vessel when the system actuates. Witn tne isolation condensers actuated the reactor
~
systen would depressurize and coc1 down. Continuec depressurization coolcown, and shrinkage of tne contained inventory would occur until core sora; ficw would restore tne decreasing water levels in the reactor vessti.
51/
125 "WW*Me W
Qw
. We have compared the LOFW event to other transient events postulated for
./
Oyster Creek. We agree that the LCFW transient described above will result in the 1argest inventory 1oss from the reactor vessel should it occur. However, the distribution of this inventory within the reactor vessel (e.g. downcomer and core regions) is dependent on reactor coolant pump Condition (running or not running) and reCirCJlation loop discharge valve and bypass valve positions.
For analysis purposes the tripping of all recirculation pumps at low-low water level, conservatively accounts for the shif ting of reactor vessel inventory away from the core region and towards the annulus region. The effect of recirculation icop valve posi-tions is exolicitly accounted for in the analysis assumptions (see Sec-tion II.B.4) and in the plant Tecnnical Specifications (see Section III).
11.8.3 Codes and Methods The calculational methods which were used to determine the minimum water level over the core in the event the limiting loss of coolant inventory consists of two parts. The first parf5jtilizes ; e xxon Nuclear Company PTSBWR2 plant trarsient analysis code to calculate reactor vessel inventory and water levels for the first 125 seconds of the transient.
The second part utilizes a degenerative (special) case of calculational methoas discussed in Section II. A.1, herein, to extrapolate to the minimum water level over the core during the cooldown-depressurization phase (when the isolation condensors are operating) until core water level recovery occurs as a result of core spray system flow initiation. Addi-tionally, the second part includes methods to assess the effect of dis-charge valve position on the steady-state water level in the core region.
The PTSSWR2 Code which has been used in connection with previously ac-ceptec Oyster Creek plant transient simulations for core reload applica-tions, was modified to mocel the automatic initiation and heat removal characteristics of the isolation condensers. The addition of this model thereby enacles simulation of the steam condensing (heat removal) function of the isolation condensors suDsequent to reactor. vessel isolation. Con-servatively, no credit for the inventory associated with the suDccoled water normally storea in tne isolation concenser was inclucea in tne revised version of tne PTS 2WR2 Code.
Botn isolation concensors were modeled in the analysis. A tine del ay frca the time of low-law water level to initiation of the isolation concenser crain valve opening was also includec.
51/
1c0 p-
. The ef fects cf discharge valve position on s a.~ -state water level in the core region was evaluated with a hydraulic analysis of the recirculation lines. This analysis modeled the recirculation line geometry wi tn standard fluid mechanics methods.
The methods included the geometric pressure loss coefficients whicn includes a factor for the fixed rotor recirculation pump. The pressure loss coefficient for the recirculation pump was cased on in situ tests.
The other pressure loss coefficients involve standard methods and are adequate.
The analysis assumed differential driving heads between annuius and core regions whicn are within the range of values assumed for the overall analyses. The methods were used to calculate the natural circulation flow from the downcomer region to the core region.
II.B.4 Assumptions The licensee's bounding analysis assumptions (3) which can significantly affect the calculated ractor coolant system inventory lost during the transient have been evaluated, together with the assumptions whicn can adversely affect the calculated distribution of inventory be-tween the vessel annulus and the core region. Collectively these assumptions should result in a conservative prediction of the mini-mum water level over the core during the transient.
Inventory Loss Assumotions The analysis was performed assuming an initial full power level of 1930 MWt.
This power level, in conjunction witn the assumed low reactor water level scram, will maximize tne rate of inven, tory lost f rca the reactor vessel up until the ccmplete closure of the main steam line isolation valves. The total reactor coolant inventory lost from the reactor vessel up to the time of MSIV closure has been conservatively moceled.
The analysis assumes feecwater ficw into the reactor vessel f alls to zero in 3.5 seconcs witn MSIV closure initiated on low-icw water level in tne annulus. Adai-tionally, the MSIV closure time is tne maximum (10 seconds) per-mitted by tne present Oyster Creek Technical Specificaticns.
To prevent additional reactor coolant inventory loss wnich might otheraise occur cue to system repressurization (af ter MSIV closure) the analysis takes credit for the heat removal and pressure control 51/
1u7 9
~
, functions of the Oyster Cre(k isolation c:ndensers.
The analysis assumes automatic actuation and operation of both isolation con-densers for heat removal and pressure control, although no credit has been taken for the subcooled inventory of water normally stored in the isolation condenser piping.
The analysis results are ocsea on automatic initiation of the isolation condensers caused by the decreasing water level in the annelus being sustained at or below the low-low water level setpoint for 10 seconds. After the 10 second time delay, the isolation condenser drain valves are assumed to coen fully in 20 seconds. Aaditionally, the analysis conservatively takes no credit for the small source of inventory makeup associated with control rod drive flow.
In summary, it is assumea that after MSIV closure no reactor coolant inventory loss er makeup oce.urs until core spray ficw termiriates the decrease of core water level.
Inventory Distribution Assumotions The actuated isolation condensers are assumed to depressurize and cooldown the contained reactor coclant mass to a reactor pressure at which core spray flow makeup would start to raise reactor vessel water level s.
The cooldown results in an ir. crease in reactor coolant density, thereby causing an additional drop in reactor vessel water l evel s.
The core water level analysis assumes no voids are present in the system at Saturation conditions.
Thus, the actual height of the two phase mixture in the core region is conservatively accounted for from a density viewpoint. Finally, the distribution of coolant inventory (between annulus and core) has Deen accounted for based on no forced recirculation flow (due to a reactor coolant pump trip on low-law water level) ano a maximum of one unisolated recirculation loop. The above conditions will result in tne most adverse distribu-tion of coolant inventary within the reactor vessel.
