ML19256G257
| ML19256G257 | |
| Person / Time | |
|---|---|
| Site: | Fort Saint Vrain  |
| Issue date: | 12/18/1979 |
| From: | Warembourg D PUBLIC SERVICE CO. OF COLORADO |
| To: | Varga S Office of Nuclear Reactor Regulation |
| References | |
| RTR-NUREG-0578, RTR-NUREG-578 P-79305, NUDOCS 7912280562 | |
| Download: ML19256G257 (12) | |
Text
.
public service company of collomde 16805 ROAD 19%
PLATTEVILLE, COLOR ADO 80651 December 18, 1979 Fort St. Vrain Unit No. 1 P-79305 Mr. Steven A. Varga Acting Assistant Director for Lij;ht Water Reactors Division of Project Management Office of Nuclear Reactor Regulation U. S. Nuclear Regulatory Commission Washington, D. C.
20555 Docket No. 50-267 Subj ect :
Supplementary Response Item 2.2.1.b Lessons Learned Task Force, TMI-2
Reference:
- 1) PSC Letter P-79249
- 2) PSC Letter P-79299 Gentlemen:
In our correspondence to you dated October 29, 1979, (Reference 1) and our supplementary response dated December 12, 1979 (Reference 2) we addressed the various items of the TMI-2 Lessons Learned Task Force.
In subsequent conversation with the staff we were requested to provide additional information and justification for our position regarding Item 2.2.1.b, Shift Technical Advisor.
As requested, please find attached a supplementary response to
- tem 2.2.1.b which sets forth additional information concerning our position.
It should be noted that while we are still of the opinion that a two (2) hour response time for the Technical Advisor can be justified for Fort St.
Vrain, we are prepared to commit to a one (1) hour response time.
Should you have any questions regarding this supplementary response or other previously submitted responses please contact me.
Very truly yours, W WW Don W. Warembourg Manager, Nuclear Pro uction DWW:dkm K
f \\
.7 Attachment t>
p k sod.
u%p+p#p 3
t sfet esso /
1654 086
2.2.1.6 Shif t Technical Advisor (Supplementary Response)
In our October 29, 1979, response, we provided our position for placing the Technical Advisors on-call rather than placing them on shift.
We also provided our justification for a two (2) hour response time of the Technical Advisor for accident assessment. Based on subsequent conversations with the staff as a result of the Nuclear Regulatory Commission October 30, 1979, letter, we amended our response to co=mit to a one (1) hour response time of the Technical Advisor (see P-79299, dated December 12, 1979). We were advised on De-cember 13, 1979, the.t we would have to provide additional justification for the one (1) hour response time, and the following is submitted as additional justification:
It is our understanding that the functions of the shif t Technical Advisor fall into two main categories; 1) accident assessment, and 2) operational assessment.
In Enclosure 2 of the Nuclear Regulatory Commission September 13, 1979, letter, considerable discussion was provided concerning the shif t Technical Advisor, and additional clarification was provided by the Nuclear Regu-latory Commission October 30, 1979, le t te r.
We have evaluated the guidance provided in terms of accident situations at Fort St. Vrain, including the rate at which accidents develop and the consequences of such accidents requiring operator action and the need for technical assistance response times versus the apparent need for similar response for LWR based on the TMI-2 incident and the consequences of similar LWR accidents.
We still maintain our position that placing the Technical Advisors en call provides more than adequate response for accident assess-ment, especially when considering the consequences of accidents that can develop within the ten (10) minute response afforded for L'JR's versus a one (1) hour response for Fort St. Vrain.
I.
Accident Assessment As indicated in our October 29, 1979, response, accidents at Fort St. Vrain oevelop slowly, allowing sufficient time for operator response and allowing considerable time for accident assessment. To reiterate the two design basis accidents, we can lose forced cooling up to thirty (30) minutes from 100% reactor power with no damage to the fuel or other primary system components. Even with a loss of forced cooling of up to five hours, core safety limits on fuel temperature are not exceeded.
The total off site release with a permanent loss of forced cooling (LOFC) are orders of magnitude less than 10CFR100 limits.
For the LOFC accident, we have up to two (2) hours to initi-ate depressurization through any one of two (2) redundant i654 087
trains. Depressurization is controlled by written pro-cedures that require no technical advise to initiate.
