ML20076B171
| ML20076B171 | |
| Person / Time | |
|---|---|
| Site: | Sequoyah  |
| Issue date: | 07/12/1979 |
| From: | Mills L TENNESSEE VALLEY AUTHORITY |
| To: | Vassallo D Office of Nuclear Reactor Regulation |
| References | |
| NUDOCS 7907200376 | |
| Download: ML20076B171 (37) | |
Text
y
[- 31 o
TENNESSEE V ALLEY AUTHCRITY cr ew,c cc a. Tra css er rac' 400 Chestnut Street Tower II July 12, 1979 Sk. Dominic B. Vassallo, Acting Director Division of Project Management Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Cocmission Washington, DC 20355
Dear Mr. Vassallo:
8 In the Matter of the Application of
)
Docket No. 50-327 Tennessee Valley Authority
)
Enclosed are TVA's responses to the requests for additional information transmitted in S. A. Varga's letter to H. G. Parris dated June 1, 1979, concerning Sequoyah Nuclear Plant (SNP) Unit 1. provides responses to each of the 13 items of the NRC-0IE y
Bulletin 79-06A.
These respcases to the bulletin are essentially the same as presented to the Advisory Committee on Reactor Safeguards (ACRS) on May 11, 1979. is our responses to the ACRS recommendations of April 7, 17, and 20, 1979, which were also presented to the ACRS on May 11, 1979.
As seen from the enclosures, our responses indicate an extensive evalua-8 tion of the Three Mile Island (TMI) incident as it relates to the ShT facility design and operation. This evaluation has verified the adequacy of current design and procedural controls governing operation, testing, and emergency response for the Sequoyah facility. However, our evalua-tion has also identified appropriate changes to improve the nuclear safety and reliability of the Sequoyah facility.
These changes in design, testing, operation, and emergency procedures are expressed as 1
i
\\
9
(
79072003g o s m c _ m e,-
' [, 9 l.
Mr. Dominic B. Vassallo July 12, 1979 co=mitments in the enclosures and will be documented in the SNP Final Safety Analysis Report (FSAR). TVA will continue to incorporate lessons learned from its review of the TMI incident into its nuclear plants, both operating and under construction.
Very truly yours, TENNESSEE VALLEY AUTHORITY I3/\\
f7
.. M. Mills, M nager Nuclear Regulation and Safety 8
Enclosures 8
l i
s
)
ENCLOSURE 1 RESPONSE TO NRC OIE BULLETIN 79-06A 8
e
[
ENCLOSURE 1 Response to ' RC OIE Bulletin 79-06A 1.
Review the description of circunstances described in Enclosure 1 of 1E Bulletin 79-05 and the preliminary chronology of the TMI-2 3/28/79 accident included in Enclosure 1 to IE Bulletin 79-05A.
This review should be directed toward understanding:
(1) the a.
extreme seriousness and censequences of the simultaneous blocking of both trains of a safety system at the Three Mile island unit 2 plant and other actions taken during the early phases of the accident; (2) the apparent operational errors which led to the eventual core damage; and (3) the necessity to systematically analyze plant conditions and parameters and take appropriate corrective action.
b.
Operaticnal personnel should be instructed to (1) not override automatic action of engineered safety features unless continued operation of engineered saf ety f eatures will result in unsafe plant conditiens (see Section 7a of this bulletin); and (2) not make operational decision.s based solely on a single plant parameter indication wben one or more confirmatory indications are available.
c.
All licensed operators and plant management and supervisors with operational responsibilities shall participate in this review and such participation shall be documented in plant records.
8
,,2 Response to question 1 The plant superintendent o f T'.'A's Rel le f en te Nucl ea r Plan t,
a 2-unit Sabcock and Wilcox type reactor plant, presented a review of the TML incident to all nuclear plant managers and supervisors with operational responsibilities.
This review began at Stevns Ferry on April 23, 1979, and at Sequoy.th.Nucleai Plant on May 4, 1979.
In addition to studying NRC reports and analysis of the event, he was on site at the Three Mile Island plant in an assistance role during the period of April 9-13, 1979, and is f amiliar with the circums tances of the TMI incident.
Plant manage: cat subsequently conducted a comparable review using the same material and training aids for all licensed operators.
This review was directed toward (1) understanding the serious consequences of improper alignment of critical systems, (2) evaluating operational actions which could potentially lead to core damage, (3) recognizing the potential for erroneous conclusions based upon a single observation of a given plant parameter, and (4) understanding the necessity to systematically analyze plant conditions and parameters and take appropriate corrective action.
Instruction and caution was given to licensed operating personnel in (1) not overriding automatic action of engineered safety features and (2) not making operational decisions on a single observation of a given plant parameter when one or note ccnfirmatory indications are available.
The contents of and participation in this review was documented.
8
2 Action 2.
Review the actions required by your operating procedures for coping with transients and accidents with particular attention to:
Recognition of the, possibility of forming voids in the primary coolant a.
system large enough to compromise the core cooling capability, especially natural circulation capability.
Respcase to questien 2a Abnormal Operating and Emergency Operating Instructions dealing with transients and LOCA situations have been reviewed.
In relation to the recognition of the possibility of forming voids in the primary system, these instructions differenti-ate between situations in which maximum charging and reactor seal injection flow are adequate to maintain pressuriser water level and thus prevent void formation and those situations in which voiding is an expected occurrence.
A caution will be inserted in the appropriate operating instructions dealing 8
with LOCA situations to indicate the potential of forming voids in the primary system.
In most czscs, the engineered safety features have been designed to cope with voiding, thus plant operating instructions need not make specific ref erence to specific operator actions in response to voids in the primary system since this would be the expected condition. These instructions do require verification of proper safety system actuation and operation.
Specific cautions and requirements are included for the termination of any automatic safety system function.
There are two situations where void formation is not expected during a loss of coolant event which must be recognized by the operators and appropriate action taken.
