ML19248D014
| ML19248D014 | |
| Person / Time | |
|---|---|
| Site: | Davis Besse  |
| Issue date: | 07/06/1979 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML19248D011 | List: |
| References | |
| FOIA-79-98 NUDOCS 7907300406 | |
| Download: ML19248D014 (38) | |
Text
.
July 6, 1979 EVALUATION OF LICENSEE'S COMPLIANCE WITH THE NRC ORDER DATED MAY 16, 1979 TOLEDO EDISON CCMPANY AND THE CLEVELAND ELECTRIC ILLUMINATING CCMPANY DAVIS-BESSE NUCLEAR POWER STATICN, UNIT No. 1 DOCKET NO. 50-346 INTRODUCTION By Order dated May 16, 1979, (the Order) the Toledo Edison Company and the Cleveland Electric Illuminating Company (TECO or the licensee) were directed by the NRC to take certain actions with respect to Davis-Eesse Nuclear Power Station, Unit 1 (08-1).
Prior to this Order and as a result of a preliminary review of the Three Mile Island, Unit No. 2 (TMI-2) accident, the NRC staff initially identified several human errors that contributed significantly to the severity of the event. All holders of operating licenses were subsequently instructed to take a number of immediate actions to avoid repetition of these errors, in accordance with bulletins issued by the Commission's Office of Inspection and Enforcement (IE).
Subsequently, an additional bulletin was issued by IE which instructed holders of operating licenses for Babcock &
Wilcox (31W) designed reactors to take further actions, including immediate changes to decrease the reactor high pressure trip point and increase the pressurizer power-operated relief valve (PORV) setting."
"[IE Bulletins Nos. 79-C5 (April 1, 1979),79-05A (April 5, 1979), anc 79-053 ( April 21,1979) a: ply to all 31W facilities.]
553127
- .c:. st:.:2 ;
7 90 73009g' g,
. The NRC staff identified certain other safety concerns that warranted addi-tional short-term design and procedural changes at operating facilities having B&'d designed reactors.
Those were identified as items (a) through (e) on page 1-7 of the " Office of Nuclear Reactor Regulation Status Report to the Commission" dated April 25, 1979. After a series of discussions between the NRC staff and the licensee concerning possible design =cdifications and changes in operating procedures, the licensee agreed, in letters dated April 27, 1979 and May 4, 1979, to perform promptly certain actions.
The Commission found that operation of the plant should not be resumed until the actions described in Items (a) through (g) of paragraph (1) of Section IV of the Order are satisfactorily completed.
Ourevaluatienofthelicensee'scompiiancewithitems(a)through(g)of paragraph (l; of Section IV of the Order is given below.
In performing this evaluation we have utilized additional information provided by the licensee in letters dated May 11, 18, 19, 22 (2), 23 (2), 25 (2), 29 and June 15 (2), 18, 21, 23 and 25, 1979 and numerous discussions with the licensee's staff.
Confirmation of design and procedural changes was made by members of the NRC staff at the DS-1 site.
An audit of the training and performance of the 03-1 reactor operators was also performed by the NRC staff to assure that the design and procedural charges were understood and were being correctly implemented by the operators.
559128
3 EVALUATION Item (a)
It sas ordered that the licensee take the following action:
" Review all-aspects of the safety grade auxiliary feedwater system to further upgrade components for added reliability and performance.
Present modifications will include the addition of dynamic braking on the auxiliary feedpump turbine speed changer and crovision of means for control room verification of the auxiliary feedwater ficw to the steam generators.
This means of verification will be provided for one steam generator prior to startup from the present maintenance outage and for the other steam generator as soon as vendor-supplied equipment is available (estimated date is June 1, 1979).
In addition, the licensees will review and verify the adequacy of the auxiliary feedwater system cacacity."
The auxiliary feedwater (AFW) system at 08-1 consists of two safety grade AFW pumos cacable of being actuated and controlled by safety grade signals that ensure the availacility of feedwater to at least one steam generator, under the assumed conditions of a single failure.
In addition, the capability to manually actuate and control AFW is available in the control room.
The sources of sater include two condensate storage tanks (CST), the service water system and the fire protection system.
The CSis provide the normal supply (non-safety-grade) and tne service aater system is used as a backuo safety g ace sucoly.
55S199
A low level in either CST is alarmed to the operator and a continuous level is displayed inside the control room.
Low pressure switches on the AFW pump suction provide safety grade signals to automatically shift suction for the pump frcm the CSTs to the backup service water supply.
Additionally, the operator could also manually transfer the AFW suction to the fire water storage tank (FWST) in the fire protection system.
Both steam-driven auxiliary feedwater pump turbines at 08-1 are provided with a governor used for variable pump speed control.
The governor is equipped with a small DC motor which changes the speed setpoint on the turbine control valve, thereby controlling steam flow which regulates the turbine and pump speed.
This DC motor receives " raise-and-icwer" pulses frca the safety grade steam generator level control system or the manual conteci switches (located in the control rcom), which change the turbine speed as required.
Pulse length is automatically increased the further steam generator level deviates from its setpoint.
These changes in pump speed alter the AFW ficw and thus control the water level in the steam generators.
A " dynamic brake" feature has been added, which consists of a resistor and electrical contac+3 in parallel with the windings of the CC motor. When the control pulse is terminated, the braking resistor is placed in parallel with the motor windings, causing rapid dissipation of the energy associated with the motor mcmentum (thus reducing the amount of motor coast).
This, in turn, reduces the amount of pu*p speed Oversh00t, there0y allcwing fewer sceed changes to match the AFW #1:w rate to the steaming rate of the steam generators.
5.? ' 3 D
. The licensee has also added flow rate indication for both steam generator AFW inlet lines.
Each inlet line has a pipe-mounted ultrasonic flow transducer and signal conditioner.
These are located in the auxiliary building and are accessible during normal plant operations.
The signal conditioners provide outputs both locally and in the control room on the AFW pump section of the main control console.
Each device is designed to provide flow rate indication to each steam generator from 0 to 1000 gpm The systems are powered from 120 VAC, 60 Hz buses which are fed by redundant non-Class IE station inverters.
Functional testing of the installed auxiliary feedwater flow rate indication is to be conducted in conjunction with the functional testing of the dynamic braking modification of AFW puro turbine controls.
