ML20065J585
| ML20065J585 | |
| Person / Time | |
|---|---|
| Site: | 05000000, Browns Ferry |
| Issue date: | 11/30/1981 |
| From: | Lanik G NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD) |
| To: | |
| Shared Package | |
| ML082180533 | List:
|
| References | |
| FOIA-82-261 NUDOCS 8210060082 | |
| Download: ML20065J585 (22) | |
Text
s
SUMMARY
OF THE AE0D ANALYSIS AND EVALUATION OF BROWNS FERRY UNIT 3 PARTIAL FAILURE TO SCRAM EVENT OF Jul,'I 28, 1980*
by the Office for Analysis and Evaluation of Operational Data (AEOD)
U.S. Nuclear Regulatory Commission Washington D.C. 20555 November 1981 Prepared by:
G. Lanik (921'0060082 820628
~~
l~PDR FDIA
_UDELLB2-261 PDR
- Presented to International Atomic Energy Agency Advisory Group on Using Experience from Abnormal Occurrences to Improve Safety of Nuclear Power Plants, November 23-27, 1981.
A a, 2_
o
1.
INTRODUCTION Browns Ferry Unit 3, owned and operated by the Tennesse Valley Authority (TVA), experienced a partial failure of its scram system on June 28, 1980 while shutting down for a scheduled feedwater system maintenance.
The failure occurred when the control room operating personnel initiated a manual scram at low power (about 35%), which was the next step in the nonnal shutdown evolution.
Upon scram actuation, all of the control rods on the west side of the core inserted properly.
However, most of the rods (80%) on the east side of the core failed to fully insert; stopping at positions ranging from 00 to 46 (fully withdrawn), with an average insertion of about 20 p-sitions.
In all, a total of four reactor scrams over a period of 14 minutes was required to complete full-in insertion of the east side control rods before normal shutdown could be resumed.
Shortly after the Browns Ferry 3 event, the Office for Analysis and Evaluation of Operational Data (AE0D) initiated an independent study of the occurrence, including the Browns Ferry 3 scram system design and operation and the special scram system tests and inspections which were performed at the plant site during the days immediately following the event. The principal purpose of this study was to provide an independent assessment of the event cause and to determine the lessons learned and recommend corrective actions to prevent recurrence.
The AE0D review focused, for the most part, on the scram system design and the adequacy of the design features which protect against the loss of scram capability and provide containment isolation.
Since it was recognized very soon after the event that the cause was due to an hydraulic problem, the discussion of this paper is addressed primarily to that aspect.
This paper includes a discussion of the Browns Ferry scram system, the AE0D analysis of the June 28 event, and the Nuclear Regulatory Commission (NRC) followup actions.
2.
BROWNS FERRY SCRAM SYSTEM DESCRIPTION On a General Electric (GE) BWR, such as Browns Ferry Unit 3, each control rod is moved by its own individual control rod drive (CRD) mechanism and its associated hydraulic control unit (HCU).
Figure 1 provides a schematic diagram of a typical BWR scram hydraulic system.
Rod motion is accomplished by application of an hydraulic pressure across a pisten in the CRD.
During scram (i.e., a rapid control rod insertion for reactor shutdown), a high differential pressure is applied across the CRD piston by opening the scram inlet valve to admit high pressure water from the scram accumulator to the area below the piston, and opening the scram discharge valve to vent the area above the piston to the scram discharge volume (SDV).
The SDV is a large free volume, initially at atmospheric pressure.
Each CRD is individually driven by an HCU which has its own scram inlet and outlet valves and its own
v Water pipinD Control w-Air line rod
[><1 Open valvo i
Nr b4 Closed valve Reactor supply k'
msel Electrical Outlet - open J
U.
i s e[1 -Inlet - closed !
solenoM Atmosphere l Atmospheren y 9 l
Sc,am
- =
N Check varve I
r vi+c l
l pilot air J
l header u
l Drivo
~ 'N ' '
l housing n
SDV l
vent r--s j
I H
aM I
Scram dischargo to Scram Scram l
volume (SOV)
Controf rod I intot outteI L ---n; drive and l valvo valve u
cooling water l (3
I'""'
Level condensaio l
11 0 r4 2
2 instrument r.torage l
l
()
tank T
Y l
Charging l
Scram l
header l
accumutator Drive
______j
}g u_._.__________
water Typical for 33 purnp 185 control v drain rod drives Figure 1.
DWR Scram flydraulic System (scrammed v-Ive lineup)
?
. scram accumulator.
The SDV is common to a large number of drives.
Browns Ferry Unit 3 has a total of 185 control rod drives, approxi-mately one half of which discharge to the east header of the SDV and one half discharge to the west header.
The. Browns Ferry SDV equipment layout is shown schematically in Figure 2.
The piping arrangement is shown in Figure 3.
The SDV is sized to provide a volume of approximately 3.3 gallons per CRD (approximately 600 gallons total).
