ML19246A687

Restart Ser

ML19246A687
Person / Time
Site:	Oyster Creek
Issue date:	05/30/1979
From:	Office of Nuclear Reactor Regulation
To:
Shared Package
ML19246A686	List: ML19246A685 ML19246A687
References
SER-790530, NUDOCS 7907060243
Download: ML19246A687 (42)

Text

f RESTART SAFETY EVALUATION REPORT BY THE OFFICE OF NUCLEAR REACTOR REGULATICN U.S. NUCLEAR REGULATORY CCMMISSION IN THE MATTER OF JERSEY CENTRAL POWER AND LIGHT COMPANY OYSTER CREEK NUCLEAR GENERATING STATION DOCKET NO. 50-219 29b Dated: May 30,1979

?S07060293-

0YSTER CREEK RESTART SAFETY E'dALUATICN REPERT I.

INTRCDUCTION II.

EVALUATION II.A Oyster Creek Core Condition II.A.1 Minimum Water Level Over tne Core II.A.2 Primary Coolant anc Off-Gas Analyses 11.3 Licensing Basis Loss of Coolant Inventory Transient II.3.1 Low-Low-Low Water Level Saf ety Limi t 1I.3.2 Bouncing Event Cescription 11.3.3 Coces anc Metnocs II.3.4 Assumptions 11.3.5 Results II.B.6 Conclusions

.11 TECHNICAL SPECIFICATIONS III.A Safety Limi ts II*.3 Limiting Safety System Settings IV.

CPERATING PROCEDURES IV.A Cperator Acticns IV.3 Revisec Plant Operating Procecures V.

STARTUP SURVEILLANCE PRCGRAM 298 279

2

'v !.

OT'_R CCNSIDERAT:Ch5 VI.A Wa!.er Level Indication VI.3 Potential for Transients Due to Surveillance Tests VII. CCNCLUSIONS VIII. REFERENCES APDENDIX - Detailed Event Sequence Qhb

, I.

INTRODUCTION On May 2,1979 the Oyster Creek Nuclear Generating Station experienced a sequence of events which caused the indicated r. actor water level to fall below the " low-low-low" ( triple-low) al arm setpoint. The triple-low level is sensed within the core shroud and corresponds to an elevation as low as 4'8" above the top of the active fuel. This water level corres-ponds approximately to the lower limit for direct instrument indication.

Although the reactor had already scrammed when water level fell L'elow the triple-lcw alarm setpoint, a question of adequacy of core cooling during the event was raised.

Region I of the Office of Inspection and Enforcement was notified by the licensee (Jersey Central Power & Light) on the day of the event.

Inspectors from Region I went to the site. The Of fice of Nuclear Reactor Regulation was also notified. A team from ONRR went to the site May 3,1979, to gain first-hand information.

Investigations continued for several days thereaf ter by the technical staff of the licensee, the reactor vendor, licensee consultants, and the NRC. The investigations focused upon the contributirg causes of the event and an assessment of the core condition.

On May 9,1979, licensee representatives and its consultants net with the NRC staff to discuss the event, their analysis of the core condition, the corrective actions necessary to prevent reoccurrence and lessons learned. The licensee sub g ted a report pursuant to 10 CFf2 g y (c)(1) 5 for staff review by letter dated May 12, 1979.

Letters from the licensee dated May 17, 1979 and May 19, 1979 forwarded additional information and requested authorization to restart the reactor.

This safety evaluation addresses the condition of the Oyster Creek core following the event of May 2,1979 and the changes to the plant design and operation necessary to prevent recurrence.

The report describes our review of the core condition, the licensing-basis loss of coolant inventory transient, the Technical Specification changes, the operating procedures, special startup tests, and other considerations.

A summary of the May 2nd event follows.

r"'

. The Oyster Creek reactor was operating normally at approximately 98%

power, with one of its five reactor coolant system loops and one of its two startup transformers out-of-service, when a simultaneous reactor trip and ATWS recirculation pump trip occurred. The cause of these trips was a momentary spurious high RCS pressure signal caused by routine surveil-lance testing of the isolation condenser initiation pressure switches.

As a result of the reactor scram and recirculation pump trip, reactor power, steam flow, pressure, water level, recirculation flow and turbine generator output began decreasing. At about 13 seconds into the transient the turbine-generator tripped at the low load trip point. This subse, quently caused all three reactor feed oump motors to trip, because the backup electric power source supplied by the one available startup trans-former was not capable of proviaing powe.- to condensate and feedwater pumps suf ficient to retain even partial feedwater supply to the reactor vessel. The reactor operator attempted at this time to restart a feedwater pump but was unsuccessful. Reactor water level continued to drop since the steam flow exiting the reactor was only being replaced by makeup from a single control rod drive pump. Recognizing the continued inventory loss from the reactor, the operator started a second control rod drive pump at 31 seconds into the event and initiated manual reactor isolation at 43 seconds. With the reactor fully isolated from the main conden"!r the opera:or manually closed the discharge valves of recirculation loops "A" and "E" which take return condensate from the two isolation condensers. The operator manually placed into service one of the isolation condensers at this time.

It is oelieved that the operator also initiated closure of the "B" and "C" long discharge valves about this time as a first step in starting one or both the associated reactor coolant pumps which had tripped at the start of the event. Additionaliy, as indicated previously, one loop (loop 0) was already isolated and out-0f-service, with its discharge valve closed prior to the event. All of the discharge valve bypass lines were open prior to and throughout the event however. As the discharge valves moved to the full-closed oosition the reactor vessel water inventory distribution continued to shift away from the Mre region toward the downcomer (annulus). At 172 seconds, the reactor low-low-low water level instrument trip point was reached.

All discharge valves were fully closed at 186 seconds. Heat was removed from the system subsequently by alternately manually actuating and stopping 298 282

,3, the isolation condenser. Reactor pressure and annulus water level increases and decreases were noted during this period and were caused Dy the intermittent isolation condenser operation. At approximately 32 minutes the operator started the C recirculation loop pump. The pump was shutdcsn and the discharged valve reclosed, however, when the operator observed water level in the annulus quickly ' - sping. At about 37 minutes one feedwater pump was restarted causing water level in the annulus to rapidly rise to 13'8" above the top of the core. At 39 minutes a recircu-lation pump was placed in service and the triple-low water level in the core region was observed to be cleared. At this time steps were initiated to bring the plant to a cold shutdown condition.

II.

EVALUATION ll.A.

Oyster Creek Core Condition As part of our evaluation, se have reviewed calculations provided by the licensee of the minimum water level which could have existed over the Oyster Creek core on May 2,1979. Additionally, we have reviewec the radioactivity and :hemistry analyses of the plant provided by the licensee.

II.A.1 Minimum Water Level Over the Core a) Reason for Level Calculations Water level in the annulus was recorded during the event. However, due to partial isolation of the annulus from the core (discussed in Section I and in the attached Appendix), the minimum recorded level in the annulus did not correspord to the minimum level reached in the core region during the event.

The instrumentation that monitors water level in the core region is not recorded as a function of time. Rather, the core region level instrument provides visibla and audible signals in the control room when core water level decreases below the alarm setpoint low-low-low l evel. The lowest alarm setting possible for the core region level instrument is 4 f t-8 in (56 in.) above the core, which is the elevation above the core of that instrument's pressure tap. On May 2, the setting for the low-low-low level alarm was 10" above that minimum or 5 f t-6 in (66 in) aDove the core.

The tine when that low-low-low level signal w received during the May 2 event was recorded (172 seconds after scram)g) and this single point (level and time) represents the only dirdct core region water level measurement recorded during the incident.

Except for the first few seconds following scram, a sufficient condition to demonstrate lack of core damage is that the water level remained above the top of the core.

Since the minimum incore water level was not measured, tne calculations were performed to determine whether or not the core uncovered during the May 2 event.

298 283

t

.t_

b) Calculations for the Fi st Few Seconds Af ter Scram Reactor scram caused a rapid power decrease for the first few seconcs following the May 2 reactor trip. However, the recirculation pumps had also tripped simultanecusly with the scram, so reactor flow was also cecreasing. Transient Minimum Critical Power Ratio (MCPR) cal-culations were performed oy Exxon Nuclear Company using their Plant Transient Simulator Coce.(5)* Results of tnose calculations inci-catea that MCPR values increased from the steady state MCPR :nat existed prior to scram. Thus, acceptable cooling was maintained in the core curing the initial rapid pcwer and flow decrease perica.(2)

Physically, this means that the heat being transferred to the reactor coolant (a comoination of stored neat and power being procuced) ce-creased more rapidly than the coolant's acility to remove that neat was decreasing.

c) Minimum Level Calculations Following the rapid power and flow decrease transient discussec acove, a sufficient, out not necessary, concition to demonstrate lack of core damage is that the water level remained aDove the top of the core.