The staff concludes that tne dynamic brake and AFW flow rate indication modifications are acceptable contingent upon successful testing prior to restart.
We nave reviewed the piping and instrumentation diagrams and have determined that no active failure of a mechanical componcnt, such as a pump or valve, would preclude obtaining the required AFW flaw rate.
The licensee 5as pre-viously performed tests of the manual and automatic level control system.
The test results showed that the control system functioned as designed to control steam generator level.
Verification of acceptable flow capacity for each of the two AFW pumps was based upon recorded steam generator level changes folicwing a previous reactor trip.
These data shewed that each pump exceeded the design flow rate of 300 gpm at a steam generator pressure of 1050 psig.
(The 800 gpm is the flow rate delivered to the steam generators and does not include the accroximately 250 gpm recirculation flow rate.)
559131
. Additional information submitted by the licensee (letter from Lowell E. Roe (TECO) to Mr. Robert W. Reid (NRC) dated May 23,1979) shows that a total minimum flow, to one or both steam generators, of 550 gpm is required to support the accident analfses.
Based on these data and analyses, and the agreement by the licensee to perform checkout testing of the dynamic braking and flow rate indication modific'ations prior to restart, we conclude that adequate assurance exists that the AFW system will deliver the recuired flow
~~
rate upon demand.
By letter (Lowell E. Roe (TECO) to Mr. Robert W. Reid (NRC) dated May 23, 1979), the licensee provided results of a review of the operating history of the APJ system at DB-1.
The largest numoer of failures
- occurred during the initial operating and debugging phase of the f acility.
Fourteen (la) of tne seventeen (17) reported failures occurred prior to January, 1973.
Subsequent to implementing system design changes as a result of several of these failures, the systems failure rate has been reduced and its reliability enhanced.
There were 3 failures of AFW system components from January 1973 to May 1979.
(There were a total of 65 actuations of the AFW system in this time period.)
Three different components in the AFW system were involved in these three failures:
(1) the speed control circuit for #1 AFd pump turoine, (2) a faulty limit switcn on an APJ discharge valve, and (3) two sticky AFW pump turbine steam supply valves.
In each case, the licensee performed corrective actions.
'[For the purpose of demarstrating improvement in tne performance of the AFW system, tne licensee has defined a failure of the AFW system to be any event for enich at least one train of the AFW system is not cel' sering cesign ' low to a steam generator.]
559132
A later letter (Lowell E. Roe (TECO) to Mr. Robert W. Reid (NRC) dated June 29, 1979) addressed a series of pressure switch failures which were discovered on May 21, 1979, and which affected both AFW trains.
An evaluation of th'ese failures by the licensee concluded that both trains would have automatically actuated if required, but that one train would not have shifted automatically to the service water supply.
The NRC staff has discussed these failures with TECO and has requested that an improved surveillance program for these pressure switches be initiated to determine the cause of the failures and the cotimum calibration interval.
The licensee has agreed to an increased frequency of switch calibration.
In addition, the licensee has made crocecural changes, requested by the staff, to instruct the operator to manually shif t to the alternate sucply of water for the AFW pumps, when the CST level drops to three feet (if automatic switcnover has not occurred).
This procedure provides greater assurance that, even with failuics of this nature, the AFW system is available during the longer term. More recently (July 5, 1979), the NRC staff was verbally informed by TECO (Mr. G. Novak) of a valve malfunction which tcck place in an AFW system pump discharge line on July 4, 1979.
The cause of the valve failure (failed closed) was apparently due to an electrical malfunction.
TECO stated that they would request the motor vendor to examine the failed motor to determine the cause of the mal-function.
The IE site inspector has been recuested to follow this evaluation and to determine the need for further study and corrective action if necessary.
The licensee has noted that marual capability (local handwneel) to open the valve existed at the time of the failure and that the redundant AFW train was available.
559133
.g.
With regard to the operating history of the AFW system, the staff concludes that the licensee has increased the reliability of the AFW system by imple-menting appropriate corrective actions and design modifications. With regard to the more recent pressure switch and valve failures, the staff concludes that adequate assurance exists that the causes of the failures are being pursued by the licensee in a timely manner, and that the IE site inspector will follow the need for further corrective action.
In addition, the licensee has revised the administrative procedure pertaining to valve alignment and control.
These revisions to AD 1839.02 ("Cperation and Control of Locked Valves") provide further assurance that mispositioning of AFW system valves would be detected.
Based on the above evaluation, the NRC staff concludes that the licensee has complied with the requirement of Item (a) of the Order.
Item (b)
It was also ordered that the licensee:
" Revise operating procedures as necessary to eliminate the option of using the Integratec Control System as a backup means for controlling auxiliary feecwater flow."
55S134
, As indicated in Item (a), the 08-1 AFW system has been designed as a safety grade system and, as such, is separate from the integrated control system (ICS); however, the licensee has indicated that the APd system is capable of being switched to the ICS mode for a backup means of control.
As currently designed, the AFW system has three operational codes of controlling flow:
"ICS control", " auto essential" and " manual." We recuested that the licensee consider a more positive means to assure the continued separability of the ICS
' ~~
control position of the modc selector switches.
The licensee agreed (letter from Lowell E. Roe (TECO) to Mr. Robert W.
Reid (NRC) dated June 15, 1979) to install a mechanical stop on these switches to further deter use of the ICS control position.
The IE site inspector has verified the installation of this mechanical stco.
The licensee has revised $P 1106.06 (" Auxiliary Feedwater System"), which describes procedures for AFW system operation.
This procedure specifically prohibits the use of the ICS control position on the mode selector switches.
Procedural steps for placing the AFW system in service for plant startup require the operator to place the AFW mode selector switches in the auto-essential position. We have reviewed the revised procedure for AFW switcn operation and conclude there is sufficient guidance to prevent use of the AFW system in the ICS mode of control.
Other plant procedures that made reference to the ICS control moce of AFW have been revised by tne licensee to no longer authorize that mode of control. The 559133
. staff has reviewed those procedures and concludes that those revisions are adequate.
In addition, the NRC staff audit confirmed that the control roc operators are aware that ICS control of AFW is prohibited.
