Text

Responds Partially to FOIA Request for 11 Categories of Documents Re Atws.Documents Listed on App a Encl
	ML20054D351
Person / Time
Issue date:	03/15/1982
From:	Felton J; NRC OFFICE OF ADMINISTRATION (ADM)
To:	Earley A; HUNTON & WILLIAMS
Shared Package
ML19310B145	List: ML19310B144; ML20054D351; ML20054D352; ML20054D357;
References
	FOIA-82-107, RTR-NUREG-0460, RTR-NUREG-460 NUDOCS 8204220617
	Download: ML20054D351 (2)
	v • d • e

y PDtL-olis pmNco

'o, UNITED STATES E j 3.,g ' 'g NUCLEAR REGULATORY COMMISSION 3

WASHINGTON, D. C. 20555

\\fw ]y

~

o p

RECElygg g

March 15, 1982 k-MAR 19igggw

C

{

" E 4" 9

i, Anthony F. Earley, Jr., Esquire 4

Hunton & Williams 8) 707 East Main Street P.O. Box 1535 IN RESPONSE REFER Richmond, VA 23212 TO F01A-82-107

Dear Mr. Earley:

This is in reply to your letter dated February 23, 1982, in which you requested, pursuant to the Freedom of Information Act, documents and records concerning anticipated transients without scram (ATWS) as detailed in the eleven categories stated in your request.

In partial response to your request, copies of the documents listed on Appendix A hereto, are enclosed.

In view of the scope of your request we will require additional time to complete our search for documents which may be subject to your request.

We will communicate with you again when we have completed our search efforts.

Sinc'b ly, m

/ M. Felton, Director Division of Rules and Records Office of Administration

Enclosures:

As stated 8204220617 820315 PDR FOIA EARLEY82-107 PDR j

1 Re:

f01A-82-107 Appendix A 1.

July 30,1980 Report on the Browns Ferry 3 Partial failure to Scram Event on June - 28, 1980, S. D. Rubin-and G. Lanik (54 pages) 2.

September-1980 Report on the Interim Equipment and Procedures at Browns Ferry to Detect Water in the Scram Discharge Volume, George Lanik (40 pages) 3.

March 1981 NUREG-0785 Draft: Safety Concerns Associated with Pipe Breaks in the BWR Scram System, Stuart D. Rubin (47 pages)

4. '

August ll,1981 Routing and Transmittal Slip w/ Remarks To:

W. Minners and D. Pyatt, from: F. H. Rowsome w/ Attachment (3 pages) 5 February 26, 1982 Memorandum For: 11. S. Bassett, From: R. B.

Minogue,

Subject:

Corrected and Updated Research Chapter for 1981 NRC Annual Report w/ Attachment (55 pages) 4 J

a

(-

I... [h2.-

t RE?CRT CN THE BRCWNS FERRY 3 PARTIAL FAILURE TO SCRAM EVENT CN JUNE 23, 1980

~

by the CFFICE FCR ANALYSIS AND EVALUATICN CF OPERATICNAL DATA July 30, 1980 Prepared by: Stuart Rubin, Lead Secrge Lanik

/

I

/

/*,,),/'

N0i-:

inis report documents results of studies ccccletac to f,

date by the Cffice for Analysis and Evaluaticn of Ccera-tienal Data with regard :o a particular caerating event, gf1 /' /',fgi j

The findings and reccmmendaticns centained in this reccrt

p are provided in suppcrt of other engoing NRC activities Dp1 ccncerning this event. Since the studies are ensaing, the report is not necessarily final, and the findings and reccamendaticns co not represen: the ;csiticn er requirements of the respcnsible prcgrun office of the Nuclear Regula: cry C:nnissicn.

=

i',

r

,. r.

f PREFACE The findings, recomendations, and conclusions contained in this report are, for reasons of timeliness, based on infomation gathered through infomal channels between the Tennessee Valley Authority, the General Electric Ccepany, and the US NRC Headquarters and Regional of fices. To the extent possible, the infomation used in the report has been verified by cross checking with other scurces. The findings containec in this 2

rescrt, including the underlying causes of the partial scram failure which cccurred at 3rewns Ferry Unit No. 3 (SF-3) en June 29, 1980, relate east directly to the Browns Ferry reactor. However, similarities a:ncng boiling water reactor facilities leads us to believe that the fincings and rec-cmendatiens may be broadly and generically applied to most if not all coerating SWRs. To this end, we recemend that. a plant-by-plant review, not pcssible in this investigation, be undertaken by others, to assess the applicability of these findings and recernr.endations to'other SWRs and to i

provide analysis and evaluaticn of plant-unique design arcblems not un-covered in this investigation. Additicnally, the sccpe of cur investi-gatien and recemendations was intentionally limited so as to address only the specific, direct and underlying causes of the partial scram failure at SF-3. We have not, therefore, taken the broader view, as could be taken by those most directly involved in the ATWS issue. We do believe, hcwever, that seme of the information presented in the report can be useful to those involved in this impcrtant generic concern. Finally, this in-vestigatien was not able to pinpoint a single precise root cause(s) which led to the SF-3 partial scram failure event, beycnd to say it was caused by water in the scram discharge volume. Mcwever, we believe that, in totality, the varicus massible cause mechanisms discussed in this re; ort include the actual, albeit, indeterninacle ecct cause(s) cf the event.

As a footnote, the writers wish to ackncwledge the invaluable and timely infcmaticn provided by the SF-3 resident inscectors, James Chase and Rccert Sullivan, withcut whose cooceration, timely issuance cf this recort wculd not have been possible.

1 9

e

y TABLE OF CONTENTS Page i

.RE AC:................................................................

r r 1 INTRODUCTION........................................................

I 2 EVENT SEQUENCE......................................................

3

~

3 CESIGN AND GPERATION OF THE SROWNS FERRY UNIT 3 SCRAM SYSTEM........

5 4 CAUSES INVESTIGATED.................................................

11

~.,

5 EVENT SEQUENCE ANALYSIS.............................................

14 5 SCRAM OISCHARGE VOLUME / SCRAM INSTRUMENT VCLUME INSPECTIONS AND TESTS.........................................................

19 7 PREVICUS SWR EXPERIENCE OF FAILURE TO FULLY INSERT..................

23 3 FINDINGS............................................................

24 9

RECCWE'JCATIONS......................................................

35 "I

10 CONCLUSIONS....................................'.....................

40

_i

~.

LIST OF FIGURES Ficure 2-1 Control Red Posi tions Before First Manual Scram...................

43 2-2 Centrol Red Positions After First Scram...........................

44 2-3 Centrol Red Positicns After Second Scram..........................

45 2-4 Control Red Position After Third Scram............................

46 3-1 Centrol Red Drive.................................................

47 3-2 Scram Electrical Diagram..........................................

48 3-3 Centrol Red Scram Grcup Assignment................................

49 34 Scram Valve Arrangement...........................................

50 l

3-5 Scr am Vo l ume Crai n Arr angement....................................

51 l

\\

l LIST CF TABLES __

Table 2-1 Event Sequence Recceder Printcut..................................

41 5-1 Scram Discharge Volume Grain Time and Total Posi-icns 'nserted....

52 ii

(

1 i

1 INTR 000CTION On June 28, 1980, the Brcwns Ferry 3 reactor experienced a partial failure of the scram system, while shutting down for a seneduled maintenance of the feedwater system. The reacter had been brought down to approximately 35%

power by reducing recirculation ficw and by manual insertion of control rods. The subject event occurred when the centrol rocm cperator initiated a manual scram to make the reacter subcritical which was the next step in the normal shutdown evolution. After manual scram actuation, the centrol rods en the West side cf the core were observed to be fully inserted. Mcw-ever, the centrol rods en the East side of the core did not fully insert.

Mest of the East side reds came to rest in notch positiens ranging between 00 and 46 after all East side red motion had ended.

Three additional scrans and at: cut 14 minutes were required to achieve full insertion of the aartially withdrawn East side centrol rods..After all rods were ccm-oletely inserted, the cperatcrs resumed nomal shutdcwn ccerations.

On July 2,1980, a team of NRC Headquarters representatives frem IE, NRR, and AE00 went to the Browns Ferry site to gather detailed information on the event, the scram system design and operatien, and the results of scram system tests which already had been performed by T'/A personnel. With this initial direct centact at the plant, an independent investigation of the event cause and the reccmended corrective actions was begun by the Office for Analysis and Evaluation of Cperational Data (AE00). Over the next several days, additional equipment testing was performed on the SF-3 scram system. Testing and analysis was also being conducted during this time by General Electric in San Jose, California to succort T'lA activities at :he plant. During this :ericd, AE00 centinued to obtain, analyte, and evaluate information as it evolved from these and other scurces to continue its investigatien.

The :ur;ose of this recort is to provice the analysis, evaluaticn, findings, 1

l.

r

.-r

s and reccamendations which ficwed frcm the investigation of the SF-3 event by the AE00, US NRC. Section 2 of the report contains an event sequence.

Section 3 provides a description of tne design and coeraticn of the SF-3 scram system. Section 4 discusses the passible causes of the event which were investigated and the conclusions in each case. Section 5 provides an event sequence analysis. Section 5 provides a summary of the tests and

~ ~ ~

inspecticns performed at SF-3 which support the event sequence analysis and scme of the findings. Previcus operating ex:erience and investigation findincs are contained in Secticns 7 and 8, respectively. Specific reccamendatiens to correct the deficiencies discussed in the ' findings are provided in Secticn 9.

The conclusions of this investigatien are given in

~

Section 10.

.w e

h b :-

2 EVENT SE00ENCE On June 29, 1980, power was being reduced by the centrol recm cperator at the 3rewns Ferry Unit 3 nuclear reactor in preparation for a scheduled shut-down for feedwater system maintenance. By 0131 hours0.00152 days 0.0364 hours 2.166005e-4 weeks 4.98455e-5 months , the reactor power had been brought to 390.We via decreased recirculation ficw and manual con-trol rod insertion. The operating personnel then initiated a manual reactor scram to complete insertion of the remaining centrol reds (which were at

].

the pcsitions shcwn in Figure 2-1 at the time) and thereby bring the reactor, ~

to a subcritical state.

7 Irrmdictely after depressing the manual scram buttens, the operators placed the reacter mode switch in the SHUTCOWN mode. C:ntrol recm personnel ob-I served that the blue scram lights for all centr,ol red drive scram inlet and cutlet valves were illuminated, indicating that all scram valves were open.

Control red positicn indication also shewed that all of the reds en the West side of the core were fully inserted (except for cne which had stopped at position "02").

Mcwever, positicn indication shcwed that 75 rods en the East side of the core were not inserted fully. The East side control reds came to rest at positions ranging from 46 to CO withdrawn with an average of about 23 positions withdrawn (positicn 48 corresponds to fully withdrawn). Red position indications follcwing the first manual scram are shewn in Figure 2-2.

At this time 18 rods on the East side were fully inserted. As estimated by the LPRM readings, pcwer level en the East side of the core folicwing the first scram appeared to be less than two percent.

Folicwing scram, the Scram Instrument Volume began to ffil and the Scram In-strument Volume Hi Level Scram (level switenes) actuated. This cc:urred seme-wnat socner than expected at about 19 sec nds. The Hi Level scram conditicn was subsecuently bypassed by the ccerator (as allcwed in SHUTCCWN mece), to

ermit reactor protection system reset which oc:urred 4 minutes anc 31 sec;nds folicwing the first scram.

One minute and 33 seconds later a sec:nd manual scram,vas initiated by the __

e e

coerator. The time following reset allcwed partial drainage of the East and West Scram Discharge Volumes. Rod positiens follcwing the second scram are shown in Figure 2-3.

After this scram, 33 rods on the East side fully inserted. The seccnd manual scram was reset af ter 59 seconds and the scram discharge volume was allowed to drain for 53 seconds at which time a third manual scram was actuated. Upon ccmoletion of this scram, 47 reds on the East side were fully inserted. Red positions following the third manual 7' ',

scram are shcwn in Figure 2-4.

The third scram was reset after 3 minutes and 25 seconds. The scran discharge level bypass switch was returned to normal 2 minutes and 40 seccnds later. This acticn initiated a fourth, autcmatic scran due to a Scran Instrument Volume Hi Lavel scram ccncition which had not cleared. At this time all rods en the East side were fully inserted.

A detailed sequence of events as provided by th,e event sequence recorder is shown in Table 2-1 The total elapsed time between the initial scram and.

.+-

final insertion of all reds was 14 minutes 2 seccnds.'~At this time the

--~~T ccerators centinued ncrmal shutdown cperations.

t 0

e l

.1 y

3 DESIGN AND CpERATION CF THE 3RCWNS FERRY _. UNIT 3 SCRAM SYSTEM vechanical and Hydraulic Cesicn__of_the Scram System Cn a GE CWR, such as Browns Ferry Unit No. 3, the Control Red Drive (CRD) and its associated Hycraulic Centrol Unit (HC'J) provide the means by whicn each individual c:ntrol rod can be rapidly inserted upward into the core l

during a reactor scram. A simplified drawing cf the CR0 mechanism is shown T'}

in Figure 3-1.

During perieds of no red motien, the collet fingers are spring leaded into a grcove en the index tube to hold the drive stationary against the force of Hi h pressure cooling water is applied below the drive pist n and gravity.

S equalized without CAD motien via centrolled inle,akage past the CR0 seals and

.. e-into tne reactor. A CRD temperature prcce is provided internally to menitor each CRD to detect CR0 heat-up should cooling dater ficw te interrupted cr Q;

should excess leakage of high temperature RCS water ficw out thrcugh the drive, drive insert line and scram cutlet valve. Scram cutlet valve leakage into the scram discharge volume en the order of 0.1 cpm wculd raise the probe tercer-0 ature to the alan, setpoint of abcut 350 F.

At SF-3, water exhausted from the CRDs is rcuted to either an East er Wes.

header scram discharge volume. The scram discharge volume (SDV) is sized to provide a volume of approximately 3.3 gallens per CRD (a;:roximately 500 gallens total). The SDV volume is sized to limit the total amcunt of hot react r water leakage past the seals during a reactor scram (maximum volume requirement) while providing encugh free space at atmospneric pressure so that back pressure en the CRDs does not increase so rapidly as to imcede red insertien s eed (minimum volume requirement). In particular, the system design results in a pressure in the SDV immediately follcwing full insertien red acticns of less than ~5 ;sig.

Lcw pressure in the SOV is necessary ta assure hat technical specification scram speeds and full-in roc motien are achievec. The volume of nater exnaustad througn the scram cutlet valve of a single normal drive for a full s roke is about 0.75 gallens, not including seal leakage and bypass ficw. The leakage

4 and byoass ficw for a single dt ive can be in excess of S gallons per minute.

Nonnal scram time. from full cut to 90 percent insertion is'less than 3 seconds.

Although the 50V is sized for a volume of a::groximately 3.3 gallens ::er drive and.

the drive stroke (without bypass) is cnly approximately 0.75 gallons, enly a

=

~~

sinole reactor scram is normally possible with respect to the scram discharge, volume. Leakage of reactor water past the seals fills the 50V rapidly as icng

^ 7.

as the scram cutlet valves are open which wculd be the case withcut an RPS

.,,,[

reset. This leakage occurs even en rods that are fully inserted. The leakage is -

an average of 2 gpm to 3 gpm per CRD. Thus, frem this scurce alene, the 3.3 gallens per drive of free volume available in'the 50V is filled and pressurized

}

within two minutes. Thus, more than ene scram would be possible cnly if the operator were able to reset the scram (cicsing the scram outlet valves) well

, a.

within this time period. Withcut an early reset, the 50V would be filled and the 50V would have to be drained to atte: pt a rescram if red maticn is to be produced.

The East and West 50V headers are each provided with a vent line and vent valve.

Each header drains via a separate drain line into a scram instrument volume (SIV) wnere level menitoring instruments are located. The SIV, in turn, has drain piping and a drain valve.

During nonnal cperation, the vent valves of the East and West 50V headers and che drain valve of the SIV are cpen. These valves are kept cpen to allcw the leakage past the scram outlet valves entering the 50V to drain ecntinucusly into the SIV so that no build-up of water in the 50V occurs which could prevent a reactor scram. These valves close during ccntrol rod scram insertien to centain and limit the reactor water released througn the scram cutlet valves.

During a scram, inficw of water to tne 50V normally ccntinues after ccntrol rod insertien is ccrnoleted due to leakage past the CR0 seals. Leakage c::ntinues until the scram is rese: cr until the 50V pressure ecuilibrates with reactcr pressure. __

m

A pressure difference of at least 550 psi must be acolied between the CRD insert and withdraw lines to drive the rods in during a scram. The pressure difference applied at the beginning of a scram is provided by the 1500 psia

~

scram accumulator and atmospneric pressure in the empty 50V. As CR0 scram insertion progresses, pressure losses in the driving fluid due to line losses reduce the insert line pressure to belcw reactor ccolant system pressure.

]

At that time, the ball checx valve, integral to the CRD, allcws reactor ccolant system water to ccme in under the pisten to complete tne scram, before any

'Q significant build-up in scr:m discharge volume pressure due to filling fecm leakage and cypass flow.

RPS Electrical Desicn A simplified schematic of the electrical ccmpene'nts Of the Reacter Protecticn System (RPS) is shown in Figure 3-2.

It is di'vided into two independent trip channels A and 3.

Each of the channels can be tripped (de-energized) by either the manual scram relays or the two subchannel relays. The subchannel relays are de-energized and opened whenever any one of a variety of trip ccnditiens exist in the reactor or associated equipment. The autcmatic logic can be described as "cne-cut-of-two taken twice." For purposes of analysis of the Brcwns Ferry event, the autcmatic trip logic will not be discussed because 7

this event cccurred first with a manual scram.

With reference to Figure 3-2, both scram solenoid valves A and 3 must change positien to provide a scram. Electrically, this requires a trip of both channel A and channel 3.

De-energizing the two scram solenoids changes the air ficw fran the centrol air supply to the vent path. For manual scrams, a separate scrsn tutten is proviced en the centrol panel for each cnannel. A manual scram is initiated by decressing both the channel A scru but:cn and the cnannel 3 scram butten. Because of the acwer requirements cf 135 separate scram solenoid valves en each channel, eacn channel is divided electrically into

secarate scram grcups. Centrol reds associated with the HC'Js frcm the fcur grcu;s are distributed randcoly thrcugncut the cire as shown in Figure 3-3. :

p Scram Oceratien The Reacter Protecticn System performs its design functicn by de-energizing the 370 scram solenoid air supply valves (2 for each centrol red drive HC'J),

de-energi:ing the two scram discharge volume (50V) air supply solenoid valves, 4

and energi:ing the fcur backup scram solenoid valves in the air supply lines,

~~_

as shcwn in Figure 3-4

^ 7.

Scram insertien is achieved for each individual centrol red by opening the "7

scram inlet and scram cutlet valves. This applie; 1500 psi accuculater pressure to the " insert" side of the centrol red drive ;ilsten and vents the " withdraw"

~

side of the pisten to the 50V which is at atmospheric pressure.

For normal unscrammed conditions, the scram in1,et and cutlet valves are held shut by control air pressure applied thrcugh the energized scrm air supply valves (539A and 5398 in Figure 3-4).

The 50V vent anc SIV drain valves are held open by air pressure applied through the energized discharge volume air supply valves (537A and S373). The air header which suppiles control air to all of the 372 air supply valves (370 scram, 2 vent / drain) is pressurized through de-energized backup scram valves (535A and $353, S70A and 5708). The 50V vent and SIV drain valves can ::e cpersted manually from the centrol rocm.

A scram signal de-energi:es both air supply valves for each rod, de-energi:es the scram discharge volume air supply valves, and energi:es the back-up scram valves, thus venting air pressure from the scram inlet and cutlet valves and the SDV and SIV valves. This causes the scram valves to ccen anc the 50V vent and SIV drain valves to close. In the event the individual centrol red air supply valves shculd f ail to change positicn (i.e., mechanical bind-up, etc.),

the back-up scram valves which nere energi:ed and ventad air to depressuri:e the air sucply header assure ocening of the scram valves. Thus, even if an air supply valve failed to shift, tnat red would still scrm. A cneck valve is provided arcund the acwnstream bac'<-up scram valve in the air sucoly line so the upstream valve can assist in tne air header venting or assume venting in case the ecwnstream valve fails.

3

,r e.-

Physical layout of the Scram System Hydraulic Comcenents at 3rewns Ferry Unit 3 At Browns Ferry Unit No. 3, the HCUs for all of the CR0s are physically arranged in rows on the " East" and " West" sides of the reactor vessel, cutsice the drynell and inside the reactor building. The CR0s on the West side of the core are controlled by the West side HCUs and the CR0s on the East side of the core are controlled by the East side HCUs. Urives along the interface centerline, T]

between the East and West sides of the core, are alternately rcuted to the Eas:

and West headers. A simplified diagram of tne physical arrangement of the HCUs, scram discharge volume, and vent and drain system is shcwn in Figure 3-5.

TFe HCus en each side of the reactor are arranged in 4 rcws.

mediately abcve tPe a rews of HCUs are two cross connected " race tirack* shaced headers f abri-w cated with 5" piping inte which the discharge from each scram cutlet valve is

~

oiped. The two connected 6" headers en the East side cciprise the East bank 7

scram discharge volume (SDV) and the two connected 6" headers en the West side comprise the West bank scram discharge volume. Eacn HCU inser and withdraw line is connected to the' CR0s below the reactor vessel with 3/4" Schedule 80 piping through which the scram inlet and scram outlet water ficws (and water for normal red drive motion). These lines average over 50 feet in length.

The lines fran the HCU scram cutlet valve to the SDV are f abricated with 3/4" Schedule 80 piping and are approximately 10' in length.

The Scram Instrument Volume (SIV) is located en the West side of the reactor at ene end of tne West side HCus (and 50V). It is configured as a 12" diameter 10' hign vertical cylinder. Single float-type level switenes are installed to

enitor the 3 gallen and 25 gallen levels. Fcur float-type level switenes are provided at the 50 gallen level for the :ur:csa of initiating a reactor scran (SIY Mi Level Scram) before the SCV tegins to fill beycnd tne poin:.nere complete control rod insertion would be prevented.

At 3rowns Ferry Unit 3, the East bank and West bank SUV each drain via 2" schedule 150 pipe to a single SIV located cn the West sica. The crain line for ne Wes: bank is acproximately 15' icng antle that fran tne East bank is approximately 150' long.

In each run, the total elevaticn f all in the Tine 9

m 4

is approximately l' 7".

On the East bank n2n this is an average 0.13" fall per fcot of horizcntal run.

The drain line piping at the bottem of the scram instrument volume and the vent line piping at the high points of the slightly inclined East bank and West bank 50V headers are routed dcwn to the Clean Radwaste Orain (CRW) piping physically

T}

located in the reactor building flocr. The CRW system is a closed drain system, wnich discharges undenvater in the Raactor Building Equipment Orain Sump at the icwest elevatien in the reactor building. Many other equi;ments are drained

]

and vented by this system.

s 4>

e e

e r,

I i.

4 CAUSES INVESTIGATED Ictnediately folfcwing the event at Browns Ferry 3, all aspects of the scram system were investigated in an effort to find the cause. The Reactor Pro-tection System (RPS), the air system, mechanical aspects of the CR0 and varicus valves, the CR0 and HCU hydraulics, and the possibility of air in the hydraulic system were considered. Finally, attention was focused en 7

the East bank Scram Discharge 'lolume.

r Electrical Investicatiens Folicwing the first manual scram, the operaters verified that the blue scram lignts were illuminated fer all centrol rods. Both the scram inlet snd the outlet valve stem positicn switches must shcw an Open valve position to illuminate these lights. Illumination of these lights for all CRDs would indicate that the electrical portien of the RPS'had successfully generated a scram signal to coen all scram solenoid varves and that all scram valses 4

had actually opened for all control reds.

The Reactor Manual Control System (RMCS) which is designed to control enly one control rod at a time was reviewed to determine if there could have been possible interference with the scram function. It was detennined that postulated gross failure of the RMCS and initiation of multiple control rod

,7 drive withdrawal signals would not prevent insertion during scram since upward scram forces are more than three times the magnitude of the with-drawal forces under these conditions.

By use of reference drawings, hydraulic centrol units frcm each of the four red scram grctos were verified to be randcmly osittened en both sides of the core as shcwn in Figure 3-3.

Centrol rod electrical signals to a grcup 1 red en the East side of the core and a grcup 1 red en the ' dest side of the c re would be identical. The red insertien pattern during the event shcws that on the East side a number of reds frem eacn electrical group did not c moletely insert while en the '4est side, reds from all electrical groups did : molgtely insert. q

=.

M 1

Based en this analysis it was concluded that the failure of reds to fully insert only on the East side was not caused by any electrical mal-functicn in the RPS trip logic.

TVA test (entitled SMI 150) was performed to verify that the response times for the scram actuating relays to fully de-energize were within technical s:ecifications. Verification that they were, eliminated the concern that

'Z%

an electrical problem delayed ccening of the East side scrm valves which in turn resulted in partial insertion.

'l A test of the voltage on all channel A and channel 3 scram gr ups shcwed that all went to zero folicwing a manual scram and all returned to 125 VAC when reset. This test was run to verify the recuirements of US NRC IE 4

w Bulletin 80-17. A visual and electrical search of the scr m circuitry

~

cabinetsforspuriousvoltagesourcesandicosewireslthatmighthave

~7 provided a path for electrical gewer) to prevent a dropout of the scram relays was perfomed by TVA. Ncne was found.

CR0 Tests Various tests were run en the CR0s en the East side to verify that CRD seal integrity, friction and scram times were within allcwable limits.

CAD seal integrity was measured via a stall test. Results of these tests did not indicate any unusual amcunt of ficw during stall conditions and, censequently, the CR0 seals were judged to be intact. Stall tests could also have provided a means of detecting scram cutlet valve leakage. Hcw-ever, this test das not done. Friction tests and single red scru tests also showed no ancmalies.

Ven-Cendensible Gas in the Hydraulic System The effects of air er nitrogen in the CR0 Hycraulic system aere c nsidered.