(1) If the loss of coolant is caused by an open pressurizer relief valve which cicses or is isolated before the system depressurizes to hot leg saturation, voiding is not expected. The detection of this type of transient is covered by an abnormal operating instruction which instructs the operator to isolate the faulty relief valve and, if possible, to recover pressurizer pressure and level to their normal operating values.
(2) Voiding in the primary system is 8
not expected for breaks suf ficicntly small such that RCS pressure equilibra tes above hot leg saturatica shen safety injection flow equals break flow.
This small LCCA situation is covered by an operating instruction which instructs the operator to maintain RCS pressure by supplying adequate charging flow and to recover pressuricer level to normal if possible.
In these two specific cases, confirmation cf no voids in tne primary system will be by sufficient pressuriser pressure for existing hot leg temperature.
Action 2b.
Operator action required to prevent the formation of such voids.
R e s'p.o n s e to cuestien 2h Ac rentioned in the reapense to Action 2a, accident procedures dealint; with h0CA situati;nu in ttuct the ope itar to take actions to provide core coo!ing and t>
u'intain prensurl:Or pressure above the c o r r e r.n c a n.1g 20 0 l e r, saturation temperature.
Examples of irrediate required operator actions from these instructions whica tend to prevent void formation in LUCA situations include:
1.
Verif"ing that reactor trip has occurred, and that safety inj ection has been initiated 1: reactor coolant pressure is below the setpoint.
2.
Verifying that residual heat is being dissipated through the stean generators and reactor coolant temperature is stable or decreasing, 3.
Verifyinr, that f ecthe iter is being supplied to the stean generaters and an indicatcJ level is being e.aintained in all steam generators not directly affected, and 4.
Operator action shonid be taken to maintain pressuricer water icve'.
and pressure b-charging and emergency makeup control.
8 ror scoe hCCA cases, no operator action will pr2 vent the fornation of voids in t'ie primarv crolant system.
The enr,ineered safety features were desiemed to re cover and cool the core f ollowing various dec rees of..
p ri r!a ry s ys tem *cc i li ni,.
depending cn break siac and location.
In the event of a s tean generator tube l eak, an opera ting instruction indicates that if the leak rate is law encugh, then charring flet will naintair sys ten pressure above saturatica; if not, the systen will start to void.
'lhe operator has been t rained to identify and isolate the f a u l t:. steom p,enerator as quicklv as possibic to prevent or mininite voidin?
The procedure f o r isa !a t i:1g the f aulty steam generator is also included in the operating instruction.
Action 2c.
Operator actien to enhance core cooling in the event such voids are formed (e.g.,
remote venting).
8 Response to question 2e P] ant procedures describe the necessary operator actions to encure core cooling i f the preary sys ten is voided.
These procedures require operator verification of ECCS compencut per t urmance and provide f or hot J en "iiilS injection inr enhanced core ecoline, at a latcr time in the cooldown process.
l'i m t instructions will centain require.ent.s lor crera tion o f the reac to r coolant pumps under abnermal conditienc to cubance core coolinn Currently, there are no provisions for remote venting of the reactor vessel head. TVA will proceed with the design and installation of this capability for Sequoyah.
A design effort has been initiated and as soon as design details are available, they will be submitted for NRC review.
s.
3 Action 3.
For your f acilities that use pressuriner water level coincident with pressurizer pressure for autematic initiation of safety injection into the reactor coolant system, trip the icw pressuriner level setpoint bistables such that, when the pressurizer pressure reaches the icw set-point, safety injection would be initiated regardless of the pressurizer level.
In addition, instruct operators to manually initiate safety injection when the pressurizer pressure indication reaches the actuation setpoint whether or not the level indication has dropped to the actuation setpoint.
Respense to question 3 in the interim, the low pressurizer level setpoint bistables will be tripped to permit safety injection on low pressurizer pressure.
Each low level bistable vill be removed from the tripped mode only to perait surveillance testing of the coincident icw pressurizer pressure bistable.
TVA is initiating a design change to the protective logic that will cause initiation of safety inj ection on 2 out of 3 low pressurizer pressure signals regardless of pressurizer level.
This change will be made before fuel loading.
8 TVA will revise all applicable instructions to require manual initiation of safety injection when two of the three pressuricer pressure signals reach the actuation setpoint.
8 m
J g
Action 4.
Review the containment isolatica initiation design and procedures, and prepare and implement all ch.. aces necessarv to permit ce n ta inme:. t isolation whether manual or automatic of all lines whose isolation does not degrade needed safet, features or cooling capability, upon automatic initiation of safety injection.
Response to question i The containnent isolatica systems functica to isolate all non-saf ety-related fluid systens penetratinc the containnent upon receipt of a phase A or phase B containment isolation signal.
Phase A isolates all process.ines except safety injection, containment spray, portions of component coolint, and essential raw coolins water.
Phase A isolatien can be initiated manually anc is initiated by autenatic or manual safety injection actuation.
Phase 3 isolates all remaining process lines except safety injection, containment spray, and auxiliare feecwater.
Phase 3 is initiated by 2 out of a llI 11I containment pressure signal or by manual actuation of containment s p ray.
In addition.
isolatica valves in the primary containment ventilation system receive a containment ventilation isolation signal.
This signal provides for 8'
automatic isclaticn on high radiation and saf ety injection.
See table 1 for a description of contain:.ent isolation signals.
Containment isolation does not automatically reset by elimination or resetting of the actuation signal.
For example, resetting safet:.
injection will not clear containment isolation; the isolation signal can only be cleared by manual actions on the main control board.
Control features are provided for the containment isolation valves such that:
1.
The valves will remain in the closed position if the containment isclation signal is reset.
2.
The containment isolation signals override all other automatic control signals.
8 3.
Each valve can be cpened or closed manually af ter the containment isolation signals are reset.
