ML19290E694

Analysis & Evaluation of Plant Incident.

ML19290E694
Person / Time
Site:	Crystal River
Issue date:	03/31/1980
From:	AFFILIATION NOT ASSIGNED, ELECTRIC POWER RESEARCH INSTITUTE
To:
Shared Package
ML19290E689	List: ML19290E688 ML19290E694
References
INPO-1, NSAC-3, NUDOCS 8003140392
Download: ML19290E694 (70)

Text

o NSAC-3 INPO-1 March 1980 Analysis and Evaluation of Crystal River - Unit 3 Incident INSTITUTE NUCLEAR OF SAFETY NUCLEAR POWER ANALYSIS OPERATIONS CENTER v . . y-.,t,._

. o .

_.f.

• ' A 5 y 7

- . ** . 4 J2..:M.p4. M sh M

K k RM .

4 Ti i,767arite@n:' S idgm' N M m MRd @'s- p J{$ ggf kk g "#E*'a-jMf.e.g[J"v

k. $.r e , m%"el t 0; e f fq',e

[gwg,%tbY+j-

• )*e;r,yf,r M.:c$a;g .i?g g-(j%es;;[

e yw ~1 @g e 4. >v~'

p * .x .,f .m -= m N

. a . ;.: ,.. . g y QC9m.a QW 'l Q4liT?rn s

P.'mm@.k y s

'. R~i'We

-cm. ~. . ~  ;  : ,

.K , , f, .; - -

J' *

'7, g,q - $_ .}  %

%nt; i

- 9.

m ..% r.s M> -

. gr

.ps a c - . =+ l,, *

. .,. - 7 , M. _.

_g'5

~

5 6 '" .

~ m ..

Prepared by the staffs of the Nuclear Safety Analysis Center and the Institute of Nuclear Power Operations 8 0 0314 0 3 q j,

TABLE OF CONTENTS Page Executive Summary............................... 1 Findings and Conclusions........................ 2 Recommendations................................. 5 Summary Description of Transient............... 10 Appendices Sequence of events..................................SOE Plant Procedures and Operation...................... OPS Reactor Response................... ................COR Instrument and Control..............................I&C Radiation and Radiochemistry . . . . . . . . . . . . . . . . . . . . . . . . RAD Reference List....................................... ..REF e'

Glossary of Tenms, Abbreviations and Acronyms........... GLOS O

i

W A NOTICE This report was prepared by the Nuclear Safety Analysis Center (EEAC) operated by the Electrio Power Raesarch Institute, Inc. .

(DRI) and by the Institute of Wucisar Power Operations (INPO).

Weither EEAC, DRI, INPO, muebers of DRI or DPO, other persone contributing to or assisting in the preparatim of the report, nor any person acting on the behalf of any of thsee parties (a) makes any warranty or representatice, express or implied, with respect to the securacy, comple+= mas or usetniness of the informatim contained in this report, or that the use of any

• informatica, apparatus, method or procese disclosed in this report may not infringe privately owned rightst or (b) assumes any liabilities with respect to the see of, or for damages resulting fra the use of, any information, apparatus, method or y procese disclosed in this report, 11

INPO/NSAC CRYSTAL RIVER TASK FORCE A. Buhl G. Caldwell D. Gillispie W. Graves W. Guinn W. Layman A. Miller J. O'Hara.

R. Pack H. Pantis V. Poeppelmeier l'

iii

INPO/NSAC EXECUTIVE

SUMMARY

OF THE CRYSTAL RIVER UNIT 3 NUCLEAR PLANT INCIDENT ON 2/26/80 The Florida Power Corporation requested that the Institute of Nuclear Power Operations (INPO) and The Nulcear Safety Analysis Center (NSAC) make a full evaluation of the Crystal River shutdown incident that took place on February 26, 1980. A sequence of events has been developed and verified by comparing oral and written statements with the instrumentation records, data logs, operator logs, and inferences which can be made from these records by straightforward calculation or evaluation.

The operators faced a very difficult situation for a period of the first 21 minutes of the incident when an electrical equipment failure caused a loss of reactor coolant from the high pressure reactor coolant system by blowing down coolant into the reactor containment building. The electrical equipment failure also made unavailable a majority of the important instruments needed for operator actions.

Approximately 40,000 gallons of reactor coolant water were dumped into the reactor containment build-ing.

The incident was initiated by an instrument and control -

system malfunction. The resulting transient shut down the reactor and turbine generator automatically. Safety systems and operator responses resulted in a plant shutdown with no apparent damage to reactor fuel or equipment; however, inspections have not been completed at the time of writing of this report. Radio-active releases have been only a fraction of the amounts allowed by government regulations for normal plant operations.

1

FINDINGS AND CONCLUSIONS

1. There is no indication of damage to the reactor from the incident of February 26, 1980.

2. The analysis performed by INPO/NSAC establishes that the plant was operated in a manner which provided an ample safety margin during the incident (more than adequate to protect the core and to protect the public health and safety).

3. The incident was initiated by an instrument and control system malfunction. This malfunction probably was caused by either an electrical component failure resulting frem an undersized plug-in card which made misalignment of connector pins possible and likely, or by inadvertent actions of an instrumant technician who was working in the area, or by the combined effect of these two circumstances.

4. As noted in 2. above the operators' actions adequately protected the reactor and public health and safety; however the assessment of system conditions during the incident was made more difficult becaose about three quarters of the instruments were aligned to bus NNI-X which lost power. A _

more even distribution of instruments between X and Y busses is practical, and would produce greater effective redundancy of indications and control.

5. There were no losses or indications of damage to instruments or equipment in the reactor containment building although there existed a warm and moist environment for a time.

Relief and Safety valve discharge of steam into the reactor building built up pressure to about 4 psig and about 1/2 of the normal radioactivity frem the reactor coolant system "

water was transferred to the reactor containment building.

The four temperature detectors located in the reactor 2

containment building recorded local temperatures of 140*F to 150*F. Dose rates up to 60R per hour declined to less than

.2R per hour in five hours

6. Many of the control room indications went to the midscale position on loss of pcwer. The midscale indication occurs by design of the system which is a - 10 to + 10 VDC control voltage. Since midscale is usually in the normal operating range, after the power loss , many indications were close to normal values thereby making it difficult to determine if the reading was real or a failed (unpowered) instrument.

The operators were aware of this and distrusted all readings that were in the midscale range, even those which were functioning properly.

7. The emergency procedure action levels for declaring class A and B emergencies are rigid. They possibly are too rigid in that they do not allow for any. judgment in declaring an emergency. An assessment of the 2/26 actions shows that:

a. No class "A" Emergency was declared although it was called for by procedural action levels by 11 minutes into the incident.

b. The class "B" Emergency should have been declared about 12 minutes into the incident. There was a delay until about 54 minutes into the incident.

8. Radioactive releases to the environment as a result of the incident were well below the amounts allowed by government regulations for normal plant operations. (See Appendix RAD for a more complete stctement).

9. The design actions of the Integrated Control System (ICS) -

complicated the plant response to the partial loss of '

instrumentation. In response to faulty midrange inputs, the 3

ICS throttled down feedwater flow, making one steam generator go dry, and the other approach dryout, opened the turbine throttle, and pulled control rods until reactor power level reached the control limit at 103%, These actions were also limited by design by tripping the turbine and reactor. However, this puts the system through unnecessary thermal and hydraulic transients, and creates challenges to equipment and operation which should be minimized.

10. The posu TMI generic emergency procedure for small break LOCAs is safe, but not necessarily conservative in that it challenges the safety valves and the containment barrier as in the Crystal River Incident. The open PORV put only a small amount of reactor coolant into the containment while the emergency procedure contributed to repeated lifting of the safety valve and tens of thousands of gallons of primary coolant water were put into the containment by way of the code safety valve.

11. The steam generator rupture matrix which is a safety system to protect against steam and feed system ruptures aggravated this incident by isolating the steam generators when the steam pressure dropped below 600 psig.

This denied use of ,

the steam generators as heat sinks temporarily even though no rupture existed in the steam generator system.

l 1

4

Recommendations Florida Power Corporation should correct items involving train-ing, procedures, plant systems and hardware discussed below. In a presentation to the NRC on 4 March 1980 Florida Power Corpora-tien indicated plans for corrective action (immediate, at next refueling, and long term) which respond to or relate to all or most of the recommedations made in this report. The timely implementation of such plans is endorsed by this evalution.

Other reactor plant owner-operators should investigate and take corrective actions as required on the following list:

I. Training I. A Procedural requirements for declaration of appro-priate emergencies should be emphasized in plant training sessions.

I. B Review power supply failures and their effects on control systems. Include events such as ICS related malfunctions at Crystal Rivar in plant training sessions and in simulator training.

I. C Instrument technician work practices and their potential impact on plant safety should be reviewed in plant training sessions. Attention should be given to events similar to the 3/20/78 and 1/5/79 transients at the Rancho Seco plant where overcooling resulted from maintenance technician actions.

II. Procedures II. A Promulgate written procedures for switching J instruments between power supplies, in the event J of power supply failures and promulgate a 5

procedure designating the preferred bus for each inst rument.

II. B Procedures for Steam Generator rupture matrix or its equivalent should be reviewed in conjunction with post-TMI requirements on steam-driven emergency feedwater pumps to determine if aggravating effects exist during loss of heat sink.

II. C Procedures for orderly plant shutdown following loss of power supply should be prepared or reviewed / revised as necessary. Reactor system cooldown limits, and the basis for those limits should be reviewed.

