ML19318A479
| ML19318A479 | |
| Person / Time | |
|---|---|
| Site: | Davis Besse  |
| Issue date: | 06/05/1980 |
| From: | Crouse R TOLEDO EDISON CO. |
| To: | James Keppler NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III) |
| References | |
| IEB-80-12, TAC-48832, NUDOCS 8006230201 | |
| Download: ML19318A479 (8) | |
Text
.
.o 3
e-
, f,-
Tds%d TOLEDO w EDISON June 5, 1980 Rcsana P. CROUSE Vce Presdent Nuclear (4191259-5221 Docket No. 50-346' License No. NPF-3 Serial No. 1-136 Mr. James G. Keppler Regional Director, Region III Office of Inspection and Enforcement U. S. Nuclear Regulatory Commission 799 Roosevelt Road Glen Ellyn, Illinois 60137
Dear Mr. Keppler:
Attached is Toledo Edison's required 30 day response to IE Bulletin 80-12 dated May 9, 1980, as applicable to Davis-Besse Nuclear Power Station Unit 1.
Yours very truly, g7 RPC/SNB/1j k i
Attachment i
cc: Director, Division of Reactor Operations Inspection United States Nuclear Regulatory Commission Office of Inspection and Enforcement Washington,.D. C.
20555
- st4
- THE TOLEOO EOISON COMPANY
' E0ISON PLAZA 300 MAOISON AVENUE TOLEOO OHIO 43G52 somsso W g
~
DOCKET NO. 50-346 SERIAL NO.
1-136 PAGE 1 ITEM 1:
Review the circumstances and sequence of events at Davis-Besse as described in Enclosure 1.
RESPONSE: was reviewed and one error was discovered. The decay heat pump suction was not isolated by a containment isolation actuation as stated in Page 2.
The decay heat line was isolated by the loss of 120 VAC power to the pressure switch relay which isolates the decay heat isolation valve DH-12.
Also the decay heat cooldown line was isolated by the clccurr of DH-1518 from the interlock with the Safety Features Actuation System (SEAS) actuated suction valve DH-2734.
Toledo Edison also does not agree with the statement in Enclosure 1 that the two out of four SFAS logic was a major contributor to the event. The two out of four logic is more reliable and provides better testability than the one out of two taken twice logic.
A two out of four logic is functionally failed if three or all four in-put channels cannot trip properly.
A one out of two taken twich logic is functionally failed if two or more input channels (in certain com-bination) cannot trip properly.
Since the former requires one more channel to fail, it is more reliabic from the safety standpoint.
The two out of four system provides better testability than the one out of two taken twice system. Per the Davis-Besse Unit 1 Technical Specifications, if one channel of a two out of four system fails, it will be placed in a tripped condition.
However, one additional channel can be bypassed for testing or maintenance.
In a one out of two taken twice system, if one channel fails, operation may proce'ed until perfor-mance of the next required channel functional test, provided the channel
'is put in tripped condition.
N_o additional channel can be bypassed for o
testing without experiencing a half or full trip of the system.
ITEM 2:
Review your facility (ics) for all DHR degradation events experienced, especially for events similar to the Davis-Besse incident.
RESPONSE
The April 19, 1980 event was the only occurrence at Davis-Besse Unit 1 of an extended loss of DHR capability. The following is a list of previous occurrences of minor interruptions of decay heat flow at Davis-Besse Unit 1.
- _.,m_
DOCKET No. 50-346 SERIAL NO. 1-136 PAGE 2 DATE LER NUMBER
SUMMARY
5/27/77 NP-32-77-02 While tightening a loose connection in a junction box, a momentary short caused DH-11 to close. The decay heat pump was shutdown for twelve minutes.
5/28/77 NP-32-77-03 While performing an SEAS surveillance test, DH-11 stroked closed due to a test proce-dure error. The decay heat pump was shut-down for three minutes.
6/12/77 NP-32-77-05 While performing an SFAS surveillance test, the procedure modification was not followed and DH-11 stroked. closed. The decay heat pump was shutdown for three minutes.
7/12/77 NP-32-77-09 While inspecting an SEAS output signal lead, the I6C mechanic discovered a loose connec-tion. While tightening the lead, he caused several closures of DH-11.
Decay heat flow was interrupted for one minute the first time and sixteen minutes the second time.
9/7/77 NP-33-77-74 Due to a design problem in the interlock circuit, DH-12 closed hen transferred to its alternate power supply. The operator started the redundant pump in a low pres-sure injection mode. Decay heat flow was less than 2800 gpm for only a few seconds.
DH-12 was reopened and normal decay heat lineup restored.
5/28/78 NP-33-78-72 An inadvertent bumping of a control switch caused a shutdown of the decay heat pump.
The pump was restarted within two minutes.
6/15/78 NP-33-78-81 Improper electrical switching caused several interruptions of decay heat flow.
Total time the flow was below the minimum required was less than two minutes.
