ML19308C084
| ML19308C084 | |
| Person / Time | |
|---|---|
| Site: | Crane  |
| Issue date: | 07/20/1979 |
| From: | Johnston B NRC - NRC THREE MILE ISLAND TASK FORCE |
| To: | Frampton G NRC - NRC THREE MILE ISLAND TASK FORCE |
| References | |
| TASK-TF, TASK-TMR NUDOCS 8001210377 | |
| Download: ML19308C084 (10) | |
Text
e' " *.
h UNITED STATES
'[?
\\.
NUCLEAR REGULATORY COMMISSION
~
k
- S
, g rf WASHINGTON, D. C. 20555 7/20/79 NOTE T0:
George Frampton As you requested, attached is a draft of Section 2.1, " Design Deficiencies."
0
^
Bill Joh'n /
ston Task Force 2
~-
8001210 8 77
/
7/20/79 3:10 2.
Design deficiencies (which may be found to be of significance to the course of the accident).
ydp/-
2.1 (Possible) Plant System Deficiencies
/'
2.1.1 Pressurizer Size
- (M SWW It has been suggested t at theavolurfle of the TMI-2 pressurizer k i@iy wail, comgared to other PWRs of similar power..id:supreet, the smaller v
volume would cause more rapid filling or draining of the pressurizer and thus:
(1) demand more rapid operator response, and (2) cause mre frequent demands on the PORV.
2.1.2 OTSG secondary side water inventory The mass of water held in the secondary side of the B&W OTSGs is relatively small cortpared to other PWRs, causing these OTSGs to boil dry more quickly. This can result in:
(1) mre rapid heatup of the RCS, and (2) the need for more rapid operator intervention in some situations.
This " deficiency," in concert with (possibly) the concern in 2.1.1, may make the B&W design fundamentally less managea
" forgiving") in abnormal situations.
2.1.3 Core barrel vent valves In order to overcome the potential problems of steam binding during a large LOCA, B&W installed vent valves in the core barrel.
When the RCS pressure above the core is greater than that in the downcomer, these valves open and allow steam flow into the downcomer.
In the 3-16 hour period in the TMI-2 accident, these valves may have been opening, allowing steam flow to go directly to the down-comers, bypassing the steam generators.
Thus the heat removal capability afforded by the steam generators may J
have been compromised by the presence of these valves.
2.1.4 Inhibitions to natural circulation Certain design features of the B&W NSSS may be detrimental to the establishment of natural circulation, most notably the relative heights of the vessel and the OTSGs and the
" candy cane" arrangement.
Thus it may be more difficult to achieve natural circulation cooling in the B&W design.
?
2 2.1.5 PORV design and use 2.1.5.1 Design The power operated relief valve at the top of the pressurizer is designed to assist in nornal plant operations, and has not been l
considered in licensing proceedings to be a " safety-related" component.
As such it is not environmentally qualified to safety-grade standards.
In transientuinitiated accidents such as that at TMI-2, the PORV may be required to operate in conditions outside its design envelope, and thus may be less likely to perform satisafactorily when needed.
It has also been suggested that a cause for the PORV sticking open may have been because of the discharge line arrangement.
As it was arranged, it was suggested that backpressure in the line could have caused the valve to re-main open.
2.1.5.2 Use Because of the possible " deficiencies" dis-cussed in 2.1.1 and 2.1.2 above, the frequency of demands on the PORY in B&W plants is signi-ficantly greater than that in other PWRs.
Since the likelihood of such a valve failing to close after opening has been known to be relatively high, the likelihood of causing a small LOCA in B&W plants is greater than that in other PWR designs.
2.1.6 RHR system not designed for operating pressures.
The RHR systems in all PWRs are designed for low pressure operation, i.e., after the RCS has been cooled and depressurized by other systems.
Since attempts to reach RHR pressures during the accident were unsuccessful, it has been suggested that the RHR system be modified to be operable at operating pressures.
l l
l
3 2.1. 7 Pressurizer surge line loop seal The surge line connecting the pressurizer to the RCS hot leg contains a " loop seal" which may have inhibited flow into and out of the pressurier during the course of the accident. This loop seal may thus have contributed to the high pressurizer level readings indicated and used by the operators throughout the accident.