II. D The Industry should further analyze and resolve with the NRC the current reactor coolant pump trip procedures to be followed during a small break LOCA. Mandated procedures can be counter-productive to safety if they are not surficiently discriminating to specific circumstances, and to specific plant designs.

II. E The Industry should review the current High Pressure Injection pump requirements and resolve any procedural issues with the NRC. Procedures which avoid or minimize challenges to safety valves, primary system, (and eventually to the containment building itself) are needed.

Mandated procedures can be counterproductive to safety if they are not sufficiently discriminat-ing to specific circumstances and to plant designs. -

6

II. F Procedures for declaration of emergencies should be reviewed to determine if responsibility for monitoring plant conditions which lead to declaration of a specific emergency category should be assigned to a specific individual. It ir suggested that this individual would also be responsible for immediately informing the senior person in charge at the time when these condi-tions for emergencies and emergency notification have been met.

III. Plant Systems and Hardware The following list of problems should be investigated and corrective action taken as required.

III. A Loss of Power Suppiv III. A. 1 Need for backup or bus transfer capabilities if a fault trips ins,trumentation and control power supplies.

III. A. 2 Coupling of indication, control and computer .

input signals, e.g., loss of power to ICS, NNI, -

or RCS results in loss of control board indica-tion of many signals.

III. A. 3 PORV cponing and its failure modes due to voltage variation resulting in loss of proper setpoint reference. ,

III. A.-4 Susceptibility of control systems to incorrect information caused by electrical faults, e.g., .

choking off feedwater to steam generators, with- g drawing rods, and opening the turbine throttle.

7

III. A. - 5 Instrument loops are selected by a switch in the control room. Designs should be reviewed, and wherever practical field-tested, to determine the effects of a loss of power to one of the instru-ment loops, and to establish the absence of cross-contamination of multiple power supplies in the instrument and control functions.

III. A. 6 The coincidence of having a midscale operating point and midscale instrument failure on loss of power gives uncertain information, e.g., loss of EFW auto start becauso steam generator level indication appeared to be higher than actual.

III. A. 7 Assignment of instruments to specific busues should insure as much redundancy as possible.

III. B Data Handling and Displav III. B. 1 The adequacy of data handling and display systems should be reviewed. Examples of specific problems encountered daring Ebis event were as follows:

III. B. 1. a Many instances of alarm conditions returning to a normal state without any prior indication of having reached an alarra state.

III. B. 1. b Computer printout loss due to overload.

III. B. 1. c The system monitoring the in-core temperatures automatically prints any temperature which indicate in excess of 700*F. The basis for -

selecting 700 *F should be reviewed to determine "

if this number should be revised, since data was lost during the transient. -

8

III. B. 2 Plant transient monitoring and recording. Plant transient records independent of process com-puter, to provide a tape record of main plant parameters, are desirable for all plants. They are desirable on an earliest practicable schedule.

III. C. Steam Generator System The Steam Generator rupture matrix or equivalent should be reviewed and changed as necessary to prevent actuation of isolation and loss of heat sink for events which do not actually involve ruptures in the steam generator system.

6 9

640 1-Loop temperature

{ Reactor trip Saturation Y temperature 2400 -

e20 {-

9\

b600 Reactor Automatic increase of reactor 2200 3 M r coolant [ building coolers and fans 18 g j pressure 7 '~ % ,,

S 2000 & -

/ '~~.

e 580

/ Reactor building 17 h a ty y 3 /

pressure E 1800 - g,560 / 3 2 * $

/

s,

} f Core temperature -

16 k j 1600 -h540 -

/ $

b b

'h1400 520 -

y Safety valve 15 g RCV-8 opens j

--PORV block valve closure 1200 -

500 -

_ 14 i Reactor coolant k rupture (1) (2) drain (3) ,

1000 - -

1420 1430 1440 1450 1500 1510 Eme .

(1) HPIin ESF mode C2) Reacter coolant pumpe stccoed Reactor txak2ng purge stopped p) NNI X ptwer restored Figure 1. Crystal River Transient b 4 e

e e

SUMMARY

DESCRIPTION SE.

TRANSIENT Initial Events The incident was initiated about 2:23 p.m. (reference time 0 minutes) February 26, 1980 by an instrument and control system electrical malfunction. This malfunction probably was caused by

. combination of misaligned connector pins on printed circuit boards plus a technician working on the recently installed saturation meter circuits which utilized these boards. This malfunction caused the feedwater control valves to reduce significantly the flow of water to the steam generators. This also caused a transient which initially increased reactor power level by a few percent and raised reactor coolant pressure and temperature as one steam generator went dry and the other approcched dryout. The power operated relief valve had been opened by Ehe instrument and control system malfunction at the beginning of the transient. Opening, the power operated relief valve did not prevent the reactor coolant pressure from reaching the overpressure sr.fety trip point which initiated the reactor shutdown (time 23 seconds). The reactor protection features functioned as intended by design to shut down the reactor.

Loss of Reactor Coolant The electrical malfunction made Ehe power operated relief valve stay open. With the reactor shutdown and the power operated relief valve open, the reactor coolant system pressure dropped as the reactor coolant discharged into the reactor coolant drain tank and then into the reactor containment building after the drain tank rupture disk actuated. As the pressure dropped the high pressure injection pumpr came on automatically (at 3 -'

minutes). The pressure continued to drop. The operator turned "

off the reactor coolant pumps (4 minutes), and shut a block 10

valve, which stopped the loss of reactor coolant through the power operated relief valve (6-7 minutes).

The high pressure injection pumps continued to pump 1100 gpm of water into the reactor coolant system. This increased the reactor coolant system pressure to the point where a code safety valve opened (10 minutes); again discharging reactor coolant into the reactor coolant drain tank and then into the reactor contain-ment building. At time 29 minutes the operator throttled high pressure injection system flow to about 250 gpm thus reducing reactor coolant system pressure to about 2300 psi. Purification system letdown was reestabished (30 minutes) and makeup pump recirculating valves were opened (33 minutes). These two opera-tions reduced the amount of water being pumped through the code safety valve into the reactor building by way of the reactor coolant drain tank; however, the safety valve periodically passed coolant at about 2300 psi until time about 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. At time 1 hr. 27 minutes the high pressure injection was shifted back to the normal makeup and letdown operation. After time 2 hrs. the safety valve stayed seated and pressure gradually was r, educed (2 ces. 15 min.) to the 1850 psi to 2050 psi range. The loss of coolant portion of the incident was finished (2 hrs.) having dumped approximately 40,000 gallons of coolant into the reactor building.

The plant was held in a partially cooled down condition until a low pressure decay heat removal pump motor repair was completed, and then the operators followed normal operating procedures to bring the reactor plant to a cold shutdown condition.

Reactor Containmtnt Building At approximately 6 6.o 7 minutes into the incident the reactor coolant system relief and safety valves had caused an accumula- -

tion of reactor coolant in the coolant drain tank. Enough pres- a sure built up in the drain tank to actuate its rupture disk.

11

This rupture disk feature operated as it had been designed to and allowed the open reactor system relief and code safety valves to discharge reactor coolant water through the drain tank and into the reactor containment building. The highest pressure reached in the reactor containment building during the incident was approximately 4 psig (18.7 psia).

By time 5 minutes radiation levels of 10R/hr existed in local areas of the reactor containment building. At time period 15 to 20 minutes the radiation levels were up to approximately 60 R/hr . By 30 minutes the levels were dropping. By time 5 hou rs the radiation levels were decaying slowly from a level of 100-200 mR/hr. These levels could be expected considering the reactor coolant system activity levels before the incident.

By March 2 significant progress had been made on processing the 40,000 gallons of radioactive water from the floor and sump of the reactor containment building and processing of gaseous and airborne activity from the building commenced.

There is no indication of damage to the reactor from the incident of February 26, 1980.

d 12

SEQUENCE OF EVENTS CRYSTAL RIVER 3 February 26, 1980 Plant Status prior to the start of the event:

Crystal River Unit 3 was operating at 99% reactor power with the Integrated Control System (ICS) in full automatic. The reactor coolant system (RCS) was operating with four RCS pumps circulating coolant at a pressure of 2157 psig. The High Pressure Injection (HPI) system was operating in the normal RCS inventory control mode with the "B" HPI pump in service providing makeup, letdown and reactor coolant pump seal injection flow. The "A" and "C" HPI pumps were selected to provide borated water injection into the RCS upon an Engineered Safeguards Features (ESP) actuation. The condensate and feedwater system was operating normally with two steam driven feedwater pumps running. The water levels in the "A" and "B" steam generators were indicating approximately 67t and 65% on the operating range, respectively, with a pressure of about 9005 existing in each steam generator. At approximately 2:20 in the afternoon, a voltage decay and subsequent loss of power on the non-nuclear instrumentation (NNI) "X" bus and power supply led to the following sequence of events:

Time Event Remarks and References 14:23:20 High letdown temperature. The events indicate a deteriorating plant mndit ion res a l t-3A and 3D steam generators level low. ing from erroneous control input signals. (Reference 6, 3).

High RCS inlet loop A f. B differential temperature.

Reactor coolant system flow runback in ettect.