In summary, the above combination of inventory loss and inventory distribution assumptions provides an adequately conservative basis upon wnich to calcul ate tne minimum core water level attained during the limiting loss of coolant inventory transient.
51/
\\23
- m6m-
.h me e
. IIcR.5 Results The results of the limiting loss of coolant inventory transient from initiation to 125 seconds, as calculated oy the PTSBWR2 Code, are proviced in Reference 3.
The results show that vessel annulus water level drops rapicly reaching the low level reactor scram setpoint corresponding to 11'5" acove One top of the active fuel within 4.5 seconds. At 15 secunds, the iow-low level setpoint, corresponding to 7'2" above the top of the active fuel, is reached initiating MSIV closure and a trip of all reactor coolant pumos.
Core spray pumps are signalled to start at this time although reactor pressure is sufficiently high to prevent any inventory accition.
The voiding in the core caused by the tripped recirculation pumps causes level in the annulus to start increasing and recovering low-low water level af ter approximately 3.4 seconds. This result is not consistent with the 10 second sustained low-law water assumed for initiating opening of the isolation condenser drain valves described in Section II.B.4 HowevEr, the licensee has committed to propose Technical Speci-ficaticns (see Section III) which will acceptably resolve this inconsi stency. The proposed technical specifications will require a sustainec low-low water level for three seconds or less to initiate opening of the isolation condenser drain valves.
In view of the predicted margin to icw-low-low water level for this limiting (see discussion below) event we consider giving credit for prompt manual initiation of the isolation condensor subsequent to reactor isolation acceptable until the proposed technical specification is impleuented.
The minimum annulus water level af ter MSIV closure and before cooldown cepressurization begins is 5.36 f t. above the top of the active core and occurs at approximately 35 seconds. However, continuec depressurization, cooldcwn, and shrinkage of the contained inventory occurs until core spray flow recovers the cecreasing water levels in the reactor vessel.
Based on the methods and assumptions
( evalua ted in Sections II.S.3 and II.3.4, respec ti vely') usec to extrapolate the eater inventorygistrioutions and levels, the minimum attained collacced water level' is 6'7" acove the toc of tne active fuel.
This result incluces tne effect of recirculation loco a schar:e valve posi tions on ste3cy-sta te wa ter level s.
That is, with only one recirculation icoe assured unisolated, recirculation ficw is sufficient to prevent acilotf frca reducing core water level celcw 6'7" accve the top of the active fue?
II.B.6 Conclusions The above resul t is accep*.aole in that the Icw-low-low water level fuel claccing integrity safety 1imi is not viol atec.
Our evaluation of the revisions to tne plant Technical Specifications which are consicerec necessary anc sufficient to complete the imple-mentation of tne iccortant analysis assumptions and results acpears in Section III.
517 129
III.
TECHNICAL SPECIFICATIONS The licensee has proposed several changes to the Oyster Creek Technical Specifications to clarify the appropriate limits for transient events which result in a loss of reactor coolant inventory and to provice assurance that the reactor coolant system configuration and mitigating equipment taken creoit for in the bounding loss of coolant inventory analysis will be in accordance with tne analysis assumptions.
A dis-cussion of these changes follows.
III.A Safety Limits As discussed in Section II.B.1, the licensee has proposed that the definition of the low-low-low water level fuel cladding integrity safety limit appearing in paragrach 2.1.D of the plant Technical Speci-fications, be clarified to specifically provide for applicability to all modes of reactor operation.
Based on our evaluatiop4jn Section II.B.1, this is acceptacle. The licensee has also proposed to add a safety limit appearing as paragraph 2.1.F in the plant Technical Specifications which requires that curing all moces of operation (except when :ne reactor head is off and the reactor is flooded to a level above the main steam nozzles) at least two (2) recirculation icop suction valves and their associated discharge valves will be in the full open position. Based on our evaluation appearing in Section II.B. herein, the acceptability of this requirement is conservative relative to the assumptions used in the bounding loss of coolant inventory transient analysis.
III.B Limitina Safety System Settinas The licensee has taken credit for the automatic protective aceration of the isolation concensers for acceptably terminating the 1imiting loss of coolant inventory event. To assure the procer initiation and operation of the isolation concensers on icw-low water level in the annulus in ac-corcance with the bouncing analysis assumptions, the licensee nas proposed to add a limiting safety system setting recuirement to Section 2.3 of tne Cyster Cree ( cl ant Tecnnical S:ecifications. The S;ecification will state tnat tne liniting safety system setting is the icw-icw water level setpoint anicn aas assumec in tne ocunaing analysis, i.e., 7'2" above the tcp of the active fuel. The limiting safety system setting =ill incorporate a maximum tnree (3) second time celay to assure tnat tne system will not fail to initiate cecause low-low water level accentarily clears as a result of tne water level swell in the annulus caused by a simul-taneous recirculation pump trip. Additionally, based on our review of 5i7
?30
. actual plant operating data of isolation condenser initiations and possible isolation, a time delay of three seconds or less will not d
cause the isolation concensors to reisolate on high flow conditions caused by recirculation cump coastacwn ef fects. Tnis time celay will also be adequate for recirculation ficw coastccwn effects applicable to four loop operation as well. The limiting conditions of operation and surveillance requirements for the isolation condenst ? will not be changed.
IV.
OPERATING PRCCEDURES We have reviewed both the operating procedures (including standing orders) which were in effect at Oyster Creek at the time of the May 2,1979 event, and the revisions of these operating procedures as a result of the event.
The former procedures were reviewed to evaluate shether the operator actions curing the event were wnolly in conformance with the procedures then in effect. The revised procedures were reviewed to evaluate their consistency with the bounding analysis assumptions (discussed in Section II.B.4) and the resulting technical specification changes (described in Section III).