The SDV volume is sized to limit the total amount of hot reactor water leakage past the seals during a reactor scram (maximum volume requirement) while providing enough free space at atmospheric pressure so that back pressure on the CRDs does not increase so rapidly as to impede rod insertion speed (minimum volume re-qui rement).
In particular, the system design results in a pressure in the
.SDV immediately following full insertion rod motions of less than 65 psig.
Low pressure in the SDV is necessary to assure that technical specification scram speeds and full-in rod motion are achieved.
The volume of water exhausted through the scram outlet valve of a single normal drive for a full stroke is about 0.75 gallons, not including seal leakage and bypass flow.
The leakage and bypass flow for a single drive can be in excess of 5 gallons per minute.
Normal scram time from full out to 90% insertion is less than 3 seconds.
Although the SDV is sized for a volume of approximately 3.3 gallons per drive and the drive stroke (without bypass) is only approximately 0.75 gallons, only a single reactor scram is normally possible with respect to the scram discharge volume.
Leakage of reactor water past the seals fills the SDV rapidly as long as the scram outlet valves are open which would be the case without an RPS reset.
This leakage occurs even on rods that are fully inserted.
The leakage is an average of 2 gpm to 3 gpm per CRD. Thus, from this source alone, the 3.3 gallons per drive of free volume available in the SDV is filled and pressurized within two minutes.
Thus, more than one scram would be possible only if the operator were able to reset the scram (closing the scram outlet valves) well within this time period.
Without an early reset, the SDV would be filled and the SDV would have to be drained to attempt a re-scram if rod motion is to be producqd.
The east and west SDV headers are each provided with a vent line and vent valve.
Each header drains via a separate drain line into a scram instrument volume (SIV) where level monitoring instruments are located.
The SIV, in turn, has drain piping and a drain valve.
During normal operation, the vent valves of the east and west SDV headers and the drain valve of the SIV are open.
These valves are kept open to allow the leakage past the scram outlet valves entering the SDV to drain continuously into the SIV so that no build-up of water in the SDV occurs which couid prevent a reactor scram. These valves close during control
3.
West Bank East Bank SDV vent ia SDV vent Open
() () () ( SDV hoadors SOV ) () () ()
~
A o
o o
o
/
4 level switches (scram)
Scram at 50 gal.
l discharge lines I level switch (rod hfock)
SIV at 25 gal.
l 1
~
l I
IICUs HCUs llCUs llCUs e
1 level switch (alarm) a
]
at 3 gal.
Other drains
[]
Floor elevation "
f"1 fl ai 1I
'M g
4" drain header Other drains and vents
~
flenctor building equipment drain sump a
Si etch of Browns Ferry SDV Equipment Layout (elevation)
Figure 2 t
8 9
. ~C axU
~
5 a
A'/ M T
/ v
/
2 E
I E
E
.g 2
3 b
5:
5k3 8
C
'5 h
y f
5 Y
E 3
.S
/
O b
N M
l h
h
/
s
/
7-c B
>/
=
/
g 2
/
e L
8 2
2 ca 5
/
u-C 9 :7 h
0 E
y E
u 6-5 5
2 4
4
' rod scram insertion to contain and limit the reactor water released through the scram outlet valves.
During a scram, inflow of water to the SDV normally continues after control rod insertion is completed due to leakage past the CRD seals.
Leakage continues until the. scram is reset or until the SDV pressure equilibrates with reactor pressure.
A pressure difference of at least 550 psi must be applied between the CRD insert and withdraw lines to drive the rods in during a scram. The pressure difference applied at the beginning of a scram is provided by the 1500 psia scram accumulator and atmospheric pressure in the empty SDV.
As CRD scram insertion progresses, pressure losses in the driving fluid due to line losses reduce the insert line pressure to below reactor coolant system pressure.
At that time, the ball check valve (integral to the CRD) allows reactor coolant system water to come in under the piston to complete the scram before any significant build-up in scram discharge volume pressure occurs due to filling from leakage and bypass flow.
The reactor protection system performs its design function by de-ener-gizing the 370 scram solenoid air supply valves (two for each HCU), and by de-energizing the two scram discharge volume (SDV) air supply solenoid val ves.
(Refer to. Figure 1.)
Scram insertion is achieved for each individual control rod by" opening the scram inlet and scram outlet valves.
For normal unscrammed conditions, the scram inlet and outlet valves are held shut by control air pressure applied through the energized scram air supply valves.
The SDV vent and SIV drain valves are held open by air pressure applied through the energized discharge volume air supply valves.
The air header which supplies control air to all of the 372 air supply valves (370 scram, 2 vent / drain) is pressurized through de-energized back-up scram valves which are not shown on Figure 1.
A scram signal de-energizes both air supply valves for each rod, de-energizes the SDV air supply valves, and energizes the back-up scram valves, thus venting air pressure from the scram inlet and outlet valves and the SDV and SIV valves. This causes the scram valves to open and the SDV vent and SIV drain valves to close.
