ML19347E033

Safety Concerns Associated W/Pipe Breaks in BWR Scram Sys

ML19347E033
Person / Time
Site:	Browns Ferry
Issue date:	03/31/1981
From:	Rubin S NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
To:
Shared Package
ML19347E032	List: ML19347E031 ML19347E033
References
NUDOCS 8104140722
Download: ML19347E033 (35)

Text

{{#Wiki_filter:~ SAFETY CONCERHS ASSOCIATED WITH PIPE BREAKS IN THE BWR SCRAM SYSTEM by the OFFICE FOR ANALYSIS AND EVALUATION OF ODERATIONAL DATA March 14A1 Prepared by: Stuart D. Rubin Lead Reactor Systems Engineer i NOTE: This report documents results of studies performed by the Office for Analysis and Evaluation of Operational q Data. The findings and recommendations contained in this report are provided it; support of other onooing NRC activities and do not represent the position or requirements of the responsible program offices of the Nuclear Regulatory Commission. .T 810.4140 722

D f TABLE OF CONTENTS Pace EXECUTIVE

SUMMARY

........................... i

1. I NTRO D UCT I O N............................

1

2. DISCUSSION OF SAFETY CONCERNS.............

3 2.1 B reak Loca ti o n........................ 3 2.2 B re ak I sol a ti o n........................ 4 2.3 Break Di scharge Conditions.................. 6 2.4 Potential Core Consequences.................. 7 2.5 Potential Consequences to the Mitication Systems....... A

3. FINDINGS.............................

11

4. RECOMMENnATIONS.........................

21

5. REFERENCES............................

25 List of Fiaures Figure 2-1 Floor Pl an - 565' El evation.................. 26 2-2 Fl oor Pl a n - 519 ' El evation.................. 27 l 2-3 Break Outside Containment without Isolation (Control Ai r Fail ure).................... 2R l Appendices f A Risk Assessment l ( B Inspection Report for LaSalle County Station l l l

EXECUTIVE

SUMMARY

since the Browns Ferry 3 (BF-3) partial failure to scram of June 28, 1980, the scram discharge volume (SDV) subsyrtem of the BWR scram system has been extensively studied with respect to failure conditions which may cause a loss of scram capability or its protective function. At the same time, while the SDV system has reactor pressure boundary and primary containment bourf ary functions, little if any review effort has been expended to study the safety concerns associated with postulated pipe break failures within the SDV subsystem. Promoted by the seriou3 and fundamental findings of deficiency, dccumented in our original BF-3 event case study investigation, AE00 underteck a more thorough safety review of the adequacy of the scram system design with regard to the reactor coolant boundary and primary containment functions. As a result of this further work, important additional issues and safety concerns have been raised with respect to isolation cJpabilities of the scram system and operation of the emergency core cooling systems for SDV pipe break situations. We have found that, in the event of a SDV system pipe break attendant to a reactor scram, termination of the resultant reactor cociant blcwdown outside primary containment would be dependent on successful closure of non-redundant (scram outlet) valves. The closure principle and design arrangement of these valves do not meet the important requirements for isolation valves described in GDC 54 and 55 of Appendix A to 10 CFR 50. Furthermore, while the break isolation involves a man-machine system, we have found that potentially less than adequate human factor preparation has been provided, given the importance to safety of isolating a break in the SDV system. Additionally, in the event that break isolation is not~ achieved, the current plant emergency operating procedures do not adequately address the potentially concurrent need for maintaining the core covered and protecting against the loss of ECCS equipment due to adverse environmental conditions including flooding.

I - ii - We have found that failure to isolate a SDV system pice break raises sericus concerns regarding the assurance of long-term decay heat removal with emergency core cooling systems since the break itself ootentially threatens operation of this equipment. At the same time, information found from our investigation for the mechanical integrity assurance basis of the SDV system piping indicates that the present level of assurance may not be commensurate with the risks associated with an accidental rupture of this piping. In view of the deficiencies found and issues raised, we have recommended several corrective actions which shoul'1 substantially reduce, althouch not eliminate, the perceived risks associated with a break in the SDV system piping attendant to a reactor scran. In view of these perceive,d risks, we reccomend that the reculatory need to postulate such pipe breaks as part of the BWR desicn basis be determined and standardized. To this end, we would recommend that a two-phase action plan be initiated. The first chase should immediately address and correct the presently inadequate mechanical integrity assurance basis of the SDV system components for operating BWRs. The second phase should incorporate a hign priority safety issue review which will address the need to consider sucn breaks in the design basis and will develop and implement the needed corrective actions on a plant-by-plant basis if it is determined that SDV system breaks are to be included in the plant design basis. i l t l

1. INTRODUCTION Immediately after the Browns Ferry partial failure to scram of June PA, l o RO, the Office for Analysis and Evaluation of Operatioral Data ( AE00) initiated an independent investigation of the event, including the Browns Ferry 3 scram system design, operation and operating characteristics. The principal focus of this investigation centered on the Browns Ferry 3 (BF-3) scram discharge volume (SDV) systen, including its hydraulic operating characteristics import 3nt to reactor scram capability and its prscective function. The report which documented this review also touched uoon the reactor coolant boundary isolation function of the SDV system. As a result of our independent investigation, AECD identified several important deficiencies in the system design and hydraulic characteristics which related principally to the SOY system scram capability and protective functions. The serious and fundamental nature of these findinas made it apparent to AE00 that less than an adecuate systen desien review and regulatory safety review had been made when the SDV systen design was crioinally developed and pronosed for use in operating SWRs. Because of this perception, AECD made the decision to extend its initial analysis and evaluation of the BF-3 scram system to include a more thorough safety assessment of the reactor coolant bcundary and primary containment functions of the SDV system and its appendages. (1) l In the case study report for the Browns Ferry 3 partial failure to scram event, we addressed deficiencies in the isolation capabilities of the BWR scram discharge volume system. We found that during a reactor scran a single active failure (to close) of an SDV system vent valve or drain valve would result in a blowdown of the reactor coolant system (RCS) outside primary containment. For this event, the RCS blowdown could be terminated only if all of the scram discharge valves could be reclosed. This is normally

. accomplished from the control room by manually resettino the reactor protection system (RPS). However, as described in the BF-3 case study report and further expanded in this report, reclosure of the scram outlet valves may not always be possible. For example, many BWR reactor trio conditions do not readily clear or cannot be bypassed in either the SHUTDOW4 or REFUELING mode. These are among many conditions that would normally prevent RPS reset. Thus, a sustained trio condition followinc a scram, such as caused by closure of the MSIVs, would normally prevent isolation of an RCS blowdown throuch a stuck open vcot or drain valve. Thus it was noted in our report that closure of the scram outlet valves via RPS *eset would be blocked by the trio condition itself (which cannot be bypassed in eitner the SHUTDOWN or REFUELING mode). Since the time of our case study investication of the BF-3 event and its cause, we have extended our review to include an assessment of safety concerns associated with single passive failures (i.e., oice break.s) in the SDV system. It is postulated that attendant to a reactor scram a break may occur in the SDV system piping downstream of the scram outlet valves and upstream of the SDV system vent or drain valves. For this break. location automatic closure i of the vent or drain line isolation valves will not terminate the RCS blowdown since these valves are located downstream of the )reak location. In such an event, closure of all scram outlet valves wou!d be the only available ention to prevent an uncontrolled RCS hlowdown outside primary containment.