4/18/80 NP-32-80-05 The decay heat pump was intentionally shut-down until the source of Icakage in the system was determined. The pump was shut-down for 29 minutes duri.ig which RCS tanpera-ture reached a maximum of 103 F
' DOCKET No. 50-346 SERIAL NO. 1-136 PAGE 3 DATE LER NUMBER
SUMMARY
5/28/80 NP-33-80-53 After completion of a field change to SFAS Channel 4, the operational test cau' sed DH-ll to close. The decay heat pump was shutdown for approximately two minutes.
5/31/80 NP-33-80-54 A surveillance test being performed by 16C personnel caused a loss of decay heat flow indication. The decay heat pump was shutdown for approximately eight minutes untti the testing was determined to have caused the loss in indication.
As evidenced by the above list, most of these occurrences were caused by an inadvertent closure of the decay heat isolation valves DH-11 or DH-12.
Davis-Besse Unit 1 was initially designed to operate with the power removed from DH-11 and DH-12 while on decay heat to prevent these inadvertent closures.
However, License Condition 2.c. (3). (j) requires the power remain on these valves while on decay heat, and that only one decay heat pump be operated at a time. This condition should be resolved shortly after the first refueling outage and power will be removed from these valves on future refueling outages. An expeditious NRC approval of the technical specification change requested (submitted March 20, 1978) will help enhance the reliability of the decay heat re-moval system by allowing the system to be operated as designed.
ITEM 3:
Revies the hardware capability of your facility (ies) to prevent DHR loss events, including equipment redundancy, diversity, power source reliability, instrumentation and control reliability, and overall reliability during the refueling and cold shutdown modes of operation.
RESPONSE
Davis-Besse is designed with complete redundancy in the dual purpose decay heat / low pressure injection pumps.
The pumps are physicay located in separate rooms, with separate power supplies poweres independent essential busses and diesel generators.
Separate esse.
tial power supplies feed all the redundant active components.
All auxiliary support systems are redundant and independent to ensure a single failure (except for the inadvertent closure of DH11 or DH12 in Modes 4, 5, or 6) cannot render both trains inoperabic.
- However, power will be removed from these valves as discussed in Item 2 to pre-clude this condition. When the unit is in Modes 1 through 3, both por-tions of these redundant systems are required by technical specifications to be operable.
DOCKET-No. 50-346 SERIAL NO. 1-136 PAGE 4 7
When the unit is shutdown, portions of these systems must be made in-operable to allow corre.ctive and preventative maintenance on these components.
Davis-Besse Unit 1 maintains as a minimum the require-ments of the Technical Specifications during shutdown conditions.
These technical specifications require:
T.S. NUMBER REQUIREMENT 3.9.8 At least one DHR pump in operation 3.1.1.2 Reactor Coolant System (RCS) flow greater than 2800 GPM when boron change in progress 3.1.2.1, 3.1.2.5, 3.1.2.6 Operable boron injection flowpath 3.1.28 operable borated water source 3.3.2.1 Operable SFAS - containment radiation 3.8.1.2, 3.8.2.2, 3.8.2.4 Minimum operable electrical power sources Therefore, even though the. unit is designed with independent and re-dundant components, the maintenance required to ensure the reliabi-lity of-'the systems requires at times that redundancy be reduced when the unit is shutdown.
Even though the redundancy is not maintained to. totally exclude the possibility of a loss of the DHR system, suffi-cient diverse methods are available to maintain adequate core cooling.
See the response to Item 6 for further details.
i ITEM 4:
- Analyze your procedures for adequacy of safeguarding against loss of redundancy and diversity of DHR capability.
RESPONSE
The response to this item is contained in Item 6 response.
ITEM 5:
Analyze your procedures for adequacy of responding to DHR loss events.
Special emphasis.should be placed upon responses when maintenance or refueling activities degrade the DHR capability.
1
-1
+
^
DOCKET No. 50-346 SERIAL NO. 1-136 PAGE 5 r
RESPONSE
The " Loss of DHR Emergency Procedure", EP 1202.32, was revised in Febru-ary, 1980, to' include the total loss of decay heat transients identified in the B&W " Inadequate Core Cooling DHR System Mode of Operation" Speci-fication 69-1106921-00. This includes a description of all possible RCS conditions at which a loss of DHR may occur. The two cases added to the procedure and the RCS conditions possible are:
CASF_l: Loss of core cooling during DHR via DER system.
Part.I.
RCS pressure boundary intact, filled or drained Part II RCS pressure boundary not intact, reactor vessel head detensioned Part III Reactor vessel head removed, fuel transfer canal filled or empty CASE 2: Loss of RCS inventory during heat removal via DHR system.
Part I RCS boundary intact or reactor vessel head deten-sioned Part II Reactor vessel head removed The procedure was modified to include required operator response times'for the reactor water 1cvel established and to include alter-native flowpaths to supply water to the core if both decay heat pumps are inoperable.