1 1
i
.ww e
e m eehe
- + " = > - +
e-w-
TABLE 1 Safety Injection System (SIS) Initiation
]
Sbnually - 1 of 2 hand switches or Automatically - on 2 out of 3 high containment pressure or,
- 2 out of 3 logic on any of 4 sets of differential pressure between steam lines or,
- Idw pressurizer pressure on any of 3 channels (low level bistables tripped)
- coincident high s team line flow with low s team line pressure or low low average RCS temperature.
Each loop has two high flow meters.
One pressure and temperature instru=ent are provided per loop. At least two of the four loops must reach the instrument setpoints to initiate the SIS.
Phase A Initiation Manually - 1 of 2 hand switches or, Manually - SIS switch or, Automatically - SIS auto initiaticn Phase S Initiation Manually - 2 of a hand switches or, Automatically - 2 of 4 high-high containment pressure Containment Ventilation Isolation Initiation Manually - Phase A manual initiate or,
- Phase B manual initiate or,
- SIS manual initiate or, Automatically - SIS auto initiate or,
- high radiation lower ccmpartment/l sensor (train A only) or,
- high radiation upper compartment /l sensar (train B only) or,
- high purge exhaust radiation /l of 2 sensors 8
e Actica 5.
For f acilities f or which the auxiliary f eedwater system is not automatically initiated, prepare and implement immediately procedures shich require the stationing of an individual (with no other assigned concurrent duties and in direct and continuous communication with the control room) to promptly initiate adequate auxiliary'feedwater to the steam generator (s) for those transients or accidents the consequences of which can be limited by such action.
Respcase to cuestion 5 Aur.iliary feedwater sys tem is autematically initiated on saf ety injection, loss of both turbine-driven feed pumps, loss of a single nain feed pump coincident with reactor power above 500, 2 out of 3 low-low steam generator level on any s team generator, or station blackout.
This system utilices two electric motor-driven puT.ps and one turbine-driven pump.
Each =ctor-driven pump has a capacity of 440 gallcas per minute which is sufficient for safe cooldown.
The pumps are connected to separate cecrgency pcwer buses.
The turbine-driven pump has a capacity 8
of 8SO gallens per r.inute; steam supply to the turbine is taken frc two of four main steam lines at a point upstream of the main steam isolatica valves.
4
.9 Acticu 6.
Fcr your facilities, prepare and implement immediately procedures which:
a.
Identify these plant indications (such as valve discharge piping temperature, valve position indication, or valve discharge relief tank temperature or pressure indication) which plant operators may utilize te determine that pressurizer power-operated relief valve (s) are open.
Response to cuestien 6a Plant indications for detecting an open pressurizer relief valve are:
(a) control room valve position indication is directly determined from s tem counted switches, (b) inline temperature element downstream of the relief valves with ccatrol room temperature indication and hir,h temperature alarm, (c) pressuriner relief tank (PRI) temperature indication ani high temperature alarm in the control room, (d) PRT pressure indicati2n and high pressure alarm in the control room, (c) PRT level indication and high level alarm in the control room, and (f) pressurizer pressure 8
indication and low pressuriser pressure alarm in the control room.
Action 6o.
Direct the plant operators to manually close the power-operated relief block valve (s) when reactor coolant system pressure is reduced below the setpoint for normal automatic closure of the power-cperated relief valve (s) and the valve (s) remain stuck open.
Resconse to questica 6b A plant Abnormal Operating Instruction is currently available which instructs plant operators to utilize the plant indicators described in 6a above to detect an open pressuricer relief valve.
The operator is further instructed to isolate the open valve (s) if they fail to automati-cally reclose at the proper system pressure.
8 l
10 Action 7.
Review the action directed by the operating procedures and training instructions to ensure that:
a.
Operators do not override automatic actions of engineered safety features, unicas continued operation of engineered safety features wi11 result in unsafe plant conditions.
For example, if continued operation of engineered safety features would threaten reactor vessel integrity, then the HPI should be secured (as noted in b(2) below).
Response to cuestion 7a The operating procedures and training instructions are being reviewed to ensure that operators are instructed not to override automatic operations of the enginecred safety features. unless continued operation of the engineered safety system will result in unsafe plant conditions, or until the plant is clearly in a stable, controlled state, and engineered safeguards are no longer required. This review will be ccmpleted before the fuel loadin3 of unit 1.
Action 7b.
Operating procedures currently, or are revised to, specify that if the high-pressure injection (HPI) system has been automatically actuated because of Icw-pressure conditions, it must remain in operation until either:
(1)
Both lcw-pressure injection (LPI) pumps are in operation and flowing for 20 minutes or longer at a rate which would ensure stable plant behavior, or (2)
The HPI system has been in operation for 20 minutes, and all hot and cold leg temperatures are at least 50 degrees below the saturation temperature for the existing RCS pressure.
If 50 degrees subcooling cannot be maintained after HPI cutoff, the HPI shall be reactivated.
The 8
degree of subccoling beyond 50 degrees Fahrenheit and the length of time HPI is in operatica shall be limited by the pressure / temperature consideration for the vessel integrity.
Response to question 7b The cammitment expressed in the response to question 7a guarantees adequate run time for both low-pressure and high-pressure injection pumps.
llowever, applicable operating instructicns, abnormal operating instructions, and emergency operating instructions will be revised to require operation of high-pressure injection pumps for 20 minutes fo11 ewing automatic actuation unless all of the following conditions are met:
(a) reactor coolant system pressure above safety injection setpoint, (b) reactor coolant pressure stable or increasing, (c) at least one steam generator available for primarv system cooling, and (d) pressurizer level above the point at vnich pressuriner heater can be utilined.
These conditions will ensure that the plant is in a con-trolled state with an excess of 500F subcooling based en Tave.
If the above
11 condit*ians dre met, 1:PI can be shutof f and subecolin;; will be moni tored by J
calculating the s.1Lurati on te:"nerature cor respond ing to the measured pressurizer pressure.
This saturation tc~; erature.eill be compared to the hot leg temperatures.
If 50 degrees sontaaling, cannot be maintained after llPI shutoff, then lil'I will be reactivated. The degree of subcooling beyond 50 degrecs Fahrenheit and the length of time ilPI is in operation shall be limited by tne pressure / temperature censidctations foc vessel integrity.