. 2. DISCllSSION OF SAFETY CONCERNS 2.1 Break Location When a BWR is not in a scrammed state, the scram valves are hcid closed by control air pressure and reactor coolant is retained on the upstream side In this state, the scram valves perform reactor coolant of the closed valves. Downstream boundary (RCB) and primary containment isolation (PCI) functions. of the closed scram outlet valves, the SDV headers are continuously drained The SDV headers (empty), unoressurized (open) and isolated from the RCS. in this state provide a scram capability function in that they provide the flpon required free volume for the reactor water exhausted during a scram, a reactor scram, the scram outlet valves open, the SDV drain and vent valves close and the SDV system pioino fills and pressurizes as it accepts., contains, and limits the water exhausted from the reactor through the control rod drives (CRDs). Even after the control rods have fully inserted, (with the scram valves left open), reactor coolant continues to flow past the CRD seals, through the scram outlet valves and into the SDV system piping pressurizino Therefore, durino and immediately following it to full reactor pressure. a scram the SDV system becomes the reactor coolant retainina boundary well outside of primary containment. After completion of a scram, therefore, the SDV system having fulfilled its scram capability function, assumes a reactor coolant boundary function and a primary containment isolation function. It is during this fully pressurized state of the SDV system that we have examined the potential safety concerns associated with a break in the SDV system piping. The pipe break is postulated to be a high energy break in any size line in the system and initiated by the pressure, temperature and other loadings attendant to the reactor scram but not, necessarily, considered in the mechanical design basis of the SDV system.

~ .4-2.2 Break Isolation From a system's viewpoint, the blowdown of the postulated break into the reactor building (secondary containment where the SDV system piping is located) could be terminated via manual control room operator action by initiating group closure of the scram outlet valves. This action requires the ability to manually reset the RPS (which requires RPS power and an absence of trip conditions) and the availability of control air supply. However, group closure of the scram outlet valves has not heretofore been defined as a required safety function. Accordingly, the systems (includino control air supply) upon which operation of the scram outlet valves is dependent have not been desianed to assure reliable closure of these valves. Thus, isolation of a postulated break in the SDV portion of the RCB which lies outside primary containment and downstream of the hydraulic control units (HCUs) cannot presently be reliably assured, at least to t e degree inherent in other RCB pipes N incorporating qualified isolation valve desians and arrangements. Al though the scram outlet valves incorporate a relatively leak resistant design, there are numerous disabling conditions consequential to the trip condition or pipe break, as well as numerous disabling single failures in the RPS and control air systems, which could temporarily or permanently prevent successful reclosure of these valves following a scram. For example, such conditions as (1) a loss of control air pressure for any reason, (2) a trip condition which cannot be bypassed in either the SHilTDOWN or REFUELING mode or (3) a total loss of RPS power supply would prevent group reclosure of the scram outlet valves. Also, unlike qualified RCB or PCI isolation valves, the scram outlet valves do not incorporate an automatic closure feature. The absence. of an auto closure feature is clearly necessitated by the need for a reliable scram function which must not be automatically overridden under any circumstances. , - - - + - e.

5-The net effect is that scram valve group closure is a manual operation which must be remotely actuated by the operator from one of the control room consoles. Even under such circumstances, closure is precluded by a time delay relay for a minimum of ten seconds. This is to prevent the control room operator from interfering with, or prematurely terminating scram insertion of control rods. Thus, isolation of a break in the SDV system piping with the current design of the scram valve closure apparatus of necessity involves the human factor; that is, the isolation system for a postulated break in the SDV system piping can be characterized as a " man-machine" system. I A review of the " man" side of the man-machine SDV break isolation arranoement indicates potentially less than adequate human-factor preparation. There are no qualified SDV system break detection instruments for the operator to rely upon to quickly identify the presence of a break in the SDV system piping. Typically, BWRs like Browns Ferry-3 have reactor building radiation monitors located in the CRD-HCU areas. However, their operability and calibration are not presently included in plant Technical Specification requirements as are other radiation monitoring instruments in the plant. Additionally, depending on the sensor positions and their sensitivity, these instruments l may annunciate for every reactor scram, regardless of whether a break were present or not. Furthermore, the control room operator has not been provided with special emergency operating procedures or training to quickly and l appropriately respond to SDV system pipe break symptoms which would accompany l normal post-reactor trip control room indications and activities. Additionally, should immediate reclosure of the scram valves not be possible there are no emergency operating procedures or operator training provided to aid the operator in diagnosing and correcting the source of failure in attaining RPS reset and/or recovering from a loss of control air supply. Continued blowdown i of hot reactor water past the scram valves may also degrade and eventually disintegrate their teflon seating surface which could eventually eliminate the primary means of break isolation. 9 a--,,-- ,.--wy- ..---,,,-m---,..-..y..-,4--. -ry.p,y-,- p-p, e-ac4 4 4% ~.. _ _gmy--- mg-.. sw w wy-w, w-- 7 ,--9 -se

r, - A local manual isolation valve is provided in series with each remote air-operated scram outlet valve on each HCU. However, dispatching an auxiliary operator to enter the reactor buildina to manually close each of these valves would be extremely unlikely, given the harsh environmental conditions including hot water blowdown, high radiation and possible loss Sf lightino or visibility in the area of the reactor buildina where the postulated break is located. Therefore, for both equipment-related and procedural-related reasons, isolation of a break in the SDV system attendant to a reactor scram may not be reliably assured. 2.3 Break Discharge Conditions One should expect that failure to close the remote air-operated scram outlet valves or the local manual isolation valves would result in a considerable blowdown rate out of the reactor coolant system directly into the reactor buildina secondary containment. The blowdown rate would be limited only by either the combined control rod drive seal leakage from all drives manifolded by the SDV headers (via the 3/4 inch Schedule A0 scram exhaust risers on l each drive) or by the postulated SDV system pipe break size and location. Currently, there is no Technical Specification limit for CRD seal leakage i ra te. However, seal leak rate (stall) testing at the BF-3 site after the I June 28, 1980 control rod insertion failure indicated that the average CRD seal leak rate (with approximately 250 psi pressure differential across the seals) could be about a 3 gpm per drive. Furthermore, the General Electric (2) Company technical manual used for CRD operation, maintenance and testing recommends that seals be rebuilt when seal leakage exceeds 5 gpm. Thus, for l AS CRDs initial cumulative seal leakace could he anywhere from about 650 cpm to 000 com assumino a 7.50 psi pressure differential across the seal s. Continued blowdown of hot reactor water through the CRDs would likely t