Possible causes for the loss of DHR such as a loss of power, loss of net positive suction head, valve operator failure, or inadvertent closure, and a system rupture are identified and correc-tive action discussed. -The procedure is written to emphasize keeping the core covered at all times to assure adequate core cooling.
The procedure as is now written adequately delineates the loss of DHR transients and corrective actions required.
As a result of the April 19, 1980 occurrence, procedure modifications were completed to give additional guidance on venting the decay heat system if air is drawn into the piping, and a reference added to a manual method of obtaining incore temperatures if the computer is un-available.
Five pr'ocedures were modified to assure the power is re-moved from DH9A and DH9B when the unit is in Modes 5 or 6.
Also a modification was made to the Instrument AC System Procedure SP 1107.09 to allow the inverters to 'e supplied from the DC Bus when the normal fe:J for the regulated rectifiers from motor control centers E12A or F12A are to be de-energized.
DOCKET No. 50-346 SERIAL NO. 1-136 PAGE 6 ITEM 6:
Until further notice, or until Technical Specifications are revised to resolve the issues of this Bulletin, you should:
a.
Implement as soon as practical administrative controls to assure that redundant or diverse DHR methods are available during all modes of plant operation.
(Note: When in a refueling mode with water in.the refueling cavity and the head removed, an acceptable means could include one DHR train and a readily accessible source of borated water to replenish any loss of inventory that might occur subsequent to the Icss of the available DHR train.)
b.
Implement administrative controls as soon as practical, for those cases where single failures or other actions can result in only one DHR train being available, requiring an alternate means of DHR or expediting the restoration of the lost train or method.
RESPONSE
Administrative controls already exist to ensure redundant low pressure injection / decay heat systems while the unit is in Modes 1 through 3 per Technical Specification 3.5.2.
Technical Specifications require at least one low pressure injection / decay heat string be operable at all times while the unit is in Modes 4, 5, or 6 and the station administra-tive procedures reficct this requirement. The redundancy in decay heat /
low pressure injection systems is not required due to the diverse means availabic to maintain adequate core cooling while the unit is in Modes 4, 5, or 6.
Adequate diverse methods already exist at Davis-Besse Unit 1 to ensure a means is established to keep the core covered prior to reaching inade-quate core cooling conditions.
If the RCS pressure boundary is intact and the dacay heat system becomes
-inoperable, the RCS can be refilled if drained and either or both steam generators used for long term decay heat removal per EP 1202.32, " Loss of Decay Heat Removal Emergency Procedure".
Either natural circulation or a reactor coolant pump can provide adequate RCS flow.
If the RCS pressure boundary is not intact, water can be injected into the RCS to ensure the core remains covered. The loss of the decay heat system while in Modes 4, 5, or 6 is not an occurrence which re-quires an immediate. equipment or operator response and therefore admin-istrative controls should not require complete and immediate redundancy.
The B&W analyses supporting inadequate core cooling guidelines of Decem-ber,1979 (69-1106921-00 and 86-1105508-1) specify even for the worst case conditions (the RCS level is at the reactor vessel flange, and the unit has -been shutdown for~ only 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />) it would be at least 2-1/4 hours af ter the loss of all decay flow before inadequate core cooling would exist.
This is more than adequate time to start the decay heat pump or to es-tablish an injection floupath, m
DOCKET No.'50-346
~ SERIAL. NO. 1-136 PAGE 7 Numerous diverse methods exist at Davis-Besse to inject water into the RCS. The high pressure injection pumps, nakeup pumps or borated, water recirculation pump can be aligned to inject water into the RCS if both decay heat / low pressure injection pumps are inoperable. The borated water storage tank is located at a higher elevation than the reactor core. This allows a gravity feed (as per EP 1202.32) of makeup water even if no pumps are availabic. The flovpath can be into the decay heat injection lines, reverse flow through the decay heat cooldown line, through either high pressure injection pump, or through either makeup pump.
Even during the complicated loss of power event at Davis-Besse on April 19, 1980, the operators were carefully monitoring RCS level and were prepared to gravity feed the RCS from the borated water storage tank if the RCS level dropped.
If the refueling canal is full, the borated water storage tank may not be available for gravity flow but the over 300,000 gallons of water in the canal will maintain adequate core cooling. No diverse methods are required to fill the RCS since the water is already available to cool the core.
Even though Toledo Edison believes adequate diverse decay heat removal methods exist at Davis-Besse, additional administrative controls will be issued to establish methods to ensure adequate core cooling. A special order will be issued to require whenever possible the redundant decay heat system not be intentionally removed from service in Modes 4, 5, or 6 unless:
- 1) At least one steam generator is available for decay heat removal
/or/
- 2) The refueling canal is filled to a minimum of elevation 588'0" (approximately 200,000 gallons total volume)
/or/
- 3) The decay heat pump can be restored to service or a gravity flowpath to the RCS can be established within four hours.
The special order will also request expediting the restoring of redundant
- or diverse methods if a component failure causes an inadvertent loss of alternative methods.
j i