In the event the individual control rod air supply valves should fail to change position (i.e., mechanical bind-up, etc.), the back-up scram valves which were energized and vented air to depressurize the air supply header assure opening of the scram valves. Thus, even if an air supply valve failed to shift, that rod would still scram.
At Browns Ferry Unit 3, the HCUs for all of the CRDs are physically arranged in rows on the east and west sides of the reactor vessel, outside the drywell and inside the reactor building.
(Refer to Figure 2.) The CRDs on the west side of the core are controlled by the west side HCUs and the CRDs on the east side of the core are controlled by the east
side HCOs.
Drives along the interface centerline, between the east arJ west sides of the core, are alternately routed to the east and west headers.
The HCUs on each side of the reactor are arranged in four rows.
Immediately above the four rows of HCUs are two cross connected " race track" shaped headers fabricated with six-inch piping into which the discharge from each scram outlet valve is. piped (see Figure 3).
The two connected six-inch headers on the east side comprise the east bank scram discharge volume (SDV) and the two connected six-inch headers on the west side comprise the west bank scram discharge volume.
Each HCU insert and withdraw line is connected to the CRDs below the reactor vessel with 3/4" schedule 80 piping through which the scram inlet and scram outlet water flows (and water for normal rod drive motion).
These lines average over 50 feet in length. The lines from the HCU scram outlet valve to the SDV are fabricated with 3/4" schedule 80 piping and are approximately 10 feet in length.
The scram instrument volume (SIV) is located on the west side of the reactor at one end of the west side HCUs (and SDV).
It is configured as a 12" diameter 10' high vertical cylinder.
Single float-type level switches are installed to monitor the three-gallon and 25-gallon levels.
Four float-type level switches are provided at the 50-gallon level for the purpose of initiating a reactor scram (SIV Hi Level Scram) before the SDV begins to fill beyond the point where complete control rod insertion would be prevented.
At Browns Ferry 3, the east bank and west bank SDV each drain via two-inch schedule 160 pipe to a single SIV located on the west side.
The drain line for the west bank is approximately 15' long while that from the east bank is approximately 150' long.
In each run, the total elevation fall in the line is approximately l' 7".
On the east bank run this is an average 0.13" fall per foot of horizontal run.
The drain line piping at the bottom of the scram instrument volume and the vent line piping at the high points of the slightly inclined east bank and west bank SDV headers are routed down to the clean radwaste drain (CRW) piping physically located in the reactor building floor.
The CRW system is a closed drain system which discharges underwater in the reactor building equipment drain sump at the lowest elevation in the reactor building.
Many other equipment items are drained and vented by this drain system.
3.
AE00 ANALYSIS AND EVALUATION Analysis Immediately following the event at Browns Ferry 3, all aspects of the scram system were investigated in an effort to find the cause. The reactor protection system (RPS), the air system, mechanical aspects of the CRD and various valves, the CRD and HCU hydraulics, and the possibility of air in the hydraulic system were considered.
Finallyt attention was focused on the east bank SDV.
. As discussed previously, the CRD HCU exhausts are partitioned into east and west bank scram discharge headers.
CRDs which discharge into the east header are located on the east half of the core, while CRDs which exhaust into the west headers are positioned on the west side of the core.
The most notable observation of the control rod positions after the first manual scram was that all of the CRDs exhausting into the west header inserted full-in (except for the CRD at position 30-23 which inserted to within one notch of full-in) while the control rods ex-hausting into the east bank header inserted an average of only 20 positions. This CRD insertion pattern provides strong evidence that the fundamental cause of the extensive failure-to-fully-insert of the CRDs on the east side of the core was hydraulic in nature.
More spec-ifically, the rod pattern resulted from an inability of the east header CRDs to exhaust properly for some reason.
With respect to possible multiple scram outlet valve failures, all of the east header scram discharge valves were observed by the control room operators to have opened upon manual scram actuation.
Additionally, all of the manual isolation valves on the scram discharge lines of the east header HCUs were inspected by the licensee immediately upcn shutdown, with each found to be fully open. Accordingly, the remaining possible hydraulic causes could have been blockages in most of the CRD scram exhaust discharge lines or inadequate free volume (or high back pressure) in the east header SDV.
Subsequent scram testing of numerous east header CRDs which failed to fully insert demonstrated, however, that no blockages existed in the CRD exhaust lines. Accordingly, it was concluded that for some reason the east bank SDV had inadequate free volume available to accept the full scram discharge from all east bank CRDs exhausting into the east header.
Thus, the observed east bank control rod insertion behavior can best be explained on the basis that the east header SDV was at least partially filled with wtter when the operator manually scrammed the reactor.
As discussed earlier, adequate free volume must be available in. both the east and west headers to accommodate water exhausted during control rod scram insertion.
