ML19322D669
| ML19322D669 | |
| Person / Time | |
|---|---|
| Site: | Crane  |
| Issue date: | 11/01/1979 |
| From: | Michelson C Advisory Committee on Reactor Safeguards |
| To: | |
| Shared Package | |
| ML19322D668 | List: |
| References | |
| ACRS-CT-1191, NUDOCS 8002200136 | |
| Download: ML19322D669 (7) | |
Text
.
J ADEQUACY OF TMI-2 04ERGENCY PROCEDURES FOR THE CASE OF A LOSS OF REACTOR COOLANT AT THE TOP OF THE PRE 55URIZER C. Michelson November 1, 1979 The forward to NUREG-0600 claims that the accident at TMI-2 could have been prevented in spite of certain inadequacies.
It states, "The design of the plant, the equipment that was installed, the various accident and transient analyses, and the emergency procedures were adequate to have prevented the serious consequences of the accident, if they had been permitted to function or be carried out as planned."
NUREG-0600 is uadoubtedly a comprehensive investigative report of the accident and a credit to the meticulous efforts of many competent people.
d I have no specific comments or concern's relating to the scope or general content of the report at this time, but I am having some difficulty reconciling the above stated conclusion with my own observations which are, admittedly, based on a more limited viewing of the situation.
There is little doubt that the accident at TMI-2 could have been terminated without significant consequences by a timely closure of the NRV block valve through operator action.
However, the plant was designed to be forgiving and it was verified by analysis to be fully capable of It was handling this lack of action without unacceptable consequences.
an established design requirement to accommodate a postulated pipe break upstream of the PORY block valve or elsewhere at the top of the pressurizer or a failed open code safety valve. For such cases, termination of the resulting loss of reactor coolant by operator action would not be possible.
The equipment required to fulfill this requirement was operable during 8002206/3 4
~
(
the accident, but it is not clear to me that the e:3ergency procedures in effect were adequate to assure a proper operation for this specific loss-of-coolant situation and thus prevent serious consequences.
The only TMI-2 emergency procedure which appears to be directly applicable to the accident situation is 2202-1.5 (Pressurizer System Failure).
A portion of this procedure deals with a leaking or failed open PORV or code safety valve which,was the situation for over two hours. The symptons and automatic actions outlined in this procedure match closely those observed during the accident. However..some of the observed symptons and automatic actions are also indicative of those caused by a loss of reactor coolant, so the procedure to consider might be 2202-1.3 (Loss of Reactor Coolant /
Reactor Coolant System Pressure). This procedure deals with a small leak p'
is within the system capability, and a large leak or or rupture which rupture which leads to the automatic actuation of the engineered safety features.
Some of the symptons outlined in this procedure did not match those observed during the accident.
I am not sure which of these procedures the operator thought he was following during the first hours of the accident, so I examined both to determine their applicability and adequacy. My conclusions are based on the following observations which were derived from this examination.
Emergency Procedure 2202-1.5 (Pressurizer System Failure)
This emergency pmcedure contains a Part B which deals with a failed open PORV and a Part 0 which deals with a failed open code safety valve. The
[;
procedure indicates that both of these conditions lead to symptons of i
4*
3
(
s elevated valve discharge pipe temperature, elevated reactor coolant drain tank pressure and temperature, and the automatic actuation of high pressure injection. The procedure calls for manual closure of the PORY bl.ock valve if the PORY fails to close (B.2.B.2.a).
For a failed open code safety valve, the pmcedure instructs the operator to attempt to contml pressurizer' level using safety injection valve MV-V16B (0.2.B.2.c).
It also stipulates
~
to manually initiate additional safety injection if required to maintain pressurizer level (0.2.B.2.d).
As a follow-up action, the procedure specifies holding the pressurizer level, if possible, at or greater than 220 inches with safety injection (0.3.2.a).
During the TNI-2 accident, the failed open condition of the PORY was not directly apparent to the operator because the valve position indicating lignt showed the valve to be closed. The discharge pipe temperature was nigh on both the PORV and code safety valves. Since the individual valve cischarge pipes are joined together -it is u,sual to experience high temperature on all discharge pipes'if any one valve is open. The operator was pmbably aware of or anticipated that the loss of main feedwater transient would open the PORV and perhaps one or more code safety valves.
He could not tell that the code safety valves closed.
The subsequent elevated reactor coolant drain tank pressure and tem::erature, and the automatic actuation of high pressure injection were additional direct indications of a failed open PORV or code safety valve as opposed to a possible loss of reactor coolant due to a pipe leak or rupture.
Since the PORV positic.n light was indicating closed, it would be reasonable to conclude that all of these symptoms were due to a failed open code safety valve. For this case, the applicable procedure is 2202-1.5 which calls for pressurizer level contml.