Based on the above evaluation, we conclude that the licensee has complied with t.1e requirements of Item (b) of the Order.
Item (c)
The Orcer requires that the licensee:
" Implement a hard-wired control grace reactor trip that would be actuatec on less of main feed ater and/or turbine trip."
The CS-1 original design did not have a direct reactor trip from a malfunction in the secondary system (loss of main feedwater and/or turbine trip).
To cbtain an earlier reactor trip (rather than delaying the trip until an operator took action or until a primary system parameter exceeded its trip setpoint),
the licensee committed to install a hard wired, control grade reactor trip on the less of all main feedwater and/or on turbine trip (letter frca Lcwell E. Rce (TECO) to H. Centon (NRC) dated Acril 27, 1979).
The purpose of this antici-patory trio is to minimize the pctential for opening of the pcwer-operated relief valve (PORV) and/cr the safety valves on the pressurizer.
This ne.
559136
~.
e circuitry -.eets this objective by providing a reactor trip during the incipient stage of the related transients (turbine trip and/or loss of main feedwater).
TEC0 has added control grade circuitry to 08-1 which is designed to provide an automatic reactor trip when either the main turbine trips or there is a reverse differential pressure of 177 psid across both of the two main feecwater cneck valves (one check valve is located in the main feedwater discharge piping associated with each steam generator).
The main turbine trip is sensed by a normally deenergized auxiliary relay associated with the main turbine generator master trip bus.
The power for this bus is provided from a 24 volt DC source, which in turn is proviced power (through *ectifier circuitry) from a non-Class lE inverter supolied 120 volt-AC distribution panel.
A contact from the above auxiliary relay is arranged into a 120 volt AC circuit containing four normally deenergized relays.
Power for this 120 volt circuit is provided from a Class lE inverter supplied distribution panel.
The design for these four relays and acpropriate associated circuitry conform to Class lE requirements, including physical independence and provisions for testing.
Each of these four relays provide one contact which is arranged in series with one of the four Class lE undervoltage coils associated with one of the four AC reactor trip circuit breakers (one undervoltage coil associated with each AC reactor trip circuit breaker). When these relays are energized, power to the associated Class lE undervoltage coils is interrupted so as to produce the desired reactor trip.
5591M
~
. As indicated above, differential pressure switches across check valves, located in the main feedwater pump discharge piping, actuate upon sensing a reverse differential pressure across these check valves.
Two contacts from these differential pressure switches are arranged into a 125 volt DC circuit, which is provided power frem a Class 1E 125 volt distribution panel.
This circuit contains two associated DC relays. Two contacts (one contact per relay) associated with these relays are arranged in series.
This series contact arrangement is provided in parallel with the contact associated with the main turoine generator master trip bus.
The remaining circuitry associated with this trip is identical and common (shared) to that described above for the turbine trip (including power supply identification).
Provisions have been included in the design to manually bypass and to reinstate the reactor trip feature associated with the main turbine generator trip.
T0 l
sup? ement this feature, the design includes an annunciator which actuates whenever this reactor trip is bypassed and the reactor power level is above 15 percent.
Access to this bypass switch will require a key which is under suitable administrative control.
Operator verification of the bypass removal is recuired by procedure during power escalation.
The NRC staff has revicwed these procedures and concludes that sufficient administrative control exists No bypass features are included in the design for the reactor trip feature associated with the loss of main feedwater circuitry.
During normal startup or shutcown, an electric auxiliary pumo is used -nen the steam driven main feedwater pumps are not available.
559138
. The licensee has analyzed this additional circuitry with respect to its independence from the existing reactor trip system and to assure that the design and operation of this additional circuitry will neither degrade the reliability of the existing reactor protection system nor create any new adverse safety system interactions.
Based on our review of the implementation of the added trip circui'try, with respect to its independence from the existing tric circuitry, we conclude that this addition sill not degrade the existing raactor protection system design.
In addition, the licensee has satisfactorily completed testing of this trip circuitry.
The licensee has co mitted to cerform a monthly periodic test of the added circuitry to demonstrate its a::ility to open the AC reactor trip circuit breakers (tripping of the AC reactor trip circuit breakers via the uncer-voltage trip circuit).
We conclude that there is reascnable assurance that the adcitional circ itry will perform its intended function.
Based on the above evaluation, we conclude that the licensee has complied with the requirements of Item (c) of the Order.
Item (d)
This Item in the Order requires the licensee to:
559139
" Complete analyses for potential small breaks and develop and implement operating instructions to define operator action."
By letter, (Lowell E. Roe (TECO) to H. Denton (NRC) dated April 27, 1979), the licensee agreed to provide the analyses and operating procedures of this requirement.
B&W, the reactor vendor for the CB-1 plant, submitted generic analyses for B&W plants entitled, " Evaluation of Transient Sehavior and Small Reactor Coolant Systems Breaks in the 177 Fuel Assembly Plant," and supplements to these analyses (References 1 through 5).
Additional information specific to 05-1 was transmitted in References 6 to S.
The transmittal under Reference 6 contains Volume III for tne B&W generic study covering raised-loop plants.
Reference 7 provides additional analytical results soecific to CB-1 with appropriate auxiliary feecwater flow rates.
Reference 8 provices additional analytical results for the loss of all main feecwater flow accident with loss of all AFW.
This latter analysis demonstrates that capability exists at 08-1 which the acerator could use in the unlikely event of a loss of main feedwater and a loss of both safety grade AFW trains.
This capability consists of using the combined functions the makeuo pumps," the electric startup auxiliary feecwater pump and the PCRV to achieve deprere';rization (only if necessary).
We requested that the availability of this option be incorporated in procecures at 03-1.
The NRC staff will review these procedural changes prior to startup.
'at :5 '_,. e Ta<suo p os are secarate f r:- the " : :2ros.
559140
. i By letter, (Lowell E. Roe (TECO) to Mr. Robert W. Reid (NRC) dated May 22, 1979), TECO referenced the analyses as appropriate for 08-1.
The staff evaluation of the B&W generic stucy has been completed and the results of the evaluation will be issued as a NUREG report in July 1979.