IV.A Operatcr Actions The following is an evaluation of the correctness of the operator actions relative to the plant operating procedures which existed at the time of the May 2,1979 event. Our evaluation is itemized by procedure.
1.
Procecure 514, Rev 2 " Reactor Isolation Scram" This precedure is pertinent to the May 2,1979 event since the operator manually closed all four main steam isolation valves 43 seconcs af ter the reactor scrammed to minimize the loss of coolant inventory. Tne closure of tne MSIVs, altncugn not specifically recaired in the par-ticular prccecure, was tne proper action to take ac; was taken promptly.
This procedure requires the coerator to verify :nat a reactor isolaticn was initiated if a reactor Icw-Icw water level or reactor hign-pressure concition exists. The low-Icw water level is measured in tne ccwn-comer (annulus) out was never reached curing the event. Tne hi;n reactor pressure signal whicn occurred was scuricus anc was not sustained for tne delay time needed to initiate isolation Cooling. The subject procecure requires the cperator to manually actuate systems tnat have not auto-matically actuated.
Thus, he correctly actuatec tne isolation concenser in order to estaolisn an alternate heat sink.
All apprcpriate immediate and subsequent coerator actions were completed by the operators as required by tnis procecure.
51/
i3i
. 2.
Procedure 511.1, Rev 1 "Feedwater Pump Failure" This procedure states that a reactor low-low level condition may be experienced in the case of a trip of all three feedwater pumps.
How-ever, since the low-low water level conaition was not attained for the subject event some of the automatic actions listeJ in 'he procedure did not occur. Among the significant immediate and suosequent operator ac-tions requirea for this situation is to restart one or more feedwater pumps. Ten seconds after scram the operator did make an attempt to restart the only feedwater pump powered by a live bus. The control roca operator was unsuccessful since a tripped overload condition existed on the motor drven auxilidry oil pump. No further attempt was made to restart this only available 'eedwater pump until 31 min-utes and 54 seconds af ter the scram since the low water level alarm had cleared at 90 seconds and water level was normal. 31 minutes and 54 seconds, after the reactor scrammed the operator started the "C"
recirculation pump which resulted in a level decrease in the downcomer.
At this time, the operator made a second unsuccessful attempt to start the feedwater pump. However, operating personnel dispatched to the feed-water pump station locally started the auxiliary oil pump allowing feed-water pump A to be successfully restarted at 36 minutes and 48 seconds.
No procedure violations occurred and all actions taken were in accordance with the procedure.
The time delay to locally start the auxiliary oil pump appears to be somewhat long but is =ot considered unreasonable since other operator actions were being taken at the time. Additionally, since water level in the annulus during most of the event was normal, this delay is understandable.
One cf the subsequent operator action steps required by the procedure is to place a recirculation pump back into service. This was done at 31 minutes, 54 seconds but the pump was immedia.tely tripped manually.
Another recirculation pump was started 36 minutes and 40 seconds af ter the scram.
3.
orocedure 301, Rev 4 " Nuclear Steam Supply System,"
This procecure addresses rcutine oceration including startup and shut down of :ne main steam and recircul ation systems. Section 7.0 of this procedure is enti tled " Removing a Reactor Recirculation ?umo frem Scrvice." The " Precautions and Limitations" suosection incluces the b
98-N
' folicwing statements:
"Never isolate all recirculation loops at the same time. The suction and discharge valves of at least one recirculation ' cop shall always remain open and, if possible, at least one pump should always be running to provide continuous circulation and indication of reactor vessel water level." This condition was violated since all five recirculation discharge valves were Delieved to be simultaneously closed 76 seconds after the scram and were oefinitely observed to ce closed 186 seconds af ter scram.
Furthermore, all five discharge valves remained closed until 31 minutes, 53 seconds af ter the scram wnen a recirculation pump was started and its associated discharge valve reopened. Although both the violation and precaution in the procedure are considered to be clear, the subject event caused some complications which may have contributed to the procedure violation. Standing Order "23 in effect at the time of the event reouires the operator to close the A and E loop discharge valves to prevent the isolation concenser from isolating itself as a result of high ficw conditions. The "D" loop discharge valve was closed prior to the event since the associated pump was out of service.
The above precaution required the operator to have at least one pump running. To start one of the pumps, it is necessary (by procedure) to first close the asso-Ciated discharge valve. The logical pump to start was pump C since it was powered by a live bus and was not in a loop connected to the isola-tion condenser. The pump was started at 31 minutes, 54 seconds.
There-fore, the operator was required to close three discharge valves but made the error of closing four discharge values.
There would appear to be some basis for confusion since the term " isolated" as used in the procedures can be inferred to describe either closing the discharge valve or closing both the discharge valve and the discharge by-pass valves simul taneously.
During the entire event, all five discharge bypass valves were open, however.
4.
Procedure 307, Rev 3 " Isolation Condenser System" Standing Order No. 23 Rev 0 (dated 11/15/77)
" Isolation Condensor Operation" The section of Procedure 307, applicable to this event requires the oper-ator to cont-cl reactor pressure and limit the cocidown rate to less than 100 *F /H r.
Procedure 307 does not mention the relationships between isolation concenser and "A" and "E" bypass and discharge valves.
51/
133
. closing the discharge valves is intended to prevent automatic isolation of the isolation condenser systen. Based on our review, we believe that there were no violations of any of the steps in either the procedure or standing order.
Procedure 502.3 Rev 1
" Loss of 4160V Bus l A, B, C, 0" Procedure 510 Rev 2 " Turbine Trip" Based on our review of these two procedures and the operator actions we believe that no procedure violations occurred curing the May 2,1979 event.
IV.B.
