ML19320C404

Forwards Zr Rosztoczy Paper, Thermal Hydraulics:Changes in Methods in Light of Tmi

ML19320C404
Person / Time
Issue date:	06/30/1980
From:	Larkins R, Oliu W NRC OFFICE OF ADMINISTRATION (ADM)
To:	Rich Smith NRC OFFICE OF ADMINISTRATION (ADM)
References
NUDOCS 8007160773
Download: ML19320C404 (7)

Text

.

m 4

/ **' ' ' ' ',

UNITED STATES g

jQf ')

NUCLEAR REGULATORY COMMISSION j

WASHING TON. D. C. 70555 h

SOf O Memo For:

Rich Smith, DSB From:

P. Larkins, TIDC W. Oliii, TIDC 1

Subject:

Transmittal of Speeches t

i Attached are (ttyo) copies of a speech to be

~ ~ ~

sent to the PDR and TER 7 We have filed the'426 Form.

j

=

11.

1 i

r THIS DOCUMENT CONTAINS POOR QUAL.lTY PAGES y,

8cp$7.Llo$7$3

.. c. v,.

864 THERMAt HYDRAUUCS THERMAL HYDRAUI.lCS: CH ANGES IN METHODS IN LIGHT OF TMI Sponsored by Therrnal-Hydraulics Technical Group All Papers invited

1. The Frequency and Consequences of Small PWRs designed by Westinghouse, CE, and B&W are expected to experience 2, I, and 0 2 vahe openings per scactor year, Loss-of Coolant Accidents, Zoltan R. Ros:toczy Nspedely. De n!adsely I w number ass ciated with the (NRC)

B&W design results from the design changes initiated after Small breaks in the coolant systems of nuclear reactors the T511-2 accident (changes in relief valve and reactor tnp have not, until recently, been subjected to detailed analytical setpoints; anticipatory trips on loss of feedwater and on study comparable to the attention desoted to large breaks.

turbine trip), and is supported by the operating experience Typically, small breaks base been analyzed down to the accumulated since the change. The obser ed failure rate per smallest break size that would produce system depressuriza-challenge' varies between A and 4. Consequently, a stuck-tion without core uncovery. Although the analyses, in open relief valve is the most probable cause of a smallloss-of-general, predicted eceptable fuel cladding temperatures, coolant accident. The probability of this event is at least an they considered only single active failures, and did not order of magnitude higher than the probability of a small preside sufficient information for operator training and for pipe break (10-8 per reactor year) for Westiaghouse and CE the preparation of plant emergency procedures. Furthermore, plants and two orders of magnitude higher than a small pipe only the consequences of smallloss-of-coolant accidents were break for GE plants.

evaluated;little attention was paid to their frequency.

The consequences of a small break depend on break size.

Following the accident at Three Stile Island (Tall) the A typical stuck-open PWR re!!ef valve is equivalent to a emphasis on small breaks increased greatly. Licensees of 1.4-in.' break. With a sing!c failure assumption, this break size does not result in reactor core uncovery. BWRs have operating power plants were requested to provide informa-significantly larger vahes, which are ~14 in.2 This break size tion on both the frer 'ncy and consequences of small breaks. Suppliers of nuclear reactors were required to proside with a single failure partially uncovers the reactor core. Other additional guidance to the operators of the plants through design features such as a tight upper-head design, as used by the issuance of operating guidelines. The licensees had to Westinghouse, can reduce the water levelin or above the core initiate plant modiGcations, retrain the operators, and because of sfow upper-head drainage.

modify the emergency procedures based on the newinforma-The evaluat. ion also showed that protect. ion in the case of

- tion. The purpose of the effort was to substantia!!y reduce small breaks often requires prompt operator action Design the likelihood for accidents of the type that occurred at T511.

changes were required to automate some of the operator The new evaluation of small breaks produced one major actions; for example, tripping of the reactor coolant pumps.

surprise and focused attention on a number of shortcomings.