U;cn cuestiening, GE CRD experts stated that ncn-cendensible gas in the hydraulic system wculd Only cause pr:blems with normal insert and eithdraw moticns but would not cause Oreblems with scram inser:fon. This is because stapoing the rods requires intricate timing of r:d motien and latcning

. ~

A.

whereas scramming is a single motion. During a stepping functica any non-cendensible gas would undergo ccepressions and expansions much different from the behavicr of the ncn-cc=pressible ifcuid.

. The presence of nitrogen gas in the SOV prior to scram would be no different than the presence of air which is there routinely. Folicwing initiation

'?Pj.

of the scram, the vent valve closes sicwly enough to allow a gcod portion of the non-condensible gas in the SDV to be vented.

,...,' ~:

'A s

Se e v_

q-e W

6 ll 13 -

M

~5 E'IENT SEOUENCE ANALYSIS As discussed previcusly, the control rod drive HCU exhausts are partitiened into East and West bank scram discharge headers. Centrol Rod Drives which discharge into the East header are located on the East half of the core while CR0s which exhaust into the West headers are positicned en the West side of 7

the core.

The most notable observaticn of the centrol red positicns after the first manual scram was that all of the control rod drives exhausting into the West header inserted full-in (except for the CR0 at positten 30-23 which insarted to within ene notch of full-in) while the centrol rods exhausting into the East bank header inserted an average of cnly 20 positions. This CR0 insertion 4

pattern provides strong evidence that the fundariental cause* of the extensive failure-to-fully-insert of the CR0s en the East side of-the core was hydraulic in nature. More specifically, the rod pattern resulted frcrn an inability of the East header CR0s to exhaust prcperly for scme reason.

With respect to possible multiple scram outlet valve f ailures, all of' the East header scram discharge valves were cbserved by the centrol recm operators to have openeiupen manual scram actuation. Additionally, all of the manual

, ' ~

isolation valves en the scram discharge lines of the East header HCUs were inspected by the licensee imediately upcn shutdcwn, with each founc to be fully open. Accordingly, the remaining possible hydraulic causes cculd have been blockages in most of the CRD scram exhaust discharge lines or inadec;uate free volume (or high back pressure) in the East heacer SDV. Subsecuent scram testing of numer0us East header CR05 which failed to fully insert demcastrated, however, that no blockages existed in the CR0 exhaust lines. Excessively rapid buildup of back pressure in the East bank SCV, due t: multiple CR0 seal failures, cculd also be postulated as a mechanism nnich c uld innibit full-in centrol rod moticn. Hcwever, stall tests perfor ed cn the East tank CR0s,

'See Section a for a discussica of other pcssible causes investigated.

4 14 -

W e

together with individual rod and full core scram tests perfor:ed prior to restart, demonstrated that an excessively rapid increase in SUV back pressure resulting frem multiple CRD seal failures was not the cause of the partial scram failure. Accordingly, it was ccncluded that, for some reason, the East bank SDV had inadequate free volume available to accept the full scram discharge from all East bank CRDs exhausting into the East header. Thus, the cbserved East bank centrol rod insertien behavior can best be exclained on the basis that the East header SDV was at least cartially filled with water when the acerator manually scrammed the reactor, s

As discussed in Section 3, adequate free volume must be available in both the East and West headers to acccomcdate water exhausted during control rod scram insertien. Furthermore, water must be exhausted into the SDV with icw back pressure en the drive pisten to assure that technical specificaticn scram speeds are met. A reducticn in the free volume in the SOV could tend to in-crease back pressure en the drive pistens tco fast which could then increase the time required to cceplete scram insertien. Ccmplete red insertien wculd still be possible, however, even for signif'. cant reducticns in the available free volume in the SDV as de=cnstrated in iecent single CRD scram test simula-tiens performed by GE. The GE tests showed that for a 4C% cecrease in the available SOV, a centrol red can still fully insert over a broad range of seal leakage values. For a 70% reduction (i.e.,1.0 gal / drive remaining) in available scram discharge heacer free volume, the rods could still fully insert if seal leakage rates were small encugn. Fcr a recucticn in SUV cf this magnitude, hcwever, increasing seal leakage rates can cause the CR0 travel (nuster of positions inserted) to decrease. The tests shcw that drive travel decreases to cnly 26 cositions (cut of 18) wnen a 7C% reducticn is ceuoled with a seal leakage rate of 3.9 gpn. The GE tast cases run fer SS: recuction in free volume (.5 gal / drive remaining) shewed that even with no seal leakage, the drive <culd insert only 23 positicns and decreased to 22 pcsiticns fer 5.2 gpm and 18 positiens for 8.9 spm leakage. Finally, as ex:ected, the tests shewed that the CRDs wculd co insert at all if nere were no free volume in which to exhaust (0.0 gal /crive) regardless of seal leakage. Thus,

(- __

M e

s these tests clearly demonstrate that CRD travel during scram insertiens can be sharply reduced if the amount of available exhaust volume is reduced suffi-ciently.

Since the manual rescrams (scrams #2 and 3) occurred with East bank scram dis-charge volume almost full of water en eacn occasien, these later scrams can be used as models for back-checking the cause of the cbserved East bank centrol red insertien behavier during the first scram. That is, the fullness of the East cank SUV during the first scrm can be qualitatively ano secewhat quan-titatively inferred by ccmparing it.vith red motiens during the later scrams.

The available free volumes in the East bank 50V for each of the later scrams can be calculated by multiplying the drain times discussed in Secticn 2 by the East bank scram discharge volume drain rates discussed,in Secticn 6.

The arcunt of free volume which would have had to have been available during these later scrams can also be calculated frem the observed red motions during these scrams together with the GE test result:;. Ccmparing the volumes calculated both ways can then be used to shcw wnether or not the cbserved red moticns during each scram were censistent with the amcunt of discharge volume made available by the drains between scrams. Once these are shcwn to be censistent, cne can infer the limited accunt of free volume which must have been present in the East bank SOY during the first scram. The East bank drain times, total number of positicns inserted, and average number of positions inserted per red used in this analysis are shewn in Table 5-1.

The drain times between the first and seccnd manual scram was 93 seccnds and between the seccnd and third manual scrams the drain time was 53 seccnds.

Tests at 3rewns Ferry show that the nomal drain rate fcr the East SDV is accut 11.6 ;;m wnen East anc West scram cisenarse volumes are draining st=ultanecusly. Thus, by multiplying tnis nemal drain rate times the crain time between scrams', we can calculate aporoximately hcw uch nater cculd have drained out (free volume made available) of the East bank heacer during =

l

the periods between scrams. Multiplying, cne finds that accut 18 gallens would have been made available during the first drain (between scrams 1 and

2) for the seccnd scru wnile about 10.2 gallens wculd have been made avail-able during the seccnd drain (between scrams 2 and 3) fer the third scram.

On the other hand, frem the GE tests and the average red rotion given in Table 5-1 to a first approximation and assuming no CR0 seal leakage, an average of.18 gallons per drive was availacle for the seccnd scram nnile accut.07 gallons per drive was available en average fer the third scram.

Thus, fer 93 drives, to a first approximatien and given no seal leakage, a total of abcut 17 gallens of free volume was available in the East SDV for the second scram while accut 7 gallons was availacle for the third scram.

Hcwever, if every East bank CRD were assumed to.have a seal leakage of 5 spm,*

frem the GE test results the required volume per drive would have had to have been no more than abcut 20 percent mere than the above ' values. That is, about 20.5 gallons of free volume wculd have had to have been available during the seccnd scram and abcut 9 gallens for the third scram.

Ccmparing the results of the above calculations, it could be cencluded that the East 50V was draining normally between scrams ene and two, and two and three, and that the average red insertien during the seccnd and third scrams was the accunt which one wculd ex;:ect for the amcunt of volume made available by the drain. Thus, the insertien behavicr of the East bank centrol reds logically cculd be explained en the basis of a virtually filled SCV during the second and third scrams.

This same acercach can new be used to infer the cause of limited centrol roc cotten during the first manual scram. From Figures 2-2 and 2-3, the average centrol red insertien during the first scram was 20 ::csiciens. Frem this value de 4culd infer (using the GE test results) nat there was an average of enly.35 gallens per drive available (or acout 33 gallens total) in the i

i

<cnservative based en CR0 maintenance reccc=endaticns..

=

m

East scram volume during the first manual scram. This assumes no seal leakage. With a 5 gpm seal leakage, we wculd infer that cnly about.45 gallens per drive (or about 42 gallons total) had been available.

The above calculaticnal results show that the partial scram failure during the first scram can most easily be explained by having an initially partly filled East bank SOV. Similarly, the subsequent CR0 f ailures-to-fully-insert are explainable based on a partly filled scram discharge volume.

It shculd be pointed out, however, that there was c:nsicerable spread amcng the centrol rods in the nuccer of notches inserted after the first scram.

The variation from red-to-rod could be explained by CRO-to-CR0 differences in such parameters as seal leakage (which significantly effects number of notches inserted), control red drive friction, nitrogen accumulater pressures, etc.

Finally, evidence that the East bank scram discharge volume was initially partly filled with water can be fcund in the elapsed time :: activate the SIV Hi Level scram switches folicwing the first manual scram. Reacter scrams at SF-3 prior to the June 23, 1980 event resulted in time delays frca reactor scram actuation to SIV Hi Level scram actuatien ranging frcm 42 to 54 seccnds.

The first manual scram from the June 23 event had a delay of only 19 seconds.

Ecr a normally empty 50V and SIV, the time delay wculd represent the time it takes for water exhausted fran the CR0s to enter and tegin n fill the 50V, travel dcwn the SOV-to-SIV drain lines, and fill the SIV to the 50 gallen level.

If water were airtady in the East SOY, water exhausted fr::m the CRDs wculd almost imediateli start to push mater cut of the East 50V and in.o ne crain line. This wculd cause the SIV to fill more rapidly. Thus, an ela::sec time of only 19 sec nds to actuate the SIV Hi Level scram switches ::rovices icccrtant evidence that the East 50V was already almost ccepletely filled nitn water at the time of the first manual scrin. '

i

=

\\

e

6 SCRAN DISCHARGE VOLUME /SCRAN INSTRUMENT VOLUME INSPECTIONS AND TE5i5 Folicwing the partial scram f ailure event at BF-3, TVA, with the assittance of GE, emoarked en an extensive inspection and test prcgram. These inspections and tests were performed to try to pinpoint what caused substantial watsr to be present in the East bank scram discharge volume en June 23, 1980, while the scram instrument volume level switches were indicating both headers

}

were empty. The inspecticn program included pnysical examinatiens of the drain and vent piping, the scram discharge and instnment volumes, as well as the drain and vent valves. These inspections were performed in an attemot to determine if a vent or drain line bicckage had caused the Eas bank scrsa discharge volume to not drain properly. Additicnally, drain tests were per-formed on both the East and West headers to establish the drain characteristics of these ccepenents. The following paragraphs. summarize the results of these inspecticns and tests.

Inscections The 2* drain line between the East bank scram discharge volume and the scram instrument volume were checked for blockages. The drain piping was cut at several locaticns. Metal tape was then inserted thrcugh the drain piping ses-ments. These inspecticas uncovered no obstructicns in the piping between the 50V and SIV which cculd have impeded normal craining of the SCV. A fiber eptics inspecticn of the inside of the 50V at the icw peint of the 6" diameter SDV (where the 2" drain line ccnnects to the 6" SUV) revealed no foreign cbjects which could have blocked water from draining cut of the 6* SOV into the 2" drain line. The vent piping which cross-ccnnects the high points of the East bank scram discharge header was also cut, flushed, and inspected.

No costructicn was fcund in these vent lines nnich cculd have imceded or prevented nornal draining of the East SDV.

i Follcwing the event, the vent valve on the East header das removed and a vacuum pump connected to the Clean Radioactive Waste (CRW) side of the vent line. Eight (8) inches of mercury was indicated by the 1.35 CFM vacuum ;u=p

- 1g -

k

=

e

gauge after a few minutes of pumping but fell off sharply to 2 inches shcrtly thereafter. Neither the validity of this vacuum reading nor the reason for the apparent and brief vacuum pull could be determined by TVA.

Several days later when the 1.35 C.M vacuum pump was reconnected to the same East header commen vent pipe, no vacuum could be drawn after the vent line was flushed. A test of the East header vent valve itself showed that it was operable.

The scram instrument volume was also visually examined with a torescope by inserting it through the vent and drain line' penetrations. No costructions were found which could have prevented draining into cr cut of the instrument volume.

An inspecticn of the 6" East bank SUV and drain line showed that they sicped centinuously dcwnward toward the instrument volume, with the exceptien of a localized 3/4" rise in drain line at the expansion loop in the steun vault.

This might have been a locp seal of greater depth when the steam vault was hot during normal reactor pcwer operaticn. The overall drop in the drain line between the East SDV and instrument volume was determined to be l' 7" over its 150 ft. length. From the inspecticns discussed above, TVA was not able to locate a bicekage, loop seal, valve maleperatien, or other impediment to draining which cculd be described as the root cause for holding water in East SUV.

Scram Discharge Volume Vent and Drain Tests TVA cerformed a series of drain tests en both East and West SDV headers over a period of several days immediately folicwing the partial scram f ailure event.

The purpose of these tests was to determine the effects of a restricted vent path an East and West bank SDV drain cacabilities and to cuantify the normal crain characteristics of the SDV. Special test procacures aere written for these tests. :

e

~

l Typically, these tests involved initially filling the East and West SDV discharge headers and scram instrument volume tank with recm temperature demineralized water. Curing filling operations, the East and West header vent valves were kept coen and the scram instrument volume drain valve was kept closed. Ncrmal drain times and drain rates for the East and West SDV headers and scram instrument volume were then determined by recording the elapsed time necessary to empty these volumes with the vent and drain valves cpen. Vacuum hold tests (si=ulating vent line blockages) were performed to determine the drain capabilities of the headers with the vent valves cicsed.

Water level in the SIV and SDV was monitored by ultrascnic equipment and verified by a clear tygen (maneceter) tube attacned to the scram discharge volume headers. Clearing times of the 50, 25, and 3 gallen level switches attached to the SIV tank were also recorded dur.ing the tests.

Swanary of Test Results Scrsn Dischar;e Volume vacuum Hold Tests East Header With tne West header drained to empty, the East header was allcwed to drain into the SIV with the East header vent valve and SIV drain valve closed and the West header vent valve cren. For this conditicn (which si=ulated a biccked East header vent), water drainec frem the East SDV into the SIV tank at a rate of only 0.6 gpm.

West Header Fcr this test, the East header was first drained to ampty by ccening its associated vent valve together with the SIV drain valve. The West header was then allcwed to drain into the SIV with the West header vent valvt and SIY drain valve closed. For this concition (which simulated a blocked West header vent), water drained from the West SDV into the SIV tank at a rate of abcut 3.2 spm. :

y,

u i

4 East and West Headers For this test, both the East and West headers nere allowed to drain simultan-ecusly into the SIV tank with their respective vent valves closed and the SIV tank drain valve closed. After an initial water surge, the combined drain rates of the two headers into the SIV tank was 0.6 spm.

Scram Discharte Volume crain Tests These tests were perfer ed to determine the drain times and drain rates of the 50V and SIV during normal draining (open vent and drain) conditions.

Crain tests were performec for both East and, West headers draining at the same time. The system was first filled with the 50V vent valves open ano the SIV drain valve closed. At time zero the drain valve was cpened.

Ultrasenics indicated that the West header empt'ied after abcut 9% minutes while the East header emptied censiderably la'ter at abcut 25 minutes.

Additionally, the 50 and 25 gallen switches in the scram instrument volume cleared at about 9h minutes and 101/4 minutes, respectively. The SIV 3 gallen switch cleared after 11 minutes and 20 seccnds had elapsed. Based en the volumes associated with the SDV headers, taese tests showed the average drain rate (with both 50V headers draining together) of the East 50V header to be 11.5 gpm while the average drain rate of the West 50V header nas shewn to be accut 35 gpm. The average drain rate for the SIV based en clearing of the SIV level switches was 24.5 gpm. Mcwever, this drain rate was with the East 50V header still draining into the SIV at an average rate of 11.6 spm. That is, the SIV drained 24.5 spm faster than the East 50V drained.

l l --

m

e 7

PREVIOUS BWR EXPERIENCE CF FAILURE 10 rutLf i dERT A review of previous SWR excerience was performed with respect to failure to fully insert centrol rods and problems with the 50V. The sources of in-formation used were NUREG-C640 and ccmputer searenes of LERs. Ccaputer searches via the.NRC LER system and the Oak Ridge Nuclear Safety Information Center data base revealed no later events mere significant than those re-ported in NURE34640.

Mcst instances of failure of reds to fully insert resultad in a number of rods latching in posit.icn 02 (position C0 is fully inserted). Up to the time of publicaticn of NUREG-0640 in April of 1973, 12 scran events where some reds failed to fully insert were tabulated. These events in gener31 involved a relatively snall number of CR0s, between 2 and 15. Hcwever, one event at Oresden 2 in November of 1974 involved 96 reds. Ninety-three stopped at position 02, one at position C4, and two at positien C6. The only cause reported for the f ailure of rods to fully insert was damaged s cp pisten seals. Step pisten seal damsge can cause excessive leakage past these seals during a scram which could be large encugh to fill (and pressurize)the discharge volume in advance of the centrol reds reaching their full-in position. ;

8 FINDI;GS 1

The eartial failure to scram at 8F-3 on June 29, 1990, was accarently due to the cresence of water in the East scram discharce volume header.

As succorted by the tests, inspections and analyses discussed in Sections 4 and 5 of this report, the apparent cause of the extensive failure of cen.

trol rods to fully insert on the East sice of the core was the presence of water in the East scram discharge volume. header.

O i

(

i

- 24 l

l

2.

The 3F-3 scram instrument volume Hi level scram functicn did not and does not crovide crotection against the accumulatien of water in the East scram discharge volume header (with attendant loss of East bank scram functien) even for normal venting ano draining conditiens.

[ rain rate tests perfcmed at SF-3 shcw that water drains cut of the scram instrumen't Eolume tank censiderably faster than water drains into it frem the East bank scram discharge halume header even for nomal, free, uncbstructed venting and draining. Based en the tests, the average drain rate of the SIV is accroximately 25 spm while the averace drain rate of the East bank scram discharge volume header is apprcximately 11.5 gem. For these drain characteristics, water will drain cut of the SIV leaving it virtually empty while water may still be present in the East bank SUV. This actually occurred in the East header drain tests. During the test, the SIV emptied abcut 20 minutes before the East header fully drairfed.

'With these relative draining characteristics, if water were to leak inte tne 50V faster than 11.6 spm, water would accumulate in and fill the East header (since water is being added faster than it can drain cut). Ac the same time, the water draining out of the East header (i.e., at 11.6 gam) will not accumulate in the SIV since the SIV drains at a faster rate (i.e.,

25 gem). This process would result in water filling the East header with-out an automatic SIV Hi Level scram ever occurring. *de have also fcund that water drains out of the SIV so rapidly that the SIV Not Drained alarm wculo not alarn in the centrol recm. Thus, there would te neither control rocm indication that water is filling an East 50V nce a tematic reactor scr!m actuation to provide protection against partia' loss of scram cacability.

!n view of the above, with regard to the SIV Hi Level autcmatic scr!c function, we have found that continucus autcmatic protecticn against filling the East bank 50V (with subsequent partial loss of scram function) never did and still dces not accear to exist at 5F-3. Further cre, any 5'aR sith a SIV normal drain rate significantly f aster than its SCV nemal drain rate also would be without autcmatic protecticn against filling of the 50V. Althcugh =

l

~

l

not verified by test, it is likely that the 3F-3 West SCV header also would be in :his category.

The loss of autcmatic scram functicn can be explained in hydrau'ic head terms. The SIV is a high cylindrical tank and the 50 gallen sit Hi level scram is located over 8' above the bottom of the tank. Thus, it is necessary to build up a head cf 8' in the SIV before the Hi Level Trip switches can actuate. If :ne drain line fecm the SIV to CRW is a relatively short line (as is the case at 3F-3) an 3' driving head, wculd result in a fairly rapid drain rate. On the other hand, the SCV header is 1 horizontal pipe with a small slece. Even when filled, the maximum head of water that can be developed above the SDV drain (at 3F-3) is a pecximately 2\\'.

Thus, even with a relatively short drain line between the SDV and the SIV, the flow rate in this line wculd normally be icw t'ecause of the icw. end.

Actually the 50V header drain and the SIV drain are the same size for 3F-3, but the 50V drain is considerably longer. As a result,the icwer available hydrostatic head in ccmbinatien with the higher fluid ficw resis:Ince re-sults in a much slower drain rate for the East SDV header than for the SIV.

Such an arrangement can never detect accumulatien of water in the SUV. --

3.

A sinole blockate in the West header vent or drain line c uld ccmoletely disable the autcmatic reactor orotecticn functicn installed to orotect aoainst a loss of scram cacability for all centrol rods.

For plants like BF-3 which have ene SDV which nonnally crains significantly slower than the SIV, it is possible to comoletely disable the protection provided by the SIV Hi Level scram for both the East and West SDV by postulating a blockage en the f aster draining SDV. Reduced flow frem a blockage en this faster draining header SDV, when ccmbined with che normally slower draining header flow, may total less than tne scrun instrument volume drain rate wnich wculd then result in the SIV emptying with both SDvs still centaining water. This wculd be a sericus and undetectable condition if water inleakage were to subsequently develep into both SDV headers such as to keep the headers full at all times. For such a situaticn, there wculd be no autcmatic scran to protect against a total loss ~cf scram function due to CRD water inleakage since the SIV water level we~uld never rise to actuate the SIV Hi Level scram switches.

j 4

e 4

With the current scrim discharce volu$e/ scram instrument volume cesien, a blockage in the 50V vent or drain oath can cause a cartial loss of scram capability and disable the crotecticn functicn installed to orevent As discussed in the previcus secticns, a blockage in the 50V header vent or drain path will drastically reduce the drain rate of the scram discharge volume. Water leaking past the scram cutlet valves (or from other scurces) could then cause the scram discharge volume to fill. Since the CAD temperature proces would allcw about.1 gpm of undetecte,d leikage, as much as 9 gpm could leak into the 50V header undetected from all CR0s. Thus, given a partially blocked West header drain, for example, the West header could easily start to fill with water, leaking in undetected thrcush the West side CR0 scram cutlet valves. At the same time, since the drain rate of the West header with a drain line blocked could new be substantially less than the SIV drain rate, water neuld not accumulate in the SIV. Therefore, the SIV Hi Level scram switches would not actuate to prevent filling of the header.

Thus, with the present SOV/SIV and Hi Level scram arrangement, a single failure such as a blockage of a 50V drain or vent can help initiate a partial loss of scram capability and disable the protective function designed to prevent the loss. '

=

5.

There are numercus actual and cotential echanisms for introcucina and retainine water in the 50V with no accumulation in the SIV.

Review of the vent and drain paths for the scram discharge volume and the scram instrument volume has shewn that there are numerous actual and Dotential mechanisms wnich could slew or even stop 50V drainage into the SIV. Since the SIV would still maintain a high drain rate, it would be possible for the 50V to retain water while SIV instrumentaticn indicates emoty.

Possible s,curces of water are: water fecm the previous scram; multiple scram cutlet valve leakage; or injection frcm 50V flush lines.

Mechanisms which retard free draining of water cut of the 50V include:

a bicckage in the vent piping; a plugged 50V-to-SIV drain line; a closed 50V vent valve; a vacuum held in the 50V by a loop seal somewnere in the vent line; vent line siphon effects from water in the 50V vent line; venting to the closed CRW system in the Reacter Building Orain Sucp belcw water without vacuum breakers; vacuum effects frcm fluid ficws through the CRW piping system; Vacuum effects frem concensing het water in 50V frcm the previous scram.

Venting of the 50V to atnospheric pressure while the SIY drains into the closed CRW drain system (which could be pressuri:ed above atmospheric pressure) could also inhibit draining of the 50V headers if there is insufficient dcwnward slece in the 50V drain line. Since the CRW exhausts under water in the Reactor Building Orsin Sumo and ncn-c:ndensible gases are present in the fluids draining thrcugh the CRW drain system, there is a possibility for pressure to build up in the CRW : rain system. This cressure, in conjuncticn with a small 1cco seal in the train line frcm the 50V to the SIV, could hold up water in the 50V even if the 50V were vented directly to atmosphere.,

i,.

6.

The current scram discharge volume / scram instrument volume desien results in the autcmatic Hi level scram (safetyl function beine directly decendent en the ncnsafety-related reacter bu11cino Clean Radioactive Waste drain system.

For the scran instrument volume Hi Level scram switches to activate, water must accumulate in the scram instrument volume. For water to be able to accumulate in the SIV, it must be able to drain at an adequate rate frem the SDV into the SIV. Mcwever, frcm the drain rate tests performed at SF-3, improper venting of the 50V can snarply or totally prevent water fran draining cut of the 50V. Precer draining of the SDV is directly decencent en the venting functicn provided by the react:r building Clean Racicactive Waste drain system (a required systems interaction). A:c:rdingly, we aculd conclude that operability of the SIV Hi Level scram function is dependent on the venting provided by the ncnsaf,ety-related reactor building CRW system. Unanticipated adverse venting behavior of the CRW system, which results in reduced venting of air back into the'SDVs, can result in the holdup of water in the 50V with little or no accumulation of water in the SIV. This dependancy accears to be particularly inapprcpriate if not unacceptable for a reactor protection function which is intended to prevent the loss of reactor scram capability.

t :.

M

7.

The 3F-3 cartial scram f ailure event, together with recent events at other 3WRs, have shewn that ficat-tyce water level menitering instruments have a significant decret of unreliability.

The BF-3 partial scram failure event demcnstrated en several occasiens a significant unreliability of float-type level switches. As shown en the event sequence recorder printcut (Table 2-1), several of the 50 gallen level instruments failed to activate en different ecessicns. Furthermore,

' during calibration testing of the SIV level switches folicwing plant shut-dcwn, both the 3 gallon and 25 gallen switches were fcunc to be incperable.