For the maximum depressurization accident which involves the total release of primary coolant, the resulting off site doses are about one half of 10CFR100 limits.
As indicated in our response (P-79299) to 2.1.5.a, we do not experience the formation of explosive mixtures in the primary system, even with conservative hydrogen gener-ation estimates. We have no adverse chemical reaction phenomenon related to materials integrity in the primary system boundaries, and we are not involved with immediate core heat-up problems, boiling, or fuel damage for con-siderable periods of time.
It is evident that even under the most credible accident situations postulated, that resulting consequences from Fort St. Vrain are orders of magnitude less than similar consequences of LWR's.
In addition to the design basis accidents, we have analyzed the following:
1.
Environmental disturbances (s eismic, wind, tornado, flood, fire, etc.).
2.
Rod withdrawal accidents (including the consequences of with-drawing all 37 rod pairs simultaneously.
3.
Loss of fission product poison.
4 Re-arrangement of core components.
5.
Introduction of steam into the core.
6.
Sudden reactor temperature changes.
7.
Reactivity changes.
8.
A multitude of incidents and transients involving the primary system and auxiliary systems.
All of these analysis demonstrate that the consequences are well within the envelope of the design basis accidents and all demonstrate the fact that considerable time is available to the operator to take necessary action.
It is recognized that a good part of the Lessons Learned Task Force concerns are in the area of unanalyzed accidents and prompt assessment for coping with these accidents. Again, Fort St. Vrain, as designed, does not require the prompt assessment and prompt outside technical 1654 088 advise as compared with LWR's.
The basic response at Fort St. Vrain is to maintain forced cooling and to establish a heat sink. If these two parameters cannot be maintained, the basic response is to depres-surize and establish the liner cooling system. As indicated in our October 29, 1979, response, we stated that we had already been through several unanalyzed scenarios which are not specifically addressed in the FSAR or in our Emergency Procedures. The following examples are cited to provide an indication of the ability of the operator respond without severe consequences and without immediate technical advise.
1.
On October 30, 1976, while operating at 27% thermal power, a malfunction in a circuit board in a plant protective system dewpoint moisture monitor module caused the Loop 1 feedwater isolation valve to close. Automatic shutdown of the Loop 1 helium circulators was correctly inhibited, because the inter-lock sequence switch was in the low power position. When the feedwater flow low alarm annunciated, the operator attempted unsuccessfully to re-open the feedwater valve. Since header pressure was high, feedwater flow from the emergency feedwater header could not be established. The normal control system had been placed in an unusual configuration to accomodate tests that were in progress at this time.
The operator manually tripped the Loop 1 circulators and initiated a reduction in reactor power to less than 2% with no adverse effects on the health and safety of plant personnel and with no off-site ef-fects.
2.
On November 23, 1976, while operating at 27% thermal power and performing the B series startup tests, a condition existed in which the DC battery and battery charger LA were taken out of service and the bus tie between the two DC buses was open. While this condition existed, the turbine generator emergency DC oil pump was started. This resulted in an automatic reactor scram, an automatic Loop 2 shutdown, isolation of feedwater supply to Loop 1, and a steam / water dump of both secondary coolant loops.
Circulator LA provided the primary coolant circulation, but as the steam supply was depleted, the speed began to decrease.
The operator closed the Loop 1 circulator steam bypass valve, which resulted in a better utilization of available steam and a temporary increase in circulator lA speed. Loop 1 was manually isolated to re-establish cooling with Loop 2.
Helium circulator ID speed was increased by using auxiliary boiler steam. The operator manually closed the Loop 2 dump valve and re-established feedwater flow in Loop 2.
Elapsed time to establish stable plant conditions was approximately 19 minutes. Further, since inter-locking (as described in the FSAR) was intended to prevent a steam / water dump simultaneously from both loops, operator actions to recover from the unanticipated condition were prompt and cor-rect.
1654 089
. 3.
On April 6,1977, while operating at 35% thermal power and 28% electrical power, a turbine trip occurred. This caused a transient in feedwater flow, due to transfer of power from the unit auxiliary transformer, to the reserve auxiliary trans-former. The low feedwater flow signal tripped the 1A and 1B helium circulators and caused a Loop 1 shutdown. The operator reduced reactor power to 13%. Approximately five minutes later the reactor scrammed on low reheat pressure. The low feedwater flow transient tripped the 1C and ID circulators, but did not get an automatic water turbine start so that an interruption of primary coolant flow was experienced. The operator re-established feedwater flow and primary coolant flow using 1A circulator on steam. Elapsed time was approximately 7 minutes.