4 e
l
~~~=- *
- m
-w' ' ' ---
._y, m
12 Action 7c.
Operating procedures currently, er are revised to, specify that in the event of IIPI initiatten with reactor coolant pumps (RCP) cperating, at least one RCP shall remain operating for two loop plants and at least two RCP's shall remain operating for 3 or 4 loop plants as long as the pump (s) are providing forced ficw.
Response to cuesticn 7c The Sequoyah ::SSS vendor, Westinghouse, has not fully ev-luated the above NRC recomacndaticn, and Westinghouse continues to recorrend that all reactor coolant pumps (RCP's) be tripped follcwing stean break and loss of coolant accidents.
Since TVA has no technical basis for disputing the Westinghcuse recemmendatica, Sequoyah operating ins.truc-tions will specify the conditiens under which the pumps shculd be tripped based en Westinghouse ;uidelines.
If Westinghouse's full evaluation of NRC's recommendatien shows the acceptability of maintaining at least two reactor coolant pumps in operatica following high pressure injection, Sequoyah operating procedures 4
will be revised to require cperation of at least two RCP's p rovided pressurizer level indicatica is above zero, specific centrol rcem instrumentatica (notor amps, loop ficw, Icop temperature, and lecp pressure) clearly indicate that the RCP's are providing stable forced flew, and a Phase 3 contain=ent isolation signal is not present.
As discussed in the respense to questica 4, Phase 3 isolatien will isolate the cc=penent cooling systes biccking coolant flow to the reactor coolant pucps.
4
13 Actibu 7d.
Operatcrs are provided additienal infermation and instructions to not rely upon pressuri cr level indicatien alone, but to also exar.ine pressurizer pressure and other plan; parameter l
indicaticas in evaluating plant conditions, e.g.,
- water, inventory in the reactor primary system.
Response to cuestien 7s TVA's training progran emphasizes the interpretation of all available informatica in order that the cperator can diagnose the basic cause of any malfunctica or abnormal occurrence.
The plant abnormal and crergency instructions list specific confirmatory indications cnd expected systen parameter changes asscciated with equipment malfunctions or postulated accidents. The prescribed operator respense to the abnormal situatiens also lists the cenfirmatory indications to verify appropriate corrective actica is being taken.
In addition to pressurizer level, there are other types of instrurentation that will provide the operator with indirect indicaticns of primarv system coolant inventory changes and could inform the cperator of the need to take corrective action.
Examples are listed belcu.
Prirary systen pressure Pricary system tecperature Containtent pressure and temperature Containrent radiaticn levels Felief valve tailpipe temperature Pressuri cr relief tank level, tc=perature, and pressure Reacter coolant pump notor amps Containment ccisture alarms Containment sump level indications and alarms Ice c:ndenser deers opening alarm Ice bed temperature alarms Charging flow 4
14 Action 8.
Review all safety-related valve positions, positioning requirenents, and positive controls to ensure that valves remain positioned (open or closed) in a manner to ensure the proper operation of engineered safety features. Alsesreview related procedures, such as those for maintenance, testing, plant and system startup, and supervisory periodic (e.g., daily / shift checks) surveillance to ensure that such valves are returned to their correct positions following necessary manipulations and are maintained in their proper positions during all operational modes.
Response to question S Positioning requirements for saf ety-related valves will be reviewed for
~
correctncss and completeness for all operational modes to ensure the proper operation of engineered safety features.
Addi tionally, system operating instructions, maintenance instructions, Lest instructions, and surveillance instructions will be reviewed to ensure proper position.nq of these valves.
This review and any necessary modifications will be completed 4
before the fuel loading unit 1.
Current plant administrative procedures require that (a) all essential safety system and ccmponent alignment is verified prior to unit startup, (b) changes in the alignment of any safety system component is recorded on a system status sheet, and (c) shift personnel being relieved ccmmunicate information on any abnormal plant condition including temporary conditions.
Plant operating instructions require completion of a prestartup checklist prior to unit startup.
This checklist is used to verify cotrect alignment of all safety systems. Alignment of critical systems is reviewed on a weekly basis. Anytime a critical component is changed from its normal position or condition, a system status sheet is ccmpleted and placed in a system status folder.
In addition, panel checklists are revicued weekly to verify that proper panel alignment exists for all safety systems.
Return of a system or component to its normal mode or status following 8
maintenance or testing is addressed in the response to action 10.
l l
l
~ _ _ _ _
i5 Action 9.
Review your operating modes and procedures for all systems designed to transfer potentially radioactive gases and liquids out of the primary containment to ensure that undesired pumping, venting, or other release of radioactive liquids and gases will not occur inadvertently.
In particular, ensure that such an occurrence would not be caused by the resetting of engineered safety features instrumentation.
List all such systems and indicate:
a.
Whether interlocks exist to prevent transfer when high radiation indication exists, and b.
Whether such syste=s are isolated by the containment isolation signal.
c.
The basis on which continued operability of the above features is ensured.
Response to cuestion 9 We have reviewed the operating modes and procedeces for all systems designrd to transf er petentially radioactive liquids and gases f rom the primary contain-ment.
Those systems er ccmponents include the reactor building purge ventilatine system, waste disposal system, the containment building floor and equipment drain sump pumps, and the reactor coolant drain tank pumps and vent line.
The function of the containment floor and equipment drain sump is to collect and measure nuclear systc= icakage from both identified and unidentified sources.
Two : ump pumps operate automatically to maintain the sump level within a desired range; the pumped fluid is transferred to the waste disposal system.
The reactor coolant drain tank collects reusable reactor coolant water f rca inside the contain=cnt (excess letdcwn flow, leakoff flow, pressuricer relief tank drains, etc.).
Two pumps are available to transfer the fluid through isolation valves to the chemical and volume control system holdup tanks.