Furthermore, water must be exhausted into the SDV with low back pressure on the drive piston to assure that technical specification scram speeds are met. A reduction in the free volume in the SDV could tend to increase back pressure on the drive pistons too fast which could then increase the time reqyired to complete scram insertion. Complete rod insertion would still be possible, however, even for significant reductions in the available free volume in the SDV as l
demonstrated in recent single CRD scram test simultations performed by GE.
The GE tests showed that for a 4D% decrease in the available SDV, l
. a control rod can still fully insert over a broad range of seal leakage values.
For a 70% reduction (i.e.,1.0 gal / drive remaining) in available scram discharge header free volume, the rods could still fully insert if seal leakage rates were small enough. For a reduction in SDV of this mag-nitude, however, increasing seal leakage rates can cause the CRD travel (number of positions inserted) to decrease.
Thus, these tests clearly demonstrate that CRD travel during scram insertions can be sharply reduced if the amount of available exhaust volume is reduced sufficiently.
During the June 28, 1981 event, the drain time between the first and second manual scram was 93 seconds and between the second and third manual scram the drain time was 53 seconds. Tests at Browns Ferry show that normal drain rate for the east SDV is about 11.6 gpm when east and west scram discharge volumes are draining simultaneously.
Thus, by multiplying this normal drain rate times the drain time between scrams, we can cal-culate approximately how much water could have drained out (free volume made available) of the east bank header during the periods between scrams.
Multiplying, one finds that about 18 gallons would have been made avail-able during the first drain (between scrams 1 and 2) for the second scram, while about 10.2 gallons would have been available during the second drain (between scrams 2 and 3) for the third scram.
From GE tests of average rod motion, if every east bank CRD were assumed to have a seal leakage of 5 gpm (conservative, based on CRD maintenance recommendations),
about 20.5 gallons of free volume would have had to be available during the second scram and about 9 gallons for the third scram.
Comparing the results of the above calculations, it could be concluded that the east SDV was draining normally between scrams one and two, and two and three, and that the average rod insertion during the second and third scrams was the amount which one would expect for the amount of volume made available by the drain.
Thus, the insertion behavior of the east bank control rods logically could be explained on the basis of a virtually filled SDV during the second and third scrams.
This same approach can be used to infer the cause of limited control rod motion during the first manual scram and make an estimate of. the free volume available for the first scram.
The calculated value of free volume by this method is approximately 40 gallons.
Finally, evidence that the east bank scram discharge volume was initally partly filled with water can be found in the elapsed time to activate the SIV Hi Level scram switches following the first manual scram.
Reactor scrams at BF-3 prior to the June 28, 1980 event resulted in time delays from reactor scram actuation to SIV Hi Level scram actuation ranging from 42 to 54 seconds.
The first manual scram from the June 28
- event had a delay of only 19 seconds.
For a normally empty SDV and SIV, the time delay would represent the time it takes for water exhausted from the CRDs to enter and begin to fill the SDV, travel down the SDV-to-SIV drain lines, and fill the SIV to the 50-gallon level.
If water were already in the east SDV, water exhausted from the CRDs would almost immed-iately start to push water out of the east SDV and into the drain line.
This would cause the SIV to fill more rapidly.
Thus, an elapsed time of only 19 seconds to actuate the SIV Hi Level scram switches provides important evidence that the east SDV was already almost completely filled with water at the time of the first manual scram.
Investigation The AE0D investigation was unable to conclusively determine the immediate cause of water accumulation in the east header prior to the first scram.
If a blockage had been present to c>use the initial accumulation, it was either cleared out by the pressure of the initial scram or inadvertently removed during the subsequent physical investigations performed by the licensee.
However, the event investigation did lead to a better under-standing of the scram system.
For example:
(1)
It became' evident that even unobstructed drainage of the SDV to the SIV during certain inleakage situations would not actuate the scram level switches in the SIV to provide an automatic scram (as intended) prior to filling of the SDV.
This is because the two lines draining into the SIV from the east and west SDVs are relatively long two-inch normal diameter pipes and the water is driven through them to the SIV by a very low hydraulic head.
The elevation difference between the top of the SDV and the discharge of the two-inch line _to the SIV is less than two feet. On the other hand, the drain from the SIV is a relatively short two-inch line with a possible hydraulic head up to the level of the scram switches before automatic scram would occur.
Thus, under normal conditions at atmospheric pressure (i.e., with vent and drain valves open) the drain rate from the SIV is sufficient to prevent any significant build-up of water in the SIV event though the SDV is filling because of a leakage which is greater than its long two-inch drain line can handle.
This led investi-gators to propose that corrections to the SDV/SIV should include greatly improved flow communication between the SDV and the SIV.