Revised Plant Oceratina Procecures The Of fice of Inspection and Enforcement has reviewed the revised Oyster Creek operating procedures to evaluate whether they adequately implement the revised Oyster Creek Technical Specification requirements.
V.
START-UP SURVEILLANCE PROGRAM As stated in Section IIA 2, there is no indication from the primary coolant ccncentrations or the off-gas rates that any abnormal release of fission products from the fuel occurred during the transient.
However, some fuel damage can be detected in either the primary coolant concentrations or the off-gas rates curing startup and ascension to full power. The licensee has designed a surveillance program to identify signs of fuel camage occurring during restart.
This program, wnich tne licensee has committed to during this startup, is described below.
The off-gas rates frcm the air ejector and the stack will be continu-ausly monitored. The primary coolant will be sampled and analyzed for garna-emitting radicquclides on the following schedule:
- 1) P re-s ta r tu p
- 2) 250 e average reactor coolant tercerature
- 3) SCO psig reactor system pressure
- 4) 20t tnermal power
- 5) 10% thermal cower increments ap to full power
- 6) Daily for 14 cays after reaching full power f/
f}f
-w
Air ejector off-gas samples will be taken and analyzed for isotopic content on the following schedule to ensure proper calibration of the continuous off-gas monitors:
- 1) 20% power
- 2) 40% power
- 3) 60% power
- 4) 80% power 5) full pcwer
- 6) Weekly for 14 days af ter reaching full power.
Two additional air ejector samples will be taken each week for 14 dayr after reaching full power. These samples will be analyzed for gross gamma only.
If the ratio of snort and long-lived emitters changes, further sampling and analysis will be performed.
The surveillance program includes adequate frequency of sampling, analysis and monitoring of the primary coolant concentations and off-gas rates to ensure that signs of acnormal fission product release resulting from the transient will be identified quickly.
These are the criteria by which the licensee has committed to judge the information on primary coolant concentrations and of f-gas rates from the surveillance program.
Iodine-134 and Iodine-135 will be used as the indicator nuclides in the primary coolant analyses.
These nuclides reach equilibrium concentrations for the varicus pcwer levels quickly because of their short half-lives. The bases for the criteria will be the primary coolant concentrations and of f-gas rates experienced at Oyster Creek at full pcwer before the transient. All of these criteria will be applied to both tne primary coolant concentrations and the off-gas release rates.
For startup evaluations up to 50% power, no action will De taken if 100% of the case levels are not exceeded.
If 100% of the base levels are exceeded, pcwer level will De held and the samples and analyses receated until the 100% criteria are met.
If 200% of the base levels are exceeded, tne licensee will pecaptly initiate a reactor snutccwn until the proclem is rescived.
For startup evaluations between 50% and full pcwer, no action will be taken if 150% of tne base levels are not exceeced.
If 150% of the base levels are exceeded, acwer level will De neld and the samples and ar.alyses repeated until the 150% criteria are met.
Again, i f 200%
of the base levels are exceeded, ne licensee will snut down the reactor until the prcolem is resolved. For two weeks af ter reaching full power, L
J[/
i r
!JJ
. the licensee will continue evaluations of tne off-gas rate.
If 125% of the base level is exceeded, the sampling and analysis program will be augmented.
If 150% of the base level is exceeded, the licensee will reduce power to stay within 150% of the base level.
If 200% of the base level is exceeded, the licensee will shut down the reactor until the problem is resolved.
Before the incident, stack off-gas rates at full power were running at approximately 40,000 microcuries per second. A stack off-gas rate of 125%,150% or 200% of this base level would still be less than one-third of the rates allowed by technical specifications. Therefore,
',e cri-teria are acceptable. We request that the licensee notify us within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> if the reactor is shut down based cn these criteria.
VI.
OTHER CONSIDERATIONS VI.A.
Water Level Indication The level instrumentation in the Oyster Creek reactor reads only " collapsed" water level. Such a collapsed level is an indicator of water inventory, but does not necessarily correspond to a liquid surface height. This distinction is especially true within the core area during cperation, where liquid quality increases monotonically from the boiling boundary up to the steam separator, with no distinct liquid / vapor interface.
In the annulus, collapsed level roughly corresponds to the liquid level.
Moreover, the water inventory within the annulus is generally greater than core inventory curing operations and when annulus level is in the normal range, it is above the bottom -f tne steam separator skirts.
Thus, the whole core area is submerged under these conditions. Also, water is normally being drawn from the annulus and forced into the core. Thus, wnen supply is interrupted or inventory.is lost, it is the annulus level which will go cown at first, while core inventory will not change greatly.
The annulus level is continously monitored by three electric level (GE /MAC )
gauges (two narrow range anc one wice range) and 8 Yarway level gauges.
The Yarways reac cut in the control rccm anc are used as inputs to the hign, icw, and low-icw level se too i n ts.
The GE/MAC gauges are recorcea as well as reaa-cut in t.ne control rcoa. Moreover, tne GE/MAC signals are usec for feecwater control. One of the narrow range GE/ AC signals is for a strip M
chart recorder in tne control rocm.
G1JI!'
I ), D New h
. The water level in the core area is monitoreo by four Barton level gauges.
The four Bartons tap into the core spray sparger for their lower tao, and share reference columns with the GE/MAC instruments described aoove. The Barton gauges read-out locally, but only send a signal which initiates the low-low-low l evel logic plus a control room alarm.
Thus, core level is monitored only in the sense of an alarm signal' it is neither recorced nor observable by a control room operator.
At this point, it is essential to understand the purposes of the three low level setpoints. The low level setpoint is aoove tne lower ecge of the steam separator skirts. Actuation of tnis setpoint cause3 a reactor trip anc a group II isolation.
It is normal to reacn tne icw setpoint follcwing a reactor scram at power cue to voic collapse.
