ML19329D328
| ML19329D328 | |
| Person / Time | |
|---|---|
| Site: | Davis Besse  |
| Issue date: | 07/06/1979 |
| From: | NRC COMMISSION (OCM) |
| To: | |
| References | |
| NUDOCS 8003050664 | |
| Download: ML19329D328 (39) | |
Text
. - _ _ _
July 6, 1979 l
EVALUATION OF LICENSEE'S CCMPLIANCE i
WITH THE NRC ORDER DATED MAY 16, 1979 TOLEDO EDISON CCMPANY AND THE CLEVELAND ELECTRIC ILLUMINATING COMPANY CAVIS-BESSE NUCLEAR POWER STATION, UNIT No. 1 DOCKET NO. 50-346 i
l 1
INTRODUCTION Sy Orcar dated May 16, 1979, (the Order) the Toledo Edison Ccmpany and the Cleveland Electric Illuminating Ccmpany (TECO or the licensee) were directed by the NRC to take certain actions with respect to Davis-3 esse Nuclear Power Station, Unit 1 (0B-1).
Prior to this Order and as a result of a preliminary review of the Three Mile Island, Unit No. 2 (TMI-2) accident, the NRC staff initially identified several human errors that contributed significantly to the severity of the event.
All holders of cperating licenses. vere subsequently instructed to take a number of inmediate actions to avoid repetition of these errors, in accordance with bulletins issued by the Cecm.ission's Office of Inspection and Enforcement (IE).
Subsequently, an additional bulletin was issued by IE which instructed holders of operating licanses for Sabcock &
I hilco.: (31W) designed reactors to take further actions, including i.Tmediate cndnges to decrease the reactor high pressure trip point and increase the i
pressurizer pcwer-operated relief valve (PCRV) setting.*
i
"[IE Bulletins Nos. 79-05 (April 1,1979),73-05A (April 5,1979), and l
79-053 (April 21,1979) apply to all ELW facilities.]
r
..,ce=
003050 hk THIS DOCUMENT CONTAINS POOR QUALITY PAGES
~
The NRC staff identified certain other safety concerns that warranted addi-tional short-term design and procedural changes at operating facilities having B&W designed reactors.
Those were identified as items (a) through (e) on page 1-7 of the " Office ' f Nuclear Reactor Regulation Status Report to the o
Commission" dated April 25, 1979. After a series of discussions between the NRC staff and the licensee concerning possible design codifications and changes in cperating procedures, the licensee agreed, in letters dated April 27,1979 and May 4, 1979, to perform promptly certain actions.
The Commission found that operation of the plant should not be resumed until the actions described in Items (a) through (g) of paragraph (1) of Section IV of the Order are satisfactorily completed.
i Our evaluation of th! licensee's compliance with items (a) through (g) of 7
paragraph (1)- of Section IV of the Order is given belcw.
In performing this evaluation we have utilized additional information provided by the licensee in letters dated May 11, 18, 19, 22 (2), 23 (2), 25 (2), 29 and June 15 (2), 13, 21, 23.and 25, 1979 and numerous discussions with the licensee's staff.
Confirmation of design and procedural changes was made by members of the NRC staff at the OS-i. site.
An audit of the training and performance of the DS-1 reactor operators was. also' performed by -the NRC -staff to assure that the design and procedural changes were understood and were being ccrrectly implemented by the cperators.
l
3-EVALUATION Item (a)
It was ordered that the licensee take the following action:
" Review all aspects of the safety grade auxiliary feedwater system to further upgrade components for added reliability and perfernance.
Present modifications will include the addition of dynamic braking on the auxiliary feedpump turbine speed changer and provision of means for control room verifi' cation of the auxiliary feedwater ficw to the steam generators.
This means of varification will be provided for one steam generator prior to startup frca the present maintenance outage and for the other steem generator as soon as vendor-supplied equipment is available (estimated date is June 1, 1979).
In addition, the licensees will revicw and verify the adequacy of the auxiliary feedwater system capacity."
The euxiliary feedwater (AFW) system at 08-1 consists of two safety grade AFW pumps capable of being actuated and controlled by safety grade signals that ensure the availability of feedwater to at least one steam generator, under the assumed conditions of a single failure.
In addition, the capability to manually actuate and control AFW is available in the control room.
The scurces of water include two condensate storage tanks (CST), the service water systam and the fire protection system.
The CSTs provide the normal supply (non-safe;y-grade) and the service water system is used as a backt? safety grade sL?oly.
i
f
_ 4 A low level in either CST is alarmed to the operator and a continuous level is displayed inside the control room.
Low pressure switches on the AFW pump _
suction'p'rovide safety grade signals to automatically shift suction for the pump from the _CSTs to the backup service. water supply.
Additionally, the operator could also manually transfer the AFW suction to the fire water storage tank (FWST) in the fire protection system.
Both steam-driven auxiliary feedwater ptmp turbir.es at 05-1 are provided with a governor used for variable pump speed control.
The governor is eouipped with a small DC motor which changes the speed setpoint on the turbine centrol valve, thereby controlling steam flow which regulates the turbine and pump speed.
This DC motor receives " raise-and-icwer" pulses from the safety grade steam generator level control system or the manual control switches (located in the control room), which change the turbine speed as required.
Pulse i
length is autcmatically increased the further steam generator level deviates from its setpoint.
These changes in pump speed alter the AFW ficw and thus control the water level in the steam generators.
A_" dynamic brake" feature has been added, which consists of a resistor and electrical contacts in parallel with the windings of the DC motor. When the control pulse.is terminated, the braking resistor is placed in parallel with the'cotor windings, causing rapid dissipation of the energy associated with the motor acmentum (thus reducing the _ amount of motor coast).
This, in turn, reduces the amount' of _ pump spaed overshoot, thereby allowing fewer s eed changes to match the AFW f1:w rate to the steaming rate of the steam generators.
e M
g--
-e cm-9
-4w-
-- r
4 t
~~ P
~. 5 -
n The licensee has also added flow rate indication.for both steam generator AFW inlet lines.
Each inlet line has'a pipe-mounted ultrasonic ficw transducer and. signal conditioner.
These are located in the auxiliary building and are accessible during normal plant operations.
The signal conditioners provide outputs both locally and in the control room on the AFW purp section of the main control console. ~ Each device is designed to provide ficw rate indication to each steem generator from 0 to 1000 gpm.