After the instrument taps were flushed of residue, the switches operated satisfactorily. During drain rate testing of the BF-3 SOV, two of the four 50 gallen switches f ailed to activate twice in,two drain tests. Acditienally, inspecticns at Brunswick L' nit No.1, folicwing a reactor scram en November 14, 1979, revealed incperable alarm and red block level switches due to bent float reds. Other surveillances and inspectiens at Hatch nit 1 en June 13, 1979, found two SIV Hi Level switches inoperable due to bent floats binding against the inside of the float char.ber. These recent ex:eriences indicate a significant degree of unreliability of float-type level switches resulting frcm varicus causes.

O

8.

With the current 3WR Reactor Drotection System lecic, the cresence of certain autcmatic scrim c nditicns creclude SCV drainine (scram reset) to cermit a rescrim.

In order to drain the SDV for rescram follcwing a scram actuation, it is necessary to reopen the SUV vent and drain valves and to reclose the scram inlet and cutlet valves (RPS reset). This requires tne folicwing steps:

1) place the reactor mode switch in SHUTOCWN or REFUEL; 2) actuate the O!SCFARGE VCLUME HI WATER LEVEL 3YPASS switen; 3) the reactor trip signal must clear or be bypassed in SHUTCCWN or REFUEL T.cdes; anc finally 4) reset the RPS. Mcwever, the folicwing reactor trip functions cannot be by assed by the cperator in the SFUTOCWN orsREFUEL mcde:

Orywell High Pressure Reacter Vessel Lcw level Main Steam Line Hi Radiation Neutron Mcnitor System Trip Reactor Vessel High Pressure Condensor Lew Vacuum

Main Stern Line Isolation Valve Closure

Thus,1f any of the above trip conditicns are present, resetting the RPS would not be possible.

For example, if a spurious MSIV closure event shculd occur at gewer with the 50V initially full of water, a reacter scram wculd occur with the control r0ds failing to fully insert. If tne MSIV closure trip (or Reacter Vessel High Pressure) c0nditicn persisted, then a rescram attemet wculd not be

ossible since it cannot be bypassed in SHUTCCWN or REFUEL meces. Thus, the trio c:ndition itself would prevent the :ossibility of rescram. Mcwever, we do not consider that any modificaticn is recuired in the RPS trio / reset circuitry to enable tne cperator to reset the RPS in the presanca :f any aut:matic scram c nditien, since the capability to reset and rescrun has not been defined as a required protective acti:n.

l

'Cepends en Reactor System Pressure Interlcck set;oint.

\\

~ ~

i 1

I I

9.

If a scrw conditien exists wnich cannot be bytassed in SHUTCCWN or AEFUEL mode, then failure (to close) of a SDV vent er SIV drain valve can result in an unisolatable blewdown of reacter coolant cutside :rtmary centainment.

With the reactor in an unscramed state, the scrm cutlet valves provide l

both a reactor coolant pressure ecundary functicn and a primary containment isolation function. During a reactor scram, the scram cutlet valves open (ene per control red drive) and the SCV vent and SIV drain valves close.

Reactor coolant pressure tcundary integrity and primary containment iso-lation functions are then transferred to the scram discharge volume vent and SIV drain valves wnien seal tne SCV. We' nave founc :nat :nere are no redundant isolation valves in the vent er drain lines to provide these isolation functions fer a scram condition. The failure of any one of these valves in the cpen positien, therefore, c:uld result in an uncontrolled blewdewn of reactor water outside primary containment and into the CRW drain lines if the cperator cculd not reset the scram. The blowdcwn would ultimately discharge to a drain sump which is not ces,igned to handle the heat load or pressure buildup. With the present SWR RPS design, the operator would be able to reestablish primary centainment isolation (with scrm cut.

let valve closure) only if the RFS could be reset. Hewever, if a reacter scram condition persists and it cannot be bypassed in SHUTDCWN or REFUEL mode (i.e., any of those listed in Finding #8) it wculd be impossible to reset the RPS to terninate the bicwdown.

Thus, for example, a scram caused by spuricus closure of the XSIVs with a failed open scram instrument volume drain valve would result in an uncen-trolled bicudown of reactor coolant cutside primary centainment and into the drain sump recm which centains the engineered safeguard ; umps which are recuired fcr mitigation. 31cwdcwn wculd c:ntinue as icng as the MSIV closure scram c nditien existed (MSIVs not recpened) since this trip cannot be bypassed in SHUTUCWN or REFUEL mcde. That is, the scram cutlet valves could not be reclosed to isolate tne bicwdcwn until the MS*Vs c:uld be recpened. For events which result in scrams caused by condi:icns wnich cannot readily be cleared, unc:ntrolled bicwccwn into the reactor building (sec:ndary containment) could be sustained for an indefinite peried cf time with pcssible envir:nmental impact en the reg 2 ired mitigating features. :

e

10. The er.ercency coerating instructiens at 3F-3 did not include a crecedure er cuidance for the coerster to folicw in the event of a certial er c =oletj_,

scram f ailure.

The Browns Ferry plants, as perhaps do most (if not all) other SWRs (and probably all other LWRs), do not have emergency procedures for the Ocerator to follow in the event of a partial or complete scram failure. We have found that, although control recm coerators are trained to verify that the rods have fully inserted ucen a scram actuation, precedures do not exist for the ccerator's immediate or subsequent actions if full centrol red insertion dces not occur. Moreover, althougn ccerat:rs are fully knowledge-able of the function and cceratien of the s,tandby liquid centrol (poisen) system, the plant dces not have scecific procedures *nith state when the alternate shutdcwn system must be actuated.

S :-

A

9 RECCPPEN0ATIONS 1.

The acernoility of the Scrim Instrument Volume Hi Level Scram functicn should be indecendent of the Scram Discharge Volume venting and draining recuirements.

The current SWR scram discharge volume / scram instrument volume design ccnfiguraticn requires prcper venting of the SUV and proper SCV-to-SIV draining to assure operability of the scram instrument volute Mi Level scram functicn. We recccmend that the cperability of the Hi level scram be made indecendent of SDV venting or draining re(uf recents. We make this reccamendaticn because of Finding l4cs. I through 5 discussed in the previcus section. That is, the hydraulic facters which control water level in the SDV and SIV should not be able to negate the response of the Hi Level orotecticn functicn. We be'lieve the acceptable ccnfigura-tien wculd be to place the SIV tcnk directly undar-the icw end of the 6" SDV header and to ccnnect the tco of the SIV tanA to t'. bottcm of the low end of the SDV headen-by-a-short vertical 5' clame er pipe (rather than the current 2" diameter horizontal pipe). This trrangement shculd assure water scillace frcm the SUV directly down to the tank centaining the level mcnitoring instruments. Furthermore, it wculd not depend en venting or craining phencmena which are sensitive to bicckages. We also recccmend two separate scram instrument volume tanks, one en each SDV header bank.

Separate instrument volumes, in inmediate pecximity to their respective headers, shculd assure prc:er water spillage into the S!Vs and provide adequate redundancy for protection against a total loss of scram cacability.

It is our finn belief that mcdificatiens whicn simply imcreve the venting of the SUV/SIV volume arrangement to assure ccerability cf the SIV Hi Level scram functicn are not adequata. We recccmend that this unicuely important safety function be made ecmpletely indecendent of any vent or drain arrangements, therehy separating the water accumulaticn centrol and protecticn functicns. We further recommend that in situ fill tests be performed to demonstrate that the cperability Of the protactive Hi Level scram functicn is insensitive to the vent er drain arrangement for the desten ecnfiguraticn finally installec.

. I".

mm

i 9

2.

Scram instrument volume water level icniterino instruments for the SIV Hi level scram functicn shculd be both recundant and diverse.

It is recommended that diversity be added to the redundancy of SIV level acnitoring instruments for the SIV Hi Level screm function. Cu rrently, there are redundant ficat-type level switches for each RPS channel for the Hi Level scram function. Cn several occasicns recently, as discussed in Finding No. 7, more than ene float-type level switen was coservec to be inoperable at cnce. Curing and in:ediately folicwing the 3F-3 partial scran failure event, several float-type level switches in the instrument volume f ailed to actua'te. In view of these ex;eriences, we reccamend that diversity be incluced in :ne level mcnitoring functicn for the SIV Hi Level scram function. The imcortant and unique protection provided by this trip function requires that the presence of water in the SIV be monitored centinucusly witn extremely high reliability. We are recommending that diversity be added in crder to assure this reliability.

Mcnitoring techniques, such as differential pressure cells, ultrascnic detection or conductivity prebes, may be censidered alcng with others for this purpose.

3.

All vent and drain caths from the scram disenar;e volume and scram instrument volume sncule have recundant automatic isolaticn valves.

As discussed in Finding No. 9, scrams which cccur as a result of automatic reactor trip ccnditions wnich cannot be cleared or bypassed in REFUEL or SHUTDOWN modes can result in unisolatable reacter system bicwcewns cut-side of primary centainment if the 50V vent er SIV drain valve f ails to close. To protect against such occurrences, ae reccamend tnat redundant valves be placed cn all vent and drain lines c:nnected to these volumes.

Redundant valves would also pr0tect against equipment damage wnich might otherwise occur as a result of excessivdly slew closure or delayed closure of one of' the isolaticn valves. These valves must be qualified and capable of closing against full reactor pressure, ficw, and temperature c:nditicns in case the lines are not isolated within normally specified time limits. The vent and crain lines and drain su;ccrts must also be designed for the hydraulic loads and insta:ilities associated with the blowdcwn of the high pressure / temperature reactor ccolant to the drain system. Prolonged bicwdcwn may be ruled out as a design basis with a;propriate diverse isolaticn or other acceptable previsiens. Sicwdewn instability due to isolatien valve time delay is believed to be the cause of failure of the float-type level switches at Brunswick Unit No. 1..

euen

4 Emergency coeratino crocedures and cceratcr traininc snculd be orovided for comolete and carcial scrim failure conditiens.

In view of Finding No.10, we recommend that emergency cperating procedures and training se provided to centrol rcce operators to rescend to partial cr ccmplete scrsa failure ccnditiens. These procedures shculd include explicit statements regarding the ccnditicns for nhich the standby liquid centrol system must be used. The precedures should incluce cautiens regarding operator acticns which shculd not be taken wnich could result in a severe transient ccnditica (e.g.,

main turoine trip) being created. The procedures shculd provice guidance to the operator for starting up safety systems for standby readiness (e.g., HFCI cn minimum ficw) cr-for tripping other systems (e.g., re-circulaticn pumps). The ceder of cperator actions. (i.e., immediate, subsequent) should be censidered, as well as when the operater should begin attempting to insert reds manually.

We believe that such operaticns (human facters) aspects can and shculd be implemented in the near tenn. Such procedures and training would assure, in the near term, the most appropriate control recm ccerator acticn during a scram f ailure event and well in advance of any ATW5 mccificatiens which may be required in the icng term. -

27

5.

Ccnsider mcdifyino the SDV vent and SIV drain arrancement to im= rove scram discharge volume drain reliability.*

As discussed previcusly, scram discharge volu=e draining currently depends on uncertain vent and drain functions provided by the reactor building Clean Radioactive Waste drain piping, alcng with relatively small diameter, ncnredundant vent and drain piping, which are susceptable to blockage. This current, relatively unreliasle SCV venting arrangement c uld be improved by increasing the vent line si:e and by adding an alternate, reliable, and isolatable vent patn. The alternate vent path cculd be installed with a check val've and air operated isolaticn valve to provide an alternate and isolatacle path for air inleakage into the scram discharge volume. The alternate' vent path cculd be vented either directly to the Reactor Building atmospnere or to a gas treatment system with a vacuum breaker. The check valve wculd provide autccatic isolation of this redundant line upcn pressurizaticn of the scram dis-charge volume during a reactor scram. The drain functicn cculd also be improved by providing a seccnd drain line from the SIV to the CRW floce drain.

We believe that modificaticns, such as these describec above, would help improve SIV drain reliability. Improvements such as these wculd thus help to further reduce the number of challenges to the SIV Hi level protective scram function.

Althcugh this reccemendatien is only fcr censideratien, we do believe inat it wculc further reduce the risks associated with less of scram capability arising from water accumulaticn in the SDV. :,

10 CONCLUSI0fiS The Srewns Ferry L' nit 3 partial scrmu f ailure event wnich occurred en June 28, 1980, demcnstrated tnat the present S'aR scram system can be vul-nerable to loss of scram capability while operating at power. Furthermore, the event shcwed that the loss of scram cacability can occur in a way which goes undetected by the operator and unprotected by the reactor protecticn system.

The information and analysis of the SF-3 partial scram failure, which is provided in this repcrt, cencludes that the cause of the Icss of scram capability was the presence of water in th'e East scram discharge header.

Furthermore, our analysis of the scram discharge volume / scram instrument volume design ccnfiguratien, tcgether with its vent and drain characteristics, leads us to cenclude that numercus actual and postulated mechanisms exist wnich can cause the scram discharge volume to fill undetected and withcut protecticn against such filling. Our analyses also show that certain scram events can result in an unisclated reactor coolant blowdcwn cutside of primary containment folicwing a single isolaticn valve failure.

In view of these design deficiencies, we believe it necessary that modifica-tiens be made to the scram discharge ' clume/ scram instr ment volume arrange-ment and isolatien features. Our specific recommendatiens for change in the SCY/3IV design which flow frem cur-findings have been ;revided in this report.

'We believe that these reccarendations shculd be considered alcng with these of others who are also reviewing the SF-3 event. We do telieve, hcwever, that the design changes described in the reccomendations are necessary to adetuately reduce the risks asscciated with the present unreliability of the SWR scrcm system arising frcm undetected accumulation of water in -he scram discharge volume.

l l :

p

~

Table 2-1 Event Secuence Recorder Print ut 01 31 16 A034 Reactor Scram Manual 3 CY 5 34 A034 CY 6 44 A033 Reacter Scram Manual A 01 31 24 A035 Reac:0r Trip Actuator Al or A2 CY 3 38 A035 CY 3 39 A021 Reactor Low Water Level A CY 3 42 A023 Reacter Lew Water Level C CY 3 47 A021 Reacter Lew Water Level O CY 3 47 A036 Reactor Trip Actuator 31 or 32 CY 3 56 A022 Reacter Lcw Water Level 3 CY 5 11 A076 REPT C Tricced 01 31 34 A003 Discharge Volume High Water Level C CY 3 42 A003 CY 5 01 AC04

- Dischar;e Volume Hign Water Level 0 01 31 37 A002 Discharge Volume High Water Level B CY 6 58 A002 01 31 40 AC01 Discharge Volume High Water Level A CY 0 03 AC01 CY 0 18 A106 Malfunction Sus Er$!rgtzed CY 0 33 A038 Turb. Stop Valve Closure Scram Trip A CY 0 33 A040 Turb. Stoo Valve Closure Scram Tric C CY 0 33 A041

~ Turb. Step Valve Closure Scram Trip D CY 0 34 A039 Turb. Step Valve Closure Scram Trio 3 CY 0 47 A043 Turb. Gen. Load Rejecticn Scram Trip 3 CY 0 47 A045 Turb. Gen. Load Rejection Scram Trip D CY 0 48 A042 Turb. Gen. Load Rejecticn Scram Trip A CY 0 48 A044 Turb. Gen. Load Rejecticn Scram Trip C A084 Turb. Tripced - Loss of Hydr. Trio Pressure 01 32 01.N021 Reactor L0w Water Level A CY l 12 N021

~

CY 1 57 N023 Reacter L:w Water level C CY 2 04 1024~

Reacter Low Water Level O CY 3 35 NO22 Reactor Lcw Water Level 3 01 34 45 A058 IRM Upscale Trip en Level F CY 4 30 A058 01 34 48 A057 IRM Upscale Trip en Level O CY 7 36 A057 (v o n7 NnC7 CY 3 13 A057

9 9

Table 2-1 Event Secuence Recercer Printcut CY 0 25 N058 IRM 'J scale Trip cn Level.:

CY 0 49 A056 IRM toscale Trip en Level 3 CY 0 55 NC56 CY l 01 A056 CY l 16 NC56 CY l 41 A056 CY l 48 N056 CY l 56 A056 CY 2 21 N057 IRM Ucscale Trip on Level O CY 4 14 N056 IRM Upscale Trip cn Level 3 01 42 CO A035 React:r Trip Actuater Al er A2 CY 9 23 A035 01 2 27 NO35 CY 5 35 NO35 CY 6 36 NO35 Reactor Trip Actuator 31 cr 32 CY 8 05 NO34 Reactor Scram Manual 3-CY 3 06 NO33 Reactor Scram Manual A 01 :5 17 A035 Reactor Trip Actuator Al er A2 CY 5 47 A035 CY 47 A036 Reacter Trip Actuator 31 cr 32 01 45 36 N002 Discharge Volume High Water Level 3 CY 5 09 NCO2 CY 6 15 A002 0146 30 A031 Reactor Scram Manual 3 CY 9 48 A034 CY 9 48 A033 Reacter Scram Manual A 01 47 43 NO35 Reactor Tri Actuator Al cr A2 CY 2 37 NO35 CY 2 38 NO36 React:r Trip Actuator 31 or 32 CY 3 05 NO33 Reactor Scram Manual A CY 3 05 NO24 React:r Scram Manual 3 01 57 C4 NCO2 Discharge Volume High Water Level 3

'CY 3 22 NCO2 i

CY 4 08 NC01 Discharge Volume High Water '.evel A 01 57 34 NCC4 Discharge Volume High Water Level O CY 4 07 N004 CY 4 19 NCO3 Discharge Volume High Water Level C l

02 28 06 0 30 77A BFUP 42 -

T

o l

l l

00

.r. f l

EAST WEST l

l 59 48 48 48 48 48 l 48 48 55 48 48 48 42 48 42 48 48 48 l

51 48 48 48 48 48 48 48 48 48 48 48 48 12 48 0

48 8

48 0

48 12 48 43 48 48 48 48 48 48 48 48 48 48 43 48 48l48 48 29 38 48 48 48 0

48 48 48 48 48 12 48 48 i 48 33 1

25 48 48 48 48 48 l 48 48 48 48 48 48 48 48 l 48 48 i

1 31 48 48 0

48 48 48 8

48 8

48 48 48 0 48l48 27 48 48 48 48 48 48 48 48 48 48 48 48 48 48 48 23 38 48 48 48 0

48 48 48 48 48 0

48 48 48 38 48l48l48 48l48 48ja8,j48l48l48 48l48 48l48j48 19 48 l 12 l 48 48 0

48 8

8 48 0

48 12 48 15 48 l 48 48 48 48 48 l

48 48 48 48 48 07 48 48 48 42 48 42 48 48 48 02 1

48 48 48 48 48 48 48 02 C6 to 14 18 22 25 20 24 23 42 46 50 54 ga 1200 Figure 2-1 Centrol Red Positicns Befors First Manual Scrw h

9 EAST

'4EST 5

5?

40 4

36 1 42 0

0 0

t 1

2 l 0, 55

' 36 46 33 O

G 0

0 42 I,10 0

0 0

51 36 34 0

36 4;

42 0

20 0

24 0

0, 0

0 0

0 43 12 40;44 0

30 28 40 38 0

0 0

29 24 0

40 0

0 34 32 0,

0 0

0 35 30 4

38 0

1S 8

34 ;30 0

0 0

0l0 31 22 10 0

34 2S 2

0 10,

'O O

O O

O Ol0 27 42 36 30 14 26 23 36 1 24 0

0 0

23 8

0 38 32 0

12' 36 l 2,)

0 0-0 0

0 0

0 19 34 l 42 l 34 20 10 28l22 26 0

0 l0l0 l0 0

0 l 0, 0

0 0'

O O

O

. 15 40 0

36 0

38 0

.~.*

11 26 6

14 40 40 24 0

0 0

l j

07 O

40 2

0 0,,,

0 0

03 23 42 42 30 0

0 0

02 C6 10 14 18 22 26 30 34 28 42 46 50 54 53 I

1800 l

Figure 2-2 Centrol Red Pesitiens After First Scram

\\

...r_

o g

I EAST WEST

' ' 59 30 0

14 18 0

0 0

55 25 42 28 0

0 0

0 51 12 22 0

23 34 0

0 0

0 47 30 0

0 0

12 0

0 0

0 43 0

30 38 0

14 4

20 25 0

0 0

29 8

0 30 0

0 25 14 0

0 0

0 35 14 0

30 0

4 0

22 20 0

0 0

0 0 l0 0

31 3

0 0 l 14 12 0

0 0

0 0l0 0l0 27 25 22 20 2-12 12 15 2

0 0

0 l0 0

23 0

0 30 20 0

0 15 0

0 0

,0 0

0 0

0 10l25l24 8l5l4 0l0 0 l 0 l0 l0 0

19 0

0 I

15 18 0

18 0

28 ; O O

O O

O 0 l0 0

5 11 12 0

0 32l30l14 0

0 0

C7 O

30 0

0 0

c2 2

34 22 4

0 0

0 l

02 C6 10 14 18 22 26 20 34 28 42 46 50 54 52 ISOC Figure 2-3 Centrol Red Positiens After Sec:nc Scram 3 e e

e

Table 5-1 Scram Discharge Volume Orain Time and Total Positions Inserted Orain Time from Total Positiens Positions Scram No.

Previous Scram. Sec.

Inserted Per CR0 2

93 956 10.2 3

53 202 4.3~

4 160 ECO S.S b

I F

e e

e "o

e i

l 4

e i.

b 52 -

i i!-

l 1

,w,-

c

.-------s t

-~-

~

l EAST

'4EST 53 24 0

0 0

0 55 20 20 22 0

0 0

0 S'

O 16 0

24 30 0

0 0

0 26 0

0 0

6 0

0l 0 0

0 0

2!0

3 0

24 36 0

24 18 0

0 0

0l0 29 2

0 24 0

0 20 0

0 0

0 0l0 0

14 l 16 35 6

0 26 0

0 0-l010 0

0 0

0 O

O!0 31 0

0 0

2 4

0 0

0 0 l0 0

27 18 16 14 2

4 6

2 0

0 0

0 23 0

0 25 12 0

0 2

0 0

19 0

16 l 18 0l0 0l2 2l C 0 l0l0 0 l0 0

0l 0 15 4

0 10 0

0 0

0. l 0

,0 11 I

I 6

0 O 23 I 25 ! S ! 0!O I O O ll 0 Il I

i 1

37 O

24 0

0 0,

0 0

03 O

30 10 0

0 0

0 02 C6 10 14 18 22 26 30 34 28 42 46 50 54 53 1800 Figure 24 Centrol Acd Positicns' After Third Scram 4

46 -

=

emnsum l

s i

e COUPt;MG

$PMO b

[

SCTTCW CP I

REACTOR VE13EL

)

n +

l E 'l

k$hi T

1 MCU$3NG

4 = /

FIRED Pi$7CN O

(STOP Pl$7CN) i I

%e I

[g)4 RETURM $PRING COLLET FIMCER3

Ct L$

' l

( kEI h_j:

s y PtsTcM Ttne cei.trT Pi3 Tom

.i(

YIN 0EK TUSE R

CYUN CER -%

M l h'j E's g

3;

'! 'i '

e;

..d

. [!

I h.

it e

2 k CRtyt Pisics

/

oRivt iN$tRT unt (

3 r

4 cmvt viTncRair g2 cac 3 =

l A

'.a 5! ::

L s

ix.

Pg2REACTCR ($3yR6 Q-1

ei

~

I-i ip 480 VAC RE AC TOR 480 VAC HE ACIOli g

MOV 00 Alli) 1 A AtOV 00 Allo Iis ltPs 8 tJOR?.lAL SUPPLY itPS A FJOnM Al. SUPPLY k

")

8~

Note: All relays anil solenoids G

sliours energlzed pos1Llos 6

(non-scrani poet.ltion) 1JGVAC IIPS UUS ~G" ItPS DUs *A*

870 VAC Hanual Scrain Relays

c__

.[

~

e

]II j

.;)

{

Channel B

~

D Subchannel One Relays c

Channel A

(( [I.

.]

Subchannel Two Relays e

p u

g p%

+-

d-4-

46 CRDs

-c-e-

46 s

caos 1

,7 w

,a -

4.s u..

a p 3.r

,r-g.aA l-

,t_

s _.

4_

SCH Ant Sut t hise() V AL Vt 50 l

2 3

4 4

3 2

)

p g,,,

l Q

Scrain l

l Groups Scrain m.

H Groups

_ f,.

f, -

l J

i e,s e

Scram l-

- >I (i

n'!

Discharile 4 1

In ;lde dast.ed line volume ln*ceva sc7,r,- -

.u s u e nti 4

typical of all IB's llClis R.

c Accuoui n on v

ou s t t : c scn.s.

l O

f WAItM o

E'

-4 er4 t :

i I

a,

t. _ _ /_-

a E

RCS Water l

i

,1

,'ll n

e_.

C0 East

'Je s 59 2

1 3

4 2

1 3

55 3

4 2

1 3

4 2

1 3

=

$1 1

3 4

2 1

3 4

2 1

3 4

47 1

3 4

2 1

3 4

2 1

3 4

2 1

43 2

1 3

4 2

1 3

4 2

1 3

4 2

1 3

39 4

2 1

3 4

2 1

3 4

2 1

3 4

2 1

35 4

2 1

3 4

2 1

3 4

2 1

3 4

2 1

31 2

1 3

4 2

1 3

4 2

1 3

4 2

1 3

27 2

1 3

4 2

1 3

4 2'

1 3

4 2

1 3

23 4

2 1

3 4

2 1

3 4

2 1

3 4

2 1

2l1 2l1 19 4

3 4

2 1

3 4

2 1

- 15 1

3 4

2 1

3 4

7 1

3 4

2 1

11 1'

3 4

2 1

3 4

2 3

4 2

C7 3

4 3

1 3

4 3

1 3

C3 4

2 1

3 4

2 1

4 02 C6 10 14 18 22 26 30 34 38 42 46 50 54 Sa l

1800 i

l Figure 3-3 Centrol Red Scram Groua Assige.ent.

=

m 4

O

(

.'(

e' a

0280

.l.

S'.

~

a s.