Since the minimum water level acove tne core was not measured and/or recorded calculations were performed to conservatively cetemine tne minimum level reacned curing the May 2 event.

Minimum water level calculations were indepencantly performed by the General Electric Company (GE),(1) anc tne Exxon Nuclear Company (ENC).(2) The Nuclear Regulatory Commission (NRC) staff performec preliminary calculations in preparation for evaluating the otner cal-culations.

All of the calculations innicatec that the core cic not uncover.

'The PTS model has previcusly Oeen appliec to Oyster Creek plant to ceter-mine MCPR values curing transients.

Each of the above groups independently performed the same basic type of "boilaff" calculation.

In addition, ENC performed a " mass inventory" calculation.

All calculations were initiated by modeling the system that existed at Oyster Creek 172 seconds into the May 2 event. The initialized conditions are that the Main Steam Line Isolation Valves were closed, and all steam produced in the core went to the Isolation Condenser where it was condensed and returned to the annulus. Flow passed between the annulus and the core only through the five small (2" diameter) bypass pipes described below.

The only change to the system inventory cane from mass addition into the core region from the control rod drive (CRD) pumps. Other methods and conditions commo.1 to all of the water level calculations dre des-cribed below.

1) The single measured water level inside tt.e shroud, low-low-low l evel (66 inches above the core) at 172 seconds following scram, was used in calculating the 'ini tial" (i.e.

t=172 seconds) water i nv ento ry.

The " initial" in-shroud water inventory was in turn used in the calculations of inventory at times later than 172 seconds. The calculated in-shroud inventories were then used to infer water levels above core at later the final resul t desi red.

Errors in calculating changes in the voic

'nt or distribution in the various regions inside the shroud at ter the !72 second cal-culation-initiation time would affect the final calculated water levels above tha core. However, any bias in void content would tend to propagate through the calculations in such a manner as to

" cancel", i.e., not affect the water level vs time calcul ations.

This is because the initial inventory included effects of a cal-culated void content and distriDution; the t:tal amount of water that must be present in the core and upper plenum in order to hold 10" of water above the low-low-low level measurement tap (i.e., the low-low-low level alarm point) is dependent on the void content of the various regions below that tap. Stated differently, less voids below the measurement tap would allow water that was previously above the tap (and therefore measured) to drop to levels below the tap and no longer be neasured.

Thus, the void content in regions below the tap is important in deter-mining the time at which the core level drops below the low-low-low level point. However, that time was taken from the actual low-low-low level measurement, thus automatically taking into account the correct, actual void content and distribution witnout regard to whether or not that void content and distribution was correctly predicted. As long as no major errors are made in predicting changes in void content due to changes in the parameters which affect void formation (af ter calculation-initiation time) then no significant errors in minimum calculated water level sill be introduced.

Since valves aere opened or closea in he recircula-298 285 tion flow path, no large recirculation flow temperature changes occurred, no large core power chariges occurred, etc., large changes from the initial void content and distribution would not be expected, and were in fact not predicted by the calculations. Therefore, what-ever voias were " holding the level up" when the initial (low-low-low) level measurement was made, would continue to " hold the level up" rougnly the >ame amount during later calculated times.

Tnus, small errors in calculating changes in the void content would slightly affect later water level calculations, but errors in the under-standing of absolute values of void congt and distribution would " cancel out" of the calculations In addition to the above, we believe no significant errors are present in the absolute values of void content and distribution.

GE har compared the calculated void fractions with values frcm proprietary data which was taken over a mass flux and void fraction range which covers the values of mass flux and voigraction pre-dicted by these calculations, with good agreement.

Al so,

EhC has provided a " maximum uncertainty in void fraction" sensi-tivity study showing that effects on minimum calculated water level dueg errors in void fraction would be only 5 inches level decrease.

Due to the acceptable agreement of calcul ated vs measured absolute void content, plus the lack of sensitivity of the calculated water level results to absolute values of void content and distribution, we find the treatment of void content in the level calculations to De acceptable.

2) Annulus-level-versus-time data were used to determine the initi al

( t=172 sec) inventory in the annulus and the pressure differential (head) available to drive water from the annulus region into the core region through the five 2" diameter recirculation-pump-discharge-valve bypass-valves and associated piping. Tempera-tures in the annular region were measured throughout the transient and remained subcooled; therefore, the void considerations dis-cussed above for the core region are of no concern for the annular region.

3) Plant data were used to calculate flow resistance in the above men-tioned 2" lines, i.e., the calculations assumed actual piee size, thickness, material, roughness, length, number and type of bends, entrance and er ' shape, and valve size and type i. calcul& ting flow resistanc.

gg

4) Recirculdtion flow (flow from the annulus to the core) was cal-culated using the driving head and flow resistances determined as descrioed in 2) and 3) above. All main recirculation pump discharge valves were assumed to be closed at the 172 second initial time.

5) Recirculation flow temperature was taken from measurements.

Mixing of the cooler recirculation flow with warmer water in the lower plenum was not assumed.

The cooler recircuiation flow was assumed to stratify in the cottom of the lower plenum.

If mixing in the lower plenum had Deen assumed, it would not have resulted in contraction and lowered level due to void collapse in the lower plenum (the lower plenum remained sub-cooled - i.e.,

there were no voids there to be collapsed. The stratification assumption therefore does not result in non-t 'nservatism in the water level calculatic n.

The stratification as'umption does conservatively maximize ti 3 time before the cooler recirculation flow reaches t's core (maximizes time before inventory losses from the cc.

due ta steaming would De reduced due to the cooler recirculated liquid reaching the hotter core region).

6) Staaming to the isolation condenser was assumed as that required to remove all heat produced by the following heat sources: a) best estimate decay heat as a function of time; and b) a conservative value of stored heat due to temperatures above saturation in the fuel, core internals, and coolant ir "entory. These values are functions of the decreasing saturation temperature (determined by the measured and recorded core saturation pressure as a function of time).

The isolation condenser capability was evident from the measured pressure decreases when the isolation condensers were ODerating (pressure would increase if all steam were not condensed).

7) The assumed flow into the core region through the Control Rod Drive (CRD) pumps varied among the several group < ' calculations from 40 gpm to 130 gpm. NRC staff calculation performed for 130 gpm and 100 gpm (65 and 50 gpm each).

sey Central Power and Light believes that the two-pump total CRD flow airectly to the core region is at least 60 gpn, and their best estinate is over IUU gpm.

298 287 40 gpm, CRD flow) probably contain conservatism resulting from assuming 20 to 60 gpm less CRD flow than actually existed.

Results of all calculadons performed utilizing the above methods indi, cated a minimum two 61ase mixture water level above the core between 1.0 and 3.5 feet above the top of tne active fuel (

i.e., individual calculations from the groups were within that range). Time-of-occurrence of the minimum level varied from 7.5 to 32 minutes after scram. The NRC staff calculatian indicated the most margin (3.2 feet) and the earliest minimum level time (7.5 minutes af ter scram). The cther groups' calculations conservatively included lowering of cur e water level due to lower plenum contraction caused by recirculation flow, which the NRC calculations had neglected. Condensate from the isolation condenser flowing from the annulus through the five 2" lines into the hotter lower plenum (i.e., the recirculation flow) would cause the lower level due to volume shrinkage in the lower plenum.

The other groups' calculations also conservatively included a larger amount of core-intervals and fuel-stored-heat being removed (by steaming) from the core than did the NRC staff calculations. Approximate correc-tion of the NRC staff calculations for these effects results in reason, able agreement with the other calculations (i.e., within the range of the other results). The staff's calculations were prelininary in prepar-ation for evaluating the licensee's calculations.

To further alleviate any potential concerns regarding the role of void calculations and assumptions on the minimum calculated water level, GE performed a calculation which removed the " credit" for voids at times af ter t=172 seconds but kept the penal ty for voids at t=172 sec. That is, in calculating initial core water inventory, the measured level at t=172 seconds was corrected (reduced; ar calculated void content present at that time.