The systems are powered frcr 120 VAC, 60 Hz buses which are fed by redundant non-Class IE station inverters.
Functional testing of the installed auxiliary feedwater flow rate indication is to be conducted in conjunction with the functional testing of the dynamic braking modification of AFW pump turbine controls.
The staff concludes that the dynamic brake and AFW flow rate indication modifications are acceptable contingent upon successful testing prior to restart.
We have reviewed the piping and instrumentation diagrams and have determPned
' that no active failure,of a mechanical component, such as a pump -" valve, would preclude obtaining the required AFW flow rate.
The licensee has pre-viously performed tests of the manual and automatic level control system.
The i
test results showed that the control system functioned as designed to control 1
- steam generator-level.
Verification of acceptable flow capacity for each of the two AFW-pumps was based upon recorded steam generator level changes follcwing a previous reactor trip.
These data sho-ed that each pump exceeded the design ficw rate of 800 gpa at a steam generator pressure of 1050 psig.
(The 800 gpa is the ficw rate delivered to the steam generators and does not include the approximately 250 jam recirculation ficw rate.)
M 4
m
~.
s c
o-Additional information submitted by the licensee (letter from Lowell E. Roe (TEC0) to Mr. Robert W. Reid (NRC) dated May 23,1979) shows that a total
, minimum flow, to one or both stea, generators, of 550 gpm is required to support the accident analfses.
Based on these data and analyses, and the agreement by the licensee to perform checkout tasting of the dyaamic braking and ficw rate indication modifications prior to restart, we conclude that adequate assurance exists that the AFW system will deliver the required flow rate upon demand.
i By letter (Lowell E. Ece (TECO) to Mr. Robert W. Reid (NRC) dated May 23, 1979), the ' licensee provided results of a review of.the operating history of
~
+
the AFW system at 08-1.
The-largest number of failures
- occurred during the
-initial operating and debugging phase of. the facility.
Fourteen (14) of the seventeen (17) reported failures occurred prior to January,1978.
Subsequent to implementing system design changes as a result of several of these failures, the systems failure rate has'been reduced and its reliability enhanced.
There were 3 failures of AFW system components from January 1978 to 'iay 1979.
(There were a total of 65 actuations of the AFW; system in this time period.)
Three different components in the AFW system were involved in these three failures:
(1) the speed control circuit for #1 AFW pump turbine, (2) a faulty i -
limit switch on an.AFW discharge valve, and (3) two sticky AFW pump turbine
- steam supply valves. =In each case, the licensee' performed corrective actions.
1 i-
- '[For the purpose of demonstrating improvement in the perforrance of the AFW.
-system, theDlicensee has defined a failure of the AFW system to be any event for wnich at least one train of the AFW system is rot calivering disign ficw i
to 3 steam generat0r.]
E
+
-r r
..e.
+
,w 4
-,-,--mw2
-,--tr-4
--m-y
-m-vr-*
O -
A later letter (Lowell E. Roe (TECO) to Mr. Robert W. Reid (NRC) dated June 29, 1979) addressed a series of pressure switch failures which were discovered on May 21, 1979, and which affected both AFW trains.
An evaluation of these failures by the licensee cor.cluded that both trains would have automatically actuated if required, but that one train would not have shifted automatically to the service water supply.
The NRC staff has discussed these failures with TECO and has requested that an improved surveillance program for these
~
pressure switches be initiated to determine the cause of the failures and the optimum calibration interval.
The licensee has agreed to an increased frequency of switch calibration.
In addition, the licensee has made procedural changes, requested by the staff, to instruct the operator to manually shift to the alternate supply of water for the AFW pumps, when the CST level drops to three feet (if automatic switchover has not occurred).
This procedure provides greater assurance that, even <ith failures of this nature, the AFW system is available during the longer term.
More recently (July 5, 1979), the NRC s.taff was verbally infor. red by TECO (Mr. G. Novak) of a valve malfunction which took place in an AFW system pump discharge line on July 4, 1979.
The cause of the valve failure (failed closed) was apparently due to an electrical malfunction.
TEC0 stated that they would request the motor vendor to examine the failed motor to determine the cause of the mal-function.
The IE site inspector has been requested to follow this evaluation and to detaraine the need for further study and corrective action if necessary.
The licensee has noted that manual capability (local handwheel) to ocen the valve existed at the time of the failure and that the redundant AFW train was Ivailable.
o.
~
t
-With regard to the, operating history of the AFW system, the staff concludes i
that.the ' licensee ~has increased the reliability of the AFW system by imple-menting appropriate corrective actions and design modifications.
With regard
' to the core recent pressure switch and valve failures, the staff concludes
- that~ adequate assurance exists that the causes of the failures are being pursued by-the-licensee in a timely manner, and that the'IE site inspector will -follow the need for further corrective action.
In addition, the licensee has-revised the administrative procedure pertaining.
to valve alignment and control.
These. revisions to AD 1839.02 (" Operation and Control of Locked Valves") provide further' assurance that mispositioning of AFW system valves would be detected.
Sased on the above evaluation, the NRC staff concludes that the licensee has ccmplied with the requirement of Item (a) of the Order.
l Item (b)-
1 It was also ordered that the licensee:
" Revise 'cperating procedures as necessary to eliminate the option of
-using the. Integrated Control System as a backup means for controlling auxiliary feedaater flow."
1 1s,
m
.g.
As indicated-in Item (a), the 03-1 APd system has been designed as a safety grade system and, as such, is separate from the integrated control system
~
(ICS); however, the licensee has indicated that the AFW system is capable of being switched to the ICS mode for-a backup means of control. As currently designed, the AFW system has three operational codes of controlling ficw:
"ICS control", " auto-essential" and "canual." We requested that the licensee
~
consider a more positive ceans to assure the continued separability of the ICS control position of the mode selector switches.
The licensee agreed (letter frca lowell E. Roe (TECO) to Mr. Robert W. Reid (NRC) dated June 15, 1979) to install a mechanical stop cn these switches to further deter use of the ICS control position.
The IE site inspector has verified the installation of this mechanical stop.
The licensee has revised S? 1106.06 (" Auxiliary Feedwater System"), which describes procedures for AFW system operation.
This procedure specifically prohibits the use af'the.ICS control position on the mode selector switches.
H Procedural steps for placing the AFW system in service for plant startup require the operator to place the AFW mode selector switches in the auto-essential position. We have reviewed the revised procedure for AFW switch operation and conclude there is sufficient guidance to prevent use of the AFW system in 'the ICS rode of control.