A principal finding of our review of the CB-l submittals and the generic study is a reconfirmation that less of-coolant accident (l.CCA) analyses of breaks at the icwer end of the small breaks spectrum (smaller than 0.04 ft.2) demonstrate that a ccmcination of heat removal by the sterm generators, high pressure injection (HFI) system and througn the break ensure adequate core cccling.
The AFW system used to remove heat tnrough the steam generators has been modified to enhance its reliability as discussed in Item (a).
Uncovering of tne reactor core is not predicted for breaks at this enc of tne small break scectrum with these features available, therefore, cladding temperatures do not rise significantly above pre-reactor trip temperatures (less than 800 F), and remain wcll within the i0 CFR 50.46 limit of 2200 F.
The ability to remove heat via the steam generators nas always been recognized to be an important consideration when analyzing very small breaks.
The licensee demonstrated that permanent less of main feecwater and loss of AFW for the first 20 minutes of a small LOCA will not result in uncovering the reactor core.
However, when AFW is delayed beyond this time, a positive reliance on AFW actuation exists as a result of the relatively low (1500 psig)
HPI system shutoff nead for CB-1.
Thus permanent loss of both main anc auxiliary 559141
. feedwater could result in uncovering the core and fuel damage for the facility because of the unavailability of the high pressure injection pumps.
Makeup pump and startup feedwater pump actuation, as discussed in the analysis of Reference 8 for the loss of feedwater accident with permanent loss of AFW, are consicered potentially capable of raintaining the vessel mixture above the core for a small break, but this scenario was not confirmed in the small break analyses.
The licensee's position is that such analyses are unwarranted irL light of the safety grade design of the AFW system.
Since the additional heat remcval and coolant makeup cacability does exist at 08-1, we requested that the procedures identify the availability of this option.
Imclementation of this ::roce:: ural change will be verified by the staff prior to restart.
While tne staff recognizes that the AFW system is safety grace, we also note that the licensee has agreed to continue to review performance of the AFW system for assurance of reliability and performance.
Consistent with this long-term agreement, we will require that the licensee modify the plant to provide the greater degree of diversity offered by a 100% capacity motor-cperated AFW pump, or an alternative acceptable to the staff.
Another aspect of the analytical studies conducted was an assessment of the effect of recent design changes on the lift frequency of pressurizer safety and relief valves.
The design changes included:
(1) a change in the setpoint of the PCRV from 2255 psig to 2000 psig, (2) a change in the high pressure reactor trip setpcint from 2355 psig to 2300 psig, and (3) tne installation of anticipatory reactor trips on turbine trip and/or loss of main feedwater-In the cast, curing turoine trip and loss ::f feed-ater transients the POUV aas 559142
. lifted. With the new design, these transients do not result in lif ting of this valve.
However, lif ting of both PORV and safety valves might occur in the cases of rod withdrawal or inadvertant boron dilation transients, using the normally conservative assumptions presented in Chapter 15 of the Final Safety Analysis Report (FSAR).
The above design changes did not affect the lift frequency of the valves for these Chapter 15 safety analyses.
Based on our review of the analyses presented by B&W, the staff.has determined that a loss of all main feedwater with (1) an isolated PORY (closed block valve), but safety valves opening and closing as designec, or (2) a stuck cpen PORV consequentially does not result in uncovering the reactor core, provideo AFW pumos are initiated within 20 minutes.
It is also concluded, that in the event of a loss of all AFW for either case. covering of the ccre would be sustained to long-term cooling by operator actions described in the analysis of Reference 8.
These actions consist of starting at laast one of the two makeuo pumps, starting the startup feedwater pump, and opening the PORV (only if needed).
Based on the consecuences calculated for small break LOCAs and loss of all main feedwater events, and taking into account the expected reliability of the AFW and HPI systems for 08-1, we conclude that the licensee has comolied with the analyses portion of Item (d) of the Order.
To succort icng-term operation of the facility, recuire ents will be developed for adciticnal and more detailec analyses of loss of feed. ater and otner 559143
. anticipated transients.
More detailed analyses of small break LOCA events are also needed for this purpose.
Accordingly, the licensee will be required to provide the analyses discussed in Sections 8.4.1 and 8.4.2 of the recent NRC
" Staff Report of the Generic Assessment of Feedwater Transients in Pressurized Water Reactors Designed by tr. Babcock and Wilcox Ccmpany" (NUREG 0550).
Further details on these analyses and their applicability to other FWRs and SWRs will be specified by the staff in tne near future.
In addition, to assist the staff in developing. Tore detailed guidance on design requirements of relief and safety valve reliability during anticipated transients, as discussed in Section 8.4.6 of NUREG 0560, the licensee will be required to provide analyses of the lif t frequency and the mechanical reliability of the pressurizer relief and safety valves of the DB-1 facility.
The B&W analyses show that some operator actions, both immediate and follcwup, are required under certain circumstances for a small break accident.
Immediate operator actions are defined as those actions, cccmitted to memory by the operators, which must be carried out as soon as the problem is diagnosed.
Folicwup actions require operators to consult and follow steps in written anc approved procedures.
These procedures must always be readily availaole in the control room for the ocerators' use.
Guidelines were developed by SiW to assist the cperating EiW facilities to deveicp emergency procedures for the small break accident.
559144
. The "Coerating Guidelines for Small Breaks" were issued by B&W on May 5, 1979 and reviewed by the NRC staff.
Revisions recommended by the staff sere in-corporated in the guidelines." In addition, by letter, the licensee submitted supplemental guidelines (Lowell E. Roe (TECO) to Mr. Robert W. Reid (NRC) dated May 22, 1979).
In response to these guidelines, the licensee made substantial revisions to EP 1202.C6 (" Loss of Reactor Coolant and Reactor Coolant Pressure"), EP 1202.14 (" Loss of Reactor Coolant Flow /RCP Trip"), and ED 12C2.26 (" Loss of Steam Generator Feed").
These emergency procedures define the required operator action in response to a spectrum of accicents including a LCCA in conjunction with various equipment availability and failures.
The procedure dealing witn loss of reactor coolant (EP 1202.C6) is divided into three sections.
The first section deals with small reactor coolant system leaks within the cacacity of the makeup pumps and assumes the reac.or does not automatically trip.
The second section assumes a small break within the capacity of the HPI system and a situation where the SFAS** and reactor trips may or may not automatically occur.
