ML20030A229
| ML20030A229 | |
| Person / Time | |
|---|---|
| Site: | Crane  |
| Issue date: | 11/02/1979 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML19250C213 | List: |
| References | |
| NUDOCS 7911230023 | |
| Download: ML20030A229 (37) | |
Text
. --.
o-1 SAFETY EVALUATION REPORT...-.:+':
THREE MILE ISLAND UNIT 1 OVERPRESSURE MITIGATING SYSTEM TAC 6708 OCTOBER 1979 PREPARED BY i
a PLANT SYST915 BRANCH DIVISION OF OPERATING REACTORS O
e
?
3 7
e
.1 1
i L.
r, d o,;AD
,m_
y_
z 9
^
s-
~'
~ ~ ~
SAFETY EVALUATIO!; REPORT
- ~
__i.Oi1NTRODUCTION:
W
"~
a c By letter dated August 11, 1976, we raquested Metropolitan Edison Company (MEC) to analyze the Three Mile Island Nuclear Plant Unit 1 (TMI-1) for potential causes of overpressure transients at low RCS temperatures, and to design and install plant systems to --
mitigate. the consequences of these events.
Le also requested that operating procedures be examined and administrative controls be implemented to guard against initiating overpressure transients at RCS temperatures below the Nil Ductility Transition Temperature (NDTT).
The electrical, instrumentation, and control system aspects of the MEC proposal have been reviewed.
Discussed are the events which are most likely to cause overpressure conditions at low temperatures, precautionary measures taken at TMI-1 to minimize the occurrence of these events, and a description 'of the system designed to respond to an overpressure transient should it occur.
A safety evaluation follows.
2.0 EVALUATI3N The enclosed Technical Evaluation Report was prepared for us' by EG&G Idaho, Inc., as part of our D0R technical assistance program.
3.0 SYSTEM DESCRIPTION The design of the Three Mile Island, Unit 1 reactor differs from that of Westinghouse designed reactors in that the TMI-l RCS is never operated in a water solid condition.
The B&W designed system is operated at all times with either a steam or nitrogen bubble in the pressurizer.
This bubble prevents a rapid overpressure transient from occurring in the RCS. The events which could potentially cause a reactor vessel low temperature overpressurization have been analyzed.
With the initial RCS conditions at NDTT and a pressure of 275 psig, the analysis has determined the time required for a pressure transient to reach 550 psig (required pressure relief setting) after initiation, varies between 3.9 and 46.6 minutes, depending on the pressure transient Only a pressure transient caused by the actuation of a high source.
pressure iniection (HPI) train will reach the required pressure relief setting in ten minutes or less.
The Three Mile Island, Unit 1 plant has a single existing pilot actuated relief valve (PARV), located on the pressurizer.
The decay heat removal system can not provide any additional relief protection from overpressure transients since it is isolated from the RCS when the pressure exceeds-400 psig.
.w~
s
_2_
7 The' low temperature overpressure mitigating system is a modification of the actuation circuit for the existing PARV and provides alternate pressure relief setpoints. ^.The high pressure setpoint is 2255 psig for reactor operation and the low temperature pressure setpoint is 485 psig which is lower than 550 psig when the NDTT limit is reached.
This gives some allowance for the operator to serve as backup.
A nanually operated switch is provided to change the PARV setpoint.
- ~
Control power is provided from a 125V DC battery supply.
The system is also testable.
An alarm is actuated when the RCS temperature is below 2750F and the PARV setpoint control switch is not in the low-range position or when the PARV isolation valve is closed.
Alarms and indication provided to indicate the PARV has operated include the PARV indication lights, the PARV operation alarm, and the PARV discharge line high temperature alarm.
In addition to the above design features, the licensee has agreed to implement the following NRC recommended changes:
(1) Pressure alarms should be installed to give the operator direct indication that a low temperature pressure transient is in progress and that the RCS pressore is on a trend to exceeding the 485 psig setpoint.
(2' The RCS pressure and temperature should be continuously recorded to provide a permanent record of all low temper-ature pressure transients.