Other_ plant procedures _that made reference to the ICS control mcde of AFW have been revised by the licensee to no longer au-horize that mode of control. The m
10 -
staff has reviewed those procedures and concludes that those revisions are adequate.
In addition, the.NRC staff audit confirmed that the control room n'perators are aware that ICS control of AFW is prohibited.
Based on the above evaluation, we. conclude that the licensee has complied with j
the requirements of Item (b) of the Order.
i Item (c) f
[
The Order requires that the licensee:
1
" Implement a hard-wired control grade reactor trip that would be actuated on loss of main feedwater and/or turbine trip."
The 08-1 original design did not have a direct reactor trip from a malfunction in the secondary system (loss sof main feedwater and/or turbine trip).
To obtain an earlier reactor trip (rather than delaying the trip until an operator took action or until a primary system parameter exceeded its trip setpoint)-,
the licensee committed to install a hard-wired, control grade reactor trip on the loss of.all main feedwater and/or on turbine trip (letter from Lowell E. Roe
'(TECO) to H. Denton (.NRC) dated. April 27,1979).
The purpose of this antici-patory trip is _to minimize the potential for opening of the power-operated i
relief valve (PORV) and/or the safety valves en the pressurizar.
This new e a ww e
a
~.
4 w 3
N
- 11 I
circuitry meets this objective by providing a reactor trip during the incipient stage of the related transients (turbine trip and/or loss of cain feedwater).
TEC0 has added control grada circuitry to 03-1 which is designed to provide an automatic reactor trip when either the main turbine trips or there is a reverse differential pressure of 177 psid across both of the two main feedwater check valves (one check valve is located in the, main feedwater discharge piping associated with each steam generator).
The main turbine trip is sensed by a normally deenergized auxiliary relay associated with the ma$in turbine generator master trip bus.
The power for this bus is provided from a 24 volt DC source, which in turn'is provided pcwer (through rectifier circuitry) from a non-Class IE inverter. supplied 120 valt AC distribution panel.
A contact from the above auxiliary relay is arranged into a 120 volt AC circuit containing four normally deenergized relays [ Power for this 120 volt' circuit is provided from a Class lE inverter supplied distribution panel.
The design for these four relays and apprcpriate associated circuitry conform to Class IE requirements, including physical independence and provisions for testing.
Each of these four relays provide one contact which is arranged in series with one of the-four Class lE undervoltage coils associated with one of the four AC reactor trip circuit breakers (one undervoltage coil associated with each AC reactor trip circuit
. breaker). When these relays are energized, power to the associated Class lE
~
undervoltage coils is interrupted so as to produce the desired reactor trip.
T
,m s
,w--
y s
...,.a.--,,
e As indicated above, differential pressure switches across check valves, located
~ ~ ~
in the main feedwater pump discharge piping, actuate upon sensing a reverse differential pressure across these check valves.
Two contacts from these differential pressure switches are arranged into a 125 volt DC circuit, which is provided pcwer from a Class lE 125 volt distributica panel.
This circuit contains two associated DC relays.
Two ccatacts (one contact per relay) associated with these relays are arranged in series.
This series contact
.arrangecent is provided in parallel with the contact associated with the main turbine generator master trip bus.
The remaining circuitry associated with this trip is identical and common (shared) to that described above for the turbine trip (including power supply identification).
Provisions have_been included in the design to canually bypass and to reinstate
'the reactor trip feature associated with the main turbine generator trip.
To supplement this feature, the design includes an annunciator which actuates whenever this reactor trip is bypassed and the reactor power level is above 15
. percent. Access to this bypass switch will require a key which is under
. suitable administrative control.
Operator verification of the bypass removal
-is required oy procedure during pcwer escalation.
The NRC staff has reviewed these procedures and concludes that sufficient administrative control exists.
No bypass features are included in the design for the reactor trip feature i
associated with the loss of main feedwater circuitry.
During normal startup or shutdcwn, an. electric auxiliary pump is used when the sta3a driven main
.feedwater pumps-are not available.
9 g
y y
4 The licensee has analyzed this additional circuitry with respect to its independence frcm the existing' reactor trip system and to assure that the design and operation of.this additional circuitry will neither degrade the reliability of the existing _ reactor protection system nor create any new adverse safety system interactions.
Sased on cur review of the implementation of the added trip circuitry, with respect-to its independence from the existing trip circuitry, we conclude that this addition will not degrade the existing reactor protection system design.
In addition, the licensee has satisfactorily ccmpleted testing of this trip circuitry.
The. licensee has committed to perform a monthly periodic test of the added circuitry to demonstrate.its ability to open the AC reactor trip circuit bneakers (tripping of the AC. reactor trip circuit breakers via the under-voltage trip circuit). ~We-conclude that there is reasonable assurance that the additional circuitry will perform its intended function.
Based on the above evaluation, we conclude that the licensee has complied with the' requirements of Item (c) of the Order.
Item (d)
LThis Item in the Order requires the licensee to:
i
" Complete analyses for potential small breaks and develop and implement operating instructions to define operator action."
By letter,.(Lowell E. Roe (TECO) to H. Denton (NRC) dated April 27, 1979), the licensee agreed to provide the analyses and operating procedures of this requirement.
B&W, the reactor vendor for the C8-1 plant, submitted generic analyses for S&W plants entitled, " Evaluation of Transient Sehavior and Small Reactor Ccolant i
Systems Breaks in the 177 Fuel Assembly Plant," and supplements to these analyses (References 1 through 5).
Additional information specific to 08-1 was1 transmitted in References 6 to 8.
The transmittal under Reference 6 contains Volume III for the S&W generic study covering raised-loop plants.
Reference 7 provides additional analytical results specific to 08-1 with appropriate auxiliary feedwater flow rates.
Reference 8 provides additional analytical results for the loss of all main feedwater flow accident with loss of all AFW.
This latter analysis demonstrates that capability exists at 03-1 which the operator could use in the unlikely event of a loss of-main feedwater and a loss of both safety grade AFW trains.
This capability consists of'using the combined functions the makeup pumps,* the electric-startup auxiliary feedwater pump and the PORV to achieve depressurization (only if necessary). We requested that the availability of this option be incorporated-in procedures at CS-1.
The NRC staff will review these procedural changes prior to startup.