2.1. 8 Lack of remote vent capability at RCS high points During the TMI-2 accident a capability to remotely open the vents at the RCS high points could have been useful to discharge steam and/or noncondensible gases trapped at the high points which were inhibiting natural circulation cooling.
2.1.9 Reactor Building emergency sung design The emergency sump in the reactor building contains screens to prevent materials which could clog the sunp from actually end.-Ing it.
Apparently, these screens were installed to a specific height based on the expected water levels in a large LOCA.
In the actual accident water levels rose to heights above the top of the screens, so that the operators could not be sure that blockage had not or would not occur if the sump were used. Because of this concern, the nunber of available options for core cooling appears to have been reduced.
l l
7 4
2.1 10 Post accident restoration capabilities In general, the TMI plant experienced significant difficulties in recovering from the accident because of the high levels of radiation.
Liquid waste storage facilities were soon filled, making access to vital equipment more difficult.
A second problem was that, throughout the course of the accident, it was desirable and/or necesary to use systems located in the auxiliary building which would or did draw radioactive material into the auxiliary building. Because the associated radiation shielding problems had apparently not been fully considered before the accident, systems such as the RHR system were not (and still are not) used. Other systems, such as the hydrogen reconbiners, were used only after shielding could be brought to the site from other locations.
2.1.11 Safety classification of the EFW system The EFW system in TMI-2 was not deisnged to the safety qualification of systems such as ECCS. Because of this, actuation signals were only given to particular components in the system, and not delivered ti valves such as the discharge line block valves.
Had such actuation signal requirements been placed on the EFW system, the delay in EFW delivery to the OTSGs may not have occurred.
2.1.12 Lack of hot leg ECCS injection capability The THI 2 plant does not have the capability of injection of ECCS water into the RCS hot legs which exists on some other PWRs.
Since such a capability might have been useful in collapsing steam voids in the upper core and providing better cooling of the damaged portions of the core, the long term cooldown of the core may have been enhanced.
l
5 2.1.13 Qualification of pressurizer heaters As is the case for the PORV design discussed in 2.1.5 above, the pressurizer heaters are considered opera-tionally-related equipment rather than safety-related.
As such they are not qualified for steam environments and did experience problems in operating during the 5
accident. This lack of qualification may have con-p tributed to the prolonged time period during which i.he core remained at high temperatures and radioactive material was forced out of the fuel.
I 2.1.14 Lack of automatic bypass on the demineralizer/
polisher units.
The initiating event in this accident was apparently the closure of the discharge valves from the demineralizer/
polisher units in the main feedwater system.
In other PWRs the bypass valves to these units are designed to automatically open upon closure of the discharge valves.
Thus the specific initiating event of this accident may not have occurred in other PWRs.
2.1.15 Condenser hotwell control Two problems appear to have existed which related to the availability of the hotwell for OTSG heat removal.
2.1.15.1 Hotwell volume and level control Problems were experienced during the accident of overfilling of the hotwell, which made it unavailable for use in steam condensation.
Apparently, the hotwell volume and faulty level E
Wk h-,
h W-2.1.15.2 Availability of the auxiliary boilers Auxiliary steam boilers are used to supply steam to the air ejectors which maintain condenser vacuum.
During the accident, problems apparently were encountered in operating the boilers, which seems to have added to the delays in restoring the hotwell to operability.
l
6 2.2 (Possible) Command and Control Deficiencies 2.2.1 Control Room Design The design and layout of the control room and the controls within it nay have contributed to the apparent lack of understanding by the operators during the course of the acci dent.
2.2.2 No anticipatory reactor trip The control logic of the TMI-2 reactor protection system (the trip system) was such that a delay occurred between the feedwater stoppage to the OTSGs and the tripping of the reactor. This mismatch beteen heat generation and heat removal contributed to the initial RCS heatup and the rapid dryout of the OTSGs.
2.2.3 Containment isolation The containment isolation system is designed to actuate at pressures L:'. ermined by the events in a large LOCA.
