ML20024A304
| ML20024A304 | |
| Person / Time | |
|---|---|
| Site: | McGuire, Mcguire  |
| Issue date: | 05/31/1983 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| References | |
| NUREG-0422, NUREG-0422-S07, NUREG-422, NUREG-422-S7, NUDOCS 8306160665 | |
| Download: ML20024A304 (100) | |
Text
-
e NUREG-0422 ll Y
Supp.No.7 JVilIlit illl ellt) *l Regulatory Conim s on related to operation of Office of Nuclear Reactor Regulation McGuire Nuclear Station, Units 1 and 2 oocket mos. s0-389 and 50-370 Duke Power Company l
Supplement No. 7 May 1983 rs'aMb =tgg.etw A b -4.N
,M e
-@" r 0
$
- M N#'
e f-C~
' - = +
Ti ('[;- M'1 1.gdiyI
~
YG^R$R$
4
- %akAL%E.
C=
4 55 n =w gnn 3 p,-n u~g myLw-W~r gv u
- 3..
fy pg
.www=5ny 4 Mu
. wp gwp@sd[
h S5 m = w, m _m,.cr _.
==..,._w,,,y= ~~ns.,
g s m:..m..=.
.- m. ~, w.
(
zP '
', x n-w w-mmu.mau w...
es-
. ~,
W
'5.m
+;Qd..
,.m,
_s, OL+n
^
8306160665 830531 PDR ADOCK 05000369 E
m NOTICE ~
Availability of Reference Materials Cited in NRC Publications
- Most documents cited in NRC publications will be available from one of the following sources:
- 1. ' The NRC Public Document Room,1717 H Street, N.W.
Washington, DC 20555 L 22 The NRC/GPO Sales Program, U.S. Nuclear Regulatory Commission,
' Washington, DC 20555 :
3.1 The National Technical Information Service, Springfield, VA 22161 :
Although the listing that follows represents the majority of documents cited in NRC publications,
. It is not intended to be exhaustive.
~ Referenced documents available for inspection and copying for a fee from the NRC Public Docu-ment Room include NRC correspondence and internal NRC memoranda; NRC Office of Inspection
. and Enforcement' bulletins; circulars, information notices,1 inspection and investigation ' notices; =
Licensee Event Reports; vendor reports and correspondence; Commission papers; and applicant and licensee documents and correspondence.
The following' documents in'the NUREG series are available for purchase from the NRC/GPO Sales Program: formal NRC staff and contractor reports, NRC-sponsored conference proceedings, and NRC booklets and brochures. Also available are Regulatory Guides, NRC regulations in the Code of Federal Regulations, and Nuclear Regulatory Commission Issuances.
- Documents available-from the National Technical Information Service include NUREG series
- reports and technical reports prepared by other federal agencies and reports prepared by the Atomic Energy Commission, forerunner agency to the Nuclear Regulatory Commission.
,.(
Documents available from public and special technical libraries include all open literature items, such as books, journal and periodical articles, and transactions. Federal Register notices, federal and state legislation, and congressional reports can usually be obtained from these libraries.-
, Documents such as theses, dissertations, foreign reports and translations, and non-NRC conference
. proceedings are available for purchase from the organization sponsoring the publication cited.
Single copies'of NRC draft reports are available free upon written request to the Division of Tech-
. nical Information and Document Control, U.S. Nuclear Regulatory Commission,' Washington, DC'
= 20555.
- Copies of industry codes and standards used in a substantive manner in the NRC regulatory process -
are maintained at the NR", Library, 7920 Norfolk Avenue,'Bethesda, Maryland, and are available there for reference use by the public. Codes and standards are usually copyrighted and may be purchased from the originating organization or, if they are American National Standards, from the
-American National Standards Institute,1430 Broadway, New York, NY 10018.
'GPO Printed copy price: $4.75 l
t a
y
,f oy-
-,,,,..--,m.,e
,,,.,,A---
.,w, r,,,
g
~-,
m,
-w--,
NUREG-0422 Supp. No. 7 SAFETY EVALUATION REPORT RELATED TO OPERATION OF MCGUIRE NUCLEAR STATION, UNITS 1 AND 2 DUKE POWER COMPANY OFFICE OF NUCLEAR 9.EACTOR REGULATION U.S. NUCLEAR REGULATORY COMISSION DOCKET NOS. 50-369 AND 50-370 MAY 1983 1
l l
i I
ABSTRACT This report supplements the " Safety Evaluation Report Related to the Operation of McGuire Nuclear Station, Units 1 and 2" (SER (NUREG-0422)) issued in March 1978 by the Office of Nuclear Reactor Regulation of the U.S. Nuclear Regulatory Commission with respect to the application filed by Duke Power Company, as appli-cant and owner, for licenses to operate the McGuire Nuclear Station, Units 1 and 2 (Docket Nos. 50-369 and 50-370).
The facility is located in Mecklenburg County, North Carolina, about 17 mi north-northwest of Charlotte, North Carolina.
This supplement provides information related to issuance of a full power authori-zation for Unit 2.
The staff concludes that the McGuire Nuclear Station can be operated by the licensee without endangering the health and safety of the public.
'd i
McGuire SSER 7 iii
TABLE OF CONTENTS Page ABSTRACT.............................................................
iii 1
INTRODUCTION AND GENERAL DISCUSSION.............................
1-1 1.1 Introduction...............................................
1-1 1.8 License Conditions.........................................
1-1 7
INSTRUMENTATION AND CONTROLS....................................
7-1 7.2 Reactor Trip Actuation System..............................
7-1 7.2.5 Reactor Trip Breaker................................
7-1 7.8 Environmental Qualification of Electrical Equipment 4
Important to Safety........................................
7-1 7.8.1 Introduction and Background.........................
7-1 7.8.3.2 Information Required by 10 CFR 50.49.......
7-2 7.8.3.2.1 Licensee's Responses Addressing Information Required by 10 CFR 50.49....................
7-2 7.8.3.3 Aging......................................
7-4 7.8.3.4 TMI Action Plan Equipment..................
7-4 7.8.3.5 Conclusion.................................
7-4 22 TMI-2 REQUIREMENTS..............................................
22-1 22.4 NRC Action................................................
22-1 i
APPENDICES A
CONTINUATION OF THE CHRONOLOGY OF RADIOLOGICAL REVIEW OF WILLIAM B.
MCGUIRE STATION UNITS 1 AND 2 OPERATING LICENSE REVIEW 3
REFERENCES
~
C MCGUIRE NUCLEAR STATION SAFETY EVALUATION REPORT CONCERNING THE HYDROGEN MITIGATION D
MCGUIRE NUCLEAR STATION SAFETY EVALUATION REPORT CONCERNING THE REACTOR TRIP BREAKERS McGuire SSER 7 v
i l'
1 INTRODUCTION AND GENERAL DISCUSSION L
1.1 Introduction
?
On March 1, 1978, the staff of the U.S. hoclear Regulatory Commission (NRC) issued its Safety Evaluation Report (NCREG;0422) in the matter'of Duke Power f
[,
Company's application to operate the McGuire Nuclear Station,-Units 1 and 2.
The Safety Evaluation Report'(SER) was supplemented by Supplement' Nos.1, 2,;
3, 4, 5, and 6.
On January 23, 1981,' Facility L.icense No. NPF-9 was issued to Duke Power Com-pany (licensee and/or' applicant) to permit fuel loading, criticality'and zero-power testing of Unit 1.
The license was subsequently revised and amended on June 12 and July 8, 1931 to authorize operation at 5% and 100% of rated power,.
respectively.
On March 3, 1983, Facility License No. NPF-17 was issued to Duke Power Company for Unit 2' authorizing fuel loading, low power testing for opera-tion at up to 5% of full power.
The purpose of this supplement is to update the SER by providing additional information related to issuance of a 100% operating license authorization for Unit 2.
Except where noted, the meterial herein supplements material in the SER and Supplement Nos. 1, 2, 3, 4, 5 and 6.
Appendix A to this supplement is a con-tinuation of the chronoTogy of principal actions related to the staf f's safety review of McGuire Nuclear Station, Units 1 and 2.. References cited in this-supplement are listed in Appendix B.*
Appendix C contains the safety evaluation for the hydrogen mitigation sytems.
Appendix D contains the staff's safety.
evaluation report on the reactor trip breakers.
Copies of this supplement are available for public inspection at the Commis-sion's Public Document Room at 1717 H Street, N.W., Washington D.C., and at Atkins Library, University of' North Carolina, Charlotte, UNCC Station, North Carolina 28223.
They are +164 available for purchase from the sources indicated on the inside front cover C:.this report.
On the basis of it.' y ' tv the staff concludes that the McGuire Nuclear Station Unit 2 may be opera...a 3...,
, up to 100% of full power in accordance with the Technical Specifications without undue risk to the health and safety of the public.
1.8 License Conditions The staff has identified certain issues in }ts review that will become condi-tions of the operating license for McGuire Unil 2 when it is issued.
These t
- Availability of all material cited is described on the inside front cover of this report.
McGuire SSER 7 1-1 1
issues are listed below and are discussed further in the sections of this report as indicated.
Issue Section (1) Environmental Qualification:
The licensee shall environ-7.8 mentally qualify all electrical equipment within the scope of 10 CFR 50.49 in accordance with the implementation require-ments of 10 CFR 50.49(g).
(2) Reactor Trip Breakers:
7.2.5 (a) By June 3, 1983, the licensee shall provide a program plan for conducting a life-test of the undervoltage trip attachment. The life-test program is to be reviewed by the staff before implementation.
(b) The licensee shall modify the design of the automatic shunt trip of the main reactor trip breakers to install an independent fusing scheme.
This modification shall be implemented on a schedule consistent with the schedule requirements of the NRC Salem Task Force generic program.
r.
la(
(c) The licensee snall implement the reactor trip breaker and bypass breaker testing as described in Table 1.1.
(d) Within 60 days from the time the full power amendment to the license is issued, the licensee shall provide upgraded post-trip procedures for NRC staff review.
(3) Hydrogen Control Measures (II.B.7):
Before startup following 22.4 the first refueling outage, the licensee shall z
(a) Install two additional igniter units in the containment lower compartment and four additional igniter units in
=
the containment upper compartment in locations acceptable
~
c to the staff.
c.
(b) Provide a means of verifying the operational status of L
the hydrogen control system in the main control room.
(c) Provide the capability to actuate the hydrogen mitigation Y-system from the control room.
h
(
l r
McGuire SSER 7 1-2
Table 1.1 Periodic surveillance / maintenance of reactor trip breakers and reactor trip bypass breakers
- Before Each Startup (if not completed Monthly Surveillance (each Every 6 Months within past 7 days) breaker every 31 days)
Surveillance / Maintenance Reactor Trip Reactor Trip and Reactor Breakers Reactor Trip Breakers Trip Bypass Breakers Functional test of Functional test of_UV Response time testing of UV/
UV trip davica trip device independently break on UV signal from RPS independently (visicorder shall be used and data trended)**
Response time testing of UV/ breaker on UV signal from RPS (event recorders may be used)
Functional test of Functional test of shunt Trip shaft force measurements **
shunt trip device trip device independently independently Functional test of UV output force measurement **
manual reactor trip from the control Functional test of shunt trip room device independently l
Servicing / lubrication / adjust-ment in accordance with licensee's maintenance procedures Check the dimensional tol-erance of pre-and post-travel of the trip tab **
Inspect lubricant and clean-liness of roller bearing **
- 0n failure of any reactor trip breaker or reactor trip bypass breaker, either 9
in service or during testing (on either undervoltage or shunt coils), preserve evidence of failure and notify the Commission pursuant to Technical Specifica-tion 6.9.1.10.
- To be performed before and after preventive maintenance.
McGuire SSER 7 1-3
l i
7 INSTRUMENTATION AND CONTROLS
- 7. 2 Reactor Trip Actuation System 7.2.5 Reactor Trip Breaker As a result of failures in early 1983 of the reactor protection system (RPS) breakers at several facilities, the Commission issued Office of Inspection and Enforcement Bulletins (IEBs) 83-01 and 83-04 and Information Notice 83-18.
The licensee in response to IEB 83-04 performed tests on the Westinghouse DS-416 breakers used at the McGuire facility.
No failures occurred in these tests.
However, subsequent testing resulted in failures of the DS-416 breakers.
These failures were attributed to a variety of causes indicating weaknesses in design and manufacture.
Because of the failures of the 05-416 reactor trip breakers, the staff has reviewed the failure history, the investigative actions taken by the licensee, the licensee's conclusions regarding the causes of the failures, and his main-tenance and test procedures, surveillance program, plant modification to pro-vide automatic actuation of the shunt trip, and the procedures for reactor trip and for anticipated transients without scram.
A summary of the staff's evaluation is presented in Appendix D.
The staff has initiated independent testing of the DS-416 reactor trip breakers at the Franklin Research Center to confirm that all failure mechanisms have been identified.
On the basis of its evaluation and the re=ults of current testing of the device, the staff concludes that the failure causes have been identified and sufficient remedial actions have been taken to provide reasonable assurance that the McGuire Units 1 and 2 can be operated without undue risk to public health and safety.
However, to increase and improve the reliability of the RPS breaiers, the staff will condition the operating license to provide for th licensee actions as discussed in Section 1.8 of this supplement.
7.8 Environmental Qualification of Electrical Equipment Important to Safety 7.8.1 Introduction and Background i
In Supplement No. 6 (SSER 6) to the McGuire Safety Evaluation Report (SER), the staff identified several open items requiring resolution before 5% of full power is exceeded at McGuire Unit 2.
Subsequently, the staff met with the licensee j
on March 29 and May 4, 1983 to discuss these issues, and by letters dated May 11 and 12, 1983, the licensee provided information addressing these open items.
The staff's evaluation of that information is given herein and refers to the subsections of Section 7.8 of SSER 6 that identified these open' items McGuire SSER 7 7-1
7.8.3.2 Information Required by 10 CFR 50.49 7.8.3.2.1 Licensee's Responses Addressing Information Required by 10 CFR 50.49 By letters dated May 11, 12, and 20, 1983, the licensee provided additional information required by 10 CFR 50.49.
The staff's evaluation of this informa-tion is given below.
7.8.3.2.1.1 Information Addressing Item (1)(b) in Section 7.8.3.2 The licensee has stated that his definition of safety-related is consistent with the definition given in 10 CFR 50.49(b)(1).
This!open item is satisfac-torily resolved.
7.8.3.2.1.2 Information Addressing Item (1)(a) in Section 7.8.3.2 This open item concerns compliance with 10 CFR 50.49(b)(2).
The licensee con-firmed his previous response to this item; that is, he has not identified any nonsafety-related electrical equipment located in a harsh environment whose failure under the postulated accident conditions could prevent satisfactory accomplishment of a safety function by safety-related equipment.
The licensee supplemented'the bases for this response with the following information.
As stated in the licensee's May 12 and 20, 1983 letters, the McGuire safety-related electrical power and control systems are designed in accordance with Institute of Electrical and Electronics Engineers (IEEE) Std. 308-1971 and IEEE Std. 279-1971, respectively, as discussed in the McGuire Final Safety Analysis Report (FSAR).
These two standards, as implemented in the McGuire design, place strict requirements on the interfacing of safety-related and nonsafety-related electrical equipment.
Nonsafety-related loads receiving power from safety-related buses are automatically tripped from these buses by safety-related breakers, receiving trip signals generated by the plant protec-tion systems, in order to preclude unacceptable influences of nonsafety related equipment on the safety-related power system.
The McGuire separation require-ments are discussed in FSAR Section 8.3.1.2.7 and have previously been reviewed and accepted by the staff (see McGuire SSER 2).
With regard to control systems where nonsafety-related equipment provides input to control safety-related equipment, accident actuation signals are provided to override the nonsafety-related control inputs.
In addition to the override feature, nonsafety-related inputs to safety-related control systems are reviewed during the design process to ensure that no failure modes of the nonsafety-related inputs can preclude completion of the required safety actuation.
The combination of the override feature and the review of nonsafety related control inputs ensures that no unacceptable influences of nonsafety-related equipment
(
on safety-related equipment can occur to prevent the satisfactory accomplish-ment of a safety function.
In addition to the design features described above, the licensee performed an
(
analysis c7 control systems at.McGuire in response to Office of Inspection and Enforcement (IE) Information Notice 79-22.
The purpose of the analysis was to determine what, if any, design changes or operator actions would be necessary to ensure that environments caused by high energy line breaks would not cause an McGuire SSER 7 7-2
electrical nonsafety-related control system to fail in such a manner as to com-plicate the event beyond the assumptions of the accident analysis.
The systems considered in this analysis were identified by Westinghouse for McGuire and re-viewed by the licensee for the interaction described above.
The systems reviewed were the steam generator power-operated relief valve (PORV) control system, the pressurizer PORV control system, the main feedwater control system, and the automatic rod control system.
The results of this review for McGuire revealed that no design changes or operator actions were required to address the issue.
The licensee has recently documented the same analysis with the same results for the Catawba Nuclear Station in response to NRC Staff Question 420.3.
The staff has reviewed the information provided and found the Catawba analysis ~ acceptable (see Catawba SER (NUREG-0954)).
The staff finds that the above information from the licensee adequately addresses compliance with 10 CFR 50.49(b)(2); therefore, this open item is satisfactorily resolved.
7.8.3.2.1.3 Information Addressing Item (1)(c) in Section 7.8.3.2 Regarding the open items identified in this subsection, the licensee stated that the auxiliary feedwater flow transmitters have been replaced with qualified transmitters. The replacement transmitters are Rosemount 11530 series transmit-ters.
The licensee also stated that failure of the steam relief radiation monitors will not affect the functions of any other safety-related equipment.
This satisfactorily resolves these open items.
7.8.3.2.1.4 Information Addressing Item (2) in Section 7.8.3.2 This subsection identified several items requiring resolution.
Concerning the Robertshaw level switches, the licensee stated that he has replaced these with Magnetrol level switches and has provided justification for interim operation with these switches, pending completion of their qualification, on the basis of the results of recently completed qualification testing, which are being finalized for documentation purposes.
Concerning the in-core thermocouples, the licensee stated that although this instrumentation is currently not safety related, it is a TMI Action Plan item and will be environmentally qualified before startup following the first refueling outage.
Because the thermocouples receive no power, their failure cannot affect any safety-related equipment, and, according to the licensee, the operator will rely on other qualified instruments to provide indication of inadequate core cooling.
This satisfactorily resolves these open items.
The licensee previously had identified McGuire Unit 2 equipment that was not identical to McGuire Unit 1 equipment to be Barton Lot 5 transmitters.
The licensee now states that both Lot 4 and Lot 5 transmitters are used at McGuire Unit 2, and has provided his bases for concluding that the Lot 5 transmitters are qualified because they are similar to the Lot 4 transmitters.
Although the staff has not yet issued the SER addressing Westinghouse Topical Report WCAP-8687, the staff has concluded that the Lot 4 transmitters are qualified.
This
)
satisfactorily resolves this open item.
The licensee provided additional information concerning the environmental qual-ification of the Rotork Model NA-2 valve actuators and Rosemount Model ll53GA9 McGuire SSER 7 7-3 l
[
1 pressure transmitters, which were identified as NRC Category II.b items.
On the basis of its evaluation of this information, the staff concludes that these equipment items are qualified for their applications at McGuire.
This satis-factorily resolves these open items.
Concerning NRC Category I.b, II.a, and IV equipment items, the licensee stated that technical resolutions have been determined for the Category II.a items and that documentation of the specific resolutions currently is in progress.
Accept-able justifications for interim operation have been provided for equipment lack-ing complete qualification or being replaced.
For the Category I.b and IV equipment items, the licensee stated that qualification documentation is now available in his files for most of this equipment.
For the remaining equipment, acceptable justifications for interim operation or information to resolve the deficiencies have been provided.
The staff considers that this open item has been satisfactorily addressed by the licensee.
7.8.3.3 Aging The licensee stated that the maintenance and surveillance program for safety-related electrical equipment conforms to guidance contained in ANS-3.2/ ANSI-
'N18.7-1976, " Administrative Controls and Quality Assurance for Operational Phase of Nuclear Power Plants." This is adequate to resolve this open item at this time.
7.8.3.4 TMI Action Plan Equipment The licensee stated that all TMI Action Plan equipment is installed with the exception of the reactor vessel level instrumentation system, which is to be installed before startup following the first refueling outage, in accordance with a Unit 2 license condition. The licensee also stated that all safety-related TMI Action Plan equipment located in a harsh environment is included in the McGuire equipment qualification program.
In addition, the licensee refer-enced a July 28, 1982 Duke Power Company letter from W. O. Parker to H. R.
Denton, that specifically addressed TMI Action Plan equipment (by item number lizted in NUREG-0737).
This open item is satisfactorily resolved.
7.8.3.5 Conclusion On the basis of its evaluation, the staff concludes that all open items identified in Section 7.8 of SSER 6 have been satisfactorily resolved.
The staff further concludes that, with the exception of the completion of documentation and the determination of the qualified life or replacement schedule for all equipment, the licensee has demonstrated compliance with 10 CFR 50.49.
However, since the licensee states that all technical resolutions have been determined and because a qualified life or replacement schedule is not important during the early opera-l tion of a plant, the staff further concludes that McGuire Unit 2 can be safely operated at 100% full power, pending completion of the environmental qualifica-tion of electrical equipment.
The staff will condition the operating license to require the licensee to have all electrical equipment within the scope of q
10 CFR 50.49 environmentally qualified by the schedule specified in 10 CFR 50.49(g) that applies to holders of operating licenses issued before February 22, 1983.
McGuire SSER 7 7-4
22 TMI-2 REQUIREMENTS 22.4 NRC Action II.B.7 Analysis of Hydrogen Control In Supplements 4 and 6 to the McGuire SER (NUREG-0422), the staff concluded that the interim hydrogen mitigation system (HMS) installed at McGuire Units 1 and 2 is acceptable as an interim hydrogen control measure for degraded core accidents.
However, the staff recommended that the detailed review of the hydrogen mitigation system continue so that a number of issues related to degraded core hydrogen control could be more thoroughly investigated before it endorsed a long-term commitment to deliberate ignition.
This effort was continued by both the licensee and the staff.
The staff has now concluded its review of the matter and has summarized its evaluation of the permanent HMS for McGuire Units 1 and 2 in Appendix C.
The staff concludes that the McGuire permanent HMS is acceptable subject to the installation of two additional igniter units in the containment lower compart-ment and four additional igniter units in the upper compartment and a means of verifying the operational status of the hydrogen mitigation system in the con-trol room.
In addition, the licensee has committed to provide control room actuation of the hydrogen mitigation system.
These items shall be implemented before startup following the first refueling outage.
This item has been satis-factorily resolved.
i 0
McGuire SSER 7 22-1
-APPENDIX A i
CONTINUATION OF THE CHRONOLOGY OF THE RADIOLOGICAL REVIEW 0F WILLIAM B. MCGUIRE STATION UNITS 1 AND 2 OPERATING LICENSE REVIEW February 16, 1983 Licensee submits Amendment 71 to application for licenses.
Filing consists of Revision 45 to Final Safety Analysis Report.
February 23, 1983 Letter from licensee responding to 10 CFR 50.49.
February 25, 1983 Letter from licensee concerning results of the preservice examination.
February 25, 1983 Letter from licensee concerning environmental qualification.
February 28, 1983 Letter from licensee forwarding revised Offsite Dose Calculation Manual.
February 28, 1983 Letter from licensee concerning environmental qualifica-tion of electric equipment.
February 28, 1983 Letter from licensee concerning review of reactor trip system.
March 1, 1983 Letter from licensee forwarding annual report.
March 1, 1983 Letter from licensee responding t'o staff questions.
March 1, 1983 Letter from licensee forwarding revision to Emergency Plan Implementing Procedures.
March 1, 1983 Letter from licensee concerning 02/03 steam generator design modification.
March 1, 1983 Letter from licensee concerning reactor trip circuit breakers.
March 2, 1983 Letter to licensee concerning proposed Technical Speci-fication change - reduced measurement uncertainty for-reactor coolant system (RCS) flow rate.
March 3, 1983 Operating License NPF-17 issued for Unit 2.
License 9
authorizes low power testing and operation at up to but not to exceed 5% of power.
March 3, 1983
, Letter from licensee concerning the designated near-site emergency operation facility.
McGuire SSER 7 A-1
March 4, 1983 Board Nctification 83 Additional RELAP-5 Calculation for Semiscale S-SR-2 Test.
March 4, 1983 Letter to licensee concerning safety evaluation for environmental qualification of safety-related electrical equipment.
March 7, 1983 Generic Letter 83 Definition of " Key Maintenance Personnel" (Clarification of Generic Letter 82-12).