"At 03-1, tne takaup'at.ps are separate fr0m the M?: ;
s.
~ -..
~.
By letter, (Lowell E. Roe (TECO) to Mr. Robert W. Reid (tGC) dated May 22, 1979), TEC0' referenced.the analyses as appropriate for 08-1.
The staff evaluation of the B&W generic study has been completed and the results of the evaluation will be issued as a tiUREG' report in July 1979. A principal finding of our review of the 08-1 submittals and the generic study is a reconfirmation -
that loss-of-coolant accident-(LOCA) analyses of breaks at the lower and of the small breaks spectrum (smaller than 0.04 ft.2) demonstrate that a combination of heat removal by the steam generators, high pressure injection.
(HPI) system and through the break ensure adequate core cooling.
The AR1 system used to remove heat through the steam generators has been modified to enhance its reliability as discussed in Item (a).
Uncovering of the reactor core is not predicted for breaks at this end of the small break spectrum with these features available, therefore, cladding temperatures do not rise significantly above pre-reactor trip temperatures (less than 800 F), and remain well within the 10 CFR 50.46 limit of 2200 F.
The. ability to remove heat via the steam generators has always been recognized
- to be an important consideration when analyzing very small breaks.
The.
licensee demonstrated that permanent loss of main feedwater and icss of AFW for the first 20 minutes of a small LOCA will not result in uncovering tne reactor core.
However, when AP,4'is delayed beyond this time, a positive reliance on AP.1 actuation exists as a result of the relatively low (1600 psig)
HPI system shutof f head for 08-1.
Thus permanent loss of both main and auxiliary
~.
M,
--is -
'feedwater could result in uncovering the core and fuel damage for the facility because of the unavailability of the high pressure injection pumps. Makeup pump and startup feedwater pump actuation, as discusse^d in the analysis of Reference 8 for the loss of-feedwater accident with permanent loss of AFW, are considered potentially capable of maintaining the vessel afxture above the core for a small' break, but this scenario was not confirmed in the small break analyses. The licensee's position is that such analyses are unwarranted in light of the safety grade design of the AFW system.
Since the additional heat i
removal and coolant makeup capability does exist at 03-1, we requested that the procedures identify the availability of this option.
Implementation of
. this procedural change will be verified by the staff prior to restart.
While
.t the staff recognizes that the ArW system is safety grade, we also note that theilicensee has agreed to continue to review performance of the AFW system for assurance of reliability and performance.
Consistent with this long-term
- agreement, we will ~ require that the licensee modify the plant to provide the greater degree of. diversity offered by a 100% capacity actor operated AFW
. pump, or. an alternative acceptable to the staff.
Another aspect' of tne analytical studies conducted was an essessment of the effect of recent design changes on the lift frequency of pressurizer safety.
and. relief valves.
The design changes included:
(1) a change in the setpoint
.of?the'PORV from 2255 psig to 2400.psig, (2) a change in the high pressure n
_ reactor trip setpoint from 2355 psig to 2300 psig, and-(3) the installation of anticipatory, reactor trips: cn turbine -trip.and/or-loss of main feedwatar.
In 1
~.ha past, dLrirg turbine trip and loss of 'faed-ater transients,- the ?OT!,as -
u
.___.,-,,.,__._7.,a
.+
-_17 lifted. With the new design,.these transients do not_ result in lifting of this valve.
However, lifting of both PORV and safety valves might occur in the cases of rod withdrawal' o~r inadvertant boron dilution transients, using 4
~~the normally conservative assumptions presented in Chapter 15 of the Final Safety Analysis Report (F5AR).
The above design changes did not affect the lif't frequency of the valves for these Chapter 15 safety analyses.
~
3ased on our review of the analyses presented by B&W, the staff has determined that a loss of all main feedwater'with (1) an isolated PCRV (closed block valve), but safety valves _ opening and closing as designed, or (2) a stuck open PORV consequentially does not result in uncovering the reactor core, provided AFW pumps are initiated within 20 minutes.
It is also concluded, that in the event.of a loss of all AFW for.either case, covering of the core would be
.i i '
sustained to long-term cooling by operator actions described in the analysis g
of Reference 8.
These actions cons,ist of starting at least one of the two 4
makeup pumps, starting the.startup feedwater pump, and opening the FORV_(only if needed).
I a
Based on the consequences-' calculated for small break LOCAs and loss of all main feedwater events, and taking into account the expected reliability of the AFW and HPI; systems for DB-1, we conclude that the licensee has complied with
-the analyses portion of' Item.(d) of the Order.
To support long-term operation.of the. facility, requirenants will be caveloped for-additicnal=and' ore detailed analyses of loss of feedsater and other y
q'>
qy y
ar-y w
m 9.
-w-i-*,pw-
. - - ~
.18 -
t anticipa,ted transients.
More detailed analyses of small break LOCA events are also needed.for this purpose.
Accordingly, the licensee will be required to prov.ide the analyses discussed in Sections 8.4.1 and 8.4.2 of the recent NRC
" Staff Report of the Generic Assessment of Feedwater Transients in Pressurized Water Reactors Designed by the Babcock and Wilcox Company" (NUREG 0560).
Further details on these analyses and their applicability to other PWRs and BWRs will be specified by the staff in the near future.
In addition, to assist the staff in developing mora detailed guidance on design requirements
.of relief and safety valve reliability during anticipated transients, as discussed in Section 8.4.6 of NUREG 0550, the licensee will be required to provide analyses of the lift frequency and the mechanical reliability of the pressurizer relief and safety valves of the 08-1 facility.
The B&W analyses show that scme operator actions, both immediate and followup,
~ are required under certain circumstances for a small break accident.
Immediate operator actions are defined as those actions, committed to memory by the
- operators, which must be carried out as soon as the problem is diagnosed.
- Folicwup actions require operators to consult and follow steps in written and approved procedures.
These procedures must always be readily available in the.
i control = room for the operators' use.
Guidelines were developed by B&W to assist the operating B&W facilities to develop emergency procedures for.the small-break-accident.
2 I
W
b The " Operating Guidelines for Small Breaks" were issued by B&W on May 5, 1979 and reviewed by the NRC staff.
Revisions recommended by the staff were in-corporated 'in the guidelines.* In addition, by letter, the licensee submitted supplemental ~ guidelines (Lowell E. Roe (TECO) to Mr. Robert W. Reid (NRC) dated May 22,1979).