(2) Another aspect of the design which became apparent during the AEOD investigation was that following a reactor scram when the scram outlet valves are open, the SDV vent valves and the SIV drain valve provide the only isolation barrier between primary system water and the atmosphere (through
. the clean radwaste drain system). Thus, the investigators proposed improvement of containment isolation provisions by adding redundant isolation valves in the SDV vent and SIV drain lines.
Findings The initial AE0D report was issued July 30,1980 (Reference 1) and contained the following findings:
The BF-3 scram instrument volume (SIV) Hi Level scram function o
did not and cannot provide protection against the undetected accumulation of water in the east scram discharge volume (SDV) header with attendant loss of the east bank scram capability even during unobstructed venting and draining conditions.
A single blockage in the west header SDV vent or drain line can o
result in an undetected accumulation of water ia both the east and west headers which could disable the scram capability of all control rods.
~
With the current SDV/SIV design, a blockage in the SDV drain o
(or vent) path can cause a partial loss of scram capability and disable the protection function installed to assure de-tection and corrective action.
The current SDV/SIV design arrangement results in the automatic o
Hi Level scram safety function being adversely influenced by the nonsafety-related reactor building clean raJioactive waste drain system.
The BF-3 partial scram failure occurrence, together with o
recent events at other BWRs, shows that float-type water level j
monitoring instruments have a significant degree of unreli-l ability.
If a scram condition exists which cannot be bypassed in SHUTDOWN o
or REFUEL mode, then failure to close of the SDV vent or SIV l
drain valve can result in an unisolable blowdown of reactor coolant outside primary containment.
The emergency operating instructions at BF-3 did not include a o
procedure or guidance for the operator to follow in the event of a partial or complete scram failure.
Recommendations As a result of the findings described above, AE0D recommended the following
(
l changes to the scram system design and operating basis:
The SIV Hi Level scram function should be independent of the o
SDV vent and drain arrangement. An acceptable configuration would be to place the SIV tank directly under the low end of l
l
the six-inch SDV header and to connect the top of the SIV tank to the bottom of the SDV header by a short, vertical six-inch diameter pipe (rather than the long two-inch diameter horizontal pipe).
This arrangement should assure water spillage from the SDV directly into the tank containing the level monitoring instruments.
Diversity should be added to SIV water level monitoring o
instruments for the SIV Hi Level scram function.
All vent and drain paths from the SDV and SIV should be o
equipped with redundant, automatic isolation valves.
Emergency operating procedures and operator training o
should be provided for both partial and complete scram failure events.
4.
NRC FOLLOW-UP ACTIONS Preliminary Notifications, Action Letter and Bulletin The event at Browns Ferry Unit 3 resulted in prompt action by personnel of TVA, GE, and NRC to analyze and evaluate the seriousness of the event, determine the cause, and take corrective action to prevent recur-rence.
The NRC initiated an immediate investigation by two NRC Resident Inspectors assisted by a specialist in core physics from NRC Region II.
A Confirmation of Action letter was issued by Region II confirming TVA's commitments for action to be taken before restart of Browns Ferry Unit 3.
An evaluation team was formed from NRC. headquarters and the team was dispatched to the BF-3 site under direction of the Region II Director.
Preliminary Notifications were issued by the Office of Inspection and Enforcement (IE) on June 30, July 3, and July 14, 1980 to notify all NRC offices of events related to BF-3.
The Director of IE briefed the NRC Commissioners on July 3,1980.
Preliminary inspections, testing, analyses, and evaluations indicated the cause of the BF-3 event was the accumulation of a significant amount of water in the east side SDV.
The exact cause of the water accumulation could not be determined, but the most proba' le cause was determined to o
be insufficient draining of the SDV due to an obstruction in the drain and/or vent lines.
NRC Bulletin IEB 80-17 was issued on July 3,1980 to provide test and surveillance requirements to assure that similar conditions did not exist at other operating BWRs.
This bulletin required licensees of BWRs designed by GE to initiate corrective actions to prevent a significant accumulation of water in the SDV and to perform tests confirming that no other significant problems existed in the scram system.
In addition, IEB 80-17 required actions to enhance mitigation should a scram failure occur.
Supplement I to IEB 80-17 was issued on July 18, 1980 following NRC evaluation of additional detailed information received on "as-built" SDV piping configurations and administrative procedures related to the use of the standby liquid control system (SLCS).
This supplement required (a) additional inspection and evaluation of the as-built SDV system, (b) procedures 'specifying action to be taken if water is found in the SDV, (c) additional procedural controls on the use of SLCS, and (d) installation of a system to continuously monitor for water accumulation in the SDV.
During the period from July 30 until August 5,1980 working level regional meetings were held with BWR licensees to gather information regarding the as-built configurations of the scram discharge system at each operating BWR.
Supplement 2 to IEB 80-17 was issued on July 22, 1980 after testing required by IEB 80-17 at Dresden Nuclear Power Station Unit 3 and additional testing at Browns Ferry Unit I highlighted the importance of proper SDV venting.