4.
On January 23, 1978, while operating at 6 7% thermal power and 63% electrical power, a level control malfunction on the Loop 2 bearing water surge tank resulted in circulator trips, a reactor scram, and release of activity to the Reactor Building and the atmosphere. Based upon data available, the operators assumed a " worst case" condition and responded accordingly.
Elapsed time from the onset of the event to restoration of plant access was five hours and 45 minutes.
5.
On June 26, 1979, while operating at approximately 1.5% thermal power and zero electrical power, a fault current trip on non-essential 480 volt switchgear 5 occurred. This caused a voltage perturbation, which resulted in a reactor scram and an inter-ruption of forced circulation. Operator response dealt with a potential fire, assuring bus isolation, followup action for the scram, and re-establishing forced circulation. Within 15 minutes, forced circulation was re-established and plant restored to normal.
6.
On November 29, 1978, we experienced an upset of the helium circulator auxiliary system, which resulted in a reactor scram and main turbine trip. The operators responded in re-establishing the helium auxiliary system, isolating primary coolant which was coming down the shaf t of the operating circulators and placing the plant in a safe shutdown condition.
The total loss of primary coolant during this incident was approximately 68 pounds resulting in a conservatively estimated release from the Reactor Building of 3 Ci.
7.
On August 17, 1979, we experienced a loss of an instrument bus from 68% reactor power. This incident resulted in a re-actor scram, main turbine trip, and a loop isolation; and be-cause of the instrument control upset, eventually led to trip-ping all four circulators. The operators responded and re-established forced circulation and placed the plant in a safe shutdcwn condition. Forced circulation was lost for less than three (3) minutes and feedwater flow was interrupted only for five (5) seconds, 1654 090
From the examples cited above, it
,n be seen that the operator's response is either immediate, precluding the need for other assistance, or by the nature of the event, adequate time is provided for further accident assessment if required.
The accidents that are analyzei in the FSAR show that. immediate operator action, while possible, would not be required in even the worst postulated accident conditions. Several of these accidents and their recommended actions and required operator response times are listed b elow.
Ope ra tor Postulated
Response
Accident Times Recommended Actions Primary system over 1/2 Initiate manual scram (No plant pro-depressurization hour tective system scram is assumed to occur.
Turbine trip first few Initiate manual scram (No plant pro-minutes tective system scram is assumed to occur).
Total interruption 1/2 hour Restore forced cooling using approved of coolant flow for Emergency Procedures.
thirty minutes.
These analyses show that the accidents, which could be expected to occur, do not require immediate operator response and would not res ult in any fuel temperatures exceeding the allowable limits. Even if there were to be a total loss of forced circulation which could not be restored (an extension of the 30 minute loss of forced circulation), there would be ample time to take the corrective actions required as follows.
Permanent loss of forced cooling occurs:
1/2 hour - No forced circulation can be re-established.
2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> - Depressurization of prestressed concrete reactor vessel must begin.
5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> - Loss of forced cooling is permanent. Restoration of cooling would damage the steam generators.
The following operator actions have been determined to be either necessary or desirable to mitigate the consequences of this accident:
1.
Normal post scram operations.
2.
Actions required to re-establish helium circulation (assumed to be unsuccessful for this hypothetical accident).
3.
Primary coolant system depressurization.
1654 091 4.
Operation of the reserve shutdown system.
5.
Adjustment of the prestressed concrete reactor vessel cooling system water flow rates and cover pressure to increase cooling ability in areas affected.
None of the above actions require rapid operator response and thus, these could be carried out in a logical and thoughtful manner within the required time.
As a result of the Browns Ferry incident, Fort St. Vrain prepared and implemented a procedure developed to facilitate plant safe shutdown and core cooling under highly degraded conditions, including loss of redundant plant equip =ent.
Procedures were developed to provide in-structions for the operator in response to different levels of equip-ment failure or inoperability. Each of these conditions was analyzed and the most appropriate response given so as to maintain the plant in a safe condition. The procedure is divided into four sections as follows:
Section 1 - Shutdown The reactor can be scrammed from the Control Room or the 480 Volt Switchgear Room (I-49) or by direct interruption of the control rod brake power on the refueling floor.