In response to these guidelines, the' licensee made i
substantial-revisions to EP 1202.05 ("Less of Reactor Coolant and Reactor.
Ccolant Pressure"), EP 1202.14 ("Less of Reactor Coolant Ficw/RCP Trip"), and EP 1202.26 (" Loss of Steam Generator Feea").
These emergency procedures defina the required operator action in response to a spectrum of accidents including a LOCA in conjunction with various equipment availability and failures.
The precedure dealing with loss of reactor coolant (EP 1202.06) is divided '
into three sections.
The first section deals with small reactor coolant system leaks within the capacity of the makeup pumps and assumes the reactor
- does not automatically trip.
The second section assumes a small break within the capacity of the HPI system and a situation where the SFAS** and reactor trips-may or may not automatically occur.
This section incorporates the B&W small break guidance and provides for cperator actions in the avent other
~71Lettar from J. Taylor (B&W) to Z. Rosztoczy (NRC) dated May 16,1979]
i
' ^^[The safetyf features actuation system (SFAS) monitors variables to detect loss
-of' reactor. coolant system boundary integrity.
Upon detection of " cut-of-limit" Conditions of these variables, the system initiates various actions, depending upon the location and severity of'the " cut-of-limit" concitions measured.
These actions can include:
initiatica of emergency core cooling (ECC), which consists of.hign pressure injection (SPI) and icw pressure injection (LPI);
ccatainment vessel cooling arc isolation; containment vessel spray systems; j
~ and starting of the emergency diesel' ganaratces. ]
h J
systems (such as reactor coolant pumps) do not operate as expected.
The third section of this procedure deals with a pipe rupture well in excess of the capability of the makeup and/or HPI pumps (a large break in which the system depressurizes to the point of low pressure injection).
Automatic reactor trip and SFAS actuation are assumed.
In all cases dealing with a small break, the cperator actions are aimed at achieving a safe cold shutdcwn in accordance sith the normal cooldown procedure.
- As indicated above, procedures provide guidance to the operators for dealing with small breaks in the event of a degraded condition (such as loss of reactor coolant pumps). 'If the reactor coolant pumps are inoperable, the operator is directed to establish and verify natural circulation.
Procedural steps to restore reactor coolant pump operation, once a pump becomes available, are provided.
In the event natural circulation cannot be established and a reactor coolant pump cannot be restarted and plant pressure reaches 2300 psig,_the operator is provided precedural steps to relieve the heat energy via the PORV.
(Additional relief capacity is provided via the code safety valves if the PORV is inoperable).
1 In the event that normal feedwater is lost to the steam generators, auxiliary feedwater is automatically initiated via the safety grade APd system.
EP 1202.26 provides operator. guidance in this event. With.S.AS actuation, steam generator
. level'is automatically maintained at 95 inches on the startuo range to assure adequate heat removal'during the small break event.
A
~
- i. -
For all cases in which HPI is manually or automatically initiated, the operators
. are. specifically instructed to maintain maximum HPI. flow unless one of the two following criteria is met:
(1) Low pressure. injection has been cperating for greater than 20 minutes I
with ficw rates in excess of 1000 gallons per minute per train, or
~
(2) All hot and-cold leg terperatures are at least 50 degrees belc: the i
saturation temperature for the existing reactor coolant system pressure.
If the 50 degrees subcooling cannot be maintained after high pressure injection cutoff, the high pressure injection shall be l
reactuated.
i This: requirement to determine and maintain 50 F subccoling has been incorporated into EP 1202.06 (" Loss of Reactor Coolant and Reactor Coolant Pressure") and EP 1202.24 (" Steam Supply System Rupture").
The procedures also provide j.
. instructions to the operators to check alternate instrumentation channels to confirm key parameter readings, such as the degree of subcooling.
Accordingly, the use of core exit thermoccuples as alternate temperature indicatcrs is addressed in the procedures.
Under degraded cooling conditions (such as a
- LOCA), the pressure-temperature limits considered in the Technical Specifica-tions are not applicable to the ensuing decressurization and cooldown because these limits were developed for normal and upset cparating conditions only.
- Density differences between the downcomer ard reactor core will cause
[
- recirculatienL(lcw between the care exit and d:.nc: mar via the.ent valves.
...,m-.-.
s 22 -
Mixing of the hot core exit' water with the cold HPI water (or makeup water) will provide sufficiently warm-vessel temperatures to preclude any significant thermal shock effects to the vessel.
Subsequent restoration of AFW would depressurize the reactor coolant system to below 600 psig where pressure vessel integrity is assured for any reasonable thermal transients that might subsequently occur.
E&W has agreed to provide a detailed thermal-c.echanical generic report cn.the behavior of vessel materials for those extreme conditions.
The " Loss of Reactor Coolant and Reactor Coolant Pressure" procedure was reviewed by the NRC staff to determine its conformance with the B&W guidelines.
Comments generated as a result of this review were incorporated in a further revision to the proced-
..1ber of the NRC staff walked through this 3
emergancy procedure in the Cavis-Besse control room.
The procedure was judged to provide-adequate guidance to the operators to cope with a small break LOCA.
The instrumentation necessary to diagnose the break, the indications and controls required by the action statements, and the administrative controls which prevent unacceptable limits from being exceeded are readily available to the operators.
We conclude that the operators should be able to use this procedure to bring the plant'to a safe shutdcwn condition in the event of a small~ break accident.
An audit of'9 of the 25 licensed reactor operators and senior reactor ocerators 4
i-was conducted by the NRC staff to determine the cperators' understanding of the small! break accident, including how they are recuired to diagnose and
[
r?spond to it.
The IE-1 staf f has conda: tid 5;?cial trainic; 3 assions f;r the-E i
w
,r v
n-e m-e 3-
operators on the concept of and use of Emergency Procadure 1202.06.
The operators were found to have sufficient knowledge of the small break pheno-menon and the general requirements of the emergency procedure, although some deficiences were identified which were primarily due to the cperators' lack of familiarity with the recently revised procedure. All cperators will receive additional training on EP 1202.06 and a facility administered audit prior to assuming licensed duties during power operation.
The audit of the operators also included questi'.ning about the TMI-2 accident and the resulting design changes made at C8-1.
The discussions covered the initiating events of the incident, the response of the plant to the simul-taneous loss of feedwater and small break LOCA (PORV stuck open), and c;arator actions that were taken during the coursa of the incident.