14:23:21 Non-Nuclear Instumentation (NNI) "X" bus The voltage decay and subsequent loss of this power supply and power supply failure. resulted in erroneous system control room RCS indication Power operated relief valve (PORV) open. and system control ins ta to the Integratol control System (ICS). The ICS controls components in two sections of the overall plant. The two sections are the Nuclear Steam Supply System (NSSS) and the Balance of Plant (BOP)

System. The components which are controlled in each section are listed below A. Reactor Power generation in the NSSS through

• manipulation of control rods SOE-1

Time Event Remarks and References B. Turbine / generator electrical generation in the BOP through manipulation of turbine steam inlet and bypass valves C. Water inventory in the steam generators in the NSSS through feed-water pumps and valves of the BOP The erroneous control inputs (change in RCS flow and Tave) resulted in the ICS calling for simultaneoua withdrawal of control rods and reduction in the demand for water inven-tory in the steam generators. The result of these actions produced a high pressure (2300 psig) condition in the RCS which resulted in a reactor trip and accompanying actuation signal which tripped the turbine / generator. In addition, the PORV opened and remained open creating a loss of coolant from the RCS. SEE Appendix I&C. (Reference 3, 4, 5 and 6).

14:23:45 Reactor / Turbine / Generator trip The reactor tripped on high pressure in the RCS.

(Reference 3 and 5).

14:24:12 Signals were received indicating a need Although the validity of this indication probably was for additional liPI system flow into the RCS. affected by the NNI "X" power supply failure, actual plant conditions were approaching saturation conditions (Refer-ence 3 and 5) .

14:24:44 The reactor protective system low pres- This event indicates that reactor coolant system pressure sure reactor trip signals were actuated. had decreased to approximately 1800 psig (Reference 3, 6 7).

14:25 High level alarm was received in the drain Coolant inventory was being i st f rom the RCS through the tank. PORV to the drain tank (Reference 6).

14:26:48 ESF actuation signal for llPI was received The actuation signal setpoint was set at approximately for trains A and B. 1500 psig (Reference 6, 4 and 3).

SOE-2 9 m 0

Time Event Remarks and References 14:26:53 HPI pumps A and C, decay heat pumps A and All three llPI pumps were running at this point in time in-B, emergency nuclear service seawater jecting borated water from the borated water storage tank pump B, and diesel generators A and B through four loops into the BCS. In addition, the reactor were running. building purge to the environment was secured (Reference 3, 4 and 5).

14:27 Reactor building pressure began increas- This event is attributed to the volume of RCS fluid being (approx.) ing. displaced through the PORV to the drain tank in excess of its capacity to contain the RCS discharge, actuating the rupture disc. Thus, the building pressure began to increase (Reference 3 and 4).

14:27:04 Radctor coolant pumps A1 and B2 were neactor coolant pumps were stopped by the operators in re-stopped. sponse to the ESF actuation of HPI pumps per procedural requirements (Reference 5).

14:27:07 Reactor coolant pumps A2 and B1 were Reactor coolant pumps were stopped by the operators in re-stopped. sponse to the ESF actuation of IIPI pumps per procedural requirements (Reference 5).

14:28 - The PORV block valve was closed. Reference 3 and 4.

14:30 14:30 The A and B steam generators approached a The low feed water demand signaling the ICS established by dry condition. the NNI "X" power interruption created this condition (Reference 3 and 4).

14:31 High reactor building pressure alarm was The increase in reactor building pressure indicated an received. approach to 2 psig resulting from the previous fluid discharge to the drain tank (Reference 51 14:31 A steam generator reached a dry condition. The rupture matrix for the "A" steam generator was B steam generator indicated some level received, indicating less than 600 psig steam pressure existed. existed. The matrix initiated isolation of the feed water supply and steam discharge valves from 14:32 Main feedwater pump "A" trips leaving the "A" steam generator. Additionally, the affected "B" running. feedwater pump suction valve is tripped shut resulting in the trip of the affected feedwater pump (Reference 3 and 5). SEE Appendix IEC.

SOE-3 as 9

Time Event Nemarks and References 14:32 ESP channels A and B actuation signals Ef forts were made to balance the flowrates in the four were bypassed. IIPI injection loops to the ICS (Reference 5).

14:32 An emergency feedwater pump Reference 6.

(EFP 3) was started.

14:33 Code safety valve (RCV-8) opens. The reactor coolant system has been filled to a solid water condition as a result of the high pressure injection system operation in the ESP mode. Reactor coolant system pressure was approximately 2400 psig and the temperature in the tail pipe on RCV-8 indicated a marked increase (Reference 3 and 4).

14:33 Reactor core exit water temperature At this time, the highest core exit. water temperature recorder started by operator action. temperature as displayed by the core monitor was indicating approximately 560*F. The core monitor would have automati-cally printed any temperatures which indicate in excess of 700*F. (Reference 10) SEE Appendix COR.

14:34 The reactor building dome radiation monitor Readings on the monitor indicated approximately high ',evel alarm was actuated. 10 R/ hour (Reference 3 and 6). Appendix RAD.

14:35 24 volt NNI-X bus and power supply Attempts to clear the faulted conditions which existed in alarms cleared a.sd returned. the NNI-X power system were unsuccessful (Reference 3 and 5). Appendix I&C 14:37 Computer event summary loses informatica Reference 5.

from this point until 15:11.

14:30 Feedwater supply to the "B" steam FMV-34 was manually closed by the operator as "B" steam generator was shut off. generator level indicated approximately mid-scale in the operating range. This represents the level required to

, induce natural circulation of the reactor coolant water through the core (Reference 3 and 6).

SOE-4

,. 7..,.

Time Event Remarks and References 14:44 NNI "X" power supply and bus fault was All erroneous indication and system control inputs were cleared with subsequent power restoration. restored to correct plant conditions (Reference 6).

14:45 Engineered safeguards features for reactor Indicated reactor building pressure was approaching 4 building isolation signal were actuated. psig. The isolation signal also triggered additional building cooling and closed reactor building piping penetrations (Reference 3, and 6).

14:46 The operator bypassed engineered safe- Actions were ...itiated to reemtchlish balanced flow in the guards feature actuation signal. HPI system injection loops. This is one of many instances where an alarm condition returned to a normal state without any prior indication of having reached an alarm state (Reference 6).

14:50 Reactor building dome radiation monitor ' Indicated levels reached approximately 60 R/ hour peaked. (Reference 3). Appendix RAD.

14:51 Rupture matrix for the "B" steam generator This event resulted in the isolation of the "B" steam actuated. generator (Reference 6). Appendix I&C.

14:52 RCS pressure was reduced to 2300 psig. RCS pressure was reduced from " 2400 psig to a 2300 psig by throttling flow through the HPI system (Reference 6).

14:53 Imtdown from the reactor coolant system Reference 6.

was reestablished.

14:55 Main feedwater pump 3B trip. Reference 14:32 entry. At this time, two emergency Turbine driven emergency feedwater pump feedwater pumps were operating. Main feedwater pump started. 3B trip resulted from the actuation of the "B" rupture matrix. (Reference 3 and 6). Appendix I&C 14:56 - Steam generator A and B rupture matrix This action restored the capability to feed and steam 14:57 actuation signals were bypassed and reset. (heat sink) both steam generators (Reference 6).

15:00 Steam generator A level indication shows Efforts were initiated to raise the level in the A steam increasing trend. generator to induce natural circulation in the A loop of the reactor coolant system (Reference 3 and 6) .

SOE-5

' i

Time Event Remarks and References Plant Status as of 1515:

The reactor was shutdown. Reactor coolant pumps in both loops were stopped. Core temperatures show indication of a cooling trend. Both steam generator water levels were being maintained at the natural circulation levels. Reactor building pressure was decreasing along with Reactor Building radiation levels (dome monitor approximately 20 R/ hour).

Efforts were underway to reestablish normal reactor coolant system water inventory control. ,

15:17 Class "B" emergency was declared. Reference 31.

15:26 Im level in the sodium hydroxide tank. Reference 6.

15:28 Computer event summary loses information Reference 5.

from this point until 16:26.

15:30 Reactor Building (RB) area monitors peaked. RB personnel hatch (RMG-17) 200 mr/ hour.

RB fuel handling bridge monitor (RMG-16) 200 mr/ hour (Reference 3). Appendix RAD 15:50 Terminated operation of the itPI system in Reactor coolant inventory control was returned to the the ES mode (4 loop injection). normal operational mode (Reference 3).

16:00 RB incore instrumentation removal area RMG-18 5 R/ hour. Decreasing trends over the next five radiation monitor peaked. hour period indicated no further releases of coolant from the RCS. Appendix RAD 16:08 Steam driven emergency feed pump stopped. Reference 6.

t 18:30 Class B emergency terminated. Reference 31.

21:06 Started BC pump A2. Forced circulation using the reactor coolant pumps was reestablished. The steam bubble allowed a return to the 21:12 Started NC pump B2. forced circulation mode of operation. (The steam bubble was regained in the pressurizer at 19:51 as recorded in the operator's log.) (Reference 3, 5 and 6 and 32.)

SOE-6 i

Plant Status at Termination of Incident:

The plant had been placed in a normal hot shutdown condition. The reactor was shutdown, heat removal through the steam generators had been establin.hed, two reactor coolant pumps were circulating coolant. The ability to control the reactor coolant system pressure and inventory had been regained subsequent to the IIPI operation in the ESP mode. Approximately 40,000 gallons of borated water existed on the floor of the reactor building.

b SOE-7 t M 'l

APPENDIX CPS PLANT PROCEDURES AND OPERATION 1.0 Objective To review the appropriate plant procedures in effect at the time of the incident to try to ascertain if they were adequate and used in placing the plant in a safe shutdown conditicn.

2.0 Scope The scope of this review included selected operating (OP),

abnormal (AP), emergency (EP) and administrative (AI) procedures. Also the site emergency plan and associated administrative procedures were reviewed.