The calculation then sta'ted with this artificially re-duced inventory; reduced (collapsed) water level vs time was calculated assuming no swelling in the core or upper plenum (residenco time of voids in the core of zero, or all steaning occurs at the upper surface are equivalent conservative assumptions).

This calculation, even with these conservative assumptions, predicted a minimun collapsed level of 1.67 feet above the core.

298 288 Also, additional calculations performed by Exxon Nuclear Company utilized a different basic method (a mass inventory allocation process) to distribute the available mass througn the system depending upon known volumes along with measured levels and measured thermo-dynamic conditions. These calculations shared dependence with the other cal-culations on void distribution and initial inventory distribution.

However, they did not share dependence on heat transfer and steam pro-duction calculations since inventory in the core region was inferred by tracking all other regions (with available, recorded measurements taken during the May 2 incidenc) and subtracting the sum of the,nasses in the other regions from the initial total system mass (which was constant except for an assamed 40 gpa CRD flow). Results of those calculations were in agreement with the first set of calculations described, predictina a minimun two phase level of 1.62 f t. above the core a: 12 to 32 minutes 3"ter sc ram.

c) Conclusions On the basis of the acceptable MCPR calculations reported above in Section (b) and on the basis of agreement of all (independent) calculations reported in Section (c) that the water level remained above the core, and the conservatisms described that are present in the methods used, we conclude that the two phase mixture water level did not drop below the top of the core during the May 2 event and no fuel damage occurred.

II.A.2 Primary Coolant and Off-Gas Analyses The licensee and the staff have examined the radiochemical records for empirical evidence of core damage. The primary coolant sample analyses, from before and for several days af ter the transient, showed no unusual increase in the concentrations of radionuclides.

The Iodine-131 concentration went up by a factor of two at shutdown but iodine spikes of that magnituoe at shutdown are normal due to reactor system depressurization.

Tne readings from the stack and steam air ejector radioactivity monitors are continuously recorcad on a strip chart. The strip chart around the time of the int;.ent showed no unusual increase in the release of airborne radiocctivity. There were spikes in the stack reading at shutdown and when the mechanical vacuum pumps were started. But again, of f-gas increases are normal at shutdown and when mechanical vacuum pumps are started.

Thus, there is no ind1-cation frcn either the primary coolant analyses or the off-gas rates 298 289 that there was any abnormal release of fission products from the fuel due to the transient. Therefore, we agr :e with the licensee's con-clusion that the radiochemical records provide evidence that the core was not damaged as a result of the event.

II.B Licensing Basis Loss of Coolant Inventory Transient The licensee has submitted an analysis of the most severe postulated loss of reactor coolant inventory transient at the Oyster Creek Nuclear Generating Station. The purpose of the analysis is to show that with the revisea Technical Specifications water will not fall below the low-low-low l evel. Our evaluation of the licensee's bounding analysis is provided in the following sections.

II B.1 Low-Low-Low Water Level Safety Limit At the time of the May 2,1979 event, paragraph 2.1.D of the Oyster Creek Technical Specifications defined a water level of 4'-8" above the top of the normal active fuel zone to be a fuel cladding integrity safety limit.

Technical Specification 2.1.2 states:

"Whenever the Reactor is in the shutdown condition with irradiated fuel in the reactor vessel, the water level shall not be less tnan 4' 8" above the top of the normal active fuel zone."

The purpose of this limit was to assure acequate margin for decay heat cooling of the fuel curing periods when the reactor is shutdown and Corresponds to the lowest reactor vessel water level that can be moni-tored. As a result of the event of May 2,1979, however, it was recognized by both the licensee and us that the low-low-low water level safety limit is applicable to all operating modes. We and the licensee agree that a water level above the core that can be monitored is an appropriate basis for con-cluding that significant fuel failure does not occur.

Accordingly, the licensee has proposed, that the subject Technical 3pecification definition be changed to make clear that the low-low-low water level (4' - 8" above the top of the active fuel zone) is a safety limit applicable to all modes of operation including transient conditions.

Low-low-low water level thus oecomes the safety limit applicable to the licensing oasis loss of coolant inventory transient. This is acceptable.

298 250 II.B.2 Bounding Event Description In order to assure that Oyster Creek will not violate the triple-low water level safety limit during any anticipated operational occurence, the 1icensee has analyzed the postulated transient event which results in the largest lossg reactor coolant system inventory.

For Oyster Creek, the licensee states that a total loss of feedwater (LOFW) starting from hot full power, results in the most severe reduction in reactor vessel water levels.

For the LOFW event, feedwater flow to the reactor vessel rapidly falls to zero. Thus, with full power reactor heat generation continuing, steam flowing frca the reactor to the turoine causes reactor water level to decrease rapidly. For Oyster Creek, a reactor scram occurs when water level in tne annulus reaches the " low" water level set point which corresponds to a height of 11'-S" aDove the top of the active fuel region. The reactor scram causes a further rapid drop in water level in the annulus as the reduction in heat generation rate results in a marked decrease in the core void content.

Steam generation continues caused by core decay heat and stored heat effects. This steam continues to exit the reactor thereDy causing a continuing water level decrease in the vessel.

When water level in the annulus reaches the " low-low" water level setpoint, corresponding to 7'-2" above the top of the active fuel region, main steam line isolation valve closure will automatically initiate to terminate in-ventory loss from the reactor vessel.

Inventory loss is completely termin-ated when the MSIVs are fully closed.

For Oyster Creek, the low-low water level also initiates an ATWS pump trip. A small water level swell occurred in the vessel annulus due to the reduced core flow and the increased ccre voiding. Additionally, low-lcw water level in the annulus corresponds to the isolation condenser initiation set point.

Thus, after a short time delay the drain valves of the isolation condenser would start to open to remove core decay heat and stored heat from the isolated reactor vessel.

Since the isolation condenser piping system normally is filled with liquid water, some inventory makeup can also be supplied to the reactor vessel when the syitem actuates. With the isolation Condensers actuated the reactor systen woulc depressurize and cool down. Continued depressurization coo'i down,

and shrinkage of the contained inventory would occur until core spray flow would restsre the decreasing water levels in the reactor vessel.

298 291

. We have compared the LOFW event to other transient events postulated for Oyster Creek. We agree that the LOFW transient described above will result in the largest inventory loss from the reactor vessel should it occur. However, the distribution of this inventory within the reactor vessel (e.g. downcomer and core regions) is dependent on reactor coolant pump condition (running or not running) and recirculation loop un scharge valve and bypass valve positions.

For analysis purposes the tripping of all recirculation pumps at low-low water level, conservatively accounts for the shifting of reactor vessel inventory away from the core region and towards the annulus region. The effect of recirculation loop valve posi-tions is explicitly accounted for in the analysis assumptions (see Sec-tion II.B.4) and in the plant Technical Specifications (see Section III).

II.B.3 Codes and Methods The calculational methods which were used to determine the minimum water level over the core in the event the limiting loss of coolant inventory consists of two parts. The first pargtilizes the Exxon Nuclear Company PTSBWR2 plant transient analysis code to calculate reactor vessel inventory and water levels for the first 125 seconds of the transient.

The second part utilizes a degenerative (special) case of calculational methods discussed in Section II. A.1, herein, to extrapolate to the minimum water levd over the core during the cooldown-depressurization phase (when the isolation condensors are operating) until core water level recovery occurs as a result of core spray system flow initiation.

Addi-tionally, th i second part includes methods to assess the effect of dis-charge valve position on the steady-state water level in the core region.

The PTSBWR2 Code which has been used in connection with previously ac-cepted Oyster Creek plant transient simulations for core reload applica-tiens, was mr dified to model the automatic ir.itiation and heat removal characterist cs of the isolation condensers. The addition of this model thereby enab es simulation of the steam condensing (heat removal) function of the isola tion condensors suDsequent to reactor. vessel isolation. Con-servatively, no credit for tne inventory associated with the subcooled water normal 'y stored in tne isolation condenser was included in the revised versien of the PTSBWR2 Code. Both isolation condensors were modeled in the analysis. A time delay from the time of low-low water level to initiat on of the isolation cosidenser drain valve opening was i

also included.