The low-Icw level causes a group I isolation (which incluces the MSIVs),
trips the recirculation pumps, initiates isolation cooling and starts the core spray pumps.
(However, core spray flcw will not start unless the reactor is depressurized.)
The low-low-low level starts the Automatic Depressurization System ( ADS) timer provided tnere is coincicent high drywell pressure and the core spray punps are operating. This is the only use of the low-lcw-Icw level signal.
Limitations of Water Level Indication Although annulus level is appropriate for feedwater control and water inventory monitoring curing normal and most upset conditions, it has no intrinsic safety significance except through its relationship witr.
core water level.
The annulus, core area and recirculation lines forn a large U-tube when tne recirculation pumps are not running, and the two level s < ioul d oe very nearly the same.
When the recirculation pumps are running and the core is shut down, the level in the annulus shculd be Icwer than tne (collacsec' core level, and therefore snoula be. a conserva-tive inaicator. Fcr the annulus level instrumentation to work procerly, the annulus and the core area must De in good communication at the bottom.
It is ncw apparer.t that the non-conservative situation (annulus level greater than care level) can exist if tnere is a restriction in tne recircul ation lines.
(This is only possiale in non-jet-cumps 3WRs, since the more accern ;lants always have gcca communication between :ne two regions tnrcugr the jet punos.)
The core water level instrumentation provide meaningful results only ahen there is no liquis ficw :nrcugn :ne steam separators. When there is ficw tnrougn tne separators, tre resulting differential pressure introcuces a non-conservative error in tne core water level reading. This is of no conse-cl,/
}j,,
J
/
. quence during power operation, since the core is filled with a two-phase level-less mixture, anc inventory is monitored in the annulus. The core area water level does become meaningful under low separato.- flow condi tio ns.
Thus, core area level inaication will not work unless eitner tne recirculation pumos are tripped or the collapsed core level drops so far that only steam enters the separators. This is the reason why the core level instrumentation is often called " accident" instrumentation:
the instrumentation is not operative under normal and most upset conditions.
In addition to the limitation described above, collapsed core water level is not linearly relatea to core water inventory. The horizontal cross-sectional area of this water volume is large above the core, narrows rapidly through the dome, and is small through the standpipes. Therefore, a constant inventory loss (in gallons per minute) will cause collaosed level to drop very rapicly out of the standpipes, but much more slowly in the large cylindrical volume immediately above the core.
The low-low-low setpoint is normally about hal f-way up the transitional (come) area between the two vol umes.
Finally, the lower taps of the core area level instrumentation are on the core spray spargers. The instrumentation cannot monitor water levels below these spargers.
Summary The primary safety concern for level instrumentation is that the level setpoints nust be assurea to occur in proper sequence.
This implies that the core and annulus water volumes must not be partially isolated frcm one another. Given this, all safety analyses remain valid and bounding.
In addition, it is reccmmended that a read-out of the core level instru-mentation be provicea in tne control rocm.
Thi s read-out coul a. inform plant ocerators during an accicent situation.
Such a read-out is pro-videa in new plants.
The licensee olans to acd level instrumentaticn with a tap at 3 still lower elevation (e.g. the core differential pressure tao) be investigated in the longer term. Presently, tnis plant cannct m.onitor levels belcw :ne core stray soarger. Al though such si tuations are not likely and al so nave been b;unced oy accicent analyses, ae consider accitional level i ns trunen ta ti o n pruder t.
517 13g VI.B Potential for Transients Due to Surveillance Testing The event on May 2,1979, at Oyster Creek occurred when a gauge valve was opened to verify that an excess flow check valve in the instrument line was still in tne open position. The instrument line feeds pressure switches which actuate the reactor and recirculation pump trip systems.
A simultaneous reactor trip and recirculation pump trip resulted from this surveillance testing of tne isolation concenser pressure switches.
Confirmation tnat the cneck valve is open is necessary af ter tne sur-veillance test to assure that the pressure switches are hydraulically communicating with the reactor vessel and can, therecy, sense any changes in reactor cool ant system pressure. As the valve was opened, fluid enterea the gauge line and stopped abruptly when there was no more roca for fluid motion. This caused a short term pressure transient of sufficient duration to actuate the press. e sensing switches for the reactor trip system.
A reactor trip resulting from the test to confirm that an excess flow check valve is in its proper position for normal operation has not been a recurring event at the Oyster Creek plant.
Al though a reactor trio is not an unexpected event and several may De expected over the lifetime of a plant, the possibility for unnecessary reactor trips of this nature should be mir.imizea by proper procedure and design.
Unnecessary reactor trips can be eliminated procedurally by instructions which result in slower opening of valves or Dy closing the oleck valve to one set of sensors wh le "e check of the excess flow check valve is made.
It may also be pass.
5v design to significantly reduce the spurious signals by utilizing e.uner fine control test valves or self indicating excess ficw check valves.
We conclude that it is desirable to reduce the likelihood of spurious scram signals but it i not necessary tc assure tne heal th and safety of the public.
The licensee has stated that modifications to surveillance testing procedures are in progress to recuce the likelinood of 3 similar cccur-rence and that the cesign will oe reviewec to cetermine the need for equipment accifications for further imorovement. de nave recuestec that tne licensee sucmit nis findings prior to the startup af ter tne next refueling outage.
5 j ~/
I/
17 IJ
~
. Yll CONCLUSIONS We have evaluated both the current condition of the core and the adequacy of cnanges being made to prevent a recurrence of the significant events that happened at Oyster Creek on *1ay 2,1979.
The condition of the core was evaluated both analytically and empirically. The analytical evaluation (Section II. A.1) demonstrates by conservative tneraal-hydraulic calculations that the licuid level did not drop belcw the top of the core.