March 9, 1983 Letter from licensee concerning i~nadequate core cooling instrumentation system.
Response to Generic Letter 82-28.
March 9, 1983 Letter from licensee concerning emergency preparedness exercises at Oconee and McGuire Nuclear Stations during 1980, 1981, and 1982.
March 10, 1983 Letter to licensee concerning changes to Safeguards Contingency Plan (two letters).
March 11, 1983 Licensee submsts Revision 10 to Emergency Plan.
March 14, 1983 Letter from licensee concerning reduced measurement uncertainty for RCS flow rate.
March 14, 1983 Letter from licensee concerning D2/D3 steam generator design _ modification.
March 14, 1983 SER Supplement No. 6 issued.
March 15, 1983 Letter from licensee concerning the startup testing schedule for Unit 2.
March 16, 1983 Letter to licensee concerning hydrogen mitigation system.
March 16, 1983 Letter to licensee forwarding staff evaluation of utility design review panel report on modification to Westinghouse D2/D3 steam generators.
March 16, 1983 Letter from licensee forwarding Revision.7 to report, "An Analysis of Hydrogen Control Measures at McGuire Nuclear Station."
March 16, 1983 Letter to licensee providing staff evaluation of Utility Design Review Panel report on modification to Westinghouse 1
D2/D3 steam generators.
March 17, 1983 Letter to licensee concerning proposed Technical Specifica-(
tion change - reduced measurement uncertainty for RCS V
flow rate.
March 21, 1983 Letter from licensee concerning environmental qualifica-tion of electrical equipment.
McGuire SSER 7 A-2 I
March 21, 1983 Letter from licensee concerning methodology for calculating 40 year normal operating dose rates.
March 21, 1983 Meeting with Design Review Panel to discuss information rotated to the forward flush transient on D2/03 steam generators.
March 22, 1983 Board Notification 83 Failure of GE AK-2 Reactor Trip Breakers.
March 23, 1983 Generic Letter 83 Implementation of Regulatory Guide 1.150, " Ultrasonic Testing of Reactor Vessel Welds During Preservice and Inservice Examinations, Revision 1."
March 24, 1983 Generic Letter 83 Transmittal of NUREG-0977 Relative to the ATWS Events at Salem Generating Station, Unit No. 1.
March 28, 1983 Letter from licensee concerning Technical Specification change to reduce the measurement uncertainty for RCS flow rate.
March 28, 1983 Letter to licensee concerning reporting of offsite doses for 1982.
March 29, 1983 Amendment No. 19 issued to License No. NPF-9 replacing Appendix A Technical Specifications with a revised version which applies to both Units 1 and 2.
March 29, 1983 Meeting with licensee to discuss equipment qualification.
March 31, 1983 Letter from licensee concerning installation of source-range neutron flux instrumentation as an integral part of the standby shutdown system.
March 31, 1983 Letter from licensee concerning IWP/IWV Pump and Valve Inservice Testing Programs.
April 1, 1983 Letter to licensee concerning reactor trip breakers.
April 1, 1983 Letter from licensee forwarding Annual Financial Report.
April 4, 1983 Board Notification 83 Staff Position Regarding Un-resolved Safety Issue A-17.
April 4, 1983 Board Notification 83 Need for Rapid Primary System l
Depressurization Capability in PWRs.
April 8, 1983 Generic Letter 83 Integrity of the Requalification Examinations for Renewal of Reactor Operator and Senior Reactor Operator Licenses.
April 13, 1983 Amendment No. 20 to License NPF-9 and Amendment No. 1 to License NPF-17 issued.
Amendments increase the maximum flow rate for the centrifugal charging pumps.
McGuire SSER 7 A-3
April 15, 1983 Letter'from licensee forwarding description of various programmatic activities and special audits supporting conclusion that an independent design verification program is unnecessary.
April 15, 1983 Letter from licensee concerning failure of Unit 2 reactor trip breaker "B" to open on an undervoltage trip signal during testing.
l April 18, 1983 Letter from licensee concerning reactor trip breakers.
l-l April 19, 1983 Meeting with licensee to discuss undervoltage trip device failures.
(Summary issued April 25, 1983.)
April 20, 1983 Letter from licensee concerning the removal of the RCS thermal sleeves for Unit 1.
April 22, 1983 Letter from licensee forwarding Revision 8 to report, "An Analysis of Hydrogen Control Measures at McGuire Nuclear Station."
April 22, 1983 Letter from licensee regarding Generic Letter 83-10d concerning resolution of TMI Action Plan Item II.K.3.5,
" Automatic Trip of Reactor Coolant Pumps."
April 26, 1983 Letter from licensee concerning proposed change to Tech-nical Specifications for Unit 1 to reduce the measurement uncertainty for RCS flow rate.
April 27, 1983 Letter from licensee concerning reduced measurement uncertainty for RCS flow rate.
April 28, 1983 Letter from licensee concerning potential boron leaching from the B C pellets encapsulated in the Unit 2 control 4
rods.
April 28, 1983 Letter from licensee concerning actions taken regarding recent problems with the DS-416 breaker undervoltage devices.
April 28, 1983 Letter from licensee concerning reactor trip breakers.
April 28, 1983 Letter from licensee providing additional information on the monitoring and testing program for the steam generators related to the preheater modification.
I April 28, 1983 Letter from licensee providing information related to reactor trip breakers.
l May 2, 1983 Generic Letter 83 New Procedures for Providing Public Notice Concerning Issuance of Amendments to Operating Licenses.
May 2, 1983 Letter from licensee concerning problems with reactor trip breakers.
McGuire SSER 7 A-4 l
1
May 2, 1983 Letter from licensee forwarding revisions to Crisis Management Plan Implementing Procedure.
May 3, 1983 Letter from licensee concerning reactor trip breaker problems.
May 3, 1983 Letter from licensee identifying additional surveillance that should be performed to ensure the operability of the reactor trip breakers.
May 4, 1983 Board Notification 83 Differing Professional Opinion Regarding Systems Interaction and Safety Classification.
May 4, 1983 Letter from licensee requesting amendments to Technical Specifications to revise the setpoint for upper head injection accumulator automatic isolation.
May 5, 1983 Letter from licensee concerning problem with the Unit 1 Train "B" reactor trip breaker.
May 5, 1983 Letter from licensee forwarding revision to the Emergency Plan Implementing Procedures.
May 5, 1983 Letter from licensee concerning revised rod drop test method and acceptance criteria.
May 5, 1983 Amendment No. 21 issued to License NPF-9 adding a license condition for verifying acceptability of model D2 steam generator design modifications.
May 5, 1983 Letter from licensee providing revised information regard-ing steam generator inspection program following installa-tion of the preheater modification.
May 5, 1983 Letter from licensee concerning loss of electrical load test at Unit 1.
May 6, 1983 Letter to licensee concerning Unit 1 reactor trip breakers and permission for Unit 1 to return to operation.
May 9, 1983 Letter to licensee granting relief from ASME Code requiring performance of hydrostatic tests after modifications.
~
May 9, 1983 Generic Letter 83 Integrated Scheduling for Imple-mentation of Plant Modifications.
May 10, 1983 Letter from licensee concerning actions taken regarding recent problems with the DS-416 breaker undervoltage devices.
May 11, 1983 Generic Letter 83 Clarification of Accesss Control Procedures for Law Enforcement Visits.
McGuire SSER 7 A-5
May 12, 1983 Letter from licensee concerning environmental qualification.
May 13, 1983 Letter from licensee concerning installation of source-range neutron flux instrumentation as an integral part of the standby shutdown system.
May 13, 1983 Letter from licensee concerning installation of reactor coolant system cold-leg temperature monitors as an integral part of the standby shutdown system.
May-17, 1983 Letter to licensee concerning completion of operating license condition 2.C(11)g, " Anticipatory Reactor Trip."
l
\\
McGuire SSER 7 A-6
APPENDIX B REFERENCES Code of Federal Regulations, Title 10, " Energy" (10 CFR).
Duke Power Company, " Final Safety Analysis Report, McGuire Nuclear Station, Units 1 and 2,"
Aug. 25, 1974.
U.S. Nuclear Regulatory Commission, NUREG-0422, " Safety Evaluation Report Related to Operation of McGuire Nuclear Station, Units 1 and 2," Mar. 1978; Supplement No. 2, Mar. 1979; Supplement No. 6, Feb. 1983.
--, NUREG-0954, " Safety Evaluation Report Related to the Operation of Catawba Nuclear Station, Units 1 and 2," Docket Nos. 50-413 and 50-414, Feb. 1983.
--, NUREG-0737, " Clarification of TMI Action Plan Requirements," Nov. 1980.
--, Regulatory Guide 1.97, " Instrumentation for Light-Water-Cooled Nuclear Power Plants To Assess Plant and Environs Conditions During and Following an Accident," Rev. 2.
U.S. Nuclear Regulatory Commission, Office of Inspection and Enforcement (IE),
Bulletin 83-01, " Failure of Reactor Trip Breakers."
--,Bulletin 83-04, " Failure of Undervoltage Trip Function of Reactor Trip Breakers."
--, Information Notice 79-22, " Qualification of Control Systems."
--, Information Notice 83-18, " Failures of the Undervoltage Trip Functions of Reactor Trip System Breakers."
Westinghcuse Electric Corporation, Topical Report WCAP-8687, E01A, Revision 1,
" Equipment Qualification Test Report Barton Pressure Transmitters - Group A (Seismic and Environmental Testing)," Apr. 1982, and E03A, Revision 1,
" Equipment Qualification Test Report Barton Differential Pressure Trans-mitters - Group A (Seismic and Environmental Testing)," Apr. 1982.
Industry Codes and Standards 1
American Nuclear Society /American National Standards Institute, ANS-3.2/ ANSI N18.7-1976, " Administrative Controls and Quality Assurance for the Opera-tional Phase of Nuclear Power Plants."
Institute of Electrical and Electronics Engineers (IEEE) Std. 279-1971,
" Criteria for Protection Systems for Nuclear Power Generating Stations."
--, 308-1971, "IEEE Standard Criteria for Class 1E Electric Systems for Nuclear Power Generating Stations."
McGuire SSER 7 B-1
APPENDIX C MCGUIRE NUCLEAR STATION SAFETY EVALUATION REPORT CONCERNING THE HYDROGEN MITIGATION SYSTEM t
McGuire SSER 7
TABLE OF CONTENTS P, age C.1 INTRODUCTION.....................................................
C-1 C.2 SYSTEM DESCRIPTION...............................................
C-2 C.2.1 General...................................................
C-2 C.2.2 Igniter Power Supply.....................................
C-2 C.2.3 Igniter Coverage..........................................
C-4 C.2.4 System Actuation..........................................
C-5 C.2.5 Surveillance Testing......................................
C-7 C. 3 COMBUSTION / IGNITER TESTING.......................................
C-7 C.4 DETONATIONS AND FLAME ACCELERATION...............................
C-9 C.5 DEGRADED CORE ACCIDENTS AND HYDROGEN GENERATION..................
C-10 C.6 MCGUIRE CONTAINMENT STRUCTURAL CAPACITY..........................
C-11 C.7 CONTAINMENT ANALYSIS.............................................
C-12 C.7.1 Containment Codes.........................................
C-12 C.7.2 Containment Pressure and Temperature Calculations.........
C-13 C.7.3 Confirmatory Analysis and Conclusion......................
C-14 C.8 SURVIVABILITY OF ESSENTIAL EQUIPMENT.............................
C-16 C.8.1 Essential Equipment.......................................
C-16 C.8.2 Thermal Environment Response Analysis.....................
C-18 C.8.3 Pressure Effects..........................................
C-21 C.8.4 Staff Conclusions Regarding Equipment Survivability.......
C-21 C.9 OVERALL CONCLUSIONS..............................................
C-22 C.10 REFERENCES.......................................................
C-23 f
l McGuire SSER 7 C-iii
C.1 INTRODUCTION The staff's licensing requirements relative to the provisions for hydrogen con-trol beyond those prescribed in 10 CFR 50.44 have evolved from numerous delibera-tions among the Nuclear Regulatory Commission (NRC or Commission), the Advisory Committee on Reactor Safeguards (ACRS), the NRC staff, and applicants and licensees.
In summary, the Commission's requirement for. ice condenser contain-ments is that a supplemental hydrogen control system be provided so that the consequences of the hydrogen release generated during the more probable degraded core accident sequances do not involve a breach of containment nor adversely affect the functioning of essential equipment.
Based on a determination that a hydrogen mitigation system would provide addi-tional assurance of safety in the event of excessive hydrogen generation result-ing from an accident beyond the design basis for McGuire Nuclear Station, the Duke Power Company (Duke or licensee) installed a distributed hydrogen ignition system in McGuire Units 1 and 2.
The staff concluded in analyses prepared for the Atomic Safety Licensing Board hearings on McGuire Units 1 and 2 that the installed distributed ignition system was acceptable as an interim hydrogen control measure for degraded core accidents.
However, the staff recommended that the detailed review of the distributed ignition system continue so that a number of issues related to degraded core hydrogen control could be more thoroughly investigated before it endorsed a long-term commitment to deliberate ignition. These issues included items related to combustion phenomena as well as further consideration of a spectrum of degraded core accident sequences.
Based on these recommendations, the operating license of McGuire Unit 1 was conditioned to require that Duke, by the end of the first refueling outage of McGuire Unit 1, provide the bases for a Commission determination that an ade-quate hydrogen control system for the plant is installed and will perform its intended function in a manner that provides adequate safety margins.
In the interim, Duke was required to continue research programs on hydrogen control measures and the effects of hydrogen burns on safety functions.
As part of its research activities, Duke Power in cooperation with Tennessee Valley Authority (TVA) and American Electric Power (AEP) continued to investi-gate alternative measures of hydrogen control.
As a result of continued studies, Duke has concluded that a deliberate ignition system, similar to the interim system, provides adequate safety margins in controlling the consequences of degraded core accidents.
The permanent hydrogen mitigation system (HMS) is identical in concept to the interim system but provides some system design o
improvements.
The McGuire Nuclear Station is the second ice condenser plant to have a delib-erate ignition system as the permanent means of hydrogen control for degraded core accidents.
The lead plant, Sequoyah, received Commission approval in December 1982 for a permanent hydrogen control system similar to that installed at McGuire.
McGuire SSER 7 C-1
This report summarizes the staff's evaluation of the permanent HMS for McGuire Units 1 and 2.
The staff's review of the HMS has in large part proceeded con-currently with the review of the Sequoyah system.
The staff concluded in its evaluation for Sequoyah that the deliberate ignition system would provide ade-quate margins of safety in the event of a degraded core accident.
The staff's evaluation is documented in Supplements 3 through 6 to the Sequoyah SER (NUREG-0011).
In view of the similarities between the McGuire and Sequoyah
~ system designs and the joint nature of the utility hydrogen research programs, many of the staff's findings for Sequoyah are applicable to the McGuire system as well.
Accordingly, the emphasis of the present evaluation is on those aspects of the McGuire system that differ from those of Sequoyah and on prog-I ress in those areas identified in the Sequoyah review as needing further study.
In this report, the staff concludes that subject to the licensee's implementa-tion of certain commitments regarding the location of igniters in the lower and upper compartments of containment and the addition of control room indication of system status, the permanent hydrogen mitigation system at McGuire will per-form.its intended function in a manner which ensures adequate margins of safety.
C.2 SYSTEM DESCRIPTION C.2.1 General The HMS is a system of thermal igniters and ancillary equipment Duke has in-stalled within the containment of McGuire Units 1 and 2.
The igniters are designed to ensure a controlled burning of hydrogen.in the unlikely event that excessive quantities of hydrogen, well beyond the design bases required by 10 CFR 50.44, are generated as a result of a postulated degraded core accident.
The HMS is designed to promote the combustion of hydrogen in a manner such that containment integrity is maintained.
The HMS is virtually identical to the interim system evaluated by -the staff in early 1981 (NRC,1981) except for slight modifications in the number and location of igniters.
As in the interim system for McGuire (Duke, Feb. 17, 1981), the permanent system utilizes the Model 7G glow plug manufactured by General Motors (GM) AC Division.
The igni-
-ter is powered directly from a 120/14V ac transformer.
Each igniter assembly consists of a 1/8-in.-thick steel box (8 in. H x 6 in. W x 8 in. D) which con-tains the transformer and all electrical connections and partially encloses the igniter. This enclosure meets National Electrical Manufacturers Association (NEMA) Type 4 specifications for watertight integrity under various environ-mental conditions, including exposure to water jets.
The sealed box incorpo-rates a copper heat shield to minimize the temperature rise inside the igniter assembly, and a spray shield to reduce water impingement on the glow plug from above.
In addition, the igniter system is designed to meet seismic Category I requirements.
C.2.2 Igniter Power Supply The igniters in the HMS are equally divided into two redundant groups, with five separate circuits and circuit breakers per group.
The number of igniters on each circuit ranges from 1 to 10.
Igniters located at elevations near the flood level (those in the pipe chase and incore instrumentation area) are on dedicated circuits.
Each group has independent and separate control, power, and igniter locations to ensure adequate coverage even in the event of a single failure.
The system is to be manually actuated from the auxiliary building.
McGuire SSER 7 C-2
The igniters are powered from the Class 1E emergency lighting power system that has normal and alternate power supply from offsite sources.
In the event of a loss of offsite power, the igniters would be powered from the emergency diesel generators.
Group A igniters receive power from the train A diesels and Group B igniters from the train B diesels.
In the course of the Sequoyah hydrogen control system review, the ACRS recom-mended that the staff further consider the need for a backup power supply to ensure hydrogen mitigation system operability in the event of a station black-out.
The staff has considered the need for such'a backup for McGuire and con-cludes that the probability of recoverable degraded core accidents involving station blackout at McGuire is sufficiently remote that such sequences need not be made a design-basis scenario for the distributed ignition system.
This conclusion is based on both a qualitative and quantitative assessment of the McGuire power system.
Qualitatively, several features of the McGuire power system should provide an ac power supply system reliability that is better than average.
These features include the location of McGuire in the Duke Power grid, as well as design fea-tures such as immediate, multiple accessibility to the offsite power source, instantaneous isolation capability of the switchyard breaker design, and elimi-nation of the fast transfer scheme by generator circuit breakers.
The McGuire Nuclear Station is located in the center of the Duke Power System and is connected to the Southeastern Electric Reliability Council grid by five double-circuit 230-kV and four 500-kV transmission lines.
This is the same grid to which Sequoyah belongs.
Each of the McGuire generating units is pro-vided with two immediate access circuits to the offsite power system.
Each of these two circuits is separate and powered on independent towers from the switching stations to each unit's two stepup transformers.
In addition, there are two interties provided between Unit 1 and Unit 2 power systems at the 6900/4160-V levels so that the two incoming offsite power sources to either unit may be utilized to supply the engineered safety features' loads to the other unit.
The McGuire switchyard design employs a breaker-and-a-half scheme (three breakers) as opposed to a bus transfer scheme.
The breaker-and-a-half scheme is a simpler and more reliable system because of better automatic isolation capability for certain faults.
The bus transfer scheme requires a series of breaker operations for its transfer scheme to work and also may involve time delays.
The McGuire design provides two diesel generators per unit, with manual cross-ties which make it possible to use one of the diesels from the other unit to supply emergency loads should both diesels be lost on one unit.
The McGuire I
design also employs generator circuit breakers, which accommodate certain faults in the region of the generator, and turbine or reactor trips without the need for a fast transfer to an immediate access source.
This lack of dependence on fast transfer schemes makes for a more reliable system.
In addition, McGuire has a distinctive design feature, a safe shutdown system with a fifth dedicated diesel generator.
Considering the above design features, the staff concludes that qualitatively the reliability of the McGuire ac power supply system should be better than average and should reduce the likelihood of station blackout at McGuire.
McGuire SSER 7 C-3
l l
t In addition to this qualitative assessment, the staff has considered the prob-ability of recoverable degraded core accidents involving station blackout, including the reactor coolant pump seal loss-of-coolant-accident scenario iden-tified in the Zion and Indian Point Probabilistic Safety Studies.
The staff concludes that the probability of recoverable degraded core sequences involving station blackout is sufficiently remote that such sequences need not be made a design-basis scenario for the distributed ignition system.
This small proba-bility is due in part to the relatively short time window following onset of hydrogen generation in which ac power must be restored to preclude a core melt.
The probability of restoring power within this window is estimated to be 0.07.
The staff, therefore, concludes that pending completion of Unresolved Safety Issue Task Action Plan (TAP) A-44 on station blackout, the safety benefits derived from an additional power supply do not warrant the associated costs.
The subject of backup batteries for hydrogen control systems will be addressed in the resolution of TAP A-44; however, preliminary indications are that the findings of this study will reinforce the present conclusion.
C.2.3 Igniter Coverage The hydrogen mitigation system consists of 66 igniter assemblies distributed throughout the upper, lower, dead ended, and ice condenser compartments.
Fol-lowing the onset of a degraded core accident, any hydrogen that is produced would be released into the lower compartment.
To cover this region, 20 igniters (equally divided between the power trains) have been provided.
Eight of these are distributed on the lower compartment side of the operating deck.
Two igniters are located at the top of each of the five steam generator and pres-surizer enclosures, and another pair is located above the reactor vessel.
Any hydrogen not burned in the lower compartment would be carried up through the ice condenser and into its upper plenum.
Because steam would be removed from the mixture as it passes through the ice bed, thus concentrating the hydrogen, mixtures that were nonflammable in the lower compartment would tend to become flammable in the ice condenser upper plenum.
Controlled burning in the upper plenum is preferable to burning in the upper compartment because upper-plenum burns involve smaller quantities of hydrogen per burn and allow for the expansion of the hot gases into the compartment, thereby reducing the peak pressure.
Duke has chosen to take advantage of the beneficial character-istics of combustion in the upper plenum and has distributed 12 igniters around it.
These igniters are located in a staggered fashion alternately between the crane wall and the containment shell wall sides of the upper plenum, at 12 al-most equally spaced azimuthal locations.
To handle any accumulation of hydrogen in the upper compartment, eight igniters are located in the upper compartment dome.
The air return fans provide re-circulation flow from the upper compartment through the dead-ended volume and
{
back into the lower compartment.
To cover the dead-ended region, a pair of igniters is located in each of the eight rooms through which the recirculation flow passes.
In addition, five pairs of igniters are provided in the incore instrumentation area and the pipe chase.
I The staff has reviewed the number and locations of igniters provided in the HMS and finds the igniter coverage acceptable provided additional igniters are in-stalled at lower elevations in the lower compartment, and several of the upper McGuire SSER 7 C-4
compartment igniters are relocated to lower elevations in the upper compartment.
The overall objective of this system enhancement is to provide added assurance that combustion of lean mixtures will occur in both the lower compartment and the upper campartment.
Currently, all lower compartment igniters are located at the top of the compart-ment (on the ceiling below the operating floor).
The staff has requested that Duke install additional igniters at lower elevations in the lower compartment to further promote combustion at lower concentrations characteristic of upward propagation.
On the basis of its review, the staff concludes that the addition of at least two igniters in the vicinity of the pressurizer relief tank and recctor coolant piping penetrations (elevation approximately 35 ft below the existing igniters) would provide the appropriate lower compartment coverage.
Comparable lower compartment igniter coverage has already been provided in the hydrogen mitigation system installed in the Sequoyah and D. C. Cook ice con-denser plants.
Duke has committed to provide two additional lower compartment igniters at McGuire Units 1 and 2 before restart following the first refueling of,each unit.
For operation during the first operating cycle, the present igniter arrangement is acceptable.
The staff also has requested that Duke provide igniters at lower elevations in the upper compartment of containment to reduce the consequences of burning in this compartment.
Currently, all of the upper compartment igniters are located in the dome region above the spray headers.
Installation of upper compartment igniters at lower elevations would further promote combustion at lower hydrogen concentrations and provide added assurance that any burning in the upper com-parment will involve smaller quantities of hydrogen.
The staff believes that the placement of four additional igniters at lower ele-vations represents a significant improvement in upper compartment coverage and has requested Duke to make the appropriate modifications.
The Commission has required TVA to provide comparable igniter coverage for the permanent hydrogen mitigation system at Sequoyah.
Duke is unable to complete this modification in Units 1 and 2 before the date for Unit 2 startup but has committed to do so before restart following the first refueling of each unit.
For operation dur-ing the first fuel cycle, the staff considers the present igniter arrangement acceptable.
C.2.4 System Actuation The licensee's emergency operating procedure for responding to loss-of-coolant accidents (LOCAs) includes instructions for actuating and securing the hydrogen mitigation system.
This procedure is to be used by operating personnel after they have taken immediate actions to shut down the plant r d diagnose the acci-dent as a loss of coolant.