The infermation obtained from the small-break evaluation Throughout the years, applicants and licensees have main-was ala used to improve operator training and to upgrade

' tained that the worst break size was a large break with a plant emergency procedures. Special attention was given to relatively low probability of occurrence. The new analysis requirements permitting termination of high-pressure safety revealed that, without any restriction on the operation of injection.

the reactor coolant pumps, the small breaks are limiting and the calculated cladding temperatures are well in excess of The uncertainty of the calculations has not yet been the 2200*F limit specified by the ECCS Acceptance Criteria, evaluated. It could be rather large; for example, equiulent to immediate action was taken to climinate this possibility by a 4. or 5-ft level difference in the core. Should this be the requiring prompt tripping of the reactor coolant pumps in case, a predicted 5-ft uncovery could actually be a 10 ft case of a loss-of-coolant accident. While tripping of the.

uncosery. As we learned from TS11, deep uncoscries for extended time intervals are unacceptable.

pumps is not an ideal solution, it solved the immediate problem. A better, more permanent solution should be in addition to the sing!c failure assumption, two degraded forthcom, g from the mdustry.

conditions were also evaluated: loss of auxiliary feedwater m

The frequency of relief valve challenges was evaluated (RCIC in the case of BWRs) for an extended period of time, based on operating experience and also based on auilable and loss of natural circulation for an extended period of plant safety evaluations. In all but one case, there was good

. time. PWRs with a high cutoff head, high. pressure injection agreement between the two evaluations. The results show ' system (IIP!) were shown to have sufGeient time (at least 20 t that BWRs designed by GE are expected to experience or 30 min) to initiate emergency core cooling and were pro-approximately 15 valve openings per reactor year, and that

ccted for these cases. BWRs needed operator action within a

• MdW*

rw'

. * * ^

• e."

Wwe.w s

y

.1 p

Thermal Hydraulics: Changes in Methods in Light of TMI 8G5 few minutes to prevent core uncovery. The time avaMle tile core gets uncoscred, (b) dq:radation in core geometry, was found to be insufficient and a design chante to auto-when t, lockages occur, (c) the system heat transport; matic initiation of the automatic depressurintion s> stem e.g., when the flow from the core to steam generators is (ADS) was required. PWRs with low cutoff head liPI are reduced, (d) system coolant inventory; e.g., in swell break possible unprotected for these events. Present emergency LOCA, and (c) the heat sink e g., when the secondary side procedures require opening of relief sahes and initiation of steam generators becomes empty.

of IIPl. It is not known whether the system would suffi-ciently depressurize to pennit ilPI flow.

The thermal-hydraulic phenomena of interest include (a) mass flow-through relief vahes. pipe cracks, valve seals, In summary, the n. k associated w.th small breaks was s

i etc., (b) phase separation and mosement of a two-phase found to be larger than presiously reported. This was mainly level, (c) fuel cladding dryout and DNB,(d) rost DNB heat the result of high relief sabe challenge and failure rates, and transfer, (c) sapor reneration rate. (f) steam coolinf, (g) liq-a faster than expected ma<s depletion caused by the running uid entrinment in vapor, (h) quenchinp, (i) condensation reactor coolant pumps. New requirements on tripping the heat tiai.sfer and condensation induced pressure changes, pumps sched the latter probl:m. Corrective measures taken (j) hs drogen generation, (k) heat transhr reduction due to en BiW plants produced a significant reduction m the the ' presence of noncondensible gases, (1) reflux beiling, frequency of small loss-of coolant accidents. GE, Westing-(m) heat transfer in degraded core geometry, (n) natural.

house, and CE plants should take appropriate steps t consection flows in the heat transpert system with and improve their respectae designs. Furthermore, PWRs with without pres:nce of noncondensiMes, (o) mass transfer low liPI cutoff head are possibly not protected for the characteristics of the noncondensiMes, (p) steam generato extended loss of auxiliary feedwater or natural circulation.

secondary side flow distribution, twophase lesel, boitout, Appropriate design changes should be considered. Tinally, (q) heat rejection in suppression pools,(r) heat rejection in the current state-of the-art of small lossyf-coolant accident containment through sprays, (s) containment pressures, evaluation is unsatisfactory. Uncertainties are large, and (t) ultimate and long-term heat rejection.