The procedures considered applicable were reviewed and an evaluation was made to ascertain if they were adequate and steps required for the plant condition ~were performed. The time frame considered was from 1423 to 1830. Methods used for verification were review of computer printouts, sequences of events as they developed, review of charts to look for results of specific actions required and taken, review of operator log entries and written statements submitted by them and interviews with various operations and management personnnel. _

In many cases verification of performance was limited to looking for adverse plant conditions that might be expected to occur if specific steps were not performed.

3.0 Summary Based on a review of plant conditions during the incident, procedures available to plant personnel and actions taken to -

terminate the incident and/or mitigate the consequences the L following conclusions have been reached:

OPS-1 APPENDIX CPS

Nature of the incident: The incident was unique in that many of the key parameter indications needed by the oporator were lost due to the power failure in the NNI-X power cabinet. This resulted in some uncertainty as to which procedures were applicable during the first 20 minutes of the incident.

Procedure Adequacy: Procedures were adequate with some minor improvements needed. These improvements are identified in the specific procedure review statements.

Adherance to procedures: During the transient applicable procedures were used to maintain core cooling and ensure that the core was covered. Operator support was provided early in the event by senior personnel including operators who obtained procedures and assisted in verification of automatic actions and immediate actions required. This support continued through the critical sta as of the incident. Areas of potential improvement in the use s recedures that would have been helpful in ascertaining the plant status sooner and minimizing the consequences of the incident are addressed in the specific procedure review statements of section 4.0. Emphasis was placed on ensuring that the core was covered and cooling maintained.

Procedures for this, verification of and establishing natural _

circulation and restoration of steam generator levels were used very well.

4.0 Review Results 4.1 AP-110 revision 8 Reactor-Turbine Trip Applicable steps were performed.

APPENDIX OPS OPS-2

4.2 EP-106 revision 24 Loss of Reactor Coolant Or Reactor Coolant Pressure Due to the loss of hot and cold leg temperature instruments step 2.4.6.2, verification of at least 50*F subcooled conditions, was not performed as written until instrument power was restored.

The alternate method of using the incore thermocouples was used within 5 minutes of the initiating event. "A" steam generator reached a dry condition and "B" steam generator indicated that some level existed early in the transient. "A" was isolated by the isolation matrix and "B" level was restored providing a heat sink for the primary system. The level indication in "B" generator was functioning. The operators maintained the high pressure injection in service discharging RCS through the pressurizer relief and safety valves. This method of cooling was in accordance with the procedure.

4.3 AP-123 revision 0 Solid System Pressure Control This procedure was used effectively after verification of natural circulation to control pressure and reestablish a presssuriser bubble.

4.4 AP-ll6 revision 10 Pressurizer System Abnormal Conditions _

Section 2.0, Leaking Code Relief Valve, applicable steps were followed. Section 4.0, Pressurizer Level Indication Malfunction, did not provide guidance needed for this particular malfunction. In accordance with step 4. 3.1 the operator switched the channel selector switch from the "X" position to the "Y" position; on other failed instruments this would have restored the signal. However the compensated level is unique in that both "X" and "Y" NNI power supplies are involved. An uncompensated level channel was available in the control room and on the -

shutdown panel; however, the inaccuracy at the existing

temperature precluded its usefulness since there was no compensation curve available. -

OPS-3 APPENDIX OPS

4.5 AP-ll2 revision 2 Loss of Electrical Supplies Loss of 24VDC electrical power was not addres' sed in APil2 or any other abnormal or emergency procedure.

4.6 AP-113 revision 7 Reactor Cooldown by Natural Circualtion Only a part of this procedure was applicable since 2 reactor coolant pumps were placed in service at 2107. Based on information available it appears the applicable parts were followed and RCS cooldown ra'.es were acceptable.

3.7 AP-103 revision 10 Radiation Monitoring System Alarms Step 1.2.2.1, automatic actions from high radiation (gas) on RM-Al reactor building purge, closes containment isolation valves AHV-1A, AHV-1B, AHA-lC and AHV-10. Step 1.3.1, immediate operator actions requires verification of automatic closure of the above valves.

R.M.-Al alarmed high due to the purge in progress at the time of the incident having the above valves open and the reactor building purge air supply and exhaust fans running. Operator action almost simultaneously with automatic action closed the containment isolation valves at the time of rising radioactivity within the containment building.

4.7 EP-103 revision 8 Loss of Reactor Coolant Flow /RCP Trip The reactor coolant pumps were tripped by the operator at about 1500 psi following actuation of the HPI system as required by EP-106. The applicable sections were followed.

l 1

o APPENDIX OPS OPS-4

4.8 EP-108 revision 10 Loss of Steam Generator Feed Parts of this instruction were applicable to the incident.

Symptoms listed in section 2.0, i.e., decreasing flow, decreasing OTSG levels, increasing Tave, and increasing RCS temperature.

The instrument failures created uncertainties as to the exact status of the feedwater system and steam generator levels since both main feedwater flow indicators were lost, "A" steam generator level had failed and "B" level was essentially zero following the trip.

Step 2.2.2.1 lists automatic action as follows: " Automatic start of steam driven emergency feed water pump and motor driven pump if offsite power is available on low OTSG 1evel." Step 2.3.1 requires verification of the automatic actions described. The auxiliary feedwater pumps did not start automatically due to the NNI X power supply failure and were started nine minutes into the transient by the operator. "B" OTSG level however was being restored by the main feedwater pump "B" which was still running. The "A" OTSG level was recovered in accordance with the recovery procedure 'wida precautions taken to prevent cooldown of the RCS.

4.10 EM-202 revision 10 Emergency Plan Implementing Procedure -

Duties of the Site Emergency Director Section 6.0 requires all significant information, events and actions taken during the emergency period be recorded. During the class "B" emergency which was in effect between the hours of 1517 and 1830 on 2/26 most actions were recorded in various logs. For example the following is recorded in the shift log,

" declared class "B" emergency, all required notification made. "

i OPS-5 APPENDIX OPS

4.11 EM-100 revision 7 Emercency Plan Section 4.4.2 Class A Emergency Action Levels lists " Report of an abnormal increase of direct radiation in excess of 100 mrem /hr" as an action level to initiate a class "A" Emergency. This action level was raached when the reactor coolant drain tank rupture disk operated and at time 14:34 the reactor building dome monitor alarmed at 10R. A class "A" Emergency was never declared.

Section 4.6.1 states that " Class "B" radiation emergencies are the result of .... or the result of a loss of coolant accident." Section 4.4.3 states that the following is an action level "A loss-of-coolant accident by verification of high RB pressure, high pressure injection (HPI) and initiation of RB sprays." Although legalistically one might say that since the RB (reactor building) sprays were not needed or used that a class "B" Emergency was not required, the intent of the procedure seems fairly clear that a class "B" Emergency should have been declared at about 14:35. The delay until 15:17 was too long. Following initiation of the emergency plan the prescribed actions were taken.

4.12 AI-200 revision 15 Administrative Instructions -

Organization and Responsibility Section 5.10 and enclosure 2 describe the duties and responsibilities of the Shift Technical Advisors (STA) during plant abnormalities and emergencies.

Interviews with the individual assigned this position and with others indicate he reported to the control room within less than 10 minutes following the initiating event at 1423 on 2/26 and did function in the advisory capacity during the emergency. -

4 APPENDIX OPS OPS-6

4.13 AP-102 revision 18 Annunciator Alarms The panel K alarm listings list "24V ICS power failure . " This was one of the early alarms acknowledged by the operators. One of the possible causes for the alarm listed is " loss of + and -

24v DC ICS NNI power supply low voltage trip. " The column of the procedure that delineates automatic actions associated with the alarm states "none". The prescribed operator actions are:

" Determine cause of power supply trip, correct and return to service."

Nothing in this procedure warns the operator that loss of power actuating this may result in rapid major changes in the ICS controls and loss of indications whose power source has failed.

3.16 Short Term Instruction 17 This instruction was issued by the Operations Superintendent to comply with short term requirements of NUREG-0578. The instruc-tion expired 3/3/80 and a copy was unavailable for this report.

Copies of procedures should be retained. The following is a '

recall from memory provided by operating personnel. The following list of reactor building isolation valves shall be

" blue tagged" in the deenergized or closed position.

CAV 1, 2, 3, 4, 5, 6, 7, 126 CFV 11, 12, 15, 16, 25, 26, 27, 28, 29 and 42 MSV 130 and 148 WDV 3, 4, 60, 61, 62 and 94 The following 10 valves shall be closed immediately upon receipt w fo an HPI signal at 1500 psig. AHV-1A, 1B, 1C, 1D DWV-160 MUV- L 40, 41, 49 WDV-405, 406.

OPS-7 APPENDIX OPS

The above valves were closed by the operators immediately following initiation of the HPI at 1500 psig.

O G*

9 e-APPENDIX OPS OPS-8

APPENDIX COR REACTOR RESPONSE The source range nuclear instrumentation and the incore instru-mentation system provide the most direct monitoring of the core during severe shutdown transients.

The source range signals originate in two highly sensitive BF3 proportional counters located on opposite sides of the core out-side the reactor vessel. Each of the two redundant channels provides neutron flux information over a range of seven decades 0.1 to 10 6 counts per second. The location of all nuclear instrumentation detectors is shown in Figure 1 (Figure 7-22 from FSAR).

The incore instrumentation system is comprised of $2 assemblies. Each assembly contains seven self-powered neutron detectors (SPND) and one core outlet thermocouple. The outputs of these incere instrument strings are connected to the computer.