This section incorporates the B&'a small break guidance and provides for operator actions in the event other
"(Letter from J. Taylor (31W) to Z. Ros: toc:y (NRC) dated May 16, 1979]
"*[The safety features actuation system (SFAS) monitors variables to detect loss of reactor coolant system boundary integrity.
Uoon detection of "out-of-linit" conditions of these variaoles, the system initiates various actions, decencing uoon the location and severity of the "out-of-limit" conditions measured.
These actions can include:
initiation of emergency core cooling (ECC), which censists of high pressure injection (HPI) and low pressure injection (LPI);
ccatai rent vessel cooling and isolation; containment vessel spr3y systems; a-d starting of the emergency ciesel generators.]
559145
. systems ':"e"
. actor ccolant pumps) do not operate as expected.
The third section of this procedure deals with a pipe rupture well in excess of the capability of the makeup and/or HPI pumps (a large break in which the system depressurizes to the point of low pressure injec, tion).
Automatic reactor trip and SFAS actuation are assumed.
In all cases cealing with a small break, the operator actions are aimed at achieving a safe cold shutdcwn in accordance with the normal cocidown procecure.
~ __
As indicated above, procedures provide guidance to the ocerators for dealing with small breaks in the event of a degraded condition (such as loss of reactor coolant cumps).
If the reactor coolant pumps are inoperable, the operator is directed to establisn and verify natural circulation.
Procecural steps to restore reactor ccciant pump oceration, once a pump becomes available, are provided.
In the event natural circulation cannot be established and a reactor coolant pump cannot be restartec and plant pressure reaches 2300 psig, tne operator is provided procecural steps to relieve the heat energy via the FORV.
(Additional relief ca acity is provided via the ccde safety valves if the PORV is inocerable).
In the event that normal feedwater is lost to the steam generaturs, auxiliary feedwater is automatically initiated via the safety grade AFW system.
EP 1202.25 provides ocerator guidance in this event. With SFAS actuatien, steam generator level is aut;matically maintained at 96 inches on tne startuo range to assure adequate neat removal during the small break event.
559146
. For all cases in which HPI is manually or automatically initiated, the operators are specifically instructed to maintain maximum HPI flow unless one of the two following criteria is met:
(1) Low pressure injection has been operating for greater than 20 minutes with flow rates in excess of 1000 gallons per minute per train, or (2) All hot and cold leg temperatures are at least 50 cegrees below the saturation tercerature for the existing reactor coolant system pressure.
If the 50 degrees subccoling cannot be maintained after high pressure injection cutoff, the high pressure injection shall be reactuated.
This requirement to determine and maintain 50 F subcooling has been incorporated into EP 1202.06 (" Loss of Reactor Coolant and Reactor Coolant Pressure") and EP 1202.24 (" Steam Supply System Rupture").
The procedures also provide instructions to the operators to check alternate instrumentation channels to confirm key parameter readings, such as the degree of subccoling.
Accordingly, the use of core exit thermoccuples as alternate temperature indicators is addressed in the procedures.
Under degraded cooling conditions (such as a LOCA), the pressure-tamperature limits considered in the Technical Specific =-
tions are not applicable to the ensuing decressurization and cooldown cecause tnese limits were cevelopec for normal and upset operating conditions only.
Density differences between the downcomer and reactor core will cause recirculation fios tetween tne core exit and downcomer via tne vent salves.
559147
Mixing of the hot core exit water with the cold HPI water (or makeup water) will provide sufficiently warm vessel temperatures to preclude any significant
'hermal shock effects to the vessel.
Subsequent restoration of AFW would t
depressurize the reactor coolant system to belcw 600 psig where pressure vessel integrity is assured for any reasonable thermal transients that might sucsequently occur.
E&W has agreed to provide a detailed thermal-mechanical generic report on the behavior of vessel materials for those extreme conditions.
The " Loss of Reactor Coolant and Reactor Coolant Pressure" procedure was reviewed by tne NRC staff to determine its conformance with the B&W guidelines.
Ccmments generated as a result of this review were incorporated in a further
" revision to the procecure.
A memoer of the NRC staff walked througn this emergency procedure in the Cavis-Besse control room.
The procedure was jucged to provide adequate guidance to the operators to cope with a small break LCCA.
The instrumentation necessary to diagnose tne break, the indications and controls recuired by the action statements, and the administrative controls wnicn prevent unacceptable limits from being exceeded are readily available to tne operators.
We conclude that the operators should be able to use this procedure to bring the plant to a safe shutdown condition in the event of a sr.all break accident.
An audit of 9 of the 25 licensed reactor operators and senior reactor operators was concucted by the NRC staff to determine the operators' understanding of tre small break accident, including 'o- :ne,. are recuired to :iagnose anc r
es: rd ::
't.
T e CE-1 staf' 535 ::rc :ta 5:e:ia t a'H g sass' ns f:- tre 3
npP9M 559148 ytw nunL t.
j
.s e-o
. operators on the concept of and use of Emergency Procedure 1202.06.
The operators were found to have sufficient knowledge of the small break pheno-menon and the general requirements of the emergency procedurc, although some deficiences were identified which were primarily due to the operators' lack of f amiliarity with the recently revised procedure.
All operators will receive additional training on EP 1202.06 and a facility administered audit prior to assuming licensed duties during power operation.
The audit of the operators also included questioning about the TMI-2 accident and tne resulting design changes made at 03-1.
The discussions covered the initiating events of the incident, the response of the plant to the simul-taneous loss of feedwater and small break LOCA (PORV stuck open), and operator actions that were taken during the course of the incicent.
In accition, similarities and differences between the TMI-2 accident and the 08-1 incident of September 24, 1977 were discussed.
We found their level of understanding sufficient to be able to respond to a similar situation if it happened at 03-1.
We also conclude that they have adequate knowledge of succooling and saturated conditions and are able to recognize each condition in the primary coolant system by several methods.
The AFW system was also discussed during the audit to determine the operators' ability to assure proper starting and operation of the system during normal conditions, as well as during adverse conditions such as loss of offsite power or loss of main feedwater.
The long-term operation of tne system was examined to evaluate the operators' ability to use available manual controls and water suoplies.