. degrade the CRD seals as a result of flashina and cavitation and seal heat-up caused by hot pressurized water flowing past the seals. (This effect might be similar to reactor coolant pump seal degradation following a loss of seal coolino injection flow.) Thus, the CRD blowdown rate, as initially limited by intact seals, might be expected to increase with time from the magnitudes Reactor system pressure, CRD seal condition, the actual differential cited above. pressure across the seals, line losses and the break size / location in the SDV piping system, would ultimately set the blowdown rate in the lona term. 2.4 Potential Core Consecuences The anticipated cumulative seal leakage would be expected to be well within the makeup capacity of the high pressure coolant injection (HPCI) systen If the HPCI or possibly the reactor core isolation cooling (RCIC) system. system was unavailable, the automatic depressurization system ( ADS) in conjunction with either of the core spray (CS) systems or the low pressure coolant in.iection (LPCI) subsystem of the residual heat removal (RHR) system could provide ample alternate makeup. Thus, as far as peak cladding temperature, maximum cladding oxidation, maximum hydrogen generation, and coolable geometry criteria are concerned, an unisolated break in the SDV system may not be of concern during the initial mitigation phases of the event. It is, however, with respect to the continued long-term core cooling requirements and the availability of emergency makeup systems over the long term, that such an unisolated break provides unique ECCS challenges and uncertainties. Thus, it is with respect to long-term decay heat removal and maintaining the core covered that potentially serious public health and safety questions arise. A break in the SDV system without isolation is equivalent to a small unisolated break in the bottom of the reactor vessel. For this case, the c0re shroud

. and jet pump diffuser nozzles cannot provide their usual protection against a relatively rapid coolant loss and level drop above the core attendant to a temporary loss of makeup supply. This is unlike the case for even the largest postulated break in a recirculation line. Furthermore, even primary containment flooding (assuming water supply and pumps were available) would not assure long-term core coverage since the break would essentially be in the bottom of the vessel but located outside the primary containment structure. Accordingly, a source of makeup water and adeouate pumping capability must be maintained available indefinitely or until such time that some means of break isolation can be provided. However, because of the unique location of this unisolated break, long term cooling may not be assured. For an unisolated break in the SDV system, reactor coolant would continue to be lost out the reactor system without accumulating in the drywell-torus which is the normal reservoir for water for long term coolina. Reactor water discharged directly into the. reactor building would collect on the floor and be carried down through the open floor drains and other open passageways of the reactor building to the basement of the buildino. Once there, it would collect in the dirty radwaste (DRW) sumps located in the reactor building I basement corner rooms. Water collected there would normally be pumped out of tha secondary containment by two small capacity, (50 gpm) sump pumps and enter the DRW liquid waste collection system tanks. This water lost l from the reactor would not normally be suitable or available for return to the reactor. 2.5 Potential Consecuences to the Mitigation Systems The reactor building layout for BF-3 incorporates large stairwell openings (identified by circles in Figure 2-1) in three of the four corners of the 1

-g_ 565-foot elevation, where the SDV headers are located. The stair steps are open-lattice metal gratings which would permit hot water to cascade directly down to the basement floor. There are no curbs at the stairwell entrances. Any water not removed by the floor drains on the 565-feet elevation floor will run over to the stairwells and flow directly into the basement. Located in the basement at these corners (see circles in Figure 2-2) are the RHR system pumps and the CS system pumps. Thus these low pressure makeup systems might be quickly disabled by the effects of water cascading into the corner rooms and by the flashing of hot water. In this way, a Dreak in the SDV system could result in the loss of most if not all of the low pressure emergency core cooling pumps shortly after the break occurred. Qualification of this equipment for operation under such environmental conditions clearly would be questionable. Additionally, the RCIC pump is located in the same roon with one train of the CS pumps and the HPCI pump is located in a room which is adjacent to one train of the RHR pumps and would, therefore, also be subject to severe environmental conditions including flooding. The control rod drive pumps are located on a platform above one train of the CS pumps and would be similarly involved in the adverse environmental conditions. The fourth corner of the reactor building basement contains an elevator shaft instead of a stairwell which should provide temporary protection against immediate damage to one train of the residual heat removal system, although the environment would degrade quickly. If break isolation is not successful, the blowdown rate into the reactor building (which could be in excess of 1,000 cpm) would substantially exceed the total capacity of the sump pumps (which is approximately 100 cpm). Even if the sump pumps initially were capable of removing the reactor water being collected in the sumps, assurance of continued water removal from the sump

, cannot be provided indefinitely for continued SDV system blowdown. An unarrested blowdown would eventually challenge the operability of the sump pumps and their electrical circuits with environmental conditions for which they were not desianed. For example, for BF 1 the sump pumps are powered by the 3C 490V reactor buildina MOV boards which are immediately adjacent to the HCUs on the 565 feet elevation. Furthermore, these pumps and their power supplies would not be readily accessible by maintenance personnel niven the harsh environmental conditions in the reactor building. The pumps are not supplied with emeroency onsite power. Thus it appears likely that all of the ECCS pumps in the basement would eventually be lost by floodina if the break were not isolated. Clearly, the unavailability of either qualified bich or Inw pressure makeup coupled with an unisolated break in the bottom of the vessel would result in a continuing drop in water level over the core and eventual enre uncovery. An integrated pictorial overview of the concerns expressed in this section is provided in Fiqure 2-3. Appendix A contains an estimate of the risk associated with a pipe break in the SDV system.

. 3. FINDINGS 3.1 During a BWR reactor scram, the SDV system piping becomes an extension of the reactor coolant boundary outside primary containment. During this (scram) condition, only non-redundant (scram outlet) valves protect acainst an uncontrolled blowdown of the reactor coolant which could arise from a postulated pipe break in the SDV system piping. As discussed previously, during a reactor scram the boundary of the reactor coolant system is extended beyond the scram outlet valves to the SDV system piping which accepts, contains, and limits the high oressure reactor water exhausted during a scram. The SDV system piping would normally pressurize to full reactor pressure unless the scram outlet valves are reclosed immediately after full control red insertion. Isolation of a postulated break in the SDV piping during a reactor scram would depend upon successful reclosure of each of the scram outlet valves. There is only one such valve in the flow path from each of the 185 control rod drives to the postulated break. This single " isolation" valve arrangement appears to violate those portions of General Design Criteria 54 and 55 of Appendix A to 10 CFR 50 which require that reactor coolant pressure boundary piping systems penetrating primary containment he provided with redundant isolation and containment capabilities which reflect the importance to safety of isolating these piping systems. Clearly, the use of a single isolation (scram) valve does not meet these criteria for the containment isolation function. It is equally clear, however, i e