The incore detector locations are shown in Figure 2 (Figure 7-25 from FSAR). _

I. Evaluation of the Source Range Detector Response The response of the source range monitor is shown in Figure 3.

This chart ir read right to left. Note that the response begins as an intermediate range response which undergoes several automatic range changes at the initiation of the transient then switches to the source range monitor. The heavy black line shows the scale which is ultimately 10 2 for the source range detector. The SR response appears normal and decreases from an -

initial peak of about 1200 cps. This response is consistent with i' earlier trips and, if anything, the count rate appears to COR-1 APPENDIX COR

decrease more rapidly than it did on the September 21, 1978 trip shown in Figure 4. This is expected owing to inherent source decay. The source range instrument response in consistent with trips observed at other power plants following considerable power operation. The conclusion is that, from the excore source range monitors' response, the reactor trip appears normal. There are no indications of substantial density changes in the coolant. It is clear that the core remained in a shutdown state and remained covered with liquid water during the transient.

II. Evaluation of Available Thermocouple Data Incore Thermocouple data is printed automatically if the hottest thermocouple exceeds a set limit (now 700*F). The limit was not exceeded and, hence, the printer did not actuate automatically.

The automatic thermocouple recorder was initiated manually at 14:33:28 (time 10 minutes). An examination of this data indicates that the highest temperature recorded was around 560*F. The cooldown following the transient seemed to occur normally. There are no indications of abnormal occurrences in the core such as might accompany material damage.

III. Evaluation of SPND h*sponse The SPNDs are normally used to monitor nuclear power. When the reactor trips, the SPND responso normally goes to O plus or minus a few nanoamps .

Several SPND's were tied to a multipoint recorder at CR-3 at the time of the transient on February 26, 1980. These several SPNDs behaved as expected.

SPND's respond to neutrons, gammas and temperature. With the reactor shutdown, occasionally a few spurious signals are noted -

on alarm printers under normal circumstances. At IbI-2 in 1979, '

the SPND's became thermionic and were qualitative indicators of APPENDIX COR COR-2

the core thermal environment. In high temperature environments, SPNDs exhibit behavior shown in Figure COR A.

Considerable activity was noted on the CR-3 alarm printout on February 26, 1980 beginning at about 14:30 or at 7 to 10 minutes into the transient. This activity is illustrated in Figures COR

5. The darkened locations in these figures denote the SPND going off scale. These all go off on the negative side. This deduction derives from the observation that when they returned on-scale, they were read by the computer as -9, -8, -7, etc.

nanoamps.

The initial SPND activity coincides with the minimum saturation temperature shown in Figure COR 6. The tripping of all reactor coolant pumps almost simultaneously with the closest approach to hot leg saturation, loss of one steam generator heat sink, decaying pressure in the other generator and SPND activity suggest that probably some boiling occurred in the core.

e COR-3 APPENDIX COR

Hi g h __ _ _ _ _ _ _ __ _ __ __ _ __ __ _ __ _ __ _ _ __ _ __ _ __Off sca]_ _ _

limit Computer prints 777 Moves up on cycling at high temperature p

/

/

[ Temperature (Computer prints ???

Low

/ 4 /

4 Off scale 7 /

/

COR A 7 SPND response to elevated temperatures t

w

X ,

NI-1 NI-3 PC CIC NI-5 NI-7 UCIC UCIC 4 _, y

_p -

4 0$*d$?O -

PC6

• • -*- O;f

'-g fu[.y .-

- -W l >> > ;> ; g

$ Y NI 8 NI-6 UCIC -

UCIC _

NI 4 NI 2 CIC PC Z

- ~

Legend PC: Proportional counter - source range 1 detector CIC: Compenaated ion chamber-intermediate range detector U"lC: Uncompensated ion chamber-power range detector

~

Figure COR 1. Nuclear instrumentation detector locatior.s, Crystal River - Unit 3.

(Figure 7-22 from FSAR)

I eI e e 4 0 .

S l 4 0 @ O O O 4 O e e @

Total core monitors e @ G O G based on % acre symmetry e @ 48 9 -O Symmetry monitors 9- O e e O G _g Combination total core e O e, e O and symmetry monitors S O O e O 9 9 O 4 9 O 4 G S' Thermocouple a /\

E Axial flux shape T l

Active core _

length I

E Es v Background detectors b ocal L flux detectors Figure CCR 2. Incore detector locations, Csystal River - Unit 3. ',

1 l l l l l l l I

- 1 Source Source

_ /~ range -

[ range

_ intermediate ._ , Intermediate range [ range

/

~ ~ -

r. r. .

September 21, 1978 . -

-0030 l I l l. Y l February t

26,1980 t

0 3 .6 _.9 12 _. 15 0 3 8 9 12 15 Counts per Second (X 10-2) . _ Counts per Second (X 104 )

Figure CCR 4. _ . _ . _ . _ Pqure COR 3. ,

e

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 e NI 1 e Ni-3 A

e Ni-5 CR4 9 CR7-1 CR4-2 e NI 7 l #

l A "J CR1-6 - ' CAS-8 CRS-1 CR11

A f CR8-1 CR6-2 "4

CR6-0 -! CRS 6 CR3-1 27 { D j

CR17 CR24 -r CR3-3 CR12 e

~

~A. CR312 y 2 =a CR44 CR8-7 CR76 -

La CR7-2 _ ...w ' CR4 3 m

M CRS-7 V CR3 s1 M

~

W CRS-2

~

G

q .;

=; =7 uj CR7 7 CR3-10 CR6-7 1' CR6-3 CR34 CR7-3 b *J *J CRS-6  % CR3-8 CR3-5 __ _ - CRS-3

-W W X*A K CR4-7 CR8-6 CR74 CC6-5 CR7-4 CR8-3 p-i CR4 4 4 f CR16 CR3-9

' *4 CR2-5 g i

' 'A CR34 CR13 "l

• A '$ Y UA '&

CR8-5 CR3-7 CR8-4 CR6-4 14 j is j N

- - CR$-5 CRS-4 CR1-4

• • Y l CR4-5 "A

y,-.: CR7-5 N E- P e NI-8

~ e NI-6 b R e NI-4 e NI-2

• SPND went off scale Total core monitor ,

Total core and symmetry monitor Z: Incore monitor number CRX-Y: Control rod number Y

{ Symmetry monitor of control rod group X Figure COR 5. Incore monitor and Control rod map, level 7, time 1430 - 1436. -

4

680

-Loop temperature 660 -

g Saturation

.- 5[ temperature 6a0 1

\ I

\ I

\

I 2400 -

e20 -

g i g IW------------

\ I 2200 -

e00 - \ /

i

\ /

c

\ /

2000 - e 580 \/

3 SPND activity }

a begins 1800 - @ 560 -

3 s j-Incore temperature S /

$1600 -

540 s

ct 1400 -

520 Reactor coolant 1200 -

500 --

pressure 1000 -

480 g_ 6  !  ! I 14:20 14 25 14:30 14:35 14:40 14:45 14:50 14:55 Time Figure COR 6. CR-3 transient, February 26,1980.

i'

APPENDIX I&C INSTRUMENTATICN AND COC ,. (O L NON-NUCLEAR INSTRUMENTATION SYSTEM NNI The Crystal River Non-Nuclear Instrumentation (NNI) provides measurements used to indicate, record, alarm, interlock and control process variables such as pressure, temperature, level and flow in the reactor coolant system, secondary system end auxiliary reactor systems.

Non-Nuclear Instrumentation is employed in the following systems:

1) Reactor Protection System (Indication Only)

2) Engineered Safeguards Actuation System (Indication Only)

3) Integrated Control System

4) Reactor Coolant Pressure Control System a) Pressurizer Heaters b) Pressurizer Spray Control Valve c) Pressurizer Power Operated Relief Valve

5) Pressurizer Level Control

6) Pressurizer Level Temperature Compensation 7.) Reactor Coolant Pump Start Interlocks -

8) Feed and Bleed Control (Boron)

I&C-1 APPENDIX I&C

POWER SUPPLY:

The NNI is powered by two separate 120 VAC Vital Busses designated NNI (X) and NNI (Y). Each supplies t24 VDC power supplies through breakers Si and S2 in addition to their 120 VAC loads (see Fig. I&C-1).

24 VDC POWER SUPPLY The NNI (X) DC power supply ccar.sL: of two +24 VDC and two -24 VDC (Lambda) supplies auctioneered from a 24 VDC bus. NNI (Y) is identical except it only has one set of 24 VDC supplies. The DC NNI (X) and NNI (Y) power supplies have no backup or bus transfer capabilities if a fault trips Si and S2*

Power Supply Monitor The Power Supply Monitor Module senses the output levels of the t24 VDC power supplies and the 24 VDC Busses. This monitor is used to indicate the loss of any DC power supply or the positive and negative busses Referring to Fig. 1, the monitor will operate the shunt trip ,

coils in the 120 VAC breakers (Si and S2) if the bus voltage falls below the set point (t22 VDC). Bus Monitor relays provide the contacts that close the power circuit to the shunt trip coils in the AC breakers which provide the AC Source to the DC power supplies. If either the positive or negative bus voltage falls below 22 VDC the relays in the monitor will close to apply voltage to the shunt trip of the AC breakers. The (Si and S2).

Circuit has a 0.5 second delay to allow the bus voltage to recover if the fault is momentary. Also, the delay allows the power supplies to attain the proper voltage when they are -

initially powered.  ?

APPENDIX I&C I&C-2

THE INSTRUMENT LOOPS The NNI systems that are CC powered fall in the following four categories:

1) All instrument loop components are powered by NNI (X).

2) All instrument loop components are powered by NNI (Y).

3) Component power is mixed between X and Y.

4) Component power is mixed between X and Y, but is switch-able to all CNE power.