In adcition, similarities and diffarances between the TMI-2 accident and the 08-1 incident of September 24, 1977 were discussed.' We fou.') their level of understanding sufficient to be able to respor,d to a similar situation if it happened at 08-1.
We also conclude that they have acsquate knowledge of subcooling and saturated conditions and are able to recognize each condition in the primary coolant system by several methods.
The AFW system was also ciscussed during the audit *e determine the operators' abi'.ity to assure proper starting and operation of the system during normal conditions, as well as during adverse conditions such as loss of offsite power or loss of main feedwatar.
The long-term operation of the system was examined to evaluate the operators' ability to use available manual controls and watar sa; plies.
The level of understanding was found to be sufficient to assure proper short-and long-term AFi fl:w to the steam generators.
.=
s
~
a
~
.The licensed reactor operators and senior reactor operators have received training concerning the TMI-2 accident, smai! break LOCA recognition, design modifications, and procedure changes.
The trainitig included formalized class-room sessions and on-shift review of training matarial and emergency procedure changes.
To determine the' effectiveness of this traicing program, a written exam was administrated to all licensed personr.e1 by the licensee. The exam was reviewed and found acceptable by a member of the NRC steff.
Individuals.
scoring less than 90 percent on the exia will receive additional training and Nill not assume licensed duties until a score of at least 90 percent is attained on an equivalent, but different exam.
The NRC staff conducted audits to evaluate the effectiveness of the training program.
The results ere judged satisfactory with some deficiencies noted to the 08-1 staff.
The CB-1 staff will use the results of these audits as well as any generic weaknesses discovered on the written exams in their development of future training and requalification programs.
The NRC staff will review all results and records as part of the normal inspection function of the 08-1 roqualification program.
We conclude that there is adequate assurance that the operators at 03-1 have, and will continue to receive, a sufficient level of training concerning the TMI-2 accident.
Based on the above evaluation, wa conclude that the licensee has complied with the requirements of Itam (d) of the Order.
I 4
-n-
. =,,
---a, e
n,,..
p,,,
.e n++g
, r - 4, rma-
. g5 -
Item (e)
The Order requires that:
"All licensed reactor operators and senior reactor operators will have completed the Three Mile Island Unit No. 2 simulator training at B1W."
The licensee has confirmed that all reactor operators and senior reactor cperators have co.pleted the TMI-2 simulator training at 81W as required by the Order.
This training consisted of a class discussion of the TelI-2 event and a demonstration of the event on the simulator and how it should have bcen controlled.
The class discussion was about one hour long and the remainder of the four hour sassion was conducted on the simulato.*.
The TMI-2 avant, including oparational errors, was demonstrated to esca operator.
The event was again initiated and the operators were given " hands-on" experience in successfuT1y regaining control of the plant by several methods.
Other transients, which resulted in depressurization and saturation conditions, were presented to the operators, in which they maneuvered the plant to a stable, subcooled condition.
The licensee has submitted copies of procedures that were revised as a result of this Order and actions the licensee has taken to preclude the occurrence of an incident similar to that which occurred at TMI-2."
The precedures reviesad by the staff include:
I[As noted On page 16 of this Safety Evaluation, additional ino. ore det3i'?d 1 ilyses of icss-cf-feed,ater trarsian;s ird Otbar inticicitso trirsients will I? 20re.
hi!r. c0uld af fe!'. 1.~.;-s i ; * ?c 9 d'.* ? s ! r 1re I c ~ g-ti r". )
- gg.
EP 1202.01 Load Rejection EP 1202.02 Stati,on Blackout EP 1202.03 RCS Overpressure Anticipatory Manual Trip EP 1202.04 Reactor-Turbine Trip EP 1202.06 Loss of Reactor Coolant and Reactor Coolant Pressure EP 1202.14 Loss of RC Flew /RCP Trip
(? 1202.22 High Condenser Pressure EP 1202.24 Steam Supply System Rupture EP 1202.26 Loss of Steam Generator Feed AB 1203.04 Depressurization of the RCS with Safety Grade Equipment A3 1203.02 Loss of All AC Power AP 3003.41.44 High Pressure Injection High Ficw Alarm AP 3003.49.50 Low Pressure Injection High Flow Alarm AP 3003.51.54 High Pressure Injection Low Ficw Alarm AP 3003.59.60 Low Pressure Injectic. Low Flow Alarm SP 1105.16 Steam and Feedwater Rupture Control System Operating Procedure SP 1106.06 Auxiliary Feecwater System ST 5071.01 Auxiliary Feedwater System Monthly Test Special Order.'lo.
20 Additional Guidance for Checking Critical Parameters for Emargency Procedures The liciesee's revised procadures provide 3dditional guidance for the :perators W
8
.W WP W8 4
W w
g W
W
directed to recheck certain critical plant parameters.
Cperators are also directed to check alternate instrument channels to confirm readings and reduce the possibility of reliance on faulty or misleading indications.
flRC staff cerr.ents on the licensee's procedures have been incorporated into the revised documents.
These r2 visions have been reviewed by the staff and detarmined to 'e acceptable.
The staff walked thrcugh the folicwing procedures c
with tne control room operators:
EP 1202.06 ("Less of Reactor Coolant and Reactor Coolant Pressure"), EP 1202.14 (" Loss of RC Flow / RCP Trip"), EP 1202.26
(" Loss of Steam Generator Feed"), and SP 1106.06 (" Auxiliary Feedwater System").
Based on this walk through and interviews with the operators, (see the discussion of the tiRC staff audit of operators under Item (d)), we conclude that the procedures are functionally adequate and the operator training on their use 'is satisisctory.
Based on the above evaluation, we conclude that the licensee is in compliance with Item (e) of the Order.
Itam (f)
The Crdar requires that the licensee:
" Submit a reevaluation of the TECO analysis of the r.eed for automatic or l
administrative centrol of steam generator level setpoints during auxiliary l
feedwacar system operation, previously submitted by TECO letter of Cece-ber 22, 1973. in T ight of the Thcee Mile Isle-d ':c. 2 incidano."
t a
By letter, (Lowell E. Roe.(TECO) to Mr. Robert 'd. Reid (NRC) dated May 19, i
1979), the licensee provided additional discussion of the steam generator dual level setpoint.
The need for this feature is to reduce the potential for loss of pressurizer level indication as a result of overcooling of the primary system for non-LOCA events.