- a:

i 2

s

a 2

"9 t

$4 i i i i

! :i I i

A i I

i i,5 15.

-s.

a a

i

,=

'q:.

1:* 5,4

.1 o

r<

5 4

r a *1

55:

b ;g L.

2.

2 : : : :

5 5

3 773 :e 3

t.

I i

i i

i 1

i Ti:

a >*

53-3 I

3*,"5 B

.'s 3 ;2.3 3

3 i

i ii A &3 313

>I c-A.c, 5423.:.2 t

9 1; i i;;it co..igs

-.s i

-,2 2

1 2

'i. i a 2

,g 4

a ae g

5:::s

! --b.c mg at.50 i

L A

1

. l, i

2.

,,_. :s ji $.

4

' @r!!

O!, i

<r r - - - ; P: s.t O

=

11 e

[

3 s.::

T 2

n@

r a

ae.

u

( b j>

Ch'k)

M c

L*.

3 1?

- ' o ]I---D.i<} '

.I s?-

P' g

ti I

i h7 V!5hI 5! $!!

h, f

5 I

us I m1>

v.

_'l I

m; 137 l

i.

a--

ao.

i ag.e4.

._23.4-

,;[ a 4

3

-5*

o u,

..a

.z -

i g:

S:

~

3 { -.

l

I

+

~

l J

al i.

\\r B U

< g a< g a.4 Nt n

s

-- U a.*

a i

I wl a

ee s

at as 2,'

a t 2 s..t-

.I -

6 6

e m

W-

=a[

l um l

s.

[:-l

$ 3-><*

l }N I

~

5=

5' n

a y

e L

i' 3-+4-d e ei 5

eu

_E. s; Figure 3-4 Scram 'talve Arrangement

.50 -

1

1 I

,.o

}

1 k

5 0

z

= c 00H 3EC l

u=

~

>=a N

3 33b 0H

- o a_

v

.a = =

~

a u-I W

00H e

/

saugl

~

I 0"H v'

~

a5.1 43s50 00H 2=

4.J

=

sutvac 2ay;o -> H~l

?_

i

=

1<

G m?

==

G ^=

2 s C;3 b

,c O

u._.

u.

v, =

.=, 5 u-c z2

%~

+

,a v

+

v

=

_;;. ? g t

yi

- n a

{

5_-

'dS

.5 say:2 pas ta^al e

=

1 h4*

s

-5 E C,.

I eee U

Z N

_-v

a s

"o.". E W-~_i i

g o

4 s

=

E 00H x

00H v

a n

s j

~

0;H v N-a 0H

~

u=

- 3 I

. igure 3-5 Scrar.1 Volume Crain Arrangement

2,.

\\

o o

REPORT ON THE INTERIM EQUIPMENT AND PROCEDURES AT BROWNS FERRY TO DETECT WATER IN THE SCRAM OISCHARGE VOLUME by the OFFICEFORANALYSISANDEVkLUATONOF OPERATIONAL DATA September 1980 Prepared by:

George Lanik Iy/

es e1

f f

EXECUTIVE

SUMMARY

On June 28, 1980, the Browns Ferry Unit 3 reactor experienced a partial failure to scram while shutting down for a scheduled outage.

As reported by the Office for Analysis and Evaluation of Operational Data (AE00) on July 30, 1980, the apparent cause of this event was found to be water accumulation in the Scram Discharge Volume (SDV) prior to the attempted scram.

The AE00 study identified possible fundamental deficiencies in the SDV which cast doubt on the ability of the Scram Discharge Volume / Scram Instrument Volume (SIV) to adequately perform their intended functions.

In view of these deficiencies, AE00 recommended design changes to improve the performance of the scram system for the long term.

Following the event, the Office of Inspection and Enforcement (IE) issued Bulletin 80-17 and Supplement Nos. 1, 2, and 3.

Supplement 3 was issued in response to the concerns raised by the AEOD memorandum of August 18, 1980 which identified degraded air pressure in the control air system as a mechanism which could rapidly fill the SDV.

The equipment and procedural changes required by Bulletin 80-17 and its Supplements are intended to provide the basis for continued operation of BWR's during the period prior to completion of design changes to the scram system.

AE00 has evaluated the procedures and equipment at the Browns Ferry Units 1, 2 and 3 to determine their adequacy with respect to providing assurance that the SDV will not fill with water and interfere with a successful scram.

This evaluation applies specifically to the Browns Ferry units. However, the findings and recommendations should be considered in the review process for all applicable BWR's.

The principal findings of the study are summarized below:

e The present system, which uses recently installed ultrasonic water detec-tion equipment and special procedures, in conjunction with previously installed instrumentation and procedures, does not restore the level'of i

scram protection capability thought to be assured in the original design.

However, except for degraded control air pressure events, it dces provide adequate assurance for the interim that, accumulation of water in the Scram Discharge Volume (from currently identified sources),which could result in a loss of scram capability,will be reliably detected and adequately responded to by the operator, e Degraded HCU control air pressure could result in scram outlet valve leakage to the SDV which would require operator action to manually scram the reactor within a few minutes before scram capability would be com-pletely lost.

Control air related disruptions in the plant would likely also initiate a plant disturbance which would require a scram.

Such an event would be accompanied by numerous control room alarms and indications which could distract the operator from a prompt manual scram actuation.

The current system does not adequately assure sufficient time for operator diagnosis and actions for this event.

e Operating experience indicates that a significant number of reactor scrams attributed to loss of HCU control air pressure have occurred.

These provide evidence that rapid filling of the SDV is a credible event.

The principal recommendations of the study are as follows:

i e An immediate manual scram should be required based on control room indi-cation of degraded HCU control air pressure.

Review of licensee proposals should include consideration of the available pressure indications and procedures to assure that other alarms and indications do not divert operator attention from this priority action.

e Redundant HCU air header pressure instrumentation should be provided in the control room.

To aid the operator in ouickly focusing his attention on the need for protective action, a distinctive alarm for degraded air pressure should be provided.

ii

'o Because of the possibility that a currently unidentified water source could result in water accumulation in the SDV, it would be prudent to monitor the ultrasonic system alarm output in the control room and require an immediate verification of a sustained alarm by operator dispatch to the equipment.

Operability and calibration checks of the system should be continued on a schedule of once per shift.

The conclusions of the study are summarized below:

AEOD has reviewed the interim surveillance system at Browns Ferry used to detect the presence of water in the 50V.

The~AE00 assessment considers the procedures and equipment changes initiated in response to IE Bulletin 80-17 with Supplements, 1, 2, and 3 to be adequate for continued interim operation of the Browns Ferry Nuclear Plant, if the recommmendations of this report relating to degraded control air pressure are implemented.

As of the date of this report, the instrumentation and procedures in place to respond to the loss of control air scenario at Browns Ferry are judged to be inadequate.

For this event the operator must respond promptly to a single indistinctive alarm for loss of control air pressure during a period when numerous alarms may be occurring.

Additionally, the operator must take actions outside the control room in a very limited time frame because of the absence of a pressure readout in the control room.

IE is currently taking steps to upgrade the procedure for response to the degraded control air pressure event.

In the past, operator action to perform a vital safety function within less than 10 minutes has not been considered acceptable by the NRC.

However, providing the operator with both a distinctive low pressure alarm and reliable air pressure instrumentation in the control room would help assure adequate operator response within the required time period.

Such an arrangement should be acceptable for the interim.

A dedicated operator with adequate alarms and instrumentation in the control room could provide even greater assurance of a-timely manual scram.

If the provisions made to accomplish a manual scram are iii

=

i found to be. untimely or inadequate, provisions should be made for an automatic scram on low HCU control air pressure.

For the long-term, the scram system should be upgraded according to the recom-mendations of the AE00 report of July 30, 1980.

However, the consequences of degraded air pressure in the HCU control air headers were not fully recognized at the time of that report and were not directly addressed. Although the recommended scram system modifications may be sufficient to enable the scram system to respond to rapid inflows of water from the scram outlet valves due to degraded HCU control air pressure, design review of the long-term modifications should include specific consideration of the eff'ects of degraded air pressure.

4 4

e j

t 4

l I

-iv

TABLE OF CONTENTS PAGE j

EXECUTIVE

SUMMARY

i 1.

INTR 000CTION........................................................

1 2.

SYSTEM DESCRIPTION..................................................

3 2.1 Calibration and Operation......................................

6 2.2 Operating Procedures..........................................

8 2.3 Other Leakage Detection Capabilities.................

8

2. 4 Procedures for loss of Control Air..l..'........................

9 2.5 Procedures for Standby Liquid Control Initiation...............

10 3.

ANALYSIS AND EVALUATION.............................................

11 3.1 Water From the Previous Scram..................................

12 3.2 Purge Line Inflow..............................................

13

3. 3 Water or Steam f rom the Orain System...........................

13 3.4 Single Scram Outlet Valve Leakage..............................

14 3.5 Multiple Scram Outlet Valve Leakage f rom a Common Cause........

16 3.6 Degraded Control Air.....

17 3.7 Operating Experience with Degraded Control Air Supply..........

21 4.

FINDINGS............................................................

24 5.

RECOMMENDATIONS.....................................................

25 6.

CONCLUSIONS.........................................................

26 REFERENCES..........................

28 TABLE....................................................................

29 l

i -

FIGURES..................................................................

30 v

i I

_y 97.

1.

INTRODUCTION On June 28, 1980, the Browns Ferry 3 reactor experienced a partial failure cf the scram system while shutting down for a scheduled outage.

The operators were able to completely insert all control rods within 14 minutes of the initial scram attempt. Because of the initial partial success of inserting rods on the first scram and because no unplanned transient requiring a scram was in progress, no immediate challenge to reactor safety and integrity developed.

As documented in the AE00 report dated July 30, 1980, (I) the cause of this event was found to be water accumulation in the East Bank Scram Discharge Volume (SDV) prior to the first attempted scram.

Following the event, IE Bulletin 80-17 and Supplement Nos. 1, 2, and 3 were issued.

These directed BWR licensees to begin surveillance of the SDV to detect the presence of water. A requirement for continuous monitoring of the SDV water level in the control room was stated in Supplement No. 1.

Scram system problems revealed by testing subsecuent to the Browns Ferry event were reported in Supplement No. 2.

Supplement No. 3 was issued in response to the concerns raised by the AE00 memorandum of August 18,1980(2,)

This supplement required uperator actions for a loss of control air to the Hydraulic Control Units (HCOs}.

The following report is an evaluation of the cur en: 9easures being taken at Browns Ferry in response to the IE bulletin and supp'ements to prevent even+-

of the type that occurred en Junc 22, 1900. This assessment was undertaken wy AE00 because of its concern about the adequacy of the interim system which will be used during the period preceding the implementation of long-term corrective measures. The scope of this report is purpo'ely limited to:

s a) Browns Ferry Units 1, 2, and 3: b) the interim measures; c) selected bulletin requirements; and d) procedures and equipment in place on the date of this report.

The findings, recommendations, and conclusions are based on information gathered through informal channels between AEOD and the Tennessee Valley Authority, the General Electric Company, and the U.S. NRC headquarter.s and r.egional zoffices.

d

'Section 2 of this report contains a description of the present equipment and procedures at Browns Ferry used to prevent a recurrence of the failure to scram event.

Section 3 provides an AE00 evaluation of the effectiveness of the present system (equipment plus procedures) for providing a timely response to a range of costulated scenarios.

Sections 4 and 5 present, respectively, j

the findings and recomendations. The conclusions are given in Secticn 6.

i 2

i j

a e

i J

F 1

e s

}

i

l.,

I

. 6 l

1. '

I 2

j

. c 4

2.

SYSTEM DESCRIPTION To compensate for the identified deficiencies (1) associated with the protection system instrumentation installed at Browns Ferry prior to the June 28, 1980 i

event, additonal hardware and operating procedures have been put in place.

The additional equipment installed at Browns Ferry for monitoring the SDV for the presence of water is an ultrasonic (UT) system.

Ultrasonic transducers L

are mounted on the East and West SDV header low points.

The transducer is driven by a signal generating and processing device which incorporates a cathode ray tube (CRT) display and provides an output to a strip chart recorder.

Unit 3 has eleven transducers located as shown in Figure 1.

Units 1 and 2 each have four transducers located as shown in Figures 2 and 3. Unit 3 was instrumented to a greater extent to attempt to find the cause of the June 28, 1980, partial scram event.

Since completing the testing of SDV drainage, long-term monitoring has been limited to use of transducers #2 and #7 on Unit 3; transducers #12 and #13 on Unit 2; and transducers #14 and #15 on Unit 1.

In the case of failure of these transducers, a backup transducer is available on each header.

The transducers are bonded to the headers with a high tempera-ture adhesive.

The pulse-echo technique of depth measurement is used and is.i e, rated in Figure 4.

The top illustration shows a cross section of the SDV pipe on which the transducers are mounted.

Ths bottom-illustration shows the CRT display arising from this situation.

Since sound travels one-fourth the speed in water as in steel, the reflection from the inner tube wall is received very l

quickly following the initial pulse.

This is shown on the left hand side of the CRT display in Figure 4.

Multiple reflections are seen on the CRT because of sound reflections between the inner and outer diameter of the pipe. These show a decreasing amplitude and die out rapidly.

F The sample illustration is shown containing 5.2 inches of water. A second series of echoes is received at a later time on the CRT indicating the" 3

s

reflection from the water-air surface at a distance of 5.2 inches.

The instru-ment has been previously calibrated on a pipe with a known water level.

The numbers shown on the horizontal axis of the CRT display correspond to the depth in inches of water in the SDV above the transducer location.

A continuous recorder is provided.

By use of gating devices, it is possible to pick the signal of interest to look at which is the water-air interface and not the pipe insiae diameter (i.d.).

The gating device is set to gate signals which come in at a time later than those corresponding to one inch of water.

This eliminates the reflection from the i.d. of the SDV pipe and the associated multiples.

The gating device is also set to gate' only those signals with an amplitude greater than approximately 20% of full-scale amplitude.

The first signal associated with a given pulse to pass the gate is transmitted to the recorder > -The recorder is a two channel recorder; one channel records the amplitude of the gated signal, and the other records the calibrated depth of water associated with the gated signal.

A local alarm is provided. Any echo signal which passes' the gate will generate an audible and visual alarm.

The alarm is generated when the water level is greater than one inch and self-clears when the level is less than one inch.

Two characteristics of the gating method used are of particular interest with respect to the recorder output:

(1) only water depths greater than one inch are recorded; and (2) only the first echo received at a depth greater than one inch is recorded.

When no water is present in the header, the echo from the pipe i.d. is the only return pulse.

Since this initial pulse and its multiples indicate less than one inch, nothing is gated to the recorder. The seccnd pulse indicating t:ater level never comes.

The recorder sees this as a long delayed second pulse.

Thus, the normal empty header condition reads full scale on the recorder.

j The recorder full scale reads ten ii.ches.

Since the full pipe condition would read only six inches, there is no confusion in the reading. When a pulse is 4

l i

C gated, indicating the presence of water in the header, the recorder pen is driven down toward the lower part of the scale.

(See lower portion of Figure 5).

At Browns Ferry Unit 3, two separate UT devices and recorders are provided to monitor both the East and West SDV headers independently.

On Units 1 and 2, however, a single UT device is used to drive and monitor two transducers at the same time, one on the East SDV header and one on the West SDV header.

This provides another characteristic of the system that must be recognized by those operating the system.

The gating device pa,sses the f'rst pulse which returns corresponding to a depth greater than one inch, and the recorder responds to this pulse. With water in both headers, the indication seen on the recorder corresponds to the first returning echo greater than one inch.

Thus, if both East and West headers have a water depth above one inch, the smaller depth indication is recorded because it is the first pulse to return.

Individual measurements for either side can be made by disconnecting the cable from the transducer on the header opposite the side of interest.

The following is a brief discussion of the recorder output from a scram test at Browns Ferry 2 (Refer to Figure 5).

Figure 5 shows only the calibrated water depth trace. The amplitude trace has been omitted for simplicity.

Increasing time is from the botten upward with one division equal to approxi-mately 5 minutes. Water depth is measured in inches starting from zero on the right hand side of the trace to 10 inches on the left.

Note that the pen location prior to the scram at 0202 hours0.00234 days 0.0561 hours 3.339947e-4 weeks 7.6861e-5 months is full scale left (10 inches).

This is because no water is present and the second echo never returns, which the instrument interprets as maximum distance from the bottom mounted trans-ducer.

The momentary readings where the pen is driven downward (to the right) prior to the scram are due to the instrument reacting to the "walkie-t:lkies" used for ccmmunication. These momentary reaoings also activate the visual and audio alarms which clear each time the walkie-talkie transmission stops.

Since Unit 2 was scrammed at 0202 hours0.00234 days 0.0561 hours 3.339947e-4 weeks 7.6861e-5 months the water level indicates 6 inches.

l The trace has been blacked in below the 6 inch level for emphasis.

At about 5

l

0230 hours0.00266 days 0.0639 hours 3.80291e-4 weeks 8.7515e-5 months the indicated water level falls from 6 inches to 1 inch.

This is due to the West header going empty. At the time when the level indicator reaches 1 inch, the pen is driven back up to the 6 inch level.

This is because on Unit 2, a single UT instrument is used to monitor both East and West headers.

Since the gating device passes the first returning signal above one inch, the recorder tracks the header which empties first (West side) and when the echo from the West side indicates less than one inch, the gating device begins to pass the echo from the East side header.

Since the East side header has not yet emptied, the pen is driven back up to about 6 inches.

Between 0234 and 0256 hours0.00296 days 0.0711 hours 4.232804e-4 weeks 9.7408e-5 months , the East side header continues to drain.

When the level reaches one inch on the East side, no returning echo is dated and the pen returns to the 10 inch position.

As indicated on the trace, a series of momentary indica-tions of water are present at 0440 hours0.00509 days 0.122 hours 7.275132e-4 weeks 1.6742e-4 months . These are due to some CRD survillance tests which were run at that time.

2.1 Calibration and Operation All tranducers used in the system were tested prior to u'se to assure adequate performance. The gain of the signal generating and receiving equipment is adjusted to provide an adequate signal output from the least responsive trans-ducer.

The minimum acceptable signal for reflection from the water interface is adjusted for 80% full scale output on the CRT display.

The gating device is set to pass any signal with an amplitude more than approximately 20% of full scale so as to provide an adequate margin of sensitivity.

The time scale on the CRT is adjusted to read the depth of the water in the header in terms of horizontal divisions on the CRT screen.

As shown in Figure 4, a total of ten horizontal divisions are used on the CRT display. The sweep time and the horizontal centering of the CRT are adjusted so that the sixth division on the screen corresponds to a water depth of 6 inches while the first division on the screen corresponds to a water depth of one inch.

Thus, the CRT displays witer depth directly.

If no water is present, only the echo from the f.d. of the pipe is displayed on the CRT screen at a position below the one inch mark.

6

T Initial system calibration and later checkir.g of the calibration is done by use of standard pipes filled with known amounts of water. Once per shift, a level two QC inspector takes a reading from a standard containing 2 inches of water and from a standard containing 6 inches of water.

This is done by disconnecting the cable from th transducers on the headers and connecting it to hand-held transducer which is hel,d against the bottom of the standard sample pipes.

If the reading on the CRT and the recorder does not agree with the known depth of water in the standard pipes., the gain and amplitude of the UT instrument are adjusted to recalibrate the system.

At this time, all transducers are functinally checked by examining the CRT display for indica-tions of transducer deterioration.

The two 'IT instruments on Unit 3 are physically located at the ends of the rows of HCds, one on the East side and'one on the West side. On Units 1 and 2, the UT instruments are located on a mezzanine level above the HCU level approximately midway between the two sides.

Browns Ferry has an auxiliary operator on each shift who observes the UT system recorder strip chart for each unit every 30 minutes.

The operator is not qualified or required to monitor the CRT output.

His sole responsibility is to monitor the strip chart recorder and the alarm.

The calibration and operability of each UT device and each transducer is checked once per sh1ft by a level two QC inspector trained in the use of UT equipment. Communication with the control room concerning SDV water accumulation is by a hand held wal kie-tal kie.

As mentioned earlier, a separate UT transducer, CRT and recorder is provided for each side on Unit 3, while Units 1 and 2 each have a single UT, CRT and recorder to monitor both the East and West SDV header transducers.

Thus for

-Units 1 and 2, since the recorder tracks the first returning pulse for a water level greater than one inch, it is necessary to disconnect one lead at a time to determine separate SDV water levels.

If water is detected, a level two QC inspector must be called to verify the readings.

7

2.2 Operating Procedures Procedures have been written for the control room operator to respond to the presence of water in the SDV as detected by the UT system.

If the water level

~

reading in the SDV is less than 1-1/2 inches, procedures call for an operator to:

(1) visually verify that the SDV vent and drain valves are open; (2) check for leaks in the scram discharge valves by observing CRD temperature probe outputs and by touching the HCU discharge risers; and (3) request QA verification of the UT reading.

If the water level reading is between 1-1/2 and 2 inches, procedures call for the control room operator to:

(1) immediately request QA to dispatch a level two QC inspector to verify the reading; and (2) unless the QC inspector deter-mines that the water level is less than 1-1/2 inches, begin an orderly shutdown within one hour.

If water level exceeds 2 inches, procedures call for the control room operator to immediately begin an orderly shutdown without verifying the UT reading.

Plant personnel estimate that a level two QC inspector can reach the area of the UT device within approximately three minutes of being notified. At least one level two QC inspector is available for this duty at Browns Ferry during each shift.

2.3 Other Leakage Detection Capabilities Leakage of water through a scram outlet valve to the SDV is recognized as one of the ways for water to reach the SDV.

This leakage may be detectable by means other than the UT system or SIV instrumentation.

Flow out of a scram outlet valve would change the flow of the CR0 cooling water through the CRD seals so as to increase the water temperature at the location of. the CRD temperature probe.

At this time, no good data is available to correlate CRD temperature with scram outlet valve leakage.

In particular,

~' -

8

o the rate of temperature change ft.r a given leakage is unknown.

However, for the leakage rates postulated in this section, it is reasonable to assume that the temperature probe alarm set point would be reached within a relatively short time; on the order of a few minutes.

Although the CR0 temperature probe alarms in the control room, not all 185 CRD temperature probes are read simultaneously. A sequential scan is used and it is estimated by GE that the cycle time to read all temperature probes is approximately six minutes.

Another means of inferring scram outlet valve leakage is the observation of control rod drift.

Leakage past the scram valve'in excess of the CRD seal leakage would cause the associated control rod to begin to drift into the core.

A rod drif t alarm is available in the control room.

Another indication of scram outlet valve leakage is movement of the scram outlet valve stem sufficient to actuate the scram valve position indication switches.

This requires a stem movement of approximately 1/32", out of a total valve stroke of approximately 3/16".

Actuation of the stem mounted switch will light the associated scram outlet valve position indication light in the control room.

One means by which the scram outlet valves can open sufficiently to leak is degraded air pressure in the HCU air header.

A low pressure alarm is provided to alert the operator at approximately 70 psia. The actual pressure reading on the HCU header is available locally in the area of the HCus.

2.4 Procedures for loss of Control Air The procedures at Browns Ferry for loss of control air were modified in response to IE Bulletin 80-17, Supplement 3, to protect against scram valve leakage on gradual loss of control air.

The details of the concern for loss of control air are discussed in the AEOD memorandum of August 18,1980.(2)

At Browns Ferry, centrol room indication of the air pressure in the HCU air header is limited to a single alarm with a setpoint at 70 psia.

A local air 9

pressure guage is available at the HCus.

Normally air pressure is maintained between 70 and 75 psia.

Since only a slight degradation of air pressure initiates the alarm, the licensee considers it undesirable to initiate a scram

~

based on this alarm alone. Upon receipt of the 70 psia alarm, ocedures call for the control room operator to dispatch an auxiliary unit operator to read

\\

the local air pressure gauge.

Plant operations personnel at Browns-Ferry have told the NRC resident inspector that an operator will be dispatched to read the local pressure guage no later than 2 minutes after receipt of the 70 psia alarm.

If air pressure in the HCU air header is found to be 60 psia or less, the auxiliary operator informs the control room operator. The control room operator then initiates a manual scram. Communication between the auxiliary and control room operators is maintained via walkie-talkie.

N' In addition to the above procedure for gradual loss of air to the HC0 air header, other procedures have been implemented in response to IE Bulletin 80-17, Supplement 3.

These call for manual scram initiation in the event of:

(1) multiple rod drift-in alarm::; or (2) a marked change in the number of control rods with high temperature probe alarms, 2.5 Procedures for Standby Liquid Control Initiation Bulletin 80-17, Supplement 1, requested that operating procedures be revised to provide clear guidance to the control room operator regarding initiation of the standby liquid control system (SBLC) following a failure of control rods to fully insert.

At Browns Ferry, mandatory SBLC system actuation is required by operating procedure if either of the following conditions exist:

(1) five or more adjacent rods are not inserted below 06 position and either reactor water level cannot be maintained or suppression poo' water temperature limit of 110 F is reached; or (2) thirty or more rods are not inserted below 06 position and either reactor water level cannot be maintained or suppression j

pool water temperature of 110 F is reached.

10

~.

3.

ANALYSIS AND EVALUATION For purposes of analysis and evaluation of the Browns Ferry failure to scram event, an effort was made by AE00 to identify water sources that could fill the 50V. The AE00 report of August 1980, identified the following sources of water:

1) water lef t from a previous scram; 2) purge line inflow; 3) water or steam backing up frcm the clean radwaste drain system; and 4) inflows through the scram discharge valves.

It is recognized that this list of water sources may not be complete. However, at this time, neither operating experience nor design review has revealed any other sources.

As discussed in Section 2 of this report, the current capability at Browns Ferry to detect and respond to accumulation of water in the SOV is based on the following elements: previously installed SIV instrumentation; recently installed UT instrumentation; other previously installed instrumentation such

as CRD temperature probes, CRD drift alarms, control air flow pressure alarm, etc; and operating procedures for response to the aforementioned instrumenta-tion.

The response of the interim system at Browns Ferry is dependent on both the instrument capability and the operator response.