The switching is unique to only a small number of the more important parameters and is accomplished by switches located on the control panel (see Fig. I&C-2). These switches are positioned below their respective indicating instrumentation and temporarily labeled X and Y.

LOSS OF POWER:

The NNI (X) 24 VDC bus voltage started to decline. This apparently was caused by a misaligned set of connector pins _

between a printed circuit board and a buffer module causing a short circuit. The printed circuit board acts as an extension between the cabinet connections and the buffer module. This buffer module provided an input to the recently installed saturation meter which had not operated properly since installation. At the time, an instrument technician was working on the problem.

Further investigation revealed a similar pin misalignment on another buffer extennion board installation indicating a possible -

generic problem with this equipment. "

I&C-3 APPENDIX I&C

The Power Supply Monitor sensed the reduced voltage and tripped Si and S2 (AC Supply breakers) causing an exponential decay of the DC voltage resulting from the circuits RC time constant.

This voltage decay and subsequent total failure created the following:

1) Erroneous inputs to the Integrated Control System (ICS) resulting in a reduction in feedwater ficw and a brief power increase with rod withdrawal demand terminated at the 103% limit.

2) The power operated relief valve (PORV) actuated because the signal monitor module which checks the RCS pressure signal operated due to an effective lowering of the set-point as the internal reference voltage lowered with the declining voltage from the DC supply. The PORV operated as a result of losing proper set-point reference rather than an actual high pressure and then sealed in after actuation due to the voltage loss.

3) Opened the spray valve to something less than 40%. This had a negligible impact on the transient.

4) An RCS high pressure reactor trip resulted from the _

transient created by the ICS response to the erroneous signals.

5) Loss of an automatic start capability of the Emergency Feedwater System due to che midrange failure of the Low /

Low steam generator instrumentation indicating a higher than actual level. This resulted in boiling the "A" steam generator dry and actuation of the rupture matrix.

6) Loss of low steam generator level (<18") plant trip -

capability.

• APPENDIX I&C I&C-4

7) Loss of a myriad of control room instrumentation leaving only the following list of operable instruments.

SUMMARY

OF OPERABLE INSTRUMENTS FOLLOWING NNI POWER FAILURE Tag No. Description Location SF-1-LT 1 Spent Fuel Level Control Board FF-1-LT 2 Spent Fuel Level Control Board CD-15-FT Condensate Flow Control Board CD-61-LT Dearator Level Control Board CA-12-TT Boric Acid Temperature Waste Disposal Panel BS-1-dpt 2 RB Spray Flow Control Board BS-7-TT Thios. Tank Temperature Control Board CF-2-LT 2 CF Tank Level ALL CF-2-LT 4 CF Tank Level Control Board CF-1-PT 2 CF Tank Pressures Control Board CF-1-PT 4 CF Tank Pressures Control Board DH-2-TT 2 DH Inj. Temperature All DH-6-TT 2 DH Cooler Inlet Temp. Control Board DH-1-dpt 2 DH Flow Control Board DE-2-TT 1 DH Injection Temperature Control Board DH-6-TT 1 DH Cooler Inlet Temperature Control Board MU-23-dpt 3 HPI Flow Control Board _

MU-23 -dpt 4 HPI Flow Control Board MU-4-dpt aetdown Flow ALL MU-5-TT Letdown Temperature Control Board MU-2-PT MU Pump Discharge Pressure Control Board MU-18-dpt MU Filter A P Control Board SP-7B-dpt Startup FW flow Computer SP-6B-PT 1 OTSG Pressure All SP-6A-PT 2 OTSG Pressure Computer SP-lCA-PT 1 Turbine Inlet Pressure Computer SP-1)B-PT 2 Turbine Inlet Pressure Computer SP-4B-TT Main Steam Temperature '.

- Computer SP-1A-CT 1 OTSG Full Range Level Control Room I&C-5 APPENDIX I&C

Tac No. Descriotion Location SP-1B-LT 1 OTSG Full Range Level Control Room RC-3A-PT 3 Safeguards Wide Range Press. Control Room RC-3B-PT 3 Safeguards Wide Range Press. Control Room RC-5A-TT 3 T c Narrow Computer RC-5B-TT 3 T e Narrew Computer RC-1-LT 3 Pressurizer Level Shutdown Board RC-1-LT 1 Pressurizer Level Control Room (uncompensated)

RC-131 PT Low Range RC Pressure 0-6004 ALL SP-1B-LT 4 OTSG Startup Level Computer SP-1B-LT 3 OTSG Oper. Level Control Room RC-5A-TT 4 Tc Wide Control Room RC-5B-TT 4 Te Wide ALL Since the NNI (X) supplies a disproportionately large number of instruments in the NNI system, many of the control room indicators failed to midscale. The midscale failure was due to the -10 to +10 VDC control-voltage used in the NNI. Often the midscale failure indications were close to a normal operating parameter making it difficult to determine if the reading was accurate. Additional instrumentation potentially available was lost since most of the control switches (located on the control panel) were selected to the X position.

During the 20 minutes (approximately) the NNI (X) DC power supply was down, several unsuccessful attempts were made to close Si and S

2 T*e breakers continued to trip after each closure until the power supply monitor was removed. After the power supply monitor was removed, the breakers were successfully closed restoring power. At this time, the short was presumed to have burned through thus clearing the fault. Later, the power supply monitor tested satisfactorily and was eventually returned to service in -

the NNI (X) power supply system. -'

APPENDIX I&C I&C-6

On November 10, 1979, an event occurred at OCONEE Power Station that resulted in AC power loss to the ICS and NNI System leaving .

the operator with very little indication of plant status due to the loss of instrumentation on the control board. This event resulted in an NRC IE Bulletin (79-27) " Loss of Non-class-IE Instrumentation and Control F ,wer System Bus", dated November 30, 1979. The bulletin allowed licensees 90 days to complete a review of their plants related systems and provide a written response to the NRC.

INTEGRATED CONTROL SYSTEM The purpose of the integrated control system (ICS) is to maintain a match between the power prcduced in the reactor and the power (megawatts) generated by the turbine-generator. The ICS accomplishes this purpose by controlling the power in the reactor, the rate of steam production in the steam generator, and the megawatt output of the turbine-generator.

• There are three basic ways of controlling a reactor / steam generator / turbine-generator unit. These are:

A. Reactor / steam generator following mode where a turbine load is established and the reactor / steam generator _

system maintains the required steam conditions .

B.

Turbine following mode where the reactor / steam generator system established a steam output and the valves which control steam flow to the turbine maintain constant steam conditions, thus determining generator electrical output.

C. The integrated reactor / steam generator / turbine mode of control which is a combination of both A and B. -

4 I&C-7 APPENDIX I&C

The portion of the ICS that controls reactor power uses a comparison of megawatt demand, core thermal power, and reactor coolant system temperature to produce a demand for a certain control rod position. The portion of the ICS that controls steam production in the steam generators uses a comparison of primary and secondary system parameters to produce a steam generator water level demand signal which is then used by the speed control system of the main feedwater pumps and the position control system of the main feedwater control valves. The portion of the ICS that controls the electrical generation from the turbine-generator uses a comparison of secondary system parameters and load demand to produce a demand for a certain turbine throttle valve position. The steam pressure and steam temperature to the turbine throttle are held constant.

The following is a list of the NNI (X) powered input signals to the ICS and their subsequent effect on the transient at CR-3 when power was lost.

ICS INPUT RESULT CCNTROL EFFECT

1. Feedwater Flow (Main) +

Feedwater Control Valves

~

fail to 50% open. _

2. T,g Te (t) and T ave + Rod withdrawal to increase Rx power.

o.

Steam. Generator Level (OP) + Reduce feedpump speed (flow).

4. RCS flow + Reduce feedpump speed (flow).

5. Steam. Generator Pressure + Reduce feedpump speed

• e APPENDIX I&C I&C-8

(flow).

6. Feedwater Temperature + Increace Rx power. Re-duce feedpump speed (flow).

7. Turbine Inlet Pressure t Open turbine valves increase MWe.

In the event which occurred at CR-3, degradation and subsequent failure of the non nuclear instrumentation (NNI) X bus and power supply failure resulted in erroneous flow, pressure, level, and temperature input signals to the ICS. These erroneous signals initiated control actuation signals which created the demand and thus system response in the reactor, steam generator water inventory and the turbine generator. The system response resulted in a transient which materialized by simultaneously increasing reactor power, megawatts generated, and a rapid reduction in feedwater flow to the steam generator. This created an overpressure conditon in the reactor coolant system which culminated in a reactor and turbine / generator trip. -

It should be noted, however if half the ICS inputs had been powered from the NNI-Y source, a transient of similar proportions would have resulted.

The present design of the ICS does not allow for control signal input failures resulting from power losses or instrumentation faults.

RUPTURE MATRIX The Rupture Matrix is a system which actuates on low steam generator pressure to totally isclate the steam generator in the event of a pipe rupture. (See Fig. I&C-3).

Figure I&C-4 shows the logic required to actuate the rupture

matrix. Basically, two low pressure inputs (<600 psig and <725 I&C-9 APPENDIX I&C

psig) from the same steam line header will result in an isolation.

This isolation closes the suction valve on the affected feed pump which results in a feed pump trip.

At CR-3, the "A" OTSG Rupture Matrix isolation occurred an a result of the loss of power to one pressure instrument coupled with low steam pressure on the other. The actual low steam generator preasure was caused by loss of feedwater eventually boiling the steam generator dry.

Approximately 20 minutes later, "B" OTSG Rupture Matrix isolated the "B" steam generator, but for a different reason.