The isolation valves en the discharge lines f rc= the floor and equirnent drain e
W sump and the reactor coolant drain tank (RCDT) auto-close on initiation of safety injection or phase A isolation.
In addition, the vent line from the ECDT to the waste disposal system vent header is equipped with two in scries centainment isolation valves that auto-close on safety injection or phase A isolation.
All of ti.e above valves will remain closed following reset of saf ety injectica or pnase A isoj ation.
Manual operator action is required to open each valve.
In addition, these valves are designed to fail closed.
There are currently no hi;n radiation signal (s) to close any of these valves.
1 is The lines in the waste di,pesal system isolate automatically upon actua tion o f the SIS.
Ib,etting the SIS initiation does not permit any containment isolati.cn valve to reopen.
The operator must reopen i nd ivi-dually the two isolation zalves in each line after resetting the 51S signal before any fluid can be transferred out of containment.
The reactor building pLrge system is desip,ned to supply fresh air for breathing and contamination control to allew personnel access for main tenance and re f uel : a.; opera tions.
Each purge system containment penetration is pravidcd eith both inboard and outboard motor-operated isolation butterfis valves.
Containment ventilation isolation signal automatically shuts down the purge air supply fans and closes their discharge dampers
.nd butterfly valves.
Containment ventilation isola-tion is generated by high radiation in the pur.;e exhaust line, high radiation in the upper and icwer containment (r,aseous and particulate rcdiation monitorq), saf ety injection, and mmual Phase A or P'iase B isolation.
Isclation talves will remain closed following reset of containment ventitatica isolation.
Manual eperator actica is required to open each valve.
In addition, these butterfly valves are designed to fail cicscd.
TVA will proceed with the design and installation of radiation detectors for Sequoyah which will automatically isolate the RCDT and the floor and equipment drain surge when high radiation is detected.
As soon as design details are available, they will be submitted for SRC review.
Operability cf the above features are ensured through surveillance testing of the applicable components as required by plant technical specifications.
8 l
17
=
Action 10.
Review and mcdify, as necessary, your maintenance and test procedures to ensure that they require:
a.
Verification, by test or inspection, of the operability of redundant safety-r' elated systems prior to the removal of any safety-related system from service, b.
Verification of the operability of all safety-related systems testing.
c.
Explicit notification of involved reactor operational personnel whenever a safety-related system is removed from and returned to service.
l Response to cuestion 10 Current plant administrative procedurcs:
(a) require verification of the operability of redundant safety-related equipment before such equipment is removed from service (equipment operability requirements are based on plant technical specification), (b) require that system operability is demonstrated befere a system is returned to service, and (c) require approval by the shift supervisor or his representative prior to the performance of any activity on safety-related plant equipment, or any activity that may affect safety-related plant equipment.
In addition, the shift supervisor or his representative is notified when an activity authoriced to be perforned on safety-relatcd plant equipment is completed or a change occurs in the scope of the activity.
Detailed plant maintenance and test procedures will be reviewed, and any found not meeting the above requirements will be modified before ruel loading of unit 1.
In addition to prewritten maintenance instructions (MI's), maintenance activities are controlled through a maintenance request (MR) system which identifies specific maintenance requirements on cach MR.
Before maintenance
- 8 superintendent is performed, the work requirements of the MR are reviewed by the operations or his representative. Approval to perform maintenance on safety-related equipment is indicated by signature of the shift supervisor en cach MR is required by plant administrative procedurcs. After completion of werk, the shif t supervisor or his representative is notified that the maintenance activity is complete.
Return to nornal instructions and test requirements are specified in a ref erenced MI, surveillance instruction, or on the initiating MR.
13 Normat hydrohen levcis in the primary system are accommodated by the plant chemical volume control system.
i.etlown fle. to the volume contral tank permits primary system hydrogen purging to the waste c,a s system.
The partial pressure of hydrogen in the volume control tank controls the hydrogen concentration in the primary makeup water.
The water is returned to the primary loop through the charging pumps.
Ilydrogen may accumulate 12 the primary containment following a loss-of-coolant accident. This hydrogen is controlled via the containment combustible gas control system; this system is composed of two redundant hydrogen recc=biner units permanently located in the upper containnent compartment.
A redundant hydrogen sampling system qualified to process the post-LOCA atmosphere is used to provide control room indication of containment hydrogen concentration.
Each recomoiner is siced to limit hydrogen concentrations belew 4 percent which is the accepted lower flammability limit for hydrogen.
Adequate mixing of the containment atmosphere is provided by the containment air return fan system.
Post-LOCA hydrogen mixing capability is provided by the air return fan Aystem in the following recions of containment:
containment deme, each of the steam generator enclosures, pressuricer enclosure, upper reactor cavity, each of the accunulater rooms and the instrument room.
This casures optimum recombiner action by preventing the local concentration of
/8 hydrogen.
A remote manual hydrogen purge systen is also provided to limit the flammcble gas conccatration to 4 percent in the absence of recombiner action.
The containment air space is purged to the annulus and replenished ay a dilution air supply.
The air entering the annulus will mix with the annulus air and is processed by the encracacy gas treatment system sefore discharge to the outside environment. This system provides a backup for the recombiner system.
Existing plant precedures for controlling containment hydroaca concentration using the above procedures have been reviewed and found acceptabic.
t
L1 i
Actica 11.
Review your prompt reporting precedures for NRC notification to ensure that NRC is notified within one hour of the tine the reactor is not in a centrolled or unexpected condition of operation.
Further, at that tine an epen continuous ccm:nunication chaunel shall be established and maintained with NRC.
Response to cucstion 11 This requirement will be incorporated into our Sequovah Nuclear Pi'an-
~
Procedures.
i l
8 4
I y
2d Action 12.
Review operating modes and precedures to deal with significant amounts of hydrogen gas that may be generated during a transient or other accident that would either remain inside the primary system or be released to the containment.
Response to cuestien 12 The methods for removing hydrogen f rom the reactor coolant system are:
1.