The reserve shutdown system can be actuated remotely f rom the Con-trol Room or locally at the reserve shutdown racks. Actuation remotely requires instrument power and instrument air. Local actuation is accomplished with manual valves and nitrogen bottles.
Section 2 - Prestressed Concrete Reactor Vessel (PCRV) Cooling Maintaining PCRV liner cooling requires a source of circulation for the system and a heat sink. The system is redundant as either of the two loops will remove sufficient heat to maintain PCRV in-tegrity. Each loop is redundant, since either of the two pumps in each loop will provide sufficient flow and each pump is provided with two completely independent power sources. Normal electrical supply is backed up by the alternate cooling method (ACM) generator and manual transfer switches.
The heat sink can be provided by the service water system, which is also provided backup from ACM or by the circulating water sys-tem, which has ACM backup for makeup only. In the event that the closed loop PCRV liner cooling equipment is not available, the system is provided with ties to the fire water system for operation in a once-through cooling mode. Fire water can be supplied by the electric motor driven fire pump from normal or ACM source or by the engine driven fire pump.
i654 092
-7_
As described above, PCRV cooling can be maintained under all con-ceivable accident conditicns.
Section 3 - Maintaining Forced Cooling Af tar a reactor scram from 100% power and a loss of forced circu-lation, a period of five hours is available to re-establish core flow. If flow is established within five hours, no unacceptable core or internal compeaent damage will occur.
To insure that primary coolant flow can be maintained (or re-established),
essentially three conditions must be met:
1.
Bearing water must be supplied to at least one of the four helium circulators.
2.
The circulator (s) supplied with bearing water must have motive power (either steam turbine or water turbine).
3.
Heat removal via the steam generator economizer evaporator super-heater (EES) or the reheater (RH) section in the loop with the operating circulator.
Below is a table showing the various combinations of bearing water /
turbine power / steam generator sections that may be used to satisfy the above three conditions. Following the table are the various combinations of conditions available to supply bearing water, circulator motive power, and secondary coolant.
(Note that it is assumed s team turbine motive power is unavailable).
Water Turbine Se condary Bearing Water Motive 'ower Coolant No rmal Feedwater Feedwate r Backup Feedwater Feedwater No rmal Condensate Condensate to RH Backup Feedwater Condensate to RH Normal Condensate Condensate to EES No rmr1 Condens ate Condensate to RH No rmal Auxiliary Boiler Auxiliary Boiler Feedpump Feedpump to EES Normal Firewater Feedwate r Normal Firewater Firewater to EES No rmal Firewate r Firewater to RH Normal Auxiliary Boiler Auxiliary Boiler Feedp ump Feedpump to RH No rmal Feedwa ter Condensate to RH Normal Fe edwate r Condensate to EES i654 093
Normal Bearing Water 1.
Six pumps, 3 per loop available, 2 per loop required, and 1 loop required.
2.
Power from:
a)
Any one of 5 outside lines.
b)
Emergency diesel generator (one of two).
Backup Bearing Water 1.
Any one of three boiler feedpumps (BFP).
a) Two BFP steam driven.
1)
Flash tank steam for one to three hours,
- 11) Auxiliary boiler steam.
b) One BFP electric driven.
- 1) Any of five outside lines.
Motive Power for Circulators 1.
Steam - turbine a)
Flash tank steam, b) Auxiliary boiler.
2.
Water - turbine a)
Any one of three BFP's (as above).
b) Any one of four condensate pumps.
- 1) One of two powered from outside lines.
- 11) One of two powered from outside lines or from either of two emergency diesel generators.
c) Either of two auxiliary boiler feedpumps, i) Either auxiliary boilar feedpu=ps may be powered from outside lines or either of the emergency diesel generators.
!654 094
_9_
d)
Firewater
- 1) Electric driven fire pumps.
(1) Powered from any of five outside lines.
(2) Powered from either of two emergency diesel generators.
(3) Power from ACM diaJel generator.
ii) Engine driven fire purp.
Secondary Coolant Sources Feedwater to EES of either loop:
1.
Via normal feedwater heater.
2.