experimental esidence is rather limited. Natural-circulation tests (two phase) and integral small-break tests are needed t Andysis of the possible transient scenarios will require verify the analytical methods and results.

the understanding of the sarious thennal-hydraulic phenom-cna mentioned above. A start has been made at LPRI by conducting large-and small-scale experiments with analytical

2. Post-TMI Thermal Hydtculic Aspects of m deling." It was found that the primary and secondary heat removal capabilities are coupled through the two-phase LWR Safety Analysis, B. R. Sehgal, R. B.

lesels in the core and in the secondary side of the steam Duffey, W. B. Loewenstein (EPRD generator.' ne results of the analysis of the TMI accident *J showed that reasonably satisfactory post test predictions can The accident at Three Mile Isl.nd (TMI) has spawned be made; however, many assumptions had to be made and examinations of the practices and attitudes followed in LWR the computer running times were very large. We are presently safety and licensing by a number of bodies. Some of these in the process of initiating tests on fu!!-sca!c relief a'id safety have been published and are receiving attention at various salves to obtain mass discharge data.

lesels. In this paper we will concern ourselves only with the thermal-hydraulic aspects ofissues in LWR safety emphasized Reliable prediction of the actual reactor conditions since the D!! accident.

during such lone-term transients is the challenge we face. It will require the integration of the information obtained from Perhaps it is worth repeating that the pre-TMI LWR cxperimental and anal)tical studies into prediction codes.

safety evaNations were largely dom.inated by those con-It will require the development of stable, accurate, and fast-cerning the hypothetical large-break LOCA design basis nmning system analysis codes, which perhaps is the greatest accident. Thus the main R&D efforts were focused toward challenge, since the thermal hydraulic phenomena ofinierest understanding and predicting the thermal-hydraulic behasior involve both mechanical and thermal nonequilibrium be-during the various phases, of the large LOCA; i e., a scry tween phases. The recently descloped system analysis codes, rapid b' wdown, ECC mject, ion and bypass, lower plenum e E. RETRAN, T RAC, and RELAP-5, having models for such refill, and core reflood. The peak claddmg temperature and nonequilibria, generally require large computer times as well the cladding oxidation were the two main safety limits and as the scarce information for the interphase exchange the accident lasting ~3 min, m fact, is a minor one because processes during different parts of such transients. We at of the engineered safeguards. Regardless of what form an EPR! have started studies on efficient and stable numerical accident may take, heat must be transported from the fuel methods and models for the nonequilibrium processes, to an ultimate smk for extended periods. An analysis of the besides the experimental studies mentioned abose. The goal path that the heat must be transported through gives a good is to deselop the required code (s) and to qualify them with Indication of the effectiveness of the reactor and safety heat as much experimentd data as possible at different scales.

tramport systems during an accident.

The degree of reliability and integrity demanded of the

'. K.11. SUN, R. B. DUFFEY, and C. M. PENG, "A Thermal-various heat transport paths can be determined indepen-Ilydraulic Analysis of Core L'ncoscry," ASME-AIChE dently from an overall reactor risk analysis.

Natiunal !! eat Transfer Conference, Orlando, FL (1980).

A whole class of accident scenarim. previously considered

2. S. P. KALRA, R. B. DUFFEY, and G. ADAMS, " Loss of but not particularly emphasized in LWR safety esaluations, Fredwater Transients in PWR U-Tube Steam Generators,"

should be considered in light of the TMI accident. These ASME-AIChE National lleat Transfer Conference, Or-accidents may be broadly classed as degraded-heat-remosal lando, FL (1950).

accidents. The duration of such accidents may be on the order of hours or days and operator action plays a crucial

3. U. ZVERIN, P. R. JEUCK, C. W. SULLIVAN, R. B.

role throughout.

DUFFEY, and P. BAILEY, " Experimental and Analytical Studies of a PWR Natural Circulation Loop," ANS Topical The degradation in heat removal may occur due to Meeting on Thermal Reactor Safety, Knouille, TN decrease in (a) the core to-coolant heat transfer; e g., when (1980).