The level of uncerstanding was found to be suf ficient to assure oro;e snort-and long-term W '!:
- .c the stear generators.
559149
. The licensed reactor operators and senior reactor operators have received training concerning the TMI-2 accident, small break LOCA recognition, design modifications, and procedure changes.
The training included formalized class-room sessions and on-shift review of training material and emergency procedurc changes.
To det:rmine the effectiveness of this training program, a written am was acministrated to all licensed personnel by the licensee. The exam r
was re/fe-ed and found acceptable by a memoer of the NRC staff.
Individuals scoring less than 90 percent on the exam will receive additional training and will not assume licensed duties until a score of at least 90 percent is attained on an equivalent, but different exam.
The NRC staff conducted audits to evaluate the effectiveness of the training program.
The results were judged satisfactory witn some deficiencies noted to the 08-1 staff.
The CS-1 staff will use the results of tnese audits as well as any generic weaknesses disccvered on the written exams in their development of future training and requalification programs.
The NRC staff will review all results and records as part of the normal inscection function of the 03-1 requalification program.
We conclude that there is adequate assurance that the operators at CB-1 have, and will continue to receive, a sufficient level of training concerning the TMI-2 accident.
Based on the above evaluation, we conclude that the licensee has complied with the requirements of Item (d) of the Order.
559150
. Item (e)
T:.e Order requires that:
"All licensed reactor operators and senior reactor operators will have comcleted the Three Mile Island Unit No. 2 simulator training at ElW."
The licensee has confirmed that all reactor operators and senior reactor operators have coroleted the TMI-2 simulator training at E1W as required by the Order.
This training consisted of a class discussion of the TMI-2 event and a demonstration of the event on the simulator and how it should have been controlled.
The class discussion was about one nour long ana the remainder of tne fcur nour session as conductec on the simulator.
The TMI-2 event, inclucing operational errors, was de=costrated to each cperator.
The event was again initiated and the operators were given " hands-on" experience in successfully regaining control of the plant by several methods.
Other trar.sients, which resulted in depressurizati0n and saturation conditions, were presented to tne Operators, in which they maneuvered the plant to a stable, subccoled condition.
The licensee has submitted copies of procedures that were revised as a result of this Order and actions the licensee has taken to preclude tne occurrence of an incicent similar to that wnicn occur ed at TMI-2."
The prece:ures swfe-ed by the staff include:
'[ss notec cn cage 16 of tnis safe;y Evaluatica, acciti: a arc Ore de'_a 'ec fco: Of Icis-Of #ee:43:er trari'ir*3 i~
Ol'er a'!ic'7a*.ec :r3~5 3 15 m'
2-2i
- s ::re.
e:r ::_ :
3= e:: : ese :-::e:; es :- :e
- ;-:e-- :
559151 i
h, di
. EP 1202.01 Load Rejection EP 1202.02 Station Blackout EP 1202.03 RCS Overpressure Anticipatary Manual Trip EP 1202.04 Reactor-Turbine Trip EP 1202.06 Loss of Reactor Coolant and Reactor Coolant Pressure EP 1202.la Loss of RC Ficw/ ROP Trip EP 1202.22 High Condenser Pressure EP 1202.24 Steam Supply System Rupture EP 1202.26 Loss of Steam Generator Feed AB 1203.04 Depressurization of the RCS with Safety Grade Ecuipment AB 1203.02 Loss of All AC Power AP 3003.41.44 High Pressure Injection High Flow Alarm AP 3003.49.50 Low Pressure Injection Hign Flow Alarm AP 3C03.51.54 High Pressure Injection Low Flow Alarm AP 3003.59.60 Low Pressure Injection Les Ficw Alarm SP 1105.16 Steam and Feedwater Rupture Control System Operating Procedure SP 1106.06 Auxiliary Feedwater System ST 5071.01 Auxiliary Feedwater System Monthly Test Soecial Order No. 20 Additional Guidance for Checking Critical Parameters for Emergency Procedures
'he licensee's r isec pr::2 cures provice acditi:nal gu'cance for the ::erators 9?n :::f g th e~er;s,:y ;'s.: ::rditi:ns.
~'s e a: Orc
' ate, ::s st: s ars 4
new NT l H Unilj,l nL 559152 vast
. directed to recheck certain c-itical plant parameters.
Operators are also directed to check alternate instrument channels to confirm readings and reduce the possibility of reliance on faulty or misleading indications.
NRC staff com:2nts on the licensee's procedures have been incorporated into tne revised decuments.
These revisions have been reviewed by the staff and determined to be acceptable.
The staff walked througn tne following procedures with the control room operators:
E? 1202.06 (" Loss of Reactor Coolant and Reactor Coolant Pressure"), EP 1202.14 (" Loss of RC Flow / RCP Trip"), EP 1202.26
(" Loss of Steam Generator Feed"), and SP 1106.06 (" Auxiliary Feedwater System").
Basec on this walk througn and interviews with the operators, (see the discussion of the NRC staff audit of operators under Item (d)), we conclude that tne procecures are functionally adecuate and tne operator training on their use is s a ti s f acto ry.
Based on the above evaluation, we conclude that the licensee is in compliance with Item (e) of tne Order.
Item (f)
The Order recuires that the licensee:
"$uomit a reevaluation of tne TECO analysis of tne aeed for autcratic or administrative control of steam generator level setcoints during auxiliary feecwater system operation, previcusly submitted by E:: 'etter of :e:e-ter 22,
'975, i
' f ;n t o f O n e Th r e e.'li ' e I s ' a : 'c.
- 'n:':e't."
- y eqty Qad 3
559153
. By letter, (Lowell E. Roe (TECO) to Mr. Robert W. Reid (NRC) dated May 19, 1979), the licensee provided additional discussion of the steam generator deal level setpoint.
The need for this feature is to reduce the potential for loss of pressurizer level indication as a result of overcooling of the primary system for non-LCCA events.
The results of a natural circulation test conducted at 03-1 and B&W analyses demonstrate that 03-1 can be operated at a low steam generator level (35 inches on the startup range instrumentation).
The hign level setpoint (96 inches indicated on the startup range instrumentation) is required since previous small break analyses assumed that auxiliary feedwater was controlled to a steam generator level of 96 inches.