Via emergency feedwater header.
Condensate to EES of either EES or RH of either loop.
Condensate to RH to either EES or RJ of either loop.
Auxiliary feedwater to EES of either loop.
Auxiliary feedwater to RH or either loop.
Firewater to EES of either loop.
Firevater to RH of either loop.
Section 4 - Loss of Forced Cooling The procedure to be followed in the event of loss of forced cooling (LOFC) is based on an accident analysis which requires that the reactor be shutdown, PCRV integrity be maintained, and the primary cooling system be depressurized to approximately atmospheric pressure.
Reactor shutdown and PCRV cooling are maintained as described in Sections 1 and 2 above, either through use of normal / emergency or ACM equipment. Depressurization of the primary coolant system is accomplished using installed plant equipment powered by normal /
emergency electrical sources or by ACM if normal / emergency sources are not available. The ACM system was designed to cope with the LOFC accident caused by disruption of all normal / emergency power sources; and therefore, provides an independent power source for all electrical equipment required in the LOFC core. Jn the event that LOFC is not accompanied by loss of all other ele:;rical power, the same plant conditions are maintained by use of normal / emergency power.
1654 095
In view of this superior safety level and the unique procedures available which provide various options to mitigate the consequences of unforeseen accidents, we contend that a one-hour response time is more than adequate to meet the intent of the requirements for Technical Advisors as discussed in " Lessons Learned - Short Term Requirements From Three Mile Island."
II.
Operational Assessment In our October 29, 1979, response we indicated that the three (3) engineers that we plan for the Technical Advisors will be assigned to our Technical Services section. As such, this group of Technical Advisors will be assigned duties in addition to accidsnt assessment of continually assessing plant operations. They will be reviewing plant operations on a daily basis, reviewing plant maintenance, reviewing plant modifications, and evaluating temporary plant changes, operational and equie-ment trends, and evaluating plant upsets. These duties will keep the Technical Advisors abreast of plant status and plant conditions, which will enhance their ability to respond to accident assessment situations much more readily than if they were on shift.
Placing these advisors on shift will only serve to frag-ment the operational assessment activities and can only serve to reduce their ability to keep abreast of plant changes and operating problems.
Assigning the Technical Advisors to the Technical Services Department provides true independence from the operating chain of co==and as recommended by the various Nuclear Regulatory Commission positions.
In our initial staffing, we are utilizing two (2) engineers from the NSSS supplier and one (1) engineer from our Tech-nical Services Department-These personnel are thoroughly familiar with Fort St. Vrain, the operating characteristics of Fort S t. Vrain, and the operational procedures and Technical Specifications. On the basis of this experience, these people are in a much better position to respond to accident situations than engineers with the necessary technical background, but who have no HTGR experience.
As indicated in our supplementary response (P-79299),
at least a year of training will be required to familiarize engineers with the HTGR concept, and yet we could meet the Nuclear Regulatory Commission guidelines by having these people on shift without the necessary training.
We feel that our position of providing personnel who are experienced and knowledgeable, even though they are on-call, is a much more reasonable approach and a much more effective approach of meeting the accident assessment requirements, as well as the operational assessment require-men ts. To have an engineer on shift without necessary 1654 096
training provides us with very little confidence in accident or operational assessment capabilities.
Long Term Plans We have not as yet made any firm decisions concerning the long term role of the Technical Advisors. In accordance with Nuclear Regulatory Commission guidelines, we have the option of upgrading Shift Supervisors or other operating personnel to fill the position of Technical Advisor, pro-vided that we can demonstrate appropriate qualifications and operational independence. We are obviously evaluating these options with reference to future operations.
We feel, however, as indicated above, that our position for placing the Technical Advisors on-call with a one hour response time adequately meets the intent of proept accident assessment given the characteristics of Fort St. Vrain.
Re ferences For iurther reference to times in which accidents develop at Fort St. Vrain, your attention is directed to the fol-lowing documents.
1.
Fort St. Vrain FSAR 2.
NUREG 0111 - Evaluation of HTGR Fuel Particle Counting Failure Module and Data, November,1976 3.
Relationship of HTGR Fuel Failure Models to Potential Off Site Doses (Mike Tokar, W. F. Pasedag and Peter Williams paper as presented to AAAS on February 13, 1978).
1654 097
.