- that the use of an additional redundant automatic " isolation" valve in the scram discharge (riser) line would adversely impact the r liability of the scram function aspect of the lines. Thus, while opening only a single valve (to cause a rod to scram) is clearly desirable from a scram function reliability viewpoint, the availability of only a single valve (to isolate a break in the SDV system piping) is clearly equally undesirable (if not unacceptable) from a containment isolation function reliability viewpoint. Implici tly, it may be concluded from the single scram outlet valve arrangement that the overriding need for a highly reliable scram function has taken precedence over (and at the expense of) the reliability of the containment (and break) isolation function. 3.2 The non-redundant (scram outlet) valves do not utilize a closure principle or orovide a design arrangement with a reliability reflecting the importance of isolating a postulated pipe break. i The use of scram outlet valves for reliable isolation of a postulated break in the SDV system piping attendant to a reactor scram appears to violate those portions of. General Design Criteria 54 and 55 of Appendix A to 10 CFR 50 which require that reactor coolant pressure boundary piping systems penetrating ( primary reactor containment be provided with reliable isolation and containment capabilities which reflect the importance to safety of isolating these systems. As noted earlier, group closure of the scram outlet valves has not heretofore been defined as a required safety function. Accordingly, the systems upon which scram outlet valve operation is dependent have not been designed with features to assure reliable closure of these valves.

13 - Reliable group opening of these valves has been established as a required Because of the need safety function, to assure a reliable scram function. for a reliable scram, the reactor protection and control air systems have been designed such that the numerous possible failure states of either of these systems would cause the scram outlet valves to open, which is in the " fail safe" direction for scram function reliability. Conversely, the same possible failure (loss of) modes of these two systems have the opposite impact on the reliability of the valves in the qroup closure sense. That is, the list of possible active and passive failure states of the reactor protection and control air systems which will cause the scram valves to open also represents the list of possible common failure modes which would prevent group closure of the scram outlet valves when reactor coolant boundary intearity and containment isolation are needed. Some of these common failure causes are readily correctable thereby pemitting relatively prompt remote manual aroup reclosure of these valves, e.o., a reactor trip condition which can be quickly bypassed in either the SHUTDOWN or REFUELING mode. Other causes would not be correctable even in the lona term, e.g., rupture of a copoer tubing control air line caused by a postulated high energy-(pipe whip) type break in the SDV system piping or a seismic Access to the source of failure for repair likely would be precluded i event. by the harsh environmental conditions created by the break. Thus, the reactor coolant blowdown would not be considered terminatable by reclosure of the scram outlet valves. l l l

- la - 3.3 The reliability of ecuipment currently installed and the capability of SDV system pipe break detection is neither commensurate with the needed reliability for break isolation nor reflective of the potential consecuences of a rupture of the SDV system piping. Typically, BWR plants like BF-3 have radiation monitors located in each of the CRD-HCU areas c' the reactor buildino. However, this instrumentation is not safety crada nor is it supported by Technical Specification operability and trip setpoint (calibration check) requirements. These instruments are also of a sinale channel desion. The reactor buildino does have reliable hiqh radiation monitors in the various zones of the ventilation system exhaust duct work. These zone radiation monitors are used for automatic zone isolation of the reactor buildino and for automatic initiation of the standby cas treatment system. The operability and trip set point of these instruments are covered by Technical Specification operability and calioration check requirements. However, these instruments are not sufficiently close to the CRD-HCUs and SDV headers to provide reliable and unambiguous detection of breaks in this equipment. Accordingly, we find that the reliability of the current break detection function of the overall " man-machine" arrancement for SDV break isolation cannot he assured to the decree which would normally be recuired of a primary containment or a reactor coolant pressure boundary isolation sy stem. Operator action to initiate manual reclosure of the scram outlet valves in the event of an SDV system break wouln be uncertain.

. 3.4 A postulated break in the SDV system pipino durino a reactor scram with a failure to reclose the scram outlet valves would result in an uncontrolled reactor coolant blowdown outside primary containment which could threaten the ECC systems and the availability of makeup water required for lona-term core cooling. As previously discussed, since the SDV system piping is located in the reactor building and outside primary containment, a postulated break there would result in a reactor coolant blowdown outside primary containment (unless the scram outlet valves are reclosed). Furthermore, since the SDV pipino is below the level of the core and drains from inside the core shroud, reactor hot water could continuously drain out of the reactor vessel and onto the floor of the reactor building. Additionally, an unisolated SDV break inside the reactor building would also, sooner or certainly later, threaten the operability of the emergency core cooling systems required for mitigation since the ECC system pumps are located in the basement of the building. The adverse environmental conditions created by the hot water break, together with potential flooding conditions, would make operability of this egyipment questionable before very long. Moreover, the water lost from the reactor coolant system would be unavailable to the normal heat removal recirculation flow path (i.e., torus, low pressure ECC system and return to vessel) required for long-term cooling. Accordingly, unless the water which is lost from the RCS can be returned to the condensate storage tank (for return to the vessel), all normal ECCS inventory eventually will be depleted. At this point, an alternate makeup source would have to be provided if pumps were still available to deliver the water to the reactor vessel. l

. 3.; A break in one or more control rod drive scram exhaust lines located upstree.n of the scram outlet valves and outside primary containment would result in an unisolatable bicwdown of reactor coolant outside of primary containment even if all scram outlet valves were closed. Except for the manual isolation valves immediately upstream and downstream of the scram outlet valves, there are no valves in the scram exhaust lines between the CRDs and the SDV which could be closed to isolate a break. Thus, should one or more of the 3/A inch Schedule An exhaust lines rupture upstream of tne scram outlet valves and outsine primary containment, closino these valves would not isolate the break. Furthermore, since the subject piping is below the level of the core and drains from inside the core shroud, hot reactor water would continucusly drain out of the reactor vessel and onto the floor of the reactor buildino. It should be noted that this situation is different, for example, frcm the small diameter BWR transversino incore probe (TIP) system instrument lines which also penetrate the bottom of the reactor vessel. The TID lines do incorporate redundant and diverse isolation valves immediately outside the drywell to provide isolation protection. Break isolation of the scram exhaust lines is also different from the situation for ruptured PWR steam cenerator tubes. For this case, leaks through the ruptured tubes (which would place the lost reactor coolant outside containment) can be conveniently terminated by draining the primary system down to a level exposino the break elevation of the tubes. The lowest elevation o', the tubes is still well above the l l top of the core; thus, the break flow can always be terminated eventually. Since all of the BWR scram exhaust pipino (and SDV system pipino) is well helow the Core elevation, drainino the RCS to uncover and thereby terminate the break flow from the botta9 of the reactor vessel would not be possible.

