ML20077K310
| ML20077K310 | |
| Person / Time | |
|---|---|
| Site: | San Onofre  |
| Issue date: | 12/30/1982 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML20077K287 | List: |
| References | |
| NUDOCS 8301120539 | |
| Download: ML20077K310 (4) | |
Text
_ --
5 I
O
-0 u,
SAFETY EVALUATION rep 0RT SAN ONOFRE NOCLEAR GENERATING STATION UNITS 2 AND 3, DOCKET NOS. 50-361 AND 50-362
' Introduction By application dated December 29, 1982 and letter dated December 29, 1982, the Southern California Edison Company (SCE) on behalf. of itself and the other licensees (San Diego Gas and Electric Company, the City of Anaheim and the City of Riverside) requested revisions to Sections 3/4.3.2 and 3/4.5.2 of the San Onofre Nuclear Generating Station, Units 2 'and 3 Technical Specifications.
The proposed change would delete the requirement for automatic closing of the-ECCS miniflow valves upon receipt of a Recirculation Actuation Signal or Test Signal for both Units 2 and 3.
Our evaluation of this proposal is described below.
Background
On December 17, 1982, while San Onofre Unit 3 was at cold shutdown conditions, with the reactor coolant. system at 180 F and 350 psia, an inadvertent Engineered Safety Feature Actuation System (ESFAS) event occurred. This event included actuation of safety injection and sinultaneous actuation of the recirculation node of emergency core cooling. Plant operating personnel returned all systems to nonnal operation in accordance with procedures and no equipment damage was experienced as a result of this event.
Subsequently, Southern California Edison initiated an investigation of the cause of this event. By letter dated December 28, 1982, the licensee provided a full discription of the event and the conclusions of investigations conducted to date on its cause. Based on a review of the ESFAS design conducted by Combustion Engineering. it has been determined that the disconnection of a single electrical connector would cause simultaneous actuation of all safeguards features including initiation of recirculation actions. Examination of this connector as installed has, however, precluded it as a probable cause of the event since it is firmly held in place by two connector retaining screws. Further, attempts to repeat the event by manipulation of the connector proved unsuccessful.
A thorough examination of the protection system cabinets, associated equipnent and power supplies was conducted by plant personnel in an attempt to identify the cause of the event. Two independent equipment problems were identified which taken together have the potential for having caused the event.
The first was the discovery of an overheated circuit breaker in the vital bus AC power supply to the protection system cabinet. The second was two loose leads on one of the DC power supplies for the ESFAS logic circuits. Since surveillance tests were being conducted at the time of the event, this act.ivity may have caused a nomentary loss of power from the power supply with loose leads.
The simultaneous loss of power from these two independent sources would cause this event.
It may be noted that the sinultaneous failure of redundant and independent power sources exceeds the requirenents of the single fature criterion and is not a design basis for protection systems. However, omca>
~. ~.... - ~... ~.
. ~. ~. - ~ ~...
.. ~ ~. _ - -..
--.-~~~~
~~~~~~~~
Sun B$01120539 B21230
.. ~. - - -..
- - - -...- ~..
.. - ~ ~. - ~ ~ ~
- -...- ~ ~ ~ ~
~ ~. - ~. - -..
goaanocnosooo36g
. emc ronu m oampeacu ono OFFICIAL RECORD COPY uso m i i_ m A
4.
7 2-these investigations confimed, that subsequent to this event, all power supply voltages were within acceptable limits.
Therefore if the loss of power were the cause of the evcnt, it would have had to have occurred momentarily in two independent power sources at the same time. The overheated circuit breaker has been replaced and all leads within the protection systen cabinets have been confirmed to be secure. Since complete functional testing has subsequently confirmed that the ESFAS is fully operable and the conditions causing the event can not be conclusively identified, the simultaneous momentary loss of redundant power sources are judged to be the most probable cause.
The staff met with representatives of Southern California Edison and Corbustion Engineering in Bethesda, Maryland on December 27th and 28th,1982 to discuss the actions which the licensee has taken on this natter and the safety significance of such an event should it recur during subsequent plant operation.
Based on these discussions the staff concluded that appropriate short tern actions had been taken by the licensee to investigate the cause of this event, correct the deficiencies identified with the overheated circuit breaker and loose power supply leads, and surveillance to confirm the operability of the ESFAS.
The licensee has further evaluated the consequences that this event would have if it occurred inadvertently during subsequent plant operation.
Based on this evaluation, the automatic closure of the minimum flow recirculation (mini recirc) valves on actuation of the recirculation mode of energency core cooling is the only action which has imediate safety significance. Under those conditions the recirculation flow path from the discharge of the HPSI punps to the refueling water storage tank is closed.
This would cause deadheading of the multi-stage HPSI pumps and rapid consequential damage due to seizing. Although the LPSI and containment spray pumps are also affected, this is not a concern since these single stage pumps would not be damaged by deadheading.
Evaluation Ry letter dated December 29, 1982 the licensee has proposed modifications to the plant Technical Specifications for Units 2 and 3 which would permit the renoval of the recirculation actuation signal from the nini recirc valves.
This change would preclude the concern for damage to HPSI pumps as a consequence of an inadvertent safety injection simultaneous with initiation of automatic recirculation actions.
This change will be incorporated prior to entry into
!! ode 2 operation. Further, the licensee will identify by January 14, 1983, the design changes associated with the plant protection systen to reduce the probability of the event which occurred on December 17, 1982.
Specifically the licensee will confim that based upon the review of the protection system design, there are no other problens with inadvertent ESFAS combinations.