Thus in the TMI-2 small LOCA the isolation setpoints were not reached for approximately four hours. This allowed radioactive material to escape through various paths such as the reactor building sump, vent headers, etc.
l An additional possible deficiency in the isolation system i
is the isolation of support systens for the reactor coolant punps, so that operator bypass of the isolation is required to maintain operation of these pumps.
2.2.4 No ECCS actuation bypass prevention The TMI-2 ECCS actuation signals can be (and were) bypassed quickly by the operators.
In other PWR designs, such i
I a bypass is prevented by electrical interlock controls for certain periods of time. Thus the lack of such inter-l locks allowed the operators to interfere with the designed response of the ECCS, contributing substantially to the core heatup and danage.
~
7 2.2.5 RCS sampling capabilities Samples of the reactor coolant are taken and analyzed as part of both routine shutdowns and emergency situations.
A nunt)er of problems in these processes occurred during the accident, including the following:
2.2.5.1 Apparent dilution of sanples Samples of boron concentrations taken early in the accident were apparently incorrect because of the method of sanpling.
This may have contri-buted to confusion and misunderstanding by the operators.
2.2.5.2 High levels of radioactive material in the sanpling lines and area coupled with inadequate shielding (see 2.1.10) caused additional probleras in analysis of sanples, 2.2.6 Reactor Building hydrogen concentration control In the early course of the accident (~first 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />) hydrogen was being generated and transported into the Reactor Building, causing an increase in the concentration sufficient to cause at least a localized burning at about 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />.
No method apparently existed which could have been rapidly actuated and used to control this hydrogen concentration buildup.
2.2.7 Interactions between ECCS control systems and fire, control system Throughout the accident, problems in maintaining the opera-tion of the makeup punps were experienced.
Apparently this problem was in some part due to high tenperatures in the areas where the makeup punp circuit breakers were located, which caused the breakers to trip. The high temperatures in these areas, were apparently conpounded by the tripping of cooling fans by the fire control system.
This system seems to have been actuated by heat sensors in the area.
8 2.2.8 Integrated Control System The Integrated Control System (ICS) controls much of the initial plant response to a transient such as was the initiating event in this accident. As such, the ICS nay have contributed to the initial variations in plant parameters.
2.3 (Possible) Instrumentation Deficiencies 2.3.1 Instrumentation Ranges Various important instruments in the control room had ranges of indication which were quickly exceeded, so that inadequate or misleading information was presented to the operator. RCS hot leg temperature sensors, core exit thermocouples, and many radiation monitors experienced this problem.
2.3.2 Instrumentation environmental qualification Sone instnamentation which was significant in controlling and understanding this accident experienced environmental conditions beyond their design basis.
Pressurizer level sensors were sporadically failing throughout the accident; apparently some Reactor Building radiation monitors also failed.
2.3.3 Accuracy of pressurizer level instrumentation Because of the nature of the TMI-2 accident, the pressurizer level did not accurately represent the water levels in the RCS. The indications of high pressurizer level apparently misled the operators into believing the the RCS was full of water throughout the accident; thus, actions to refill and cool the core were not believed to have been needed.
2.3.4 Conputer storage and printout capabilities The alarm conputer printout located in the control room began experiencing significant backups early in the accident, and was actually out of service for some tine period.
No permanent storage in the conputer occurs, so that when the printer is out of service, information is lost conpletely.
As a result of these problems, the computer apparently was of little value to the operators.
i l
a 9
1 2.3.5 PORV status instrumentation In the TMI-2 control room, the position of the PORY is j
indicated by a light.
Since this light actually indicates that the electric power to the valve has been removed, it does not indicate the physical position of the valve.
Thus the operators were led to believe by the PORY indicator that the valve had reclosed when in fact it remained open, j
causing the loss of RCS coolant.
l 2.3.6 No reactor vessel water level indication In all PWRs, water level in the RCS is measured in the pressurizer.
Thus in an accident such as that at TMI-2, when phenomena such as that discussed in 2.3.3 occur, j
an accurate measure of water level in the vessel and core 1
is not available.
2.3.7 No remote visual observation equipment No remote visual equipment such as television cameras are installed in the Reactor Building of any PWR; so no visual indication of the status of euipment, etc. was available to the operators in the TMI-2 control room.
i l
l r ---~.
m