298 292

. The ef fects of discharge valve position on steady-state water level in the core region was evaluated with a hydraulic analysis of the recirculation lines. This analysis modeled the recirculation line geometry with standard fluid mechanics methods.

The methods included the geometric pressure loss coefficients which includes a factor fU the fixed rotor recirculation pump. The pressure loss coefficient for the recirculation pump was based on in situ tests. The other pressure loss coefficients involve standard methods and are adequate. The analysis e

assumed differential driving heads between annulus and core regions which are within the range of values assumed for the overall analyses.

The methods were used to calculate the natural circulation flow from the acwncemer region to the core region.

II.B.4 Assumptions The licensee's bounding analysis ass tions(3) which can significantly affect the calculated ractor coolant.;., tem inventory lost during the transient have been evaluated, together with the issumptions which can adversely as: :t the calculated distribution of inventory be-tween the vessel annulus and the core region. Collectively these assumptions should result in a conservative prMiction of the mini-mum water level over the core during the transient.

Inventory Loss Assumptions The analysis was performed assumitig an initial full power level of 1930 L t.

This power level, in conjunction with the assumed low reactor water level scram, will maximize the rate of inventory lost from the reactor vessel up until the complete closure of the main steam line isolation valves.

The total reactor coolant inventory lost from the reactor vessel up to the time of ilSIV closure has been conservatively modeled. The analysis assames feedwater flow into the reactor vessel f alls to zero in 3.5 seconds with MSIV closure initiated on Icw-low water level in the annulus. Ad di -

tionally, the MSIV closure time is the maximum (10 seconds) per-mitted by the present Oyster Creek Technical Specifications.

To prevent additional reactor coolant inventory ioss which might otherwise occur due to system repressurization (af ter MSIV closure) the analysis takes credit for the heat removal and pressure control n n -r 298 m

functions of the Oyster Creek isolation condensers. The analysis assumes automatic actuation and operation of both isolation con-densers for heat removal and pressure con rol, although no credit has been taken for the suocooled inventc./ of water normally stored in the isolation condenser piping. The analysis results are Dased on automatic initiation of the isolation condensers caused by the decreasing water level in the annulus being sustained at or below the low-low water level setpoint for 10 seconds. Af ter the 10 second time delay, the isolation concenser drain valves are assumed to open fully in 20 seconds. Additionally, the analysis conservatively takes no credit for the small source of inventory makeup associa' ed with control rod drive flow.

In summary, it is assumed that af ter MSIV closure no reactor coolant inventory loss or makeup occurs until core spray flow terminates the decrease of core water level.

Inventory Distribution Assumotions The actuated isolation condensers are assumed to depressurize and cooldown the contained reactor coolant mass to a reactor pressure at which core spray flow makeup would start to raise reactor vessel water level s.

The cooldown results in an increase in reactor coolant density, thereby causing an additional drop in reactor vesscl water levels. The core water level analysis assumes no voids are present in the system at saturation conditions.

Thus, the actual height of the two phase mixture in the core region is conservatively accounted for from a density viewpoint.

Finally, the distribution of coolant inventory (between annulus and core) has been accounted for based on no forced recirculation flow (due to a reactor coolant pump trip on low-low water level) and a maxi, vin of one unisolated recirculation loop. The above conditions will esult in tne most adverse distribu-tion of caolant inventory within the reactor vessel.

In sumnary, the above combination of inventory loss and inventory distribution assumptions provides an adequately conservative basis upon which to calculate the minimum core water level attained during the limiting loss of Coolant inventory transient.

298 294 II.9.5 Results The results of the limiting loss of coolant in'.entory transient from initiation to 125 seconds, as calculatea by the PTSBWR2 Code, are proviced in Reference 3.

The results show that vessel annulus water level drops rapidly reaching the low level reactor scram setpoint corresponding to 11'5" above the top of the active fuel within 4.5 seconds.

At 15 seconds, the low-low level setpoint, corrermaing to 7'2" above the top of the active fuel, is reached initiating MSIV clasure and a trip of all reactor coolant pumps.

Core spray pumps are signallea to start at this time although reactor pressure is sufficiently higri to prevent any inventory addition. The voiding in the core caused by the tripped recirculation pumps causes level in the annulus to start increasing and recovering low-low water level after approximately 3.4 seconds. This result is not consistent with the 10 second sustained low-low water assumed for initiating opening of the isolation c(ndenser drain valves described in Section II.B.4.

However, the licer.see has committed to propose Technical Speci-fications (see Section III) which will acceptably resolve this inconsistency. The proposed technical specifications will require a sustained low-low water level for three seconds or less to initiate opening of the isolation condenser drain valves.

In view of the predicted margin to low-low-low water level for this limiting (see discussion below) event we consider giving credit for prompt manual initiation of the isolation condensor suDsequent to reactor isolation acceptable until the proposed technical specification is implementea. The minimum annulus water level after MSIV closure and before cooldown depressurization oegins is 5.36 f t. above the top of the active core and occurs at approximately 35 seconds. However, continued depressurization, cooldown, and shrinkage of the contained inventory occurs until core spray flow recovers the decreasing water levels in tne reactor vessel. Based on the methods and assumotions (evaluated in Sections II.B.3 and II.B.4, respectively) used to extrapolate the water inventor istributions and levels, t'e minimum r

3ttained col'apsed citer level is 6'7" aDove the top of tne active fuel.

This result inu ides the effect of recirculation 1000 discharce valve positions on steady-s

' e water level s.

That is, with only one recircul ation loop assured ur..solated, recirculation flow is suf ficient to prevent Doiloff from reaucing core water level celow 6'7" above the top of the active fuel.

II.G.o Conclusions Tne above resul t is acceptable in that the low-low-low water level fuel claading integrity safety limit is not violated.

Our evaluation of the revisions to the plant Technical Specifications which are considered necessary and sufficient to complete the imple-mentation of the important analysis assumptions and results appears in Section III.

298 295 III.

TECHNICAL SPECIFICATIONS The licensee has proposed several changes to the Oyster Creek Technical Specifications to clarify the appropriate limits for transient events which result in a loss of reactor Coolant inventory and to provide assurance that the reactor coolant system configuration and mitigating equipment taken credit for in the Dounding loss of coolant inventory analysis will De in accordance with the analysis assumptions.

A dis-cussion of these changes follows.

III.A Safety Limits As discussed in Section II.B.1, the licensee has proposed that the definition of tre low-low-lcw water level fuel cladding integrity safety limit appearing in paragraph 2.1.D of the plant Technical Speci-fications, be clarified to specifically provide for applicability to all modes of reactor operation.

Based on our evaluatiogjn Section II.B.1, this is acceptaDie.

The licensee has also proposed to add a safety linic appearing as paragraph 2.1.F in the plant Technical Specifications which requires that during all modes of operation (except when the reactor head is off and tne reactor is flooded to a level above the main steam nozzles) at least two (2) recirculation loop suction valves and their associated discharge valves will De in the full open position.

Based on our evaluation appearing in Section II.B. herein, the acceptability of this requirement is conservative relative to the assumptions used in the bounding loss of coolant inventory transient analysis.

III.B Limiting Safety System Settings The licensee has taken credit for the automatic protective operation of the isolation condensers for acceptably terminating the limiting loss of coolant inventory event. To assure the proper initiation and operation of the isolation condensers on low-low water level in the annulus in ac~

cordance with the counding analysis assumptions, the licensee has proposed to add a limit 'ig safety system setting requirement to Section 2.3 i

of the Oyster Creek plant Technical Specifications.

The Specification will state that the limiting safety system setting is the low-lcw water level setpoint ahich was assumed in the bounding analysis, i.e., 7'2" above the top of the active fuel. The limiting safety system setting will incorporate a naximum three (3) second time delay to assure that the systen will not fail to initiate because low-low water level nomentarily clears as a result of the water level swell in the annulus caused Liy 3 simul, taneous recirculation pump trip.

Additionally, based on our review of n9n 7 'I $

L,J L

actual plant operating data of isolation condenser initiations and possiole isolation, a time delay of three seconds or less will not cause the isolation condensors to reisolate on high flow conditions ccused by recirculation pump coastMwn effects. This time delay will also be adequate for recirculatic' flow coastdown effects applicable to four loop operation as well.

ine limiting conditions of operation and surveillance requirements for the isolation Condenser will not be changed.

IV.