Hydrogen can be s tripped f rom the reactor coolant to the pressurizer vapor space by pressuri:cr spray operation if a reactor coolant pump is operating in a loop from which pressuri:er spray is provided.
2.
Hydregen in the pressuricer vapor space can be vented by pcwcr-operated relief valves to the pressurizer relief tank.
3.
liydrogen can be removed f rom the reactor coolant system by the 8
letdown line and s tripped in the volume control tank where it enters the waste gas system.
The vaste gas system consists 3
of 9 tanks of 600 ft each at a maximum of 100 psig.
4.
In the event of a LOCA, hydrogen would vent with the stcam to the containment.
If a noncondensable gas bubble becomes situated in the primary coolant system, there are many options for continued core cooling and removing the bubble.
With a gas bubble located in the upper head, several =cthods of core cooling are unaffected.
The steam generators can be used to remove decay heat using reactor coolant pump forced flow or natural circu-lation.
The safety injection system can be used to cool the core while
~
venting throuch the prtssurizer power-operated relief valve.
Core cooling by either of these methods can proceed indefinitely if the f
)
primary coolant pressure is held constant.
If a lower system pressure is desired, a controlled depressurization will allow the bubble to grow slowly until it unc ove rs the top of the hot leg and is expelled through the pressuriner power-operated relief valve.
Existing plant procedures dealing with LOCA situations will be revised to include instructions to the operator for dealing with a noncondensable gas bubble in the primary system based upon the methods described above before fuel loading of unit 1.
1
21 Nornal h'ydrogen levels in the primary system are acconmodated by *he plant chemical volume control system.
Letdown flow to the volume control tank permits primary system hydreren purgine to the waste gas system. The partial pressure of hydrogen in the volume control tank controls the hydrogen concentration in the primary makcur. water.
The water is returned to the primary loop through the changing pumps.
Ilydrogen may accumulate inNthe primary containment following a loas-of-coolant accident. This hydrogen is controlled via the coc.tainment combustible gas control system; this system is composed of tuo reuundant hydrogen recombiner units permanently located in the upper containment conpartment.
A redundant hydrogen sampling system qualified to precer,s the post-LCCA atmosphere is used to provide control room indication of containment hydrogen concentration.
Each recombiner is sized to limit hydrogen concentrations belcw 4 percent which is the accepted icwcr flammability limit for hydregen.
Adequate mixing of the containment atmosphere is provided by the containment air return fan system.
Post-LOCA hydrogen mixing capability is provided by the air return fan system in the following regions of containment:
containment drme, each of,the steam generator enclosures, pressurizer enclosure, upper reactor cavity, cach of the accumulator rooms and the instrument room.
This~ ensures optimum recombiner action by preventing the local concentration at hydrogen. A remote manual hydrogen purge system is also provided te limit the fl'ammable gas concentration to 4 perecct in -he absence of recombiner action.
The containment air space is purged to the annulus and replenished Ly a dilution air supply. The air entering the annulus will mix with the annulus air and is processed by the cm.ergency gas treatment system before discharge to the outside envirjnment.
This system provides a backup for the recembiner system.
Existing plant procedures for controlling ccataiament hydrogen concentration using the above procedures have been reviewed and found acceptabic.
/"N s
4 O
h e-
/
l
.~
^
i Actien 13.
Propose changes, as required, to those technical specifications which must bc modified as a resalt of your implementing the above items, Response to cuestgen 13 A technical specification change has been submitted to reflect tripping
' the pressuricer-?: vel bistables.
Technical specifications will again be revised when tho logic change discussed in the response to ques tion 4 is implemented.
Other changes will be submitted for staff review if upon egmpletion of our desailed evaluation, fu,rther t.cdifications are con-sidered necessary.
t n
-#a-I b
M d
i i
+
f '
s d~
m Mwe a
i ENCLOSURE 2 TVA EVALUATION OF GENERIC ACRS QUESTICNS s
O l
l l
ACRS Statcaacnt It would be prudent to consider expeditiousi/ the provision of instru-mentation that will be providing an unambiguous indication of the level of fluid in the reactor vessel.
Response
To meet the need for better information concerning the level of fluid in the reactor vissel, TVA will provide level measurement instrumentation for the Sequoyah Nuclear Plant. As soon as design details are available, they will be submitted for NRC review.
0
\\
1 v
l
2 AC_RS S t.t t er.c n t Early consideratica should be given also to providing renotely controlled means for venting high points in the reactcr systen, as practical.
Respense fligh points in the SON reactor coolant system (RCS);
i.e.,
locations where gases and/or vapors have the rotential to accumulate, are as folleus:
1.
Uppermost region of reactor vessel.
2.
Uppermost regica (U-bend) of each steam generator (four).
3.
Up pe r:ne s t region of pressurizer.
Of the regions listed above, currently only the uppermost region of the pressurizer 8
auxiliary building, and in the MCR.
has renotely controlled means for venting; the controls are located in the The vent line is routed to the ?RT.
The reactor vessel currently requires local =anual operations for venting throgh u
a small diameter (3/4-inch diameter) line.
It is not possible to directly vent the U-bend region of a steam generator.
TVA will provide remote venting capability for the reactor vessel at Sequoyah.
A careful cesign effort has been initiated and as soon as design details are available, they will be 'ubmitted for NRC review.
...~
e
._.N
ACRS Statement The committee believes that greater understanding of this mode of cooling (natural circulation) is required and that detailed analyscs should be developed by licensees or their suppliers.
The analyses should be supported, as necessary, by experiment.
Response
In order to prevent confusion, the definition of natucal circulation must be established prior to discussing this phenomena.
Natural circulation is a condition in the reactor coolant system (RCS) wherein the RCS fluid is single phase water, no forced circulation of the water exists, but water density differences between the water in the reactor pressure vessel and the 4
steam generators exists such that a driving head across the core results.
This definitica is apparently consistent with the ACKS definition of natural circulation, but may not be consistent with the NRC definition.