Both aspects are addressed in this analysis and evaluation.

i The original design, as understood prior to analysis of the Browns Ferry event, was thought to have provided continuous, redundant, safety grade and automatic protection which was functional for all water sources.

It was thought to also fail safe on loss of HCU control air pressure.

However, the analysis of the Browns Ferry event showed that this system did not work for all situations of water accumulation.

Accordingly, the original system was supplemented with a functional UT system.

This interim system is neither continuous, redundant, safety grade, nor automatic for many cases.

Further-more, its capability may be inadequate for a loss of control air pressure.

That is, the interim system does not provide the same 'evel of protection as was perceived of the original design.

11

At this point, a short discussion of the capability and reliability of the UT system will be presented.

As stated in Section 2, the UT system includes a CRT display of the return echo.

This is shown in Figure 4.

As stated earlier, an echo is received from the i.d. of the pipe and is displayed on the CRT as the left most peak. The presence of this so-called " reference pulse" is interpreted by the inspector performing the calibration as verification of the operability of the transducer which is being monitored.

The calibration technique also requires that the UT system be connected to a separate trans-ducer to detect a known depth of water in a standard pipe.

These surveillance and calibration procedures are performed once each shift by a level two QC inspector who has extensive training in UT techniques. We believe that because of the presence of the " reference pulse" and the high level of training of the level two QC personnel who performed the surveillance and calibration of this instrument, any degradation of the operation of the UT system due to heat, vibration, radiation or other failure mode would be discovered during the scheduled surveillance.

It is recognized that during the period of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months between surveillance of the UT system, it would be possible for equipment failure to go undetected.

However, because of the unlikelihood of a rapid water inflow with an accompanying need to scram occurring during the same

~

period of the equipment failure (except for the degraded air case), this surveillance interval is judged to be adequate.

lhe following analysis and evaluation addresses the capability of the interim system to detect and respond to water from various postulated sources.

3.1 Water From the Previous Scram Water left from the previous scram after scram reset will be detected by the ultrasonic system.

Because of the time required between a scram and startup operations, a number of ultrasonic readings and equipment calibrations would normally take place during the shutdown.

For this situation, rapid detection is.not required and no immediate action is needed if water is detected.

Startup would simply be delayed until it was assured that the situation was corrected and no. water remained in the SDV.

12

3.2 Purge Line Inflow Purge line inflows would be detected in time depending on the rate of inflow and the time of purging.

Purging of the SDV is an operation which is per-formed when the reactor is shutdown in order to reduce accumulations of radio-activity in the SDV and its associated piping. The ultrasonic system would be used to check for the presence of water prior to startup.

Enough time would be available during the plant shutdown for the operator action required to detect and remove all water from the SDV prior to startup.

s An administrative or operator error, which allowed purging during normal operation, could provide a flow rate of water into the SDV which might not be detected soon enough by either the interim system or the original system.

However, the likelihood of a properly informed operator performing this unprecedented action is remote.

3.3 Water or Steam From the Drain System Water backing up from the clean radwaste (CRW) drain system would most probably be detected by the SIV instrumentation of the original design. An exception to this would be a SIV drain line blockage which could prevent flow from the CRW drain system into the SIV but would allow flow up through the SDV vent lines to fill the SDV.

However, at Browns Ferry, positive vent paths to atmosphere have been provided on the SDV vents.

Any water backing up in the vent line would be released via this path rather than to fill the SDV unless the backflow rate wa< high due to a large water release to tre drain system.

Operating experience at Browns Ferry to date has shown that water backing up from the CRW drain system has actuated level switches in the SIV.

Low pressure steam backing up from the CRW drain system due to flashing hot water in the drain pipe would not be detected by the SIV instrumentation.

If the drain line between the SDV and SIV became plugged by the slow drain of condensed vapor mixed with rust, the steam backing up through the SDV vent lines would slowly fill the SDV with condensed vapor.

The positive vent paths 13

to atmosphere would vent.a portion of the low pressure steam but would not prevent the SDV from filling with condensate.

Operating experience at Browns Ferry Unit I has shown that flashing hot water can appear in the drain pipe from valve leakoff connections or other sources.

Therefore, the ultrasonic system must be used to monitor this situation and the surveillance interval must be short enough to assure timely discove"y during a large hot water release.

Thus, with respect to the three identified sources of water listed above, we believe that the UT system provides adequate interim assurance that water can be detected and actions taken before the plant reaches a condition where the SDV is filled and a scram is required.

It appears that this would be true with a surveillance interval longer than the 30 minutes currently used at Browns Ferry provided that surveillance was performed prior to any start-up. However, if protection for currently unidentified water sources and flow rates is to be provided, continuous monitoring of the UT system in the control room would be preferable to the current 30 minute surveillance interval. This would allow for a more rapid control room operator response. As an intermediate method (between continuous monitoring and lengthy surveillance intervals) for providing response to unidentified water sources and rates, an alarm output of the UT device could be provided in the control room. This would allow more timely operator response without the complexity of locating the complete UT system cutput in the control room. Upon receipt of the sustained alarm, an auxiliary operator could be dis-patched to the UT readout located by the HCus. We believe this approach would also provide adequate protection for unidentified water sources and flow rates.

3.4 Sincle Scram Outlet valve Leakace To evaluate the adequacy of the interim system for various leak rates from the scram outlet valves, it is necessary to identify the causes of leakage.

First, it should be noted that scram valve leakage during normal cperation is quite low.

At. Browns Ferry Unit 3, tests following the June 28, 1980 event indicated an aggregate leakage of from 0 to 3 gallons per hour.

14 l-

Discussions with GE on the leakage characteristics of the scram outlet valves indicate that any leakage is likely to cause degradation of the valve seats and could lead fairly rapidly to greater leakage. Rapid deterioration of the seating surface of one valve would result in obvious problems with the associated control rod drive but would not affect others.

One aspect of the scram outlet valve leakage problem that must be addressed is the difference in character between a leak arising from a single valve failure and that which could arise from a common mode failure leakage of many valves.

With respect to a single valve failure, the maximum inflow of water into the SDV is limited by leakage past the CRD seals. GE has estimated that with the CRD seals completely destroyed, a leak rate of 10 to 12 gpm into the SDV is the maximum that could occur. This is the rate if the flow is completely un-restricted by the scram outlet valve.

If the scram valve is only partially open or leaking, the flow rate would be less.

If the CRD seals are intact, leakage would be expected to be in the range of 1 to 5 gpm.

Thus, a single failure of a scram valve results in only a limited flow into the SDV which would drain out with no accumulation for the current SDV drainage characteristics.(1)

~

Indications of scram valve leakage would be available to the operator. The CRD temperature probe alarm would be actuated.

If the scram outlet valve leakage is greater than the corresponding CRD seal leakage for a pressure differential across the piston of approximately 550 psig, the rod would move into the core.

When assessing the probability of an event that could cause problems for the SDV, it must be recognized that the probability of a simultaneous failure of more than one scram outlet valve at a given time is very low.

Multiple valve failures would have to occur simultaneously before the drainage capabilities of the current system would be challanged. Because of (1) the icw probability of this event, (2) the likelihood of early detection by rod drif t alarm or CRD temperature. probe alarm, and (3) because the event does not cause an accompanying plant disturbance, this postulated event is not considered to be a serious concern for the interim period.

The interim precautions should be adequate to ~~-

protect against failures of this type.

15 l

l l

t 3.5 Multiple Scram Outlet Valve Leakage from a Common Cause Multiple scram outlet valve leakage due to a common cause can raise serious concerns about the ability to scram the plant successfully.

To date, the only plausible common cause which leads to substantial leakage of a large number of scram outlet valves is degraded air pressure in the control air header for the HCus.

Loss of air pressure in the control air header has occurred due to a variety of reasons such as failure of an air compressor, improper valve a!ignment, clogging of filters and dryers, and severance of an air line.

As air pressure in the header decays, the scram outlet valves, which are held closed by air pressure, begin to open.

Although the exact pressure at which a given valve begins to open depends on manufacturing tolerances, the pressure for a group of valves is in tne range of about 40 to 45 psia.

Information from GE indicates that a leakage flow of from 1 to 5 gpm out of a scram outlet valve for a given drive could occur without producing rod motion.

The actual value for a given drive would depend on the condition of the seals in that particular drive.

GE has stated that for a typical reac' tor, if the scram discharge valve flow rate to produce rod motion for each individual CRD was averaged with the scram discharge valve flow rate to produce rod motion of all other CRDs, the average would be in the range of 2 to 3 gpm.

With this information it can be postulated that a degraded control air pressure condition could exist for which leakage from a large nu.mber of scram outlet valves could exist without producing a scram, In fact, depending on the number of scram valves which partially open and the leakage rate of these valves, it would be possible to generate a significant flow of water into the SDV without producing significant rod motion.

It is recognized that the possibility of the actual occurrence of high flow rates without rod insertion depends on three factors:

(1) the control air pressure degradation pattern, (2) the range of air pressure over which the scram outlet valves oper., and (3) the seal leakage rate of the CRD associated with each particular scram outlet valve. However, with the data given above, a flow rate in the range of 1 to 16

2 gpm per drive without significant rod insertion could be possible for certain degraded air pressure scenerios.

3.6 Degraded Control Air Assuming an average leak rate that could be generated without significant rod motion (given a specific degraded air pressure) of 2 gpm per CRD, a total of 2 x 185 or 370 gpm flow into the SDV would occur.

Although this large flow rate appears feasible within the characteristics of the system, lower rates of leakage to the SDV could also be generated by the same mechanism, and indeed are more probable. These are discussed below in a framework of average steady-state flow rates.

It is recognized that an actual air system failure would likely lead to continuously changing leakage rates, but the air pressure degradation might level off and thereby stabilize the leakage rate at any point.

For purposes of evaluation, inflow rates into the SDV can be separated into those for the East SDV header and those for the West SDV' header.

Test data show that for Browns Ferry Unit 3 the average drain rate of the East SDV header is normally about 12 gpm with its vent and drain valves open.

Thus, any steady state in-leakage of less than 12 gpm would not result in water accumulation in the East header unic:: the East side drain line were blocked.

Similarly, test data show that the average drain rate of the West SDV header, with its vent and drain valves open is normally about 24 gpm. Thus, any steady-state in-leakage of less than 24 gpm would not result in water accumu-lation in the West header unless the West side drain line were blocked.

Test data also show that the average drain rate of the SIV, with the vent and drain lines and valves functioning normally, is about 35 gpm.

To a first approximation, from the above test data and assumptions, the following general statements can be made:

1)

For a steady-state in-leakage below approximately 12 gpm per side, no water accumulation would occur, no water measurement with UT is required, and no operator action is necessary.

P

o 2)

For a steady-state in-leakage between approximately 12 and 24 gpm per side, water would accumulate on the East side.

As an example, for a steady state flow rate of 24 gpm into each header, the West side would remain empty and the East side would fill within approximately 25 minutes.

The current 30-minute surveillance interval at Browns Ferry using the UT system might not detect this accumulation before filling of the East side. Also, because the SIV drain rate is greater than the inflow rate from both the SDV sides to the SIV, the 50 gallons scram level switch would probably not activate.

However, the 3 gallon and perhaps the 25 gallon level switches might be activated.

This level of inleakage could result in a scenario similar to the Browns ferry event where the West side rods scrammed successfully but the East side rods did not.

3)

For a steady-state in-leakage above approximately 24 gpm per side, water would accumulate in both the East and West side SDVs. As an example, for a steady state flow rate of 36 gpm into each header, the East header would fill within approximately 12-1/2 minutes and the West header within approximately 25 minutes.

The current 30-minute surveillance interval at Browns Ferry using the UT system might not detect this accumulation before filling both the East and West sides.

For this case, the SIV 50 gallon level switches would probably activate somewhere between 12-1/2 and 25 minutes and initiate an automatic scram.

However, the scram capability would be limited on both the East side and the West side due to the previous water accumulation.

4)

For in-leakage at very high rates (approaching 150 gpm per side) water would accumulate in both the East and West side SDVs.

Each side would fill within 3 minutes and probably before sufficient water could flow to the SIV to activate the automatic scram switches at the 50 gallon level.

The current 30-minute surveillance interval at Browns Ferry using UT would not detect this accumulation before a probable loss of scram capa-l Dility.

Proper cperator action would probably be required within less l

than 2 minutes following the initiation of this scram valve leakage rate to avoid reaching a point where it would become impossible to scram.

~

18 l

In summery, the above analysis adresses conditions of degraded pressure in the HCU control air header which can lead to aggregate leakage rates to the 50V in the range of 24 to 300 gpm.

Flow rates at the high end range probably produce at least some rod motion and perhaps some rods might fully insert. However, at this time there is no assurance either by analysis or testing that a range of leakage rates does not exist which could fill the 50V quickly with insufficient indication to the operator or time for manual scram before tha ability to scram is lost.

The above discussion of the scram system behavior is for different but constant flow rates.

This would probably not be the case for an actual degraded control air event.

The scram valve flow rate would likely pass through the different regimes as discussed above and the characteristics of a particular flow rate would apply at that time.

However, analysis or test results for a variable flow rate, which show acceptable system behavior, do not exist at this time.

Thus, inadequate basis is available to justify disregarding these concerns.

~

A degraded air supply can also affect the performance of the SDV vent and the SIV drain valves.

Tests done at Browns Ferry show that the SOV vent and the SIV drain valves begin to close at a control air system pressure of about 17 psig.

Thus, the drain and vent valves will remain open during the type of degraded air condition that might lead to ioss of scram capability.

It should be noted that the time available for operator action to respond to a degraded air condition can be separated conceptually into two phases:

(1) time available before air pressure degrades from the normal alarm set-point of 70 psig to the pressure at which scram discharge valves leakage begins (about 45 psig) and (2) time available following the beginning of scram discharge valve leakage to the time where the SDV fills to the l

point where a scram is no longer possible.

The analysis shows that the time available for operator action following the beginning of scram discharge valve leakage can be as little as 2 minutes.

Because of the" -- ~-

19 i

short time available for operator action following initiation of scram discharge valve leakage, operator action should be taken prior to reaching a degraded or lost scram capability.

Because HCU control air degradation preceeds opening of the scram discharge valves, added time would be available if operator action were based on air pressure indications.

For a rapid air pressure degradation which stabalized at a point where large scram discharge valve leakage occurred, the benefits of operator action based on air pressure indication would be diminished.

From the standpoint of improved assurance of a successful scram during a degraded HCU control air event, however it is preferrable to scram on the indications of degraded air pressure than on the UT system.' This would be true even if UT readout were continuous in the control room.

The UT system (on indica-tion of water in the scram discharge volume) to initiate a manual scram for the degraded HCU control air event does not provide sufficient assurance that adequate time will be available for the required operator diagnosis and action.

The same can be said for reliance on CR0 temperature probes,'

rod drift alarms, and scram outlet valve indicator lights.

IE Supplement 3 to Bulletin 80-17 requires an immediate manual scram on low HCU control in pressure at a minimum pressure of 10 psi above the opening pressure of the scram outlet valves.

This provides additional time for operator diagnosis and action prior to possible filling of the SDV following receipt of the low pressure alarm.

However, because of the lack of any control room indication of HCU control air pressure (except the low pressure alarm at 70 psig) current procedures at Browns Ferry require an operator to be sent to the HCUs to read a local HCU air pres-sure gauge.

This local operator then reports back the local reading to the control room by walkie talkie. Given the rapidity of the water inflow possible with the degraded air pressure condition, we judge this arrangement to be inadequate. We believe that the rapid operator response required by a degraded air system condition ncessitates that adequate alarms and instrumentation be available in the control room.

However, because the present alarm is not safety grade and is a single channel, we l

20

believe that reliance on the alarm alone to initiate a manual scram is not adequate.

Short of installing safety grade instrumentation for this function, we believe that adequate instrumentation could be provided by redundant pressure indication in the control room along with a distinctive alarm on degraded air pressure.

Furthermore, since the instrumentation is not qualified to function during certain postulated events (e.g.

earthquakes), procedures which require immediate manual scrams for such events should be considered.

It is our judgment that if the upgraded instrumentation and procedural changes discussed above are provided, then the system will be adequatesto respond to degraded HCU control air for the interim period.

We believe that this analysis supports the position that a scram on degraded HCU control air is sufficient to respond to the complete range of aggregate leakage rates arising from degraded HCV control air pressure as enumerated earlier in this section.

This judgement is based on Q) the additional time available before any discharge valve leakage begins and (2) the relatively low probability of a rapid air pressure degradation which stabilizes in the range of serious scram outlet valve leakage.

,a 3.7 Operating Experience With Degraded Control Air Supply An effort was made to look at reactor operating experience relative to scrams caused by the consequences of a degraded control air supply. By looking through the Annual Report on Nuclear Power Plant Operating Experience (3-6) for the years 1974-78, a total of 21 events were found for BWRs where the description of the event mentioned a loss of control air as the initiating event leading to the scram.

The dates of these events are listed in Table 1.

Because of the brevity of the descriptions and the lack of records available to make a more careful study of each event, it is probable that not all of'the 21

o events describe a loss of control air which would or could affect the HCOs.

On the other hand, some of the events seemed to be very close' descriptively to the type of rod behavior that would be expected given a loss of control air to the HCUs.

For example, one event description mentioned massive rod drift.

Another event generated an automatic scram due to high level in-the SIV.

This event occurred at Browns Ferry Unit 1 on November 24, 1976. Because of the known drain characteristics at the Browns Ferry units, it is likely that during this event the SDV was at least partially filled.

Because the 50V is designed to provide approximately 3.3 gallons per drive free volume, and a typical scram requires less than one gallon per drive, enough volume was available for a successful scram.

However, there is no doubt that the volume margin was reduced. An air degradation of a slightly different character could have lead to a water filled SDV and inability to scram.

An effort was made by AE00 to find data that would indicate filling of the SDV during some of these events.

From the event at Browns Ferry 3 on June 28,1980,one bit of evidence that leads to the conclusion that water 'was in the SDV prior to the first attempted scram was that the SIV high level scram switches were activated more quickly than expected during a manual scram (18 seconds vs. 45 seconds).

This is because for a full SDV, water entering the SDV during the scram will more quickly pressurize the SDV and force water through the drain line to the SIV than if the SDV were not pressurized.

For events where an event recorder output was available, no such change was Inoted.

However, most events had no data frov an event recorder available and no other way of recalling this data.

In general, this search for operating experience data was unsuccessful. On the other hand, the argument that because a plant has successfully scrammed 21 times during degraded control air events does not provide a large statistical j

basis on which to judge the adequacy of the scram system (machine and man) for responding to such events.

From the observation of 20 successful scrams in 20 l

scram attempts, one can conclude that the 95% upper (one sided) conf;dence l

limit for the probability of a scram failure is approximately 3/20 =.15.-

22

Alternatively, the 95% lower (one sided) confidence limit for the probability of successful scram is approximately 1 - 3/20 =.85.

Both confidence limits are computed on the assumption of a common probability of a scram attempt

~

failing and the assumption of statistical independence of scram attempts.

These assumptions have been made for mathematical convenience; they are not necessarily plausible.

In fact, there is no doubt that the list of successful scrams includes some events where the HCU control air header system was not affected. These would not be included in a list developed through a closer investigation of the event which would disclose that fact.

A lower number of successful scrams, due to legitimate control air, degradation, even if all are successes, only detracts from the merits of the argument which claims that since no scram failures have occurred to date, the system is adequate.

l i

I 23 f

l l

4.

FINDINGS

~

Based on the system description and evaluation discussed in Sections 2. and 3.

of this report, a number of findings have been determined.

Again, it should be emphasized that these are based on Browns Ferry only.

The present system (ultrsonic level instrumentation, existing SIV instru-e mentation, and special operating procedures, etc.) should be capable of providing adequate protection during the interim against filling of the SDV due to all identified water sources except for those related to scram discharge valve leakage due to degraded HCU control air pressure.

e Degraded HCU control air pressure could result in scram outlet valve leakage to the SDV which would require operator action to manually scram the plant within a few minutes before scram capability would be completely lost.

This event would likely be accompanied by a plant disturbance requiring a scram due to other control air related disruptions in the plant.

Such an event would be accompanied by numerous control room alarms and indications which could distract the operator from a prompt manual scram actuation.

e Operating experience indicates that a significant number of reactor scrams attributed to loss of HCU control air pressure have occurred.

These provide evidence that rapid filling of the SDV is a credible event.

l

5.

RECOMMENDATIONS The principal recommendations of the study are as follows:

e An immediate manual scram should be required based on control room indi-cation of degraded HCU control air pressure.

Review of licensee proposals should include consideration of the available pressure indications and procedures to assure that other alarms and indications do not divert operator attention from this priority action.

s e

Redundant HCU air header pressure instrumentation should be provided in 4

the control room. A distinctive alarm for degraded air pressure should be provided to aid the operator in quickly focusing his attention on the need for protective action.

e Because of the possibility that a currently unidentified water source could result in water accumulation in the SDV, it would be prudent to monitor the ultrasonic system alarm output in the control room and require

~

an immediate verification of a sustained alarm by operator dispatch to the equipment. Operability and calibration checks of the system should be continued on a schedule of once per shift.

25

6.

CONCLUSIONS AEOD has reviewed the interim surveillance system at Browns Ferry used to detect the presence of water in the 50V.

The AEOD assessment considers the procedures and equipment changes initiated in response to IE Bulletin 80-17 with Supplements, 1, 2, and 3 to be adequate for continued interim operation of the Browns Ferry Nuclear Plant, if the recommendations of this report for response to degraded control air pressure are implemented.

As of the date of this report, the instrumentation and procedures in place to respond to the loss of control air scenario at Browns Ferry are judged to be inadequate.

For this event the operator must respond promptly to a single in-distinctive alarm for loss of control air pressure during a period when numerous alarms may be occurring.

Additionally, the operator must take actions outside the control room in a very limited time frame because he lacks a pressure readout in the control room.

IE is currently taking steps to upgrade the procedure for response to the degraded control air pressure event.

In the past, operator action to perform a vital safety function within less than 10 minutes has not been considered acceptable by the NRC.

However, pro-viding the operator with both a distinctive low pressure alarm and reliable air pressure instrumentation in the control room, would help assure adequate operator response within the required time period.

Such an arrangement should be acceptable for the interim.

A dedicated operator with adequate alarms and instrumentation in the control room could provide even greater assurance of a timely manual scram.

If the provisions made to accomplish a manual scram are found to be untimely or inadeqiate, provisions should be made for an automatic scram on low HCU control air pressure.

For the long-term, the scram system should be upgraded according to the recom-mendations of the AE00 report of July 30, 1980.

However, tne consequences of degraded air pressure in the HCU air headers were not fully recognized at the time of that report and were not directly addressed.

Although the recommended scram system modifications may be sufficient to enable the scram system to 26

l e

respond to rapid inflows of water from the scram outlet valves due to degraded HCU air header pressure, design review of the long-term modifications should include specific consideration of the effects of degraded air pressure.

~

s e

e 27

l l

REFERENCES t

i 1.

AE00 MEMO (Michelson) to NRR (Denton) dated August 1, 1980 with enclosures.

2.

AE00 MEMO (Michelson) to NRR (Denton) dated August 18, 1980.

l t

3.

USNRC NUREG-0227 dated April 1977.

l A

4.

USNRC NUREG-0366 dated December 1977.

l t

l 5.

USNRC NUREG-0483 dated Februan> 1979.

l 1

k~

6.

USNRC NUREG-0618 dated December 1979.

?

i

\\

\\*

i 4

e i

I 28 t

e

,a

. _ _ _ -.y 9

y

__.,..y.,

v_.

y

e Table 1 Scrams Attributed to Loss of Air (1974-1978)

Browns Ferry 1:

8/1/74, 10/19/76, 11/24/76, 8/15/78, 8/18/78 Browns ferry 2:

8/18/78 Brunswick 2:

4/5/77 Dresden 2:

9/7/77, 7/23/78 Dresden 3:

8/15/74 Ouane Arnold:

1/9/73 s

Hatch 1:

3/4/76 Millstone 1:

8/6/77. 5/29/78 Nine Mile Point 1: 12/21/74 Pilgrim:

1/19/76 Quad Cities 1:

1/3/77, 4/30/78 Quad Cities 2:

7/1/74, 8/31/74, 10/25/77 O

ammer 29

d g

NO s. 's \\*\\

s-s*

i

... -.. :,,- y_-

3 n-gi

' ='Tg t

p:

s

,. w e

n^?

m

~

1\\m];

/

z N

3 3

i' h,

i f'

=>

N, p ).

i.

i;i. -

k 9

I

r ;.

l 7

3 l-

.. r.

ua.i 9

Il i

i.

l 3 -

i

}

Il i

'I s

5 l)^

l.

i.

r.

'\\

/

8 9,

s

/

'I,-

i -

l1

/

@r;.

l I

i

'i g l I

I e

J I 1

--J, i-3 j

/

1.

. I ' '.

b tcp/,.

..5ACSDOCEL +1

i. OcmT O

1

r i

V Ei.Ticat 400 Di.

l' \\/EC i' 9 t P E.

~, !.il 2

V O E 6 0 E C (co uti. ucos U %. roc.iOG)

',.(.j!l

.2 A b l \\ E* A bE 2. SI' A c is (, M< C W E Clo o)

' (j.,,

3W (o ' H F AbG V. Tacu T uus.nu.,,o a-Ro e,Tn t,

s',

2.

D C. A t O i$

h H o R i t ovf A t. (2.0... O F j,

e l=. v r Pi o.r-l

.[N..O.

7 4/ w ano e c ( t ev n a uo

. m e o.ro e. *a c.)

4.

7g 6

DE A DE G. MM E, (.u c t a n ::. R v 4

'". T *.i.

,1gc;

(, ' m o c e T a u.o.

c u. m.,,. g, y.,a c,.;r,.

)D 2

D C' A i o a

))

M

\\/ot.o m t. T AiO d-D C 'M *J

.m.

1:st, '

I'"ir.'-

?h.

Figure i Unit 3 I""6icer Location

~ ~ ~ ~

* ~. * ~ ~

9.:.

I U OI. I 14 n_

\\

..g l:-

I58 i.