_(3) HPI valves MU-V15A/B/C/D should be alarmed in the control room when not. closed and the RC3 temperature is less than 2750F.
4.0 CONCLUSTONS The_ Metropolitan Edison Company's proposal for a low temperature over-pressure mitigation system for the Three Mile Island, Unit 1 does not meet the intent of the NRC criteria in the areas of electrical, instrumentation, and controls.
It fails to meet the criteria on the basis that (a) operator action will be required within ten minutes after detection of one specific transient, (b) the system does not have redundant channels and may be susceptable to a single failure, and (c) the system does not satisfy the IEEE Std-279 and seismic requirements.
e
~
3-Although the TMI-l plant does not comply with the original staff criteria, the e are other factors which should be considered.
The staff criteria for an OMS were originated for plants that are operated with the RCS in a water solid condition during cooldown and startup.
With a water solic condition, a transient can cause an overpressurization of the vessel within seconds of initiation.
This step transient makes it impossible for an operator'to detect a transient and act in time to 7
r-prevent overpressurization.
The B&W designed plant never operates with a water solid condition.
A steam or nitrogen bubble is maintained in the reactor pressurizer at all times.
Of the 44 overpressure transients to date, there has only Leen one low temperature overpressyre transient at B&W designed plants.
In order that the Ti1I-l OMS be found acceptable in the areas of EI&C, the licensee will be required to implement the additional changes described '
in Section 3.0 prior to startup.
e 9
i e
e e
e I
-w
. -. =
-,a
,,w.,n
..,r.,n..
.,..a-.,
0872F j
.l J
TECHNICAL EVALUATION ELECTRICAL, INSTRUMENTATION, AND CONTROL ASPECTS LOW TEMPERATURE OVERPRESSURE MITIGATING SYSTEM FOR THREE MILE ISLAND, UNIT 1 50-289 i
A. C. Udy EG&G Idaho, Inc.
l i
l TAC 6708 m--______
j s
CONTENTS 1.
l
1.0 INTRODUCTION
. ~.
- 2.0 DESIGN BASIS EVENTS (DBE) 1 3.0 PROCEDURAL PRECAUTIONS.
3 3.1 Description.
4-
-3.2 Evaluation 5
4.0 OVERPRESSURE MITIGATING SYSTEM (OMS) 5
4.1 System Description
.- 5 4.2 Design Compliance 7'
5.0 TECHNICAL SPECIFICATIONS.
9
6.0 CONCLUSION
S 11
7.0 REFERENCES
12 ee 4
Q 1
5 0
5 L
e h
e e 11 i
,.. -,~..
..r..,..
r.
TECHNICAL EVALUATION y;
ELECTRICAL, INSTRUMENTATION, AND CONTROL ASPECTS LOW TEMPERATURE OVERPRESSURE MITIGATING SYSTEM-FOR THREE MILE ISLAND, UNIT 1
1.0 INTRODUCTION
By letter dated August 11, 1976 (Reference 8), the NRC requested Metropolitan-Edison Company (MEC) to analyze the Three Mile Island Nuclear Plant, Unit 1 (TMI-1) for causes of pressure transients at low pressure, and to design and install plant systems to mitigate the con-sequences of these events.
It was also requested that operating pro-cedures be examined and administrative controls be implemented to guard against initiating overpressure events at temperatures below the Nil Ductility Transition Temperature (NDTT).
By letter dated October 15, 1976 (Reference 1), MEC submitted to the NRC a plant specific analysis.
The NRC questioned portions of this analysis in a letter dated December 9, 1976 (Reference 9).
In respond-ing, the.MEC, in a letter dated March 22, 1977 (Reference 2), revised i
their analysis and answered the NRC questions. This prompted design changes documented in References 3, 4, 5, and 6).
The el*ectrical, instrumentation, and control system aspects of the MEC proposal hav'e been reviewed in this report.
Section 2 di'scusses the events which are most likely to cause overpressure conditions at low temperatures; Section 3 describes precautionary measures taken at TMI-l to minimize occurence of these events; and Section 4 describes the system designed to respond to an overpressurizing event should it occur.