This supplement required that each BWR licensee with an SDV system similar to BF-3 must provide a vent path continuously open to building atmosphere.
Subsequently, all plants have verified that their SDV vent systems contain a direct vent path to the reactor building atmospnere.
A proposed abnormal occurrence report vias issued on July 30, 1980 classifying the BF-3 event as a major degradation of essential safety-related equipment.
AE0D Investigation of Interim Correction Measures Following issuance of its July 30 report, AE0D continued its investigation and began taking a closer look at the added scram discharge volume instru-mentation required by the IE bulletins in terms of acceptability for continued operation pending completion of the recommended long-term system modifications.
This ongoing study resulted in the recognition of an interaction between the control rod drive system and the non-essential control air system that could degrade the scram capability of BWRs. This concern was first published in an AE0D memo to NRR dated August 18, 1980.
The memo described the scenario where a loss of control air to the hydraulic control units could cause multiple scram outlet valve leakage to the SDV that would not be detected due to the drainage characteristics of the SDV and the SIV.
Degraded air pressure in the scram valves could result in the scram valves drifting slightly open (without control room indication) as air pressure decreases, but the control rods themselves would not move because of the CRD seal leakage.
This situation could fill the SDV suf-ficiently to prevent a scram.
It was also noted that loss of contrni air is not an uncommon event.
The exact air pressure at which a given scram valve begins to drift open depends on mant.facturing tolerances.
The pressure for a group of valves is in the rarse of about 40 to 45 psia.
In addition, information from GE indicated that a leakage flow of 1 to 5 gpm through a scram outlet valve could occur without producing rod motion.
The actual value for a given drive would depend on the condition of the seals in that particular
drive.
GE also stated that for a typical reactor, if the scram discharge valve flow rate to produce rod motion for each individual CRD was averaged with the flow rate to produce rod motion of all other CRDs, the average would be in the range of 2 to 3 gpm.
With this information it can be postulated that a degraded control air pressure condition could exist for which leakage from a large number of scram outlet valves could exist without producing a scram.
In fact, depending on the number of scram valves which partially open and the leakage rate of these valves, it would be possible to generate a significant flow of water into the SDV without producing significant rod motion.
It is recognized that the possibility of the actual occurrence of high flow rates without rod insertion depends on three factors:
(1) the control air pressure degradation pattern, (2) the range of air pressure over which the scram outlet valves open, and (3) the seal leakage rate of the CRD associated with each particular scram outlet valve.
However, with the data given above, a flow rate in the range of 1 to 2 gpm per drive without significant rod insertion could be possible for certain degraded air pressure scenarios.
Assuming an average leak rate that could be generated without significant rod motion (given a specific degraded air pressure) of 2 g'pm per CRD, a total of 2 x 185 or 370 gpm flow into the SDV could occur. Although this large flow rate appears feasible within the characteristics of the system, lower rates of leakage to the SDV could also be generated by the same mechanism, and indeed are more probable.
It is recognized that an actual air system failure would likely lead to continuously changing leakage rates, but the air pressure degradation might level off and thereby stabilize the leakage rate at any point.
Due to the close cooperation between AE0D and IE personnel, this concern was quickly relayed to all BWR licensees in IE Information Notice 80-30.
Shortly thereafter, IE Bulletin 80-17 supplement 3 required BWR licensees to implement measures to respond to degraded air events.
On October 1,1980 AE00 published a report (Reference 2) which contained an evaluation of the interim measures taken at Browns Ferry to prevent scram system degradation until a long-term modification could be imple-mented. These interim measures were implemented in reponse to IE Bulletin 80-17 and Supplements 1, 2 and 3.
These documents directed BWR licensees to begin surveillance of the SDV to detect the presence of water. The additional hardware installed at Browns Ferry for monitoring the SDV for the presence of water is an ultrasonic (UT) system which uses the pulse-echo technique of depth measurement. Ultrasonic transducers are mounted on the east and west SDV header low points.
The transducer is driven by a signal generating and processing device which incorporates a cathode ray tube (CRT) display and provides output to a strip chart recorder. A
o requirement for continuous monitoring of the SDV water level in the control room was stated in Supplement 1.
Scram system problems revealed by testing subsequent to the Browns Ferry event were reported in Supplement 2.
Supplement 3 was issued in response to the control air concerns raised by the AE00 memorandum of August 18.
This supplement required certain operator actions following a loss of control air to the HCUs.
The principal findings of the AE0D study are summarized below:
The interim system (ultrasonic water detection equipment o
and special procedures) in conjunction with previously installed instrumentation and procedures does not restore the level of scram protection capability thought to be assured in the original design.
However, except for degraded control air pressure events, it does adequately assure for the interim that any accumulation of water in the SDV (from currently identified sources) which could result in a loss of scram capability will be reliably detected and adequately responded to by the operator, o Degraded HCU control air pressure could result in scram outlet valve leakage to the SDV which would require opera-tor action to manually scram the reactor within a few minutes or scram capability could be completely lost.