'-t f

/

. q.,&. '

e t v

r

\\,

gg l*j EA l

\\

15 I

l s

. v J.j',]. '

I

/

'N-

"lp s.

t

\\

i u.

a a/.'

/

i d,G.

t.A.;i

,,L 5 i..$.'

l i

i 4

9.,9.,

g J

'i 1

./

I 8

e i

I.

i I

.'s

. lh,p%,,.i..

N.

/

typ i ft.

g I

i t

e

_e y,7',j,

.. )

i s.gt, r P A O *5 D U Cli D *ti.

L o q g 7 i c. g N

Y M E6 O EsL* (( CuTIw0 00 r, rnoo:To o %..

NA

' V N F A o (I c. '5 Pth e (,,a,, g g,~

15 6' uE 4 ose ( e.ooris.o x., %,7cc,,'.[

t' I54 6' H E Ace.o D A 2.t (E.o c A & g, G.

., s.,.

t,s..,

t I

5,.Gi.

n

}q t:,.

M

!'.D!-

0 l

*I.,

!.J.

t Figure 2 Unit 1 Transducer Location i

J.*

N Nolil H

..~.

f_

~,

pu

\\

.d,..h!,i

_J l b Ih

_1

/,'

lI g.c A I ~i 31 N,

l

/

s

'd,/

'\\

m\\

N

's 1

i s

Ij l

e.'^

q.

s

- (-'.. ~

, h,Q:,

Il s

i t

5-I g

n 1

'3 U,. : t

/

t, i

')'