OPERATING PROCEDURES

1. have reviewed both the operating procedures (including standing orders) which were in effect at Oyster Creek at the time of the May 2,1979 event, and the revisions of these operating procedures as a result of the event.

The former procedures were reviewed to evaluate whether the operator actions during the event were wholly in conformance with the procedures tnen in effect.

The revised procedures were reviewed to evaluate their consistency with the bounding analysis assumptions (discussed in Section II.B.4) and the resulting technical specification changes (described in Section III).

IV.A Operator Actions The following is c _/aluation of the correctness of the operator actions relative tc the plant operating procedures which existed at the time of the May 2,1979 event. Our evaluation is itemized by procedure.

1.

Procedure 514, Rev 2 " Reactor Isolation Scram" This procedure is pertinent to the May 2,1979 event since the operator manually closed all four main steam isolation valves 43 seconds af ter the reactor scranmed to minimize the loss of coolant inventory. The closure of the MSIVs, although not specifically required in the par-ticular procedu-e, was the proper action to take and was taken promptly.

This procedure requires the operator to verify that a reactor isolation was initiated if a reactor low-low water level or reactor high-pressure condition exists. The low-low water level is measured in the down-comer (annulus) but was never reached during the event. The high reactor pressure signal which occurred was spurious and was not sustained for the delay time needed to initiate isolation cooling. The subject procedure requires the operator to manually actuate systems that have not auto-matically actuated.

Thus, he correctly actuated the isolation condenser in order to establish an alternate heat sink.

All appropriate immediate and subsequent operator actions were completed by the operators as required by this procedure.

298 297

- 2.

Procedure 511.1, Rev 1 "Feedwater Pump Failure" This procedure states that a reactcr low-low level condition may be experienced in the case of a trip of all three feedwater pumps.

How-ever, since the low-low water level condition was not attained for the subject event soa:e of the automatic actions listed in the procedure did not occur. Among the significant immediate and subsequent operator ac-tions required for this situation is to restart one or more feedwater pumps. Ten seconds af ter scram ths operator did make an attempt to restart the only feedwater pump powered by a live bus. The control room operator was unsuccessful since a tripped overloac condition existed on the motor deven auxiliary oil pump. No further attempt was made to restart this only available feedwater pump until 31 min-utes and 54 seconds af ter the scram since the low water level alarm had cleared at 90 seconds and water level was normal. 31 minutes and 54 seconds, after the reactor scrammed the operator started the "C"

recirculation pump which resulted in a level decrease in the downcomer.

At this time, the operator made a second unsuccessful attempt to start the feedwater pump. However, operatirg personnel dispatched to the feed-water pump station locally started the auxiliary oil pump allowing feed-water pump A to be successfully restarted at 36 minutes and 48 seconds.

No procedure violations occurred and all actions taken were in accordance with the procedure. The time delay to locally start the auxiliary oil pump appears to be somewhat long but is not considered unreasonable since other operator actions were being taken at the time. Additionally, since water level in the annulus during most of the event was normal, this delay is understandable.

One of the subsequent operator action steps required by the procedure is to place a recirculation pump back into service. This was done at 31 minutes, 54 seconds but the pump was immedietely tripped manually.

Another recirculation pump was started 36 minutes and 4d seconds af ter the scram.

3.

Procedure 301, Rev 4

" Nuclear Steam Supply System" This procedure adcresses routine operation including startup and shut down of the main steam and recirculation systems.

Section 7.0 of this procedure is entitled " Removing a Reactor Recirculation Pump from Service." The " Precautions and Limitations" suDsection includes the b

-19.

following statements:

"flever isolate all recirculation loops at the same time. The suction and discharge valves of at least one recirculation loop shall always remain open and, if possible, at least one pump should always be running to provide continuous circulation and indication of reactor vessel water level." This condition was violated since all five recirculation discharge valves were believed to be simultaneously closed 76 seconds after the scram and were definitely observed to De Closed l86 Seconds after scram. Furtnermore, all five aischarge valves remained closed until 31 minutes, 54 seconds after the scram when a recirculation pump was started and its associated discharge talve reopened. Although both the violation and precaution in the procedure are ccmciser ed to be clear, the subject event caused some complications,vnich may have contributed to the procedure violation. Standing Order "U in ef fect at the time of the event requires the operator to close the A and E loop discharge valves to prevent the isulation condenser from isolating itself as a result of high flow conditions.

The "D" loop discharge valve was closed prior to the event since the associated pump was out of service.

The above precaution required the operator to have at least one pump running. To start one of the pumps, it is necessary t by procedure) to first close the asso-ciated discharge valve. The logical pump to start was pump C since it was powered by a live bus and was not in a loop connected to the isola-tion condenser. The pump was startao at 31 minutes, 54 seconds. Trere-fore, the operator was required to close three discharge vi.ives but made the error of closing four d'scharge values.

There would appear to be some basis for confusion since the term " isolated" as used in the procedures can be inferred to describe either closing the discharge valve or closing both the discharge valve and the discharge by-pass valves simul taneously.

During the entire event, all five discharge bypass valves were open, hcwever.

4.

Procedure 307, Rev 3 " Isolation Condenser System" Standing Order No. 23 Rev 0 (dated 11/15 /77)

" Isolation Condensor Operation" The section of Procedure 307, applicable to this event requires the oper-ator to control reactor pressure and limit the cooldown rate to less than 100 F/Hr. Procedure 307 does not mention the relationships between isclation condenser and "A" and "E" bypass and discharge valves.

closing the discharge valves is intended to prevent automatic isolation of the isolation condenser systen. Based on our review, we believe that there were no violations of any of the steps in either the procedure or standing order.

Procedure 502.3 Rev 1

" Loss of 4160V Bus l A, B, C, D" Procedure 510 Rev 2 " Turbine Trip" Based on our review of these two procedures and the operator actions we believe that no procedure violations occurred during the May 2,1979 event.

IV.B.

Revised Plant Operating Dracedures The Office of Inspection and Enforcement has reviewed the revised Oytter Creek operating procedures to evaluate whether they adequately implement the revised Dyster Creek Technical Specification requirements.

V.

START-UP SURVEILLANCE PROGRAM As stated in Section IIA 2, there is no indication f rom the primary coolant concentrations or the off-gas rates that any abnormal release of fission products from the fuel occurred during tne transient.

However, some fuel damage can be detected in either the primary coolant concentrations or the off-gas rates during startup and ascansion to rull power.

The licensee has designed a surveillance program to identify signs of fuel damage occurring during restart.

This program, which the licensee has committed to during this startup, is descrited below.

The off-gas rates from the air ejector and the stack will be continu-ously monitored. The primary coolant will be sampled and analyzed for gamma-emitting radionuclides on the follcwing schedule:

1) Pre-startup

2) 250 F average reactor coolant temperature

3) 500 psig reactor system pressure

4) 20% thermal power 5) 10' thermal power in.,ements up to full power

6) Daily for 14 days af ter reaching full power

. Air ejector of f-gas samples will be taken and analyzed for isotopic content on the following schedule to ensure proper calibration of the continuous off-gas monitors:

1) 20% power

2) 40% power

3) 60% power

4) 80% power 5) full power

6) Weekly for 14 days af ter reaching full power.

Two additional air ejector samples will be taken each week for 14 days after reaching full power. These samples will be analyzed for gross gamma only.

If the ratio of short and long-lived emitters changes, further sampling and analysis will be performec.

The surveillance program includes adequate frequency of sampling, analysis and monitoring of the primary coolant concentations and of f-gas rates to ensure that signs of abnormal fission product release resulting from the transient will be identified quickly.

These are the criteria by which the licensee has committed to judge the information on primary coolant concentrations and of f-gas rates from the surveillance program.

Iodine-134 and Iodine-135 will be used as the indicator nuclides in the primaq coolant analyses. These nuclides reach equilibrium concentrations for the various power levels quickly because of their short half-lives. The bases for the criteria will be the primary coolant concentrations and of f-gas rates experienced at Oyster Creek at full power before the transient. All of these criteria will be applied to both the primary coolant concentrations and the off-gas release rates.

For startup evaluations up to 50% power, no action will be taken if 100% of the base levels are not exceeded.

If 100% of the base levels are exceeded, power level will be held and the samples and analyses repeated until the 100% criteria are met.

If 200% of the base levels are exceeded, the licensee will promptly initiate a reactor shutdown until the problem is resolved.