The first step in the LOCA procedure instructs the y
operator to verify that all immediate actions in the "Immediate Actions and Diagnostics" procedure have been performed.
The next step in the LOCA proce-dure provides instructions to actuate the HMS.
The licensee has determined that the time of actuation will be approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> before the first release of hydrogen to containment. As recommended in the interim evaluation, the air handling units used for normal refrigeration in the ice condenser will be ixippad for both units for accidents in which the HMS is actuated.
McGuire SSER 7 C-5
The LOCA procedure calls for the HMS to remain actuated (1) for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after the establishment of_ adequate core cooling if any indication of inadequate core cooling exists or has existed or (2) until the containment pressure drops below 0.25 psig if adequate core cooling has always existed for the duration of the transient.
The procedure instructs the operator to reactuate the HMS if there is indication of return to inadequate core cooling.
The staff has determined that the LOCA procedure provides instructions to actuate the HMS under all conditions for which it would be needed, and that the instructions for securing the system are based on acceptable conditions.
The HMS is presently actuated by switching a total of 14 breakers at six loca-tions in the auxiliary building.
The postaccident radiation levels in these areas are estimated to be less than 100 mR/ hour, or approximately one-tenth the level at which a specific task evaluation would be performed.
The staff has reviewed the sequence.in which the HMS breakers are actuated in the auxiliary building and concludes-that the required actions can be completed in a reason-ably short time (less than 10 min).
Although the present switching arrangement affords the operator sufficient time to actuate the HMS for any event in which it would be' required, to provide added assurance that the system will_be actuated in a timely manner, the licensee has committed to modify the HMS so that it can be manually actuated from the main control room.
This modification will be made for Units 1 and 2 before restart following the next refueling of each unit. -The licensee also has committed to provide a means of verifying the system status from the control room by that time.
The staff finds these changes acceptable.
For operation during the first fuel cycle, the staff considers the present switching arrangement acceptable, provided a number of procedural and other improvements are: implemented. As indicated below, each of these items has been discussed with the licensee and he has stated that the necessary improvements will be made for Units 1 and 2 before startup following the steam generator modi-fication outage for Unit 2.
The procedural substeps that provide instructions for actuating the HMS and securing the HMS following termination of safety injection include actions at different locations (motor control center or electrical panels) within the same substeps.
No checklist is provided in the procedure for the operator's use in' keeping track of his actions while performing the breaker operations required with the present arrangement.
Some type of placekeeping aid should be provided.
The licensee has stated that the detailed instructions for actuat-ing and securing the HMS will. be removed from the body of the procedure and placed_in an attachment to the procedure, and that the attachment will provide a separate checkoff space-for each breaker.
The staff finds this to be an acceptable means of placekeeping.
j Step 3.43 of the LOCA procedure includes two instructions:
(1) secure the HMS
_and (2) reactuate it upon indication of inadequate core cooling.
The presence
(
_of two instructions in one step is undesirable because an operator may believe I
that'the step is completed when one instruction is accomplished. This is of special concern if the operator is under stress.
The licensee has stated that the procedure will be revised to place these two instructions in separate steps.
McGuire SSER 7 C-6
In addition, to provide added assurance that the HMS will be actuated upon indi-cation of inadequate ~ core cooling (ICC), the ICC procedure will be revised to provide instructions to actuate the HMS.
In addition to the operational improvements discussed above,.the licensee has stated that improvements will be made in the labeling of the HMS breakers at the four lighting panels.
To provide added assurance that the proper breakers will be operated to actuate or secure the HMS, these breakers will be labeled distinctively to make them easily identifiable as HMS breakers.
Subject to confirmation that the stated improvements are made, the staff con-cludes that the procedural instructions for operating the HMS are acceptable.
In addition, the emergency operating procedures will be upgraded in accordance with TMI Action Plan Item I.C.1 and " Supplement 1 to NUREG-0737 - Requirements for Emergency Response Capability" (Eisenhut, Generic Letter No. 82-33, dated December 17, 1982).
The upgraded procedures will address hydrogen mitigation systems.
The licensee's program for upgrading these procedures will be reviewed and the procedures will be subject to staff audit.
C.2.5 Surveillance Testing To ensure that the HMS will function as intended, Duke has proposed a surveil-lance testing program similar to that established fcr the interim system.
Preoperational testing, to be performed before startup, will verify that the electric current drawn by each group of igniters is within tolerance, and that the temperature of each igniter is at least 1700 F.
The current measured in each circuit during preoperational tests provides the baseline for future sur-veillance tests.
The igniter system will be subjected to surveillance testing on a quarterly basis.
This testing will consist of energizing the HMS and taking current and voltage readings of the igniter circuits at the emergency lighting panelboards.
If the power consumption does not compare favorably with that measured during preoperational testing, the igniters on the affected circuits will be individ-ually inspected to ensure their operability.
In addition to power consumption measurements, the igniter temperatures will also be measured at specified intervals.
C.3 COMBUSTION / IGNITER TESTING In support of the interim distributed ignition system, Duke, TVA, and AEP con-ducted two testing programs to'obtain information pertinent to the performance characteristics of the glow plug igniters.
A summary discussion of igniter testing was provided in Supplement 6 to the Sequoyah SER.
The staff concluded in its review of the Sequoyah system that the results of the utility combustion testing programs support the use of a distributed ignition system for post-accident hydrogen control.
Although staff findings regarding the deliberate ignition system were favorable, the issue of igniter performance in a spray environment remained an open item in the staff's final evaluation of the Sequoyah hydrogen control system.
This was due primarily to the fact that the Tayco igniter used in the Sequoyah system (1) exhibited a tendency to cool significantly in the spray environment and i
McGuire SSER 7 C-7 t
(2) was never combustion tested in a spray environment.
Furthermore, what spray tests were conducted with this igniter failed to simulate adequately important characteristics of the spray environment, such as spray droplet flux.
These factors led the staff to require additional testing for the Tayco igniter.
The McGuire system uses a GM glow plug igniter rather than the Tayco igniter.
With regard to testing of the glow plug in a spray environment, numerous tests have been performed as part of both early testing at Fenwal in support of the interim system and the utility hydrogen research program conducted during the past 2 years.
In all tests, the glcw plug successfully initiated combustion in a spray environment.
In the Fenwal tests, a hollow cone nozzle with a 45-degree half angle was installed at the top of the 6-ft-diameter spherical test vessel; a glow plug igniter was located at the center of the sphere.
Static tests with hydrogen concentrations of 6% and 8%, as well as transient tests, were conducted.
These tests indicated the effects of spray operation on igniter performance to be minimal in terms of affecting the ability of the igniter to initiate combustion.
However, with the hollow cone nozzle used, it is likely that a large fraction of the spray passed through the periphery of the spray cone and ran down the vessel wall, rather than falling vertically through the vessel atmosphere.
As spray density was not measured in these tests, the Fenwal tests by themselves are considered inconclusive with regard to the effect of the spray on igniter performance.
Additional spray tests were conducted by Factory Mutual (FM) and Acurex as part of the utility research program.
The FM test program investigated the effects of water fog density, droplet diameter, and temperature on the lower flamma-bility limit of hydrogen-air nixtures; the Acurex program addressed the effects of fog and sprays on the characteristics of deflagration at larger scale.
The results of these programs are discussed in Supplement 6 to the Sequoyah SER.
As part of the FM test program, 13 tests were conducted with the glow plug using different spray nozzles to achieve a range of spray conditions.
The droplet size, droplet distribution, and spray flux present in the ignition tube were measured in the FM' tests.
From this information and consideration of droplet fall velocities, spray density was determined.
Estimated spray conditions investigated ranged from a spray density (water volume fraction) of 2 X 10 5 with a volume mean droplet diameter of 10 p to a density of 1 X 10 2 with a mean droplet diameter of 100 p.
Spray flux at a horizontal plane in the vessel 2
An unshielded glow plug successfully initi-ranged from 0.04 to 0.23 gpm/ft ated combustion in all tests.
The staff has compared the spray environment in the FM tests with that expected in the upper compartment of the McGuire containment.
The McGuire upper com-partment environment can be characterized by a spray density of approximately 2
2 X 10 4, a mean droplet diameter of 700 p, and a spray flux of 0.65 gpm/ft,
Thus, the FM glow plug tests bound the spray density expected in containment but underestimate the spray flux and droplet size.
In addition to the FM tests, a number of spray tests were also conducted in the Acurex test vessel.
Sp, ray nozzles investigated at Acurex included a nozzle of the same type as that installed in McGuire; thus, concerns regarding droplet McGuire SSER 7 C-8
size effects were alleviated.
The glow plug successfully initiated combustion in all tests; however, important characteristics of the spray environment such-as spray droplet density and spray flux were not quantified in these tests.
In spite of the apparent shortcomings of many of-the spray tests, the range of spray conditions. investigated with the glow plug resulted in a significant variation in several important spray parameters which influence-igniter cooling
- and operability, e.g., droplet spray temperature and spray flux.
Although any one test might be considered inadequate with regard to'some spray parameter or l
lack of a particular test measurement, the body of data taken as a whole.sup-ports the-use of the glow plug igniter.
The fact that combustion was initiated in all cases-provides assurance that the glow plug will operate as intended in a spray environment.
Additional assurance is provided by the igniter spray shield (not evaluated in the aforementioned tested but installed on.each igni-l ter assembly in the plant), which will reduce water impingement on the glow l
plug from above.
The staff intends to further investigate the effect of spray on igniter operability as part of its ongoing hydrogen research program at-Sandia but finds that the glow plug combustion-tests conducted-to date provide an adequate basis for use of the glow plug igniter in the permanent hydrogen mitigation system at McGuire.
'C.4 DETONATIONS AND FLAME ACCELERATION i
I As discussed in Supplement 6 to the Sequoyah SER, a series of large-scale mix-ing tests was conducted by the Hanford Engineering Development Laboratory (HEDL) as part of the Electric Power Research Institute (EPRI) research program.. Test results show that~ good mixing in the lower compartment can be expected if the air return fans remain operational thoroughout-the accident.
In all cases with forced air recirculation, which included two jet orientations and two different.
release rates, the maximum concentration difference between all points in the
' test compartment was less-than 3 volume percent at all times and was generally on the order of 2L The upper compartment of containment is also expected to be well mixed because of operation of the containment spray system.
On the basis of its review of the HEDL results, the staff concludes that the formation of significant hydrogen concentration gradients in containment is unlikely.
With regard to the potential for local detonations, operation of the deliberate ignition system in conjunction with the mixing by the air return fans ensures that hydrogen concentrations throughout containment will not approach those limits necessary to support detonation for the duration of the accident.
In this regard, the formation of detonable pockets of hydrogen should be precluded.
Even assuming that a high concentration might be formed locally, detonation of the cloud by a glow plug igniter is unlikely because these igniters are generally acknowledged to be' unsuitable as direct initiators of a detonation.
This con-clusion that detonation will not occur is supported by test data, including several of the tests recently conducted at Whiteshell and Lawrence Livermore National Laboratory (LLNL). - Although these tests do not show conclusively that detonation or. transition to detonation cannot occur, they do illustrate the difficulty involved in~ producing the phenomenon even when using stoichiometric hydrogen-air mixtures.
Another concern related to the detonation issue is that of flame acceleration.
The phenomenon of flame acceleration as a possible mechanism for producing a McGuire SSER 7 C-9 o
detonation or large overpressures in containment and the staff's position on this matter were discussed in Supplements 4, 5, and 5 to the Sequoyah SER.
As discussed in Supplement 6 to the Sequoyah SER, the staff has previously considered these matters and concluded that flame acceleration poses no threat to the containment.
Additional tests are planned at both McGill and Sandia to address such topics as the effects of steam addition and scaling on the requisite hydrogen concen-tration for flame acceleration.
A substantial portion of this work will be conducted in the FLAME facility and the heated detonation tube at Sandia as part of the NRC hydrogen research program.
Results of these programs should become available in mid-to-late 1983.
The staff believes, however, that the findings to date by McGill (Berman,1982) will not be significantly altered by the additional tests and that they provide an adequate basis for its con-clusion that detonations will not occur.
Even though investigations show detonable mixtures of hydrogen will not be formed as a result of a postulated degraded core accident at McGuire, Duke has calculated the response of the containment shell to a postulated local detona-
' tion of a 6-ft-diameter gas cloud adjacent to the containment shell.
The results of this analysis showed that the calculated local stresses were well below the actual material yield strengths, and within the allowable limits as specified by the American Society of Mechanical Engineers, " Boiler and Pressure Vessel Code" (ASME Code).
At the request of the staff, Sandia has performed independent calculations of the effects of various postulated local detonations on the containment struc-ture using the CSQ computer code in conjunction with a detailed structural model.
Results of conservative calculations for the upper plenum of an ice condenser plant indicate that the containment would survive upper plenum detonations.
Additional detonation calculations for other regions in contain-ment are planned to improve the staff's understanding of the consequences of local detonations and to better assess safety margins.
As previously stated, however, it is the view of the staff that the conditions that must prevail to produce detonations are extremely unlikely.
Moreover, even with the presence of detonable mixtures, as assumed in the the Sandia analysis, there has been no demonstration that a detonation could be initiated.
As the results of the Sandia investigation are not expected to alter the staff's findings on the hydrogen control capability at McGuire, this effort is viewed as confirmatory.
C.5 DEGRADED CORE ACCIDENTS AND HYDROGEN GENERATION As discussed in the staff's analysis of the interim system, a small-break LOCA followed by a failure of emergency core cooling injection (S 0) was selected 2
by Duke as the base case for evaluation of the hydrogen mitigation system.
Hydrogen release rates for this scenario are a time-varying function whose average is about 20 lb per minute.
The staff considered these rates to be representative of releases that might be encountered in typical degraded core accidents and considered them an acceptable upper limit basis for use in the interim evaluation.
However, for purposes of the final evaluation the staff requested Duke to broaden the studies of steam and hydrogen releases to account for a number of uncertainties in the analysis.
Among these were the possibility McGuire SSER 7 C-10
that (1) other scenarios might present schedules of steam and hydrogen releases not covered by the analysis chosen; (2) steam inerting might occur at some time during the sequence allowing large concentrations of hydrogen to develop; (3) the recovery pericd might produce an exceptional burst of steam or hydrogen; or (4) hydrogen might be released after the loss of the ice heat sink.
In the follow-on CLASIX studies that were submitted by Duke (Parker, Oct. 30, 1981),
hydrogen releases were varied to correspond to higher release rates (260 lb per minute) and releases after the ice had melted.
The staff has compared the release rates and sequences used in Duke calculations with those developed in an independent study of degraded core accidents in ice condenser plants carried out at Brookhaven National Laboratory (Yang and Pratt, 1982).
It is clear from this comparison that Duke's choices of hydrogen and l
steam celease rates cover the above range of accident scer,arios.
The highest rate of hydrogen release calculated by Brookhaven was about 60 lb per minute.
The Brookhaven calculations did not indicate that these rates would be exceeded during quenching or recovery from the degraded core conditons as well as in the initial core uncovery phase.
In addition, the staff has compared the release rates chosen by Duke with those anticipated in the Interim Rule on hydrogen control.
(The 1000-lb per-minute maximum suggested in the proposed rule is considered to be overly conservative and will likely be reduced to about 150 lb per minute in the final rule.)
In this comparison, the release rates used by Duke were again found to be an ade-quate representation of the scenarios considered important in these degraded core situations.
The staff, therefore, finds the Duke treatment of scenarios to develop steam /
hydrogen source terms to be in conformance with the anticipated requirements of the Interim Rule on hydrogen control for degraded core accidents.
C.6 MCGUIRE CONTAINMENT STRUCTURAL CAPACITY In support of the licensing of the McGuire plant, the ultimate pressure-retaining capacity of the McGuire steel containment was calculated by the staff's con-sultant, Ames Laboratory (NUREG/CR-1891).
The calculations indicated that the steel containment has a mean ultimate capacity of 84 psig.
To provide an ade-quate safety margin, the staff reduced its mean ultimate value of 84 psig by three standard deviations.
The standard deviation computation incorporated the variations in the material properties, material sizes and thicknesses, stiffener spacing, and containment shell diameter.
The standard deviation of the contain-ment pressure was calculated to be 12 psig. Therefore, the ultimate capacity of the containment adopted by the staff was 43 psig.
An assessment of the con-tainment penetrations was also made by the licensee which indicated that the pressure capacity of the penetrations is greater than that of the containment shell.
Thus, the penetrations are not the controlling item for the containment pressure capacity.
The licensee has also made an evaluation of the reinforced concrete floor that divides the upper and lower compartments (operating floor).
This evaluation showed the reinforced concrete floor differential pressure capacity to be 41 psi.
The staff consultant computed the value of the internal pressure which would produce stresses in the steel shell corresponding to Service Level C limits as McGuire SSER 7-C-11
specified in the ASME Code,Section IV, Division 1.
This value is 38 psig.
This value is based onLthe finite element analysis model used in computing the containment ultimate capacity reported earlier.
The limiting section in this analysis is the 3/4-in.-thick cylindrical plate.
Duke independently computed the ASME Code Service Level Cl nternal pressure, based on his containment chell i
panel model, and reported this value to be 45 psig.
On the basis of the con-sultant's analyses and the licensee's analyses, the ctaff concludes that the
~
ostimated pressure retention' capability for ASME Code Service Level C limits is 38 psig with all of the inherent safety margins of the code implied.
The Interim Rule ci hydrogen control will permit some flexibility in the method used by the licensee to demonstrate containment structural integrity.
As pro-posed, acceptable methods would include (1) the use of actual material proper-ties with suitable margins to account for uncertainties, which results in the calculated value of.43 psig for the McGuire containment, or (2) the use of ASME Code Service Level C limits, which results in a value of 38 psig for McGuire.
Containment analysed discussed later indicate that for McGuire, the containment pressure response to a postulated hydrogen burn event will remain below either pressure value throughout the transient.
C.7 CONTAINMENT ANALYSIS C.7.1 Containment Codes Calculations of containment atmospheric pressure and temperature have been per-formed using the CLASIX corrputer code developed by Westinghouse Offshore Power Systems (Westinghouse OPS-36A31).
Descriptions of the CLASIX code have been previously reported in Supplements 3 through 6 to the Sequoyah SER.
As part of the McGuire Unit 1 license condition, the staff asked for improved calculational methods for containment pressure and temperature response to hydrogen combustion.
Specifically, the staff requested that CLASIX be refined to permit the simulation of structural heat sinks and the separate modeling of the upper plenum.
The present and latest version of CLASIX incorporates these changes.
In addition, the staff requested further verification of the CLASIX code by comparison with results from other accepted codes and combustion tests.
To increase the level of confidence in the CLASIX code, the licensee has com-pared calculated results from CLASIX with the calculated results of the Westing-house C0C0 CLASS 9 code (Westinghouse, 1981), the Westinghouse Transient Mass Dis-tribution (TMD) code (WCAP-8077, -8078), and the measured results of selected Fenwal and LLNL tests.
A more detailed discussion of the CLASIX code, verifica-tion efforts, and staff review is provided in Supplement 6 to the Sequojah SER.
Additional confirmation of the CLASIX code has been provided by means of a gen-cric hydrogen combustion code currently under development at Sandia as part of the NRC hydrogen research program.
The Sandia HECTR (hydrogen event: -contain-ment transient response) code is comparable to CLASIX and COMPARE in terms of analytical capabilities for ice condenser plants, but will in future versions provide for more detailed treatment of mixing, transport, and flame propagation than the present codes perr.it.
Preliminary HECTR analyses for the Sequoyah base case are in good agreement with the results of CLASIX and COMPARE analyses.
McGuire SSER 7 C-12
t j
C.7.2 Containment Pressure and Temperature Calculations The approach taken by Duke to establish the acceptability of the hydrogen miti-a gation system was to select an accident sequence based on its significance and characteristics'from the standpoint of hydrogen threat, and then to vary key 4
aspects of the containment analysis parametrically.
This is the same approach used by TVA in the licensing of Segouyah.
As in previously reported analyses, a small-break LOCA with failure of safety injection, the S D event, was chosen 2
as the base case.
Duke has performed calculations of the containment pressure and temperature response to the base case scenario using the latest version of CLASIX and the releases calculated from the MARCH code.
For the base case cal-culation, Duke assumed a lower flammability limit of 8.5 volume percent hydro-gen, complete combustion, and a flame speed of 6 fps.
Test data from Fenwal
'and Whiteshell, as well as the literature on combustion, indicate that ignition in the turbulent postaccident environment will occur around 5 volume percent hydrogen.
The assumption of ignition at the higher concentration results in a greater amount of energy being released over a shorter period of time, and thus is conservative.
Another conservatism in the CLASIX analysis is the assumption
- l. /
that ignition will occur simultaneously at all igniter sites in a compartment.
This assumption will act to further increase the calculated pressure and temperature.
The results of the CLASIX base case analysis indicate that the hydrogen will be ignited in a series of 6 burns in the lower compartment and 23 burns in the upper plenum.
The burns occur over a 2500-sec interval, with the 6 lower com-partment burns intermixed, some concurrently, with 13 upper plenum burns over the first half of the interval.
The peak calculated containment pressures and temoeratures are 12.5 psig and 1358*F for the lower compartment, 12.5 psig and b
!/
255 F for the dead-ended region, 12.6 psig and 1526*F for the upper plenum, and 12.0 psig and 173*F for the upper compartment.
The peak differential pressure s
across the operating floor is approximately 2 psi, with the higher pressure occurring in the upper compartment. The pressure in containment before the l
first burn was approximately 6 psig.
As a result of the action of engineered safety features such as the ice conden-ser, air return fans, and upper compartment spray, the pressure and temperature spikes were rapidly attenuated between burns. After the last hydrogen burn, which occurs at approximately 7000 sec into the accident, roughly 1.1 x 108 lb of ice are calculated to remain in the ice condenser section (representing at least 150 x 108 Btu in remaining heat removal capacity).
In summary, the result, of i.9 Duke base case analysis show an increase in con-tainment pressure as a result of ivydrogen burns of about 7 psi, with the con-tainment remaining well below the lower bound ultimate capacity of 48 psig.
The analysis predicts that burning will occur in the lower compartment and the upper plenum, thereby gaining the advantage of heat removal by the ice bed and venting to the large upper compartment volume.
It should also be noted that each burning cycle involved the combustion of only 35 lb of hydrogen or roughly 2 x 10s Btu of energy addition.
By burning at a given concentration in the lower compartment and upper plenum, there is also the advantage of burning less total hydrogen at a time because the combined volume of these compartments accounts for less than one-third of the total containment volume.
McGuire SSER 7 C-13
In addition to the base case, Duke has performed sensitivity studies to assess the effects of partial operation of the containment air return fans and sprays, heat removal by ice, and hydrogen release rates.
Finally, the effect of such postulated phenomens as fogging reducing the burn completeness in the upper plenum and steam inerting the lower compartment were analyzed by Duke.
The results of selected CLASIX sensitivity analyses are summarized in Table C.1, along with the results predicted by Los Alamos National Laboratory (LANL) using the hydrogen burn version of the COMPARE code.
In all cases analyzed, the peak containment pressures calculated by either code are well below the ultimate containment pressure capacity of 48 psig and are typically below the contain-ment design pressure of 15 psig.
It should be noted that the calculated peak pressures reported for the McGuire sensitivity cases are generally lower than comparable results for Sequoyah.
This is attributed primarily to the fact that a flame speed of 2 fps was assumed in the McGuire sensitivity analyses in con-trast to the more conservative value of 6 fps used in the Sequoyah analyses.
Peak pressures obtained using a 6-fps flame speed are expected to be somewhat higher but still well below the containment pressure capacity.
Also, peak pressures and temperatures predicted using the early version of CLASIX are con-servative because this version does not take credit for radiation heat transfer
'from the flame and heat transfer to passive heat sinks.
The results of the CLASIX sensitivity analyses demonstrate that a wide variation in assumptions still results in acceptable containment pressures.
It should be noted that the cases with no ice are not mechanistic; i.e., they are not repre-sentative of the S D scenario.
However, these cases importantly demonstrate 2
that, even without ice, the containment pressure with the assumed igniter opera-tion remains below the containment pressure capacity.
This serves to indicate some insensitivity to whatever accident scenario is chosen.
C.7.3 Confirmatory Analysis and Conclusion At the request of the staff, LANL has performed confirmatory analyses for the base case and several other cases using the hydrogen burn version of the COMPARE code (NUREG/CR-3278). Agreement between COMPARE and CLASIX analysis of the base case transient was good, with COMPARE predicting a peak containment pressure of 15 psig and peak differential pressure across the operating floor of 3 psi for the base case.