l ;

~~~~

l 1

i

/

c..

x l

tw, i.

$,.fi. i.;i,l.,.: I..

\\

/.

e

.\\

/

l.'

A '*

t s

~

II

. s

' s._J w_) i

..,) ;,

u_

./

.1

r T.,f TMC'.20',cEE 5 i.. O c A T i c.

J.>

.T t

lL b

H L16 c E.C. ( Lo..n s uo c. :,.

'f,E I26

( " O E A D E 4. ' M'^ c. e. (,0.,.

~

t i I.j

(;" R E. A DE ;>. (c.oe r i % -

~

?

1 A

6 " H E W o ri c. -$p A e_ E. (..--

3. '

s.

t. j,'.,

..i i..

.I

.t,.

r t

t i

l Figure 3 Unit 2 Transducer Location

~

5,' '"

1, rill.SE-P.C1) TECH: 10Ur.

? 't

,. ?

1 ',

,, 3 e.

-g

' i t/

j :;.;'

3 D

3 y

2 I"Ch28 Of UCC"E

.. l Y l',,

p v

-~

wi m

v tf'. r...,

.c n

~

t, y0., -

t.

-I n

v n

v y

.8 p I

,,. :. )

e n

J e

n-

.?.,,.L.d..

i

^

O l r,,

..g.

^

}'i:!{ld)?9 u -

l

^

o i

n g

i tp'i i

.W

," th..

n

, C' '4*..

)

.}-

....-,..._.,n,,-

^

Tuba Wel,l w

g ; i.

v g----

p..;.

.n,

4+

L

(*,*

15

'j s

.l'.l.l) i

A C

's L,.y e d i'

CATUCDE RAY DJBE PRESD:TATIO t h-

[ p,,

Iuitial Pulse of Transducer

/

l'.8s.

t

>~

I d,.}

l

'D bo Vall liultiples (Enterin6)

'N p'iplitur!s A

fJ

-*---Reflection f ren Oppor Surfsco of Vater

.(Sieggf t ',

g{,1 hf1CS$15 8

.gurfpeg)

-Mube Vall thitiplan (tit. icing)

- i.

r

.. I...,. *.

8 s

r

%p)( t 't :.!'hb. ':, * * \\

er -

-Q

f.

,';i'y'.'Mh'! ~. ' i.:

1 2

3 4

3 6

7 8

9 10' il t T.,i

.,u.

i.

Inches of Wa,tsr

/..

Figure 4 Pulse Echo CRT Display

...o r.i,..u

. r.v.;,4 3

~

4.

...l l

l

.~

....m.....s.,,

....,.,.m u- %

g:.,

i

'IEIG.R G SITG-I.3%U$h.'O

. u.~ r:

m--

i '.\\.. pl s ' l,.. f. h. f..h..

.{

I.g-

. u;,U..'d.

J

........L.

i j il 1.-

7/26/t!0

' '. '.,.. ". lig;4 4.

t

.x j. r.

+

'. 4

+ y---f 4

i..

t-4 ;

s ;:

I d

h'

~..,S

'p Pi t u

l _.b#

'. G.;c;'

e.4. b, [..

p.

-t d

.J i

1-... x.

e is

. r.l.. i._

3..j_

- r-M L. g

, y. j.:

t.;. e

,,, g

,.g.g I

.N.

. f:-

m Ml.a.

=---- I I.ns. t..ru.c ti. cc..h, Tu. r..b. u..l.

... t 5 Pe.rfor-d.4 D.urv.e..i. l sf

~

ta.r...:':),g..

.,.1

i r'; T I l3 e.n. t f

.j-I

~I

'7;"

in U.tadors at 0440 '

_.:. gt.

I-

' Dk'3 j'

'. h ici t

3

..L -

' 4 -

OM

,$NN.

l

! i e

.. :.e h

i.-

r

.. l.]

1-s.

l

/-

~'

[* ]--

., a

"" 9 h,.i

. !._.-._p l%

v,..

I-A

,I w

1 s

w.

]

g

-l:.

l j

i L

-l 1..

S j.

-[

1 1:7 d'p[Pph E

l.:1 ;~;

i li

l 7-m'

[

j..

i.

t

- +

j..

s

. l,.

1,1_y ig_..

6 g,

1

_ J 4 hot Bander Drair.e4 at 0255,.i e

. :. +-.

--.s.

i, i

. y 'r.

h,;, ;,.

i n.[;

.i

.m

. oi

_ t.

ii

.~~'

~

_Q F-

]- ),q, g. l..

6.

ss 3 West Essder traised at 0234.

y 't l ( -

' ~.Q :3.:

2 Drain im W at 0123 1%t s

'[T

' 1 Us.it 2 Sc ri's et 0202

.i r

.-9o h1 l

i i

a.

._ A

.,,'-l li j:.I}l_..l..

l-l I

I I

/ \\

I.

o

.C_...i, Figure 5 Strip Chart Recorder Cutput

NUREG-0785 DRAFT SAFETY CONCERHS ASSOCIATED WITH DIPE BREAKS IN THE BWR SCRAM SYSTEM by the 0FFICE FOR ANALYSIS AND EVALUATION OF OPERATIONAL DATA March 1981 Prepared by:

Stuart D. Rubin Lead Reactor S_ystems Enqineer NOTE: This report documents results of studies perfomed by the Office for Analysis and Evaluation of Operational Data. The findings and recommendations contained in this report are provided in support of other onooing NRC activities and do not represent the position or requirements of the responsible program offices of the Nuclear Regulatory Commission.

A*gphf "-

g;eD m

e TABLE OF CONTENTS Pace EXECUTIVE

SUMMARY

i

1. INTRODUCTION............................

1

2. DISCUSSION OF SAFETY CONCERNS................... 3 2.1 B reak Loca tio n......................... 3 2.2 Break Isolation........................ 4 2.3 Break Di scharge Condi tions.................. 6 2.4 Potential Core Consequences.................. 7 2.5 Potential Consequences to the Mitiaation 'Systens....... 8

3. FINDINGS.............................

11

4. RECOMMENDATIONS.........................

21

5. REFERENCES............................

25 List of Fiaures Fiaure 2-1 Fl oor Pl an - 565' El evation.................. 26 2-2 Fl oor Pl a n - 519 ' El evation.................. 27 2-3 Break Outside Coatainment without Isolation (Control Ai r Fail ure).................... 28 Appendices A Risk Assessment B Inspection Report for LaSalle County Station i

l

EXECUTIVE

SUMMARY

Since the Browns Ferry 3 (BF-3) partial failure to scram of June 28, 1980, the scram discharge volume (SDV) subsystem of the BWR scram system has been extensively studied with respect to failure conditions which may cause a loss of scram capability or its protective function. At the same time, while the SDV system has reactor pressure boundary and primary containment boundary functions, little if any review effort has been expended to study the safety concerns associated with postulated pipe break failures within the SDV subsystem.

Prompted by the serious and fundamental findings of deficiency, documented in our original BF-3 event case study investigation, AE00 undertook a more thorough safety review of the adequacy of the scram system design with regard to the reactor coolant boundary and primary containment functions. As a result of this further work, important additional issues and safety concerns have been raised with respect to isolstion capabilities of the scram system and operation of the emergency core cooling systems for SDV pipe break situations.

We have found that, in the event of a SDV system pipe break attendant to a reactor scram, termination of the resultant reactor coolant blowdown outside primary containment would be dependent on successful closure of non-redundant (scram outlet) valves. The closure principle dnd design arrangement of these valves do not meet the important requirements for isolation valves described in GDC 54 and 55 of Appendix A to 10 CFR 50.

Furthennore, while the break isolatier involves a man-machine system, we have found that pctentially less than adequate human factor preparation has been provided, given the importance to safety of isolating a break in the SDV system. Additionally, in the event that break isolation is not achieved, the current plant emergency operatig procedures do not adequately address the potentially concurrent need for maintaining the core covered and protecting against the loss of ECCS equipment due to adverse environmental conditions including flooding.

a I

- ii -

We have found that failure to isolate a SDV system pipe break raises serious concerns regarding the assurance of long-term decay heat removal with emergency core cooling systems since the break itself ootentially threatens operation of this equipment. At the same time, information found from our investigation for the mechanical integrity assurance basis of the SDY system piping indicates that the present level of assurance may not be commensurate with the risks associated with an accidental rupture of this piping.

s In view of the deficiencies found and issues raised, we have recommended several corrective actions which should substantially reduce, although not eliminate, the perceived risks associated with a break in the SDV system piping attendant to a reactor scram.

In view of these perceived risks, we recommend that the regulatory need to postulate such pipe breaks as part of the BWR design basis be determined and standardized. To this end, we would recommend that a two-phase action plan be initiated. The first phase should immediately address and correct the presently inadequate mechanical integrity assurance basis of the SDV system components for operating BWRs. The second phase should incorporate a high priority safety issue review which will address the need to consider such breaks in the design basis and will develop and implement the needed corrective actions on a plant-by-plant basis if it is determined that SDV system breaks are to be included in the plant design basis.

o i

1.

INTRODUCTION Immediately af ter the Browns Ferry partial failure to scram of June 28, 1980, the Office for Analysis and Evaluation of Operational Data (AEOD) initiated an independent investigation of the event, including the Browns Ferry 3 scram system design, operation and opcrating characteristics. The principal focus of this investigation centered on the Browns Ferry 3 (BF-3) scram discharge volume (SDV) system, including its hydraulic operating characteristics important to reactor scram capability and its protective function. The report which documented this review also touched uoon the reactor coolant boundary isolation function of the SDV system. As a result of our independent investigation, AE00 identified several important deficiencies in the system design and hydraulic characteristics which related principally to the SDV system scram capability and protective functions. The serious and fundamental nature of these findings made it apparent to AE00 that less than an adequate system design review and regulatory safety review had been made when the SDV system design was originally developed and proposed for use in operating BWRs. Because of this perception, AEOD made the decision to extend its initial analysis and evaluation of the BF-3 scram system to include a more thorough safety assessment of the reactor coolant boundary and primary containment functions of the SDV system and its appendages.

(1)

In the case study report for the Browns Ferry 3 partial failure to scram event, we addressed deficiencies in the isolation capabilities of the BWR scram discharge volume system. We found that during a reactor scran a single active failure (to close) of an SDV system vent valve or drain valve would result in a blowdown of the reactor coolant system (RCS) outside primary containment. For this event, the RCS blowdown could be terminated only if all of the scram discharge valves could be reclosed. This is normally

s

_2 accomplished f rom the control room by manually resettino the reactor protection system (RPS). However, as described in the BF-3 case study report and further expanded in this report, reclosure of the scram outlet valves may not always be possible. For example, many BWR reactor trip conditions do not readily clear or cannot be bypassed in either the SHUTDOWN or REFUELING mode. These are among many conditions that would normally prevent RPS reset. Thus, a sustained trip condition followino a scram, such as caused by closure of the MSIVs, would normally prevent isolation of an RCS blowdown throuah a stuck open vent or drain valve. Thus it was noted in our report that closure of the scram outlet valves via RPS reset would be blocked by the trip condition itself (which cannot be bypassed in either the SHUTDOWN or REFUELING mode).

Since the time of our case study investigation of the BF-3 event and its cause, we have extended our review to include an assessment of safety concerns associated with single passive failures (i.e., pipe breaks) in the SDV system.

It is postulated that attendant to a reactor scram a break may occur in the SDV systen piping downstream of the scram outlet valves and upstream of the SDV system vent or drain valves. For this break location automatic closure of the vent or drain line isolation valves will not terminate the RCS blowdown since these valves are located downstream of the break location.

In such an event, closure of all scram outlet valves would he the only availrble option to prevent an uncontrolled RCS blowdown outside primary containment.

l l

' 2.

DISCUSSION OF SAFETY CONCERHS 2.1 Break Location When a BWR is not in a scrammed state, the scram valves are held closed by control air pressure and reactor coolant is retained on the upstream side of the closed valves.

In this state, the scram valves perform reactor coolant boundary (RCB) and primary containment isolation (PCI) functions. Downstream of the closed scram outlet valves, the SDV headers are continuously drained (empty), unpressurized (open) and isolated from the RCS. The SDV headers in this state provide a scram capability function in that they prcvide the required free volume for the reactor water exhausted during a scram.

Ilpnn a reactor scram, the scram outlet valves open, the SDV drain and vent valves close and the SDV systen pipina fills and pressurizes as it accepts, contains, and limits the water exhausted from the reactor through the control rod drives (CRDs). Even after the control rods have fully inserted, (with the scram valves left open), reactor coolant continues to flow past the CRD seals, through the scram outlet valves and into the SDV system piping pressurizing it to full reactor pressure. Therefore, durina and imediately following a scram the SDV system becomes the reactor conlant retainina boundary well outside of primary containment. After completion of a scram, therefore, the SDV system having fulfilled its scram capability function, assumes a reactor coolant boundary function and a primary containment isolation, function.

It is during this fully pressurized state of the SDV system that we have examined the potential safety concerns associated with a break in the SDV system piping. The pipe break is costulated to he a high energy break in any size line in the system and initiated by the pressure, temperature and other loadings attendant to the reactor scram but not, necessarily, considered in the mechanical design basis of the SDV system.

j

_d_

2.2 Break Isolation From a system's viewpoint, the blowdown of the postulated break into the reactor building (secondary containment where the SDV system pipino is located) could be terminated via manual control room operator action by initiating group closure of the. scram outlet valves. This action requires the ability to manually reset the RPS (which requires RPS power and an absence of trip conditions) and the availability of control air supply.

However, group closure of the scram outlet valves has not heretofore been defined as a required safety function. Accordingly, the systems (includino control air supply) upon which operation of the scram outlet valves sis dependent have not been desianed to assure reliable closure of these valves. Thus, isolation of a postulated break in the SDV portion of the RCB which lies outside primary containment and downstream of the hydraulic control units (HCUs) cannot presently be reliably assured, at least to the degree inherent in other RCB pipes incorporating qualified isolation valve desions and arrangements. Al though the scram outlet valves incorporate a relatively leak resistant desian, there are numerous disabling conditions consequential to the trip condition or pipe break, as well as numerous disabling single failures in the RPS and control air systems, which could temocrarily or permanently prevent successful reclosure of these valves following a scram. For example, such conditions as (1) a loss of control air pressure for any reason, (2) a trip condition which cannot be bypassed in either the SHUTDOWN or REFUELING mode or (3) a total loss of RPS power supply would prevent group reclosure of the scram outlet valves.

Also, unlike qualified RCB or PCI isolation valves, the scram outlet valves do not incorporate an automatic closure feature. The absence of an auto closure feature is clearly necessitated by the need for a reliable scram function which must not be automatically overridden under any circumstances.

The net effect is that scram valve group closure is a manual operation which must be remotely actuated by the operator from one of the control room consoles.

Even under such circumstances, closure is precluded by a time delay relay for a minimum of ten seconds. This is to prevent the control room operator from interfering with, or prematurely terminating scram insertion of control rods. Thus, isolation of a break in the SDY system piping with the current design of the scram valve closure apparatus of necessity involves the human factor; that is, the' isolation system for a postulated break in the SDV system piping can be characterized as a " man-machine" system.

A review of the " man" side of the man-machine SDV break isolation arranaement indicates potentially less than a6 auate human-factor preparation. There are no qualified SDV system break detection instruments for the operator to rely upon to quickly identify the presence of a break in the SDV system piping. Typically, BWRs like Browns Ferry-3 have reactor building radiation monitors located in the CRD-HCU areas. However, their operability and calibration are not presently included in plant Technical Specification requirements as are other radiation monitoring instruments in the plant. Additionally, depending on the sensor positions and their sensitivity, these instruments may annunciate for every reactor scram, regardless of whether a break were present or not. Furthemore, the control room operator has not been provided with special emergency operating procedures or training 'to quickly and appropriately respond to SDV system pipe break symptoms which would accompany normal post-reactor trip control room indications and activities. Additionally, should immediate reclosure of the scram valves not be possible there are no emergency operating procedures or operator training provided to aid the operator in diagnosing and correcting the source of failure in attaining RPS reset and/or recovering from a loss of control air supply. Continued blowdown of hot reactor water past the scram valves may also degrade and eventually 7

disintegrate their teflon seating surface which could eventually eliminate the primary means of break isolation.

O

. A local manual isolatfon valve is provided in series with each remote air-operated scram outlet valve on each HCU. However, dispatchina an auxiliary operator to enter th reactor buildina to manually close each of these valves would be extremely unlikely, given the harsh environmental conditions including hot water blowdown, high radiation and nossible loss of lightino or visibility in the area of the reactor buildina where the postulated break is located.

Therefore, for both equipment-related and procedural-related reasons, isolation of a break in the SDV system attendant to a reactor scram may not be reliably assured.

2.3 Break Discharge Conditions One should expect that failure to close the remote air-ocerated scram outlet valves or the local manual isolation valves would result in a considerable blowdown rate out of the reactor coolant system directly into the reactor buildino secondary containment. The blowdown rate would be limited only by either the combined control rod drive seal leakaae from all drives manifolded by the SDV head ~s (via the 3/a inch Schedule A0 scram exhaust risers on each drive) or by the postulated SDV system pipe break size and location.

Currently, there is no _ Technical Specification limit for CRD seal leakage rate. However, seal leak rate (stall) testing at the BF-3 site af ter the June 28,1980 control rod insertion failure indicated that the average CRD seal leak rate (with approximately 250 psi pressure differential across the seals) could be about a 3 gpm per drive. Furthennore, the General Electric (2)

Company technical manual used for CRD operation, maintenance and testing recommends that seals be rebuilt when seal leakage exceeds 5 gpm.

Thus, for 185 CRDs initial cumulative seal leakaae could be anywhere from about 550 cpm to 000 qpm assumino a 250 psi pressure differential across the seals. Continued blowdown of hot reactor water throuch the CRDS would likely

. degrade the CRD seals as a result of flashina and cavitation and seal beat-up caused by hot pressurized water flowing past the seals.

(This effect might be similar to reactor coolant pump seal degradation following a loss of seal cooling injection flow.) Thus, the CRD blowdown rate, as initially limited by intact seals, might be expected to increase with time from the magnitudes cited above. Reactor system pressure, CRD seal condition, the actual differential pressure across the seals, line losses and the break size / location in the SDV piping systen, would ultimately set the blowdown rate in the long term.

2.4 Potential Core Consequences The anticipated cumulative seal leakage would be expected to be well within the makeup capacity of the high pressure coolant injection (HPCI) system or possibly the reactor core isolation cooling (RCIC) system.

If the HPCI systen was unavailable, the automatic depressurization system ( ADS) in conjunction with either of the core spray (CS) systems or the low pressure coolant injection (LPCI) subsystem of the residual heat removal (RHR) system could provide ample alternate makeup. Thus, as far as peak cladding tenperature, maximum cladding oxidation, maximun hydrogen generation, and coolable geometry criteria are concerned, an unisolated break in the SDV system may not be of concern during the initial mitigation phases of the event.

It is, however, with respect to the continued long-term core cooling reauirements and the availability of emergency makeup systems over the long term, that such an unisolated break provides unique ECCS challenges and uncertainties. Thus, it is with respect to long-term decay heat removal and maintaining the core covered that potentially serious public health and safety questions arise.

A break in the SDV system without isolation is equivalent to a small unisolated break in the bottom of the reactor vessel. For this case, the core shroud

, and jet pump diffuser nozzles cannot provide their usual protection against a relatively rapid coolant loss and level drop above the core attendant to a temporary loss of makeup supply. This is unlike the case for even the largest postulated break in a recirculation line.

Furthermore, even primary containment flooding (assuming water supply and pumps were available) would not assure long-term core coverage since the break would essentially be in the bottom of the vessel but located outside the primary containment structure.

Accordingly, a source of makeup water and adequate pumping capability must be maintained available indefinitely or until such time that some means of break isolation can be provided. However, because of the unique location of this unisolated break, long term cooling may not be assured.

For an unisolated break in the SDV system, reactor coolant would continue to be lost out the reactor system without accumulating in the drywell-torus which is the normal reservoir for water for long term cooling. Reactor water discharged directly into the reactor building would collect on the floor and be carried down through the open floor drains and other open passageways of the reactor building to the basement of the building. Once there, it would collect in the dirty radwaste (DRW) sumps located in the reactor building basement corner rooms. Water collected there would normally be pumped out of the secondary containment by two small capacity, (50 ppm) sump pumps and enter the DRW liquid waste collection system tanks. This water lost from the reactor would not normally be suitable or available for return to the reactor.

2.5 Potential Consequences to the Mitigation Systems The reactor building layout for BF-3 incorporates large stairwell openings (identified by circles in Figure 2-1) in three of the four corners of the

_9-565-foot elevation, where the SDV headers are located. The stair steps are open-lattice metal gratings which would permit hot water to cascade directly down to the basement floor. There are no curbs at the stairwell entrances.

Any water not removed by the floor drains on the 565-feet elevation floor will run over to the stairwells and flow directly into the basement. Loca ted in the basement at these corners (see circles in Figure 2-2) are the RHR system pumps and the CS system pumps. Thus these low pressure makeup systems might be quickly disabled by the effects of water cascading into the corner rooms and by the flashing of hot water.

In this way, a break in the SDV system could result in the loss of most if not all of the low pressure emergency core cooling pumps shortly af ter the break occurred. Qualification of this equipment for operation under such environmental conditions clearly would be questionable. Additionally, the RCIC pump is located in the same room with one train of the CS pumps and the HPCI pump is located in a room which is adjacent to one train of the RHR pumps and would, therefore, also be subject to severe environmental conditions including flooding. The control rod drive pumps are located on a platform above one train of the CS pumps and would be similarly involved in the adverse environmental conditions.

The fourth corner of the reactor. building basement contains an elevator shaft instead of a stairwell which should provide temporary protection against immediate damage to one train of the residual heat removal system, although the environment would degrade quickly.

If break isolation is not successful, the blowdown rate into the reactor building (which could be in excess of 1,000 gpm) would substantially exceed the total capacity of the sump pumps (which is approximately 100 9pm). Even if the sump pumps initially were capable of removing the reactor water being collected in the sumps, assurance of continued water removal from the sump

. cannot be provided indefinitely for continued SDV system blowdown. An unarrested blowdown would eventually challenge the operability of the sump pumps and their electrical circuits with environmental conditions for which they were not desianed. For example, for BF-3 the sump pumps are powered by the 3C 480V reactor building MOV hoards which are inmediately adjacent to the HCUs on the 565 feet elevation. Furthermore, these pumps and their power supplies would not be readily accessible by maintenance personnel niven the harsh environmental conditions in the reactor building. The pumps are not supplied with emeroency onsite power.

Thus it appears likely that all of the ECCS pumps in the basement would eventually be lost by floodina if the break were not isolated. Clearly, the unavailability of either qualified hich or low pressure makeup coupled with an unisolated break in the bottom of the vessel would result in a continuing drop in water level over the core and eventual core uncovery.

An integrated pictorial overview of the concerns expressed in this section is provided in Figure 2-3.

Appendix A contains an estimate of the risk associated with a pipe break in the SDV system.

11 -

3 FINDINGS i ing becomes an extension _

3.1 During a BWR reactor scram, the SDV system p p j

During this _

containment.

i of the reactor coolant boundary outside pr mary tlet) valves protect against (scram) condition, only non-redundant, (scram out which could arise from l

_an uncontrolled blowdown of the reactor coo an I

i ing.

i

_ postulated pipe break in the SDV system p o the boundary of the reactor As discussed previously, during a reactor scramtlet valves to the SDV sys coolant system is extended beyond the scram outhe high pressure rea i

j piping which accepts, contains, and lim tsThe SDV system

{

i exhausted during a scram.

outlet valves are reclosed immediately l

I to full reactor pressure unless tne scramIsolation of a postulated b af ter full control rod insertion.

n successful reclosure SDV piping during a reactor scram would depend upoThere of each of the scram outlet valves.

to the postulated break.

i flow path from each of the 185 control rod dr ves to violate those portions This single " isolation" valve arrangement appearsdix A to 10 CFR of General Design Criteria 54 and 55 of Appeniping systems pe that reactor coolant pressure boundary p l tion and containment capabilities containment be provided with redundant iso af ty of isolatin

/

which reflect the importance to sa e

) valve does not meet these Clearly, the use of a single isolation (scram It is equally clear, however, in criteria for the containment isolation funct o.

t

O that the use of an additional redundant automatic " isolation" valve in the scram discharge (riser) line would adversely impact the reliability of the scran function aspect of the lines. Thus, while opening only a single valve (to cause a rod to scram) is clearly desirable from a scram function reliability viewpoint, the availability of only a single valve (to isolate a break in the 50V system piping) is clearly equally undesirable (if not unacceptable) from a containment isolation function reliability viewpoint.

Impl ici tly, it may be concluded from the single scram outlet valve arrangement that the overriding need for a highly reliable scram function has taken precedence over (and at the expense of) the reliability of the containment (and break) isolation function.

3.2 The non-redundant (scram outlet) valves do not utilize a closure principle or provide a design arrangement with a reliability reflecting the importance of isolating a postulated pipe break.

The use of scram outlet valves for reliable isolation of a postulated break in the SDV system piping attendant to a reactor scram appears to violate those portions of General Design Criteria 54 and 55 of Appendix A to 10 CFR 50 which require that reactor coolant pressure boundary piping systems penetrating primary reactor containment be provided with reliable isolation and containment capabilities which reflect the importance to safety of isolating these systems.

As noted earlier, group closure of the scram outlet vah as has not heretofore been defined as a required safety function. Accordingly, the systems upon which scram outlet valve operation is dependent have not been designed with features to assure reliable closure of these valves.

I I

Reliable group opening of these valves has been established as a required safety function, to assure a reliable scram function.

Because of the need for a reliable scram, the reactor protection and control air systems have been designed such that the numerous possible failure states of either of these systems would cause the scram outlet valves to open, which is in the

" fail safe" direction for scram function reliability.

Conversely, the sane possible failure (loss of) modes of these two systems have the opoosite impact on the reliability of the valves in the aroup clos'ure sense. That is, the list of possible active and passive failure states of the reactor protection and control air systems which will cause the scram valves to open also represents the list of possible common failure modes which would prevent group closure of the scram outlet valves when reactor coolant boundary intecrity and containment isolation are needed.

Some of these common failure causes are readily correctable thereby permitting relatively prompt remote manual aroup reclosure of these valves, e.g., a reactor trip condition which can be quickly bypassed in either the SHUTDOWN or REFUELING mode. Other causes would not be correctable even in the lona term, e.g., rupture of a copper tubing control air line caused by a postulated high energy (pipe whip) type break in the SDV system piping or a seismic event. Access to the source of failure for repair likely would be precluded by the harsh environmental conditions created by the break. Thus, the reactor coolant blowdown would not be considered terminatable by reclosure of the scram outlet valves.

i

o

-la-3.3 The reliability of equipment currently installed and the capability of SOV system pipe break dete', tion is neither commensurate with.the needed reliability for break isolation nor reflective of the potential consequences of a rupture of the SDV systen piping.

Typically, BWR plants like BF-3 have radiation monitors located in each of the CRD-HCU areas of the reactor buildina. However, this instrumentation is not safety grade nor is it supported by Technical Specification operability and trip setpoint (cali.bration check) requirements. These instruments are also of a sinale channel design. The reactor building does have reliable high radiation monitors in the various zones of the ventilation system exhaust duct work. These zone radiation monitors are used for automatic zone isolation of the reactor building and for automatic initiation of the standby gas treatment system. The operability and trip set point of these instruments are covered by Technical Specification operability and calibration check requirements.

However, these instruments are not sufficiently close to the CRD-HCUs and SDV headers to provide reliable and unambiouous detection of breaks in this equipment. Accordingly, we find that the reliability of the current break detection function of the overall " man-machine" arranoement for SDV break isolation cannot be assured to the decree which would normally be required of a primary containment or a reactor c'oolant pressure boundary isolation system. Operator action to initiate manual reclosure of the scram outlet valves in the event of an SDV system break would be uncertain.

3.4 A postulated break in the SDV system pipino durina a reactor scram wi i

I lled a failure to reclose the scram outlet valves would result in an unc t

reactor coolant blowdown outside primary containment which could threa en t

the ECC systems and the availability of makeup water required for lona-erm core cooling._

As previously discussed, since the SDV system pipino is located in the building and outside primary containment, a postulated break there would (unless result in a reactor coolant blowdown outside primary' containment Furthermore, since the SDV piping the scram outlet valves are reclosed).

is below the level of the core and drains from inside the core shroud, react h

hot water could continuously drain out of the reactor vessel and onto t e Additionally, an unisolated SDV break inside floor of the reactor building.

h the reactor building would also, sooner or certainly later, threaten t e i

operability of the emergency core Cooling systems required for mitigati The adverse the ECC system pumps are located in the basement of the building.

tial environmental conditions created by the hot water break, together with pote flooding conditions, would make operability of this equipment questionab Moreover, the water lost from the reactor coolant system before very long.

flow path (i.e.,

would be unavailable to the normal heat removal recirculation torus, low pressure ECC system and return to vessel) required for long-term Accordingly, unless the water which is lost from the RCS can be cooling.

), all normal returned to the condensate storage tank (for return to the vessel At this point, an alternate ECCS inventory eventually will be depleted.

l ble to makeup source would have to be provided if pumps were still avai a deliver the water to the reactor vessel.

3.5 A break in one or more control rod drive scram exhaust lines located upstream of the scram outlet valves and outside primary containment would result in an unisolatable blowdown of reactor coolant outside' of primary containment even if all scram outlet valves were closed.

Except for the manual isolation valves immediately upstream and downstream of the scram outlet valves, there are no valves in the scram exhaust lines between the CRDs and the SDV which could he closed to isolate a break. Thus, should one or more of the 3/4 inch Schedule 80 exhaust lines rupture upstream of the scram outlet valves and outside primary co'ntainment, closina these valves would not isolate the break. Furthermore, since the subject piping is below the level of the core and drains from inside the core shroud, hot reactor water would continuously drain out of the reactor vessel and onto the floor of the reactor buildina.

It should be noted that this situation is different, for example, from the small diameter BWR transversing incore probe (TIP) system instrument lines which also penetrate the hottom of the reactor vessel.

The TIP lines do incorporate redundant and diverse isolation valves immediately outside the drywell to provide isolation protection. Break isolation of the scram exhaust lines is also different from the situation for ruptured PWR steam generator tubes. For this case, leaks through the ruptured tubes (which would place the lost reactor coolant outside containment) can be conveniently terminated by draining the primary system down to a level exposino the break elevation of the tubes. The lowest elevation of the tubes is still well above the top of the core; thus, the break flow can always be terminated eventually.

Since all of the BWR scram exhaust pipina (and SDV system piping) is well below the core elevation, drainina the RCS to uncover and thereby terminate the break flow from the botta, of the reactor vessel would not he possible.

~-

l The CRD seal leakage flow passing through a single scram exhaust line could range between 3 gpm and 5 gpm imediately after the break to about 12 gpm after CRD seal degradation (assuming a 250 psi pressure differential). The flow would be considerably higher for a larger pressure differential which might be the case for breaks immediately outside primary containment. Thus, rupturing only a few of these lines could quickly result in a cumulative break flow which would exceed the capacity of the two 50 gpm sump pumps in the reactor building basement.

Although a single passive failure might legitimately be postulated for any pipe in the reactor coolant boundary (including a scram exhaust line), no SDV system pipe break is thought to concurrently involve the rupture of several exhaust lines. Multiple line failures might occur, however, due to such causes as large high energy pipe breaks, sabotage or interaction with heavy equipment (e.g., fuel shipping railroad cars) in the vicinity of the hydraulic control units in the reactor building.

3.6 The assurance provided by the industry codes and vendor quality assurance programs for the mechanical design, fabrication, installation, testing and inspection of the SDV system piping do not appear to be commensurate with the risks associated with an accidental rupture of this piping without isolation.

As discussed previously, a break in the SDV system piping without isolation could result in severe consequences including possible core uncovery since the break might threaten continued operability of the emergency core cooling systems and the availability of makeup water. Additionally, the reliability of the break isolation arrangement upon which prompt mitigation of the event would be dependent, is considered to be less than adequate.

Under such circumstances it would appear to be appropriate to compensate, in part,

. for these systems-related deficiencies :nd safety concerns by providing a higher degree of assurance for the mechanical integrity of the SDV system piping during the life of the plant. A review of the current basis for assuring mechanical integrity of the SDV system piping shows that this assurance is not commensurate with the possible consequences associated with a postulated break in this piping.

For most of the operating BWRs (i.e., those for which the SDV system mechanical design was initiated before about 1971), the SDV piping system was probably designed, fabricated, installed and inspected to the requirements of USA Standard Code for Pressure Piping-Power Piping,USAS, B31.1. This code did not provide for a detailed quality assurance program for design, fabrication

~

and construction. Also, piping systems for use in water service and built in accordance with B31.1 were not required to have volumetric examinations of welds except for those with nominal wall thickness greater than 1-5/8 inches. Pipes of one to two inches in diameter such as drain, vent and instrument lines were not required to have examinations.

The Section III ASME B&PV Code rules for Class 2 components were available in 1971.

Plants granted a construction permit from 1971 through 1973 would probably have been specified to construct the SDV system piping to the Class 2 rules rather than B31.1, but it could vary depending upon the order date for the component. The B31.1 and Class 2 rules are similar and nether requires a thermal fatigue analysis (thermal expansion fatigue by anchors is included).

A The Browns Ferry-3 SDV system was constructed by Reactor Controls, Inc.

(RCI) of San Jose, California. From conversations with RCI representatives, it has been learned that most operating BWR/3 and BWR/4 SDV systems (including the CRD-HCU piping networks) were constructed by RCI. More recently, RCI has expanded its scope of supply to include the mechanical engineering design and analysis of the SDV systems. The SDV systems for BWR plants now under construction would be built to the ASME B&PV Code,Section III, Subsection flC rules for Class 2 Components. The Code requires that this work be done in accordance with the

. assurance requirements of ASME Section III Article NCA-4000.

However, examination of the construction deficiency report for LaSalle County Station (see Appendix B) shows that contrary to these requirements, " Reactor Controls, Inc., (designer and installer of portions of the Control Rod Drive System) did not have a 0A/0C program that addressed the areas of... design control,... and detailed implementing procedures for design, installation, and inspection activities." From this inspection report it may be inferred that most op3 rating BWR SDV systems were not constructed to the high quality assurance standards now considered to be appropriate and reflective of the potential consequences associated with an accidental rupture of this piping without isolation.

Finally, inservice inspection of SDV components built to Section III would be conducted in.accordance with the ASME B&PV Code,Section XI, Subsection IWC rules for Class 2 components.Section XI rules would, most likely, also be followed for SDV components constructed to B31.1 rules because Section 50.5Sa of 10 CFR Part 50 requires periodic updating of inservice inspection programs _ for each plant. The CRD scram exhaust risers and the SDV vent and drain. lines could be exempted from examination because they are smaller s

s

C.

. than the 4" diameter exemption provided in the Code. The SDV header should not be exempted on either size _ or pressure considerations, but it is not apparent that all plants include the header in their inservice inspection program. One argument that might be used to explain why the header is not l

included is that there is no need to examine the larger pipe because the maximum break flow is limited by the flow from a single 3/4 inch scram exhaust riser.

If the header is extmpted by this reasoning, then the only inservice j

inspection required by the Code would be the systen pressure test once every 3-1/3 years and the system hydrostatic test once every ten years.