The evaluation (Section II. A.2) of the radiochemical records supports a conclusion that the event caused no fuel failures.
Therefore, we conclude that the Oyster Creek core is currently undamaged. Additionally, the licensee has established a surveillance program to monitor for sicns of fuel damage occurring during the subsequent restart. We consider the surveillance an acceptacly prudent measure and request notifica-tion if any of the criteria of Section V are exceeded.
We agree with the licensee's proposal to make the triple low alarm a safety limit for all reactor acces. This provides a measurable basis for concluding that the core is covered.
We conclude that the hydraulic communication between the annulus and the core is acequate whenever more than one recirculation loop dis-charge valve is open. This requirement will be assured by the proposed Technical Specification.
We conclude that the loss of reactor-vessel-inventory analysis provided adequately ocunas transients of this nature.
Two key assumptions of the analysis are now covered by Technical Specifications because of the impor-tance of automatic actuation of the isolation condensor at douole-low level.
Both the double-lcw level and the maximum time delay before isolal stion condensor value opening shall De included as limiting rafety system settings.
In addition, we have recommended incrovement; for Cyster Creek regarcing level indication and surveillance testing. Inese were discussed in Section V:.
Basec on tne foregoing, e corclude tnat there is reasonaole assurance that operation of the Oyster Creek facility can De resumed witnout uncue risk to the health and safety of the public.
f VIIk REFERENCES 1.
Letter dated May 12, 1979, from I. Finfrock (JCP3L) to URC and an enclosed " Report on the May 2,1979, Transient at the Oyster Creek Nuclear Generating Station."
2.
Letter (undated), received by NRC on May 17, 1979, from I. Finfrock (JCPdL) transmitting ENC Report XN-NF-79-47, "Evalua tion of the Oyster Creek Reactor Core Licuid Level Following the Inadvertent Reactor High Presure Scram on May 2,1979," cated May 11, 1979 (Issue Date: May 15, 1979).
3.
Letter dated May 19, 1979 from I. Finfrock (JCP3L) to NRC enclosing an analysis titled " Bounding Loss of Coolant Inventory Transient for the Oyster Creek Plant."
4.
Letter dated May 19, 1979 from I. Finfrock (JCP&L) to NRC requesting changes to Technical Specification 2.1.0 to extend tne applicaoility of a safety limit, and a new Section 2.1.F to prevent the isolation of pump loops.
5.
J. D. Kahn and M. S. Foster, PTSBWR2 - Plant Transient Simulation Code for Boiling Water Reactors," XN-74-6 Revision 3.
6.
Telecopy, " Responses to Staff Questions on May 19, 1979 Submittal, Loss of Inventory Trar..ient Analysis," received by the NRC on May 23, 1979.
J
APPENDIX DESCRIPTION CF TRANSIENT AND SE0UENCE OF EVENTS RELATED TO SCRAM OF MAY 2,1979, AT OYSTER CREEX NUCLEAR GENERATING STATICN (EDITED FRCP. JERSEY CENTRAL POWER 3 LIGHT CO., LETTER / REPORT D 05/12/79)
INITIATING EVENT:
On May 2,1979, at 1350 hours0.0156 days <br />0.375 hours <br />0.00223 weeks <br />5.13675e-4 months <br />, an inadvertent reactor high pressure scram occurred during required surveillance testing on the isolation condenser high pressure initiation switches.
Two of the four reactor high pressure scram sensors share a common se line with the isolation condenser high pressure initiation switches being tested.
The technician performing the test was in the process of verifying that the sensing line excess flow check valve was open when the scram occurred.
The scram has been attributed to a momentary simultaneous operation of tw o of the reai ir high pressure scram sensors due to a hydraulic disturoance associated with valve manipulations which was required by procecure to ve
~
position of the excess flow check valve.
These sensors are also used in tne automatic recirculation pump trip logic which tripped the four operating recirculation pumos.
The hydraulic disturoance also caused a mcmentary trip of the isolation concenser initiation swit:nes.These sensors were not closed long enougn for automatic initiation of tne isolation concensers since a ti me delay is involved in the initiation logic.
5i7 142 e
O'
. INITIAL CONDITIONS:
Plant Parameters at the Time of the Scram:
Reactor Power 1895 MWt Reactor Water 79" Yarway (13'4" Above the top of the active fuel) 6.4 ' GE' TAC Reactor Pressure 1020 psig 6
Feedwater Flow 7.1.x 10 lbs/hr 4
Recirculation Flow 14.8 x 10 gp-Ecuipment Out of Service Relevent to Event Seauence A.
One (SB) of the two startup transformers was out of service as permitted by Techcnical Specifications to inspect associated 4160-Volt cabling. SB supplies offsite power to one half of the station electrical distribution system when power is not available through the station auxiliary trans-fo nr.e r.
The 4160 Volt buses which receive power frca SB are 18 and 10.
Bus ID supplies power to certain redundant safety systems. Bus 10 is designed to be powered fro:n 42 Diesel Generator in the event power is not available from eitner the auxiliary transformer or startup transformer.
Bus IB sucolies 4160-Volt power te non-safety related systems and hence, does not have a diesel backuo power source.
f!
f(}
~3-B.
One (D) of the five recirculation icops was not in service d ue to a defective seal cooler cooling coil.
The pump suction valve was open, the discharge valve was closed, and the discharge valve c ypass valve was open.
No other important systems or components were out of se rvice.
EVEllT SECUENCE (Two = 1350 hours0.0156 days <br />0.375 hours <br />0.00223 weeks <br />5.13675e-4 months <br />):
TIME OF EVENT (Sec)
_ EVENT DESCRIPTION O
c or che reason previously cescribed a reactor scram occurred coupled with a simultaneous automatic trip of the four operating Recirculation Pumps.