. The CRD seal leakage flow passing through a single scram exhaust line could range between 3 gpm and 5 gpm immediately after the break to about 12 gpm after CRD seal degradation (assuming a 250 psi pressure differential). The flow would be considerably higher for a larger pressure differential which might be the case for breaks immediately outside primary containment. Thus, rupturing only a few of these lines could quickly result in a cumulative break flow which would exceed the capacity of the two 50 gpm sump pumps in I the reactor building basement. Although a single passive failure might legitimately be postulated for any pipe in the reactor coolant boundary (including a scram exhaust line), no SDV system pipe break is thought to concurrently involve the rupture of several exhaust lines. Multiple line failures might occur, however, due to such causes as large high energy pipe breaks, sabotage or interaction with heavy equipment (e.g., fuel shipping railroad cars) in the vicinity of the hydraulic control units in the reactor builoing. 3.6 The assurance provided by the industry codes and vendor quality assu ance programs for the mechanical design, fabrication, installation, testing and inspection of the SDV system piping do not appear to be commensurate with the risks associated with an accidental rupture of this piping without i solation. As discussed previously, a break in the SDV system piping without isolation could result in severe consequences including possible core uncovery since the break might threaten continued operability of the emergency core cooling l systems and the availability of makeup water. Additionally, the reliability of the break isolation arrangement upon which prompt mitigation of the event would be dependent, is considered to be less than adequate. Under such circumstances it would appear to be appropriate to compensate, in part,

. for these systems-related deficiencies and safety concerns by providing a higher degree of assurance for the mechanical integrity of the SDV system piping during the life of the plant. A review of the current basis for assuring mechanical integrity of the SDV system piping shows that this assurance is not commensurate with the possible consequences associated with a postulated bresk in this piping. For most of the operating BWRs (i.e., those for which the SDV system mechanical design was initiated before about 1971), the SDV piping system was prcbably designed, fabricated, installed and inspected to the requirements of USA Standard Code for Pressure Piping-Power Piping,USAS, 831.1. This code did not provide for a detailed quelity assurance program for design, fabricetion ind construction. Also, piping systems for use in water service and built in accordance with B31.1 were not required to have volumetric examinations of welds except for those with nominal wall thickness greater than 1-5/8 inches. Pipes of one to two inches in diameter such as drain, vent and instrument lines were not required to have examinations. The Section III ASME B&PV Code rules for Class 2 components were available in 1971. Plants granted a construction permit from 1971 through 1973 would probably have been specified to construct the SDV system piping to the Class 2 rules rather than 831.1, but it could vary depending upon the order date for the component. The B31.1 and Class 2 rules are similar and nether requires a thermal fatigue analysis (thermal expansion fatigue by anchors is included).

. The Browns Ferry-3 SDV system was constructed by Reactor Controls, Inc. (RCI) of San Jose, California. From conversations with RCI representatives, it has been learned that most operating BWR/3 and BWR/4 SDV systems (including the CRD-HCU piping networks) were constructed by RCI. More recently, RCI has expanded its scope of supply to include the mechanical engineering design and analysis of the SDV systems. The SDV systems.for BWR plants now under construction would be built to the ASME B&PV Code, Section III, Subsection HC rules,for Class 2 Components. The Code requires that this work be done in accordance with the quality assurance requirements of ASME Section III Article NCA-4000. However, examination of the construction deficiency report for LaSalle County Station (see Appendix B) shows that contrary to these requirements, " Reactor Controls, Inc., (designer and installer of portions of the Control Rod Drive System) did not have a OA/0C program that addressed the areas of... design control,... and detailed implementing procedures for design, installation, and inspection activities." From this inspection report it may be inferred that most operating BWR SDV systems were not constructed to the high quality assurance standards now considered to be appropriate and reflective of the potential consequences associated with an accidental rupture of this piping without isolation. Finally, inservice inspection of SDV components built to Section III would be conducted in accordance with the ASME B&PV Code, Section XI, Subsection IWC rules for Class 2 components. Section XI rules would, most likely, also be followed for SDV components constructed to B31.1 rules because Section 50.55a of 10 CFR Part 50 requires periodic updating of inservice inspection programs for each plant. The CRD scram exhaust risers and the SDV vent and drain lines could be exempted from examination because they are smaller ~ -.

. than the 4" diameter exemption provided in the Code. The SDV header should not be exempted on either size or pressure considerations, but it is not apparent that all plants include the header in their inservice inspection One argument that might be used to explain why the header is not program. included is that there is no need to examine the larger pipe because the maximum break flow is limited by the flow from a single 3/4 inch scram exhaust ri ser. If the header is exempted by this reasoning, then the only inservice inspection required by the Code would be the system pressure test once every 3-1/3 years and the system hydrostatic test once every ten years. I 4 e 9

. 4 RECOMMENDATIONS 1. Require that the CRD-HCU exhaust lines and SDV system piping meet the highest standards for design, fabrication, installation, testing, inservice inspection and quality assurance which can he reasonably attained. In view of the potentially serious consequences associated with pipe breaks in the SDV systen without isolation and the significant difficulty and issues involved in improving break isolation reliability, it would appear most appropriate to first assure that the probability of an SDV system pipe break has been adequately minimized. However, from our investigation we found that the level of mechanical integrity assurance presently provided for the life of the plant is significantly deficient. We, therefore, recommend that a thorough re-review of the mechanical design, fabrication, installation, testing, inservice inspection and quality assurance standards and requirements which were applied to the existing CRD-HCU and SDV systems be undertaken with the intention of evaluatinq their adequacy and upgrading as necessary and practicable. Requiring a complete faticue analysis and a more extensive and frequent inservice inspection of the small diameter piping welds for the existino SUV systems are examples of possible improvements in these areas. We also recommend that the results of the actual work performed in these areas for all operating BWRs be thoroughly re-reviewed and re-performed as necessary to assure that the mechanical integrity requirements are met and that the current bases are acceptable. Finally we recommend that these standards he applied to future RWR CRD-HCll exhaust and Snv systems.

~ . 2. Assure that reliable and redundant break detection instruments such as temoerature, humidity, or radiation monitors are provided in the immediate vicinity of the HCUs and SDV system piping. An important component of the SOY system " man-machine" break isolation arrangement is reliable break detection. Accordingly, it is recommended that reliable (safety grade) break detection instruments be installed in the immediate area of the control rod drive HCUs and SDV system piping. Detection based on high radiation, temperature, and/or humidity conditions may be used for this purpose. These instruments should be covered by Technical Specification setpoint and operability requirements and should be annunciated in the control room. They should be redundant. To preclude a single failure from disabling the detection link in the man-machine isolation arrangement. Appropriate consideration should be given to adequate environmental qualification. Only with such break detection instruments can reliable and timely break diagnosis and actions by the operator be assured.

3. Develop and implement appropriate emergency operating procedures and operator training for postulated breaks in the CRD insert or exhaust piping or the SDV system pipino.