2.0 DESIGN BASIS EVENTS (DBE)
MEC analyzed seven postulat'ed events in References 1 and 2.
Of these events, four were found capable of creating an overpressure event.
The events are:
1
^
__. _ (1)
Erroneous Action of a HP1 Train.- An inadvertent actuation of a single' train of high pressure.injec-tion (HPI) pumps:would require action of the. pilot-actuated relief valve (PARV) between 3.9 and 4.9 ainutes wi.h an initial pressure of 275 psig und a pressurizer level at 260 and 220 inches,
-$t-respectively. At lower initial pressures, the times are longer. MEC does not consider this event credible because of procedural requirements on as startup and cooldown that require the circuit breakers for the HPI motor-operated valves to be racked-out when the Reactor Coolant System (RCS) temperature is less than 250 F.
(2)- Makeup control valve (Makeup to the RCS) Fails Full' Open.- The time from initiation of the over-pressure transient to required action of the PARV at 550 psig varies between 10.1 and 12.1 minutes (the analysis shows that the makeup tank will be empty at 12.1 minutes) with an initial pressure of 275 psig and the initial-pressurizer level at 260 and 220 inches, respectively.
This transient occurs when one makeup pump is running and the makeup control valve (which is automatically controlled by the pressurizer level controller)-fails in a full-open position.
The operator can identify this event before the re-quired PARV action by a combination of pressurizer high level alarms, makeup line flow rate indicator, low makeup pump discharge pressure, makeup control valve foll-open indicating light, and high RCS pressure indication.
(3) All Pressurizer Heaters Erroneously Energized -
The time from initiation of the overpressure 2
W --
- m--.
m
.-m.
- ...-..... 1 m..
tronaient to rsquirsd ccticn of-th2 PARV io
~ ~ '
46.6 minutes with an initial pressure of 275 psig
~
at a. pressurizer level of 90 inches (resulting in the fastest rate of pressure increase).
The pres-surizer level is normally under automatic control,-
therefore, the automatic low-level heater cutoff
/*- :
l#
cannot be credited with the capability of ending the pressure transient.
The operator. can identify this event before the required PARV action by a combination of RCS pres-sure indication, higher-than normal letdown flow rate indication (to the makeup tank), higher-than-normal makeup flow rate indication, and the pres-surizer heater bank "On" lights.
(4) Loss of Decay Heat Removal System Capability -
This event could be caused by loss of flow in either the decay heat-removal system (DHRS) or in the cooli'ng water system serving the DRRS, either of which would actuate low-flow ~ alarms.
The time from the initiation of the overpressure transient to required action of the PARV is 28.2 minutes for an initial pressure of 275 psig and an initial pressuriser level of 260' inches.
By a combination of RCS pressure indicators and low-fl ow alarms, mentioned above, the operator is made aware of this event.
3.0 PROCEDURAL PRECAUTIONS The staff position with regard to the inadvertent operation of components capable of causing a low temperature overpressurization during cold shutdown and startup requires the deenergization and 3
^
eithat lockcut or alcrming of equipment capeble of causing tha ovsrprss-surization, and equipment not necessary for. shutdovn and-startup.
~
3.1 Description The TMI-l procedural steps requiring the. removal of equipment f rom operation or the racking-out of pump and valve.cir-c cuit breakers are performed by precedure steps that require initialling -
to indicate that satisfactory completion (Reference 2, Appendix A).
Critical steps perfermed under administrative, control are included.
The MEC TMI-l plant has the following procedural precautions to prevent DPEs during cold shutdown and startup.
(1)
Erroneous action of a HPI train - The circuit breakers for the four normally-closed HPI motor-operated valves are racked out with the valves closed during plant cooldown and prior to startup of the DHR system.
This is accomplished by opening the breaker and tagging their associated selector switches in the Control Room and by racking out and tagging the valve circuit breakers at the Motor Control Center.
The operator has indication that power has been removed as the status lights in the Control Room will be off. These circuit breakers-are not racked-in again until startup when RCS temperature is above 250 F.
l (2) All pressurizer heaters erroneously energized -
As part of the TMI-l cooldown procedure, the pressurizer heater banks are placed in the off i
position during cooldown to prevent erroneous ener-t gizing of the heaters.