More exhaustive comparisons between CLASIX and COMPARE were not pursued for McGuire because detailed comparisons performed for Sequoyah (described in Supplement 6 to the Sequoyah SER) indicated good agreement between the two codes.
Although the Duke sensitivity studies indicate that containment integrity will be maintained for the base case and all sensitivity variations considered, upper compartment burns occurred in only a few cases, and in those cases a flame speed of 2 fps was assumed.
The subject of burning in the upper compartment was pre-viously identified as a staff concern in the review of the hydrogen mitigation system at Sequoyah.
Staff interest in this area lies in the fact that ignition in the large, relatively open upper compartment conceivably represents the largest energy release' rate by combustion and thus the greatest threat to con-tainment. As a result of these considerations, the staff required TVA to install additional upper compartment igniters in the permanent hydrogen mitiga-tion system at Sequoyah to ensure smaller burns in this region.
Although the McGuire SSER 7 C-14
Table C.1 Containment sensitivity studies
- Calculated peak Calculated peak pressure (psig) temperature ( F)
LC UC LC UC Base case 12.5 12.0 1358 173 (14.4)
(15.1)
(1542)
(215)
Flame speed 1 fps flame 9.4 9.4 717 135 2 fps flame 11.8 11.6 1138 162 Safeguards 1 fan, 1 spray operation 12.7 12.7 1100 175 No ice 19.2 19.2 1167 407 Hydrogen release 4 x base case H2 release rate 10.4 10.6 1193 164 Reduced igniter performance Inerted LC 10.3 10.6 225 160 Inerted UP 14.4 14.4 1250 388 LANL mechanistic burn model Conservative (30.8)
(29.5)
(1563)
(542)
Best estimate (23.9)
(24.1)
(1458)
(377)
- LC = lower compartment; UC = upper compartment; UP = upper plenum.
All sensitivity cases assume base case parameters and 2-fps flame speed except as noted;
( ) = results predicted by LANL using hydrogen burn version of COMPARE.
Duke upper compartment burns did not result in excessive pressures, the staff asked LANL to investigate this phenomenon further for McGuire.
In response to the NRC request, LANL performed a number of additional sensi-tivity analyses using the modified COMPARE code.
The approach taken by LANL was to identify the combination of burn parameters required to produce the.
maximum containment pressure and then to assign parameter values based on a mechanistic burn model that is substantiated by test.
Independent burn initia-tion in the upper compartment was identified as necessary to produce maximum pressures.
(
The model used by LANL to establish parameter values for the COMPARE contain-ment analyses is based on estimates of turbulence levels and fluctuations, and McGuire SSER 7 C-15
their relationship to eddy diffusivity and burn velocity.
Specifically, the controlling rate mechanism for the transport of the hydrogen from its source to an igniter can, in general, be estimated by using turbulence theory.
The rate of burning for the lean mixtures under consideration is also controlled by the turbulence level.
The level of turbulence can then be estimated by summing all of the dissipation sources (sprays, fans, jets, natural convection, etc.) and by using the formulation that relates the turbulent kinetic energy, mixing length, and eddy diffusivity to the rate of dissipation of kinetic energy.
The tur-bulence model was used to estimate the mean concentration at the initiation of burning, and the flame speed for the ice condenser containment burn analyses in which the first burn occurred in the upper compartment.
(
Two COMPARE calculations were performed for McGuire to assess the significance of upper compartment burning.
Burn parameters for these runs were specified so that burning could only initiate in the upper compartment but could propa-gate into any compartment in which the hydrogen concentration is greater than 4.1 volume percent.
The first COMPARE run assumed ignition at 5% hydrogen with 40% burn completion and a flame speed of 30 fps.
The second run assumed the best estimates for these parameters based on the mechanistic burn model, i.e.,
ignition at 4.2% hydrogen with 10% burn completion and a flame speed of 16 fps.
Results of these calculations, summarized in Table C.1, show that for both cases peak pressure will remain below the pressure capacity of the containment.
The peak differential pressure across the operating floor was calculated to be ap-proximately 10 psi for these cases.
A structural analysis of the containment air return fans shows their pressure differential pressure capability to be well in excess of this value.
The staff concludes that the CLASIX containment analysis performed by Duke and confirmed in part by LANL provides an adequate basis for concluding that hydro-gen combustion associated with the operation of the HMS will not pose a threat to the integrity of the McGuire containment.
The staff, however, intends to continue its evaluation of the code as part of its ongoing code assessment work and licensing of hydrogen control system for other plants.
C.8 SURVIVABILITY OF ESSENTIAL EQUIPMENT Although the HMS is designed to prevent high hydrogen concentration buildup by deliberate ignition of relatively low concentrations of hydrogen in hydrogen-air-steam mixtures, the resulting release of thermal energy may still be suf-ficient to significantly increase the temperature of the equipment located in the containment.
Because some of this equipment is needed to ensure main-tenance of the safe shutdown condition and of containment integrity, Duke was required to demonstrate that the essential equipment located inside the contain-ment will survive the hydrogen burn environment resulting from operation of the HMS.
Duke has determined analytically the thermal response of selected pieces of essential equipment exposed to a hydrogen burn environment and demonstrated the survivability of the equipment by comparing the resulting temperatures with
.the qualification temperatures for this equipment.
C.8.1 Essential Equipment The licensee provided a list of the equipment which has to survive a hydrogen burn based on its function during and after an accident.
In general, all the McGuire SSER 7 C-16
equipment located in the containment and belonging to the safety-related systems was considered essential for the safety of the plant.
The list of the equipment identified by the licensee as essential to achieve and maintain a safe shutdown condition for the reactor core and to maintain containment integrity is provided in Table C.2.
Table C.2 List of essential equipment Steam generator water level transmitters Pressurizer water level transmitters Reactor coolant loop resistance temperature detectors (hot and cold leg)
Core exit thermocouples Containment air return fans Hydrogen skimmer fans Hydrogen igniters Associated power and instrument cables Hydrogen recombiner PORV and block valves Penetrations The staff compared the licensee's list of essential equipment with the list pre-pared independently by the staff and finds that the licensee's list contains all the equipment essential for safe shutdown of the plant under accident conditions.
Duke has reviewed the list of the equipment for components which, because of low heat capacity, heat-sensitive components, or location in containment, would be more susceptible to thermal damage than other items in the list.
Duke re-stricted the analytical survivability evaluation to the equipment which is most sensitive to temperature change, the rationale being that if the most suscep-tible items on the list are shown to have a reasonable assurance of surviving a degraded core event, these evaluations will bound all other items on the list.
On this basis, Duke has reduced considerably the number of thermal response analyses that has to be performed.
The following equipment items were selected for an evaluation of their response to the hydrogen burn environment:
(1) igniter assembly (2) igniter power cable (3) Barton transmitter (4) thermocouple cable (5) resistance temperature detector (RTD) cable (licensee supplied)
(6) RTD cable (vendor supplied)
The staff has reviewed the criteria used by the licensee in selecting the equip-ment for analytical investigation.
The staff concludes that determination of the survivability of these pieces of equipment will be sufficient for establish-p ing survivability of all the equipment listed in Table C.2 provided the licensee e
has (1) included all equipment in Table C.2 in his equipment qualification (EQ) program or (2) provided separate bases for establishing survivability limits for the equipment not in the program.
The licensee has met these provisions for all essential equipment.
McGuire SSER 7 C-17
I C.8.2 Thermal Environment Response Analysis The thermal environments used for evaluating equipment survivability were deter-mined by the licensee based on either analyses using the CLASIX computer code or analysis of heat transfer in the vicinity of a flame.
CLASIX temperature profiles were developed assuming the base case code input parameters with varia-tions in flame speed.
Analytical determination of the thermal environment was based on consideration of heat transfer resulting from both radiation and convection.
For the lower compartment in containment, the licensee assumed two temperature profiles corresponding to flame velocities of 1 fps and 6 fps.
The tempera-ture profiles corresponding to 1-fps flame velocity consisted of three burns with the average time between the burns of 250 sec.
The temperature profile l
for flame velocity of 6 fps consisted of six burns with the average time between the burns of 220 sec.
In both cases, the CLASIX generated profiles were modified so that the highest temperature reached by the gas was equal to i
the adiabatic flame temperature of 1400 F.
For the ice condenser upper plenum the licensee assumed an ambient temperature
' corresponding to a continuous hydrogen burn at the top of the ice condenser lasting for 45 min.
This is a conservative assumption because intermittent rather than continuous burning is the phenomenon likely to occur in the ice condenser region.
The staff has reviewed and concurs with the choice of thermal environments used by the licensee because they conservatively represent the thermal environments to which the given equipment would be exposed during an accident.
The thermal responses for thermocouple cable and for both licensee-and vendor-supplied RTD cables were analytically predicted using the lower compartment thermal environments corresponding to flame velocities of 1 fps and 6 fps.
The Barton transmitter was analyzed assuming a single burn with a flame velocity of 2 fps; however, its thermal response under this condition was so low that when it was extrapolated to the thermal conditions postulated for the lower compart-ment the resulting peak temperature did not exceed the qualification temperature.
j l
Thermal responses for the ' igniter assembly and power cable were analytically predicted for the licensee's postulated ice condenser upper plenum thermal envi-ronment.
This environment is considered more severe than the lower compartment environment.
The analytical models used in predicting thermal responses of equipment considered thermal energy transfer from the flame and from the hot gases by radiation and convection.
Standard heat transfer equations were used to calculate this heat transfer.
Heat transfer inside the equipment was deter-mined by the licensee using the HEATING 5 computer code (0ak Ridge National Labor-atory).
Equipment components were represented in the code by models of rela-tively simple geometry which possessed all the significant heat transfer charac-teristics of the equipment.
The same HEATING 5 code was used by TVA in calcu-lating thermal responses in the Sequoyah plant.
TVA verified the code using experimental data from the tests performed in Fenwal Laboratory (Fenwal, 1980).
In addition, the staff's consultant, Sandia, performed independent verification of the thermal response analyses performed by TVA for Sequoyah and concluded that the results are conservative (McCulloch, 1982).
Because the Sequoyah and McGuire SSER 7 C-18
McGuire plants are very similar, these conclusions apply to both plants.
The staff has reviewed the methodology used by the licensee and all the verifica-tion evidence and concludes that the thermal responses of equipment calculated by this method have adequate margins of conservatism.
The acceptance criterion used for evaluating survivability of essential equip-ment is based on the qualification temperature of the equipment located in the containment.
The criterica is that essential equipment will survive the hydro-gen burn event if the temperature reached by its most sensitive component does not exceed the temperature reached by this component during qualification tests.
9ecause the actual temperature reached by the test equipment during these tests was not measured, and qualification temperature was the temperature of the envi-ronment to which the test equipment was exposed, there is no direct way to deter-mine the actual temperature components during the qualification test.
- However, Duke claims that environmental qualification tests are typically conducted for an extended period of time so that the equipment surface temperature would achieve thermal equilibrium with the test chamber during the tests.
Because the heat transfer to the equipment during the qualification testing could be modeled by a simple analytical model ' nd engineering judgment could be made on the long a
duration of the qualification testing, the staff believes that the measurement of surface temperature is not necessary during qualification testing.
- Also, because of several conservative assumptions in the thermal response analysis, the staff concludes that use of qualification temperature by Duke as a crite-rion for evaluating the survivability of limiting components is acceptable.
All equipment listed in Table C.2, except for core exit thermocouples and hydro-gen igniters, has been included in the Duke equipment qualification (EQ) pro-gram.
Core exit thermocouples are not qualified yet but will be qualified by the next refueling to comply with TMI Item II.F.2 requirements.
Hydrogen ignit-ers are also not included in the qualification program.
However, the functional capability of the igniters has been demonstrated in tests conducted at Fenwal and Whiteshell in an atmosphere of burning hydrogen.
Moreover, similar igniter assemblies were recently qualified by Grand Gulf in accordance with NUREG-0588 Category I requirements.
Based on these findings the staff concludes that there is adequate assurance that the hydrogen igniters will survive the hydrogen burn event.
Recently, the staff was informed by the Power Systems Division of Morrison Knudsen (Cake, 1983) about a possible reportable defect under 10 CFR 21 concern-ing the General Motors glow plug used in the hydrogen igniter assemblies.
The defect was related to a change in manufacturing process from brazing to hot rolled compression fit and resulted in some failures during pneumatic leak test-ing.
It was determined that the change in manufacturing process for the glow plugs was made by General Motors in June 1982.
All glow plugs manufactured before that time are of brazed construction and are therefore not subject to the deficiency reported to the NRC.
Duke has informed the sta*f that the hydrogen mitigation system in both McGuire Unit 1 and McGuire Unit 2 contains glow plugs manufactured before June 1982, and is therefore not affected by the reported deficiency.
Duke has also verified that his spare parts stock contains none of the affected units.
Accordingly, the 10 CFR 21 report issued by Power Systems is not applicable to McGuire Nuclear Station.
McGuire SSER 7 C-19
Duke has provided the results of survivability analyses for the selected essen-tial equipment. The analytically calculated thermal responses during hydrogen burn are compared with the qualification temperatures in Table C.3.
With one exception, the vendor supplied RTD cable, the design / qualification temperature was found to be higher than the calculated responses.
Futhermore, a similar cable has been tested by TVA at their Singleton laboratory in an atmophere of burning hydrogen (Mills, 1981).
In this test, the cable was repeatedly exposed to temperatures of 1400 F and reached a measured temperature of 993 F.
The subsequent high voltage testing indicated that its dielectric strength was not impaired by this exposure.
Although CLASIX does not predict any burns in the upper compartment, the licensee has considered the effect of upper compartment burns on equipment survivability and concludes that upper compartment burning will have no significant effect on the operability of either the hydrogen recom-biners or the air return fans because of the short duration of the hydrogen burn and the low baseline temperature for the compartment.
Table C.3 Comparison of analytically calculated thermal responses during hydrogen burn and qualification temperatures Maximum temperature, F Design / qualification Component (calculated) temperature, *F Igniter Interior box air 400 428 (transformer)
Transformer core 400 Barton transmitter Interior 310 (estimated) 320 Igniter power cable 700 1200 Thermocouple cable Outer armor 385 346 Insulation 338 RTD cable (licensee supplied) l Outer armor 382 346 l
Insulation 322 i
RTD cable 400 332 (vendor supplied)
McGuire SSER 7 C-20
It should be noted that the tests conducted by the industry were performed in a relatively small oven.
In NUREG/CR-2730, the staff's contractor, Sandia, stated that on the basis of some preliminary test results, scaling (volume of containment building vs. volume of the test chamber) may be a significant fac-tor in analyzing the survivability of the equipment.
However, on the basis of the conservative assumptions and available margins in the work done to date, the staff believes that even after taking the scaling effect into considera-tion, the equipment will be found to survive the hydrogen burn environment.
During fiscal year 1983, Sandia and EPRI will be performing some additional confirmatory tests to address this issue.
The results from these upcoming tests will be relied on to confirm the findings made above.
Secondary fires in the McGuire plant originate either when combustible materi-als located in the containment reach ignition temperatures or when the insula-tion on the ice condenser's cooling ducts is heated to the point at which poly-urethane foam starts to decompose and emit combustible gases.
The licensee, after reviewing different possible sources of combustible materials, identified organic cable insulation and the reactor coolant pump oil as the only signifi-cant sources.
In most cases, however, cables are completely enclosed in con-duits or cable trays, and are not directly exposed to the hydrogen burn. The licensee has also demonstrated that even those cables that have exposed insula-tion will not reach the temperature at which they may ignite.
The same applies to the coolant oil which is contained within massive oil reservoirs with large thermal capacities.
These reservoirs will not reach the ignition temperature of oil when exposed to the postulated hydrogen burn environment.
In evaluating the thermal stability of ice condenser cooling duct insulation, the licensee has performed an analysis using the HEATING 5 computer code.
On the basis of the results of this analysis, Duke concluded that no degradation of the foam insL*lation or release of combustible gas will occur.
The staff has reviewed this analysis and concurs with the licensee's conclusion.
C.8.3 Pressure Effects With the HMS, the highest pressure in the containment during a hydrogen burn event does not exceed the pressures to which essential equipment is qualified.
The licensee has performed analyses using the CLASIX code which indicated that the differential pressures developed across the air return fans and hydrogen skimmer fans during a postulated burn in the upper compartment will not chal-lenge the structural integrity of the fans.
Furthermore, the licensee has stated that the predicted pressure differential will not significantly affect performance of these fans.
The staff has reviewed the licensee's analyses and concurs with his statement that the fans will remain operable during and fol-lowing hydrogen burning in containment.
C.8.4 Staff Conclusions Regarding Equipment Survivability After reviewing Duke's analytical investigation of equipment survivability and other industry research on equipment survivability, the staff concludes that Duke has provided sufficient evidence that all the equipment required to ensure safe shutdown conditions and containment integrity will survive the environment created by burning of the hydrogen generated during a postulated accident.
This conclusion is based on the following:
McGuire SSER 7 C-21
(1) The list of equipment provided in the submittal included all the essential equipment.
(2) The equipment selected for the analytical investigations adequately charac-terizes the essential equipment on the list.
(3) The analytical methods used by the licensee adequately calculate thermal response of equipment on the basis of the postulated thermal environment.
(4) The comparison of analytically determined thermal responses with the corre-sponding qualification and/or design temperatures for some sample compo-nents has indicated that these temperatures will not be exceeded during a hydrogen burn.
(5) It was satisfactorily demonstrated that burning hydrogen will not initiate secondary fires in the containment by igniting combustible materials or by generating combustible gases from the decomposition of polyurethane foam 3
insulation.
C.9 OVERALL CONCLUSIONS The staff has concluded its review of the matter of hydrogen control for postu-lated degraded core accidents at the McGuire Nuclear Station.
In the course of the review, the staff requested Duke to make a number of modifications to the HMS to provide added assurance that the system will operate in the intended manner with adequate safety margins.
Specifically, the staff requested Duke to (1) add or relocate igniters to the lower elevations of the lower and upper compartments of containment and (2) provide a means of verifying the HMS status from the control room.
Duke has committed to make the appropriate modifications to McGuire Units 1 and 2 before restart following the next refueling for each unit.
The staff finds this time frame and operation during the interim period acceptable.
Subject to the satisfactory resolution of these contingencies, the staff finds that:
(1) The peak pressures as a result of igniter-induced burns will be less than the containment pressure capacity.
The results of many accident analyses i
indicate that the peak contair, ment atmosphere pressure will be close to the design pressure of 15 psig.
Even considering a broad range of accident scenarios and combustion assumptions that are more conservative than the base case, it is expected that the containment pressure will remain below 30 psig. With adequate margins, the ultimate pressure capacity of the containment has been determined to be 48 psig.
(2) The essential equipment has been identified and the peak temperatures during a hydrogen burn for the most sensitive pieces of equipment have been shown to be less than their qualification temperature.
As part of its HMS evaluation, the staff also identified a number of technical concerns that it will be continuing to investigate as confirmatory items.
The confirmatory items are:
(1) local detonations (2) containment code work McGuire SSER 7 C-22
(3) equipment survivability for a spectrum of accidents (4) combustion effects at large scale (5) combustion phenomena including flame acceleration and igniter operability in a spray environment The subject of local detonations in confined regions of the containment is cur-rently under investigation at Sandia under a staff technical assistance contract.
This work is considered confirmatory in nature because (1) mixing of the contain-ment atmosphere in conjunction with igniter operation at low hydrogen concentra-tion will preclude the formation of detonable mixtures and (2) recent analyses performed by Sandia using the CSQ code and a refined structural analysis indi-cate that the ice condenser containment can withstand the postulated detonation of a 20 volume percent hydrogen mixture in the upper plenum.
The Sandia inves-tigation should be completed by late 1983.
The staff will continue to assess the adequacy of the CLASIX code as part of its technical assistance program with the Los Alamos National Laboratory and its hydrogen research program at Sandia.
This containment code work is considered to be confirmatory in light of the staff's findings regarding the adequacy of the CLASIX models and the reasonable agreement obtained between CLASIX, COMPARE, and HECTR.
The code work will be an ongoing effort.
The staff will also continue to investigate equipment survivability for a spec-trum of degraded core accidents.
This investigation will be carried out as part of the NRC Hydrogen Burn Survival Program already in place at Sandia.
The favor-able results of the survivability analyses for the more temperature-sensitive pieces of equipment provide the bases for classifying this item as confirmatory.
The staff will monitor the results of other ongoing NRC and EPRI hydrogen research programs to confirm (1) the margins;provided by the HMS, (2) the absence of significant flame acceleration at large scale, and (3) the reliable operation of thurmal igniters in a spray environment.
Research programs to address these concerns will be performed at the Nevada test sit ~e and at Sandia.
These programs are considered confirmatory because similar test programs have been completed at smaller scale with acceptable results.
Accordingly, subject to meeting the conditions discussed herein dealing with igniter number and locations and system status indication, and subject to com-pleting installation, the staff finds the McGuire Units 1 and 2 license condi-tions dealing with hydrogen control during postulated degraded core accidents to be satisfactorily resolved.
C.10 REFERENCES t
American Society of Mechanical Engineers, " Boiler and Pressure Vessel Code,"
Section IV, Division 1.
Berman, M., Sandia, letter to J. T. Larkins, NRC, enclosing April and May 1982 status reports for the Sandia Hydrogen Programs, July 20, 1982.
Cake, M. P., Powers Systems Division of Morris Knudsen, letter to NRC Region II Office (Attn. J. D. O'Reilly), " Hydrogen Igniters (Possible Reportable Defect - 10 CFR 21), January 28, 1983.
McGuire SSER 7 C-23
Duke Power Company, An Analysis of Hydrogen Control Measures at McGuire Nuclear Station, February 17, 1981.
Eisenhut, D., NRC, letter to all licensees of operating reactors, applicants for operating licenses, and holders of construction permits, " Supplement 1 to NUREG-0737 Requirements for Emergency Response Capability" (Generic Letter No. 82-33), December 17, 1982.
Fenwal Laboratory, "Sequoyah Nuclear Plant Core Degradation Program, Volume 2, Report on Safety Evaluation of the Interim Distributed Ignition System,"
December 15, 1980.
McCulloch, W. H., Sandia, letter to K. Parczewski, NRC, October 29, 1982.
Mills, L. M., TVA, letter to E. Adensam, NRC, June 2, 1981, Attachment A.
l Oak Ridge National Laboratory (ORNL), " HEATING 5, an IBM 360 Heat Conduction Program," ORNL/CSD/TM-15.
Parker, W.
O., Duke, letter to H. R. Denton, NRC, "An Analysis of Hydrogen Control Measures at McGuire Nuclear Station," October 30, 1981; Revision 1, December 31, 1981; Revision 2, January 22, 1982; Revision 3, March 11, 1982; Revision 4, May 4, 1982; Revision 5, November 5, 1982; Revision 6, February 15, 1983; Revision 7, March 16, 1983; Revision 8, April 22, 1983.
U.S. Nuclear Regulatory Commission, "NRC Staff Analysis of Hydrogen Control Measures for McGuire Nuclear Station, Units 1 and 2," Docket Nos. 50-369 and 50-370, February 17, 1981.
--, NUREG-0011, " Safety Evaluation Report Related to the Operation of Sequoyah Nuclear Plant, Units 1 and 2,"
Docket Nos. 50-327 and 50-328, January 1976; Supplement 3, September 1980; Supplement 4, January 1981; Supplement 5, June 1981; Supplement 6, December 1982.
)
--, NUREG-0588, " Interim Staff Position on Environmental Qualification of Safety-Related Electrical Equipment," December 1979.
--, NUREG/CR-1891, " Reliability Analysis of Containment Strength--Sequoyah and McGuire Ice Condenser Containment," Ames Laboratories, August 1982.
--, NUREG/CR-2730; " Hydrogen Burn Survival Thermal Model and Test Results,"
Sandia, August 1982.
--, NUREG/CR-3278, " Hydrogen Burn Analyses of Ice Condenser Containments,"
Los Alamos National Laboratory, April 1983.
Westinghouse Electric Corporation, " Zion Probabilistic Safety Study," Module 4, Section 4, NRC Docket Nos. 50-295 and 50-304, 1981.
--, WCAP-8077, " Ice Condenser Containment Pressure Transient Analysis Methods" l
(Proprietary Class 2), March 1973; WCAP-8078 (Proprietary Class 3), March 1973.
l McGuire SSER 7 C-24 l
t
Westinghouse Offshore Power Systems, OPS-36A31; "The CLASIX Computer Program for the Analysis of Reactor Plant Containment Response to Hydrogen Release and Deflagration" (nonproprietary; OPS-0735, proprietary).