Training provided should familiarize the control room operator with SDV break symptoms, indications, and diagnosis. The emergency procedures developed should require immediate reclosure of the scram outlet valvas upon a detected break in the SDV system piping. Emergency operating procedures should include all available mitigation steps if timely reclosure of the scram outlet valves cannot be accomplished. The procedures should be supported by appropriate analyses to demonstrate the most approcriate course of action (e.g., possibly

- R3 - depressurizing the reactor via the ARVs to reduce the CRD blowdown rate). Subsequent actions required to er '.'se the scram outlet valves should be developed and provided. Procedures a,$d trainino required for long-term recovery .ot be reclosed for an indefinite period should if the scram outlet valver be developed and implemented. These procedures should include steps to prevent or delay the possible eventual loss of all ECCS by flooding or environmental damace. Finally, consideration should he af ven to any special emergency procedures and trainino which may be recuired to terminate a reactor coolant blowdown which cannot be isolated by the scram outlet or manual isolation valves because of break location, environmental conditions or valve failure.

4. Consider improving the closure reliability of the scram outlet valves.

Various ways should be studied for imoroving the closure reliability of the scram outlet valves. Such studies should examine concepts for improving the reliability of control air supply (e.g., accurulators) and AC power supply (e.g., individual alternate temporary energency power supply hookups) to the solenoid scram pilot valve's. Any proposed improvements in closure reliability should carefully consider the possible negative impacts on scran reliability. 5. Prior to the initiation of any pressure boundary maintenance on the 50V system pioings, recuire the manual isolation valve for each scram exhaust riser be closed; and before subsecuent startuo, reouf re appropriate verification that the manual valves are recoened. SDV pressure houndary maintenance or modification activities may not be precluded by Technical Specifications from being performed in any reactor mode. However, such activities would normally be expected to take place durino periods when the reactor is in either SHUTDOWN or REFUELING mode. Activities which result in a loss of SDV pressure boundary intenrity minht be cerformed with only the scram outlet valves closed to isolate the 50V system pipine from the

. reactor coolant. Maintenance or modification procedures may not require that the HCU manual isolation valves also be closed. If the manual valves are not closed, the scram outlet valves would be maintained closed with both RPS channels energized and control air pressure applied to each of the scram valve actuators. Under such circumstances, should a RPS trip condition f or loss of RPS power) or a loss of control air occur, an uncontrolled loss of reactor coolant outside primary containment would result if the SDV pressure boundary were open at that time. Dependino upon the circumstances, reclosure of the scram outlet valves 9ay not be readily achievable. Accordinoly, to protect acainst such an uncontrolled loss of coolant, it is essential that manual closure of the manual isolation valves be required. It should also be noted that opening the SDV system manual flush valves without an operator remaining on standby to assure immedfa'.e reciosing, i# needed, is another pressure boundary maintenance which requires similar treatment. 6. For plants to be constructed consider locating the 50V system headers and HCOs at an elevation in the reactor building which would olace them above the top of the reactor core. By routing the CRD piping to and from the HCUs and SOY headers to.a level above the top of the reactor core, the possibility of an unisolatable break which could drain reactor coolart from below the core would be substantially reduced. It would still be possible for an individual CR0 insert or withdraw (scram outlet) line to break below the core level inside the primary containment. However, only a break outside containment above the level of the top of the core could be cross connected by the flow contribution of all of the scram exhaust if nes. Thus, with this arrannement it would be possible to terminate a break in the SDV. system by bringinq reactor systen pressure down to atmospheric condi tions. Reactor water would not be able to drain outside prinary containment to below the level of the top of the core.

. 5. REFERENCES 1. " Report on the Browns Ferry 3 Partial Failure to Scram Event on June 28,1980," July 30,1980, Office for Analysis and Evaluation of Operational Data, USNRC. 2. " Operation and Maintenance Instructions Control Rod Drive System for Browns Ferry Nuclear Plant," GER-9585/9586, June 1971. 1

e 76 - -w, I, .S--*,.. .. l. J t,. - .i N ' ". M, ds.k,2 w,j .=_ D g e a t %bc-I ( '.,.,

p-m.. ~*

3

.t i

s, i, ,B. l j ,'i'l:F.-"'.%.., ,m. [ R. Ei o n mu,,. o ., o. p nmi-n .i

m. q.

i b._ l*Q@a i s ] ', Q *Q - T.;. .. - g *i - - p'.J llp! ::Q C1 - i1 y p y < :a d: :[: .. A),-: {,. ? 4: 2;- .a ....n. p" e . u.. .I I,-- l. t F h t c'i pI) g

it

-i i

ti

NI a 4 t p- ~ 4

j h,i I, [;

k_,,t l j- < [ 8 L.,t.,' o

• s c :s a

1 li

• C.---}f Q}j,'__.f4 M.-, l}I4 h _,. L. :

i. . _[ 44M.-. = .. so 't. a - i y.n y~ ' "ll @,. k : r.,- m N i oi .r ~

b. Wj r-srT gnj,x.rJ.e, b e -

i.! - i, L r. 3 :,a, , g4 : t.; a

o

! M jd '[ L h.ll:w. A J ' ; 4L{M. W if,t1hl e l IN Ni fi .Q I I. . f j ',,, c ' .h u , y ",:fj '.; 1 4 - Y: r.i ..e 1,. >' i =.. m m.: n.I3.. - i(s. r %. 31.e.l d, i h

s....

,7Ca D , I, h,. "ll' \\Y*l , pZ...... " 1*T..d.ni r] l1 r,..!l t s A "" (.

ce,

.I l % ; ' _p 1 }' & 1", p* '

)

i .D 1 s. g m y

• • w

'L.,

x D I, 5 i.. wt I 1. <ei:n N . w,- - 4:...,:. , i e.. t jr l w: i.<, s. {. s s. hk. l h .h ., i d

i ";13 Hl [

f ' -9.1./

,/, t ( !! {\\ t i t r. l- =.1 Ei .y s,,. , : s-l =. : s, a, t. e i 'da 4 p < t,i /, s, l]* 8HQi. lr. f i 6 e t ' j " -{, f" 67.. l ii l g[, u q. i i e l s' l' N s s [- q- -+ 4.ir.i-i i i I u- ! r '* i l, st ;a, t., _. > [, 3.w. v. + i t o:, f..-i ,6 ,h'4: L-s_ E D <.f . 43 r iO

• A

'. t..%1t.] '4I -5 s '- 5 P '{, - l. i m 3 s ' ]' + c.~. .r$ !9

' ! -[ ' kN

. tj(J \\l N, J b W i M-(!fT'- -h, w! 4!h i

k..E'-!

,l 4,j l ' ' t. 3. . p..,d.[., - ['.'l Z I gfl m! i m t. .< r ,/'u l,; fi i y I $1. ]:,(j e Eri **. t F i3: t.. 1 "J g-4,,,,, /- c. i. 3, 4i r> [_~~, p"._'../ e ; A.. I', .1 - '.-.j.i i....- f f. g e

y

-i .r.. r.6,-,. c,. e .,t.,,.'.,_,_,, _._._.,.3. D l o i bj --..

ns

?.',.. i 4- ' J ! ' -- i.p') ' 10 J 4 \\ q i,.;,;,__ _. q...[, .t._.__ n_, -. _ i __' - r., t.f r,-JC. .e c.... _,m _-~q.. t: p ~ -,. m, g<-~~i(g,a.._ k.