9 l

E 9

. 4.

RECOMMENDATIONS 1.

Require that the CRD-HCU exhaust lines and SDV system piping meet the highest standards for design, fabrication, installation, testina, inservice inspection and quality assurance which can be reasonably attained.

In view of the potentially serious consequences associated with pipe breaks in the SDV systen without isolation and the significant difficulty and issues involved in improving break isolation reliability., it would appear nost appropriate to first assure that the probability of an SDV system pipe break has been adequately minimized. However, from our investigation we found that the level of mechanical integrity assurance presently provided for the life of the plant is significantly deficient. We, therefore, recommend that a thorough re-review of the mechanical design, fabrication, installation, testing, inservice inspection and quality assurance standards and requirements which were applied to the existing CRD-HCU and SDV systems be undertaken with the intention of evaluating their adequacy and upgradina as necessary and pract4:able. Requiring a complete fatigue analysis and a more extensive and frequent inservice inspection of the small diameter piping welds for the existina SDV systems are examples of possible improvements in these areas. We also reconmend that the results of the actual work performed in these areas for all operatina BWRs be thoroughly re-reviewed and re-perforned as necessary to assure that the mechanical integrity requirements are met and that the current bases are acceptable. Finally we recommend that these standards be applied to future BWR CRD-HCU exhaust and SDV systens.

2.

Assure that reliable and redundant break detection instruments such as temperature, humidity, or radiation monitors are provided in the immediate vicinity of the HCus and SDV system piping.

An important component of the SDV system " man-machine" break isolation arrangement is reliable break detection. Accordingly, it is recommended that reliable (safety grade) break detection instruments be installed in the immediate area of the control rod drive HCUs and SDV system piping.

Detection based on high radiation, temperature, and/or humidity conditions may be used for this purpose. These instruments should be covered by Technical Specification setpoint and operability requirements and should be annunciated in the control room. They should be redundant. To preclude a single failure from disabling the detection link in the nan-machine isolation arrangement. Appropriate consideration should be given to adequate environmental qualification. Only with such break detection instruments can reliable and timely break diagnosis and actions by the operator be assured.

3. Develop and implement appropriate emergency operating procedures and operator training for postulated breaks in the CRD insert or exhaust piping or the SDV system piping.

Training provided should familiarize the control room operator with SDV break symptoms, indications, and diagnosis. The emergency procedures developed should require immediate reclosure of the scram outlet valves upon a detected break in the SDV system piping.

Emergency operating procedures should include all available mitigation steps if timely reclosure of the scram outlet valves cannot be accomplished. The procedures should be supported by appropriate analyses to demonstrate the most appropriate course of action (e.g., possibly

depressurizing the reactor via the SRVs to reduce the CRD blowdown rate).

Subsequent actions required to reclose the scram outlet valves should be developed and provided. Procedures and trainino required for long-term recovery if the scram outlet valves cannot be reclosed for an indefinite period should be developed and implemented. These procedures should include steps to prevent or delay the possible eventual loss of all ECCS by flooding or environmental camage. Finally, consideration should be aiven to any special emergency procedures and trainino which may be required to terminate a reactor coolant blowdown which cannot be isolated by the scran outlet or manual isolation valves because of break location, environmental conditions or valve failure.

4. Consider improving the closure reliability of the scram outlet valves.

Various ways should be studied for improving the closure reliability of the scram outlet valves. Such studies should exanine concepts for improving the reliability of control air supply (e.g., accumulators) and AC power supply (e.g., individual alternate temporary energency power supply hookups) to the solenoid scram pilot valve's. Any proposed improvements in closure reliability should carefully consider the possible negative impacts on scran reliability.

5.

Prior to the initiation of any pressure boundary maintenance on the SDV system pipings, require the manual isolation valve for each scram exhaust riser be closed; and before subseouent startup, reauire appropriate verification that the manual valves are reopened.

SDV pressure boundary maintenance or modification activities may not be precluded by Technical Specifications from being performed in any reactor mode. However, such activities would normally be expected to take place durino periods when the reactor is in either SHilTD0HN or REFUELING mode. Activities which result in a loss of SDV pressure boundary inteority mioht be oerforned with only the scram outlet valves closed to isolate the SDV system pipino from the

- - - ~.

- 24.

reactor coolant. Maintenance or modification procedures may not require that the HCU manual isolation valves also be closed.

If the manual valves are not closed, the scram outlet valves would he maintained closed with both RPS channels energized and control air pressure applied to each of the scram valve actuators. Under such circumstances, should a RPS trip condition (or loss of RPS power) or a loss of control air occur, an uncontrolled loss of reactor coolant outside primary containment would result if the SDV pressure boundary were open at that time. Dependino upon the circumstances, reclosure of the scram outlet valves may not be readily achievable. Accordinoly, to protect against such an uncontrolled loss of coolant, it is essential that manual closure of the manual isolation valves be required.

It should also be noted that opening the SDV system manual flush valves without an operator remaining on standby to assure immediate reclosing, if needed, is another pressure boundary maintenance which requires similar treatment.

6.

For plants to be constructed consider locating the SDV system headers and HCus at an elevation in the reactor building which would olace them above the top of the reactor core.

By routing the CRD piping to and from the HCUs and SDV headers to a level above the top of the reactor core, the possibility of an unisolatable break which could drain reactor coolant from below the core would be substantially reduced.

It would still be possible for an individual CRD insert or withdraw (scram outlet) line to break below the core level inside the primary containment.

However, only a break outside containment above the level of the top of the core could be cross connected by the flow contribution of all of the scram exhaust lines. Thus, with this arrancement it would be possible to terminate a break in the SDV system by bringing reactor system pressure down to atmospheric conditions. Reactor water would not be able to drain outside primary containment to below the level of the top of the core.

. 5.

REFERENCES 1.

" Report on the Browns Ferry 3 Partial Failure to Scram Event on June 28,1980," July 30,1980, Office for Analysis and Evaluation of Operational Data, USNRC.

2.

" Operation and Maintenance Instructions Control Rod Drive System for Browns Ferry Nuclear Plant," GER-9585/9586, June 1971.

s 4

=

-e j

i

\\

i

e 26 -

w.

J t_.-

n-4 p. {6..

C

.t.~ a ay

r.

4 gI A

[y

- - 1 ',t'

.i e

~

i

{~'

y

{

,e. a b-:.a

, - { d -*'7.-h. y

j

?

l 3

r i

o s

i

't*

F

..a

! 1..

l u[

- 4

e, 2 *p e.

. c. O.

l vs w

' :::[,, p @=

w..

m.

1 le

.]

w te, N

r.

3 d.s.+ rg..r. _._... _ g.. g.. lly :

. L.

L. :-

p y

l

,['.,:, f f h * *

,t :$ : Y

t ;:

r-

.at:

':i: : s ? # N*D:

.tr- : p:;:

it ii

t;.- :. :: u. : 1.. : s - s.: : :.. t : 4-d :p fji.

l

-. j.-

lt g.

t g.i T

,a

.s.t' p t: q

.I 4

/' %

! -} g '

.t i

i C*w

..s

.g 1

s i

g le !

}s 1 e'.t J.

1.cg k

i.

r'h.

s

.e...,

. f_.J,

'l

.ji*I l

lA.e i

t

=. '_j. _.

L.

p.t edl Ii,1'J,W

,l.

r.'.

r1 4

.u

..,.1,.,.

. j,.

I.,a_

- *d b, l l

l]i

[,

w-c,,

t *., ;

d t s

...e

}

Q. 6~'4 d **

.}'e

% 'e A-t ; l._'

.'.'_.l l,e,, n., iP:,~k u

' ' ~ ~ ' " * "

. 3,,.,1

,r-.dr. -a t

t -

. ~, r s 'i.

e 3

i.

3..a. g ] ; i Y.M. r.

e-1 is c-4.

r,

,1

. a ;J d i

.t

.I J.b.

J,i u p. w, +1 c, :y * =[,

c..n,.L'.l - c i 3-, s.!.!.h.a,!.r,.

s

. e UH t. ;g ; ;.,,_;. (

1., 1 p.!.i _.._

I.n..-'I Q } r. !; j N-M,. eP}.

L#.t m

,,s.

n tt

i. t..i.

r

>t...

I u...'

3 -

3

c :

s

('., ~ l.i -

1. m..

.. g"[ :

( s 1 m l.-

s e -

f

.,! ;..., : :.. I, 'u. ib.

s p

o...

^

p*

'q

}i I ;..

di,.

, N '/

3('e,A.. L i

r:-- =. :,,,

s.

I

.s g

C],9;;@ }

;3<t li -

l, p.

.g t..

,!. ' i '.,,'s.

cc-r tj:h?

voy ga : IX g

).;

.{r,tgq, c

! -:(.

i

! i

t. e i

t 1 ) ; ;:) r:' '

E I,\\

h!

J}

t U E ',f

'i's,t.

y A.Q. i i s' i

l I

,eY l'l.!p:t

' l, *:i m

.;I. t ;.ii.i.!

i e i l

- h= 7

. A,

/ '

,; /,

),

U>.

e-

~

3..

e.

. 4 a i:

t e ira

,(

i

[gg. M 4 4,6 fl. 4-i t,!

'j e..+

g-i 4

. i-6.-

l 2..

==

, 1!

(-~ M ',

,~_>L

.t t

~

p* i b r--

17.

+

s

c. N,,,.,

2 L

2"

j !-

". ;Mku!

L. I.t.

y i t'.,

1

-" H..E E 1) <

--- 4 l '. pO.-4,.

iW: i l'y Vi q S

l-L'..t.p!

1,

( '.?. h.

_. r'L $r.._e.: _..,'.

- 3

'a 3

r,,.

.A

._,. s..

s.:

t f.

t

'.*W'*"

k 1,,. e.: +M !

(N3 l r <i.

p t

A

+.% s t.

?.

g s

r.

1

...._ n - 1

.f, '.;

l.'.', ;,,.. y

/

. f.,.

i et

)-,i s. 3 9. u,,.

t,.. l).', i. a. i,

r,,

.?.

,,j..

't.

6;,.

..p lIh.-j..

ri i

{_.

h,_/

'81 l

\\.Ip l'

.f

.A4 E

Er i

a t

.'t Gr..'s >.a-..'

o es 6

i !! i '9j g,

.;;,,) f

p. :ta

~

.:, s 6

!'}M ')

i

.Q

,c ;

6 a

- tm._._._' r_ / L

..J_ : p _.-- _p, -~.

P:==- -

...n - -- '

. F ?j T,,.c

~,,,.r,.,.

- - " ] j,'*.

[ }.

E'

r */ : ?sg r

s_

,e

.o

., :..- n. '~

<*h.

'2'**

. T

.i

,,.,e

.s

.g.

.6.......

...... t ;.,t a

.,, eq i; p.!;,

g..

,m.

.'. :. 4,. -

, J

'.4

'I;;:;;n;j;

-t 1

..' t.

1 i

i m, s

- p.:f,.,

O.,

ts...

,:...o r :!.;;.' 1R a,

m.,. s

.*:.is

.rp:"-

';t.

c' M.,.

' d :.

y,,

1.. t..

l :-! ' ;.'

.s i n. g n_i '

,. :W.

Figure 2-1 Floor Plan -565' Elevation w-Y v

ww w

e

t t! NIT 2

-o-9 f9)

)

ir!

ine iu.

!ss s*i s

r r.o -

l i s '-s' l

, ca *

A !w2C0,7 s.,,,a...,,,, l.;,

. - s aiso,a e er.e t

4, t-m*

D i

1 Ll!

e T*

{#p ', [

N.,',",,"j /

' (,u,ij d,7 f I'.r.,1, r

II 3

8

,, J t--

wi l

.s ns - err *<> w o J% & y,,,,.l

? >= ' f i

.s,*o q

/

w Sr 2 C; & ;

. ' Je. 3

'M sea.- *r*

r-a

- -- =, ;,

m.

,,,-... Ja.s.,!,f e

-*6==

l lf eo.aer 3, t

./.

W Grs sr.roa 4

\\

n >*

,g

'. x-Yr de F'**'* ~'A f

l

.e U

i it ii.t I

7a i

.4/!sh

/*

)

,..t DEACY')*

. l L'

o-i I

{s -- $

,m r >

e-I

t j

\\

s 4

t

.oint fho;n end

\\*

6 a

1 6

I,\\

r.oo peo*o 18 tb

.J N'

g 1

4 l

\\

s el

g t

h

,t

'w _i *

],

t.

,g gry

.>2 s.>rer /.

n

.I

- - - '~y

!d

,,,6 y:*I

,*t,re-,,<*carse

'practse ar.,p

..<r :

L:.c. L i

sQ

y i s s

l j, y-mg

? P'"8 O' :""8 3,g l

' ' * ' ~ ~ ' *

,s****

seere l' ~ t'. *1,

L _ u.**n

__.-*._ e' i _wir

.a,.,.

s h, _. _

l

- DCI s,o sr* =. t

,. een -

I r".,

-r3

. ~, -.

.. i

~

g,.

.#W.*F9e de.dI"JS#

.. _1

i..

cl..JN - El. 5/ 3 0 Lsm Figure 2-2 Floor Plan - 519' Elevation

a

~

WHHAM%

5 SCRAM AIR HEADEB REACTOR DRYWELL-VESSEL TORUS

';s ';s

=;s "o

\\

(PRIMARY CONTAINMENT)

JET PUMPS REACTOR

\\

CORE RPS"A" N

't Sis" W,:

=

e M

VALVES f

~

n.

f RPS"B" j

L SCRAM s

I l

CONTROL ROD PILOT DRIVES 1 1 11 VALVES :

(4 TYP. OF 185)

N

'/

.V i.

N T

m r

4H-t s

r.c

=

SCRAM VALVE O SCRAMg SC yAL

> D NE a

I E

B

.m SCg,M i;str.

(g_ s e p - -,j ]

___._- _=,._;

_ _37 j

g

-3 _-_..

SDV System Q

7 g

Drain Valve 3

PIPE BREAK

/*

N'

[=

(

To Clean Radwaste R

Open Dirty Radwaste Floor Drains Y

Floor Drain

//

rt __ _.._

_ Ds a,

_ :m 1

IWffffffA fV#########A"lllllllll'"lllllllllll"l B

\\$

A l((.l TORUS CRD

/ TORUS l

.j____._._.-

lN

) Sump Pump

_.=r_-__-

RHR t'_--'

' CS RHI 1 r Sump e

.=a

,=

=

=.g _?W/__

f

~_R

~

= * -

/

~

/

-T- ~5 E_5. _E

_ q. __ i.c

,i,,,,,,,,ii l

f

tio r

CONTROL AIR SUPPLY RPS "A" NORMAL POWER i

t :

480 VAC REACTOR MOV BOARD A k

RPS BUS "A" 120 \\ AC CHANNEL A th ----

!! ", l' p

- ____ _ _.: : g :::: :::: :'::m e 9 n,

v v

>- -j J?

\\\\\\

SUBCHANNEL RELAYS

///

s

/

l: ll ll

0 fy X

~

s_

g g

t t j q v

V h-:

F

%}

I tt it If Q

SCRAM CHANNEL B

<N N

VALVE RPS BUS"B"

')

N+3 120 VAC SDV System Vent Valves RPS "B" NO NORMAL POWER 480 VAC REACTOR

,4 MOV BOARD B REACTOR b- - _-

.- _ M r

BUILDING

-J (SECONDARY b = :-

CONTAINMENT)

IiM DISCHARGE VOLUME HEADER To Clean RM vaste Drains Ng

(#VHHK

\\

T-To Floor Drain Collecter System i

HPCI RCIC and CS h

h t

i 3

[/[

Figure. 2-3 BREAK OUTSIDE CONTAINMENT WITHOUT ISOLATION

/

(CO'iTROL AIR FAILURE) f s

Appendix A RISK ASSESSMENT An estimate of the core uncovery risk from a break in the SDV systen pipino (at a plant like BF-3) minht be calculated as follows:

P = P) x P2 g

where, P = Probability of Core Uncovery/Rx/Yr g

Pz = Probability of an unisolated SDV break /Rx/Yr P2 = Probability of core uncovery following an unisolated SDV break

where, P),= (N x P))) x (P12+P13 I N = Number of Rx scrams /Rx/Yr P)) = Probability of an 50V Break (n sump oump cap)/Rx scram P

Probability of not beino able (RPS or control air condition) 12 = to immediately reclose scram valves after a Rx scram /Rx scram P)3 = Probability of not reclosing (human or procedural) or being unable to reclose (break consequences) scram valves af ter an SDV break.

If we assume:

N=2 P)) = 10-12 = 10-I P

13 = 10'I P

P

= 0.25 2

then P

= 10~

g

A-2 Discussion Based on BWR operating experience it would not be unreasonable to assume that at least two reactor scrams (fron full pressure and temperature) occur every year at each plant.

It miaht also be assumed that a break in a small line in the SOV system (downstream of the scram outlet valves and upstream of the SDV system vent and drain valves), resulting in a substantial blowdown rate *,

(>> 100 ppm) can occur once in every 10,000 BWR reactor scrams.

(A blowdown rate of this magnitude could result in eventual, loss of the emergency makeup systems if not isolated.) For BWRs it also seems reasonable to assume that out of every ten reactor scrans, one would involve a RDS trip condition or power supply failure or a loss of control air supply such that the scam outlet valves would not be able to be reclosed for an indefinite period of time. Furthe rmore, should a break in the SDV system occur, the additional abnormal plant symptoms and reactor system process conditions indicated in the control room could divert and continue to occupy the control room operator's time and attention (e.o.,

reactor water level drop) which could result in the scram valves being lef t open. The break itself may also introduce additional failure modes to the break isolation arrangements (e.g., air line failure due a postulated pipe whip of a ruptured SOY system line, environmental damage to the detection equipment, damage to the scram valve teflon seating surfaces caused by prolonged blowdown).

We would estimate that considerations such as these could contribute an additional one chance in ten of not isolating a break in the SDV system.

Note: A break from a one inch Schedule 160 vent line is capable of passing approximately 400 gpm at 1,000 psi, while a two-inch Schedule 160 drain line is capable of passing approximately 1,500 opm.

A-3 Finally, in the event of such an unisolated break in the SDV system, we would arsume that there is a 75% chance that at least some ECCS equipment in the Reactor Building basement and emergency makeup inventory will be available to keep the core covered continuously and indefinitely even thouah none of the equipment is qualified for environmental conditions including flooding.

Although the above point estimate is considered to be 10" /Rx/Yr, which would make this event a significant contributor to risk, the uncertainty range may be such that the uncovery probability most likely lies within the range of 10-3 /Rx/Yr to 10 /Rx/Yr. Consequently it is difficult to conclude on the basis of these numbers alone that the existing plant design configuration is safe, i.e., less than 10-6/Rx/Yr.

If from these convolutions one were to conclude that the SDV pipe break is a significant contributor to BWR core uncovery risk, it is believed that the risk can best be reduced by decreasina the likelihood of a break in the SDV system pipina by an appropriate upgradinn of the SDV system mechanical integrity assurance basis. The risk can also be reduced in a significant althouah less favorable or desirable way by improvino the reliability of the break isolation arrangements, i

l I

l

Aapendix B INSPECTION REPORT FOR LaSALLE COUNTY STATION

[.....

MUD o

UNITED STATES

[i

~,j NUCLEAR REGULATORY COMMISSION y.,

ne REGION ill 8,

799 ROOSEVELT ROAD g

[

CLEN ELLYN,ILLINols Go137

' MAR 3 19 81 Docket No. 50-373 Docket No. 50-374 Commonwealth Edison Company ATTN:

Mr. Cordell Reed Vic'e President Post Office Box 767 Chicago, IL 60690 Gentlemen:

Thank you for your letter dated February 3,1981, informing us of the steps you have taken to correct the noncompliance which we brought to your attention in Inspection Report No. 50-373/80-48; 50-374/80-30 forwarded by our letter dated January 9,1981. We will examine these matters during a subsequent inspection.

In your letter you requested us to reconsider (1) whether the meeting of January 29, 1981 should be classified as an Enforcement Conference and (2) the Severity Level of the noncompliance. Ve have reconsidered the matter and continue to believe the Severity Level selection is correct and the meeting was an Enforcement Conference.

The Severicy Level of these violations was not increased for repeating a pre-vious violation.

It was our determination that the problems related to control rod drive oice suspension systems resulted from degradation of management control systems designed to assure proper plant construction (Severity Level IV). Although a close call, we believed it was not a Severity Level III viola-tion, i.e., lack of quality assurance program implementation related to a single work activity as shown by multiple program implementation violations that were not identified and corrected by more than one quality assurance / quality control checkpoint relied upon to identify such violations.

The meeting is considered an Enforcement Conference because of your noncom-pliance history related to large and small bore pipe suspension systems.

Ilad the new enforcement pplicy not been in effect at the time of this inspection, these items would have been infractions and your history would have prompted an Enforcement Conference. Under the new policy we continue to look at past history,'so the same conclusion was reached.

Although we took the position that the " clock started" at the time of issuance of the revised enforcement policy with respect to counting multiple violations of Severity Level I, II, or III items of nonconpliance, it is necessary that the history before issuance of the Policy be considered in the determination of when to hold an Enforcement Conference.

p

[/0) //O3 W

/ 02 0

af /04? Q

2-MAR 3 Jgg)

Commonwealth Edison Company You have stated a desire to meet with us to discuss enforcement. We will contact you in the near future to arrange such a meeting.

Sincerely, James G. Keppler Director cc w/ltr dtd 2/3/81:

cc w/ encl:

J. S. Abel, Director of Nuclear Licensing L. J. Burke, Site Construction Superintendent T. E. Quaka, Quality Assurance Supervisor R. H. Holyoak, Station Superintendent B. B. Stephenson Project Manager Central Files Reproduction Unit NRC 20b AEOD Resident Iespector, RIII PDR Local PDR NSIC TIC Dean Hansell, Office of Assistant Attorney General

..V

.T.TYnx W 50- M LG V

b R I, RITI RI8I RIII RIII RIII.

/

s/

73

![ D 7

M. N e

s Davis Keppler Y /jp Dante.lsc%

SpeAsard ann 2/25/81

{

g-MI f.4

,,1l?'

Commonwealth Edison e

one First Na!>cnal Plata C%cago llhnois Accress Reply to: Post Off4ce Box 767 Chicago Illinois 60690 February 3, 1981 Mr. James G.

Keppler, Director Directorate of Inspection and Enforcement - Region III U.S. Nuclear Regulatory Commission 799 Roosevelt Road Glen Ellyn, IL 60137

Subject:

LaSalle County Station NRC Inspection Report 50-373/80-48 and 50-374/80-30 NRC Docket Nos. 50-373/374

Dear Mr. Keppler:

In response to the subject inspection report transmitted Dy your letter cated January 9, 1981, attached are replies to tne apparent items.of noncompliance in the Notice of Violation.

The attached replies include our evaluation of quality assurance program ano management control system improvements which will be implemented to preclude further violations of this type.

~

The primary reason for the violation was inadequate followup of corrective actions identified in our reply to your previous inspection report 50-373/80-20 and 50-374/80-13.

This inadequate followup occurreo because the LaSalle County Project Construction Management did not recognize their responsibility to followup their contractor's oesign control corrective actions.

Tnis was the only LaSalle County Construction Management controlleo contractor with extensive design and analysis responsibility.

Design and analysis are normally handled by contractors controlled by the LaSalle County Project Engineering organization; tnerefore, Construction Management incorrectly assumed the design and analysis corrective actions would be followed by Project Engineering.

Tnis lack of responsibility for control of contractor design activities is unique to this spe,cific contractor.

We agree that our followup was not adequate to assure timely corrective actions to deficiencies identified in the vendor quality assurance program by t,he NRC.

As we stated in our meeting on January 29, 1981, Commonwealth Edison had performed an audit of the vendor in May, 1980, in which deficiencies were identified and had scheduled a reaudit of the vendor in November, 1980 to take steps to correct his inacequate response to date.

Although our followup was not timely, it did not represent a breakdown in our Quality Assurance program.

g/05'/ fD 5nah"AL na p s.est 1

~

2-Your Inspection Report does not discuss the basis ycu used to determine the severity level of this violation; however, in a 1981, you explained the severity level was meeting on January 20.,

We stated in the increased for repeating a previous violation.in our opinion the noncenpliance cited a

January 29, 1981 ceeting that should not be considered a repeat noncompliance under the Therefore, period of applicability of the new enforcement policy.

we respectfully requ'est your reconsideration of considering the meeting as an enforcement meeting and the January 29, 1981, of severity level.

appropriate _ reassignment Very truly yours, C-. W C. Reed Vice President O

e f

D

l

~

\\

Enclosure Response to Notice of Violation The items of apparent noncompliance identified in Appendix A of the NRC letter dated January 9, 1981, are responced to in the following paragraphs.

ITEM 1 10 CFR'50, Appendix B, Criterion II, states that, "The applicant shall establish at the earliest practicable time consistent with the schedule for accomplishing the activities, a quality

" and Criterion I, states that, "The assurance program such as contractors, the applicant may delegate to others, executing the quality assurance program work of establishing and shall retain responsibility therefore."

but I

Commonwealth Edison Company Topical Report CE 1A, " Quality Assurance Program for Nuclear Generating Station," Revision 14, dateo September 9, 1980, states in Section 2 that, "The quality assurance programs of Commonwealth Edison Company, Architect Engineers and Nuclear Steam Supply System vendors include the requirements of ASME Section III Article NCA-4000, the quality B to 10 assurance criteria for nuclear power plants for Appendix CFR 50 " Quality Assurance Criteria for Nuclear Power Plant," and the mandatory requirements of ANSI N45.2, " Quality Assurance Program Requirements for Nuclear Power Plants" and ANSI N18.7,

" Standards for Administrative Control for Nuclear Power Plants."

The requirements are implemented by means of detailed quality procedures delineating the means of detailed quality proceoures In addition, delineating the specific methodology to be used.

individual contractor's, fabricator's and vendor's Quality Assurance programs will include the applicable portions of tne Code Standards and Appendix B as they affect the total program."

Inc., (desioner and Contrary to the above, Reactor Control, installer of oortions of tne Control Roo Drive System) cio not have a 04/or orocram tnat accresseo the areas of orcanization interfaces, design control, and document contrcl.

In addition, tne crocram also lac <ec cetailec 1molementino procecures for_

oesion. installation, ano inspection activities.

CORRECTIVE ACTION T AKEN AND RESULTS ACHIEVED Based on Audit 1-80-95 (performed November 11, 1980 and Novemoer of as-built 12, 1980) by CECO QA and CECO Construction review drawings, a stoo work letter dated November 12, 1980 was issued by Project Construction to Reactor Controls, Inc., coverino tne installation and inspection of safety relateo CRD pioing letter _=as aritten tovember 13, s u p o o r t s_,

an excenceo stop work 1980 to Reactor Controls, Inc., covering all safety related

2-enninearine work since further review of the deficiencies noted in tne Novemoer 12, 1980 Stop Work Letter were determined to be the responsibility of Reactor Controls, Inc., San Jose

- Engineering organization.

Subsequently, a letter from W.

H.

Donaldson to J. Hillett was written on November 17, 1980 to identify all the open items requiring resoJution.

The " Action Item List" encompassed the NRC findings and open items, CECO audit findings, the B. R.

Shelton letter dated November 6,

1980, and the' CECO QA trend analysis letter dated November 14, 1980.

In response to the Stop Work lettes and the action item list, Reactor Controls. Inc., has totally reviewed their 00/0C orocram.

As a result, implementation instruction and a OA manual addenda were written adoressing areas where their'7A/QC procram neeoed imorovement.

The QA Manual accenoa contains an inoex wnicn indicates anere each point of the 18 point criteria are addressed.

The instruction book is indexed to provide a cross reference to the Reactor Control, Inc., QA Manual and the 18 point criteria.

Specific items identified in the noncompliance report are oiscusseo oelow:

1.

(roanizational Interface:

Reactor Controls, Inc., has prepared the following procecures to identify various organizational interfaces:

1)

QA 1 3-1 Instruction For Jnterfaces Between Engineering and Stress Analysis.

2)

QA 1 6-3, Instructions for Document Transmittal for Approval.

3)

RSD.A 1, Procedure for Review of Design or Stress Analvsis Recorts Suomitteo ov venoors or suocontractors.

Additionally, it has been established that the responsibility for the transmittal of engineering and design information will be vested with the Engineering and Construction Manager for Reactor Controls, Inc., and the cognizant LaSalle County Project Construction Engineer.

2.

Desion Control:

Reactor Controls, Inc., has developed the following procedures to control design:

1)

Q A 1 3 1, Interfaces oetween Engineering and Stress Analysis; QA 1 3-2, Drawing Changes.

. 2)

RSDA 1, Procedure for Review of Design or Stress Analysis Reports Submitted by vendors or Subcontractors.

3)

QA 1 5-2, Enoineerino Drawinos ano Enoineerino Cnance_

Notices; QA i 6-2, ECCL control.

3.

Document Control:

Reactor Controls, Inc., has recently instituted a computerized system for controlling documents which have been reviewed and approved for use by their Project Engineer.

All documents which constitute tne Engineering Controlled Checklist (ECCL) will now be incluoed in the computerized system.

The following procedures implement Reactor Control's document control system.

1)

QA 1 3-2 Drawing changes 2)

QA 1 5-2 Engineering drawings and engineering enange notices 3)

QA 1 5-1 Procedure control 4)

QA 1 6-1 Document control heacquarters 5)

QA 1 6-2 ECCL control 6)

QA 1 6-3 Document transmittal for approval.

7)

QA 1 6-4 Document control site / shop 8)

OA 1 6-5 Document control system (computer) 4.

Installation and Inspection:

Reactor Controls.

Inc.. has develooed OA 1 8

?_

installation of component succorts to furtner cover tne installation ano insoection of tne CRD plaino succorrs.

Reactor Controls, Inc., is also oevelooing a final walkcown proceoure to oe useo for final insoection ano verification of tne as-built CRO piping ano support system.

This procedure will encompass tne requirements of IE Bulletin 79-14.

The LaSalle County Project Construction Engineer and the Site QA Supervisor reviewec the preliminary orafts of tne implementation procedures and the QA Manual accenda in San Jose Decemoer 9, 1980

-4 through December 12, 1980, in order to determine that all open items were being addressed.

Comments on these procedures and their response to the action item list were given to Reactor Controls at tnat time.

The formal transmittal of these procecures was received on site January 12, 1981, ano are currently being processed through the formal review by CECO and S&L.

A preliminary review and follow-up of implementation procedures and the QA Manual was performed by the NRC Region III and Region IV inspectors between January 12, 1981, ano January 15, 1981, in San Jose ano at Earthouake Engineering Systems (EES), Reactor Control's analysis suocontractor, in dan francisco.

It was explaineo to tne inspectors tnat we had not yet initiatea formal review and, therefore, no approval of any Reactor Control's procecures haa been given.

Some orocedures were still oeino oevelooed.

The NRC inspectors acxnowleogeo tnis ano inoicateo tnelr review was solely to keep abreast of the Reactor Control, Inc.,/ CECO corrective action progress.

All items raised during this NRC inspection were either in progress or were being reviewed and resolved.

The cesien and acceotance criteria for stiffness, ceflection. frecuencv, loadino comoinations, are current 1v ceinc reviewed bv 9M and Reactor Controls.

Reactor Controls is doina ohvsical_testino of_

clamos ano unistrut material.

Inese test results w111 De comparea to tne calculateo values usea by EES in the CRD pipe support analysis.

Sargent & Lundy is revising specification J-2922 to incorporate ECNS M-233-LS and M-285-LS in an Amendment.

These previously transmitted ECNs contained in the design information necessary for RCI to complete the analysis.

CORRECTIVE ACTION TO AVOID FURTHER NONCOMPLIANCE The contract with Reactor Controls is unique.

No other on-site contractor has extensive design and analysis responsibility coupled with the normal material supply and erection contract.

The division of responsibility within CECO, that is, Engineering is responsiole for design whereas Construction is responsible

' for administratidn of contracts which contain major field erection, lead to ambiguous control of the design portion of l

Reactor Controls scope of work.

As a result some of the open l

items from NRC Report 50-373/80-20; 50-374/80-13 were not adequately followed up to ' assure successful corrective action l

prior to the NRC inspection recorded in Report 50-373/80 48; l

l 50-373/80-30.

To resolve this problem, LaSalle County Project Construction has been given the responsibility for tne overall administration of Reactor Control's contract.

Project Engineering and S&L will provice assistance anc information

' as necessary but all design and engineering information transmitted to Reactor Controls will be transmitted with the knowlecge of the LSC Project Construction Engineer to the Reactor Control, Inc., Engineering and Construction Manager.

Similarly, Reactor Control's engineering and design information will be transmitted from the Reactor Control Engineering and Construction Manager to the LSC Project Construction Engineer.

The previously discussed Amendment to specification J-2922 will include all outstanoing ECNs, thus incorporating all oesign and technical information in one package.

The establishment of the single line responsibility and interface between Reactor Controls, Inc., Engineering and Construction Manager and LSCS Project Construction Engineer combined with the amenced specification encompassing outstanding ECNs should improve oesign control.

In adoition, review, approval, and implementation of Reactor Control proceoures previously referenced will provide the QA/QC controls necessary for design, document control, installation and inspection.

DATE WHEN FULL COMPLIANCE WILL BE ACHIEVED Full compliance is expected to be achieved generally in accordance with the following senedule:

1.

Submittal, Review, and Approval of Procedures 2/2/81 - 2/6/81 2.

Reactor Control, Inc., Training and Implementation 2/2/81 - 2/6/81 (off site) 2/9/81 - 2/13/81 (on site) 3.

Partial Life - Document Control, QC Inspection, HCU Bracing Detailing and Material Purchase.

2/6/81 4.

Partial Life - CEA Installation 2/13/81 5.

Partial Life - CRD HCU Bracing Erection 2/13/81 6.

Implementation Audit in San Jose 1

7.

Implementation Audit - Site l

8.

Lift Stop Work 2/20/81

s

' In this regard, we shall provide a copy of the RCI documentation package after final CECO approval has been given in order to expedite your review.

We request, therefore, that your

- verification review be timely so that work can be reinitiated on this project on the schedule definea above.

ITEM 2 10 CFR 50, Appendix 8, Criterion XVIII, states that, "A comprehensive system of planned and periodic audits shall be carried out to verify compliance with all aspects of the quality assurance program and to determine the' effectiveness of the program."

Commonwealth Eoison Company Topical Report CE 1-A,

" Quality Assurance Program for Nuclear Generating Stations", Revision 14, dated September 9, 1980, states in Section 18 that, "Auoits will be performed by Commonwealth Edison Company and/or its contractors, subcontractors and vendors to verify the impicmentation and effectiveness of quality programs under their cognizance" and " Audits will be performed selectively at various stages of contracts on a varying frequency, based on the nature and safety significance of the work being done to verify compliance and determine the effectiveness of procedures, inspections, tests, process controls and documentation."

Contrary to the above, audits of Reactor Controls, Inc.,

appeared to be inaaequate in that there was no systematic evaluation of contractor performance and audit findings were not resolved in a timely manner.

CORRECTIVE ACTION TAKEN AND RESULTS ACHIEVED 1.

As indicated in Commonwealth Edison's letter of June 6, 1980, responding to noncompliance items in report 50-373/80-20 and 50-374/80-13, an established program of Audits and surveillances does exist for RCI on-site and off-site activities.

RCI's off-site activities had been periodically reviewed during

scheduled audits-in May, 1977, with follow up and close out June, 1977; in March, 1979, with follow up and close out June, 1979; in March, 1980, with follow up and close out June through

. August, 1980.

This planned evaluation process for off-site activities was in addition to 4 on-site audits of RCI in 1977 4 in 1978, 8 in 1979, and 10 in 1980, as well as numerous I

surveillance of on-site activities.

The structure of the RCI organization is such that many on-site reviews necessitate l

evaluation of documents prepared off-site and as such, our on-site audits anc surveillances were indirectly reviewing off-site activities.

(

7-2.

The CECO audit of RCI and Earthquake Engineering Systems (EES) conducted on march 25, 26, and 27, 1980, reviewed in detail the RCI design, design control, and design personnel qualifications

. for the control rod drive (CRD) piping hangers.

Four items of noncopmpliance were identified and later closed out through review of RCI management commitments and documents transmitted to the site.

Commonwealth Edison has always had an established program for monitoring corrective action and ultimately closing out the audit noncompliances when resolved to our satisfaction.

Commonwealth Edison believes that this program was complied with during the close out of this audit.

3.

Commonwealth Eoison QA does acknowleage the fact that QA did not follow up and verify effective close out of the items ioentified during NRC inspector Yin's audit of RCI (San Jose) in April, 1980 (NRC Report 50-373/80-20 and 50-374/80-13).

For deficiencies identified oy the NRC at off-site vendor locations, it has been the practice, for engineering related items, that the Commonwealth Eoison Engineering organization respond to, and be responsible for, follow up and close out of the deficient item.

Commonwealth Edison engineering responded to the NRC citations indicating satisfactory resolution had been achieveo.

In these cases, Quality Assurance would not have initiated any follow-up action to assure satisfactory resolution.

Tnis problem is now resolved with the clear ioentification of the cognizant Construction Engineer as overall contract administrator.

4.

In light of RCI's f ailure to initiate and complete adequate corrective actions as committed in CECO's response of June 6, 1980, QA recognizes the need to establish a system to track the corrective action commitments for NRC Region III Off-Site venoor inspections.and verify proper resolution.

This would be in addition to our normal practice of monitoring follow up progress for on-site deficiencies.

In an effort to provide this coverage, the Quality Assurance Department has established by Hemoranoum #17 dated January 14, 1981, a program whien requires site QA track all NRC items with a monthly status report submitted to the Manager of QA.

This monitoring process is expected to assure timely completion of committed corrective action and should improve the ef fectiveness of the Commonwealth Edison QA program in this area.

5.

Relative to the specific matters of concern identified Oy Mr.

Yin curing his November,1980, audit of RCI, San Jose, immediate action was taken by the Commonwealth Edison Engineering organization when it was determined that follow up action was not adequately completed.

Separately, Site QA and Project Construction had been pursuing resolution of on-site aucit deficiencies prior to Mr. Yin's trip to RCI.

On Octooer 21, 1980

site QA scheduled an audit of RCI's on-site organization for the week of November 10.

This audit was to include formal review of corrective action taken by RCI in response to earlier CECO

. on-site aucits.

That audit identified inadequate corrective action by RCI on. CECO items.

As a result, installation ano inspection for all Safety Related CRD Pipe Supports was stopped on Novemoer 12, 1980.

Tnis "stop worka was later expanded to include all related Engineering activities in San Jose.

The with stop work will remain in place until Project Construction, the concurrence of Commonwealth Edison QA, is satisfied that adequate corrective action has been c 11eted.

6.

When Commonwealth Edison was advised by,RCI that they had in craft form, what they considered the majority of

prepared, procecures necessary to resolve Commonwealth Edison and NRC concerns, the Site QA Superintencent and the cognizant Project Construction Engineer performed an intensive review of the draft occuments at San Jose.

Comments were provided and in the case of the design interface document, total rewrite of procedure was recommended.

The incorporation of all comments has been completed and submittal of required documents began the second week of January.

Following review and approval of the necessary procedures, site QA plans to review the corrective action on site ano in San Jose prior to allowing RCI to return to work.

This will be followed by an extensive audit of RCI's implementation both on site and off site promptly after returning to work.

CORRECTIVE ACTION TO AVOID FURTHER NONCOMPLIANCE In audition to the Commonwsalth Edison QA/QC Program changes addressed in ITEM 1, and the implementation of Quality Assurance Department Memorandum #17 which was discussed above, the

~

Commonwealth Edison QA Department has been reorganized to improve the effectiveness of QA management levels in accressing Quality concerns.

Each of the construction sites now has three supervisory level personnel, 2 QA Supervisors and a QA Superintendent rather than a QA Supervisor as in the past.

This change should allow'tne Site QA organization to follow on-site and of f-site Quality Items more closely.

More management attention to significant quality matters and consequently l

quicker resolution of Quality Related Problems is expected.

This focusing of the attention of the responsible CECO Field Engineer on the QA/QC activities associated with a project as well as the administrative changes made in the conduct of activities by the CECO QA Department will prevent recurrence of the deficiencies identified.

[.

..,e

..o 9-DATE WHEN FULL COMPLIANCE WILL BE ACHIEVED The administrative changes in the conduct of review of on-site contractor QA activities has been implemented, including the aodition of a Site QA Superintendent., Final review and acceptance of the' RCI QA/QC Program changes will be completeo as oefined in ITEM 1.

The CECO QA verification audit of RCI

'j promptly af ter the stop work order has been lif teo.

e e

4 e

9 02798 4

ML20054D351

Contents

Text

Dear Mr. Earley:

Enclosures:

Subject:

SUMMARY

SUMMARY

SUMMARY

SUMMARY

Subject:

Dear Mr. Keppler:

Navigation menu

ML20054D351

Text

Dear Mr. Earley:

Enclosures:

Subject:

SUMMARY

SUMMARY

SUMMARY

SUMMARY

Subject:

Dear Mr. Keppler:

Navigation menu

Search