~-

4 -

591

, IMPACTS OF MI O'N REGULATORY REQUIREMENTS - I T

Sponsored by Power Division All Papers invited

1.. NRC Action Plans, Harold R. Denton (NRC) ever, the most significant impact on nuclear rower in this country is the chance in attitude.

.The accident at Three Stile Island has had unprecedented

~

immediate and long-range consequences. 51any organizations This change in attitude can best be exemplified by con-were assembled with the sole purpose of resiewing the acci.

trasting the current NRC-industry method of resohing prob-dent, the response of utility, industry, state, and federal lems with the method of the past. Until recently, the personne.", and identifying concerns of potential safety sig.

scenario went something like this The NRC identified a nificance that need to be resohed by modifying the plant or prob!cm and set a requirement; industry reacted in many procedures, or demonstrating by analysis that corrective ac.

cases by taking the position that nisting designs had suffi-tions are not required. Among the several special NRC groups cient margin or that NRC's requirements had little or no established were "The Bulletins and Orders Task Force,"

technical merit. After much argument tack and forth,indus-

"The Lessons. Learned Task Force," "Unresobed Issues try conceded and proposed a fix which met rninimum NRC Group," " Emergency Preparedness Task Force," and the requirements and which would be implemented at some "Special Inquiry Group." President Carter also vstablished a cornenient future refueling outage. NRC then applied the Commission under the chairmanship of John G. Kemeny.

" ratchet" and industry r.:luctantly impicmented the fit. In These groups developed recommendations that would contrast, in the post Three Stile Island cra. problems have directly or indirectly improve reactor safety and reduce the been identified by both industry and NRC; f.3cs hase been risk to the public. After the report of the President's Com-volunteered by industry as acil as required by NRC and, al-ndssion on Three !Llite Island was released, the NRC staff pre

• though there are still some throwbacks to the old way,in an pared an analysis of the recommendations and identified increasing number of situations industry has gone beyond ongoing staff efforts. We then developed, from the numerous NRC requirements both in intent and in spirit. We expect a recommendations of the various Task Forces, a plan which similar change in attitude from the regulators. The NRC was to integrate all the T511-related recommendations. The technical reviewers, in addition to NRC top management, resulting document, NUREC-0660. " Action Plan for Imple-must recognize that it is possible to provide a completely menting Recommendations of the President's Commission satisfactory response on the first try, and Other Studies of the Ull 2 Accident,"has four chapters.

There are certain aspects of the nuclear safety program Chapter I deals with plant operators, operator training, that can best be served by industry response as a whole.

and the use of operating experience. The second chapter in-Good examples of this are the fermation of the Institute of cludes reliability and risk assessment, and design improve-Nuclear Power tlNpO) and the Nuc! car Safety Analysis Cen-l ments. The third chapter deals with emergency plans and ter0 Mer d Gese msmusns was a resuh M ind

- improving the understanding among state, local government, p sed requirements, but were formed and financed by the and utilities. The last chapter deals with internal NRC reor-industry on its own uutiathet

. ganization and utilization of NRC staff.

Even more important are the attitude and initiatise of The draft action plan was first published in early Decem-each utility that operates a nuclear unit. I will devote the re-bst 1979. Since then it has undergone refinement, such as maining portion of my paper to items that,I believe reflect assuring recommendations in the Special Inquiry hase been TVA's current attitude and display our desire to be innova-considered. We will be incorporating these T511 related items tive m the everimportant area of nuclear plant safety, into the existing reactor review rrocedures. When this is ac-complished, the licensing basis for nuclear power reactors will Before the NRC issued its first post T511 requirements, have been improved and he oserall risk to the public re-the TVA Board of Directors established a task force to make duced.

recommendations relating to TVA's nuclear program in light

)

of the Three Stile Island incident,One of the most significant i

improvements recommended was the establishment of a

2.. Impact of TMI-A Change in Attitude, L. M.