This function is performed i
by the operator from the Control Room.
He a ter "on
indicator lights in the Control Room provide the operator reatus of the heate > when energized.
i 4
i l
I
3.2 Evaluation The TMI-l procedural precautions are in agreement vith the stait position except that the circuit breakers supplying'the - - -
==-
pressurizer heaters should be opened, locked-out and tagged when not in use and the RCS temperature is below the NDTT IL=it.
4.0 OVERPRESSURE MITIGATING SYSTEM (OMS) 4.1 System Description The design of the Three Mile Island,. M I.
Unit I reactor differs from those of Westinghouse design in that the RCS is never in a water solid state.
The B&W designed system is oper-ated at all tLses with either a steam or nitrogen bubble in the pres-surizer.
This, bubble prevents a rapid overpressure transient from occurring in the RCS.
References 1 and 2 has analyzed the events which could potentially cause a reactor vessel low temperature overpressur-ization. With the initial RCS cenditions at NDTT and a pressure of 275 psig, the analysis has determined the time required for a pressure transient to reach 550 psig (required relief setting) after initiation varies-between 3.9 and 46.6 minutes, depending on the transient Only a pressure transient caused by the actuation of a RPI source.
train will reach the required relief setting in ten minutes or less.
The Three Mile Island, Unit 1 plant has a single existing pilot actuated relief valve (PARV) located on the pressurizer.
The decay heat removal system can provide no additional relief protection from overpressure transients since it is isolated from the RCS when the RCS pressure exceeds 400 psig.
Therefore, MEC proposes two separate methods for low temperature verpressure protection.
They are:
Operator Action - Since the operation of the RCS with a steam or nitrogen bubble in the pressurizer provides a minimum 3.9 minutes from the initiation of the transient until overpressurization, MEC has proposed that operator action should be credited as a redundant action to the autesatic pressure relief system (dual setpoint PARV).
5 D
Th; op;rrtor cetion nacasscry to pr;vant v2ss al ov;r-pressurization is to determine the cause of the transient and to deenergize or control the responsible equipment before the RCS presssure reaches the PARV setpcint.
Alar =s and indications which give direct indication that a transient is in progress include pressurizer level alarms, RCS pressure indication and pressurizer level r__
indication.
The operator also has other system indi-cators and alarms to indicate that the systems and equipment as described in Section 2.0 are in abnormal condition.s.
Dual Setpoint PARV - The automatic low temperature overpressure protection system is a modification of the actuation circuit for the existing PARV to provide alter-nate relief setpoints.
The high pressure setpoint is 2255 psig for reactor operation and the low temperature pressure setpoint chosen by MEC is 485 psig (Reference 6) which is lower than 550 psig when the NDTT limit is reached.
This gives some allowance for the operator to sarve as backup.
A manually operated switch is provided to change the PARV setpoint.
Control power is provided from a 125 VDC battery supply.
The system is testable.
An alarm is actuated when the RCS temperature is below 275 F and the PARV setpoint control switch is not in low-range position or when the PARV isolation valve is closed.
Alarms and indication provided to indicate that the PARV has operated include the PARV indication lights, the PARV operation alarm, and the PARV discharge line high temperature alarm.
There is no alarm indicating the
. failure of the PARV to operate at 485 psig.
6
~
~ ~ 4.2 Design Compliance On November 11, 1977, the h'RC granted approval to MEC f or their low temperature overpressurization protection
- =:
for all postulated transients with the exception of an inadvertent initiation of safety injection by the high pressure injection (HPI) train (Reference 10).
The OMS, as it is designed to respond to HPI transients, is evaluated relative to the following staff requirements:
(1) Operator Action "No credit can be taken for operator action until ten minutes after the opera-tor is aware, through an alarm, that a pressure transient is in progress."
The TMI-l proposal does not meet the staff require-ments as the methods for overpressure mitigation are operator action and the PARV system.
The PARV is designed to respond to HPI transients, but the operator can't be given credit for backup response.
During a HPI caused transient the operator must detect the transient and act to prevent everpres-surization within 3.9 minutes after the transient has been initiated.