Yang, J. W., and W. T. Pratt, "A Study of Hydrogen Combustion During Degraded Core Accidents in PWR in Condenser Plant," Brookhaven National Laboratory, Department of Nuclear Energy, prepared for NRC under Interagency Agreement DE-AC02-76CH00016, January 1982.
t McGuire SSER 7 C-25
APPENDIX D MCGUIRE NUCLEAR STATION-SAFETY EVALUATION REPORT CONCERNING THE REACTOR TRIP BREAKERS l
i 1
i
?
4 4
f I
i L
McGuire SSER 7 l
n.
,. --- --.~- -,-,.-. - -.. -
~, - - - -... - - - - _
TABLE OF CONTENTS Page D.1 INTRODUCTION..................................................
D-1 0.1.1 Description of the Reactor Protection System and Trip Breakers..........................................
D-1 0.1. 2 Reactor Trip Breaker Failure Experience................
D-4 D.2 IDENTIFICATION OF CAUSE OF BREAKER FAILURE TO TRIP............
D-10 D.2.1 Description of Investigation by Licensee...............
D-10 l
D.2.1.1 McGuire Unit 1................................
D-10 D.2.1.2 McGuire Unit 2................................
D-10 0.2.2 Conclusions by Licensee Regarding Cause of Failure.....
D-11 D.2.2.1 McGuire Unit 1................................
D-11 D.2.2.2 McGuire Unit 2................................
D-11 0.2.3 Conclusions by Franklin Research Center Regarding Cause of Failure.......................................
D-12 D.2.4 Conclusions by Staff Regarding Cause of Failure........
D-12 0.3 ^ MAINTENANCE AND TESTING PROCEDURES............................
D-13
- 0. 3.1 Proposed Revisions to Maintenance and Testing Procedures.............................................
D-13 0.3.2 Conclusions by Staff Regarding Maintenance.............
D-14 D.4 PERIODIC SURVEILLANCE TESTING 0F REACTOR TRIP BREAKERS........
D-14 0.4.1 Surveillance Procedures................................
D-14 D.4.2 Conclusions by the Staff Regarding Surveillance........
D-15 D.5 REACTOR TRIP BREAKER MODIFICATION.............................
D-16 D.5.1 Description of the Modi fication........................
D-16 D.5.2 NRC Preliminary Evaluation.............................
0-17 D.5.3 NRC Final Evaluation...................................
D-18 D.5.4 Conclusions on Reactor Trip Breaker Modification.......
D-20 D.6 LICENSEE'S RESPONSES TO WESTINGHOUSE NOTIFICATION.............
D-20 D.6.1 Westinghouse March 31, 1983 Letter.....................
D-20 D.6.2 Westinghouse 10 CFR 21 Notification....................
D-21 D.6.3 Conclusion.............................................
D-21 McGuire SSER 7 D-iii
J i
TABLE OF CONTENTS (Continued)
P. age D. 7 HUMAN FACTORS CONSIDERATIONS RELATED TO DESIGN MODIFICATIONS..
D-21 0.7.1 Revised ATWS Operating Procedures......................
D-21 0.7.2 Post-Trip Procedures...................................
D-22 D.7.3 Operator Training......................................
D-25 0.8
SUMMARY
AND CONCLUSIONS.......................................
D-25 l
D.9 REFERENCES....................................................
D-26 FIGURE 9
D.1 Reactor Trip System............................................
D-3 D.2 Basic Breaker Mechanism........................................
D-5 D.3 Operation of the Breaker.......................................
D-6 D.4 Shunt Trip Attachment..........................................
D-7 D.5 Under Voltage Trip Device 0peration............................
D-8 ATTACHMENT 1........................................................
D-29 McGuire SSER 7 D-iv
D.1 INTRODUCTION As a result of failures of the reactor protection system (RPS) breakers at several facilities, the U.S. Nuclear Regulatory Commission issued Office of Inspection and Enforcement Bulletins (IEBs) 83-01 and 83-04 and Information Notice 83-18.
Duke Power Company (the licensee), in response to'IEB 83-04, performed tests on the Westinghouse DS-416 breakers used'at the McGuire facility. No failures occurred in these tests.
However, subsequent testing resulted in failures of the DS-416 breakers.
These failures were attributed to a variety of causes indicating weaknesses in design and manufacture.
These findings have indicated a need for regulatory action relative to McGuire in the form of a comprehensive set of requirements to improve the reliability of the RPS breakers.
Some of the actions identified would require 3 to 9 months to complete.
Until these actions are completed, compensatory actions were deemed necessary.
In addition.to the actions proposed by the licensee, the following set of actions was determined to be necessary:
(1) The licensee must commit to conduct a life-test of a statistically significant sample of the undervoltage (UV) trip device /DS-416 breakers on a prompt basis. Within 45 days, the licensee should provide the program plans for the testing and the schedule for its completion.
(2) The licensee must commit to conduct the special periodic RPS breaker surveillance tests identified by the staff.
This safety evaluation report describes the reactor protection system trip breakers and discusses the background of failures of the DS-416 breakers, reviews the licensee's maintenance and testing procedures, and identifies causes of the breaker failures.
On the basis of this evaluation, proposed modifications to installation, quality assurance, maintenance, and surveillance of the D5-416 breakers are identified.
The licensee's proposals for actions responding to the DS-416 breaker failures are reviewed against the staff posi-tions and the conclusions are presented regarding the operation of McGuire Units 1 and 2.
D.1.1 Description of the Reactor Protection System and Trip Breakers The reactor protection system (RPS) at this station is designed by the Westing-house Company to sense several plant variables and to actuate a trip of the reactor (emergency shutdown) in the event that any plant variable reaches an abnormal value (setpoint).
The RPS consists of multiple instrument channels and logic units to cause the holding power to the control rods to be interrupted.
When this power is interrupted by the circuit breakers, the control rods fall into the reactor core and thereby terminate the nuclear reaction process.
A The overall functions of the RPS are to ensure that fuel design limits are not exceeded during a plant transient (anticipated operational occurrence) and to sense the onset of accidents and function in conjunction with the engineered safety feature systems to limit the consequences of accidents to acceptable McGuire SSER 7 D-1
values.
The RPS is designed to comply with applicable NRC regulations, includ-ing the General Design Criteria (GDC) in Appendix A to 10 CFR 50.
Because the RPS is a safety-related system, it must be designed, constructed, installed, operated, maintained, and tested in accordance with the quality assurance criteria in Appendix 8 to 10 CFR 50.
Of the GDC, the most germane to the issue is GDC 23, which requires that, for conditions such as loss of electric power, the RPS must fail to a safe state.
Traditionally, this criterion has been applied as requiring the RPS design to be such that it intrinsically causes an automatic reactor trip upon loss of power to the RPS.
Therefore, RPS designs include undervoltage (UV) trip mechanisms as part of the reactor trip breakers.
The UV trip is energized dur-ing normal plant operation and will trip the breakar either when power is lost or when power to the UV trip is interrupted by automatic or manual protective signals.
The present design of the RPS at this plant is summarized below and is shown in Figure D.1.
The system consists of multiple instrumentation channels (sensors, transmitters, bistables, and field contacts) that monitor various plant vari-ables.
Typically, there are four redundant instrument channels per variable; this varies somewhat depending on the particular parameter.
The outputs of these instrument channels are used as inputs to each of two redundant trains of coincident logic circuitry (solid-state protection system (SSPS) trains "A" and "B").
The output of each SSPS train provides power for two undervoltage trip attachments, one for its associated reactor trip breaker and one for the bypass breaker that may be connected in parallel with the alternate (redundant) reactor trip breaker.
When two of the four instrument channels for a given variable are in the tripped state (i.e., the value has exceeded its setpoint), the logic of each SSPS train is satisfied and power is interrupted to the undervoltage trip attachment.
This loss of power automatically opens the circuit breakers.
t When either of the two series reactor trip breakers opens, power provided from I
the motor generator sets to the control rod drive mechanisms is interrupted, thus allowing all control rods to drop into the core.
Manual reactor scram capability is provided by two switches on the main control board in the control room.
At the McGuire station, the manual scram switches are " channelized"; that is, the Train "A" manual scram switch operates the UV and the shunt trip of the reactor trip breaker "A"; the Train "B"
- switch, reactor trip breaker "B".
Either switch operates both the bypass breakers.
Thus, diverse means (undervoltage trip attachments and shunt trip attachments) are used to open the reactor trip breakers on a manual reactor trip signal, whereas only the undervoltage trip attachments are actuated on an automatic reactor trip signal from the SSPS.
As shown also in Figure D.1, the desic *ncludes a bypass breaker around each reactor trip breaker.
The bypasses are provided to test the main trip breaker without tripping the plant.
Typically during plant operations, the bypass breakers are not closed.
The bypass breakers can be in operation only on a one-at-a-time basis and then only for a limited time as necessary for testing.
The reactor trip breakers are Westinghouse Model DS-416 1600 amp 480 V power circuit breakers.
These breakers operate on the magnetic de-ion principle of interruption.
In these breakers the arc rises from the main contacts into a series of insulated plates. These plates break the arc into a series of smaller McGuire SSER 7 D-2
?
m
/
5.
INSTRUMENT CHANNELS ACTUATION LOGICS SENSORS BISTABLE TRIPS M
h i *!
! i i '
O o
or f
I i
i POWER k b l
T :l l jl u
l SOURCES
$z l
3 1
I l
l
)
)
l bg I
1-I l
4 a.
I T'
I T
'*o 2eo vAC 3 sf l
2/4 5
4 l
l1 l
- +f,*
i 1 mi i
I I
I 'I I
l
/
g
' ~~~7 s
l COMPUTER C
8 INPUT l
f l
/c'$-
N '" ','I.
g[,
_ _ _j
\\'
l s
c A --- ANNUNCIATOR 4
TRIP d,
l
,i,, g [
ALARMS ef BREAKERS
,. \\\\
i o
, is-
,s-j
)
i) to m ___j
=
(O MANUAL 35 l
SCRAM TEST SWITCHES BVPASS zw(
l, 4
4 4
4 BREAKERS gg g
E I
METERS I
1 r i
POWER TO l- - -> #
CONTRot RODS IINSERT ON POWER LOSSI RECORDERS Figure 0.1 Reactor trip system
arcs to cool and extinguish them and funnel the heat to ambient air.
The breakers are designed for use in metal enclosed switchgear and are equipped with spring-stored energy closing mechanisms.
The basic breaker mechanism is depicted in Figure D.2.
These breakers are supplied with a shunt trip attachment (energize to actuate) and an undervoltage trip attachment (deenergize to actuate) for purposes of opening the breaker remotely.
See Figures D.3, D.4, and D.5.
There is also a mechanical trip mechanism for opening the breaker locally.
D.1.2 Reactor Trip Breaker Failure Experience This section discusses the failure experience of the reactor trip breakers (RTBs) at the McGuire facility.
The followup investigative testing conducted by the licensee as a result of these failures is discussed in Section D.2 of this report.
The summary below reflects the staff's current understanding of the failures and was compiled from discussions with the licensee, numerous letters provided by the licensee, and information from the staff's regional office.
Shortly after the Salem anticipated transients without scram (ATWS) events, the McGuire licensee provided a letter dated February 28, 1983 stating that no RTB failures had occurred.
A March 1, 1983 letter corrected the previous letter by stating that one RTB failure in Unit 2 had occurred during preoperational testing.
Further clarification was provided by letters dated March 22, April 18, April 28, May 3 and May 5, 1983.
The staff considers a failure to be either a lack of functional capability demonstrated during testing or a nonconformance with a critical characteristic such as a physical dimension.
Further, if a device failed a test and subse-quent attempts te actuate the device were also unsuccessful, each is considered a failure for the purposes of this report.
All the failures were found during testing while the McGuire units were shut down.
(1) On February 4, 1983, Unit 2 RTB "B" failed five consecutive times during routine RPS functional testing.
After the breaker was operated by the k
shunt trip, all subsequent UV trip tests that day were successful.
(A work request was initiated, which was executed on February 18, 1983.)
(2) On February 16, 1983, Unit 2 RTB "B" failed several times during routine RPS response-time testing.
(3) On March 16, 1983, all Unit 2 RTBs were tested successfully in response to IE Bulletin 83-04.
(4) On March 17, 1983, all Unit 1 RTBs were tested successfully in response to IE Bulletin 83-04.
1 (5) On March 18, 1983, Unit 2 RTB "B" failed 3 out of 10 attempts during retesting in the switchgear cubicle, which was initiated because of the February 1983 experience with this breaker.
The breaker was moved to a i
maintenance area fpr additional testing.
In over 100 tests, 1 or 2 additional failures occurred.
During this testing, after each test of McGuire SSER 7 D-4
n F
W.
m n
/
N
%{y N
t
[
.g l
- 1. Stop Roller
- 2. Close Cam
- 3. Roller Constraining Link h
- 4. Pivot Pin
- 5. Trip Latch Y
- 6. Trip Shatt Latching Surface
, g' g
n q'
M*/
- 7. Trip Shaf t g
\\
'?.-
'p','h7
/
- 8. Pole Shaf t 4
e o
- 9. Center Pole Lever m
- 10. Pole Lever Pin 5
'9
- 11. Moving Contact Arm I
's
's
- 12. Stationary Arcing Contact s
b
- 13. Moving Contact Pivot Pin h,
' q,'< =
M
')
- 14. Main Drive Link T
s' G
- 15. Main Roller h.k
/
D A
- 16. Spring Release Latch
\\
h
- 17. Insulating Link Adiusting Stud and Locknut g
/
- 18. Insulating Link
'O
- 19. Mechanism Side Frame
'g'
- 20. Hardened Latch Surfaces Breaker Open - Springs Garged (Spring Oarged Position Corresponding To This Gosing Cam PbsitiorQ Figure D.2 Basic breaker mechanism l
x h
D'"hs
%N J
~
C/
.T. -
re_rl I
n
!5
-:./
' '.h... - \\j]n m
/
/
/
,/
/
/
,0. g,, '
~ ([ ' ;g.,
,4,, t 0:-
~.
m n
e a
),g,,' N _,.,.i a) Breaker Open Springs
&e.-
c) BreakerClosedSprings V
Discharged Discharged
's%
. s)%
s's
?
N m
\\
-s
^
\\
c:, N -
g
- \\
s x 'N, -
N -,. __
[ g]
g
\\
]
y
. Q s.., j'Y
. N-
~
.g' p-
,f
\\,;
.+
g.
I d) Breaker ClosedSprings Osarged e) Trip Shaft Latch Details Figure D.3 Operation of the breaker
2 E
5.
2
- 1. Trip Latch-
- 7. Trip Shaf t Lever g
- 2. Trip Latch Pivot Pin
- 8. Trip Shaf t
- 3. Roller Constraining Link
- 9. Trip Shaf t Latch Surface y
- 4. Shunt Trip Device
- 10. Main Drive Link
- 5. Shunt Trip Armature
- 11. Trip Shaft Adjusting Screw
- 6. Shunt Trip Coil
- 12. Trip Actuator
/@D D
g
/l 91 @
@ lO(
s
,4 se (k %l h 43-~
e 3
g+
i
( p _ :'.-fC Z:0 s
s i
NN J\\
c s
N t
a) Shunt hip b) Dip Shaft Adjustment Figure D.4 Shunt trip attachment
l l
l y POLE
__ _. y \\
SHAFT
. l-BKR.
] OPEN
\\
BKR.
POSITION
\\ CLOSED
\\ POSITION Y,"
'</
,N /','s d
D l'a
-BKR. CLOSED, le U.V. EN ERGlZ ED
/s.
.s y
TRIP BAR Q-W BKR. CLOSED y-
,g..,,
.t c - '
y WTr~T~~_"L 1
i l ;4;I 1-c s.,
l s
D _. - _
)
l l
Figure D.5 Undervoltage trip device operation McGuire SSER 7 D-8
the UV device that was unsuccessful, the breaker was cycled manually by operating the local mechanical trip.
The initial diagnosis was binding of the UV trip device because of insufficient dimensional clearance between two of its moving parts (the moving core and the roller bracket).
(6) On March 19, 1983, Unit 1 RTB "A" failed twice during routine RPS response-time testing.
The initial diagnosis was insufficient dimensional clearance between the UV trip device and the trip shaft of the main breaker assembly.
(7) On March 28, 1933, the bearing surface at the ends of the trip shafts of the main breaker assemblies in Unit 2 were found to have been " ground down" rather than machined.
(8) On March 31, 1983 at Unit 1, all four RTBs failed to pass special dimen-sional checks specified by Westinghouse.
Subsequently that day, a func-tional test of RTB "B" was also conducted; it failed.
(9) On March 31, 1983 at Unit 2, all four RTBs failed to pass special dimen-sional checks specified by Westinghouse.
(10) In an attempt to acquire acceptable UV trip devices for the McGuire units, the licensee checked the devices at Catawba station.
On March 31, 1983, six of the eight Catawba RTBs failed to pass the special dimensional checks specified by Westinghouse.
On April 1,1983, the remaining two Catawba RTBs were transferred to the McGuire station, inspected, serviced, cycled 10 times on the bench, and installed in the Unit 2 RTB "A" and "B" cubicles.
During the inspection, it was verified that all retaining clip rings were in place.
(11) On April 2, 1983, Unit 2 RTB "B" failed to function upon the first opera-tion of the breaker after installation.
This failure occurred during a functional check in preparation for control rod drop tests.
The initial diagnosis was dislocation of the roller arm shaft of the UV device because of a missing retaining clip ring from the end of the shaft.
(12) On April 6, 1983, a new modified UV trip device was installed on Unit 2 RTB "B" and tested 25 times successfully.
(13) On April 11, 1983, one of six new modified UV trip devices received at McGuire from Westinghouse failed to pass the special dimensional checks specified earlier by Westinghouse.
It should be noted that a related failure of the same type reactor trip breaker occurred at the Farley station on April 15, 1983.
That failure was attributed to the fact that the clearance between the UV device and the trip shaft of the main breaker assembly was too great.
The special dimensional checks specified by Westinghouse in their March 31, 1983 letter to NRC indicated a minimum clearanca value but did not indicate a need to check for a maximum clearance.
For completeness, the staff notes also that on April 6, 1983 at the Summer plant, one RTB device was found not to satisfy the special dimensional checks and a retaining clip ring was missing.
McGuire SSER 7 D-9
From this breaker failure experience, the staff observed the following:
(1) The reactor trip breakers at McGuire are the newer generation DS-416 type; the breakers at Salem are the 08-50 type.
(2) The initial diagnosis indicates a variety of causes that have oeen dis-covered sequentially from experience, raising an' uncertainty as to what the next type of failure may be.
(3) The general nature of the failures indicates weaknesses in design and manufacturing.
(4) The number of failures is substantial and widespread and the failure rate exceeds that expected of a component of the RPS.
i (5) The failures in relationship to testing suggest a need to review the surveillance testing program.
D.2 IDENTIFICATION Of CAUSE OF BREAKER FAILURE TO TRIP 0.2.1 Description of Investigation by Licensee D.2.1.1 McGuire Unit 1 By letter dated April 18, 1983 and in a meeting in Bethesda, Maryland, with the NRC on April 19, 1983, the licensee described his efforts to determine the reason for the failure of the DS-416 RTBs to open on loss of voltage to the undervoltage trip attachment.
On March 21, 1983, Westinghouse representatives inspected the McGuire Unit 1 RTB that had failed to trip on loss of voltage.
Their preliminary assessment was that the undervoltage trip mechanism on the Unit 1 RTB had failed because of improper clearance between the undervoltage trip device and the trip shaft pin.
However, during the investigation, the cycling of the Unit 1 Train A RTB could not reproduce the intermittent failure previously experienced.
The design of the trip mechanism requires that a gap exist between the undervoltage tripping device and the trip shaft pin.
Because the failure could not be repeated, it was concluded that the observed anomaly most probably caused the intermittent failure.
The undervoltage trip attach-ment was not removed.
This undervoltage attachment was observed to have end-play between the plucger and roller bracket, allowing freedom of movement that would tend to hinder normal operation of the undervoltage trip device.
During investigative testing on March 31, 1983, Unit 1 Train B RTB failed to trip on loss of voltage to the undervoltage trip device.
Subsequently, no gap was found between the undervoltage device trip arm and the breaker trip shaft pin.
This failure to trip and probable cause of failure was similar to the one on Unit 1 Train A RTB.
D.2.1.2 McGuire Unit 2 In addition to the required IEB 83-04 tests, the licensee performed further testing on March 28, 1983 on the Unit 2 Train B RTB because of the failures to trip on February 4-18, 1983.
The Unit 2 Train B RTB again failed to trip on loss of voltage to the undervoltage trip device during this testing.
Continued McGuire SSER 7 D-10
testing resulted in a total of 3 failures out of 125 attempts on this RTB.
The RTB was removed from the cabinet and taken to a maintenance area where the undervoltage trip device was energized and the breaker closed on March 18 and allowed to remain over the weekend.
On Monday after several cycles of the breaker, the failure was repeated.
The undervoltage trip device was then removed from the RTB and a series of " drop-out" tests (lowering of the coil voltage slowly to 60%-30% of rating) were performed.
In addition, manual exercising of the moving parts was performed.
This manipulation identified a sluggish operation of the moving core and roller bracket caused by a binding between the parts where they are connected.
On March 21, 1981, Westinghouse representatives inspected this McGuire Unit 2 RTB.
Their preliminary assess-ment also was that this RTB had failed because of binding between parts of the undervoltage trip mechanism proper.
The McGuire Unit 2 Train B undervoltage trip attachment was returned to Westinghouse for further evaluation.
This attachment was disassembled and a complete detailed dimensional check made of all the parts against design / manufacturing drawing requirements.
Detailed layout drawings also were made to check various dimensions.
This detailed evaluation of the parts identified that certain dimensions of the operating l
rod in the moving core were not within specification.
The binding initially i-identified as causing the failure could have resulted from this nonconformance l
between manufactured part and design / manufacturing drawing.
The licensee reported that on March 28, 1983, during preventive maintenance of the Unit 2 breakers, the surfaces of the undervoltage trip shafts were found to be machined improperly. Westinghouse was asked to evaluate this nonconformance.
The licensee states that on March 31, 1983, Westinghouse provided dimensional tolerance requirements regarding the undervoltage device to be checked by the licensee and that no McGuire RTBs passed all of the requirements.
The licensee checked the Catawba RTBs and two of the eight Catawba RTBs were found acceptable.
These two Catawba RTBs were transferred to McGuire, inspected, serviced, cycled 10 times, and installed as the Unit 2 Train A and B RTBs.
On April 2, 1983, the Unit 2 Train B breaker failed to trip via the undervoltage trip device during a functional check before rod drop tests.
On April 4, 1983, Westinghouse personnel inspected the Unit 2 Train B breaker at McGuire and determined that the failure was due to dislocation of the undervoltage device roller arm shaft.
The dislocation was attributed to the absence of a snap retaining ring from the shaft, permitting the shaft to move axially and become dislodged from one of its end supports.
D.2.2 Conclusions by Licensee Regarding Cause of Failure D.2.2.1 McGuire unit 1 The licensee concludes that the failure of the undervoltage device to trip the breaker is due to the absence of the gap between the undervoltage trip reset lever and the breaker trip shaft pin.
No additional evidence was identified which would permit the formulation of any other conclusion.
D.2.2.2 McGuire Unit 2 The licensee concludes there are two causes of failure with regard to the undervoltage trip attachment from the Unit 2 RTB.
The drawings used for manu-McGuire SSER 7 D-11
\\
facture did not clearly specify tolerances which led to variations in dimensions of the manufactured parts.
These manufacturing variations resulted in inter-ference between the moving core and roller bracket, resulting in intermittent failures.
A further, though of lesser degree, contributing effect was lack of side-to-side clearance of the roller bracket.
The other is the missing retain-ing ring.
This was attributed to insufficient width of the groove where the retaining ring snaps into place.
Therefore, all new devices will have wider grooves to accommodate the retaining rings.
The licensee's evaluation of the effect of improper machining on the surface of the trip shaft is that no significant adverse problems would occur from this condition.
A D.2.3 Conclusions by Franklin Research Center Regarding Cause of Failure The staff requested its consultant, the Franklin Research Center (FRC), to l
conduct an evaluation of the undervoltage trip' attachment. failures on the DS 416 RTBs at McGuire.
Findings by FRC are based on the submittals from the licensee and Westinghouse,' information obtained from'a site visit to McGuire on May 13, 1983, and FRC internal investigations 'of four DS 416 undervoltage trip attachments in their possession.
The FRC findings are presented in an Interim Technical Evaluation Report dated May 19, 1983, which is attached as Attachment.1 to this, append'ix.