For startup evaluations between 50% and full power, no action will br taken if 150% of the base levels are not exceeded.

If 150% of the base levels are exceeded, power level will be held and the samples and analyses repeated until the 150% criteria are met.

Again, if 200%

of the base levels are exceeded, the licensee will shut down the reactor until the problem is resolved. For two weeks af ter reaching full power, n\\

-r#

7@

-22, the licensee will continue evaluations of the off-gas rate.

If 125% of the base level is exceedea, the sampling and analysis program will be augmented.

If 150% of the base level is exceeded, the licensee will reduce power to stay within 150% of the case level.

If 200% of the base level is exceeded, the licensee will shut down the reactor until the problem is resolved.

Before the incident, stack off-gas rates at full power were running at approximately 40,000 microcuries per second. A stack off-gas rate of 125%,150% or 200% of this base level would still be less than one-third of the rates allowed by technical specifications. Therefore, the cri-teria are acceptable. We request that the licensee notify us within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> if the reactor is shut down based on these criteria.

VI.

OTHER CONSIDERATIONS VI.A.

Water Level Indication The level instrumentation in the Oyster Creek reactor reads only " collapsed" water 'avel.

Such a collapsed levei is an indicator of water inven tory, but does not necessarily correspond to a liquid surface height.

This distinction is especially true within the core area during operation, where liquid quality increases monotonically frcm the boiling boundary up to the steam separator, with no distinct liquid / vapor interface.

In the annulus, collapsed level roughly corresponds to the liquid level.

Moreover, the water inventory within the annulus is generally greater than core inventory curing operations and when annulut level is in the nomal range, it is above the bottom of the steam separator skirts. Thus, the whole core area is submerged under these conditions. Also, water is normally being drawn from the annulus and forced into the core. Thus, when supply is interrupted or inventory is lost, it is the annulus level which will go down at first, while core inventory will not change gre&cly.

The annulus level is continously monitored by three electric level (GE /MAC )

gauges (two narrow range and one wide range) and 8 Yarway level gauges.

The Yarways reau out in the control room and are used as inputs to the high, low, and low-low level setpoints.

The GE/MAC gauges are recorded as well as reaa-out in the control room. Moreover, the GE/MAC signals are used for feecuater control. One of the narrow range GE/? TAC signals is for a strip chart recorder in the control room.

. The water level in the cure area is monitored by four Barton level gauges.

The four Bartons tap into the core spray sparger for their lower tao, and share reference columns with the GE/f1AC instruments described above. The Barton gauges read-out locally, but only send a signal which initiates the 1ow-low-low 1evel 1ogic plus a control room alarm.

Thus, core 1evel is monitored only in the sense of an alarm signal', it is neither recorded nor observable by a control roon operator.

At this point, it is essential to understand the purposes of the three low level setpoints.

The low level setpoint is above the lower edge of the steam separator skirts. Actuation of tnis setpoint causes a reactor trip and a group II isolation.

It is normal to reach the low setpoint following a reactor scram at power due to void collapse.

The low-low level causes a group I isolation (which includes tt

'"IVs),

trips the recirculation pumps, initiates isolation cooiing and warts the core spray pumps.

(However, core spray flow will not start unless the reactor is depressurized. )

The low-low-low level starts the Automatic Depressurization System ( ADS) timer provided there is coincident high drywell pressure and the core spray punps are operating. This is the only use of the low-low-low level signal.

Linitations of Water Level Indication Although annulus level is appropriate for feedwater control and water inventory monitoring during normal and most upset conditions, it has no intrinsic safety significance except through its relationship with core water level. The annulus, core area and recirculation lines form a large U-tube when the recirculation pumps are not running, and the two levels should be very nearly the same. When the recirculation pumps are running and the core is shut down, the level in the annulus snould be lower than the (collapsed) core level, and therefore should be a conserva-tive indicator. For the annulus level instrumentation to work properly, the annulus and the core area must be in good communicatien at the Dottom.

It is now apparent that the non-conservative situation (annulus level greater than core level) can exist if there is a restriction in the recirculation lines.

(This is only possible in non-jet-pumps BWRs, since the more modern plants always have good communication between the two regions tnrough the jet pumps. )

The core water level instrumentation provide meaningful results only when there is no liquid flow through the steam separators. When there is flow through the separators, the resulting differential pressure introduces a non-conservative error in tne core water level reading.

This is of no conse-quence during power operation, since the core is filled with a two-phase level-less mixture, and inventory is munitored in the annulus.

The core area water level does become meaningful under low separator flow conditions.

Thus, core area level indication will not work unless either the recirculation pumps are tripped or the collapsed core level drops so far that only steam enters the separators. This is the reason why the core level instrumentation is of ten called " accident" instrumentation:

the instrumentation is not operative under normal and most upset conditions.

In addition to the limitation described above, collapsed core water level is not linearly related to core water inventory. The horizontal cross-sectional area of this water volume is large above the core, narrows rapidly through the dome, and is small through the standpipes. Therefore, a constant inventory loss (in gallons per minute) will cause collapsed level to drop very rapidly out of the standpipes, but much more slowly in the large cylindrical volume immediately above the core.

The low-low-low setpoint is normally about hal f-way up the transitional (dome) area Detween the two vol umes.

Finally, the lower taps of the core area level instrumentation are on the core spray spargers. The instrumentation cannot monitor water levels below these spargers.

Summary The primary safety concern for level instrunentation is that the level setpoints must De assured to occur in proper sequence. This implies that the core and annutus water volunes must not De partially isolated from one another. Given this, all safety analyses remain valid and Dounding.

In addition, it is recommended tnat a read-out of tne core level instru-mentation be provided in the control room. This read-out could inform plant operators during an accident situation.

Such a read-out is pro-video in new plants.

The licensee plans

) to add level instrumentation with a tap at a still loer elevation (e.g. the core differential pressure tap) be investigated in the longer term. Presently, this plant cannot monitor levels below the core spray sparger. Although such situations are not likely and also have been counded Dy accident analyses, we consider additional level i nstrunen ta tion prudent.

g:

s.%

VI.B Patential for Transients Due to Surveillance Testing The event on May 2,1979, at Oyster Creek occurred when a gauge valve was opened to verify that an excess flow check valve in the instrument line was still in the open position. The instrument line feeds pressure switches which actuate the reactor and recirculation pump trip systems.

A simultaneous reactor trip and recirculation pump trip resulted from this surveillance testing of the isola cion condenser pressure switches.

Confirmation that the check valve is open is necessary after the sur-veillance test to assure that the pressure switches are hydraulically communicating with the reactor vessel and can, therecy, sense any changes in reactor coolant system pressure. As the valve was opened, fluid entered the gauge line and stopped abruptly when there was no more room for fluid motion. This caused a short term pressure transient of sufficient duration to actuate the pressure sensing switches for the reactor trip system.

A reactor trip resulting from the test to confirm that an excess flow check valve is in its proper position for normal operation has not been a recurring event at the Oyster Creek plant. Al though a reactor trip is not an unexpected event and several may be expected over the lifetime of a plant, the possibility for unnecessary reactor trips of this nature should be minimized by proper procedure and design.

Unnecessary reactor trips can be eliminated procedurally by instructions which result in slower opening of valves or Dy closing the block valve to One set of sensors while the check of the excess flow check valve is made.

It may also be possible by design to significantly reduce the spurious signals by utilizing either fine control test valves or self indicating excess flow check valves.

We conclude that it is desirable to reduce the likelihood of spurious scram signals but it is not necessary to assure the health and safety of the public.

The licensee has stated that modifications to surveillance testing procedures are in progress to reduce the likelihood of a similar occur-rence and that the design will be reviewea to determine the need for equipment acdifications for further improvement. We have requested that the licensee submit his findings prior to the startup after the next refueling outage.

VII CONCLUSIONS We have evaluated both the current condition of the core and the adequacy of changes being made to prevent a recurrence of the significant events that happened at Oyster Creek an May 2,1979.

The condition of the core was evaluar.ed both analytically and empiric,'

The analytical evaluation (Section II. A.1) demonstrates Dy conse.. ative thermal-hydraulic calculations that the liquid level did not drop below the top of the cor e.

I'9 evaluation (Section II. A.2) of the radio k mical recoids supports a

iusion that the event caused no fuel failures.