N"c!'8'.Sarety Review Staff."This staff, which has been Mills (TVA).

functiomng for about a year, is completely inuependent of our operating, design, and construction disisions. Reporting This past year seems to have been the year of task forces directly to the General Slanager and Board of Directors, the and reports." We have become familiar uith Kemeny, Les.

staff serves as a mechanism for keeping the highest level of sons Learned, Bulletins and Orders, Action Plans, and Rogo.

management informed of nuclear safety matters.

vin. In addition, many involved in the nuclear Industry have performed self-evaluations m quest of a safer and more A separate nuclear operating dis sion has been established acceptable nuclear program.

in recognition that nuclear plants, st be operated under a

. different set of rules than fossil and hydro plants. In addi-We,in TVA, believe the future of the nuclear industry in

-tion, TVA has established a Nuclear Engineering Branch in this country is much more dependent on what we do, and the Disision of Engineering Design. Personnel with nuc! car require of ourselves, than on requirements put forth by any backgrounds have been placed in high lesel manacement po.

regulatory agency. We have seen many new NRC require-sitions in both the operating and design organizations.These ments related to physical plant. modifications, optrator organizational and personnel changes enhance the awareness training, additional plant personnel, and upgrading *of plant.

and ensure the consideration of nucicar safety throughout and off site management. All of these are important; how-the TVA organization. Last December, TVA volunteercJ to E

j

,,,4

^'

s.

718 ASSESSMENT OF Pl. ANT INSTRUMENTATION:

MEETING THE OPERATOR'S NEEDS

~ Cosponsored by Reactor Operations Division and Human Factors Technical Group

1. Nuclear Power Plant Saf my in the Man-ANSI Standard N-660 (Ref. 2) uses a salue of 10 min as t'he Machine Interface, R. M. Satterfield, L. Bel-minimum time for human thoughtful response. It should be noted that the 10 min response is a minimum time. Some tracchl(NRC),. invited oftnormal conditions may never be discovered by a particu-The automatic portion of a nuclear power plant safety lar observer, giving rise to a possible infinite response time.

system consists of the reactor trip system and the engineered Esen though one may question the uncertainty associated safety features. These sy stems act automatically in response with these data, they nonetheless suggest that humans are to off normal events to ensure their quick termination and to bandpass limited to relatively low frequency even for repeti-mitisse their effects.

tive fune!!ons and that their response time deteriorates rapid-n C

a n requ g te 8

The reactor operator is another important component of the plant safety system. The reactor operator is required to OPERATOR ASSISTANCE assess plant <afety by evaluating control panel displays and to take corrective action on detection of an approach to un.

From the previous observatiore it would seem to be safe operating conditions. lie also must assist in mitigating worthwhile to try to augment the operators capabilities in the effects of transients and accidents, should they occur.

areas where he is already performia near the tuit of his The capability of the operator to perform these actions ability. An area having potential for 'mproving operator per-effectively is a function of the operator's training, the ade.

formance that comes immediately to mind is the use of quacy of the control panel to depict the status of the plant, additional automation. Extensive automation can now be and the availability of operatur aids to assist in the detection, easily accomplished because of the availability ofinexpensive analysis, and correction of anomalous operations.

components for which software deselopment costs are res-ma

,c ex sewexes can n w e automated The NRC has recently developed requirements which

~

i carry the concept of

"'

• tempts t when implemented, should enhance the capability of the automat on to the' extreme,it soon becomes obvious that the cperator as a component of the plant's safety system.These success f such an effort requires that all possible accident include the use of human factors engineering to improve scenari s be accurately antiupated in advance. Thus, com-control room design, and improsements in control room af ma i n s en fr n t s me lack of a privrf m-e displays to facilitate the operator's c:pability to respond to f rmati n that has severely limited the effectisen ss of the upset conditions. Research is also under way to develop

'#3

" * " ' D I* * " '" 3 "# '"8 computer based operator aids such as disturbance analysis pr gress of accidents. Bas.ically, neither can wholly succeed systems.

without a precise unJerstanding of how an accident sequence is going to proceed before it happens.

[

Despite the inherent shortcomings of a totally automated 2.