.. ~.
4_
The actual operator response during the accident appeared to follow this procedure. Unfortunately, the procedure is unacceptable for a failed open code safety valve (or a failed open PORV with a defective position indication ). For this case, a rapid pressurizer refilling occurs and the level can appear to stabilize even though the core becomes uncovered.
The high level in the pressurizer obligates the operator to throttle back
~
on high pressure injection to control level as required by the procedure, and this leads to unacceptable consequences as found out during the TMI-2 accident.
Emergency Procedure 2202-1.5 does not explicitedly warn the operator with a symptom statement that pressurizer level will rise while the reactor coolant system pressure is falling.
However, this possibility should be apparent from the requirement to control pressurizer level at or greater than 220 inches by the addition of safety injection while the pressure is falling below 1600 psig. An increasing pressurizer level with decreasing reactor coolant system pressure should not confuse the operator if he believes the event to be a failed open PORY or code safety valve.
Emergency Procedure 2202-1.3 (Loss of Reactor Coolant / Reactor Coolant System Pre ssure )
This emergency pmcedure contains Part A which deals with a", " Leak or Rupttfre Within Capability of System Operation," and Part B which deals with a, " Leak or Rupture of Significant Size Such That Engineered Safety Features are Automatically Initiated." The procedure indicates that both of these conditions lead to symptoms of decreasing reactor coolant pressure t ~
e
and pressurizer level. For Part A, the level will stabilize with time.
For Part B the level will e.ontinue to detrease.
At TMI-2, the accident condition of interest was a failed open PORY which remained undetected. This condition was a small break (le;s than 0.5 ft ) loss-of-coolant accident until terminated by closure of the upstream 2
block valve. However, the pressurizer level response during tnis event was not indicative of that predicted by the procedure. For the leak experienced, the pressurizer level soon started to increase instead of stabilizing or continuing to decrease as the system depressurized.
The reason for th.is difference from predicted behavior is straightforward.
A loss of reactor coolant at the top of the pressurizer will produce an increasing pressurizer level response whether the coolant loss is due to a pipe leak or rupture, or a failed open safety or relief valve. A similar loss of reac*.or coolant from a lenk or rupture in a hot or cold lege pipe will produce a decreasing pressurizer level response. The symptoms identified in the emergency procedure are those corresponding to a hot leg or cold leg pipe 1eak or rupture. These symptoms were not observed during the first two hours of the accident at TMI-2 because th'e loss of reactor coolant was at the top of the pressurizer.
At this point it should be questioned why the operator would consider further the applicability of this procedure when the observed symptoms directly match those of a failed open code safety vlave (or a failed open PORY which remains undetected) and do not match those of a LOCA. The only significant indicator of a LOCA was the decreasing reactor coolant
~
The pressurizer level did not behave as predicted and the pressure.
t primary containment response was noticeably delayed. The observed e
e
~ ~. ~...-. -
, -(-
elevation of safety and relief valve discharge pipe temperature and the elevated reactor coolant drain tank conditions were not mentioned in the procedure and are not indicative of a pipe leak or rupture LOCA condition.
From the viewpoint of adequacy, this procedure appears to be acceptable for hot and cold leg pipe leaks or ruptures, but it may be confusing to apply for a loss of reactor coolant at the top of the pressurize r.
For this case, the operator would have to ignore the conflicting pressurizer level observations and concentrate on reactor coolant system pressure as the controlling indicator when electing which part of the procedure to use. Guidance concerning the possibility of an increasing pressurizer level with decreasing system pressure is not pmvided in the procedure.
Concl usions The early symptoms of the TMI-2 accident were those associated with a failed open code safety valve (or a failed open PORV with a defective position indication). The emergency procedure for a failed open code safety valve is 2202-1.5 (Pressurizer System Failure). This procedure calls for operator actions which closely approximate those performed by the TMI-2 operators during the first two hours of the accident. Un fo rtunately, this procedure specifies pressurizer level control which is.not an acceptable msponse to' this loss of reactor coolant situation. This procedure was, therefore, unacceptable for the TMI-2 accident case.
i S
l
~
{.
s Emergency Procedure 2202-1.3 (Loss of Reactor Coolant / Reactor Coolant System Pressure) is not directly applicable to the case of a loss of reactor coolant at the top of the pressurizer.
This procedure appears to be based on the reactor coolant system response to a hot or cold leg break.
It contains no guidance concerning the unique response of a leak or rupture at the top of the pressurizer.
Its use may cause operator confusion whenever
~
the observed pressurizer level is increasing during an emergency because the procedure indicates only a decreasing level. This procedure was, therefore, not adequate for the TMI-2 accident case.
In addition, it was not the correct procedure to follow in view of the observed symptoms.
i
=
i
.