Therefore, we conclude that the Oyster Creek core is currently undamaged. Additionally, the licensee has established

.arve'llance progra.' to monitor for signs of fuel damage occurring C 'ing tile subsequent restart. We consider the surveillance an acceptaDly prudent measure and request notifica-tion if any of the criteria of Seution V are exceeded.

We agree with the licensee's proposal to make the triple low alarm a safety limit for all reactor modes. This provides a measuraole basis for concluding that the core is covered.

We conclude that the hydraulic commun. cation between the annulus and the core is adequate.vhenever more than one recirculation loop dis-charge valve is open. This requirement will be assured by the proposed Technical Specification.

We conclude that the loss of reactor-vessel-inventory analysis provided adequately ocunds transients of this nature. Two key assumptions of the analysis are now covered by Technical Specifications because of the impor-tance of automatic actuation of the isclation condensor at double-low level.

6;th the double-low level and the maximum time delay before isolaiation condensor value opening shall be included as limiting safety system settings.

In addition, we have recor.tmended improvements for Oyster Creek regarding level indication and surveillance testing. These were discussed in Section VI.

Based on the foregoing, we conclude that there is reasonable assurance that operation of the Oyster Creek facility can be resumed without undue risk to the health and safety of the public.

n, F

VIII REFERENCES 1.

Letter dated May 12, 1979, fran I. Finfrock (JCP&L) to NRC and dn enclosed " Report on the May 2,1979, Transient at the Oyster Creek Nuclear Generating Station."

2.

Letter (undated), receivcd by NRC on May 17, 1979, from I. Finfrock (JCP&L) transmitting ENC Report XN-NF-79-47, " Evaluation of the Oyster Creek Reactor Core Liquid Level Following the Inadvertent Reactor High Presure Scram on May 2,1979," cated May 11, 1979 (Issue Date: May 15, 1979).

3.

Letter dated May 19, 1979 from I. Finfrock (JCP&L) to NRC enclosing an analysis titled " Bounding Loss of Coolant Inventory Transient for the Oyster Creek Plant."

4.

Letter dated May 19, 1979 from I. Finfrock (JCP&L) to NRC requesting changes to Technical Specification 2.1.D to extend the applicability of a safety limit, t nd a new Section 2.1.

to prevent the isolation of pump loops.

5.

J. D. Kahn and M. S. Foster, PTSBWR2 - Plant Transient Simulation Code for Boiling Water Reactors," XN-74-6 Revision 3.

6.

Telecopy, " Responses to Staff Questions on May 19, 1979 Submittal, Loss of Inventory Transient Analysis," received by the NRC on May 23,1979.

APPENDIX DESCRIPTION OF TRANSIENT AND SEQUENCE OF EVENTS RELATED TO SCRAM OF MAY 2,1979, AT OYSTER CREEK NUCLEAR GENERATING STATION (EDITED FROM JERSEY CENTRAL POWER & LIGHT CO., LETTER /REPCRT DATED 05/12/79)

INITIATING EVENT:

On May 2,1979, at 1350 hours0.0156 days <br />0.375 hours <br />0.00223 weeks <br />5.13675e-4 months <br />, an inadvertent reactor high pressure scram occurred during required surveillance testing on the isolation condenser high pressure initiation switches.

Two of the four reactor high pressure scram seasors share a common sensing line uith the isolation cordenser high pressure initiation switches being tested.

The technician performing the test was in the process of verifying that the sensing line excess flow check valve was open when the scram occurred.

The scram has been attributed to a momentary simultaneous operat.cn of two of the reactor high pressure scran sensors due to a hydraulic disturbance associated with valve nanipulations which was required by procedure to verify the position of the excess flow check valve.

These sensors are also used in the automatic recirculation pump trip logic which tripped the four operating recirculation pumps. The hydraulic disturbance also caused a momentary trip of the isolation condenser initiation switcher These sensors were not closed long enough for automatic initiation of the isolation condensers since a time delay is involved in the initiation 1ogic.

INITIAL CONDITIONS:

Plant Parameters at the Time of the Scram:

Reactor Power 1895 ftWt Reactor Water 79" Yarway (13'4" Above the top of the active fuel) 6.4' GEf1AC Reactor Pressure 1020 psig 0

Feedwater Flow 7.1 x 10 lbs/hr Recirculation Flow 14.8 x 10 gpm Equipment Out of Service Relevent to Event Seouence A.

One (SB) of the two startup transferaers was out of seri sce as p6r'nitted by Techcnical Specifications to ins,ect associated 4160-Volt cabling.

SB supplies offsite power to one bC r the station electrical distribution system when power is not available through the station auxiliary trans-former.

The 4160 Volt buses wh h receive power from SB are 18 and 1D.

Bus 10 supplies power to certain redundant safety systems. Bus ID is designed to be powered fro:n 22 Diesel Generator in the event power is not availaDie from either the auxiliary transformer or startup transformer.

Bus 1B supolies 4160-Volt power to non-safety related systens and hence, does not have a diesel backup power source.

[b

,3, B.

One (n) of the five recirculation loops was not in tervice due to a defective seal cooler cooling coil.

The pump suction valve was open, the discharge valve was closed, and the discharge valve oypass valve was open.

No other important systems or components were out of service.

EVENT SEQUENCE (Two = 1350 hours0.0156 days <br />0.375 hours <br />0.00223 weeks <br />5.13675e-4 months <br />):

TIME OF EVENT (Sec)

EVENT DESCRIPTION U

For the reason previously described a reactor scram occurred coupled with a simultaneous automatic trip of the four operating Recirculation Pumps. The Control Room operator verified that all control rods inserted and proceeded to drive-in the IRM and SRM Nuclear Instrumentation.

At this time, 4160-Volt power was being supplied from the auxiliary transformer during the coast-cown of the Turoine Generator System and the Feedw ter System was in operation. Recirculation flow started decreasing due to pump coastdown.

Stean flow started decreasing due to loss of heat production (scram) but feed flow rate renained at the rated leve!. Reactor vessel pressure decreased to the pressure regulator setpoint as stean flow decreased.

Reactor water level began decreasing due to steam void collapse in the core.

Q)

TIME OF EVENT (cont)

EVErlT DESCRIPTION (cont) 13 The turbine Generato-tripped at the no load trip point which initiates an automatic transfer of power from auxiliary to the startup transformers.

Power to Buses l A and IC successfully transferred from the auxiliary transformer to the SA startup trans-former.

Since 53 sas out of service at this time, power was lost to Buses 18 and 10.

As designed, Buses 18 and ID separated through operation o' breaker ID and Diesel Generator No. 2 fast started to power emergency loads on Bus 1D.

Loss of power to Bus IB caused the loss of Feed-water punps B and C and Condensate Pumps B and C.

Although power was available to the A condensate and feedwater pump via Bus lA, the A Feedwater Pump tripped on low suction pressure.

Reactor water level and pressure decreased since water was leaving the Reactor Vessel through the Steam Bypass Valves to the Main Condensers and no high capacity source of high pressure makeup water was available.

[b TIME OF EVENT (cont)

EVENT DESCRIPTION (cent)

In addition, the loss of power to Bus IB caused the B Cleanup System Recirculation Pump to trip which, in turn, caused an isolation of the Cleanup Syst,-m aue to low flow through the cleanup filter.

Furthermore, one condensate transfer pump and.he operating fuel pool cooling pump tripped.

An un-successful attempt was made to restart the A feedwater pump.

(The reasons for the restart failure are described later.)

(Event Recorder) 13.6 Reactor water level decreased to the Low level scram setpoint which is 11'5" above the top of the active fuel region.

(Event Recorder) 16.8 The output breaker on the No. 2 Deactor Protection System M.G. Set tripped due to loss of power to the drive motor. The output voltage from the M.G. Set had been maintained by flywheel action since the time of the turbine trip.

Power to the M.G. Set drive motor is fed indirectly through Bus 10 which was deenergized at this time.

2hb

-b -

TIftE OF EVENT (cont)

EVEtiT DESCRIPTION (cont) 31 The No. 2 Diesel Generator Breaker closed and supplied power to the ID Bus. A second control rod drive pump started.

13 Reactor water loss continued from steam flow to the main condenser.

Reactor isolation was manually initiated to conserve water by clos'ng the flain Steam Isolation Valves prior to an auw...atic isolation of the reactor on a Low-Low Reactor Water Level signal which occurs at 7'2" above the top of the active fuel region).