• • y{Ng
• I

.. w.e n j m n _,J :.. i /. I, l Ij 4: 2 "- p iM - .W il g 5,11 - di-y. .I r 4, 1.. .c. i l i 3. *. l 1 \\ $ '5: l'i l f.' d.

• p I8;. i*n.

4, 3 s,, i s v i F ";f l l.:..;._l..~3 I t p')~i \\ Figure 2-1 Floor Plan -565' Elevation P00R DRIGINAL

. + UNIT 2 ru. Bf9) (r; .ni 19319* Y r r.o

• I y $ *.,9*

r {[ f _ s-e,* ** *

• a<er

, co e ar.vseo 7 y.,,,,,,,,,,, l e g m - Q_ . -. m y,.;.,.. - _ "d.y f'.e.4 i i~ - 1i* i f,, ., "j / O 7(t.u N., i <.. Q 'W; l r 7 Q, C r/s er ar, s.-o ' l. g %l%r.' j l .* Q /, ~ x - s . ~, v.:pe rw a l '<y,hl i' ~ / g, 2 u >* d , /- ..'J* 2

,,, sare,

\\, Gj s.,, s'. N '., : ;i / s ,:. na <i,,,,. -

I c

.\\ n e.a.,n za , '\\ j I,/ / \\ \\ 'l l / 1-i f M.cs ,/

• _,,, g orac roo l4

?!st s' s ,rn 3 'l g[g j i

• j I

_ 0* -- e i t s, i ,r n s ra,.,,,.s \\ i ,',

• Fa p.a.o 14

=

f. -

N' l / .i s \\ 4 ] k' ; . s'.s \\\\ pr

.v, w e, /

g ./. rs .y - Q c.w,,<<. a /: t &+,, ,v? ,,c. --,..< o.~au x. e-r.. ~ s,(*.. =... y ow*,

-r c

n*ss /m, . ;o - ... n

• Tii.1__o, '\\

/. l .)e L. l ' l t we' m .i g, -- _ _ _ _ ._. _. L -. ein ]. I _u. -4,.... ., a -Q \\ oci r.,~- s I F.,,- ,- l, g' _ _g _._a_- s..,.,.- ij 21 g CL!N -EL S/3 O A Figure 2-2 Floor Plan - 519' Elevation 1 P00R ORIGINAL l -. _..

H z . ?*. w E z. H s!< s!. z z a== . s= o o

• 55$

U

• L$$ - d=%

Q P 77vi f4v8 W< 22<> s2<2 OJ - s s>- w>g mi mi i3o i 5 r m - U h b) b g O 'i m e e ^ 20 1 5 2 3 <= 5 4 wp : 1 ( c e-s- i i m3 4 f4 I 53 E e<f ETEh ~ a es e r5 rest 333.E-I i l _i, l c 25., s.m.; s'l 39***

• • • • 2

= !i i I t. 3 1 4 ~ 1 1

s r

dN? b i f f{ f' 4 i W@y; j i jr N e i II l3 l I

1. j*

i' t 13 b,, >, [O, J 'm. e i I li 1 ( ll t i l d-3NNd^'c - ; i s._ w .m. m g,. e 1, hz [bb. khkf i I, l ; 1:$f 5".t <r h.. .,iiI III i - s y' ' t-W.6 ~ -7 "*- - y' E' '-- as i i l I g i b.:,, m; w i;L' l bxf( er i r F j I S{ f I ij j

w 4

l

i. m*:qeM ra L

t ~ w't a. M r ~ .b L k} k Tit l I T 3..'es ? k[<- g g . nJN SN' N / am jl --2h P i('l l ), L's.h l h f I l g {.' I. 1 b, - t} - -.' _J s. 1 *3 - -.n' n = e h:a '}' '.. E : I e., } i g p: y I r i# i g s r c , o .d 6 z: s .~ f 2 'j; z" 'Ns 9 : l_, a s g y os t y t :. T T s. O ? 14 D. _2 . [: =s, z e, ; 1: u z I- <3=j =!=y 4,5

s s.

<=,- t ., [ k. IE, E-$ IM'S f }l$i 7 l t N, =. i Qk"&^: $ <7l... .i _ -i g ~

$5%

=j/ 2 5 K: g!) ic u s = 2 I 4 j

• .2 5 15 1

j g,p-4.l_

q n ':

g e l '.c,N' N t v i / get/ l = ,\\ ~ 14 F i N:- c i s I 7f [ '4.) Q l j i i j &; $4' ; M

MS!

!.y 4.:y. e4 5:

s

%e / 2/ 4 g : Ns(c. m'9', z s s I' / 1I -P t; p e gf 25 iC g/ : y~ R4';' z 5i

?

$ 3 ff iD_ " !.(,',0 [: E.3-

IMR

{2.it 6-r q - (OMNi i le$" _hi [- W. t3 ', N1,' I A s s ' c N;; o uy o s _.s_unsu. sus s , s s susamwo s P00R ORIGINAL

Appendix A i RISK ASSESSMENT 4 An estimate of the core uncovery risk from a break in the SDV system cipino (at a plant like BF-3) minht be calculated as follows: P = P) xP g 2

where, P = Probability of Core Uncovery/Rx/Yr g

P) = Probability of an unisolated SDV break /Rx/Yr P2 = Probability of core uncovery followino an unisolated SDV break

where, P) = (N x P )) x (P12+P13I j

N = Number of Rx scrams /Rx/Yr F) = Probability of an SDV Break (>> sump puno cap)/Rx scram j 12 =' Probability of not beino able (RDS or control air condition) P to immediately reclose scram valves after a Rx scram /Rx scram Probability of not reclosing (human or procedural) or being P13 = unable to reclose (break consequences) scram valves af ter an SDV break. If we assume: l N=2 P)) = 1 D~ P12 " I O P13

• P

" n*2 2 then 6 p , )g t P00R ORlGlNAl.