Pending incorporation of permanent design modifications to provide the automatic dual setpoint steam generator level control, emergency procedures instruct the operator to manually control the steam generator level at 35 inches for all events requiring AFW unless an SFAS level 2* signal occurs.
When the SFAS level 2 signal occurs, the cperator is instructed to control the steam generator level at 96 inches by placing the AFW mode selector switch in the auto essential position.
This manual provision required no previous change to the design of the AFW control system.
The future circuitry modification, to automatically control to 35 inches, will be reviewed by the staff during the long term.
TECC has cited Reference 9 to demonstrate that no unreviewed safety issues or detrimental accident consequences would result if the operator failed to manually control the steam generator level at 35 inches.
The staff reviewed the information contained in this reference and concluded that additional information was required to verify that the effects of manually controlling the steam generator level at 35 incnes is adecuate for the 03-1 F5AR Chapter 15 transient and j ?,2 ece: : - ;r IF $ Irce! : s':ral is ce.s'::e:
a' rea:_:
- 's ;
5;5!r C'955Jr? O r '. 0 3 ! 2 0 pEig O'
- ~ tai"~en!.953e: 2: :!3.re '
'51:55 to a :sig.]
u O a 1. Q 1 ryo d w
g g
. accident analyses, and the more recent S&W small break analyses (Reference 1).
By letter, (Lowell E. Roe (TECO) to Mr. Robert W.
Reid (NRC) dated June 15, 1979), the licensee stated that the control of the steam generator level at 35 inches has no adverse effect on the CB-1 FSAR analyses, since the peak reactor temperature and pressure following the most severe transients (loss of feedwater, feedwater.line breaks, loss o' offsite power) occur prior to initiation of the AFW.
The results of natural circulation testing conducted at CB-1 support t4e effectiveness of the 35 inch steam generator control level to maintain natural circulation and remove decay heat for:
(1) transients that result in loss of forced circulation (loss of offsite power) and (2) for small breaks (less tnan 0.01 f t.2) that depressurize slow enough that it is possible to manually control the steam generator level prior to actuation of the SFAS level 2 e
signal.
For small breaks larger than 0.01 ft.',
recuction of the reactor coolant system pressure to SFAS level 2 occurs prior to the steam generator level decreasing to 95 inches.
With the steam generator level controlled at 35 inches, the effectiveness of natural circulation is such that there is no small creak size that will result in repressuri:3 tion of the primary system without an SFAS level 2 actuation.
The staff has reviewed tne information proviced ty TECO in the referenced documents and concluces that dual level setpoints, with manual control of the steam generator level at 35 incnes, are acceptable.
Also, the NRC staff has verified that this manual control capacility has been previously demonstrated.
The licensee has sutmitted revised procedures, which the staf' has reviewed, trat pr:vice recuire ents 'or steam generator level control.
These croce nres 559155
.s 30 -
include:
EP 1202.06 (" Loss of Reactor Coolant and Reactor Coolant Pressure"),
EP 1202.14 (" Loss of RC Ficw/RCP Trip") and EP 1202.26 (" Loss of Steam Generator Feec").
The NRC staff has verified that these procedures instruct the operator to confirm that the AFW mode selector switches are in the auto-essential position and maintaining steam generator level at 96 inches on the startup range indication in the event SFAS level 2 condition is present.
If a SFAS level 2 condition is not present and an AFW system demand event occurs, steam generator levels will autcmatically control at 95 inches (since the AFW mode selector switches are in the auto essential position).
The ccerator is directed to take manual control of steam generator level and
. maintain level at 35 inches on the startup range indication.
If an SFAS Level 2 condition subsequently develops, the operator must return the AFW moce selector switcnes to the auto-essential position to allow automatic level control at 96 inches.
Therefore, the emergency procedures are written to permit manual control of steam generator level after an automatic initiation of AFW cnly if an SFAS level 2 condition is not present.
If a SFAS level 2 condition is present (or develops), the operatcr is directed to leave (or return) the AFW mode selector switches in the auto-essential position.
In addition, a warning plate has been installed adjacent to the cde selector switch for each AFW train, reminding the Operator of the recuirement to maintain the switch in the auto-essential position mode if an SFAS level 2 concition is present.
The NRC staff has verified the installation Of this warning plate.
Also, during the aucit the NRC staf# confircec that 559156
~
. the control room operators are aware of the requirements outlined in the revised procedures and understand the purpose of the warning plate.
Based on the above evaluation, we conclude that the licensee has complied with the requirements of Item (f) of the Order.
Item (0)
The Order requires that the licensee:
" Submit a review of the previous TECO evaluation of the Septemoer 24, 1977 event involving equipment problems and depressurization of the primary system at Davis-3 esse 1 in light of the Three Mile Island Unit No. 2 incident."
By letter (Lowell E. Roe (TECO) to Mr. Robert W. Reid (NRC) dated May 18, 1979), the licensee submittad additional discussion of the September 24, 1977 event.
This event was similar in several important areas to the TMI-2 accident.
The initiating malfunction aas a loss of main feedwater (the same as TMI-2);
however, the ensuing trainsient 'aas much less severe than TMI-2 for several significant reasons.
The following discussion compares The C5-1 event to the accident at TMI-2.
The bases for this comparison are the six human, cesign anc mechanical failures described in IE Euiletin 79-05A (Aori' 5, 1979) v.n;:n ss 'isc i
- re :a 3;e arc acia:#:-
s' esses at t'e "I-
._:~ 5a : 's.
~ 32 -
1.
At the time of the initiating event, loss of feedwater, (at TMI-2) both of the auxiliary feedwater trains were valved cut of service.
The 03-1 loss of feedwater (LCFW) event initiated both trains of AFW.
However, only one train fed its associated steam ganerator (SG) due to a malfunction of a turbine governor which kept one of the two AFW pump turbines at a sceed insufficient to pump water into its associated SG.
As a result of the DB-1 event, the modifications that have been mace include:
(1) the AFW pump turbine governors were modified to prevent binding malfunctions; (2) springs were installed in the AFW governor to prevent closure of the governor valve cue to vibration; (3) the AFW governcr centrol circuitry relays were replaced (see additional AFW discussi:ns in ! tem (a)).
2.