Improving th9 Operator's Role in Future approach, a new look should be taken to see where its use Control Room Designs, D. G. Cain, A. B. Long, might be emrloyed to advantage in particular applications.

L. C. Oakes (EPRD, invited For example, more automation of predetermined sequences and procedures and m fast trans,ients can be a good first step Present<!ay nuclear reactors rely heavily on human oper-toward freeing the operator from manual operation in pre-ators for both startup and steady-state operation In addition, paring him for a more sophisticated role.

operators are responsible for bringing the reactor to a safe shutdown condition following system transients when such REAL-TlalE SYSTEllS ANALYSIS transients are outside the capability of the automatic control The foregoing discussion suggests there is a fundamental devices.

problem that must be solved if signifkant improvement is to Data have been collected over the past few years which be exercted in the man-machine interface. Namely, we must suggest that limitations on human response capabilities have desclop a system capable of providing the operator with not been properly considered as a possible constraint on sys.

high<1uality information during upset conditions that may tem performance, especially during unusual occurrences or never have been previously anticipated and analyzed. The large off normal excursions from plant steady-state condi-system must have predictive capability toaid the operatorin tions.

his decision-making process so he will know in advance of OPERATOR LI3tlTATIONS'/

taking corrective action which of the sescral options available to him will produce success.

Studies have been made which atteir.pt to quantify hu.

The approach outlined here is actually a variation on man response time and reliability. Tullwood and Gilbert 8 timited form of automation, it would provide for an auto-report that the optimum data transmission rate for human mated or semiautomated means of analyzing and integrating comprehension is approximately I bit /s, af which point the plant data. This is presently done " manually" in the oper-minimum error rate of 5.5 X 10'8 is achieved. At a rate of ator's head, handicapped by the operator's rather modest i ~45 bits /s the probaSility of error reaches D.The proposed information bandpass capability.

JW

. _ _ _ ML T ' " m"~~m

.~

w-

-w v

Lessons fearn,ed from TMl in Reactor Instrumentation and Diagnostics 791 TABLEI

~ associated with T51I 2 cients. Two of these are: faster nna n nt hag in h Variables Recorded at Tirne of TMI-2 Accident form, and recording a greater number of parameters. A recent tabulation of desired parameters for the RECALL system

. 1.

Nuclear Instrurantation Power Range, now.availabic from B&W identified 125 of these. The Channel 5.

extension of permanent memory storage capability and transmission techniques should add greatly to the use of such 2.

Reactor Coolant Loop A, T T and Flow 4 ' '* **

h The expanded reactimeter(RECALL system) willinclude 3.

Reactor Coolant Loop B. T, T and Flow a highly reliable recording device designed to be in operation h

at all times to provide endless loop " flight recorder style" 4

Pressurizer Level recording of the data. The objective here is to ensure transient recording as opposed to relying on a fortuitous 5.

Makeup Tank Level stroke of luck, such as having the reaetimeter connected and operating as it was at T511-2. The paper will describe

6.. Pressurizer Spray Valve Posi'.fon other features of the expanded reactimeter data recording device.

7.

RC Drain Tank Pressure 8.

Reactor Coolan't System narrow range pressure (1600-2500 psig) 3.

Lessons Learned from TMI In Reactor In-strumentation: An NRC Viewpoint, John C.

9.

Reactor trip contacts Voglewede (NRC) 10.

Turbine header pressure During the T5112 accident, a condition of inadequate core cooling existed and was not recognized for many hours.

11.

Feedwater tecperature This resulted from a combination of factors including insufficient indicatics range for existin Instrumentation, 12.

OTSG A startup and cperate levels unfavorable location of instrument readout, and perhaps insufficient instrumentation. The Nuclear Regulatory Com-

13. OTSC B 'startup and operate levels mission staff has anal > red each of these perceived defi-ciencies and has made a number of new regulatory

14. ' Loop A and 3 feedwater flows rquirements and technicai recommendations.