The_results of a natural circulation test conducted at 03-1 and B&'d analyses demonstrate that 08-1 can be operated at a low steam generator level (35 inches on the startup range instrumentation).
The high i
level setpoint (95 inches indicated on the startup range instrumentation) is required since previous small break analyses assumed that auxiliary feedwater was controlled to a steam generator level of 96 inches.
Pending incorporation of permanent design modifications to provide the automatic dual setpoint steam generator level control, emergency procedures instruct the cperator to manually control the steam generator level at 35 inches for all events requiring AP4 unless an SFAS level 2* signal occurs.
'dhen the SFAS level 2 signal occurs, the operator is instructed to control the steam generator level at 96 inches by placing the APd mode selector switch in the auto essential position.
This manual provision required no previous change to the design of the APd control system.
The future circuitry modification, to automatically control to 35 incnes, will be reviewed by the staff during the long term.
TECO has cited Reference 9 to demonstrate that no unreviewed safety issues or detrimental accident consequences would result if the cperator failed to manually control the steam generator level at 35 inches.
The staff reviewed the. information contained in this refertece and concluded that additional information was required to verify that.the effects of manually controlling the steam generator -
~
level
+.t 35 inches is adequate for the GB-1 FSAR Chapter 15 transient and N 5 ?.25 zeei'2 Ar. SM S 13;el 2 sig.ai is dsce'cced,%n ns:::e cc:: art syst2m rassure de:,ps o '_E0 psig or c: air ent assai pressure ir: sases
.l c
~
' psig.]
~
2 accident analyses, and the more recent B&W small break analyses (Reference 1).
By _ letter, (Lowell E. Roe (TECO) to Mr. Robert W. Reid (NRC) dated June 15, 1979), the licensee stated that the control of the steam generator level at 35 inches has.no adverse effect on the 03-1 FSAR analyses, since the peak reactor i
temperature and pressure following the most cevere transients (loss of feedwater, feedwater line breaks, loss of offsite power) occur prior to initiation of the AFW.
The results of natural circulation testing conducted at 03-1 support the effectiveness of the 35 inch steam generator control level to caintain natural circulation and remove decay heat for:
(1) transients that result in loss of forced circulation (loss of offsite power) and (2) for small breaks (less than 0.01 f t.2) that depressurize slow enough that it is possible to manually control the steam generator level prior to actuatic, of the SFAS level 2 signal.
For small breaks larger than 0.01 ft.2, recuction of the reactor coolant system pressure to SFAS level 2 occurs prior to the steam generator level decreasing to 96 inches. With the steam generator level controlled at 35 inches, the effectiveness of natural circulation is such that there is no small break size that will result in repressurization of the primary system without an SFAS level 2 actuation.
The staff has reviewed the information provided by TECO in the referenced documents and concludes that dual level setpoints, with manual control of the steam generator level at 35 inches, are acceptable.
Also, the NRC staff has verified that this manual control.
capability has been previously demonstrated.
The licensee has submitted revised procadures, which the staff has reviewed, that provide requirements for steam generatcr lecel ccatrol.
These procedures i
~.
i
-include:
EP 1202.,06 (" Loss of Reactor Coolant and Reactor Coolant Pressure"),
EP 1202.14 (" Loss of RC Flow /RCP Trip") and EP 1202.26 (" Loss of Steam Generator
~ t t
Feed").
The NRC staff has verified that these procedures instruct the operator Eto confirm that the AFW mode selec+or switches are in the auto-essential position and. maintaining steam generator' level at 96 inches on the startup a
range indication in the event SFAS level 2 condition is present.
If a SFAS level 2 ccndition is not present and an AFW system demand event occurs, steam generator levels will automatically centrol at 96 inches (since the AFW mode selector switches are in the auto-essential position).
The operator is directed to take manual control of steam generator level and maintain level at 35 inches on the startup range indication.
If an SFAS Level 2 condition subsequently develcps, the operator cust return the AFW mode-F selector switches to the auto-essential position to allcw autcmatic level control at 96 inches.
Therefore, the emergency procedures are written to permit' manual control of steam generator level after an automatic initiation i
of AFW only if an SFAS leval 2 condition is not present.
If a SFAS level 2 condition is present (or develeps), the operator is directed to leave (or return) the AFW mode selector switches in the auto-essential
'osition.
In addition, a warning plate.has been installed adjacent to the p
j
' mode selector switch for each AFW train, reminding the operator of the recuirement to maintain the switch in the auto-essential position acde if an-SFAS level 2 conditionLis'present.
The NRC staff has verified the installation of:this warning plate.. Also, during the audit the NRC staff confirmed that
-. ~ -.
. ~..
A
31 -
~
the control room 9perators are aware of the requirements outlined in the revised procedures and understand the purpose of the warning plate.
Based on the above evaluation, we conclude that the licensee has complied with the requirements of Item (f) of the Order.
Item (g)
The Order requires that the licensee:
" Submit a review of the previous TECO evaluation of the September 24, 1977 event involving equipment probleas and depressurization of the primary system at Davis-Besse 1 in light of the Three Mile Island Unit No. 2 incident."
By letter (Lowell E. Roe (TECO) to Mr. Robert W. Reid (NRC) dated May 18, 1979), the licensee submitted additional discussion of the September 24, 1977 avent.
This event was similar in several important areas to the TMI-2 accident.
The initiating malfunction was a loss of main feedwater (the same as TMI-2);
however, the ensuing trainsient was much less severe than TMI-2 for soveral significant reasons.
The following discussion compares The Ci-1 event to the accident at TMI-2.
The bases for this comparison are the six h_ran, desiga and. mechanical failures described in II Eulletin 79 5A (2pril 5,1979)..nica rtiu' tid in : ore da.3ge and rac a 'or 3'sists a-
"a ~"~-2
.:'iar :'s :.
t l.
At the time of the initiating event, loss of feedsater, (at TMI-2) both of the auxiliary feedwater trains were valved cut of service.
The 08-1 loss of feedwater (LOFW) event initiated both trains of AFW.
However, only one train fed its associated steam generator (SG) due to a malfunction of a turbine governor which kept one of the two AFW pump turbines at a speed insufficient to purc water into its associated SG.
As a result of the DB-1 event, the modificaticas that have been cade include:
(1) the AFW pump turbine governors were modified to prevent binding malfunctions; (2) springs were installed in the AFW governor to prevent closure of the governor valve due to vibration; (3) the AFW governor control circuitry relays were replaced (see additional AFW discussions in Item (a)).