The cressurizer ocwer-ocerated relief valve (DORV), which ccened durino the initial cressure succe (at TMI-2), failed to close when oressure decreased belcw tne actuation level.
During the 23-1 LOFW, the PCRV also failed to close, causing less of coolant and scme voiding in the reactor ccclant system (RCS).
Mc ever, the operators recognized the Open PCRV about 20 minutes into the event (c:maa ed with 2 1/2 hours at TMI-2) anc res:cnded by closing the PC?.7 010ck valve and reinitiating hign pr?ssure injection (HPI) ficw.
559158
The 08-1 unit has been =cdified to provide the operator with a better status of the position of the PORV.
The emergency procedures were also revised and now require the operator to verify that no leak exists at the top of the pressurizer by monitoring the saturation curve and quench tank pressure and level.
3.
Following racid decressurization of the cressurizer (at TMI-2), the cressurizer level indication may have led to erroneous inferences of high level in the RCS.
This erroneous hign level indication accarently led the ocerators to crematurely terminate HPI. even througn voids existed in the RCS.
For tne CE-1 LOFW event, the operator also initially terminated HPI due to a high pressurizer level indication; however, the operator recognized the open PORV at 20 minutes and reinitiated HPI at 49 minutes (after failing to centrol pressurizer level with a second makeup pum ).
08-1 procedures have been revised and new require that for all cases in which HPI is initiated, maximum HPI flow is to be maintained unless one of two criteria is met.
These criteria are addressed in Item (d).
4.
Because the containment does not isciate cn HPI initiation (at TMI-2), tre hicnly radioactive water from the relief valve discharce ~as cumced Out of contairment by the aut0matic initiation of a transfer curo.
This ater entered the radicactive waste treat ent svit?m in the 3txi'iar'/ Ou'Idi~g 559159
where some of it overflowed to the floor.
Outcassing from this water and discharge throuch the auxiliary building ventilation system and filters was the orincioal source of the offsite release of radioactive r.oble cases.
Containment isolation at CB-1 occurs at either 16C0 psig RCS pressure (HPI initiation) or 4 psig containment vessel pressure.
During the 08-1 event, containment isolation signals occurred and the sump was not pumped outside containment as at TMI-2.
5.
Subsecuentiv, the HPI system as intermittently acerated (at TMI-2) attemotino to control RCS inventory losses through the PCRV, accarently based on cressurizer level indication.
Due to the cresence of steam and/or noncondensible voids elsewhere in the RC5. this led to a further reduction in crimary coolant inventory.
During the C3-1 event, the operator initially tried to control the pressur-izer level decrease with a second make-up pumo after closing the PCRV block valve.
Hcwever, after the pressurizer level decreased further he restarted a HPI pump.
When the pressurizer level was recoverec, he terminated the HPI flow.
At this time plant parameters were under control and the plant was brought to a stabilized condition.
As indicated in Part 3 acove, CE-1 procedures have been revised to require that for all cases in which HPI is initiated, maximum HPI flow is to be maintair.ec cnless one of two critaria is met.
Trese criteria are accressec
=- ::e-cc) y, 559160 J
J
. 6.
Triccing of reactor coolant Dumos during the course of the transient (at TMI-2), to orotect against cumo damace due to puro vibration, led to fuel damace since voids in the RCS orevented natural circulation.
During the CS-1 incident, two RCP's were tripped to reduce system heat input into the RC5.
One RCP per locp was maintained in operation thrcughout the incident.
The CB-1 emergency operating procedures new require keeping at least one RCP per loep running in the event of a small LOCA.
To summarize Item (g) of the Order, the sta;f views the September 24, 1977 event at 03-1 to have been similar to tne TMI-2 event in several important aspects.
Hc-ever, significant differences in plant status and operator response contributed to produce a much less severe transient.
The staff concludes that satisfactory improvements in both design and emergency pro-cedures have been made since the 03-1 event and, that, the licensee has ccmolied with the requirement of Item (g) of the Order.
CCNCLUSION We concluce that the actions described above fulfill the recuirements of our Orcer of May 16, 1979 in regara :: Paragracn (1) of Section :V.
The licensee having met the requirements of Daragrach (1) may restart :3-1 as pr0 Viced by Paragraan (2).
Daragra h (3) of Secti:n :'/ of tne Orde-rsmains in force 559161
. until the long term modifications set forth in Section II of the Order are completed and approved by the NRC.
5591FP.
. REFERENCES 1.
Letter from J. H. Taylor (B&W) to R. J. Mattson (NRC) transmitting report entitled, " Evaluation of Transient Behavior and Small Reactor Cocaint System Breaks in the 177 Fuel Assembly Plant," dated May 7, 1979.
2.
Letter from J. H. Taylor (B&W) to R. J. Mattson (NRC) transmitting Fevtsed Appendix 1, " Natural Circulation in B&W Cperating Plants (Revision 1),"
dated May 8, 1979.
3.
Letter f rom J. H. Taylor (B&W) to R. J. Mattson (NRC) transmitting adci-tional information regarding Apoendix 2, " Steam Generator Tube Thermal Stress Evaluation," to report icentified in Item 1 acove, dated May 10, 1979.
4 Letter from J. H. Taylor (B&W) to R. J. Mattson (NRC), providing an analysis for "Small Break in the Pressurizer (PORV) with no Auxiliary Feedwater and Single Failure of the ECCS," identified as Supplements 1 and 2 to Section 6.0 of report in Item 1, dated May 12, 1979.
5.
Letter from J. H. Taylor (31W) to R. J. Mattson (NRC), providing Supolement 3 to Section 5 of report in Item 1, dated May 22, 1979.
6.
Letter from Lowell E. Roe (TECC) to Mr. Robert W.
Reid (NRC) dated vay 22, 1979, croviding Volume III to Reference i for the raised 1000 o' ant.
r;c14 P [\\
u
.w
1 7.
Letter from Lowell E. Roe (TECO) to Mr. Robert W. Reid (NRC) dated May 23, 1979.
8.
Letter from Lowell E. Roe (TECO-Serial No. 517) to Harold R. Denton (CNRR) dated June 15, 1979.
9.
Letter from Lce, ell E. Rce (TECO) to Mr. Robert W. Reid (NRC) dated Decemoer 22, 1978.