Cold emergency feedwater, which was being injected at the time ,

dropped the pressure below 600 psig initiating the Rupture Matrix.

It is interesting to note that the actuation of "B" OSTG Rupture Matrix was caused by cold emergency feedwater addition, and may tend to occur on any transient where emergency feedwater would be needed. This type of steam generator isolation would result in a loss of heat sink, especially, during natural recirculation. The Rupture Matrix actuated, even though no rupture existed, tripping the only operating main feedpump. This in turn called for emergency feedwater, but no flow path into the steam generator -

existed.

In view of this, a further evaluation of dhe Rupture Matrix initiation should be considered, as conflicting plant control signals during design transients (loss of feed) would result in the loss of the heat sink availability.

4 APPENDIX I&C I&C-lO

e Vital bus Station low Vital bus 118 V 50/60 Hz resistance ground 118 V 50/60 Hz

__ __ _ _ _ _ J _ __ _. _ __ ___

Power 7l auctioneer l l panel S1 <

Trip S2. Tng 8l p [3] 4] 9

_ i .

i e i

't

+ 1 + t 3r 1 2 3 4 D.C. power 24 V DC 24V DC 24 V DC 24 V DC supplies

.+. -

+_ -

+ -

+ -

i e i 3 32 System l l a19 trip o 20 contacts

~

-P,D1 2 04 D3'2 l .P, D2

-\ Diodes /--

+ n Pos. bus l 33 c-

\

Powerl l l Common l l l3o15 16 +24 34 o- -

auctionnerl }.-. lL-o 17 Com. 35 o- s panel l Neg. bus l l

+24 V DC 24 V DC -24 V DC l

0 18 -24 36 q )- ,

g pos. bus common neg. bus L __ _._ _ _ __ _ _ -._ _ _ _ _._______J Power supply monitor i

OO O O

+24 Com.-24 +24 Com. -24 Load number 1 Load number 2 Figure l&C-1. Typical system connection for the power supply monitor.

9

'me Control panel meter

' NNI control and/or ConWI a m  : ICS control and/or switch , computer input

\

\

N

-X h Y Instrument instrument -

loop X loop Y Figure l&C-2.

O k

Main steam

. isolation valves 14 _

. [g' CC :

EC D

Steam :  ;

Steam generator generator A r -y B

.Ak Ak y

JL v,

JL wh w%

vm vm Normal feedwater V' V V V block valves bLhL j J [ Normal block valvesfeedwater

~

Main Emergency Main feedwater feedwater feedwater supply supply supply Main feed pump

"* PU*U suction valve N '

p feed ump

_ __ . _ Figure I&C-3. Rupture matnx.

Actuation "A" Actuation "A" not bypassed A steam generator

< 725 < 600 J A1 Isolate steam -

o- A steam header generator

- Actuation "B" Actuation "B" not bypassed A steam generator

< 725 < 600 .

psig psig A2 '

steam header Actuation "A" B steam generator Actuation "A" not bypassed 7

< 725 < 600 2

J psig psig  %

B, Isolate 3

steam 0->B steam -

header generator j Actuation "B" B steam generator Actuation "B" not bypassed 2

7 .

_f

< 725 < 600  : = And psig psig B2 steam O = Or header Figure I&C4. Rupture matrix (simplified actuation logic).

APPENDIX RAD T4DIATION AND RADIOCHEMISTRY

1. Reactor Building Gamma Monitors After the reactor trip, the PORV and safety valves passed about 40,000 gallons of water in the form of steam and water into the reactor coolant drain tank (RCDT) on the 95 ft. level of the reactor building (RB). A high level alarm was received in the RCDT at 14:25. about 2 minutes later the reactor building pressure began to rise indicating that the rupture disk on the RCCT had relieved (110 psig). The reactor building pressure temperature, and dome radiation monitor responses are shown in Figure R.l.l. At 14:34 the reactor building dome monitor (RM-Gl9) alarmed at 10 R/hr. Figure R.l.2 shows the behtvior (recorded on RMR-1 about once per minute) of the dome monitor along with the reactor building fuel handling bridge monitor, the reactor building personnel access hatch monitor, and the reactor building incere instrument area. The fine structure and relative responses of the various instruments are reasonably consistent.

The gaseous activity was released from the RCDT through its rolief valve and rupture disk. This buoyant mixture then rose from the RCDT on the basement level (75 ft.) of the reactor

~

building up the nearby stairs to communicate with the area near the personnel hatch monitor (RM-G17) about 50' clockwise from the stairway on the 119 ft. level. This monitor, an unshielded GM tube which had been reading a low background of about 1 mR/hr, rapidly rose to about 80 mR/hr and dipped to about 30 mR/hr over 10-15 minutes. The monitor then slowly rose to a peak of 200 mR/hr and then decayed to about 70 mR/hr within 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. The response of this monitor is consistent with a puff of relatively undiluted radioactive gas being transported past it by convection or building ventilaton followed by dilution into the overall .

volume of the reactor building. Although RM-G17 should have alarmed (set point 100 mR/hr) at about 30 minutes, no record was found on the annunciator log. (Since 90% of the noble gas RAD-1 APPENDLX RAD

activity in the reactor coolant has a half life greater than nine hours, radioactive decay plays an insignificant role in the early instrument response.)

The second monitor to respond to the radioactive gas was the reactor building dome monitor, RM-Gl9. This monitor, using a high range ionization chamber, is located on top of the elevator shaft at the 206 ft. level. This location very near the stairway allowed the undiluted mixture of radioactive gases easy, direct access to the detector. The monitor responded by rapidly rising off its "zero" level of 5 R/hr and alarming (set point 10 R/hr) at 14:34:42 (about 3 minutes after the reactor building reached 2 psig pressure). The radiation level peaked at 50 R/hr about 15 uinutes after its first rise and again at 60 R/hr about 10 minutes later. This drop and subsequent rise was again probably caused by circulation and recirculation of gases followed by dilution with the full reactor building volume. The dome monitor reading dropped to less than 5 R/hr about 100 minutes after its initial response.

The other two gamma monitors in the reactor building both use unshielded GM tubes and are located on the 160 ft. level at the fuel handling bridge (RM-G16) and the incere instrument area (RM-G18). These monitors both responded to the reactor trip at about _

the same time. The incore instrument area monitor had been reading about 55 mR/hr. The very fast drop-off at the time of reactor shutdown is consistent with radiation from the water activation products Nitrogen - 16 (7 second) and Carbon-15 (2.5 second). The incore monitor then peaked at 5 R/hr at 90 minutes and decayed (by dilution) to 100 mR/hr within 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. The fuel handling bridge monitor apparently located in line of sight of ten times more reactor coolant than the incore instrument area monitor, read about 600 mR/hr before the reactor trip. It responded after the reactor trip with double peaks of 180 mR/hr -

and 200 mR/hr (15 and 60 minutes) and dropped slowly to 90 mR/hr e after 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

APPENDIX RAD RAD-2

The slowly decreasing radiation field over the first five hours is consistent with dilution by the 100,000 SCFM containment ventilation system flow in the 2 x 106 ft 3 volume. These figures yield a dilution / decay constant of 3 Er-1 (15 minute half life). The downward slopes on the radiation monitor response vary from 1 to 6 hr.-1 (7 to 40 minutes half life).

Evaluation of records from other monitors outside the reactor building reveals no rsdiation levels above normal except one point recorded while the RB purge was being stopped. Extensive surveys made with portable instrumentation confirmed that radiation levels outside the reactor building were normal.

2. Reactor Chemistrv The 40,000 gallons of cooled down water displaced from the primary system by extended operation of the high pressure injec-tion system represents about 3/4 of one hot system volume.

Assuming a continuous-stirred-tank reactor (CSTR) model, about half (1-e .75) of the dissolved activity resident in the coolant was deposited in the reactor building area. (The CSTR model is valid since the reactor circulation flow is large in relation to the flow out the safety and relief valves.)

Table R.2.1 lists the activity in the primary system. Note that the tritium level in the coolant dropped by a factor of about two after the transient at 1423. Interpretation of the other radio-nuclides is not so straightforward since fission products (I and Cs) and activated corrosion products (Co) in the reactor coolant are increased following a reactor trip (fission product spike and crud burst). The level of I-131 is plotted in Figure R.2.1.

The iodine spikes by a factor of about 5 and then decays with a dilution time constant corresponding to about 30 gpm of purifica-tion flow or system leakage. The increase in iodine concentra- ~

tion is consistent with a normal shutdown and does not imply an 3

additional fuel failure. For example, a shutdown in early February resulted in a thirty fold increase in radiciodine.

~

RAD-3 APPENDLX RAD

From Figure R.2.1, the water released to the R.B. contained between 0.25 and 0.45 uCi/cc of I-131 or a total of 40 to 70 Ci of I-131. Early measurements of the sump water indicated that the level was about 70 C1.

The level of noble gas in the reactor building atmosphere is shown in Figure R.2.2. The Xe-133 is decaying at approximately its normal radioactive half life. The inventory of Xe-133, about 1000 Ci, corresponds to about 1/3 of the Xe-133 resident in the reactor coolant system before the reactor trip. Similar calculation for Xe-135 accounts for about 1/2 of its respective inventory (after substantial half life correction).

The level of airborne radiciodine in the reactor building is also shown in Figure R.2.2. This level has increased substantially since just after the trip as the liquid phase and gas phase equilibrate. The partition coefficient, by 3-2-80, had dropped and stabilized at about 2000. Some conversion of inorganic iodine to organic iodine may have taken place. Although this iodine may cause some operational problems, the two curies of iodine in the containment atmosphere pose no significant health risk. (The one thousand curies of noble gas in the reactor building are of even less concern).

