ML20024C737
| ML20024C737 | |
| Person / Time | |
|---|---|
| Site: | Crane  |
| Issue date: | 11/01/1979 |
| From: | Michelson C Advisory Committee on Reactor Safeguards |
| To: | |
| Shared Package | |
| ML20024C736 | List: |
| References | |
| TASK-02, TASK-2, TASK-GB GPU-0478, GPU-478, NUDOCS 8307130188 | |
| Download: ML20024C737 (7) | |
Text
._
s l
~
~
l 1
I~
k.
ADEQUACY OF TMI-2 EMERGENCY PROCEDURES FOR THE CASE l
OF A LOSS OF REACTOR C001. ANT AT THE TOP 0F THE PRESSURIZER l
C. Michelson l
November 1,1979 The fbrward to NUREG-0600 claims that the accident at TMI-2 could have been prevented in spite of certain inadequacies. It states, "The design oi the plant, the equipment that was installed, the various accident and i
transient analyses, and the emergency ' procedures were adequate to have prevented the serious consequences of the accident, if they had been permitted to function or be carried out as planned."
~ I ItJREG-0600 is undoubtedly a comprehensive investigative report of the accident and a cr2dit to the meticulous efforts of many competent people.
C'.
I have no specific coments or concern's relating to the scope or general content of the report at this time, but I am having some difficulty reconciling the above stated conclusion with my own observations which are, admittedly, based on a sore limited viewing of the situation, t
There is little doubt that the accident at TMI-2 could have been I
terminated without significant consequences by a timely closure of the PORV block valve. through operator action. However, the plant was designed to be forgiving and it was verified by analysis to be fully capable of handling this lack of action without unacceptable consequences. It was an estab1'ished design requirement to accomodate a postulated pipe break upstream of the PORY block valve or elsewhere at the top of the pressurizer or a failed open code safety valve. For such cases, termination of the msulting loss of reactor coolant by operator action would not be possible.
i The equipment required to fulfill this requirement was operable during 8307130188 791106 2012000 PDR ADOCK 05000289 P
mL j
l -
_ _ _,..-. _. _ _ _ _ - _, - ~ -... _ _ _ _ _ _.. _ _. - _.. - -. - _ _ -
t i
L.
the accident,.but it is not clear to me that the emergency procedures in
)
effect were adequate to assure a proper operation for this specific loss-of-coolant situation and thus pi: vent serious consequences.
.The only TMI-2 emergency procedure which appears tio be directly applicable to the accident situation is 2202-1.5 (Pressurizar System Failure).
j
' A portion of this procedure deals with a leaking or failed open PORY or l
code safety valve which,was the situation for over two hours. The symptons
).
and automatic actions outlined in this procedure match closely those observed 4
during-the.necident. However..some of the observed symptons and automatic actions,are also indicative of those caused by a loss of reactor coolant, so the pmcedure to consider might be 2202-1.3 (Loss of Reactor Coolant /
f This irecedure deals with a small leak Reactor Coolant" System Pressure).
i or rupture which is within the system capability, and a large leak or rupture which lands to the automat'ic actuation of the engineered safety I
features. Some of the symptons outlined in this procedure did not match those observed during the accident.
I am not sure which of these procedures the operator thought he was fol, lowing during the first hours of the accident, so I examined both to
't determine their applicability and adequacy. My conclusions are based on i
the following observations which were derived from this examination.
i
./
Emercency Procedure 22021.5 (Pressuri:er System Failure) 4
'iI This einergency procedure contains a Part S which deals with a failed open
. The POAV and a Part 0 which deals with a failed open code safety valve.
(
/
pmcedure indicates that oth of these conditions lead to symptens of
,,,j J
J
/
1
..9
I 1
]
- ~. >.
... ~.
3
{
l
(
s elevated valve discharge pipe temperature, elevated reactor coolant drain tank pressure and temperature, and the automatic actuation of l}igh pressure injection. The procedure calls fbr manual closure of the p0RV block valve if the p0RV fails to close (8.2.8.2.a).
For a failed open code safety valve.
the procedure instructs the operator to attempt to control pressurizer level using safety injection valve MV-V168 (0.2.8.2.c).
It also stipulates to manually initiate additional safety injection if required to maintain pressurizer level (D.2.8.2.d). As a follow-up action, the procedure j
specifies holding the pressurizer level, if possible, at or greater than 1
}
220 inches with safety injection (D.3.2.a).
l During the TMI-2 accident, the failed open condition of the PORY was not directly apparent to the operator because the valve position indicating g
light showed the valve to be closed. The discharge pipe temperature was high on both the p0RV and code safety valves. Since the individual valve I
discharge pipes are joined together, it is usual to experience high l
temperature on all discharge pipes if any one valve is open. The operator was probably aware of or anticipated that the loss of main feedwater i
j transient would open the p0RV and perhaps one or more code safety valves.
l He could not tell that the code safety valves closed.
The subsequent elevated reactor coolant drain tank pressure and tssperature, and the automatic actuation of high pressure injection were additional direct indications of a failed open p0RV or code safety valve as opposed to a possible loss of reactor coolant due to a pipe leak or rupture. Since the p0RV position light was indicating closed, it would be reasonable to conclude that all of these symptoms were due to a failed open code safety valve. For this case, the applicable procedure is 2202-1.5 which calls for pressurizer level control.
m.
w-1
,i
.,...,..n..
m...........,
..c_..