The regulatory viewpoint of the lessons teamed from the

15.. OTSC A & B steam pressure

,n-reactor instrumentation at T511-2 is umilar to that of the

wner, nactor vendor, and N nuclear %ustry as a i

16. Turbine trip contacts whole. That is, the in-reactor instrumentation played a

[

prominent role during the first few hours of the accident as well as the period of time leading to cold shutdown of the plant. Because of this, the NRC Lessons Learned Task Force um concluded that the as-d< iigned and field-modified instru-ments at T5t!.2 provided afficient information to indieste reduced reactor coolant leve, core voiding, and deteriorated l

3 om core therma! conditions.

IM Three Stile Island was one of the best instrumented h""

reactors in operation because of the large number of in< ore b'

thermocouples and other features. Unfortunately, these ga j,

positise features did not result in the prompt recognition of, and the rapid recosery from, a condition ofinadequate core i.

cooling..

8 '"

~

In response to this and other findings from the Three E'

Sli!c Island accident, the NRC staff initiated a number of 2m short-term requirements, based on "T5!!-2 Lessons Learned Task Force Status Report and Short Term Recommenda-o g

r i '

i e

i i

tions" (NUREG-0578). The status of the industry response concerning in-reactor instmmentation is summarized in this

' 45.s 46.2 46.s 4r.4 43.o es.o 4s.s 4s.. o.s s.t o" presentation, and the 5fetropolitan Edison Restart Submittal on Three 5 file Island Unit I is used as an example of the Fig. 2.

industry response.

continuous information about transientsind was not depen-E'"*"I

-dent on the. standard plant computer. As a result, a "8

Reactimeterc system has been part of the startup of every

1. * "" 8 ** *" # " ' ****"'"*

B&W plant and some version of data acquitition used during operation. A typical Reactirneter" cross plot is shown in etmp an n musum celant ternperatm, b, and pressure as well as neutron flux and motor current of the Fig. 2.

' coolant pumps. The staff supports such diversity. However, in retrospect.1 several improvements and extension of - ' these instruments existed at TS112 at the time of the acci-e the Reactimeter would have reduced remaining ambiguities dent. New instruments, such as the PWR vessel coolant level

}

e-

_.C'Np g.

-.34 kg,

g #

sg.,

p e"p em ( jq g_

,g,'

~

w 792 Lessons Learned frcm TMI in Reactor Instrumentation and Dignostics detector, have al>o been regt. ired and long-term improve.

Uncertainties in the readings from (and the condition of)in-ments in other areas are being actisely pursued by the staff, core, self-powered neutron detectors and thctmocouples, The results of these efforts, however, hne not yet been differential-pressure gauges used to measure coolant level in the pressurizer, primary-leg resicance thermometers, and implemented.

5 * **"' " I With regard to existing instrumentation, the staff has reac r rn an a en cn n to a sak dmtdown. In noted that man *; instruments at T5112 lacked sufficient range some cases, the instrument readings could not be verified ofy. dicat. ion. A notabic cumple was the range of the core because provision for the use of in situ calibration venfica-n eut thermocouples. As a result, Metropolitan l'Jnon has tion had not been made in the installation and cabling of the extended the maicating range of these thennocouples as well unse as the indicating range of the reactor out!ct resistance temperature detectors (RTDs) in the Unit I facility. This in response to the alarming and costly T511-2 accident, was done without replacing the sensors. Access to the in core many organizations began to restudy and reevaluate many thennocouple signa s from outside the containment building factors to which the seserity of the cecident may be f

has also been prosided. This feature did not exist on Unit I related: containtnent, plant equipment, instruments, pro-at the time of the Unit 2 accident. The irdicating range of cedures, operator tr.ining, plant supervision and regulation, these instruments now encompasses the phyeical limit.tions control room layout, and man-machine interaction. Some of the sensor rather than the expected response of the device pro; rams acknowledge the need demonstrated in the post-during normal operation. The change from expected to accident recoscry work at TMI 2 for improsed instrumenta-extended instrument range reficcts the staff position in the tiort and the va!ue of diagnostic and surveillance methods, proposed revision to Regulatory Guide 1.97, "Instrumenta-We submit our v.iew that the development and qualifica-tion for Light Water Couled Nuclear Power Plants to Access tion of improsed mstrumentatmn are of paramount impor-Plant Conditions During and Folicwing an Accident,"hsued tance,m resp ase to TMI-2, and are prerequisites to rnecting December 4,1979*

several of the needs identified above. An operator cannot be All PWR owners are al o required to install a saturation expected to assess properly the seserity of an upset cendition meter in the control room to provide an indication of the or to respond effectively unless the critical plant parameters degree of subcoo"ng in the primary coolant. Ilowever, the are displayed accurately and in a comprehensib!c form.