FRC reached the same conclusions as the licensee regarding the most likely causes of the undervoltage trip attachment' failure to trip on loss of voltage at McGuire.
In addition,'FRC has1 identified a potential failure mode with DS 416 RTBs that has not been experienced atcMcGuire or at..any plant to the knowledge of FRC.
The roller bearing on the roller bracket is of concern in that it is critical to the operation of the undervoltage trip attachment. Occurrences that increase the rolling friction of this bearing reduce the margin for proper tripping of the device.
Examples of such occurrences would be (1) the trapping of foreign matter between the roller bearing outside surface.and trip lever or (2) degraded lubricant.
Thus, cleanTiness'and the mechanical condition of the roller,btaving are important)considarations in preventing '
failures of this undervoltage trip attachment.
y
?
On May 19,.'1983 the staff, the li.censee, Westinghouse,' and FRCiaet in '
, Philadelphia, Pennsylvania, at t6e FRC facilities to review and dis Oss the
(.
findings and the associated remedies hf the causes of failure.
FRC concurs witt the remedial actions that bave been taken or are to be taken by thet licensee and Westinghouse and coraurs that these actions should prevent' future failures of this aevice.
1D, O.2.4 Conclusians by Staff Regarding Cause of Failure The staff agrees ytith the findings of FRC and the licensee with regard to the probable causes of failure of the 05-416 RTBs to trip on loss of voltage at McGuire. These probable causes of failure involve the undervoltage trip device and can be categorized as either being related to design or to quality assurance /
quality control.
The design-related cause of failure involves the undervoltage trip device roller arm shaft.
A missing retalning ring on the undervoltage trip attachment pivo.t
. J e
'N. _,
McGuire SSER 7 D-12 Q,
7 l
't
)
$1
. o.
a
W shaft allowed the pivot shaft to move axially so that the end came out of its guide hole in the frame of the undervoltage attachment.
This attachment failed to operate on demand.
The Westinghouse evaluation regarding the retaining ring is that there is a discrepancy in design.
The groove in the shaft receiving the retaining ring was not increased in width to be consistent with an earlier (1972) retaining ring design change.
The new retaining ring is wider than the original retaining ring and does not seat properly in the original grooves.
This discrepancy increases the potential for misoperation of the DS-416 under-voltage trip attachment thereby creating a condition wherein the reactor trip switchgear might not open on automatic demand from the reactor p'rotection sys-u, tem.
The new undervoltage trip attachments have modified (widened) grooves to accommodate the new retaining rings.
This modification is acceptable to the staff.
s The causes of failure to trip related to quality assurance and quality control are twofold.
One is the manufacturing process and involves maintaining critical design dimensions and 100% inspection of selected parts.
The other is installa-tion of the undervoltage trip attachment in the RTB and involves proper align-ment and interface of the attachment with the breaker trip shaft.
The licensee and Westinghouse have addressed both of these areas to the satisfaction of the staff.
The staff agrees with FRC that the roller bearing is critical to the operation of the undervoltage trip attachment.
The cleanliness and mechanical condition of the roller bearing should be monitored and the present cleanliness of the service environment of the RTBs maintained.
The licensee should include this in the life-test program to be submitted to the staff in June 1983.
D.3 MAINTENANCE AND TESTING PROCEDURES The staff requested the licensee to provide information regarding maintenance and testing procedures with regard to the RTBs, particularly the undervoltage I.,
trip attachment.
In a letter dated April 18, 1983, the licensee provided information on (1) the control of RTB vendor information, technical manuals, and configuration, (2) RTB maintenance programs, and (3) compliance with NRC bulletins and circulars.
The staff met with the licensee on April 19, 1983 to discuss this information.
The licensee also proposed revisions to the maintenance and testing procedures which are discussed below.
Proposed Revisions to Maintenance and Testing Proceduces D. 3.1
- Each time a replacement undervoltage trip mechanism is to be placed in service, to be considered operable, each undervoltage trip mechanism must first be checked for proper manufacturing tolerances (dimensional checks) and installa-tion alignment as provided by Westinghouse.
No adjustments to the undervoltage trip attachment are to be made in the field to satisfy either intraclearance 4
requirements (within the device proper) or interclearance requirements (between the device and the RTB trip shaft lever pin) without an appropriate Westinghouse service representative present.
Each breaker will be inspected and lubricatcd according to the latest technical manual and recommendations from Westinghouse.
Westinghouse will have cycled the undervoltage trip mechanism at least 25 times
\\
\\
McGuire SSER 7 D-13 r.
L
before shipment and will provide a documented record of the number of cycles to which each undervoltage trip mechanism has been subjected.
After installa-tion in the RTB, the undervoltage trip mechanism will be subject to 10 func-tional tests.
In no instance is an undervoltage trip mechanism to be placed in service if a single failure occurs during any of these tests.
The NRC must receive prompt notification of any failure of an undervoltage trip attachment, either during functional testing or in service.
In addition, the licensee should maintain a record of the number of cycles of operation for each under-voltage trip device.
The procedure used to perform maintenance on the RTBs entitled " Air Circuit Breaker Inspection and Maintenance," MP/0/A/2001/04, is being amended to include the specific requirements to maintain the DS-416 Westinghouse air circuit breaker.
D.3.2 Conclusions by Staff Regarding Maintenance When the above proposed revisions to maintenance are included, the staff finds the licensee's maintenance program with regard to RTBs acceptable.
Additional modifications to MP/0/A/2001/04 may be required when the results of the enhanced surveillance program (discussed in Section D.4) and the life-tests become available.
The staff finds the licensee's control of vendor.information, control of RTB configurations, revised RTB maintenance procedures, and com-pliance with NRC bulletins and circulars acceptable.
D.4 PERIODIC SURVEILLANCE TESTING OF REACTOR TRIP BREAKERS D.4.1 Surveillance Procedures There are currently four separate surveillance procedures that cover various requirements for reactor trip breaker testing.
These procedures cover manual trip verification (PT/1/A/4600/56), automatic trip from reactor protection system (IP/0/A/3010/05), separate verification of undervoltage and shunt trips (PT/0/A/4600/12), and breaker response times (1P/0/A/3010/06).
The staff has identified additional surveillance that should be performed to ensure the operability of the reactor trip breakers.
As a result, the licensee, by letters dated May 3 and May 10, 1983, stated the following testing will be performed in addition to that required by Technical Specifications.
It is pro-posed that these additional tests be added to the Technical Specifications only after the program has had the benefit of additional review to determine the generic applicability.
Test Frequency (1) Independent test of UV and shunt Every startup if not performed trip on reactor trip breekers within previous 7 days (2) Test of manual trip from control Every startup if not performed room on reactor trip breakers within previous 7 days (3) Response-time test of reactor trip Every 31 days breakers on UV signal from RPS McGuire SSER 7 D-14
r Test Frequency (4) Functional test of shunt trip Every 31 days of reactor trip breakers (5) Force test on trip bar and UV Every 6 months device of reactor trip breakers and bypass breakers (6) Response-time test of reactor Every 6 months trip breakers and bypass breakers on UV signal (7) Functional test of shunt trip on Every 6 months reactor trip breakers and bypass breakers (8) Servicing / lubrication / adjustments Every 6 months as appropriate on reactor trip breakers and bypass breakers (preventive maintenance)
(9) Reporting - Any failure of an RTB to open on demand, either in service or during surveillance testing, by either the undervoltage trip or shunt trip shall be reported to the NRC within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and the breaker pre-served in the as-failed state.
The staff recommends that the following surveillance protocol be used to yield the most information regarding the effectiveness of preventive maintenance and the ability to detect failures before they occur.
Before preventive maintenance (as found):
(1) force test on trip bar and UV device (2) response-time test on UV signal (3) check tolerances regarding pre-and post-travel of the trip tab (4) note condition of roller bearing with regard to cleanliness and lubricant After preventive maintenance (as left):
(1) force test on trip bar and UV device (2) response-time test on UV signal (3) check tolerances regarding pre-and post-travel of the trip tab (4) note condition of roller bearing with regard to cleanliness and lubricant D.4.2 Conclusions by the Staff Regarding Surveillance The staff finds the enhanced surveillance proposed acceptable.
An evaluation of the effectiveness of the enhanced surveillance at the end of 6 months is in orcer.
Another source of information on reliability of the UV attachment will be the results from the life-tests on the undervoltage trip attachment on 05-416 reactor trip breakers. These tests should produce statistically significant data.
These tests also should address the concern the staff has regarding the roller bearing.
Until these tests are completed and conclusions regarding the McGuire SSER 7 D-15
reliability of the DS-416 RTB have been accepted by the NRC, the staff requires continuation of the enhanced surveillance program.
The life-test program plan is to be reviewed by the staff before implementation.
The licensee has committed in the May 3, 1983 letter to provide the scope and objectives of the life-test program to the staff by June 3, 1983.
D.5 REACTOR TRIP BREAKER MODIFICATION Notwithstanding the actions taken related directly to the UV trip devices in the reactor trip breakers, the licensee decided to modify the breakers for the purpose of further enhancing the reliability of the breakers to trip demand.
The modification provides that the shunt trip device in each main reactor trip will be actuated by the automatic protection signals.
The design modification includes provisions to test the UV trip and the shunt trip device independently.
The change applies only to the main trip breakers; I
the bypass breakers' functions are unchanged.
D.5.1 Description of the Modification In the original design, the protection system provides 48 Vdc to the UV device under normal plant conditions.
When an automatic protection signal (" scram demand") is produced by the protection system coincident logic modules or when a manual scram is demanded, the 48 Vdc is interrupted from the UV trip device.
When a manual scram is demanded (but not for an automatic signal), 125 Vdc is applied to the shunt trip device; that is, automatic protection involved only the UV trip.
The modification involves adding a 48-Vdc relay in parallel with the UV trip device.
An output contact of this relay is connected between the 125-Vdc supply and the shunt trip device, in parallel with the existing manual scram contact.
Under normal plant conditions, the new relay is energized and its output contact is open.
When plant conditions necessitate automatic protection and the 48 Vdc from the protection system is interrupted, the new relay will de-energize and its output contact will close to apply the 12 Vdc to actuate the shunt trip device.
For testing purposes, one normally closed switch is installed in series with the output contact of the new relay; another normally closed switch is installed in series with the coil of the new relay.
By operating the first switch, the power to the shunt trip is interrupted to permit independent testing of the UV trip device.
By operating the second switch, the shunt trip is independently tested.
Each of the two sets of relays and test switches are mounted on separate new panels inside the reactor trip switchgear and wired to the respective main reactor trip breaker controls.
The new relays and switches are fully qualified as Class IE.
The licensee has stated that the modification has no impact on the design basis of either the reactor protection system or the reactor trip breakers.
The addi-tion of the new relay is within the capacity of the 48-Vdc supplies and the output switching devices of the RPS, and there has been no compromise of channel or train independence or separation / isolation criteria.
McGuire SSER 7 D-16
The licensee completed the installation of this modification during April 4-8, 1983.
Sub3equent to the installation, the licensee performed functional testing to verify independently proper operation of both the UV and shunt trip devices.
Technical Specification testing verifies proper breaker response time.
This modification was designed by Duke Power Company.
It was reviewed at the conceptual design level and approved by Westinghouse, as the nuclear steam supply system vendor and breaker vendor.
The licensee gave final approval to the modification on his own authority under the provisions of 10'CFR 50.59.
It was installed the first week of April 1983.
D.5.2 NRC Preliminary Evaluation At a meeting in Bethesda on April 19, 1983, the licensee described the modifi-cation by means of slides, discussions, and a submittal dated April 18, 1983.
The NRC summary of this meeting (dated April 25, 1983) includes copies of the presentation slides.
This description was presented at the conceptual design l
level; that is, design drawings and other details were not provided.
The licensee stated that the modification is considered to be safety related and was installed in accordance with all applicable Class IE requirements.
During the discussion, the licensee stated that although the shunt trip modifi-cation is considered to be a part of the RPS, the modification is not considered to be an essential, necessary, or required feature of the RPS.
The staff does not agree with the licensee that the shunt trip modification should not be an essential feature of the RPS.
The staff is requiring that in the long term, it shall be considered an essential feature.
When the reactor trip breaker was type tested for seismic qualification, the shunt trip device was installed.
The testing demonstrated that the shunt device did not interfere with any required functioning of the breaker, but the shunt device was not tested for its own functional capability in the seismic tests.
For this application, the staff considers this level of seismic qualification adequate for operation pending the completion of the Salem Task Force generic study.
The licensee indicated that the 125 Vdc for each shunt trip is from the Class 1E battery system of the same electrical division as the associated breaker; that is, the breaker operated by Train "A" of the RPS received 125 Vdc from electrical division "A".
Further, the new relay is an electromagnetic device that provides coil-to-contact physical and electrical separation between the 48 Vdc of the solid-state protection system and the 125 Vdc to the shunt trip.
The staff concurs that this degree of separation is acceptable for this application.
The staff questioned the possibility that a failure of one of the test switches could lead to an undetected loss of functional capability of the shunt trip.
The sequence of the periodic functional testing has been carefully defined so that any such failure will be identified by the testing.
The licensee described the testing scheme; the staff agrees that test switch failures can be identified.
The staff pursued the applicability of the modification to the bypass breakers.
The licensee indicated that incorporation of the change could introduce some significant complications regarding electrical independence, since each bypass McGuire SSER 7 D-17
-... ~ - -
breaker currently is provided with a trip signal from the alternate (redundant) train of the solid-state protection system (SSPS).
The staff notes that only one bypass. breaker is in service at a time and only during a limited time as
-required for testing, and that the other train can provide the-safety function i.
during testing.
Therefore, the staff concurs with the licensee's decision not to install this modification for the bypass breakers.
The staff asked the licensee if he had reviewed the facility Technical Specifi-cations to determine if they are still appropriate and sufficient in light of this addition to the RPS design.
The licensee stated that he had completed suchla review and found the present Technical Specifications to be adequate.
The staff does not agree with the licensee.
It believes that.the Technical Specifications need to be revised / clarified to reflect this new feature of the design and appropriate surveillance actions.
For example, the monthly func-tional testing requirements for the protection system need to be revised to ensure that potential failures or degradation of the UV trip device in response-to automatic protection signals are not masked (unrecognized) by the functioning of the new shunt trip device.
As discussed earlier in Section D.4 of this report, the licensee has agreed to conduct special revised surveillance testing, Because the appropriate testing indeed will be conducted, the staff has deter-i mined that it'is not necessary to delay restart or full power. operation to effec-these. changes to the Technical Specifications.
The staff believes these changes-should be proposed in close coordination with the finalization of surveillance changes, as discussed earlier.
4 D.5.3 NRC Final Evaluation On May 9, 1983, the licensee provided his complete design change package for staff review.
This package included detailed electrical schematic wiring drawings, the installation work request, and the completed modification installation verification test procedures.
To supplement this information, the staff requested, and received, from the licensee technical product informa-tion regarding the new relay and electrical drawings encompassing electrical connectio'ns at the interfaces of this modification.
The staff completed a-review of~the'information provided to determine if any deviation from safety-related requirements was evident.
The salient points.of this review are dis-cussed below.
i The design change package is identified by the licensee as Nuclear Station i
Modifications MG-1-1161, Rev. O, and MG-2-0119, Rev. O, for the two units, respectively.
The r.odifications were identified as " safety-related," and 1
l functional verification testing (special procedure TI/0/A/9200/20) and opera-bility retesting (normal monthly functional test procedure IP/0/A/3090/04) were performed before the modified system was declared to be operable and i
returned to service.
In reviewing the design as shown on the electrical drawings, the staff con-sidered the. requirements of the General Design Criteria (GDC) dnd of Institute
{
of Electrical and Electronics Engineers (IEEE) Std. 279-1971.
The licensee has stated that all the components are environmentally and seismically qualified as Class 1E, with the minor exception of the demonstration of seismic functional capability of the shunt trip device discussed earlier.
The licensee has stated that all the wiring involved has been routed and reviewed so as not to compro-mise any separation / independence requirements.
The staff notes that all the-wiring is limited to within the reactor switchgear units.
Its review confirms A
McGuire SSER 7 D-18 i
,n-.---~-.-a
+
---.-,,a
.w,,-
that testability is provided by the design. There are no bypass features (of
.this modification) included in the design.
The function of this feature does go to completion and requires manual reset action of the solid-state protection system before it' returns to its normal status.
The design generally satisfies the requirements-of the GDC and IEEE Std. 279.
The staff finds that the electrical independence between components of the reactor trip breaker that do not serve safety-related functions (e.g.,
reclosing the breaker) and components that do serve a safety-related function (e.g., ' tripping the breaker) is unacceptable for life-of-the plant purposes.
.Specifically, the shunt tripping circuits share a common single fuse with the closing circuits and auxiliary relays.
This situation could result in loss of the automatic and the manual reactor tripping of the shunt device because of a blown fuse caused by the postulated failure of a breaker closing component.
The staff has determined that this degree of interdependence is unacceptable in the long term but acceptable for interim operation for the reasons stated below.
-The installed modification is a significant improvement in the design diversity for automatic trip action.
In view of the current uncertainties surrounding the UV trip device, the staff believes that.the diversity of the automatic tripping of the shunt device is very important.
The consequences of the inter-dependency of the components that service'nonsafety-related functions and the components that service safety-related functions are limited.
The staff's review of the interface connections confirms that a blown fuse can be promptly detected in the main control room via loss of power to both the red and green breaker lights.' This self-announcement of a failure facilitates prompt repair action without having to wait for the failure to be detected during the next monthly surveillance testing.
In the staff's review, if this loss of power to the shunt trip device condition should occur during plant operation, the reactor trip breaker involved should be considered inoperable and the ccrresponding Technical Specification's Limiting Conditions for Operation Action Statement followed.
The staff concludes that, although the automatic shunt trip modifica-tion does not compromise the original design basis for the RPS, it is not a
~
fully Class 1E, essential, safety-related feature, as currently designed and installed.
The licensee has committed to modify this design to install an independent fusing scheme for the breaker closing circuits and the auxiliary relay.
The
.need for any additional changes will be determined by a McGuire-specific evaluation once the results of the Salem Task Force generic study are received.
The licensee further commits to implement their change on a schedule consistent with schedule requirements of the NRC Salem Task Force generic program.
In view of this commitment and the other considerations discussed above, the staff concludes that the present modification is acceptable for plant operations in the interim.
The staff reviewed the postmodification verification testing that was performed.
It includes' measurement of the dropout time of the new relay, independent func-
'tional operability testing of the UV trip device and shunt trip device, and response-time testing of the reactor trip breaker in response to the SSPS signal to the UV trip device. The staff finds that the areas tested are sufficient-
'and the test results are completed as expected.
It concludes that the modifi-cation was properly installed and functions as expected.
McGuire SSER 7 D-19
D.5.4 Conclusions on Reactor Trip Breaker Modification The addition of the automatic shunt trip provides diversity that is needed at this time to provide additional reliability for the reactor trip breakers.
The modification is classifed and was treated as safety related.
The equipment is adequately qualified as Class 1E.
The design includes sufficient testability.
The staff concludes that the present degree of electrical independence between components performing nonsafety-related functions and components performing safety-related functions is not acceptable for the life of the plant.
The licensee has committed to modify this design to install an independent fusing scheme for the breaker closing circuits and the auxiliary relay.
The need for any additional changes will be determined by a McGuire-specific evaluation once the results of the Salem Task Force generic study are received.
The licensee further commits to implement this change on a schedule consistent with schedule requirements of the NRC Salem Task Force generic program.
The staff finds the present design acceptable in the interim, and concurs that the bypass breakers need not be similarly modified.
It has determined that the changes to the Technical Specifications are necessary but are not required before plant restart or full power operation.
In view of these considerations, the staff concludes that the modification is acceptable for interim operations pending implementa-tion of generic requirements.
D.6 LICENSEE'S RESPONSES TO WESTINGHOUSE NOTIFICATION D.6.1 Westinghouse March 31, 1983 Letter In a letter dated March 31, 1983, Westinghouse, the vendor of the reactor trip breakers, informed their operating utility customers of "the potential for intermittent malfunction of the reactor trip switchgear" that employs the DS-416 UV trip devices.
The customers were informed that this condition is a potential unreviewed safety question under 10 CFR 50.59.
Westinghouse recom-mended two actions to the utilities.
(1) Conduct special dimensional checks of the UV devices, replacing any device-that is found out of tolerances.
(2) Until the dimensional checks have been successfully completed, have "the control room operators actuate the manual reactor trip switch at the main control board when a demand for an automatic reactor trip is observed."
This letter was developed based on the failure experience with the trip breakers at the McGuire Nuclear Station.
The staff reviewed the actions taken by the licensee in response to the March 31, 1983 notification from Westinghouse.
Both units at McGuire were shut down at
}
the time, facilitating immediate dimensional checks.
All eight of the RTBs were found to be met according to specification.
New UV trip devices were obtained, installed, and tested 10-25 times without failure.
The licensee did not imple-f ment the Westinghouse recommendation regarding manual reactor trip followup action.
This decision was' base.d primarily on the installation of a modifica-tion that automatically provided for actuation of the diverse shunt trip device.
The staff's review of the actions taken by the licensee led it to conclude that action was taken, in a timely manner, and that the licensee was fully responsive to the safety issue that had arisen.
McGuire SSER 7 D-20
D.6.2 Westinghouse 10 CFR 21 Notification In a letter dated April 21, 1983, pursuant to 10 CFR 21, Westinghouse advised the NRC and nuclear utilities of additional failures of the DS-416 UV trip devices.
This new failure mechanism involved missing retaining clip rings.
During 1972 Westinghouse changed the deign to use a different clip ring on the pivot shafts of the UV trip device that was thicker than the original clip ring.
However, the groove that holds the clip ring was not made correspondingly wider.
Because of this design oversight, the new clip ring was not properly seated and hence able to fall free of the shaft, leading to fail'ure of the UV trip device.
To address these failures, Westinghouse further modified the design to provide wider grooves for the retaining clip rings and committed to supply new modified UV trip devices to each affected customer.
Furthermore, Westinghouse developed an installation procedure for the UV device to provide for proper alignment and interface of the trip device with the breaker trip shaft.
To justify continued plant operation, Westinghouse recommended that the utilities perform the following:
(1) Alert control room operators to the potential failure of the UV devices.
(2) Reemphasize the indications of an ATWS event.
(3) Reemphasize the manual reactor trip action in emergency procedures (manual trip actuates the shunt trip, which is a trip method different from the UV trip).
(4) Verify after each operation of the breakers that the retaining clip rings are still in the proper location until new modified UV trip devices are installed.
The staff reviewed the licensee's actions in response to the Westinghouse Part 21 notification.
In his letter of May 10, 1983, the licensee stated that new modified UV trip devices had been installed and tested, and that the other actions recommended by Westinghouse had been implemented.
The staff finds that the licensee's actions were fully responsive.
D.6.3 Conclusion The licensee took responsive action to the March 31, 1983 Westinghouse notifi-cation, with one exception.
In this exception, the staff concurs with the licensee that manual reactor trip followup action is not necessary if an auto-matic shunt trip design feature has been incorporated.
Similarly, the licensee's actions to the April 21, 1983 10 CFR 21 notification were fully responsive.
On the basis of its review of the information provided by the licensee, the staff concludes that the licensee's actions are appropriate and acceptable.
D.7 HUMAN FACTORS CONSIDERATIONS RELATED TO DESIGN MODIFICATIONS D.7.1 Revised Anticipated Transients Without Scram Operating Procedures In his letter to Harold R. Denton, dated April 18, 1983, the licensee stated that no operating or emergency procedures required revision as a result of the McGuire SSER 7 D-21
}
modifications to the reactor trip breakers.
However, as emergency operating procedures are provided to give the operators written guidance to mitigate ATWS events, the staff reviewed the procedures AP/0/A/5500/34, " Actions Required for an ATWS Event," and'AP/0/A/5500/01, " Reactor Trip," submitted by the licensee in his letter to Harold R. Denton dated May 2, 1983.
[
The emergency operating procedures (EOPs) indicate that the operator's role is to first recognize that an ATWS has occurred.
Immediate recognition of an ATWS is provided by specific alarms, indications, and key parameters in the control i
room.
Upon recognition of.an ATWS event, the immediate actions are to trip the reactor manually from the control room, actuate safety. injection, attempt to insert control rods manually,-and dispatch an operator to manually trip the control rod M. G. sets locally.
At the same time, if the turbine fails to trip, the operator trips it manually.
The prescribed actions are technically correct and,'if they are followed, the consequences of an ATWS event will be mitigated.
1:
)
In addition to the instructions having adequate technical basis, they must'be written so that the operator (s) can understand and implement them in an environ-ment of high stress.