The implications of Three Mile Island (TMI) plus the traditional single f ailure licensing philosophy have been considered in our evaluation of natural cir-culation at SQS.
Natural circulation is one of the important modes of decay heat removal during the course of an entire family of loss of coolant accidents (LOCA's) characterized as small break loss of coolant transients.
The other modes are heat removal through the break and by steam condensation. Any break in the reactor coolant pressure boundary larger than 0.375 inch I.D.
(0.008 sq. ft.) and smaller than 9.57 inches I.D.
(0.50 sq. ft.) is categorized as a small break on a Westinghouse pressurized water reactor.
The following discussion on natural circulation following a small break loss of coolant transient is based on the latest analyses performed by Westinghouse in light of TMI.
The base plant considered
(
in these analyses is a four loop RESSAR-3 plant.
The break size in a small break loss of coolant transient is the determining factor as to whether or not the steam generators are relied upon as a heat sink during the initial portion that is,approximately the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of the event.
Westinghouse has shown that for breaks 2 inches I.D.
(0.022 sq.
ft.) and smaller, the steam generators are relied upon as a heat sink during the initial portion of the transient until the break flow is capable of removing decay heat.
(Typically for a 1-inch I.D. line break, it would take approximately 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> before the break flow can remove decay heat.) For breaks larger than 2 inches I.D.,
the steam generators are not relied upon as a heat sink during the initial portion of the transient because the break flow is large enough to remove decay heat very early in the event.
Westinghouse has concluded that natural circulation of fluid through the reactor coolant system will not be interrupted during any of the small breaks they have analyzed. Their bases for this conclusion are as follows:
4 1.
There is not a large enough source of noncondensibles during any of the small breaks analyzed which has the potential to bind up the U-tubes in the steam generators.
2.
The physical characteristics of the U-tube steam generators used in Westinghouse plants prevent them from being susceptible to noncondensible binding; any steam and noncondensibles that enter the steam generator will pass thrcugh an area of the steam generator that is surrounded by a substantial amount of water on the secondary side, causing the steam to condense, and reducing the steam and noncondensible bubble size to the point that it cannot cause binding of the U-tubes in the steam generators.
3.
Even if large amounts of noncondensibics were present in the reactor coolant system, Westinghouse has modeled, calculated, and concluded 8
that any noncondensibles that enter the steam generator U-tubes will be swept out due to the inherent differences between the water and noncondensible velocities. Subsequently, buildup of noncondensibles in the high points of the reactor coolant system will be prevented.
It is TVA's conclusion that natural circulation will not be interrupted in a Westinghouse PWR as a result of the formation and/or introduction of non-condensibles during a small break loss of coolant transient.
This conclusion is based on TVA's current understanding of natural circulation in a Westinghouse PWR.
However, TVA will continue to work with Westinghouse to ensure that both organizations' understanding of natural circulation as a result of small break loss of coolant transients remains valid as the exact nature and implications of IMI evolve.
f 3
\\.
.---.w..
.=-
5
=
ACRS Statement The plant operator should be adequatel'/ informed at all ti,cs concerning the conditions of reactor coolant systen operation which might affect the capability to place the system in the natural circulation. ode of operation or to sustain such a mode.
Of particular importance is that in fo rma t i on which might indicate that the reactor coolant systen is approaching the saturation pressure corresponding to the core exit tenperature.
This impend-ing loss of system overpressure will signal to the operator a possible loss of natural circulation capability.
Such a warning nay be derived fron pressurizer pressure instruments and hot icg temperatures in conjunction with conventional stean tables. A suitabic display of this information should be provided to the plant operator at all times.
Response
a.
Presently, the Sequoyah process computer monitors four hot leg temperatures (HLT's) and four pressurizer pressures (PP's) and obtains an average of each.
The computer programs include steam table conversions. Also, the computer has trend recorders with dual pens.
b.
TVA will add pregram(s) to calculate the saturation temperature correspondim; to the reasured pressurizer pressure (avg.).
We have the to trend the llLT (avg. or any leg) on one pen and the calculated capabilit-j saturation tcmperature on the other pen.
The degrees of subcooling can be observed as the difference between the tuo pens.
An alarn function would be added to indicate when the subcooling AT is abncrmal. The operator could select the points for trend at that time.
(The calculation would be performed every 64 seconds.)
g.,
TVA will also have steam tables and/or saturation curves available to the control room operator at all times.
7
%_,J
6 ACRS Statement The exit temperature of coolant from the core is currently mer.sured by the rmoco uples in many P'.IR's to determine core performance.
The Committee rcccmmends that these temperature measurements, as currently available, be used to guide the operator concerning core status. The range of the infor-nation displayed and recorded should include the full capability of t'..e thernocouples.
It is also recommended that other existing instrumentation be examined for its possible use in assisting operating action during a transient.
Response
a.
Presently, the Sequoyah process computer monitors 65 incore CA (type K) thermocouples. They are now ranged from 0-700 F and calibrated for 8
highest degree of accuracy between 400-7000F (+ 3/8 percent).
They should be within 120F below 400 F.
0 b.
TVA is in the process of changing the software out-of-range index to IS000F.
Accuracy in the upper range will be considerably less than the 0-7000F range (+ 20 f).
The software change will be complete before 0
Sequoyah unit 1 fuel leading.
m
(
b./
i ACRS Statement The use of natural circulation for decay heat removal following a loss of offsite power sources requires the naintenance of a suitable overpressure on the reactor conlant system.
This overpressure may be assured by placing the pressuri:er heaters en a qualified onsite power source with a suitable arrangement of heaters and power distribution to provide redundant capability.
Response
There are four banks of pressurizer heaters:
1 automatic control group at 415KW 3 backup groups at 435, 485, and 415 KW pressuriner low level will trip all four banks of the heaters and prevent them f rom coming back on until level is recovered in the pressurizer.