4
}.
The actual operator response during the accident appeared to follow I
this procedure. Unfortunately, the procedure is unacceptable for a failed i
open code safety valve (or a failed open PORY with a defective position-I j
indication). For this case, a rapid pressurizer refilling occurs and the level ca'n appear to stabilize even though the core becomes uncovered.
The high level in the pressurizer obligates the operator to throttle back on high pressure injection to control level as reiuired by the procedure, l
and this leads to unacceptable consequences as found out during the TMI-2 accident.
1 I
Emergency Procedure 2202-1.5 does not explicitedly warn t).e operator with a symptom statement that pressurizer level will rise while the reactor 6'
coolant system pressure is falling. However, this possibility should be i
apparent from the requirement to control pressurizer level at or greater than 220 inches by the addition of safety injection while f.he pressure is l
falling below 1600 psig. An increasing pressurizer level with decreasing j
reactor coolant system pressure should not confuse the operator if he believes the event to be a failed open PORY or code safety valve, i.
l 1
Emercency procedure 2202-1.3 (Loss of Reactor Coolant / Reactor Coolant System l
Pressure >
l This emergency procedure contains Par: A which deals with a, " Leak or Rupture Within Capability of System Operation," and Part B which deals i
with a, ' Leak or Rupture of Significant Size Such That Engineered Safety Features are Automatically Initiated." The procedure indicates that both of these conditions lead to symptoms of decreasing reactor coolant pressure
\\.
..~.
..,_,.,_;,,,.g
~~
.I 1
(..-
and pressurizer level. For Part A, the level will stabilize with time.
For Part 8 the leve'l will continue to de: crease.
j.
At TMI-2, the accident condition of interest was a failed open PORY t
which remained undetected. This condition was a small break (less than
.I 2
O.5 ft ) loss-of-coolant accident until teminated by closure of the upstream block valve. However, the pressurizar level response during this event i
was not indicative of that predicted by the procedure. For the leak experienced, the pressurizer level soon started to increase instead of stabilizing or continuing to decrease as the system depressurized.
The reason for this difference from predicted behavior is straightforward.
A loss of reactor coolant at the top of the pressurizer will produce an increasing pressurizer level response whether the coolant loss is due to a a
j pipe leak or rupture, or a failed open safety or relief valve. A similar loss of reactor coolant from a leak or rupture in a hot or cold lege pipe will produce a decreasing pressurizer level response. The symptoms identified in the emergency procedure are those corresponding to a hot leg or cold leg l
pipe leak or rupture. These symptoms were not observed during the first two hours of the accident at TMI-2 becaese the loss of reactor coolant was at the top of the pressurizer.
At this point it should be questioned why the operator would consider l
further the applicability of this procedure when the observed symptoms directly match those of a failed open code safety vlave (or a failed open PORY which remains undetected) and do not match those of a LOCA. The only significant indicator of a LOCA was the decreasing reactor coolant pre ssure. The pressurizer level did not behave as predicted and the primary containment response was noticeably delayed. The observed 6
..e e
._-.--.-,,e-,-
,.v,_=,,_,_e,-,-.,.-.
,w
..., L. s.
_. _.._...........~._._. _ _... __. s u..a 1
.,....s
.. u......s
............... ~
I i
~!
-6 h.
.(
i
)
elevation of safety and relief valve discharge pipe temperature and the f
elevated reactor coolant drain tank conditions were not mentioned in the procedure and are not indicative of a pipe leak or rupture LOCA l
condition, j
From the viewpoint of adequacy, this pmcedure appears to be t
i acceptable fbr hot and cold leg pipe leaks or ruptures, but it may be
.f.
confusing to apply for a loss of reactor coolant at the top of the pressurizer. For this case, the operator would have to ignore the
~
conflicting pressurizer level observations and concentrate en reactor i
j coolant system pressure as the controlling indicator when electing which part of the procedure to use. Guidance concerning the passibility of an increasing pressurizer level with decreasing system pressure is not i
provided in the procedure.
I i
Concl usions The early symptoms of the m!-2 accident were those associated with a failed open code safety valve (or a failed open p0RV with a defective i
I position indication). The emergency procedure for a failed open code safety valve is 2202-1.5 (pressurizar System Failure). This procedure l
s calls for operator actions which closely approximata those perforud by
(
the.TMI-2 operators during the first two hours of the accident. Unfortunately, this procedure specifies pressurizer level control which is not an acceptable response to' this loss of reactor coolant situation. This procedure was, therefore, unacceptable foi the NI-2 accident case.
e E
~
?
w.
3-.._..
- .u.
1
,. 3....
i 1
7
.(.
Guergency Procedure 2202-1.3 (Loss of Reactor Coolant / Reactor Coolant i
System Pressure) is not directly applicable to the case of a loss of reactor 1
coolant at the top of the pressurizer. This precedure appears to be based on the reactor coolant system response to a hot or cold leg break. It contains no guidance concerning the unique response of a leak or rupture at the top of the pressurizer.
Its use may cause operator confusion whenever j
the observed pressurizer level is increasing duribg an emergency because the q
procedure indicates only a decreasing level. This procedure was, therefore, i
not adequate for the TMI-2 accident case. In addition, it was not the correct precedure to l' allow in view of the observed s.ymptoms, f
i s
j * '..
t i
i k
4 h
,.