use of in-core thermocouples, extended range reactor outlet I lually important, the value of a sophisticated information temperature RTDs, and the new saturation meter are en-display system can be no greater than permitted by the hancements of existing instruments. The staff presiously validity of its input information. Verified plant data are concluded that reduced coolant level and the existence of essential to effective man-machine interaction and therefore core soiding cculd be detennined with these instruments.

to ski!!ful plant operation. Verified data can be obtained, we Longer tenn improvements in the instrumentation will make believe, only by the application of a h'gher state-of the art this detennination c.aier, provided the cperator is aware of of instrumentation design philosophy; namely, (a) direct the availabic information and interprets it correctly.

measurement of some plant parameters that are now merely

• ** "I

' ' " " I d'**W **

An important lesson learned from TMI-2 on the subject

• I '#ns r signa verif cation, and (c) application of a of in-reactor instrument. tion is that the operator must be c mputmed model of the, plant process for displaying to made aware of the available information and must know how the operator, m real time, mformation about the status of to interpret it correctly. Marked improsement in an oper-d'"'

ator's ability to quickly recognite a condition of inadequate core coo!ing, and his ability to act on this information, will, To be more specific, we suggest six approaches that may in my judgment, lie more with improsement to the operator's be undertaken effectively for improving plant instrumenta-training and instruction than with improvement of the tion by retrofit or for new designs.

instrumentation, floweser, both approaches have been re-

1. Design instruments for direct rr easurement of plant quired by the NRC to ensure that conditions of inadequate parameters that are now inferred from other measurements; a

core cooling do not go undetected in the future.

for example, i+ core liquid-lesel detecto s and relief-valve flow indicators.

4.PWR instrumentation: Recommendations

2. Develop instruments for diverse meamrement of criti-for Improvement from TMI2 Experience, cal, safety rt!ated riant parameters where redundant sensors R. L. Shepard, /, L. Andmon (ORNL) susceptible to common; mode failure are now employed, such as resistive or ultrasome level detectors for the pressurizer Instruments in the Three Mile Island plant, Unit 2 or a combined thennocouple-resistance thermometer for (TMI-2), were inadequate to unequisocally indicate critical ternperature measurement of the primary coolant.

plant parameters to the plant operators during the accident

3. Develop multifunctional instruments that could mea-in March 1979. As a result, the operators were uncertain about the level of coolant in the reactor vessel, the total sure more than one process condition, such as a resistance thermometer that would also serve as a level detector for the inventory of coolant in the system, whether there was boiling in the core, the solume and composition of the gas phase presanzer.

abose the core, and whether coolant was flowing in feed-

4. improve instrument sensors, cables, connectors, and water and relief Imes during the onset of the accident as..cIl transmitters so they would operate reliably under environ-as during the attempts to regairi control and stabthre the mental conditions of high moisture, temperature, and radia-plant during the postaccident penod. The instruments had tion esposure. Reconsider the location of criticalir.struments been jadged adequate to license the TMI-2 plant and to in the rea: tor containment.

operate it under nonnal ccnditions. Ilowever, dunng the accident, the information from these instruments was either

5. Dn elop, qualify, and apply methods for in stru erroneous or conflicting or both. The instrumcr.ts were not senfication of the continuity, isolation, calibration, and required to meet Regulatory Guide 1.97 (Ref.1) for post.

rnponse of plant instruments. Some serification methods accident monitoring, and, indeed, many failed later in the already dneloped for plant thermometers to meet require-

' accident sequence owing to effects of moisture or radiation.

ments of Regulatory Guid:s 1.118 (Ref. 2) and 1.105 m

.