2.
The cressurizer ocwer-ocerated relief valve (PORV), which coened during the initial oressure surge (at TMI-2), failed to close when oressure decreased below the actuation level.
During the C8-1 LOFW, the ?CRV also failed to close, causing icss of coolant and some voiding in the reactor coolant system (RCS).
- Mcwever, the operators recognized the open PORV about 20 minutes into the event (compared with 2 1/2 hours at TMI-2) and responded by cicsing the ?CRV bicek valve and reinitiating high pressure injaction (H?!) ficw.
0 The 08-1 unit has been modified to provide the cperator with a better status of the position of the PORV.
The emergency procedures were also revised and now require the operator to verify that no leak exists at the top of the pressurizer by monitoring the saturation, curve and quench tank pressure and level.
3.
Following racid denressurization of the crassurizar (at TMI-2), the cressurizer level indication may have led to erroneous infarences of high level in the RCS.
This erroneous high level indication a:oarently led the ocerators to crematurely terminate HPI. even throuch voids existed in the RCS.
For the 08-1 LOFW event, the operator also initially terminated HPI due to a high pressurizer level indication; however, the operator recognized the open PORV at 20 minutes and reinitiated HPI at 49 minutes (after failing to control pressurizer level with a second makeup pump).
08-1 procedures have been revised and now require that for all cases in which HPI is initiated, maximum HPI flow is to be maintained unless one of two criteria is met.
These criteria are addressed in Item (d).
4.
Because the containment dces not isolate on HPI initiation (at TMI-2), the hichly radioactive water from the relief valve discharce was cumoed out of containment by the automatic initiation of a transfer cumo.
This water entered the radioactive.aste treatment systam in the auxiliary building
_ o where some of it cverficwed to the floor.
Outg'assing from this water and discharge through the auxiliary building ventilation system and filters was the orincical source of the offsite release of radioactive noble gases.
Containment isolation at 03-1 occurs at either 1600 psig RCS pressure (hPI initiation) or 4 psig containment vessel pressure.
During the 03-1 event, contair. ment isolation signals cccurred and the sump was not pumped outside containment as at TMI-2.
5.
Subsecuently, the HPI system was intermittently coersted (at TMI-2) atta otina to control RCS inventory losses through the PCRV, accarently based on cressurizer level indication.
Due to the cresence of steam and/or noncondensible voids elsewhere in the RCS, this led to a further reduction in crimary coolant ir.vantory.
During the CB-1 event, the operator initially tried to control the pressur-iter level decrease with a second make up pump after closing the ?CRV block valve.
However, after the pressurizer level decreased further he restarted a HPI pump. When the pressurizer level was recovered, he terminated the HPI ficw.
At this time plant parameters were under control and the plant was brought to a stabilized condition.
As indicated in Part 3 above, 03-1 procedures have been revised to require that for all cases in which HPI is initiated, maximum HPI flow is to be maintainad unless one of two criteria is met.
These criteria ars addressed ir.~ tem (c).
.m 6.
Tricaino of reactor coolant pumos during the course of the transient (at TMI-2), to protect acainst puma damage due to cumo vibration, led to fuel damage since voids in the RCS orevented natural circulation.
During the 03-1 incident, two RCP's were tripped to reduce system heat input into the RCS.
One RCP per loop was maintained in operation throughout the incident.
The 0B-1 emergency operating procedures new require keeping at least one RCP per locp running in the event of a small LOCA.
To summarize Item (g) of the Order, the staff views the September 24, 1977 event at 03-1 to have been similar to the TMI-2 event in several ic crtant asp cts.
Scwever, significant differences in plant status and operator respcnse contributed ~n produce a much less severe transient.
The staff
-concludes that satisfactory improvements in both design and emergency pro-cedures have been made since the 03-1 event and, that, the licensee has complied with the requirement of Item (g) of the Order.
CONCLUSION We conclude that the actions described above fulfill the requirements of our Cedar of May 16, 1979 in regard to Paragrapn (1) cf Section IV.
The licenses having met the requicaments of Paragraph (1) may restart 03-1 as proviced by
?arsgesph (2).
Pa.agraph (3) of Section IV of the Cedar remains in force
m
. 3g _
until the long term modifi~ cations set forth in Section II of the Order are completed and approved by the ?!RC.
9
n.
a4%.
e~s s
37 -
-REFERENCES 1.
Letter-from J. H. Taylor (B&W) to R. J. Mattson (NRC) transmitting report entitled, " Evaluation of Transient Behavior and Small, Reactor Cocaint System 3reaks in the 177 Fuel Assembly Plant," dated May 7, 1979.
2.
Letter from J. H. Taylor (SLW) to R. J. Mattson (NRC) transmitting revised Appendix 1, " Natural Circulation in 31W Operating Plants (Revision 1),"
dated May 8, 1979.
- 3.
Letter from J. H. Taylor (B&W) to R. J. Mattson (NRC) transmitting addi-
.tional information regarding Appendix 2, " Steam Generator Tube Thermal Stress Evaluation," to report identified in Item 1 above, dated May 10, 1979.
l 4.
Letter frcm J. H. Taylor (S&W) to R. J. Mattson (NRC), providing an analysis for "Small Break-in the Pressurizer-(PORV) with no Auxiliary Feedwater and Single Failure of t.t.e' ECCS," identified as Supplements 1 and 2 to Section 6.0 of report in Item 1, dated May 12, 1979.
5.-
Letter from J. H. Taylor (BiW) to R. J. Mattson (NRC), providing Supplement-3 to Section 6 of report in Item 1, dated.May 24, 1979.
d 6.
Letter frca Lcwell E. Rce (TECO) to Mr. Rchert W. Reid (NRC) dated ay 22, 1
1979, prcviding Volche III;to Raferanca i for the raised loep plant.
t r
?
--tw-+
..r 4,,,-
.,m--,-m, t-,
,v r
~y
,m
~
o a
33 _
~
7.
Letter from.Lowell E. Roe (TECO) to Mr. R:bart W. Reid (!!RC) dated May 23, 1979.
8.
Letter from Lowell E. Roc (TECO-Serial flo. 517) to Harold R. Denton (OilRR) dated June 15, 1979.
9.
Letter frca lowell E. Rce (TECO) to Mr. Ecbert W. Reid (!;RC) dated December 22, 1978.
.