This should include considerations related to containnent isolation and its impact on reactor coolant pump operability.
In addition, the licensee will provide the implementation schedule for proposed changes and confim that the plant OFFICE )
.a u.n on..
...u.
un.nanunuaan
.""a.
.a u a
.aa"*"
a SURNAMEh
.....o.o...o
. u. u n. o....o...
o.noonoun o
u u.
..o
..a.-
n.n a*
aa*
omy
~ - - -
NRC FORM 3i8 (10-80) NRCM cao OFFIClAL RECORD COPY us = = _us.m
n
. conforms to General Design Criteria 35 of Appendix A to 10 CFR Part 50.
The deletion of the automatic closure of nini recirc valves by the recirculation actuation signal requires that this action will now have to be performed manually by the plant operator following an accident.
The most liniting accident for nanual operator action to close the mini recirc valves would be a large break loss of coolant accident. For this event recirculation from the containnent sump to the borated water storage tank could occur in approximately 18.5 minutes.
Isolation of this flow path is required to prevent the transport of radioactive sump water to the storage tank which is vented to the atmosphere.
Under the most adverse conditions, sump water could arrive at the storage tank in about two minutes following the initiation of the recirculation mode of emergency core cooling. Since recirculation valve closure is about 40 seconds, the total time for operator response is approximately 20 minutes for the worst single failure of the safety systems.
The licensee has proposed that administratively the operator will initiate closure of the mini recirc valves on receipt of the pretrip alarm associated with the initiation of the recirculation node of emergency core cooling.
Under the highest injection flow conditions this alarm will occur six minutes before miniflow isolation must be complete. During subsequent discussions, the licensee indicated that by procedures the operator will be instructed to close the mini recirc valves on receipt of safety injection tank low pressure or low level alarms. Thus under conditions of a large break loss of coolant accident the operator will be given positive indication of this condition and has available the full time interval (20 minutes) from the receipt of information to perform the required action until such time as that action must be completed. Under small and interned 1 ate break conditions, primary systen pressure will not fall to the point at which alarms would be actuated
)
on safety injection tank pressure or level.
In this case, the time in which isolation nust be effected as well as the time between to pretrip alarm and the former are greatly extended.
The inadvertent safety injection and simultanous actuation of the recirculation node of emergency core cooling which occurred at San Onofre Unit 3 is believed to have been the result of two independent failures which occured in redundant power sources of the plant protection system. Although the investigation into this event has revealed that the interruption of signals routed through a single i
electrical connector could cause this event the staff concludes that based on the nethod by which this connector is firmly secured as well as having been i
seismically qualified, it alone does not pose a sufficient threat to safety to warrant immediate renedial action.
The staff concludes that the licensee proposed changes to delete the automatic closure of the mini recirc valves on initiation of the recirculation mode of emergency core cooling greatly increases the availability of the high pressure injection pumps which could otherwise be damaged within a few minutes if operated under no flow conditions.
The staff concludes that the proposed changes are apDropriate to assure the availability of the HPSI pumps for such an event.
OF FICE )
.n.
n
.o
.. a a. ". " *" "
' ""*"" ""*"~"
sunuaue>
--~~~ ~~
omy
" " " ' ' " " " " ' ~
nac ronu as nem Nacu om OFFIClAL RECORD COPY uSm =-33=
f s
, Based upon the surveillance tests which have demonstrated the operability of the ESFAS and the staff's prior review, the' staff concludes that no new facts have been revealed through the recent San Onofre Unit 3 event or its subsequent investigations to suggest that this event has a suf ficient probability of occurrence to be considered simultaneously with a large break loss of coolant accident.
The staff concludes the proposed changes to the plant's administrative procedures as discussed herein are appropriate and consistent with the additional post accident operator actions resulting from this change.
With regard to the proposed Technical Specification changes, the staff has discussed further modifications with the licensee such that response time testing for manual closure of the mini recirc valves would be retained. Based on the licensees concurrence, this aspect is addressed in the revised Technical Specifications. Therefore, we find the proposed changes to the Technical Specification, modified as noted above, acceptable.
Environmental Consideration The NRC staff has determined that these amendments do not authorize a change in effluent types or total amount nor an increase in power level and will not result in any significant environmental impact. Having made this determination, we have further concluded that these amendments involve actions which are insignificant from the standpoint of environmental impact and pursuant to 10 CFR Section 51.5(d)(4), that an environmental inpact statement or negative declaration and environmental inpact appraisal need not be prepared in connection with the issuance of these anendments.
Conclusion Based upon our evaluation of the proposed changes to the San Onofre, Unit 2 and 3 Technical Specifications, we have concluded that:
(1) because these amendnents do not involve a significant increase in the probability or consequences of accidents previously considered, do not create the possiblity of an accident of a type different from any evaluated previously, and do not involve a significant decrease in a safety margin, these anendments do not involve a significant safety hazards consideration; (2) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, and (3) such activities will be conducted in compliance with the Commission's regulations and the issuance of these amendments will not be inimical to the common defense and security or to the health and safety of public.
We, therefore, conclude that the proposed changes are acceptable contingent on receipt of the January 14, 1983 submittal coverning the long term modifications.
Dated:
$[C P u $2 n
~oughV odan
..sssciii...".7..s....
".p @ s".. ".. ". ' ". "... ". ".. ". ".. ".. '
su== >
12/ 7.g.82.........12&Lu.....
om>
m eronu m o>aamacuom OFFICIAL RECORD COPY usam --mmo
_ _ _ _ _