Control air related disruptions in the plant would likely initiate a plant disturbance which would require a scram.
The principal recommendations of the AEOD study are as follows:
o An immediate scram should be required for the degraded HCU control air pressure case.
o Redundant HCU air header pressure instrumentation should be provided in the control room. A distinctive alarm for degraded air pressure should be provided to aid the operator in quickly focusing his attention on the need for protective action.
o Because of the possibility that a currently unidentified water source might cause water accumulation in the SDV, it would be prudent to closely monitor the ultrasonic system output.
Confirmatory Orders Confirmatory orders were issued on October 2,1980 to 16 facilities that had provided unacceptable responses to rdquirements set forth in IEB 80-17 Supplement 1.
The orders confirmed commitments by each utility to install instrumentation to provide control room indication and alarm of accumulation of water in either SDV header volume.
The orders also provided for increased
surveillance (once per shift) of the SDvs until installation of the continuous monitoring system was completed (by December 1,1980).
Browns Ferry committed to be completed by December 22, 1980 because of equipment availability considerations.
This was acceptable since Browns Ferry also committed to surveillance of the scram-discharge volumes once per 30 minutes until the modifications were completed.
During the course of the above events, special inspection procedures were developed and issued to the NRC Regional Offices for guidance in inspecting licensees' actions in response to bulletin requirements.
Briefings on the significant issues and NRC actions were provided to the Commission and the ACRS both shortly after the BF-3 event and follcwing implementation of certain short-term actions.
NRP, Safety Evaluation In early August 1980, the Office of Nuclear Reactor Regulation (NRR) formed a task group to meet with a BWR owners group to establish design criteria for possible long-term scram discharge system modifications.
This was done with the participation of both IE and AE0D. The design criteria developed closely followed the recommendations of the AE0D studies.
The NRR Safety Evaluation Report (SER) dated December 1,1980 (Reference 3) summarized the results of a generic evaluation of BWR scram discharge system deficiencies found as a result of the Browns Ferry 3 event of June 28, 1980 and subsequent investigations, tests, and analyses.
The report also addressed the short-term actions taken by each licensee and provided the basis for the staff judgment that continued operation of these plants is acceptable pending the implementation of pemanent modifications.
It described the content of IE Bulletins and Supplements which identified these requirements and provided the technical bases for the requirements. An appendix to the report provided a summary of the plant-specific actions taken by each licensee in reponse to bulletin requirements and the staff evaluation of these actions.
The report also described additional requirements which had to be met by each licensee to provide an automatic air header dump on the control air system to mitigate problems associated with fast fill of the SDV during certain loss of control air events.
The design criteria that were developed by the BWR owners group for use in implementing permanent system modifications to correct deficiencies were described together with their technical bases.
These criteria were endorsed by the NRR SER as providing adequate design criteria for permanent long-term corrective action.
Acceptable means of complying with these criteria were also listed.
Use of these means of compliance would alleviate the need for plant-J specific approval of permanent modifications by the NRC. Other
{
e -
means of complisnce would require specific NRC approval, together with analyses and tests, which justify the acceptability of the alternate design.
Those licensees which agreed to the criteria were issued a Confirmatory Order from the NRC to establish the legal obligation of the licensee to proceed with the changes.
(As of the date of publication of this paper, orders are in preparation but have not been sent.) Those ifcensees which do not voluntarily agree to the design criteria will be issued an Order for Modification by Licensee, requiring compliance with the design criteria.
As a consequence of the NRR SER review, two additional requirements were identified in addition to the design criteria proposed by the BWR owners group.
Both requirements had been identified earlier in the AE00 reports as areas where improvements might be desirable.
The first requirement addressed the potential fast fill of the SDV on loss of control air.
An automatic air header dump will be required to initiate scram on control air header low pressure.
This will cause a scram before the SDV fills from scram outlet valve leakage due to low control air pres-sure and thereby prevent loss of the scram function.
The requirement for an automatic air header dump was implemented via NRC Orders which were issued on January 9, 1981.
The second additional requirement involved certain modifications to the BWR owners group design criteria for SDV level instrumentation. These modifications are to address potential common-cause failures.
In the evaluation of the owners group criteria, NRR outlines acceptable means of complying with the criteria.
If a licensee chooses to follow these means, no further review by NRR is needed.
However, should a licensee decide to use some other means of canpliance to the criteria, a plant-specific review will be required.
The final design criteria listed in the NRR SER are as follows:
(1) The scram discharge headers shall be sized in accordance with GE 0ER-54 and shall be hydraulically coupled to the instrumented volume (s) in a manner to permit operability of the scram level instrumentation prior to loss of system function.