The Control Rocm operator verifiet hat all control rocs inserted and proceeded to drive-in the IRM and SRM Nuclear Instrumentation
. At this time, 4160-Volt power was being supplied from the auxiliary transformer during the coast-down of the Turbine Generator System and the Feedwater System was in opera' ion.
Recirculation flow started decreasing due to pumo coastdcwn.
Steam flow started decreasing due to loss of heat production (scr3m) but feed ficw r3te remained at the rated level.
Reactor vessel pressure cecreased to the pressure regulator setpoint as steam flow decreased.
Reactor water level Degan decreasing due to steam void collapse in the core c
3,i
)'
/
t44 w-e
. TIME CF EVENT (cont)
EVENT DESCRIPTICN (cont)
~
13 The turbine Generator tripped at the no load trip point which initiates an automatic transfer of power ^.. auxiliary to the startup transformers.
..-cr v.s Buses lA and IC successfully transferred from the auxiliary transformer to the SA startup trans-fo rme r.
Since 58 was out of service at this time, power was lost to Buses 18 and 10.
As designed, Buses 18 and 10 separated through operation of breaker ID and Diesel Generator No. 2 f ast started to power emergency loads on Sus 10.
Loss of power to Bus 18 caused the loss of Feed-water pumps B and C and Condensate Pumps B and C.
Although power was available to the A condensate and feedwater pump via Bus l A, the A Feedwater Pump tripped on low suction press,ure. Reactor water level and pressure decreased since water was leaving the Reactor Vessel through the Steam Bypass Valves to the Main Condensers and no hign capacity source of hign pressure makeup water was available.
517
,s 4. cs
. TIME CF EVENT (cont)
EVENT DESCRIPTION (cont)
In addition, the loss of power to Bus 1B caused the B Cleanup System Recirculation Pump to trip which, in turn, caused an isolation of the Cleanup System due to low flow through the cleanup fil ter.
Furthermore, one condensate transfer pump and the operating fuel pool cooling pump tripped. An un-successful attempt was made to restart the A feedwater pump.
(The reasons for the restart failure are described later.)
(Event Recorder) 13.6 Reactor water level decreased to the Low level scram setpoint which is 11'5" above the top of the active fuel region.
(Event Recorder) 16.8 The output creaker on the No. 2 R,eactor Protection System M.G. Set tripped due to to~ss of power to the drive motor. The output voltage fron the M.G. Set had been maintained by flywheel action since the time of the turbine trip.
Power to the M.G. Set drive motor is fed indirectly thrcugh Bus 13 which was deenergized at this time.
5i/
I46
. TIME OF EVENT { cont)
EVENT DESCRIPTION (cont) 31 The No. 2 Diesel Generator Breaker closed and supplied power to the 10 Bus. A second control rod diive pump started.
43 Reactor water loss continued from steam flow to the main condenser. Reactor isolation was manually initiated to conserve water by closing the Main Steam Isolation Valves prior to an autcmatic isolation of the reactor on a Low-Low Reactor Water Level signal which occurs at 7'2" above the top of the active fuel region).
This action was taken at an indicated water level of approximately 30" on the Yarway instrument which corresponds to 9'8" above the top of the active fuel region. Note, that the decrease in indicated water level and pressure was amplified by the effects of in-traducing cold feedwater into the vessel during the 13 second period prior to the Turbine Generator Trip.
The cold feecwater recuced the steam voiding inside the vessel tnereDy shrinking the water level.
E
[fj
. TIME OF EVENT (cont)
EVENT DESCRIPTION (cont) 1 49 The Main Steam Isolation Valves fully closed, thus stopping the loss of water from the vessel.
The reactor steam pressure increased.
Indicated reactor water level started to increase shortly after iso-lation wnen reactor decay heat reestablished a steam void distribution.
(Event Recorder) 59.6 The operator transferred the acde switch from RUN to REFUEL.
76 (1 min. 16 sec)
The operator placed the B isolation condenser into service to establish a sink for the removal of decay heat from the reactor. At this time, the Control Roots operator closed the A and E recirculation 'oop discharge valves (these valves take approv',otely two (2) minutes to close).
It ik postulated that at this time, the operator closed both 3 and C loop dis-charge valves.
The conclusion that the five recirculation pump discharge valves were closed is based upon icoo temperature resconse later in :ne event and is further supcorted by tne Low-Low-low level at 172 seconds.
The 3 lcop was isolated pre-viously (see the equipment out of service section).
5i7 i48 memww NM
8 TIME OF EVENT (cont)
EVENT DESCRIPTION (cent)
(Event Recorder) 90 (1 min. 30 sec.)
The reactor Low water level alarm cleared as water r ater was added from the isolation condenser to the Primary Systen.
96 (1 min. 26 sec.)
The B isolation concenser initiation valve fully opened after 20 seconds.
The temperature of the recirculation 1 cop, which serves as the 3 isolatior, condenser water return path, decreased due to the effects of cold water frca the isolation condenser.
The D recirculation loop temperature did not change appreciably.
A, 8, and C recirculation loop temp-eratures increased slightly. The heat-up is attributed to natural circulation through the partially open dis-charge valves carrying hot water (536 F) warming the lines previously cooled by the effects of cold feedwater.
The reduced ficw area between the lower downconer and icwer plenum area, due to the sicw closure of the discharge valves, started to cause a shif t in water inventory frcm tne core area to the upper and lower do'incomer region.
The shift was due to the isolation f
ffG
9, TJoiE CF EVENT (cont)
EVENT DESCRIPTION (cont) condenser returning condensed steam from the core area to the downcomers. The water inventory shif t continued as the discharge valves moved to the full closed position.
(Event Recorder) 172 (2 min. 52 sec.)
The reactor Low-Low-Low water level instrument trip Last recorced point on point was reached.