3. Hydrogen Before the trip, the level of dissolved hydrogen was 27 cc/kg (from analysis at 1100 on Februa.ry 26). The hydrogen inventory was therefore about 300 ft 3 or about 0.02% of the reactor building volume. A sample of the containment air as expected revealed no detectable hydrogen and normal levels of oxygen.

Therefore, no significant sources of hydrogen such as metal / water reaction or radiolysis were detected. .

APPENDIX RAD RAD-4

4. Plant Releases At the time of the trip, three release pathways were open: a liquid discharge was underway, the reactor huiding was being vented, and a waste gas decay tank was being discharged. The liquid discharge was being made from an evaporator condensate Jtorage tank. This discharge was terminated at 1750 as recorded in the shift supervisor log. As expected there was no change in the response of the plant discharge line monitor (RM-L2) at the time of or after the plant trip.

Interim operating procedures required that the reactor building purge be secured after initiation of high pressure injection.

Only verbal confirmation of manual securing is available. The radiation monitor for this purge (RM-Al-G) does show one point at 3400 cpm in a background of 100 to 500 cpm. The setpoint for automatic termination of the purge by this monitor was 3020 cpm. The one elevated point occurred at the same time as the activity' increase as measured by the reactor building sample line monitor (RM-A6-G). Because of the short time frame between initiation of high pressure injection and the response of the radiation monitors, it is not possible (and probably irrelevant) to determine whether termination of the reector purge was manual or automatic.

Waste gas decay tank "C" was also bef.ng released at the time of the trip. This release was secured at 1730. Monitors on the auxiliary building ventilation discharge show only slight responses during and after the trip. .

RAD-5 APPENDIX RAD

Table R.2.1 Reactor Coolant Radiochemistry Sample Total Activity Dose Eq. I I-131 I-133 Cs-134 Co-58 11 - 3 Date -

Time pCi/cc pCi/cc pCi/cc pCi/cc pCi/cc pCi/cc pCi/cc 2-26 0010 2.29 0.322 0.246 0.233 1.77E-2 7.64E-3 0.27 1615 2.41 0.593 0.454 0.429 4.46E-2 2.31E-2 1904 1.55 0.566 0.447 0.383 4.15E-2 -

2135 1.93 0.831 0.664 0.548 5.754-2 5.19E-2 2-27 0058 2.63 1.45 1.19 0.884 8.91E-2 -

0.13 0615 1.97 1.10 0.924 0.574 8.47E-2 -

0.113 0855 1.78 0.979 0.833 0.506 1.04E-2 -

1255 1.60 0.944 0.818 0.437 7.71E-2 1755 1.75 1.07 0.949 0.416 9.37E-2 9.99E-3 2110 1.31 0.818 0.736 0.288 7.06E-2 1.12E-2 2-28 0110 1.12 0.755 0.686 0.245 4.97E-2 2.0E-3 0.112 0815 0.97 0.620 0.575 0.160 6.76E-2 9.6E-3 2020 0.77 0.526 0.525 -

5.52E-2 5.3E-2 APPENDIX RAD RAD-6

160 Reactor Building Temperature 140 -

120 -

100 -

80 -

I ' I I I I e0 Reactor Building Pressure

.s 20 -

E 10 -

0 m 60 -

Reactor Building Dome Monitor a

s I k I i 1400 1500 1600 1700 1800 1900 2000 2100 -

Time (hours)

Figure R.1.1 e

105 Reactor building dome monitor 104 -

d Reactor building incore instmmentation area 103 -

b '

B c.

cc 102 _

k

/ -l

,e Personnel hatch Fuel handling bridge 10

,' I I 3

O 1 2 3 4 5 Time (hours)

Figure R.1.2 e

U '

S o -

1.0 --

g _

R w

C -

O Dose equivalent iodine O lodine-131 trip 0.1  !  !  !  !

12 Midnight 12 Midnight 12 Noon 12 Midnight *2 Noon 12 Noon 2/26/80 2/27/80 2/28/80

_ Time Figure R.2.1. Radio-lodine in reactor coolant versus time.

1.0 _. _ 1 X 104 O _

_ O xe-133 O-O lodine-131 U

U R 0

0 3

3 0.1 - -

1 X 104 5 5

7 O

O. -

~

0.01 l l l l 1 X104 0 2/26/80 0 2/27/80 0 2/28/80 0 2/29/80 0 3/1/80 0 Date _

Figure R.2.2. Xe-133 and lodine-131 levels in containment atmosphere.

EL e

• e

e REFERENCE LIST 1.

Sequence of events and operator interviews - 0930 2/27/80 2.

Sequence of events and operator interviews - 1630 2/27/80

3. Unusual Operating Event Summary (Strip Charts)

4. Computer Post Trip Review - 14:08:45 + 14:38:30

5. Computer Event Summary - 13:33:32 + 16:37:48

6. Alarm Summary 14:09:56 + 16:54:05

7. A&B - Sequence of Events - (1600 2/27/80)

8. Unusual OP Event Summary

9. Preliminary SOE cs of 2/28/80

'O. Incore Temperature Charts

11. Generated Curve of HPSI Injection Flows (FPC) 12.

Generated Curve of Pressure / Saturation /Incore Temp (FPC)

13. Instrument Cross Reference List 14.

Personnel Observations of Accident (FPC)

15. FPC Sequence of Events 2/29

16. SPND data for 2/26/80 Event

17. Evaluation of Core Instrumentation

18. Strip Chart (12/21/79) Rx Trip

19. Source and Intermediats Range Power Indication for (12/21/79)

20. Sequence of Events (as of 1300 2/29/80) Rev. 2A

21. Sequence of Events (as of 2300 2/1/80) Rev. 3

22. Post TMI modifications

23. Steam Rupture Matrix

a. Actuation Logic "

b. Pilot Valve Operation

c. Rupture Matrix Valve Summary Ref-l

e

24. IE Bulletin No. 79-27, Loss of Non-class IE Inst. & Control Power System during operation, Oconee.

25. Cerves used by F.P.C. to describe 2/26/80 Incident

26. Summary of Operable Instruments Following NNI Power Failure

27. Curve for PCRV cpening

28. Sequence of Events of 2300 3/1/80 - Rev. 5

29. Lescription of Equipment Deficiencies

30. Engineering Response-Correction Action for Loss of Vital Instrumention Upon Loss of NNI

31. Shift Supervisora Log

32. Operators Log

33. Plant Procedures

a. OP-501 Reactor Non-nuclear Instrumentation

b. AP-103 Radiation Monitoring System Alarms

c. AP-123 Solid System Pressure Control

d. AP-llo Reactor-Turbine Trip

e. AP-ll2 Loss of Electrical Supplies

f. AP-123 Solid System Pressure Control

g. AP-ll6 Pressuriser System Abnormal Conditions

h. EP-106 Loss of Reactor Coolant or Reactor Coolant Pressure

i. EP-108 Loss of Steam Generator Feed

j. EP-103 Loss of Reactor Coolant Flow /RC Pump Trip

k. EM-207 Reporting Requirements On Emergencies

l. EM-203 Classification of Emergencies and Criteria -

for Evacuation

m. EM-202 Duties of the Emergency Coordinator

n. EM-102 Staffing of Technical Support Center and Operation Support Center

o. AI-500 Conduct of Operations

p. AI-200 EM-100 Organization and Responsibility

q. Emergency Plan

r. OP-504 Integrated Control System

s. AP-102 Annuniciator Alarms

t. AP-ll3 Reactor Cooldown by Natural Circulation

u. 80-17 Ehort Term Instruction - Contm't. Iso.

Valves

34. Piping and electrical system prints .

a. Overall plant schematics

b. NNI X + Y schematics Ref-2

e

1. NNI-X power distribution

2. ICS -

3. AC loads from NNI-X power supply

4. AC loads from NNI-X power supply

5. AC loads from NNI-Y power supply

35. Telephone books and contacts at CR-3

36. File folder with draft copies of report

37. Crystal River Viewgraphs

38. OP-501 - CR-3 Rev. 2 - 2/3/77 e

6 Ref-3

9 GLOSSARY OF TERMS BOP Balance of Plant cc/kg Cubic Centimeter per Kilogram aci/cc Microcurie per Cubic Centimeter Co Cobalt epm Counts per Minute cps Counts per Second Cs Cesium CR-3 Crystal River - Unit 3 CSTR Continuous Stirred Tank Reactor Dose Eq. I Dose Equivalent Iodine ESF Enginered Safeguards Features GM Geiger-Muller H3 Tritium HPI High Pressure Injection I Iodine ICS Integrated Control System mR/hr Milli-Roentgen per Hour NNI Non-Nuclear Instrumentation NSSS Nuclear Steam Supply System OTSG Once Through Steam Generator PORV Power Operated Relief Valve psia Pounds per Square Inch - Absolute psig Pounds per Square Inch - Gage R/hr Roentgen per Hour RB Reactor Building RC Resistive Capacitive Rh Rhodium RCDT Reactor Coolant Drain Tank RCS Reactor Coolant System RM-A Radiation Monitor - Air RM-G Radiation Monitor - Gamma -

RM-L Radiation Monitor - Liquid RMR Radiation Monitor Recorder GLOS-1

=

0 SCFM Standard Cubic Feet per Minute SPhT Self Powered Neutron Detector SR Source Range T ave Average of Th and T c Tc Cold Leg Loop Temperature Th Hot Leg Loop memperatures Xe Xenon S.

GLOS-2