This action was taken at an indicated water level of approximately 30" on the Yarway instrunent which corresponds to 9'3" above the top of the active f uel region.

Note, that the uecrease in indicated water level and pressure was anplified by the effects of in-t*oducing cold feedwater into the vessel during the 13 second period prior to the Turbine Generator Trip.

The cold feedwater reduced the steam voiding inside the vessel thereby shrinking the water level.

298 313 TIME OF EVENT (cont)

E"ENT DESCRIPTION (cont) 49 The Main Steam Isolation Valves fully closed, thus stopping the loss of water from the vessel.

The reactor steam pressure increased.

Indicated reactor water level started to increase shortly af ter iso-lation when reactor decay heat reestablished a steam void distribution.

(Event Recorder) 59.6 The operator transferred the mode switch from RUN to REFUEL.

76 (1 min. 16 sec)

The operator placed the B isolation condenser into service to establish a sink for the renoval of decay heat from the reactor. At this time, the Control Room operator closed the A and E recirculation loop aischarge valves (these valves take approximately two (2) minutes to close).

It is postulated that at this time, the operator closed both B and C loop dis-charge valves. The conclusion that the five recirculation pump discharge valves were closed is based upon loop temperature response later in the event and is further supported by the Low-Low-Low level at 172 seconds. The D loop was isolated pre-viously (sae the equipment out of service section).

A

-d-TIME OF EVENT (cont)

EVENT DESCRIPTION (cont)

(Event Recorder) 90 (1 min. 30 sec.)

The reactor Low water level alarm cleared as water water was added from the isolation condenser to tue Primary Syster.

96 (1 min. 36 sec.)

The 3 isolation condenser initiation valve fully opened after 20 seconds. Tne temperature of the E recirculation loop, which serves as the B isolation condenser water return path, decreased due to the effects of cold water from the isolation condenser.

The D recirculation loop temperature did not change appre;iably.

A, B, and C recirculation loop temp-er:tt 'es increased slightly.

The heat-up is attriDuted to natural circulation through the partially open dis-charge valves carrying hot water (536 F) warming the lines previously cooled by the effects of cold feedwater.

The reduced flow area between the lower downcomer and lower plenun area. due to the slow closure of the discharge valves, started to cause a shift in water inventory from the core area to the upper and lower downtomer region. The shif t was due to the isolation 298 31-

,9, TIME CF EVENT (cont)

EVENT DESCRIPT!L3 (cont) condenser returning r.ondensed stean from the core area to the downcomers. The water inventory shif t continued as the discharge valves moved to the full closed position.

(Event Recorder) 172 (2 nin. 52 sec.)

The rr : tor Low-Low-Low wa ter level instrument trip Last recorded point on point was reached.

186 sec. (3 min. 6 sec.)

All recirculation loop discharge valves fully closed.

At this time, based upon closure initiation, the cooldown of the E recirculation loop stopped and a heat-up began. The indicated reactor water level increased due to the shi f t in water inventory.

Recirculation loops A, B, and C continued to heat up.

The mechanism of the heat up was due M heat transSr between the hot recirculation loop piping and the water in the piping.

Reactor pressure continued to decrease as a result of isolation condenser operation.

250 (4 nin.10 sec. )

The operator removed B isolation concenser frcn service to reduce the rate of cooldown of the Primary System.

The indicated annulus water level fell due to a return of water to the ore region from the downcomer region through the five, two-inch bypass 298 7> g valves around the recirculation loop discharge valves.

Juring this period, the water was stored in th::

recently securea isolation conden9r.

The recirculation 1 cop discharge te.1peratures reached equilibrum anc folicwea a sicw cooldown trena.

~10-TIME OF EVENT (cont)

EVENT DESCRIPTION (cont) 270 (4 nin. 30 sec.)

The reactor pressure increated due to the effects of removing B isolation condenser. The rate of decrease in water level shif ted from a ramp of approximately 37 in/ min to 2 in/ min. The reason for this change is the isolation condenser tube assembly was completely filled.

The flow through the five 2" bypass valves continued.

450 (7 min. 30 sec.)

Both isolation condensers were placed in service.

This caused an increase in indicated water level and a decrease in pressure. The A recirculation loop tenperature decreased because cold water from the A isolation condenser entered the A recirculation loop by design. A portion of the water passed through the loop via its 2" bypass line contributing to the cool-down.

528 (8 min. 48 sec.)

The operator renoved the B isolation condenser from service to slow the rate of cooldown. The indicated annulus water level reached a "1aximum of apprcximately 14.4 feet above the top of the active fuel (88" on Yarway).

This is considered to be above normal water level for h

full power operation.

When the B isolation condenser

-ll-TIME OF EVENT (cont)

EVENT DESCRIPTION (cont) was removed from service, indicated water level decreased to 13'3" above the top of the active fuel where it remained until approximately 1212 seconds when the A isolation condenser was removed from service.

The reactor pressure continued to decrease and all r6 Circulation loop temperatures continued to to trend downward.

Indicated water level was stable at this time because the head of water in the down-comer region was sufficient to establish equilibrium between the water entering the core region via the 5 two inch bypass valves and condensed steam returning to the downcomer from the isolation condensers.

540 (approx) (9 min)

The four (4) Low-Low-Low water level indicators were verified locally to be below their alarm setpoint which is 10" above 4' 8", or 5' 6" aoove the core.

The reading appea;Td to be at or below the instrument's lower level of detection.

d10 (approx) (13 min 30 sec) A recheck of the triple Low water level indicators showed that the pointers were active (moving) although they continued to read below their alarn point.

The instrument was Jt or slightly above its lower level of 298 318 de tec ti o n.

~12-TIME OF EVErlT (cont)

EVEtlT DESCRIPTI0tl (cont) 1212 (20 min 12 sec)

The operator removed the A isolation condenser from service stcpping the removal of water from the core region.

Indicated water level decreased as the water in the downcomer region flowed into the core region.

R e ac tt,r pressure started to increase cte to the decay heat s',eam production.

1488 (24 min 48 sec)

The isolation condensers were used seve-al mor4 -

times to control the reactor cooldown with pre-dictable increases in indicated water level and reduction in pressure. This mode of operation continued until 1914 seconds.

1914 (31 min r1 sec)

In order to more correctly dete:mine the plant cool-down rate C recirculation pump was started and tne discharge valve was opened.

It war noted that the indicated water level dropped approximately 3 feet in less than 2 minutes.

The operator shutdown the C recirculation pump and isolated it to investigate the reason for the drop in level.

In response to the inaicated water level droo, an additional attempt was

.nade to start the A feedwater pump. The punp had bb failed to start earlier cue to a tripped overload on the auxiliary oil pump that is interlocked in the pump starting sequence. The indicated water level started to increase dtie to the action of the operating isolation TIME OF EVENT (cont)

EVENT DESCRIPTI0tl (cont) condenser transferring water to the downcomer region.

When the C recirculation loop was started the loop temperature increased from approximately 400 F to 470 F.

The other recirculation loop temperatures continued to trend down. At this time Low-Low-Low alarm may have cleared.

2208 (36 min 48 sec)

The A Feedwater pump was successfully started by locally starting the auxiliary oil pump which satisfied the required starting interlocks.

Indicated water level increased to a level corresponding to 13'8" above the top of the active fuel region.

Realization occurred that the indicated water level and core water level may not have been the same when it was recognized that the five recirculation loop discharge valves were, closed.

2340 (39 min 0 sec)

The A recirculatten pump was placed in service at a flow rate of approximately 1.9 x 104 gpm, thus removing the disparity between water level measuring systems.

The Low Lcw Low water level alarms ware kncwn to be cleared at this time.

Indicated water level drcpped approximately three feet to 11'4" above the top of the active fuel.

The A recirculation loop temperature 298 320 rose fec= 375 r to 4es r wher it was placed in service.

Steps were initiated at this time to bring the plant to " cold shutdcwn condition".

. TIME OF EVENT (cont)

EVENT DESCRIPTION (cont) 2700 (45 mir. O sec.)

Reactor Protection System 32 restored and scran reset.

3600 (1 hr.)

The SB transfomer was returned to ser/ ice and Bus 1B was eneraized, and normal shutdown proceeded.

(8 hr. 40 min.)

Cold shutdown achieved.

298 321