186 sec. (3 min. 3 sec.)
All recirculation loop discharge vcives fully closed.
At this tima, based upon closure initiation, the cooldown of tne E recirculation 1000 stopped and a heat-up began. The indicated reactor water level increased due to the shif t in water inventory.
Recirculation loops A, B, and C continued to heat up.
The mechanism of the heat up was due to heat transfer between the hot recirculation loop c1 ping and the water in the piping.
Reactor pressure continued to decrease as a result of isolation concenser operation.
250 (4 min.10 sec.)
The operator removed B isolation concenser from service to reduce the rate of cocicown of :ne ?rizary System. The indicated annulus water level fell due to a return of water to the core region frcm tne downcocer region through tne five, two-inch Dypass valves around tne recirculation loop cischarge valves.
During this period, tne water was stored in the i/
!S0 recentir secureo isolation concenser-The rect :ulation loop discharge temperatures reached equilibrum and followec a slow cooldcwn trend.
. TD'E OF EVENT (cont)
EVENT DESCRIPTION (cont) 270 (4 min. 30 sec.)
The reactor pressure increased due to the effects of removing B isolation condenser.
The rate of decrease in water level shif ted frca a ramp of approximately 37 in/ min to 2 in/ min. The reason for this change is the isolation condenser tube assembly was completely filled. The flow through the five 2" bypass valves continued.
450 (7 min. 30 sec.)
Both isolation condensers were placed in service.
This caused an increase in indicated water level and a decrease in pressure. The A recirculation loop temperature decreased because cold water from the A isolation condenser entered the A recirculation icop by design. A portion of the water passed through the Icop via its 2" bypass line contributing to the cocl-down.
523 (8 min. 48 sec.)
The cperator remcved the 3 isolation concenser frcn service to sicw the rate of cooldown. The indicated annulus water level reached a maximum of approximately 14.4 feet above the top, f the active fuel (58" on Yarway:
This is considered to be at Sve ncrmal water level for full power operation. When the B 1 solation condenser
') f !
l}l g
, TIME OF EVENT (cont)
EVENT DESCRIPTION (cont) e was removed from service, indicated water level decreased to 13'S" above the top of the active fuel where it remained until approximately 1212 seconds when the A isolation condenser was removed from service.
The reactor pressure continued to cecrease and all recirculation loop temperatures continued to to trend downward.
Indicated water invel was stable at this time because the head of water in the down-comer region was sufficient to establish equiiibrium between the water entering the core region via the 5 two 1r.ch bypass valves and condensed steam returning to the downcomer from the isolation condensers.
540 (approx) (9 min)
The four (4) Low-Low-Low water leve1' indicators were verified locally to be below their alarm setpoint which is 10" above 4' 3", or 5 ' 6" above the core.
The reading appeared to be at or below :ne instrument's lower level of detection.
810 (approx) (13 min :0 sec) A recheck of the triple Low water level indicators showed that the pointers were active (moving) althougn they continued to read below their alarm point. The instrument was at or sligntly above its lower level of detection.
51/
!52
. TIME OF EVENT (cont)
EVENT DESCRIPTION (cont) 1212 (20 nin 12 sec)
The operator removed the A isolation condenser from service stopping tne removal of water from the core region.
Indicated water level decreased as the water in the downcomer, region ficwed into the ccre region.
Reactor pressure started to increase due to the decay hea. stean production.
1488 (24 min 48 sec)
The isolation condensers were used several more times to control the reactor cooldown with pre-dictable increases in indicated water level and reduction in pressure. This mode of operation continued until 1914 seconds.
1914 (31 min 54 sec)
In order to more correctly determine the plant cool-down rate C recirculation pump was started and the discharge valve was opened.
It was noted that the indicated water level dropped approximately 3 feet in less thar. 2 minutes. The operator shutdown the C recirculation pump and isolated it to investigate the reason for the drop in level.
In response to the indicated water leve! crco, an additional attempt was
.nade to start the A feecwate: pump. The pump had failed to start earlier due to a tripped overload en the auxiliary oil pump that is interlocked in the pump starting sequence. The indicated water level started to increase due to the action of the operating isolation S1/
!53
TIME CF EVENT (cont)
EVENT DESCRIPTION (cont) condenser transferring water to the downccmer region.
When the C recirculation loop was started the loop temperature increased from approximately 400 F to 470 F.
The other recirculation loop temperatures continued to trend down.
At this time Low-Low-Low alarm may have cleared.
2208 (36 min 48 see)
The A Feedwater pump was successfully started by locally starting the auxiliary oil pump shich satisfied the required starting interlocks.
Indicated water level increased to a level corresponding to 13'8" above the top of the active fuel regien.
Realization occurred that the indicated water level and core water
. level may not have been the same when it was recognized that the five re:irculation loop discharge valves were, closed.
2340'(29 min 0 see)
The A recircu'.atien pump was pfaced in service at a flow rate cf appr:ximately 1.9 x 104 gpm, thus removing the disparity between -ater level measurin, s; stems.
The L0w L:w Low water ievel alarms were krcwn t: be cleared at this time.
Indicated water level dropped approximately three feet to 11'4" above the t p cf the active fuel.
The A recircu'.atien locp temperature rose frcm 375*F to 455 F when it was placed in service.
Steps were initiated at this time to bring the plant to " cold shutdown ccndition".
9)l
)0b t
..,, TIME OF E'/ENT (cont)
EVENT DESCRIPTIO1 (cont) 2700 (45 min. O sec.)
Reactor Protection ',ystem 4'2 restored ard scram reset.
3600 (1 hr.)
The SB transformer was returned to service and Bus 1B was eneraized, and normal shutdown creceeded.
(8 hr. 40 min.)
Cold shutdown achieved.
e 51/
155
__