This includes immediate actions that mest be committed to memory so that they can be performed without reference to the procedure.
J i
- In Supplement No. S to the SER (NUREG-0422), the staff documented its review in which a team of NRC staff and contractor personnel visited the McGuire site to discuss the applicable procedures, observe the use of each procedure in responding to simulated accidents and transients on the McGuire simulator, and to observe a walkthrough of the procedures in the plant control room.
The transients and accidents observed at the simulator included failure of scram breakers to open (ATWS).
The staff' discussed the operator's actions and the procedure with operators and other members of the plant staff.
Some changes were made to the procedures as a result of the simulator exercise.
The proce-dural steps for dealing with ATWS were performed in a correct, expeditious l
manner during the simulator exercise.
The staff concludes that the ATWS procedures provide the operators _with means to immediately identify or recognize an ATWS event based on knowledge and instructions in the' emergency operating procedures (EOPs).
The procedures are clearly written and include appropriate caution statements and instruction on plant interlocks.
On the basis of these findings, the staff concludes that the licensee's procedure, AP/0/A/5000/34', " Actions Required for an Anticipated Transient Without Scram Event," provides adequate guidance to the operators to 1
mitigate an ATWS event.
D.7.2 Post-Trip Procedures Section 6.9 of the McGuire Nuclear Plant Technical Specification requires that the licensee provide prompt notification with written followup to NRC if listed types of events occur at the McGuire station.
The first type of event specifies:
3 Failure of the reactor protection system or other system subject to limiting safety system settings to initiate the required pro-tective function by the time a monitored parameter reaches the McGuire SSER 7 D-22 i
n,
.-.n,.---,
_,__,,,,__,,-._,c
setpoint specified as the limiting safety system setting in the Technical Specifications or failure to complete the required protection function.
Recently experienced failures of circuit breakers in the RPS have resulted in loss of redundancy of the RPS and in one case an anticipated transient without scram (ATWS).
As a result of these experiences, NRC has been assessing the adequacy of procedures for reviewing reactor trip events before restart.
The licensee has committed to following Regulatory Guide 1.33.
This guide endorses industry standard ANSI N18.7-1976, which states in Section 5.2.1:
5.2.1 Responsibilities and Authorities of Operating Personnel.
The responsibilities and authorities of the plant operating personnel shall be delineated.
These shall include, as a minimum:
The responsibilities to determine the circumstances, analyze the cause, and determine that operations can proceed safely before the reactor is returned to power after a trip or an unscheduled or unexplained power reduction.
l The licensee has stated that the written (procedural) guidance which satisfies the commitment to assign responsibility is provided in Station Directive 3.1.10 (dated October 3, 1977) " Investigation of Unit Trips." The staff has reviewed this directive to determine if the responsibility for post-trip review is clearly delineated (ANSI N18.7-1976).
The directive assigns responsibility to the Superintendent of Operations or his Operations Duty Engineer.
The staff has concluded that the post-trip review responsibility is adequately assigned to the appropriate level of management.
Section 5.3.4.2 of ANSI N18.7-1976 requires prompt analyses of causes of reactor trips or abnormal conditions requiring unplanned controlled shutdowns.
Plant Procedure OP/1/A/6100/05, " Unit Fast Recovery," contains the written (procedural) guidance to determine the cause and/or actions resulting in a reactor trip and/or shutdown.
This procedure also defines the corrective action to be taken.
The staff has reviewed this procedure to determine if detailed instructions are provided for post-trip review.
On the basis of this review, the staff has concluded that the present procedure relies too much on the review staff's training and experience rather than written guidance.
Areas of weakness include:
(1) The procedure does not list available information that should be evaluated, I
such as:
(a) recorder charts (b) operator and senior operator logs (c) computer alarm printout (d) computer sequence of event printout McGuire SSER 7 D-23
(e) computer post-trip printout (f) any other computer printouts, or logs, that aid in determining initial conditions, initiating event, and plant response (These may include equipment status logs and supervisor's night orders.)
(g) interviews of individuals involved (2) The procedure does not describe how and with what to compare recorded integrated plant response.
The response may be compared to (a) as a minimum, the setpoints and responses covered as either limiting condition for operation or limiting safety system settings in the Technical Specifications (b) the transient and accident analyses described in the FSAR (c) available plant records of previous trips including the plant prestartup test program (3) The procedure does not require a post-trip review except when a " unit fast recovery" is being performed.
A post-trip review should be con-ducted after any reactor trip, major transient that might require a plant safety system to operate, or abnormal occurrence.
(4) The procedure does not provide for both an initial (before restart) review and a subsequent (within 30 days) detailed review, nor does it describe which review groups (i.e., Station Safety Engineering Group and the Nuclear Safety Review Board) or individuals (Shift Technical Advisor) are responsible to the Superintendent of Operations for an investigatory and independent review.
(5) The procedure does not include an adequate " default clause." The proce-dure should require that if all significant aspects of a transient are not well understood within a period of time, such as 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, the plant should be kept at hot or cold shutdown and a more thorough investigation undertaken.
The staff concludes that the post-trip review procedure for the McGuire station needs to be upgraded in light of the above areas.
The licensee should review and consider adopting the Reactor Trip Mini Report which is part of the Oconee Nuclear Station's Operating Experience Evaluation Program.
The licensee has stated that adequate post-trip reviews are being performed by McGuire personnel because of personnel training and experience.
By letter dated May 20, 1983, the licensee stated that evaluation of reactor trips and the operating procedures for reactor trip recovery and unit startup have been re-vised to require that the duty performance engineer be notified before restart.
The duty performance engineer is responsible for performing an independent engineering analysis on all reactor trips except for those that are a direct result of operator error. This analysis will be performed using a reactor trip check list to ensure all appropriate parameters are considered.
The revised procedures require the duty performance engineer to document his review of the trip and provide,his recommendation on restart to the Operations Group before restart of the unit.
McGuire SSER 7 D-24
The staff finds these initial revisions sufficient to satisfy the staff concerns related to the areas of weakness described above.
However, the staff will require that the licensee provide upgraded post-trip procedures to the NRC for staff review and approval within 60 days from the time the full power amendment to the license is issued.
The licensee also committed to ensure that McGuire personnel who are performing the post-trip review will receive both initial and supplemental training to ensure that they have adequate knowledge and abilities to provide a comprehensive post-trip review.
On this basis, the staff has concluded that the guidance provided to the McGuire staff concerning post-trip review is acceptable.
D.7.3 Operator Training To provide assurance of proper operator response to plant transient or accident conditions, training on the procedures that specify the operator's response is necessary.
To respond properly to an ATWS event, the plant's procedures require i
the operators to recognize an ATWS event immediately and then take the directed actions.
To recognize an ATWS event immediately, the operators must recognize a reactor protection system demand for a trip, and determine that a trip has not occurred using readily accessible instrumentation.
As part of the licensing review of E0Ps, the staff visited the site on November 11 and 12, 1980.
The purpose of the visit was to discuss selected emergency operating procedures and observe their implementation on a simulator and in the control room.
This included an evaluation of the procedures for ATWS events.
The staff observed that the operators were knowledgeable of ATWS indications, including reactor trip demand versus confirmatory indications.
Specifically, the operators knew that the first out annunciator indicating a reactor trip should have occurred and rod bottom lights not illuminated is an ATWS event.
The staff also observed dur'ing simulator exercises that the operators performed the procedural steps for dealing with an ATWS in a correct, expeditious manner.
On the basis of the above consideratfons, the staff concluded that the training program provides operators with the knowledge and skills necessary to recognize an ATWS event immediately and respond properly.
D.8
SUMMARY
AND CONCLUSIONS As a consequence of the failures of DS-416 reactor trip breakers, the staff has reviewed the failure history, the investigative actions taken by the licensee, the licensee's conclusions regarding the causes of the failures, the licensee's maintenance and test procedures, the licensee's surveillance program, the licensee's plant modification to provide automatic actuation of the shunt trip, and the licensee's procedures for reactor trip and for ATWS.
From this review the staff reaches the following conclusions:
(1) The design of the UV trip device / breakers should be analyzed.
(2) Control over design changes and over the manufacturing of the breakers needs to be improved.
(3) A life-test program is needed for the breakers.
McGuire SSER 7 D-25
(4) Items (1)-(3) need not be cc,upleted before plant restart or full power operation.
(5) The causes of the failures have been identified and can be categorized as design related and/or manufacturing quality assurance related.
(6) Revisions to the licensee's maintenance and testing program are needed.
(7) Special periodic surveillance actions are needed.
(8) Areas of weakness have been identified in the post-trip evaluation proce-dures. The licensee is in the process of modifying the procedures to strengthen the areas that are of concern to the staff.
The licensee has committed to conduct a life-test of the DS-416 breakers.
The licensee has installed an automatic shunt trip modification.
It is not mandatory that the operator take immediate manual reactor trip action to follow up auto-matic reactor trip signals.
The licensee has certified that the installed UV trip devices in the McGuire reactor trip breakers are of the latest modified design supplied by Westinghouse.
The licensee has successfully conducted special testing of the breakers with the new UV devices installed and confirmed that the breakers are operable.
The licensee has committed to revise the maintenance and testing program and to conduct special periodic surveillance testing.
Therefore, the staff concludes that the failure causes have been identified and sufficient remedial actions have been taken to provide reasonable assurance that the McGuire Units may be operated without endangering public health and safety.
In addition, the staff has initiated independent testing through its consultant, Franklin Research Center, to confirm that all failure mechanisms have been identified.
The staff will continue to work with the licensee (and his vendor) to complete the long-term actions that have been identified.
D.9 REFERENCES American Nuclear Society /American National Standards Institute, ANS-32/ ANSI N18.7-1976, " Administrative Controls and Quality Assurance for the Operational Phase of Nuclear Power Plants."
Institute of Electrical and Electronics Engineers (IEEE) Std. 279-1971, " Criteria for Protection Systems for Nuclear Power Generating Stations."
Letter, February 28, 1983, from H. B. Tucker (Duke Power Company) to H. R.
Denton (NRC),
Subject:
Review of Reactor Trip System.
. --, March 1, 1983, from H. B. Tucker (Duke Power Company) to H. R. Denton (NRC).
--, March 22, 1983, from H. B. Tucker (Duke Power Company) to J. P. O'Reilly (NRC).
--, March 31, 1983, from E. P. Rahe (Westinghouse) to R. C. DeYoung (NRC).
McGuire SSER 7 D-26
--, April 18, 1983, from H. B. Tucker (Duke Power Company) to H. R. Denton (NRC).
--, April 21, 1983, from E. P. Rahe (Westinghouse) to R. C. DeYoung (NRC).
--, April 28, 1983, from H. B.-Tucker (Duke Power Company) to H. R. Denton (NRC).
--, May 2, 1983, from H. B. Tucker (Duke Power Company) to H. R. Denton (NRC).
--, May 3, 1983, from H. B. Tucker (Duke Power Company) to H. R. Denton (NRC).
--, May 5, 1983, from H. B. Tucker (Duke Power Company) to H. R. Denton (NRC).
--, May 10, 1983, from H. B. Tucker (Duke Power Company) to H. R. Denton (NRC).
Memorandum from R. A. Birkel, April 25, 1983,
Subject:
Summary of Meeting Held on April 19, 1983.
U.S. Nuclear Regulatory Commission, NUREG-0422, " Safety Evaluation Report Related to Operation of McGuire Nuclear Station, Units 1 and 2,"
Supplement No. 5, April 1981.
--, Regulatory Guide (RG) 1.33, " Loose-Part Detection Program for the Primary System of Light-Water Cooled Reactors."
U.S. Nuclear Regulatory Commission, Office of Inspection and Enforcement (IE),Bulletin 83-01, " Failure of Reactor Trip Breakers."
--,Bulletin 83-04, " Failure of Undervoltage Trip Function of Reactor Trip Breakers."
--, Information Notice 83-18, " Failures of the Undervoltage Trip Functions of Reactor Trip System Breakers."
McGuire SSER 7 D-27
ATTACHMENT 1 INTERIM TECHNICAL EVALUATION REPORT l
I r
i McGuire SSER 7 D-29
i INTER!M TECHNICAL EVALUATION REPORT EVALUATION OF McGUIRE UNITS 1 AND 2 UNDERVOLTAGE TRIP ATTACHMENT FAILURES NRC DOCKET NO. 50-369, 50-370 FRC PROJECT C5506 NRC TAC NO. 51000, 51001 FRC ASSIGNMENT 16 NRC CONTRACT NO. NRC-03-81-130 FRC TASK 417 Prepared by Franklin Research Center Author:
G. Toman 20th and Race Streets J. Stone Philadelphia, PA 19103 FRC Group Leader: G. Toman Prepared for Nuclear Regulatory Commission Lead NRC Engineer: P. Shemanski Washington, D.C. 20555 May 19, 1983 This report was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor any agency thereof, or any of their employees, makes any warranty, expressed or impiled, or assumes any legal liability or responsibility for any third party's use, or the results of such use, of any information, appa-ratus, product or process disclosed in this report, or represents that its use by such third party would not infringe privately owned rights.
McGuire SSER 7 D-31
CONTENTS Section Title Page 1
INTRODUCTION 1
2 EVALUATION OF THE INTERACTION BETWEEN THE UVTA AND THE CIRCUIT BREAKER 2
.., 2.1 Discussion of Failures.
2 3
2.2 Operation of UVTAs on Circuit Breakers.
3 2.3 Measurements of UVTA Output Force and Circuit Breaker Trip Bar Input Force 4
2.4 Trip Timing of Circuit Breaker Operation by UVTA 5
3 EVALUATION OF UVTAs AT FRC.
9 3.1 Characterization Measurements.
9 3.1.1 Mechanical Dimensions 9
3.1.2 Forces Developed 10 3.1.3 Discussion of Roller Bearing 11 4
CONCLUSIONS.
16 5
RECOMMENDATIONS.
17 iii McGuire SSER 7 D-33
l.
INTRODUCTION This Interim Report contains the initial findings of Franklin Research Center (FRC) concerning the evalitation of failures of undervoltage trip attachments (UVTA) associated with Westinghouse DS-416 reactor trip circuit breakers (RCTB) from McGuire Units 1 and 2.
This is a report of work in progress; thus, the conclusions contained herein may change as subsequent evaluation is completed.
The scope of work for this effort includes the evaluation of:
1.
the interaction between the UVTA and the associated circuit breaker, 2.
the failure modes (both those recognized by the Licensee and vendor and those determined by FBC during the evaluation, 3.
newly prescribed test methodology for determining correct mating between the lrVTA and the circuit breaker and for determining the adequacy of cJitical clearance between components of the UVTA, 4.
modifications made by the vendor to prevent failures, 5.
evaluation of baseline test data taken on McGuire RTCBs.
t
! McGuire SSER 7 D-35
2.
EVALUATION OF THE INTERACTION BETWEEN THE UVTA AND THE CIRCUIT BREAKER To evaluate circuit breaker and UVTA interaction, Mr. G. Toman and Mr. J. Stone of FRC traveled to McGuire Nuclear Station to view the RTCB installation, to watch a new UVTA and several failure-prone UVTAs in operation on a circuit breaker, and to discuss the past failures and corrective action with Duke Power Company personnel.
2.1 DISCUSSION OF FAILURES i
The Duke personnel described the failures that have occurred to date.
The first was attributed to inadequate clearance between the roller bracket and the moving core in the vicinity of the pin that lif ts the operating rod (see Figure 1 for nomenclature and cutaway drawing; see Figure 3 for side view and operating positions of UVTA). The second failure mode involved improper clearance of the UVTA trip tab with respect to the circuit breaker trip pin on the rotating trip bar. The third failure mode involved the retaining clips of the pivot shaf ts that could walk off the shaf t ends, allowing the shaf ts to drop out of the frame and causing the device to jam.
The corrective action recommended by Westinghouse for the third failure mode is most easily addressed. The grooves for the spring clips were found to be too narrow. Westinghouse has now cut the grooves wider so that the clip is completely relaxed when the clip is properly on the shaf t, thereby requiring significantly higher forces to cause the clip to move out of the groove.
As the UVTA is now made in the " modified" version, the clips should deform and break if enough force is exerted on them to remove them. This amount of force should not occur due to any normal operation of the device.
The manufacturer's corrective action for the second failure mode was to reject devices with less than 0.018 inches clearance between the moving core and the roller bracket arm.
In addition, a minimum clearance of 0.030 inches between the roller bracket and the brass bushing on its pivot pin is also required to prevent the bushing' from causing a lateral force that pinches the McGuire SSER 7 D-36
bracket between the frame and the bushing. This pinching would act as a
-braking mechanism and prevent unlatching of the UVTA.
The third failure mode is improper positioning of the trip tab with respect to the trip bar rolled pin (trip pin). This positioning is critical in two directions, in that the UVTA trip tab must be.neither tco close nor too far from the pin.
The manufacturer's recommended corrective action to prevent positioning problems is to measure the clearance between the trip bar pin of the circuit breaker and the trip tab of the UVTA with the circuit breaker closed and
. latched and the UVTA armed. Duke personnel found that small drill bits held by a needle-nosed pliers could be used to make this measurement. The drill bit that exactly fit between the pin and the trip tab was then measured and recorded. A minimum of 0.030 inches is required. Westinghouse refers to this clearance as " pre-travel." To assure that the trip tab had adequate remaining travel to cause the circuit breaker latch to trip, the manufacturer required that a shim be placed between the reset arm bracket and the brass bushing on the roller bracket pivot pin. If the UVTA can successfully trip the circuit breaker with a 0.070-inch-thick shim in place, the UVTA has adequate trip margin.
(Note: Trip margin is the manufacturer's term. The shim is called a trip margin gage.)
For this test, Duke personnel used drill bits to determine the trip margin.
2.2 OPERATION OF UVTAs ON CIRCUIT BREAKERS Following the discussion of failures and corrective measures, FRC requested that Duke personnel place three UVTAs on the test circuit breaker (a i
Catawba DS-416) for observation of operation and performance of the clearance and force tests that are now recommended by Westinghouse. The UVTAs were brought to the McGuire plant by FRC.
They were the McGuire lA UVTA that had failed to trip during tests, a Catawba unmodified UVTA (as originally received with the circuit breakers), and a " modified," newly manufactured UVTA. A p
fourth device, the McGuire 2B UVTA, was brought to the McGuire plant; however, it was in the disassembled state and could not be tested on a circuit breaker. McGuire SSER 7 D-37
The first device to be tried on the circuit breaker was the 1A UVTA. The pretravel gap measurement was taken, and then the trip margin gap test was attempted. This. required tripping the circuit breaker by deenergizing the UVTA coil. The 1A UVTA coil was deenergized and the UVTA did not unlatch and trip the circuit breaker. Attempts were made to determine the cause of binding. The moving core was noted to release and move slightly, indicating that the core had not jammed. The device remained latched for 10 minutes or more until it was jarred while attempting to find the cause of binding. The failure to unlatch at the McGuire plant could not be repeated. The testing of the lA UVTA and the other two UVTAs was completed on the Catawba circuit breaker without further failures to unlatch.
NOTE:
Subsequent to return to Philadelphia, FRC determined that the source of binding of the lA UVTA was inadequate clearance between the roller bracket and its brass bushing which caused a braking action that prevented rotation. FRC succeeded in having the device remain latched while deenergized several times. The clearance between the bushing and the roller shaf t was such that failure to unlatch would be periodic and not continuous.
2.3 MEASUREMENTS OF UVTA OUTPUT FORCE AND CIRCUIT BREAKER TRIP BAR INPUT FORCE Duke personnel demonstrated the methodology for measuring the force required to unlatch the circuit breaker and the output force from the UVTA.
The force required -to trip the latch of the circuit breaker is measured by pushing on the trip bar pin of the. manual tripping mechanism at approximately the same point at which the UVTA would strike its trip bar pin.
A horizontal spring scale is used. The measurements vary from reading to reading since the method is not highly precise. Consistency is attempted and an average of multiple measurements is required.
The measurement of available output force that can be performed on the McGuire plant circuit breakers is a static pull of the reset lever from the point just in front of the tab that is above the roller bearing when the device is latched (see Figure 2). Duke personnel perform this test with the UVTA unlatched, causing the trip spring to be in the most relaxed operating state. This reading is conservative with respect to a reading taken with the
-4 McGuire SSER 7 D-38
trip spring in the latched position and would compensate for the pivot point frictions that would reduce initial output force slightly. A multiplier of 0'.88 must be used to adjust these forces to account for lever arm differences.
Duke personnel also demonstrated the technique for determining UVTA output force on circuit breakers of slightly newer vintage than those of the McGuire plant. This technique was demonstrated on the Catawba DS-416 circuit breaker that was brought to the McGuire plant.
For this test, the UVTA is reset and energized, and the circuit breaker contacts are restrained in the closed position. The circuit breaker trip mechanism is released, allowing the trip bar to rotate freely for a limited arc. The UVTA reset arm is also allowed to rest on the roller of the latch. The output force of the UVTA is measured by pulling on the backside of the manual trip, trip bar pin with the norizontal spring scale. This causes the UVTA trip bar pin to rotate against the UVTA's trip tab, causing the UVTA trip spring to wind tighter. The measurement is read when the reset lever just starts to move. The output force measured by this method is less conservative than the force measured by the first method described, since the trip spring is measured at the highest operating force level (most tightly wound position).
Also, the pivotal friction and the friction of the trip bar pin to UVTA trip tab interface would l
l cause the measurements to be slightly higher than actually available.
Duke personnel provided the measured values for the McGuire Units 1 and 2 RTCBs. The force required to trip the circuit breaker latches ranges from a low of 0.25 lb to a high of 1.5 lb.
The range of the UVTA outputs (after application of the 0.88 multiplier) was from 3.1 to 4.4 lb.
The minimum ratio of the two forces was 2.6.
l-2.4 TRIP TIMING OF CIRCUIT BREAKER OPERATION BY UVTA l
FRC requested that Duke personnel provide the timing of opening of the McGuire Units 1 and 2 RTCBs from time of deenergization of the UVTA coil until contact opening. The timing charts provided by Duke personnel indicated a maximum allowable time of 0.150 seconds. The actual recorded trip times ranged from 0.065 to 0.080 seconds. McGuire SSER 7 D-39
DIRECTION PRODUCING CIRCUIT BREAKER TRIP RESET LEVER "A" AND "B" ARE PIV0T SHAFTS TRIP W
\\
ROLLER BRACKET SPRING TRIP TAB J
r gh ROLLER
,-,M)
ROLLER BRACKET i
A h
1U UPPER FRAME 5.-/
/ /
\\
///
OPERATING R0D f
MOVING CORE TRIP SPRING g
\\
\\\\
\\N
/
C0ll y
y 4
\\
\\g
\\g s
N s
/
7
\\
\\
s
/
g g\\
\\
/
/
\\
N
\\
/
/
g\\
\\
\\
\\
/
\\
\\
\\
/
N
/
s \\
\\
\\
g 7
N
\\
\\
f
/
g s\\
\\
\\
/
s s
s
/
\\
s //
&\\
f' l
.J b
/
e WASHER 7
j
/
\\
J
/
l, STATIONARY CORE y
N f'l 1 1 3 l ll 11 Figure 1.
DS-416 Undervoltage Attachment Note:
Portion of reset arm and roller bracket arm not shown.
l The parts not shown cause mechanical resetting of the device when the circuit breaker opens. McGuire SSER 7 0-40
STATIC PULL P0 INT TRIP BAR h
TRIP TAB
~
%%N 3
(O;
,h --/
l lll l
\\
\\\\
\\\\
/
\\
\\\\
\\
\\
N
/
\\
\\s g
N
/
\\
/
,/
\\
s s
g\\ s
\\
\\
\\
/
/
\\
\\
/
g\\
/.
N \\
\\
\\
g
/
/
N
\\
\\
f g
N
.\\
\\
/
x x
s
/
\\
s //
4\\ \\
/
l L
s
/
l
/
/
\\
/
/
j
/
l, 1b 3 l L1 11 Figure 2.
DS-416 Undervoltage Attachment Note:
Portien of reset arm and roller bracket arm not shown.
The parts not shown cause mechanical resetting of the device when the circuit breaker opens. McGuire SSER 7 D-41
i l
l POLE SHAFT I
BKR.
8 1
s Q OPEN i
BKR.
POSITION
\\ CLOSED
\\ POSITION Q ln.
\\ f,,
..b
/'.'s
'l sb 6
-BKR. CLOSED,
//
U.V. EN ERGlZED
/h-#
TRIP BAR BKR. CLOSED
-e i
_ _~ 3 r.$_
y = = ~ "~~~~."-,
. -(l I ;4;I o,
/
Figure 3.
Undervoltage Trip Device Operation McGuire SSER 7 D-42
3.