There is no alarm that a pres-sure transient is in progress.
l (2)
Seismic and IEEE 279 Criteria - " Ideally, the system should meet Seismic Category I and IEEE 279 criteria.
The basic objective is that the system should not be vulnerable to a ce= son failure tha.t would both initiate a pressure transient and dis-able the overpressure mitigation system.
Such events as the lors of instru=ent air and the loss of offsite power must be considered."
The TMI-l OMS does not comply with the IEEE 279 and Seismic criteria.
7
The original intent of the NRC staff was that at 2
least two independent automatic low pressure pro-tection channels should make up the OMS.
A channel should include separate sensors, alarms, power trains, and relief valves.
Each channel should have complete electrical and physical independence from each other to prevent ce= son mode failures.
The OMS should be operable upon loss of offsite power.
In addition, each OMS channel should not be susceptable to seismic events that could cause a transient and fail the channel at the same time.
MEC has proposed to utilise only one automatic low pressure protection channel for TMI-1, with the use of operator action as a second method of overpres-sure protection.
The single channel utili es a seismic qualified PARV with the control power pro-vided by a 125 VDC power train.
No information has been provided by MEC concerning the electrical and physical independence between the control and power systems for the transient initiating devices and the PARV channel.
(3)
Single Failure "The system must be designed to relieve the pressure transient given a single fail-ure in addition to the failure that initiated the pressure transient.
The TMI-1 design has only one low temperature over-pressure protection channel.
There is no channel redundancy.
It does not comply with the NRC criterion.
(4) Testability "The system shall include provis-ions for testing on a schedule consistent with the 8
' frequency that the system is relied upon for pres-sure protection.'?
i The single TMI-1 PARV system is designed to allow testing of the system prior to its use.
The licensee was also required to provide alarms to alert the operator to (a) manually enable the pressure protection system during cooldown, (b) indicate closure of a PARV isolation valve, and (c) indi-cate the occurrence of a pressure transient.
The licensee design provides an alarm to indicate to the operator that the PARV must be enabled or that the PARV isolation valve is closed. This meets. the staf f requirements.
There is no direct pressure alarm to indicate that a transient is in progress.
Since the TMI-l proposal depends on operator action as-the pri=ary method to mitigate an overpressurization, the PARV operate alarm does not meet the staf f requirements.
5.0 TECHNICAL SPECIFICATIONS It is the staff position that, when administrative controls are used to limit overpressurization scenarios, that administrative con-trols shall' appear in the Technical Specifications as Limiting Condi-tions for Operation.
Therefore, it'is recemmended that the licensee be required to submit Technical Specification changes into the Three Mile Island, Unit I license consistent with the following:
(1)
A.., operation or failure of the PARV to operate to relieve pressure transients must be reported to the NRC.
(2) The CMS and alarms must be operable (in operation) when the RCS temperature is below 275 F.
If these conditions are not met, the primary system 9
)
5 must be depressurized and vented to the acnosphere within eight hours.
The PARV system may be removed' from service for a short period of' time.if all (RC) makeup pumps are out of service.
b-(3)
The four HPI motor-operated valves must be closed and the supplying circuit breakers opened, racked out, and tagged when the temperature is below 275 F and.the reactor coolant is not vented to the atmosphere.
(4)
The pressurizer water level will be maintained below 220 inches when the reactor coolant tempera-ture is below 275 F and the reactor vessel is not vented to the atmosphere.
(5) The low temperature overpressure protection system (dual setpoint PARV) and the low temperature over-pressure alarms must be tested on a periodic basis consistent with the need for its use.
A system functional test and a setpoint verification test shall be performed prior to enabling the overpres-sure protection system during ecoldown and start-up.
The system shall be calibrated and the PARV operationally-tested at refueling intervals.
(6) When the RCS temperature is below 275 F, the operation of makeup water to the pressurizer shall be manually controlled.
(See 4 above.).
(7)
The pressurizer heater banks will be deenergized and the breakers locked out and tagged when not required during cooldown and startup.