Each system shall be analyzed based on a plant-specific maximum in-leakage to ensure that the system function is not lost prior to initiation of automatic scram.
l Maximum in-leakage is the maximum flow rate through the scram discharge line without control-rod motion summed over all control rods. The analysis should show no need for vents or drains.
i (2) Level instrumentation shall be provided for automatic scram initiation while sufficient volume exists in the SDV.
(3)
Instrumentation taps shall be provided on the verifcal j
instrument volume and not on the connected piping.
(4) The scram instrumentation shall be capable of detecting water accumulation in the instrumented volume (s) assuming d
a single active failure in the instrumentation system or the plugging of an instrument line.
(5)
Structural and component design shall consider loads and conditions including those due to fluid dynamics, thermal expansion, internal pressure, seismic considerations, and adverse environments.
(6) The power-operated vent and drain valves shall close under loss of aii and/or electric power.
Valve position indication shall be provided in the centrol room.
(7) Any reductions in the system piping flow path shall be analyzed to assure system reliability and operability under all modes of operation.
(8)
System piping geometry (i.e., pitch, line size, orientation) shall be such that the system drains continuously during nonnal plant operation.
(9)
Instrumentation shall be provided to aid the operator in the detection of water accumulation in the instrumented volume (s) prior to scram initiation.
(10)
Vent and drain line valves shall be provided to contain the scram discharge water with a single active failure, and to minimize operational exposure.
In addition to design criteria, the NRR SER also includes a list of func-tional criteria, safety criteria, operational criteria and surveillance criteria.
As of the date of this paper, orders confirming the licensees commitments to SDV modifications that satisfy the NRR design criteria are in final preparation but have not yet becn issued.
However, plant modifications which satisfy the design criteria have proceeded at some plants even though the order has not yet been issued.
At this time, the final date by which all plants will be modified is December 1983.
Most plants will l
be modified considerably sooner and some are already modified.
Ongoing Study of Postulated SDV Break Following the investigation of interim corrective measures, AE0D returned its attention to the original case study report (Reference 1).
In this report, AE0D questioned the adequacy of the scram system design with regard to the reactor coolant boundary and primary containment functions.
Following a more thorough safety review by AE00, additional issues and safety concerns were raised with respect to the break isolation capability of the scram system and subsequent operation of the emergency core cooling systems in the unlikely event that an SDV header or associated drain and
a -
and vent piping were to rupture following a scram.
The results of this work were presented in an AE0D report in May 1981 (Reference 4).
AEOD found that, in the unlikely event of a SDV system pipe break attendent to a reactor scram, termination of the resultant reactor coolant blowdown outside primary containment would be dependent on successful closure of non-redundant (scram outlet) valves.
The closure principle and design arrangement of these valves did not meet the important requiremente for isolation valves described in General Design Criteria.54 and 55 of Appendix A to 10 CFR 50.
Furthermore, while the break isolation involves a man-machine system, AE0D found that potentially less than adequate human factor preparation had been provided, given the importance to safety of isolating a break in the SDV system.
Additionally, in the event that break isola-tion is not achieved, the current plant emergency operating procedures did not adequately address the potentially concurrent need for maintaining the core covered and protecting against the loss of ECCS equipment due to adverse environmental conditions including flooding.
AE00 found that failure to isolate an SDV system pipe break raises serious concerns regarding the assurance of long-term decay heat removal with emergency core cooling systems since the break itself potentially threat-ens operation of this equipment. At the same time, information found from investigation of the mechanical integrity assurance basis of the SDV system piping indicated that the present level of assurance may not be commensurate with the risks associated with an accidental rupture of this piping.
In view of these perceived risks, AE0D recommended that the regulatory need to postulate such pipe breaks as part of the BWR design basis be determined and standardized.
To this end, AE0D recommended that a two-phase action plan be initiated.
The first phase should immediately address and correct the presently inadequate mechanical integrity assurance basis of the SDV system pressure boundary components for operating BWRs.
The second phase should incorporate a high priority safety issue review which will address the need to consider such breaks in the design basis and will develop and implement the needed corrective actions on a plant-by-plant basis if it is determined that SDV system breaks are to be included in the plant design basis.
The NRC study of this isssy is ongoing and a generic safety evaluation has been issued (Reference 5); a resolution is expected in early 1982.
- REFERENCES 1.
Rubin, S. and Lanik, G., " Report on the Browns Ferry 3 Partial Failure to Scram Event on June 28, 1980," July 30, 1980.
2.
Lanik, G., " Report on the Interim Equipment and Procedures at Browns Ferry to Detect Water in the Scram Discharge Volume," September 1980.
3.
" Generic Safety Evaluation Report BWR Scram Discharge System," December 1, 1980.
4.
Rubin, S., " Safety Concerns Associated with Pipe Breaks in the BWR Scram System," NUREG-0785, May 1981.
5.
" Generic Safety Evaluation Report Regarding Integrity of BWR Scram System Piping," NUREG-0803, August 1981.
9
.__