EVALUATION OF UVTAs AT FRC Prior to and following the trip to the McGuire plant by FRC personnel, further evaluation of the four UVTAs in the possession of FRC was performed.
The dropout voltage of the UVTAs was determined for each, tendencies to remain on latch after denergization was investigated, dimensional checks were made, and the disassembled device (McGuire 2B) was reassembled and tested.
The force balance between the roller bracket spring and the solenoid were determined.
3.1 CHARACTERIZATION MEASUREMENTS The DS-416 UVTA (Figure 1) was carefully measured to determine whether interference between moving parts could inhibit the operation.
Mechanical dimensions were measured, and the forces developed by the trip spring, roller bracket spring, and solenoid moving core were determined.
3.1.1 Mechanical Dimensions The mechanical dimensions were obtained from the disassembled 2B UVTA.
A surface plate was used as a reference plane. A dial indicator mounted on a vernier height gage, a vernier caliper, a 1-inch micrometer, and a 1-to 2-inch micrometer were used to make these measurements.
The measurements obtained for the critical areas are shown in Figure 4.
The position shown is for the reset condition where the roller bracket is pressed down against the operating rod. With the rod firmly against the side of the hole in the moving core, the core would clear the sleeve by 0.0086 inches. However, the diameter of the core does vary by 0.010 inches, which i
would reduce the clearance to 0.0036 inches.
3 As the roller bracket is rotated in an upward direction by the roller bracket spring, the operating rod will be pulled toward the center line of the sleeving; at the extreme, the center line of the rod will be 0.005 inches past the center line of the sleeving. This motion did not show any tendency to McGuire SSER 7 D-43
prevent the core from moving during the full expansion from reset position to the fully tr ipped position.
3.1.2 Forces Developed The forces and/or torques sere measured to determine the levels involved that cause the roller bracket to move out from under the reset lever. Once the roller bracket roller is clear of the reset lever, the trip tab can rotate as driven by the. trip spring, to drive the roll pin projecting from the trip bar so that the bar will rotate and trip the breaker.
The first spring to be measured was the tri? spring.
In the position associated with the untripped condition, the force exerted against the roller was 3 lb (1360 g).
Since the force is nearly constant as the roller moves under the reset lever, the tJrque acting on the roller bracket can be evaluated as a function of bracket position.
The eguation for the torque is T
= (13 60) (sin 0 ) (0.619) gram inches, where e is the angle of the TS roller arm with zero reference found when the roller is directly under the reset lever, thus producing no rotating torque on the roller bracket. The 0.619 inches in the radius arm of the roller from support bearing.
In the untripped position the angle is approximately 6 degrees, thus producing a torque of 87.9 gram inches that add to the coil torque.
The force developed by the coil was measured by pulling directly upward on the operating rod with a spring scale. No other linkages were involved in l
this reasurement. The data obtained at various excitation voltages are plott'd in Figure 5.
As noted on the data plot, the force doe drop to a e
reduced level once the core has moved away from the washer separating it from the stationary core. The torque developed by the moving core is expressed as
~
(
(.9).
s shows that as the moving core leaves TMC '
MC the untr ipped position, the torque tends to increase until 0 reaches a level of 13' degrees, where the torque would be approximatelf 6% higher. However, as soon as the core moves, the force of the moving core is reduced approximately 30% due to the increased air gap. McGuire SSER 7 D-44
- l. ',
Another observation related to the forces developed by the moving core is that as the core moves down and with excitation voltage applied, the core will pull down first on the side closest to the roller bracket support shaf t.
This cocks the moving core, but when in the final position, the core is straight; in many attempts, it could not force the core to assume a position that would
^
prevent normal trip ope:ation.
\\
The torque developed by the roller bracket spring (TRBS' by use of a spring scale with all other linkages disconnected. The data obtained from these measurements are plotted in Figure 6.
As the roller bracket rotates bringing the moving core up from the step, the torque is constantly decreasing.
The combined result of these systems is plotted in Figure 6.
The roller torque is not shown. At the time of the trip activation, it was observed that, on the units that f ailed to perform as required, the moving core does move slightly, but the roller arm shows no sign of movement.
3.1.3 Discussion of Roller Bearing The roller element bearing is not symmetrical because the rollers extend to one end of the bearing housing, but only come to about 75% of the distance from the other end. With the rollers directly under the reset lever, the system will trip consistently. When the bearing is reversed on the mounting shaft, the reset lever now applies force at one end of the rollers.
In this configuration, the assembly can be made to fail.
Further confirmation of the ef fect of increased frictios.
'tudied by taking a brass brushing with the same dimensions as the roller bsaring and placing it on the bearing shaft. The assembly could readily be made to fail.
The maximum torque level for the rolling friction can then be determined from Figure 7.
Since the slope of T s ess than that for the T RBS TS' rolling friction would have to be less than 310 gram inches at an angle of -6 I
degrees. McGuire SSER 7 D-45
- m. u n.., a a gegon e Co A rs.
St.se ve-cLgAM C$
%FAWLC.
..,e,,-
.a < -
.J 91
- I l
.c ro I
I I
s --
/
,as I
f i
_([
l 3 +l Lf I
+
.cae (N XN-T' s' N ' g
, u 3,
ie ixxx xx
.m A\\\\'
r x '2 N '
!! \\ \\ \\
i NN N
N\\\\
. om NN NNN N
L NN NN N\\
x NN:
NN sN
?
'N N
.wi aM W
l l
l j~
, 504 1,
l l
Figure 4.
DS-416 UVTA in Reset Position (Partial View Showing Critical Measurements) McGuire SSER 7 D-46
^
I l t
I _
I I
l i
i
.l i
e
. 6 i I qg i
l i
~I P~~
i i
- 'ILPs i
a
_/,
~
i I
I t
i I e e p
i i
t
{
.f 1 i i
.6
? -
9 !
I
./
3 e
f
? '
1 i
t ! _/
t !
6
' i ! !
I..'
!.i i
i I
e e
!.i 9 i j i
! l if 4 i i
e 6 i i
i i
., fi l
jf t
e fa i
e
, fi I
W I
I i i
1
!t i i i i i I i i
!/i
'.i i
i i.
! i '
I I t i
i
. ' f fi !
8
'I t
8 I I I i 6 i i i I !
! i i i I I 1 !
[i l ?
! I e j i e
' !ii i
! i !
i i
i
/i j i e
j 1 l s
'I i
_ !. l
! ! i 8 *
! ! !/
i i I
i i i t
i i.
t i i i i
- i 1 i i i i i !
. i.
i ! i fi t. i!
! i i i e
. - gi i. I i..
. i i.
i i i i i. i
, if--
i i j
l
, '. i,
_ i !
/!
8 i
f i
.m i,
i,
i f
, i i i g-1
., e i i
.fi,
i.
i e i i.
. i.
i l
,fi
.. i ggi.
i
.f i
! _t a !
_ i
' i I
. I i i i
i e i.
/,
i ! !
l !%i i.
I i i i i.
e i e i 3 e i i I
I i i
/
6
, i i e i i i i i..
! 1 !
i i i i
i i i
..'/s i
! i i i
! i 1 U
I
. I l
i l
8
! i i i
'. ! i i
! i i
i
'I i!
t i i i e i e
i
. i
!. C!
I I i '
i !
! l i i
. ! /
i i
i i I i
t t
i i
i.
I Ji
,.2 i
i i i i i
! i i f, i.
Q'S i
i i 1
i i i i
! r
!, /.
e i.
M e -- -
t
, i i,
e i.
i !, _
i ! /i i
i i i
t i
ib l 1
! i
. i 4 !
l ! ! i e
i i i /r !
i i
_ t i
! i. I i
i i 13 i
i i i
i i e
i i i i i i I
if Iii i i i
i i i I i
A i !.
I i i
i i i !
e i
/4
. i !
I i i ! i
. i,
l i i. I i
i
/. i i
! i i i i i
i i
I i
1 l
i 11
. t.
i 4
i i
' i !
l ? f !
i l
f i
! I f
! I i
l i.
i i - <pl.
i i i i
f i
i i
i i
6 ! !
+
i i e i
i
/
l i
. f.
,. i l
! 4 ! i i I.
! i.
I[.
1 I
I. I i i t
!i i i i 1 +
i i ei
! 6 i 6 i i I l
.fi l 4 i I i i i i i i i i.
i i i !
!Ii
/.
i
! i !
1 1
t i.
I i,
, i e i!
i i i iii I i !.
I i i
! i!
1 i,,'i !
/i i i e i
! i j
i
! 1 i
i i i
I I
i e i i/
. i e
i i i 6 i
i i 1
. ! i
! i.
! I i
! If
! I f f i !
i 1
! i ! '
i e
1 !
, ! ! I I I e
i i /!
l ! 1 3.
t i
I i i
i i
i !
i.
I imb
. i e i
. e i
</
4
, i i
W iWW
, i !i i.
. i f.
' i i i i t/
i e i i
t t * !
_ i i,
i i
.i i
i.
i i i i,
i I
i
' i ! !
I i
. t f
! i l I I i.
i i n I i l i i I i !
i 1
?
8 i
i
. ! i.
.i i i !
/' i
, 6 3 i
e l i
.s i.h 1
. i..
!, i i !
, i
, i i i..
. i,
. i i i i,
i i
. i i
_ re i_!
, i,
i.i i i i
1 6. 4
- f !
ii s i
.. ! 1 i i i Ir N
Nkb lii ii i
i ii.
sa 6
i 7
, i
. wa.
i i,
. IP
. #i i
i,
i.
i ! i.
i i e i,!
t i,
i i i i.,
. i i
i s i
i i
I !
! i I i
i i
!. i i I
i
! i,
, e i I
6 e i i
, ! a i 6
t.I i
! i t i
I.
t, i i i i i 6 i
. ii.
i e i i i
., i i
! l I i I
i i
. i t
i
! ! 6 i ! i e t i i.
i t
i i
, i
, i r i i i i
i i
i.
i i
1
- I h.
M.
?
w.
4, a
, f I
go'.
L l.
g6 i
i
-n r_-
u i
fa i
i,
no I
i i
% o.
_,m.2 i.
i i
.. i.
! ! ! i i..
vu u s i c_wumugri, !
. i e
I i oiI 6 i i i i I.. I i i l l l t i i !
, e I i, i...
4 i i 1,ji,
'lil l j ; i i Figure 5.
Force Developed by Moving Core versus Coil Excitation Voltage
. McGuire SSER 7 D-47
.e
., i I,
i 6 i,
. 3.
3
! 6 1 i
- i
! i !
,., i. *.
1 i.
l 1 6
,s
. w, i.
.. 6 1
o.i
,i t,
- i,
t,
,, I
'ie
,_,,j6 l j,
9 i i I I i i
\\1
'?
3 !
i,.
, i...
.X:
i
.,. i..
x i,
E l,' l" Y l' 7 PLUNGER IN FULLY RESET PO,SlTidN o
- \\
i i i
i.,,
i
.. i e i
! 'M i
! \\
4.
I'?
3 i
\\'
i,
t. i i..
i ji,
~
w FZ!'
'n i i
!~
\\:
lZ, OPERATING..
i','
i 4.,
is
- E';,i.
- ..l.
l- "4.
- . ANGLE
- : l' l!:
, :4;:;
td v
L
?W
. i
\\.
t t...
l
~
. i i
X'
, I i,
4,
. 6,.
I i.,
,j.i ii.
\\
i i i t i
! I e
'I
, 'i4 i
i.. i
, i.
6 i i i i i, i.i, ii I
i !
.'\\.
I ! ' (
i !
i,
i.. 6 i i
.i,,
L-
! I '
' i I
j i
\\.
i,....
['
! i,,!
i;.
,. 4. t 6 i i..
, ; i..
iX t i I
', I I '
I i.ii
,
- t i
.\\
t I i 6 6 6 i 6
i,,,.
i,;
6 i
pQ
. ee i.
i ; ; !., 4
- , l ;
- ,j; i i
! I I I i 4 i
- i e i
\\. i j X6 3
i ou f'.,,1 l
.,f{
4 i i t g,i..
.s.
. i.
t *.\\
f p
i,
.4 3 ',
! l * ! +
+,
-.\\
i..
i L
k I '
i ' !
i i.4
(!, i 6
.4 6
i e '.
X-
- 4 ;
.. i i
L i!
, i t
.g t
i.. i 6
6
. l.. !
.i 4,.
.\\.
i. ! i,
1 4
.\\
s i6,
i i
I ' '
' 'AM e
i
,\\
l
., i, \\
. 6 i i
6 3
?
, i i,
t...
.\\., e,
, i i.,,
i. i 6 6 i
', '
- I I
1
. x...,
1 i
e i
. i T.
t i
i i
,l i
i f.m
.,H1D i
i,.
i 4
i,,,
i,
,. i
.., 4,
- - i.
l 4
9 f
I 9,
I i
3
- i f,;,; ;, 9 g g J,a t
Jai 2
m,
1 i'
~
. w....
,m.
u,
,70 i..
...m_...,,
,,v.
.m, i
ROLLER BRACKET TRAVEL ANGLE E.,
i
....,,i,
i
.i.
Figure 6.
Torque Developed by Roller Bracket Spring versus Angle of Travel of Roller Bracket McGuire SSER 7 D-48
{
, i e ii.
, i i i.,, '
r ii i ti!
i ' l i i i i t i r-
, i i i 1.,
f i
e t * *
.
- i
! l.
I i i,
r" i
1 i 6 i
. i,
t i i
1 i Yg]
6 i
e i
6 i
e i
e I t
. e 6 i e i i, e l.,4
= -
i i
- I
. i e i.,
t i t
I ! t i
i e i i
JE i t t t
- t i
e i
ij. j i I i
.s 1 i ! ' C,
i i.
I t i i i 3
t i e i i i ai
- E i
. I 6 i
a i a _
- l.
i
- i I i i
i w
g.
.*t-i i *.
t i TD gi FF.
- E.
i q_,
i i
e i i I
. i i
i i i.,
V.
n% i l
i i
P.
8
' i '
cri 3 i ! i i
I i !
e i i9
' + '
gi i i,
i i 1
e i i !
. 6 t i 7 'y
. I i i i
. i i
a i '
6
, ! i t
i
. i i
. t. I i e i
'w i
E.
.. 4 i e i i j I
i i
i i i !.
t y4
, g m jt 11 C i
e i *
%s t
i i i '
, i i i
+ i
, e i
e
- I e t G T*i i
+ +
r ! I 6
i
! e i i
t i
i f* y
. i l i
, i
==: !
i
. s.
1 4 i i
i i
4 i
UR _
i e
i t i i t i
- i
' i 6
- id i
a t
i 6
t i
! e i Q
. ' _ es s
i 6
i e
i c
i 4
6
.... i.
.M
. I 2>s
, i i, i t
- a i i t i
y
+ t t t
- t i i i l 6 i i i t I i e i
e i
i i t i
i i i
e a at I '
m i
a i I.
L t 29 ~
i i i i i i
i t i t
i i
i i
CD i
i 6
.Z.
. i e
i t I !
I i
t
' +
i 6 I i y i,.
i i
e i
l i i
- 6 i
Q
%g'
.. i
.i i !
e e
i i
e i i i + e a ie i i !
i
. I i e i
3 i i.
i t i i
i i i,
I I
i i
i e i i
- P-i i
i i F=
i
- .. i ' i 3
- 4.
i..
t 6
, e t i
i ! !
i i
i
[
a e i
. I i ! i i U A A_-m I
i i e
- i i *.
I i
4 i
+. !
i
. i i
i 6 i i
%y.
i\\
i i a
6.
- i 4
i e i t t e i !
.I Y
i i
! i i
i i i l
O Y
i !
M_i i
['~ j '
t r
t i i l
I i
.I 1
I t
i i imi i Ni i i, i g i
i !.
i a i i
8,
. i i,
I..
i 0
i i e i
' i i i i@ !
! mA !
i e i me i
? i 1
- a i
i i
i I
t I i
i r-i f
i
.. 76 y
i i 4
4 4
i 4
.. i i
m 6
' i 1-i e
t ?
C
/t i
1 i
' t t +
t i t i t i t
i i i
! i ? ! '.
CC i
! i i !
T-i i i
- i
! i i
! I I
i
' i !
- f.. i l
6 i 1 e
6/ I l e 4
4.
, e i. p i
4 ii i
!. i i e a 1 i. !
i i i g
' i i
i e i !
I a
+
i e i I #1 I
i I t i i i i
3 i
e I
J' m
i Mf,,.
wu L
6 4
i
- .C A O
i
,. i.
6 e i
i i WI6 I ie ! l 15
% it I i e i i e t
' i e ! !
1
- . i a
i 9 6 i ' i
! i
' i b /!
i !
! I t
I'
\\e t !
i
! e a
i I
g i i
. i
, i 1;}
i i i !#.! !
i i
! e i
e i,
6
. i i
. i a
- p. i. i..
i i.
i 4..
.gi i i i e 6
7 i
i II j e.
t i s i 1.
6 ' '
e b
!i e
i ! ! t
-t \\ !
E! !
! i i i i t
i i i i i t t. !
i i i h
i i
t i i i i
- i a f
i i '
i ! : F it 6 !
t I i t
i 11
! i ! i w
6 i i i I
t
! i X i i if
! i.
e
+ i
- y
,. i 4
, i i y
i s i 1..tI 6 6 O
~i 6 a 1
. t Ti T i
U
. i
_ h
! ' i +
(
i t *
! t X I!
t i i 6 l
N a !
I i
i
- t
. i. t t
i i
F* i i
t i i i i e
i
! XI
- g a i i
L i i !.
I I
I i i i JL i i t ! e i
i i i
i !
i i i '
i I\\
i 6 i 6
i e
i CO i
,!f X
. t i
i i i i
i i
i ii a f a
i !
i t !
!
- i '
l i e a L
j i i i 6 1:
t hil 4
i s
e t
i i i i 6
, 6 e
1 4 i
i !
i 6 i i g
.. i i i,
i i t.
1 X.,.
i,
i
. i m
t r
a 3
! t i
! i i i i i
. i t
i i i
, i
! I i
f.! 4 Xi i
i i
O e
i i
6 t i
i
. 6 i
Jt L.
t i
y
! I ' i I
t
[!
f T-i
_3 P
i
? ?
i i
i i.
e 4
! i i i i 1
- i i i Ti i..
- e t
i
. t i
t o t
i l '
i i
i ' i e i ! I!
I !
! i Yi i t i
, i a i !
. t i
, N i i i
., i e i
Ii,
, i i 4 i X:
- \\i i.
- i i e
i i
i i if 1 i'
' 4 r
i
- i GJ i
a i
1 :\\
i,
- 4 Es i
e t
g
.*'. i 3
! i ' i, Y.
i i
6 J:
! i i t,
I i i r
I
!E i ' I i i\\'
!4' i I Z!
i Cn i !.
e i i a I !X w
5L!
e i
i i t.r a t "Li-3 Ei i i i i
3,w sa S. i i i 1
i
't i
.Y a
t ia*
, i su
' i '
\\
L i L
l'.
4 teii,i t MX.i i i i e
+
e i e
., i
-W!
i
.
- i M i i i.
?\\li Y
'N-a i
' * ! N
'\\
- i 1 i N
N!
UM3MI ? XM i I
, e i 76 ii
- i i. >
ie
+
N 1
'. i
- ii i e i i i a e i X i*
- _ ' ' ;;jei ! 6 E-
'
- i i i hl 1
I i e i i ! Ji I
e i
. i *
- MI ! 2/F FJ X D # i 6..
_\\-
i i i i
,,,A i
6, i i.,
6 i
'.'im
~
m.e i
i i i ! i i\\
i !
i i i I '
- . i i i i
I i
! ! l 1 i +
i
' i i l i
i
., l iY ii l
l
'I t
i i l 1 ?
i
! J i
6 1
h e a A
.. i.
.. 6 4
.J T
T e
t 1 *
! ! 1 1
! 7.
t
. i,
i si i i.
i.
. ! i
- c. i
. i
., i i
i i
! !,I i I
i t
i i i i
- 8..
a i i t i i i i r t F !
i i i e
i
., i ii i i i i i i i
. D-49 McGuire SSER 7
4.
CONCLUSIONS The FRC evaluation indicates that the f ailure modes recognized by Duke and Westinghouse personnel (i.e., clearance problems within the UVTA, clearance problems between the trip bar pin and the UVTA, and pivot shaf t spring clip failure) have been corrected. However, evaluation of the overall operation of the UVTA causes FRC to be concerned about the roller bearing on the roller bracket.
The roller bearing is critical to the operation of the device and slight changes in rolling friction rapidly reduce the margin for correct unlatching of the UVTA. While failure to unlatch caused by roller bearing friction has not occurred to date, closer evaluation of the potential of such failures is prudent.
Acceptance criteria have been set for critical measurements for the UVTA by the manufacturer.
UVTA output force, circuit breaker trip force, bushing clearances, and clearances of UVTA with respect to the circuit breaker trip bar pin all have criterion set.
Testing methodology has been developed for each of these criterion.
Baseline tests for determining whether the McGuire I
reactor trip circuit breakers meet the criteria have been performed.
1 McGuire SSER 7 D-50
i 5.
RECOMMENDATIONS 1.
The baseline tests on the UVTAs and circuit breakers should be repeated periodically and the data compared to baseline data and trended in order to determine degradation.
2.
Life testing of the UVTA should be performed to show that the device can successfully operate for the intended lifetime.
3.
Criteria for a replacement interval should be developed for the UVTA so that replacement occurs significantly before the expected end of life. These criteria should be based on the life testing of Recommendation 2.
4.
The roller bracket to roller bearing frictional forces should be reviewed and evaluated. Potential for failure to operate should be determined, and any significant potential for failure should be eliminated.
Data available at the time of writing of this report indicated that there is no immediate short-term concern for roller bearing failures and that this evaluation could be 7erformed in conjunction with the life testing program. McGuire SSER 7 D-51
U.S. NUCLE AR REGULATORY COMMISSION
'7 m NUREG-0422 BIBLIOGRAPHIC DATA SHEET Supplement No. 7 4 TITLE AND SUBTsiLE (Add Volume No., & appeceristel
- 2. (Leave bimkl Safety Evaluation Report related to operation of McGuire Nuclear Station, Units 1 and 2
- 3. RECtPIENT'S ACCESSION NO.
- 7. AUTHOR (S)
- 5. DATE REPORT COMPLETED l YEAR M ON TH May 1983 9 PERFORMING ORGANIZATION NAME AND MAILING ADDRESS (lactue 2,p Code /
DATE REPORT ISSUED Division of Licensing uoNTH lvEAR Office of Nuclear Reactor Regulation May 1983 U.S. Nuclear Regulatory Commission
- 6. (Leave uan*>
Washington, D. C.
20555 8 (Leave uank)
- 12. SPONSORING ORGANIZATION N AME AND M AILING ADDRESS (Include lip Code) p Same as 9 above II. CONTRACT NO.
Safety Evaluation Report, Supplement No. 7
- 15. SUPPLEMEN TARY NOTES
- 14. (Leave orm&/
Pertains to Docket Nos. 50-369 and 50-370
- 16. ABSTR ACT (200 words or sess/
This report supplements the " Safety Evaluation Report Related to the Operation of McGuire Nuclear Station, Units 1 and 2" (SER (NUREG-0422)) issued in March 1978 by the Of fice of Nuclear Reactor Regulation of the U.S. Nuclear Regulatory Commission with respect to the application filed by Duke Power Company, as applicant and owner, for licenses to operate the McGuire Nuclear Station, Units 1 and 2 (Docket Nos. 50-369 and 50-370). The facility is located in Mecklenburg County, North Carolina; about 17 mi north-northwest of Charlotte North Carolina. This supplement provides information related to issuance of a fu 1-power 1
authorization for Unit 2.
The staff concludes that the McGuire Nuclear Station can be operated by the licensee without endangering the health and safety of the public.
17 KE Y WORDS AND DOCUMENT AN ALYSIS 17a DESCRiPTORS 16 IDE NTIFIE RS'OPEN-EN DE D TERMS
S !This ongel 22 PRICE 20ggqq g
N RC F ORM 33% 47 77)
UNITED STATES saast cuss Jen NUCLEAR REGULATORY COMMISSION rositct a satsroo WASHINGTON, D.C. 20565
.Islh'c 5
etama 4. i n OFFICIAL BUSINESS PENALTY FOR PRIVATE USE. 4300 12 0 $ 5 '317 > a / /
1 1AN US N L' C Af)M nIV t Ilm r
pnt IC Y f.
P ut' VC) T H P o o i-
'.d r"
l h-S :1 l
h.1 SH I N ~, T F N "t
"'5
S
/
{
- ---- -