10
e 6.0 CONCLUSIO _NS~
=
The licensee should submit Technical Specifications to comply with u-.
the requirements listed in Section 5.0.
The Metropolitan Edison Compcny's proposal for a low temperature.
overpressure mitigation system for the Three Mile Island, Unit 1 does not meet the intent of the NRC criteria in regards to electrical, -in-strumentation, and controls.
It does not meet the criteria on the basis that (a) operator action will be required within ten minutes after detection of the transient, (b) the system does not have redun-dant channels and will be susceptable to a single f ailure, and (c) the system does not' meet the IEEE 279 and seismic requirements.
It does-not have redundant channels that are electrically and physically _ separ-ated and may be susceptable to seismic or other events which could cause a transient and a co= mon f ailure of the single protection channel.
The single protection channel does have the required testability and an OMS enable switch alar = as required by the staff criteria.
One acceptable method for TMI-l to comply with the N'RC staff cri-teria would be - to install an identical, yet electrically and physically independent, protection channel.
Although the TMI-l plant does not comply with the original staff criteria, there are other f actors shich should be considered.
The staff criteria for an OMS was originated for plants that are operated with the RCS in a water solid condition during cooldown and startup.
With a water solid condition, a transient can cause an overpressuri-zation of the vessel within seconds of initiation.
This step transient makes it impossible for an operator to detect a transient and act in tLse to prevent overpressurization. The B&W designed plant never oper-ates with a water solid condition. A steam or nitrogen bubble is main-tained in the reactor pressurizer at all tbnes. This bubble does not allow step transients to occur.
Instead, transients occur as a ramp function with the RPI transient reaching the overpressurization point 11 4.
m
.m.
3.9 minutes or more af ter initiation and a_11 others (equiring overy ten e.inutes.
Dais delay ' allows the operator time to detect the tran-sient and take action to prevent the RCS pressure from reaching the PARV relief point.
There has been only one low' temperature overpres-
?
surization at the B&W designed plants.
5 If the MEC proposal is accepted, it is recommended that the fol-loving be required of the licensee:
(1) Pressure alarms should be installed to give the
)
operator direct indication that a low temperature press,ure transient is in progress ar.d that the RCS pressure has exceeded 485 psig.
(2)
The RCS pressure and te'eperature should be contin-uously recorded to provide a permanent record of all low temperature pressure transients.
t (3)
HPI valves MU-V16A/B/C/D should be alarmed in the control roc = when not closed and the RCS tempera-ture is less than 275 F.
7.0 REFERENCES
1.
R. C. Arnold, " Evaluation of Potential Vessel Overpressurization,"
October 15, 1976, Met-Ed letter GQL 1448.
2.
R. C. Arnold, " Evaluation of Potential Vessel Overpressurization,"
March 22, 1977, Met-Ed letter GQL 0332.
3.
R. C. Arnold, letter to R. W. Reid, NRC, April 6, 1977, Met-Ed letter GQL 0464.
4.
J. G. Herbein, "Overpressurization Protection Systems," January 13, 1978, Met-Ed letter GQL 0049.
12 7
p
,y, re,,
.,-_m-p
~,
.,.-g--
-r--.3--
- - - +
w
b l
5.
J. G. Herbein, "RCS Overpressurization," March 13, 1978, Met-Ed 2,
letter GQL 0426.
6.
J. G. Herbein, " Technical Specification Change Request No. 74,"
~
March 13, 1978, Met-Ed letter GQL 0395.
7.
" Staff Discussion of Fifteen Technical Issues listed in Attach-ment G, November 3, 1976-Memorandum from Director NRR to NRR staff," NUREG-0138, Nove=ber 1976.
8.
R. W. Reid, NRC letter to Met-Ed, Re: Reactor vessel overpresst.ri-zation in. pressurized water reactor facilities, August 11, 1976.
9.
R. W. Reid, NRC letter to Met-Ed, Re: Additional information to evaluate overpressure mitigating system, December 9, 1976.
10.
R. W. Reid, NRC letter to Met-Ed, Re: Preliminary review of over-pressure mitigating system, November 11, 1977.
5 13
_.____._____-.-._.__.-_.m_.__
_