I A-2 Discussion d Based on BWR operatino experience it would no't be unreasonable to assume that at least two reactor scrams (from full pressure and temperature) occur every year at each plant. It micht also be assumed that a break in a small line in the SDY system (downstream of the scram outlet valves and upstream of the SDV system vent and drain valves), resulting in a substantial blowdown rate *, (>> 100 gpm) can occur once in every 10,000 BWR reactor scrams. (A blowdown rate of this magnitude could result in eventual loss of the emergency makeup systems if not isolated.) For BWRs it also seems reasonable to assume that out of every ten reactor scrams, one would involve a RDS trip condition or power suoply failure or a loss of control air supply such that the scam outlet valves would not be able to be reclosed for an indefinite period of time. Furthe rmore, shculd a break in the SDV system occur, the additional abnormal plant synotoms and reactor system process conditions indicated in the control room could divert and continue to occupy the control room operator's time and attention (e.o., reactor water level drop) which could result in the scram valves being left The break itself may also introduce additional failure modes to the open. break isolation arrangements (e.o., air line failure due a postulated pice whip of a ruptured SDV system line, environmental damage to the detection equipment, f damage to the scram valve teflon seatino surfaces caused by prolonged blowdown). We would estimate that considerations such as these could contribute an additional l l one chance in ten of not isolatinp a break in the SDV system. l l

• Note: A break from a one inch Schedule 160 vent line is capable of passino approximately 400 gpm at 1,000 psi, while a two-inch Schedule 160 drain line is capable of passing approximately 1,500 opm.

A-3 Finally, in the event of such an unisolated break in the SDY system, we would assume that there is a 75% chance that at least some ECCS equipment in the Reactor Buildina basement and emeroency makeup inventory will be available to keep the core covereo continuously and indefinitely even thcugh none of the equipment is qualified for envirormental conditions including ficoding. Although the above point estimate is considered to be 10 /Rx/Yr, which would make this event a significant contributor to risk, the uncertainty rance may be such that the uncovery probability most likely lies within the rance of 10- /Rx/Yr to 10~'/Rx/Yr. Consequently it is difficult to conclude on the basis of these numbers alone that th'e existing plant desian configuration is safe, i.e., less than 10'^/Rx/Yr. If from these convolutions one were to conclude that the SDV pipe break is a significant contributor to BWR core uncovery risk, it is believed that the risk can best be reduced by decreasina the likelihood of a break in the SDV system pipino by an appropriate upgradinn of the SDV system mechanical intearity assurance basis. The risk can also be reduced in a sianificant althouah less favorable or desirable way by improvina the reliability of the break isolation arrang6ments. i l I l I

Aopendix B INSPECTION REPORT FOR LaSALLE COUNTY STATION ~ /e " "nu'o' s UNITED STATES NUCLEAR REGULATORY COMMISSION /nE 2 REGION lli 7ts ROOSEVELT acAD M e{Cf4/ CLIN ELLYN,ILUNCis GoW ' WAR 3 rea; Docket No. 50-373 Docket No. 50-374 Commonwealth Edison Company ATIN: Mr. Cordell Reed Vic'e President Post Office Box 767 Chicago, IL 60690 Gentlemen: Thank you for your letter dated February 3,1981, informing us of the steps you have taken to correct the noncompliance which we brought to your attentien in Inspection Report No. 50-373/80-48; 50-374/80-30 forwarded by our letter dated January 9,1981. We will examine these matters during a subsequent inspection. In your letter you requested us to reconsider (1) whether the meeting of Janua ry 29, 1981 should be classified as an Enforcement Conference and (2) the Severity Level of the noncompliance. Ve have reconsidered the matter and continue to believe the Severity Level selection is correct and the meeting was an Enforcement Conference. t The Severity Level of these violations was not increased for repeating a pre-vious violation. It was our determination that the problems related to control rod drive pipe suspension systems resulted from degradation of management coutrol systems designed to assure proper plant construction (Severity Level IV). Although a close call, we believed it was not a Severity Level III viola-tion, i.e., lack of quality assurance program implementation related to a single work activity as shown by multiple program implementation violations that were not identified and corrected by more than one quality assurance / quality control checkpoint relied upon to identify such violations. The meeting is considered an Enforcement Conference because of your noncom-pliance history related to large and small bore pipe suspension systems. Had the new enforcement p.olicy not been in effect at the time of this inspection, these items would have been infractions and your history would have prompted an Enforcement Conference. Under the new policy we continue to look at past history,'so the same conclusion was reached. Although we took the position that the " clock started" at the time of issuance of the revised enforcement policy with respect to counting multiple violations of Severity Level I, II, or III items of noncompliance, it is necessary that the history before. issuance of the Policy be considered in the determination of when to hold an Enforcement Conference. guQ< m e-Q gy qv

~ h43 3 gg Commonwealth Edison Company You have stated a desire to meet with us to discuss enforcement. We will contact you in the near, future to arrange such a meeting. Sincerely, James G. Keppler Director cc w/1t: dtd 2/3/81: cc w/ enc 1: J. S. Abel, Director of Nuclear Licensing L. J. Burke, Site Construction Superintendent T. E. Quaka, Quality Assurance Supervisor R. H. Holyoak, Station Superintendent B. B. Stephenson Project. Manager Central Files Reproduction Unit NRC 20b AEOD Resident Inspector, RIII PDR Local PDR NSIC TIC Dean Hansell, Office of Assirtant Attorney General ..ed I.n ynds 36-423I0 e[B \\ RIIT P'I' RIII RIII RIII R If f RIU f 7 l} N l( % Spea/sard .W[$ % 1 "; Davis Keppler Yia/jp Dants.lscg .u a nn f4

;, ? '

2/25/31 { 'g p gM-61

Comm:nw alth Edis:n e ore First Nat>cnai P' ara CNeago minois Accress Repy to. Post Othce Sox 767 CNcago. Hhnois 60690 February 3, 1981 Mr. James G. Keppler, Director Directorate of Inspection and Enforcement Region III U.S. Nuclear Regulatory Commission 799 Roosevelt Road Glen Ellyn, IL 60137

Subject:

LaSalle County Station NRC Inspection Report 50-373/80-48 and 50-374/80-30 NRC Docket Nos. 50-373/374

Dear Mr. Keppler:

In response to tne subject inspection report transmitted Dy 1981, attacned are replies to tne ycur letter cated January 9, items of noncompliance in tne Notice of Violation. The apparent replies include our evaluation of quality assurance program attached anc management control system improvements which will be implementee to precluce further violations of this type. The primary reason for the violation was inadequate followup of corrective actions icentified in our reply to your 50-373/80-20 and 50-374/80-13. This previous inspection report inadequate followup occurred because the LaSalle County Project Construction Management did not recognize their responsibility toTnis followup their contractor's cesign control corrective actions. was tne only LaSalle County Construction Management controllec contractor with extensiva cesign anc analysis responsibility. Design and analysis are normally hancied by contractors controlled Engineering organization; tnerefore, by the LaSalle County Project Construction Management incorrectly assumed the design and analysis I This corrective actions would be followed by Project Engineering. lack of responsibility for control of contractor design activities is unique to this spe,cific contractor. We agree that our followup was not adequate to assure timely corrective actions to deficiencies identified in the vendor NRC. As we stated in our meeting h Edison had performed an audit of h deficiencies were identified and l DUPLICATE DOCUMENT endor in Novemoer, 1980 to take response to date. Although our Entire document previously not represent a breakdown in our I entered into system under: ANo $10bil O M O 4198P No. of pages: uuh% ._.}}