All four heater banks vill trip en a Safety Injection signal when in the normal mode. After safety injection ruset and level recovery in the pressurizer, The other two 8 '
one backup heater bank would come on automatically.
backup heater banks and the control bank would not cor.e on automatically, but could be ranually activated. All four heater banks can be powered from the on-site emergency diesel generators. The control bank and one backup bank of heaters are supplied from one cicctrical power train and the other two backup banks are supplied from the other power train.
p
(
6 l
ACRS Statencnt Consideration should be given to the desirability of additional equipment status menitoring on varicus engineered safeguards features and their supporting services to help assure their availability at all times.
Response
1.
The status monitoring system automatically presents the operator in the main control roem with a visual display and alarn, indicating the status of any ECCS system which has been deliberately bypassed or deliberately made inoperable.
This system meets the conditions described in Section C of Regulatory Guide 1.47.
The visual display consists of a schematic flow diagram of the bypassed
,8 or inoperable system (s), the status of each component to which Section C of RG 1.47 is applicable is indicated on the face of a cathode ray tube.
In addition, a clock is provided indicating the time remaining before the system must be returned to normal or the unit shut down as required by technical specifications.
The SMS does not currently monitor:
1.
Solenoid valves for which the loss of power causes the valve to go to a safe position 2.
Backpressure valves on the motor-driven pump discharges 3.
Manual maintenance valves 4
Check valves 3.
Auxiliary equipment and support systems t
1%,3 TVA is proceeding to expand the Status Monitoring System capability for the Sequoyah Nuclear Plant. As soon as design details are available, they will be submitted for NRC review.
l
i e
ACMS Statement The ACRS recommends that operating power reactors he given priority with rer,at J to t he de finit ion.ntd inplement atica of Inst runent at ion which provides additional informatien to help diat; nose and follow the course of a serious accide'it.
Thi s should include Inproved sampling proceduren under accident ccnditions and techniques to help provide improved guidance to offsite authorities, should this be necded.
Response
1.
The follouing post accident instrumentation is supplied to enabic the operator to follow transients.
a.
T hot or T cold (measured wide range) b.
Pressurizer water level c.
RCS pressure (wide range) d.
Containment pressure e.
Steam line pressure f.
Steam generator water level (wide range) g.
Steam generator water level (narrow range) h.
RWST water level 1.
Containment water level j.
Pressurizer pressure k.
Containment H monitors Each of the above channels is either recorded or logged.
(
',_,I 2.
Containment Radicactivity Levels a.
Airborne radioactivity levcis in the primary containment during accident conditions can be indirectly obtained with the high range area monitor that is located outside the upper compartment personnel hatch.
This monitor will remain on scale for containment airborne radioactivity concentrations up to about 20 percent of those that could be experienced in a RC 1.4 Joss-vf-coolant accident.
There is no prevision for direct measurement durinr, accident conditions of exposure rates or nuclide radioactivity concentrations in the primary containment.
There are no radiation monitors inside the containment that have sufficient range and atmospheric qualification for the measurement of radiation levels in the containment during accident conditicas cer-responding to RG 1.4 assumptions.
lu
- e Under normal conditions, real time detection of airborne particulate.
iodine, and gross radioactivity concentrations is provided by two thcee-channel =enitors per reactor unit.
For these monitors, samples of containment air are pumped to the detection assemblies which are located in the auxiliary building. After containment isolation, the isolation valves on the sample lines may be manually reopened from the aain control room; however, this action cannot be taken until the containment atmospheric conditions permit it since the monitors are not designed to operate with sacple pressure, temperature, and humidity conditions that would exist during some accidents.
Even after sample pressure, temperature and humidity conditions return to acceptable values, the monitor channels vould be offscale for containment activity levels corresponding to RG 1.4 assumptions.
TVA will install a radiation monitor outside of containment capable of monitoring airborne radiation inside containment corresponding to RG 1.4 assumptions. As soon as design details become available they will be submitted for SRC review.
b.
Containment Air Sample Currently, there is no provision to take containment atmospheric samples for laboratory analysis during harsh containment atmospheric pressure, temperature, and humidity conditions.
During normal conditions, the monitors referenced in part (a) provide the following samples that can be analyzed in the laboratory:
(1) particulate filter, (2) charcoal absorption :artridge, and (3) a gaseous sample.
However, the sampling system for these monitors is not qualified for operation when containment atmospheric conditions correspond to RG 1.4 assumptions.
Furthermore, were such sa:ples collectable with these monitor assemblies during accident conditions, there is not sufficient radiation protection for personnel to remove the samples and analyze them in the laboratory.
IVA will codify portions of the existing gaseous sampling system so that shielded samples of RG 1.4 containment atmosphere can be taken in an accessible area.
As soon as design details are available, they will be submitted for NRC review.
Under accident conditions, the hydrogen content of the containment atmosphere is monitored with two analyzers located in the annulus between the containment and the shield building.
Remote indication is provided in the main control room.
These analyzers are redundant safety grade and are on trained power.
c.
Water Samples During normal operation, reactor coolant samples, cooled with component cooling water, are available in the hot sample room.
During accident conditions, the containment isolation valves on the sample lines can be opened and reactor coolant sa=ples will again be available in the hot sample room. During normal reactor shutdown operations, samples of the reactor coolant water being cooled by the residual heat removal system (RHR) are taken from RHR pipes and routed to the hot sample room.
During accident conditions, these samples, which are available in the hot sample room, would be samples of the surp water under the reactor vessel that is being recirculated.
The radiation protection design for taking these
- e
~
e 1
sample and analyzing them in the laboratory is based on operation with up to 1.0,.
Ia:. led ruel.
The samples could not be taken and analv ed when
~
sample specific activities are even a small fraction of those corresponding to AG t.4 assumptions.
TV.i will make provisions for sampling water from the reactor coolant syste 1
(RCS) and the residual heat removal system (RHR) for activities corresponding j
to RG 1.4 assu=ptions.
The radiation monitor (s) will be placed on the RHR piping to monitor contair. ment sump water activities corresponding to RG 1.4 assumptions.
As soon as design details are available, they will be submitted for :iRC review.
O e
l